From 698c0e0288625fdb733b0649466d7aaf487b2a23 Mon Sep 17 00:00:00 2001 From: Pavel Heraska Date: Mon, 17 Apr 2017 09:42:52 +0300 Subject: [PATCH] Pavel Heraska report 13 --- database.png | Bin 0 -> 213159 bytes environments/prod/manifests/site.pp | 4 + environments/prod/modules/mysql/CHANGELOG.md | 770 ++++ .../prod/modules/mysql/CONTRIBUTING.md | 218 + environments/prod/modules/mysql/Gemfile | 52 + environments/prod/modules/mysql/LICENSE | 202 + environments/prod/modules/mysql/NOTICE | 18 + environments/prod/modules/mysql/README.md | 1050 +++++ environments/prod/modules/mysql/Rakefile | 38 + environments/prod/modules/mysql/TODO | 8 + .../prod/modules/mysql/checksums.json | 115 + .../prod/modules/mysql/examples/backup.pp | 9 + .../prod/modules/mysql/examples/bindings.pp | 3 + .../prod/modules/mysql/examples/java.pp | 1 + .../modules/mysql/examples/mysql_database.pp | 17 + .../prod/modules/mysql/examples/mysql_db.pp | 17 + .../modules/mysql/examples/mysql_grant.pp | 5 + .../modules/mysql/examples/mysql_plugin.pp | 23 + .../prod/modules/mysql/examples/mysql_user.pp | 32 + .../prod/modules/mysql/examples/perl.pp | 1 + .../prod/modules/mysql/examples/python.pp | 1 + .../prod/modules/mysql/examples/ruby.pp | 1 + .../prod/modules/mysql/examples/server.pp | 3 + .../mysql/examples/server/account_security.pp | 4 + .../modules/mysql/examples/server/config.pp | 3 + .../mysql/lib/facter/mysql_server_id.rb | 9 + .../modules/mysql/lib/facter/mysql_version.rb | 8 + .../mysql/lib/facter/mysqld_version.rb | 5 + .../parser/functions/mysql_deepmerge.rb | 58 + .../puppet/parser/functions/mysql_dirname.rb | 15 + .../puppet/parser/functions/mysql_password.rb | 17 + .../parser/functions/mysql_strip_hash.rb | 21 + .../mysql/lib/puppet/provider/mysql.rb | 115 + .../puppet/provider/mysql_database/mysql.rb | 68 + .../puppet/provider/mysql_datadir/mysql.rb | 78 + .../lib/puppet/provider/mysql_grant/mysql.rb | 176 + .../lib/puppet/provider/mysql_plugin/mysql.rb | 53 + .../lib/puppet/provider/mysql_user/mysql.rb | 197 + .../mysql/lib/puppet/type/mysql_database.rb | 25 + .../mysql/lib/puppet/type/mysql_datadir.rb | 35 + .../mysql/lib/puppet/type/mysql_grant.rb | 103 + .../mysql/lib/puppet/type/mysql_plugin.rb | 17 + .../mysql/lib/puppet/type/mysql_user.rb | 105 + .../mysql/manifests/backup/mysqlbackup.pp | 106 + .../mysql/manifests/backup/mysqldump.pp | 73 + .../mysql/manifests/backup/xtrabackup.pp | 67 + .../prod/modules/mysql/manifests/bindings.pp | 57 + .../mysql/manifests/bindings/client_dev.pp | 15 + .../mysql/manifests/bindings/daemon_dev.pp | 15 + .../modules/mysql/manifests/bindings/java.pp | 11 + .../modules/mysql/manifests/bindings/perl.pp | 11 + .../modules/mysql/manifests/bindings/php.pp | 11 + .../mysql/manifests/bindings/python.pp | 11 + .../modules/mysql/manifests/bindings/ruby.pp | 11 + .../prod/modules/mysql/manifests/client.pp | 29 + .../modules/mysql/manifests/client/install.pp | 14 + .../prod/modules/mysql/manifests/db.pp | 72 + .../prod/modules/mysql/manifests/params.pp | 450 ++ .../prod/modules/mysql/manifests/server.pp | 89 + .../manifests/server/account_security.pp | 39 + .../modules/mysql/manifests/server/backup.pp | 55 + .../mysql/manifests/server/binarylog.pp | 22 + .../modules/mysql/manifests/server/config.pp | 56 + .../modules/mysql/manifests/server/install.pp | 13 + .../mysql/manifests/server/installdb.pp | 46 + .../modules/mysql/manifests/server/monitor.pp | 24 + .../mysql/manifests/server/mysqltuner.pp | 52 + .../mysql/manifests/server/providers.pp | 8 + .../mysql/manifests/server/root_password.pp | 46 + .../modules/mysql/manifests/server/service.pp | 58 + environments/prod/modules/mysql/metadata.json | 80 + .../spec/acceptance/mysql_backup_spec.rb | 205 + .../mysql/spec/acceptance/mysql_db_spec.rb | 65 + .../mysql/spec/acceptance/mysql_helper.rb | 8 + .../spec/acceptance/mysql_server_spec.rb | 107 + .../spec/acceptance/nodesets/centos-7-x64.yml | 10 + .../spec/acceptance/nodesets/debian-8-x64.yml | 10 + .../spec/acceptance/nodesets/default.yml | 10 + .../acceptance/nodesets/docker/centos-7.yml | 12 + .../acceptance/nodesets/docker/debian-8.yml | 11 + .../nodesets/docker/ubuntu-14.04.yml | 12 + .../acceptance/types/mysql_database_spec.rb | 64 + .../spec/acceptance/types/mysql_grant_spec.rb | 578 +++ .../acceptance/types/mysql_plugin_spec.rb | 76 + .../spec/acceptance/types/mysql_user_spec.rb | 146 + .../spec/classes/graceful_failures_spec.rb | 19 + .../mysql/spec/classes/mycnf_template_spec.rb | 86 + .../mysql/spec/classes/mysql_bindings_spec.rb | 32 + .../mysql/spec/classes/mysql_client_spec.rb | 38 + .../mysql_server_account_security_spec.rb | 86 + .../spec/classes/mysql_server_backup_spec.rb | 407 ++ .../spec/classes/mysql_server_monitor_spec.rb | 38 + .../classes/mysql_server_mysqltuner_spec.rb | 46 + .../mysql/spec/classes/mysql_server_spec.rb | 220 + .../mysql/spec/defines/mysql_db_spec.rb | 83 + .../prod/modules/mysql/spec/spec.opts | 6 + .../prod/modules/mysql/spec/spec_helper.rb | 8 + .../mysql/spec/spec_helper_acceptance.rb | 66 + .../modules/mysql/spec/spec_helper_local.rb | 3 + .../spec/unit/facter/mysql_server_id_spec.rb | 27 + .../spec/unit/facter/mysql_version_spec.rb | 20 + .../spec/unit/facter/mysqld_version_spec.rb | 20 + .../puppet/functions/mysql_deepmerge_spec.rb | 91 + .../puppet/functions/mysql_password_spec.rb | 37 + .../provider/mysql_database/mysql_spec.rb | 118 + .../provider/mysql_plugin/mysql_spec.rb | 71 + .../puppet/provider/mysql_user/mysql_spec.rb | 345 ++ .../unit/puppet/type/mysql_database_spec.rb | 29 + .../spec/unit/puppet/type/mysql_grant_spec.rb | 74 + .../unit/puppet/type/mysql_plugin_spec.rb | 24 + .../spec/unit/puppet/type/mysql_user_spec.rb | 136 + .../prod/modules/mysql/templates/meb.cnf.erb | 18 + .../prod/modules/mysql/templates/my.cnf.erb | 24 + .../modules/mysql/templates/my.cnf.pass.erb | 11 + .../mysql/templates/mysqlbackup.sh.erb | 104 + .../modules/mysql/templates/xtrabackup.sh.erb | 21 + .../prod/modules/staging/CHANGELOG.md | 30 + .../prod/modules/staging/CONTRIBUTING.md | 97 + environments/prod/modules/staging/Gemfile | 68 + environments/prod/modules/staging/LICENSE | 11 + environments/prod/modules/staging/README.md | 79 + environments/prod/modules/staging/Rakefile | 33 + .../prod/modules/staging/checksums.json | 60 + .../prod/modules/staging/docs/deploy.html | 113 + .../prod/modules/staging/docs/extract.html | 176 + .../prod/modules/staging/docs/file.html | 178 + .../prod/modules/staging/docs/init.html | 87 + .../prod/modules/staging/examples/deploy.pp | 4 + .../prod/modules/staging/examples/extract.pp | 25 + .../prod/modules/staging/examples/file.pp | 17 + .../prod/modules/staging/examples/init.pp | 1 + .../staging/examples/scope_defaults.pp | 7 + .../modules/staging/examples/staging_parse.pp | 12 + .../prod/modules/staging/files/sample | 1 + .../prod/modules/staging/files/sample.tar.bz2 | Bin 0 -> 27984 bytes .../prod/modules/staging/files/sample.tar.gz | Bin 0 -> 33352 bytes .../staging/lib/facter/staging_http_get.rb | 27 + .../staging/lib/facter/staging_windir.rb | 11 + .../puppet/parser/functions/scope_defaults.rb | 18 + .../puppet/parser/functions/staging_parse.rb | 39 + .../prod/modules/staging/manifests/deploy.pp | 59 + .../prod/modules/staging/manifests/extract.pp | 126 + .../prod/modules/staging/manifests/file.pp | 166 + .../prod/modules/staging/manifests/init.pp | 34 + .../prod/modules/staging/manifests/params.pp | 40 + .../prod/modules/staging/metadata.json | 115 + .../acceptance/nodesets/centos-511-x64.yml | 15 + .../acceptance/nodesets/centos-66-x64-pe.yml | 17 + .../acceptance/nodesets/centos-66-x64.yml | 15 + .../acceptance/nodesets/centos-72-x64.yml | 15 + .../acceptance/nodesets/debian-78-x64.yml | 15 + .../acceptance/nodesets/debian-82-x64.yml | 15 + .../acceptance/nodesets/docker/centos-5.yml | 19 + .../acceptance/nodesets/docker/centos-6.yml | 20 + .../acceptance/nodesets/docker/centos-7.yml | 18 + .../acceptance/nodesets/docker/debian-7.yml | 19 + .../acceptance/nodesets/docker/debian-8.yml | 20 + .../nodesets/docker/ubuntu-12.04.yml | 19 + .../nodesets/docker/ubuntu-14.04.yml | 21 + .../nodesets/docker/ubuntu-16.04.yml | 19 + .../acceptance/nodesets/fedora-24-x64.yml | 15 + .../acceptance/nodesets/fedora-25-x64.yml | 18 + .../nodesets/ubuntu-server-1204-x64.yml | 15 + .../nodesets/ubuntu-server-1404-x64.yml | 15 + .../nodesets/ubuntu-server-1604-x64.yml | 15 + .../staging/spec/classes/coverage_spec.rb | 4 + .../modules/staging/spec/default_facts.yml | 14 + .../spec/defines/staging_deploy_spec.rb | 104 + .../spec/defines/staging_extract_spec.rb | 175 + .../staging/spec/defines/staging_file_spec.rb | 219 + .../modules/staging/spec/fixtures/hiera.yaml | 9 + .../prod/modules/staging/spec/spec.opts | 6 + .../prod/modules/staging/spec/spec_helper.rb | 32 + .../parser/functions/scope_defaults_spec.rb | 45 + .../parser/functions/staging_parse_spec.rb | 51 + environments/prod/modules/stdlib/CHANGELOG.md | 775 ++++ .../prod/modules/stdlib/CONTRIBUTING.md | 217 + environments/prod/modules/stdlib/Gemfile | 86 + environments/prod/modules/stdlib/LICENSE | 202 + .../prod/modules/stdlib/MAINTAINERS.md | 6 + environments/prod/modules/stdlib/NOTICE | 23 + .../prod/modules/stdlib/README.markdown | 1791 +++++++ .../modules/stdlib/README_DEVELOPER.markdown | 35 + .../prod/modules/stdlib/README_SPECS.markdown | 7 + .../modules/stdlib/RELEASE_PROCESS.markdown | 24 + environments/prod/modules/stdlib/Rakefile | 37 + environments/prod/modules/stdlib/appveyor.yml | 40 + .../prod/modules/stdlib/checksums.json | 508 ++ .../prod/modules/stdlib/examples/file_line.pp | 9 + .../stdlib/examples/has_interface_with.pp | 9 + .../modules/stdlib/examples/has_ip_address.pp | 3 + .../modules/stdlib/examples/has_ip_network.pp | 3 + .../prod/modules/stdlib/examples/init.pp | 1 + .../modules/stdlib/lib/facter/facter_dot_d.rb | 202 + .../stdlib/lib/facter/package_provider.rb | 21 + .../modules/stdlib/lib/facter/pe_version.rb | 58 + .../stdlib/lib/facter/puppet_settings.rb | 43 + .../modules/stdlib/lib/facter/root_home.rb | 45 + .../stdlib/lib/facter/service_provider.rb | 17 + .../stdlib/lib/facter/util/puppet_settings.rb | 21 + .../lib/puppet/functions/deprecation.rb | 29 + .../stdlib/lib/puppet/functions/is_a.rb | 32 + .../lib/puppet/functions/is_absolute_path.rb | 15 + .../stdlib/lib/puppet/functions/is_array.rb | 15 + .../stdlib/lib/puppet/functions/is_bool.rb | 15 + .../stdlib/lib/puppet/functions/is_float.rb | 15 + .../lib/puppet/functions/is_ip_address.rb | 15 + .../lib/puppet/functions/is_ipv4_address.rb | 15 + .../lib/puppet/functions/is_ipv6_address.rb | 15 + .../stdlib/lib/puppet/functions/is_numeric.rb | 15 + .../stdlib/lib/puppet/functions/is_string.rb | 15 + .../stdlib/lib/puppet/functions/length.rb | 14 + .../stdlib/lib/puppet/functions/type_of.rb | 19 + .../functions/validate_absolute_path.rb | 15 + .../lib/puppet/functions/validate_array.rb | 15 + .../lib/puppet/functions/validate_bool.rb | 15 + .../lib/puppet/functions/validate_hash.rb | 15 + .../lib/puppet/functions/validate_integer.rb | 15 + .../puppet/functions/validate_ip_address.rb | 15 + .../puppet/functions/validate_ipv4_address.rb | 15 + .../puppet/functions/validate_ipv6_address.rb | 15 + .../lib/puppet/functions/validate_legacy.rb | 62 + .../lib/puppet/functions/validate_numeric.rb | 15 + .../lib/puppet/functions/validate_re.rb | 15 + .../lib/puppet/functions/validate_slength.rb | 15 + .../lib/puppet/functions/validate_string.rb | 15 + .../stdlib/lib/puppet/parser/functions/abs.rb | 34 + .../lib/puppet/parser/functions/any2array.rb | 33 + .../lib/puppet/parser/functions/any2bool.rb | 54 + .../puppet/parser/functions/assert_private.rb | 28 + .../lib/puppet/parser/functions/base64.rb | 71 + .../lib/puppet/parser/functions/basename.rb | 34 + .../lib/puppet/parser/functions/bool2num.rb | 25 + .../lib/puppet/parser/functions/bool2str.rb | 44 + .../lib/puppet/parser/functions/camelcase.rb | 32 + .../lib/puppet/parser/functions/capitalize.rb | 30 + .../lib/puppet/parser/functions/ceiling.rb | 22 + .../lib/puppet/parser/functions/chomp.rb | 32 + .../lib/puppet/parser/functions/chop.rb | 34 + .../lib/puppet/parser/functions/clamp.rb | 29 + .../lib/puppet/parser/functions/concat.rb | 40 + .../puppet/parser/functions/convert_base.rb | 35 + .../lib/puppet/parser/functions/count.rb | 21 + .../lib/puppet/parser/functions/deep_merge.rb | 44 + .../parser/functions/defined_with_params.rb | 38 + .../lib/puppet/parser/functions/delete.rb | 43 + .../lib/puppet/parser/functions/delete_at.rb | 46 + .../puppet/parser/functions/delete_regex.rb | 44 + .../parser/functions/delete_undef_values.rb | 31 + .../puppet/parser/functions/delete_values.rb | 23 + .../puppet/parser/functions/deprecation.rb | 16 + .../lib/puppet/parser/functions/difference.rb | 35 + .../stdlib/lib/puppet/parser/functions/dig.rb | 16 + .../lib/puppet/parser/functions/dig44.rb | 70 + .../lib/puppet/parser/functions/dirname.rb | 21 + .../lib/puppet/parser/functions/dos2unix.rb | 15 + .../lib/puppet/parser/functions/downcase.rb | 31 + .../lib/puppet/parser/functions/empty.rb | 29 + .../puppet/parser/functions/enclose_ipv6.rb | 42 + .../parser/functions/ensure_packages.rb | 47 + .../parser/functions/ensure_resource.rb | 46 + .../parser/functions/ensure_resources.rb | 54 + .../lib/puppet/parser/functions/flatten.rb | 32 + .../lib/puppet/parser/functions/floor.rb | 22 + .../parser/functions/fqdn_rand_string.rb | 34 + .../puppet/parser/functions/fqdn_rotate.rb | 61 + .../lib/puppet/parser/functions/fqdn_uuid.rb | 92 + .../parser/functions/get_module_path.rb | 17 + .../lib/puppet/parser/functions/getparam.rb | 35 + .../lib/puppet/parser/functions/getvar.rb | 35 + .../lib/puppet/parser/functions/grep.rb | 32 + .../parser/functions/has_interface_with.rb | 70 + .../puppet/parser/functions/has_ip_address.rb | 24 + .../puppet/parser/functions/has_ip_network.rb | 24 + .../lib/puppet/parser/functions/has_key.rb | 28 + .../lib/puppet/parser/functions/hash.rb | 39 + .../puppet/parser/functions/intersection.rb | 33 + .../parser/functions/is_absolute_path.rb | 50 + .../lib/puppet/parser/functions/is_array.rb | 21 + .../lib/puppet/parser/functions/is_bool.rb | 21 + .../puppet/parser/functions/is_domain_name.rb | 53 + .../parser/functions/is_email_address.rb | 20 + .../lib/puppet/parser/functions/is_float.rb | 31 + .../parser/functions/is_function_available.rb | 25 + .../lib/puppet/parser/functions/is_hash.rb | 21 + .../lib/puppet/parser/functions/is_integer.rb | 46 + .../puppet/parser/functions/is_ip_address.rb | 33 + .../parser/functions/is_ipv4_address.rb | 29 + .../parser/functions/is_ipv6_address.rb | 29 + .../puppet/parser/functions/is_mac_address.rb | 26 + .../lib/puppet/parser/functions/is_numeric.rb | 74 + .../lib/puppet/parser/functions/is_string.rb | 28 + .../lib/puppet/parser/functions/join.rb | 40 + .../parser/functions/join_keys_to_values.rb | 53 + .../lib/puppet/parser/functions/keys.rb | 25 + .../parser/functions/load_module_metadata.rb | 24 + .../lib/puppet/parser/functions/loadjson.rb | 34 + .../lib/puppet/parser/functions/loadyaml.rb | 34 + .../lib/puppet/parser/functions/lstrip.rb | 30 + .../stdlib/lib/puppet/parser/functions/max.rb | 20 + .../lib/puppet/parser/functions/member.rb | 60 + .../lib/puppet/parser/functions/merge.rb | 34 + .../stdlib/lib/puppet/parser/functions/min.rb | 20 + .../lib/puppet/parser/functions/num2bool.rb | 42 + .../lib/puppet/parser/functions/parsejson.rb | 29 + .../lib/puppet/parser/functions/parseyaml.rb | 33 + .../lib/puppet/parser/functions/pick.rb | 29 + .../puppet/parser/functions/pick_default.rb | 35 + .../lib/puppet/parser/functions/prefix.rb | 51 + .../lib/puppet/parser/functions/private.rb | 17 + .../stdlib/lib/puppet/parser/functions/pry.rb | 30 + .../lib/puppet/parser/functions/pw_hash.rb | 59 + .../lib/puppet/parser/functions/range.rb | 85 + .../puppet/parser/functions/regexpescape.rb | 29 + .../lib/puppet/parser/functions/reject.rb | 31 + .../lib/puppet/parser/functions/reverse.rb | 25 + .../lib/puppet/parser/functions/rstrip.rb | 29 + .../puppet/parser/functions/seeded_rand.rb | 22 + .../puppet/parser/functions/shell_escape.rb | 29 + .../lib/puppet/parser/functions/shell_join.rb | 30 + .../puppet/parser/functions/shell_split.rb | 25 + .../lib/puppet/parser/functions/shuffle.rb | 43 + .../lib/puppet/parser/functions/size.rb | 46 + .../lib/puppet/parser/functions/sort.rb | 27 + .../lib/puppet/parser/functions/squeeze.rb | 35 + .../lib/puppet/parser/functions/str2bool.rb | 44 + .../parser/functions/str2saltedsha512.rb | 31 + .../lib/puppet/parser/functions/strftime.rb | 106 + .../lib/puppet/parser/functions/strip.rb | 36 + .../lib/puppet/parser/functions/suffix.rb | 52 + .../lib/puppet/parser/functions/swapcase.rb | 37 + .../lib/puppet/parser/functions/time.rb | 49 + .../lib/puppet/parser/functions/to_bytes.rb | 30 + .../puppet/parser/functions/try_get_value.rb | 53 + .../lib/puppet/parser/functions/type.rb | 19 + .../lib/puppet/parser/functions/type3x.rb | 50 + .../lib/puppet/parser/functions/union.rb | 28 + .../lib/puppet/parser/functions/unique.rb | 48 + .../lib/puppet/parser/functions/unix2dos.rb | 15 + .../lib/puppet/parser/functions/upcase.rb | 44 + .../lib/puppet/parser/functions/uriescape.rb | 33 + .../functions/validate_absolute_path.rb | 54 + .../puppet/parser/functions/validate_array.rb | 35 + .../parser/functions/validate_augeas.rb | 83 + .../puppet/parser/functions/validate_bool.rb | 37 + .../puppet/parser/functions/validate_cmd.rb | 63 + .../functions/validate_email_address.rb | 31 + .../puppet/parser/functions/validate_hash.rb | 35 + .../parser/functions/validate_integer.rb | 134 + .../parser/functions/validate_ip_address.rb | 52 + .../parser/functions/validate_ipv4_address.rb | 50 + .../parser/functions/validate_ipv6_address.rb | 51 + .../parser/functions/validate_numeric.rb | 96 + .../puppet/parser/functions/validate_re.rb | 50 + .../parser/functions/validate_slength.rb | 71 + .../parser/functions/validate_string.rb | 41 + .../functions/validate_x509_rsa_key_pair.rb | 47 + .../lib/puppet/parser/functions/values.rb | 38 + .../lib/puppet/parser/functions/values_at.rb | 93 + .../stdlib/lib/puppet/parser/functions/zip.rb | 38 + .../lib/puppet/provider/file_line/ruby.rb | 132 + .../modules/stdlib/lib/puppet/type/anchor.rb | 46 + .../stdlib/lib/puppet/type/file_line.rb | 146 + .../prod/modules/stdlib/manifests/init.pp | 18 + .../prod/modules/stdlib/manifests/stages.pp | 43 + .../prod/modules/stdlib/metadata.json | 112 + .../stdlib/spec/acceptance/abs_spec.rb | 30 + .../stdlib/spec/acceptance/anchor_spec.rb | 26 + .../stdlib/spec/acceptance/any2array_spec.rb | 49 + .../stdlib/spec/acceptance/base64_spec.rb | 18 + .../stdlib/spec/acceptance/bool2num_spec.rb | 34 + .../stdlib/spec/acceptance/build_csv.rb | 83 + .../stdlib/spec/acceptance/capitalize_spec.rb | 33 + .../stdlib/spec/acceptance/ceiling_spec.rb | 39 + .../stdlib/spec/acceptance/chomp_spec.rb | 21 + .../stdlib/spec/acceptance/chop_spec.rb | 45 + .../stdlib/spec/acceptance/clamp_spec.rb | 40 + .../stdlib/spec/acceptance/concat_spec.rb | 54 + .../stdlib/spec/acceptance/count_spec.rb | 30 + .../stdlib/spec/acceptance/deep_merge_spec.rb | 20 + .../acceptance/defined_with_params_spec.rb | 22 + .../stdlib/spec/acceptance/delete_at_spec.rb | 19 + .../stdlib/spec/acceptance/delete_spec.rb | 19 + .../acceptance/delete_undef_values_spec.rb | 19 + .../spec/acceptance/delete_values_spec.rb | 25 + .../spec/acceptance/deprecation_spec.rb | 102 + .../stdlib/spec/acceptance/difference_spec.rb | 26 + .../stdlib/spec/acceptance/dirname_spec.rb | 42 + .../stdlib/spec/acceptance/downcase_spec.rb | 39 + .../stdlib/spec/acceptance/empty_spec.rb | 53 + .../spec/acceptance/ensure_resource_spec.rb | 30 + .../stdlib/spec/acceptance/flatten_spec.rb | 39 + .../stdlib/spec/acceptance/floor_spec.rb | 39 + .../spec/acceptance/fqdn_rand_string_spec.rb | 66 + .../spec/acceptance/fqdn_rotate_spec.rb | 64 + .../spec/acceptance/get_module_path_spec.rb | 27 + .../stdlib/spec/acceptance/getparam_spec.rb | 24 + .../stdlib/spec/acceptance/getvar_spec.rb | 26 + .../stdlib/spec/acceptance/grep_spec.rb | 26 + .../acceptance/has_interface_with_spec.rb | 54 + .../spec/acceptance/has_ip_address_spec.rb | 33 + .../spec/acceptance/has_ip_network_spec.rb | 33 + .../stdlib/spec/acceptance/has_key_spec.rb | 41 + .../stdlib/spec/acceptance/hash_spec.rb | 26 + .../spec/acceptance/intersection_spec.rb | 27 + .../stdlib/spec/acceptance/is_a_spec.rb | 30 + .../stdlib/spec/acceptance/is_array_spec.rb | 67 + .../stdlib/spec/acceptance/is_bool_spec.rb | 81 + .../spec/acceptance/is_domain_name_spec.rb | 83 + .../stdlib/spec/acceptance/is_float_spec.rb | 86 + .../acceptance/is_function_available_spec.rb | 58 + .../stdlib/spec/acceptance/is_hash_spec.rb | 63 + .../stdlib/spec/acceptance/is_integer_spec.rb | 95 + .../spec/acceptance/is_ip_address_spec.rb | 80 + .../spec/acceptance/is_ipv4_address_spec.rb | 52 + .../spec/acceptance/is_ipv6_address_spec.rb | 66 + .../spec/acceptance/is_mac_address_spec.rb | 38 + .../stdlib/spec/acceptance/is_numeric_spec.rb | 95 + .../stdlib/spec/acceptance/is_string_spec.rb | 113 + .../acceptance/join_keys_to_values_spec.rb | 24 + .../stdlib/spec/acceptance/join_spec.rb | 26 + .../stdlib/spec/acceptance/keys_spec.rb | 23 + .../stdlib/spec/acceptance/loadjson_spec.rb | 52 + .../stdlib/spec/acceptance/loadyaml_spec.rb | 56 + .../stdlib/spec/acceptance/lstrip_spec.rb | 34 + .../stdlib/spec/acceptance/max_spec.rb | 20 + .../stdlib/spec/acceptance/member_spec.rb | 54 + .../stdlib/spec/acceptance/merge_spec.rb | 23 + .../stdlib/spec/acceptance/min_spec.rb | 20 + .../spec/acceptance/nodesets/centos-7-x64.yml | 10 + .../spec/acceptance/nodesets/debian-8-x64.yml | 10 + .../spec/acceptance/nodesets/default.yml | 10 + .../acceptance/nodesets/docker/centos-7.yml | 12 + .../acceptance/nodesets/docker/debian-8.yml | 11 + .../nodesets/docker/ubuntu-14.04.yml | 12 + .../stdlib/spec/acceptance/num2bool_spec.rb | 76 + .../stdlib/spec/acceptance/parsejson_spec.rb | 55 + .../stdlib/spec/acceptance/parseyaml_spec.rb | 58 + .../spec/acceptance/pick_default_spec.rb | 54 + .../stdlib/spec/acceptance/pick_spec.rb | 44 + .../stdlib/spec/acceptance/prefix_spec.rb | 42 + .../stdlib/spec/acceptance/pw_hash_spec.rb | 34 + .../stdlib/spec/acceptance/range_spec.rb | 36 + .../stdlib/spec/acceptance/reject_spec.rb | 42 + .../stdlib/spec/acceptance/reverse_spec.rb | 23 + .../stdlib/spec/acceptance/rstrip_spec.rb | 34 + .../stdlib/spec/acceptance/shuffle_spec.rb | 34 + .../stdlib/spec/acceptance/size_spec.rb | 55 + .../stdlib/spec/acceptance/sort_spec.rb | 34 + .../stdlib/spec/acceptance/squeeze_spec.rb | 47 + .../stdlib/spec/acceptance/str2bool_spec.rb | 31 + .../spec/acceptance/str2saltedsha512_spec.rb | 22 + .../stdlib/spec/acceptance/strftime_spec.rb | 22 + .../stdlib/spec/acceptance/strip_spec.rb | 34 + .../stdlib/spec/acceptance/suffix_spec.rb | 42 + .../stdlib/spec/acceptance/swapcase_spec.rb | 22 + .../stdlib/spec/acceptance/time_spec.rb | 36 + .../stdlib/spec/acceptance/to_bytes_spec.rb | 27 + .../spec/acceptance/try_get_value_spec.rb | 47 + .../stdlib/spec/acceptance/type_spec.rb | 37 + .../stdlib/spec/acceptance/union_spec.rb | 25 + .../stdlib/spec/acceptance/unique_spec.rb | 33 + .../stdlib/spec/acceptance/upcase_spec.rb | 33 + .../stdlib/spec/acceptance/uriescape_spec.rb | 23 + .../acceptance/validate_absolute_path_spec.rb | 31 + .../spec/acceptance/validate_array_spec.rb | 37 + .../spec/acceptance/validate_augeas_spec.rb | 63 + .../spec/acceptance/validate_bool_spec.rb | 37 + .../spec/acceptance/validate_cmd_spec.rb | 52 + .../spec/acceptance/validate_hash_spec.rb | 37 + .../acceptance/validate_ipv4_address_spec.rb | 31 + .../acceptance/validate_ipv6_address_spec.rb | 31 + .../spec/acceptance/validate_re_spec.rb | 47 + .../spec/acceptance/validate_slength_spec.rb | 72 + .../spec/acceptance/validate_string_spec.rb | 43 + .../stdlib/spec/acceptance/values_at_spec.rb | 73 + .../stdlib/spec/acceptance/values_spec.rb | 30 + .../stdlib/spec/acceptance/zip_spec.rb | 67 + .../stdlib/spec/aliases/absolute_path_spec.rb | 67 + .../stdlib/spec/aliases/absolutepath_spec.rb | 50 + .../modules/stdlib/spec/aliases/array_spec.rb | 34 + .../modules/stdlib/spec/aliases/bool_spec.rb | 32 + .../modules/stdlib/spec/aliases/float_spec.rb | 28 + .../modules/stdlib/spec/aliases/hash_spec.rb | 32 + .../stdlib/spec/aliases/httpsurl_spec.rb | 44 + .../stdlib/spec/aliases/httpurl_spec.rb | 47 + .../stdlib/spec/aliases/integer_spec.rb | 28 + .../modules/stdlib/spec/aliases/ip_address.rb | 34 + .../modules/stdlib/spec/aliases/ipv4_spec.rb | 22 + .../modules/stdlib/spec/aliases/ipv6_spec.rb | 40 + .../stdlib/spec/aliases/numeric_spec.rb | 32 + .../stdlib/spec/aliases/string_spec.rb | 32 + .../stdlib/spec/aliases/unixpath_spec.rb | 47 + .../stdlib/spec/aliases/windowspath_spec.rb | 47 + .../stdlib/spec/fixtures/dscacheutil/root | 8 + .../modules/stdlib/spec/fixtures/lsuser/root | 2 + .../fixtures/test/manifests/absolute_path.pp | 6 + .../fixtures/test/manifests/absolutepath.pp | 6 + .../spec/fixtures/test/manifests/array.pp | 8 + .../spec/fixtures/test/manifests/bool.pp | 8 + .../test/manifests/ensure_resources.pp | 4 + .../spec/fixtures/test/manifests/float.pp | 8 + .../spec/fixtures/test/manifests/hash.pp | 8 + .../spec/fixtures/test/manifests/httpsurl.pp | 6 + .../spec/fixtures/test/manifests/httpurl.pp | 6 + .../spec/fixtures/test/manifests/integer.pp | 8 + .../fixtures/test/manifests/ip_address.pp | 6 + .../spec/fixtures/test/manifests/ipv4.pp | 6 + .../spec/fixtures/test/manifests/ipv6.pp | 6 + .../spec/fixtures/test/manifests/numeric.pp | 8 + .../spec/fixtures/test/manifests/string.pp | 8 + .../spec/fixtures/test/manifests/unixpath.pp | 6 + .../fixtures/test/manifests/windowspath.pp | 6 + .../modules/stdlib/spec/functions/abs_spec.rb | 30 + .../stdlib/spec/functions/any2array_spec.rb | 21 + .../stdlib/spec/functions/any2bool_spec.rb | 42 + .../spec/functions/assert_private_spec.rb | 41 + .../stdlib/spec/functions/base64_spec.rb | 37 + .../stdlib/spec/functions/basename_spec.rb | 19 + .../stdlib/spec/functions/bool2num_spec.rb | 14 + .../stdlib/spec/functions/bool2str_spec.rb | 17 + .../stdlib/spec/functions/camelcase_spec.rb | 17 + .../stdlib/spec/functions/capitalize_spec.rb | 15 + .../stdlib/spec/functions/ceiling_spec.rb | 13 + .../stdlib/spec/functions/chomp_spec.rb | 25 + .../stdlib/spec/functions/chop_spec.rb | 25 + .../stdlib/spec/functions/clamp_spec.rb | 16 + .../stdlib/spec/functions/concat_spec.rb | 29 + .../spec/functions/convert_base_spec.rb | 24 + .../stdlib/spec/functions/count_spec.rb | 23 + .../stdlib/spec/functions/deep_merge_spec.rb | 59 + .../functions/defined_with_params_spec.rb | 40 + .../stdlib/spec/functions/delete_at_spec.rb | 30 + .../spec/functions/delete_regex_spec.rb | 54 + .../stdlib/spec/functions/delete_spec.rb | 76 + .../functions/delete_undef_values_spec.rb | 57 + .../spec/functions/delete_values_spec.rb | 41 + .../stdlib/spec/functions/deprecation_spec.rb | 60 + .../stdlib/spec/functions/difference_spec.rb | 23 + .../stdlib/spec/functions/dig44_spec.rb | 131 + .../modules/stdlib/spec/functions/dig_spec.rb | 13 + .../stdlib/spec/functions/dirname_spec.rb | 18 + .../stdlib/spec/functions/dos2unix_spec.rb | 47 + .../stdlib/spec/functions/downcase_spec.rb | 15 + .../stdlib/spec/functions/empty_spec.rb | 22 + .../spec/functions/ensure_packages_spec.rb | 51 + .../spec/functions/ensure_resource_spec.rb | 117 + .../stdlib/spec/functions/flatten_spec.rb | 15 + .../stdlib/spec/functions/floor_spec.rb | 12 + .../spec/functions/fqdn_rand_string_spec.rb | 66 + .../stdlib/spec/functions/fqdn_rotate_spec.rb | 76 + .../stdlib/spec/functions/fqdn_uuid_spec.rb | 13 + .../spec/functions/get_module_path_spec.rb | 48 + .../stdlib/spec/functions/getparam_spec.rb | 35 + .../stdlib/spec/functions/getvar_spec.rb | 38 + .../stdlib/spec/functions/grep_spec.rb | 20 + .../spec/functions/has_interface_with_spec.rb | 38 + .../spec/functions/has_ip_address_spec.rb | 22 + .../spec/functions/has_ip_network_spec.rb | 21 + .../stdlib/spec/functions/has_key_spec.rb | 20 + .../stdlib/spec/functions/hash_spec.rb | 15 + .../spec/functions/intersection_spec.rb | 22 + .../stdlib/spec/functions/is_a_spec.rb | 30 + .../stdlib/spec/functions/is_array_spec.rb | 36 + .../stdlib/spec/functions/is_bool_spec.rb | 33 + .../spec/functions/is_domain_name_spec.rb | 43 + .../spec/functions/is_email_address_spec.rb | 14 + .../stdlib/spec/functions/is_float_spec.rb | 42 + .../spec/functions/is_function_available.rb | 9 + .../stdlib/spec/functions/is_hash_spec.rb | 11 + .../stdlib/spec/functions/is_integer_spec.rb | 45 + .../spec/functions/is_ip_address_spec.rb | 40 + .../spec/functions/is_ipv4_address_spec.rb | 32 + .../spec/functions/is_ipv6_address_spec.rb | 30 + .../spec/functions/is_mac_address_spec.rb | 30 + .../stdlib/spec/functions/is_numeric_spec.rb | 48 + .../stdlib/spec/functions/is_string_spec.rb | 47 + .../functions/join_keys_to_values_spec.rb | 30 + .../stdlib/spec/functions/join_spec.rb | 20 + .../stdlib/spec/functions/keys_spec.rb | 24 + .../modules/stdlib/spec/functions/length.rb | 35 + .../functions/load_module_metadata_spec.rb | 61 + .../stdlib/spec/functions/loadjson_spec.rb | 66 + .../stdlib/spec/functions/loadyaml_spec.rb | 36 + .../stdlib/spec/functions/lstrip_spec.rb | 35 + .../modules/stdlib/spec/functions/max_spec.rb | 21 + .../stdlib/spec/functions/member_spec.rb | 23 + .../stdlib/spec/functions/merge_spec.rb | 25 + .../modules/stdlib/spec/functions/min_spec.rb | 21 + .../stdlib/spec/functions/num2bool_spec.rb | 22 + .../stdlib/spec/functions/parsejson_spec.rb | 69 + .../stdlib/spec/functions/parseyaml_spec.rb | 86 + .../spec/functions/pick_default_spec.rb | 26 + .../stdlib/spec/functions/pick_spec.rb | 17 + .../stdlib/spec/functions/prefix_spec.rb | 29 + .../stdlib/spec/functions/private_spec.rb | 56 + .../stdlib/spec/functions/pw_hash_spec.rb | 69 + .../stdlib/spec/functions/range_spec.rb | 126 + .../spec/functions/regexpescape_spec.rb | 41 + .../stdlib/spec/functions/reject_spec.rb | 20 + .../stdlib/spec/functions/reverse_spec.rb | 33 + .../stdlib/spec/functions/rstrip_spec.rb | 35 + .../stdlib/spec/functions/seeded_rand_spec.rb | 58 + .../spec/functions/shell_escape_spec.rb | 27 + .../stdlib/spec/functions/shell_join_spec.rb | 28 + .../stdlib/spec/functions/shell_split_spec.rb | 29 + .../stdlib/spec/functions/shuffle_spec.rb | 38 + .../stdlib/spec/functions/size_spec.rb | 38 + .../stdlib/spec/functions/sort_spec.rb | 24 + .../stdlib/spec/functions/squeeze_spec.rb | 50 + .../stdlib/spec/functions/str2bool_spec.rb | 23 + .../spec/functions/str2saltedsha512_spec.rb | 17 + .../stdlib/spec/functions/strftime_spec.rb | 26 + .../stdlib/spec/functions/strip_spec.rb | 35 + .../stdlib/spec/functions/suffix_spec.rb | 40 + .../stdlib/spec/functions/swapcase_spec.rb | 40 + .../stdlib/spec/functions/time_spec.rb | 21 + .../stdlib/spec/functions/to_bytes_spec.rb | 72 + .../spec/functions/try_get_value_spec.rb | 100 + .../stdlib/spec/functions/type3x_spec.rb | 41 + .../stdlib/spec/functions/type_of_spec.rb | 25 + .../stdlib/spec/functions/type_spec.rb | 42 + .../stdlib/spec/functions/union_spec.rb | 25 + .../stdlib/spec/functions/unique_spec.rb | 29 + .../stdlib/spec/functions/unix2dos_spec.rb | 40 + .../stdlib/spec/functions/upcase_spec.rb | 26 + .../stdlib/spec/functions/uriescape_spec.rb | 36 + .../functions/validate_absolute_path_spec.rb | 73 + .../spec/functions/validate_array_spec.rb | 37 + .../spec/functions/validate_augeas_spec.rb | 75 + .../spec/functions/validate_bool_spec.rb | 36 + .../spec/functions/validate_cmd_spec.rb | 35 + .../functions/validate_email_address_spec.rb | 23 + .../spec/functions/validate_hash_spec.rb | 38 + .../spec/functions/validate_integer_spec.rb | 101 + .../functions/validate_ip_address_spec.rb | 65 + .../functions/validate_ipv4_address_spec.rb | 41 + .../functions/validate_ipv6_address_spec.rb | 60 + .../spec/functions/validate_legacy_spec.rb | 68 + .../spec/functions/validate_numeric_spec.rb | 100 + .../stdlib/spec/functions/validate_re_spec.rb | 56 + .../spec/functions/validate_slength_spec.rb | 72 + .../spec/functions/validate_string_spec.rb | 33 + .../validate_x509_rsa_key_pair_spec.rb | 180 + .../stdlib/spec/functions/values_at_spec.rb | 54 + .../stdlib/spec/functions/values_spec.rb | 24 + .../modules/stdlib/spec/functions/zip_spec.rb | 21 + .../monkey_patches/alias_should_to_must.rb | 9 + .../spec/monkey_patches/publicize_methods.rb | 11 + .../prod/modules/stdlib/spec/spec_helper.rb | 8 + .../stdlib/spec/spec_helper_acceptance.rb | 55 + .../modules/stdlib/spec/spec_helper_local.rb | 31 + .../stdlib/spec/support/shared_data.rb | 38 + .../stdlib/spec/unit/ensure_resources_spec.rb | 22 + .../spec/unit/facter/facter_dot_d_spec.rb | 32 + .../spec/unit/facter/package_provider_spec.rb | 44 + .../spec/unit/facter/pe_version_spec.rb | 88 + .../stdlib/spec/unit/facter/root_home_spec.rb | 65 + .../spec/unit/facter/service_provider_spec.rb | 37 + .../unit/facter/util/puppet_settings_spec.rb | 37 + .../parser/functions/enclose_ipv6_spec.rb | 69 + .../parser/functions/is_absolute_path_spec.rb | 86 + .../puppet/provider/file_line/ruby_spec.rb | 447 ++ .../spec/unit/puppet/type/anchor_spec.rb | 11 + .../spec/unit/puppet/type/file_line_spec.rb | 113 + .../prod/modules/stdlib/types/absolutepath.pp | 2 + .../stdlib/types/compat/absolute_path.pp | 7 + .../prod/modules/stdlib/types/compat/array.pp | 2 + .../prod/modules/stdlib/types/compat/bool.pp | 2 + .../prod/modules/stdlib/types/compat/float.pp | 19 + .../prod/modules/stdlib/types/compat/hash.pp | 2 + .../modules/stdlib/types/compat/integer.pp | 23 + .../modules/stdlib/types/compat/ip_address.pp | 1 + .../prod/modules/stdlib/types/compat/ipv4.pp | 2 + .../prod/modules/stdlib/types/compat/ipv6.pp | 1 + .../modules/stdlib/types/compat/numeric.pp | 23 + .../prod/modules/stdlib/types/compat/re.pp | 3 + .../modules/stdlib/types/compat/string.pp | 2 + .../prod/modules/stdlib/types/httpsurl.pp | 1 + .../prod/modules/stdlib/types/httpurl.pp | 1 + .../prod/modules/stdlib/types/unixpath.pp | 2 + .../prod/modules/stdlib/types/windowspath.pp | 1 + .../prod/modules/task13/manifests/mysql.pp | 19 + .../prod/modules/task13/manifests/nginx.pp | 10 + environments/production/environment.conf | 18 + environments/production/manifests/site.pp | 48 + .../production/modules/apache/CHANGELOG.md | 816 ++++ .../production/modules/apache/CONTRIBUTING.md | 218 + .../production/modules/apache/Gemfile | 87 + .../production/modules/apache/LICENSE | 202 + environments/production/modules/apache/NOTICE | 17 + .../production/modules/apache/README.md | 4097 +++++++++++++++++ .../production/modules/apache/Rakefile | 39 + .../production/modules/apache/checksums.json | 336 ++ .../modules/apache/examples/apache.pp | 6 + .../production/modules/apache/examples/dev.pp | 1 + .../modules/apache/examples/init.pp | 1 + .../apache/examples/mod_load_params.pp | 11 + .../modules/apache/examples/mods.pp | 9 + .../modules/apache/examples/mods_custom.pp | 16 + .../production/modules/apache/examples/php.pp | 4 + .../modules/apache/examples/vhost.pp | 261 ++ .../apache/examples/vhost_directories.pp | 44 + .../modules/apache/examples/vhost_filter.pp | 17 + .../modules/apache/examples/vhost_ip_based.pp | 25 + .../apache/examples/vhost_proxypass.pp | 66 + .../modules/apache/examples/vhost_ssl.pp | 23 + .../apache/examples/vhosts_without_listen.pp | 53 + .../production/modules/apache/files/httpd | 24 + .../apache/lib/facter/apache_version.rb | 13 + .../lib/puppet/parser/functions/bool2httpd.rb | 30 + .../puppet/parser/functions/enclose_ipv6.rb | 45 + .../functions/validate_apache_log_level.rb | 27 + .../apache/lib/puppet/provider/a2mod.rb | 34 + .../apache/lib/puppet/provider/a2mod/a2mod.rb | 35 + .../lib/puppet/provider/a2mod/gentoo.rb | 116 + .../lib/puppet/provider/a2mod/modfix.rb | 12 + .../lib/puppet/provider/a2mod/redhat.rb | 60 + .../modules/apache/lib/puppet/type/a2mod.rb | 30 + .../modules/apache/manifests/balancer.pp | 97 + .../apache/manifests/balancermember.pp | 52 + .../modules/apache/manifests/confd/no_accf.pp | 10 + .../modules/apache/manifests/custom_config.pp | 73 + .../apache/manifests/default_confd_files.pp | 15 + .../modules/apache/manifests/default_mods.pp | 179 + .../apache/manifests/default_mods/load.pp | 8 + .../modules/apache/manifests/dev.pp | 14 + .../apache/manifests/fastcgi/server.pp | 29 + .../modules/apache/manifests/init.pp | 395 ++ .../modules/apache/manifests/listen.pp | 9 + .../modules/apache/manifests/mod.pp | 176 + .../modules/apache/manifests/mod/actions.pp | 3 + .../modules/apache/manifests/mod/alias.pp | 23 + .../apache/manifests/mod/auth_basic.pp | 3 + .../modules/apache/manifests/mod/auth_cas.pp | 57 + .../modules/apache/manifests/mod/auth_kerb.pp | 7 + .../apache/manifests/mod/auth_mellon.pp | 26 + .../apache/manifests/mod/authn_core.pp | 7 + .../modules/apache/manifests/mod/authn_dbd.pp | 30 + .../apache/manifests/mod/authn_file.pp | 3 + .../apache/manifests/mod/authnz_ldap.pp | 34 + .../apache/manifests/mod/authz_default.pp | 9 + .../apache/manifests/mod/authz_user.pp | 3 + .../modules/apache/manifests/mod/autoindex.pp | 14 + .../modules/apache/manifests/mod/cache.pp | 3 + .../modules/apache/manifests/mod/cgi.pp | 17 + .../modules/apache/manifests/mod/cgid.pp | 42 + .../modules/apache/manifests/mod/cluster.pp | 38 + .../modules/apache/manifests/mod/dav.pp | 3 + .../modules/apache/manifests/mod/dav_fs.pp | 22 + .../modules/apache/manifests/mod/dav_svn.pp | 28 + .../modules/apache/manifests/mod/dbd.pp | 3 + .../modules/apache/manifests/mod/deflate.pp | 27 + .../modules/apache/manifests/mod/dev.pp | 5 + .../modules/apache/manifests/mod/dir.pp | 23 + .../apache/manifests/mod/disk_cache.pp | 42 + .../modules/apache/manifests/mod/dumpio.pp | 20 + .../modules/apache/manifests/mod/env.pp | 3 + .../modules/apache/manifests/mod/event.pp | 76 + .../modules/apache/manifests/mod/expires.pp | 22 + .../apache/manifests/mod/ext_filter.pp | 25 + .../modules/apache/manifests/mod/fastcgi.pp | 26 + .../modules/apache/manifests/mod/fcgid.pp | 28 + .../modules/apache/manifests/mod/filter.pp | 3 + .../modules/apache/manifests/mod/geoip.pp | 33 + .../modules/apache/manifests/mod/headers.pp | 3 + .../modules/apache/manifests/mod/include.pp | 3 + .../modules/apache/manifests/mod/info.pp | 33 + .../modules/apache/manifests/mod/itk.pp | 96 + .../modules/apache/manifests/mod/ldap.pp | 30 + .../modules/apache/manifests/mod/mime.pp | 25 + .../apache/manifests/mod/mime_magic.pp | 17 + .../apache/manifests/mod/negotiation.pp | 27 + .../modules/apache/manifests/mod/nss.pp | 28 + .../modules/apache/manifests/mod/pagespeed.pp | 60 + .../modules/apache/manifests/mod/passenger.pp | 120 + .../modules/apache/manifests/mod/perl.pp | 4 + .../modules/apache/manifests/mod/peruser.pp | 77 + .../modules/apache/manifests/mod/php.pp | 94 + .../modules/apache/manifests/mod/prefork.pp | 85 + .../modules/apache/manifests/mod/proxy.pp | 23 + .../modules/apache/manifests/mod/proxy_ajp.pp | 4 + .../apache/manifests/mod/proxy_balancer.pp | 32 + .../apache/manifests/mod/proxy_connect.pp | 10 + .../apache/manifests/mod/proxy_fcgi.pp | 4 + .../apache/manifests/mod/proxy_html.pp | 42 + .../apache/manifests/mod/proxy_http.pp | 4 + .../apache/manifests/mod/proxy_wstunnel.pp | 5 + .../modules/apache/manifests/mod/python.pp | 6 + .../modules/apache/manifests/mod/remoteip.pp | 30 + .../apache/manifests/mod/reqtimeout.pp | 15 + .../modules/apache/manifests/mod/rewrite.pp | 4 + .../modules/apache/manifests/mod/rpaf.pp | 23 + .../modules/apache/manifests/mod/security.pp | 130 + .../modules/apache/manifests/mod/setenvif.pp | 14 + .../modules/apache/manifests/mod/shib.pp | 20 + .../apache/manifests/mod/socache_shmcb.pp | 3 + .../modules/apache/manifests/mod/speling.pp | 4 + .../modules/apache/manifests/mod/ssl.pp | 129 + .../modules/apache/manifests/mod/status.pp | 49 + .../modules/apache/manifests/mod/suexec.pp | 3 + .../modules/apache/manifests/mod/suphp.pp | 16 + .../modules/apache/manifests/mod/userdir.pp | 23 + .../modules/apache/manifests/mod/version.pp | 10 + .../apache/manifests/mod/vhost_alias.pp | 3 + .../modules/apache/manifests/mod/worker.pp | 147 + .../modules/apache/manifests/mod/wsgi.pp | 42 + .../modules/apache/manifests/mod/xsendfile.pp | 4 + .../modules/apache/manifests/mpm.pp | 148 + .../apache/manifests/namevirtualhost.pp | 9 + .../modules/apache/manifests/package.pp | 37 + .../modules/apache/manifests/params.pp | 566 +++ .../apache/manifests/peruser/multiplexer.pp | 17 + .../apache/manifests/peruser/processor.pp | 17 + .../modules/apache/manifests/php.pp | 18 + .../modules/apache/manifests/proxy.pp | 15 + .../modules/apache/manifests/python.pp | 18 + .../apache/manifests/security/rule_link.pp | 18 + .../modules/apache/manifests/service.pp | 53 + .../modules/apache/manifests/ssl.pp | 18 + .../modules/apache/manifests/version.pp | 49 + .../modules/apache/manifests/vhost.pp | 1164 +++++ .../modules/apache/manifests/vhost/custom.pp | 40 + .../modules/apache/manifests/vhosts.pp | 6 + .../production/modules/apache/metadata.json | 79 + .../spec/acceptance/apache_parameters_spec.rb | 501 ++ .../apache/spec/acceptance/apache_ssl_spec.rb | 94 + .../apache/spec/acceptance/class_spec.rb | 89 + .../spec/acceptance/custom_config_spec.rb | 94 + .../spec/acceptance/default_mods_spec.rb | 109 + .../apache/spec/acceptance/itk_spec.rb | 60 + .../spec/acceptance/mod_dav_svn_spec.rb | 63 + .../spec/acceptance/mod_deflate_spec.rb | 33 + .../apache/spec/acceptance/mod_fcgid_spec.rb | 57 + .../apache/spec/acceptance/mod_mime_spec.rb | 30 + .../spec/acceptance/mod_negotiation_spec.rb | 78 + .../spec/acceptance/mod_pagespeed_spec.rb | 80 + .../spec/acceptance/mod_passenger_spec.rb | 208 + .../apache/spec/acceptance/mod_php_spec.rb | 152 + .../spec/acceptance/mod_proxy_html_spec.rb | 36 + .../spec/acceptance/mod_security_spec.rb | 386 ++ .../apache/spec/acceptance/mod_suphp_spec.rb | 57 + .../spec/acceptance/nodesets/centos-7-x64.yml | 10 + .../spec/acceptance/nodesets/debian-8-x64.yml | 10 + .../spec/acceptance/nodesets/default.yml | 10 + .../acceptance/nodesets/docker/centos-7.yml | 12 + .../acceptance/nodesets/docker/debian-8.yml | 11 + .../nodesets/docker/ubuntu-14.04.yml | 12 + .../apache/spec/acceptance/nodesets/suse.yml | 25 + .../spec/acceptance/prefork_worker_spec.rb | 80 + .../apache/spec/acceptance/service_spec.rb | 18 + .../modules/apache/spec/acceptance/version.rb | 96 + .../apache/spec/acceptance/vhost_spec.rb | 1590 +++++++ .../apache/spec/acceptance/vhosts_spec.rb | 32 + .../apache/spec/classes/apache_spec.rb | 908 ++++ .../modules/apache/spec/classes/dev_spec.rb | 89 + .../apache/spec/classes/mod/alias_spec.rb | 97 + .../apache/spec/classes/mod/auth_cas_spec.rb | 64 + .../apache/spec/classes/mod/auth_kerb_spec.rb | 77 + .../spec/classes/mod/auth_mellon_spec.rb | 90 + .../apache/spec/classes/mod/authn_dbd_spec.rb | 62 + .../spec/classes/mod/authnz_ldap_spec.rb | 76 + .../apache/spec/classes/mod/cluster_spec.rb | 105 + .../apache/spec/classes/mod/dav_svn_spec.rb | 80 + .../apache/spec/classes/mod/deflate_spec.rb | 127 + .../apache/spec/classes/mod/dev_spec.rb | 32 + .../apache/spec/classes/mod/dir_spec.rb | 137 + .../spec/classes/mod/disk_cache_spec.rb | 125 + .../apache/spec/classes/mod/dumpio_spec.rb | 51 + .../apache/spec/classes/mod/event_spec.rb | 214 + .../apache/spec/classes/mod/expires_spec.rb | 83 + .../spec/classes/mod/ext_filter_spec.rb | 64 + .../apache/spec/classes/mod/fastcgi_spec.rb | 43 + .../apache/spec/classes/mod/fcgid_spec.rb | 141 + .../apache/spec/classes/mod/info_spec.rb | 222 + .../apache/spec/classes/mod/itk_spec.rb | 130 + .../apache/spec/classes/mod/ldap_spec.rb | 86 + .../spec/classes/mod/mime_magic_spec.rb | 110 + .../apache/spec/classes/mod/mime_spec.rb | 52 + .../spec/classes/mod/negotiation_spec.rb | 56 + .../apache/spec/classes/mod/pagespeed_spec.rb | 51 + .../apache/spec/classes/mod/passenger_spec.rb | 337 ++ .../apache/spec/classes/mod/perl_spec.rb | 74 + .../apache/spec/classes/mod/peruser_spec.rb | 43 + .../apache/spec/classes/mod/php_spec.rb | 319 ++ .../apache/spec/classes/mod/prefork_spec.rb | 134 + .../spec/classes/mod/proxy_balancer_spec.rb | 95 + .../spec/classes/mod/proxy_connect_spec.rb | 65 + .../spec/classes/mod/proxy_html_spec.rb | 128 + .../apache/spec/classes/mod/proxy_wstunnel.rb | 5 + .../apache/spec/classes/mod/python_spec.rb | 75 + .../apache/spec/classes/mod/remoteip_spec.rb | 48 + .../spec/classes/mod/reqtimeout_spec.rb | 146 + .../apache/spec/classes/mod/rpaf_spec.rb | 126 + .../apache/spec/classes/mod/security_spec.rb | 155 + .../apache/spec/classes/mod/shib_spec.rb | 42 + .../apache/spec/classes/mod/speling_spec.rb | 37 + .../apache/spec/classes/mod/ssl_spec.rb | 238 + .../apache/spec/classes/mod/status_spec.rb | 205 + .../apache/spec/classes/mod/suphp_spec.rb | 38 + .../apache/spec/classes/mod/worker_spec.rb | 189 + .../apache/spec/classes/mod/wsgi_spec.rb | 145 + .../apache/spec/classes/params_spec.rb | 22 + .../apache/spec/classes/service_spec.rb | 173 + .../apache/spec/classes/vhosts_spec.rb | 35 + .../apache/spec/defines/balancer_spec.rb | 72 + .../spec/defines/balancermember_spec.rb | 61 + .../apache/spec/defines/custom_config_spec.rb | 138 + .../spec/defines/fastcgi_server_spec.rb | 156 + .../modules/apache/spec/defines/mod_spec.rb | 166 + .../apache/spec/defines/modsec_link_spec.rb | 53 + .../apache/spec/defines/vhost_custom_spec.rb | 99 + .../modules/apache/spec/defines/vhost_spec.rb | 1311 ++++++ .../spec/fixtures/files/negotiation.conf | 4 + .../modules/apache/spec/fixtures/files/spec | 1 + .../fixtures/templates/negotiation.conf.erb | 4 + .../modules/apache/spec/spec_helper.rb | 8 + .../apache/spec/spec_helper_acceptance.rb | 82 + .../modules/apache/spec/spec_helper_local.rb | 39 + .../apache/spec/unit/apache_version_spec.rb | 33 + .../spec/unit/provider/a2mod/gentoo_spec.rb | 182 + .../parser/functions/bool2httpd_spec.rb | 53 + .../parser/functions/enclose_ipv6_spec.rb | 69 + .../functions/validate_apache_log_level.rb | 39 + .../apache/templates/confd/no-accf.conf.erb | 4 + .../apache/templates/fastcgi/server.erb | 22 + .../modules/apache/templates/httpd.conf.erb | 150 + .../modules/apache/templates/listen.erb | 6 + .../apache/templates/mod/alias.conf.erb | 13 + .../apache/templates/mod/auth_cas.conf.erb | 58 + .../apache/templates/mod/auth_mellon.conf.erb | 21 + .../apache/templates/mod/authn_dbd.conf.erb | 17 + .../apache/templates/mod/authnz_ldap.conf.erb | 5 + .../apache/templates/mod/autoindex.conf.erb | 56 + .../apache/templates/mod/cgid.conf.erb | 1 + .../apache/templates/mod/cluster.conf.erb | 23 + .../apache/templates/mod/dav_fs.conf.erb | 1 + .../apache/templates/mod/deflate.conf.erb | 7 + .../modules/apache/templates/mod/dir.conf.erb | 1 + .../apache/templates/mod/disk_cache.conf.erb | 4 + .../apache/templates/mod/dumpio.conf.erb | 3 + .../apache/templates/mod/event.conf.erb | 33 + .../apache/templates/mod/expires.conf.erb | 11 + .../apache/templates/mod/ext_filter.conf.erb | 6 + .../apache/templates/mod/fastcgi.conf.erb | 8 + .../apache/templates/mod/fcgid.conf.erb | 5 + .../apache/templates/mod/geoip.conf.erb | 25 + .../apache/templates/mod/info.conf.erb | 19 + .../modules/apache/templates/mod/itk.conf.erb | 8 + .../apache/templates/mod/ldap.conf.erb | 29 + .../modules/apache/templates/mod/load.erb | 7 + .../apache/templates/mod/mime.conf.erb | 38 + .../apache/templates/mod/mime_magic.conf.erb | 1 + .../apache/templates/mod/mpm_event.conf.erb | 9 + .../apache/templates/mod/negotiation.conf.erb | 2 + .../modules/apache/templates/mod/nss.conf.erb | 228 + .../apache/templates/mod/pagespeed.conf.erb | 102 + .../apache/templates/mod/passenger.conf.erb | 61 + .../apache/templates/mod/peruser.conf.erb | 12 + .../modules/apache/templates/mod/php.conf.erb | 23 + .../apache/templates/mod/prefork.conf.erb | 8 + .../apache/templates/mod/proxy.conf.erb | 27 + .../templates/mod/proxy_balancer.conf.erb | 10 + .../apache/templates/mod/proxy_html.conf.erb | 18 + .../apache/templates/mod/remoteip.conf.erb | 23 + .../apache/templates/mod/reqtimeout.conf.erb | 3 + .../apache/templates/mod/rpaf.conf.erb | 15 + .../apache/templates/mod/security.conf.erb | 80 + .../templates/mod/security_crs.conf.erb | 436 ++ .../apache/templates/mod/setenvif.conf.erb | 34 + .../modules/apache/templates/mod/ssl.conf.erb | 38 + .../apache/templates/mod/status.conf.erb | 16 + .../apache/templates/mod/suphp.conf.erb | 19 + .../apache/templates/mod/userdir.conf.erb | 27 + .../apache/templates/mod/worker.conf.erb | 11 + .../apache/templates/mod/wsgi.conf.erb | 13 + .../apache/templates/namevirtualhost.erb | 8 + .../modules/apache/templates/ports_header.erb | 5 + .../apache/templates/vhost/_access_log.erb | 21 + .../apache/templates/vhost/_action.erb | 4 + .../templates/vhost/_additional_includes.erb | 9 + .../apache/templates/vhost/_aliases.erb | 16 + .../vhost/_allow_encoded_slashes.erb | 4 + .../apache/templates/vhost/_auth_cas.erb | 65 + .../apache/templates/vhost/_auth_kerb.erb | 32 + .../modules/apache/templates/vhost/_block.erb | 14 + .../apache/templates/vhost/_charsets.erb | 4 + .../templates/vhost/_custom_fragment.erb | 5 + .../apache/templates/vhost/_directories.erb | 326 ++ .../apache/templates/vhost/_docroot.erb | 7 + .../templates/vhost/_error_document.erb | 7 + .../templates/vhost/_fallbackresource.erb | 4 + .../apache/templates/vhost/_fastcgi.erb | 23 + .../apache/templates/vhost/_file_footer.erb | 1 + .../apache/templates/vhost/_file_header.erb | 12 + .../apache/templates/vhost/_filters.erb | 10 + .../apache/templates/vhost/_header.erb | 10 + .../modules/apache/templates/vhost/_itk.erb | 29 + .../apache/templates/vhost/_jk_mounts.erb | 12 + .../templates/vhost/_keepalive_options.erb | 9 + .../apache/templates/vhost/_logging.erb | 10 + .../apache/templates/vhost/_passenger.erb | 33 + .../templates/vhost/_passenger_base_uris.erb | 7 + .../modules/apache/templates/vhost/_php.erb | 16 + .../apache/templates/vhost/_php_admin.erb | 12 + .../modules/apache/templates/vhost/_proxy.erb | 98 + .../modules/apache/templates/vhost/_rack.erb | 7 + .../apache/templates/vhost/_redirect.erb | 35 + .../apache/templates/vhost/_requestheader.erb | 10 + .../apache/templates/vhost/_require.erb | 62 + .../apache/templates/vhost/_rewrite.erb | 53 + .../apache/templates/vhost/_scriptalias.erb | 24 + .../apache/templates/vhost/_security.erb | 43 + .../apache/templates/vhost/_serveralias.erb | 7 + .../templates/vhost/_serversignature.erb | 1 + .../apache/templates/vhost/_setenv.erb | 17 + .../modules/apache/templates/vhost/_ssl.erb | 55 + .../apache/templates/vhost/_sslproxy.erb | 23 + .../apache/templates/vhost/_suexec.erb | 4 + .../modules/apache/templates/vhost/_suphp.erb | 11 + .../modules/apache/templates/vhost/_wsgi.erb | 34 + .../production/modules/apt/CHANGELOG.md | 541 +++ .../production/modules/apt/CONTRIBUTING.md | 217 + environments/production/modules/apt/Gemfile | 75 + environments/production/modules/apt/LICENSE | 202 + .../production/modules/apt/MAINTAINERS.md | 6 + environments/production/modules/apt/NOTICE | 15 + environments/production/modules/apt/README.md | 527 +++ environments/production/modules/apt/Rakefile | 37 + .../production/modules/apt/checksums.json | 79 + .../modules/apt/examples/backports.pp | 11 + .../modules/apt/examples/builddep.pp | 3 + .../modules/apt/examples/debian_testing.pp | 18 + .../modules/apt/examples/debian_unstable.pp | 18 + .../modules/apt/examples/disable_keys.pp | 5 + .../modules/apt/examples/fancy_progress.pp | 4 + .../production/modules/apt/examples/force.pp | 28 + .../production/modules/apt/examples/hold.pp | 5 + .../production/modules/apt/examples/key.pp | 6 + .../production/modules/apt/examples/pin.pp | 5 + .../production/modules/apt/examples/ppa.pp | 4 + .../modules/apt/examples/release.pp | 4 + .../production/modules/apt/examples/source.pp | 35 + .../apt/examples/unattended_upgrades.pp | 1 + .../apt/lib/facter/apt_reboot_required.rb | 7 + .../apt/lib/facter/apt_update_last_success.rb | 18 + .../modules/apt/lib/facter/apt_updates.rb | 57 + .../lib/puppet/provider/apt_key/apt_key.rb | 227 + .../modules/apt/lib/puppet/type/apt_key.rb | 135 + .../apt/lib/puppet_x/apt_key/patch_openuri.rb | 63 + .../modules/apt/locales/config.yaml | 25 + .../modules/apt/manifests/backports.pp | 65 + .../production/modules/apt/manifests/conf.pp | 20 + .../production/modules/apt/manifests/init.pp | 171 + .../production/modules/apt/manifests/key.pp | 111 + .../modules/apt/manifests/params.pp | 142 + .../production/modules/apt/manifests/pin.pp | 80 + .../production/modules/apt/manifests/ppa.pp | 69 + .../modules/apt/manifests/setting.pp | 64 + .../modules/apt/manifests/source.pp | 158 + .../modules/apt/manifests/update.pp | 61 + .../production/modules/apt/metadata.json | 39 + .../spec/acceptance/apt_key_provider_spec.rb | 847 ++++ .../modules/apt/spec/acceptance/apt_spec.rb | 68 + .../modules/apt/spec/acceptance/class_spec.rb | 17 + .../spec/acceptance/nodesets/centos-7-x64.yml | 10 + .../spec/acceptance/nodesets/debian-8-x64.yml | 10 + .../apt/spec/acceptance/nodesets/default.yml | 10 + .../acceptance/nodesets/docker/centos-7.yml | 12 + .../acceptance/nodesets/docker/debian-8.yml | 11 + .../nodesets/docker/ubuntu-14.04.yml | 12 + .../apt/spec/classes/apt_backports_spec.rb | 272 ++ .../modules/apt/spec/classes/apt_spec.rb | 333 ++ .../apt/spec/classes/apt_update_spec.rb | 75 + .../modules/apt/spec/classes/params_spec.rb | 22 + .../modules/apt/spec/defines/conf_spec.rb | 84 + .../apt/spec/defines/key_compat_spec.rb | 330 ++ .../modules/apt/spec/defines/key_spec.rb | 325 ++ .../modules/apt/spec/defines/pin_spec.rb | 145 + .../modules/apt/spec/defines/ppa_spec.rb | 378 ++ .../modules/apt/spec/defines/setting_spec.rb | 117 + .../apt/spec/defines/source_compat_spec.rb | 164 + .../modules/apt/spec/defines/source_spec.rb | 444 ++ .../modules/apt/spec/spec_helper.rb | 8 + .../apt/spec/spec_helper_acceptance.rb | 43 + .../spec/unit/facter/apt_has_updates_spec.rb | 38 + .../unit/facter/apt_package_updates_spec.rb | 34 + .../unit/facter/apt_reboot_required_spec.rb | 25 + .../unit/facter/apt_security_updates_spec.rb | 29 + .../facter/apt_update_last_success_spec.rb | 28 + .../apt/spec/unit/facter/apt_updates_spec.rb | 29 + .../apt/spec/unit/puppet/type/apt_key_spec.rb | 188 + .../modules/apt/templates/15update-stamp.erb | 1 + .../modules/apt/templates/_conf_header.erb | 1 + .../modules/apt/templates/_header.erb | 1 + .../production/modules/apt/templates/conf.erb | 1 + .../modules/apt/templates/pin.pref.erb | 21 + .../modules/apt/templates/proxy.erb | 4 + .../modules/apt/templates/source.list.erb | 9 + .../production/modules/concat/CHANGELOG.md | 339 ++ .../production/modules/concat/CONTRIBUTING.md | 217 + .../production/modules/concat/Gemfile | 156 + .../production/modules/concat/LICENSE | 202 + .../production/modules/concat/MAINTAINERS.md | 6 + environments/production/modules/concat/NOTICE | 15 + .../production/modules/concat/README.md | 360 ++ .../production/modules/concat/Rakefile | 37 + .../production/modules/concat/appveyor.yml | 38 + .../production/modules/concat/checksums.json | 45 + .../modules/concat/examples/fragment.pp | 20 + .../modules/concat/examples/init.pp | 6 + .../concat/lib/puppet/type/concat_file.rb | 212 + .../concat/lib/puppet/type/concat_fragment.rb | 64 + .../modules/concat/locales/config.yaml | 25 + .../modules/concat/manifests/fragment.pp | 57 + .../modules/concat/manifests/init.pp | 158 + .../production/modules/concat/metadata.json | 109 + .../concat/spec/acceptance/backup_spec.rb | 115 + .../concat/spec/acceptance/concat_spec.rb | 228 + .../spec/acceptance/concurrency_spec.rb | 37 + .../spec/acceptance/fragment_source_spec.rb | 156 + .../fragments_are_always_replaced_spec.rb | 139 + .../concat/spec/acceptance/newline_spec.rb | 67 + .../spec/acceptance/nodesets/centos-7-x64.yml | 10 + .../spec/acceptance/nodesets/debian-8-x64.yml | 10 + .../spec/acceptance/nodesets/default.yml | 18 + .../acceptance/nodesets/docker/centos-7.yml | 12 + .../acceptance/nodesets/docker/debian-8.yml | 11 + .../nodesets/docker/ubuntu-14.04.yml | 12 + .../concat/spec/acceptance/order_spec.rb | 123 + .../concat/spec/acceptance/pup-1963_spec.rb | 69 + .../spec/acceptance/quoted_paths_spec.rb | 42 + .../concat/spec/acceptance/replace_spec.rb | 261 ++ .../concat/spec/acceptance/specinfra_stubs.rb | 19 + .../spec/acceptance/symbolic_name_spec.rb | 35 + .../concat/spec/acceptance/validation_spec.rb | 35 + .../spec/acceptance/warn_header_spec.rb | 104 + .../concat/spec/acceptance/warnings_spec.rb | 61 + .../modules/concat/spec/spec_helper.rb | 8 + .../concat/spec/spec_helper_acceptance.rb | 53 + .../spec/unit/defines/concat_fragment_spec.rb | 160 + .../concat/spec/unit/defines/concat_spec.rb | 362 ++ .../concat/spec/unit/type/concat_file_spec.rb | 65 + .../production/modules/firewall/CHANGELOG.md | 618 +++ .../modules/firewall/CONTRIBUTING.md | 218 + .../production/modules/firewall/Gemfile | 87 + .../production/modules/firewall/LICENSE | 202 + .../production/modules/firewall/NOTICE | 26 + .../modules/firewall/README.markdown | 943 ++++ .../production/modules/firewall/Rakefile | 38 + .../modules/firewall/checksums.json | 105 + .../firewall/lib/facter/ip6tables_version.rb | 11 + .../lib/facter/iptables_persistent_version.rb | 22 + .../firewall/lib/facter/iptables_version.rb | 11 + .../firewall/lib/puppet/provider/firewall.rb | 34 + .../lib/puppet/provider/firewall/ip6tables.rb | 242 + .../lib/puppet/provider/firewall/iptables.rb | 785 ++++ .../provider/firewallchain/iptables_chain.rb | 179 + .../firewall/lib/puppet/type/firewall.rb | 1695 +++++++ .../firewall/lib/puppet/type/firewallchain.rb | 235 + .../firewall/lib/puppet/util/firewall.rb | 232 + .../firewall/lib/puppet/util/ipcidr.rb | 42 + .../modules/firewall/manifests/init.pp | 47 + .../modules/firewall/manifests/linux.pp | 72 + .../firewall/manifests/linux/archlinux.pp | 44 + .../firewall/manifests/linux/debian.pp | 56 + .../firewall/manifests/linux/gentoo.pp | 44 + .../firewall/manifests/linux/redhat.pp | 118 + .../modules/firewall/manifests/params.pp | 75 + .../production/modules/firewall/metadata.json | 83 + .../spec/acceptance/change_source_spec.rb | 76 + .../firewall/spec/acceptance/class_spec.rb | 33 + .../spec/acceptance/connlimit_spec.rb | 63 + .../firewall/spec/acceptance/connmark_spec.rb | 27 + .../spec/acceptance/firewall_bridging_spec.rb | 369 ++ .../acceptance/firewall_clusterip_spec.rb | 49 + .../spec/acceptance/firewall_dscp_spec.rb | 117 + .../acceptance/firewall_iptmodules_spec.rb | 201 + .../spec/acceptance/firewall_mss_spec.rb | 117 + .../firewall/spec/acceptance/firewall_spec.rb | 2419 ++++++++++ .../spec/acceptance/firewall_tee_spec.rb | 64 + .../spec/acceptance/firewall_time_spec.rb | 75 + .../spec/acceptance/firewall_uid_spec.rb | 104 + .../spec/acceptance/firewallchain_spec.rb | 127 + .../firewall/spec/acceptance/invert_spec.rb | 61 + .../spec/acceptance/ip6_fragment_spec.rb | 116 + .../spec/acceptance/isfragment_spec.rb | 93 + .../spec/acceptance/match_mark_spec.rb | 57 + .../spec/acceptance/nodesets/centos-7-x64.yml | 10 + .../spec/acceptance/nodesets/debian-8-x64.yml | 10 + .../spec/acceptance/nodesets/default.yml | 10 + .../acceptance/nodesets/docker/centos-7.yml | 12 + .../acceptance/nodesets/docker/debian-8.yml | 11 + .../nodesets/docker/ubuntu-14.04.yml | 12 + .../nodesets/new/aio/debian-8-64mda.yml | 29 + .../nodesets/new/aio/redhat-6-64mda.yml | 28 + .../nodesets/new/aio/redhat-7-64mda.yml | 28 + .../nodesets/new/aio/ubuntu-1404-64mda.yml | 28 + .../nodesets/new/aio/ubuntu-1604-64mda.yml | 28 + .../nodesets/new/pe/centos-5-64mda.yml | 27 + .../nodesets/new/pe/centos-6-64mda.yml | 27 + .../nodesets/new/pe/centos-7-64mda.yml | 27 + .../nodesets/new/pe/debian-6-64mda.yml | 27 + .../nodesets/new/pe/debian-7-64mda.yml | 27 + .../nodesets/new/pe/debian-8-64mda.yml | 28 + .../nodesets/new/pe/oracle-5-64mda.yml | 27 + .../nodesets/new/pe/oracle-6-64mda.yml | 27 + .../nodesets/new/pe/oracle-7-64mda.yml | 27 + .../nodesets/new/pe/redhat-5-64mda.yml | 27 + .../nodesets/new/pe/redhat-6-64mda.yml | 27 + .../nodesets/new/pe/redhat-7-64mda.yml | 27 + .../nodesets/new/pe/scientific-5-64mda.yml | 27 + .../nodesets/new/pe/scientific-6-64mda.yml | 27 + .../nodesets/new/pe/scientific-7-64mda.yml | 27 + .../nodesets/new/pe/sles-10-64mda.yml | 27 + .../nodesets/new/pe/sles-11-64mda.yml | 27 + .../nodesets/new/pe/sles-12-64mda.yml | 27 + .../nodesets/new/pe/ubuntu-1004-64mda.yml | 27 + .../nodesets/new/pe/ubuntu-1204-64mda.yml | 27 + .../nodesets/new/pe/ubuntu-1404-64mda.yml | 27 + .../nodesets/new/pe/ubuntu-1604-64mda.yml | 27 + .../firewall/spec/acceptance/params_spec.rb | 152 + .../firewall/spec/acceptance/purge_spec.rb | 235 + .../spec/acceptance/resource_cmd_spec.rb | 190 + .../firewall/spec/acceptance/rules_spec.rb | 280 ++ .../firewall/spec/acceptance/socket_spec.rb | 98 + .../spec/acceptance/standard_usage_spec.rb | 60 + .../fixtures/ip6tables/conversion_hash.rb | 117 + .../spec/fixtures/iptables/conversion_hash.rb | 1278 +++++ .../modules/firewall/spec/spec_helper.rb | 16 + .../firewall/spec/spec_helper_acceptance.rb | 41 + .../firewall/spec/spec_helper_local.rb | 14 + .../classes/firewall_linux_archlinux_spec.rb | 38 + .../classes/firewall_linux_debian_spec.rb | 87 + .../classes/firewall_linux_gentoo_spec.rb | 41 + .../classes/firewall_linux_redhat_spec.rb | 102 + .../spec/unit/classes/firewall_linux_spec.rb | 46 + .../spec/unit/classes/firewall_spec.rb | 35 + .../iptables_persistent_version_spec.rb | 97 + .../spec/unit/facter/iptables_spec.rb | 23 + .../unit/puppet/provider/ip6tables_spec.rb | 61 + .../puppet/provider/iptables_chain_spec.rb | 237 + .../unit/puppet/provider/iptables_spec.rb | 433 ++ .../spec/unit/puppet/type/firewall_spec.rb | 688 +++ .../unit/puppet/type/firewallchain_spec.rb | 217 + .../spec/unit/puppet/util/firewall_spec.rb | 208 + .../spec/unit/puppet/util/ipcidr_spec.rb | 77 + .../production/modules/inifile/CHANGELOG.md | 265 ++ .../modules/inifile/CONTRIBUTING.md | 218 + .../production/modules/inifile/Gemfile | 41 + .../production/modules/inifile/LICENSE | 202 + .../production/modules/inifile/NOTICE | 19 + .../modules/inifile/README.markdown | 482 ++ .../production/modules/inifile/Rakefile | 42 + .../production/modules/inifile/checksums.json | 46 + .../modules/inifile/examples/ini_setting.pp | 25 + .../inifile/examples/ini_subsetting.pp | 31 + .../parser/functions/create_ini_settings.rb | 90 + .../lib/puppet/provider/ini_setting/ruby.rb | 118 + .../puppet/provider/ini_subsetting/ruby.rb | 86 + .../inifile/lib/puppet/type/ini_setting.rb | 128 + .../inifile/lib/puppet/type/ini_subsetting.rb | 136 + .../lib/puppet/util/external_iterator.rb | 28 + .../inifile/lib/puppet/util/ini_file.rb | 331 ++ .../lib/puppet/util/ini_file/section.rb | 103 + .../inifile/lib/puppet/util/setting_value.rb | 187 + .../production/modules/inifile/metadata.json | 104 + .../spec/acceptance/ini_setting_spec.rb | 320 ++ .../spec/acceptance/ini_subsetting_spec.rb | 336 ++ .../spec/acceptance/nodesets/centos-7-x64.yml | 10 + .../spec/acceptance/nodesets/debian-8-x64.yml | 10 + .../spec/acceptance/nodesets/default.yml | 10 + .../acceptance/nodesets/docker/centos-7.yml | 12 + .../acceptance/nodesets/docker/debian-8.yml | 11 + .../nodesets/docker/ubuntu-14.04.yml | 12 + .../classes/create_ini_settings_test_spec.rb | 25 + .../create_multiple_ini_settings_spec.rb | 5 + .../spec/classes/inherit_test1_spec.rb | 10 + .../manifests/init.pp | 15 + .../modules/inifile/spec/fixtures/tmp/.empty | 0 .../functions/create_ini_settings_spec.rb | 24 + .../production/modules/inifile/spec/spec.opts | 6 + .../modules/inifile/spec/spec_helper.rb | 8 + .../inifile/spec/spec_helper_acceptance.rb | 23 + .../modules/inifile/spec/spec_helper_local.rb | 3 + .../provider/ini_setting/inheritance_spec.rb | 67 + .../puppet/provider/ini_setting/ruby_spec.rb | 1529 ++++++ .../provider/ini_subsetting/ruby_spec.rb | 348 ++ .../spec/unit/puppet/type/ini_setting_spec.rb | 63 + .../unit/puppet/type/ini_subetting_spec.rb | 62 + .../puppet/util/external_iterator_spec.rb | 35 + .../spec/unit/puppet/util/ini_file_spec.rb | 287 ++ .../unit/puppet/util/setting_value_spec.rb | 103 + .../production/modules/mysql/CHANGELOG.md | 770 ++++ .../production/modules/mysql/CONTRIBUTING.md | 218 + environments/production/modules/mysql/Gemfile | 52 + environments/production/modules/mysql/LICENSE | 202 + environments/production/modules/mysql/NOTICE | 18 + .../production/modules/mysql/README.md | 1050 +++++ .../production/modules/mysql/Rakefile | 38 + environments/production/modules/mysql/TODO | 8 + .../production/modules/mysql/checksums.json | 115 + .../modules/mysql/examples/backup.pp | 9 + .../modules/mysql/examples/bindings.pp | 3 + .../production/modules/mysql/examples/java.pp | 1 + .../modules/mysql/examples/mysql_database.pp | 17 + .../modules/mysql/examples/mysql_db.pp | 17 + .../modules/mysql/examples/mysql_grant.pp | 5 + .../modules/mysql/examples/mysql_plugin.pp | 23 + .../modules/mysql/examples/mysql_user.pp | 32 + .../production/modules/mysql/examples/perl.pp | 1 + .../modules/mysql/examples/python.pp | 1 + .../production/modules/mysql/examples/ruby.pp | 1 + .../modules/mysql/examples/server.pp | 3 + .../mysql/examples/server/account_security.pp | 4 + .../modules/mysql/examples/server/config.pp | 3 + .../mysql/lib/facter/mysql_server_id.rb | 9 + .../modules/mysql/lib/facter/mysql_version.rb | 8 + .../mysql/lib/facter/mysqld_version.rb | 5 + .../parser/functions/mysql_deepmerge.rb | 58 + .../puppet/parser/functions/mysql_dirname.rb | 15 + .../puppet/parser/functions/mysql_password.rb | 17 + .../parser/functions/mysql_strip_hash.rb | 21 + .../mysql/lib/puppet/provider/mysql.rb | 115 + .../puppet/provider/mysql_database/mysql.rb | 68 + .../puppet/provider/mysql_datadir/mysql.rb | 78 + .../lib/puppet/provider/mysql_grant/mysql.rb | 176 + .../lib/puppet/provider/mysql_plugin/mysql.rb | 53 + .../lib/puppet/provider/mysql_user/mysql.rb | 197 + .../mysql/lib/puppet/type/mysql_database.rb | 25 + .../mysql/lib/puppet/type/mysql_datadir.rb | 35 + .../mysql/lib/puppet/type/mysql_grant.rb | 103 + .../mysql/lib/puppet/type/mysql_plugin.rb | 17 + .../mysql/lib/puppet/type/mysql_user.rb | 105 + .../mysql/manifests/backup/mysqlbackup.pp | 106 + .../mysql/manifests/backup/mysqldump.pp | 73 + .../mysql/manifests/backup/xtrabackup.pp | 67 + .../modules/mysql/manifests/bindings.pp | 57 + .../mysql/manifests/bindings/client_dev.pp | 15 + .../mysql/manifests/bindings/daemon_dev.pp | 15 + .../modules/mysql/manifests/bindings/java.pp | 11 + .../modules/mysql/manifests/bindings/perl.pp | 11 + .../modules/mysql/manifests/bindings/php.pp | 11 + .../mysql/manifests/bindings/python.pp | 11 + .../modules/mysql/manifests/bindings/ruby.pp | 11 + .../modules/mysql/manifests/client.pp | 29 + .../modules/mysql/manifests/client/install.pp | 14 + .../production/modules/mysql/manifests/db.pp | 72 + .../modules/mysql/manifests/params.pp | 450 ++ .../modules/mysql/manifests/server.pp | 89 + .../manifests/server/account_security.pp | 39 + .../modules/mysql/manifests/server/backup.pp | 55 + .../mysql/manifests/server/binarylog.pp | 22 + .../modules/mysql/manifests/server/config.pp | 56 + .../modules/mysql/manifests/server/install.pp | 13 + .../mysql/manifests/server/installdb.pp | 46 + .../modules/mysql/manifests/server/monitor.pp | 24 + .../mysql/manifests/server/mysqltuner.pp | 52 + .../mysql/manifests/server/providers.pp | 8 + .../mysql/manifests/server/root_password.pp | 46 + .../modules/mysql/manifests/server/service.pp | 58 + .../production/modules/mysql/metadata.json | 80 + .../spec/acceptance/mysql_backup_spec.rb | 205 + .../mysql/spec/acceptance/mysql_db_spec.rb | 65 + .../mysql/spec/acceptance/mysql_helper.rb | 8 + .../spec/acceptance/mysql_server_spec.rb | 107 + .../spec/acceptance/nodesets/centos-7-x64.yml | 10 + .../spec/acceptance/nodesets/debian-8-x64.yml | 10 + .../spec/acceptance/nodesets/default.yml | 10 + .../acceptance/nodesets/docker/centos-7.yml | 12 + .../acceptance/nodesets/docker/debian-8.yml | 11 + .../nodesets/docker/ubuntu-14.04.yml | 12 + .../acceptance/types/mysql_database_spec.rb | 64 + .../spec/acceptance/types/mysql_grant_spec.rb | 578 +++ .../acceptance/types/mysql_plugin_spec.rb | 76 + .../spec/acceptance/types/mysql_user_spec.rb | 146 + .../spec/classes/graceful_failures_spec.rb | 19 + .../mysql/spec/classes/mycnf_template_spec.rb | 86 + .../mysql/spec/classes/mysql_bindings_spec.rb | 32 + .../mysql/spec/classes/mysql_client_spec.rb | 38 + .../mysql_server_account_security_spec.rb | 86 + .../spec/classes/mysql_server_backup_spec.rb | 407 ++ .../spec/classes/mysql_server_monitor_spec.rb | 38 + .../classes/mysql_server_mysqltuner_spec.rb | 46 + .../mysql/spec/classes/mysql_server_spec.rb | 220 + .../mysql/spec/defines/mysql_db_spec.rb | 83 + .../production/modules/mysql/spec/spec.opts | 6 + .../modules/mysql/spec/spec_helper.rb | 8 + .../mysql/spec/spec_helper_acceptance.rb | 66 + .../modules/mysql/spec/spec_helper_local.rb | 3 + .../spec/unit/facter/mysql_server_id_spec.rb | 27 + .../spec/unit/facter/mysql_version_spec.rb | 20 + .../spec/unit/facter/mysqld_version_spec.rb | 20 + .../puppet/functions/mysql_deepmerge_spec.rb | 91 + .../puppet/functions/mysql_password_spec.rb | 37 + .../provider/mysql_database/mysql_spec.rb | 118 + .../provider/mysql_plugin/mysql_spec.rb | 71 + .../puppet/provider/mysql_user/mysql_spec.rb | 345 ++ .../unit/puppet/type/mysql_database_spec.rb | 29 + .../spec/unit/puppet/type/mysql_grant_spec.rb | 74 + .../unit/puppet/type/mysql_plugin_spec.rb | 24 + .../spec/unit/puppet/type/mysql_user_spec.rb | 136 + .../modules/mysql/templates/meb.cnf.erb | 18 + .../modules/mysql/templates/my.cnf.erb | 24 + .../modules/mysql/templates/my.cnf.pass.erb | 11 + .../mysql/templates/mysqlbackup.sh.erb | 104 + .../modules/mysql/templates/xtrabackup.sh.erb | 21 + .../modules/postgresql/CHANGELOG.md | 876 ++++ .../modules/postgresql/CONTRIBUTING.md | 217 + .../production/modules/postgresql/Gemfile | 86 + .../production/modules/postgresql/LICENSE | 202 + .../modules/postgresql/MAINTAINERS.md | 6 + .../production/modules/postgresql/NOTICE | 29 + .../production/modules/postgresql/README.md | 1461 ++++++ .../production/modules/postgresql/Rakefile | 37 + .../modules/postgresql/checksums.json | 124 + .../modules/postgresql/files/RPM-GPG-KEY-PGDG | 30 + .../files/validate_postgresql_connection.sh | 34 + .../postgresql_acls_to_resources_hash.rb | 76 + .../parser/functions/postgresql_escape.rb | 25 + .../parser/functions/postgresql_password.rb | 18 + .../puppet/provider/postgresql_conf/parsed.rb | 42 + .../puppet/provider/postgresql_psql/ruby.rb | 80 + .../postgresql_replication_slot/ruby.rb | 68 + .../lib/puppet/type/postgresql_conf.rb | 29 + .../lib/puppet/type/postgresql_psql.rb | 135 + .../type/postgresql_replication_slot.rb | 16 + .../modules/postgresql/manifests/client.pp | 27 + .../modules/postgresql/manifests/globals.pp | 155 + .../modules/postgresql/manifests/lib/devel.pp | 30 + .../modules/postgresql/manifests/lib/docs.pp | 16 + .../modules/postgresql/manifests/lib/java.pp | 16 + .../modules/postgresql/manifests/lib/perl.pp | 13 + .../postgresql/manifests/lib/python.pp | 13 + .../modules/postgresql/manifests/params.pp | 314 ++ .../modules/postgresql/manifests/repo.pp | 23 + .../manifests/repo/apt_postgresql_org.pp | 28 + .../manifests/repo/yum_postgresql_org.pp | 36 + .../modules/postgresql/manifests/server.pp | 83 + .../postgresql/manifests/server/config.pp | 219 + .../manifests/server/config_entry.pp | 126 + .../postgresql/manifests/server/contrib.pp | 23 + .../postgresql/manifests/server/database.pp | 128 + .../manifests/server/database_grant.pp | 20 + .../modules/postgresql/manifests/server/db.pp | 47 + .../postgresql/manifests/server/extension.pp | 61 + .../postgresql/manifests/server/grant.pp | 294 ++ .../postgresql/manifests/server/grant_role.pp | 51 + .../postgresql/manifests/server/initdb.pp | 142 + .../postgresql/manifests/server/install.pp | 22 + .../postgresql/manifests/server/passwd.pp | 46 + .../manifests/server/pg_hba_rule.pp | 64 + .../manifests/server/pg_ident_rule.pp | 27 + .../postgresql/manifests/server/plperl.pp | 19 + .../postgresql/manifests/server/plpython.pp | 19 + .../postgresql/manifests/server/postgis.pp | 24 + .../postgresql/manifests/server/recovery.pp | 38 + .../postgresql/manifests/server/reload.pp | 14 + .../postgresql/manifests/server/role.pp | 124 + .../postgresql/manifests/server/schema.pp | 63 + .../postgresql/manifests/server/service.pp | 46 + .../manifests/server/table_grant.pp | 26 + .../postgresql/manifests/server/tablespace.pp | 56 + .../manifests/validate_db_connection.pp | 92 + .../modules/postgresql/metadata.json | 73 + .../spec/acceptance/00-utf8_encoding_spec.rb | 37 + .../spec/acceptance/alternative_port_spec.rb | 28 + .../postgresql/spec/acceptance/db_spec.rb | 54 + .../acceptance/default_parameters_spec.rb | 28 + .../spec/acceptance/nodesets/centos-7-x64.yml | 10 + .../spec/acceptance/nodesets/debian-8-x64.yml | 10 + .../spec/acceptance/nodesets/default.yml | 10 + .../acceptance/nodesets/docker/centos-7.yml | 12 + .../acceptance/nodesets/docker/debian-8.yml | 11 + .../nodesets/docker/ubuntu-14.04.yml | 12 + .../spec/acceptance/postgresql_psql_spec.rb | 183 + .../spec/acceptance/remote_access_spec.rb | 72 + .../acceptance/server/config_entry_spec.rb | 38 + .../spec/acceptance/server/grant_role_spec.rb | 230 + .../spec/acceptance/server/grant_spec.rb | 306 ++ .../spec/acceptance/server/recovery_spec.rb | 61 + .../spec/acceptance/server/schema_spec.rb | 56 + .../acceptance/z_alternative_pgdata_spec.rb | 34 + .../modules/postgresql/spec/spec_helper.rb | 8 + .../postgresql/spec/spec_helper_acceptance.rb | 92 + .../postgresql/spec/spec_helper_local.rb | 14 + .../spec/unit/classes/client_spec.rb | 58 + .../spec/unit/classes/globals_spec.rb | 87 + .../spec/unit/classes/lib/devel_spec.rb | 73 + .../spec/unit/classes/lib/java_spec.rb | 43 + .../spec/unit/classes/lib/perl_spec.rb | 31 + .../spec/unit/classes/lib/pgdocs_spec.rb | 29 + .../spec/unit/classes/lib/python_spec.rb | 31 + .../spec/unit/classes/params_spec.rb | 12 + .../postgresql/spec/unit/classes/repo_spec.rb | 19 + .../spec/unit/classes/server/config_spec.rb | 136 + .../spec/unit/classes/server/contrib_spec.rb | 59 + .../spec/unit/classes/server/initdb_spec.rb | 127 + .../spec/unit/classes/server/plperl_spec.rb | 47 + .../spec/unit/classes/server/plpython_spec.rb | 48 + .../spec/unit/classes/server/postgis_spec.rb | 44 + .../spec/unit/classes/server_spec.rb | 160 + .../unit/defines/server/config_entry_spec.rb | 136 + .../defines/server/database_grant_spec.rb | 34 + .../spec/unit/defines/server/database_spec.rb | 78 + .../spec/unit/defines/server/db_spec.rb | 58 + .../unit/defines/server/extension_spec.rb | 130 + .../unit/defines/server/grant_role_spec.rb | 161 + .../spec/unit/defines/server/grant_spec.rb | 155 + .../unit/defines/server/pg_hba_rule_spec.rb | 198 + .../unit/defines/server/pg_ident_rule_spec.rb | 66 + .../spec/unit/defines/server/recovery_spec.rb | 113 + .../spec/unit/defines/server/role_spec.rb | 135 + .../spec/unit/defines/server/schema_spec.rb | 43 + .../unit/defines/server/table_grant_spec.rb | 35 + .../unit/defines/server/tablespace_spec.rb | 42 + .../defines/validate_db_connection_spec.rb | 72 + .../postgresql_acls_to_resources_hash_spec.rb | 137 + .../unit/functions/postgresql_escape_spec.rb | 14 + .../functions/postgresql_password_spec.rb | 8 + .../provider/postgresql_conf/parsed_spec.rb | 147 + .../provider/postgresql_psql/ruby_spec.rb | 104 + .../postgresql_replication_slot/ruby_spec.rb | 92 + .../unit/puppet/type/postgresql_psql_spec.rb | 251 + .../type/postgresql_replication_slot_spec.rb | 11 + .../spec/unit/type/postgresql_conf_spec.rb | 50 + .../postgresql/templates/pg_hba_rule.conf | 5 + .../postgresql/templates/pg_ident_rule.conf | 5 + .../postgresql/templates/recovery.conf.erb | 47 + .../postgresql/templates/systemd-override.erb | 14 + .../production/modules/puppetdb/CHANGELOG | 482 ++ .../production/modules/puppetdb/LICENSE | 202 + .../production/modules/puppetdb/NOTICE | 5 + .../production/modules/puppetdb/README.md | 948 ++++ .../modules/puppetdb/checksums.json | 33 + ...uppetdb_create_subsetting_resource_hash.rb | 15 + .../functions/puppetdb_flatten_java_args.rb | 8 + .../puppetdb_conn_validator/puppet_https.rb | 72 + .../puppet/type/puppetdb_conn_validator.rb | 49 + .../lib/puppet/util/puppetdb_validator.rb | 45 + .../puppetdb/manifests/database/postgresql.pp | 33 + .../modules/puppetdb/manifests/globals.pp | 11 + .../modules/puppetdb/manifests/init.pp | 161 + .../puppetdb/manifests/master/config.pp | 184 + .../manifests/master/puppetdb_conf.pp | 43 + .../manifests/master/report_processor.pp | 28 + .../puppetdb/manifests/master/routes.pp | 43 + .../puppetdb/manifests/master/storeconfigs.pp | 29 + .../modules/puppetdb/manifests/params.pp | 167 + .../modules/puppetdb/manifests/server.pp | 300 ++ .../manifests/server/command_processing.pp | 58 + .../puppetdb/manifests/server/database.pp | 150 + .../puppetdb/manifests/server/firewall.pp | 25 + .../puppetdb/manifests/server/global.pp | 21 + .../puppetdb/manifests/server/jetty.pp | 100 + .../puppetdb/manifests/server/puppetdb.pp | 36 + .../manifests/server/read_database.pp | 134 + .../puppetdb/manifests/server/validate_db.pp | 25 + .../manifests/server/validate_read_db.pp | 25 + .../production/modules/puppetdb/metadata.json | 79 + .../templates/certificate-whitelist.erb | 3 + .../puppetdb/templates/routes.yaml.erb | 3 + .../production/modules/puppetexplorer/Gemfile | 16 + .../modules/puppetexplorer/README.md | 107 + .../modules/puppetexplorer/Rakefile | 42 + .../modules/puppetexplorer/checksums.json | 21 + .../files/RPM-GPG-KEY-puppetexplorer | 32 + .../puppetexplorer/manifests/apache.pp | 19 + .../modules/puppetexplorer/manifests/init.pp | 215 + .../modules/puppetexplorer/metadata.json | 28 + .../acceptance/classes/puppetexplorer_spec.rb | 35 + .../spec/acceptance/nodesets/centos-7.yml | 13 + .../spec/acceptance/nodesets/debian-7.yml | 12 + .../spec/acceptance/nodesets/default.yml | 12 + .../spec/acceptance/nodesets/ubuntu-1404.yml | 12 + .../spec/acceptance/nodesets/ubuntu-1604.yml | 12 + .../puppetexplorer/spec/classes/init_spec.rb | 46 + .../puppetexplorer/spec/spec_helper.rb | 27 + .../spec/spec_helper_acceptance.rb | 26 + .../puppetexplorer/templates/config.js.erb | 19 + .../puppetexplorer/tests/basic_auth.pp | 31 + .../modules/puppetexplorer/tests/init.pp | 12 + .../production/modules/staging/CHANGELOG.md | 30 + .../modules/staging/CONTRIBUTING.md | 97 + .../production/modules/staging/Gemfile | 68 + .../production/modules/staging/LICENSE | 11 + .../production/modules/staging/README.md | 79 + .../production/modules/staging/Rakefile | 33 + .../production/modules/staging/checksums.json | 60 + .../modules/staging/docs/deploy.html | 113 + .../modules/staging/docs/extract.html | 176 + .../production/modules/staging/docs/file.html | 178 + .../production/modules/staging/docs/init.html | 87 + .../modules/staging/examples/deploy.pp | 4 + .../modules/staging/examples/extract.pp | 25 + .../modules/staging/examples/file.pp | 17 + .../modules/staging/examples/init.pp | 1 + .../staging/examples/scope_defaults.pp | 7 + .../modules/staging/examples/staging_parse.pp | 12 + .../production/modules/staging/files/sample | 1 + .../modules/staging/files/sample.tar.bz2 | Bin 0 -> 27984 bytes .../modules/staging/files/sample.tar.gz | Bin 0 -> 33352 bytes .../staging/lib/facter/staging_http_get.rb | 27 + .../staging/lib/facter/staging_windir.rb | 11 + .../puppet/parser/functions/scope_defaults.rb | 18 + .../puppet/parser/functions/staging_parse.rb | 39 + .../modules/staging/manifests/deploy.pp | 59 + .../modules/staging/manifests/extract.pp | 126 + .../modules/staging/manifests/file.pp | 166 + .../modules/staging/manifests/init.pp | 34 + .../modules/staging/manifests/params.pp | 40 + .../production/modules/staging/metadata.json | 115 + .../acceptance/nodesets/centos-511-x64.yml | 15 + .../acceptance/nodesets/centos-66-x64-pe.yml | 17 + .../acceptance/nodesets/centos-66-x64.yml | 15 + .../acceptance/nodesets/centos-72-x64.yml | 15 + .../acceptance/nodesets/debian-78-x64.yml | 15 + .../acceptance/nodesets/debian-82-x64.yml | 15 + .../acceptance/nodesets/docker/centos-5.yml | 19 + .../acceptance/nodesets/docker/centos-6.yml | 20 + .../acceptance/nodesets/docker/centos-7.yml | 18 + .../acceptance/nodesets/docker/debian-7.yml | 19 + .../acceptance/nodesets/docker/debian-8.yml | 20 + .../nodesets/docker/ubuntu-12.04.yml | 19 + .../nodesets/docker/ubuntu-14.04.yml | 21 + .../nodesets/docker/ubuntu-16.04.yml | 19 + .../acceptance/nodesets/fedora-24-x64.yml | 15 + .../acceptance/nodesets/fedora-25-x64.yml | 18 + .../nodesets/ubuntu-server-1204-x64.yml | 15 + .../nodesets/ubuntu-server-1404-x64.yml | 15 + .../nodesets/ubuntu-server-1604-x64.yml | 15 + .../staging/spec/classes/coverage_spec.rb | 4 + .../modules/staging/spec/default_facts.yml | 14 + .../spec/defines/staging_deploy_spec.rb | 104 + .../spec/defines/staging_extract_spec.rb | 175 + .../staging/spec/defines/staging_file_spec.rb | 219 + .../modules/staging/spec/fixtures/hiera.yaml | 9 + .../production/modules/staging/spec/spec.opts | 6 + .../modules/staging/spec/spec_helper.rb | 32 + .../parser/functions/scope_defaults_spec.rb | 45 + .../parser/functions/staging_parse_spec.rb | 51 + .../production/modules/stdlib/CHANGELOG.md | 775 ++++ .../production/modules/stdlib/CONTRIBUTING.md | 217 + .../production/modules/stdlib/Gemfile | 86 + .../production/modules/stdlib/LICENSE | 202 + .../production/modules/stdlib/MAINTAINERS.md | 6 + environments/production/modules/stdlib/NOTICE | 23 + .../production/modules/stdlib/README.markdown | 1791 +++++++ .../modules/stdlib/README_DEVELOPER.markdown | 35 + .../modules/stdlib/README_SPECS.markdown | 7 + .../modules/stdlib/RELEASE_PROCESS.markdown | 24 + .../production/modules/stdlib/Rakefile | 37 + .../production/modules/stdlib/appveyor.yml | 40 + .../production/modules/stdlib/checksums.json | 508 ++ .../modules/stdlib/examples/file_line.pp | 9 + .../stdlib/examples/has_interface_with.pp | 9 + .../modules/stdlib/examples/has_ip_address.pp | 3 + .../modules/stdlib/examples/has_ip_network.pp | 3 + .../modules/stdlib/examples/init.pp | 1 + .../modules/stdlib/lib/facter/facter_dot_d.rb | 202 + .../stdlib/lib/facter/package_provider.rb | 21 + .../modules/stdlib/lib/facter/pe_version.rb | 58 + .../stdlib/lib/facter/puppet_settings.rb | 43 + .../modules/stdlib/lib/facter/root_home.rb | 45 + .../stdlib/lib/facter/service_provider.rb | 17 + .../stdlib/lib/facter/util/puppet_settings.rb | 21 + .../lib/puppet/functions/deprecation.rb | 29 + .../stdlib/lib/puppet/functions/is_a.rb | 32 + .../lib/puppet/functions/is_absolute_path.rb | 15 + .../stdlib/lib/puppet/functions/is_array.rb | 15 + .../stdlib/lib/puppet/functions/is_bool.rb | 15 + .../stdlib/lib/puppet/functions/is_float.rb | 15 + .../lib/puppet/functions/is_ip_address.rb | 15 + .../lib/puppet/functions/is_ipv4_address.rb | 15 + .../lib/puppet/functions/is_ipv6_address.rb | 15 + .../stdlib/lib/puppet/functions/is_numeric.rb | 15 + .../stdlib/lib/puppet/functions/is_string.rb | 15 + .../stdlib/lib/puppet/functions/length.rb | 14 + .../stdlib/lib/puppet/functions/type_of.rb | 19 + .../functions/validate_absolute_path.rb | 15 + .../lib/puppet/functions/validate_array.rb | 15 + .../lib/puppet/functions/validate_bool.rb | 15 + .../lib/puppet/functions/validate_hash.rb | 15 + .../lib/puppet/functions/validate_integer.rb | 15 + .../puppet/functions/validate_ip_address.rb | 15 + .../puppet/functions/validate_ipv4_address.rb | 15 + .../puppet/functions/validate_ipv6_address.rb | 15 + .../lib/puppet/functions/validate_legacy.rb | 62 + .../lib/puppet/functions/validate_numeric.rb | 15 + .../lib/puppet/functions/validate_re.rb | 15 + .../lib/puppet/functions/validate_slength.rb | 15 + .../lib/puppet/functions/validate_string.rb | 15 + .../stdlib/lib/puppet/parser/functions/abs.rb | 34 + .../lib/puppet/parser/functions/any2array.rb | 33 + .../lib/puppet/parser/functions/any2bool.rb | 54 + .../puppet/parser/functions/assert_private.rb | 28 + .../lib/puppet/parser/functions/base64.rb | 71 + .../lib/puppet/parser/functions/basename.rb | 34 + .../lib/puppet/parser/functions/bool2num.rb | 25 + .../lib/puppet/parser/functions/bool2str.rb | 44 + .../lib/puppet/parser/functions/camelcase.rb | 32 + .../lib/puppet/parser/functions/capitalize.rb | 30 + .../lib/puppet/parser/functions/ceiling.rb | 22 + .../lib/puppet/parser/functions/chomp.rb | 32 + .../lib/puppet/parser/functions/chop.rb | 34 + .../lib/puppet/parser/functions/clamp.rb | 29 + .../lib/puppet/parser/functions/concat.rb | 40 + .../puppet/parser/functions/convert_base.rb | 35 + .../lib/puppet/parser/functions/count.rb | 21 + .../lib/puppet/parser/functions/deep_merge.rb | 44 + .../parser/functions/defined_with_params.rb | 38 + .../lib/puppet/parser/functions/delete.rb | 43 + .../lib/puppet/parser/functions/delete_at.rb | 46 + .../puppet/parser/functions/delete_regex.rb | 44 + .../parser/functions/delete_undef_values.rb | 31 + .../puppet/parser/functions/delete_values.rb | 23 + .../puppet/parser/functions/deprecation.rb | 16 + .../lib/puppet/parser/functions/difference.rb | 35 + .../stdlib/lib/puppet/parser/functions/dig.rb | 16 + .../lib/puppet/parser/functions/dig44.rb | 70 + .../lib/puppet/parser/functions/dirname.rb | 21 + .../lib/puppet/parser/functions/dos2unix.rb | 15 + .../lib/puppet/parser/functions/downcase.rb | 31 + .../lib/puppet/parser/functions/empty.rb | 29 + .../puppet/parser/functions/enclose_ipv6.rb | 42 + .../parser/functions/ensure_packages.rb | 47 + .../parser/functions/ensure_resource.rb | 46 + .../parser/functions/ensure_resources.rb | 54 + .../lib/puppet/parser/functions/flatten.rb | 32 + .../lib/puppet/parser/functions/floor.rb | 22 + .../parser/functions/fqdn_rand_string.rb | 34 + .../puppet/parser/functions/fqdn_rotate.rb | 61 + .../lib/puppet/parser/functions/fqdn_uuid.rb | 92 + .../parser/functions/get_module_path.rb | 17 + .../lib/puppet/parser/functions/getparam.rb | 35 + .../lib/puppet/parser/functions/getvar.rb | 35 + .../lib/puppet/parser/functions/grep.rb | 32 + .../parser/functions/has_interface_with.rb | 70 + .../puppet/parser/functions/has_ip_address.rb | 24 + .../puppet/parser/functions/has_ip_network.rb | 24 + .../lib/puppet/parser/functions/has_key.rb | 28 + .../lib/puppet/parser/functions/hash.rb | 39 + .../puppet/parser/functions/intersection.rb | 33 + .../parser/functions/is_absolute_path.rb | 50 + .../lib/puppet/parser/functions/is_array.rb | 21 + .../lib/puppet/parser/functions/is_bool.rb | 21 + .../puppet/parser/functions/is_domain_name.rb | 53 + .../parser/functions/is_email_address.rb | 20 + .../lib/puppet/parser/functions/is_float.rb | 31 + .../parser/functions/is_function_available.rb | 25 + .../lib/puppet/parser/functions/is_hash.rb | 21 + .../lib/puppet/parser/functions/is_integer.rb | 46 + .../puppet/parser/functions/is_ip_address.rb | 33 + .../parser/functions/is_ipv4_address.rb | 29 + .../parser/functions/is_ipv6_address.rb | 29 + .../puppet/parser/functions/is_mac_address.rb | 26 + .../lib/puppet/parser/functions/is_numeric.rb | 74 + .../lib/puppet/parser/functions/is_string.rb | 28 + .../lib/puppet/parser/functions/join.rb | 40 + .../parser/functions/join_keys_to_values.rb | 53 + .../lib/puppet/parser/functions/keys.rb | 25 + .../parser/functions/load_module_metadata.rb | 24 + .../lib/puppet/parser/functions/loadjson.rb | 34 + .../lib/puppet/parser/functions/loadyaml.rb | 34 + .../lib/puppet/parser/functions/lstrip.rb | 30 + .../stdlib/lib/puppet/parser/functions/max.rb | 20 + .../lib/puppet/parser/functions/member.rb | 60 + .../lib/puppet/parser/functions/merge.rb | 34 + .../stdlib/lib/puppet/parser/functions/min.rb | 20 + .../lib/puppet/parser/functions/num2bool.rb | 42 + .../lib/puppet/parser/functions/parsejson.rb | 29 + .../lib/puppet/parser/functions/parseyaml.rb | 33 + .../lib/puppet/parser/functions/pick.rb | 29 + .../puppet/parser/functions/pick_default.rb | 35 + .../lib/puppet/parser/functions/prefix.rb | 51 + .../lib/puppet/parser/functions/private.rb | 17 + .../stdlib/lib/puppet/parser/functions/pry.rb | 30 + .../lib/puppet/parser/functions/pw_hash.rb | 59 + .../lib/puppet/parser/functions/range.rb | 85 + .../puppet/parser/functions/regexpescape.rb | 29 + .../lib/puppet/parser/functions/reject.rb | 31 + .../lib/puppet/parser/functions/reverse.rb | 25 + .../lib/puppet/parser/functions/rstrip.rb | 29 + .../puppet/parser/functions/seeded_rand.rb | 22 + .../puppet/parser/functions/shell_escape.rb | 29 + .../lib/puppet/parser/functions/shell_join.rb | 30 + .../puppet/parser/functions/shell_split.rb | 25 + .../lib/puppet/parser/functions/shuffle.rb | 43 + .../lib/puppet/parser/functions/size.rb | 46 + .../lib/puppet/parser/functions/sort.rb | 27 + .../lib/puppet/parser/functions/squeeze.rb | 35 + .../lib/puppet/parser/functions/str2bool.rb | 44 + .../parser/functions/str2saltedsha512.rb | 31 + .../lib/puppet/parser/functions/strftime.rb | 106 + .../lib/puppet/parser/functions/strip.rb | 36 + .../lib/puppet/parser/functions/suffix.rb | 52 + .../lib/puppet/parser/functions/swapcase.rb | 37 + .../lib/puppet/parser/functions/time.rb | 49 + .../lib/puppet/parser/functions/to_bytes.rb | 30 + .../puppet/parser/functions/try_get_value.rb | 53 + .../lib/puppet/parser/functions/type.rb | 19 + .../lib/puppet/parser/functions/type3x.rb | 50 + .../lib/puppet/parser/functions/union.rb | 28 + .../lib/puppet/parser/functions/unique.rb | 48 + .../lib/puppet/parser/functions/unix2dos.rb | 15 + .../lib/puppet/parser/functions/upcase.rb | 44 + .../lib/puppet/parser/functions/uriescape.rb | 33 + .../functions/validate_absolute_path.rb | 54 + .../puppet/parser/functions/validate_array.rb | 35 + .../parser/functions/validate_augeas.rb | 83 + .../puppet/parser/functions/validate_bool.rb | 37 + .../puppet/parser/functions/validate_cmd.rb | 63 + .../functions/validate_email_address.rb | 31 + .../puppet/parser/functions/validate_hash.rb | 35 + .../parser/functions/validate_integer.rb | 134 + .../parser/functions/validate_ip_address.rb | 52 + .../parser/functions/validate_ipv4_address.rb | 50 + .../parser/functions/validate_ipv6_address.rb | 51 + .../parser/functions/validate_numeric.rb | 96 + .../puppet/parser/functions/validate_re.rb | 50 + .../parser/functions/validate_slength.rb | 71 + .../parser/functions/validate_string.rb | 41 + .../functions/validate_x509_rsa_key_pair.rb | 47 + .../lib/puppet/parser/functions/values.rb | 38 + .../lib/puppet/parser/functions/values_at.rb | 93 + .../stdlib/lib/puppet/parser/functions/zip.rb | 38 + .../lib/puppet/provider/file_line/ruby.rb | 132 + .../modules/stdlib/lib/puppet/type/anchor.rb | 46 + .../stdlib/lib/puppet/type/file_line.rb | 146 + .../modules/stdlib/manifests/init.pp | 18 + .../modules/stdlib/manifests/stages.pp | 43 + .../production/modules/stdlib/metadata.json | 112 + .../stdlib/spec/acceptance/abs_spec.rb | 30 + .../stdlib/spec/acceptance/anchor_spec.rb | 26 + .../stdlib/spec/acceptance/any2array_spec.rb | 49 + .../stdlib/spec/acceptance/base64_spec.rb | 18 + .../stdlib/spec/acceptance/bool2num_spec.rb | 34 + .../stdlib/spec/acceptance/build_csv.rb | 83 + .../stdlib/spec/acceptance/capitalize_spec.rb | 33 + .../stdlib/spec/acceptance/ceiling_spec.rb | 39 + .../stdlib/spec/acceptance/chomp_spec.rb | 21 + .../stdlib/spec/acceptance/chop_spec.rb | 45 + .../stdlib/spec/acceptance/clamp_spec.rb | 40 + .../stdlib/spec/acceptance/concat_spec.rb | 54 + .../stdlib/spec/acceptance/count_spec.rb | 30 + .../stdlib/spec/acceptance/deep_merge_spec.rb | 20 + .../acceptance/defined_with_params_spec.rb | 22 + .../stdlib/spec/acceptance/delete_at_spec.rb | 19 + .../stdlib/spec/acceptance/delete_spec.rb | 19 + .../acceptance/delete_undef_values_spec.rb | 19 + .../spec/acceptance/delete_values_spec.rb | 25 + .../spec/acceptance/deprecation_spec.rb | 102 + .../stdlib/spec/acceptance/difference_spec.rb | 26 + .../stdlib/spec/acceptance/dirname_spec.rb | 42 + .../stdlib/spec/acceptance/downcase_spec.rb | 39 + .../stdlib/spec/acceptance/empty_spec.rb | 53 + .../spec/acceptance/ensure_resource_spec.rb | 30 + .../stdlib/spec/acceptance/flatten_spec.rb | 39 + .../stdlib/spec/acceptance/floor_spec.rb | 39 + .../spec/acceptance/fqdn_rand_string_spec.rb | 66 + .../spec/acceptance/fqdn_rotate_spec.rb | 64 + .../spec/acceptance/get_module_path_spec.rb | 27 + .../stdlib/spec/acceptance/getparam_spec.rb | 24 + .../stdlib/spec/acceptance/getvar_spec.rb | 26 + .../stdlib/spec/acceptance/grep_spec.rb | 26 + .../acceptance/has_interface_with_spec.rb | 54 + .../spec/acceptance/has_ip_address_spec.rb | 33 + .../spec/acceptance/has_ip_network_spec.rb | 33 + .../stdlib/spec/acceptance/has_key_spec.rb | 41 + .../stdlib/spec/acceptance/hash_spec.rb | 26 + .../spec/acceptance/intersection_spec.rb | 27 + .../stdlib/spec/acceptance/is_a_spec.rb | 30 + .../stdlib/spec/acceptance/is_array_spec.rb | 67 + .../stdlib/spec/acceptance/is_bool_spec.rb | 81 + .../spec/acceptance/is_domain_name_spec.rb | 83 + .../stdlib/spec/acceptance/is_float_spec.rb | 86 + .../acceptance/is_function_available_spec.rb | 58 + .../stdlib/spec/acceptance/is_hash_spec.rb | 63 + .../stdlib/spec/acceptance/is_integer_spec.rb | 95 + .../spec/acceptance/is_ip_address_spec.rb | 80 + .../spec/acceptance/is_ipv4_address_spec.rb | 52 + .../spec/acceptance/is_ipv6_address_spec.rb | 66 + .../spec/acceptance/is_mac_address_spec.rb | 38 + .../stdlib/spec/acceptance/is_numeric_spec.rb | 95 + .../stdlib/spec/acceptance/is_string_spec.rb | 113 + .../acceptance/join_keys_to_values_spec.rb | 24 + .../stdlib/spec/acceptance/join_spec.rb | 26 + .../stdlib/spec/acceptance/keys_spec.rb | 23 + .../stdlib/spec/acceptance/loadjson_spec.rb | 52 + .../stdlib/spec/acceptance/loadyaml_spec.rb | 56 + .../stdlib/spec/acceptance/lstrip_spec.rb | 34 + .../stdlib/spec/acceptance/max_spec.rb | 20 + .../stdlib/spec/acceptance/member_spec.rb | 54 + .../stdlib/spec/acceptance/merge_spec.rb | 23 + .../stdlib/spec/acceptance/min_spec.rb | 20 + .../spec/acceptance/nodesets/centos-7-x64.yml | 10 + .../spec/acceptance/nodesets/debian-8-x64.yml | 10 + .../spec/acceptance/nodesets/default.yml | 10 + .../acceptance/nodesets/docker/centos-7.yml | 12 + .../acceptance/nodesets/docker/debian-8.yml | 11 + .../nodesets/docker/ubuntu-14.04.yml | 12 + .../stdlib/spec/acceptance/num2bool_spec.rb | 76 + .../stdlib/spec/acceptance/parsejson_spec.rb | 55 + .../stdlib/spec/acceptance/parseyaml_spec.rb | 58 + .../spec/acceptance/pick_default_spec.rb | 54 + .../stdlib/spec/acceptance/pick_spec.rb | 44 + .../stdlib/spec/acceptance/prefix_spec.rb | 42 + .../stdlib/spec/acceptance/pw_hash_spec.rb | 34 + .../stdlib/spec/acceptance/range_spec.rb | 36 + .../stdlib/spec/acceptance/reject_spec.rb | 42 + .../stdlib/spec/acceptance/reverse_spec.rb | 23 + .../stdlib/spec/acceptance/rstrip_spec.rb | 34 + .../stdlib/spec/acceptance/shuffle_spec.rb | 34 + .../stdlib/spec/acceptance/size_spec.rb | 55 + .../stdlib/spec/acceptance/sort_spec.rb | 34 + .../stdlib/spec/acceptance/squeeze_spec.rb | 47 + .../stdlib/spec/acceptance/str2bool_spec.rb | 31 + .../spec/acceptance/str2saltedsha512_spec.rb | 22 + .../stdlib/spec/acceptance/strftime_spec.rb | 22 + .../stdlib/spec/acceptance/strip_spec.rb | 34 + .../stdlib/spec/acceptance/suffix_spec.rb | 42 + .../stdlib/spec/acceptance/swapcase_spec.rb | 22 + .../stdlib/spec/acceptance/time_spec.rb | 36 + .../stdlib/spec/acceptance/to_bytes_spec.rb | 27 + .../spec/acceptance/try_get_value_spec.rb | 47 + .../stdlib/spec/acceptance/type_spec.rb | 37 + .../stdlib/spec/acceptance/union_spec.rb | 25 + .../stdlib/spec/acceptance/unique_spec.rb | 33 + .../stdlib/spec/acceptance/upcase_spec.rb | 33 + .../stdlib/spec/acceptance/uriescape_spec.rb | 23 + .../acceptance/validate_absolute_path_spec.rb | 31 + .../spec/acceptance/validate_array_spec.rb | 37 + .../spec/acceptance/validate_augeas_spec.rb | 63 + .../spec/acceptance/validate_bool_spec.rb | 37 + .../spec/acceptance/validate_cmd_spec.rb | 52 + .../spec/acceptance/validate_hash_spec.rb | 37 + .../acceptance/validate_ipv4_address_spec.rb | 31 + .../acceptance/validate_ipv6_address_spec.rb | 31 + .../spec/acceptance/validate_re_spec.rb | 47 + .../spec/acceptance/validate_slength_spec.rb | 72 + .../spec/acceptance/validate_string_spec.rb | 43 + .../stdlib/spec/acceptance/values_at_spec.rb | 73 + .../stdlib/spec/acceptance/values_spec.rb | 30 + .../stdlib/spec/acceptance/zip_spec.rb | 67 + .../stdlib/spec/aliases/absolute_path_spec.rb | 67 + .../stdlib/spec/aliases/absolutepath_spec.rb | 50 + .../modules/stdlib/spec/aliases/array_spec.rb | 34 + .../modules/stdlib/spec/aliases/bool_spec.rb | 32 + .../modules/stdlib/spec/aliases/float_spec.rb | 28 + .../modules/stdlib/spec/aliases/hash_spec.rb | 32 + .../stdlib/spec/aliases/httpsurl_spec.rb | 44 + .../stdlib/spec/aliases/httpurl_spec.rb | 47 + .../stdlib/spec/aliases/integer_spec.rb | 28 + .../modules/stdlib/spec/aliases/ip_address.rb | 34 + .../modules/stdlib/spec/aliases/ipv4_spec.rb | 22 + .../modules/stdlib/spec/aliases/ipv6_spec.rb | 40 + .../stdlib/spec/aliases/numeric_spec.rb | 32 + .../stdlib/spec/aliases/string_spec.rb | 32 + .../stdlib/spec/aliases/unixpath_spec.rb | 47 + .../stdlib/spec/aliases/windowspath_spec.rb | 47 + .../stdlib/spec/fixtures/dscacheutil/root | 8 + .../modules/stdlib/spec/fixtures/lsuser/root | 2 + .../fixtures/test/manifests/absolute_path.pp | 6 + .../fixtures/test/manifests/absolutepath.pp | 6 + .../spec/fixtures/test/manifests/array.pp | 8 + .../spec/fixtures/test/manifests/bool.pp | 8 + .../test/manifests/ensure_resources.pp | 4 + .../spec/fixtures/test/manifests/float.pp | 8 + .../spec/fixtures/test/manifests/hash.pp | 8 + .../spec/fixtures/test/manifests/httpsurl.pp | 6 + .../spec/fixtures/test/manifests/httpurl.pp | 6 + .../spec/fixtures/test/manifests/integer.pp | 8 + .../fixtures/test/manifests/ip_address.pp | 6 + .../spec/fixtures/test/manifests/ipv4.pp | 6 + .../spec/fixtures/test/manifests/ipv6.pp | 6 + .../spec/fixtures/test/manifests/numeric.pp | 8 + .../spec/fixtures/test/manifests/string.pp | 8 + .../spec/fixtures/test/manifests/unixpath.pp | 6 + .../fixtures/test/manifests/windowspath.pp | 6 + .../modules/stdlib/spec/functions/abs_spec.rb | 30 + .../stdlib/spec/functions/any2array_spec.rb | 21 + .../stdlib/spec/functions/any2bool_spec.rb | 42 + .../spec/functions/assert_private_spec.rb | 41 + .../stdlib/spec/functions/base64_spec.rb | 37 + .../stdlib/spec/functions/basename_spec.rb | 19 + .../stdlib/spec/functions/bool2num_spec.rb | 14 + .../stdlib/spec/functions/bool2str_spec.rb | 17 + .../stdlib/spec/functions/camelcase_spec.rb | 17 + .../stdlib/spec/functions/capitalize_spec.rb | 15 + .../stdlib/spec/functions/ceiling_spec.rb | 13 + .../stdlib/spec/functions/chomp_spec.rb | 25 + .../stdlib/spec/functions/chop_spec.rb | 25 + .../stdlib/spec/functions/clamp_spec.rb | 16 + .../stdlib/spec/functions/concat_spec.rb | 29 + .../spec/functions/convert_base_spec.rb | 24 + .../stdlib/spec/functions/count_spec.rb | 23 + .../stdlib/spec/functions/deep_merge_spec.rb | 59 + .../functions/defined_with_params_spec.rb | 40 + .../stdlib/spec/functions/delete_at_spec.rb | 30 + .../spec/functions/delete_regex_spec.rb | 54 + .../stdlib/spec/functions/delete_spec.rb | 76 + .../functions/delete_undef_values_spec.rb | 57 + .../spec/functions/delete_values_spec.rb | 41 + .../stdlib/spec/functions/deprecation_spec.rb | 60 + .../stdlib/spec/functions/difference_spec.rb | 23 + .../stdlib/spec/functions/dig44_spec.rb | 131 + .../modules/stdlib/spec/functions/dig_spec.rb | 13 + .../stdlib/spec/functions/dirname_spec.rb | 18 + .../stdlib/spec/functions/dos2unix_spec.rb | 47 + .../stdlib/spec/functions/downcase_spec.rb | 15 + .../stdlib/spec/functions/empty_spec.rb | 22 + .../spec/functions/ensure_packages_spec.rb | 51 + .../spec/functions/ensure_resource_spec.rb | 117 + .../stdlib/spec/functions/flatten_spec.rb | 15 + .../stdlib/spec/functions/floor_spec.rb | 12 + .../spec/functions/fqdn_rand_string_spec.rb | 66 + .../stdlib/spec/functions/fqdn_rotate_spec.rb | 76 + .../stdlib/spec/functions/fqdn_uuid_spec.rb | 13 + .../spec/functions/get_module_path_spec.rb | 48 + .../stdlib/spec/functions/getparam_spec.rb | 35 + .../stdlib/spec/functions/getvar_spec.rb | 38 + .../stdlib/spec/functions/grep_spec.rb | 20 + .../spec/functions/has_interface_with_spec.rb | 38 + .../spec/functions/has_ip_address_spec.rb | 22 + .../spec/functions/has_ip_network_spec.rb | 21 + .../stdlib/spec/functions/has_key_spec.rb | 20 + .../stdlib/spec/functions/hash_spec.rb | 15 + .../spec/functions/intersection_spec.rb | 22 + .../stdlib/spec/functions/is_a_spec.rb | 30 + .../stdlib/spec/functions/is_array_spec.rb | 36 + .../stdlib/spec/functions/is_bool_spec.rb | 33 + .../spec/functions/is_domain_name_spec.rb | 43 + .../spec/functions/is_email_address_spec.rb | 14 + .../stdlib/spec/functions/is_float_spec.rb | 42 + .../spec/functions/is_function_available.rb | 9 + .../stdlib/spec/functions/is_hash_spec.rb | 11 + .../stdlib/spec/functions/is_integer_spec.rb | 45 + .../spec/functions/is_ip_address_spec.rb | 40 + .../spec/functions/is_ipv4_address_spec.rb | 32 + .../spec/functions/is_ipv6_address_spec.rb | 30 + .../spec/functions/is_mac_address_spec.rb | 30 + .../stdlib/spec/functions/is_numeric_spec.rb | 48 + .../stdlib/spec/functions/is_string_spec.rb | 47 + .../functions/join_keys_to_values_spec.rb | 30 + .../stdlib/spec/functions/join_spec.rb | 20 + .../stdlib/spec/functions/keys_spec.rb | 24 + .../modules/stdlib/spec/functions/length.rb | 35 + .../functions/load_module_metadata_spec.rb | 61 + .../stdlib/spec/functions/loadjson_spec.rb | 66 + .../stdlib/spec/functions/loadyaml_spec.rb | 36 + .../stdlib/spec/functions/lstrip_spec.rb | 35 + .../modules/stdlib/spec/functions/max_spec.rb | 21 + .../stdlib/spec/functions/member_spec.rb | 23 + .../stdlib/spec/functions/merge_spec.rb | 25 + .../modules/stdlib/spec/functions/min_spec.rb | 21 + .../stdlib/spec/functions/num2bool_spec.rb | 22 + .../stdlib/spec/functions/parsejson_spec.rb | 69 + .../stdlib/spec/functions/parseyaml_spec.rb | 86 + .../spec/functions/pick_default_spec.rb | 26 + .../stdlib/spec/functions/pick_spec.rb | 17 + .../stdlib/spec/functions/prefix_spec.rb | 29 + .../stdlib/spec/functions/private_spec.rb | 56 + .../stdlib/spec/functions/pw_hash_spec.rb | 69 + .../stdlib/spec/functions/range_spec.rb | 126 + .../spec/functions/regexpescape_spec.rb | 41 + .../stdlib/spec/functions/reject_spec.rb | 20 + .../stdlib/spec/functions/reverse_spec.rb | 33 + .../stdlib/spec/functions/rstrip_spec.rb | 35 + .../stdlib/spec/functions/seeded_rand_spec.rb | 58 + .../spec/functions/shell_escape_spec.rb | 27 + .../stdlib/spec/functions/shell_join_spec.rb | 28 + .../stdlib/spec/functions/shell_split_spec.rb | 29 + .../stdlib/spec/functions/shuffle_spec.rb | 38 + .../stdlib/spec/functions/size_spec.rb | 38 + .../stdlib/spec/functions/sort_spec.rb | 24 + .../stdlib/spec/functions/squeeze_spec.rb | 50 + .../stdlib/spec/functions/str2bool_spec.rb | 23 + .../spec/functions/str2saltedsha512_spec.rb | 17 + .../stdlib/spec/functions/strftime_spec.rb | 26 + .../stdlib/spec/functions/strip_spec.rb | 35 + .../stdlib/spec/functions/suffix_spec.rb | 40 + .../stdlib/spec/functions/swapcase_spec.rb | 40 + .../stdlib/spec/functions/time_spec.rb | 21 + .../stdlib/spec/functions/to_bytes_spec.rb | 72 + .../spec/functions/try_get_value_spec.rb | 100 + .../stdlib/spec/functions/type3x_spec.rb | 41 + .../stdlib/spec/functions/type_of_spec.rb | 25 + .../stdlib/spec/functions/type_spec.rb | 42 + .../stdlib/spec/functions/union_spec.rb | 25 + .../stdlib/spec/functions/unique_spec.rb | 29 + .../stdlib/spec/functions/unix2dos_spec.rb | 40 + .../stdlib/spec/functions/upcase_spec.rb | 26 + .../stdlib/spec/functions/uriescape_spec.rb | 36 + .../functions/validate_absolute_path_spec.rb | 73 + .../spec/functions/validate_array_spec.rb | 37 + .../spec/functions/validate_augeas_spec.rb | 75 + .../spec/functions/validate_bool_spec.rb | 36 + .../spec/functions/validate_cmd_spec.rb | 35 + .../functions/validate_email_address_spec.rb | 23 + .../spec/functions/validate_hash_spec.rb | 38 + .../spec/functions/validate_integer_spec.rb | 101 + .../functions/validate_ip_address_spec.rb | 65 + .../functions/validate_ipv4_address_spec.rb | 41 + .../functions/validate_ipv6_address_spec.rb | 60 + .../spec/functions/validate_legacy_spec.rb | 68 + .../spec/functions/validate_numeric_spec.rb | 100 + .../stdlib/spec/functions/validate_re_spec.rb | 56 + .../spec/functions/validate_slength_spec.rb | 72 + .../spec/functions/validate_string_spec.rb | 33 + .../validate_x509_rsa_key_pair_spec.rb | 180 + .../stdlib/spec/functions/values_at_spec.rb | 54 + .../stdlib/spec/functions/values_spec.rb | 24 + .../modules/stdlib/spec/functions/zip_spec.rb | 21 + .../monkey_patches/alias_should_to_must.rb | 9 + .../spec/monkey_patches/publicize_methods.rb | 11 + .../modules/stdlib/spec/spec_helper.rb | 8 + .../stdlib/spec/spec_helper_acceptance.rb | 55 + .../modules/stdlib/spec/spec_helper_local.rb | 31 + .../stdlib/spec/support/shared_data.rb | 38 + .../stdlib/spec/unit/ensure_resources_spec.rb | 22 + .../spec/unit/facter/facter_dot_d_spec.rb | 32 + .../spec/unit/facter/package_provider_spec.rb | 44 + .../spec/unit/facter/pe_version_spec.rb | 88 + .../stdlib/spec/unit/facter/root_home_spec.rb | 65 + .../spec/unit/facter/service_provider_spec.rb | 37 + .../unit/facter/util/puppet_settings_spec.rb | 37 + .../parser/functions/enclose_ipv6_spec.rb | 69 + .../parser/functions/is_absolute_path_spec.rb | 86 + .../puppet/provider/file_line/ruby_spec.rb | 447 ++ .../spec/unit/puppet/type/anchor_spec.rb | 11 + .../spec/unit/puppet/type/file_line_spec.rb | 113 + .../modules/stdlib/types/absolutepath.pp | 2 + .../stdlib/types/compat/absolute_path.pp | 7 + .../modules/stdlib/types/compat/array.pp | 2 + .../modules/stdlib/types/compat/bool.pp | 2 + .../modules/stdlib/types/compat/float.pp | 19 + .../modules/stdlib/types/compat/hash.pp | 2 + .../modules/stdlib/types/compat/integer.pp | 23 + .../modules/stdlib/types/compat/ip_address.pp | 1 + .../modules/stdlib/types/compat/ipv4.pp | 2 + .../modules/stdlib/types/compat/ipv6.pp | 1 + .../modules/stdlib/types/compat/numeric.pp | 23 + .../modules/stdlib/types/compat/re.pp | 3 + .../modules/stdlib/types/compat/string.pp | 2 + .../modules/stdlib/types/httpsurl.pp | 1 + .../modules/stdlib/types/httpurl.pp | 1 + .../modules/stdlib/types/unixpath.pp | 2 + .../modules/stdlib/types/windowspath.pp | 1 + prod_env.png | Bin 0 -> 40666 bytes puppet.conf | 15 + reports_enabled.png | Bin 0 -> 72407 bytes user_prev.png | Bin 0 -> 269386 bytes 2152 files changed, 145146 insertions(+) create mode 100644 database.png create mode 100644 environments/prod/manifests/site.pp create mode 100644 environments/prod/modules/mysql/CHANGELOG.md create mode 100644 environments/prod/modules/mysql/CONTRIBUTING.md create mode 100644 environments/prod/modules/mysql/Gemfile create mode 100644 environments/prod/modules/mysql/LICENSE create mode 100644 environments/prod/modules/mysql/NOTICE create mode 100644 environments/prod/modules/mysql/README.md create mode 100644 environments/prod/modules/mysql/Rakefile create mode 100644 environments/prod/modules/mysql/TODO create mode 100644 environments/prod/modules/mysql/checksums.json create mode 100644 environments/prod/modules/mysql/examples/backup.pp create mode 100644 environments/prod/modules/mysql/examples/bindings.pp create mode 100644 environments/prod/modules/mysql/examples/java.pp create mode 100644 environments/prod/modules/mysql/examples/mysql_database.pp create mode 100644 environments/prod/modules/mysql/examples/mysql_db.pp create mode 100644 environments/prod/modules/mysql/examples/mysql_grant.pp create mode 100644 environments/prod/modules/mysql/examples/mysql_plugin.pp create mode 100644 environments/prod/modules/mysql/examples/mysql_user.pp create mode 100644 environments/prod/modules/mysql/examples/perl.pp create mode 100644 environments/prod/modules/mysql/examples/python.pp create mode 100644 environments/prod/modules/mysql/examples/ruby.pp create mode 100644 environments/prod/modules/mysql/examples/server.pp create mode 100644 environments/prod/modules/mysql/examples/server/account_security.pp create mode 100644 environments/prod/modules/mysql/examples/server/config.pp create mode 100644 environments/prod/modules/mysql/lib/facter/mysql_server_id.rb create mode 100644 environments/prod/modules/mysql/lib/facter/mysql_version.rb create mode 100644 environments/prod/modules/mysql/lib/facter/mysqld_version.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_deepmerge.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_dirname.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_password.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_strip_hash.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/provider/mysql.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/provider/mysql_database/mysql.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/provider/mysql_datadir/mysql.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/provider/mysql_grant/mysql.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/provider/mysql_plugin/mysql.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/provider/mysql_user/mysql.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/type/mysql_database.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/type/mysql_datadir.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/type/mysql_grant.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/type/mysql_plugin.rb create mode 100644 environments/prod/modules/mysql/lib/puppet/type/mysql_user.rb create mode 100644 environments/prod/modules/mysql/manifests/backup/mysqlbackup.pp create mode 100644 environments/prod/modules/mysql/manifests/backup/mysqldump.pp create mode 100644 environments/prod/modules/mysql/manifests/backup/xtrabackup.pp create mode 100644 environments/prod/modules/mysql/manifests/bindings.pp create mode 100644 environments/prod/modules/mysql/manifests/bindings/client_dev.pp create mode 100644 environments/prod/modules/mysql/manifests/bindings/daemon_dev.pp create mode 100644 environments/prod/modules/mysql/manifests/bindings/java.pp create mode 100644 environments/prod/modules/mysql/manifests/bindings/perl.pp create mode 100644 environments/prod/modules/mysql/manifests/bindings/php.pp create mode 100644 environments/prod/modules/mysql/manifests/bindings/python.pp create mode 100644 environments/prod/modules/mysql/manifests/bindings/ruby.pp create mode 100644 environments/prod/modules/mysql/manifests/client.pp create mode 100644 environments/prod/modules/mysql/manifests/client/install.pp create mode 100644 environments/prod/modules/mysql/manifests/db.pp create mode 100644 environments/prod/modules/mysql/manifests/params.pp create mode 100644 environments/prod/modules/mysql/manifests/server.pp create mode 100644 environments/prod/modules/mysql/manifests/server/account_security.pp create mode 100644 environments/prod/modules/mysql/manifests/server/backup.pp create mode 100644 environments/prod/modules/mysql/manifests/server/binarylog.pp create mode 100644 environments/prod/modules/mysql/manifests/server/config.pp create mode 100644 environments/prod/modules/mysql/manifests/server/install.pp create mode 100644 environments/prod/modules/mysql/manifests/server/installdb.pp create mode 100644 environments/prod/modules/mysql/manifests/server/monitor.pp create mode 100644 environments/prod/modules/mysql/manifests/server/mysqltuner.pp create mode 100644 environments/prod/modules/mysql/manifests/server/providers.pp create mode 100644 environments/prod/modules/mysql/manifests/server/root_password.pp create mode 100644 environments/prod/modules/mysql/manifests/server/service.pp create mode 100644 environments/prod/modules/mysql/metadata.json create mode 100644 environments/prod/modules/mysql/spec/acceptance/mysql_backup_spec.rb create mode 100644 environments/prod/modules/mysql/spec/acceptance/mysql_db_spec.rb create mode 100644 environments/prod/modules/mysql/spec/acceptance/mysql_helper.rb create mode 100644 environments/prod/modules/mysql/spec/acceptance/mysql_server_spec.rb create mode 100644 environments/prod/modules/mysql/spec/acceptance/nodesets/centos-7-x64.yml create mode 100644 environments/prod/modules/mysql/spec/acceptance/nodesets/debian-8-x64.yml create mode 100644 environments/prod/modules/mysql/spec/acceptance/nodesets/default.yml create mode 100644 environments/prod/modules/mysql/spec/acceptance/nodesets/docker/centos-7.yml create mode 100644 environments/prod/modules/mysql/spec/acceptance/nodesets/docker/debian-8.yml create mode 100644 environments/prod/modules/mysql/spec/acceptance/nodesets/docker/ubuntu-14.04.yml create mode 100644 environments/prod/modules/mysql/spec/acceptance/types/mysql_database_spec.rb create mode 100644 environments/prod/modules/mysql/spec/acceptance/types/mysql_grant_spec.rb create mode 100644 environments/prod/modules/mysql/spec/acceptance/types/mysql_plugin_spec.rb create mode 100644 environments/prod/modules/mysql/spec/acceptance/types/mysql_user_spec.rb create mode 100644 environments/prod/modules/mysql/spec/classes/graceful_failures_spec.rb create mode 100644 environments/prod/modules/mysql/spec/classes/mycnf_template_spec.rb create mode 100644 environments/prod/modules/mysql/spec/classes/mysql_bindings_spec.rb create mode 100644 environments/prod/modules/mysql/spec/classes/mysql_client_spec.rb create mode 100644 environments/prod/modules/mysql/spec/classes/mysql_server_account_security_spec.rb create mode 100644 environments/prod/modules/mysql/spec/classes/mysql_server_backup_spec.rb create mode 100644 environments/prod/modules/mysql/spec/classes/mysql_server_monitor_spec.rb create mode 100644 environments/prod/modules/mysql/spec/classes/mysql_server_mysqltuner_spec.rb create mode 100644 environments/prod/modules/mysql/spec/classes/mysql_server_spec.rb create mode 100644 environments/prod/modules/mysql/spec/defines/mysql_db_spec.rb create mode 100644 environments/prod/modules/mysql/spec/spec.opts create mode 100644 environments/prod/modules/mysql/spec/spec_helper.rb create mode 100644 environments/prod/modules/mysql/spec/spec_helper_acceptance.rb create mode 100644 environments/prod/modules/mysql/spec/spec_helper_local.rb create mode 100644 environments/prod/modules/mysql/spec/unit/facter/mysql_server_id_spec.rb create mode 100644 environments/prod/modules/mysql/spec/unit/facter/mysql_version_spec.rb create mode 100644 environments/prod/modules/mysql/spec/unit/facter/mysqld_version_spec.rb create mode 100644 environments/prod/modules/mysql/spec/unit/puppet/functions/mysql_deepmerge_spec.rb create mode 100644 environments/prod/modules/mysql/spec/unit/puppet/functions/mysql_password_spec.rb create mode 100644 environments/prod/modules/mysql/spec/unit/puppet/provider/mysql_database/mysql_spec.rb create mode 100644 environments/prod/modules/mysql/spec/unit/puppet/provider/mysql_plugin/mysql_spec.rb create mode 100644 environments/prod/modules/mysql/spec/unit/puppet/provider/mysql_user/mysql_spec.rb create mode 100644 environments/prod/modules/mysql/spec/unit/puppet/type/mysql_database_spec.rb create mode 100644 environments/prod/modules/mysql/spec/unit/puppet/type/mysql_grant_spec.rb create mode 100644 environments/prod/modules/mysql/spec/unit/puppet/type/mysql_plugin_spec.rb create mode 100644 environments/prod/modules/mysql/spec/unit/puppet/type/mysql_user_spec.rb create mode 100644 environments/prod/modules/mysql/templates/meb.cnf.erb create mode 100644 environments/prod/modules/mysql/templates/my.cnf.erb create mode 100644 environments/prod/modules/mysql/templates/my.cnf.pass.erb create mode 100755 environments/prod/modules/mysql/templates/mysqlbackup.sh.erb create mode 100644 environments/prod/modules/mysql/templates/xtrabackup.sh.erb create mode 100644 environments/prod/modules/staging/CHANGELOG.md create mode 100644 environments/prod/modules/staging/CONTRIBUTING.md create mode 100644 environments/prod/modules/staging/Gemfile create mode 100644 environments/prod/modules/staging/LICENSE create mode 100644 environments/prod/modules/staging/README.md create mode 100644 environments/prod/modules/staging/Rakefile create mode 100644 environments/prod/modules/staging/checksums.json create mode 100644 environments/prod/modules/staging/docs/deploy.html create mode 100644 environments/prod/modules/staging/docs/extract.html create mode 100644 environments/prod/modules/staging/docs/file.html create mode 100644 environments/prod/modules/staging/docs/init.html create mode 100644 environments/prod/modules/staging/examples/deploy.pp create mode 100644 environments/prod/modules/staging/examples/extract.pp create mode 100644 environments/prod/modules/staging/examples/file.pp create mode 100644 environments/prod/modules/staging/examples/init.pp create mode 100644 environments/prod/modules/staging/examples/scope_defaults.pp create mode 100644 environments/prod/modules/staging/examples/staging_parse.pp create mode 100644 environments/prod/modules/staging/files/sample create mode 100644 environments/prod/modules/staging/files/sample.tar.bz2 create mode 100644 environments/prod/modules/staging/files/sample.tar.gz create mode 100644 environments/prod/modules/staging/lib/facter/staging_http_get.rb create mode 100644 environments/prod/modules/staging/lib/facter/staging_windir.rb create mode 100644 environments/prod/modules/staging/lib/puppet/parser/functions/scope_defaults.rb create mode 100644 environments/prod/modules/staging/lib/puppet/parser/functions/staging_parse.rb create mode 100644 environments/prod/modules/staging/manifests/deploy.pp create mode 100644 environments/prod/modules/staging/manifests/extract.pp create mode 100644 environments/prod/modules/staging/manifests/file.pp create mode 100644 environments/prod/modules/staging/manifests/init.pp create mode 100644 environments/prod/modules/staging/manifests/params.pp create mode 100644 environments/prod/modules/staging/metadata.json create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/centos-511-x64.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/centos-66-x64-pe.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/centos-66-x64.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/centos-72-x64.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/debian-78-x64.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/debian-82-x64.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/docker/centos-5.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/docker/centos-6.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/docker/centos-7.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/docker/debian-7.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/docker/debian-8.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/docker/ubuntu-12.04.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/docker/ubuntu-14.04.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/docker/ubuntu-16.04.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/fedora-24-x64.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/fedora-25-x64.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/ubuntu-server-1204-x64.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml create mode 100644 environments/prod/modules/staging/spec/acceptance/nodesets/ubuntu-server-1604-x64.yml create mode 100644 environments/prod/modules/staging/spec/classes/coverage_spec.rb create mode 100644 environments/prod/modules/staging/spec/default_facts.yml create mode 100644 environments/prod/modules/staging/spec/defines/staging_deploy_spec.rb create mode 100644 environments/prod/modules/staging/spec/defines/staging_extract_spec.rb create mode 100644 environments/prod/modules/staging/spec/defines/staging_file_spec.rb create mode 100644 environments/prod/modules/staging/spec/fixtures/hiera.yaml create mode 100644 environments/prod/modules/staging/spec/spec.opts create mode 100644 environments/prod/modules/staging/spec/spec_helper.rb create mode 100644 environments/prod/modules/staging/spec/unit/puppet/parser/functions/scope_defaults_spec.rb create mode 100644 environments/prod/modules/staging/spec/unit/puppet/parser/functions/staging_parse_spec.rb create mode 100644 environments/prod/modules/stdlib/CHANGELOG.md create mode 100644 environments/prod/modules/stdlib/CONTRIBUTING.md create mode 100644 environments/prod/modules/stdlib/Gemfile create mode 100644 environments/prod/modules/stdlib/LICENSE create mode 100644 environments/prod/modules/stdlib/MAINTAINERS.md create mode 100644 environments/prod/modules/stdlib/NOTICE create mode 100644 environments/prod/modules/stdlib/README.markdown create mode 100644 environments/prod/modules/stdlib/README_DEVELOPER.markdown create mode 100644 environments/prod/modules/stdlib/README_SPECS.markdown create mode 100644 environments/prod/modules/stdlib/RELEASE_PROCESS.markdown create mode 100644 environments/prod/modules/stdlib/Rakefile create mode 100644 environments/prod/modules/stdlib/appveyor.yml create mode 100644 environments/prod/modules/stdlib/checksums.json create mode 100644 environments/prod/modules/stdlib/examples/file_line.pp create mode 100644 environments/prod/modules/stdlib/examples/has_interface_with.pp create mode 100644 environments/prod/modules/stdlib/examples/has_ip_address.pp create mode 100644 environments/prod/modules/stdlib/examples/has_ip_network.pp create mode 100644 environments/prod/modules/stdlib/examples/init.pp create mode 100644 environments/prod/modules/stdlib/lib/facter/facter_dot_d.rb create mode 100644 environments/prod/modules/stdlib/lib/facter/package_provider.rb create mode 100644 environments/prod/modules/stdlib/lib/facter/pe_version.rb create mode 100644 environments/prod/modules/stdlib/lib/facter/puppet_settings.rb create mode 100644 environments/prod/modules/stdlib/lib/facter/root_home.rb create mode 100644 environments/prod/modules/stdlib/lib/facter/service_provider.rb create mode 100644 environments/prod/modules/stdlib/lib/facter/util/puppet_settings.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/deprecation.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/is_a.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/is_absolute_path.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/is_array.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/is_bool.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/is_float.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/is_ip_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/is_ipv4_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/is_ipv6_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/is_numeric.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/is_string.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/length.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/type_of.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/validate_absolute_path.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/validate_array.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/validate_bool.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/validate_hash.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/validate_integer.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/validate_ip_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/validate_ipv4_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/validate_ipv6_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/validate_legacy.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/validate_numeric.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/validate_re.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/validate_slength.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/functions/validate_string.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/abs.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/any2array.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/any2bool.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/assert_private.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/base64.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/basename.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/bool2num.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/bool2str.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/camelcase.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/capitalize.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/ceiling.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/chomp.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/chop.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/clamp.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/concat.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/convert_base.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/count.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/deep_merge.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/defined_with_params.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/delete.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_at.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_regex.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_undef_values.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_values.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/deprecation.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/difference.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/dig.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/dig44.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/dirname.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/dos2unix.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/downcase.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/empty.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/enclose_ipv6.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/ensure_packages.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/ensure_resource.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/ensure_resources.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/flatten.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/floor.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/fqdn_rand_string.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/fqdn_rotate.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/fqdn_uuid.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/get_module_path.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/getparam.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/getvar.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/grep.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/has_interface_with.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/has_ip_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/has_ip_network.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/has_key.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/hash.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/intersection.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_absolute_path.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_array.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_bool.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_domain_name.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_email_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_float.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_function_available.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_hash.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_integer.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_ip_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_ipv4_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_ipv6_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_mac_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_numeric.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/is_string.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/join.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/join_keys_to_values.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/keys.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/load_module_metadata.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/loadjson.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/loadyaml.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/lstrip.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/max.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/member.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/merge.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/min.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/num2bool.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/parsejson.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/parseyaml.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/pick.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/pick_default.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/prefix.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/private.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/pry.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/pw_hash.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/range.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/regexpescape.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/reject.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/reverse.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/rstrip.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/seeded_rand.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/shell_escape.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/shell_join.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/shell_split.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/shuffle.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/size.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/sort.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/squeeze.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/str2bool.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/str2saltedsha512.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/strftime.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/strip.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/suffix.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/swapcase.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/time.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/to_bytes.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/try_get_value.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/type.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/type3x.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/union.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/unique.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/unix2dos.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/upcase.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/uriescape.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_absolute_path.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_array.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_augeas.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_bool.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_cmd.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_email_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_hash.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_integer.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_ip_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_ipv4_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_ipv6_address.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_numeric.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_re.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_slength.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_string.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_x509_rsa_key_pair.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/values.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/values_at.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/parser/functions/zip.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/provider/file_line/ruby.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/type/anchor.rb create mode 100644 environments/prod/modules/stdlib/lib/puppet/type/file_line.rb create mode 100644 environments/prod/modules/stdlib/manifests/init.pp create mode 100644 environments/prod/modules/stdlib/manifests/stages.pp create mode 100644 environments/prod/modules/stdlib/metadata.json create mode 100755 environments/prod/modules/stdlib/spec/acceptance/abs_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/anchor_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/any2array_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/base64_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/bool2num_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/build_csv.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/capitalize_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/ceiling_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/chomp_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/chop_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/clamp_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/concat_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/count_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/deep_merge_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/defined_with_params_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/delete_at_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/delete_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/delete_undef_values_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/delete_values_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/acceptance/deprecation_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/difference_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/dirname_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/downcase_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/empty_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/ensure_resource_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/flatten_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/floor_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/acceptance/fqdn_rand_string_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/fqdn_rotate_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/get_module_path_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/getparam_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/getvar_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/grep_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/has_interface_with_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/has_ip_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/has_ip_network_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/has_key_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/hash_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/intersection_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/acceptance/is_a_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/is_array_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/is_bool_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/is_domain_name_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/is_float_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/is_function_available_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/is_hash_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/is_integer_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/is_ip_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/is_ipv4_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/is_ipv6_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/is_mac_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/is_numeric_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/is_string_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/join_keys_to_values_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/join_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/keys_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/acceptance/loadjson_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/acceptance/loadyaml_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/lstrip_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/max_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/member_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/merge_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/min_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/acceptance/nodesets/centos-7-x64.yml create mode 100644 environments/prod/modules/stdlib/spec/acceptance/nodesets/debian-8-x64.yml create mode 100644 environments/prod/modules/stdlib/spec/acceptance/nodesets/default.yml create mode 100644 environments/prod/modules/stdlib/spec/acceptance/nodesets/docker/centos-7.yml create mode 100644 environments/prod/modules/stdlib/spec/acceptance/nodesets/docker/debian-8.yml create mode 100644 environments/prod/modules/stdlib/spec/acceptance/nodesets/docker/ubuntu-14.04.yml create mode 100755 environments/prod/modules/stdlib/spec/acceptance/num2bool_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/parsejson_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/parseyaml_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/pick_default_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/pick_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/prefix_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/acceptance/pw_hash_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/range_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/reject_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/reverse_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/rstrip_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/shuffle_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/size_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/sort_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/squeeze_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/str2bool_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/str2saltedsha512_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/strftime_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/strip_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/suffix_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/swapcase_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/time_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/to_bytes_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/try_get_value_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/type_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/union_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/unique_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/upcase_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/uriescape_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/validate_absolute_path_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/validate_array_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/validate_augeas_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/validate_bool_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/validate_cmd_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/validate_hash_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/validate_ipv4_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/validate_ipv6_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/validate_re_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/validate_slength_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/validate_string_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/values_at_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/values_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/acceptance/zip_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/absolute_path_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/absolutepath_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/array_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/bool_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/float_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/hash_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/httpsurl_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/httpurl_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/integer_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/ip_address.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/ipv4_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/ipv6_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/numeric_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/string_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/unixpath_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/aliases/windowspath_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/fixtures/dscacheutil/root create mode 100644 environments/prod/modules/stdlib/spec/fixtures/lsuser/root create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/absolute_path.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/absolutepath.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/array.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/bool.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/ensure_resources.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/float.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/hash.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/httpsurl.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/httpurl.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/integer.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/ip_address.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/ipv4.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/ipv6.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/numeric.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/string.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/unixpath.pp create mode 100644 environments/prod/modules/stdlib/spec/fixtures/test/manifests/windowspath.pp create mode 100755 environments/prod/modules/stdlib/spec/functions/abs_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/any2array_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/any2bool_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/assert_private_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/base64_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/basename_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/bool2num_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/bool2str_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/camelcase_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/capitalize_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/ceiling_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/chomp_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/chop_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/clamp_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/concat_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/convert_base_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/count_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/deep_merge_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/defined_with_params_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/delete_at_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/delete_regex_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/delete_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/delete_undef_values_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/delete_values_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/deprecation_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/difference_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/dig44_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/dig_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/dirname_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/dos2unix_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/downcase_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/empty_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/ensure_packages_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/ensure_resource_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/flatten_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/floor_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/fqdn_rand_string_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/fqdn_rotate_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/fqdn_uuid_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/get_module_path_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/getparam_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/getvar_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/grep_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/has_interface_with_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/has_ip_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/has_ip_network_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/has_key_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/hash_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/intersection_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/is_a_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/is_array_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/is_bool_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/is_domain_name_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/is_email_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/is_float_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/is_function_available.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/is_hash_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/is_integer_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/is_ip_address_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/is_ipv4_address_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/is_ipv6_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/is_mac_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/is_numeric_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/is_string_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/join_keys_to_values_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/join_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/keys_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/length.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/load_module_metadata_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/loadjson_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/loadyaml_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/lstrip_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/max_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/member_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/merge_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/min_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/num2bool_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/parsejson_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/parseyaml_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/pick_default_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/pick_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/prefix_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/private_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/pw_hash_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/range_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/regexpescape_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/reject_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/reverse_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/rstrip_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/seeded_rand_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/shell_escape_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/shell_join_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/shell_split_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/shuffle_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/size_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/sort_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/squeeze_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/str2bool_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/str2saltedsha512_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/strftime_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/strip_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/suffix_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/swapcase_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/time_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/to_bytes_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/try_get_value_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/type3x_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/type_of_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/type_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/union_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/unique_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/unix2dos_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/upcase_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/uriescape_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_absolute_path_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_array_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_augeas_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_bool_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_cmd_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/validate_email_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_hash_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_integer_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/validate_ip_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_ipv4_address_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_ipv6_address_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/functions/validate_legacy_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_numeric_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_re_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_slength_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_string_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/validate_x509_rsa_key_pair_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/values_at_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/values_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/functions/zip_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/monkey_patches/alias_should_to_must.rb create mode 100755 environments/prod/modules/stdlib/spec/monkey_patches/publicize_methods.rb create mode 100755 environments/prod/modules/stdlib/spec/spec_helper.rb create mode 100755 environments/prod/modules/stdlib/spec/spec_helper_acceptance.rb create mode 100644 environments/prod/modules/stdlib/spec/spec_helper_local.rb create mode 100644 environments/prod/modules/stdlib/spec/support/shared_data.rb create mode 100644 environments/prod/modules/stdlib/spec/unit/ensure_resources_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/unit/facter/facter_dot_d_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/unit/facter/package_provider_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/unit/facter/pe_version_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/unit/facter/root_home_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/unit/facter/service_provider_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/unit/facter/util/puppet_settings_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb create mode 100644 environments/prod/modules/stdlib/spec/unit/puppet/parser/functions/is_absolute_path_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/unit/puppet/provider/file_line/ruby_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/unit/puppet/type/anchor_spec.rb create mode 100755 environments/prod/modules/stdlib/spec/unit/puppet/type/file_line_spec.rb create mode 100644 environments/prod/modules/stdlib/types/absolutepath.pp create mode 100644 environments/prod/modules/stdlib/types/compat/absolute_path.pp create mode 100644 environments/prod/modules/stdlib/types/compat/array.pp create mode 100644 environments/prod/modules/stdlib/types/compat/bool.pp create mode 100644 environments/prod/modules/stdlib/types/compat/float.pp create mode 100644 environments/prod/modules/stdlib/types/compat/hash.pp create mode 100644 environments/prod/modules/stdlib/types/compat/integer.pp create mode 100644 environments/prod/modules/stdlib/types/compat/ip_address.pp create mode 100644 environments/prod/modules/stdlib/types/compat/ipv4.pp create mode 100644 environments/prod/modules/stdlib/types/compat/ipv6.pp create mode 100644 environments/prod/modules/stdlib/types/compat/numeric.pp create mode 100644 environments/prod/modules/stdlib/types/compat/re.pp create mode 100644 environments/prod/modules/stdlib/types/compat/string.pp create mode 100644 environments/prod/modules/stdlib/types/httpsurl.pp create mode 100644 environments/prod/modules/stdlib/types/httpurl.pp create mode 100644 environments/prod/modules/stdlib/types/unixpath.pp create mode 100644 environments/prod/modules/stdlib/types/windowspath.pp create mode 100644 environments/prod/modules/task13/manifests/mysql.pp create mode 100644 environments/prod/modules/task13/manifests/nginx.pp create mode 100644 environments/production/environment.conf create mode 100644 environments/production/manifests/site.pp create mode 100644 environments/production/modules/apache/CHANGELOG.md create mode 100644 environments/production/modules/apache/CONTRIBUTING.md create mode 100644 environments/production/modules/apache/Gemfile create mode 100644 environments/production/modules/apache/LICENSE create mode 100644 environments/production/modules/apache/NOTICE create mode 100644 environments/production/modules/apache/README.md create mode 100644 environments/production/modules/apache/Rakefile create mode 100644 environments/production/modules/apache/checksums.json create mode 100644 environments/production/modules/apache/examples/apache.pp create mode 100644 environments/production/modules/apache/examples/dev.pp create mode 100644 environments/production/modules/apache/examples/init.pp create mode 100644 environments/production/modules/apache/examples/mod_load_params.pp create mode 100644 environments/production/modules/apache/examples/mods.pp create mode 100644 environments/production/modules/apache/examples/mods_custom.pp create mode 100644 environments/production/modules/apache/examples/php.pp create mode 100644 environments/production/modules/apache/examples/vhost.pp create mode 100644 environments/production/modules/apache/examples/vhost_directories.pp create mode 100644 environments/production/modules/apache/examples/vhost_filter.pp create mode 100644 environments/production/modules/apache/examples/vhost_ip_based.pp create mode 100644 environments/production/modules/apache/examples/vhost_proxypass.pp create mode 100644 environments/production/modules/apache/examples/vhost_ssl.pp create mode 100644 environments/production/modules/apache/examples/vhosts_without_listen.pp create mode 100644 environments/production/modules/apache/files/httpd create mode 100644 environments/production/modules/apache/lib/facter/apache_version.rb create mode 100644 environments/production/modules/apache/lib/puppet/parser/functions/bool2httpd.rb create mode 100644 environments/production/modules/apache/lib/puppet/parser/functions/enclose_ipv6.rb create mode 100644 environments/production/modules/apache/lib/puppet/parser/functions/validate_apache_log_level.rb create mode 100644 environments/production/modules/apache/lib/puppet/provider/a2mod.rb create mode 100644 environments/production/modules/apache/lib/puppet/provider/a2mod/a2mod.rb create mode 100644 environments/production/modules/apache/lib/puppet/provider/a2mod/gentoo.rb create mode 100644 environments/production/modules/apache/lib/puppet/provider/a2mod/modfix.rb create mode 100644 environments/production/modules/apache/lib/puppet/provider/a2mod/redhat.rb create mode 100644 environments/production/modules/apache/lib/puppet/type/a2mod.rb create mode 100644 environments/production/modules/apache/manifests/balancer.pp create mode 100644 environments/production/modules/apache/manifests/balancermember.pp create mode 100644 environments/production/modules/apache/manifests/confd/no_accf.pp create mode 100644 environments/production/modules/apache/manifests/custom_config.pp create mode 100644 environments/production/modules/apache/manifests/default_confd_files.pp create mode 100644 environments/production/modules/apache/manifests/default_mods.pp create mode 100644 environments/production/modules/apache/manifests/default_mods/load.pp create mode 100644 environments/production/modules/apache/manifests/dev.pp create mode 100644 environments/production/modules/apache/manifests/fastcgi/server.pp create mode 100644 environments/production/modules/apache/manifests/init.pp create mode 100644 environments/production/modules/apache/manifests/listen.pp create mode 100644 environments/production/modules/apache/manifests/mod.pp create mode 100644 environments/production/modules/apache/manifests/mod/actions.pp create mode 100644 environments/production/modules/apache/manifests/mod/alias.pp create mode 100644 environments/production/modules/apache/manifests/mod/auth_basic.pp create mode 100644 environments/production/modules/apache/manifests/mod/auth_cas.pp create mode 100644 environments/production/modules/apache/manifests/mod/auth_kerb.pp create mode 100644 environments/production/modules/apache/manifests/mod/auth_mellon.pp create mode 100644 environments/production/modules/apache/manifests/mod/authn_core.pp create mode 100644 environments/production/modules/apache/manifests/mod/authn_dbd.pp create mode 100644 environments/production/modules/apache/manifests/mod/authn_file.pp create mode 100644 environments/production/modules/apache/manifests/mod/authnz_ldap.pp create mode 100644 environments/production/modules/apache/manifests/mod/authz_default.pp create mode 100644 environments/production/modules/apache/manifests/mod/authz_user.pp create mode 100644 environments/production/modules/apache/manifests/mod/autoindex.pp create mode 100644 environments/production/modules/apache/manifests/mod/cache.pp create mode 100644 environments/production/modules/apache/manifests/mod/cgi.pp create mode 100644 environments/production/modules/apache/manifests/mod/cgid.pp create mode 100644 environments/production/modules/apache/manifests/mod/cluster.pp create mode 100644 environments/production/modules/apache/manifests/mod/dav.pp create mode 100644 environments/production/modules/apache/manifests/mod/dav_fs.pp create mode 100644 environments/production/modules/apache/manifests/mod/dav_svn.pp create mode 100644 environments/production/modules/apache/manifests/mod/dbd.pp create mode 100644 environments/production/modules/apache/manifests/mod/deflate.pp create mode 100644 environments/production/modules/apache/manifests/mod/dev.pp create mode 100644 environments/production/modules/apache/manifests/mod/dir.pp create mode 100644 environments/production/modules/apache/manifests/mod/disk_cache.pp create mode 100644 environments/production/modules/apache/manifests/mod/dumpio.pp create mode 100644 environments/production/modules/apache/manifests/mod/env.pp create mode 100644 environments/production/modules/apache/manifests/mod/event.pp create mode 100644 environments/production/modules/apache/manifests/mod/expires.pp create mode 100644 environments/production/modules/apache/manifests/mod/ext_filter.pp create mode 100644 environments/production/modules/apache/manifests/mod/fastcgi.pp create mode 100644 environments/production/modules/apache/manifests/mod/fcgid.pp create mode 100644 environments/production/modules/apache/manifests/mod/filter.pp create mode 100644 environments/production/modules/apache/manifests/mod/geoip.pp create mode 100644 environments/production/modules/apache/manifests/mod/headers.pp create mode 100644 environments/production/modules/apache/manifests/mod/include.pp create mode 100644 environments/production/modules/apache/manifests/mod/info.pp create mode 100644 environments/production/modules/apache/manifests/mod/itk.pp create mode 100644 environments/production/modules/apache/manifests/mod/ldap.pp create mode 100644 environments/production/modules/apache/manifests/mod/mime.pp create mode 100644 environments/production/modules/apache/manifests/mod/mime_magic.pp create mode 100644 environments/production/modules/apache/manifests/mod/negotiation.pp create mode 100644 environments/production/modules/apache/manifests/mod/nss.pp create mode 100644 environments/production/modules/apache/manifests/mod/pagespeed.pp create mode 100644 environments/production/modules/apache/manifests/mod/passenger.pp create mode 100644 environments/production/modules/apache/manifests/mod/perl.pp create mode 100644 environments/production/modules/apache/manifests/mod/peruser.pp create mode 100644 environments/production/modules/apache/manifests/mod/php.pp create mode 100644 environments/production/modules/apache/manifests/mod/prefork.pp create mode 100644 environments/production/modules/apache/manifests/mod/proxy.pp create mode 100644 environments/production/modules/apache/manifests/mod/proxy_ajp.pp create mode 100644 environments/production/modules/apache/manifests/mod/proxy_balancer.pp create mode 100644 environments/production/modules/apache/manifests/mod/proxy_connect.pp create mode 100644 environments/production/modules/apache/manifests/mod/proxy_fcgi.pp create mode 100644 environments/production/modules/apache/manifests/mod/proxy_html.pp create mode 100644 environments/production/modules/apache/manifests/mod/proxy_http.pp create mode 100644 environments/production/modules/apache/manifests/mod/proxy_wstunnel.pp create mode 100644 environments/production/modules/apache/manifests/mod/python.pp create mode 100644 environments/production/modules/apache/manifests/mod/remoteip.pp create mode 100644 environments/production/modules/apache/manifests/mod/reqtimeout.pp create mode 100644 environments/production/modules/apache/manifests/mod/rewrite.pp create mode 100644 environments/production/modules/apache/manifests/mod/rpaf.pp create mode 100644 environments/production/modules/apache/manifests/mod/security.pp create mode 100644 environments/production/modules/apache/manifests/mod/setenvif.pp create mode 100644 environments/production/modules/apache/manifests/mod/shib.pp create mode 100644 environments/production/modules/apache/manifests/mod/socache_shmcb.pp create mode 100644 environments/production/modules/apache/manifests/mod/speling.pp create mode 100644 environments/production/modules/apache/manifests/mod/ssl.pp create mode 100644 environments/production/modules/apache/manifests/mod/status.pp create mode 100644 environments/production/modules/apache/manifests/mod/suexec.pp create mode 100644 environments/production/modules/apache/manifests/mod/suphp.pp create mode 100644 environments/production/modules/apache/manifests/mod/userdir.pp create mode 100644 environments/production/modules/apache/manifests/mod/version.pp create mode 100644 environments/production/modules/apache/manifests/mod/vhost_alias.pp create mode 100644 environments/production/modules/apache/manifests/mod/worker.pp create mode 100644 environments/production/modules/apache/manifests/mod/wsgi.pp create mode 100644 environments/production/modules/apache/manifests/mod/xsendfile.pp create mode 100644 environments/production/modules/apache/manifests/mpm.pp create mode 100644 environments/production/modules/apache/manifests/namevirtualhost.pp create mode 100644 environments/production/modules/apache/manifests/package.pp create mode 100644 environments/production/modules/apache/manifests/params.pp create mode 100644 environments/production/modules/apache/manifests/peruser/multiplexer.pp create mode 100644 environments/production/modules/apache/manifests/peruser/processor.pp create mode 100644 environments/production/modules/apache/manifests/php.pp create mode 100644 environments/production/modules/apache/manifests/proxy.pp create mode 100644 environments/production/modules/apache/manifests/python.pp create mode 100644 environments/production/modules/apache/manifests/security/rule_link.pp create mode 100644 environments/production/modules/apache/manifests/service.pp create mode 100644 environments/production/modules/apache/manifests/ssl.pp create mode 100644 environments/production/modules/apache/manifests/version.pp create mode 100644 environments/production/modules/apache/manifests/vhost.pp create mode 100644 environments/production/modules/apache/manifests/vhost/custom.pp create mode 100644 environments/production/modules/apache/manifests/vhosts.pp create mode 100644 environments/production/modules/apache/metadata.json create mode 100644 environments/production/modules/apache/spec/acceptance/apache_parameters_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/apache_ssl_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/class_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/custom_config_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/default_mods_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/itk_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/mod_dav_svn_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/mod_deflate_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/mod_fcgid_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/mod_mime_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/mod_negotiation_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/mod_pagespeed_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/mod_passenger_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/mod_php_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/mod_proxy_html_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/mod_security_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/mod_suphp_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/nodesets/centos-7-x64.yml create mode 100644 environments/production/modules/apache/spec/acceptance/nodesets/debian-8-x64.yml create mode 100644 environments/production/modules/apache/spec/acceptance/nodesets/default.yml create mode 100644 environments/production/modules/apache/spec/acceptance/nodesets/docker/centos-7.yml create mode 100644 environments/production/modules/apache/spec/acceptance/nodesets/docker/debian-8.yml create mode 100644 environments/production/modules/apache/spec/acceptance/nodesets/docker/ubuntu-14.04.yml create mode 100644 environments/production/modules/apache/spec/acceptance/nodesets/suse.yml create mode 100644 environments/production/modules/apache/spec/acceptance/prefork_worker_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/service_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/version.rb create mode 100644 environments/production/modules/apache/spec/acceptance/vhost_spec.rb create mode 100644 environments/production/modules/apache/spec/acceptance/vhosts_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/apache_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/dev_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/alias_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/auth_cas_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/auth_kerb_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/auth_mellon_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/authn_dbd_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/authnz_ldap_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/cluster_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/dav_svn_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/deflate_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/dev_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/dir_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/disk_cache_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/dumpio_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/event_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/expires_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/ext_filter_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/fastcgi_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/fcgid_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/info_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/itk_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/ldap_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/mime_magic_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/mime_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/negotiation_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/pagespeed_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/passenger_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/perl_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/peruser_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/php_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/prefork_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/proxy_balancer_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/proxy_connect_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/proxy_html_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/proxy_wstunnel.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/python_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/remoteip_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/reqtimeout_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/rpaf_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/security_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/shib_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/speling_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/ssl_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/status_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/suphp_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/worker_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/mod/wsgi_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/params_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/service_spec.rb create mode 100644 environments/production/modules/apache/spec/classes/vhosts_spec.rb create mode 100644 environments/production/modules/apache/spec/defines/balancer_spec.rb create mode 100644 environments/production/modules/apache/spec/defines/balancermember_spec.rb create mode 100644 environments/production/modules/apache/spec/defines/custom_config_spec.rb create mode 100644 environments/production/modules/apache/spec/defines/fastcgi_server_spec.rb create mode 100644 environments/production/modules/apache/spec/defines/mod_spec.rb create mode 100644 environments/production/modules/apache/spec/defines/modsec_link_spec.rb create mode 100644 environments/production/modules/apache/spec/defines/vhost_custom_spec.rb create mode 100644 environments/production/modules/apache/spec/defines/vhost_spec.rb create mode 100644 environments/production/modules/apache/spec/fixtures/files/negotiation.conf create mode 100644 environments/production/modules/apache/spec/fixtures/files/spec create mode 100644 environments/production/modules/apache/spec/fixtures/templates/negotiation.conf.erb create mode 100644 environments/production/modules/apache/spec/spec_helper.rb create mode 100644 environments/production/modules/apache/spec/spec_helper_acceptance.rb create mode 100644 environments/production/modules/apache/spec/spec_helper_local.rb create mode 100644 environments/production/modules/apache/spec/unit/apache_version_spec.rb create mode 100644 environments/production/modules/apache/spec/unit/provider/a2mod/gentoo_spec.rb create mode 100644 environments/production/modules/apache/spec/unit/puppet/parser/functions/bool2httpd_spec.rb create mode 100644 environments/production/modules/apache/spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb create mode 100644 environments/production/modules/apache/spec/unit/puppet/parser/functions/validate_apache_log_level.rb create mode 100644 environments/production/modules/apache/templates/confd/no-accf.conf.erb create mode 100644 environments/production/modules/apache/templates/fastcgi/server.erb create mode 100644 environments/production/modules/apache/templates/httpd.conf.erb create mode 100644 environments/production/modules/apache/templates/listen.erb create mode 100644 environments/production/modules/apache/templates/mod/alias.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/auth_cas.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/auth_mellon.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/authn_dbd.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/authnz_ldap.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/autoindex.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/cgid.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/cluster.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/dav_fs.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/deflate.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/dir.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/disk_cache.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/dumpio.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/event.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/expires.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/ext_filter.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/fastcgi.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/fcgid.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/geoip.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/info.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/itk.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/ldap.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/load.erb create mode 100644 environments/production/modules/apache/templates/mod/mime.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/mime_magic.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/mpm_event.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/negotiation.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/nss.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/pagespeed.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/passenger.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/peruser.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/php.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/prefork.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/proxy.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/proxy_balancer.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/proxy_html.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/remoteip.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/reqtimeout.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/rpaf.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/security.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/security_crs.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/setenvif.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/ssl.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/status.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/suphp.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/userdir.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/worker.conf.erb create mode 100644 environments/production/modules/apache/templates/mod/wsgi.conf.erb create mode 100644 environments/production/modules/apache/templates/namevirtualhost.erb create mode 100644 environments/production/modules/apache/templates/ports_header.erb create mode 100644 environments/production/modules/apache/templates/vhost/_access_log.erb create mode 100644 environments/production/modules/apache/templates/vhost/_action.erb create mode 100644 environments/production/modules/apache/templates/vhost/_additional_includes.erb create mode 100644 environments/production/modules/apache/templates/vhost/_aliases.erb create mode 100644 environments/production/modules/apache/templates/vhost/_allow_encoded_slashes.erb create mode 100644 environments/production/modules/apache/templates/vhost/_auth_cas.erb create mode 100644 environments/production/modules/apache/templates/vhost/_auth_kerb.erb create mode 100644 environments/production/modules/apache/templates/vhost/_block.erb create mode 100644 environments/production/modules/apache/templates/vhost/_charsets.erb create mode 100644 environments/production/modules/apache/templates/vhost/_custom_fragment.erb create mode 100644 environments/production/modules/apache/templates/vhost/_directories.erb create mode 100644 environments/production/modules/apache/templates/vhost/_docroot.erb create mode 100644 environments/production/modules/apache/templates/vhost/_error_document.erb create mode 100644 environments/production/modules/apache/templates/vhost/_fallbackresource.erb create mode 100644 environments/production/modules/apache/templates/vhost/_fastcgi.erb create mode 100644 environments/production/modules/apache/templates/vhost/_file_footer.erb create mode 100644 environments/production/modules/apache/templates/vhost/_file_header.erb create mode 100644 environments/production/modules/apache/templates/vhost/_filters.erb create mode 100644 environments/production/modules/apache/templates/vhost/_header.erb create mode 100644 environments/production/modules/apache/templates/vhost/_itk.erb create mode 100644 environments/production/modules/apache/templates/vhost/_jk_mounts.erb create mode 100644 environments/production/modules/apache/templates/vhost/_keepalive_options.erb create mode 100644 environments/production/modules/apache/templates/vhost/_logging.erb create mode 100644 environments/production/modules/apache/templates/vhost/_passenger.erb create mode 100644 environments/production/modules/apache/templates/vhost/_passenger_base_uris.erb create mode 100644 environments/production/modules/apache/templates/vhost/_php.erb create mode 100644 environments/production/modules/apache/templates/vhost/_php_admin.erb create mode 100644 environments/production/modules/apache/templates/vhost/_proxy.erb create mode 100644 environments/production/modules/apache/templates/vhost/_rack.erb create mode 100644 environments/production/modules/apache/templates/vhost/_redirect.erb create mode 100644 environments/production/modules/apache/templates/vhost/_requestheader.erb create mode 100644 environments/production/modules/apache/templates/vhost/_require.erb create mode 100644 environments/production/modules/apache/templates/vhost/_rewrite.erb create mode 100644 environments/production/modules/apache/templates/vhost/_scriptalias.erb create mode 100644 environments/production/modules/apache/templates/vhost/_security.erb create mode 100644 environments/production/modules/apache/templates/vhost/_serveralias.erb create mode 100644 environments/production/modules/apache/templates/vhost/_serversignature.erb create mode 100644 environments/production/modules/apache/templates/vhost/_setenv.erb create mode 100644 environments/production/modules/apache/templates/vhost/_ssl.erb create mode 100644 environments/production/modules/apache/templates/vhost/_sslproxy.erb create mode 100644 environments/production/modules/apache/templates/vhost/_suexec.erb create mode 100644 environments/production/modules/apache/templates/vhost/_suphp.erb create mode 100644 environments/production/modules/apache/templates/vhost/_wsgi.erb create mode 100644 environments/production/modules/apt/CHANGELOG.md create mode 100644 environments/production/modules/apt/CONTRIBUTING.md create mode 100644 environments/production/modules/apt/Gemfile create mode 100644 environments/production/modules/apt/LICENSE create mode 100644 environments/production/modules/apt/MAINTAINERS.md create mode 100644 environments/production/modules/apt/NOTICE create mode 100644 environments/production/modules/apt/README.md create mode 100644 environments/production/modules/apt/Rakefile create mode 100644 environments/production/modules/apt/checksums.json create mode 100644 environments/production/modules/apt/examples/backports.pp create mode 100644 environments/production/modules/apt/examples/builddep.pp create mode 100644 environments/production/modules/apt/examples/debian_testing.pp create mode 100644 environments/production/modules/apt/examples/debian_unstable.pp create mode 100644 environments/production/modules/apt/examples/disable_keys.pp create mode 100644 environments/production/modules/apt/examples/fancy_progress.pp create mode 100644 environments/production/modules/apt/examples/force.pp create mode 100644 environments/production/modules/apt/examples/hold.pp create mode 100644 environments/production/modules/apt/examples/key.pp create mode 100644 environments/production/modules/apt/examples/pin.pp create mode 100644 environments/production/modules/apt/examples/ppa.pp create mode 100644 environments/production/modules/apt/examples/release.pp create mode 100644 environments/production/modules/apt/examples/source.pp create mode 100644 environments/production/modules/apt/examples/unattended_upgrades.pp create mode 100644 environments/production/modules/apt/lib/facter/apt_reboot_required.rb create mode 100644 environments/production/modules/apt/lib/facter/apt_update_last_success.rb create mode 100644 environments/production/modules/apt/lib/facter/apt_updates.rb create mode 100644 environments/production/modules/apt/lib/puppet/provider/apt_key/apt_key.rb create mode 100644 environments/production/modules/apt/lib/puppet/type/apt_key.rb create mode 100644 environments/production/modules/apt/lib/puppet_x/apt_key/patch_openuri.rb create mode 100644 environments/production/modules/apt/locales/config.yaml create mode 100644 environments/production/modules/apt/manifests/backports.pp create mode 100644 environments/production/modules/apt/manifests/conf.pp create mode 100644 environments/production/modules/apt/manifests/init.pp create mode 100644 environments/production/modules/apt/manifests/key.pp create mode 100644 environments/production/modules/apt/manifests/params.pp create mode 100644 environments/production/modules/apt/manifests/pin.pp create mode 100644 environments/production/modules/apt/manifests/ppa.pp create mode 100644 environments/production/modules/apt/manifests/setting.pp create mode 100644 environments/production/modules/apt/manifests/source.pp create mode 100644 environments/production/modules/apt/manifests/update.pp create mode 100644 environments/production/modules/apt/metadata.json create mode 100644 environments/production/modules/apt/spec/acceptance/apt_key_provider_spec.rb create mode 100644 environments/production/modules/apt/spec/acceptance/apt_spec.rb create mode 100644 environments/production/modules/apt/spec/acceptance/class_spec.rb create mode 100644 environments/production/modules/apt/spec/acceptance/nodesets/centos-7-x64.yml create mode 100644 environments/production/modules/apt/spec/acceptance/nodesets/debian-8-x64.yml create mode 100644 environments/production/modules/apt/spec/acceptance/nodesets/default.yml create mode 100644 environments/production/modules/apt/spec/acceptance/nodesets/docker/centos-7.yml create mode 100644 environments/production/modules/apt/spec/acceptance/nodesets/docker/debian-8.yml create mode 100644 environments/production/modules/apt/spec/acceptance/nodesets/docker/ubuntu-14.04.yml create mode 100644 environments/production/modules/apt/spec/classes/apt_backports_spec.rb create mode 100644 environments/production/modules/apt/spec/classes/apt_spec.rb create mode 100644 environments/production/modules/apt/spec/classes/apt_update_spec.rb create mode 100644 environments/production/modules/apt/spec/classes/params_spec.rb create mode 100644 environments/production/modules/apt/spec/defines/conf_spec.rb create mode 100644 environments/production/modules/apt/spec/defines/key_compat_spec.rb create mode 100644 environments/production/modules/apt/spec/defines/key_spec.rb create mode 100644 environments/production/modules/apt/spec/defines/pin_spec.rb create mode 100644 environments/production/modules/apt/spec/defines/ppa_spec.rb create mode 100644 environments/production/modules/apt/spec/defines/setting_spec.rb create mode 100644 environments/production/modules/apt/spec/defines/source_compat_spec.rb create mode 100644 environments/production/modules/apt/spec/defines/source_spec.rb create mode 100644 environments/production/modules/apt/spec/spec_helper.rb create mode 100644 environments/production/modules/apt/spec/spec_helper_acceptance.rb create mode 100644 environments/production/modules/apt/spec/unit/facter/apt_has_updates_spec.rb create mode 100644 environments/production/modules/apt/spec/unit/facter/apt_package_updates_spec.rb create mode 100644 environments/production/modules/apt/spec/unit/facter/apt_reboot_required_spec.rb create mode 100644 environments/production/modules/apt/spec/unit/facter/apt_security_updates_spec.rb create mode 100644 environments/production/modules/apt/spec/unit/facter/apt_update_last_success_spec.rb create mode 100644 environments/production/modules/apt/spec/unit/facter/apt_updates_spec.rb create mode 100644 environments/production/modules/apt/spec/unit/puppet/type/apt_key_spec.rb create mode 100644 environments/production/modules/apt/templates/15update-stamp.erb create mode 100644 environments/production/modules/apt/templates/_conf_header.erb create mode 100644 environments/production/modules/apt/templates/_header.erb create mode 100644 environments/production/modules/apt/templates/conf.erb create mode 100644 environments/production/modules/apt/templates/pin.pref.erb create mode 100644 environments/production/modules/apt/templates/proxy.erb create mode 100644 environments/production/modules/apt/templates/source.list.erb create mode 100644 environments/production/modules/concat/CHANGELOG.md create mode 100644 environments/production/modules/concat/CONTRIBUTING.md create mode 100644 environments/production/modules/concat/Gemfile create mode 100644 environments/production/modules/concat/LICENSE create mode 100644 environments/production/modules/concat/MAINTAINERS.md create mode 100644 environments/production/modules/concat/NOTICE create mode 100644 environments/production/modules/concat/README.md create mode 100644 environments/production/modules/concat/Rakefile create mode 100644 environments/production/modules/concat/appveyor.yml create mode 100644 environments/production/modules/concat/checksums.json create mode 100644 environments/production/modules/concat/examples/fragment.pp create mode 100644 environments/production/modules/concat/examples/init.pp create mode 100644 environments/production/modules/concat/lib/puppet/type/concat_file.rb create mode 100644 environments/production/modules/concat/lib/puppet/type/concat_fragment.rb create mode 100644 environments/production/modules/concat/locales/config.yaml create mode 100644 environments/production/modules/concat/manifests/fragment.pp create mode 100644 environments/production/modules/concat/manifests/init.pp create mode 100644 environments/production/modules/concat/metadata.json create mode 100644 environments/production/modules/concat/spec/acceptance/backup_spec.rb create mode 100644 environments/production/modules/concat/spec/acceptance/concat_spec.rb create mode 100644 environments/production/modules/concat/spec/acceptance/concurrency_spec.rb create mode 100644 environments/production/modules/concat/spec/acceptance/fragment_source_spec.rb create mode 100644 environments/production/modules/concat/spec/acceptance/fragments_are_always_replaced_spec.rb create mode 100644 environments/production/modules/concat/spec/acceptance/newline_spec.rb create mode 100644 environments/production/modules/concat/spec/acceptance/nodesets/centos-7-x64.yml create mode 100644 environments/production/modules/concat/spec/acceptance/nodesets/debian-8-x64.yml create mode 100644 environments/production/modules/concat/spec/acceptance/nodesets/default.yml create mode 100644 environments/production/modules/concat/spec/acceptance/nodesets/docker/centos-7.yml create mode 100644 environments/production/modules/concat/spec/acceptance/nodesets/docker/debian-8.yml create mode 100644 environments/production/modules/concat/spec/acceptance/nodesets/docker/ubuntu-14.04.yml create mode 100644 environments/production/modules/concat/spec/acceptance/order_spec.rb create mode 100644 environments/production/modules/concat/spec/acceptance/pup-1963_spec.rb create mode 100644 environments/production/modules/concat/spec/acceptance/quoted_paths_spec.rb create mode 100644 environments/production/modules/concat/spec/acceptance/replace_spec.rb create mode 100644 environments/production/modules/concat/spec/acceptance/specinfra_stubs.rb create mode 100644 environments/production/modules/concat/spec/acceptance/symbolic_name_spec.rb create mode 100644 environments/production/modules/concat/spec/acceptance/validation_spec.rb create mode 100644 environments/production/modules/concat/spec/acceptance/warn_header_spec.rb create mode 100644 environments/production/modules/concat/spec/acceptance/warnings_spec.rb create mode 100644 environments/production/modules/concat/spec/spec_helper.rb create mode 100644 environments/production/modules/concat/spec/spec_helper_acceptance.rb create mode 100644 environments/production/modules/concat/spec/unit/defines/concat_fragment_spec.rb create mode 100644 environments/production/modules/concat/spec/unit/defines/concat_spec.rb create mode 100644 environments/production/modules/concat/spec/unit/type/concat_file_spec.rb create mode 100644 environments/production/modules/firewall/CHANGELOG.md create mode 100644 environments/production/modules/firewall/CONTRIBUTING.md create mode 100644 environments/production/modules/firewall/Gemfile create mode 100644 environments/production/modules/firewall/LICENSE create mode 100644 environments/production/modules/firewall/NOTICE create mode 100644 environments/production/modules/firewall/README.markdown create mode 100644 environments/production/modules/firewall/Rakefile create mode 100644 environments/production/modules/firewall/checksums.json create mode 100644 environments/production/modules/firewall/lib/facter/ip6tables_version.rb create mode 100644 environments/production/modules/firewall/lib/facter/iptables_persistent_version.rb create mode 100644 environments/production/modules/firewall/lib/facter/iptables_version.rb create mode 100644 environments/production/modules/firewall/lib/puppet/provider/firewall.rb create mode 100644 environments/production/modules/firewall/lib/puppet/provider/firewall/ip6tables.rb create mode 100644 environments/production/modules/firewall/lib/puppet/provider/firewall/iptables.rb create mode 100644 environments/production/modules/firewall/lib/puppet/provider/firewallchain/iptables_chain.rb create mode 100644 environments/production/modules/firewall/lib/puppet/type/firewall.rb create mode 100644 environments/production/modules/firewall/lib/puppet/type/firewallchain.rb create mode 100644 environments/production/modules/firewall/lib/puppet/util/firewall.rb create mode 100644 environments/production/modules/firewall/lib/puppet/util/ipcidr.rb create mode 100644 environments/production/modules/firewall/manifests/init.pp create mode 100644 environments/production/modules/firewall/manifests/linux.pp create mode 100644 environments/production/modules/firewall/manifests/linux/archlinux.pp create mode 100644 environments/production/modules/firewall/manifests/linux/debian.pp create mode 100644 environments/production/modules/firewall/manifests/linux/gentoo.pp create mode 100644 environments/production/modules/firewall/manifests/linux/redhat.pp create mode 100644 environments/production/modules/firewall/manifests/params.pp create mode 100644 environments/production/modules/firewall/metadata.json create mode 100644 environments/production/modules/firewall/spec/acceptance/change_source_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/class_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/connlimit_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/connmark_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/firewall_bridging_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/firewall_clusterip_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/firewall_dscp_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/firewall_iptmodules_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/firewall_mss_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/firewall_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/firewall_tee_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/firewall_time_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/firewall_uid_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/firewallchain_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/invert_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/ip6_fragment_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/isfragment_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/match_mark_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/centos-7-x64.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/debian-8-x64.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/default.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/docker/centos-7.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/docker/debian-8.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/docker/ubuntu-14.04.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/debian-8-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/redhat-6-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/redhat-7-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/ubuntu-1404-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/ubuntu-1604-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/centos-5-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/centos-6-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/centos-7-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/debian-6-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/debian-7-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/debian-8-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/oracle-5-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/oracle-6-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/oracle-7-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/redhat-5-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/redhat-6-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/redhat-7-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/scientific-5-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/scientific-6-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/scientific-7-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/sles-10-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/sles-11-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/sles-12-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1004-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1204-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1404-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1604-64mda.yml create mode 100644 environments/production/modules/firewall/spec/acceptance/params_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/purge_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/resource_cmd_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/rules_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/socket_spec.rb create mode 100644 environments/production/modules/firewall/spec/acceptance/standard_usage_spec.rb create mode 100644 environments/production/modules/firewall/spec/fixtures/ip6tables/conversion_hash.rb create mode 100644 environments/production/modules/firewall/spec/fixtures/iptables/conversion_hash.rb create mode 100644 environments/production/modules/firewall/spec/spec_helper.rb create mode 100644 environments/production/modules/firewall/spec/spec_helper_acceptance.rb create mode 100644 environments/production/modules/firewall/spec/spec_helper_local.rb create mode 100644 environments/production/modules/firewall/spec/unit/classes/firewall_linux_archlinux_spec.rb create mode 100644 environments/production/modules/firewall/spec/unit/classes/firewall_linux_debian_spec.rb create mode 100644 environments/production/modules/firewall/spec/unit/classes/firewall_linux_gentoo_spec.rb create mode 100644 environments/production/modules/firewall/spec/unit/classes/firewall_linux_redhat_spec.rb create mode 100644 environments/production/modules/firewall/spec/unit/classes/firewall_linux_spec.rb create mode 100644 environments/production/modules/firewall/spec/unit/classes/firewall_spec.rb create mode 100644 environments/production/modules/firewall/spec/unit/facter/iptables_persistent_version_spec.rb create mode 100644 environments/production/modules/firewall/spec/unit/facter/iptables_spec.rb create mode 100644 environments/production/modules/firewall/spec/unit/puppet/provider/ip6tables_spec.rb create mode 100755 environments/production/modules/firewall/spec/unit/puppet/provider/iptables_chain_spec.rb create mode 100644 environments/production/modules/firewall/spec/unit/puppet/provider/iptables_spec.rb create mode 100755 environments/production/modules/firewall/spec/unit/puppet/type/firewall_spec.rb create mode 100755 environments/production/modules/firewall/spec/unit/puppet/type/firewallchain_spec.rb create mode 100644 environments/production/modules/firewall/spec/unit/puppet/util/firewall_spec.rb create mode 100644 environments/production/modules/firewall/spec/unit/puppet/util/ipcidr_spec.rb create mode 100644 environments/production/modules/inifile/CHANGELOG.md create mode 100644 environments/production/modules/inifile/CONTRIBUTING.md create mode 100644 environments/production/modules/inifile/Gemfile create mode 100644 environments/production/modules/inifile/LICENSE create mode 100644 environments/production/modules/inifile/NOTICE create mode 100644 environments/production/modules/inifile/README.markdown create mode 100644 environments/production/modules/inifile/Rakefile create mode 100644 environments/production/modules/inifile/checksums.json create mode 100644 environments/production/modules/inifile/examples/ini_setting.pp create mode 100644 environments/production/modules/inifile/examples/ini_subsetting.pp create mode 100644 environments/production/modules/inifile/lib/puppet/parser/functions/create_ini_settings.rb create mode 100644 environments/production/modules/inifile/lib/puppet/provider/ini_setting/ruby.rb create mode 100644 environments/production/modules/inifile/lib/puppet/provider/ini_subsetting/ruby.rb create mode 100644 environments/production/modules/inifile/lib/puppet/type/ini_setting.rb create mode 100644 environments/production/modules/inifile/lib/puppet/type/ini_subsetting.rb create mode 100644 environments/production/modules/inifile/lib/puppet/util/external_iterator.rb create mode 100644 environments/production/modules/inifile/lib/puppet/util/ini_file.rb create mode 100644 environments/production/modules/inifile/lib/puppet/util/ini_file/section.rb create mode 100644 environments/production/modules/inifile/lib/puppet/util/setting_value.rb create mode 100644 environments/production/modules/inifile/metadata.json create mode 100644 environments/production/modules/inifile/spec/acceptance/ini_setting_spec.rb create mode 100644 environments/production/modules/inifile/spec/acceptance/ini_subsetting_spec.rb create mode 100644 environments/production/modules/inifile/spec/acceptance/nodesets/centos-7-x64.yml create mode 100644 environments/production/modules/inifile/spec/acceptance/nodesets/debian-8-x64.yml create mode 100644 environments/production/modules/inifile/spec/acceptance/nodesets/default.yml create mode 100644 environments/production/modules/inifile/spec/acceptance/nodesets/docker/centos-7.yml create mode 100644 environments/production/modules/inifile/spec/acceptance/nodesets/docker/debian-8.yml create mode 100644 environments/production/modules/inifile/spec/acceptance/nodesets/docker/ubuntu-14.04.yml create mode 100644 environments/production/modules/inifile/spec/classes/create_ini_settings_test_spec.rb create mode 100644 environments/production/modules/inifile/spec/classes/create_multiple_ini_settings_spec.rb create mode 100644 environments/production/modules/inifile/spec/classes/inherit_test1_spec.rb create mode 100644 environments/production/modules/inifile/spec/fixtures/create_multiple_ini_settings/manifests/init.pp create mode 100644 environments/production/modules/inifile/spec/fixtures/tmp/.empty create mode 100644 environments/production/modules/inifile/spec/functions/create_ini_settings_spec.rb create mode 100644 environments/production/modules/inifile/spec/spec.opts create mode 100644 environments/production/modules/inifile/spec/spec_helper.rb create mode 100644 environments/production/modules/inifile/spec/spec_helper_acceptance.rb create mode 100644 environments/production/modules/inifile/spec/spec_helper_local.rb create mode 100644 environments/production/modules/inifile/spec/unit/puppet/provider/ini_setting/inheritance_spec.rb create mode 100644 environments/production/modules/inifile/spec/unit/puppet/provider/ini_setting/ruby_spec.rb create mode 100644 environments/production/modules/inifile/spec/unit/puppet/provider/ini_subsetting/ruby_spec.rb create mode 100644 environments/production/modules/inifile/spec/unit/puppet/type/ini_setting_spec.rb create mode 100644 environments/production/modules/inifile/spec/unit/puppet/type/ini_subetting_spec.rb create mode 100644 environments/production/modules/inifile/spec/unit/puppet/util/external_iterator_spec.rb create mode 100644 environments/production/modules/inifile/spec/unit/puppet/util/ini_file_spec.rb create mode 100644 environments/production/modules/inifile/spec/unit/puppet/util/setting_value_spec.rb create mode 100644 environments/production/modules/mysql/CHANGELOG.md create mode 100644 environments/production/modules/mysql/CONTRIBUTING.md create mode 100644 environments/production/modules/mysql/Gemfile create mode 100644 environments/production/modules/mysql/LICENSE create mode 100644 environments/production/modules/mysql/NOTICE create mode 100644 environments/production/modules/mysql/README.md create mode 100644 environments/production/modules/mysql/Rakefile create mode 100644 environments/production/modules/mysql/TODO create mode 100644 environments/production/modules/mysql/checksums.json create mode 100644 environments/production/modules/mysql/examples/backup.pp create mode 100644 environments/production/modules/mysql/examples/bindings.pp create mode 100644 environments/production/modules/mysql/examples/java.pp create mode 100644 environments/production/modules/mysql/examples/mysql_database.pp create mode 100644 environments/production/modules/mysql/examples/mysql_db.pp create mode 100644 environments/production/modules/mysql/examples/mysql_grant.pp create mode 100644 environments/production/modules/mysql/examples/mysql_plugin.pp create mode 100644 environments/production/modules/mysql/examples/mysql_user.pp create mode 100644 environments/production/modules/mysql/examples/perl.pp create mode 100644 environments/production/modules/mysql/examples/python.pp create mode 100644 environments/production/modules/mysql/examples/ruby.pp create mode 100644 environments/production/modules/mysql/examples/server.pp create mode 100644 environments/production/modules/mysql/examples/server/account_security.pp create mode 100644 environments/production/modules/mysql/examples/server/config.pp create mode 100644 environments/production/modules/mysql/lib/facter/mysql_server_id.rb create mode 100644 environments/production/modules/mysql/lib/facter/mysql_version.rb create mode 100644 environments/production/modules/mysql/lib/facter/mysqld_version.rb create mode 100644 environments/production/modules/mysql/lib/puppet/parser/functions/mysql_deepmerge.rb create mode 100644 environments/production/modules/mysql/lib/puppet/parser/functions/mysql_dirname.rb create mode 100644 environments/production/modules/mysql/lib/puppet/parser/functions/mysql_password.rb create mode 100644 environments/production/modules/mysql/lib/puppet/parser/functions/mysql_strip_hash.rb create mode 100644 environments/production/modules/mysql/lib/puppet/provider/mysql.rb create mode 100644 environments/production/modules/mysql/lib/puppet/provider/mysql_database/mysql.rb create mode 100644 environments/production/modules/mysql/lib/puppet/provider/mysql_datadir/mysql.rb create mode 100644 environments/production/modules/mysql/lib/puppet/provider/mysql_grant/mysql.rb create mode 100644 environments/production/modules/mysql/lib/puppet/provider/mysql_plugin/mysql.rb create mode 100644 environments/production/modules/mysql/lib/puppet/provider/mysql_user/mysql.rb create mode 100644 environments/production/modules/mysql/lib/puppet/type/mysql_database.rb create mode 100644 environments/production/modules/mysql/lib/puppet/type/mysql_datadir.rb create mode 100644 environments/production/modules/mysql/lib/puppet/type/mysql_grant.rb create mode 100644 environments/production/modules/mysql/lib/puppet/type/mysql_plugin.rb create mode 100644 environments/production/modules/mysql/lib/puppet/type/mysql_user.rb create mode 100644 environments/production/modules/mysql/manifests/backup/mysqlbackup.pp create mode 100644 environments/production/modules/mysql/manifests/backup/mysqldump.pp create mode 100644 environments/production/modules/mysql/manifests/backup/xtrabackup.pp create mode 100644 environments/production/modules/mysql/manifests/bindings.pp create mode 100644 environments/production/modules/mysql/manifests/bindings/client_dev.pp create mode 100644 environments/production/modules/mysql/manifests/bindings/daemon_dev.pp create mode 100644 environments/production/modules/mysql/manifests/bindings/java.pp create mode 100644 environments/production/modules/mysql/manifests/bindings/perl.pp create mode 100644 environments/production/modules/mysql/manifests/bindings/php.pp create mode 100644 environments/production/modules/mysql/manifests/bindings/python.pp create mode 100644 environments/production/modules/mysql/manifests/bindings/ruby.pp create mode 100644 environments/production/modules/mysql/manifests/client.pp create mode 100644 environments/production/modules/mysql/manifests/client/install.pp create mode 100644 environments/production/modules/mysql/manifests/db.pp create mode 100644 environments/production/modules/mysql/manifests/params.pp create mode 100644 environments/production/modules/mysql/manifests/server.pp create mode 100644 environments/production/modules/mysql/manifests/server/account_security.pp create mode 100644 environments/production/modules/mysql/manifests/server/backup.pp create mode 100644 environments/production/modules/mysql/manifests/server/binarylog.pp create mode 100644 environments/production/modules/mysql/manifests/server/config.pp create mode 100644 environments/production/modules/mysql/manifests/server/install.pp create mode 100644 environments/production/modules/mysql/manifests/server/installdb.pp create mode 100644 environments/production/modules/mysql/manifests/server/monitor.pp create mode 100644 environments/production/modules/mysql/manifests/server/mysqltuner.pp create mode 100644 environments/production/modules/mysql/manifests/server/providers.pp create mode 100644 environments/production/modules/mysql/manifests/server/root_password.pp create mode 100644 environments/production/modules/mysql/manifests/server/service.pp create mode 100644 environments/production/modules/mysql/metadata.json create mode 100644 environments/production/modules/mysql/spec/acceptance/mysql_backup_spec.rb create mode 100644 environments/production/modules/mysql/spec/acceptance/mysql_db_spec.rb create mode 100644 environments/production/modules/mysql/spec/acceptance/mysql_helper.rb create mode 100644 environments/production/modules/mysql/spec/acceptance/mysql_server_spec.rb create mode 100644 environments/production/modules/mysql/spec/acceptance/nodesets/centos-7-x64.yml create mode 100644 environments/production/modules/mysql/spec/acceptance/nodesets/debian-8-x64.yml create mode 100644 environments/production/modules/mysql/spec/acceptance/nodesets/default.yml create mode 100644 environments/production/modules/mysql/spec/acceptance/nodesets/docker/centos-7.yml create mode 100644 environments/production/modules/mysql/spec/acceptance/nodesets/docker/debian-8.yml create mode 100644 environments/production/modules/mysql/spec/acceptance/nodesets/docker/ubuntu-14.04.yml create mode 100644 environments/production/modules/mysql/spec/acceptance/types/mysql_database_spec.rb create mode 100644 environments/production/modules/mysql/spec/acceptance/types/mysql_grant_spec.rb create mode 100644 environments/production/modules/mysql/spec/acceptance/types/mysql_plugin_spec.rb create mode 100644 environments/production/modules/mysql/spec/acceptance/types/mysql_user_spec.rb create mode 100644 environments/production/modules/mysql/spec/classes/graceful_failures_spec.rb create mode 100644 environments/production/modules/mysql/spec/classes/mycnf_template_spec.rb create mode 100644 environments/production/modules/mysql/spec/classes/mysql_bindings_spec.rb create mode 100644 environments/production/modules/mysql/spec/classes/mysql_client_spec.rb create mode 100644 environments/production/modules/mysql/spec/classes/mysql_server_account_security_spec.rb create mode 100644 environments/production/modules/mysql/spec/classes/mysql_server_backup_spec.rb create mode 100644 environments/production/modules/mysql/spec/classes/mysql_server_monitor_spec.rb create mode 100644 environments/production/modules/mysql/spec/classes/mysql_server_mysqltuner_spec.rb create mode 100644 environments/production/modules/mysql/spec/classes/mysql_server_spec.rb create mode 100644 environments/production/modules/mysql/spec/defines/mysql_db_spec.rb create mode 100644 environments/production/modules/mysql/spec/spec.opts create mode 100644 environments/production/modules/mysql/spec/spec_helper.rb create mode 100644 environments/production/modules/mysql/spec/spec_helper_acceptance.rb create mode 100644 environments/production/modules/mysql/spec/spec_helper_local.rb create mode 100644 environments/production/modules/mysql/spec/unit/facter/mysql_server_id_spec.rb create mode 100644 environments/production/modules/mysql/spec/unit/facter/mysql_version_spec.rb create mode 100644 environments/production/modules/mysql/spec/unit/facter/mysqld_version_spec.rb create mode 100644 environments/production/modules/mysql/spec/unit/puppet/functions/mysql_deepmerge_spec.rb create mode 100644 environments/production/modules/mysql/spec/unit/puppet/functions/mysql_password_spec.rb create mode 100644 environments/production/modules/mysql/spec/unit/puppet/provider/mysql_database/mysql_spec.rb create mode 100644 environments/production/modules/mysql/spec/unit/puppet/provider/mysql_plugin/mysql_spec.rb create mode 100644 environments/production/modules/mysql/spec/unit/puppet/provider/mysql_user/mysql_spec.rb create mode 100644 environments/production/modules/mysql/spec/unit/puppet/type/mysql_database_spec.rb create mode 100644 environments/production/modules/mysql/spec/unit/puppet/type/mysql_grant_spec.rb create mode 100644 environments/production/modules/mysql/spec/unit/puppet/type/mysql_plugin_spec.rb create mode 100644 environments/production/modules/mysql/spec/unit/puppet/type/mysql_user_spec.rb create mode 100644 environments/production/modules/mysql/templates/meb.cnf.erb create mode 100644 environments/production/modules/mysql/templates/my.cnf.erb create mode 100644 environments/production/modules/mysql/templates/my.cnf.pass.erb create mode 100755 environments/production/modules/mysql/templates/mysqlbackup.sh.erb create mode 100644 environments/production/modules/mysql/templates/xtrabackup.sh.erb create mode 100644 environments/production/modules/postgresql/CHANGELOG.md create mode 100644 environments/production/modules/postgresql/CONTRIBUTING.md create mode 100644 environments/production/modules/postgresql/Gemfile create mode 100644 environments/production/modules/postgresql/LICENSE create mode 100644 environments/production/modules/postgresql/MAINTAINERS.md create mode 100644 environments/production/modules/postgresql/NOTICE create mode 100644 environments/production/modules/postgresql/README.md create mode 100644 environments/production/modules/postgresql/Rakefile create mode 100644 environments/production/modules/postgresql/checksums.json create mode 100644 environments/production/modules/postgresql/files/RPM-GPG-KEY-PGDG create mode 100644 environments/production/modules/postgresql/files/validate_postgresql_connection.sh create mode 100644 environments/production/modules/postgresql/lib/puppet/parser/functions/postgresql_acls_to_resources_hash.rb create mode 100644 environments/production/modules/postgresql/lib/puppet/parser/functions/postgresql_escape.rb create mode 100644 environments/production/modules/postgresql/lib/puppet/parser/functions/postgresql_password.rb create mode 100644 environments/production/modules/postgresql/lib/puppet/provider/postgresql_conf/parsed.rb create mode 100644 environments/production/modules/postgresql/lib/puppet/provider/postgresql_psql/ruby.rb create mode 100644 environments/production/modules/postgresql/lib/puppet/provider/postgresql_replication_slot/ruby.rb create mode 100644 environments/production/modules/postgresql/lib/puppet/type/postgresql_conf.rb create mode 100644 environments/production/modules/postgresql/lib/puppet/type/postgresql_psql.rb create mode 100644 environments/production/modules/postgresql/lib/puppet/type/postgresql_replication_slot.rb create mode 100644 environments/production/modules/postgresql/manifests/client.pp create mode 100644 environments/production/modules/postgresql/manifests/globals.pp create mode 100644 environments/production/modules/postgresql/manifests/lib/devel.pp create mode 100644 environments/production/modules/postgresql/manifests/lib/docs.pp create mode 100644 environments/production/modules/postgresql/manifests/lib/java.pp create mode 100644 environments/production/modules/postgresql/manifests/lib/perl.pp create mode 100644 environments/production/modules/postgresql/manifests/lib/python.pp create mode 100644 environments/production/modules/postgresql/manifests/params.pp create mode 100644 environments/production/modules/postgresql/manifests/repo.pp create mode 100644 environments/production/modules/postgresql/manifests/repo/apt_postgresql_org.pp create mode 100644 environments/production/modules/postgresql/manifests/repo/yum_postgresql_org.pp create mode 100644 environments/production/modules/postgresql/manifests/server.pp create mode 100644 environments/production/modules/postgresql/manifests/server/config.pp create mode 100644 environments/production/modules/postgresql/manifests/server/config_entry.pp create mode 100644 environments/production/modules/postgresql/manifests/server/contrib.pp create mode 100644 environments/production/modules/postgresql/manifests/server/database.pp create mode 100644 environments/production/modules/postgresql/manifests/server/database_grant.pp create mode 100644 environments/production/modules/postgresql/manifests/server/db.pp create mode 100644 environments/production/modules/postgresql/manifests/server/extension.pp create mode 100644 environments/production/modules/postgresql/manifests/server/grant.pp create mode 100644 environments/production/modules/postgresql/manifests/server/grant_role.pp create mode 100644 environments/production/modules/postgresql/manifests/server/initdb.pp create mode 100644 environments/production/modules/postgresql/manifests/server/install.pp create mode 100644 environments/production/modules/postgresql/manifests/server/passwd.pp create mode 100644 environments/production/modules/postgresql/manifests/server/pg_hba_rule.pp create mode 100644 environments/production/modules/postgresql/manifests/server/pg_ident_rule.pp create mode 100644 environments/production/modules/postgresql/manifests/server/plperl.pp create mode 100644 environments/production/modules/postgresql/manifests/server/plpython.pp create mode 100644 environments/production/modules/postgresql/manifests/server/postgis.pp create mode 100644 environments/production/modules/postgresql/manifests/server/recovery.pp create mode 100644 environments/production/modules/postgresql/manifests/server/reload.pp create mode 100644 environments/production/modules/postgresql/manifests/server/role.pp create mode 100644 environments/production/modules/postgresql/manifests/server/schema.pp create mode 100644 environments/production/modules/postgresql/manifests/server/service.pp create mode 100644 environments/production/modules/postgresql/manifests/server/table_grant.pp create mode 100644 environments/production/modules/postgresql/manifests/server/tablespace.pp create mode 100644 environments/production/modules/postgresql/manifests/validate_db_connection.pp create mode 100644 environments/production/modules/postgresql/metadata.json create mode 100644 environments/production/modules/postgresql/spec/acceptance/00-utf8_encoding_spec.rb create mode 100644 environments/production/modules/postgresql/spec/acceptance/alternative_port_spec.rb create mode 100644 environments/production/modules/postgresql/spec/acceptance/db_spec.rb create mode 100644 environments/production/modules/postgresql/spec/acceptance/default_parameters_spec.rb create mode 100644 environments/production/modules/postgresql/spec/acceptance/nodesets/centos-7-x64.yml create mode 100644 environments/production/modules/postgresql/spec/acceptance/nodesets/debian-8-x64.yml create mode 100644 environments/production/modules/postgresql/spec/acceptance/nodesets/default.yml create mode 100644 environments/production/modules/postgresql/spec/acceptance/nodesets/docker/centos-7.yml create mode 100644 environments/production/modules/postgresql/spec/acceptance/nodesets/docker/debian-8.yml create mode 100644 environments/production/modules/postgresql/spec/acceptance/nodesets/docker/ubuntu-14.04.yml create mode 100644 environments/production/modules/postgresql/spec/acceptance/postgresql_psql_spec.rb create mode 100644 environments/production/modules/postgresql/spec/acceptance/remote_access_spec.rb create mode 100644 environments/production/modules/postgresql/spec/acceptance/server/config_entry_spec.rb create mode 100644 environments/production/modules/postgresql/spec/acceptance/server/grant_role_spec.rb create mode 100644 environments/production/modules/postgresql/spec/acceptance/server/grant_spec.rb create mode 100644 environments/production/modules/postgresql/spec/acceptance/server/recovery_spec.rb create mode 100644 environments/production/modules/postgresql/spec/acceptance/server/schema_spec.rb create mode 100644 environments/production/modules/postgresql/spec/acceptance/z_alternative_pgdata_spec.rb create mode 100644 environments/production/modules/postgresql/spec/spec_helper.rb create mode 100644 environments/production/modules/postgresql/spec/spec_helper_acceptance.rb create mode 100644 environments/production/modules/postgresql/spec/spec_helper_local.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/client_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/globals_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/lib/devel_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/lib/java_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/lib/perl_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/lib/pgdocs_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/lib/python_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/params_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/repo_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/server/config_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/server/contrib_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/server/initdb_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/server/plperl_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/server/plpython_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/server/postgis_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/classes/server_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/config_entry_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/database_grant_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/database_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/db_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/extension_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/grant_role_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/grant_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/pg_hba_rule_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/pg_ident_rule_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/recovery_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/role_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/schema_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/table_grant_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/server/tablespace_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/defines/validate_db_connection_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/functions/postgresql_acls_to_resources_hash_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/functions/postgresql_escape_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/functions/postgresql_password_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/provider/postgresql_conf/parsed_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/puppet/provider/postgresql_psql/ruby_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/puppet/provider/postgresql_replication_slot/ruby_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/puppet/type/postgresql_psql_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/puppet/type/postgresql_replication_slot_spec.rb create mode 100644 environments/production/modules/postgresql/spec/unit/type/postgresql_conf_spec.rb create mode 100644 environments/production/modules/postgresql/templates/pg_hba_rule.conf create mode 100644 environments/production/modules/postgresql/templates/pg_ident_rule.conf create mode 100644 environments/production/modules/postgresql/templates/recovery.conf.erb create mode 100644 environments/production/modules/postgresql/templates/systemd-override.erb create mode 100644 environments/production/modules/puppetdb/CHANGELOG create mode 100644 environments/production/modules/puppetdb/LICENSE create mode 100644 environments/production/modules/puppetdb/NOTICE create mode 100644 environments/production/modules/puppetdb/README.md create mode 100644 environments/production/modules/puppetdb/checksums.json create mode 100644 environments/production/modules/puppetdb/lib/puppet/parser/functions/puppetdb_create_subsetting_resource_hash.rb create mode 100644 environments/production/modules/puppetdb/lib/puppet/parser/functions/puppetdb_flatten_java_args.rb create mode 100644 environments/production/modules/puppetdb/lib/puppet/provider/puppetdb_conn_validator/puppet_https.rb create mode 100644 environments/production/modules/puppetdb/lib/puppet/type/puppetdb_conn_validator.rb create mode 100644 environments/production/modules/puppetdb/lib/puppet/util/puppetdb_validator.rb create mode 100644 environments/production/modules/puppetdb/manifests/database/postgresql.pp create mode 100644 environments/production/modules/puppetdb/manifests/globals.pp create mode 100644 environments/production/modules/puppetdb/manifests/init.pp create mode 100644 environments/production/modules/puppetdb/manifests/master/config.pp create mode 100644 environments/production/modules/puppetdb/manifests/master/puppetdb_conf.pp create mode 100644 environments/production/modules/puppetdb/manifests/master/report_processor.pp create mode 100644 environments/production/modules/puppetdb/manifests/master/routes.pp create mode 100644 environments/production/modules/puppetdb/manifests/master/storeconfigs.pp create mode 100644 environments/production/modules/puppetdb/manifests/params.pp create mode 100644 environments/production/modules/puppetdb/manifests/server.pp create mode 100644 environments/production/modules/puppetdb/manifests/server/command_processing.pp create mode 100644 environments/production/modules/puppetdb/manifests/server/database.pp create mode 100644 environments/production/modules/puppetdb/manifests/server/firewall.pp create mode 100644 environments/production/modules/puppetdb/manifests/server/global.pp create mode 100644 environments/production/modules/puppetdb/manifests/server/jetty.pp create mode 100644 environments/production/modules/puppetdb/manifests/server/puppetdb.pp create mode 100644 environments/production/modules/puppetdb/manifests/server/read_database.pp create mode 100644 environments/production/modules/puppetdb/manifests/server/validate_db.pp create mode 100644 environments/production/modules/puppetdb/manifests/server/validate_read_db.pp create mode 100644 environments/production/modules/puppetdb/metadata.json create mode 100644 environments/production/modules/puppetdb/templates/certificate-whitelist.erb create mode 100644 environments/production/modules/puppetdb/templates/routes.yaml.erb create mode 100644 environments/production/modules/puppetexplorer/Gemfile create mode 100644 environments/production/modules/puppetexplorer/README.md create mode 100644 environments/production/modules/puppetexplorer/Rakefile create mode 100644 environments/production/modules/puppetexplorer/checksums.json create mode 100644 environments/production/modules/puppetexplorer/files/RPM-GPG-KEY-puppetexplorer create mode 100644 environments/production/modules/puppetexplorer/manifests/apache.pp create mode 100644 environments/production/modules/puppetexplorer/manifests/init.pp create mode 100644 environments/production/modules/puppetexplorer/metadata.json create mode 100644 environments/production/modules/puppetexplorer/spec/acceptance/classes/puppetexplorer_spec.rb create mode 100644 environments/production/modules/puppetexplorer/spec/acceptance/nodesets/centos-7.yml create mode 100644 environments/production/modules/puppetexplorer/spec/acceptance/nodesets/debian-7.yml create mode 100644 environments/production/modules/puppetexplorer/spec/acceptance/nodesets/default.yml create mode 100644 environments/production/modules/puppetexplorer/spec/acceptance/nodesets/ubuntu-1404.yml create mode 100644 environments/production/modules/puppetexplorer/spec/acceptance/nodesets/ubuntu-1604.yml create mode 100644 environments/production/modules/puppetexplorer/spec/classes/init_spec.rb create mode 100644 environments/production/modules/puppetexplorer/spec/spec_helper.rb create mode 100644 environments/production/modules/puppetexplorer/spec/spec_helper_acceptance.rb create mode 100644 environments/production/modules/puppetexplorer/templates/config.js.erb create mode 100644 environments/production/modules/puppetexplorer/tests/basic_auth.pp create mode 100644 environments/production/modules/puppetexplorer/tests/init.pp create mode 100644 environments/production/modules/staging/CHANGELOG.md create mode 100644 environments/production/modules/staging/CONTRIBUTING.md create mode 100644 environments/production/modules/staging/Gemfile create mode 100644 environments/production/modules/staging/LICENSE create mode 100644 environments/production/modules/staging/README.md create mode 100644 environments/production/modules/staging/Rakefile create mode 100644 environments/production/modules/staging/checksums.json create mode 100644 environments/production/modules/staging/docs/deploy.html create mode 100644 environments/production/modules/staging/docs/extract.html create mode 100644 environments/production/modules/staging/docs/file.html create mode 100644 environments/production/modules/staging/docs/init.html create mode 100644 environments/production/modules/staging/examples/deploy.pp create mode 100644 environments/production/modules/staging/examples/extract.pp create mode 100644 environments/production/modules/staging/examples/file.pp create mode 100644 environments/production/modules/staging/examples/init.pp create mode 100644 environments/production/modules/staging/examples/scope_defaults.pp create mode 100644 environments/production/modules/staging/examples/staging_parse.pp create mode 100644 environments/production/modules/staging/files/sample create mode 100644 environments/production/modules/staging/files/sample.tar.bz2 create mode 100644 environments/production/modules/staging/files/sample.tar.gz create mode 100644 environments/production/modules/staging/lib/facter/staging_http_get.rb create mode 100644 environments/production/modules/staging/lib/facter/staging_windir.rb create mode 100644 environments/production/modules/staging/lib/puppet/parser/functions/scope_defaults.rb create mode 100644 environments/production/modules/staging/lib/puppet/parser/functions/staging_parse.rb create mode 100644 environments/production/modules/staging/manifests/deploy.pp create mode 100644 environments/production/modules/staging/manifests/extract.pp create mode 100644 environments/production/modules/staging/manifests/file.pp create mode 100644 environments/production/modules/staging/manifests/init.pp create mode 100644 environments/production/modules/staging/manifests/params.pp create mode 100644 environments/production/modules/staging/metadata.json create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/centos-511-x64.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/centos-66-x64-pe.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/centos-66-x64.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/centos-72-x64.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/debian-78-x64.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/debian-82-x64.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/docker/centos-5.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/docker/centos-6.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/docker/centos-7.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/docker/debian-7.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/docker/debian-8.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/docker/ubuntu-12.04.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/docker/ubuntu-14.04.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/docker/ubuntu-16.04.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/fedora-24-x64.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/fedora-25-x64.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/ubuntu-server-1204-x64.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml create mode 100644 environments/production/modules/staging/spec/acceptance/nodesets/ubuntu-server-1604-x64.yml create mode 100644 environments/production/modules/staging/spec/classes/coverage_spec.rb create mode 100644 environments/production/modules/staging/spec/default_facts.yml create mode 100644 environments/production/modules/staging/spec/defines/staging_deploy_spec.rb create mode 100644 environments/production/modules/staging/spec/defines/staging_extract_spec.rb create mode 100644 environments/production/modules/staging/spec/defines/staging_file_spec.rb create mode 100644 environments/production/modules/staging/spec/fixtures/hiera.yaml create mode 100644 environments/production/modules/staging/spec/spec.opts create mode 100644 environments/production/modules/staging/spec/spec_helper.rb create mode 100644 environments/production/modules/staging/spec/unit/puppet/parser/functions/scope_defaults_spec.rb create mode 100644 environments/production/modules/staging/spec/unit/puppet/parser/functions/staging_parse_spec.rb create mode 100644 environments/production/modules/stdlib/CHANGELOG.md create mode 100644 environments/production/modules/stdlib/CONTRIBUTING.md create mode 100644 environments/production/modules/stdlib/Gemfile create mode 100644 environments/production/modules/stdlib/LICENSE create mode 100644 environments/production/modules/stdlib/MAINTAINERS.md create mode 100644 environments/production/modules/stdlib/NOTICE create mode 100644 environments/production/modules/stdlib/README.markdown create mode 100644 environments/production/modules/stdlib/README_DEVELOPER.markdown create mode 100644 environments/production/modules/stdlib/README_SPECS.markdown create mode 100644 environments/production/modules/stdlib/RELEASE_PROCESS.markdown create mode 100644 environments/production/modules/stdlib/Rakefile create mode 100644 environments/production/modules/stdlib/appveyor.yml create mode 100644 environments/production/modules/stdlib/checksums.json create mode 100644 environments/production/modules/stdlib/examples/file_line.pp create mode 100644 environments/production/modules/stdlib/examples/has_interface_with.pp create mode 100644 environments/production/modules/stdlib/examples/has_ip_address.pp create mode 100644 environments/production/modules/stdlib/examples/has_ip_network.pp create mode 100644 environments/production/modules/stdlib/examples/init.pp create mode 100644 environments/production/modules/stdlib/lib/facter/facter_dot_d.rb create mode 100644 environments/production/modules/stdlib/lib/facter/package_provider.rb create mode 100644 environments/production/modules/stdlib/lib/facter/pe_version.rb create mode 100644 environments/production/modules/stdlib/lib/facter/puppet_settings.rb create mode 100644 environments/production/modules/stdlib/lib/facter/root_home.rb create mode 100644 environments/production/modules/stdlib/lib/facter/service_provider.rb create mode 100644 environments/production/modules/stdlib/lib/facter/util/puppet_settings.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/deprecation.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/is_a.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/is_absolute_path.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/is_array.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/is_bool.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/is_float.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/is_ip_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/is_ipv4_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/is_ipv6_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/is_numeric.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/is_string.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/length.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/type_of.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/validate_absolute_path.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/validate_array.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/validate_bool.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/validate_hash.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/validate_integer.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/validate_ip_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/validate_ipv4_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/validate_ipv6_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/validate_legacy.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/validate_numeric.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/validate_re.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/validate_slength.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/functions/validate_string.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/abs.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/any2array.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/any2bool.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/assert_private.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/base64.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/basename.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/bool2num.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/bool2str.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/camelcase.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/capitalize.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/ceiling.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/chomp.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/chop.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/clamp.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/concat.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/convert_base.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/count.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/deep_merge.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/defined_with_params.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/delete.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/delete_at.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/delete_regex.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/delete_undef_values.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/delete_values.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/deprecation.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/difference.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/dig.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/dig44.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/dirname.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/dos2unix.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/downcase.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/empty.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/enclose_ipv6.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/ensure_packages.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/ensure_resource.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/ensure_resources.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/flatten.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/floor.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/fqdn_rand_string.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/fqdn_rotate.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/fqdn_uuid.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/get_module_path.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/getparam.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/getvar.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/grep.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/has_interface_with.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/has_ip_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/has_ip_network.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/has_key.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/hash.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/intersection.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_absolute_path.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_array.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_bool.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_domain_name.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_email_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_float.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_function_available.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_hash.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_integer.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_ip_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_ipv4_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_ipv6_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_mac_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_numeric.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/is_string.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/join.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/join_keys_to_values.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/keys.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/load_module_metadata.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/loadjson.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/loadyaml.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/lstrip.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/max.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/member.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/merge.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/min.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/num2bool.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/parsejson.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/parseyaml.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/pick.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/pick_default.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/prefix.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/private.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/pry.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/pw_hash.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/range.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/regexpescape.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/reject.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/reverse.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/rstrip.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/seeded_rand.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/shell_escape.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/shell_join.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/shell_split.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/shuffle.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/size.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/sort.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/squeeze.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/str2bool.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/str2saltedsha512.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/strftime.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/strip.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/suffix.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/swapcase.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/time.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/to_bytes.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/try_get_value.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/type.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/type3x.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/union.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/unique.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/unix2dos.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/upcase.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/uriescape.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_absolute_path.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_array.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_augeas.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_bool.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_cmd.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_email_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_hash.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_integer.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_ip_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_ipv4_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_ipv6_address.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_numeric.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_re.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_slength.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_string.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/validate_x509_rsa_key_pair.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/values.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/values_at.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/parser/functions/zip.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/provider/file_line/ruby.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/type/anchor.rb create mode 100644 environments/production/modules/stdlib/lib/puppet/type/file_line.rb create mode 100644 environments/production/modules/stdlib/manifests/init.pp create mode 100644 environments/production/modules/stdlib/manifests/stages.pp create mode 100644 environments/production/modules/stdlib/metadata.json create mode 100755 environments/production/modules/stdlib/spec/acceptance/abs_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/anchor_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/any2array_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/base64_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/bool2num_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/build_csv.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/capitalize_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/ceiling_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/chomp_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/chop_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/clamp_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/concat_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/count_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/deep_merge_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/defined_with_params_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/delete_at_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/delete_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/delete_undef_values_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/delete_values_spec.rb create mode 100644 environments/production/modules/stdlib/spec/acceptance/deprecation_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/difference_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/dirname_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/downcase_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/empty_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/ensure_resource_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/flatten_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/floor_spec.rb create mode 100644 environments/production/modules/stdlib/spec/acceptance/fqdn_rand_string_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/fqdn_rotate_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/get_module_path_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/getparam_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/getvar_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/grep_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/has_interface_with_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/has_ip_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/has_ip_network_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/has_key_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/hash_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/intersection_spec.rb create mode 100644 environments/production/modules/stdlib/spec/acceptance/is_a_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/is_array_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/is_bool_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/is_domain_name_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/is_float_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/is_function_available_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/is_hash_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/is_integer_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/is_ip_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/is_ipv4_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/is_ipv6_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/is_mac_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/is_numeric_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/is_string_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/join_keys_to_values_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/join_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/keys_spec.rb create mode 100644 environments/production/modules/stdlib/spec/acceptance/loadjson_spec.rb create mode 100644 environments/production/modules/stdlib/spec/acceptance/loadyaml_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/lstrip_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/max_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/member_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/merge_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/min_spec.rb create mode 100644 environments/production/modules/stdlib/spec/acceptance/nodesets/centos-7-x64.yml create mode 100644 environments/production/modules/stdlib/spec/acceptance/nodesets/debian-8-x64.yml create mode 100644 environments/production/modules/stdlib/spec/acceptance/nodesets/default.yml create mode 100644 environments/production/modules/stdlib/spec/acceptance/nodesets/docker/centos-7.yml create mode 100644 environments/production/modules/stdlib/spec/acceptance/nodesets/docker/debian-8.yml create mode 100644 environments/production/modules/stdlib/spec/acceptance/nodesets/docker/ubuntu-14.04.yml create mode 100755 environments/production/modules/stdlib/spec/acceptance/num2bool_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/parsejson_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/parseyaml_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/pick_default_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/pick_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/prefix_spec.rb create mode 100644 environments/production/modules/stdlib/spec/acceptance/pw_hash_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/range_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/reject_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/reverse_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/rstrip_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/shuffle_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/size_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/sort_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/squeeze_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/str2bool_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/str2saltedsha512_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/strftime_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/strip_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/suffix_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/swapcase_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/time_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/to_bytes_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/try_get_value_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/type_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/union_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/unique_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/upcase_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/uriescape_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/validate_absolute_path_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/validate_array_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/validate_augeas_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/validate_bool_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/validate_cmd_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/validate_hash_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/validate_ipv4_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/validate_ipv6_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/validate_re_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/validate_slength_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/validate_string_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/values_at_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/values_spec.rb create mode 100755 environments/production/modules/stdlib/spec/acceptance/zip_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/absolute_path_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/absolutepath_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/array_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/bool_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/float_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/hash_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/httpsurl_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/httpurl_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/integer_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/ip_address.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/ipv4_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/ipv6_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/numeric_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/string_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/unixpath_spec.rb create mode 100644 environments/production/modules/stdlib/spec/aliases/windowspath_spec.rb create mode 100644 environments/production/modules/stdlib/spec/fixtures/dscacheutil/root create mode 100644 environments/production/modules/stdlib/spec/fixtures/lsuser/root create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/absolute_path.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/absolutepath.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/array.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/bool.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/ensure_resources.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/float.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/hash.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/httpsurl.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/httpurl.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/integer.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/ip_address.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/ipv4.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/ipv6.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/numeric.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/string.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/unixpath.pp create mode 100644 environments/production/modules/stdlib/spec/fixtures/test/manifests/windowspath.pp create mode 100755 environments/production/modules/stdlib/spec/functions/abs_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/any2array_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/any2bool_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/assert_private_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/base64_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/basename_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/bool2num_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/bool2str_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/camelcase_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/capitalize_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/ceiling_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/chomp_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/chop_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/clamp_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/concat_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/convert_base_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/count_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/deep_merge_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/defined_with_params_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/delete_at_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/delete_regex_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/delete_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/delete_undef_values_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/delete_values_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/deprecation_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/difference_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/dig44_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/dig_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/dirname_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/dos2unix_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/downcase_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/empty_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/ensure_packages_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/ensure_resource_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/flatten_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/floor_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/fqdn_rand_string_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/fqdn_rotate_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/fqdn_uuid_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/get_module_path_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/getparam_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/getvar_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/grep_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/has_interface_with_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/has_ip_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/has_ip_network_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/has_key_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/hash_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/intersection_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/is_a_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/is_array_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/is_bool_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/is_domain_name_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/is_email_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/is_float_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/is_function_available.rb create mode 100755 environments/production/modules/stdlib/spec/functions/is_hash_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/is_integer_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/is_ip_address_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/is_ipv4_address_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/is_ipv6_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/is_mac_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/is_numeric_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/is_string_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/join_keys_to_values_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/join_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/keys_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/length.rb create mode 100755 environments/production/modules/stdlib/spec/functions/load_module_metadata_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/loadjson_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/loadyaml_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/lstrip_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/max_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/member_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/merge_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/min_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/num2bool_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/parsejson_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/parseyaml_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/pick_default_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/pick_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/prefix_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/private_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/pw_hash_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/range_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/regexpescape_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/reject_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/reverse_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/rstrip_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/seeded_rand_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/shell_escape_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/shell_join_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/shell_split_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/shuffle_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/size_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/sort_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/squeeze_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/str2bool_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/str2saltedsha512_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/strftime_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/strip_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/suffix_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/swapcase_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/time_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/to_bytes_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/try_get_value_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/type3x_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/type_of_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/type_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/union_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/unique_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/unix2dos_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/upcase_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/uriescape_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_absolute_path_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_array_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_augeas_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_bool_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_cmd_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/validate_email_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_hash_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_integer_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/validate_ip_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_ipv4_address_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_ipv6_address_spec.rb create mode 100644 environments/production/modules/stdlib/spec/functions/validate_legacy_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_numeric_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_re_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_slength_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_string_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/validate_x509_rsa_key_pair_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/values_at_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/values_spec.rb create mode 100755 environments/production/modules/stdlib/spec/functions/zip_spec.rb create mode 100755 environments/production/modules/stdlib/spec/monkey_patches/alias_should_to_must.rb create mode 100755 environments/production/modules/stdlib/spec/monkey_patches/publicize_methods.rb create mode 100755 environments/production/modules/stdlib/spec/spec_helper.rb create mode 100755 environments/production/modules/stdlib/spec/spec_helper_acceptance.rb create mode 100644 environments/production/modules/stdlib/spec/spec_helper_local.rb create mode 100644 environments/production/modules/stdlib/spec/support/shared_data.rb create mode 100644 environments/production/modules/stdlib/spec/unit/ensure_resources_spec.rb create mode 100755 environments/production/modules/stdlib/spec/unit/facter/facter_dot_d_spec.rb create mode 100644 environments/production/modules/stdlib/spec/unit/facter/package_provider_spec.rb create mode 100755 environments/production/modules/stdlib/spec/unit/facter/pe_version_spec.rb create mode 100755 environments/production/modules/stdlib/spec/unit/facter/root_home_spec.rb create mode 100644 environments/production/modules/stdlib/spec/unit/facter/service_provider_spec.rb create mode 100755 environments/production/modules/stdlib/spec/unit/facter/util/puppet_settings_spec.rb create mode 100644 environments/production/modules/stdlib/spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb create mode 100644 environments/production/modules/stdlib/spec/unit/puppet/parser/functions/is_absolute_path_spec.rb create mode 100755 environments/production/modules/stdlib/spec/unit/puppet/provider/file_line/ruby_spec.rb create mode 100755 environments/production/modules/stdlib/spec/unit/puppet/type/anchor_spec.rb create mode 100755 environments/production/modules/stdlib/spec/unit/puppet/type/file_line_spec.rb create mode 100644 environments/production/modules/stdlib/types/absolutepath.pp create mode 100644 environments/production/modules/stdlib/types/compat/absolute_path.pp create mode 100644 environments/production/modules/stdlib/types/compat/array.pp create mode 100644 environments/production/modules/stdlib/types/compat/bool.pp create mode 100644 environments/production/modules/stdlib/types/compat/float.pp create mode 100644 environments/production/modules/stdlib/types/compat/hash.pp create mode 100644 environments/production/modules/stdlib/types/compat/integer.pp create mode 100644 environments/production/modules/stdlib/types/compat/ip_address.pp create mode 100644 environments/production/modules/stdlib/types/compat/ipv4.pp create mode 100644 environments/production/modules/stdlib/types/compat/ipv6.pp create mode 100644 environments/production/modules/stdlib/types/compat/numeric.pp create mode 100644 environments/production/modules/stdlib/types/compat/re.pp create mode 100644 environments/production/modules/stdlib/types/compat/string.pp create mode 100644 environments/production/modules/stdlib/types/httpsurl.pp create mode 100644 environments/production/modules/stdlib/types/httpurl.pp create mode 100644 environments/production/modules/stdlib/types/unixpath.pp create mode 100644 environments/production/modules/stdlib/types/windowspath.pp create mode 100644 prod_env.png create mode 100644 puppet.conf create mode 100644 reports_enabled.png create mode 100644 user_prev.png diff --git a/database.png b/database.png new file mode 100644 index 0000000000000000000000000000000000000000..9ca4695cc823e89f535a239f7d5c3c248fe063ac GIT binary patch literal 213159 zcmaI6W0+*Y5-nP7+nTm*+qP}nwrxxs(>?8;Y1_7K+s5lT_nmX!uUCI+@2s8iMMlJ0 zv36EQD#(e$L1RM$001~i2@xd#02l-S06K>R{~nPitj_uV0(BOWRDt~d_&}OOeBWca zh-$bf+nc$#8#S zRxD~YSQWaSEi#5Ngb>0SLJDK{I-_%q3+o&FyF~mRJz|2*3H*P5Ld@M`Z~_1CqaJa6 z(^&uKAwt+4PIzJS|2v6;huGX;26r%d?L=K*@}Hgmn0R*WqvHmVu3%mE9MG=27tQN# z^%|&&sQj<}us!+6>rVtF6@wkhqv2KCM0o8YJJL-NL+M=Khi zPo`zgF0%6Q|2a+%#}$nHJueoY_w&f(rqe%mY_T1Uc!5KY_Ybc6*9Vu3-3N=B?=h~< zOJ~jQfd3oSIKSNr9m@4Ear`#^=MFxD{U(pkHVA$I;~|!6G2G@|?vuet5^3{sVRTei z9;J+|Y+xoM7uRZ2`w_5?&&|Mct)cMq#)Vs*%ZU=M_jw)1L5i|~$dqK~{|Tf$G;9nk zri#Z6pMUIH-ZROgZZkB$|Eu`U+Ghp)fb7?iRrY6r^E5MS?#OF!-upf|0TIu~{ao|Y zrnlp?AjAbzTxP(u+xL~>=ljc4gc_Xxle>R791h#IF#fB;?Pq%E7duiM&#lC~Yb>pH z<8~x@Zue5xr|bE09f*0hqnN~<&i>ecLeH~in9t1MZsP9qR?uXS2Uco0Hp%MoIeQlX zx3pb*7dNzeRW;cAk-pt_^~N;$dhfq#D!O&{;4ntpw7s7!KRCg@74y$QjTWZ^dZj!y z#8tZH?V$Z9dYGDSdYrH7?kT@VW}nBuc^5wq*PW*Z6vgo#s42hN?{rC^ z2l2n-#dTQRY5thw?;U=|tbTdS(ePXCSvJp`QS;$kcU{t5ZgD1;$$30`_GGol)QOrZYdIpnEn z!wsjp^VOaCiXW4*Suz8{^5JC2EWdG;$cqTK1 zIKD57-s^07*h$G2i67j5ApRFjD<{y?4F2uzhd z9G}m7$u9g~FH?@QlH>(*C)eV*3$%%P zBEQG8y-t4v{Qf?({)hgi&@EiS8|T-qx%0U2x863b-Zz@;zyR6amyyr?Z(Si%J_oQg zt#@79`g{)PWLF=sfbGQ-m;h6IF_28KqMW5$BeE2K>*SWmiP^zb?;)8b~2*V$T8IC-4s9mcP@IqfgBo5--)@T@9*p2g-)jv z;XKI+F&@Kx*-VVd0Kmk<8;8~V%a;2H=5Pi=$jW%C}q&1yZAd7dv@+_!ne zz~-03pN^xHrGV#&-T#rr6^r1NCm!zSt#I8%H2e1b9KwLA`bOv$-yP)o^If##s~)}Z z)y!3X+c}90|1BP__bsD`(H~}GFt2Z5c56lFaJw5FP3G);5XbWbefK@Xli8A;oF6N+ z+J|m5-_YlSlAgNv{(KuD&+A`rac1P>%Pl^6@OoZs>I~(+YDZaXvPal5!3Z485r+CY zU-{cJURDkrjX^(X9M7v(Y`<8kDd}0`y>a%RLe&3yUAl?2_W=>db4As=iBe~AW85bI zudY7RZ!tt!$A903(C!*xW=7bz)&BW!@c@UDlJwnKX?nOT^NFknoPnDEG)9lco^G%Z ze*GuZ&%<5k>#4kF!pALtO1`(2vzx6+&|jBdJX~#gkZ>(4TqlIpxSb;UpF-hn;cKTyi| zK$-2a8)@k0mFN2i1mL-!7S7;yr(3Mn{kfmRZvW$7Wz+kfNdKdmx}#igqb=Vj+im`v zew6>DKJRV)$l-oQeDAXDYVaFij;|-BQ^Q#Qf$70mdUyoH_TgGyEO-UJY%AWc(o&%M zyT&TnNv<;*8l7fDbsa~rM*FR}7Uv_Qu{2tZW(PwJhS#6{|E-H|0rTzr;I!?U&(lS<_Tbw>e?4Eq@!T-0 zTMn_;{l7j8fwuSeNjl#)t_tT)48Aep@y&nnXw+&U?H`?8_a*cL2!7WfI_?{;h9*!V zeXje7;z1D(8?H+`w`24}%gdOLtJd`AU0M>+1hJK^|)w+Ca2s;ZE#d5(iv z&xhD^{%Y7wek><$9Czc)Z@1sUA|ofiNo#5c`xmV0u1~LToo4tg z+YCPd*FXPUW|L!+s4%K z+yCV1F+!V<;!GTQ+Ai9gFU-%}48ZjnjxAiFGsi8?f5h>(?#=9BZteBhL*a%XeM>Ja7yK6C zltIEZC?JtKJi;KtV5P&j@p$1}DLF6{?u3S!YcQWEh!Nn)g?S#QY3BCKyB3QiR`)tV zK!ga1-b)bF5VP9qrR4^RiyvrdJ@YqC|NL&rh8I7kXpV`drJa@83OoanS35XTKxVtu zt!iwgQPy*kND35~J17O$^d!P)4OLgcQ*y#x5capC8DoQycwGA=)E~ zuNY{z$YlJCL+vUD*Q})RhR(9ANA%HHb~eP;x9Ns&6;u7gEKe#4rDn@S$c8pz`M1dw zN+bFXHmMoIoAgf~ZOJR8w3Z`w~{B2>Xho)ct1HH z>`p-?Y>Zd`IQo6kfoQWFS2*-pn1Li<2e|^9|l_Z(U8ZgGl9J zih!pbFT;nfQ0*_k(pQ26ju8u>U$DSa-34&%&fuC@(xQc$TNA0)I3eP!s`}e)!ylTd zM1G!RgM!yN|CaH1dGHy5S zBP=J3ORutZkm?4dZdHuYAR1|bReX%<-XBFXms-WHMAhuW^lqX#bCC068Yme-Tty}? zNnw~80$WXOL*_G&iqJZy2uK&w4{z62dc{o1qXKB6$O0xD!IUbNuBecbjV4~`Rh_!-o zA!$}{8#ZJ5Bb#7V%0Xa<{u)E55%Zk>M@;Vc1jN^qkAS`;c!7b4?lgoYZy5;7Cd^04 zCLtDxqmOjU;nA=5Y?8fQ7B62D%4L&cX48J1lm4ory+Ex*$eg3EDz zTWrV(*Q9?fU;l&~*q|La5vdUl*4PwdSsa^0=EnsJqAH>{o!h)bhcPTHB%To__^?DU z^ZW7^uk?%BFASZOeh(1JdK{-BTl9ky>iz_VwxW{9cjhc%K2ZAz1ywQ;2qXSRxh^2j;K*%EzqkZ5=ZdHtMk8|*YH`4ka+3_O9 zU(ziF%!(=ss5wlFJ5^#3%EKyHbB8BuHmck2v6;*6ct%N&ZzV3A2-*)-1J_1UN{ z2qXXaGZh>S0^{Wg7^;9zNM7(HJTQr7|3DY#tnHjm3rX$?uz0cL4e zr$b&tSlhd_Z`hNz5?hvva;zURg7}l*oiC4EA^dB=5ON1Cj^=l}a_?q>W(74SVjEXk znBnuWu*9X{SgSxYfput0&lF*)Zk{K(3dgm#c2S!-8G zc45<&gP4?yqJ=%}o1#Akswh9?sDXN=jh#g?T^wJU+xSQ3to#I^3PY+GRnmr;$2I{c zj&I8iOdj6$eQK4KB0eF0bPC&bjYY)Fn%K|qubcwWpMAu#;>a7ynL#KlQ-!FO=?x?P z*az5$oJ5&@T)&j{AvqT z!+DM9ut8wGy-iYL9acXgb{3H_A5X=w`n7sj{6KZJk8l|<&oSl~a(@`()le8i1`Ep6 z=BDpkLc7JR+pkzMZdCAIaX@-yv>T`|Wo_7NVh9k-`{4npZr;@5;v#idy*Dk2^1@F4#Xjat9ur&#s2um7DzVBQhc%B|G5#B4Rf z3T8l{>eAPBAIPANsftofj~sV+M>hOb9v*#~P93LCghIrGuk~+^ZtQd?|1MNkRbUpjZeD6hz{<6vwGlu)RU-b>32X zBrN23H$YdoZ#$NTSLfH(Q~JLcPj_h8vA*4!fSph4EhJ8#Pg znD){ndT$MFnRgj%ff7wMXV{5xUd-J+?DGavpfDY<0N=Lp_L9LfCE{KqnZ(w-oMbj# z1Y44ixeHeivN;T38v|Rbaq{NchuHxM4;V;H6j%g22%-WP+_Jqr*~9cm@1+XgFiXIE zG8b*KeJf3r>#V1;>q&A6I^~_RR|YqT2-z`*qS75pBSNN#bvlw+Eu&`gP&7D>9-UqI zVD-3vbY*&2dNc}^cO5kq)=^4Z$YTV1qF*3lY1It!b-P3-j^!R@pT>4qp*)TYW!kyS z6Hf?}lUST+2;CBY@&x+INlR%jw@VGQ7{81(vtIBqD%rl=ugcek>;jJm`QdMOn^I#Z zqA5|~AsK*qL8{4l$>9QC5QL1N@^ufcpePIaE;vGG({|ELeDX~ zh1MHl%Q`8-_en>j+%sp~81%nzA;%wYVah?))X?$BMzq<+y}4$(aKBG!P0D#EuXEYR{8XUJ3R9Jzy|Ga&2!fEHcAqLvGlx|wWe-1sqaK@d<8 zxZ;6tA%~N>_E1%@$$EQxJ%}~~&Q-C{POtBdAoEJ9w~&GxF_vgH_ux3; z51L#RqVFM%c}rPX@5vP;35VG^B1>J0xXfuC(jOahm8}{7zsF=*ojXH72_}-*{I}vM zJdk#&2>tvPg%-3Xh(!>XkotNF3t}o#5j(?gA}?vUW6c}vP0W`~g_a6`K~u4jz>JeS z_L3B-U4tv>Q(ntpvy=8M`v~76Qt&t7_a#9+wL9+k#Dk=@Lx60l-m?nU!%{>cVxl^Q zuyuVS~GlgjJ$Oz)7l#V`*&k4o!b)%_6t!GLxYb5L>zph9P0}U=h_KC~6;B zl~blm1VH)nF{vLejkwc|sc}NXt~`R(!_J7o;jM05{wk~UN+Wkf+g#39jc$XV`Z3$A@JRz+vGZ@TAh_j@Zh11Jc`0F4bm!@ z;0qdbp(U+ff@`)Pi@k>AHUMxKdc^T%I8r3h52bTP5N$5d36d^vXy7i?F2{N#W$5sf zU4Z+0%0BJ|OPTVs`dA{t46Kiu6YAt_ou#*Klt{Q#7jH?45zxR%Q`yjFffBG@${Neg zDaiW|E5ek)4yj80pBzD5UQ#-(rz^zSY+-3+6D_{-EdX!(BmB`xDQ+|P&eWALgLK@W zErmP7eYMFXeIsJ~M8X4Dl!(klc)3B2wh8O+#}0or=H`C|GvTJJ_7cpY-nHf8UXz1^ zl)PA1eI#-k6z@lY*iuT)E2&--LrSR?J7$s9r@PV3ma{)6Mu^%~maGR6kX=-ajzNIQ zaf))WDl(#;I%=3!u;7ih6-cC$N#h1)aJgDZ@wu*}<*!wgq}QMPC2-TCe}z3|Javv^ zqAGg;a8ifD?wE2$U|_7Cisr>_h0{VLDy6RfMVw(jxsHZ)0HC8WK(2QS-h z+^Hi~5DnOR!+*SlxkWr^?5t5dpF7t9qZV=C*-7|#1b-p12DEEVtui!Jc?Eu@;XGhbl3tCuOmTmuOb--Ot0A8&Ghy1Q zzOdUGTuntkCl>Kc>epbsBmLAj&~7}g#Uv|D=#p?P!f#lpAz`P?IiTnuYrl@g?wyeX zNz6jFv;;w0v74Sokh)0lpWC`?Mcwk|YUj0A+F|8MUnNHx2A34Avk8>TzDut+f^5e! zJJGpx|9-1WO>8?4M(8y`6q(|L{nS9VXFa$#ARNc5FM=%^B7eKDG7sX*&B%ubGiu7H zZA8c8Z(RV#2T=K|)IO=a+jJ=4jhS^RttH(3igBF@(#lzda6lv>yH$p;W6UMYzg+|D z`S67og#`zq3Em6Bz;t!UXQc#3gKBFtWY%JCVMe{KHw9-4Z(|;|h@1o^3cxvQu$WxQi#Cd@f1Z-aW?3Vmd6HmVCJ&{gN1}YmTu0hwR8t_HOUlzyqB`oC zpG5PU{((C_=jesyOo{`$X!uh>k07l3(u7epT0aSx)PL2vUNfrK+tQ0xxC_!kp9YmM z3&$2+L-D`~o=liqfKwP6IMcmsU0mi53Nj(wOhr%ZWtDs(jCAbJ-Q|g4mC^)3`p3t|DWdMI0Z{>Rss&*`waK5WA_tkn5XF|!&)ta$ zVlq~SCjmk+4ucIy`4kqo&u3zrcGmbW$3Y?xm`tkh0S`-1B-T_+122TU`9 zvo1~3sT$3$atRwMRo2aRAWe><$;atns!`Od?v%wx+8v_uvd*ytbVRSOLJ^mfWd%9+ zub4~mBdD=p`Cagz{LTW0vz5~2;U(-vpEYBF_RnO#H-*c{HpBd-hHP(dmY>`-n(sqL z`6Se7P-`wH_Ivs;E)MmG{urF4`*%gLpw{wKxxNreI?aF20w|64(X7SzqGe`HdtiG? zgD-YSwdwL>NklFT^11s-#R+87361`Icb{3I26{TF(B#E7B`7G-*i%B4s7SUBpRV- z>=OG^Et3s5UfK+PGAXd_EpV9=JlU^Gbm*>{45pDx)j|uX-qols%4t)OSV1%uF2NIBC=6wd|UQj5QZ)iM=~AcVX7@;kyX8=;Cm*opK9 z(HB#(UMA1WFp(xjG`@QgycY`;e#dk0G*^L$AQgBVRc)-Y@-r&(-r2?WOynTuc|8NhHms#k`%X+lXNdYCKRVVH!a8YvgGo$g|!kSEp#E*&m0MahB|FD#9gG65GoX(m0aSOgrDe7E3 zx4)v#Ktja+#KhHvC#(C<6+B(;-wPDR@tb$sUVyX_2a6uWV(y(9m=G2hl@fKx^XJM9 z_aYegy9N@1NDIVoSglZM_o<+X$)KS#C$R^Np#Q#3M+UR1+Uh@8;_JSms@=o_AYu^y z$ri9&R{D4EvLpauThs-fEtiLus;mLF3TK!Q6>zMdtt~B{ z{Y6qYjeMP!AONKzX!#s3>&=&Mr}TyXs&yj4r&w!uLB5chA}82J0`0oAHV_-r+(KOg z$JBuveI$ zZ^oAkE8I)zSkEY^|f3UtR*ht-DH#2b}V zr*}CV9?N%%D{eU_W}#!NN3p816B2^k$|4%BL2e9i@pjRP=Y&9jNTT7STjwGe26ecA zw?D1?wZWDK}b^`qv0W7!T!FIxGRsbH&(dW@wm+Y{65WUhAm(a^( z7=(HdS$T(40;HrMR-Tmh2^7g_@!Y3f1o3l{-|1F*!-%JibPlu`=5Hk}gG{2e$Mi0c zHy5vzZ00CVem5UN7DTpn`TydIAh9DEfm6ewDj_h$9L%k^?^3!DJf}wGTd!`MJo#wmd(jlj=zqAA_z*$zjw6 zpE;B|JwYY8`2);%-b2?3Rmz6~(}*!bP?IW&DG5h`>75C4x_#Wn4yh|#E{??|JwJm& z=Q97n$u6M3BI*c|gQ|Dq@&~tf5xr*rg$3e{_`$41aU)?!QLKcT4wJ#X#w2S59eb=z zbBj~v&w3leGgO*2hZOpk`>_=AQ@~rc#hR2Iy;eIrKrwL6-(3 zO`SpSP@%}NhGs6*d!d8R%m|QX#l0fBZ!mcr6!*oNrXo~Msqs1*DGpT7g!bBy&7hLa z_17IC!n0&s?R9iyDj}z>WI4_G0UHnx!lMrUbG*#h7z!~y`zEZYB7}z3klHay)o;%0 zB?CiUnEO!@`vXsuLaksW^`bqnDx$$$Rg%+Hds|5u2m);DI zej>7d-#aE3;c7Ad^IM?!$mF0;LPEw~V?-64|ZW4H@T-`w0G?I zvIHF_N8YT2c49|(k(TIuiygZAly$>pv=7OZcmp386{)rG{Y@P>ni`cm9_(qO>$lT2 zHu8dEFqPLZ*;#OtfZgDGX2wY@xHfD$`vlpZ<>RxOpWzD%nd1WRrdQCmSubWtPxK&W zRum8x{z_Avr_=Zv9nx@|Lm_e=zd8E$)- zo%X^kCv#yun=^ayUPLp>6 zu$s8GnEEioDtl|*bN!O6gRAgqQ3%>di(@>DhyYA>)I}Ub*Vfp}^w1&9t$%X6bqV(U zS5|W@MZi--`8NEaf znL2h%qwdK$VX4nlxGF0Jja))S%7(B}!0=ZIFxHO?sHE|+Ad4$;f-DGe z^1p^Vsg(=VFq!;8i|6D>fRC46BHU~0TiM3^{wvksOiq~u1V+jHIa*Iq4e5{WXng20 zj?^xq6a*HlZO}G_hM|{(79^VLCt8uV>w6Hl*n#-YU;@Gy3YBzO3{;%#M4gYN4OtUR zpl$3ZNALu}y%!s9E`?26(XS#U7oU`0tP0_nzkLS91&8egP0r92<+RVxmAxQ-t1rzE zM6+MTi;+>FmF=s>FV~+tKC`<49tr?bFXJXsgyQPg+`DOwNwZ1ndTQAFtaGJBOoRCe zLfe8x&;1~hXgbuRSl7aJLlF`s7E`bF5~nXl0EVx6vrOYy!W%$(rB-)$wvw3I};IduPB& z_h#)s1RuHG*uML%d@eBxc1TLAS5H3Ex=;1wZfSrJmF?Al<(#PnDHhWMvjp-9bwyD# zF)0DUfup{e_-)I4uBet){``E%AScAY|VY*FeoWr^Y!C83SsqmcS!>ph6ihc&{HPkS#cp@_IQ)*Kq1yD-it zHc1G(-9YXZ2x_+oTNb`e(+DJijTIO1B92$MqpxmCEq0VEp*4|x1a2o%wf)YKd$yCt z0}nYtg~`tt5K6bR^sexmE$)dGU1D=&7SEC=$@y@5A>U7}>!?!3$E@_%s+dnbz*t#1 zmCXb(K-obtel*L$s7O^zt2(R!Rz~B9MrBc7+QwRC(EeqQN;j_vqMi|$x0&;6cz ziByw(k^@R|5$gmsy;!@ZD>Jwd03{F)^3?GZqbE*9aoS=nsu5?_tOsh;0@9RhpEMa2J`i#h5 z{`dkwn zJa(_?KejYB;(KKryU1vkh^(Ud3DR7gd>pue(gB3<)K5Tww7N?e^h2@t!snaB{y;3xRx0VGO7l9eB zzWzkx+++nXWt7u;!OA?Y6AGG8x!*JN=`Woh^fmv6AikhXO?eIXBMqap-5PDa1Lsl= z9Yt&%G$=0LE@X&d6via(&6W$*%%N-jWt9c6N`I&utD)>nzeh38#m)h2u@Hs|S;hHa zKQ4M+zLZVWHqp>vXu!srO|8P98Wj@6JqAtVw>IDL`945RiNWB6p@%3=#71FP_E5%8tOWu4PM!iA*VHpZDV~_?M^gO_Y|AsM9|5B`EWAQ)iEkO*SSEmv*rsG8iz`79t-&Nv zJZy&-TfvvqWyTVj&`UYB6;~~|L~#91O#kzRlMgAKUg6VWWMv$wLf?1IaJq?&ci>d_ z>(id8YxRq|=k8ot5KAf?0R~95Xn&A_T-)a}0K_p6FR+hDpj6@`b%>14hzP{yWvZ!X zGI!9<-winJJw4d~L*8JGdg$L#%d2`k(jaaf*1O{90fr4?h#*Zcvq0?4dBouvVZdsCRHL+zr+`Y1 zd+Ig=b696B-2yp;lkt<2#YYah#9#Uu`NuJr;_=t4QtSg#@M^nc;wWCk3> zFQWPlyW=hy_|<6?439mex2JRd5f+`~2qDp=AgvfXe#oK#nz@+gWv2ku!xY* zWD!wViBkzrCR_XY@T3kL2_92_S24LW020^&*~k+*r}dd!WVz)Tz7a&?VojHAd=OjT z;90<)r~sEv9*+r{*EO@c!AmH8&oB1s!MHy5AR30RGirvXwJ{)u#?MFL<Vaw7UsjXNgv3y$q38Anq>%Qx-Fc5pTU0j&Rb9}pYL}!o>O;|4om{w zlNfwJ+?##9(ed#0lON}T9;Y2m2Jd6k0wT-Tq123DU%c?#dfxb6Z?<5+U|Zd3db8#6 zLQYR+0^D~i!|U!2;se}&g4$vaEFX+9daZ2o2^|*VDtA3_{F?NGd`Qa4mnAOiY{v(b zEqnm*n~>(Zy3m)sxobT^7u3^@??*d)+Y~b78%DdC)_(`1!#*xCJuL^(7BQh&ovH1H zizWfYzLw;t--df?pC&_Tez8FC#ZIa2)qK_c#bHd)k6NublokF>>K+;kWR{NF~hh|Kj`gbq-cGsSV=X z&2~-Fv)KvR5swG3xeTh3B?5l++%+vV=`AC?O#&FafQs?o%v~?&xFED*Y=8ic{kDI& zIL7xb0qaS|={nM$R$%nuc3?d$J%(_aP#@=49sBz5&u?i$GceqC*$aRC_Eq?D5zG&V z-v~?O@4!#C_YO>60-HO|{$dz+{3!@i8nD{E$r`s=;@$gcVpyi-`U>tc>5E!F1nTiY z;gx;3}%a&Or?;uT1E!Jp{Z&`k2gspX}PU+UgPfH2-r*$tNM4TwAWp7Q~L7x zNtLOIKuS&?*GIwkJyEX#5?J<|-CKT460dv4j~6&fbd;gr3X`?}!m@D2`0HN}3oss% zls9;j#vds3=K&_Bl5J>-*5ua$7Y;eF_rU^e?@Z|h9_2JaGhNkSoXKRrf|}{KU>F3R zfHZCY=I=lwuD~eJ<00G!1~lgRBOLmek(NUo0`IXlc6{pDc;9tkeuWDIA^wu{1x6|5 zk6QV1z#Q+}t9`TSi*w(ET3r`CTHOEw%!%7~?^odWFN-69{m2GuyK zeARU~zR!aP-e|?~h`-2qO>Udk=7(@O6Jj7a$H%EN%e-=j`LOb@uX%9BaU}z1dfIGr zqdeY!*!DgID-kNS6Y#xA5;3UQ@2n_qs(YRK>!`oMhqf(OwaL=89%dYgIM2ikr+3^<%G+k6Lb*>~a3Vc-KJ8tyjf zg90$y&aL?25V@5IimH_V?ji6p!JyD{gB=!=&-lJ!%XFS-sL-zlOyc18?61X5hOJ5| zXw^G@T$Gg2Z{ZR9`;!0SyY?|~qIdav_B(<_RM2mPJ#^2#o($+y?C>Byt#F57asP5+ zJ&(sQI^7Tl$h!yLSZ4G!=HI==8=jWJ0GVYNvllsU7G->{ffz1L25HuzY&>nIPtPil z`C|Aye6+(b1kV^N_<7AohV7no9{J6y(~4dBUqHBE<*@UdX6Mhb6>?egdg1FtdQH$| zd^8n#&wy-~ww85uVFDDYRzptR7mZ(Q-~)8`UQlK^^yIVscmPL`GTDAXh)XK-ALSU} zqQT)A%zw7LRI0@r0@;mp%vUu$$uSdZHl(C)Mka#=++bD*cefZk9-n_&5g&xQ#ekz+ zz~r0p+upQAogbe;-oL1clvAgUq^U4KwG8@vxOdlUo>q3AoBl0^3C8s_JX68;9`<;YcON=GdlG0Uinbb~K>s`=1O!ykdqcwT`!cjXO+m=2VYb)< zq5B;o+VI}(Y|GgAzVvBap9C{{efeaJz>8h}j1SG@#MGYh(U_QVrV_u6KV?yVv+o(^ zy#oSn?EK^#|Jap^+3ftOzkC??1s2ef$Ad}iP7f-pmM>eB@vxG5jMoVT>z;bmpNU|6 zuME+%&W+zb7oaxPw@j{X^xaiJy2$iD2*mhWkTrNQSXhBOz3ImJYh3PMUM5erw4*OE zo*=4qp*PhEwEhBe{5cUjwtOju>%jWTUYxCA$-EbBiz>@&5t-{TnAg)pU9V9<9$2Ln zbL#mLGf#^jYL_lA=b9U{Ub_>^>@(vdb7CTC(Vp+#g5$lA(_pO--8!vk#rRv05940C zO~9PDbjDxPK|th`&d2};`-3HzZGQ68adh9L;mqgha9j-YH8g|S=8VKOhsL$mn(>w)}S3 zN%gjgDQfQq0C*|JregkNG6^x%1=p4S|L&c;Y?i~IG!h`N!w+NW`l8%hO ziM~pWC((Y@q+a+*{5g#G69`{A)%<~$Y zRZ=-!3Vh80TOn`B_ug*mo#fSD)ibHN(h8^WwsFWHcxS{QUIo(Yf5@pv7vz8tjGJiT zi-3esb5Azh^WVCCj*X+*o~DHDSK_X#o8I7E@H390U9QCNH3Bw&a1*5Oaa0d1rh&we zSOA$Vx6GBX#RmaouAW%Xb$n7Pde^S*FRRDqJRS75;XoL)#k%i)>7rEPTD*sok7wLhs(VQ~cVox^Ew! zxA}OafKYA-eYiC~)8hD177H;^_M;ot&jr1<1Lm(2%=zgHL%0o4qpKl)4jL|b7IW<6 z8GZ<-T@kYi@#5AYglgvPqrr&7-F<&U;G(ZHV{l^MtCWR9?o{ zx-|p!_~0x2a9z90d4AJlQ>*i~ zCGr|_IsQ6^!kNV!rS*v(`B%cCo=pwCZpo>i0lK{8vTa_t^-CgIhq;cr62ucR1Xvp5 z6plVJx3B`!+g(BeAtqoK0$MJ;=;1P-jas*jV$svXTqv*DECkE_e&3to}nY}+O=)ZSwx(^j=`MuZ{i_W)5_fI`h^&Qz0R7>9?nG2tVNyKlx{*rp! z3uv8*RdCGAC5<3C9?sX5#tRx+k#I@Jh5Z0=)qP``B$$uTZurITX#00|vFek2Z<33^ zOv0v{DVWL~Lf}sqH-`wg?B4O(Nh@iYoGya*l#fbjwXp95vMFrfWnLw?{e{7){|_KN zc5r6RK=TF6kKKji9^ENez}y_G*l%jM;zo1PC;D?T4=Ys1oswzux`*DjfGWK4ueG9S zO@8pK>TYB7v#*D8hX7=NOO<2Rjx57}&jLVDEb#J+?m{zfz%MUK-jV!hb%K4fA_E?z zi?=n1^MuZ6;yccbUk|#(ulm<)f%utVM%uOYO_$_*TCW~V$EH90)ry`%I}|!BP)_k_ z1Q^nATU;4)sk|YsGWT33inFWBcHdA>Uohx|S8N{D@gLH_v zxWs9$3Ar4vLMH*{;IXRK$&VSL!?8z=LWmUJgk?-l9z@I}h2m7k{{I1oKzP3lI0vA$ zE}hzkxRn_Sqf?TFg>be>_V!9j3pq_trWqLBb+a+KVhcupwkUL+$^EyW^Mo5ES+?l- zG-E$o6#D1niY@3qFp{OAd~QM0?HkkNsgx~SomBRkdQ`nL#<`&(bL zJ4QZuGw`VcU{2nEsrSFY$$}R?bNFUVTyO%g-Cfdb2{4C02>_@-?xe$q=Ad`*R&;J1 zg{fS7)(1T8@H3J~y(`)Ye25l!Bknr^lZS2!eC~Ljca1ygaaN~; zDO;l!Hn4T~8AwN|3DhNED#|4X4b-OOTql@#`6)1mZ$&G+;X%t2clRRjP`8eqh_za>^g(&G253fy>*k%g!C=?-YYG_07`4sEKJLxs#nQ4iXJg}SvlYG%DDI8j+-Q1R#6}A zY#h`@f~VwoWIBU6X`hHgl@)l}(g^w7P0kDd*@$6cNZ8jcYP0@`-FVBM1M5e_*1Fa1 z*6Q^Hz?>`g#^&=^V`9Y?)ZH4B2Rw}}Z@LHL-(DU@{^M8djVA|ktg6RwHMdz};UHu8@{QJJ>z2#ouz%4Md7_@Q=s<*ktUDMvE z@fY`p{nIVm1=$!Kq_{mZ5?6> z2W@GSSA#0mq=(wtyCi@8P-%yx?|i?H+9p+Nai|8cJitt=trDlRXnp7%RR4f8>3|XW zj3Z)sThH*jr&~(x#4;ILxym+j@!6!U1f_)-i*zJE>)Jign?Hrke|)>&HaLbkS1iZa zb$fVBj9J(20lQ!dPrmE6kY@Zl%Q1G{vgoaPr1LIWi7n^fgWiQd1BkK5xvRphdb5A9 zC${{-of!M>^U%F-K6d-V7Xbv=j~teCtla-%)sPHE_nKwkg_D^0&p!h%ngl&LhVJEi zp}J<7+wR8au|M6Y!$Y0Aaw=V)SfzH1lqX%qtw5*7S3zIIih#a!y1d$0a2KQkaFSNUiF;vEd72DR5LLFWw*qW8Id(?$j`{db3= z^Va(?`p-9lIyLN?aZLaHAsG3aTQKdtXTEs>x?kJ}bm86Dx^xm|!x(0LVFkAT@tv+t z6*WXjPNkG%8<`p7A3Y4)-gGZEfAmK{w??&gF2?`y`PlN`ZvrEp8R1TobW2u8h|ujA zYzNRW&PktRy67>({>uUATyP({@4W{wjES>e?4+l(k~nzDQHITtTToxS7$AZ<>M7J$ z?j9RI8PR%VI_i>73+Oz3rVQ#IEJ61VA4Kmvdo~n7?^FArdgbHjynQWb)PgsS!2Wm< zrvKX^aRl+>Md&SQ;J2yL32o>**WIoexYP$RO}3L;ZJF(n1LcT7=?i;(qyD)6?S1#CYlr$}y_ zG0yYs>KzfG`!wXEKoT_`awLVcg4fe3BkP7^tg?sc9o-k&_)FOgOdMg#DX&GE6TFOg z2~|w%szm^7q&s0#E(7v2b1K!VqSeSq3sfBT;&Y>EB*MBcdj=O0E&%xvj zb5nRSR$_N)XNnJWsywHez z9(^wadv4hvb(x`(XJO_*V06e|n#7SlVt@?6Fk_SmWPl1lwQK@A{^C~5x$t;*N}+LU zD5UM$wAn71tGJ2kY4;pIHB#v_Z8xtV5$u&YKY1tp|~PczEjAV~My+z~)g zociOWtgVnL(=2WDVRN1q%tc>=oSMso$9;K|TcEbYne3@-hArZR9;hAC^&O0Cg<}YtY@86e$ z9+(TBJB{i8bRW7`?GeMpR<5EJIdD=Ir`sH^us%ZS200R1ZibAMiBkc#Fbs664lLWi zOIXGj8BA0LJ@m4(E`ZT*{V-NlJ4V3(A+~>Lg`7A3OTz;%q-%5{v9yuT)me{&H;jQF zo>eNQ6?HQGrwn4#XwDQwk#f|3L03g5C{<#tXlfFk`=CM5h2%=vY8{ZbL89v^DJ?Nm z4SvV|6c4>=Pg9JJBs!PlUtKw^xN|#6*^9)M77UO6oum=j0pgAVj#(3QgN$ZYp9CVZ zetvD^eEecR(8kp9spJTR`y%po7A5NvMPBBt%FiB9^2B;hyul|Wi=}>3>WieCo*JYG zsR?VOTj~gCBzkoNh+=0QDw?0_bb%F@W<==i;&nKJET0|xM?7s z&=;r-4d>Spss7*dBV9SsPr$&aqVwW^fY_g#4!kj=Z#u=r`i&5cP@;;-ON~f54cyeTf{~N zble7X-mn(fa|f_-4AuAcK=*6QVJy(8D#urU^JBOb(wA+F36Ud5ii*r6ZQ<%>+3&{C zQ&N__v%pCkks)mB_0V%%gRR|>)Tpfs$p!h#c%%g&f9GB_^LZhZtE7Y1-G)2iFfjI= zYr*SBG5tRdf?YkH8s29Bq~tQ5_@|6W3A7_oq!)@O;h%nfl15s7pL{B*Qy4XwX`CKPcK1_?a65rCWo@X)hunC@ZTCS2RQkn+A}WLo9hv422@= zybgALrc7;cx!>vh36XjGm1IDSpE9&LB)&w^L-0QfGEDlRRQohf>J+H_D-2^R}V zoyccpSGQ@8y#o0Qf7pf2{c}w~UAuQ~RBM7$!mfEj2wXp}7csoB(NI@*~5F2px(1kWBT*Ymp5RrmaQoN9m(gg)ZEpzA6}9pB8Frfc+KE zq}otLU>I>kBDJvo)<+l$vJ|Euqzw_nnp4&}Ej_rq7GU6_1mXoIQr(9ygOqua7OJmt zD%1(Cf`ZwVa{AJs4Mrp^-KLa$Dmx&|;bZ?JZ=V6(eSMuMBl>5WH%pVJPe@aZQqqIF z!gnnnTp%zXC3Bv(1%e`0Mn5=}X!4-V87SaPoSA@&^$-8I#OStilFF6KF1B%;x(#}} zrAy?uk?E$=rmlfwP;)lye$EGtYUYUBBI)JCA}?*mKGkJWzDqi)ghOuJmERh7Nypjv zT$-Xw@E}bK+3}^)dlL$f8x?B<4QSn%hMqW-r?0-Ofz*@d1DM z5L@WQB+0S9ie_sWmfT!=Z7oLpC_LJ?f{_c}6M1yeDGTXT14~T-1FoDWU44d~t&;%AGN@7uo7nLzRKwF6*Ahg&`1t}DGVX|FW`NvfQL?5$)?_$m&np*W z{CW;T%{4}izoe;VP^ZF_^}7w&^WR1}lX}lYmy|&p8^uT2niPbhMPvMu{D4%!Y4S*m zb$F*$YCnz2Nyc4-+?G(kkNR)+S?eU>Yamq{j+~j=faec0t5YbZm42V1=xofSgff5I znzNagwC*}l7g0p79&;Q?d0K>Z#=HupG-$rlwr3_V zb4Ot2i6TznlQ4tR-|l5bk1aS3Ns0`2UVd8}XMANwhpoR2(EleR@<^jod~rp)`&UM- z=@f%k^4=gbW?#IZtS zY8nG;t()plbL)P^Vnm9Lf0a`yaf$|3~eDwWN^{ZCkQhs^%ZCo79 z>!P#)Y%k00gvszUvPfU!@^gs>l`m2LjW(e)dAp}j#GNK3r4Rb$E$fK#Vwss(!&1Jy z$nv+e%26L`xe0?0Wp7H&lgo|ESK^a;F_W&ps}TBFW+;m7OND&$JtwL}WZvgm`i|(T zCLw7)_1Z-Sl%j6XCuHhTiK<5;MxrPadu9B>FeC>TIo~2KG}F9H!a9Bg$#9VYh@-*& zx?a}10XPZA$+IkE3z*rDDurestoXNH62(N-zWj=eH`0!2fxX(m%d`d=$bn79<1k)O zr7q0u7AJsE*9Kle+go4Zdv z!s}=d633v)>?S>fPIl8J6{o6n!!p_oWW8dOe;?9HH_ z9RPUZKduH(6P|bWi;}qwBEq`=_#psb=~*xK%0K#SL>1zl0WKuG{s-Sr3Rv{w-%6$y zfNZKjh5uzCip<^1s&tvIuq^YQuHj|ZK^T#-Gy3_7Pj2+0B}`uDOs9jM$5VOd!95$;nnA`*8`Q9{?84kIJ_-S~I*oaf$0 z^{QCK>cz;tVQkBiB^w-5Y#{AT05=FV5PlGPi6J3@Kmr&-0-*#00b^j8{p0 zTh@x^Dyhg@Y6dywwYAT=`Ygy_!9oShl!?~>W45zE3YbzNf6WufE&L{n=V0az!0ER9f*udaKPjt6RRZfNtNUjqO-r=1gn;I;|Va#5yc z_)~?z6%6*9Ysx#+xV})J%t-$BBSui4au%#bGGx(VYoarId@?BD<4ygFAtYtDnT>Se zz=t7HoP|NRAC>qRomFSVxCnfpYCG;448C)u0oN;boD6=o2L`WJI_fwJr8-8SFxf?H zKgrd zd(Neo;)F{tjr&B_(TtMj<)szQv4fu<9EK1JLoWK!EUWF(+^VR-D2-X(+L#=l3lt?Q zaBM!Zd;TV`g8vY+ah4PDRhFgn|DHS0z2jC9;i#Z_Y=4^^<75V@ooJ zL&jn|8jr&ND5V1Ee^{L*k@kH*$Dpwu^sV%G+p`nCBFGy+8Bf4Y1Q;TqRbt@A4ai@z z7sW>xqjTZ8=)Uf0P!}Dp3Xo7}RbCiA;I^3pM$@-5A+t67%srYI5-UtN)%ZAhmj15z zAJwGBJ?4;y1i~*;3gWpDm80Sr|Rez6{1~=Z1_QnSyu*fl* zsFgUe`!9mGc`POfP;Eng-lW_-02(lgjmMM!ZnH)>w8~YgPyr}EKO5?t5vX%Vs<0a* zD<7~cV4FmEAOgq#R@M##;n4$G)G99jU1gL=`%WzHnV1YUV*>YShZ=AEz`xer!c?39bWgf@!>Q2&X?0 z${$SwZyP}N@_qGW03c@u)ZPIAKsnUI@bB%!(QCG1>di|r=|^(`0BT=b_MJ&%^om^= zy=ptkc^#--Z47>YKHA?{46V)Ha0LhQ!=9J7AnVhH(YbC5dS@O1+8WvBsc3&?G4fka zfG7tVohx=@?3!)h`D376gJ^$wDO&$`o-^?uy6vX`fY!Y;QJj1P`Q5Woo^=@9F46w< z3bejAA4EX+dAl%nwXdi3Zzm%A`XZ3M#3WGGqPfG~;8fmmTZBJ#*KK}G*Q|#-Yy14& z;A^)dJFyEqIRJcV3HX+I$d%oz_hamph=36=(7xx6sIB%rKXczZ7hW9EQud}tLC@X? znpA=|PXYdBIp~ogV~tV3mAg=0_c&nsuD>%6qc<-wks8zF2d<7c(x^i3ianr_3_PVY z8Ofb6=w7}TBiC#fW#L$cfnUzR^iMnubWm=pBQW;dDtMgy-31t1eE{X0F+efqUb5b4 zw7Y(KYXsHYOD;vG2t_Hbok}r^%XcAr=}xG{qsWI9^v`FY_~;6AE1pjl*ZNn}WZc#q z0sg+y@t9`QKxEO%Ha=Dh0PWx00|3zXOouxC7|PpcK%ILOm{g+p_!5-gngamHerF%@ zSL_5W?1Fa=p!lbSD8K7N=~^Fv@@w;;o^t>+xrE*{8N~;dLO(F2lFufu5SaJ($M4(s z{k%5sc<_W}%Wuquy7&-iUJu9^oioq(76P&=c!Pip&9Dh0<|@Oe{I*+{>N%pMl|PzM zT~Wg;z1i>XL;i{m`+;8o0Q5c6WW0Vh1M2B=Cqi+N>mf z0P{@b1;v-=K;JPf&RkJeV-*N&ve6KlsxPKue>$_Ef>6@fEPCv+B&Kf9;L&`|x*^7eMPhPe5I9*!Sx%PK3U% zA!4W@-8h+fzwtp+|LLgjb3=te*6jBWA%D$Y(4roAM+?QL=b-$T_?mBP=_qfW1-1St zXnrAcaMkGnJPkNEat0bGzAziD_wGWmbPU)!kd$R8W+2-uw|?oN9(t?fmbBg}M~tNa z$o92B40P8V#L>4uf`OmU#O&W$i@_hw#mH+nW9&sc0BEycA8sc|(#(D}&y3>C!#Mg6 zze2fe6jR@MCZ<1cE!rPkh3<29IS=>lMF%kY&PR|vJPp%+cQvvN(=hU`N6@?AfE>vS z?APtjF9%O4(YtI9CjI$o;AsWMuHFs+=&s(6(RV(A{O2<<^#yB?|8OqGUbh*&KYZM+ zYR&pwR?UX7SQ`Ty=ePF7m!P%QhrQJotphH)80w<+juGlL2f^>&2!41viWgh}yUFNI-s+2?FItac^*ZE4$O7tAIz#sR z=Og>bNuX1YBESAIWR?`x9spgx5%k|Pfh$%+|K}X2H*7_I^^>tC9+^AgnLH@)RRFMM zGI}p~5^C#Y47)lt001BWNklzHywS(i5B2k6 z=?G^1>DicbM&M-uDa;E0GM>@w90z2cLLfT<<2=k7=E zZ6|@Im&jlKgtWW-^Ugx={mYEeKELwpc;Ep5S}}^=D^5jc&ABK(y`VPFL{`eF<#3$b!3R() z#UjPq+cmt;I2EryjMiUnfqq~L#-4SK^y~dwpw=EX9q}cKzh4MU)ySTA0KK;?m+^Y# zlL#k6a~?_RvP0;;eHl9EpN-6qlsMC+3^?sixzjiOO zKirS$H<^AJ%ZK; zwnN`B4V^V-puA-!^0z&K{AGKPB9*&@vCB_I?|loQ&KMDx$-=x3*^3UK{K<55UvM&L zey`eCB&4hj7smL^;72BbPV54MK3EQefXNJ+-vvK1Nq!U1Ips|8MM(Q-7Rb(GU{dE4 z`Q2G{W`$O`M;N>8Wc2=Gf%NMGJL7tfbD{4wh9(PFeNvYmMeBn*q3@rBv5QZEesB_6 zAKD4E{%CD}S~-U9wad|Y#wjTNVNNq(5ifUUC6xa%1AJH^fBF8P967VGY!mDgWq@ZC z=&m{n>M8VA9RUv&0Dx?N8$^te7jFdsO#aGJsF56#zO@Jd(7Eyn(_S^O37hB2i2}md ztF{8U#^A?SB70y6)XR`>o`Om5KEv%R_pXu2GWgY{z~L4KZdw8W7`tY>F>wc|c*twU z%6!*zx&RTnS4%wuUs?hlR%m@wU@l*{%Ne+>PlE~sggX~cHh4~a6fz@{Sowy!nE_lY z3P}0o#V8N9p#NFgqU&}dH)e7I+;)rgt_J|k5@nA-$SFe>jIV+O0BQjk0J-ac0U-b4 z66Bp6>W79nmXDbIcLJ^vc=!v8Q5;q1-YiU9y>OS`@^ykARa#Ezddn2(1s%|q$#E8z zzD$4bsmLFj3Un0)e<&vR?sM2M!|`NMRZC znPi^XYnz=y>pPmi;z`r56Qy7OBy?DZXMLZyw&?riJI#xQnp+7Y98;5r8ND|z2XB}R zbQQ{f6DLNsdKhUcKRq89Q7CVjA$6?mzyhBAwpcuh&&?H>KRd5dUY&DH{x0jtcG%Gz z`nDl-U$vr=*Qa1itSR`FyQQs9&jW@D#TP~K&Hms3(y=K&Jr6jhP=4RQeA1Z9lKoBy zbB5xxbAyr%QZpo7BIt)jsZ%RD$p3f`+8gde{wKSkR(8ai_i)?8ZfR_ysbU=o`t^@< zO}~bGznZ`n0hZJ`5se`QpsFb3uMtJA`0O0;fegiGPl%qUsrSAU!8>x`m_qT1xwUzs z=F-$rC~umD>~{`i6naJ%Q@^nU!+*FPW2cKYo$VU{5zt#E1iA0q zcSeRAjrb;@JXJKG{DGmEv4vX9a%qbm7lNQ|^0!=Z3>vY(D7wB5 zwtZ|#d$yk8?*^XZ0Q89+xi^a8_pjLA#t3IEFa}7upeXDXGjb4mU>6@CTOoJ7>+Nj` zuJgDs5?(oCR=wl`a%Du$SHV_X>QavJSqW=lCF`#tp7#C(1fUNQKn#o-;LMe+L;wst zxaA(?FoO+%7IX}edlON_sNIB(8N7aMvgF$8O=?A{B^JZNF^s%sGm3K#L(l9<^d?)FTww(*Ll_-< zWYfRyoVNyOY2;TuiTn-Q(E8J@=>6?-Up7t7`xh}!&{X~2lFrjg84KPvD1Wyax;|;7 zTK!?8xO5E?f@^puE>0VlF;Tl79{Ed88>zKA^0xNzEP5JXIi3n?;2%}M)KXTG9hKxY zG?4ado9)*qDk-#jX;WW|<1sJ8@9=p5(1ITFH}8OY#xQ7B;pd)NL`6;2jj5@c7K$+9 z?E)*zScIv(Z91~&9zy=kCy>8s7xXWuqWsSxl;55O6iq9`;JIzEWAPZ2(280I(q~t2s&#d#6iQ1?(CZ`f63QWxs=V=y)1F}FjIHXl$wZ)oo+|V`wJ_rc_Fv_pY zLjKDA$gVkn;uB^8Y5JZsfNY--U+4V&pq|3CuPno{E1p32!UF(+?7*N@*Omt7UAZ0@ zQSJl*5D5HqRbm*g4Nw$0zd@nSDMqKJ1+I=ylmgFl3MM#fmg`~xOnLTN&`1U#4Af%; zsmEMYtzU!*u|%Hr5I&KyILBE}eR(GZNo(Y$)-e-nfi#dQB}euc#%dC@VNMokT{_{N zvGRRpj+6l?Wt{v%tA?Dq$Oa`>_n8+#A2Y6Yc0RlACQFAfMZtoA?#(A6``U@JGI{-0 z)0QYWNB`^*lxH8t;{ahy6c@etu-J#_8Bh%WNU>LLoqP& zo{cEaK8%4+EeCz~MD#iged}ES0Xcb|4FK*Ajk&U#(>o?f=Tjo;DHPwDkNgeWpq{%A z`0(=jxqW=|y{1gRRmD?G71DjmQai39(zvPmvay+PPNnIo_gz0W3F_=&(2_CmMk^?e zr>|+JCICwxN8Z+lwm_XXjN+qEng5?s-8CAOvF< z@pXkX{sAAzQGRC#*;NNnd}g*$hy+#zW@LK=`Mr~eG4RlIsAD5?NJe`v(Cc zJ<@a)M#IWKDe(1IeS=4`Nipn{E@2C)QFw?@Fryb* z4cJ-@65=BT-fT>tCylsS+sLLJK7tQXv^65=5?_ChU=k(fWMl35)`{TZ48_u5C6=`9 zARvDlL!0(wTc#RApV@|dX4lrFe_e>yaE5%DZ)=bUgCU19H+QLXj|jf*8mh`;``u^} zl>aXX)710)F`*4wDl|csHXfafn$c+FvW<|{We+VCNuPPs&rxwI!$;=anl^|umY9` zE4uJ{Qwv^$w>g;mtS+?4DBZ}R{!rl8gx1&(AWZkz)g&5*4h2F6sM zm2kB#mn_W_s$>|Zq_39!Ro1cTDl{n9-uQq&##mSBc%VOO$GvO*nwxMo29}}Y*%}G+ zTW{K$RNQz1XhwR1LfDq2MQ7qU+|=}sTSBila!0x;O|r^v*tnBOkoqD+4TE?D?Z2gnQ50E5T;SUwPa9r)5B)F#5(#D9<R9l^-; zkGM7mz9MaPuX-Fj)N?)rtuHS@zv%O2fB+3(;LFCZ;q{xqi#p(`CCYOTVeD@o2qvZp z#>~bSz?$uuQR)&UYZuo5yJVpBxra~~>aZb%%P$Me>gw&F={@Av?hxdEX|WKS7GWxv z?=aXnUAnQ;Cbj`Xlz}JBDUYWgLSf=7^bjip;^#*Zk8u_XqgDh19)5Y|8v zGeIe2j|pw*wFjVP^q^m}&E?BUVimZg7}=@A$Y1?9c+Vipn-*4?G685Yvfth#_1-%j z%_-nAO-e=OJE6Ey_Sy57Jqemo_`U7VFF-9VAMgHXWl2NeCydkNGmci8C~g%0k^GN# zfrdhOPOQQorSU8qbwavHF|gw>UY!Q!ug!tpFd6wPb|L$%gTSB$J#7@N4+*UidHC~} z?*h#zeZT%`{)F1-pJK_Njddb>=3&r`60JAvjNaF;;Hs(ouJGLamAgSR3uLd_UCA?W z(?(>^J_MRs0*b*$WwE6<2CHXIW=$v6An!QW)@81*OpK@C8fWc@7iSM3v?@M_~j@R`6lFyv)KXpUN$%&Xc3 zhJ1M20LmXt6-Pq5t|RM<#)NF|B)~mb@{Og^ZzY0MYmKR&ScRi+*?^I^Y{ap5iIAUl$)#Wb+5JP9_WEK6P(^Y6U7HsA$#d|4F3CngP$Bg@2^%t-!;>yFYLDy$iga@?O0PCDJ6UG zr3QU`75Md=pg!>+VA{%8uZy-q>K*Pxu=0;jfPUwx$gX`HgE#*Q06{-E6~$K;1@k^s ztb&>2^`wZHqjs z@2$7G?{n9$$FvWfg5fu9#PB;G0fuu7{&X%1*w_FZ!8iD`yCnkQT{BVq(;~AEifE3u ze}1RT^&>gTAI(PL`~{HA<@7|-71n}WK>GIU>d3i3aG0{L6FqxIn)_(_RC2pG%NZA0k2cRBJ`K2hyg1=jzGa=_^Q z*)p`=yB)3fZv_u$&_9?7;7CJ$7nP*)rufPUpk*Co&p!xt(NUDQ%nFN1o{yi1?5cgp z-}^Xds1$SWzs*8%!-*3C)zwq}=M3PD%aOfeHwM4A0bqi@ZxV_x%sno2lwUakw7i4t z`G=q`8bL|+Z%m4u>zc&;4n|8@_liH8mSE(yJY8aj(=zU-z zT5o?617FzUY2HLcj8g!J1r7<-8`)S*47Z9m`~5M)WZy(xTPEqBPDSs}79oH29t_^O z0lcGy-a8jU-xeGdtz`o>e8?&*(R53ByUk4~Z=8ed=FP}{YZ&DZr9C?LSyxLj@_~PB z6~69Jy<#`2rPgwm9mYf6dEOh+XB#oeT*XL$)+GS5&u*OJn0?Tis4e5s4_lXM1AyPp zClj`qywhJ8j?$WznPf6L^l;!iK+1XeyY`JDAQ$8KXnGnz0Y+&Y2;~x>K+qA11tAy| zI|;-RX9tdvlR~KgB~hD@u?b9MR>{g-^uq)|i|{PDgblT$KmduAK|@X&0E98t5>}Z3 zMVY@f&~?v;!A#{&da;amq&0z~Sj+01#DZZJ*NkkyAczSB=BnplT(YPQzp-H>gs~2y zZJF^<728awPA={)I3%DFb!=O0~>X z5k0AGUK;lD^J=@yA@>&CP>{On@CO=T-3># z`UX(JoulnU7*Z9;ekA8|hjWB##>q{S z<8u+wHFJWu|B2EW!chZXW8P#u((Ne*2EM)pV4(Ywghm(cg*(W>d4>$710fG)2$b(W0@+UD)chN^H=!hz2iOV} zfpL@x4@@90JU#R;n~r5TnUVDQsWD7D_VpNQ67~~lYa+!QDa3R!E;f^~w)hkjhc8mW zlEUW-Re`GLMSYYWC-ADTDgrQgzXK-+;$@{Ox;CQa5VBuR>Rn3>Z7jYbMWqmolo zXJx#r8bWr3_-d554Anv3(9k&am$qGpuFCU}ht!N~bebT5f#jY7pU2)>2+v66uOUiT zQNjexUn1o+4+U~Tg456{PA;whDkIhl*r?s&NCB?Zbm6$hXI#PyAzI!E90M4R<)@=OWzJg zj0c`4B&lLOsp-f#`a(Dj+zp}Qj9nwv$17?R@hys}9DAOp}NPl8Rj)f{H0N7v+v=b67ZFz!iw%eBJ~KfVC4CR=~>Y zH7pr;@;kU?^(*OIs0FO080oOY)skYaLH^{4WVeZ6(+cI^|0Jk zVDCO)@)sj1C||eRb7J4Wih0bpLv})$vbNbm1DW!7dY3Gx4#4()2C3JshGcujIxkym zf^niF06G|3BFKszPLR9XB5RYy8zX~Q8k~=UThRlBE|F)s94$49K&BKJ#**Xal=QMR z&B^^jRH3~HWo8@*;+Pt)Z`qq8oFd^!i!5FRc5lHE9O_JtWLgV@C`vln*R&QY3r+}M z4Fj#BFP_%{Gd>Ox?E2U!xb3?}!S2-oHxG`d-KdsSVH&pr^S6dkCDx$OFf*a5qInf6 zP{72ml&ujemETF-;iK`8T4#X?7`3}Wu0h77NpOiKHK?YxYQ8rr4}q4I)S1V7#39SG zW)_x-MTAKEwQX9{IQf;LUDeB-^|pP(O4wd^YlIO4fOh6(24v6Ob;vL=Ykg3GAg~NO znD{PQpfW33Yhq=yDh(O3>7J3b5QgcsOJagDeOI;*R@hOF!r3weRyOA7R5SNDw*MIr z6oE^@dj`2OxHJNYv^K{H83mW_!lZ#rxorvx20ep?Utx?(lv=hL3b1H^rc9=kgg$n} z;)O^olmmJo33Ozaxs&+(UFw54w-!7 zm*P}b2OhyHw(-`6yPT@jpv+tk4GFlUK*%x$4MIm3C^aL?a&(JAoJ0*g%o=v9m;DIb$U*a5us_*CwBAI>v2Xg3%3l?{XIcI0D}kD{pAL*n|NG=+c@9&`TzxT z!XV6PYE9Dbcv6kzoj-~5y+Ku>skUuI`(M~F@%IhX2&Q?$E+Ht#8=gizmJ&_*N zIA$>QaiFZE0u&Py;wjBX?UUmxq>5B?}q<_N#A@cou8`nk{Zm=gWzy|_8yr(`|jVrI&T9Y!F zVT_bvPwW;ZdzG(%#rqT)o-?L;)eC%ANVG4G+&u+yzz{N?nTL z2bMSt0qxkX7FxzsLzET{{`&sAax2%p)xmB|)@f zE9}`~#A+hzQ<5Bmw)4(Bu1YG$)Fb+=tCkSGXq3A_i<~}7R_yll5Lfcn^~u8+i;F7z z^(*6)V+M+DrJr>YD&X99yu)Wn@sMu%>5H!R5PZusC}<;+4W1tA$0wz;It3`GFwC14 zOMg@F+**SpxSBc}kCv^ludu99uHw=`9)|~iopP-rRig_v!fA-iDY4EPifGXs2r}4} zCAo}IhvZM#ZX;o+elHUllD@1P`#z5tX7MBCa*tR)DG4%3#f#nx1vdna=sW@~gS13U z_Fpi-p;b_<2PuRe$=0e1c0P4+e+a%j3*%&XzX7=tSc}jxUhc{gN-&^O(kKMBUsf0~ zx$OxJS>2WZvb*IL!QSeNokCM2!Z2E`x;E^J)8G}sz?v1JfFOOyV2(9Hq7FJnqvV~j z!uwS@!QP{6wrfP;D(yrG2vix-nh~Kyssws}2x-P|4cH{s3ME3Ain+xcaz%&FxMgMFd@~KZZMQwJJ1fBobQ%30_z>C_~i~2H|&#e;!AQg;0QN z0{ot}??vtSgwN|>XjBx9dP6nBF0DU$R+q6(k*Tk;TEs7)Ds))8 ze)|q^fG78RyuLNT5Dix{W;OkcE_Rz>o0Z0n2fls^1|=^-*wS|}4urctelNyOJB;aH zUxFE*I|)Rj(2N_<@trdG8}AE|=gJQ`TJqWbQB>T?&kfv!HeT&=3!Or{vfbD+xRqS;x$nDKZ(yNcT4222|}sqzsr? z2(D`?cBZrd*xzywgMw8jojT+!CPttK6js5X0isUkdKis`z$qB^FsXTOaH6%Sjuzim zF<}6Mc?;cMPx_%093OE$Efx;TCE!o7M5Y78jCtH;Z+&vY+$av-$713PE=o=OrcP!~ zFsY{>MgHn1q1H%5v(B04BLz-9^AK8Zd|W~aZ*QabcZ;BZGQ*S9ImeK_bQjbGM?g8C zx3p2-G#BN+1vf}q-a!*Yr^S<-OmzyvIH_+|t|7>}0#>sOAEgq-@Jz&lUic8A4p-hk zB|=DGVUH)P*EHuxI1wWFpL(iO0PCxc^vy&eh%9yFpIQfS_q+~esn(IsiPWqX(v@u~ z(e)yQDS6b)=+cbgyW>zcBAT>BO36F_LlJn$27{b=HpxN5Q1VE?JA>-KRjUIf&NhE{Tql z001BWNklP;6R{kwMAxndU$z$b_I&V*c7oshn2Av6SI=Bela1af89X6tk9&}@0FVne4VZWcFv8UM2uNH5i8lc2`Hz~_yu}^cmAnjc z$zpjawRU~8+W@|t4|~1;w%f4(w%goz+nXmXjbua-&RJ`*94WE3Xc*rGlQ#oEWr3E; z&>k2_j%EuHS_fP^wJOK$n|N96ijDm9kidbMz{4gSCk&L@Mn=qiel?|rTp_GU%3r_3 z-3};u?SE#DuNuL?4V$31w9#3AF7&oR4BW5@w8~%7l)rsD^bcpEd&QaP{MOmv`=_Aw z*ISUkVi%H%?Xn^0cB<_5=@M5_ecY)@8?8%3{ToWgpA|f=-FAWH3ss)WsghCO2)sa` z>f;a&AX1>C9gmY3hziKy-Gs>^d1BNq{H_ZcbmglyPt4@Rd_u1gXIdC*X@8c$v_Eo!3NtG2( z_`4w;M}Hd2RqCMXi#iZOAvzJ5LfK~S{;*1Tg_y!N>lC)|QC~S+Ct&LUtEoIhSOtQeG5nle7=FoCl=H`s?Ha_Co0g*e z0~7a~2)lp$V*tRsXFXHkW5(W}`~(0n=h907h@jZ>Q+YP&y9?00@BqrWV}N4Jd*(A` z4!{ni6n;BvNDEN=ILY;jSgKZ7HX$s0OErkB*99T<1>jitDuGyaU7W_0e7?T`Fl7NB_6UeKfx*fIqJA2|v1;8dsN z^{(8F?ls%N^Tt5C2Ql!y`DlG@A&5I;YGXyYu!a-;^~nUdl2^W^}LEjqbJEp-=3Bo*V#uaS8aAIViP8 zPnT%__gymn-#QWMvVEY*CG_SgC_c0t`oXDwFax5rRt<3MS=|0re2sSJ+|@7xC7E)K z);qT%yJA0hRH3}Zo5)!KZco|{bR-lJFd0JozI)=f&blDFk(!1|KAX-SkJ+sGCMJ{t?%#sep&uunJUfab=`Y3vUNJ+EXabB;TfTVV)OkzBw zeh1Ei5EQk2w}IYlo=B0b>9ZBIjs6QY9S&&|sA(tlc25)mTc5>OG(0sh)@o{&PB`vE zxI(V8rlk8K2`ZvtHSkGS{fZ^cSE-KL9nHW9knUfVDS$k6ySRhu-!uS{tTg-XE+%>(S{r{EkP^z2E>U z8jk@aj1ylsQH!M`nDM4_G3WW~Fy%|j9FR(>2)$%GYA18hRJLUby3c!rugdi~iLco+0<&Lvy1qlBx5r$pv2auZ;$$9Qni%DP z2LJXGlIMqW4Ibf$(BehR`N0POpM4nmGrs{Z9|hia26~sTM)}t#A-i&qsYfBZ_#m=B z+W>xe8u*2)!5gNb^`1wOU337xF#}JR(E9!Jk$vPO@F_=8zI#)o-~a%334{OVeB>XN zJiT{qG;r${?ueQoXy=PO6Z6yk5JxH}}PB83(2G`MsVURWXDmba+NrbHR zKYB{3-%>Pvmq^KE8)W=;swp04PW~Q$3Uv|&`}iga7##H_mWA~|HYIBKK7Qh4=<0{C zUTtx*IvdL{{g#C$;5=jc_ZLBRRAf#ce#v$Kz_hO|MRufxX@$7i8_`UA=G})X~;KCh3aL< z|3d_-KJSp2(h*OT)(xwGCkDXB6!On6b3uhH44Dc9gxN2bu*IVNl%DLn7!0j}u~%;e za*ctHtpxpMI(RHYws|V1{n;5VNRZXS-KYdxSfVFs<0MGV*;DcX62M9z>Ru!C+`efE zTEl}FFtSDP;U<9Rf6gS4=94_x3--%cd|?6j zP;PECOj5eKh!GJ#=(Am+&JzC`wRBVn=ST+qvl;0A@hV?;U8*xhR{@E?4w{xr6S1@~ zcpa=DO<-Dm1ld)hu$Es8d=VUylXB@|Dygz62x|wd3VYq#2*)+6$r`1IT$}Ro8=YZ2 zep@f}83P_i1T$vN%_G{n>+pQuf!9ks}XxnH)TI9%A zgV0)wP9K`ACZNVy>jIAk^=w)X>Jbvb=@{sq&>Z)lS9aef{%LPJ5U|MK^+X z=zEKC=tbKA0Moy_DCnRJKzFH_^;$dS+RXfMG57VBA2V8oZ{6PXXOGEAGgip^eEE*a zfua(acwmo}5#Z{fL^zu|woJhofGn^KIH>1$F!slfp*;IAc&0Hq0>Jd14@n!O?D5H9 zl9j$RDZ-;*3I3BoIRTTA?1$SOYCW%m>`%6U&N&PU+M?;b3i+}b2;CBMC_2i7UG}-M zHS2*EgI}}*`gL2tuip&yu@w-8V%NazaBKI??Q=d&7=Cu&bZ4b0SOLn!Okf699FxW# zZv!CcZEfk_$`NEr1rZ*B@^CIpr!<=-8Kv2X9+(a}>0p8qk#`1E36&FI0vN$LG1gvQ!d{UiB9zNV%$N%uXFKGtUO9q+OfHv*RhCFaSLrod!1ug7ITiXQ=-qx<>txKUz-${i2sl0s#vS%Ma{?Jv-f1ZRYZl6XodXng06OW?p99sUF#;wrkTb?EKMQDS|2$Cg0e}{bq4kl+0L3W( zV-|`p&I|g}z^Q{&k#$KI>LaU8G^M;J)jH}yOcmy&%Aj0L)IbL>2fyo9(uVj`MJ)VI zF|Omb$4L~7zfJut2X%FNQBp7GgDm5xiH=}hjmZg&e&kiFb5OPKX&s?~pdN(i3n8h} z+4q|Vs1E(%Fg5P%Rk|K11J=x(?;muTS_cOu+Mko(RH3tKTQQ;7QwKJ=Tlm6?3Qy>Q z5KASg_7b-pruMfMV(^=CPyOiYHk&+B$LRGBqdfaC2LEv-vhSV<>H^1pd^#E9pX!y#gUpL zS7GX%lf=7UYv-3x>Jk_O)VEIrUbhAM^1aAEw$jBOkbyD#a0YFbSEmkV?gmM%p+Ta^ z1UWLuy#*1Txf&I`SC(LK0HXHe%RdQK-+d0`G+gsO zQIJySjf$l?Db`03@H09P-2D`X6zsZgaQvk)ZXu(p7t-`TMX75_vj%VbSld7EtX zJ21Od<-k^Pm?{@_WM#EjRx+)vQ#=7_Q(wz?d{6hw47(x=#gJdodbFfUh1KX&2JSjR zDrV&H0e9?i!+~!vKz1yHUgA$2Xf2W>Txn{E7kRFf6GFK%;dnvF!n=@|U4%R+f;vUo zD!(}&*|8kiQs0&}Wd{fbG$TJp%JAJYp|nKzv#CW2gIVT+8BrdD=H&oi30fS_dPwf6 z<}+lQf=ISGtj9kAz-D7jS=<4U0-G_#V^hqP)M330QW^5hyHRS6Plnjj7&@7YAOdZc zZ5+Mw80^Un3$R#46qJFvJVR~;voOdi-QI&?gDClq3#oFTV*6MF2^fx6vMmCSrDwfJ z#w*`E8LdpAm8qy~_}8`1kYG!ZvYh57|EUwuc1(AQC4iQ6B=@oo`X&n64dhc5P{hK3 z2q+ZFZ_Y*cwW~0;{yg;FaS{L^d*;EQe-q{`X=4bPjlNg-1}*PIfAz1X`XU));3JQL zR&-GQU>16BT?rIvClcP!FQqHcCSF>pu7bFlXNlkm$KZb@d8I9NQmiDl`NO4PO{ZNo zhHEq(NsMT?rbA(0Cqf^M=u8E9U0u}hsRJ#TYmH0d3BVVDMUeYz;*9=xIH&v%qTEx_X9Hu^j^Is z=)9_Iv$9$JMEwU$a2kLD2fvI6Ev1lWN+RuTlD6`T4?qodk-uhZf^1(_Wq>+$7SoO2kXfBT>ac>?m!ECC9I?w@W#?~FsxtrF$35sbd)k;rEN1Y}Q&C98YZ zL5E*u=u3r!>+q@E(Mx8H!LJBBV^=+na#|OiYozb(uPiYaKlz@Ku~0;vRRqd1$73B` zYF)#SYL*~w?^QnK_r)I}d-)TfnFaEfKheJmN4vJK$%IW)U^^W6(u2r;>mX=GA>q4+ zW&1;KoK#=7rjGHGz){>h4=4!PRl9*HTKoYDLh;pkE@%Fh$DuAhjPgHbq4$mzKmo^7 z;`*u_wr=k?o!8@lII#>NzHM@HjH<$>PC@IZur)q5{j3|?s7|V>KT$0D4P8Q-6B0lZ z&NyDXf$(#6)(v8fBGym&4wZ+nDh@tKzSqH5+r`xE6g;b|kJ2A@&W7)(c7FAra>p|# z0~nKj<#q*?61hD-;Y@|hn0(J{%)a4N9DeauJn@Y?knJACtPh`xNk5-u_z+>{M^C}Q zH*CbAw{8Ia$)lKb>)fFGHi%4$M6-%hDq=Qlkn5Cy#tz$+U7D;vAx)=I1T&fAICcjmh zY=H~Z(d|93Iw`u z2m`M@3&kI8L+_&x0c{Q1G8qG3S%jiAA%jhjqpAP!G#q=)CLFop0dOu@JK>T`000MX zi;o`yz@eY{XEQEdhrzpM1AlWeI#+MQk?;LC=*a<0{_9m3{O?)N&}aop>!1?rL>4?F zN1JABZJYw7Dtw^*%eyM@w10W0``&r_MJT>DAGCB7+4J^6U3eJfzt0X3YyNW#Jy`Zy zGom4i^avvWw14A|8g|aQ0L9-gM)u;}$gkfDnqGhpv{2r10*b#|R4F@NvQZM#-<`A0 z2LSMf$>_fMB((l?2iiZo7rbK-y|=CeZ}2`o`L%L-AbZXMWY0Me)z>-q88ub{pF|cD z5K!ubnIi*LVU|h_V4}BFhD939#r^7F2B%h>q=|T?8dOSVj)rCtO6sX~rnJv3P4z=x zB8;Dk^{9des=-O{tZu8#f;!>mQzeQ53aEVM&Gl?-$I@v`_ukeuwHT|TNhH6!~IgJ)8A_#Kxjr_1~D-WZJ?Y0 z8R5MF_A(yppk)ak9LFoSapi&VZUuVFd>l*a&x5|E_>#(pFzq1T^ehN)RDU_6m}>TbGf;|$IyW{x%>TXJ04as z64)e&5`j=cLIo>^Tw(+{9+{KeH^5|WQ-lb@!oeZs#l4RVj2bP<1m`R#BeE=W7MoNl zj(i)eS)Y`1>U2t$8Gzh4GZGjrMaVMa4{UHCq@j(%Vxk+Gi<|(sGuC9bb;!}IjGOq6 zh~+9Ha`-F(6r~oLRrUfXp^rjqfW+@am%&+Xa6s4Wx)DqXGq-}<=|UdsrbmtRh_*tk z780hQBI_V)EJ%%ayf>wEpS7PZ9s(aetSd7irqv`l>o|6UusEJ3C$ze?_z0P4GB)Y! z+P0eEjK?>C%T5?h``^%z(*-D+gO=_*EQyj}=cMK0m8z@4?LNkHw^}Y1}HO% ziAJ6&kaqDM#XH^@OsuNJ45R1(RvU=;ha%Y5?nXh=0c`|fsTn0{D9Sv4vl@e8dUm`D z7C1q&{g5dI#m?;kg&R$n`y9kMkj?eOR%wm46oOm%yw8Xcs4)HKN+yf#zX z&IH@G^^TXN@}(ba0cSPzHDSROrn)lR@IBzSwPhVYrQ~IwzB7XRGAzGKl_n#EC@$EH z(va>#xX_@eG{D$|&;A;lr|Ah5ZE8Q}y=IDcT|Lqpz)fDtK=aW+R~mc| zs934nhlBM2b!0ES(mg}eHso(OfHp{k)g4@EZN4+$;v^6N)*u#>y^XbR9qwc$&B&Oc zh@n`6bcqa%+-O%VB6pFGb`yu;oi$4oTB8L*%Me=*DHEz55;tFB_5+4q$U-W@)UJT7 zhdhHNw!fRrcKgJ>H)CY97&7>gMWnAo6hxtkjN~|Frhx&%z(2CkQIgmH ztRAfmCv=oZ#cf9Kk~YRm<1y)pB=Yo7TYq0hXfkk^xuM@k`c|oX9Ohd4IuybjJZs9^ zzo}{!H8c{m>Mdw>mDD`0Q6{LS{yLb)*R4_oAZ3Nb|C1_l2KqG?=-g2r zJBL#RBKlsf)XE%(9S$B;GLADI6GBo_L27{@!AEXQ%8LALXm(#e4CCpAgi{-wA}g|1 zR&sWY7oXUXaw?M*r3(!TZ_;Pe2EpF1Y|Y!|{JGYiuM)r+%<3ytJc2!37A=w>CS47~ z;DgnUU4VWNpp&#vIOaO)@EkQkTfcT@Y2N3?QsCkU7)8n|YSx#)n%>1aL$X>o?S@0*8IG))lvOh9gfZJ4fG9m|wgNO8 z-v!8Nima8R)UvHzge#ZuNKkSX$>lOW7SLXyH4p`|XS|htv%m)jU+e^m%)}uub>$NQ zShu>2Di~LiG`D4oSGr@_rb6}hzqGLZmh>^IJ88h--B#h5q+hWy5~fy#k%ICzkE4MA zf9`o$U5zGUSM#oZa`guhMq)6+)tLj6%^ZavyKo%C{`cu#(oph_>)&~46VXkjx&XBt z;E+=C0|oCxVj=&>RUWn*R}}dPL?EaA;L2CmZur~P6J(5sENGh$(@IirSZ#Rxvud<)RrZ1$30Na5$iSaLd7_dPJ9&$T=gF=;5Ig5WJBDO! z@3tNz=oNx<{R}Xd0QrDP7G}5A5==y8@NVf>L1G;!0NPkRbgA7cp8&K#$c?g~!_~2& zIdS+?PN5SR1;N?~%?#%L1v0B$79~nC+y=hgn zGP7T!#rmQcAW|sG5{fc_gZm;#)D$7%gb5}f*!dRCQ6ZG7;C2;-x$C%q&11$w)VnBG z9d8*o)h<)|X%rKxH2PDo5K!`>PB6!e7(g`M_Oh(1tZGoEDoR5gT*>?6d(qIAW1h!Z zN02R&qJf~a($?~wNFf-f&L)t#?qO4bhRPa>)$MB3(|k}BHIQjk5n!z)95m#ur$HN) z3Tx;hdhTg824g(jAVCp(W?5IXpOVn;dF?wAWgzMc6DYj99Uc!>_%kI;H9(ZyYUlTX ztq?GBJy2Y29f6Y<3;OH|jlw$FNBpzExNQU$AtsMWgrzbJFvw#q4K{`XMP^$0Vx1W6 z>asMeYgrh0lRFdp?FS1B+ZA14VE}+E2ixn710{isw6Zlx`7Yv({=#?KJ4 zCQ&N<^zwq-T5VwPXX6%>BsU-$la2^kws9bg;>Ym&{C14ZxCtm`+XD0e%m4r&07*na zR4bUAR+*?I@>AE+t~QLvs!$e>M1(xcP%@)ei1nZ_SddGrBx0qfFsk8 z9KFU&A*iEqMH@;jHw$a~9BUv^k>ptoHwqa;D9FP)Y8y>K;P{ne_-T7#@resc7k{D; zFRsulEUx}H-q zP%|tE{Z2R?Z+_oq*lfz*ef5+)B|lX5cSzm=4l3wK7S66f9o{N)i&AzF{P1*CIVA#A z@!g~xq^JxnB|(`yRd_-rC}i|bI6FX-3LWxUwki=a>;xVs$gNOG+A~gF9(M5(x6W_^ zixJvvSGq`4x$7~FkwLaYWX$YkPriO4a+gCv ziBduAPes@~Rv9$S1|%8JibxKGeA>cp>vsHFz9>Vdn&3{2kfEibD3GfR$TRec5(=^% zVsQeH3omW^SP`g!0_zw^K(Fp(f(JB`CGC6V2w~^ki-LSf?`%2uD1{*rHsSMNPFGCH zVO<;&+*4uVbzCfbX8BBip`WJq1HS+Obk2N6|BPIxETw&g6E2Mbdy+cqD`I8QHQIyrnCHFpI>U9NE+*JU#?-E78q}-NZA{@GWCl0<~2YL&R0foZk2Zu29 zy(O4@@2t2FfhNQze!H^fde^FCkcGCiVV%~(h;`u#Sgf@yPJko?sYp3XgcV?3S+RoE z{Lj8lJ87LcokS>w3n|&>7a^8q1~zTV*(%uz3ma|FzzBfhl@ksGll|gMS_WWteHS3) zD4XP$6}j@lz!oq`gHdQtoQl2jp#bB_Zck2l*BF9d;VPp%$d-V7&q<+#Y_Dj|j?q~> zX>;O1GoYcNl*H(_ii~BX?R(=X{3)8*B=& zr$kJkEEdZ^2Ex(1?*IT~|92kp_nm~^`!*tf&R(hGqIGf%kXQ3Pt1Pj~WdT+_EhL5*+)=N$@k6*lr6g-?ujcrASD7cRHH4;dq9-adSpZ>5E2=AR48S= zzbPUFQsi!>1ME0x1ZoA?2tOB6+0|#-H021!9L*jUWzN|fW3hw71wYEfgWP(zTRISr zd}C2?ZTTZTR#9LW0T`Zn2VnQy?LsUS92uLVcV@*|LW27cDX=;2XB95M`gsJ$E^Qwy z?btcNK*kK6Ddd`*a3UgeKLwlH5sj52Q&7e_VUG^lGM!)ixY{_Xg+_dYJsx#l{+7x2vpD05D2q;>3aQUJINujDbv{ICa=j zqB72@FyjSgWLXAXmX4rBxwIcq%nJjno8M%J!bz_hMjXjRu3_4NHf&O7^##aIIfnd( zjZo_kq5Gn`z@; zGXJNXt}Z{LlFio9#HzBu%+OAY|I70rKoycFe6UFCGMDI(d0GgrBKZ5*qPoR7E5bVOJI?%pi z;kX>UPWtO4XtTtKWqW|}Q2sb8QBx&JAMKV$WIYNhc6Fj2KcQ8XoK$gi=c%K6*!9mocsN#OE%f`z4TsP?OW764W^Rl(5z>y|Ss$2G>k z#PeO&rtUi_z<%s@jOll4?Rw;E)|vX1Q|iSsU~cm>Wmv%k#SwG7COBs6U=Q#IhP&lY zh=CoR0Rn4Lu}YFaMcODb+9*nHg&#~DX6;W(C}q6yWotu@Fj}7p+kbOB5)@qm#9(t1 zA<0omqY-E9V*pqYQI@6Kq7Yw&kP12Af$VWX!0gvP9qk{@MK(MDbu7o!&j|xR_Io=J zu$`DjLGHS$EK_LZKK^34bOhN6J?O>$PKv=i18I$xQt}}}&cJ{ov@+v^015t-nQ_UK zGIU{_7DIx7BQ$i*TZ7JdYfzg);btdLoxszC@}a3H{&6vAZWq~gPgL^&K$lQ_L!ybQ z^#|+ojMEk^8wH)v11%lr&IJH5?!BK)HBYl}>zwfnbj~na1b*U9pzW{;f_`W!icc*B z&FezF^vVB6+j|FCb`>{R)S0A??($W<;8CP~Jq+Kv7U^&S94S$KY7zP`ITu#P z7TKdz1vP#-d20WhoChQIiRDwjXjGorjO+S^YWCFCs3WuK)`7_Z^2gJ*v!R($wWlU~ zU3OIeYt+r=b|c=WMw(8xP~&e@eL9~v!Hw*}a$u%3bMV|Do4V!=K}U-Q`pFp`e%ix$ z>;>B}SU!W^qvKfcAFHwOL+d02AE$Zfzdi*3IPKrp;KY*;V6bck2nlEW(Dfi9Y=8G1 z7_6Sc%HO{jlV4hj<5%v-Bd_~9db{Uf!^<|C;_58x!|Oqnocc$=L;uNTEs(N?Qr7w( zyx!1~SI4%tjVu@Tzwb+^)=c5F-+lrnzOV$-oA=}Jo4$!+*BmT)$rXk=XP)^8rha?} z;>u~zBjXtR*edisuomQwd_DTP&j0{=A6bp+%7ci@W`H7L?o+q0;#)98eCakmD`80= zX%G;;u>kaeHK4l|89M9VSvPa{Hg8etdB#i$#k2PzzGOS%sy^u9G2lJxK%ZD?^;Lg^ z^48UuxnUn@P6gUJiQb=_3A%5-?I-|%{+(=|51X$>C0_g$5-*#`_BRCqY$1`Yj#N9o zKtLWl4OUUNHVVulUTz2yU`n?H4h0DKLz;@fO0)o5i(-r@io7GGJ_)48r@Lyx-+KzH z**QCs#`%2!KwR4AqnD%f9TE=}3n%Heq004x|hk^gyk${i|hd;jAw8&F~N3*=-=^|$hx29`UOedIXKAyOL0pjEk54`n%%6Ur`2REVgeIw^=>1Xxz^T7UMi_ow@fefkdcK79wq-u(^G z)dyt@rHl0-V9bo~DVb9CdZhT&=Miqd6ZpHY0b35*(h^%H{I<>9^EhwsX$|cEkI!M> ze|!!H|K=;0+I%3FV>ED#gaqKkkM3q3Jk|qM4S+#9u}t7Cgc>X>(_C(w#Po9>M%bQX z?(-6q0GTcOf!{wHbo~{ezuXA?z<$uHA3~1;%0TWE2q0{lM)6A*WB3DCVEC@JZiWR+ zU;Y$KKiOFXn6MhX;ktw9|Mr=fe(IAk{EH1Jo^}A`Z)`>9MZ7K!0AX#%teuFL32x%^ z1LA)!ZKpA_A!f$1xsh~b~EL-F*3D1UQ@RON6>r2R>UtX!1R`jQT@ka zl&{*2@+Tj4SlCT_Hcg}d(sMAg`4SBOW|fVJ_?gqV9+w`IPd+s@e)cpgE?jd2y*F(~ zymJAjuf7P?Cl;f8^&XTzwYOCc0MHrJ=>ODNn7-m74Bxi$)U7X%$4b+cH2MDac=8&N zHn~4aC(qF(;K@O%3nhAdK;@)KXETI#v4QHceRd;ELQu2xs<)ks@!fM#E$U<6PdtbR z-}8AKc+u9{lE}dy-39wd7{MPk7`*DL&FJ&T3KhKd}IRQM8Kkd+-S`3 z4t2@>2k5rAgt0F&J^c$00R#-5a0CD_{>8;+^_hCnb^ySf_pL`cRbt}bP6q%Cp7U^4 z(5|H>{_HFikIX?aU103*H-e{-2~m#b#p%ZpsX{p3L%4Gh#$S11u21q?;_|(eqETPH zm<3n$k82SRl_=yy!0IJCES+BE->(Cv3Y4E@GiKay0$CN-;cDQMh-602aRLeg%%GiM zOE8QRB741mdMV;hUxN7btB`)-BG7n+;*akIJ?l|!io`nvw2thM2!W$w`bR`{`w|R( z`eIa1zY_F|7XjlH25l&+0>+vXy!ow{+O2l`p7a)icCQA8mvS;w? zXCvJ|3G@T1k2ClVmmlsB81kbpe4VJDoC&Za;l$l{p?viY#Lq6o;E&gL)8O$)hrmq_ z&H=5RL3*hBWW>R%&*a04`oT_c3|AcKPWz_yNV~^@69tBUy{0own*jIzt2S9#@ncJ@ zEM3-Y7by3PKW?ml<8Dmca}Ubb>_q&`X&C(Rx><;Dj1u8Kc++~M?GvCS1C+nG8{_}| z4U|9saLwdazLfjs@SUrG;{}HAGI;Ykq}^k}pVfB1`kaD+qW}ouGWOr7 zKD!{7^|P$>hwoSk91j@&Blp$f`3GDzGLHst)UpDGf3>PjOs5i}+Q;{O&88r`%6lA1 zyZsOz2k@B97oxM=x}U}}^z(t4Yx_3k`7qe>Mr<2xs@>6fm;;cFkkf#+?*%(~;) z_mT%ujSsQxAI=0om|4$g^1*-lTrHFS$|>_5@YmSxxnP#+eHN+{-&lw+9WZnDF~rFV zGiMz`m=2ip%|%uhE$e~z)xFdQE2mied&U9i?VMwbvAFz_j%S{{%~1DiDoq4n;+qRW z(*eVCjscSuhG!oIO$Us9V-birZoyy!51NA?y0b=4wR&3O<=5+9>=uPUBr*DVZN2!y z5)7~3hyE)b0{#3pgs-25aQjk}A76zyOqPf3@6{{i#*Roxo0y)sbDYib+j+K?&NvPN zZ0|b&#KQ$E^nt8z7rHGliTR2!vH5CoDCC2HB1q1Z(AWf#&qE;I^49}lKxDoP^xAX9 z0WP4rZxZwe=ODfNtH4j~0RDXissId9mBUU0;vfjKKm-DYuRRw8_Ei|(I}hb8=Kz2A zRrG&y2YR1a&TgV9N)$$x1VPS&0C*;zBCz0hFF>p$obkPrnEa!&arke)iW4v1j=BH2 z5*mX50OIN?9D3b-040pyz6^8zbq#D36R_vD&!Bm&yWtuJG0rN|+sbX;+ddaIzm5^T zPyoxPF!PJs5HCKAv}lk`$u2h4JvgMhp%krHUt49Z{L zj&RvgkSnV`<7`}GGH9kHgs~f3)0bWaloiSsKZ5dCcA)pl9T>c2gA|@d%b0AJWL7*d z2L(_E11i5(&7l0Xod{1n3R*nOG@mwfiQFtl`uj-7#il|}`5vvBLHWvEon?*m;_k`) z=^Tedujz{}7YD+Jy+^Qc}<_?In)i=3H50uPcxm4Pg%M{(h4- zs^!wo*S%2lylmVvUTM%Zrbi>nvan0;tdU0cNy^l|n^kF}22|hj$PIy0uy0uC^wM{J z8W0x#&nhhZgW0+J)4sF!|+WprM1pQr6iwX<6#otbZN6dJ%K(T8c0%pt}+k)-t{2W~HJ=~^%&0OO%R2myhT zZN+QSqT4HnRc{A`70fabk!0&;fbLc>M@9<3gJLRQ)wkJo zfP#k{Rj^12pulGlXfL85hchM619KVtuj(Tqa4Z4}aDkQ^ktvY}N)Q*t0F)20qK+$P z+%ejOYR(XcZ}}F|f+5B~yA%uFbRLp(w$;E=?aTWg@HOv4YcYB2S`ZPA{=!25fU%-L zMTBF&cR#9&4`cjo8!`6pYfw#9IC1+I0OGBRNuo+xdq+Yj15#CCj7Xd}2{FjV!w#9L zXN>gT_yEGCM=*Tr1`Kaq4h#qrU-(kzY{RzfE*~&|c1^Ss0qh|6!4)WfWe37D_5*L( zkWom34~+usYxPenQT-Ed+bmzXvzDy)2M-}U@hFCWz7E3=E(7|6i7$V7^o&Z6H13)$ zwMeNeuih;WAw2OIhJSWCmo)$;zWkM0XK%DZ__I?$cQe5tVEBRM3}~Kl5V&Q1ot{o* zh|HfpP<>=6s*f&3`Ez?v{?cv~H}10|rAg$^^p%&%w$2U^=6_cs+NB>5zc?S^y2B`6 zxDObMh_@}wmJeUn<(HVO<2tBf&yyAaChI!+GV9ft?O5KUlh)1Nqm*Ye?@<{(K59D& zI@#6o@>i+R01%p;C(ET*zUbk4cDt6oS)Z=KF^Wbr(ke|kIL+b@v#Bdg7iNhV+s;lj z!%fF|?LFj5sAqi5gVN2G^O`+VKle*)27K&CSSZZBd#O2;fq=1XEWBqn9&=UUcXf@v zQ@B~-{Fjm_3sF8nmKgGuKBjj<{05HQ#Pp1Paftv*Ry3+i(wWEeP6h{nn>bSa69^eC z6A@@g=zVlGCSG+R=05XEjKA(Y06@HYzcdJCu;S}QxrYQK1fi!`JB2a<>2%(KayS(D)IhecGcZ#Dks!(p*}Hcg(}O+Z ze9UnIdK$s+i=P9&@HyxbP9UY1cU16!R@`_=@}WKBr~nKiFiZ^Uj@|KD9J}LlvP{Qy zv7HnG8hFA$7zlsD!{ZEQB&Nc#*WZWX`V$zxZ5d8`{rMThX^X~$mDg^;ifgXM>g%t; zs%y7k?e*8V36F25gb?`8c#nt>E5vhnZFbJBt1x!FK(Qgu=n8;OtMvUjCLmQ9F9PP2 z1;$cB4-q{A#t0a9&XzhBlC)(wkH^gL{mX&l1!%(*MqM1=0tlDM+VPzWbEoy4g_7}x z%9Ni|%ATP9z2^Gqh)a{}cEjO6F9(hlppDb@L`~UE%`bIr+Y$}#MmYb3l(me@a&0l{ z3QrXNe11WL5O>LmV$^FquknU#cG$Tbk$~ZQ88Bfgw{iR)TT{Z>Q?BZbJZ9BTxpAt` zECc`)FX1ITzeLb1tNwb2@*Z_H+p5*4{vTaVaXL*_FWkU?et}y3=kZ^iZ#KQt^`4)l zcyem_b)xm|{u1O*mC*NH4W%g|C}rDkxd%tC+Kb_W0Wh9$=-Imf0H=L=r8r6vmi-%} z-MugSE(WWnP|Y1;>Y_u~{kpHQKp{fu%%*|zEL8=SqPfYt84Og5cp%QddkHH`iTA(c zgIw05FS{RoDeJ@&9>dPx`Z((gz!G5r}~Lqz`_Blm$36&`QFnzW(>*JyK~NL8PP4BdR55< z6oN$8XHx)5;zO0jLV*&5p7R~RE#JZLtRskH5jbNCc+G>H;k(zOBwp(emT#_IM3Peq z`Q*mlo9{z$&M_3@31QO|(rX^zw12-A{fg6CjCq$2(@aV#j=ugr49+})VNqeQ{uqwG zlJl8(&pK3MmOJ{34`Sx>gBZVk85X?p+&tSfw&g%m*PmQt;b6LNAA)J34K z&h}6D<-kZ3zX4h*)(-uxW&IudBb2Y%2|9g7$~ua%zkWdSYILHe!m@Th)tUGAH$%57 zn~w3dpb_7>ygEjGJerjA;@Wj6{*$~n3rUTMMZVveRrinC-y2C6TQ5owK#8#A-`3;c zb9Z6SuYMb;B=q)N*!s3F0RSexy8w$nwBF4MGZh+m zCjo3aMmFt~`^PZ8Z9Zl;9L4yy`6v%eKm*UDlrZn}%dzIoPr!laZ)=sM`FQ1~CQ=Km zOF7&v05)m+phtuZ;s6x;$1%2b9{L-PVQlL>lm{k|AQ2E##Q0~IVbSkjfMYM(fdlWp zo5%lm=3~zLnLjy@k~T&XC7i7x1j3wmZo=1p32sFnsY2On>Z4pohm$zWE%4FD{lo=M_J1fomT9Y#}eb zd0LhR3h3#H%pnTQ&xnMWD&A`^O0uGe@bMK$zq}ps!lS?xAw4t+yy61HyBA|Xi6c=q z%!|5wp@$6x0O{k)QU1zy(1k~NX0&xK(l1|#aQ9-6ZAq*v+#shN0zBg<0?Lms!-?5; zIV6sk5o5%OFVwdc0zmPlJ5T`V0T^7q8G|>Rf!=GkqW8K7kdBpz|FZ$_!iOJQ>!!@paF^2K}6d*fE10Mec@4BvV> zZyS`W`s703m1m-O=^l*V`fVT);qxt!V@4(J`d^=Yq~Yfpq^|q`f^y z4N(2hLf}_7q4?QHF#eJIxU6r^!SEke!VZROmSaV9SVg`+T|fGgK4aN7S?bFqcfXa1 zzfP4ld9; zPJ(=GCY7@CSD~+UsO=etTN4+Bp#Vf31MKi4k`Tfsra9PrF(jC{RRpvSZ6nwxA^FvVedt>6`_zFNN{a_#=Rn9TW1A z$X25qcuMI|>rWAU_%KHRxBxr+sy1jfIFhte2&k$G966B#GF6bVW>kukr?hPd!2&iB z2*avE)cY~o(bp9S{i>26PQLHuKIB+1yA1RLs5!8jW>C8%!;!ugBl7pJH_NNNqyL;N zp?|>%*iWZGNov-Jpmmd!wI`WF1CnM^7vU|;}M}Y>UZbvPKytIFI?{5=NtJ%n3gDPzKtN}n4M4`` zUJ~$<0gkQXBZ)I0pE?&2;b+!dUd)!gh82L%Qs5K!^6jjUl_`EXsR$f^N9i^PIM4M) z<9j8}VTbd!I@da)Kyt*yB%M^-gT2&)Ib3T0ur|=PORy6pLA=9&2p|PxiOVajq8a=o znN5#JV1^PB1(d`NnTYC1%aQhap|JeaO*BEyEg*@u7}=L$D1(|}LMhe+?-m(TVo%+e z5Cfagm7{(aNr0X)Ax@d9Xq8En0jah*sh}1f8aTDE)XBhuU?S!N1wMzO2$FSh z3U&jB!j4h;EF+9ev($gAEI>pUR$Mj_VNgXNF>o5jh$N94nQZN|?3++KY-f~?k@q-F zvX7R?tXTNv^7XGtLszB^VAWYfLjA-; z|GF2bt`WL;)|oeTG~USoRkIO2JzdE=3O*&EAsKcl(#Hu@tVX_S`dt(Pvr`2!fv9fL z{=ToS`kS&;Vnh~ol{ZrHyXRh^G~2V)TsnE}>bUKnr4nhhjv5ErRt>m8s?4nq=b0$e zBX^TUl9#5JV|!KENZCQoU1y!*ppU~Ge)h^hAS=Jx7;&E-XXw^6Q=%f&NoIXPtq(#h z>n#@2Oj5G-WbMZ(%CgZ@QTUVi`@>b;^Q|2=O zJI_Fsx*k}R^tftelyn?NwgH-?Et@z$N|aA76mSsS3mO3I~5UY38>WWHZ}7e1*19-$|M5olgn_UeFf={hY0)V^<|lDpx4cFJ>~b`}BG zE@YNG-Lr|?@mSA_+g6RaVoJcMXr4{)h9V4uUYU`t$F-RdF0E~c$7}s zOtWFH)b*pGMD?d0V03Cg;3UAw-}bYw`DTUj*9$;!9$ve=tylIHJ% zVBBw$bFQ@sK$3&@vSC4I{mB%G0$x?J`M?(yhMr&tOngO?0*6Lrl~!=$s?atX$pH?? zj5-G7nNk8|rltaxm3OR}>Fvm5cMy=y4t04V5Mihm1ffwq`Li-terM}M6d)1ATA+$P zFUh!|Nh!aZtu<=u_I#414JULBEXh3*LRD#3#yc)UodYA}0G*UOn9Xieg%An@1u;e` zn-%SV5_%|5CWd*G#20}GRVBwKD|)e3ODLc|COo^Xz+U&gNQfbziV;HvV7lZafPn;v z@QI5dgDTlw5T$O)PZGz!*zge4EsF%+rNC!xiKD7MBN;EG>QXzW^J($Vr2(w%Lb5SI z6i^LygQ(^&{ZZOKM%XzSx-_C;p{XFQdx|Ism>3_!@qQm=!CQ0t!y$*3cATzXUdgxB zf{rxG)sTM_AmpW{+}E^i16(I+%hnpNX43?tAI&D{PU#~5CE3@LsDaS}x|N+*;`Ku7 zm?1S^%o@-Hts%@Vf=-d1`c2-ZHj2S@p47@Ud0sEx^hYgu12l~QJ~d0JHNYu0Zc}$O z^3H1G@pKmDb*I)n1^T|vjyW6X?n>j*wVL@P2&x^%e!(D@*8hH3BgRkabX1 znk2plmVadB21)9dE{O6vG$Ajk@(ze#ze(#SANiz3WaUFDV_n6PoEsqZ%K!j&%(7Qk zF=ajm5zwW8xab*I9r-lJkXXT16_+1~kR;S|6(hqT?d()Y=u9Aiypx_g78@xapk#v0Xc5i} zpLNTnE-$Gl_d5YR(38j3_9*~fy>GIVO#&X0a|lxRY2h?XP?c?yU7{- ze1xK_DYvGAC8wlEa^rek!@-m%7apyAIxvS7@+&@`GM_6)n z39eauP2ZkWk?BkA{_=feJQa^E%ruH`C(qBWP7ren`Ht#lqw;j)u+0Yrgqrawa%lva zrPrKEwYHzh2sg>qLW9geW>(2l%&N|Wq;?3RRO^E*99j9a86(0#v4A|Ut*^Uv9xI)+ z4(da|_k&Z6DYBAKa00+)dOB+f*>qvv^==rV2!yIiCiJ5TW&(7UZ$gC4)ez-@w~Xz6;sn{l@WD}aayqs8Z4xKSfbUWW|&ZfHKe`4xTacIFhyw0tECZ>+wP&HKxj}D*!Kv zMXi^OuNsN@@}_-#+>o#>Wnk#m`Tm%KM?I~MPt<`@F5A(d->v*niVJmJ*h<633n%;CMOZU^vmN}`x;#mZ&6KewcwkR)SuT znFFCh5mGuc15|kD`T(hlGDG)Hi^;ar1rgQ-v3WXB;905eP)M#m!SM$Qe3*u;Ix}y) zpp2PH$TGP!1=E_#alp*w7b90%<4`0OwEDi3%6d2`vST@m~{COye8A(HT2oKF#>9FW93XHR|hG9Yna zu}F#u7*w2bFOi&Y5->=tXiI2BMBSl~gH$QNQ1IoK&=^$Y4r{&|qA(x-K4 zgyUW?&{HtQyG*ixC<^EAVGY7hgB0dNSM&0Y0D~A23N|H_Qoo{PfKjCil>;j5kCAF1 z+Mu_$1tg)#uM$IZcuRH*%wNdl(%U!bo0jm?WlQr|V81KYZU~3-A zpQ8A(^;X{3^dl?_Z8BX$wK`9S0<1l8{iQ);mR{Zpn8CFZY`MOmdYfB$>Y3c^r>M7? zt5fZ^DQ}qkuT@9+5nWw;x9jR<4ba+3L4Hh7{WHljfhr_*Ruj@)={l(0ppwDKO2?!^ z4Pp7U!@TYdQ!boR*4^E}tyv!AzK^n|6j6hzT4o+wSutmZ_|~w@vof#s-ArdF3k<7> zv0e}TK_7ZxO+rAdsu~eZ>!wqyqc4JOrBkq(#Oq!i0Dape_s#bcvbtvgrrYBDk_Y#( zP*YrxK48F01+WSsKSLxPTH;S2$~+;7gPwpAv5e@}I0_ovg2al$e4aqSiIh+zj&V>5 zPogMfB=*NJoe+YZoe*;O1K=zsN@fH*ClUuO3JJV}AxU(Cn3n`f?GjpFReZ|Nh9b*) z*a^Utmv@+S>9Yyka$&7Kmw>JIhtctu|p;W^s7pIR+51wh=oDhk-*1VBZz~o_5+6?>T;N5*MvTIW1wMe zut9+2p2PJu`!Pb;`aFF(fC`cNjFuXo4Khx4QR~b1f3<)>L(A2yg(m|7vpqXWIZc{6 z6tTTWsDl)0@Vu5i)r)R|K`p1&c}^}bTY2ftrX}b9kBfAIrj_jCQ|f42pGPb8=rpHN zm!`$)WY&~g^Cvl*z`c{Z92q(?=d=dZHTs&BHgGVy9whHIXCr>@Of{;t^VKV26I-Dn zh|tTKCa~vxlL@)vHXloVtytA0iBRQ~Wx?kGR8^Go09ZIj*~(>zFJ(uuJZ|bf4TK!b z2T7dN5?e5M_n=rS++lq+y_~4lU(~!$R1Y#_OC_H93NVz979=WLI#_+xMsi*smk#Hn zJyOc1cmrk(r?@|*gkemG1vx7K`x}g@W=n~ceM+(wRM+eoaOiBjiaFK*xxS{P2T=?R z2zZ%=Lcz1|s)FtaVUUvKY=vNcZVC?7a>4)S-5s^%jD|eQRsyvqk@NqMWv39t|3La& zK^%Vo60l1$E)BdX&oc-JqWgjZla!E1of74221*E07@iX6Q@QegDGX+ zDo18z$dEz*ty=_|$T3-7^)$L0AT=1OX9?uGJR|`~Dua+iD2Kqa*%T{TZ|CQ{hhNs*MXT!8M>W+4 z1udj-C)ut8C{PP|sm1b=t5>q6LA|_fNlQXttDgby1W-=9T?L8#6UwrXS+~rmW3(-= z+W%|vp*C#E@`@qvs30N~vJ5s%dJ-ZK67N0;0D|nuQ2tlMJ_|v?8GtHP=!KH`E$NED zheze1RnsK7o}hYc18uz87s`@S$2Qd;*D7x1HE!3$j2Dpk!6~T*6YeKZI`ZA`=MwP5 zBGd`_nsRQIC4!^Vsc<%+ljZ2FS8KA@0A!;SQInEp`;1PR>1*9{zrUZhnXNecJ_7sz zc|ry>^d4WiiXA`!BS>xzn^tBG#&v>gz{~nsSyLaL07$H{daP`8ZK~B#(=}Ak<<6L$ z%j#=X3E8u~Mx>+Axq;=nDU+%GT1}WJz(`&RcA+a?2Ua1az(W~8LMOm8Z;K<~#+{Lo z5)0`nqR>NGG`^5Hlu=R;5RfpG*%LvxFor-pLzMUiQ6doLSO-~AlPC;zO0#t?HB$@! zTUH0?b~IIIDpx|Tzm{RJuD(Uid%NH1kc8n+}la;JxL4nQaRg5T# z!unNAtU$A6MR_IscHm5{B2^_vWK-VescWaYHPe=XBp2l^e~|_Gl$})*0VoPv?n$KE zJ^7vJ`aL-ZL*I5~8ITfTP*ot19P!M+qzna!5(X)6ktGr<6_J1|@Df9eD2pERS^Dl! zfP5l1p+LP~C~$9XThsbD#^$SIRz}G3!S}Hq?^B_q-O1hqkLh2-T zgp!u>3`C!DezV+fnP{o@J-?1-Fq|sm>I6ojuj+tI9-8&QLbVtkt6A ziRHzPa29aGZRysX0VGk_DI{6D=N$n<=_^Gd48iN#YVuA|;{foHy@(NGp+F_~V~Wi8 zP{?@`qTqcEzDe=r7B*!a<0>j8=_&@;#)XWW;0Slu|5gO`{{zZtfvKrz0T(!l`+Ws*NVTN_GRsmZ3TrRrFUMez-2?^#WnAglP~ahgF{OxLTP7vKWt4s( zy+tj6h582|VqE%hC8sSGI&P87AE*@TL=~f*TR~<4fjD-m6KwAHfO9H@sW_+DQCIlQ zfiC>Fp`Eme+B;-wLfm&?6Ifa3j^381mkPoB+Q^h9C$ns;(bLGXeq+R?bx`o**pWOl z{EU1g*k~%NwnA$AQs_@Id86br4XKuY3Hc$hX=+z|^dxklw1{c>^VA1 zo#AkTjP8MY(?pbmwjR+-wZx&YLGJ>9zMabI0K zJw{%B+S;5Mw+QYkYh=dt@;l^XrfoKKBhMRjwcgN)hntkt>egiy7*(_&9Pb#-1EPcU z+LsaaFaXo3#`$*_ZQX^rY&#s%+o?LA&(>`Gk@acqrP-RQBQxKvRTtD^0J$=oG?cZ$ z;RmkvSIyYTA)VnRQP4S>U(UU@J}-@vz{VM!;PSK7V6Zk~1IZxI_G`3t@vfttljNa5 zfIq30hE3GYTq+%gkB;V

}YB%q9bu8WZw*e!&s>`okf{%7QHh!=Xw*n{BHi(w!1M z;-l83_G!hl5H&xKS|`dQ$P{Z50HIHuBKDUmAT!x$0|-+!Y9DDPaDt!)Lc}RDWd}kH zCS(DSq+1xkOCc*)d9J2)5}ufqBN3oZc?B!nL9C!Y39|E0f+F!ULXijs2!p^%Isu5O z0--P`DFX#Z9Hf{Nw76?KBC*2Ksjc|K1bwPu_-7~#3?1S(wOtA#8b#^%KWi- zSGI;lHGt@^)>2c&TRPPNP|w8BCQN|Dejr2&*8FPm(UU15j+aETJH`4B_dPo|0c;P` zcn8MA;CK-8%rEn$(S1+#(!T2Dz{&Dx4y^wd*GcL2=%#@tPm&x!H=X|dX8Km$PFB%b zn4y5VGpB~~^p=Wd-W}Ma>ByOZoCi&4@OKsf)p(Tsi<+6Fj<3EGHhDprzLRP8@3&() zp78J(k;ka4#ezF3UF)^RjWTb=%cGKz6_b?V6cm~1S2Oe`d5G}WY9&C-qI@SNKHbjP zgGcrl7p(F4cvg1=B&20g)^0tpOx! z$Xr(T^-wdDDQq|6Z3=G-Bqe?kg62R_--SGo^wm5$N~pw%uTUK*XRAc|1W z1CaDd_R8xrLlO{B#fUNlRFKfbqQpT!fnZ^P3jqO?*eT8eTuHsOvLs+8>UkKoQyBB5 zQ3MI99_w|6!K$nPt1Vsn;vB%{ue!!repr>QX3* zs%rNW3}BGlbLG{dOTwiYsZ1J5Vm6)Q?{_M|Szc}eqZ;UWJPN8+_{j3w3agQ>CS)~* zjAxZ5N#Cn|?P%wdRl&7gtv0FltNY4KYfcn3&wOt*i0cFkUG3TAOQUY;%Qe!k#^;?W zce*a~xch1oS>}+enz0U4R~BheTG2e4&ofR32=q=(0XZ{%W9Dl=R6#*Z+Rm)#x0ktL zY1K03sWO4HB-HqxoKWs)6Y?hWT<0ogC9I)eO)*JI%Bm8*peNLE&=->U{X>%2{YfZh zZ7a(YZ2k{1JGb!qzN?24>VmTn<(QA|=me)`RB>p1HLkrBV|xKP165$b_W?;q6^S`G z2jx(QI&)}KK-RE6B=;qo+*lc#^(b&(2?TS3G}F4!NXWr~blD*xAXEueAmc$5Iqxb# zj#1W?>|`O2b!N{eIZBfMn; zH)kc0M~C@X5Ra6h?8edf2+$x~c>rhOP}8$i|IDm1K6YNCz(G1$qLW-%K%PQ@9RR|E z5gX%;I=Hb~%d4jR8-SxpM(tpuQT6nIqakp7J!^uqCG;hI$34qE)w6HnoY}5g^}Hq> zk*-rS*9+rG4jF$^jZgk_Hr`3Do&CwR-w11vjz4NXuZ{J_J(JH~^Y|onNAX%dO|~RG zo50#8WkGI25zdsWf*@xdE#xiojMEd8@{CgNY2Vg9?5zgIbEDbBlQ@I{uHE<ZHRsgKlahcGiBHi3E2o$eDvH)| zs#vk&N!jU2v$5`Hid)0q)?>_*2vHTVp4Zwb%sEdM|J5hJX0WMB3qV#lpS>DO;$tWm0HsDOa-MW021<=xtO)gr@oA{nke`Ex+V-Vkmc~i(fTZOtQh#td23#_EQLJQG}Z!>=bn)VFa!z$42DL4 zIdf`ID%x z?xBn+i|vt6AC^wICvKPSt0~D1p>>q!^7IO)sXP2De!XWDKU(^da*3_ilp$TpFS!rO z^;Q&Gqti31gRT~U$i=ou@}Q$$1&mZU?H~XEAOJ~3K~!E3YS3gnAhVG9ZDU@SG+#1( zCiSj4t~P*A9&V%h13LK80T}E~=D+G!)tCHLC%h@QXQPbdL7?e^;8>C^-lYcus@#+m zZ_3tjN%}l`O_VvFJ=ZPI(32h2t5%OP1o0H-AiP9mTj7WTVysw!0yeu= zzC}Gv5o&26i*aC3#44FpOmfW7t#kU!Z_4m9b~xn$15n8hZQ^qql=sNH3y^_CK_mk% z)0C7qtf!@4k+US^I$JvBd{ViQ!G{i)!eTfl@g-nDkRo#AJ^>M0-w+A`8*b?Yk}u`H zuHO90e+?pJmlFtHI9pr?Ii}dghMzs_?4NWLI*Su=uqJi#b3NShS3W6FQGlRJN6J3+ zPtZDXf6JDgAOqZkZYVX0$6qPS4#OCEM~&+@L+N4(9I-RT3KR-nf&qgGk~)Qgw|&Nx zFmzotDHj{E-_D=+N^O)Cp!TNEq(h;MN^i;2Y)MAsa|)N&98oYhYR(0y&P1ny_ z{j&UMmz_p@x5l?$EwXB~s4{7`ODBo#d^Gv2?cOZIrA=81b+VS)-K2f_wmQ|uH>G!y zG+s{DiSz(8b@0o}_il0d0w_XVZ8!|^$`QV&GOtVEx(YON$PB9^fQlA0N5@B zeoXeMLd#~Rp5CqobU;A#yX9yMmAo`=yeczu9wasi=i_#VD2hV%YXc!fahB2`JAUba z|4oTw%m; z6Ckh9WU%Dro!kc$fSI3!%$oV==OF$9*^Z+#YV8eq7Gky*5CJi0+jXyQkyB>cc6yJU z3iDA*L3Jx&fT|$yDT)rHXuv2!c2d*>gQTJ^47S_3L0LI_p6Mq8w7TU#$rgQBE)||X;4|B!qcrQH$_ZC>E$ZVB6K?+HI;8JyM4b= zl7Z)w0TazLE45aCAp0l3GpqJ$Uas#o0l_HU-lDJLzRDgbC_5Fr(a-}n!|x>fl&_O< zx%28kDJ`hbB+smEkAt=mD1sX8+Sxq%+nQlSgEhOLez)<^qN|14iKk6OS@%BpoX*A5m=SMt}B^^z@n zI6<#rb13Dqq}(Bq1yxWil0zT64^EW;BlVUT3joA7Ao~Xp<=HQT z1OYk*4%_`Z2o1sU)EXu^9;P-3$fsPoaSRPI1uM(1A2#f4nWt(2a3e*RxH8Yk+QYU| zCWRLDeqsGxl$=_!5@2DK6U0JbYj!LH3JrWDbQHurUV%$01Pp5k*Pho7Jtez>j5qFV|E1qWZ3R1?-7$Fsb&K8o%9_#;YYrJ)}|NVQS<+`mdXUb6y!d zSl^Y}I-P27c!l2tGFgGSZE$j*WkAD8f;T+p_k8WN?Hlakah{9-mNQp{PIkfsAl4UkiiPzlAeoLc1!UEv+?V8w0vrV(o~I(6TLwB^%19|%lt2~a zHYT($5nE7nwI&Mfysa?_Naea4pNJ4E=7smSNTBRHA;39XS&$0=`*Elxp#m@f2Wcw7 z)<2CfX{J)?!!^@Lu8j3Z6EgCBv?6IJcyDHGDYyEimc(vlKHHUY<27V&3lNOFT>ZO} zHuG*iOtJCIkLPxM+6uH$hpzV;jtS&%sURTtUaS6&x`tNm#1(Y{8#J9l+7U@<)+|yZ zL1Pe}>Xm9A$buhP^F1C+V!B3TfICpIMQY+u@_7rIo+4M%SnA{@YsJ2C8)hiK58VMB zE3w&_PQKSDt62y{k=l4q?a%yP?qe1irsHY~QST_10h5XH3?K~5WTnd~*wkN$f>Z^@ z3WEojSv6G2+Uzf3Y^=0X;9?+D8pi<&N`$v2*OF~lOetFX0faY?oUFLHR{Kn#X@MTQk5`KgZpE7+_oAa%C2b4^3ioKc+)wQVyuTxuyIKk1J z9eTdnP7YE}VaI#TinX-uEv8yqzzrD_q`>2(Kq29`z2(aFoe)rJ|58wp@=k^Um?6X1aF#TXAPT%Ac1GrJLmrG$lucpT zQp~C2`>6>0mc~am4W+CUoBG44~#2a5<%6VjF=!`x)NV@G>26h}hlohU-$elXq6bT_aq*=J)l-Jggm|aS@osvia z!>U4x%olCX47Bpm%7C6ys1^ce!j^Y*X@e;5WYIpO9gF?!C3XP;RaKz~98gG=R#67q z381r5Lf&d}jt_rnCtXGERj`^mJCJ>qv53Ns)2vx-T%yRc%DZdJ!c6do^7eY?osRg=} zxy9|)iZv_L$Z8aTq2`Sa5}MB&GODihl@3pnzdx#suDtb8YE`9$uh95yvQ7D)$HeH+ z3Hrdv^%jlY+H{oeJ@t#)tg_6wT)*pQRv^;^ZBC!%Dx~h}cox*|NhXaeA?dO4Ix`^G z9!dIYW`49#rkc5m^!yIFdn!0g0HHA+^*ybfRG@a~iRPBwn~?zViq7Rls8Y!F_MjrD z3%m7izc)aIRo(`d8AyP6@Vm@2m%zKkDkKW|Xx9Pz4`grmT-P9hen2FV;#hbE0>;YH zVh{|g2o!AUP9isWwjCr56RM_uRw~J8w8M%hJM3lsk}Ii7E?Z<&=}0<%z)W)Os2o-$ zDY=^WeUdF^fk5C{dxnHTfPhAF3>IEk+dK(PJpL6>s`8an8IjvO#flYJAW#Z?+MfiG z(s%%YAT!yNw@TVM0=Zo?I4Jmck{t^0mNYf5iyU=Mnm(_rZ@d6?fG;I$tVDcHgIOMk z>iq|)w!PKM!w{&Jr&+fWk40ACvaMA8RwBb#I~zlCjsAV7C^bT76`f^A+K1bb`Rt>2 zg7|C$4Z3ChN=9jrzEp|Rr-qCkI2K3qZ>Ky9K;l8e?W2)VYR^qdqB6 z&##tu1NDr&MrplzS#9O(l6NU0&s`Jm&+O)bf?)fd}Z6%j^ z&P%e%fuk(*wJ(}qmv(~M@|qUgp&e`aqOFMjZ?6#m$exX~NOU!v?<)-eq>mlm$@mySn~td8}Gb8tW>yK^g!1qw0s216Y#SO_0+CA7}|teX4ersTP?&E8j*#q zo>rIySlA4nfIzHhw14s%w8YofEpAC2tY9$)NO_0^o$2Xvf|BOXlT@W@7CZqVQ4X2O z+u&SRY*`Kjd^Og`)da0_KnHFS^5ICNeS^qOv9p|0HnS^yQojhE^;*vpv$)idbSVTj zi&WZ^hAfue8;B2^q7-lML`jsKKc^ z@)ZU-WtN(4GP^QsUrtyPF!9wd0RW~iy&@~Amhx|2)bYH#Oa3YnuL_Zt!hx~Yt|DD{%ZLnd0GbqH6Z5NZ3K7h$?WRgwMnPtNDJg26Zd@$05E;t z#k1x*@|vyx)cPXoUBQ;?Ge>;Q3^27WYJJmI?0nF;Y-=GA5a(7n_@ak!?5TS(T+&Cm ze;f<{c_SA5&ni*&O?2n#;L)8!ZzR8C^F<^X{P|Krt21_AeFg`4KfldPo6^$fXRimh z{Gh@q&&+mx@-_g#>Km?;veZH#iYrF3ELe{hdh@_ZzEquQGRlA+UCZc36*OV6bP7A) z^+im4_cW~gt;@1w#z8(v0@flE; z37w@WsTRIhfI)TP5zM@BCx(|D0?LH2V=l%&xEj6xT4_o!0q8$}!$frMB8*@vyTrGe% z3p5~yEmrHBE~9Zj7?^uoM zqe~t?{U(3CvQCX>K0UeJFAcgnl54xR-k3$Hb(X7%t@Ab#v_Rr1H|j|)2W+}5E3WLO zf1k$^V{hAzaKjPAPc1qd7d1++H>1&*!`*7WNlRQ$?pSsw$0{DImAf5 zC&2cJ@4xv0#5oa5-hGByBQ$11LSlb`z^5Imi93Lu2LlmKd-o>9ITa57uLorOtMW)$ zM*8|`D^WHlPyNyZ82ijJoc5y2vEZgFQQo@%Cw}L<=)ZWU36<*1W0-p5eV`q4vEbR8 z5q8bR)SK=@JnOi%?eL6aIQE8nQS6wDh0ooLuyZbsz2RQOGml$Y@vP&RdgHyIopUk& z*;gU#oP()1-ivhRF$*uO1C|wKvNe1S6-kvH6ja_3yE{E?@k+%*@Ez3$r>oN-LfDByrZhkkl1 z7XIrx<6|JEr!08+AugT9-aq>)hO19t#VekO)h~MzhG!j@?TcjNp(qNO9p@0nr0r_6 zd`-_wPR-B$#^c!YyWhmvuDLk-$F^W>_aq+v{cmHqVai!)Le0w4%#V>pTPOwV|IFV| z1QdmY$d-O-?wA4))?9xLR$X^Z&Li-tk|B^STae>{0vvs!0>JbYPsZTY zXChpE2xITP7qqBqi7x)g&~oQ-hRVW=$bzC2&@B&eqB0Baj+=965Vn?;y;ctp{S2Q?qBe6w58wl2cN zeP6X%f1QR?Yv5MhPUULK;npmc%eUdj3G+J_pWx4nrY!j^h2bO&bs6V!0>Dm3ho7?x zGiM#aq7SaeaFgMhJ}bFtzr7uMUF@*Khk2C|ta@;0svwj54rfFo1LHW*O@94V>N zCF@D~URLUBe&BknzTsM#&3dI9U0!Ntm)SXGuwld{oq@0b)3CYvo?cNvi7KNiCOM=h zxn_`nMTvu}#3Lw1UedpD zH&8~5-?|3jM8L$YtC7lx{*Akhd;ObsBb5d4Kp8Q(X}2f{m<7O=UXrI>lpTU8mVzM1NK>t^&AIs!jDKnc!r>CV6JwZs=OzHa zi5qtsAEuti^vwV8S`sf;-BygjvJtXIGK63qR^Y1Z~35FcZW2%?0eKe`)f z{t%1)VI#)2&P8#!hsA$>CM=c))d5Z+=O?gJqqJ?%Zj~It#b-Yx`E<(^x@4n%3I#!qsn#&juw5S-zaq=4EVZ;xnW-q%2Pkcr z0xj)>)=g*P3}|X1MVFFC69_bCS#6wPH>NMS0@IgVQJbXXtN9}Lt(qel07`^-?>r3O zwidL!kK!lywDmIq=o5zTU&gH1B1*hzwQcUKkaEfw?n5~LIEH_}3e~3;1N{Q=p$QCL zdq$1YTER7x;qOyc3Z+9goOrLiN zrq8=1XXg4t7a(Zevso}|^)o=5>TjpeXhR{HP9K1l4*BP@0cg!kBa!~hld0V08s#L6 z;Emf_c~ zZZ@WE`|nQy0Oo&e4W=$XfZ?(kASCk(0D#?}x~*2B)i+!ZMJDRBa^&Y8#PMhE0ab+Y zJC|VU8IN$<>#wc7d-xUK!-?x2MVeEg+%|~?e|{E<`{pA7*n4}uoV~Yy+P<&4{yKyZ z*gWdQmOm!AVjpYfW(1BtZ4W>RleaHNl@em5M;h}fd(&qh!u}UMgcBDWMjDS8-##Bp z-@gu%pI^!XQrdj}r&r?Oncu_I4?TkU@7Y)zgha0G8vx$6nF)|nBV3w4;LoLfAVg3M zs4hAT04TQ4MFLQ4n+pIKUUb+L$lwW_rrbUWAfenb2>=*8;ShWG6Q_r~PXNm8oKJPp zVTp?XBa(pndNfpSldBIwjYmC-X~e7*X1?cqNnvMf`%{7ZAT!SxPWP% z*fog&U}6{3eB#1Gl7@Nqtxs@&UHtJiIQHZN7%ZJZ3JDiH^Lo>JhpyR+{V&{x{+cO- z;|1n?Z4s8g?JN|BdPeWexyNwu$G2KP9NRh%i~i+w%=z3>24iqBAgqn@FZEHGdFEbB zy?7_$iW!8xZjCsnA}uA@tl2Z zLZ4SjTgcL1AQV5e55-G&gVs+Y9Seweord8bZ$LWOvn^;>kkiDWszX;#~_cd`rD7?Hfo5@vHN>pIvnX_}^$>9&8l4 zy|O9s(H8s!gr{*|t!`V`sTcKD@gw`0<~4n!-D4QOOP3LHrW0SkoAdg>a)hTI0<9P@ ze=d3wkbsGAd>H^Re9uZ0&o}^@SE2gEVhrAVI%rrJZQ(}_pnTcGxvY1t%1aiKX5yRo za9QtPhH&-aT-F7b8STZh4x+qyFKELw^ZASOG5muyNC$cV5+?4gTLZjxfR%pxJ^)Og zdr1qF6*nD3@pF%W)(nt#_b`0>3dD~rad~{5>HX)W2v0u*nv96wo51i5YY@LVx6OFH zns@?)aLIB0aUuY7Bf=$9sCJFDUM*kyFpB3K0!>6z|Gp4|H?0N+Dvxv*13E1a;9=oBthvnB^Ye`pJcO6z-dmUEDJ@X$B(!GFWT4lXI@$$jc#XKm-zr6^u zCr^&x4LEV(VQl}Cd(dBZ0_$FX3C{V^Yq0vy&&A;z9yar983<)TnEdu40Km+p2cdS3 zV4iOLTbCJ>ID!P+Q4lFJu#_TZUa*Tf^H>iQCD_giMxu12#L*Al1v<(dF|L>~?&UNE z9{b>3D3A8?ePZRTX~K~LM{d0f!KI0^yP`I$fGq7eMQR`+!7ZI2*NfO%pnOVVt(kej zZZ7+=F_3Hvtd{evu{c`b;eYue%41AVwS3x?QntwCeo};hG6a-?Py}GOl1+C9e(ihM z{*ljP+rQm`gRj0HVKQ+V0?&M<-PkH1bV~c^K|b0h3a)MPD&2Lkd`f8M;Gs(MVEI&S zNkXrgbtka#wU^<%7i__@f8GEe`SIxHeOU8H=i}@fug3Csorz=DJc@lU{~p(`DA0ex z5$ycaub{u~1Wte5ML6rGr()HgpMzshdqj3+%eP_bg}ZrY2N55HWR?s<0kH&$@4#3Hh^eyEHra(o9Z|&s6$2&~?$KDfDkXAJbc&gyB2Zz&FhF zrB`73lFPf_6aIwj4x;~?n=rlki5ULbIut*25anyT%L0-43WU?AyAlB73BBjD%#HuK zqy~&TFLytj!Tl%gn5bpxzl1G^(R;&I#BWbx=7viU@0*9-8@D1n<*>`s0l-aD=>N>Q zn10G77`}Z~o8lFH^q+qLs?RJ$@%;TLU$jr{A_!ZKp!ddYh~JvT%ykzb-aCojo3?RT zNtc9uS<~ph^lVIDbuos2v$9rBxZyDRzrG&RPreAlKUt098IPg-?On!$>GLne%mtTP z`swp8b+i9`weB?(bh!2?$~Wym{N`NDY&jqC+jG&oWhdzB!)RVsCULC4zWAw^_L4L>36{qU8hhpM4gp&n!Uk!h^qn0((l(4jHR`=|Ae(RF4n_@@mBQzhoywj2O3*l+^mI93BvNw_IX4M|SyQFU7< zDT59n9mBOeD8sG^R58jj0{{xx|9?1p^KiS4>Q3~xYVUIg$r>zKvo(1DPk=FCo7ppl z41|~=p&=yTkU1g1>!v$t5+|gSyu9=uNoOR`4K#rOA%TE_fEfdXDaOIZqio5NHQJVB zNmq9`yVm<-4Yj8Ofjj^JAOJ~3K~!p=b7hnLebPN=pS`PAty;C_TJ_o;;5K8;Upxtu zw=W0g6Q*~bhAqGQR4;6lRG17NniN>KoJ8B$akAphm1nbBxCJl9%d8}?2qDJsnTIiV z!(ITu)CaftfO%2|ld@J&T+p#hC|;;ML!AoHF8RB@6GWeBSge9HOr;$z|H$#zUmc}C zF}7`sf#q71r-}e2EIi{dW^NE=VCjc811i9B51vM0w)+G?ww31Id~#v*M95PD$K>86 zIQwEhyeQ$eXP=E=APnDd-ek!eaU4!+ zjs>`K+i&`dCt>Q)GzN1mHoSkkdm;eFmfyb!(>s@;9VVRq#dQFHnTro25rdF%=ymsl z+l+O8c`lZGe>s|kge5zd;mn(!3b0t{$Qdzfr?t}|4VFZhd9^UWCGXpebTVQ3!y5qr zvp>AwSB23vIBSSQPdH==Ycx8pq+t{ZqSZ!2{LBwbgEq~9gEEj<3tNHFz3p7!zNJX> z3H)hwxnFt|?q&_w!tZYf@0|plY%u)G&2@Jp3_QS~B)#zeoCCgR2{50~eR8$-_1L(V ztM!GcJo59@t>3`ZH@=1DEe|4pc?A~!Xp1OB8nf|Cd>VOGF6Hx>3lH?bXkRZpVEFEh zz>xul?-rrk-nbvGas`ER_hT!#)5& z_wM!5*Spr0zM?Uz*TOqCgCCjzW)g;fwz2;0&D+6uPYa$uz6t=4F4vq9;|+@`Oh3RS zcmRg)Tr1;xr^t);XAh1%+x^8l;6y_A$&~`e*>eS+O297C8N>4h_)ei^dfEw$Vg?xg z^&0Sz764m7q`$*=o&f-8UUp=(?MNf>J4osbFf-_60x#{5CmCrryovJi{8mBiV2=RR z?3Tat+m8Er@ODi+BrfF%eRg5pj0^DQM2pkDx)#T-+J~7d4`F`WanM48soPeL#m->Q z5_Ivl_-Kn&+Cz#}O9OyzvszNS#pBUFxXho6bqWBnY5^cEs6v#2M#??5W64?St^~oW zvzet`0s|_z!hV1EP@HI-X%I2G;SlrZ9RmPNet#v*QO1z0?=(di4!;72_(kg3u`d>!A+jCL30G2Vo=Li@$$=x5-=aE zS$zf#@;z@n ziQ_lj2@qrQ3u`d-!A(AQX^xPm7}RELd+l?;3UitxG>wG^v<^X-d;3BJZ_Tu>S9>$sPda^4vrIx-KmQoza6||I80Vt)RT`l2)bDm^yn?b__ zD;p+w)`Z=l4J_Grn&LvXx0?J~SUZQkKXV^WTzCZC%6YKTdbex=jcy5?eX`Ku(mPkk z&IBVwkQZ_4x~^h2O(Gj!B<}*yvfSie2L>?6 zq)U>3L|DjKjy@);Xa)fCeM`i5l=Yi@O;BX!%g;FW3>0 zdYKj7w^9o}7P}a?^>s2y*kqDHC+p;E>x#}%@4>D~foG=}9CXgi*e3I?DV*x! z2jzX;7UJ$~LfSzEUT`i42QZ`q6V%;TeY_Q8!nR%j>i zk&#E8_h_5vih$%@y>UHh)RV(UMW(=v?B;Q_5$oR`o6Jb(D~|4(7MebP7ChO3=9+q{ zADk3cVL044R~ifav(H=YN?9%1i3f#gENnOtjkMBHZw!{%U&cT^p-k{Hyci{*6`vNZ z?y+n3VqxPfrvH5fXtwd$wcdLj-EQp~=;6)$RcV>oVM{6a*ET zOk6S9$gE2eWbq8>c5V?!#_%+mBWFfBE^gkubXb%L035QsbB5aawyS}PAS0>GKUk@Z z^h67QRbf!~G{p5Y*)|v?Lc?%{jaakJ0bpsy@jtvBynKkkm(IYl-@O3DmJJT1143L_ z-U)s*{+Hv7GJkio@owD$$};d&va60P@hc)CXp<`ji6BzV}ve0{j&>C zKr-ajz2Q27&Ha*$6JcCSf9HJUEDsKIMsu*h!=ZTQci?y9Z)Bfq9$~?&@dTZhnfB08iZ-swt{| z)cfheSy%W6H)+UYz(^O&f_pfZ?bbb5OnK(&hI~@F<+Vv{o7-t$5m(uX=REB0{33s) z(}`WGFsO@rVUuWz6Azp=lC(ItaR$tcIem6;a7iFi#`O1AVz75wLIlKE^6k|+ARd{s zXdPO%bKC}4ja{`E+dgG$c{lt!E`4WzQ^~+&SF@CP4EmV}%H{z#n2( zv*4zDp1w=k$t&kU0J@dp3Y<`-!W2pZM1JQeC6NCa~=Z#obicGm^j&DVarK>C#eu# za*xpA?D2y=-nUpOi#$C^M&6GKd=^jEP=L-%L9 z%W(J=J8|N8{{zO>{!tNj!`V_FV6ky~k%Tg1H=Jsmd)@99rULd%KQ zJcztv9>-t3E4*L(gktqUyQ*q`0Gj<8qkr0w(hrfp>-EwLH1%@|?!>|SROaCJ)tG1qZ2|_3Fvfwp zx{V1oB#CQ-Hi-qAfaAZo19O)?f~haA#p(a!BBV|&KaJrsXH5RXM$ja*_S^AEYWR;9m%^GF_Zw5ZEMjF zRlEdc2~m%3W`1c07A|`fgU_$Q(woi$bw#@sXIOHWAA8vz%(inl{G+>pjiq(j9D{mXTs#NS5>{b5Xj`u-Auh~(-mWZ(F{pWy& z2@k#T9?V|w7%m z7A`)DL+|*W;3ZkUKv_9b-heS^8%(yXBwJFU%|Y9sCGiThkh9pM({v&w-F8~;wIpi* z_sUKeJpVA#$|3Oc5B6qsv6(i6nl?ljnOH}>{LA->0Bv4)1hjI9!7uMwqg7)?M(Oi8Pn986hoy6b|?su4n z?~;DopWY8zIYj$n})b?-Q!;xeV9votoG1hJ!LL%@r8_ z_1X~!$@pvZ0q1Uvstr=1pT8|Mo4<8hbw6J1&lx;I8{J1&R==A!+XrPIwZE3FD9?O@ zO>cb$4!`;V9J=vt4Bs}7_Ru6w|G;*rSiq8Rti~Dt^8y_Gi3hOzga3l|z$DK2;|nnT zt<^=)>D4?kg`I!(b?`)o6*q6f@{etXg-iii_e;Kc1|E6+eP|C(V{-Rt!te>Yb*Oe{ zjEstby}fOP0I)x7`CE78m00pmn=ssX5_3Pa4~O3KubBMW8IAx(y+?ZNRqG2_{=c4# zV?TE<4*!3*fm=}&;x2;-Gjlk$7zBiao0i-t(AWmF$5KBL_$q~a~Onq-9*8Tb= zc{^1=AKHoxiK}*6Liq3t4}h3(`Yr1*Xw_xTz_2Sv2{%bg%|a5q zB+e_sXXfR?oMx{$i2Ya82{3D}x&ny-x^F3#z5N2r{M`LG{E4rl**k?5zjYx7_nqd- zSi9piEdQ+wapH|TaOmS-MYDGbD}U=kH1{r5Hxyy8W0^nm$Ul7*Y40Rf{MH4S*m0UF zNir!}v#8VVDMZ!QX*nu|wrId!m5>OS*WCjPR~^EUs}5D;I^(Jrpc`hiJC3XTDIqf7hpk?#_SlRUiVE+_e&$|KK7VeDwo( z=TdC_ z{ik66>+Zwt@Ba!W_f6xRKX@vZ>|W~dRmy-OiAbz#L)o@Jxe&X5{x0nL)jN<*46y2} zYjG6fa<<(l%kEl<^M2!**!PP2ao^i-MV`!<+PxHOKe9ziGn0nAKv?%@=VJe_-Hn64 zau4>u*!y$9TAZD{=(bO#^5)0VsO*_;NvawKd%~j$KUM@6-RD+e_=j6jm=x8PAYs%DolBU1{ds8LxEJkPcVqBJJG25}G0gIp zS770{x1)W-UQFKdUGUxsEWG_J4UfB`x*m+ILlcVEF#ErLQk7 z$HLpUp}lb*CcpUa;D;u#@SEGTFJ8p5?RCSz!f$TH;J@$2;2pcb#~b8NpAO)$kynU- zh5xY`gSYO%#JhI53x4(j*<~>G{aZ)giT7sDe;V=^mto;Ix1fFFeoTJl4)8+*Ec~}E z$p5l@an#gM1Ubw-bOogoC_4$FGVq2&>KUjz8r|#p*APb=mr6Eg4fNHhaOSyjLp|mQ={g7jWp~|AKUA5^G=eT=Zj7 z(F)`6ZkVRxjUWKQecz|t{+2We4(lWnaQHXBkCRs(z?xrt1}5%W20NF*LJ(G77u;za zSp|A4R?o>NAI1HD{4K2f@_KCjyIhvL+%)l^Mw_RpGASpA@>A^nCqBJB*a-?xe z=(_Ch#qfk!xykQEJX09Ir49Cz7A@g&99?!wUngI;3v)N_#Ke2HVB($I9J2+l6`K7X z#rZ>^Uw^-pJoY%5&5;V-MvDz4Xwe?E+-+Vc84jcaN~J|pnhjT_s-X0<|5XoQ->Y|E z{fD+=!~4&w@KOwe8lPq)*db0vJ5@ab!%0Q+2%iHY!ed1-FKefGXTm*$q04%*pcU_8 zJ(`%bO)buqB`wl^v(n8u(tG~#*F1AOv{GaWmil+^oNK2B-t6k21 z9tdN zhr%r*>dJbHm(E9@qjUJJx);9qV(2#)O~d$pfWzn^j~hepz4#-u*9Mqc2k)!u=kb)9-tV4YHs(DB%GnTA=ZnA{_(cU*-NiV4uDZsde~~E} z1*HC%I*nzM#kUn>oK<)-smnBo^h8cy!UM)^^5Lig*nmoip(d)%}Tk_>K@PY^m zU14rqPO}RP5yqS;?gh8|HC7&b+g%uLpOJ*JpO9@%6W>_nLaCG;);niZvx1U>s*n;3%-mDc3c-~y}BBct(l4xqjFblHnuL_thJFUw>nMs9B zavE`PTri55%P4{?*1E`=Gjim4;sQPWE9-phr7Z)eD3Ha)FD~x3Nm2qiNs-=ISHSW} z{8(+2(1azvI?hA=1fz5L$bl(QJ--Art=xCv^pF~j2q5Uk&#$x7HFP>DAbm;7{vZ#WgFSYux_r|VF!h7KG zkBnO4v&Ia{bL7tz13OGmzMHeC8I=LWAX>+JH0u{K=J8V@haNrfQac zVf{sE>0gmon^iw|+-dKYJ4Bmg>*BIsEN1T2 z3&~(89v-r};evNtQH{~Eg?PYv27%Fe_G5fauxMna8kbwCHn$WkdMdamw9_9N`#c0a zQr4T!qqSN3(6wrcC}VV;gf(cD>%5OjVJ**;p5dp4W>px5Sx@22=DjP*wRjQLQxz=J zdb_Bd+o9DSNjwU+)-r&FVfH@VlcG4Xwkaj0`z*?mX~uwT`2~>lG{me2DY4I&dKrkY zz~Z4=$Qhk=lo_zC!Hbz`(USGG-m914ue$UYZNr#-c%h##zNd>~$r#!QguYFki<65MH0xOlTBk+xDi^n`y{jiv3!J}Y| z6FZAGGoDr|FVbTD_Mh$dJMQ&yI9?3aksAcM|rE_am+ZP;bC_RNz*9$ttSXU*|YSdAu%Ho=d>ycVIp8S>@YFWf=CXClH-GAYg^Mauw4gs;1}zj zQrpvSj5m>aX^NsjW8etb72NcQwI6ySV&|t6Y5~|I=9LgodW_fBMQq>x z_q#5u(r!ZCnkQtVKYi9Fi>l5HE;tVmC6K(q^!hiN{TkM7FSAIRvVNBW-J> zsrVTZKJ&xF6!sxA7L?v4T%chQ8=xwRUILjRN(Yh8was0@b8imq-WbFaB`}RtO_6`8 ze6z&X(jH2G+P*2oW2J$Ex7hCyxbg2VesTE|h125*GGV1r@^bx~eR76VKT{qar&!qI z;{cC+E}|3!qvKS&8^*UC;p*Lc0`D!VICxu&DKg%`=zELIMQf998Jf21P?#_kA;wbG}WY~4^6V0rRK&(Cxx5WDBU`y|oZ&VMy=H-3G#28_LG4>g)B?loqFYjm^J?<6L zHY@}bEz)d)4Z&&-a>*H(2h(7 z0Ti}f6C#d+Fx9>XP2=a)GoS`gsc9f}63RH?w1J{%A$U5%f-zTECH6V~iHxlXtlDd0 ze6Dz?5Ee-kE}lg~G5;mF-r>Xc7fUXLjKnrLGBcW{k^Bh)x;&IQNkG%I=yFDz8WcK& zdW+2JEJ_QrSfAz{0L&Xxib?e^Ql+l4F8hoj%z?=mCvTD}hpbF2TQMD1TnnuRb_@MW^dB?3iMJod={u-aoijF07v_C&v{7)^gG^(~W^)_#o)PF07sz z>q97@Awtq4ku7YP!uqEsVSd;-9*9J++p*aV#6w`p1EoT5u?WhWPz) z1mGgVngGprS!8VE)nfhF`}}wcLBA zuGJI$%pESL;;~zak@-2G27|ssTn1817&ISb9(DlnX?S3z~Z!XJz!^}RH<3f&5FVt1Zq_*`6gJBnfa z#Iz)$g86s~;rJRiMi)hicPrWiblsWaBMd9_U6hz{aF2SFeE6rj7W=&ji+YV#yxSHB zFj{l=iS;=GvwIoh6ZTT%U!iZ;MNXv@P&NPmVNIZVH%RVYbKHOA@vi=J`hIJIKDt1R zX-9tUB+ZuLtBW&t#WD%KRmzk$5~H*JLr+s?z^%jb5UbTuE2p()TM*Cjt1BH*sF#?g z%&Q1@x0VZE2XP-h1EMV4=!*7bQZ1&QB4geHZ#p@ntP~9nZg><6vBX!Ujm#!xiZm&1 z(-c4@*#nNo5tMT-IUl6ol>z1qG?X;XY6?_T?!pIGs$BKJm_OwTE3@z*^4$hbE4e5L zh8s~n>sj$+Qhm;juNLb)DIL^#9qtAvNt{F$D>7;P+1b4b6Z0;RpIhi#I8$T7Fc(YP zJr1bwV`mOfn_PHi*07OUga9-g@2%^EMhkpp;-?J~URHQYs3zZCl~VP-IaP z6RFmg)m>asM$G0_$>1WqNLn!Tn-xylNZT|jywpw2A%8(F z;hY0Q(y`AEJ2@^{XF7#>_eV__YktSV{7|}2@$#~acFsobK<{~708AFJzYcMg#yGeFZ&*yx@VOWRn_jIuSxpX;F%=U^>@QcAy*?|Ug%0Mrl~^_V?i3daBS?=; z_t?Dw94rb~7+h!|xWlxc0As%si#2+>gHgE>d<+#-32wpaHwNkog^tZ#onw-X1x+gK zVEBc@Z}(z|q9_F=In%8xXTBwjV1$;zYEdSiI}>QaY~|&q8jlfDJ@z`8CoU1oD3N={ z*sCLmQ3SESYl}cH3q8c?cYOG`%rZ7nP~I1u>vI+i)+?(54~vKB}b14 zl(cq1IonHdO5(jq$%|-_j@ynVHsvm>$5Kjgi?=5;YZxG-Nl8789omKfl%hth7U{~! zNL+S>*chGZ+B$^>^|cg@Gr?PmAZ9v^KY+aFcEq;()&php*g71vtsYlSSdStZ_wW_7QGd zJcXh33id_^bM0!V9$NF2J$ z9n3@1C_{CtS@Bb4^Xur!_CIs_sc_J}{Dw0xv_oMo121vr8;XHMJ{A9R&VE#|AJ(Kn z{K24A(6U{~1iUQbxj>7D`K)xkNdbqI7&4;ceYcABMR!*|^flamt|c0)96 z<1z2VqKHc}Tu98*Bs`(K>~f)^A#xR}<|RQnC^rLMoROmb8%b;QWTzQx!I zl1aFSfg~2U(2aTzxmV*MDATfYB?rYQ6y8FqF+oH~mfaUPcnSw5nLL{(f^pHSr(pE&IUhrT&sJhzKj`24L9P*HDD+Kqitz*-1z9EE zd2t2o@nBgLccsCeJ?;EbpfcH4JdIHvR-V8fR~r%PL8%$*ZCLawu(qakks%Yp>_ixa z3DyM%6J#*KZIjNvC682{&q~0>L5&)TI!7vMs%?ZeC=+6at_og^()zghA#;5i+#G}y zAZ2XBck>jG#wg9oHTSX64|Lm>ZMyK?00otZ369lvID_4_d4%cp^gtIN(b6`bK=Gcj zGd|C_SLSN9BTPuyoSH%;FzA0=;+tmmSzD$Ql&ND)nzNXx?JUu`^jR;Vf>@Ey5#cmk zX41VkIe3&znWWKh3Z>-P>#R6UI##dCPuahN*-vDo#$X~4R2d-&7g&Wo!xhU3NM)`G zBJ?)RPHmO~lc{(#BK-x0 z0pVjMn`nd?_IabOAos>a-ash%ZSJ)r`J7VYt;tqFRHuJtD|ErZ!IMahijr^$lJ9Mj z92SWP6a?ssaM-B{LPr%?fWRH2X>^{fz8Hiyt@LwC7Aga#ng*GLwp)7!j0WW1MpIf6 z5jp@1V4eFSYXY);aw@lYl-s@MV7T{*h{C}}5Z~!b;HXH1&O#rRnC-z;ehAP+Sy-4z z4a>NzdS~?Ka+?tU)DMjj#ES{$IA*0IijVj3Wy@hK%&{+%iHj*kS+v%(TO1l25sC$JeMkl1|O2@#8f~m!ky}cU|@ws zQq2cfe+pCY3D?m@P?!^_SO=DJ6aP&qyKJ&O8JuC3G3c zrta%H@vY9bMG>-oo2F4(4tWQrv?mhF-g;DF9bszQ2J^!XDJ2Z^(8ppPAyM$d?j8ub zQX(v5QS1h(ak{g-0Sk?0HYHh0esf^IR%e~aLn$NIsjORORNFlbIQt!8K5f<*7 zo8oe>Z_dVt`z-f~HtH9LIqvnrTs`c1Z2$T}y%{~A#z=`VLUN?j0^2wRWu#^KK1Ry9 z_b*C_@zYKtI4Q!n2Soq7-#Y~X^sZLkani0Py)eW;Xl(7XzsGDzKE^0j5pd>@0#I)e zunEE*CX8W_YcnA^Cs?%(zroBAv3gUPc-+2cLamI$p6Al0eDVp1%8#`Jpwz2(B$dTj z6sR&D%M!P^cv5`&A_>eWu0A`vfJ@7W)-n;K+8SAsRu00uKgDItmGx3h75iApVPl`e zM2%aDrd$AVd{7s8kEX3%ZBrDBLKg`HPJ}j)MGneW!F$p;y@n@Jp*aLaM%?v`iKNH- zQkEb{Pzr4a0+~{v0>UgmG)Zgj2SMk8mjdG|IUzoKwod#GtCA$4n2trrEOglgCgmb% z4GBUM`b@U?xG4mEX3$%AE?{jf!RHN8VGFQF!DGseDIe8pRsACS?_mytvShd<*tT9> z)s2Lm>`V;+NSpyA&q)y)5?V=Mz}ASbX`KUW*j9;c;dNS&62v)onxBx+Q1*NePK>4l zC^b%#85t=71Kn0#kDibr-ip@Fi9k7@fy3AfVp&7Lk?%wnILg>9mTZbBkiuNC(-I(c zGBQQGlR{smqw%6L^dCbQ6~l#=gQRLq)dTL`=>6>calC|z_l-xnR|HC5wyR{U1TEEL z>&{V$H>ZzL07jeDKF41+u%6H!`K^K^e2ywX>@fZ{92l<+{X~svF%YXc7^6t&)n?sO z9r?5gHnT%ZC_sg@0>t`)Z{@Mc3-H-0Fs5kM#bN+)52^0P#HfN36%}{K`a3Std}1qk zWbXs;?JB0!urWRgZILs*4$v&=5Tzv&4sPRgCSI(QsCc*y6@+cMYTPhKr+XQ@^+n+x z*sJNPQNbW@^fp{ctd<&*2C7y7oTVc(cK zWv)q&;|$uuuX-pm4ZSCsV(vlG{hW!CpYf2n90&#H<%L%}F|a}(c%1VxV0=Dc{E< zgKFhr+(0YAsGmnPkx|v8f@Lvb-53@-$g4^Oc4#XU1 zctll;moeN(5jA`7_gD0h$e76GdaY3CXO3-^ShxtI03w?^)fl?9pbOI%au`qF+u+uI zfZiCKD-~hX1jG{*Gk}JQK$r27GhktmE)jhT7^9S}cxfV@+a~#asj^(+v6(XlP4bpZ@X0b1dnqzYf+Z{J*#fQvNNsw86G5Q^ zr(4o68EX<|NS-6WEHfLq%`*XB4lF>*{k05eSk>Ry?4nr=C(PO|zljMHR z8BMG1|DXhQxeh;AJz#Umn}@{L6_t7l*=Qg`m0&B8Y)2duhC|i_(}YG9AY;z%u?oVs z(d0tT8N@MEq8=q8 zNS2XOTJkv==}#N+wW_?QFZ@r%qKhCHgM`vw5u4**uV5V8-ziQOtX`>BLQuj+KpF!r zJ%P`tP*w86?57CHI9SI$IsU4*=#IMzU5$FS3ao7bxL|^mSLicv{o7Mm#@aesXD9@!yDfVsMDJjIe0RErClK)M~wtZ!jT*)r{! z#r3Q1Zqg8m;UnqU4RIHP|Hb$#CVQraLLnmdd9_msO{tVAXU~AyY-b(m z9GR!YKf^*l%20IeRXa6;a#cK0y*XmR9aEsOIDdZV5E<^+Ndp9DO)2rf}UJgHs>oZs5>mKJnh!F2Ek7` zi)^psj075K2iA6P2Hb7!5U}5m9*4NYpnrLbYykEMJ7_1-ttjs2(unnuDi}&J8(;6e zMekb?!LZ|Stty;NlP7p_biNnZ4X<`;V$oH4Q>>PiDIIl~N13-TQwR zmj7TQvwC|jq-^2q%w+w|PEi!v3dy|8zT?G}N?Qz3;dafX#Zz1K!u$u5(cd2fe@qs7YgS9vL}Uh=50xG zJUAGBv^SFNf)HBkIw|Jeqz1z->&^%BpyrBK+BV$zz7Pn!Ax8GgZ>BgPxQ|DLG-o}3 zfy<7U_@u0%23^+`x{OMI^TGPP3Kpj|yVVOhRJ2T`k-pv#cvW>Rsw<2WY!v?VrL5Z{05;!uAxfa5VuECIz4pfZC zHF@+WSH2f9QUHkC8>405Y)8kN-1^kwHHsU_JWgKyKSKm#qwehz-wg3_7~{$yZIhr2 z-F7G-jzts{>QQ|;H-UZb3X_OVYjtxPJ}GQ_q!JEHmS8EEalzpy@}ba+!>CqT#n4rd z+95w=cqX%$MDSOMs+7<+skq!ZYuGA*J3X;6CASm}Yt5h)ye5m?XQZY9>v7ITFs#}8 zPG%81WcVz5)lC=|3o7zMSz$u|C1ZYJ*h$ITPQ4Vm_0VaN0Xyu*tV|ev1dke91+Osw zg$>9Yq$G)mEm@X*Q64A-m`z!5sxI4h-3s=OFv9UHHVqUW$x&dDDNmsdqYcG!lXPtu zjQVRsB(*lUc)W_x7jIou_)VcP!R?-wBwjsH(%|^)Iyvwt+kGp@rNVrEs2;rpNR>#T ze+xBrT}InT2*S!-+jd&kdCA$*`_y|xr51r1FGc?FXl&lGEI6w3)|_bkdsZdVl-!OO zmd2PlYv`zi-VAxZVs+A4*I_;R<(AtMTz(%Bh&^WO#!IE}L~cgthZ;x~_NudfN0lN| z7LNkcFX0Sa9ta#vT3cN;9Va-}{Eqm76V z3P>=5HiltL*50TzUxb;m=ZX^I$_~hdCBpFSZ$r9Wj1s7A!hBc^x*7-ouEs!sFJu?U ztcOYUUk#mG489a=DR_wa3x2P{nlaR3Q4x%pDsmW_`K{4y(%5NlXGV$bsv?k5+2c>L z#jEQ|{RBS(*lNE$O+Lp zq^d+E{VeU}lA%GmemTxjD2|l~<+S36#0quc8olWWzR+!&FfWpYPlX;hKCexg_s9%4 z_W&vJM`35|kbqI%<5M0NNO;da)U2rfQj^Q*HP%ZIdobGOQl!LW5i_bXmi;T>q|h** z0;D*Y$NO!JkY~kVrait@j&^{DhXm3|q{$Tv1GLp$adI0$ng=U@j1y zxViTW%D|~)`#N*Xy@62t!~VMb+#3ytNepvr^WCJ-UxdiG>loh;8D4yT1(>83Zal~+ z1)|G2iWA=DGYl6S`p&K(*81_QxSwv!W82@osLc6nq>4ia)F zmJq`-&_%ekwm*N+miZ$9xl_eV=MDO-(yY}D@BoerPoqrIru^_7BvZc|7j{wug^BGAvq z&%(>p>w`weKhkLB9WdCrf>-X3Yrpki|eZ@s;N?rgnD531QQ2L<+U|57hN`&08<{Cs?Ks{6JTN9z<5c(@t zx}DwNNqa6|3SHS;lssH=CD0PpJXRT*w$cg#UiD5Y6|k0y4h*#tg68qkwWTyGr&G$B zvjo+wRFJ4BWvp-+ZIyW*70P9O7uHfJlYNa)e8*oY33qmt1iZc%Pk*=fd|FdEmRZ+` ziEx%vG(7B6HZ>K7+*_`o-WY5iTnIYe+3C#+R<#iR!9*A&@#NkkXPL5v@q_ zL{()@*-Own11JVs(bOJC)b;o%_dY~EG}an^0*XM@7op13MU+Jt#WVK?5D6yWg~NEq zU8A<+I03rIF#OT~pfLBQ#sg>c9=VqMpo;gHZJ@0|W`pN2amMhX``0p8BPek@T%Q5e zmZ!!43(G4H8XQ2(;xF2N0X}QiZ>(EhW60hu-${{REme$)s5gx~viLw{vAKJW*URXi#n2F6u+ zlS}~*0>xS2qFO-tJ?cw^PUSf}w8#!&C_EwioCz-2;V?zOE{mIcZj8ar5Jl4xV6{Ie zO_QC;0iY#lL7|c>BZUIusWdZp)6P_Ted>{ogI)RY=3@t;JC5K52I>S<=>{ozs!j`pN`kGUZ=evE3I24~F5z?gvHIzhxAk9oPiZ9k5a@s86zOB`wB2N3Y#(Gi8O;`T)rj}Bn;vgc}L z;nZ-o%8^iFcd`I&OO9B1svR0$Qv@V1d;4yJiwZN9?^Mxtv8dE#Yehx^+>!Zuo8D(( z!hJNF^S8joWlLk_J&@0~lfvU|Ce&fcZ{#IYIcp4DacAQMAer{cz@pcHy|;iL0Hpia zouRQN1;Jd?jKmUSWDry~g3G4DFwQV;2K*F7XP_lyP;q1bQ*eP)k{e-Gu_|Fr)93*- z4Cc<2GiicBNN5_d^t<8EmBbY4`L~)dXo-AwiX0Rtwi6=hk;2AM70v^`oQVK5 z!pKu9beQ%0h?Ek@m^KsIhA`|pXWq^onZn*zRSbL{OQ@x>q&z6y8Xt5TH+s+ma*SU^ z0UZRYQ%Y1KQNkEDJ@Q!&%t`9zPKh-3O|JOntoz~BE93dMwo())Ix3jA1hza9d~Fs1 z5S0X_J_{uwpb3SRs(Zm>TLik3pesK1-4ZTkdo0kfDUGUV`c4w#M?FIXhF_yI$-KAm z$a;|bE%Yo3GiU%15>mq$W}xdj5GCDCOdv`aD!~pl#3fY-3G-R=HVEhxbyDz1aG3y5 zll;A+3#d|N%B2grN+YXqT$C|^+iDvmf*TkNNe+`xlBPwFKEtxxr9trI0a(ZaJ0tL5 z#i`ZZ;NFZEB8dFO)&?P6J*o*(ceMEe#i>MLExoB{8D$SeF93E)t>N zFoTQMCP9>#=)<`Gxl@ z+(f};?Q^|X*&F6w`AUNqqgQZ4jCE}W5ZJf)RqBUdc08^zYy$LPm0&vQxEhGo-8Ldc zWUCXoKq<;WnRH{ojc(^Of!KA$t6&y<3F$CWsBupS#dHc1!v650#F*%i*kb2dP;eJSA&g#R_)&N+GA3^-4uYybW3TXd#d7qA3Uot*zf$;^ZAav9wA{_Yq=T8AGu=dI;VZ>@x+>kUjUHdo-Gf<&jZ)Xer*Q8%8ZP4iRM)*{i zgbQ%(f9Gdq4BM`~8WAnKJ}39LUVBy1Cn65UT(u};ZRZQsGuy7c$}14Y_sBUDY2Ebj ztLg>9a7^LSngyXIzcXDX-1Vtj008G+f0Z|5c(?wAX0 z-HZ9Pv*1QvxcH@42f^aftWXve#feOTh9-|GS-Lx$WE)%4w3^Wl=iws!rJ)Bt`$Yi2 z+1FiJ6lIjKN44cv;b6cM;?N|d1l;!VTdH}z^vAF9Nw0GrV8-a^)w}8Zcu`Im--XlJ z=l}1gPx=F1y)L(Y zOz`>CAGu1BURj>s`9Hq{W?=m*(*8u>t z&wBQF!Fb9`6~xSvpVBnoJj7(vf-<|us-R79X@-vH7La+P;CV7+h>L6BajvQFezW>M zd-0_xGZMxVjIwIbBT58^d^=muV><51Vi@e9o$=OTTvfey!}C+$zg5O_;nNp+Y>YxM zu3dyj7Fkv!Z!8M8QTh1r0EJJZzss*}B4EQ+SHj{>dv6iK-*ENSrGr!iuq7e6A{N|% z#u!szR?*_F;~_ObCfG{_uNtM%9d3Jf4TCj7uruk{gAsFNX6AB_?kGwAvFG60@%C%4 zL`n%eK68sc2QW+7QxIUM-2w3YgT`I-g%)$t_+clmZ3!dV(Yh!Ctxt~zk-KKK;E~4E zZU1(`mh8(;YGGFHfAuU-&wV9|+vu(UhUMmwy4{tDs$w|Mdh%|e>osVo;5rf3|HC%y zc-w6_e%@g$yL%<<$XjbC&ZFbf8BtLH8M<{YJZ~WeN%qQaDfl{5`Zi0c(c&@8!0sFG z!TcGsIR95J#q@*AJd9yE7S1Br@JK-kU>C5?2vmXTa>j5tMANqDa@J6fWTQJ>8~s&0 zkX864ryXzFaKM&KS3(g)k`VUvAG-#L629{f|6Jgv_@TEx$MLOk-*u3YVOGhLJ$Xd{ zu71t+`W*1N_laU~?N7a==TQjn2UOJYf5U(2-Duh^xpCYyta)q0kz&drfRq@}q(Zau zfrK0;#xwCD2V|}O@Mi3J`yJ?>dK}I7mVpy69Cp5gpploPtCWy5>u5kpiyxJoq>jq& zA1JgVNBl-~g|%E~zB8u2{jUIk*=JpjmKsSg4BM)0UD&w}=9MM$no-%F$joEvq7Z6i z_JNaY_UR)0r*8db|0j7jg~523pf^4!jm0hk?=K+O_!rR%`?!4^g=Xpw5%_Z#U2@9j z;>Dvt_5leWdviNh(IZqL0i{{)zhg2(=fw&Oxrd+nuUrLScXw1@?jMvB0f z2CCu|N^Ci2pVtV0Sx_bfN-Q2l!3c^#^*6$39MY}t(vxYoMJciO?H{R-)A1$pMd3op z1RZ2iB!ZWEwW~=9ZIXTT4Ouq2;HNQbSK&z(!-uqOUJvtp&d zSZK-?jxkmFBkudmVv$K~S(jrY###{w za#H6i{PiwuZBRX46549p7EPPb#DXvTLz4ACxeDE%LKy7 z7w^YouiA;>x;eB5CUM%$8?pTFw@7@{6SxEOu_3u7W5TV*mmd_^~6<&!}}vn+(b?)ap57%q6pH8QU;!~(ddAWVp#kY;1{ zxk+E5aK;=s zF)semYnA>IQp!b9^9*}NqNWH;kxUhi$Vv*U*Ju4dZO4N@dne{Loy7FMB|-VA8T$P{ zb0-cydq29V4omi&hI8L_K2F=Qq7Gk-StouNQ1NR6q2(xi|MerEMZCWG_n-66&wAN4 znrD&l@HKm}|AzZ9zjh822Pd)dBWGjP=Qqf4yDYdiSMutcH{sYbA8{O>d;JwYH+_~t zKo#Dx>)~Iz7sszSggiaOvFK`KHd zUbcS1Z(sk2jCJG3x8mXF?MJs{h_zqcfV2Pi`Dliz#_c$P6dUjT)MweF%yMMW;v4Vy z8jfu}iYLA2e4P2&tvGo3KHUB*w_*Cg5?ub~=Ys)!@oyz0bmk|v;ox)jIn3MNbslJF zEfMx#xfgqW?0(FhF^9>AC$avPP1yK}t)N_#K=bl20NXWDwpPlOK(GT@0eB9Ff9HfX z|F{Kvf8ieRws|zWr;u5<7p8|0wmh@bJFwH{%0J9feQYi+5-`In6{bA73 zjC|iThQG53`Fl%!fX$B|MtkFa(8dMu-T}Igtj6#?Yk>}9FWPfV}un%;} z3BmI{)9C(sExLbR2{15q=XV9Z^Dp-IrtZ8=?>$YMVZYaXa5d8NkAc=Je$KxbfNbTK zZC=d2=M>QR0oShBB{y#X0L)!^001!Deq1{K*6NW3KU_114L^S=roXWU$6vA+GcSEe zpCO#Q>=8WjmhWTwJFBqymCwi0FRsVoH{OS1FMlu`u2UAQTi2>(o0T6ETF!pa)j0b_ zR~Jp6sM54CB%JwEmt)PJJ{fc8K88cTey3aTGnYM#gKz#mmV9Rw&iTm~VELEU1fWd7z zXD}{!$u&6dC0G0N?kG~lp!SN0rEBegg^{={F=Oo) zHlR7y;=qsYat{pnQH|xjV*s4xaxL*W-DwdXctKEUJEh(<(s&MRMp=e+Vo-qy2UaUCwZ;aXgJ!?j+U;OH|CVb`zRfhG5@z*B$b`B<`J z1s?d-+j02fgXlCiJM0QBPi{Ve&Hv@;IOpZh$LjZQtNJs4KbLi0&8vT2AZ&i^Wmxkk zPr~fEk74hd?h+bH!0}5T!QMCBiPLUfh4cQ?^RV(u>#+azJMi$2J?MSK-4HOGn8MXV z;@latxa2=S2dn;VE%sf#2m7zvUHxurwz@~9dCx&0RJg8{uW`mzu#y05{Ng46z=3D) z1DJ9AOyMo7Z#!eerkPtki)X#qzi>NN-nJUgy72{A^Di6l zz-#Ws-XDIj^gPBYvyelf6$a@^hnK(n8eI0{*Pt^Kx$dB&^F^iS2 z;lU;)44--wNB-okF2};9&lVvMfS-35{G0cIzJD5; zmplWw>onxI-v_?@h|*5L5dn5`1w%p_Oi6YtJ?$7K-hDghtXVAl`gxdr!85V&+uPCn z@F5iUZ6C=!LIIGTe*}Y@?nnOG3d~+{F}hE!Li_8x(Y|(n)kM1b2(9gNb1%m5FE@L=lA9KZ)PdQ8IiAy zIw|)e082l=9yHfr{=%c+wX+y*KLG%k_~t4<>)WmsAJ~d?q{Z?NZUq1wyKbLY(F8p9 zs+|CU(?75s%}j$8|FA`#dGTJD8B=9yCv({wCk@m5=PxCVxtS|BXanm$vK{SX1FZe% zHUPk*SMO5+T8>fmi6MCWSMV-ljr9|ljlt`jB!Y!98WKfLj_8G#Od$YA6wfO^v<-Z? z!SWBvxE_7QPDL$M_*?hqPsZTD6w=8S8$NK3^k0IkWg(g6pmSan5=#aw0?@Z+Y8z>R zu;DXXaPS3tkyk8ul4XBwZ2#EV7|b?U_qFu^fSEIopTfTvceT`B082Im%Ih&a(I+2D zMJXX7?7u;9wf>{q&>ow>y1y5C-habRWY%MfLn|Bp{5%ZyPlIL>R=sbV#Gor^3>KkL zQ+Ok-p8mJnKr;=NetsZ8EMa9&)5uC_IGr&cfjM09!sL3hRLv?$voCJoM5BWL$s09qmku4WAU6-+%R< z5eN!xln|!z=@QZmN~ZFFCW#@Ch%nK$Sab84ICAxV(8?iFBDASd&lKbM8+L-*jOBlF zHl}W0j%Ge#V#gA!{BIXw$)0ltrlgspuQwn;_ul<>Q0D$4&Yygfo7`{*Vb92MP)oTlHJsW)Y z5@5bT_er6NblI`7n%%-Xwt)9e05c7Sf3~qV=jK=*%S^`OagpEhUu^)*H0W+#DL%X;c*e~Pyt976g3B&iwT5ewcNReTuULXJn?XT?=NK-sZLnJomis%N0EH>rbL>1(A&<0@-D5eInTLwQ=kq z#?(X80D!r5Gvako?Yzs3i+}7obY166Q{0t+F>BH;e1EWXD$lXamHuXDt*blOb|uVj zQ)TU;X(_R~XNkb09-Y1}HMwVrGsLVhMlbVgP*8E_6QD(WvU)z)J#UWs1SyU~CDyp{ zGn?_ykM6|2>mS6nkDTMN_$a_8PE3Fk(5Op|6MGH$?BciVrLPi+f?gV74R$KVFC0Oj zCFEshoZNie=aj*i+$%Vo-FBi_`2p_1o@tp=b*Ta<+5XmbjnPql`IsEHOAE=zZV|kb zTLhjv-czrgxpgOf{f@|M_mIf^#V4ls$+(PGXV=W=JLB5v-{?IPzx2?1D*g&E1~V<9m^V%659pi+~*SFqTujSdbCo%4F zQemU(LL;6)t&`N)`Xf<|O%SiU`Ai&q*@HOp(uZ*Rd$+3BPFh$vU+L%e<)Xy@Q8B;D;lgckb=_{z)}q*8ap@=?055;R7KQDPD}Iy-mc?2|Ie-P6L49-Ndu&YlU_ zV6AVV1+yTV`HUxk2E%~-(qev~}-4p%>BEc9Ioh|e>dCPZeus6+>HN0sa?VENZ zU2+VxYAAaq0niGI4b@}jUDNuZ7&0T*ID$N7Zh+u6zLk$?IBi}RUQ^zub3`$i{L<}p zw`b1x;1~y9=_Nfy=r-TF6!7)?c-N`54Bk08<_(gfLza0M@zbPoPIfbBv9PcJfNhWRuN%%p)C(jmam&`mQ*_mHI1AIQ)Ix`75d z2{Z|bo!zlx$FZHnj%~%37fH4xOO|X|`~IZ&?ydQwmQ&~4`+HL8o5=6?yT7y4sj5>| zr%s(Z)tQvnI~6mgPOGR&uZB&~i?6_$s;Zor=6;SbsOIXAXtK1SP+#my04sAz)SA!2m3N=4 zhz7MQ`J@;-c{nKi?a@J5(V?Ac>q@$ncdx<=uil4!uXzqK=fAiGl?k| z$}=DkCRU17H{-x856Uq^<&iIb6FGOn?Mvw}jD=dRCu1K;}e*He(I(PkL#luzVerT?a}7W5f^Y9VIr zpM_JaPJ)TC_)(E91Z4LYoLO-?`#W}UChUZh(d*2*lbx|r`OjF~U^NBhJe$WVMXSf& z5o8;2`K{~F%$vlCoAQk(1cLnYY`N9<^A+hCN$=&);w z2P7)G4ttl09;{iYU~8B}%c=sNkyUfE=B!+Iy;@eP^vrCTvpP)aN0Nhi4j2Y1mcDt5 z@L_$;38!-}vO!77kEQqnE89LT@Kl>79Olf_k}LF>+9+J{4B`^WKn zD#m4pMxZtf#;0e_!|7OW_i4A=xXy%XF1$Kz8Lr4+)kSXmn6`86$-?jm%bP|iKdQ^< z`Ayz#DM*V)vrnL^EKm@+Q9zY2c}?cPvN!_5yl<@Za$^rJ^!Ks5Bk$b_ESSU*-M60i z&E>GmUKak3bpU`vzq}32$_enC1{2pD!Sny_5$z{U#B@Z@j_FB|Ts^2&`K1YD$IZz0 z_%mE{FcRdk0KDa&7kKvli*1-(IRVURar){b*!6EV!vw7z#TnZ%4*+odHT#oyptvvl zg`eDsX8t+s|B0OdfW>#&zKjkgxOxV4B|(T5m_z_zNA%bgp!{CB&~l|5^|mpYem6WH zeb2Mt`BOOd-e&;-rJq~tycu~ailKnmFpe~z!0f`dSFv{F5n<8a%O3dizqlQzm!878nGH@{ zbqw47??=>qod!K?r|{~bSHB=ZUmZ0MJon?f(9D~{bMM*(09f|ze2+DUCn=e1kdE)j zjAr}_aTtAGsqjq!U-|9T{%+x;OM0!2XWzX8Q}ZUV`xcpB%kQ~JWhr5e#y;%$xviL3 zeg;#s8yvs#2%h+@hckw-W{V|5Hdfod@?cb-p8+2_&avlbV&3-`|@HeXhAKM% zPD-D|C@>{%@cDUuZhWO#X>eWzMqRXt+eiP*?ZpM+Bc>I(1Q5~1be27{U)`e-gezoh>%O)D zr+fLiPd|etx388{oq?X~|Kc*t**+gTe(5RP|M$1!zW;H%pA)xd#*r~R^ojd$ z?cmuS^9=F+8G%LS?X46(;}Vdho8982SI6#NdJZG4jB7 zr4A9Qd&hwfZv?JB0etNt;PR8G|6n8P?~Xfx(d5V zJ&Cb<9>mDMe;Vy~7UU~f0wzDY4(*mX82O!D7<>4El!Sc2ob6QOPoAqcPn1_)+*oo24Z2|8d%P2I|qU(Di!uti5^!fj;1@9Qc=zrOc zu`Lf{Y|FzJ*nvFFH|JyW*VoIqzW5ZzzP$y5UwIx=|FGl&V1zSe`|uo``)8ZLyJleI z&vsz!2ajRoppwyliXGqmf^`ovRzS{jVs{3st~giTDsco7CCn-*{atP zriyj=&==&~`i(z+b6VL}wilzFG2^+P+=1ub`!rU5egjs1b|YMwDpO9ia{j+%mf$nj z3+4@w{dtS6Xg#9X;tc}5-TM{Bg>($iinTf^42K?!W_b6gfAV+UCQ^bPQ+TyUt}7lC zCO=}SvILV55f}b`f+lWSA*`Al^^_(#z?}o)~SgS3w z=7`YG<_!Tk3~j6XsUa@F@ao$boZe;dWWYp20?s?6^s@|i;07auT2BIz8||?@qY$}5 z6Q23b-^rQ%*ZoX7mTBytj1xklp|+a^8Am1~mn(&N<>T=crn@il@dAWBZ`p;d?|Txf z?plq@{_;xsRdIUfrv>IWyzkA(o`6p06?>QKCBzl9|6Igzke4UdHL$rD>KR|Pnq6|L zVQl?FNm0D^UtOoLNZg1dVzc09yKyu1W>;a`XDi1@ z9JERuiE&7V0r`d9Hq>Bc6oe-t9DcPNJ6U+&iquZK5 zN=BC9$+CYXTS%0t$Fk_y?V=^C<3iQ0r7jF1)2|sXIH;@|k9+1{!ZE=DxRlRzn52T7 zC{N97^s!)FP~smE+F{lP;bL`tZmWS|-h-xTKrjQryf&<{DB4>g1WP%jTm)2H{2pKk z0t$%o(r`kK$JmR2W3nI_1zm|qXhx^--0LOJ!O{no7eL0AjT#0_G-l-2Cg3d!KPvc< zvi}yC3Da1Y<37)m4p0x7^3JB;x&dulp{ZJ&J2#oK5EAKar9!{tX|M%{JdG_{T7W9K zL2+z!6lc#(%FT%k4MHYNu^1r(P0QGTFx561HzGoyg|t&4zx~qWY2&G}$?qZHmVGf` zTNm*9fgXBQGbo+r$u1x&m7$ZI(CaFqL_bbeShrlkH+h*M%CR&AiegE|6vAqnhX6@J zHALx`awqS*YY~V%O8hl_&%My3&)NJes&M!aj;#z-ssS3fW_!Yfcy_*pU77pDKi-9E zvc{q>uf~EcOVH{OH(4>o{r~QHnD#n3LCm zaqS0REp7PflHC&`HVOH4w4S41dCpd>6~V9WHTb1XIF4QEL5v+gLm&CjJObe4J}wx? zvXE6&`R#{hppZ@aV9+6Sk^fCX+_nr-NT1=mJ88{B6jy4ZY+H{JX*n1vR+aLh7>%KV zGJ2k}xyP(W!*ZUM$?+l6p66rnI=1DsA~aK?Lv?_^Aug9CC!6>Ao}?Q>1kZdF&{ zsTNhmXqy(JBO~q&pqjx`jTorGBWIa8D+Zb-q(LWH#E5)sFg9ZZQ%x)R1!|?Qj&7u` zfEK7(whrtta-(uZZb@Z-$6(YDIcF(}r?^37Mw^{HAn{C0wXE9{vgm1*pNw5<^&&Jj zH>{mtY-ciuQW^ij5XzBrq9UVymU1%nDM)+I-MSoqPh67MMSAD+$YwFS$I1+F;RorD z!}}bZB&SR7fyLE0Uw3Srf?w@-=KOtUka4_WteN3MptrpHpEIC)LfpENj>0)!9t4Qc z1E5T;$4y#O#srWk;)sAkw!z%7Hq%q|xxNQ{zeF>#qoM!_OaSub9o2JfVi@bZDzqoX8oEH4eoC!Lp5p`m~kfag#6m*7M!lZ zZPRg|q&OqJ4da0^!q}s#4v^>=Y_-jD<+9NeNjZ7m{7P_RMim8q^T=*WaS^863EiV~ z4r*A5Meqexts6+K{*7+ET*3Q*(m1*JA?r8cqV+y3mO{$3E!0CL+H|UEl&^*Vn1WzX zVhFsg<27jFV2CE1^H1{jYbAc#$n?@U$f>(UDV87wej%B)W*pc~tR!_h~=(g2< zWNx-9>vTDyaUE?V<7+rw@YS}e$Zf6?d75r0K8$B%(ak!JG^a&AC)YePFx6^iK!(8L zN=gFaNm1HD%GFfitN<^`jC5R*=`hJ+%WuL+-qFTzNrE$zjmFngZIe%_j6OXtd-N|j zl_H|!dqJzGwFm2ZAJw`@LQiiDL9PS1Vj1P5+WHN zMnw0}E=U(smaMxKCTJWlwYUjMFKaLy%1$KYK6P!V*57?Avco{hkRi`gV9MLve4SIY z;T@?>RW=+9$Bs%VOU8G}m@{Ew-VqrR`Cr>|DCb?ebunEX9JBpp9S?bu4QCdTHE#x3 z>{6&>#$l!Nplw-K;^IAPIL0reZMJxk6IBFmS|2m1VvrJ*cyW&9ZZOp09#Aw>;0MP~%jOOcP1t1G90*%0=0ZQZ3#FL1ePGgfWw0Jj5s% zW^&>U*5s4Y zN2`L=qCgmg{NfpHJLr6-L>uuIMJIrZrt9RoXzoPuzIW31l?m-=cE2yk*uIW z@XV=IEh}yJGFE!2SVf7KNI1DAS&6$53`)i)5vsaMTVe(kiGkm=BFEcAJ{hl0$^i(I zU{tyw%6VAjLz^20G7oY;l1yFl?Sd)wA|!=hpvzaEK``3_#O7Giw*K8+@jVLH2cIc4 zDqa?J%M5||M1cGH;iUMB_nG_CyEYldT|8L5V(wVAYyoa)E5YVY&GSDQO?t)wU{Ked zWYeRZ+ZYt+iZbIcADrbom#+k(8cow;#^?wpr>5L9VERIC0<+6LOfYEb%erIpLCT+1NDj|4elrb!2vK{Lo0&0>7WlI&D-8M;Z_{^yCb!2>rq@+^8oJlg4H6cnV z!afCjniwYXxbl~l4C%YdpvrL?Omap5yFMg{|+x#o_r)&9VeO{F2|{7IfFHpw20VW*F- zFq^gkNMLFjmYA8g^-~DBD9XQ0X9z^<_QeI{va*YHTQIoDrbPFw9P(|7G_|RGp7YGRjg%)u7j~IZkZ8bmg20XW z5F5~;QI4++kvT&}%PY}wr~)tA>U2`PG9qP-4=LzlD|o!*)jrsgy6M)R=HasaVZ-h- z1WLU6%W3+~=C#moK%$9ZmKZ2y`$~$1Lw^M#b>E+?J|uvzZCecL+KmC$Nk}?qf&>6o zo&zx#3}lnjXc9VgCE~Bl*dXUA)V_-#G*6|0@jq+ zNXNP)OQabF>2FJN-drHptqTByK@Ij;AZeq{_%IouKG%oH5S=mMza?Gb+fw3-qKPu! zjG#aK%6)9)Y?N z8PT$c+qP*n6|s0cr<$~F1n8+BmY`Iss)!PwW3AH1yt9^uU5-~XM(YZbtt2C|9m86c zJS&e^tl`!Kxhnw`8YJ&S4KvgP2No;Cr0JKb!erZMplt3Ha0A39FB{#}knLOH1H<3P z-+Gl^@y?lmon|8RIK3+$hgGYWilbNQ_W&^rK37UThJ_k*9ka^?Xyo5+msz*j1c-fU zp>h~uK7b^7A5iQ5Bx``0_Ka$+MY-kv@P!tBfd)LI78o;8?Np|ImBc92|^X>^ro z<1j|KPS^baY2`)^4vv%?vb{RuBa zRB9MGDI6w(IaIOL0JB`$WJ#9HxRJBXoK`KYLN*vf=GhUUCNNt-RO*U4npp%Y`zv2~ zneOkKbg?#PqcL=+w$aa9(?7c1LF6$6%n5H<>`L^)7*w3%BWwX~Mrz_jIVHkXs#mEo z*0!uGe>wWf4A4OKcI|kX1;3Kgr?sP!W)PSXV5qSv>3rL^mHk<&F=Yk;vgm=rxJh{t zm{L%qOrx~rmnlM{XP@BEvG+^j_+(~6QCEKNk^(KE{0r9 zPCt}hVAT7l@_~@Y;6xWcEA8zxDpeH*&=?es`rTk zQsF=E!+jr>_&px5K9CB5nJhSeM|sg{j2{;Vy;|ZtPc}i$gYyD6191`QF*ud^cC^ks z1yawHt5sDdELUscQ_GDgAB}EH>>dPQVPsfe?kcpzK9md+FRW3qX1MszSz}1q_7D`C zPgvV~HpJzU(8{~(UExly$(%^mclHhjV-PwNd&vb<(hY_jN=GwQNlUTZBd06y&1^`o;($qez#?E&pe}mli^PsIV0Qa>r8aY`vy8nJOd4BJ`k5b zlJz)rk}yNJa!g4juMkua8a^|4^hlot6xxw6Lb`LJt~6JMwO#3|-3?4j21U-#i7vJ; z3{;hb`b(Qc4SMqXM-UsBy zVHUd(L2|Ye0&~6`ics|rDFqLpyz#WRg+ksHpkxafR$1dmv~>>2R)B2zp%od>SfVr} zJXAz_Bvmhp(*=ik1fU)Pp=-;Mju=&?^P2QXpxkiS_~k^5wr%vtA!Diy{G`VoTa~Z1 zDnCYwW$>*~PToIe#y|~^)(s##4S}f5hS0{!Orxo~LN&eSzzCft0`Cp|yYO5v6>B)Ym9@9WhR ziq9>XY*f|ol{BG4d~eEW7hjm5NPkTrM-4@>9;LLL0zq2ol_(-uppE41wj(`eH>5GM zE5>(y7@i6=6!Z9>^7I%2{#rZWz_%`IE=2Ga zfJOtNuSowd-DWPNJ9|R;cw)+n+O{jfSMs*yMoRAr>`Qpd(*T{LlH9D#Y!~)pLge$r z@#Pnq$yQU#ocN7otH>63Od4bwWN6eEZ5W4>Bg{dQ5hI!r(H4;$@iHCWFOz&nw9zZ5iEfqXxI!66*8t!RC!3C zBvf&yK21T|IE0>dJd)t?0cLc7JZj(YmW|hxH#l=omPSPRL{aXxKr*czZ_Z~*t3LOB z!d6!fxj}@8*OXK$U)2VqEhj`$q9wDr6qQ`HgIe79RYiU*kjRevrJFXz#T@oqp|oH# zV2oN=3sEu&uI)uiAu4_m-d_iXhv z8Z`zWWW?z!U$$Fl7cT3C$=u-wVPH08ObOB`VktB;tx-@8Gp-!MSI4Jb^&JB;9b6b5 z0lVaVp!@HYuGqP;c`bAw)Z*c5d}VJUl--SQR}@!O1#TJ)s#?=zw<-SwM4VWlE2u(c z$%IILtJpZu_(x!=^fIvq5EW~7Spd`<}gqmQpu=k@(`UVx|ndBDt`hSC&!x*9j|zu{dK zLrOcT{R9^{nQ&otJ(dd`RY`Gz1O;!ax1>aKVHJ7}b5mEkR!7G|kzvAQ_Fy%$cmcQY zItXL{!9Yr5Rv0KKehjfXlbPN7Tk?DapAC0ALj<*$O(js!SQh^RK$jbYml( z_%NeD1%PEh@D(dQ<}^jTvH$r{}}OZfR~8lRj@F$6=H^CXAI3LBRrjP`D6} zx~D6@K}bfebV_a%6G88z7o$i5XpO(*q`2VL_JTzTq(Dr#Ay$51R${8GN?yL#T0@kXu|RB(v$je| zqLTGmVhebXpx{hOT$rfu?E&7+{2TUg@_DGFr`}xO$(|d4Y|$BMzff< zqP3lGY~EY&XadUkhxDwYWauQ4{ry(+6L6&$ED(dKlDh{iz%)a98kZ+kWcQ zqwskM{8ZASr&wXYq#>GY*817Frqe;dpm#h$IA?+)j3e$l3S%Uz2L=7@g$0_pf-l;X zzbPAG23MSa#a|n{|HqYc8Z;yB{pOw8BHE7jMBWi)8Z6R)Tgk5wO_K;z_wkjM>r%?d zLq<#oFW=_i>=OXJ!9cQ(vCb70B6@nDuH-DcwM#`CF&RucS1JW_r3-wJ21UBE?#Qwb!=Qn95)`Hx zJljA^up7y;RUnP{JTX|9H8%h zrT2B1jFsVXNA|_<9411dObO__i`YKnm*~cQl zmC{_0Y06G7);VEEe61-v4h%pOo~28O2ogimG6QvtInm(PRz_7-$!M@V1(x=gbu|yt zEjrCX0EXT>(6}-;jCiaOrMcfYzopy(%(9JI6Fg&U5>^bb1QxcWauc?oi7`1Q%XA)< zlX94>?A5X^fI{0kkp4=cx=pG+$q>r~xQqX0O4a6UA&WfjrNiU-SBh=)4b}SVA58DZ z>}Ah%nocj-GhiSDr*T4dreJjnC@!Ulxyq4N#uUmK@-@=l_BPEG9B?k}JFrw3X`xVH zAlLPw93ffOVHvB?tI&uta8yRE{? zv8hmYqcJj5hJpSk@u>}yQh)I&=X=6zX3zn}d<+ICA>r6~-C>CEKm@88gmooJV|-Pp z__Hx*tLb9snVzyQE_7hFN070Jpae)3%T^QIK!v%k4BeYVnz)NPNK#w|*Zzut0arj}XZ?k-B)vD0Z@*bAkpwB$*%jk)`^NBZbF$TAfNcv@ zm7FLdW>2LpDXmGjDKv|kdJCr1qB6gd6jhTM001BWNklx0VZhVx6WfoaHjS(Tp9RB{i-i@AiIBnm>ElmGV zc2^p#L%Q^1!8(Cs&WH``( z5#{J_SGKNttPoBUgnXQV$8D>4CE5ltZ3q~>9$3OK4jYjoTB10;ECMLpA;N* z46s-QK)Bs69;HjdHaiAs$g%IC)l6k(%9s2dIwh0P%U1)DgVdqpnl35`4^?x9PRU)Q zZ0F3Z!sbF(xv(%-P@p2}o8rmG$NB3ZNu;lIi4%Y-tt1TA%3z8HN!FfxNz5FXFu7n& zM_RHX!*SZ~Ag68bv|!GI5esH5rb1x|B)4>Q`CB;-NMfXw7nQ;z(mW{f3@_R|QRl5R z6=VPbo-&ZN_o^b#Paj)Ixid^?+wbOH49bzxmOvD6Vc{r!nV=%uSEj@s+&V8B24(K1 zF)vQlpZLt|k8fF)i)G9K#XSMD*8 z{w)WA;UIb9epKz>(JuM-j`HTbOwfhQ=wXf?PNBZ{(tgGnnRlwM|HM0K%fRGwF8H%r zL|xvcJIV+F+{`<-32kb$4m zx35_C#RI5y$xSB7HH0J z!(I~77PXubleA&$rV8ifEtn3734fA+jlpFhC2G=`IyO5wK;B0hK*C{CAT}X}Ozfb7 zI#ZNvq={~+?s=4lm5Rzr>CZMX1Ny}U8$Ce%eRK=~r4IpaT&CCy12>pr6dDSJjE4YG z>~5e0q;%v&;7bFUEJZa-Jc-v;3n3XZ5`CJTkg#zW-(}b=KLwyNx^!Ni|LG%s)<#z# zc1|@IVVpLkL6&L)WO9&m{9mBFrSM<-n61JTdBJRjMf;2PpRf^zH9AOo(}a5(wkvlpUnp9e&!tq!CakDsMgXM6TILGJbhvNrgzq^FQ z%?U`@wp7BK6pCh19FFatB`+EBl7%3M#k7#0W9BMn}FER*g*w^IX{bgmlFo84u)>C3*@ z49d3<`YDp1bnY?`c#~8fMBgCmHYpK-o7T&A`nOfR8id4}ph)G97!xh*8W%ZoXcIce zQ>{h=m{Hf3UDgbNV6e27qAF!f1VqjZ!re6k1RNvCC72gLO4jPlm~>p{a@}drtJER` zhPin@gTSf;LGLVtP_ENVuoAN=8FT{$zA4>PSxeJs=-zpPe5~cld^)c{Z+qPNp}&O^ zaq@ZKw*nHA|vD?FSs;gdB9eK zF{zA<$Y73p#sR*emSH%JkiCbGFN#yEVUsKuvR!WXH!4`{+;Cne$4??xF(XV+>KD7u zL9QzmeDs~i_ZlwD%JB`E7N!JUK@OpHR{lqOI=V*xlP%y(ShMkN_bK@$wrh&D8z`58 z38j$^!)kr&!#tE2MqM8ZML={ zTfPl*5m#mgi}8>d21)x?6`^kB3TF(XQ-@Z4Pu^~PJ$%ZT%qkTg_4G&K_X})Z8ZWw> zW{}hU)`25^>(4V#HXX+r8Me3C;zuo@Wd^qA<@zMZudb-(Za-F@i%tqb$nifxd30e- z#su}%K|nx9luJ3v+UO^#@t3bEs5}7x^sfjMl(w(kBtW|z>dzjOnTs9}qoZ4fSi_E& zK0fZ+0zClPiT9wk4H@7Je~x8Wo>Jac7qwo`8Wp5-iMN?Qf`)!YS(NI0j=2*0pETRU z#*GUsTfrn9aNcR3T2_YdCgia`V^q1kE~iBV+vnPl?&BDJBw?Z^p)UW)riu?MY_lMl z$ZczPS%f~qc82RG&S6XnUa&eW$kVQFPE$9>bDVoVUZb%k8gpnwpgN1(e3$kvo~ANJt+(=#NFRY_=f$~*I|HD z=3$?Z4^<2nZQo1zr0r7Poc$Pu zb`-!#VcB03z^SGSb4aE#+Y62R&%wFlrhNoiSsCW9?z$Bu+@BW`>NEL4}ig#SbGiL_{0@(B!T3Fq^GK~@0|jUPaT zsYW-)v@AD`Z*R4213RJyu-=aV$k9RDR#WqY8Bi~S8OAjril15MpB!b4$3DY=3#67r zxxlBVPRS=R(%yNtFBqp}qG1mO51PB;a-|#!2Ycmw20>vU1=zBqnbvI_u=Y*h&_%BF zt!UO`=yD+aD)Z?8vlU4X?76%y6n5V{<{%z}Wz}a^nDEG5&!wT03-VaE&k!g<^0}-4 zyK;0`1L(|w#sNl$D+DspFfo>fnNZuOjD|YcyF3!)F~{E{?SgBMDBV5acAL!!ov;?! zK#oHW$l@R%6DL}G$xA~C4)>%4tn_$W$Zn8yyaXB)MnhhAn6M6984zW03h5|VpCZY} zk(cZpLN*pC4nw5k^iL*}rr9ni=$(X7U|350=#Yeo!<=rf1Z3~JAwpe2ju$En-AT+@ z-`Q)G0Ug6vUndWP83M()e*`7a@g(R(ak5}qWi`v()j@p_S& zn82iwc-p6}*ln&+IK6|)A`t}sx~hUQXT26VAwyjGt#88)^tM3>7?e`ArY&aDIc|ZC z1aK2h4ME>IArs6t%7I>zWLGPjr@@6sL|Cb`td9(V{}UEMoUoaTYgn6ozm@Nta5;R_ ztR9B<7UX>rv0{q#Eb7kxa3&Lb*?XGd4=A{Of;P=+MOSj!XzVyHGDHw?XF?{SP)c|e zP%v<;PvJy130`VLH4dUOH^5A|rwK_3R_Ok&3#&9PcX?5H0w5jR^4I05fZ;rmf!*~! zr8WddX?!Jo-dyT9M4tgWJe0P zAsrL>paVdGdB}M$1!-nRQ(<%%g53xS#z_)QLAaRL$4*eFf?^JB_0S_exyK^R*sPGY z$GPIbHB!*g5RcM+P1I<)u@|B$*intN5mQ`$5Ha6jb zrWGaKOg5+pIM+0uwNR3b5tu45PQc-2RCsO^*fs>xg-Uk3v9Z$(4w9TyuuGC;3{_@q zfRnc|k~)oZ8ts+qOSt~%lq=;|UMJlOa4&D9I>r<#=ql1Qrv<*fgJhj#lW7Qk zoNt^_V%TGHPi8PgMXp)J>;wcAlPjJ4h`8*A>BVw!Rb|YXwr+;ws_%&|T!A4f*MKh_ zA;QPRFGZ(6A`Ce^!XsrOkm(|ieTyx77i*XCElCCSx=5#aWaVc3CBmC33vEk#_Y`po zxD6a>9mkvv&-tzB+-Y*2C$lt$mv;lqj8X_av!KWhLj@jl)}SAW?^4-RDT&J%RGKCq z>DA(fxXO(Z@}y8{43O8f3R? z)QeyNhz4t`#!^+mL(Li|{!`!CRJOdNScYgdf%zJhm zFa6|ey^#lh?H(Loa|Abi=$5o9h*pUU0~;zAQ0EG)^DuDd$G?P|e&d}(2kQi;Of>;u z-0`v7008y50cIYag{6$fPJld{c~g|tO5 zgEv?Jl=`vKPyFilvEYftSboR)(4ILX<+=Zlzv3;w;#c1$zgD?YNUQuf-eHq1FBhh1V|@E!5Harf*q89e58aZQ(pAOnAH5AX|K=@jdK|p! zd2D~{Q#iBe6lNZpjf=l>85TXZ3>5+Qe&lw%^gp~FBPT{PVF(Z==bgp(KXeyf`)}Uj zfKE50J3sy<0Lq7lW?}K8%dz^d4XDozN)sM0-nbV}zV8uS{^{$m><24@@dn)ei7)r# z3c!zj;2i-`j2Ca%hbP|mFs}IY^;q`M%78`2J^v}SQ%%*Fabyfj9=r$_ee+__q!|vv zM~7ejJa+xUquB7@uEmlER)DBQ#pyWd{+B+7eXrexGfPeZ02b_6h*kHj$N2U|AST>7 z4a_%v=p8Wc!t>Yf!R}Y@#OcM-&cdCGu=c(USoHMbOlXxZ&WgO8700)W0;!!+XqS!kE)1rB%I#NpU*|CE0%a_4i^d01I8WUxs3_q9>r%*4nK>ue}`%;Jcsvii1N)t11eKayWNK== zEVJWHTXE>p7jfAaufpu-=i%&vGuZjYZFu;9|1RG6p?3~#v26e3s-t-FU60|KPrnp% z_sqkw)km@AeGlQ9!!t2w?>x-jKNk~APGR)qjIaU`K0dwZ6lU+Ai<}lE$_+RnjX3?%x#_SfGIFwj&j&MrKIXWzCByWjN`)_(4a05##nrH3%~{2UzL zbO?*Sf058%>AL5w+i~>rgV^+sS7G+^b8&8b0=wR{9h=|(J^U{pc)R!Yh7Z02$XYdI z%J&^_+KR)M9>5h}yc%=%&%?xmGuZKlZFumP?#EkxD;ae|J+5y4my3&B(Yrwo+X~~X z?r<+*cOEA>6@@u>U`fVGG-q@3+yiPmaWt$ipD9vuZ(pPpiD*V+GXkuz8Dev6UhlVqoYnyJD!l(WlJAirzUq zvkmeXwF_!D?_?-MS=Q?%kFLP}Yo7y%u>ZP!Sn}A4qLFNlYsVc(F4)>)05|={JH5^L z&n?AJ)|)K`Tb-*h_xbs_?6zw#f6sh8_v)R!{Z(y+SqEq1iZ5P`eb?;mEo0|rtBOEW z`JLnx25w3t#uP-n9KQ4*W*nJ?`FqEuJx~~%9luEyUXGDq{e_0J&-Tw?tEfYm%bgb`Pu8R@vE10V4LpQ{i>bVaOb6%ziS*cRbj!7g;;mzCD{9#oge~c@1Kn` zOHZMTI>zaxCo%iQIT^hj7oGj(^wg6z<~~0U8^3TR=Ixn}eXrT&O37T;M>ihAn%g(x z=*5RJd;vY%M@A=xw_$J`x%d#)-o6n>HXgDDGRvP?kM}i%u>-Sl@jqON1K01%u+3nc z+;kYrzq$b@E;$S!-Kxg`_Pur&F8k~2Fn9L?rNwMq@tK!k!&ffNk=B9R84L`@o>%V_ zn(h&r&OR^)SO5L>*!1@^7tCTA>7G4yi{^2?7}vN#l}%mfcs%;bDK9Zhq5q6f!4PK7Sb zea`jGV(R&vm*bvyy^jlN%KPdl(AYR<#V+U>5|5BRDm8n@o4?CE1IsqA#P(aBz}jzL zf)}pci%nm?5_@0qtXCug4qUMx&%R+hPOLtLdZNbSCzfO5tyf}jX2gdu~{T1;lPzIV8x>s zd0V19WnzBg4{ycGKJ^-GfAbSKzVbM#Ny4IMmg4eTug2)fQOCjV*FJ-1U$qlw7ffKr z(J`#KcLP={?f~G9k9`R@{OPOl%$uLYiB;0h_|r>p=@+iT$cY)SsPF?|>VaBm_N3i}|mmo6y_|uEA=e0Wl z5N5wP7iX571^_(&^4-|_-bZoyXJ3L9KUj@3OHN_di*x$h4qHk^rx|d|A6Sj;?|vMs z?%LqxGKsM$%&DD6F2c5-*n)}ivlu-* zLjnX%psLWbRckZSf@idev@K(D;RKqQ4Hi7O9D9EHNt_)&gR!GCeJ`79fZBB0#%9La zJ2z&ykse~~2?7r>xRQ1vegMY$yDxFp(4jdV(s*O7sDSeoA#<*T3CKNiWjoH2oV~YX zR0#E_^;m>wz(7e| z+DiSs*k z!b(2rk5smArJo%Y?C-t*y^hm=k8MYITuyOMW5vW!Ig=R!3wAET*|}$M@QVF7H}4F_ zcPvVk)orrpbvv-(8<%1Ju5mOYEq1+W8@9gZQC#^qH*^4h>Zdki*&{1)>F2LTQ@42b z=4}q^P3rQ!^J8D?)HCQ~U+rjvop0QRr+)G=T>al~$jZ8~B4E~wb8vF$sjM|uYl9Z2 z7M{ZPw>^O+Pc17feRP;JK{DhqnNk!ww(1yGJ+Kyea9!g5C*QdRmw)*x%-u5&Q!}Tq z?QKus$y>JI+RxkopvCjo?ZcjzKZ|QVdjsY?KNlxfoWPc!ei)-CMzL)3N(XM+J0HiU zFJ0;FJpHyOu)er_|y4$Z{)Q%i!> zCCu9~jsq{-7r^DA=BWv__$>S0D!h2ZKJ0quQ&_NVF_u2K5(|I04E4FXU&&Fzu6qfI zaM2?x@xz~g5F75e6ywh!2|$c*8aIT`tscX zfD>zvU~pyx$JZXkiXW`T=_RMI;F(1Z*wDpB6eRBAlXo-s&&KIxC$oCTHXg?OXBGiW znE%XT9NBOviyJ5($1}rMoE+NW7Fh7iVjNz70Lu@r@)f<{R0LLAG0rSLj@|FtiuqfX zqHXk~01-}XI*d8n7J|6K-0h2S;*!G{dvGOGr(oF+R^strcnIshaS0afSPYu1hhjey zfCaWzJhBp-fBr#Se8(m%+_4CQ$xhtzKjA57sBU}tDlu6YLuDZ$57gA}F;~L{gMnlm z^x{GJA~(Ww`CtZ&<^LqMTL&w3^V_xngEe84Z524gDw7BRw<*xn41*dqnwDX4OKjH| z2iJa8iILuz##Y0w_9KqTAdW}U?KaOeB*uVh*^X#i*v3t;LKoGnPJjQP-L$#`T|irCT@Exf<)gektz%y*qLg>SS87Wd)W!Ec=-?fK8vj zI>9#GOw%&ge<}sv)srtG;**=ItH_01PHaaM@R`!hIjO z%Prqsui1giZ@U@`b}s|~EO>SyF1z(=JpHDvSnYV3K{ zPCRq-R-9UK0<#Xz#>(%n!K!=LBb}%QzFE*T$1|ZFX;QG9lCGYr(T+$s)2#ioF|p(n zK){K0$FTCdYjJ4P0f2xri%((p{y9>&Z{Dck;wVCwtp`&BG&82cFTl}_2QmL?rRmcP zaqN%Q-(_r@2aU9=t2#X)M$QgD0=dZvEuiK4X zZ{3C`Ry>SZ2WR7=@2|$n@2u1Fi&E~cAwh(;1-R+ftMJ^bp2gEQZ^db&=>u!9_Wt!K z=SZSq{@quSVWsCQOjD%RT9ALXFI^@UOC6ORBcJC0I*d9^QLB(kC;8MbhvT-L$Qxgj z>WKsKKDKBpfQUsd+x)SM!rb;@*QvIhXBi3Q8e{F%J#fh*O4?prwKFsmpjVV2a&4AfM~kw=IJp@|oxWQa@)kaVMLBtTHc*~FxTgI+rIH3^;T+JA&6-#SPg4BQo?&$7)cvHLYUuI%{Vy& z=VqUkl0-PY=oA(_H=d1g{_b&{UUI5vXPz4n1Yq>UD9+73r)s{F@sRw8U7j za~x0q)MHuy3}A4&MmuB5>t=>PZzd_~3RVDP2WMl|H#TC`H#XwHOZVdGpL`tqU;Z3k z`|I!MlnoxV^fbVld)H(2z3aflIJWL6w!igpoE|@o%f57#7kkrh-U7<-%E9PkRFgH@ zL5s>)p^SE`{H&ydoFZLiYUWe|>SI*b+HT93A2%-gyU z`+jVvcm={0gfIVS3Se>ip1AZd7JXwamp31a_f~o_}72n?LK}}7zo3nmayjDby$1f zI&cLXTYm)G-uyVujGxBkMG&uzJD)q@6jNrOmdm5CnOEozfiM4Fiu%-L9;w|Y-iC69 z8Q3{v3@@)R$E|ZadPn-+&gT<{Z65P5*g`JIE>?GZ!)6RXZ#S(m1ySr%O(RDbNsgDg zp+ss>I3^_z0+C(2O#rugk3q^UAVX1js^qC4&3rk496M}Huxbw}$3q&2e-A{@j^}0a zH!ud}ICuQ^t%N(TIQ*Sv-glM3G;L-T&s(S)Yoc3k5q{Qk(}|`|*SQtS<$G;w0Hkuv zjJdlO;HKZW1=*t$?}_(r#>nXrT>FU1AJm0-~6- zrs$pU`NXr>21YtDKmh8qBbXYS#K@V^h(LcTuC(m}zRXf0q}ze}0`7pCD_b9hBT8Dk zk_z|#+dDe-%r$D|D*`5GHK@)G)KE>yW`M+``EkZl6$?QpmYl+Y>-XZ|4bS83_yiXH za2b~UV08xu5%_6~2c5PA&ILOb;+p^dQhfgdcW1^xEFF2>_K(MokKx>c35*?_?cWJy}~53r}P0@GQCCL9e6s<~e<^74X@G6PQ?d8k>LTJ6SuY=AFch!!uz! z(k-*B-Wyinqb1HpWb^#yC${;O{fasGQx`RupceKADtmoL*?Bnk!qbbdgB_t3Jetj&$? z21~-WuPk+6-Vz3(s?avA1pG0aN5lZB(6&vAIUu<)5qkMEPyw}hR$4u6AfH<|SSqvx zRNQL*DoIz?K#c_=@g_73ixCoMs`LPp0jypJu*VYSm-Td*ps?tuTc+&uA~(P?u8K-`R&|RApxqW;%c7JvSd$|ILjUIWYsGP)GxWxWgl77N5r0p;_sj2~|*WUqu>0 zv|aYTVFzBk{&}2Uc^vb%F2btYFUF$BmZLs5$XAQ!F}!!&ycHX6-;|Ao02EPI8UDJ8 z0$8wX97i@B#zhC`IGv7cJctFm7J9kaFV4jaH}1uPXBPql%zt(vp1=M%%-TPvm*x>) zhJ&E5(+2|fzibZ{KPr641RTBO5ElP%1up-q>mBAN|M|l>zVQgg9+>5k-;us;F)(J} z=*B}>xOq7?{nzXC9b@}1ZpQJAN3i69nMhah2IvT=nt{Ah1$N@n!U1O#!9( zab67))Nxl3m%OA15aX`a`QNq;0NE0-E72wQRN7LhNn#1wmI1UWZMaw%dK;o;A`}I0 z@YJM+3svs&m!w6CNw)9+GrZ)f^q+<~q6v5$N{rq;@E#*6Q2;THAg#2AXxBcz8zLXN zPc)Q=m&rUL7t}7Mm!(l=XGTKrL;@gbV|v<&2bogibDo=vJ+Iq=$(fUwoH>aDS3i&K zw`}n~O#t{Y8YuHnCL0ov@iQaC*_^#|vHP_%&p z|GF(k&xZV4d;bPJ@y zoLqYp&1i$kS?6%*su%F+uY6DGl*W1D;v<;*?EKKiP&7c+C^;AhUb+uUAGruG`~916 z^`E^QOCMS#hCo7Z)?PGJecus`9dFu-$A0c1oLqJsZPnn!vg3ICryjxb5G&DrN@gOg zzJEQQdE-_bTXz^-w>ZA;2zK4H9jotK?{u2;;v5{lGPAt}+IghPKoEmh~wjKC?xlkkC0HD_K>pRYBjP>9VWzCC!nNpL>mj zUcgP!M-^cHwI~IxMYqk~$$ zSCt-dl>Y6AB z?GG0PW5qzEz$-DvAvP086TT39HB?UezLogUhtL5e{NmtrSC0Od%CStRuzKgC{zUl} zuYDR4)*H2RnyXiS_6BTw*W5uERsWa^KKqvfK@jChz=seu5yL zD7fi2ANGW z`r#T(&YQsIpM3xm^CT*M?fo0DeDkVl2#kDdgn&icmw=eC{q0ZS_^M+70rPi_WA(Q# z778nln1KD)@5Q>WZgRn6Zu~w3cyMK4xa&UpT7`ogKUsiEu@zK$s|@t({`?i#^V*&G z!N0r@TrU4YBJd?g-#&t{xibQ&`c&cfwix*GHL z&4aCu=e#%Yce|ZJ=yk;jJe813i=Fyp0 zv3Vud745_)@}IlVso!q!teO4MRzn;Jl&#LovK={3aeWy#CzFD8g=_T*L$2yht;qO> zBt%j^OIZX7;5KhWs+C>`6=5=@Ij<`MqeWHMdUpV0P-*fb z%|F1F;08inO?u-MFS2x<#O*vR=<$_)ApxEp?QG(`_KHdf5C8< zNeY}v|21im1U;o!fhi*_lyzJVq{KjJq{Yc~A&*5C8$%77R|yVsy_CEdrsVR8Nx?E? z2EOu0nw#riG5|} z<@F;)T*nbq!z`bym|vU{yUz=APOIX#3w<1)i6tD2h)*LATOGT~I{1Y=X84s6pt~Ej)S_JK1AgSza@~9cc5v^K&Wu;+!UxD;N0XSS`eDn z=5{hZEAyg+c_{&^;SwwWlT(ctphQ4bVRC9pJq(ri?eGvh<*|6QT37Nm)`}z#0u%h! zMu5PTW<4f`dz(258*g2y=#dGf+V0K9Oiw94{G(ZAnGr=c+zx?4Z0Dv0>X?Vh71#huM(frS$fkc z@De@>$EeckFxM-&0!vSXrR*wbz8?xT~%l}=|XYq%T%-z0t_+u0C*NeGfdi6u1apuf*a#m&0ZKr!$f|r zUQaEGXTlv^@>`>Uh>q4^ct~IY{N~Blc;Dt%SX`zP20DJ{_a1{FBF6-l6XZv-2Bvw6 zwtAcHS`5)v$%MBtCX9z;PKjy53$5uS_UjRi^sOn)eU z*9TW-g=dyQ04geFDqs%vLtB;^%^N7j>us3JElxh~FMn4)sV(aCUp~_*u<4&15#_3= zyXxeu8b{g$SQr{G6ubgZ7hOusLRsCi4^c`2S2BAnt+GO_mRD4suqr^7!@);Ml(%6( z7@eq#hpf#4Uonn-daqJ1hxV4~Gp0EIK~8eCc_~X4)CSLhxN&vG)U;v@P^DSng2Cjt zPezIv1~xEjhXW|i>WYAP>m6WM6iXzyFR~C|SMNYY;x;yAP?H!0bzSLinmMu~V-g<) z?{$Dc#*}*zgREA#hdoKwN24KmIjsFY&zX5d%KI}?Rjr$~6W#j1$yE(G@Lh0DcQ z(=w(S7EeMzj3>paYP4;W`c$~9N{%st$WvXnFkY*CJVbKAQUi^7`2VSU)1Z5oqdx4{ z^PKmu{M)IgUe>IT~1XhU-BiX zEEQKOcEv&xl8_yPEn~avG9X!SjU*%pXt^Q?Nr2FD|L2*`hu&xAIq!L|?#0gB`~J^4 z&ok50)6>)4(=*f4Z4;rKO6bhKnb0;mn!zlD83a$_{Yids_PFUkSIg}|C+5dAax-J( zCHG7fo5A{6c&u!AWFCi4sW>!tdd{`JYn4*$8BnAR_hL^d0!)E8<#J@!E3|{gIiesH z?z-$2#bHO(AR*z7Y-DTNIrrKSD6?|Hw1yV~CAaTQDI!$+DF)S>d`;P<2+C z+_CzS6QiUiRNm8mgSN>PO5Vv$wZ{mEaGNYJd{zlWUqky^`6Ik43z<%H3&-Cwo32kU z@v-+)@=V1$`<_CUdLIviCt5vyr$pGIWSj>?*?Ze3A+5q&%ZqSUH-9$BfNFy4?q-;HTG(t)G=vm^P@2}G<8nQkfExCFS7mMa;YOeh8RJ>vUBU+g663%nxFFTJ$9M{h%zsE+wNq;I79J zxf>Vh@j-!Mh8A;#RJNni4Z0z5?-B-?H2@M3sD%MzTrWB*32;Yo5R62Lv}-*SKT|uQ z{gV~+&YWAt|;J7zVMPXn&dXw@-PKS!frY;)duOr{72PseCvaB)GJq;~nN zXH+O^5Qq|BZ&PKQ+P-WblrdsPmZLf2Mz8=OC<4rNUZPFC_Vpq|r8Z?@A4QkUO_ipl zjDL^*nlr3^+cTQK=eD>o9V@i<>+;PqFcU(iD~R6NXZ4wJ{4_yskJBY7eF~W44AI^b zwctAkQ|XuYB3K)YFBoxQ(N@NpRPIAVzgXnW)!5W3f^3;Cl;yxMLay;70v;0}D5>nAPp(hCu1tJnr&?RXQ>V4pM|AwtmS>_5T>m*&rwvlw@s*U|4@|Eq7UL zLM#SfxYRk7<-jd7c#>a~2|@8YUy1BEs?H%>&e5*RVyqHK9yYy~v_q_Q+i{#t9ZL0a zE$%FmpV!(!BA`(YLzoHwKHFm)}*5~d(6i2n%6xeN3MRye#~3kGF04V+k{~g8cM>LVEU3ktl@(D9!4R=D`&0uJtEZHyG4Xh;C;L# z$P~OVMN3MZ8vJ`}a(m**w?Jp58C4R)J2fgx}n;+Gz|<>$qtz31WF6DKaSc& zNS=J3q69jmgE|ZXt{7-u8^|LVe=xMcZf%(3XeaD3P!@H-0>#adKC-*jkGu^i&WfEK7hf;cB?7nt7za+QCws4E^0`MR^$P2D zu_E{MX1YdTCf|vj_q~LHu^waAC+;O^w!!rF{#>Q#x@rWC9!GE2_;VsSFu0|L(nAN5 zteLNzOZFr?<|xyAz^X*XBXe($Naz5~b2Mn-M5*g05hQJD~K}nq|!W4rm zB+?q_Aef6Wl(P+rVl~6RM!1a3N~;c`3MG32Y9E9^EJV#@FtqM0^n8dK1>W%zEuj-CNt1J8!QSS_baenxv~kfh_msbEZ6Oxa00M-y`*i+V1@Fl8Te z89O^@Eo|LE8r`yOvSCk_R>FKCYGCRKmUskg$G;q7wT-Ms$-oE7r+G5gdyngm&11j} zG(uxDOl?}jqd|-TGbFP2(*h;A9SHGeIlT?((y!Mj?Mo@cq6%>WZ#p!UyQJQh zv-XiE7xtI4(rFEXRUyP|cB*i+##Q7p6B0g8!V`NwNaLl7@xWVs_(hv3`Og+2nQ<;gtkVZiVTy74zBP%_tO_Du8lsJI^5eDbKW9`b4$eg+jId(m+(> zpenDx$qm>9vf!5_LFLPuva>4#Xhhi6DDYU0T+eVDt@hr*)TAG2a~qsF8$BtID4D`w zc(~c7Gc}zZb+!<-m2yS}<_^M!&K=vLWo1*Z^4E2SKvraRoAb*sD5mK^4A?LX=y=n1-e^r^;d?88*U@RXX}>f% z0n*(VwO#(PnbZ`#wSz$s7zk45dAAW6zAOSXZm`Jq=H;QAw52boX%Hf9w%mZozGSuO zF-GqLlBkC_jc|Y8(b~zqTDBo}BRMhQd&pSIEyv%8 zm^Xb_W~A$S$sZjESL(+N!NnC3^X}PJoM|_$bq(l@leZNQQ<+Js`paIr@@Hm zk`S;-fD|E>lzpLx^^-oU!g8K{PAQdHyZITbbN?mC3KEGY*?+u}dZ|CBlNTda2eZKn z=`5C*<%(40|7g7MkXQR>0PTGY*3iBUyKWHWUFa<`cyk$ViZ-KaaVB8=M&!p} z&HHrPlK0AY4Ke@?9n4+uXd0h_8Cxgpy<=<2%N%=Itci^Xr)|@IA#C~#I_9=!Cu<03 zn;&Hi!I+h7>5!nAD+~QWO5>^{E9r-ctSdz){(79$elrmpNmUxpMKJ( z^a-uncp=T1f8vK!E~iCy<6fX=)?UB#h{V$w=H>CG3gSG2cLK;eh>W4 zcC~C67ZzbI&TGg10uv<6klokx+0-7j#I2tr1lRPP4Zpr$*7vxI-V_u7ms} z!KnA`arT@ptBBrWQveyhl^l$_3e$)Yb)DwOW2IU1lQFEC*D-X!G#$6iIZ60UGb*cP zLCuB0dH&CS9zO8p@5j5o?LmC@d!LEVdE4jWSr0xJr~3z2E@&m!909VnC%rcU$}LL+ zceKLpmfQ&w<862!E;r^d2vp8T)H7#%j(+D=pN6vH13s9MM6#$+h!YDwm7&eklXs72 z|9Rd7oULXCd^h%OefG%G9U)I_8`N?d68VugAGYqL68>)lKhD=o@iqeQtmmgiy!$M_ zcU3zWIxy|Z(SBijYW=C3tWA)m>X>9!If zUO01TQvAmEwJT;M5InO+B-g-&k2C*WRKSUSj|`!?!s9VDkI5uYC{ZKFXPHWmG>A5J z$g#cFbsvf<^mFgXy2MbFV}Qzm%6oRIpmS4s5zDvv(+m(xn|}A`j{vX{_PvJzYJ3I_ zoaC~!-rPwbU73(f3|)dCIUOOhWTl7mcw!p1{)RVN=sWA8iNs5e7_~zlOc%H)kH2v+ z_%ejaR*HPqhB9jo7{#r@`p5C1ulN8S`mzt;lTZC5p7Y>y@i}k%JbdUFq;dpt*gMISK20 z6DqmwnGa_nIp&v{LamaP^^Rrh^W1>6{(F?zNNh89F3+tG81U<&^YziPOPcCYLjV#i zhH>6i@w0UmdyIGECqFxm;Jq?FwV$jRO=r9f(DU3OS3)kSTY1yjq^|e22AoctD+inW zHH}gzIAzNs(>0-_H0!7W&J0NRP?605O;!}`d!b)=WXD9?w22f!*XYXvXn>M4T;3l6 z*xJ6q58Qohs$g+!?e~O8^eb~ZPPfooT)IA)JH|tLie>jW7vy&qu;p_cEu!i{v~)sMsj7vC2m3C%rrnsBUzPR=|ierz!;LFcv8(@@O0=Db$4UTmJg%3;b{W^RI-_p(qCZ{NPu< zAHVpW@4)#9591ZD`R>wJRKC;nEVt)2rJd8QlY_e?K0p9Q_r-H(lq_UJSzB*pkEQKA zw}I*F+*&-}eg*@H)ZO{FGjY&$O)q7-!SKz?6uH^PmxCzQdQf;Ka?QfY>WLIC(rO5# z(wSEdV46Y>0{|!nm(syQLA#)Z-vv*Adjh1ghV$OB?>jnEp{KRbLc(U@mdBkNyG|c= z!638z?UQ)+FFqH~f7|CD)>J$e3+ZuiXNCrnHXho_T^L6}5f5h(c z%O*;qrRnp7T(invp*y#=utuTFq1X?Qu6#>}xDj2)xheGgWCmzPsr9$G{AKw-HV_Va zz?gzXp=Tq*4V0u@Y*Va+3KlGy*QFaXbxbqFJH(yUpzX4Uftt#B;WgQ0xZ!>`1BiVX z5n@?kSMNdTf~=HdfH=PSacT2PG|=D$4FV+slwUadWvs$OU3nj4)k(qNm$_zT92~qF z>(K9~*(;FipO0S+{F&f!a4XL^_?mH2K;?+x(3!`s+GxeEe&a9WgJ1Rm{O)sq8_#&p zGw}ug=!@{|e|^iIflKLva(4xQ$aCvPkGrPZ|x;Hr1@pJGtW&$xH~7PxDgBm~0(0_h(h+1?tFZ>38A7 zEOZI5_4$lzp81x71^#T-bw4Yu?;C;k*tv~NHPZbACR9}jXZN$0FsFm|H!-6%neq8m zx%y8VG>^$&Ik}j}EByP~5O8XM50)IGp7E<7dlaaw6de^Mg6#GBiG@Id837b|=57ig z-o7Iv=V;)r_;^&W=>*V3$1q1+S5PrcVJBx;|DlpwF{VV{bkv(b&U>~m#Bh>jAt`Sm zie1F3*MQPrOtRRI8bX&1#2}EI`yOq)Ic=aGmvxzeCPxrSqo%5yFs`@mRK{g9Mh^OU znZ^NsLHKjwrTk*7bIf?a6V^3X$otXYUn6o6z+B0S#Tet!!s}trOA#SHov{l7%ASnL zAUGOcW4*Omj1PY0`|-TDJs;2e-~JFD|GSUBo<;{#dLrQUe^pKryz+-$y?pP;JQnFH zo5FM%0{9H*>FI$HR<0Md+CkvJe;}h11$)ghKOo zSv4R8%{7doQ05?2_CDdW*dwqs1Qso-x$R*#4CW5TjpC9*g-expprIO&;+StXEWw*m&{Nexpo8#F4Vzu<)gZRJ@xc~V30DuQR@}$f7 z{6426V<|V|l40NmLFtPu_~ybM>R4gtC}2qXKD#Gfv9H!pxc14omVL|v(YLcgzm%2~ zo8D0{=rq=BDPjpK<@Xu1zssAvl0er%@2kd?W{6yS**4LYnXUo z{y$8Ken!qJEK=4%2_NLEJaPC!pWQMNR>sH?vQrdJ`OssYjMXe=u8p9lkQeW@gVLW@ zq=< zqfEm1ub@JK+j4Aj?Dh^UY?EQa$=a#-JDr=tRSUy&u`kNQ|E+uk0&XQ!MBOl2K%W#4{S3D7T3|WwKxJ^gt`;fm( zj26gKMP|S^On}TcKqzIT9`*V-`pwaEnaBlEWgGqLQKygdQ08u&YhT+qH^uKEfGO7- zUm`BerH2Yz38S{Eo~N3F#~V zhOQ~a?aO-br>}$*M;?V?5~G!U2*u(|mD2*}&p53Cm7qg;c9v)PR{X9NPP4tlqgso1 zq$}ubnfic83Z*bBl|C5LxYAMwF#A^<b6WL&f1LnUWr>3DV$EPlTst}u`w7T}!^+mne@R=(0fH@V$ zt#eVD^OT9kaWVfip_gY3A#})(0g|8X*PY;d_ZgZWJv7Dab_ORB3s8&B=0;ob*su$0 zyJvz(PY>7(-IPvRrVxP#dvTT0E|WK-`xSy^m4(LtXqGqLFPutIeLuAsUbF=N;Vj8hf^z747EDN`tKtPObR~1aDK;Axl9$$RI~{ z?wR5ZGa4=X2y^G=s#l%10+#EWfUN5!picHPp_bU@(HaE3dd~o-ZX%$NXC-rQW zkjfRKdhm0ITu%Qc2iXkkmgKJKgS_ATKm4(!aGIZ~pnNow3k#)fR)|M!dqgNC_wxYT zLm7{B;>CI@MITVo3qx}b&|G!cAVBgs5g&HKE!Sde@RdhrOe#hroI45V#C-AfNa%zX z$lbwPnjuGGMEOM@xUh+Fue-DxmYM?02-dRHYoZU zaE2JG8h>k}a?F9^y#cwr7k;U0>0r3h1cgVgL6#P43bGYB(y#_XlcN{Os2 z5W08?SroMyAfXJv+oNw;*$~Jf05U4E|GByy2Yfy6EadK%!eW|d4|jp_7^jh`3coI_ zN_*!FacwnffDHU%@w`OgV(odj!gCaMVRU|=I1@hH*2ifIa#O}WB^og7@*ZnP>VAWE zp{8}p?pmvVl`B_a1|F$`jUZg2n&M>@0L+Y?JNBL9Y)c zW8=VZ4Wl3o0W;Kza@0U$ue5;$D@)$b&0Gb{==mN~1fDYbf6mAdBI* z<5l`H{J17(97X7py6+h*Vfqoqqm3uSg%iTDnN?`i2q&s>hR>s<8@VCR^l<$ZSsD2*fa4aBA zV7JsgG?cQL?wA-A%{!+hS^;fTENc+e5QsL+e0JxQlto^DT_*}$GD`L+Ua9cz8sSZZ zbO~L|v0M-axZ=ZR7$jkDg%I+m7%jHOtW??ebJ>TGJuXrg!)KOxEMzwuJNO`1?z>9H z^5iqCa0`L$YrIK=u;}FzsvX? z5xFoBXo5G?KPDbNX?&#@6-~#37zc<9R*65Wzv}>_R6_p^Uhy({!y;Y4T+TcPw8^*{ zFj*!?z>aDyUd@FRKa|g*!bT3{J{YZlX7Z<~DT6 z;7k47BQOg9pd|xFks_mazA%Rf#LDL>*h`Gn=3bi4vLVajv@>%E$$>1b$&9ZNrLN;7 z%o&6RY8#-Vkks&?7OK002CIa#*~q8}jb613)H`@IppN=vPPR8-)z77Wr-IsA z=HRe_pyQgmrIBT_nG?$PK-HT^2oaAWdtBY1(m`qwbUT7?=kWj^4>iV%jkk0)F%UC# zwy?k)bvN>BjYTFzLz#s}y)(8AzE=Rgv?b931x<=2FO7LYO(GEbF~Kfg1j#GW2zzp^ zgF7}5pw}oj?zjPiiLk@SoIONTg^#tOOzD#Xp8{sZ*e$x7hdjj=85t~B9L87HdZoJ2 ze&BdDJ)B&Si?SvRJzq%T;(T{2?t(H5$YH&f**=bysd)oh$&dsfWg#B*9N}@*9zLf% zT_rqz-_xpzj}(rlVD3!nk*|P5ndI+k`RHG=FM~1RiX0c#>NuN*fwLQLZV1G{A%gE3 z9%tdBRbATYGl8o#hqqHON*ErFX^L4rQ3}cz45ugS@ z7+tJ&WyNaEZcXkOIBm^$WZSjLhPd^s?I;IK79eJ697@VWNX#UY>@eE74$o`TDRG7~ zyd_uT7IDU>FD&VI9uUB^3|mMR}A2_BiNxjshEmU(iSC&b|BhX*np+51HzH zl*dJdNid@^Yk29`-T~Q**kC71;&LEKz1JwD-c;o`(-?}n|8;9m(v{R?zsk00{0nq6 zV!1pk>5&Gx?wG*XNH60`HWN`xbWZpr+6G@7>l+tD{xu=H`W#bs|6Qo%Vp@u`!wT0w z2YG49gAPprgNn6IUUY;##$*ZMHjt71ANju^6lE^9ZFna;S090r9|j{2gK;&eFDcDK z9Ix)-3u!SSx>&E*d8y#Ao;u6o8FdqyMUfX17?n@zT?18;9|+imupf`MhKw?UVFsUZ ziW#gL3J2_RiI@Bo!(jLTm~L`DWJiX~#25g@3^5FkA+yrX3^xFEp$i-1O(jmyna|?^T7qT?-A25T;%P^u+L-AYnwuvZMvwmeqNjIqU^7MwRo_s z;z;-)4-tK)493}Q&&ubf-^NM^er`R(&Yw`BF=JQzcI-MAIA-w=EgZdNY>F5mWaf5L z*1^63jh%)=*y2HO$WAMuG3!_qCEWe82dEL`RE-(43*RdEw??4T<}+{tVQT{K4EBv; zCeA1cSU)OAfSn52w#}8h?-QWr?>)GSHB)Kk|FVu24dcs3Xp40Z#HP2Iz<0K5gU}-% z4gIhJy6R&dJ1;mrP72}hm$@sqli;U7YI%#PX8h))2vg5XPL-j z=MH>mjvHPUpk*qCu&(?2f8+I~lraGjB1)RQo*J8kYC(h} z|DZJFBmGD5xq2_S%(J|)OyIO`e9n+OyUV|IxueH-)b3-4-6m_UfpJY5TwdPKS+VNB zq!Gey z1xJ!q-&+5V*rc(tTz;zAOFIN^C?`(8ZOl;Wgh7p6&;wRT`@{@AUzPyQ`>xlRXTwqV zq>Kii_O0*qhsg@^B_?KBLTGIhjiW)0O#iedhJ*noM1R}y*NAoszxSZErb`6kIXJb3 zd)tP`ZyO%h2shqL>3?c+JECu>%!IN5n+LSFWv1kMll^7>oL0;(3WLS(qfRZtB?*l% z*^b#)%jz;gbE~OpBBNwwx}~5*V)DiNOS;O%GAvLGSKm$yg^4(E!ud10I zj|y)>>oUyLe^)E{3wdk*n9^S0$>v;+2!DYVO`Pm1q^XO2*b897DjTk4h7(46t&_8X zkZou)0&?x^4Ps57&%8L(#eaK0<={&PDH{MzGr)FbOPf;r^O`OP?PIfMPYwiiQFhD6 z;7tVTrc(>%j?+fiRi=`LV)bKXh*_8UPY9yqn+3m7oZR40Tsq8gC;SqIOk!Z?QSJ96 zR|$4ENpx_~G8E3(XOw1(oXaFbYU+~VxA(*1wnU%gm4bN;94l!*s(2tW1orK+B-Ch< zuU-zt$Cj>yYk+A8Se$dF|g?Rv* z^)UhD8(IZ9TXM_ep>74X{N4G$P5}t-biY+IZ|>_5Pe_AoL?n_p0|bDTiMx)i-Wm6{ z2HpjuJ<-;KZ70KO-SY$xhwQ5ity^^H}#Kl0kZ5Dj>d#ddbc|Q_=u7CY*HCitg__sG@x$&3)PGl~(5v5f1 zSY)FZ_?*@WYzH<>X%9vMfMH)sMr$zO6whj%S9iZFpFE;28B&VsQsFPp_Tm=$A6snZ z;x8awW~dO+H)0Tw)2%h~t6Yg?{Sy!&xou5%X|tZc*1l*Y{lPmz6DW=(yTr+4Ma!xw zt)g;l_BG?gp|BYU2PB|m=q$)~`N(pmlgeUv|NFan=}=%_0DYL!IGBW+87|ggj?fws zUCAz&3Lkh&#x^@284qbQ%A}4It||vP5-FH5!Z;`!5CNY>o8q#zY}C*j`;t}nMn+Ey z|4`w9KJb5dVVk1KXbCTqEndLhsZjAfUaFvPHVxa|*-uyOESm|@fP2{RaPM-Gp~>w! z=MG=e8utrWoo1et{z>{O3^Oj}Zrj-&W?&HcR&UuPr`C@Hc=TZy0;2^H&zS-GkN)HD zV*qJsU{2rm7hYK^e#>90dB6QNuX6at1XG?Lc-1t3$2>28&8y%ofON;3e(c9fo>#o) zyC?jnJbzL0Wa03}AE|l1^9R!v#X4@@pw|~$T3uuO`lCFluGjySAeLM zu;Ys9^a=-Gi1E3Tsmqo>db}2zCAi26D>&S7Nf7HWTCTSD|<4~x~X&Cl* zo(kL{tt8AH_@xxfe5>C^!DGU2W$9=H_cX7>&|cfvDYO-ljkus5fZ5_l~yj$iy;s$&-||UuDI15*Ko+> z?eKMYwyR%tcXbEu-#=qlfz@|g<5j`j8n$%Vlpig0U-PgQOtN{=1iH|C7%PfpK90Cb zqcISD6Jsr}1y5xI2%3gNo;*hkT$+uoltz8G7+_Z#0|4gWbr@|SfaL;vJXCeK*q}w|AkvzKw{!~1eg_UvSgOWl`dC898=^7c_HxRiDq)Yw8FaCTm z1PVrBsAZ)w+h62LAY6|bkKjPI{1@28mkmaxWT;Q1FttcP2`?0!Z34jg8$nai!x~(O zHI72F8{*jeAj4&r%~s7XJ<_Ft(}oUNGu?GT zKT0Dc`AQpzPlI=*HlYM zSeLe@4R>bQa$iYT%S{nU2N6A{UAY;&BFgN25&* zpB{B++ze*M=_EHEc9u}b)JX14APsx0M;KcN8W@c>Yy_OpaAx3s?{zG|JZ7v%goDoB z_ry4D8yMnc00U^YA>WQalG8W(_P{v2My|VoV!b>Rw*DC2E@7u<^u2%T`?(Y$iX$E+ zH?MKeGlmOk1@S0dJn1K~5o^Oo%Ki<>(Rm31ZZtBF(z>c0*2AwA}A8f zJDQerypJ-ClJfKcH6uFe`uxL|BRt>Gsii)epAQtln5xlLpHIfafiV#LGjsGfjz%2D z{*PSoi)C;{>4Zm&!x?&hW{P@G;eTW8KMa7}b{VI3B8OZ~mLs56ClT)NJN7f9gCMhf zQOLHukqwTmr657w;8R?~t$iX_A)A6n9rFsWB|c;uE1f-dM)3@?1XkMjjuj$H>aeF#2_Acfh(=FE9ozr9<=2uET-6>6}KqY@z^R}rPNx&XgkT_%_wq?=! z?4h~Pv!W-2urhEyCmM*eoI0jD$5$5z)j=|$l={1Itf6KP)Cz?@K667L84*;=xUS-? zkd;WgKs13%Y3aoCYF{`>laNRb0H=EfA9$pU)pT@NUWq-{fwUYNR}HXiHC`%qEd4IA z#O0cAhp~_<@oh9drd)Z1k=qi)T-N0+fR8yN32+5&w9ex&ju)oNOa~!tBxHLM#}P-n znA1SFeI<0$u%A0P1^pte7s|`vSnuCR3{@gg&|&~m$QbTgr5OY*P@v#DF;aB%VI!c) z-j?2@aZUaKSPTG*Oh^oz&u4796mrux?A&oWHJr~oxOd!Zg!|e~i*~s09qn`i5zu+Z z*2J68!Dvj_2-ps=5TU8QyOa*zrwD{c znb#%j8t^TZAEeLJm>37^?WrO=6*<;vzdz~GtmjH2&S{vKZl%mdqb<+0Z12EO31R@l z6==aP%|ztcfd$5J%eu}=xfCITF&8hMXUc-qGB|*s%Zy1akQGE20h9)CJ^N>+ex-b~?PeKy?)ytC6%Ld&Y=&{YN3(K?%}3YGw3e?BjfxJsI6LjJs-Dk*u~ zAeap}`+aPDTaM3ca6D3jU<7jcChcknl+Q8ikgCTaRcZfH;v24`Gk**3QdnkoUDilL z;~z)8z?~;)G6qG_$=-ozpyl-7Rt+FxjY!yl&G@prZITTS0*TUA*3+A`#e+qJ);9H6 z+q6#L?!Ei60+D#L#9)@Ag|s!{JVYdy zAyI=J=G_uaPhdH4vK*?g}a*74!sEb$Q%khFI^2~H~QoWNyVvMW-@uPqP5i}`{#HJ237w4$`ED-#@Rgcj z=X(Q^P`9wf=8*!Dn05nV5UyHJQ@A@Z`o4=NN@H7yt&jvU!FTy@WC4xTd&RK3uduZZ zVA-6w?`PcHoCHT*!zVC!?`T_d49(NE-JH}jz)tf{o6|{- z7&7At_ipg;`78zlg|V|W!p^{X?>M!F-eoz!kJWbZ6x?eKyAgKV^oB;Izq>kZf|TfM zOpth|GRidu!H|qE*LM9fosN}w{=Ss-Q^iYAoS5)hglYM80y)?j3mmIRn_(SO<`FFu zJR0dP9ex)Wx1=oNLJVO#HdTI#i5+S=Sp}gSt8y*%UFZ>Ctx8AQ4vLhrBA|~9kfA}h z8JUN5Wn?(O4rQn4act+NA#@{Ch*DtQSe3-P-Undx)TLfg5M4tL=XDFp$YjM^X+y*N zb?DV0sWCW{IUU?R;MrLEsSPd59@h8)z;$e0b7fgEj_1j%bxQ@F-;Ckgc<~mHrnrmV z1#V&WQ2e5Y((;n>hFmkCrex0%8H2yFAt1j)nEGA?{l{L}tXqr%fVRyr@};FtNzzly z@O_y|4UukAqcgb6MMZtz@%Vcu=Tq9m&(L+&4`z*^DT;XS9lh`1&S;zMU65sjZEHB6 z&j873n!fMY05Ce*M%cEKd)H`_%fHV1j#DF?(ENz+>9nEm8trg1H(S$q9}59Q~T0R{s8xc7AZrLdbiaa|x z$X}jkWpt2toQalvi$bQJR)XTOQ25hchFg`(-C-Xko|p)$rZ39nGOIddE!tWX~*h8WhQ-H1gym3H+#T9&CPzO#vkv^Hxg4>WT6* ziO1PH5>~xQS&4do?I&73S3~TwWKN$8d~x`dX~k8+tfs%BdYj>Z<4}{W*VQ zU^(-*_mpy9D7)dfb1Yzu0w_E+hkRAFAbj8E3EQWfW81PGnRH-+eWm5~U;s(O` z%re_2fS7Ub=7gJ5+Dr(5NRJVQ|6iXoHg(D4M0$_Ho_NJ#ZOBMEZB4H8h8oY%69!NT zLyVh7=x(e?yBPpCVBdGy_n^l(8|U+5EI(gaAw)G*a7SiZ-pJ@ zgwodcXISs0iIwf^nuKT>H=|tCk6T$<`ssAE3GZS$u=*YJz}a`wfzE*!6#n=-53n>9 zSPup+#SYPUq>6i>%|%!Fvf@jxqOUF*1-BS$cR_{_GuW#9+ywAy%q6c#)->?BKQ8s5GC4M8xj%Rl{z$TQsUEKN(wSrEH#($)$(QLI@r<4 zcrrBMAk}`nJWfaVzkSZ&gIB|NN=F8BT?+$ph8Fo8U*(Bx*v6(n1FCWQlhQYZmD_Fi zDHLO%q~W&?qHLttX#zl%w%YH;R-E#X^02ty;mWWPaN6`%PTP5)v+2#OMM`@Wd<+OJ z8X?`MAUU=shK2-66kIoI;7wfq+@lX~Ho3s4v)l;EiofU4z+Fb(u5}W`urW5~Cf<_H ztfwht&%p^+F7%_FT+j;@!Z^sfOKISG#BCiDF4{}huVnzJ@Htpwh|SybJ~j}hPM>C% zSEQqCchN;Yzz6^1Ro4EX0R~lafXCgjyTZ&$B|alf{OG{4#;+|Shkemt;h_&kC7PMf z1=&5Fug;lI zRPCxV6$Y`sXCOT<`%ugfNc=3yTj0qBLMA&SJQlB$WE?|P)>Pa{w zLJG%T2s2icZX3x`f_W&2K#(Je=kpHYCKr0?W<%Cxfz~u02*is()PP3V_gytP`!(TB zY1fFbHIgHZyTmqVn_l01-o?m z0X7?}W5J4#yLSNm#1Fp~bB;$(N&lNjmkficuLgd(RPIPwfEIml1Vsfy{j|zg^v};& z`@agYjLh8jSsBbfqYhuQAKHBBo`M8%f%9?B*}xjbKh2czu|RJ4izHA6!C}*>OotSIBw1fa#!s9^A`=Ocz zJ+CpS5;P;G7=Fx<(8kK;$r25(l+wrryZkG2W$_A}PR+dmn;sL)L)PL?NbC#2znP)H zEVJ{CbYmgJ+$D0J&f&k|IppuufScBEYMbBL!F>mT@wjcny{*Zy!6ru3MiP+`yrU6t z@3i4$n{mNuX++w0(+H0{op7_s@xun-X4`PGQxSc~4FMZ>5M;Te#31miMja?J=eu#B ze|dvwHQI6yb19ckr+^p6KscXh{=9PVzWg<>!XN+9m*dO-&R6076F!Z9{{8<1`)R+u z;3AC|=q#20W0Yp=nHS%ObXNg4{yhrm$avF-cZPNqjOkf62rerClNX-9ksM8G;f_on zLw(hX9#@MjYZ@P^!c{ZUe}}Z1J8YR(1-iLVGhX>vR~}myn8j$3?Id?QP( z8pvl+wXUFT1Nn|{n?WU$Yakd>za)`9j6r*rCbJOQ7 z^-GK|a^7*k$sie;r}&Y-mv#FvMzT@j@b!B$CC}_fVVxhl?X5BXRGpL!GN+AtGOUeA zp#oFBm;e~^9j(bxz^#eP-@_e4j@fPMnK+#qwno_0csR8d!_ti+`MotQXNE`b*Z|yX z8ycHYaFUSX1b=rT!gksc{RN@Y9|NOJ@_jHG%10@?)|_pEcR^d2ya~Z@oO644!&5%= zRJ`O(Uyi4K;Hmhvm%aC5iL2A(uQqFMz!M{mqt-Psc%d3L%R2t6HPlM-ntmyB!D`8o z^_FPja-U3iCp_K#94{A={~|D~)tKMH_p*pQDu&J7ro@}2cJTi9`}Aq)rkG?%jPkD)v) z#tO0la1C?EOj^#j(ak1(YL-vsAT{z!4{2ZlCSmG5A9rLh#~R70a}O>V>_Rk~Xf#o1Cf5PAFI zGDQ%G(W7!n;&EdGa1u*LxR#nrK`n|fIE?oNz0LF+ZY{Y1g zy$m<4;a+RFciM2XZIY)EPTPi?n+>OvL?Y-K4`FK(t6+l~2Cd;90rvH1F9ObVm_7!BbTaB_mA(IGubDPyAaStY=A=6{@Ar{rS(wgD-yvUhp$t+VT9Wj78vwvUL62QS2hVRqNpV^gE9g=UoZ&NG&I&Kq z!NUk1Ae#X3%T5%?M32GfNIXA+^EKNmc{bBB&nyn}n*p;RRFT*2x{U9J(TKay)0Bf- zr*c$j-@)7huHtC`2xbJWOr2VjALa7z6_Lq*K=IU`kMuF+Zbsa=F-_#zxUp`6P*6VV zgR6t9i~w&LU}lR}-Wjos4Q=^p(fD`3XcFdG=vT{Rz%{%Ec9*f?UcFqZ$T!_|+T*w@ zJD*9ApYDPNqD?+(YgRy_=Uvmr|uVL2(pvJsa#-JVGx+XM;Os{^MCfqTr5}D>%=PXz;8YYzx%9@muLUa*S{Ap`l&yNr@!wR*l%|H@;AQ||LT=*$5;KIUjq=i z(tqQR{J4A{+>j+Sfezx}md*L%M4-FWG1 zzZ#$Q!KdKk&-op^?bSbvd%t%N&w1B#JkPJb>^*q#PrU?B`*nfyu5WrL-u_*0$5;QI zuK|JZFaQ02j%UB?IrxVE@tg3tPdp9}KjC3~j-^I`U$)ClOKK3L$^S#fyf>KF=rnH=eUt=j;+d;Ra>~3~N?g~09m4o`I z;+u_xDeI(!5)e$J$rUKF8P1@@?qUQC1{vq3@_-9l$!b8vdT`0+06jOYdvmGa+`X%g zNH+i|1_ec{J9lh48xqr?sRu_V3KWzLk4=#>)AwRDlzz=P*1lx0%(BcQbfjD_uyvHU ztjO7DaFM@OCeljDPL&6&^qA9w(Rj|ro;?_E{Bt95MyeWn1!nYB?KV+JP6Wz*Ywr`H z%1?w)Okx0YSq8B2Z;HMiZ8XJb{1F!jfv9*MM!Pbi4G!&Opc9A3LJ220NCvW76q!9N zF+08*xCrniN78@ppF5}#Hpr&j<{hZzt-h_Hv7SEAdbdXC+P2eXH$6&>1v>#LfV%%U zZ4#Am?{WE3qYWK;!4VOliwkE~Bi`jLt07aDU2I*$k0lyKnd|QhaaXeUc-k{?g^Ee} zGINFtc^q%s!zb+b?w5i7hyLe3g3tbyXJNa);pP+f@I^oM#rW_Ge`BcRc5GhuzkCBe z`&XVRaDML|Ui8ynjNcsKyyT5vhNu17GjO_p!c*V(bbQI1zXHGfjqjS_yf@&yc!2Xe z&-ooZ=iSf4<3Ij*P$xX@_a2Am{_D@d*Z;5I;CbHlP4C2u|KT6R^B#OYPM<#EsULhA zzT_=miuZo~FW=e@OXCuQ&F#kjRw?LzrJ-=w6|tz zL!cH?DSx;wG~jgbeO=bdQ}nkRlTv3^ycrGe%B9!9*4=q{7oV-!Y*(+nPUto3OH@AX z2_GQ#Bmh!ovpPBA83xj_B(OEvkQY1xReDvP%zdl;q``;Gu<64-gS`A2@=*2@c<5rl z?-pnzMoH7njHd=~dn4fHwBhE|^d5pPO9a~n+YGr8a8iTE{-EB56UkD@2H>V`x;(J? z#==vRJq9O`{sE8MHaxC1oWM8{aMMWPi`QUl%{N&3id*I_@5q6E7uft%&G!pA57JWc z43GAEXPh36_(ta^+{e4W<(KfG7kvnye)6Ycb0GuCFP9i|G(8l~;|XtnWdn<$i+<0 z98{S}QDzCd3O4jCXTePkuLPKyxp@_&D|wVZ+dD8+yC99eHGykDvvHH(4Mv&eU+OOm zynRcbmvV*zjX*0;WVip!r$c=@OUqF5G&Ytf^5D{$vl&`kSOiHuuUg@Tz{qWdhMC;@ zBbkCFpBUuUx1lgC<~~TG>+RhXc+iUopw^1A&B(J~G9-=UzJuD9`kw%u-Gk)peXNHE zU75(k3j6XPSE?lnxumP48|aX}=OB2plpv)yJ1*EIw6YmG)PUCYxZoyk{eAE0CPrDd zuq757jrl}CV>rDwYT#yh#4r7c2k{5~Hsag>Ndhd@UAtj6INap$NkpuH=QMM}nm^+8fyW?OF`=$(0CCt! zjPzyfehwaV+(SMMTvBlHwlPxhFFU`VX4_hv(S0_ZkNPzxKLP(RPR9TMAOJ~3K~&Hg zx(=>yo9r7fw1iih-Z~iVpr${2$F`kdGifuDh~%_@U3c6v)2jfnb#`i@&b$gINgaIl zzU-B7Lxwe8f|j-Ln#QN3kqc9IZri5HUcwaboxz(NDco6a7(8uSpUl$1jBV41iK5kg zqSTquNx~*~Q?|TmOpqO?*1)V6ClPSdo8Igw#!@?-u=kGBCd(ja-M?Y|`tZJscK~*x z2zvE0p=%$x(P`qxc~Tk7zUv5!y9wN&q4HS-`hl^q9^*0iKk(9D!*d^ep8x)>7kn7s z@;AQ~H=n%m!Sdl3{J%?h)Ct@e)W=!~zx9F- zp8rvN)^B{4*YsO2_%QzXA)Mg+2R`}$9{A`3p6BDw{5anFpZ_$zPzZY;WrUT)4IJ3V9>Vm;hO!=X19zGY4OW~xEWc=B8o?+7gUddu!;h7BqFF#z@ z=}PCKH>=id*=yC~>_Y3*!7>?Hqj4|^EBij+=0?VV$bjv5$H8h-X!qp?glm*y?J^%} z8$AM6lPOHV?uyTAs?F;P!X*?&4*+F_UQ>8;60uUd-B2~&O3ah==#<8#3VRl)iFc%W zo#u^(rT&zTm#Zp4J)|^+j5V2&*JGVudsb(;GF4VnDFDH*LEaoiY1X zqpeFQfQ)9Be#GF((7Prq)O2Ve!?D(B$|27_c#XInk=YJG`;9q>9 zXZx%VJQ=_8_3y#`C)~&V$3Kh@z2t-V*DwEtCCDd!^Z`8dk`IF0*b>HPeelWnm6yE- z_n+`E?myvSJoJ(e;K6Ty#{}cSSG)rs{k-48`R0s|J^v&4#h3ppyzpmU?C+oa!6)Or z4(C1|ddUayivygW`Tl=|U;oNq!zZ5l32a#wD_kG!~DD#dqk_vc z^9g`yx%XC>$r!oSFdK~?U5@B!pv`4wm~O>q!`x+_9pqx&{S3$^v9RXE6Uzk%7vQAA z**0W_AyC_FdRaP;koqz2Daaef0QWcmwcjZTz})IgvysMm(x1y;pJuwR`u`&Dne0QN zM=^vjF}TQG6Y$9!!m1oIcsKY0zvcdiTxJ?~MeIi3sG^D30d}O8os%qD-brWdP4|s7 zu>ZC{f(FMSU02^E-v7y!!x)r*4oX!lOQ(SRogAsmQ6mdZ z!XkuJ?I?NprXT%rZ1*=j@X-hG><6ERm;FzF1l#?vJ6`&CzZMU^{2ln|Klk_1w;fOZ z;8XAwfA_2K&%S?Fnt$*ozZ4I?;vM+;fA3#{iSZpj_}yOROaHI0!GkaV1^m>XRX7hl z1z-8vuf{+9zPA>{Uij7*;pe~SXZ2{|1Ng$Xei5Ga?(h_R)!+SE{KB`t1OGtbJmsOM z;H9tqYW$P$d#ktUi~sL0!LNMXd-03k_6z7YJ0ABtkH>T0{ak$Q|M4=X!?S+nS!hgn z@K5{#KK8ti0R%k#eNV>=|H+G{cKsVqcQypZ87k)w03ozvP4o z=3(7H?%K^q3O!3!HYOH|;-Opm!-P2xPs=|=*;m->euCp0$=9&2PPy|IGo?}&(z@%w zFkXN9;%$pPDKV+G&N0h&+zPu!#PO{I2DkW)1Ki z{z88}{+F`m_$TGl3^$0|9!#>A0FdL4yt^@N%Wd*u#?~fdQZH_5u;Yb+pBX9&rkEyf z^Z;(;+p?X}r9|7BR z-LneGdHjw$c#wX%VoARz?j0=>ZT@5+REueXbENq5$%)bUi#(JK-Sb{P`s)Svx7v%xZizHFrYi64<+->ti|%ilOtaa$Vn6$3oE`!CYjY-aFnU<7^OIB!Airb+lKY z);lQbB@T;f%EJ6X<|73WYF}Z+rll|hiaqYwTWyq)9A~>xd3hp=k^r4GFag})XREV2 z)?%xK+m_**n~bcEyZmCr{(>;7Qs(7o%mz+1{ z2N%O(Sa;7e(}LdAlG?z<0PS>V;7^T8(up5PpNm{zFvX^in|ZaAl!FWHsbU_|JYuNG$zzIJQ?9v z?$da8n-Oq_v;r_a8%JGrqTR&^xUK4I-anEJeUDXoRPa~`wGnQy+l~rFVb^jY{ImMI zTdKYFN3Q-%2|}4L`jjj(GieMoOt=FmF00)MdSG`tNqGK z(}ZnN8-s#dXw1~A+=O+agQ1+uCg!@3vY~(XXoPEcj^h%;!GQ38@`L)b2I&c%-55ojwcWpk=?=^$^Q z`Fh476DG~Rtxkqt;3c#ej}5!k z3jCDN>76wqp|(h8?_Ku+QLFvY6;bny5UFv{f)2YjvO~OtjPPyzm4ZW?g)nS*HMd#Ap?$e2mtu2EpYq`~RzSS6O;wNb)Mq^*(qk+c&KW=Es*+U60+MiqMJX@4D#1PO-OgRpM#<*~s zkO7j2ec7e%W17uaNH{pZ54>kQrZn>S`p~{s56Wyaa4O0vc81Kh^Adp>EjCWXqh|YX zLVsE;0842R0H7wDcFDH+Y5y_QdKdBq_?-2S`nIS}vS{ocVWu78aQ z22uBN@_-rc(%Tgd`{s%xIXir@G4QAV%)DpdF-;c+?fm90s9hEY*NTcq#qh~6M)~rH zz&)~pciA(Ljh!P!y4o|4^B)>g*($v{(M6b+WqAj8!fCWeLV1TVP_h&`ei`SHPB~_T zuUDoSymZH?C_)*HD42j|z}Fp_f&2G&oHf#EzRV_Ev!Mhi|3O@qr&CMsb=KAb1B0W8 zEoXA25x4Z!?VApx-Y8@La(aLLIGAVlwgnRfW_F2>{d4FYU_FDdV2{vQs!$9jr+&5P z7Q^1(#c{aIL)j9RBXhR)F3M*VH@P2ur#-6j50A^btOc|&I+&6Pib&4Ug`J0b_BdOe z*>JSB$aWYmw8{p3XZWQ_WxP17z=}EC_x9XE>-V9<;(2YGCz5*1Jj=z;x}QLBYUlty z_3&A5673$Si6DC+?(bbA1uBk8AX#1zlI^{tZ5kGuft?v=1|IG^n3`Vy9Dcyvd0G(L zwahG-@|WE2bv&H#Xs62>VS&m@;9g?XBTdW0yT>wJpgNb2?=y%CQ%>(+L|bLNbsT^c7tN{kaz`veV;c4 z5~v251Aw&2H0T_SfAo!kqvZffs^130p`4h-@jN?Tjov&k9zEm0_%xW=U>^voRn>Pv z#RdRI*QLGw4E8V>$^+_`;E~}3E*ATU-{>L8ZsWVBgHbwUq14@8V&M6lMz6pKFBCS0 zwq_tl2vIN#ls@jF2)IRwPe^k4#woY`ig@w^0n%p(!obarD_OP(xRNDq7AP5R3fhve zd9)0{P+$g-hWD2%s(S{k{Gx+Pnf!ds%M*h3{XmPDu=n0zt}SxK&%!QQ32J%oQPL4s z#uZ!9)T$Jy>~F=guuSr(m>ap z{{qfVV;F=Ian?^6WL}l;_xBz5nXz*$BkT#1c^t?BkPTzq_6B*)TwV`JT6?ODoeK;S z{V3lRX&ROkop7Wmu9GpNAhho*!{K&_$8OF+fM1icz3?cf$6^zqx$TbISD)t_&EnZn zW!K_+kz?0TFLW&-jA8Kg?3?v>5vuk)pnFBOPM3#tw=u{u+jEz3QCMrls-R5Ok(~Wz z*b$|A^2TQO5+J7OMrd|rVva@=)Szq_BuFg4WMRC_OZysC?zLmU) zSG3x}Z$i}+e3iL}!zFanqAkXl1PN-BP>Rzj$*?(4*eg;w&)Ru%mak*vyV|@3bgsEe z07--aVl*LZ&jPo>T#6@y(H0@LlafqEOIS*AO2Le;d`bbSt>zi?F{0U0Fk(5Dmplv= zTWx1CFyuJlS;yYqWl3k>cku$C;kBWi5QrCI!5{;2%Lm)NMy#o1! zQnZboCU#3DO2>JVjLd}vYR{YwXYxk|!X=4%hiSsyl>L})lj_Oxd}Q{^jEQTWTF0ZF zT)&WiuDkyW?-DOnr9=x}Ba*o3dPu1na<*35nr|K>z@wVE(5B!qN^tF6 zon4k6kJuo!nX9*(bL)%xDfx3OfmOQh1VQAf*{jwfRiuR46SHSMqTg%^S=LMv?IXXQqWKdaX#tx{Xz6VvoY1o@VccbzV8t-kuC2Qd^BgGfb!NwOy+iNc*Gr9(Ybd|=*R#w`@XfOI`oZOfk8Hb>ah`cvx0BTkU zNtopB;DWYgQ*R%aEC#OtOg4m3O}ZQ>VnZV_f^h$S*Ci9e{rhLIhCeeyzioQSlgsYh ze+fU>jfdIblUe@OG$Nwo13jW(M$afuV_ZFwN$|`q%y{Duzt$Td7F9Cut`!EWWrjS6 z?~ZE*epqExVZ!Trly4(oHOQ(0c+?U>J3EOV?T7r|A&%+4+wy+qh)Ru@st7%Mn;~#Z zZMjJH;~V7izE&6gro^S7lNkbU`5SR#<`KhGXTP=EjNKt`LeY!?+bk3=!pucO2qg}| z(!DGPKr7`&fEfaasDqFoFn0I383KOFU?5mTe9P?xVnY`>d5->^(g*LV0X5RBdYYKy z?-Iu>1CCO;R&w_`AaT{aZ_7{Z5 zay1&VA&`km_0I=nJTj6U?-{7nJbt$F1845BN0)0T>AJj086B2d4}wRW9xJ_ikn+Z$ ztJi2B0c;@g*&QGp&u%W!{hCT@o(Zoj;}_I6h0ra+C{@6~+GUC)#JnmSytQw#uH*6~ z@N?ni`Sdx}waI+W{3uDh^Y8>195Dcrf;Yjh?J|XtY37goH^sL*@WxTz>tG!4j-z@7 z5c7LpR?Vn9leC)`n;7qq>zofzt z?{Ngv#;5KHU?SWi<__xe z8X?6)V{V21C>ajZ$pI5KDUw*NHr#4H$VT}}@C`qf#cV<|9ItWryRw>iYt{I~9}D|2 z@?jg5N1Z$|Gs4tvfLl0z9yhqw0cy(-?EhA!s$K{;9*$cG&!?7%pb$ zP|71pI(r84xCF^%N_G*E1?if-IbmRQ*v7yPCc>xh?=p_nvtWjR-4U|y2%}uzGVeE^)^xa`BDpSAdM=KxI3$G;W z$ZN0oi^By$0N(VYubbeEGHQhL9e*k6GNCZS`Su@prN4j6Uw{2nucdGM3$HA{3r&-v zh`J&d11c~$83Yik-_{=om$;=ePz@Lvk5b`BQ#EqGJnM$RbUBf`e-mtd-qelI?3ro^ zdp<=F{0xoTWm_F)HRwlIFAeXr<#{yY9_&2KqVF<}hJ$-r7yXs-w4-j;FC$)g(;8S6 zg69oIFsa5tv4%TedB`RUWH(XgLdN1hbiS`*jWvRx6#B-2iP$|J2B81dWwLscQFpk7y#-u z-h#0xeG3{U28K=!Sa?D%9+IU8H}WBEy3fGFx=*1P1C!?GVUU_}u-L!h21iPSbp*mU z{>YDuV7;&ekcC#_2}deFQ+qMhyOJzJ<@okmo5po>IwJ^&h=kJ;0}2UK1Vbh zl-4CU*HpR8%jJC?%$M?C)7ZI>Cq{ zq+)C^#yEDc!A`(NJai>21d_lYBmsgekc5zQ&tCmwt@&DO?S0ObMB?<)xH{+Ty&iMT zHP@Wqn(L)`dEy`b;|Flp|L{3Os;Ad^SxjC94^k%#A?`5-5!#_H`fW!4C->3e^w-yqSq;HX?7lKYF1Q2Es z!9WYLMz$i#`NCR#)(?nPr}Xb87zqzmfE*ymo|Rp;&p?a<1!X)-gU$VXLq2jj_l(Y$ z64V*|0fYiz_QdP^?L&Q(SqkY~D`{n=BVDkc9+rmAdX54D`pHTSc}FzLEADfSF9ey_ z`m-xPzLk4Xpo_hvOnyVijud22k&USBXpn1ZzUOnu;{$=Ner$e?1Ogp-8IdSwCaF{I zYWFbIkW>zygOQhD;<-3Q*9YiT#5PM)Pcurj zA;-IvzbjJsPz*W*^z<~a%tfM*f1cLJL2_2814xnQ$#AC8IvIHZbekq$3oMPw46wi{ zJ(Kx+WY>gKY@0}D+K!kO2o44Vus#yNL*!{>0FfA$mN29#f=G*iIWq+k*C6CJ(|AId z?t*W2a>#MJ%H9$T)OxEODO9tWd+?@w4A4>O_|ze_mPRjd=6SV9qlC}3qT{CPs`9Ax ziE%ZzbuDeNm1k^wOQ@eCV1?0_S?6y#&s)n=0YbMiI+r%dXXu4yR>Gm8*s`?wQ*Ts) zdfhVKvVLUQ^`pvM=> zM5!9EH(uLSjJFl@3cr-5EGKV$(+Bgoes)KhdysaLQESLzn7kbr;P#d7Vz!T(5wZK8 zs^S+8l6?UM1+g8P=*p4jT}?>24$oc6`leq+bo3X^v-HFXRt~-~+2vh$aSUbvSI4d)$%wk41nY^v94XxZ)P}JMlp|*_&1d%N23+cJyv(_4I zsL_uk#I1wFbeF-v0-%CYM{&%pxKbY~Yrsin1{(y-?hdUc>z19iY;3|gj~tERIq z3^9j}x^#Ib?DKxt7ex8SxE0YK3lMR9HQZbs-ts5US#irKKoy*9D-5E?;1{}?IZFqw zqVzQluMk&y?9F79&O=AK#f+6F5#-DPZiB{LT9eQ1if4c<|7(p@W1i+wXE?F6oM(Zey9J?&!$e?9pA_x)=_ORY;EVz=lh& z*cEI?I-x0S$+%&iab4SA-obN;4Z^9g_Yo*AkN0ruIt!O19%>1CkH|hC>SgjJFUm{jlX}fFQ>P&!$rcl`jyFLx5g0 z%;oaA2jb0>{NvHW!!}?x@re*`M;xS!inxxa+jKRGKVr!M03ZNKL_t(B(j`PJ?CyGG zS2+U^bZv>XL(*R|{av3X$WUa+dU&6G3fX6c-0Vpy^;IKefk7pguFwwxRE=oopM#a? z3Ze47TYrup&KC$=kkE~4{7R8Z^uA}XZGhB?DoQ@60<43TT5*+;UMz>~Q1+GwBVdaOUXgBj zUwF-2JF~_QA~tN0Y@FFo~odg z)w%S<8wOYi&=UnYp9HotfX#8Z8(OY#{~XF9Uj;9%$vZC94ZQG_eX>lOeEmffn zTABqu12U}_LOP!y@~a`j)F7U5a5|lmD7QE8v`3=DcNBddPcF2m&rUCpro|Z31X&kx z&n5rjDZiuY8*)$1!@`ZBz`I77c?P+0xnK(hbLRbA81(TKL0>2ha&R9;CuIry^Q=W> zolpXRI;hNzzh9ADE7$Ia1h&CcM8~gcQCvXx@Hiopp3fAT%Oi<&{}^Dm2dha*CWJ zPTkb&7J?cM!0Ze#pe9n3>p$;tpx}XwfWY_?%tQeL9LazZNofs1-&B!reErs;B%P5L zxlhG(2#arHQ%BnuQfASZT5#uc%1@iL4z;*2&;Hg=Hsb!6ZZ_P!CV+cUaNYrVpN#J? zgmfl>%2Pwh6VTe*LsLn<$PyTty2gu%1E@)d3$oV+hzE)#I%X-#nLAaom=-W{BNevt zAW#a<1D6zxf&uSGaRt`Qc9$LQ0teI)V^pwhIWis$cnSV_E#z^0hZv*KDj_E6&xzr$ zg$unq!Wo6!zKmN`w1$;SQTS62I?3}5)q{v?MJOn!{jSyrq!-F0YNRwLGFA%&>8Eb) zQ7T2Qjh2&lC`F`TX6VD5w|KkQs&R^gybcF)}h0H%D>tctaH>yM}$s zjta(LcQkRAN6$|cdC(zmP0~#DiM;7lftRvk6+7SnnX5uF@-lKyfH3DkfZlg6?VYtr ze8%~h9J24)#+hbrg9DN_xW$(VwB$irl#P1DjTeowub1Ghq9Ogl8;E)HJ5Ar+#Qg4*aFIx0}5d zY|Ioy89+s*y=si-S0iMvc;DeJNTo~P41BqdQ#sx8mAm81cV18BB!sMmiuZY22cB-x zIc(hmXMljCD5Kj=C8U;T1A<^Sff!*)O9_Zr_Y$n&6uU%B$a@HNMyvo9_u2rb!pi&K zg>e^yZ)Ck951P&^$Ev&$0WJ4q2-3)NjfViS*&;pT1AO8iNg2AvLp^zNfOAM|2HME) zxS~I<72y2DGZ<3;4FMsc5}u$_=U@f(LF+()w|bJBDrpe`%pk-;!daws23`HtDVVPJ zDui0cgkc=As54(nA$tv@u@57*c5P{wgaYjoz;nH&Smsd4K-UuDA`jp@Reuk z{>|c^E3KYI6$1EM7XtC^rl6|?V4W^x^FDs|BNH=7k^h4fP@zAlfO8dC`SKzwj|KdG zZUF9tH6Y08X0pHza57`Z8=Q^vlo&;3`>D-Oc#=>7CEnP2%ZMLZ4L)B$Sdw%_AP)k- z^+%j@^j%#QvFnY67&xXnw);3`P{)O)w}8NBT2Jq6PB63@a^n*=*w*gxE)Ejo>^uaV zp8E#{(dH>P@er`_uwoPIqO{pXb&fZQg>f3ko9+O_Q7#*VRBs|w9S&~vU+}9NG*kmu zz5)d7PMEF?eKqYW3=5Ra0zuBtcx|cxJaCg}Td?5<(k+2)gN6ne4u|TxX8_0fv|{$< zaw5Kjh&OYFHl!T@N{0mjY-2=Dxc{1l=k0-nfCeNB{{rIZKd?6?gftzf1A%~O^qHFj zN-~^E4bZZrE2Zs^hB5>vEZPzx+kD!X$Rke^n4wvh2^bybYQe3gK8NHsCm}x+&-#KY z!3zWgs)d|my3`N>;oS51z=Kudbw1YkTDDEU)L8{9&oG9_RDf0fytV*}<2XQIjF`Hd zl?pb#NJ=h7Vx zB9*0$ZK(b?GI*IWi}(2dV0oDoxV3A>IQs*ml7X?KOan|Tcf9AKqxROk; zeugoSfxIV6(%N5&fm~bErU1(^bcz>%mO_$EKLl{q9ns;~U`J47d1(>`11h9@7=8*8 zwu3YM9Zb4tz=60%aDX-hoS8inZzklEe^PmT2@vP+PDBhU2do3)Az>+QqKk}i4Z)vb z!Qg~Bz^0jq&=SzJc4;Nj*H6(EoqJ`5N&)e*9bjgi+HmU2R=UGa7~#V6Vs~36Wcz=d&%h zuLT#4NB_m5DMzBEQ+t-6`;c-VN_QF<10JEjuek#Uv9oK}(^U<*2QSXQGp!}>RB154 z(8_p_M%go}eUzb86YjaEq0;6NHGzT9H~`)nb-;~dss>M{AX4M<+LDm|w?-k3W=&fH zW+zqP!i9Lw$IN(`-TUDSR@>VZ$dTW|j(*-{t}T_Ox;hiOhf8dwHa<|C#{ZPW6~ zd<%41C}l)4?=NPF>@OB7{ZxHH3hIc^Snot?^LUlAf~JPOzjooN0S7EI6cUgC16?!S z;X0kla1yx$jQD+{4~+0sFTAeZQ_$H@dwQ_HGl08S`bFliGlv*nzvc+O_iw+02flJ& zaX!Ay@8>FvK~H{X004)?d5c)ax(_TcLS~da7oI+FZ!R-^iK*jnR3QJ={>;H|<+ltx zD&^Tb3~I(k-k46<$sbY7NXnXfqbW8N(al3gfn>%&A=0HvxG(^YHgB=X01=k0F1yuJ zHTf=Z!-%PUHZl|YxPzxMA~#CUx^cS#B>>Pm!@w^7^w;`%e>OlR*5t+{>6Zf949$GL zT#v$xMk1>#+5Qd)cy#=PiIcy8wgEEgefkQY$<$r`YF53wkJ_VzIc^B#Dan``tDrn} z`K3JDHpnS}?8%5H`w?b`EzZsk(?UHq?#e$P?HmAf+n<07h#Y8#VMEV%1VDj>8GTq! zrFulPL6qMiT{Z+v5Me-+?hc86gQgLnK#d+v%u@_Nkj0G%A?+@RUYtQ1XfQaCj%@n9 zNU;SyolV$v&Va2k*Sf1`TbD&&S=n2gWq&$g_ubRj_Q1_pv45pQxIcFQ001Z&dAWEf z_;ZuQ_qn`^E)Gf!#pvz3;CZYB{r*l+ejgo>gPXdfP-oB3=+k$tOPLh-j zA}HEFHSdkmFe8{`cM5uAXK(eENchna7b*%xo7(5&EWGsvu<}daDY)m6MjOXv13QXv z{K>1rb#zq0^O$_xzM$!Nw9Ywp2WjPyKdqN0;MO#zJ@iIKv4L-rOXi7`BX)77qn}G= zaK?00K#Jv&o#M%Ri*`RwkjL`nTUpV*tL-mx9!xId>Z8gtOIjJnyUv9j0>rq#7#X)7 zGJ-ou%YnW0&Tj3C7x~z~bW&#mjB)he2=lqm4cV)J+_moO5IrFPc;!ABW{ZstuHn*p zUjbL#2E4+bPa0&8#%#Ri5CM=wkN}AM#dcK>1|g2#8*bx<5NH6j={Cl^L4&2mhWttV z?ZH47)b6pm`5Q~pXTS6tmAAIIs^%-gdrMDZ<^EMg9Y$dkCrqP@nR~F>aisPu(-k)r zTKsh(jebQ=`lH+4ey&`b3v+Coxt3`=QO}XpE`I*dG2Y~ufe*6JENC)@#pTLIxG~@& z$aTmT6o@TPfPksA0KwB=t49t53?y)RcLaaM4rKtoBf9Ntb$<7yBi~o^)aJPdBg&z! zbTW4x)EIF}@e-ubVti}OgqA5&D_Lz=(O3IwMiz<1uDvkjupTdfRg{DLl*+DxyF6vx z{EYHg$XlqVg#lGIuFZ>qh^`?BPS$Hwus0#P$fF^SAc283VK{8#>3wO-UuYw+;6BES zWBHU%OJYMLCj&CDkyDB(uHmqk86jQu?Wjxxf`%EB=Kcu^3R%)99U~sgQG3T*6(bM% zh+ysrI^`(s5dcuYAiZk?Fbu%39m-+IN@M!w5TKPk3u5&3Sa%bQr@C*O-PVD*R-FSD+JD{@-RvuV|t>4;)sS{HY&rS*0tAp+Jy8E~9!-3oP!<(Dl zz{V#w;n@1O@b=mn-04h2JF({zyYbGNchH<|u;Qgv*!HcPFnMya z%(Ek$zW6luetZvJ-}E|8U;I9rw!xBDm*T3&ug0nu6@VStatM1r_B>8pdK{C-r?C0^ zTd?8j4Jnt%=(n$Y3wwUq&~soFwm!HGQzx}ek6e2gdq2KM^11r4YjDMr8|D22_kLa5 z;_<66v;J+&tee604{gPUXEta)n-62(oiE^>HODYWZE^iWTQPBJUSwhCXtPw7;wBFI zo@JRka(PIQH!u#Aqyp@ygGjRoJUR^KB^&bG_H#U=JadEZ>lT#&A6Amr)q0uS?;^+G z3_(}mX_IkKrj2VyJKZ~1loY93vOr?IbN6zvUyN~0&(s@GfxKihsMAx_lv$n(eLl}_ z<0%v&lh|Zq>f)BQ6pc`VK1ULj-|Jw@*GA|yBsN}nvXOLpX6D;nKQUjqPgo$p{0QJ1 z4P)%KZDneJ4SWcM+1VjNNS6mS1D)bYyk|gV&2cQ2#PGB0o~tovOuI2~2}%>wkaLW^ zJl26DV9NAs0@o|Zpa6(#t(aA^!zuM$IVvm(tCX4OB^LXj!wDcAS6rtSqR-Mdf0#@B zUO#lmHXyPF?F>o;1AuRK%!#OZ z+k@NC4g&UmY>&L#@XY17{OK$3_&@&rnNU*A?{YQdqAmnZ+(6S#EmW%%fSxf4_G zP2tS^GkEKYquBq8FGMhaXux;fJ&l_l_z;%jJ*c>G`d2)F-fY>Vm7J>$T@OWXJ3+V5S5rLQi>aNaCl{Mhr@`T1vY%U{H@{8WHS za4zO~+W8E*r4O3Jb(E|7FylQhs6GzypFjfd=!iKz!f=?udVcP<3J zD*>)GbC^&I)dhs-7Urf+wte#^EPH7=CeBV^{<{ls{daD}n;YMlQy%+2vJYFowGGP- zF2lsx0hYbG3|qgo4g0t6tHxjb)3sPTy&m)4pTyM3DctzrP4aHVODnMa<>df?l?PU0 z>A|Hqwd6f#5VrrxN3r6-N(|06nD^d1T>Hp%c=PJlwSen|J{0RUI6J`dgUfN_ zL))9ram^d?m`N!vD>)&j{(W^Rm*g@O7m%WS2URZ_++J==cuENBb30(Z<#n|@s4;6WB`{vEAO>g+ljW}xB^o5V@ z!L^TEhqceG!^HdZu;kEET>tH@*uVWnm(TK-R$y6bixs9VID`Of|LQMdrL@H)uKC;R zaMZR%QTe$nh|E^!rmhtDLh>SS{-#Dj-ncUDS?)Z#0Q5qZtVqdY1mQietx?Wrt92Tq zmf85i?B;iEPSpQaiaN}Twko4Wdu!etvvd(EMucC7_a=X(XoGGXo&L1iA`#e90T?{FAB1Mx;b0K~>0 z2xxG2HZB|lD7xqg;CXqw79=oG;JSvKinxYgm@fEg)A+JIPxxR@|#ew`i8qGA2+Pap)G)D)d>WMB+Z z>smgSOAam3VhNZ$K7}(2Pmf&^0GwQY5=&oO=AJD*xD+Q>oUF!Q^}?l|BohX+1N}aX z--q*t!tk^6&tUJzpU2^A4&(Hq_c5FpcII`y!PP4OfdZBuTo&tP*tjV1ki+DONu0i@ z!owa-ch%o*!lQri2$mdNf+dHSV!_)NVcEfDSb9+T`p#wVU_~;{MMjRE#h#wyQ#ftf z^qtl3;MTuf?G*CzSC(Pt=bmxtTwBa)TX2|Na29(%u?I&sA1T|yjNWWRL;My627$vvwPq+5~1_2)($DK~>Ibkx!@MyxHUF-FU#(H=Uwr}w#?W0Aqd z)3U5?2%UKpq*uU~^%NM@i3r$iMmi!2A-KKb&a&ma2tl{U6M<^Hgh`sJ#dey6ro6SS zk|!zFo2Zl_Wvxp7%Xm83@;(}LHSzL*-w=g?hwIn6xU&6JP<7km<605F^# zg4fc|4u{~;J_7`5v~AcpOD$WiG9it&6VQ^arC=ZwBiajuoNRI12&mKFQav&Ye-qyZ zX;CEW3@(c6DIg&6urd6Md{WTZ26N&ednha*;q-`;9}^T8Js4n-p>MA&`V~I_%s(-IoPw(KJblkon0#*%xBvMaSU9r~ zgV_OwQ$sxXAMf|+#z#)$2ZK^=5FUzc0~gI)gu(0pvr|KS`%4cv zA*kS65$SP2f+~$#e7_1_<_o(*K4s7o&*fs3T{VCEG`NojAFfWZEqnSN}d=oQaGBc1p?D z%*M{@9BMlsEN`h75adCCk@}4Vs2egiS`<@S|Zb zgpwC+El>I63%ul(mvVe*tN&U@oZ3q^8k+5qOJWkST^hX~CxKPzj=Ugq0!bsZ_5v07Jw-uJfSb zdlb@|3Te|QXYuv~ziR`?*9^$Sm2Jc_uz=Ks^n(p{PHy89S7F!PJ2A6v2D9^qm{~uA z-M==CtA4!cf|tAK&>|eTV?WL;ID<0_&fxI%uVMFH)77{a%`C*>>kcBE(#kiv(SAMb!bp=~Dh9$N98T^BhDb6(r(PIVQ z#p|%3jNe`NeB?M@xuf6p#aB;GkP#mrSi_6Z+}Z&v5YASX?M#@1j!S}0={p%Cn6D@4 ztc$5o=P)Ye-M2;{|E}$3K8y4gc=k|W_-Bv6bqfz2HJI-psBbg8Fk$`l2Asa+G@kseALIQ+r?BANi?H#>8?kO@xs%|0!>#vy z7}Ix6<9mPjH)sb#EIzy#AG+^W{OETdE&9w2-`R>?pPt5!FFuJtA?`9rA>Tnz+h(|a z*9M$kbQ(|orm5FYuEN^s3sf&d@0Rc0fCIPh$L_m!p`ACx)VuSs`i0f_@SooyaaQkL z0~!E7{gvl%{L*(Yd3*}j{$NW91TxoV9#$P#1+;{pergwvtvLn|u=JH>*!08AwQLNr zta##+TfTN1cHg}VfBWygi*_)?qC<;u)7Ngr-~a1zK!tUa<|8m3ei((5Mj>7IUZ^f4 z)5AQyqAZ-w=-!4Ffa*MTvB+=^LFR#bLf?4Qlj7@Flr<(Gs8diTP+n0bT5$h6;1`s` zwl)E9Yde%sTLzhZ;bh{VkaJ1JS(1(r#rx1#r`Okw(Q8xh+bk zO5RWd4Iae?z3K;O5YnQ(KtLNPF62w+2Qc>nhHCW08=%IT0gEp__?|@u(xr&;RKn<4 zV9!%4?xmPWy*Apm+)&(H;(_BfY&DLml3?ncawMHLYS0K>5-$WfF|i>pt2`AVoMakO zeFEZ|ieX?cCIJ*M2!sLREr{%}PTT-dJYRu+=U@Gvk%CyrgZJKt<nqEy`hJjJ_~# zsu9Z;KKM}UtX(v9_0K&12p#bc66UIa=BTtBV9s>!+(Z9dXZ}hR6m`V#;amU9H*oiV z`1RC@*{JaCXH?jOoF0E4OEOKoWoe9x+eJuVs_h(fQaCzN@u?lw7aK;f+2~d|lTwsr zkbG*>15(fPYQuUEbDkaGV?8w7CMrikj94)5S(&=k?-al2=t@V`_Jq7(j6uVrIahZB zNh-k18W5(9x2dtamSogtf5SFk0kUJ6ec&t)wU;Gd1C)PVIjEtr#vW?yD*aO0g}-zB z=qm?8+!ojdU^r|s+Xl3O(3+F# zyhnh`gALy1zo(RLA)3#2~QQYTvux1WlD|idf7)OQ%Sj0RYryNGQC&F7;+$8U}KG*Rmd9O zF8V6OhII{tFH&71Es#c$yq3ys>SLe)03ZNKL_t&@q~vE=ql>o{BFI?(j01wx)Ij-e z>w#Tg=xP)D-UFz5u&(aHiGT2m1Bg5Lp^0MvX%5$;;j8cs*Kz- zz>)Yjvsgy(YOsk+I~Y%c)Q%r9tprsxwl4r~q)tMoA9NJ?SuQmI5qn2iM#;3h0S&@^ zvwkL%UoLNmG^G#%nh?_rlUE=hZq?)y40(!THhCH*sJ4JG3mIrl)lIIFY|)7j+i4MV z#M^DGts=;k0wbkviiM(%IOiE`wL|vYhAt!A7xzMjzVfTldw{^$MF#Llx(?#{LN}6P zV+OD?*UrgGBg&+$bQeM(G5mmSN~7FT#+-w9g;tbxa6KVOdomayI4Z0ftBTKvx!~$e zfGIQa0%YB-1Oy~m#1T^b!HcDIg|nu&r1`cjx1Ws*1oHT~``X8`&x4O+KZ(?53yYo7}e|E*DkdIHdEn$a!_x6QHOm%BkMim!=R}#aqL+ zmHGJ4nzjn@C}Cb(qSJ4>RzR>Dnqtbpu3JD_tQV3SP=RK-O;I#MVm_gXaazR7ms-w) zWZi0{A-0$}nE=qBiRU5&01cU&5J~DVAi`t-W)Uz;gf_J4;v`CpiWewF5Y~>dX29@f zR1h~^e=H~x>yBG0f^n%h&rmC-!=8*Jr>lBhc&RJQ(WnF6ryJT(Jtgr1fE2R*b?o%@ zh{edmFfYF;&Bb*_t}M&h5aTA~w+f6(!|P5Z%ZaTO$OeZ~c^%prO6Ux^cV59xL05L_?zgtbK>LdWWlgrJx8gccKnbRkd+q$T*ODa6p` z?P&B0>8>0Beuj<)4cNt=Poc2a#Xbyx$}_bfS-VfE@ok?ADnkK+Fl6TffY7#)o<@N< z11=zeEke2sidPgg(&^c26`*Gs_%#DIknc9OTa}$^9P4I9j&hmr4dZrz4JJyJvD8Xd7EyslXU}aa7XM~h0KPHdB;Xyj6$joky$t>@@qh6rA>1%AO@s$CcyW0T{Y1 zmypJhHVf%SL@w6_(mDU2M!&CHw9F4H_o)tf_5pfJV_=%0YawRa7Ht!cZjQ3pVt^(c zWgIglv~gO1y(@{jZqI;Wv{o}G%i`$^VR_0>8(rFwOr3R5TV2@glc2?Eai>6Wcemp1 z?(W6iDemrGw79#wySsaFhnx4_`R0E4Ba>v3lgwnFefG20`mM)|V9=lJNEEhJ%c-*Y zI7jgq#K%iKde95<}OxyYTwCH8(?%v4U`qm@z^A@w*sf5HB=?L>@*a;1* z5z_a?0hO98i0Pk~ETBX;M88r!KQ|aSo_-c}BU|I8*$h?#)YIz9yTm&fTin2+?XK2# zgj;T{d5u*(0L~@3pAD~V`=9E(AD10=Qon|NGf=krkQ$Sww*hk_j+&2)`~fK0m-&!) zg*gd0s#+FpxylrhN(jPxE8nXzser8Io=?0u$R3e#YMt1sI2zxkN$#V*V0W|s1O)+y z(_jz--Ty#C>I)!1ps_R%+t~lS(~4r1(Le42^r*Vo!oLk(gS3BfXFl%w-Ol+J%r3kP z@nbY|AbYt^lJu{eKO|0!63>6V^KY^=Wh1;~Xb6@iiO7tldyxjt_>={Z;-dD%UW$b< z!bz0XHpBg69NdC{RjJjn5QEa|oFH$0#O#&QkBEJMb}BR%jm#IYIs0cW`?MBli~mp3 z>j$96O-ji0PWy!`)G$OrH(x77uz{_Lq36$4iI^OYw-M=dWaaQMc`o_Oh?5|6KaD^% zVjimvG-7WoX5eW%kH0_^&b*1k7vKd2-faf@C)V0o5hrBh5hM9i9vq-RteE!3?h za_JKIL$^}FhOysh)R_3^@b{{+;4Kx=`mRIzDsQ>rau{Q-TH&6R#-pu+N4RZAi?M;M zYswKc5$RlKREu1iin`44huBI6)iI)AcJqjpQcjnpF)p}({#{gFsJY-w27e%DA$iMv zhViLTeK26xMDW}vX6>hY@H$0;ek6Yc$~hN6cYevQior0QB-TnFM`z=G79i^D+qh;yA#$~?=-Zz+2zs!pO?H-UqFI_ zLH#wht1@S0WF(Zb`p}W6Ya|2t19zWxK*XD*&Z7lWd?NnuBZ1sOFblPo5K`PZm{z$e zw&a3Meu4ypcKUoGG->P>sec?$^-~S;iIeD$e&8(gftkz?PkD2i=2sok>4A}h)k@nd z7{~%{uoZ@k(3^`sOe_fr*1SjqTi+PeHmnFXAnCYE|7%s002M;WBD18Gf!iYH*5dCTCD556%1htrwkYA$5*D#91g$4pP=3+OD=!>qvo@ z7xB!1`R{$*u-Uq#hcA{yaLLGo0>cw}4TT7hC2xuseFq|!VHmNGKn)fcs#|vDXc)+w zyM}2puY0c&yWaL2$*7DOatT2xC#xeS2lbv>#ReWzeFn{#J8V;xpR+n1u@xCVh7nwx zUrWC5Y1xeFpI*IiX)#mFBV;oz@&5s>w{s5du`xK`CBEo@>;+BN4>9}wpg5%jREI<6 zsS#-*`{6@1C)E^TbKD9M0Ej1z{cHepXG<}+bRV`rj-0KcTSSTt_H_q*rB=2?+G*3b z5zKX$6LlS|;UmHl|HI6%bT@Q+{|}XqirJ=iKx`#rbP5h@ZZn1{mNC#E!7Y|e9X9t% z9yByu6qDwP*1_F`=T%?&1~?wNi2c{Wp4xwE>VKObOZ@fdxY;dufPcq?JOQ*@9R%eM zI#llC+8=D$@9T3TViu;>My5?)?ROx+AsMlPu2 z#hy4@{mao&A2M981O<5O5zo!5<&sh^dBq4oF#o57pDqopx(*?K^{(3IHGaqAXegfH(D@R)z1%I zZXv*WRD%)J871sx+*F8@0Lrq;HU$X_BFeaUMtod6Q^17c8u>8Q$9^<4isd3b=oSl3s{uFE4A_DoqRr-ruyxn?T+{?1VIcdz#ZEYnPL|aG$&)!3Sa_oRr$cq?+Asnv?%3!u z0RWaLj)OUVCGa-?n~qc{_QJO>BnmQfsSk_c?9;4r6(=b`1WCh|38LBcRGZ2^l*FZ? ztT8Qk8w%pT3{+^6LVf?KS1V&0rT;X`|qn+XV;5^1svWZue}ArOI^XN zZA%iFuJoRmDV^2Ow{o&TVg1t%iN7m#7;9ZG3SqaqSyM)5O^pU8#A-3(T|(cWc_9YHk<6O2+{kuK}wP-@=uw9L`&8J&XdQPXYxEG^cfJGNI?tN z7@ZD{@+RkaY}ZvGC0fjlle0%D%9o{g2yK&!p6bSM#Q4K<-}dx2`eu&9K3r#}1=1|3 z3q%Z-Wt?%^<(KI2;)B`)#WYIp$VK5OIWES^CIMtf?dKJoko2*oKmK-0n%>&%I6EIz z*lq+Tjl|tqS~1f5?)G|Yqt5kOTmdk6bd}gpb=NfAwOIGfe=00yGdUGjmk5htp%D!X z1yZqCQZw281@|5|zfnxA6!Xk&_FbVvO00~(9vWU*7< zHcHy(ldT>__6G@#66Cm2n$P|~Kz7=-b&#qo2;s|cLm1oI`-T%l+^|JXYA_qV8lD?I zFpP#(^}(jCNdFm4s2$sWnx&}AoX^Wg=y3ybPr4u6HwhTH;?F?q0|Tb@ZhUsfAr~(- zBXTxwm@1!p8r(elv{Jo%zoxXihxNCdUR4eneIBCHa5h6qA<+*6G+`S4Uq$R!X}`Pc zf<2A5O&aw^Cm}W@G(>G}vuS8u^Fr?SdFH6=l;yQYM5W!#->Ho_$N6sX9!TazUR($?&%sAMuC>x0M;RfKii4_7GM8^d4^Vafrl!57WjF52H?p59=dfena28b^m$~6{K+=FdEbPDvVJ| zG|}wncuMU&a!o>SvHI(#<}XrNApPtj>P%f=2Fw7-ai_GbC| zmoK@>7DxaHs&|f-V7Pqxf$e1=2tsE{|1mrX+4ei`Y%~y@Yo$*5$TJSBQeGVV&dclDIw*}PN`6>!4fV6k_R2mokM>c!H}re^Srxy%4&gxw z5!%x{4m1HPWB$}kevQ94lFJw3J?1s%$p~JEw=z4_X+c2^WC+4YDDtQcZk?DVlu+l9P7~6+CbE5 zzefC`v9JJHmAFPFK6Daq)~HzAYn(!?FOVg!z2as}i4L`7A|8Az?s;WXL zedAuU315?3Ap^2yOPr+m&Sl2?^#JnnzC}yYJ@vv~LpK}pG?6&WtcGhM^5%YglTNG) zvPAVCQrsyfThCw13=%Ijz1+SO$;$3TO;qho-&b)y@?*Nrj0 z>g&@20>I<{i|Jx#l*+4`#A+HV^TG|Z84Q*z!hq6_c>^@tl8sI)(#k6*w2nvqYstl} z<3yF|aJXev`bZc zXHNyLxac&2+S&le%!p1eJi}$ZBwKMQee(?0=+)0>?hjtcP^J|?Y)-j)rSOcppwIOx zkm*q%^%&f<0}&dXR8-Ydghm6q0jn#)Yw9*ziGdDHmsMY`@$BZKR6(K7_z#twf>1RT zBMv{&OmCMA7{+{NrElkmI{OL~J(H1Woy6*6yJphOoJsN3>v_Md|z2-@v)ckX|*qOiJ?nu%raN0#V{jGps-8q>w8|16>l zwHWvsL29-y*g{G!zh#@WXfs2un?7$`-^|5NBT0@79n&b z=ehMh&Z9id{6lh9cifR$7gUPxW2dQ86N?~9v9XzwMfOfiJs4x{SaZZ5hE;i`?PnPn z$LyNfeC{}-agLWsJItpWr_nUB*=)(fQQrV?qmQE=Up1%&(wxjZ%6D(39oC30Qs)vQ zWU_gEr_SW}u>EW~8Cn(Wk0d&yPCBB#1}gtPFHv72?{ALFZbZaF(sDGeqELtIclY+2eSw1D z59CCk6n3^>%efH(1nd#JcPepCYy*TUuc^IAt5eGJLlkw}vke8V&x4?G=xZXm3$4lL zi=uc=`OLa=Q+=2fJMl5mt2P>t_&YpP&Y7wW#$4^X|8pg_$Xy9>+l7|89vR)kmxG1! zExP|yohYyY!)ORIyTA0$mBB|1RP)2D*1tPU7qsV%r-}^lqwL;0vm7W2?x^YBV@~Yu z>t4>b1Epg;^ta4?n7QXL)En(5b2MF72;-|-b4Ak$GAhkfLg$4XCX*w0I98h+G*MZ1 z`j{x-49wr^Rm*sLApvpfle(k4P4We9g~LQ&M*@rbD5_K`Y zB58@F4dbrf@^I?Lgqr6B)<#zD7 zDGDMI+ON&IjpX9l4mBtPDmU>kxY8Cy!?-R7>=WG!D$sIi(qRgJpanF&#AMMj$8_oO z@*$B}WW}-Be>&L5v0y_GS@qY|YGzw*v+cZKb?*0d8p3fH=o7&Hy8&jMN}4g$b1lp= zWQpTqDzyLw%;!#`#+wp@?Oh%hg(BpW*bKO8&E5_jeVt#-)bt0&sJTY=em&2n?A;Xerk42olZ7Pjemg-3oSY`x;1nv7>@&GK!m+IM zdZjb9!HCQh!%EvcyW8w0;Vh!YLCg@;O^!x^o0jJcSJ$Z-JV>gIy7iO{iJYDF^|2Jt zD;Z6UOynxgaWpd9+mFA3*fPjj;`Na~oqypuOp`lU?)7F}=O#%oac>ceNis<07*l~3 z5Ij*TW3ja+RDBB8mJG`(Cfm~pVa(snqMSmh3g4L397Q*w%{IfOqQA&?xH_){M=oBL zkdHeb6u)j#zn$HQ9}rERo#=0wbT6h1TnF$dUc$H!z0V*k@4d32qjvl>b;{NqM)V`n zxD}Qm8BD&S3%z~HJC>5fB`*B!a>3vSeF(QdTCzS?V(VN#3E}+n8Zlh8Cf4mAOV>}S zTqjLpPpaD5i8P>KVVJh3(kw0p9#nN?`A6=&#GUG(s4})46q%$4g-WacV!}@3#Y9IF z22Ld;IclC;h9QqQ0mD4)I zmwF2UED*BG;&M}&o=^LIVKcbA|Lm+92Lx`brjoZ(2!mYEYl_R!QrnR>|0SW<<>peG z^8bjOLoJ93HS=KX(xK+@w5JO$+uFF04tKwj$G>TDYO!oB6It%Y>NBfH`-6Ud{%lXF zF@s9XVtHJ0m|ZciLM2$#UD-{L8@pt{qodChZ+Cc}1vkN^_ZMR<#q=nzqFx@O##&T$ zzKBMt(P|Md31@pk46+U)+D2WV^>A65U0&#qOfE~&ijp+S=M-cE^R(4s9@Jh?Ty{VW(nzHvT z^`k*gO~kJ?J+I{>HW-h|7~4tXb@P>GqBGL(>I)q=pDY32ShUor?F-7t2RYeElcWR8 z3^_-|DM{%kd9Y!N<{I;$fU;_9<;6r z+^t`366^+Pj8nJOKE)Yh6+K6$*K?A})i_At#-g`}b?uISAIVZpEd?P;L6gil^}m^6mA*%gTEk z$ibKlZk*+@dGCXJ${*pz+P{LWv8tl|H0aESVd@;@v9BqeH?J)Sb>S!yiIm>VzA3YQ zu|t7q_XiCd8wN^J2|Y--&dPX)t%|BWnx3Q!i50 zq-8Frob2z#HSDsF3iSvTDcK(>V)A)+KH{qcPK6eoV>eY?l}GHM77%oo>>eSKF`5!g zmS`-xqlH_+R|Xra{Z@Lp6yYzu-i9X@v6GYK#@_WrYj>H^O(bFKDpq1Zx>UBuk1@;R z9MFl!l(XW&wv;NAao1X$GC`MUOf@C0zp5#Gd7f$2%c+)U3PemhzP|1d#>no?dX3jq zWQsYRqe1it^CfFc#MJjFi8>R9xHk7A3`^NQ&S$!+R)ftg|0lPlCT1&2Z4GEE`2ONgK~JJHK#k< zwX%qygg@#6tpnB8dB%>C7pOFK^ap zIe9#AVa4a!`?Z-KlqM8*hN6~8u}ewqc7gIL*xmy9xa)r;HD6@19I@daK-lHvcrW!D zFvaY~q-1%u83mTdqYqVNN>dmk%tc8V^L&paXLu+k%CS=<#UY4^b1IEFztSXJ>Nm!i zXhX1>f6=g~n*!)mF)6pUd7RM@ut@$m3yfsRa5)e>)V-0 z_YnKrAe#K0|M3DylxQKrv;q!djACCUxcI*hYW!8F>7<4sSm0q!GUjs!>L*und6@`L zSN)RGm~OEJ7WCYmsQ%Q|DpV5)}q=|Q!o={AdQvGU(qKgU; zAVyitw1=31sJ z2~ku(u^Mu*!Z|~>2$4m+Lb4|SMQlm96uIgf!#%QqKt|);LHOELuDtvA=gah-8(O1O zx`#SwZC-X8YCd57i9X4WFQ^1mtw@gg*m<3}3=x7wc#^wZUlzCb)T~l4)eU()YW7PP z_Fg!I;4P=i*2)7|arGQRrx>m62)Xs%ceVXNzZLS@<*)@K-u-*@@F=8M$A6X|MRd_q zmWMq!MYwAuM~jFld@^x~e01wW?lJIQV<)-7aF2<^E;L?f_(Sl69S;2us4B;zTXHbH zSRN+^)K4nF0#diw7(Bc2Ci$%N; }1Dir@V%*%%4du(bZHmt0C!qCggV;Ccjr593 zNE&L~P7^quE0PGxg-HMgvN2Fd)=#I-lgPLB`l0lqhP@MQfNUH;oGX2#0yz75n=No( zfI3 zRUh|}uy^{I$;H&GrpVY~~AdRfX zsrEn$X<82zI1*Lz>KnFPfg20izUCf4bV>Cu(*~|1*;|F})}3?}nMnJp zb#k{H3MXl9wshx`1SDfzgjW1Edcum5jI~P?!(z^if!OW%L%xR(MTmkDJG0A=`0Cvw z#ArB-sBzso_B;|E1~Ue``d-Hr{5 zCfOdIy6y_i=7)>+uvfMX!dd z`&z9S)-Sff=t5kVK=}mco5}zk9ULqXQ{Ug2b7xvK3qF z&;#EF@=vVA7g94&U9CB7i{p<_KtRIBwLu1GdQ*@1s`6%DR7=JzsKOj*4iFCZO6KxpYZ~xj@9B zE=fIp*Ko_xmR1Csd=`vEq;fDhk;}ns+0dMSZD{AyT@XKVH;^%iK(KEAHmmjyUu_5A z2|WplF}gw`Ofhy(#n_GB>u|M^#433sI|#P|zoifi?O#)Bzb~6=x9p8(!mfWNRqa&r ze;~MQbbR}d{waZC<8Ot+CESASZY#d}to3PHgMYO1MTN2D_j|<5>3ws>*e)ZljK2$Z z0)O`P-^u4abLvNZvh#&e&0jmOXDjvBb*^^%1>FBozEq7*j7?qcKwN@O)Rc_9L}WX@ zNKF1#%%R0`{oOlAy0tbOEy7MzFv|i7@Y);G>l5qpAoqC*+i)|R;5MIRQ-7YNS_hZZ z49*Ucw=EAS*$Hl7w7gxbLQE z_HH9!N=q2P2(oOCU?cxrSZ0U7+r}9U7>j&jQnD~X)?S`gg}?fuJIPZ>A&rQubj#xk zxBnx)tK?CHlog_GO8`NOgLKJII>?R{$m}cHw1>s_;1g+t8G1a8@(NIg99<> zz24m2r$j$Ls@Bzb^|rSg)vj+U==YMlIuRpu^@3dKy)oss>L8TJi>h57J@gcm7G;n( zgLZNUHe)X0C~&ho@lyDmp*}uxK4A%;>n@sK&LOkk$C;53@S68TtljsyXgr-c!E(T| z=Me$VYl|7UM%$pXFXCs7!tHV-!RTs)G&{-}aO`S@|If3n^{K_JOt1nVMd3uZ>;X-Q8yy(c34UF55*gwu5EfDZBeOd&}1Y_|0yn#Htr+B)Yionj%jL zz7HJ#od#WZdjDIuqj-4lg;&298b2Ct5M%Iute>qrM*HuzYuPU(cx{)fVHL=BeffbA zjBVRAJ}>2MHLpuWVA^g2+V9^>5sBMFgxucXYm>o2#DCxW&F!$sMSrK}w|a}*n)kaB zZneSCf!nU$2R`4M@0P!e89Bpyiy2r>w0QNg{@A=%e>i1AI6}Pc9m*b>oVx0-@O9Vv zYs8ihg(l;AqFIG>Be!>5a^H1s;B0M1SR*J48IF31&DvIP)bGd^>{VN-AY*g4g)TRO zP0|B{W(=424R*QJWm;n>K&R@U)OzpquMfZ8P18ZMXQb02k;<15gm#JDJhc8@Ex%pN zJxYr0_KSM`wMGz+dbAsEt{dz&FlaF&rvXl=mg}D*wli*?Z9IFfO#v|h%YNE&YAepa zLWOzn%I7mSWBAQ=0retfgyG7l#g-q1ZSQ+4SYlbb64zfcQC}Z7d-3?!NL}u`|a0tuTNUKm=0II7}~8aB&!^)5clFEgONOw<{g8B zo#q`d@;dN`zH;y_;Z~5=;O76Sl3n1=GRo6+4qH?RlL)`AXTT=(cS5S0){~x$n*S(4 zc5eUYE4psPt(KXkv%M*!+b!Fk)r~U-cMpPO0?qI#D65hi~fbcghxM7kzxs5S*LLr!-5Qm{KIE>x8T@6 zT717?{LNDre=6i!h(M`?$y@ok)VC4;)R)X#TR?`8kw5%|NI*>gFlMcBS=DSyibqaC z!a}sk%f!8mp^_PLUTdUXHb~(k6VbkiXhnUWRlnF_cmRnD1(D6p>e!~=9D8A7t7yR6 zCZaJ4I`s-O6dnj+8gl(pz@;NFO1`z?S0lb57AV*zV-iUpStzjnR;LVW2^+GHQ{>UZ zA*WHq8o2_2tXcq!B{Xgmf%Gw-{b%#J68HijH`&aIfxxg$p;(0FFTpFjaSU$1E%px0 zg{dEZRQoa7e7NoHODWu${``?4&O#IsDu8I$6j?75L41WZL&mJ>1%JIaIWSn_bLY+84tJID0v%k9t>;$L` zCb{bPqc)Ed;uPeM5=jX>JF1i!TG_M!TX~2Uq%2qGOaY=e%x8?m-s)dQgFKS^ttqI8 z0x1IUST`_7A$}t?L=VfO2ruY0K>q~}ym8+SfVgmk3FPfCsl9$$)X-2S(nRv1DXU6; zd07aQ5p*&(uO?BkVxi{b_UoB5D^vmP4CX6KF%?&X1@a#>} zu*C{;GM>#3(7i_|urk@q%DdMF>9~#4RJZzb4jBIR4kU@U5-TbMx8#6k?YTmW}#r?a6}t$?v( z_wn8|_PuUQh679hs`N))b1k^=?*CNf+I!o(tqaEH2LpjfB-nva)-5KM6q z$V1%z@o!%3vf4O{9cA{pe!PZ+o9$63;i^$JAZ}+}gS5Po zF6I7x*@%i>n`iw7{(t0mDi3Se+NU))U3v>Fm^L&eH@lurAt-S>Y~EvRU1El$P!rAS z>G2k)p9rb{x`9iqf%WC&aMggjjLI?E@J%9H%2t(FIEL)77DtReq3Hfzl$nITDy7Z4 zn%aplON*ZJ52}eKfAc8SjRGfz^QlQ4W01%@l^OS4mvy4KIsJd#0-S|=IWP`X#sW4I0y2TPRen9X=--XpJU7;w=Oe4l z7ALpk+3!qy!9v7#W7kut76Us~$z>KUK>cY^2v3VUFv*m*x2Azv-OVYFye%KBPDJav zqvgC!xfgZi2sVUBXp=;i?5bIHxpv_e`w62>jUr7vj5D+Yt zQyQ0sGQ>f*;q9 z5o3=~oKOlz|C-lM53}%Np13Om8J6ArhHK+$z zJ-FY{ti5)rqUwv%7fy<5S0m8lI*5M;& z@GShVA>?0y?{i7S(Wy%5nNim(#M}8{&Q1r}6)_92n4T|6&CUxdBD!SEcMh4|2ps)z z4YuepaC1g{8~e`)w%Nch`|pA;q7Doq4krsgy>4MITuS?%+r&-1+Pi#UXJ+|AhuCoh zZRBJpQ%S;{JEXKs8ptEIh@S}6i$>Ns@`f8ULZ{=ssA<;oNa3b&nClAJ-keLXAEtAuBC1bntkz2$z%;Ial-s46>&|kz5da7_Tpa?0dDVe zn|^Z<;55apH^xmpCph@c4p>}Y2lPeR6z(qojPHSMM}TPCjw_e*7jQ@TN93+RFsHZM zC-rM=$!-AobD^L#^*XiPnvL`ne2;E|jcx$0xa zbeR=6@I9VJ`?2H9e*58l`MuPl9?YJ4xbmrXRpT^$^1G4-|MVE1W_CA(Tk`Q88}^_` zM+!Sk$_2dLDK)q>*_8V;2}1j6bz(ffb@;xrhfPIX=Yh8ZVtgKFChvMEi9l@}J7{qW zXRC4G?QJUz_IxwGwP;CMo|fC+chQK^XO8{0??sSI#+(V);?SxtZE<^kJALaIZO#Mt zIznoKF=w{{hj1vr;-rkQ_e_TpLTI9yA9^|xYV;4& z6-S-D1vGHuk8EkMlxyJS!M1Kqzji*;PA)TS?v%hn5;a;~cp?bWmEx*r(WMR%nsH{f zOs^>cX+j~MO4n(Y(KDx$#GBu>eEx1wOwIhK$pWDnJPA~$Z95&Kc3fTb#F;|l%kidB zN;%2m*bJKA{pfpl+i{=;@>uT%UFVOHLI&>)IBCKn{!x)1>=bVo;nh&^GC-)h^5XSfN4w>03~4zgUj zm#|L%hI8N432&JC=8z59{C3KEzU$17b&Sy9LO*#ZHk+T96%9X%EL)M@C5ZctyFaO5N zH!9p2#t^hv@94#kh43@lETqB@l|RSM4n~F=g8k-V!aMjr5Q30SmH}ahKq6;OPjg|m>Ox29z@)okmNTI z6(;(Gd%C_Yv`u0@M-@>Md!`tM?8u*AJ2nq67&jv7#*lHsgaRdhcnLKRQQQlCxN^2n z2~Vd+uvVXXvgU9&jkGnYLWt;kDw*aWZWjua&Z1Nsq(rzM(YJu zM~rwa&uz@dkDc?0DXD{;SQ&8@4uAKk8{fj6G82Z5Uxy>OX;5v3t z+)&5WeN1>OUs=ui`|o3EDTIHu3&>HI?@smqrIme>BC9L0^X0ZcqK$eT)LVP|*l`ED zABY^>^VU#?DM}H6vjUts7`nPW|Md~fh)fuymP>u5&?PoN3;7AU>2+tyR7^J#&6?2d z9L~Ygfph^k3~U6!lAb>Qahlh^Ii*w(y~vd7+t{FfRIm{-7Nyov&|p?JKij{@n$Q{* ztR!rYs{#c%u*|BYx*y1^C}#4Fz4#R)0&trSya*D>&Wl2?arm z3CN4V(-z#Fbu-9-V_Ud95LG=SFyB37-0#;qCA!oT8RjDpWbZ zsh!#tA)7}dP}$^sGI4y6^iV!l+9xDM+5Q(r?`vb6srQ-Fx$UFY@m-*&&GLN;71zzD zcG|@xnKk-7jrdWwSK5qvKaSN!e!tQrX#99zHDsEFv34;OQE-mr8ywtU_HJABbNEv} z>689b<73H6lSb$5=3t=XayFIY5grvZw;JW&H;wY3b(_hs!Ze9ZbfuRCrq)=4FWNto zf=FF2QxD*DB-rxlSc4aa8P9w)%1k27D)}SL){CnkD++K}EesDWn7n$XPpl@HwD(Xw zElUKHYk8w6@ARH8war7>XUIvYMzPn=*9%3$Z|qdz{R-8Up?2J6-XvsJy7#51lptP$>7r#w&P zRQM_dmlj|bN~6n9-A@$g4m+D3jx(ggR<@n?BJoL7giN*Jp6=9oCkVw32bCmKRFMaK zv4bAo-q=`5Nc1_JS<;lrj_iogl}mjlWxpKbyxA_E?Md3lC#HP?L;Bom{qDvPd&WSu z65K#iQSq|5FV!!LK7hu`QlA#9CgE%$b9}dvqfm%3nH+?oe9b;^CP>k*y-zwGQHyk8 zfaDkp1Fr_U1N!J)F656^Sed=1(n{j$ce5UNLqgaG(Vy8=(`SxAe&1{e%pbIR?0tYp z3-}6xK~fmPmFBR{lhZnb2<$$2lS za8%zV+#n=M90{TcrDo!NIOotx@x&OEMEYHPnNOAlzlmN6jn6jnepUlO=wE^|dA&P^} z$|?M}Q|`(+o@l!il*Ufwar#6k$FI6??}rDCrZ&*LAPmW zW<&aJ!D&$L9AZtoI1x8te&kBukRh*A9!XWq^bBW{?6jn$rv^O$;%izId_{d(c0h^p z+C9%M5LVMH-h*2{uIV-#~+AbiVFM9?rie*ped^h5}cNq9ro&2M5>$-0KHY~}p zCb@fGhL2E2@8?4veB{C?Wj2{gA~0wg+n0qSm3n&~D!9d<;bU(6%OYL0=3sa3%BdY_ht@WoEqL8`Jcsi|OO_*55!*j{x#F0}dQ59(U8vHty zVuA|6(t~9NI2R&6@%0aY|E>#wQc@-jMgvlE1_4&_E@ASkd{gs5lGZ4?8{MX-9_$-W z1vbhp-qFA3{SH7!WawAKd8Rd{PT;Pt8CszOaX;?&NP_Kq5O%B~BzhEoU^5oZT#*Y- zK=Ieaq0;sCI>-vbSIWIrps#IUb@T3lon_@Tc)=25Q2h}FdsG%VG`yOm_?~u8?pa~) z#am>8D+r%9Ic9#1tM`#U|Nh@S%jj>|#&-Kns1wLfasTZ#!^(Cn>;()4**ArOlP;J` zm9&$=p~wexjXG+&LE>ApVSIz9TbIJ1{fjOp9R?>ArYnZ0Mgq+ouDo4KyrxgI#Qoq& zc6E9HqiFGi?2T)o5-Zqe(xV43CO!KAq|xnORm7P!9Wa^{k-x{8>cR`oX>=dv8;kyo z**tIvSR{5t=f+f)EG`fNDJX3`e@!6Yaw(7bA1?re0RX^?nBF50RWgl-h!`V;`vcbE zBgb+4a0z=D6=yhrV_9{E>dB1s_9Y(KBJ1y6?GfGZcX77;sA<%~Y@Zsvzs#K9!@*M^ zbTVOOihA2m95JzT={A}?ly`q<$lYe2YKliajcK32nzNK2a)mZxBUD;Y7|w(KK%n3P5nMpqvT00|3bmwPb4lZq z(T-x4zuSyRw39|B7!hjK$B2)~PKH^N+shhKHhM)TBuGBJF$D1yRNo?ui zH_}E);SPgrRNHxjlmhx0?&enZddWOU&Bz`+WhC|_^bH@_Wch?_nyvqWf+e{-n<@jv zFz)j^%imH~(04p7u{H<_i&`pbVHvJ*erqdTc(k5o1c=JRD>BxPR`GMGwGYOxL_u=n zrJxoi>T%L$A_zOjpl$8Fs*bylV?Nol`50IKpp>Y#5jJaHMYL!^h4x-#NeSM^e zvIymGYMcfckHG9qF+#te|HN>FFkyYxA%8)pRaN@)UNPzJ;VByYA=j8u@?JnbBg%2!#BUYEoBpU{y@W3Vb|ojj{VI!qJ^R*2G1L=lFC;AST2g1{loWcg z`xLhtbqsbeM^}%duc=vTz*4>#iqan2G!>_dvtO3u<>B0up=Kjqf#p6`<=oVPl2(Rs;0R(su9`wfcHQ#t-eJj~ zDdfd-jlv`_<||j7PTrPC;K8#yfO9n$6^aK4e8UK1dclw%dgY9-!#Jf;HO?(5Zl^}>_y&TefP zJ+kn=G+ym~JZ^=g$ngh#)8#-_^Lm#2o56P*!M-EonibQL!WSXsf;|j2Q zji)ge{L3c0Xf`<+SQeemd}=j! z#raHm({ZM>P;u;<&gy-lo zojO~p^(MB-#8fFq@0sx%VYVrnd?wK&o6MQg7Xm2#?=01kJ0FFc9WE$N%iS;zr{mwo zs^5%I{iiWcC4}E7NF{3i=(@tx2X7!ER7+NK&Xl_UT6reGwD(Ekb+#@w4^OO7^JycY zb6?O>)H^$Z-EZ(X@O1=kByuD(LyJQHq&#>i4l-D#a1PB81B}oXQG_`0xVg;oR4V@3 zZMEf3{`lgLaeMj~LYCV;+@jc9O+$KcZy+FEiy|RLn;39x{GR-HA+adgpW8 z+OH3M%Y6u(C^|Bwp1jUMQElw?Xc7JiZpd$>%HFU4S0S`JsM8!*gP$U zbcMlpxuXKM)2JnN*t@&mp?`+?KbY_dXQq*G1Xa)tkDnyq{-L8u62sUTUM;JWmdu zAege&Zqb!$=007aI-cpaq*UD{hiP}JP)@x>Rk?AyNwCdw36;+dyIultN7#gkt314f zk!R?M?rA;#^nlR~Jd6Dp$I)9m8h2suV}_O^?7S({Rn_uEQDMJpVcH-L4 zUyu9We{bZs6n@h^=i&T2FTnO!x8sCE$K$%sy%hlP;P*X%Yj3?CXFQ(ioblK$TzBjB zc;HVxU^MRk)A!=q&tH$7kL}EP9z6rseg682-w7tGbmqfnV%H#bvG9G*DgXR-~IL!07G`=k!{_p?W^nAf+<%r2EpieoB& zu=DhF!=gLST=xin?!8!Sdo(WRubj4JEZfnHetzqqIa8xi?vDwJal~Rw7)M}{G@_wE zAm_{Be3ZZZdrS$7MZ)H0!sa63@a6)CHy7C4%xnFdiv<=57$MkPBy29S<3GFr4sVWl zZF7OmMZOOV7?b4p9gG7Oqu}+;5t}2hxyY`4O!?gfTG!^HfDTAGMKQOaWMJ!UGMuy+XeYx2Q;nBc( z^k`>bTVP?*xDWv7w4z2XXFPrevy9Up+liNUztnB$*_|14O2DCAhp_VrrIYEN{`gKD zI`fd_d+F?h*!lR*Ada0>_iUT0w6WM|zAv^fOoA_+eGogJ*vag)bphD*#IBMhS)P~9 zJ{S<`vM_yppVw?X6uP8+o$HBIv&Tad+O6p5Ou!JQzSV zg$IjTSe+}-2!pV9zieiT6$dV@m<`Al5cDDme63xwD~+0>>9^eAblTL=Tawi9S*Ul( zAw+Zi#cHd7pnk3!U^yrtNOZl@|889gzEnV&lj=xyCspLSy5bw+VjtL?y=rOB7eeHv zvbuibNuQ|?ug_uon$yVjH#$?z&P$%f=rSC{*V7l{qP!4DOeIErbV9^<$^K-(nAF*3 z*tA%T5Xo!))|*Fg2RUw5Ns5g~8BV2J#81qb4km!Y0St^Us zBRzQ&?%c4smxjyXx142q8(T!5BRl8(T$xm8n`Mjhd5OTsik%9Gk zy_S*X@)_bOMZ1!t2wNwq?23;@DPml;ksnr2i1dk$QIgg4!-qXC!ZFsqU?4B;^ViU2IjOx|oe z=S!o7>$&!^9D1WOeV)~hg(a0+cJK+QyvQf7)oXlV5rmVlaF9_N;m#fq*(i|(AeEE$ z$5i$KfJK_A=>7ngu6KeRe;f^bCByzW)0us)LxGh83Uze(6hj4bajKSztsnG`n!nx+aInUIPU;cTtp-l(Q zk7bTlI`!F88h-XuT`Ir*=kEiDMh~2~AE!KXs^wWFDzMD38Yt1fTzL5(l~0}jR!Ot` zF+Z!6ZBR20us)$F-gzk3ZyyZ2E#YysS~sbN&%nSjc@qk`k6rf>b{95`bVcC2S_aqWo~k~e*)eo0EjttdvZVd@`%bc7w|I=Jf%j@252Op z0Elt4h^Dom(k~A%cpG`lqB0X!H&SSuonNB&Np@lt@v>?PhQ&cZDnKrOYL=lk$g5b& z+OF0R;jSC+!2S#NV{`i^ok%$MRhEl`C-Phwi}h=O4gg`vUtf*pEAJxMMl-Eu>yu-!65r{O-Kr4(z{R zUupY(-1(t9aQRoSm?9g}s)m$7LzuBo{Q;|V>s*D)(;D>Iarc18(Q+tD(+brr*VPHb z1Rx+W9fU{Pw28h*VcgH5psh2oLI7~S{EGR4!CSGU9z^3|-nM4%4WE(Ck|%(n8RHU6 z>E%?*MvCE&dm|zc7UHKkEW&s^qPM!OhP|6n2P#y_l0ig-9w0|40b<;(GnpZYpp zJ?#~oc;F=L`O4)u=iYO@eAA#dU2w;Rc(7RlW@r&T!Qnzb%EvC zeg8Rl?c~>R`^Rp>%R3L@gy&DhmA`uxzVXq{69q?@R;}yuFJFP%KK6BgwD8N9WB2_> z{v-jX+F34jo~jr+l+xCnQZFP-TUUJSNW3@2FMkhuSe4^?m$f%_2HTOO-kN?V7pf_; z|EgrNN?kQ&HwRTU((>gY$TtX7aoq&;R!MbxTN%#@U1sjb>nRog+|1_toeU+-(M9zoD4&2d;AV=qQy_lz5G|Uzw%5p&ocazi2%LHS_ptkQojjxo~ z`xZXRbNuSata+06321xO9rBWCO7K@68-p|pac>o5GZwF{-BO3H!)|8W0LLB@(XjHv+A zas=|I0K{=e;N9fqf-wH1T(Y+oy3m2o{ezqF;a~VDCKGjn($y=seEKH*_$NPBXX}pH zI!ww&cNI`#3>@oJ4P>oXyDB)tPU;!Pt*^6A(^*zOuhY*Ux=9*c`az+ST`PsUP90XY zbnZl+r_vN~Sb0B1)s)YC>ZbDgZIWlDldJG!IIE*CmUn`dy|||0c}^0&F=O_sF|g}& zdY!jsy1rL4-P4tMgE01rBvx1iN0=vXsceR;oGSs|b_NM@2!ZruvV&~GG?VrQh=hDy z8pTPD<~+SjT=OMVq2$D8&toEb5PNJ-`Af!UrazX`fy{xx!2w(H_VGIbB-5`QI@4#} zSD>Q~b0nMN(Sa5?u~Tm3+lbQ(*TYL4X6VZltp$_deFxkHrb@{-Y})mt03%f-r@^U5 z3yBW#Ei`xyKmg@rM$)rlA8b?@wn?3KD_wnJKmd#;>j+Q~&lw0@&Lu^UrPF(=-ynXy zRv{KwPAiG&_t{&P)%ZLbiN`3aXX?>+TFadCbXBVXgsEBbq{Hr|6@9`|`r`c9{S|1p zV|;aJG}p$!V~^k(U1Gb%yJaGD2~J9NI>qcZSalRLh$%N}@WBIr6=1Rqw5*m=_^ka@ zxCibzYEu_GaGQA$tHEmd_gOeP@|=A@->NB+S4`{v2rxo9T)SOgGd< zSmkaZ^*8u8b0Z+997Gxuk!ZxJZDNO60RZz)N{%KtLn&lnMtQ0bzqZ$}x=u%6PLC&& z3R_dU%&a%KtF10tP$~EJ8V&L^=;ZtG%b@*F5yu5-8y0Y)V^A+hX=cyt& z1zHn-DPyW9>l#qcs1k$fFvCfpC4=?b*37Dzw$>Q{Q|gcViFJJa&a=izAGNF_I4DnTMCi)pesU2TjPFCIqqv4{S+XDSs?N6ydC zd*5>3#d2Y#KIut>4ge^KM6XpgNECE|nw7g+s=llE+~Z|dKm^pk)8V_T~eaOAZG zBfD%ZJyv&gPYqlrEvtLgaQ?cRBj?gOfMIHBW2Vsj{UsUsYBxuN7AB}m^?eCX97*tX zO5aQs_YicPP|MszJycQoI(9(IFxj*e@*SNNrZILc|MJOApNsN)N!Uf5iO6aU+~) z3DR_j2tt#V{pM($s|w>T?R8LWT0}YWW!MGtM*SNhi1)*VtgoqG0sEFAeVCmYu9g?O9+Pu;x*)xC!P zn)i-0ts>7!05FSW1^lqNhR^2D&}iMhg&jp_6=XQ|zTH^T4g%AH$~bf!aPKg(sE3IICTunE+^Vpo2@-sH8bF_` zSCW28V8Xa4-%I(Pe)VJ=mldLOMwOpK)3(>4WKwWZ&2=a3NeoX{%NK&OUxT-~dA$rs z^bx`sWe@`c?CC<=ONO!ZW=c|V-j@Lncy4P78&jeWa~)80BB8XEqG(H^YqqQcwjCYE ztJb(PW^Iih4sq?V*+x|&ZR=wTb!6F#zIm!#SE-2cl2a2I;IS8x18Gr?#vTxd`Ff+F=pMsFzei z9xJ|@)1PgB@79!hSvM8~xAN50E3#K0mrHh-SzWgooQe{Sy%1(h(N|4!(ixHrB6z0K z7~d%?%k(Qg)mSn8n3MSs%2Vo2)Jekkmf3)g@*d2Rqt1 z{wR;srLyC{tlcMnBoGkVJr3BO1_m3-rij1o&-nK-piV9cFeGn_?jvA_Xd!-GCSds? z&V? zZyRJPG_INr)5ObQ5rG8eP$M~mzYmh^>Tev(DF{JHIoHyQlb@yRM*RYKW~uCpz?55-ZV(M+nc9EhfO91$O}_ z{+43?DS~P08kK7glF`@cj)0!RSB!BgVSIZBfO#hh=Zgd$vyChO!NwhY_BoDLF97Jt z-K?ky*|0AF4OCbg#Lm)lr`R+W%A;D}!Fxia8Vh_XBK3fXty8-bbzp74(UzG4Oo8w8 zkO~}T=LdCO)Ml$+0ft1|t8(tH;j7K7>I$if3{h#zJ@gE!fjPB(9yzc+9<+~XQk0UO z9!3$$oM#YUe(x=B@Y4r555G5&mxUAssi^HmMaDWHg3tYfn`Z>lreMF0l~Z1&@;_lI z(SPfvRl@Iy~#O%~_bMbvYQ0?1$> z*vw7=#s&(s#a1+h5B=`T8)d0M{}TemH8?{|g6yCNwFOkCLoNL@1L*p-g4Xz{fSpN> zO$x+hpc`F{gQ^Vz2YX2VP6nG~0CqM*;9croQJ$pqHuIJ2zL4@IlvgmbnChL7Gm@}O zG>nYTTRuH+T$@PT5u{^b$hVwKxZdeKhu(F%qRL=w&B5HKvtVe$@2MaoOC*&%K}L9b`)Zs+=& zbL9O8pu>PrW}WId2Ebn4lk7eqp^bUAA6x**G|I?#?dR{Kg(fQ5TYcppiJho3fALIZ zoVs(iql670+rxog22R&iQha%$;>;!uBINWuoNxY|CPfDOY zu0YoNSqiSud{XtU!C|+tDu9%HGq2L8*{~J%YM}cp6tMWRYN4)xt9&;Up)yURlSR-1 z0S1z4a?K4ZHq`Y}zT_%W5V=6?mDQp^D(R+87_uG08y!0-**gia%^MTtGMhTqLc8ad zPx}%BM+bi5lOGM#pT6=beCGrA;Nb3;aNJABJfcJNQF z@6Sa9zE=SU^StV^NaK9wJo1WQVZA6p3$7cZ)u9t6aNYW8Mg;!7JVoc(VQNKM3>31_ ztF3C4e`=DUI=w1zpK9_FRHcSHOj80V>9A0DvH&Qr*>y)#Zlw6OL0)$rBrhZAOiVWq z)|>`yDGoo}L;(PeoO~TwJH;N~FOH+QRdX7dXFq_4M;9kOoG3486c0%ZsHI7)5L$OR zzSxfsR!>|GMFQyUKy^d4z4XH>m1+bC{MFVvcxW7{Y~T)_owW90?0W|@yeU=&@du5% zz7OW0n>Hzr?$wEYa-d)WOk5fXdOn0kFKEWEz_3K2jI}XABpxbdM;p7Sf*dj!sM=PW zv1Z3&VZs!!y7l9q%*Pnt^68uL^QIkXFqs00O0F??rYe6@40y2ulyj6f8}_*e!}b6chO!v@Tc!HFz}OqFFSobN_Nh$ zgdL#DO2_%Gm6nxRa=&);Q~8r|Sk2bdYKqfW`fl!L- z!gCr+TP0(Ud<}U|fITr@48BHtMr~ID$z&*igbpc6l@p=as&i|uH#k@Sk|Kyn$;Oyi zd8atQv4F`-w2>~+IyfRoC8{xPym?-0k`<*_=yol>Q z`*xgg=mY@3@h=~bH{Ej{-gM7-(+u|vn1Rk^)~#Rem?d(!q5e+20(vsQij$F<13^>H zuR*f$-W#2^3OZB{tAd_Y^Ud)y;ZH;9Ud=WP$oVI_HkI6Vuwkw1=n<)OW{HPyZ`ZD2 zo`&@UvC<2HX37-aoa_34mFs@?x>yekJXg-vZDWhR+%d;CCn=M)%D`*={Mb5&egl^Q zAc&vWPnm3jCb}%)P0SzV3#zUR) zClc_ycDYyO^YX_Lg${u*lCzY-GAfU~nYonFRd@^jX>zc(%S~lzK36mFy#mq-QZV_c zZA~gC1(vlJC+)X`Ojbyd1YJN4>1QhIN6S`G+mSR6*S$s-;#Sv*om%fOsuVrT zq`1Za401B(Qe+j@%Aro!+t0J@IJ2ZS!e0`kJMxom=F1x%z}0wULV~U+$suscJh-zG zl0hohnl2Lsff;3mWhW}^kz64Rz_nN7Ac?7>k>aBL!fdhwDe^}aOZA7&43k1 z*J6+6a6U&QB-~{%LYToEbr1JY5W*ypAQ*H%M_Ep2=Lw`MN;}-n6t@MrvY7fHEanN# zpT63o^;`elZ#48I`R11^{{59W|Bo)j{)_hE&>4sD+$GQAo*(%(-u(4T@Rl!JJI`3l zRLk@-!*ncxz?yXgBbZ=^9`(ZbU8mk#TA+MwsBCME?{1Xp&^i(zP|KnaT($5UoY-hH z3sLSmqvdXDyKH@DY+OkFrOLVju$iwb^~(nbGofQ_&!?J5c_PRm=Ttm4*TWznmm@1> z_S~IgHqdUU!v;OJ!bGFisT$bv%srH=ff^Jj_>7;WW_KiEfNxwJF$Q8uXZ~TLBS>Y9 zA(_`rEucZK3yLh*Ih&((#}*YJ_jm-uBppFHa+w@iaI7R1^1Be4i3>{(O`EfGFC;p; z$xlZxtdi13-&2tLV6gV*u)LHClARMk^`zop35XS{P&L#@hGLwQv<~;yhJPy1qrfE& zoP=>4^Zo`#ch<gdNZCu-`A8`4YbTUwp9v12PKIkn0L*&d5v|zc&H|97&qs?`X`9=Qbg(l8*I8 z#4Zpx=BaNYkDMk`UZpYhOlXd$=zgsf%{XfNaHN2sYj~NyZs`tP7y+roZQpg1oOhzo zh%Pln+I!|mS`ah8(bkQ4xLC2mPDMSt6mMno+NNIp5+Df8T-8DNjDCc!1t%bhEorEB zsRI?1b$avL9!ieK1N%L0jN^xqa>7FL24;t(p6?&N3~bovJ)$d=sr(Z7oUl-?2z@JIigIcQrye3D)a3EwfS; z6CRE8@EB7AvH}A_jPro6%O~n@-U!65#t)6@D~~ka*~xHSJWK5L!}7+Zw8UlzeX0>` zLZ^sL(e|TN|6FG@=vM9gU~1umxW58eny^olcBwl+n#(mpj;Gq|7BiH5Z*!MPc=jNQ^cZo z2LOX4JvcDPIRGnqA~A@RXb)y35(fLrPZgN{DVqgAYzVL+<($c?U-i8ZRF%sWfTT=i zb_1a@z1ng?3=LiVh3jzF4R_%7pZ+?Mr1CbyoX&peY)BH^^<&@03vYTJ5Mbw{XJF4) zt}v#r`mML%q4zw9yFPR$#_bCn|KbTa_r7!S?*Hq(P5syWyKC|758Z*=ek#|cPZ?|} z)l%!-OB453Nb78Ns|v1E@5;_R;ix_>Fke-&&&s5&P2&g|St%`(Nk8m3S7}7-%R155 z65a6nIHcK@Iy%JbfsRbw{T@o(gsM5VKFcXZec-4>9TUkSQb`J&9HEB9vSKGZ4UNLA zpEKJ`u;ov~#k$)+EEmw`vG{spZ}eydsErIDQnDH1FanEl1SB626viFZ6>883hF>tp z18p}*Sl+XGue%&RN>*Hv9g1+Kcf}^(HFczup z$@Pbu#^X)&>|O;JraKB!lgm#inv;CjL9CKW4~Uk@sgxPZI|hcTGeq*? zRfC`$p`A$I99(T{CqX3I6)Z^X3|E_T?mZXh+!Gu{G!uYbkDQ5J z51(me=hC_No{Mv-uC-IIogL)X++Wj=9S%KJUX%5u= zv7|KdovtSSu8$J+0KpX9KJ9vzTG!R&Oni8YUY}F2DYqFN^(3FYchQ^8p9asuhF8lZ zxKkl3E`q7Bd&%o9&grzW)|^~AukW1gI1{T#oJ zpy1Mooj7d&15I@uh0ZQoi zvMsUni-M653FH1m4g6dhys6UG-=)yDNP=$$^=N?CQ6m@4laf2k++Sr`BuUt_VNv=a z13CjFiaOBRJzkd4mkauuKX0%U&kwP)AVe}|$nl{pS&IZ&J7_sU+ircR0_i?l*rJNL z)Hf3yL*E(CHeMzT#`j3-HS&#gGIjm+?_f)(g~*P-nH3ykP|(|~IJJSXVyq^#wR9A9 zYqceTItn0|YiW4epj6V0BUF9QYn~xn8T4#dIsc?Un#;=99Dte8xjE3$TqT2JU3|lAWf1=NaXgvg1@^?G7FgNmci<`-C}-gnHRP zb7wjmLq6FrC6q^!lN~{eaxIKK>O+5*K(ZVzOLtOPWHD@QoEku=d&jmL=1)4b$(?a_ z&>UPDM4G2Ca&(~p7jyOgZ-uO5S#z-DG$~r*GkJCLt+CZE9b8H@QtSi>t4nuV41-`X zj$!t0%RmJ*=(u&=@xDc&ufQXJWVq=3QB|105G$GaHS+J2>udL7OL-3 zU5h9;%zlK+tYXdQ8gqo+px1;Wp>ZU1CV)T)k@itq*BSqDq?I=V)+|o6%d>Z8l52GR zu>(aFR}D{dAg&rUG)8*6ig{VqC(gc8zM((Ki!7D*EYr$TeSHa)qUBaq4`wdLtp0!BCHP=gu5@XCui7xs2+tou#R=i(>Z(LZuO6}d3<;ujMR zC~Xn=`3xOtNFgYt{6+~2j|pW4P7?xxS|UT#dvUqzOju{b4RAHrS!ST*b#>OC9ityc z8DtO>F*0$WhY|5t+n%rDC{Ayy$p)WkDG_&^8OZN;|HK~zvylE9E z_nf#=Ygs2B0xI&^O>ggL9EbgS-+;6#NLa?&T-jxGd-tWv)4AVU!#@^|uyOoz*zO3c zKN29Yavf{Yj0UCsv2`9=osYZY6Wvag136kzxXG?uV=Qo=h1R5go`ziN@Iey^5prLo ze`m>ojZlfGl(lQYjxzziNwCu3Kj5Z-VHdY z(8t!saWp4jbLzp@sXcry&Pz(L^?Rs;E5Ag%O__<lKv0veZvAqzf`O^(FDx&hy|6Wwu^v_Qr3M7NC`5CzLAYPubO)GP35WTncB>^RX{MiL6FCDXNlsdr$1H@5CH&7b}d3d zW_>`;*K4v?fAAcg>Q?|}R<9k&SJ7Gq@;WrLQSQ)^>Ry+oum1u%bM@c7Lh9JGlJL4% z<)_pe3~sXqqs~|zII*dGPgv|WdM8vi-^p((OmH_S1`4bl;I_o7bcL9orOyWtafjxr z^(h9Q-6A^;(T!#*w^C;T0KS0H2$iANF)p_Ek=Jo1NTEjF3geGlMVXnVqQ8>z7T*7 zHK$`6>g1BY#iIPiY?!&Gn#E^ zC+{k4oyc<}k$~Ptz?v2tJ`FW;*%c~T4;-zVe;v{jEce<{&rZxtb!L-YU9UiZQIbf9 zU#3!jdhOBKN@Q)a9ky=2MR`v4@ziBD?jv7Uqfq{FkKghO*nwOqjwIIK$cm^*Pw*%3}2v(V)Jo=7bSJ_;n~2_22417D+b z#7#Hjy(3L4=yA016W+1P-><5FLyZ#yW1A49c5qJBH8~!5Hd)mS0tf~N*io3Rjmp%t zktvdwuf3!}>W5gCJS#o5p-CyHp(d;LcHXMxCfiIkP%ol+gsQvbSsmBKWBT z%SXEFc1+?4J1O2b9Tt#N^~@r^p;7yS`AcK6WtsdTVa!-0rd-gc2y#TGj2(#~e50L6 zR?KfFQlWLJss@u6B7C`mxM!eJ{1h61)e{#?$&RwDlcT<WA(ng5bjD>*!@I6ps{-?|4`X(42WkCD6=WHV-T3lmEvS{<}Z*O70?RG zGC>c;cqAonddtpD91I`<80@=`!G?^v#-Qenc)d?kNFSzP2$yj%rGbu+BwXu&OZU>m^luFJrMnv*vu(8n6 zrCSK#j|7$_0MO%jDOqUP;#EaRg9H~^*~#e8r9>EX8Zd0+ClE$kLmtXA?#cVC?gI_+ z8{@u-kL9Mj@XdPyuDeA_&YOnClbzFJt3}efzU{iQKsn;Es&Qoj3;MXqhoO|7rkw`elGdR64Uk=77S&3ex`^&$=RAr=)CU$c?+-dgEc1A*S4Tg9(+ z4D34ou$lcS50zK!hkL==x@v{fd8dHJBrP8;=199b@4PdhOlqLmq3X9D8f8Y?xMN7w z_-;t_0}3TtVI!wFcM1#GH+^9Z{gbRMm7z%}R<$xV6_DzEH}Z7~;$UFnMk{1Xo;NxG z1~)XGwGcaGR*Ex!&3- z_)Bx#IYzb1j#T;BFvr6N%@r)GGtc(f_N733+lEjbIlnGNq?E92W58lDn%p>?u1M2; ztDd%4+BFR2;3Wk=Vz?|pb#NeQnt%-~*#!YMN*+Cg$HsiQ@6o6X;%eX{BqQx7&7m)} z*29*XqokENlA}+4Y5bb6ED<=0=A?2A4 zFx|ElX-;Y1XFhdPzQ0x3v6r4xv?UePLno3*G|^kXgd`gMcblFKigJu&5>u7>XCVzc-$(}ciC^nXY{z* zlJAjdm{$Q0bG5Br{wO6v!rk;n^K*o0)g_5lQ$O-kA@S7z&N|u<)bDGcin**DrI;m| z9O$U;^chGyqI!{qnqWe9a!ByQi>h%SaD-?na?(_1Fv7FZk(_fhnp6k1vt$mXcCF1a-5w_LbxCoA9bBGpDnpXC`trQ>fR zA#K*EVAw+A+W^0thpB6Eih%`m3-ryShG>OjmuRZKbmX@8dQtYUAMP0ZGJ_VZ<$mwhauQKz=-1hKA1 znyPG`)SrYjyRTr4_VJpV7fPM)Y=G+gM=wq5Fl&E5Q_XdBnj8w$8~OOxu!mz#ky3f7 zj=EI_1{EV3vNs1&3UsAqMxAF$?ZC9F!ev?>n>adLU*gh9yKQ*3H`!pPXoB_05Py~& zUXzHQyjLm|?j&`JMZuErqiyqpI_65uCVV%&KKiGXlUex%K$g|UP~?#RKm7H!#U607rk_!mAJL4pWA_vxEr zo=>)K8?5u>w;x7rxaHF~S9v}f_z?j<`>9ChCpvX~_S4gOl<&{X&{5^;(Wz&gb)Mdv z7VEk~o-)pt<^k}TU##-{{i?1xI>h&u=+t>uq0`Ir_deDP%2_%^MW))->w{iC%^N2D zbUi@pdU;?5tt!pljGTy|)^&@z&(hYJitqGRdTdkxn#~d~!EqF$s6jkoV}t?%z)>4@ zQ@MaNdy67%mSF?bNdig#G3QGLwFU#^q?k{A?JQ79wbK!1hv#Q;y25$VHucAW()1a1BK4_2zqh(XQWOFspV+uDfJ5^_LbZi~ z^3T*kP^L3g9_tg~zGRJX@U9U8YajzYWT&tFkRKTxtP-UmB3Pu+^dXom1q0py!L9%B zX58?1KH}F*fa|4R$aSR|c*n3Z4)gE+IEA4`Q@B_kD{aG@-kG+qA+NDmm1|9R+bp9q zk+J7fI=NP3HiFmbF0AjY4@wwSldf6R8|G)fd*}xp?`S?0|PMqsU5XyPWH`rD{e(O*0^1*P_wV+Id+cgMrDc z_QRfLNZ#&LWi@ABr=HBiZ+Ae6_883VB`7c^@>}QQK1e>BOq6FNr>x+`?T3fxn_}Rh@m7odnsA2?m(_ zEGnVHo|J~S#pJB~8NaBOL#mbwvI9*%29?1v=?()2Ub?5EQ91q|{Eq_<26-Gk;XDRn z>?+CCz<`(87=}=J3-jWgRE{Ln!=*aQ1bs!COw}M~r?5&GzfUtYzxf$V=8!)kQ)*~d zuW}u@6QUdqU(;m(Rl4bXbNAGFtOTlRhL$qe{!UYSLz=c9B_L2+<#o#(#k_O+uQT4_ zad%@Xq7GG!MrTb`IzLj?cNUhVfnCDbBlK-+T1TqB$CgOo z$8RvSSAEv%X5SjvOA`aZL!g}<`pV!$3gC%RNslw0WC+5+LIXQ|skJE{>f_{MUo;IW z^k#KabrIa$^5lh(?%MhIEl9F8^yE}+Uqhk8>*Qj;1#Rz9B3@pN8DB?5 z>o9@%n@4>$fPBUl9cvSwXIfRbJlgz@vm;Q*|K_X-;q@oXwg7|i7qhIns*(+T_awo- z!u4oPEv+OjP=(xu8Llc123h+tW2a0*{R3SS_}X>bj=1^Hhf{P8{!xRy=q!3wNHTX2 zX3glyzp_&r!XJ^!?!Qu==>WmFHi!Ncf);eAh>AMwWHQKU5R{kuBqWT5&mz{{i%->OX~7R>QFDdjs-BQW6t0!1-bg>%R;9ti{w1*5!3cmMB!fBn2LM_ zs?!M?1+hFRj|x`N5u=OI*Gd4y@141D4?e_+m}YdV?^v>?xTGFp{-bxoqBD$n--CIZ~X`HWx+C0BYJvr4xw>iXaa6CmPA7}oZh(X$_0)n^!5yjA})8&pJX+pi{)G}7!-T1S;`zD)S(?fg6 zNu%r&$oo-ZUY+O$;9|a-54`EijCpZc3F@(*Qo>^Nv1O0STDHmhT8jbpSVvIz{B1Q8M<&R6vz5{$)70>lcsf`v_8p23e!te{6G(WOP5=ia z$Yl53V5wE-byl-4RImDc)6sxm*ilhK=Tdp(Oy3z_hhqaJ3OjE(rKpJkIL#JwV;OJI z_c_0dEbsaR!rGPV)x0CW)=Hf+o8B*RF3W-&{%n(l}O|0eNqS z_=3LV5W3B3b2GCe9b>3lPj%|8{fBQsp6%YGu<bxHFJC zU}MM*dvsRe{?P4>!h;ZL&^Ag04pMl~Cp!$dXcnD`h~y=^5=p?2H$3VqrY$OA)Wz{k zk*f8?OI!c|AOJ~3K~zR0tnX6Z6uPak#`^&zsK%P@K6xxit zmatdpSXR5MF;zSe?S5+V_v+Al-7~J&uy+g$jCUhhb1=sd-9Hk8yDUwS?zMXv8%M}y zyHcC~4Tf}uIvT?p=(B7!Og}+a&^Ub&@jWrA82tLBHq5KpG1@R&oKWc2FcvGFtpPwM z^^W>&Gj#}1y>^P9_&uO60|aj4{W;J$w;9mnNhv-J(OzR=he$o z7fN-6+vu=OayqV8IgM>6hM(#HRNMRV3Cs0-!xY$Ou$zm#J3XPu)BL40GS;^_YG{P_ zZ|JPlvnTi2?5Bwp<~!*Ld!_vvV0+OOF>+@E4~L3Yvt6yc{6gz{Gt1?2U9i^i7y3_iZqzk1&&&`^2Mwp!!O4;`v~ z1vQ}eJCvD8W~?gZG>~uvNslU?^ou#uG=UkQz-80a{Rs<|>bzYRmW22s3rlKTC9Mqa z{^LrdxT(_dBh^1oecAS-I&oAn&`EVGnSFH|!`hk~jnxsIBbTOzU zV^zAKn=(V>rXt@&>8d>`Lf=9pBdbp4cOy=&w0i zb!gE)L|ssl$;jAVlB7VKou{`wJeHUIx98Q)8(_ODp|qk?&Ow5*bijk0 zKSiQE+}u=6j02rH5m@N)I@Mj%_JCYw@BqZ)49zg}ZFBfXNA`hlyU)(lUFJ$-Y6jT( zk4P#Z#bav|EQB2xEY2t&x}!vrefMxQgDrM&W-~D1*PiiK13T5Bnz&)}y;~uL5{mPW_=UBZMW&-@4&i0cP#ww3Y8Hhh)a;HLR*W ztS6(DVZ@9acv(Sz*BIw}7BC!z6rfcE;dcMnruBu}Kc%5qI*uuK&|-dMEL!sbA{(+a za}swn>k4K{SBu+%nstV}b%EL#`Yi@20cK363Z>QUk7qY%oirAjxOwC{IHgG*G*fCW z_mV!wS<5F84U3v2wr31Xq7!8rZIqzTZ@5e{5Ou8P+~Ghksng4Z#pvm#x^i9htrB1w z72udl^(A_?oC)O6XgH9p?Qo$=Rg5RSCg?iZCehN6IrbnnDZoS>Y_dxE^~M5kn~*$} zaui8N@2C%D@G}td1=dxsCj$Wgk%0pQ*cMMrs)V#u^OxHXMsO2)*dgCi z?bYKbl?bkoj;ccp)}$JG6>w^kRG-}n(CL|$(o7vfoltLZ`j0Eo=C;ZJXsRQaM>q8< zM|Eu`bv2< z&~yE@@A3PU!!#z!dUkiLMNl%^lh&qOyV9hF!M!RhEU$pTyH)G-2!J|BPjULqlfdPuKWf_{o|Ry13ADP_!hDotKb*A&2(n9O*{ znUgNyk2mUN*`;dJEN{AV(4lW99qlwf?Gta+AOdWZXu+a@5__RXBH6hdtyW!TsX?0p zDk`6^#WA9QWK1c@-Sod&#>s8ugNb~E2!L%ImIxie!=gXB`)SIU*x2U4I=UcXimZRH zjEY|CBZkS;GnTjhi_ZZ7KKz$H+|A#0x^}}k)39!vm%euHS5Jh(20tA2^%BcD@<$H!Ycx~{&j<_wwTOPEXd|$8W8ZqDPc2TH`!Le6TKgu`&xj;t0)zuAvnNW)G z4lIdG()+d%>ZJUD74^*|sV?8s{lqoK15TYl>SfO!KjMMPMP zf>>`UZ--R{eU9U;kwuYhSQ-)ddoiq))F;glR=_3LrZ>LuYoA9ieemNqEH$3tfs=X{ zbd?%Mo~nC6aqNaS&VWi(g+k_8M&!s_G2dR zl(SkT8u04QSMWQZ`Vw|Nyc6&J$A2o^d+M#v;GU1%gF|N@!j5Nm;HqE03g`aO?xi#X zs9cfGx^)GBxx`;hJM-uQ++dJiRb_eUJ$E zk%DT*Yyw3>!U#z;dnTGZDbq&*vwTW~U>F<>Ao5c`nWJ)3xtb6w-xT&}^iYWQefdWU zQ{v4oYEVRY{V654$w&dj1ASIc`~p|se08|~!uc=aw!eHEc098KAN-p?h8@rDz-@o|HoS2Di%V-^{dwX17o5(2 z^JCcYjM8~wOLg@^pv&Cvw0xqT+7mF;m30l=tykWBB@Q3IiMxL0?j;=b0ZHr1JR{F` z%$cj9(C;NY$uoa_Z~VrFl=sBve0rqts!&CpMBq!bE{Ze=3J;!7A59y_ydiD0H_xEb z*-XH{$NGD`PIaZ$+0QcvzqzK^&(rl4zU{s{O!L*jKEPHASPV=q+jEy~HuBD!*e7$# z_O=Ev?!@Yp@2Xv??euiYb~V)(no9B*AuAS~UM%lG%5AoCm7JJ1*z_)s1>d8f1kL-H zLee#DW2!xgSlg8MI@wZy_D!L;p-xruxZ`m#7@w^id17dJ>b&B%KkluGo`b(DAU8cB zd!jnUrydSdYe`f8)%kiU^6Bg+P9FNHy4jwKq7LuVhtQ}1{Rr$2H!PJj5cQ2yZ$JdAN;#HC-n z1lwQPhD*M9F~*G%4}aj{wfK1W1CKbJSDDTu({=q$zb@8`aD6Mt4t>csA;;Q)QQG;? zPMr4GX?XITPvYe>U)~ZAY~=GNjbyU?)_)8H;GfWIldW8xQvJD90XWQCInItXQ8(&7wULN%nUWtwV^mV4 zsd8{t>eI^Kq68cuhyg($hN9V>XHUSOqD~d~k-m)C$vRMBCrfQf+`BDTXaEEix60@# zfKs29i_h@;>{=n>- z<0m2@xby|{Q1<$;rgnn zq4RW0$MQTiUsqUeDl+3{9^P>n-}&+T@bq<0 z?0N+!?mH0|edR)2`rDU6Mz87li=W56H{6T;mmR?3xCKsq;#6Gr`8_!I8|Ma|&ijM& z@WKTz;Ia2Ujw?QU`K&A&9RbWpaWtrQh9a8J`Lj@M$q?>=gkv5kD`YmZZX{Jted86& z8{uVPoH%?s+1|R*%FeuUE=jp9!ND%gU-+>xIaPlcU2mLR9-woMr{&wEvJQzMJ-SPV(z)AmE5t*nC{khal|ouNGL0SOC=K5Vc9B zfbOu190t;pgk&dLR!u6O^@hEq{}YI+4!;8c3IjJ1PR#t*1h=lU%Uh7e(g>8zJG8v?)lH|#+`rZ4jlKw z@i^<-XXDhzPQ`QAJcq^hO>7)?78l1a@XF3taMoRCAtB+L|M@rZ+%h67w?2TU-}w~o_{6vH zt)KlC-v9T1Km}9USebD8{f)o;4eY&oFW&V(zZ+-WeI^#ijo5$bK0N%R58o8l&3ZTK8vvaD)!{I zpT8Y@uilII{4eh*a$aEnrTg*Vk33{x;OT3h#W(-LAK{WOU5qPlz7h}q$V0g6r*fEo zPm%M!J^S!`fAecNasP?fjTH#OUeob{U~=bmWSGRjSyP6w8Q|_w)_ETKZ5SnvZxzTG(FHW+pLaR5R^E~fJOIC=&Kex&Czy?TkXW? zrRcSBQK`8_%Sz;hXYZLu`)T9EB9tjXk73rQTSCM}`-goA|BATEzIe1yqe-=Hmg#%P zzg1##^{@^EML&|Chp_whbMXDY`2F~yzxHSF?tkIP|8M00B;Z^b`QV^JTX9^6rC3L&Ek~w&UzOcH^DD{I1-3W;4aV z+P2i$r`mei=PtvxS2ysc-_MTV;CTl#Clnt497`yi4eY=3zhcHg-h@BSz6 zhKAT4_~88jfIYWfhHbBG;Nsu97y$6-`yUPbuA4ZdW^cPH>EP}|0Dv8PPio37w&wvj zjCo_tuo%MiRnu}hiSkIvBa|oe?7aK6S|Bdxmx`RXWA~lA@qPdFJ+?}ta=z@=%kr|t zZ)Z7w_kCH;DFOF>%VY4XLmRZp{tI=DJX{7$?l*f7s(E6MD; zX|$lcYB&nX_J!nDl%*f7qSPaU>yKUcK2_~GK8dr0mZ3yYMzW*OVp*5#=HP7MNV+%tP=+zs@zw!ctBtUDsiA3 zuB3as0vk?*iz0hmSzp3qEd88SuVT`*GtxCr7L*PjLL=gErcbE5(Ttr_uKy2 z+l}z4kL<*?zji%-@9%vT4}SOoocGo9Cs>$IJD%PV87>UIblytQ@H0py$ARG)P2}_-x=6_ z+c~)4D;Gc(tty4k@`PeFsWN=q4rY-Jn;ZG|phAyFXaeZj6`Xa)Zanp_Cvo?GayP#7 zvG3rF`_I5Rx1Wm(zv?`ze17Yfe=C$dRMw)^My#9WmQxR(co+b%?UnW%s*S?~Hji6i z97g=;-~M5Y+eW*-PFjVI=Sh=!y3SP`v5Np_-?-sP0laADa-la{g1yHNF6%!kk#}2#d&k%84vD?)k!PQjhD0R4xe;*n$L;U_DyuD z9!8D#EJ{$9FInnkhoGK9%Lrwb*VB=($u>DpcB#6OO1`OOh0tIjZI(XZ@tIpZG{|OW zVfHsyW&K!Kf&z**xx}=u!7O6mBGiVOC3-qy2F>3xk z1)b5_Tp4X|abAZEok3)wTSnWn%W09|WBrQ?1 za*k~VPn2*;J08z#wXdG}>Jl!e2Vm`xS4}4~7`XTaT=8$O#6ur^2q!<8BLb&9mhWHp z&#%WB_w2&nw?Bgemp+f@uGx#{uGxzNm+i-Ozk2=hiso!bJrh_Vb=Tmkarf3=eJgg| zvkT9>{TUp%g;!_HgfneJA4Jxd(Che;)U;hxc zzuG^H)9JTzt$p3*Nt*z&ERSd@yjN!zEcmCb=hi5NUy397sM3)PMM#N&g%t3f_@1<7 zdUQH1X_`S%gnFaaveY!O0x=%>YSZ*`0kM_Z>k;SkE{SDEq#CQi2}Eb;{;4wyR#Lqx z3(dI3?XuMwDYr2Iy!tih&Y^OVQ) z^^>38fsMl(c<$Qgu>H_BT=e;ivHj(3*mv!7*f_j_9Z%(m!>|}|;g>GLJAV1y_~F0$ zBe?#5%g*%Kw?EV6tloj1=u)Av?Qwh4s@4Vwcl`rV80?tk)b{OEu6BY4|Ce_P@C zX+y3j7x}z&-itLsM8hhy31&r3$*8eXocv6d>7la^HAQwkkk`Ur+I~;_dgg6U zTmPRjC1* z=E8&nhRIGHe+7OBuer_6e+r^apVS6hKWQVQPg!}QnfllHcfIe!s*S8eJJ?y9252Js z#DnY2prrojuY3b9Ui1PM+ZTB0yq9qIU-&iv;L^|T=`$HeE83o+Tl6I*;Nn~J=B$Tq zcnF72ejN|r_z(c#l5!mj!Hy?R!HaKxAwOXN;JmL~fEO=#5j&nZ#dg&H{x5tD&%E;~ z96tGVBuUuzN}kc4TtG!HrMf33IxU_@5Q{Y9dkJb_O27Aa{sW$V`%`#*$LmM}=lQWy zjK-eNXF1&UGk4+8*)L=Bqy_d}u@7JWYkz1;s!5klp1XXxv(gmMXd$)h-n?;ef9DB- zi@$U+hQ)w~e&}HwK4B9Nec<8jY`=8z%5|d${!e=D}Vh;42uDG{<&{s|D^}8*goRLa}MJ6 zPkghgQLyi_EW0!BIcp-^KI1=XYSRAZzsYjQE_E_bDu#f@Di6`@m}u?PtPMG6&BMm9 zaa64}2xlPZ-w@qFKFmdo#wy9>5^J53LH~LyGZEx9`oRIg#z4SelEKzEWCPuCXffWUBXHU z7+ro^E}R^wGJ)?`s0F>TL2VDbMf?>HOrjkGq~qZ*p`;s_tLBnmx^QqZ!qy%Vru$+P zm}=xs!McNj2{eHk#OZz$2^`9w{|i5tfP`nSdlujQ&?9($&+`~w9dODMr{I!XE~Q8G zQVm1$Z;Rjf%`g0`{Al3^fA$8{g)~g}`1{MFg=gkR3orTH9-LqHCZq)1^@%(2#QPq{ z5B`lG!tpO0kJnCr761Mpe+lP(`FvdSYu5q*4qUY#kN)s?vHyzw*xYd#+h5#{UH6`e z%l^$3IAOn@0;fXmS?A2#7yi|)?LA5#{P+#_xTK!QDB@2Z-0<-mT^>u){wwz3yFdIW z_FcZO@O&K3{LU_1`ERep2?tIzSw8)ar|`fBAHcy24niO}?V;0f$!}hY-QPMpDCslT zKZCpf>|J>I>{l>ur#*Tae&Cnh*YN$+Tc5!_AH4^M z&N_sX_MU`me*G$(^UZUbd>R$_$)E2(-LMLsI?vU=eihE`)HRo$yL=xW{=g&HclkaX zKIt%yd+9iw`JFRy&COThg#Etc@Z{T{!u>yXKVCXN%lY(&Ps63Zxd*%NI14(24qW^^ zzH{Su?9sxLpFA0t{l*@g_x1CF48Qcr-^EMkzl0zDJ3oYzo;xW{94OUxU=@H+)2c(| zfX_|pnTf71*Rzo1xqTL7KlQD3KI7qWAH&M+69UcFQes>yBS+1S1ae9L!D zQ<|A*pi*pvZNy9JAgV!AZ z207UsEnOq(RTGEiutfCME{Srh2VS=fr;eey{pY`dC*Ji0e&8RyzdCqmx*tQ9m5tYb zeCfa?&*RH~`ztu_56{Cp|Btsf_t{-`yW=RxuGVFxsbHX2SM6xcc_bk3x*sQ;F!N42 zSjJkDwbJYE9)a4p*F2`ainVLoSi+M9jVB{_M1>-*q#yx5q0J>Gy}$417!pK$rf??ix?{G-?hex%t}Py_IZpp<=q zMg~~cU9eh-!(LXT4m7pe(z9_4uIkOJnUOKSNf5s5;*J{ud`8Vn#zzDT^=~i2^y5ps z3P};#Q;kpP9h8h%~7UatwQM8F#7NPewioJ#Yq`8QW%+iM%R`=j-dx0XLWgE3}hw6Im)_A(N32@o$oV2Q^rp+*+S-$vKBPZhk z03ZNKL_t*Vf%-8tm_ZqrcY>LYE)&4SvT91zES?AWGFo$})&=j%Fhy(m0Gp015Z|W2 ze3$sa{9}mLl^SZO3{?=%lGLrIcS-6mF>9={?Gv2v-#EQpgEF%tJ>4dX2Ug!zmw~>UeYHK;-gu$)lSfOg6%#K-KbPK+^M!C z|6(pM#SM?WNkwC_Q+`tohrOxtFY`saNDXTJT+hcO-h%%v-qtPd)+3J-a zeXRPuA$_~kGgaCyXNmNa3Nen-u>TbFWjcDeSob((0^^L!>3OPEoHyqYg!9c;N=(O% zjC7oFzuZiYDvO2xy2o{{%57Wk z%ZSeG`VhNic&_+RWpC+*?2qw@z<>J;OARmh zs-9^;*J>ajZCQ&RAn)%`7NP^@S|T5Q&!J#QB6O!ZTXDh;)zoz!oj>Ww<6bJdnsvIs zxTaFin(0Pjo;7(!s&ZS=j&QRz?$hYhdxDKc&)HY`HHXCZaCoRL%jmWZbvlitWxE5Y zZVwqeYDc@lXa2W0sQuYI^~Y_Z!KJ^Oo!q^;rj(|d4zP^FK%)UwJD*AOlzQ@uYo^JMN69C*(xCmK!M8(G>^ z+rfrat&7{_k>>gdE@dYI0cw=7DC8TQ_hDlLX&fURke%p;NmIDSuT^H0<08n$Ld=0h z!(qHvt|zpl19s_Wrf&q)*!cZH>rQ^3$2SFca#8h_k{>IaIccQ^2tDsJ<&oyngkw`j z-++g$Q*YhX3=hUYhqq3e4MiKNf@(X4aV{m$OEe}5)JwJfA2DMwt&zzFCTu;mGCp$s zSc}4pkK9t4z`&FJ&R}Ezn0>#?eLPZyHj!0RXBnpo9#^K-ir=eM9yjYy}id0y|%l5|tUa2&U&aTZA0tNL5cRLYw)f>n%Sb^f!tYXyx z5jwRJh6U}ciX>h(fRi*KJ7c?+lDDa|H11AToMW8@OLZ+zl8atjBeg>du(hL?xsp~N z{hI{w$JL5@>`;3uAnHR%m%5aM7z^#w3tUAFIgK3b0DQL#m3_FT!!_1_k*vqO8Cbk8_{<8u#vnhDu_U!Xj zX!)Ae`e`+JAH~!(u=>4Knnwf3uzt@u_oE@RH3{i%I^K53(3dOl3~^~C6>9l%cLaT*HAu&2X4rkJq+wn zNXd9lMC7kfFUHaT#iSE~)0-$OHKy;=x1j327{w3d^{uf>(i7syWmlGv!|zU=#k!kM zGFCOn$zy99YTXm@~g)*tqPO5Xs;BI*A)W0fdInt$~mf#lhPOEz3 zyqmrzf4G%YFKhSYy)L-!=kb1T*wsE@M^XD2Q$cAvY@!3R(TWx?mCCHTq&9^elkXj{ zUE{`}yWKGXc5blML3>YXwrm{IeuE|Urny%S4l;uAy$R&ng^Si2Mb57>`pr`u0_5mI zg!hU1ltD+}K1>eSG1gDr2{Q#a`B%xRnm66u;!B;X-0Qdwnu_&tR6h zZ4Jd@A4`4Q->Y~#zS)hGr4*MO>b}*!NVF{Hy1LYo@~b*1 zQqpCD*q)Xg-|TyEHBJUbYX3scuNtTJW7dDwzb6dS^2DKXHa1}l2bw;ah#BN?081+UIgUD=9x zdXA&XmS*p-otDv%wyVhwfi!8Y)Z`~eU$>E?UVSGP$BEt5{LR=^H>Fmdonf2e3%~@v z>M0o5@pC)aYw>ajbf~1fFG1^Ef_Nt%>C>e+jZT0jNa}>vNDanb3Gevd;egO!PJC~TxnQ3a6WzQ-de0-aKFW1e# zs%Nw@}&ulFgYavKq1fEc$_+CdLp;gErChz`J_F{6jS_O50XA0VJ&Zs<5a5m z2t-%BLaMri2OwvdRP0b;e1xc%g|g;*N;jc#0IQ~M^nr|=ZhY|qv(zRyUL(r{-snAE z+BIWS!t2zl0B@>EAspGy5xJFYe;N`u0HRLNe54r#t~8DbGbOddCLkWFPARUW)_OqBdMc%qFrX~i=-5cE zk7{APdID~V+wJ$Kz>n@TaE94FCFtJLR6u}~Li~OK0LE{YL2=%Al`7^k3H4hX!{-C%~q%r<5b*L8(gQDCLSnkyNQ<2Baxb zvgw73NP-{$0u(j^7Dx~a0gwQ`+j*Gj?q4r+?)?B{Q274mo-@Y7v@-2s-+>7L>6lS5j^xo`{8U8mIdkTtBH)_Z zg>T%z((6MY101f`tJ#SDvd9)5fWHD*hXb%T}m+r`z7dDKc@Un>EofOn}e_;)3eqYRjSS z1R4HXtQDF}XhOzA+o)*myFptEQ*ewBJXi|@zEC&~p7dHH3R}*IeTM)EWS;}4)TxR! z-|glHaY09YJZBa{sTHV*TnHT_9ZrrZJ`98hTxcMCiKZ%bl*N^O^vRBdhXXtVZ(?KX zc?zM>o@jo07+*t{Id*2hEOV21Vz64aG{xyQT?SaHdoeT6>Q}FHt8rSD!w$Rab2}(# zkBIErEN&l*#j7uymNM3B9E`qV7!0B+@Cu}*E#`05^|7XYlc&1wtBP zoT0yVb4_5+J&I@pisn_E?C_2*TTY4N{oK#-T{w3S2ia@h#x~hYt%EzHsl{Kad=Bxg zXDe*+yc9crCD&~9uNgJHMD-chJ9F(^yexCaRaJgXGqd+R~3 z!&pU2>2W|}AkG>YNav}akY(`T#36g&BOxetzcgU%rn46z+VA(IM_KC@)Zy4h-LQd@ z-In8NhezusWP>z2qMT;J<&0#xmg*UKUF;$_{Z{NC=<|4TVx~L?dDQa(Mz(=`LMgD9 zXa0k-H=bn+IrUMzo<7T4Q3VEoNoFvRw9thjD_PL=ATmy~YvyXUceuO?&%M>IjlQ?b zR_&FqY+~Cr{2*Y-;strl))2MXt1lgo3gzOkgEmou!_4Uc1Oye_YY3kfL$s9?_c|Rc zaT>u$zZwU<8tAoii+XYp-m5McRQ0l7)>dg1plug5a?vq48gU75!|CIXg3F&r{vP*$ugdRet)$!__O5VZ&r>y2i(5?%KQB)fiC3xFlvB zyu<^Spt?B@M6KCQ>irt*Ju%POf8z0uiTKp1*~fT>oBha^3M!A_ty1f@EX4%dg$@!O zA<9UiB*lX~WhX2pTU`{sbU&mv;ZmUA*%bF+?RLB5ay9U?8yh9|X>va89V1PIywkB4 zxF)Z}oHh_bd2RM;ba>`L!0S=6ZQHdgm>2(MV5U z71f}ZjU0vNdj^bPfZDF(C_xKjvgJ{mx?3OGcy*;8rMM=W44UGxfyz;;u@Dj|SFncJ z)yPg_KqQyf|XpG}!EBO>;CdqgL~x0A?7 zfdPN0Dv%Nsk7qrz;NW20l`jd3%=lwGJ}Ls$b$vhmPmNVRYaSV#mr}+}Zrn-j57!8V zqCU+zDEU^lMDHOPYl28NXQG=dlaUQDbz@fw_+S|+3z0br7GhElHIO}aNy%Us&iY#@ zP!s4*x-plud@~+6OZz9vbLf>F%b;T*+=@-i4q?^<8Yh&!uf$*W@WN@II<(uFoOn!v z^5)|zOI|_L7VZN-CW9>d0leGoc9x+~o{qq3Z-IeO4FZikaKg?f7&$Ya41dK4&OTwU zM3TH zXNPcJH;ue)Oy#Vm0tJRHr*-pbk7h93a%AU{?Jx!hc{bzCIH0{1qf7vm9-@+VwM}VZ zGeqyCQ+I8|Rk2>I`L0m}r!a9@R2z@$(^s2W7&BX6KYguwh2rAl)!>W%Fa?7;3qP18 zSVeD?#{`fIh;BSj0&APB(BS951ub)@TANqiR<*+W>}wMx=f=)Q4^)*rfYzNrV*-#y#!rDRC4SNE;2_4{8Vmy#!fsn_2F%Y2myB><=}e60pa{LMn@q?ArTRsNGBOhS*5X8*@3OsB>GQ&zP?$4t^V-Sma8_eq345m;VUQG zWej+oK|_>#&|nkPU16N~;K(|doIRL853x*_79`wobzJeF3p@;g0|A#&;C}xM#>mlN)*Da74g;KY*y7^~vW=(qBDr^ktO21os zH2?9xvLF$$4Rm`Hmi1AM^hW%c zC93FaD8^@jlMfsF^IE;uG!S(KWD!N58R!Dx_%;82&|U{}E3j6Nd+hVQ<;G2oL(xgp zT4WY7ArNFNPnU8jK|uyLmkkbm2qw*m^0Peq!qhy@{9`q}2XHMF&9UBG<|y_bZp3Ab z2FtjvL%r!=3sDz%x}Q;vh<%Jdg1@{MC(EAW1U!c;Bm1$N_DhD7vdXTcA_Q+B%$qP9 zLJ=-|pkkU5l89Z%DuC0FkKMf9&*cNfr_&qr0YGKmuxPXUP=`VteANqAs(lYc%+%<( zK`Ts1`F+?o(TWvUo}5q@QEWJTOtFvtdI8K1^H4Ux)^3`BVAXzA5XUn)yWmh!+z{8} zaO*|kxc0v5mZM%k8m^9kr_yq?I{MoS2w5KkT78*y5E7>=tZ$`>s3|;#U`z>IB66rS z3f~C)=xdwbnbL|Ds-oUn1c5Dk;@Y?KDb;SH_v(tbnj_1v506vtp%Fmk$E{p>u8NI56DJ zq8TRrkaD)$TkH{aM&$IHQ=L?%cu#%tDj?8j>YT^dFstA*2{G?Na>a30Aax9|3Q?lJ zsXJ`I-c^+KK(_HZhXGOQdj@yfQ`BWq55Ey1P*?F&S+qQYz@#hq z){5K7F@{&2j!;xcaVdeiJQ+NrJB$2lKi$sFzW+ERN{kNPy3N41+Yr_o7K#Ci_7-+8 zqXW;QF&ki=&<|(|Qlx$Q>;TzfWLPErHGEQki_wXC9Pv}Jp#6T1^KgvXpHDP$zp; zb%(YvgaFoP?A>su<<~woVc!$z36YFf2t~~4Yc*j%=t^(mX@9CC?h?a|s)JO=NAHH^ zS`lI%_^=S2f=Qp-+ho_7ZN5v;8OEfgqAk@i6k9e0TIX2U<#fmoa6L+%iboC#Q z&Mp)@z%Sc)2lZ0+FgY+6R;?QZKxsHI-u7x&K{>X~8@j@pd63G9BP9o_*dM}2ZA=+| z=vh)K6@yr8gpsnupuuN!8Sm-_aIA;I$2ne&no1ND)E!gRZIR8V8$5)W^aSB=l`I-r zdKNMoTcV1ASn-ri-NlB?DIsoaa&YYwH8^{lfx3;1_bUN9`Q!!hjPA$4OD}&Td$(qe z2Y9f1Wj{M)qWyG_7>qD=!+qq!lvM03@WV<7{+J2klmQ$%4XlVf;2huvZ81wcuE)0| z!2RQdY2v<{-?Wzbxo3S-$as_3T~%1h{hlbMoe=GHX(X{B+YOI##3mrDot6n@hS6-) zOwo&ezhF4=7;NMW63$JvPyCzjD-GD{q}S?gVGyv!1&K=)%-i?oafOy-iJc{VcRMpDO9WnU)>lXLdCM)8XC4SU$WlG$YJfVGux!w+%+zzm#D| z96Wf*_Xp7Mfgkdq)i=|1eRP|$56A@If<2<6jWyg!Q@Yy@onQ^cG51F?i>i2&KvxX1 z2=&m$*blHM?uMGNNcM4+tyO3c^X+Eay+0k}w8ikv;F$dwYUr}cs^3&UJ-^aJ_BtR5 zwWDD{L*ww5>D6eTPR?WpeW^QD30{yLnkTm;7r`|ch6$(=pa+|hSH0)|C?X#(+S`~T&45lUYd1PdfuloZsTnyzPtD&ddj=jzJJH5^@ zst`N?Qxo--l>*P|YkK~0)ZE#YPE z_~ug17%2TWl9m(@Hv#)Sr(Kr3>%FmR+UBHVA03J8_a>Wc0H8jpV@@)?;0vt86@HBF04nrH^Us^Rr0^ut>?$CAqm~?yLd*FZ$fGFtQdr znasBwV#E>XZeon&867wqBYcE0J5}Z$^ZOAsK8KKZ;oe5IWP@@Fhi7JhnduY1{!zO4 zp-bsU|H)4q6aLNL`4f8P#_!PkKl~wR6W7_2c6D;s)ie>g>o-11@B8qF8uW9ij{mOT z_!topoqFkn&U@;7y6Vf<(i=bhCOY+!$2fQW=11*%cls2a_nq_Tn$KTHH-73ZbZUPp zBV>+FdsLbo-pB0veSh!H@f_AA_4=W|_H}ydmM7_*|Lc#JF6{R*eFMEud8tRf*0x*O zgn|I*+Q0v={}o+v-<9-(fBcqOVfOWjUw68H?(ctS>Y4Zk8Z=f0!6n*FJq3jb_m3#Y zWU}f`aW_PT2Sr;agaD%Q^-PwxWDh)Pf(A?ljQC(0~9Cy^MfuhXu%e7`rYs;X9UdI&wf4gBBc8X(Ej>0 z@I9oNCbr@*^M=5R51Y^QEKp?V$a3hWvoThz`j>GC4JE)wZdPpiyk;Z$Z9QDJ#9)W? z7;*DOE(msIlR=e)IL@Adj9*4np6JpFT9qQnkTL7C5p2OkpccF`(#E9r-iFi9kHHI^A74i_xHPc!2w7dot~$DQR146 zZ-3b!Rl3pIjM`A+fq^}0G6?p2b!%?O>quP-v4o?H~x;)3p0lIRU z^Av%#cf<;@m4derk)N!%Iw%b?RI2_HPkd9rtR{>_%b#XhtI~^(yh5pTf}Ipv?%S$w zHY`H8gx*d-p0E1ywe-Z>9wQN=|M2$5=&G;0VYaD^J_Pu1r7_^|`|zE1O^VFW*7QGC zb7LVQ#4qjW2OhtOZu#h2>7qw2rbm9_8>Hzb#ac*+PcxnOY4JByu0`Y43SrW(p!jp7p)Zbkie(b`2VspWDbbQ_Eh8lJ07oDGVkX9 zWX_W98K(?re~6gh!>4nkc}0QaMWk#L=+j@j-0dblv6}{mMUiQ_fgd|<69i98@AQ!X zjLvq&Fe#pA(&9S%4|@i#{^E6X-!I)wZ~Wt%>G5|wMz?S#o%8g$bi<#%iEjAJn+%P+e)D7Wp5J;eef{UY zO3z*QEbU(2(Pa-@Nk8=aZ>6)odyaMaAeQdy`W! z4b>a|{91bQw#Vs;d#=h@d%becuRr_WeVVTQ{0(%?=dYu4o;%l{2{pnOVWIIqs+>XH z^!bB;lPg{WQnX3R08lqiMBv-_He6h^*)Yd~x^keuGiPWy0Oce4q&q7A(%$ zh=^PHauv&OqpuOGvug2Kv(74^&NT5>7ch#5NW-3PvL*Py-s-Pe4RDg;gjU)FWX`A8 z3D<;6|Jn>zpq783iYxH;AziU-iH>nabXf8%eGoThJj`_sxZ)9c#dt?yqoB zCr{*Kq5Hr*2%vCnbm&gOY46KEjR~~*tb)@&e_7@f_Yz=%<+cH1?j0}#=D5VyJf~a* zC2d9r`aRJOh=?xz#^v<=3tyyf-Sz~%bm5D1$u};~sL>o|+a|fM1+0!@Pcds$zeShyx5+eE}tii|q z2ttqk)PwY&SV3`2+O)RnMo<85Q;? zdwTKm=jnl8_!?b)&sEV+HL(Sjuz5q0Nfj6{5qkE9r|G(Xdt)0f5E0$`OJAW|K6X1@ z_{hcd%K5L*10Vb<-S?rd(CxqbE@B~i;@ywYqd)c#-TqJCMHf7NAw7TXbM)0;`2wB& z+}U*X7q2%%b?+~Jg>LlKA6?04ZHVL96{`atDTYgvrzT@Va0PfVPA}xNR^3aqb71zl z71tUf!BQSwYS;$7Gu1#Deq?wT)MM_>J$U!<$P zbS?2d5=}z%uHXI%Gf2Cac68Gp-AaG<5APy%xR|oK>dV*C)nB-dn21gh(XAhO+d+|n zw{Gd3zy0IZZ|tjUHwk*_gifFHav<`PzxnY{_q=bPPw)Ak-&^9OAiSOY2giaHz`+R7 zi^3j&fdU8y}28pq7yy0H+!tkeZ1yOynSET0Pwl^X}1CmSZUv#Z=e`~FW%cF<@&WHR5XjKwrP`L_$H7K1QOFzVO%Js7FEC8` zX9(Be;t);a82~w!8A9XDfSi>eCX&7GDK&m!)}d;g5S~ zJ$E*}biqs3>2udTOKed~XC%$LuKYzWt#0&inQSbkkio z(@l5XOi#S)QM%_tU!lj|^Dw>t!*|k|9^$mBoZJT1FWs$rGASI#)+@f;s6K?i8osPB6*>+rS!s|gZoSQGHN5>)`Jx(;%gS{D(9){~1zGBd!cF*t+W6N;e;oAsrq%u*bw28|o zj1?YY)VdA$qn{8rOi*891kvE7|8lxldq%7WlH&HZ8LF<>!9^CuxgP9h+ z{WRV7&)!~1=~$xCBg1ig`)?2w zqDR?n;pMgv1C;8^VGIbz+m|sU+h!ft89WWY9~8yzyOWc0LZEk?22C7K>qGgsT25K7 zAI#pTTZbb#%|8UDXPHwp@l7k=ptu=PX;J$#GYkVI9h2H9+~FL``ty_Gl(IrV`Ocfa zO+WE#KTBu92EOmSpZnDL^t~&dr?VcuWPwM&@~ZI8`_={Y>S0mep$-N{zJcT#z@yL4XH9|i)r zGq}Txh-^tkXEGw{fE5Fu27~|!=_6kc$1h(he~gBNhmDHp`Xv&)mfY?`LzS*YfJRv> zVq58r1Hj$yr0-iT@(7}S#1@_It6oldwhV&5F;EIOATd!Xx%}MBazVOJoHstyXKdoAe9oUV{Tf9mvX_#DO-= z$)=Tvh<@O)3+a)cdeGhoc=|2hqWeGi)olb8hnaV4oPc%h>*jCK{lD;4sNtqze{z~$ zyz+Va=8rr~&)o1d-Td*}QG^BFOZWfs-E`CcdrRy!4_mtZ zgP*vCzWkqkj&A;=+vxl!E+jd%r>EciZF=~<57N7T>n8(FPv7)yy7-Zck6b38=uC*{ z@pnH)Z}{AGbj|;hX9-6NuBe>!WtD7K16;v zKnB8a6Q0<8*EKuv$AaS+m<8s*`nP92rLuZ~wFjx{ti$k8G*tC_9JaKV^oe_IP($iS995^)UjQ)0~cXZA(=hBsTzkzQ07q?JXR?Z0x^SB0~2jk03bj96Q(>FeFAKfrt zZ|s7B^qrLO^qS9KPcL8eeY*R<_#A!z;_uNp&zwg${OJ$URiBIdILufq{Lp3hUr8)X z_y59I>DlX_A>y$N^u|xU#e__a&ExNQjNbf-TMe=!S4+pAAN$9D4I<&_6pXUKTW}z} z>goTl(gXvmOhThMU~b6*#jRLC$2bH+m5*x7?Ld=)4>}syHU+bh0m8?@`an;L!GwPu z)}3|mQypPCjtq6Zp0AmY`|;2gE-b~aB*>nCoGwsVVi=zri8HNlt^ti}hG65MK~mad zkT%5P#9_nNLj#^Rw;rJ_oc=l*k$-|iJ7^fkh852?=)q022Qvhj05-@f&b(Pai?D=y zOA)i61y1;DQJiV=PFI+S^@SGpGcJhSP80mDMFZMc0aN>X@~~2EIv$s-M+nF7WK^Ep z37`{JZ;Mh;FyZf1h9%c+`sv7o+WepX=YKmbeJf%R=G0J#0Q(&4IEyrN3EX!_5u&{u z!6ao`p+MdJwlojh4Lb>Z;_IjW(Z}g$e)Sg{@J^?k+S8x?gS+VMzw=kHM2WWB$&?BF0d{Nu*?*&Dw@U;HosE&bH5y`T7WUeAv}?)uG-l@k~PAqVdOw#j1S zQO~RL{ty3BW5muhl<19|I=2pTnXNT4SoetOz@k2o9jR*R%tbU2zip1r#uZQT3Hs8o zSMl34f~?OwnR9|Y4eEHVPrn3OCeFU}F>dG~Jb{-1@g*w#{ahe8sT(Rcn@~clt%#0h zpfOU@`!O~3{UX5E;1*juz8$>=1@JpZcHvfQX2G_V50ZJsXkQsJuJ9qc{G^o9TfM-b?TN?H^nF z^Vd|OXvdjA3=&kpe8w3W_4S{>hu-)nZzkUF3IwgScGS{b9m0Gnmnz~JF(=MSmAPA+ zfsVn*Fazfuhs|GkUHI+>tU~aNo9MekBnRa}kIePFArr2n5>YTRq&=y3%5NxeQ!jKl z`)b#RJJW55dIzb#;B-kT$Fp3CN#AhD8|6B@9Z%?PYb+9KuHUODAOT~{Ww>!NE2tZ? zfSnyW?f}!EFZVJ)uQS;4pg@~BQ)9-3=j)I>_YDwj?)88Rb4HyUu#R797a%Qy1Y1t& zTEK#Vss@e^x+Qg{Hl85=OvE!ULMd~*4=DzBmTE)50vyPSdC5<4FN<0bW)4e2es+bn znOhMj%_S4TOaf_S4FrAe3H%nCOH~I^SKxpb5&z2H`rE;pzZ#zv^wc6OH3rZ()K`IH zc+d&TvMe8-!8$Proq&W#8?!obuE8gg9`Dgo?>G3K)vAeth!(uao@Sbh#Pb7OUUm~v zSm4#8vFKOIc@SNB|A##*(S056P(ZNt{f0v@aDBabioLYY_Vbf&-#{4(N)Z1G~_e<7{)9qMxko)L_q5hkBSPP{)<5dDMjv z@TkMB*c)CMrxY|=Pu8vY{cJO&8OvM`ZebQk_IryUkf&B3WlItcNle3XTtac&YeEEe zdC)F$cA#bpI^Bpp-GMJ^ir;l*&rH3L04+yoS0QJhzvy= z6Qq#cfN*GN{f5lWR>}VC$YT9ePxJb8?^xuw<4Rn4b8Vw z#K#OqwQKWYDjWtl$>9FXTy`;38q~LDRLNS;OHMU%dx3w`?Tzu+!Xsxa&|%>0K=2|2 z#gPnu%%E1_I5%)o9qV0XHAcBlY=x*&+dlx+TI#$5ZD3Ftotp**xT`V7OZrZ>o&$kc z;7rM8g}Of>81%-Bi|+-|O@l=>!TE(}%>J!=d$^@Ds-0>ILsa1p7-yCBO^akUQ)BOm z7r*@Oyk7#`jBk9^RPcx1n6&ggA+$zr!U##NkpQNc(#I~;9hG*pBMm6cxe)nsH3n3m zk0t0A>~NbdysxwJvS+2M%fJDp3mPz?joJQkgpzWMe>|}@qS?}nM^MttjD-OWb-MdF zxDEq%?2db}--CpRz|12X|5Y1DN52%toXyMp7w|JZO?@z&1;a#%Wy#{M5Ci)WeS3EH zSV`i&fV{n+HWitp(@O;NF0$^A4 zj(3KV5>SH)qZA_9xSJnp1Kbb*V4vw)xm+I)p;g1BVzn1+8R6t^?0)h;_%zTMo*}*D z29?wZ3#dw@5e;{Jcbd%*OT%-=%nf)faqz85rZhJ8^36Lo0FfOr4_ z11=Iju*4>J6PKhUk~@c>0iD+ji2!*F68xQdbKej=p|2ybdk_y;8>bSDSv6&dwA(+A z7{b_Ftt?v=D7^PTaf~yc;7I~AREif4I6N`XBnWKS+S6{j;z|u=~gO|O_ zioq)Q>CQ?B(Mc_;=tIfZ5XFYq?HHBQUthriVdQhi21BnRzFLy$>1+ruw^o!ZUj**- z`2yUfUb;z^l9vObOiAy_uTr7`0mKp7HMaj47P-`Q#-E}*D2Qw*f||RGm7sIeSPUmV zJbcxmg2TL95_w`S1YiMw0*mveQmB&D6Z;qr%G<`ZNW@N!TpiM!xgciG49tkg0&jN5 zrF}c5nNz*3ah;B`9^Y4jz^pY*N7xTUqp>BvPatkYP3UDX1!t5ws|fVE0I&(IFQ36I zcZwZv%I1dQ>S}Xyt-R>o@oP;4ILXwbke;ds!d$#OIKKb^T`d+FO9OLrp~yI!K>5Yf zP@xx*Kn@r474;oMGd5U;d$*6L;7Fhgxem}&f*lUyV7xGI56=P%(YlO>Cup2HnTh(- zyO7vpUm`A!sYjvfA~c00tr^9X5Q9)UDg`493$tN1n?3sS4K=8Q-ekl8lu!f!R#P0;)uBU?FrtwU91aV2|mf2T_n%!fxtR2S?=###LvYq1`l2`9ncl@BWK7tQ7?QlxctZ zS^DtZ_1fOL(v4d(0u`RPkc_3e-4UDER>fSSftZda(dVM82*Pti2m$#kr5emQ`~gR2 zgL|+QLdu&I;$zei}pLZyu3?08jysPf=J(A zXO?0!RE_LVB_?-}B1CY$Jia5p7ok(Uqup+7gcRBPIwuv4e!rio5ZkyK225YI9!#eeb6I7ugXa1UqUR^*QAZ>Pq61 zMv6MBHZaX4@i9fjs2b>O;xv!}x&p048-bzF$-Xpds)12xABH6Zy%_hqiK`lvz8{DH zGD->84Yi4i-9#jee-HcW(qGqio^i!%#3x@Yt1e4%D@B0-%qF99=L_5x%Duda_^7~# zbzyMqAnXOz;HO+RkcW0E7d9)3<4&=~JzH>MKe4f*Q%h&BKp{*Ik`s+>(z^AmG8~sQ z4vZoL4~?@-7Xr)++Z4^Ii8)}sZSQFFaQL`Jxz{%V=LdOYKhnJUwMvDp)_#0|Mwb=z z!`2D|(1yN^T+4StkZ$`pTC-}r6|8~55@r!3$rw3k4rx$>?RUPcmyGgS~4%2;2^=!Vo64g_KRez-HQsk0EexL zlHj}LvF^CwiF?fsc+D_#?5otqlS#?@@)#IcBq%6D#_AZ_Q%% zVoXM606;tfgb*RInFk%?J?&}7I|E>+3rN*7v$u@q4lq|I9w|)_kO53Kfbdjjw)4BN zfnRvKYF?)gCBz~gw3O#WF@o4AahVKh0hzUchio ztCSvwp~_#oWYH4{(J(uO4oa%zxYA968-?&)r4{XB^hvupQ_t6z8n$edR%wodQl1uF z+74ir&1)PI8>tO6#lq2Ev|073Gok`>1Ltf>iUy^sCPFDf$Zk0CZ{^5Wv63KT2rhAE z)eyI2llarPYZ&k^i=zpuZm5M|x*J|JN@0({G!8-pexqWHhGr`eFsBR-rdi_m2dqA8 znjkbP;&_XUb=Kk_nSfs-6R_KH81uL+!bUUk_z+95xnVtV<|t;{>|3+UsEzTIzw*d8 zYD=*B^g*?cMY z5Mjo8E^IAcE_-KER+gjQ!x4<~aHCko_L;IHHUa zZBbYX1d7xrp@Hi5t}4p2Ik>=qaA`+gLiMt4yG1D0V|Sz?Ko2=zofXh#ni=7egi#`f1!q2<(YT=|qLm z1p@e0!+=i4IhFEA6o+I$+O@m<(`QW>aAL+n2VM=o?hh2D7Xa(Bg38KXXuLh3Mya)z zoY2IKAy4P*_QyA_Eod`AjTR0kEm2Zy@iAYyF2$|NK#+U0gPc9ky5Ft)?5X1+o9wos z75o+aysL!5cB-%=9(5oTb&9#4#&)QU0s-%4^)<7+!Tr_v6PWqZ#w+*xAX0sbV#O3b zDqboEm7u{#A>Dk4d-AF^MSP1W!|>Wz<42knaPWtY;Yp?}Z;pt@v6g671gM&9w3(knFM-W(D9&< z9au^^8g6dWYW*OjaliK0jggcZImjF9(T(ONG%z)(8}177$3#_V;CRZNAy+dAA)HC^ zNEU%Ci)uK1Bin2>pX1>#38OaoPI=$A*&=%h>?L3uw_=`E7L7e1WSDhT9Cb`@VV+ z9d5qoa3>FVNRq9`^7zNTUqZ9J3?49#pfJpQO|Lqwns=tL+|BXESF6pA20}TELxso2 z%<%Cb;AucHc0d-Ytqg!Vi^MxyrfAx@+Aviih;mjbnlyviiw;O4iz&*IyT)RH7j8~* z#P+BP zfZ1fjPYi|{HK}BJqiPiFD9c=bfe%K^hKMVfV$;q&5M9 zwV8_Ho4}Ic=mNWlMWiRO*ih%#Dtz6Ly=lNx!0}I5dyFcyjkaU9gJi_`$9}EGl8~L# z$gT!GqBDaGF`jA&A$k0r&<1D(E#eNmqka4wI5PCbB!r)4*_VeJ6Pxr_Wprf{aM%2Ru2?yR`7ZKP=|<7pa@Yfpnl;WgLElX2+1c5! z+-Y6&AEYAC$(t?5yc;~SU^(<;A6_4Zt z@qRa0OU45poE=|v3@(e=LxI8}Ven9u*q+GP-5mBc2&z($dTKKSX4t_IbTztB;9SWK zE~09ZZtX zD$GdF@js(=##FQNJ1?HU)Nbkv#LnZ+(QV3y5vfB{wFK6Vo9#0|(~H z8sO`7#1vBW>Lii|8O{4dhY<2vu|YZ`jz@z0Q)PW&Pz zekoOq__5ZmeXb4*3~ct?4v7{8g9g+G5BBuAOVS*4p2_8$GADeSW@UI{5t%Rd zkefWoEjYJn0)kREx_`SX<%K+`1-sx&z+M-LwZ;zW=zb3i3K?rJ_Aa!N*P81P68IQl z&?Z5iQI3pP_K%n>MLpP&E_>~ zGZZy!G71BN3?pOW#KY@~N34Ce29azS!Y3J z8s;jq*e#Ly;o;!bkn3y(0*w(^$$0Z%eo$(*<^S zpC<#OR>sf6jS_H3?aBDk_>rzV^hwKmp_xC$+^IOyL1o=;>a&Ymg@MFSoDd~(2t zaa1uf0NbfJuTvudw-aldFp6W=2MHCN{sHu*3o#g5_-r9mii#EnV&UV0%H)x33>V`x zVItr=KSA+IBu-Fg@hsmpd|;3eQN3?$Y^AZk z7gh=QL*NrOiGlpMQ?1TGv)is$+ISbz^p0|bG2{%}O`QgdA3;<{iK(x?>NX5l#f?VZ1}GR$bZ3V2IWaH3fxMocSh;ftu^_r#iJB;bu5!~?-M zs>Ou|c>sDIk;Ynmm}oa( zyS>PGn?PM4zEU>&?*uKuX_$uXnCf$TZD&>xyk~N1Q%BLU zks}@U7mQAQV^S<2FqZ<(8wI|d*>+paPD0;@NGC!li}ruX#C>>2T1@ ze5~ggsH^N`)&p8h*2c}VhFj@#IL}FCleWcvBKCnH6Tf}N&kQBJtFM#`(KyaH_AthH z&LXD{@s4RHGGj@hJu~fg{>H+7zxP1R>_p5es*!Yg7edY&IbzH=$G^%i9XdhK#u&xK zoJy3HyjD!q@1e-0Bn4L{5S-E0vSB4dXT*c|{rg^EK+I^D6@K%5$l~Kmlr?||6O`z_ zyTF*s1%-eh_ofI+)*@Qjz z46trOl29AhBEp(Xf{I3Mq7;aB+>&z(b}7NtLrXkJ3b0IgpdYlst;I)Nl;K(U63l3@ zT?ia+gi7;0UyeM<0RXGffHmnHT~Z#n@n@&~g501QNZU9EE&2x(C5$IHHu#M*P+ZgU zz+gfPe@8ESa71B^D;JdWz+IlOfa1yPJ>hcb@yYA+%smf@V{2YT00-~H zJA%!v$(Ue}QE|YHe*P@*Cm@zfexNpDy9Row@EpdxJd}L8pG~0~x^#1Fl=&bQfB^ac z4(xV&qsv*o??%TRY?2GJqTKkhT2$>$Vw3^vu*Mku?XLlb4xzOg$&3QS^?GE%!-abQ zLD7MAg>K@%lpTaDo0yb4IJ6})D>Zv4c3&b#h%|_Rg1L9lsLd5)Q0%VTRml{@nOUM6 zj2fCFU5n4}hS!aT`YMeJVM5=(1{uakz^PV6lYn=Uz`&QZDX`!dL05-Ll!q!*W+Ds( z+O_s@e_L9Y>%kdEGZ}!OW(KB%vbQcWPAQ9`O)yZ&4s4&thSG?rbDQEGHz{hr6P7x| zgclRduk+1cvNwn0d+7-r$mD_SNe?$3bnIyy(F=SK`#FD4ld4Nr4Cf-u@sGCA4R){y z!65{4YT^*+%-PghTv-_LG#z9Qrcys$@vK^7cF(ZH;3(-=7W3qtx?`3Z0>4hz!6i|Q zJ+f}oikT$?;e1#%aOa0%k@uXQ0Ia;hwsX)njwt|fpUlC1qKRJn*WTay;aRXtON37P zS(=&UIEaEn;|3(BzN4MX*rzhBjF=Y)v6fW|E+DM)D}mmXZn|jK@u27nI#@UxY4FLZ zVx@~?#g#(V{nkk#IDrzV1p^so3DdaM{rP=Lv%l}o9e)?c3jv>x2?1_M>-<-u+*o_? z_&(c=0YU5tVC0Mo;)p-vq(9axV?l)mgD)K?V`W5XB)7PM)fqSCX$(6vo{_g60JsnG zpiKEK-4c@a-7H_MP~BQK#HZ~CyHK6L5i2Bh0JeWXs2mj6H$i;MydCY*bNfZARVl|;%0k&8mVluKak^>+HhW&?trh{*C{;Sba zSy|!O8L`ggg!{>9je8Og<|?=Yyt157jd05;a9b7f7H{j**7D^*rs=w?>dU2ZgQ{z9 zjhTqZ&)3l>7FmOgqI-2i4E-uFoX|FJgfNc{gbFRN+Po1M{b>0q7Y_fp@oI+w;H-yf zYcM%>lOEfvVGEDE>Qns&L&X+C2OubP6Y;`dX>0n(njxQ_QDaIBAh6pNJr+huG6^=I zWKP#7XL=#)hz3a}mxv-Bq7=FyM38LWzw`UPB-2rtgBN(Rq5I3Bn-@mYVpgwXk)c(% zD8R6nQ`;+UBw#QSX;Z9VNA+~x zJ0i;>m^`UdX7-)cnzFTZ^qD@Toyo5NZGINOE^xz~xh?|)Qb!+S32NxUp7mP_4Nt-h zSEk*FHj0QWjXr2Y1`}<`b52S32lO&dE_@m5e02jaGXNewH}CO%*1L(2t>< z=iZs~F*`-8W&&JOiv}m#4RQw_3xBu` zlh9q@myY0&C)~i5W0Wcp0Y=z?)8JOxG{#TDAE3*Pubuj5tWDOZ2xH=V_CT4EgjN_Y z>|1~*y0OR{a^HofxV6o2LcJE?hj;>C^TKa-Zu6v|v97+KcqMa;;F`X7Xz1rmoT0X! zBY^=3zFsPO%yc>5Odfe;6(T;9%X7IgF7FI|^w%8+Z}#E=$zV+i4#NHmXMo)iX$N^>&+ebK_0jCZOzQyL%>KLAzmj2v_X0(Ya0q)(_REBz`RLUHJHe&#>zP zJ4fV9G1|dv$pJ<5BO#vANgf0+eu^ddIcCd1S%3)*aU#dyd)@2IJ~`rOG|xUySR)i8 zKuA~u7#!p7H3=-Zj;5AS?C2$6iZU4MFQlTTCu@*m28bQsVaR)AdtpL{l^W&sRAy?O zOX-Nozo)*aJ8zG(-Q5jjXJ`kbkQ;|Sc!;|i@XYMOVb5DtHgUQ@V`0jJL<42b%;AfpAqPi})YUq$q+GcpB!kq{r@}-yYp{J7M$Q~L zD;{fkAr_KPsGO zs@_@;c!E3w2RxPs)OiT9ZaVV#hQ*-4aj)ki%*?|C$&l)1Vq)17@7Q^6%N@B7xR&JH z(G(JqW*Ih}*UDTnI+E(FT_?nU3t*R0%Ovq0V{@}Xuo<%~i(!b?z?uIr-pn{#CTxzM zsU$B9;DNHpFrXI-taVSDYNu<#KWHoJ_F?eojV>XoN~3d+tup$;;0-}OaLG%v1ReQI zCn^zm6mQV|%|x9WCimqG3= zZCGK1&fnj2?lhVe1!OyNz7xjzw- z`OSmmcv5|l#Y0~=ilqb<5;IK=zG&^4+_+oN5T3hy>)}sGRUif&(nM|GGj}*LIy#~H zs$)kwM|k!@B=IE&Cdgjwr)Dt`^UfwZ{yHG=Msz<@>RiB3L(sBXrNdFx8KDrv<~xwL zE&$AXMY>MfeF;>2K!M-loC4pDumfgNnLNb)JNvP&TkcIEU0W7# z>Rly653^iS_$?q93QL0|AtKp}$wS`wuWx=JzUqrl)LEKAMof`;8@6+0nA$Y&WMX*b zi=hiu<{V%cY7NY`ER5g*Z+}!U;QoHmrG#q7wr3pRT*P_hA~g)tQNc0bwW_~mcrvcx zoc*qi@w*R>rp;@DK*U!8sg^ORA!+c!g_(`pne@t(f*{I=x8`K%HL#C?> z2=p~Br5P(5OUl@ylYrZtF5tJnK`|vllnw#f_q3w{dbb0cWyrA;lKY~39}C-KWe}>0 zrHV<_ps_(gSt4khWmhfgQ9ZUSN$Tn(IYu12Yqo5o(;M-HK+;U+LJ`0@9yF>eMGAIn z@z@ZOf9G_qPYrTA^BdKxx}f<3t_Xtgabi66KQ5(Mxs+-eOI@y(wU+H(uMJ} z==aBinE*jU?JIL6CKBNp*$_lFFoO^vye;*9x3-?y+zPxYeD>gM3Ku0fz2i#+%PxI~ z!4@5I>}q!!v$)x05x8)v*mmb*S)9DWcS#TxICXpo8h)ekQfCISLku1;4ViJ$-$lpM zhMGA}cI>NK(UclyLRlC}6a#`J3mb!={RojAU+it7g)`@mGn6#mZ3i4M23pBy0m%0? zy5@{aDfH2TZgFJnLg-GLzN@ySf(K__5A;D_qqtX7b~;4Yt_0B7v$U<36F_Sh`nC z$doP(_PE$GPYuk8qLIU3%qHz_%hKR5KutUkk#{FIIThNb|6K0Nl7am@l@@Rquej~W zQ~zALH|0@0%Pg4ODV16GDnMwg2JmxbW4D~NFAX^Fk>{fQq6gBxTX+-<)oMx09KW~> zc-r1T*%t|OfIx)ol_>Hlol=Hg5?)D+{i9S6DDY@wPMGvaS+OpI^d_BFEOi+|X~)AF zR4>sIAY30`kjrM!`_Bb0$|0w`(WdQ11K!mvJvTTqC?FvVDBJt?Gryaaf&y)eeQz$! z9#hmttegWND{<*@JCUI}BEEFR&WF9ps@_vMf*zRRZ34k4B54G3ba(-=XlU536YEu( ziD)-B+-TIVXpV?RCdxjbBA#s^nj7L!y3t{&0vm%eDW+wr&)^8b{dlOqIV{JH7Cvj1DFyVkPjbjtQDH?O{<}WGWG_TJnf%Z| z1%ij!fDHiTAi*veKgu|XkH4A2VK02I#r*dery42Ud?tx6iicpOrWHw~DNvJwgXU05 z2iN)L+;67Yc*M0{y6+iImqx9#vTLj2y1O!}(;t;beO-qe0N72{S0WzY_R>i`f(`zS z=!AFFet-iR5R|tY0K5fu&y{+l{bS04h-C+x&V`6{eKX=>;lea*<6Gtyezdszv&_s! zio|i%7(HD^WCO>|6n{OFbXv1)i`*Dj$t@^v~6O9lA zcz+JR4GPVgRku#fo$z)=3R?61;I>nm6P>vNFmB`F0NSU)lz`wcuzqj(^}L2R9j%}e zVF{yqO)x_m_tSX@;xgtk2R1P9ZKYcd&)7I=Mq8R^r=uEXFXo7dtofwvCjEWA!*YJ8 z^u2H0&AZ$kkDR)GO-LOgjnm&(11pMmk)$)H0qalcn<`UR7he5%`s<&*1PNiA^{XMu ziA4?bi7E(&c_C6>(XGrvTP5@VvJ{~K!uVzH?lKY6Zl+eXCfm}&ND&OGcDiJM>;Yx- znOP>^I%*uLjyls`0|JUwI)(=0tD++L357a2T#C;yk`yPynxKJgS8Cx3+JkzoH+SMq zsYN?mN2l?g@=Bff7`VO3(A?5d%*Qwp_xqrr%Ps(7d!Tq2SkKXw!0Wr8~7cZ zI{byTFgx^yJ>#XT;R$%ar#ikRHzQ6sx}5N}+pG7)8>`r^eJatq4#}wr%0TYMbw7W0 z8qshQR5KUiHObgZY*_=Jz3Kj=lmRhD-~c$iMiaaJ%gcc}aR61EnNjCqGI`dQXN%w! zOj|NQ%{eni<1|h=cQJm|1?fRR;eLk;t*zVukO$RAHMBtcmqEQ2!g5Kl!sf(d0*@ld zD`oDqLJ>H|(HEn&uBjPvBB~$0bJ-V>v4PO4L+S=UP7+Pv8b631tUuoso!&Bq`nwqt z$@B{LVG@NgVM^Le5TbolOx=JeN#2q?N~X&RMv%o9ns9H7U6|!BQ(}GFyq49@JClA! z@k*f&&k+P=6X0(MN3)#f_2=xgC%~x2jpK%Cl=(?%`i=nXdM$s@Cyrkb6{wS905!N} z1CjQd4MajQ1_(}v1qAqHJ>WrSx+3Xs2cvnxG$dd8o&?=&(&jg!DxY7(4W``889wdblYX={>MI2)}anvPH4AgThp`0#ZTal}2 z^JH%UiS6juAacT8%D(b#!fVGAgk5Ic*VTa*>r<7udope$-fYdVi(P`QGdizVG5Ax< zp}$sp4rB;oP!u7&`UJ@_!GpUtoFtpMoKE`x1MsJ8ml_d#cmMzZ07*qoM6N<$g1ifr Az5oCK literal 0 HcmV?d00001 diff --git a/environments/prod/manifests/site.pp b/environments/prod/manifests/site.pp new file mode 100644 index 0000000..f24dab4 --- /dev/null +++ b/environments/prod/manifests/site.pp @@ -0,0 +1,4 @@ +node 'node1.loc' { + include task13::nginx + include task13::mysql +} diff --git a/environments/prod/modules/mysql/CHANGELOG.md b/environments/prod/modules/mysql/CHANGELOG.md new file mode 100644 index 0000000..5f07f6e --- /dev/null +++ b/environments/prod/modules/mysql/CHANGELOG.md @@ -0,0 +1,770 @@ +## Supported Release 3.10.0 +### Summary +This release includes new features for setting TLS options on a mysql user, a new parameter to allow specifying tool to import sql files, as well as various bugfixes. + +#### Features +- (MODULES-3879) Adds `import_cat_cmd` parameter to specify the command to read sql files +- Adds support for setting `tls_options` in `mysql_user` + +#### Bugfixes +- (MODULES-3557) Adds Ubuntu 16.04 package names for language bindings +- (MODULES-3907) Adds MySQL/Percona 5.7 initialize on fresh deploy + +## Supported Release 3.9.0 +### Summary +This release adds Percona 5.7 support and compatibility with Ubuntu 16.04, in addition to various bugfixes. + +#### Features +- (MODULES-3441) Adds the `mysqld_version` fact +- (MODULES-3513) Adds a new backup dump parameter `maxallowedpacket` +- Adds new parameter `xtrabackup_package_name` to `mysql::backup::xtrabackup` class +- Adds ability to revoke GRANT privilege + +#### Bugfixes +- Fixes a bug where `mysql_user` fails if facter cannot retrieve fqdn. +- Fix global parameter usage in backup script +- Adds support for `puppet-staging` version `2.0.0` +- (MODULES-3601) Moves binary logging configuration to take place after package install +- (MODULES-3711) Add limit to mysql server ID generated value +- (MODULES-3698) Fixes defaults for SLES12 +- Updates user name length restrictions for MySQL version 5.7.8 and above. +- Fixes a bug where error log is not writable by owner + +## Supported Release 3.8.0 +###Summary +This release adds Percona 5.7 support and compatibility with Ubuntu 16.04, in addition to various bugfixes. + +#### Features +- Adds support for Percona 5.7 +- Adds support for Ubuntu 16.04 (Xenial) + +#### Known Limitations +- The mysqlbackup.sh script will not work on MySQL 5.7.0 and up. + +#### Bugfixes +- Use mysql_install_db only with uniq defaults-extra-file +- Updates mysqlbackup.sh to ensure backup directory exist +- Loosen MariaDB recognition to fix it on Debian 8 +- Allow mysql::backup::mysqldump to access root_group in tests +- Fixed problem with ignoring parameters from global configs +- Fixes ordering issue that initialized mysqld before config is set +- (MODULES-1256) Fix parameters on OpenSUSE 12 +- Fixes install errors on Debian-based OS by configuring the base of includedir +- Configure the configfile location for mariadb +- Default mysqld_type return value should be 'mysql' if another type is not detected +- Make sure that bzip2 is installed before setting up the cron tab job using mysqlbackup.sh +- Fixes path issue on FreeBSD +- Check that /var/lib/mysql actually contains files +- Removes mysql regex when checking type +- (MODULES-2111) Add the system database to user related actions +- Updates default group for logfiles on Debian-based OS to 'adm' +- Fixes an issue with Amazon linux major release 4 installation +- Fixes 'mysql_install_db' script support on Gentoo +- Removes erroneous anchors to mysql::client from mysql::db +- Adds path to be able to find MySQL 5.5 installation on CentOS + +## Supported Release 3.7.0 +###Summary + +A large release with several new features. Also includes a considerable amount of bugfixes, many around compatibility and improvements to current functionality. + +#### Features + +- Now uses mariadb in OpenSuSE >= 13.1. +- Switch to rspec-puppet-facts. +- Additional function to check if table exists before grant. +- Add ability to input password hash directly. +- Now checking major release instead of specific release. +- Debian 8 support. + +#### Bugfixes + +- Minor doc update. +- Fixes improper use of function `warn` in backup manifest of server. +- Fixes to Compatibility with PE 3.3. +- Fixes `when not managing config file` in `mysql_server_spec`. +- Improved user validation and munging. +- Fixes fetching the mysql_user password for MySQL >=5.7.6. +- Fixes unique server_id within my.cnf, the issue were the entire mac address was not being read in to generate the id. +- Corrects the daemon_dev_package_name for mariadb on redhat. +- Fix version compare to properly suppress show_diff for root password. +- Fixes to ensure compatibility with future parser. +- Solaris removed from PE in metadata as its not supported. +- Use MYSQL_PWD to avoid mysqldump warnings. +- Use temp cnf file instead of env variable which creates acceptance test failures. +- No longer hash passwords that are already hashed. +- Fix Gemfile to work with ruby 1.8.7. +- Fixed MySQL 5.7.6++ compatibility. +- Fixing error when disabling service management and the service does not exist. +- Ubuntu vivid should use systemd not upstart. +- Fixed new mysql_datadir provider on CentOS for MySQl 5.7.6 compatibility. +- Ensure if service restart to wait till mysql is up. +- Move all dependencies to not have them in case of service unmanaged. +- Re-Added the ability to set a empty string as option parameter. +- Fixes edge-case with dropping pre-existing users with grants. +- Fix logic for choosing rspec version. +- Refactored main acceptance suite. +- Skip idempotency tests on test cells that do have PUP-5016 unfixed. +- Fix tmpdir to be shared across examples. +- Update to current msync configs [006831f]. +- Fix mysql_grant with MySQL ANSI_QUOTES mode. +- Generate .my.cnf for all sections. + +## Supported Release 3.6.2 +###Summary + +Small release for support of newer PE versions. This increments the version of PE in the metadata.json file. + +## 2015-09-22 - Supported Release 3.6.1 +### Summary +This is a security and bugfix release that fixes incorrect username truncation in the munge for the mysql_user type, incorrect function used in `mysql::server::backup` and fixes compatibility issues with PE 3.3.x. + +#### Bugfixes +- Loosen the regex in mysql_user munging so the username is not unintentionally truncated. +- Use `warning()` not `warn()` +- Metadata had inadvertantly dropped 3.3.x support +- Some 3.3.x compatibility issues in `mysqltuner` were corrected + +## 2015-08-10 - Supported Release 3.6.0 +### Summary +This release adds the ability to use mysql::db and `mysql_*` types against unmanaged or external mysql instances. + +#### Features +- Add ability to use mysql::db WITHOUT mysql::server (ie, externally) +- Add prescript attribute to mysql::server::backup for xtrabackup +- Add postscript ability to xtrabackup provider. + +#### Bugfixes +- Fix default root passwords blocking puppet on mysql 5.8 +- Fix service dependency when package_manage is false +- Fix selinux permissions on my.cnf + +##2015-07-23 - Supported Release 3.5.0 +###Summary +A small release to add explicit support to newer Puppet versions and accumulated patches. + +####Features/Improvements +- Start running tests against puppet 4 +- Support longer usernames on newer MariaDB versions +- Add parameters for Solaris 11 and 12 + +####Bugfixes +- Fix references to the mysql-server package +- mysql_server_id doesn't throw and error on machines without macaddress + +##2015-05-19 - Supported Release 3.4.0 +###Summary +This release includes the addition of extra facts, OpenBSD compatibility, and a number of other features, improvements and bug fixes. + +####Features/Improvements +- Added server_id fact which includes mac address for better uniqueness +- Added OpenBSD compatibility, only for 'OpenBSD -current' (due to the recent switch to mariadb) +- Added a $mysql_group parameter, and use that instead of the $root_group parameter to define the group membership of the mysql error log file. +- Updated tests for rspec-puppet 2 and future parser +- Further acceptance testing improvements +- MODULES-1928 - allow log-error to be undef +- Split package installation and database install +- README wording improvements +- Added options for including/excluding triggers and routines +- Made the 'TRIGGER' privilege of mysqldump backups depend on whether or not we are actually backing up triggers +- Cleaned up the privilege assignment in the mysqldump backup script +- Add a fact for capturing the mysql version installed + +####Bugfixes +- mysql backup: fix regression in mysql_user call +- Set service_ensure to undef, in the case of an unmanaged service +- README Typos fixed +- Bugfix on Xtrabackup crons +- Fixed a permission problem that was preventing triggers from being backed up +- MODULES-1981: Revoke and grant difference of old and new privileges +- Fix an issue were we assume triggers work +- Change default for mysql::server::backup to ignore_triggers = false + +####Deprecations +mysql::server::old_root_password property + +##2015-03-03 - Supported Release 3.3.0 +###Summary +This release includes major README updates, the addition of backup providers, and a fix for managing the log-bin directory. + +####Features +- Add package_manage parameters to `mysql::server` and `mysql::client` (MODULES-1143) +- README improvements +- Add `mysqldump`, `mysqlbackup`, and `xtrabackup` backup providers. + +####Bugfixes +- log-error overrides were not being properly used (MODULES-1804) +- check for full path for log-bin to stop puppet from managing file '.' + +##2015-02-09 - Supported Release 3.2.0 +###Summary +This release includes several new features and bugfixes, including support for various plugins, making the output from mysql_password more consistent when input is empty and improved username validation. + +####Features +- Add type and provider to manage plugins +- Add support for authentication plugins +- Add support for mysql_install_db on freebsd +- Add `create_root_user` and `create_root_my_cnf` parameters to `mysql::server` + +####Bugfixes +- Remove dependency on stdlib >= 4.1.0 (MODULES-1759) +- Make grant autorequire user +- Remove invalid parameter 'provider' from mysql_user instance (MODULES-1731) +- Return empty string for empty input in mysql_password +- Fix `mysql::account_security` when fqdn==localhost +- Update username validation (MODULES-1520) +- Future parser fix in params.pp +- Fix package name for debian 8 +- Don't start the service until the server package is installed and the config file is in place +- Test fixes +- Lint fixes + +##2014-12-16 - Supported Release 3.1.0 +###Summary + +This release includes several new features, including SLES12 support, and a number of bug fixes. + +####Notes + +`mysql::server::mysqltuner` has been refactored to fetch the mysqltuner script from github by default. If you are running on a non-network-connected system, you will need to download that file and have it available to your node at a path specified by the `source` parameter to the `mysqltuner` class. + +####Features +- Add support for install_options for all package resources (MODULES-1484) +- Add log-bin directory creation +- Allow mysql::db to import multiple files (MODULES-1338) +- SLES12 support +- Improved identifier quoting detections +- Reworked `mysql::server::mysqltuner` so that we are no longer packaging the script as it is licensed under the GPL. + +####Bugfixes +- Fix regression in username validation +- Proper containment for mysql::client in mysql::db +- Support quoted usernames of length 15 and 16 chars + +##2014-11-11 - Supported Release 3.0.0 +###Summary + +Added several new features including MariaDB support and future parser + +####Backwards-incompatible Changes +* Remove the deprecated `database`, `database_user`, and `database_grant` resources. The correct resources to use are `mysql`, `mysql_user`, and `mysql_grant` respectively. + +####Features +* Add MariaDB Support +* The mysqltuner perl script has been updated to 1.3.0 based on work at http://github.com/major/MySQLTuner-perl +* Add future parse support, fixed issues with undef to empty string +* Pass the backup credentials to 'SHOW DATABASES' +* Ability to specify the Includedir for `mysql::server` +* `mysql::db` now has an import\_timeout feature that defaults to 300 +* The `mysql` class has been removed +* `mysql::server` now takes an `override_options` hash that will affect the installation +* Ability to install both dev and client dev + +####BugFix +* `mysql::server::backup` now passes `ensure` param to the nested `mysql_grant` +* `mysql::server::service` now properly requires the presence of the `log_error` file +* `mysql::config` now occurs before `mysql::server::install_db` correctly + +##2014-07-15 - Supported Release 2.3.1 +###Summary + +This release merely updates metadata.json so the module can be uninstalled and +upgraded via the puppet module command. + +##2014-05-14 - Supported Release 2.3.0 + +This release primarily adds support for RHEL7 and Ubuntu 14.04 but it +also adds a couple of new parameters to allow for further customization, +as well as ensuring backups can backup stored procedures properly. + +####Features +Added `execpath` to allow a custom executable path for non-standard mysql installations. +Added `dbname` to mysql::db and use ensure_resource to create the resource. +Added support for RHEL7 and Fedora Rawhide. +Added support for Ubuntu 14.04. +Create a warning for if you disable SSL. +Ensure the error logfile is owned by MySQL. +Disable ssl on FreeBSD. +Add PROCESS privilege for backups. + +####Bugfixes + +####Known Bugs +* No known bugs + +##2014-03-04 - Supported Release 2.2.3 +###Summary + +This is a supported release. This release removes a testing symlink that can +cause trouble on systems where /var is on a seperate filesystem from the +modulepath. + +####Features +####Bugfixes +####Known Bugs +* No known bugs + +##2014-03-04 - Supported Release 2.2.2 +###Summary +This is a supported release. Mostly comprised of enhanced testing, plus a +bugfix for Suse. + +####Bugfixes +- PHP bindings on Suse +- Test fixes + +####Known Bugs +* No known bugs + +##2014-02-19 - Version 2.2.1 + +###Summary + +Minor release that repairs mysql_database{} so that it sees the correct +collation settings (it was only checking the global mysql ones, not the +actual database and constantly setting it over and over since January 22nd). + +Also fixes a bunch of tests on various platforms. + + +##2014-02-13 - Version 2.2.0 + +###Summary + +####Features +- Add `backupdirmode`, `backupdirowner`, `backupdirgroup` to + mysql::server::backup to allow customizing the mysqlbackupdir. +- Support multiple options of the same name, allowing you to + do 'replicate-do-db' => ['base1', 'base2', 'base3'] in order to get three + lines of replicate-do-db = base1, replicate-do-db = base2 etc. + +####Bugfixes +- Fix `restart` so it actually stops mysql restarting if set to false. +- DRY out the defaults_file functionality in the providers. +- mysql_grant fixed to work with root@localhost/@. +- mysql_grant fixed for WITH MAX_QUERIES_PER_HOUR +- mysql_grant fixed so revoking all privileges accounts for GRANT OPTION +- mysql_grant fixed to remove duplicate privileges. +- mysql_grant fixed to handle PROCEDURES when removing privileges. +- mysql_database won't try to create existing databases, breaking replication. +- bind_address renamed bind-address in 'mysqld' options. +- key_buffer renamed to key_buffer_size. +- log_error renamed to log-error. +- pid_file renamed to pid-file. +- Ensure mysql::server:root_password runs before mysql::server::backup +- Fix options_override -> override_options in the README. +- Extensively rewrite the README to be accurate and awesome. +- Move to requiring stdlib 3.2.0, shipped in PE3.0 +- Add many new tests. + + +##2013-11-13 - Version 2.1.0 + +###Summary + +The most important changes in 2.1.0 are improvements to the my.cnf creation, +as well as providers. Setting options to = true strips them to be just the +key name itself, which is required for some options. + +The provider updates fix a number of bugs, from lowercase privileges to +deprecation warnings. + +Last, the new hiera integration functionality should make it easier to +externalize all your grants, users, and, databases. Another great set of +community submissions helped to make this release. + +####Features +- Some options can not take a argument. Gets rid of the '= true' when an +option is set to true. +- Easier hiera integration: Add hash parameters to mysql::server to allow +specifying grants, users, and databases. + +####Bugfixes +- Fix an issue with lowercase privileges in mysql_grant{} causing them to be reapplied needlessly. +- Changed defaults-file to defaults-extra-file in providers. +- Ensure /root/.my.cnf is 0600 and root owned. +- database_user deprecation warning was incorrect. +- Add anchor pattern for client.pp +- Documentation improvements. +- Various test fixes. + + +##2013-10-21 - Version 2.0.1 + +###Summary + +This is a bugfix release to handle an issue where unsorted mysql_grant{} +privileges could cause Puppet to incorrectly reapply the permissions on +each run. + +####Bugfixes +- Mysql_grant now sorts privileges in the type and provider for comparison. +- Comment and test tweak for PE3.1. + + +##2013-10-14 - Version 2.0.0 + +###Summary + +(Previously detailed in the changelog for 2.0.0-rc1) + +This module has been completely refactored and works significantly different. +The changes are broad and touch almost every piece of the module. + +See the README.md for full details of all changes and syntax. +Please remain on 1.0.0 if you don't have time to fully test this in dev. + +* mysql::server, mysql::client, and mysql::bindings are the primary interface +classes. +* mysql::server takes an `override_options` parameter to set my.cnf options, +with the hash format: { 'section' => { 'thing' => 'value' }} +* mysql attempts backwards compatibility by forwarding all parameters to +mysql::server. + + +##2013-10-09 - Version 2.0.0-rc5 + +###Summary + +Hopefully the final rc! Further fixes to mysql_grant (stripping out the +cleverness so we match a much wider range of input.) + +####Bugfixes +- Make mysql_grant accept '.*'@'.*' in terms of input for user@host. + + +##2013-10-09 - Version 2.0.0-rc4 + +###Summary + +Bugfixes to mysql_grant and mysql_user form the bulk of this rc, as well as +ensuring that values in the override_options hash that contain a value of '' +are created as just "key" in the conf rather than "key =" or "key = false". + +####Bugfixes +- Improve mysql_grant to work with IPv6 addresses (both long and short). +- Ensure @host users work as well as user@host users. +- Updated my.cnf template to support items with no values. + + +##2013-10-07 - Version 2.0.0-rc3 + +###Summary +Fix mysql::server::monitor's use of mysql_user{}. + +####Bugfixes +- Fix myql::server::monitor's use of mysql_user{} to grant the proper +permissions. Add specs as well. (Thanks to treydock!) + + +##2013-10-03 - Version 2.0.0-rc2 + +###Summary +Bugfixes + +####Bugfixes +- Fix a duplicate parameter in mysql::server + + +##2013-10-03 - Version 2.0.0-rc1 + +###Summary + +This module has been completely refactored and works significantly different. +The changes are broad and touch almost every piece of the module. + +See the README.md for full details of all changes and syntax. +Please remain on 1.0.0 if you don't have time to fully test this in dev. + +* mysql::server, mysql::client, and mysql::bindings are the primary interface +classes. +* mysql::server takes an `override_options` parameter to set my.cnf options, +with the hash format: { 'section' => { 'thing' => 'value' }} +* mysql attempts backwards compatibility by forwarding all parameters to +mysql::server. + +--- +##2013-09-23 - Version 1.0.0 + +###Summary + +This release introduces a number of new type/providers, to eventually +replace the database_ ones. The module has been converted to call the +new providers rather than the previous ones as they have a number of +fixes, additional options, and work with puppet resource. + +This 1.0.0 release precedes a large refactoring that will be released +almost immediately after as 2.0.0. + +####Features +- Added mysql_grant, mysql_database, and mysql_user. +- Add `mysql::bindings` class and refactor all other bindings to be contained underneath mysql::bindings:: namespace. +- Added support to back up specified databases only with 'mysqlbackup' parameter. +- Add option to mysql::backup to set the backup script to perform a mysqldump on each database to its own file + +####Bugfixes +- Update my.cnf.pass.erb to allow custom socket support +- Add environment variable for .my.cnf in mysql::db. +- Add HOME environment variable for .my.cnf to mysqladmin command when +(re)setting root password + +--- +##2013-07-15 - Version 0.9.0 +####Features +- Add `mysql::backup::backuprotate` parameter +- Add `mysql::backup::delete_before_dump` parameter +- Add `max_user_connections` attribute to `database_user` type + +####Bugfixes +- Add client package dependency for `mysql::db` +- Remove duplicate `expire_logs_days` and `max_binlog_size` settings +- Make root's `.my.cnf` file path dynamic +- Update pidfile path for Suse variants +- Fixes for lint + +##2013-07-05 - Version 0.8.1 +####Bugfixes + - Fix a typo in the Fedora 19 support. + +##2013-07-01 - Version 0.8.0 +####Features + - mysql::perl class to install perl-DBD-mysql. + - minor improvements to the providers to improve reliability + - Install the MariaDB packages on Fedora 19 instead of MySQL. + - Add new `mysql` class parameters: + - `max_connections`: The maximum number of allowed connections. + - `manage_config_file`: Opt out of puppetized control of my.cnf. + - `ft_min_word_len`: Fine tune the full text search. + - `ft_max_word_len`: Fine tune the full text search. + - Add new `mysql` class performance tuning parameters: + - `key_buffer` + - `thread_stack` + - `thread_cache_size` + - `myisam-recover` + - `query_cache_limit` + - `query_cache_size` + - `max_connections` + - `tmp_table_size` + - `table_open_cache` + - `long_query_time` + - Add new `mysql` class replication parameters: + - `server_id` + - `sql_log_bin` + - `log_bin` + - `max_binlog_size` + - `binlog_do_db` + - `expire_logs_days` + - `log_bin_trust_function_creators` + - `replicate_ignore_table` + - `replicate_wild_do_table` + - `replicate_wild_ignore_table` + - `expire_logs_days` + - `max_binlog_size` + +####Bugfixes + - No longer restart MySQL when /root/.my.cnf changes. + - Ensure mysql::config runs before any mysql::db defines. + +##2013-06-26 - Version 0.7.1 +####Bugfixes +- Single-quote password for special characters +- Update travis testing for puppet 3.2.x and missing Bundler gems + +##2013-06-25 - Version 0.7.0 +This is a maintenance release for community bugfixes and exposing +configuration variables. + +* Add new `mysql` class parameters: + - `basedir`: The base directory mysql uses + - `bind_address`: The IP mysql binds to + - `client_package_name`: The name of the mysql client package + - `config_file`: The location of the server config file + - `config_template`: The template to use to generate my.cnf + - `datadir`: The directory MySQL's datafiles are stored + - `default_engine`: The default engine to use for tables + - `etc_root_password`: Whether or not to add the mysql root password to + /etc/my.cnf + - `java_package_name`: The name of the java package containing the java + connector + - `log_error`: Where to log errors + - `manage_service`: Boolean dictating if mysql::server should manage the + service + - `max_allowed_packet`: Maximum network packet size mysqld will accept + - `old_root_password`: Previous root user password + - `php_package_name`: The name of the phpmysql package to install + - `pidfile`: The location mysql will expect the pidfile to be + - `port`: The port mysql listens on + - `purge_conf_dir`: Value fed to recurse and purge parameters of the + /etc/mysql/conf.d resource + - `python_package_name`: The name of the python mysql package to install + - `restart`: Whether to restart mysqld + - `root_group`: Use specified group for root-owned files + - `root_password`: The root MySQL password to use + - `ruby_package_name`: The name of the ruby mysql package to install + - `ruby_package_provider`: The installation suite to use when installing the + ruby package + - `server_package_name`: The name of the server package to install + - `service_name`: The name of the service to start + - `service_provider`: The name of the service provider + - `socket`: The location of the MySQL server socket file + - `ssl_ca`: The location of the SSL CA Cert + - `ssl_cert`: The location of the SSL Certificate to use + - `ssl_key`: The SSL key to use + - `ssl`: Whether or not to enable ssl + - `tmpdir`: The directory MySQL's tmpfiles are stored +* Deprecate `mysql::package_name` parameter in favor of +`mysql::client_package_name` +* Fix local variable template deprecation +* Fix dependency ordering in `mysql::db` +* Fix ANSI quoting in queries +* Fix travis support (but still messy) +* Fix typos + +##2013-01-11 - Version 0.6.1 +* Fix providers when /root/.my.cnf is absent + +##2013-01-09 - Version 0.6.0 +* Add `mysql::server::config` define for specific config directives +* Add `mysql::php` class for php support +* Add `backupcompress` parameter to `mysql::backup` +* Add `restart` parameter to `mysql::config` +* Add `purge_conf_dir` parameter to `mysql::config` +* Add `manage_service` parameter to `mysql::server` +* Add syslog logging support via the `log_error` parameter +* Add initial SuSE support +* Fix remove non-localhost root user when fqdn != hostname +* Fix dependency in `mysql::server::monitor` +* Fix .my.cnf path for root user and root password +* Fix ipv6 support for users +* Fix / update various spec tests +* Fix typos +* Fix lint warnings + +##2012-08-23 - Version 0.5.0 +* Add puppetlabs/stdlib as requirement +* Add validation for mysql privs in provider +* Add `pidfile` parameter to mysql::config +* Add `ensure` parameter to mysql::db +* Add Amazon linux support +* Change `bind_address` parameter to be optional in my.cnf template +* Fix quoting root passwords + +##2012-07-24 - Version 0.4.0 +* Fix various bugs regarding database names +* FreeBSD support +* Allow specifying the storage engine +* Add a backup class +* Add a security class to purge default accounts + +##2012-05-03 - Version 0.3.0 +* 14218 Query the database for available privileges +* Add mysql::java class for java connector installation +* Use correct error log location on different distros +* Fix set_mysql_rootpw to properly depend on my.cnf + +##2012-04-11 - Version 0.2.0 + +##2012-03-19 - William Van Hevelingen +* (#13203) Add ssl support (f7e0ea5) + +##2012-03-18 - Nan Liu +* Travis ci before script needs success exit code. (0ea463b) + +##2012-03-18 - Nan Liu +* Fix Puppet 2.6 compilation issues. (9ebbbc4) + +##2012-03-16 - Nan Liu +* Add travis.ci for testing multiple puppet versions. (33c72ef) + +##2012-03-15 - William Van Hevelingen +* (#13163) Datadir should be configurable (f353fc6) + +##2012-03-16 - Nan Liu +* Document create_resources dependency. (558a59c) + +##2012-03-16 - Nan Liu +* Fix spec test issues related to error message. (eff79b5) + +##2012-03-16 - Nan Liu +* Fix mysql service on Ubuntu. (72da2c5) + +##2012-03-16 - Dan Bode +* Add more spec test coverage (55e399d) + +##2012-03-16 - Nan Liu +* (#11963) Fix spec test due to path changes. (1700349) + +##2012-03-07 - François Charlier +* Add a test to check path for 'mysqld-restart' (b14c7d1) + +##2012-03-07 - François Charlier +* Fix path for 'mysqld-restart' (1a9ae6b) + +##2012-03-15 - Dan Bode +* Add rspec-puppet tests for mysql::config (907331a) + +##2012-03-15 - Dan Bode +* Moved class dependency between sever and config to server (da62ad6) + +##2012-03-14 - Dan Bode +* Notify mysql restart from set_mysql_rootpw exec (0832a2c) + +##2012-03-15 - Nan Liu +* Add documentation related to osfamily fact. (8265d28) + +##2012-03-14 - Dan Bode +* Mention osfamily value in failure message (e472d3b) + +##2012-03-14 - Dan Bode +* Fix bug when querying for all database users (015490c) + +##2012-02-09 - Nan Liu +* Major refactor of mysql module. (b1f90fd) + +##2012-01-11 - Justin Ellison +* Ruby and Python's MySQL libraries are named differently on different distros. (1e926b4) + +##2012-01-11 - Justin Ellison +* Per @ghoneycutt, we should fail explicitly and explain why. (09af083) + +##2012-01-11 - Justin Ellison +* Removing duplicate declaration (7513d03) + +##2012-01-10 - Justin Ellison +* Use socket value from params class instead of hardcoding. (663e97c) + +##2012-01-10 - Justin Ellison +* Instead of hardcoding the config file target, pull it from mysql::params (031a47d) + +##2012-01-10 - Justin Ellison +* Moved $socket to within the case to toggle between distros. Added a $config_file variable to allow per-distro config file destinations. (360eacd) + +##2012-01-10 - Justin Ellison +* Pretty sure this is a bug, 99% of Linux distros out there won't ever hit the default. (3462e6b) + +##2012-02-09 - William Van Hevelingen +* Changed the README to use markdown (3b7dfeb) + +##2012-02-04 - Daniel Black +* (#12412) mysqltuner.pl update (b809e6f) + +##2011-11-17 - Matthias Pigulla +* (#11363) Add two missing privileges to grant: event_priv, trigger_priv (d15c9d1) + +##2011-12-20 - Jeff McCune +* (minor) Fixup typos in Modulefile metadata (a0ed6a1) + +##2011-12-19 - Carl Caum +* Only notify Exec to import sql if sql is given (0783c74) + +##2011-12-19 - Carl Caum +* (#11508) Only load sql_scripts on DB creation (e3b9fd9) + +##2011-12-13 - Justin Ellison +* Require not needed due to implicit dependencies (3058feb) + +##2011-12-13 - Justin Ellison +* Bug #11375: puppetlabs-mysql fails on CentOS/RHEL (a557b8d) + +##2011-06-03 - Dan Bode - 0.0.1 +* initial commit diff --git a/environments/prod/modules/mysql/CONTRIBUTING.md b/environments/prod/modules/mysql/CONTRIBUTING.md new file mode 100644 index 0000000..3c3f1e7 --- /dev/null +++ b/environments/prod/modules/mysql/CONTRIBUTING.md @@ -0,0 +1,218 @@ +Checklist (and a short version for the impatient) +================================================= + + * Commits: + + - Make commits of logical units. + + - Check for unnecessary whitespace with "git diff --check" before + committing. + + - Commit using Unix line endings (check the settings around "crlf" in + git-config(1)). + + - Do not check in commented out code or unneeded files. + + - The first line of the commit message should be a short + description (50 characters is the soft limit, excluding ticket + number(s)), and should skip the full stop. + + - Associate the issue in the message. The first line should include + the issue number in the form "(#XXXX) Rest of message". + + - The body should provide a meaningful commit message, which: + + - uses the imperative, present tense: "change", not "changed" or + "changes". + + - includes motivation for the change, and contrasts its + implementation with the previous behavior. + + - Make sure that you have tests for the bug you are fixing, or + feature you are adding. + + - Make sure the test suites passes after your commit: + `bundle exec rspec spec/acceptance` More information on [testing](#Testing) below + + - When introducing a new feature, make sure it is properly + documented in the README.md + + * Submission: + + * Pre-requisites: + + - Make sure you have a [GitHub account](https://github.com/join) + + - [Create a ticket](https://tickets.puppetlabs.com/secure/CreateIssue!default.jspa), or [watch the ticket](https://tickets.puppetlabs.com/browse/) you are patching for. + + * Preferred method: + + - Fork the repository on GitHub. + + - Push your changes to a topic branch in your fork of the + repository. (the format ticket/1234-short_description_of_change is + usually preferred for this project). + + - Submit a pull request to the repository in the puppetlabs + organization. + +The long version +================ + + 1. Make separate commits for logically separate changes. + + Please break your commits down into logically consistent units + which include new or changed tests relevant to the rest of the + change. The goal of doing this is to make the diff easier to + read for whoever is reviewing your code. In general, the easier + your diff is to read, the more likely someone will be happy to + review it and get it into the code base. + + If you are going to refactor a piece of code, please do so as a + separate commit from your feature or bug fix changes. + + We also really appreciate changes that include tests to make + sure the bug is not re-introduced, and that the feature is not + accidentally broken. + + Describe the technical detail of the change(s). If your + description starts to get too long, that is a good sign that you + probably need to split up your commit into more finely grained + pieces. + + Commits which plainly describe the things which help + reviewers check the patch and future developers understand the + code are much more likely to be merged in with a minimum of + bike-shedding or requested changes. Ideally, the commit message + would include information, and be in a form suitable for + inclusion in the release notes for the version of Puppet that + includes them. + + Please also check that you are not introducing any trailing + whitespace or other "whitespace errors". You can do this by + running "git diff --check" on your changes before you commit. + + 2. Sending your patches + + To submit your changes via a GitHub pull request, we _highly_ + recommend that you have them on a topic branch, instead of + directly on "master". + It makes things much easier to keep track of, especially if + you decide to work on another thing before your first change + is merged in. + + GitHub has some pretty good + [general documentation](http://help.github.com/) on using + their site. They also have documentation on + [creating pull requests](http://help.github.com/send-pull-requests/). + + In general, after pushing your topic branch up to your + repository on GitHub, you can switch to the branch in the + GitHub UI and click "Pull Request" towards the top of the page + in order to open a pull request. + + + 3. Update the related GitHub issue. + + If there is a GitHub issue associated with the change you + submitted, then you should update the ticket to include the + location of your branch, along with any other commentary you + may wish to make. + +Testing +======= + +Getting Started +--------------- + +Our puppet modules provide [`Gemfile`](./Gemfile)s which can tell a ruby +package manager such as [bundler](http://bundler.io/) what Ruby packages, +or Gems, are required to build, develop, and test this software. + +Please make sure you have [bundler installed](http://bundler.io/#getting-started) +on your system, then use it to install all dependencies needed for this project, +by running + +```shell +% bundle install +Fetching gem metadata from https://rubygems.org/........ +Fetching gem metadata from https://rubygems.org/.. +Using rake (10.1.0) +Using builder (3.2.2) +-- 8><-- many more --><8 -- +Using rspec-system-puppet (2.2.0) +Using serverspec (0.6.3) +Using rspec-system-serverspec (1.0.0) +Using bundler (1.3.5) +Your bundle is complete! +Use `bundle show [gemname]` to see where a bundled gem is installed. +``` + +NOTE some systems may require you to run this command with sudo. + +If you already have those gems installed, make sure they are up-to-date: + +```shell +% bundle update +``` + +With all dependencies in place and up-to-date we can now run the tests: + +```shell +% bundle exec rake spec +``` + +This will execute all the [rspec tests](http://rspec-puppet.com/) tests +under [spec/defines](./spec/defines), [spec/classes](./spec/classes), +and so on. rspec tests may have the same kind of dependencies as the +module they are testing. While the module defines in its [Modulefile](./Modulefile), +rspec tests define them in [.fixtures.yml](./fixtures.yml). + +Some puppet modules also come with [beaker](https://github.com/puppetlabs/beaker) +tests. These tests spin up a virtual machine under +[VirtualBox](https://www.virtualbox.org/)) with, controlling it with +[Vagrant](http://www.vagrantup.com/) to actually simulate scripted test +scenarios. In order to run these, you will need both of those tools +installed on your system. + +You can run them by issuing the following command + +```shell +% bundle exec rake spec_clean +% bundle exec rspec spec/acceptance +``` + +This will now download a pre-fabricated image configured in the [default node-set](./spec/acceptance/nodesets/default.yml), +install puppet, copy this module and install its dependencies per [spec/spec_helper_acceptance.rb](./spec/spec_helper_acceptance.rb) +and then run all the tests under [spec/acceptance](./spec/acceptance). + +Writing Tests +------------- + +XXX getting started writing tests. + +If you have commit access to the repository +=========================================== + +Even if you have commit access to the repository, you will still need to +go through the process above, and have someone else review and merge +in your changes. The rule is that all changes must be reviewed by a +developer on the project (that did not write the code) to ensure that +all changes go through a code review process. + +Having someone other than the author of the topic branch recorded as +performing the merge is the record that they performed the code +review. + + +Additional Resources +==================== + +* [Getting additional help](http://puppet.com/community/get-help) + +* [Writing tests](https://docs.puppet.com/guides/module_guides/bgtm.html#step-three-module-testing) + +* [General GitHub documentation](http://help.github.com/) + +* [GitHub pull request documentation](http://help.github.com/send-pull-requests/) + diff --git a/environments/prod/modules/mysql/Gemfile b/environments/prod/modules/mysql/Gemfile new file mode 100644 index 0000000..e8b3fa6 --- /dev/null +++ b/environments/prod/modules/mysql/Gemfile @@ -0,0 +1,52 @@ +#This file is generated by ModuleSync, do not edit. + +source ENV['GEM_SOURCE'] || "https://rubygems.org" + +def location_from_env(env, default_location = []) + if location = ENV[env] + if location =~ /^((?:git|https?)[:@][^#]*)#(.*)/ + [{ :git => $1, :branch => $2, :require => false }] + elsif location =~ /^file:\/\/(.*)/ + ['>= 0', { :path => File.expand_path($1), :require => false }] + else + [location, { :require => false }] + end + else + default_location + end +end + +group :development, :unit_tests do + gem 'metadata-json-lint' + gem 'puppet_facts' + gem 'puppet-blacksmith', '>= 3.4.0' + gem 'puppetlabs_spec_helper', '>= 1.2.1' + gem 'rspec-puppet', '>= 2.3.2' + gem 'rspec-puppet-facts' + gem 'mocha', '< 1.2.0' + gem 'simplecov' + gem 'parallel_tests', '< 2.10.0' if RUBY_VERSION < '2.0.0' + gem 'parallel_tests' if RUBY_VERSION >= '2.0.0' + gem 'rubocop', '0.41.2' if RUBY_VERSION < '2.0.0' + gem 'rubocop' if RUBY_VERSION >= '2.0.0' + gem 'rubocop-rspec', '~> 1.6' if RUBY_VERSION >= '2.3.0' + gem 'json_pure', '<= 2.0.1' if RUBY_VERSION < '2.0.0' + gem 'rspec-puppet-facts' +end +group :system_tests do + gem 'beaker', *location_from_env('BEAKER_VERSION', []) if RUBY_VERSION >= '2.3.0' + gem 'beaker', *location_from_env('BEAKER_VERSION', ['< 3']) if RUBY_VERSION < '2.3.0' + gem 'beaker-pe' if RUBY_VERSION >= '2.3.0' + gem 'beaker-rspec', *location_from_env('BEAKER_RSPEC_VERSION', ['>= 3.4']) + gem 'serverspec' + gem 'beaker-puppet_install_helper' + gem 'master_manipulator' + gem 'beaker-hostgenerator', *location_from_env('BEAKER_HOSTGENERATOR_VERSION', []) +end + +gem 'facter', *location_from_env('FACTER_GEM_VERSION') +gem 'puppet', *location_from_env('PUPPET_GEM_VERSION') + +if File.exists? "#{__FILE__}.local" + eval(File.read("#{__FILE__}.local"), binding) +end diff --git a/environments/prod/modules/mysql/LICENSE b/environments/prod/modules/mysql/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/environments/prod/modules/mysql/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/environments/prod/modules/mysql/NOTICE b/environments/prod/modules/mysql/NOTICE new file mode 100644 index 0000000..caaa8f4 --- /dev/null +++ b/environments/prod/modules/mysql/NOTICE @@ -0,0 +1,18 @@ +mysql puppet module + +Copyright (C) 2013-2016 Puppet Labs, Inc. + +Puppet Labs can be contacted at: info@puppetlabs.com + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/environments/prod/modules/mysql/README.md b/environments/prod/modules/mysql/README.md new file mode 100644 index 0000000..290d240 --- /dev/null +++ b/environments/prod/modules/mysql/README.md @@ -0,0 +1,1050 @@ +# mysql + +#### Table of Contents + +1. [Module Description - What the module does and why it is useful](#module-description) +2. [Setup - The basics of getting started with mysql](#setup) + * [Beginning with mysql](#beginning-with-mysql) +3. [Usage - Configuration options and additional functionality](#usage) + * [Customize server options](#customize-server-options) + * [Create a database](#create-a-database) + * [Customize configuration](#create-custom-configuration) + * [Work with an existing server](#work-with-an-existing-server) + * [Specify passwords](#specify-passwords) + * [Install Percona server on CentOS](#install-percona-server-on-centos) + * [Install MariaDB on Ubuntu](#install-mariadb-on-ubuntu) +4. [Reference - An under-the-hood peek at what the module is doing and how](#reference) +5. [Limitations - OS compatibility, etc.](#limitations) +6. [Development - Guide for contributing to the module](#development) + +## Module Description + +The mysql module installs, configures, and manages the MySQL service. + +This module manages both the installation and configuration of MySQL, as well as extending Puppet to allow management of MySQL resources, such as databases, users, and grants. + +## Setup + +### Beginning with mysql + +To install a server with the default options: + +`include '::mysql::server'`. + +To customize options, such as the root +password or `/etc/my.cnf` settings, you must also pass in an override hash: + +```puppet +class { '::mysql::server': + root_password => 'strongpassword', + remove_default_accounts => true, + override_options => $override_options +} +``` + +See [**Customize Server Options**](#customize-server-options) below for examples of the hash structure for $override_options`. + +## Usage + +All interaction for the server is done via `mysql::server`. To install the client, use `mysql::client`. To install bindings, use `mysql::bindings`. + +### Customize server options + +To define server options, structure a hash structure of overrides in `mysql::server`. This hash resembles a hash in the my.cnf file: + +```puppet +$override_options = { + 'section' => { + 'item' => 'thing', + } +} +``` + +For options that you would traditionally represent in this format: + +``` +[section] +thing = X +``` + +...you can make an entry like `thing => true`, `thing => value`, or `thing => "` in the hash. Alternatively, you can pass an array, as `thing => ['value', 'value2']`, or list each `thing => value` separately on separate lines. + +You can pass a variable in the hash without setting a value for it; the variable would then use MySQL's default settings. To exclude an option from the my.cnf file --- for example, when using `override_options` to revert to a default value --- pass `thing => undef`. + +If an option needs multiple instances, pass an array. For example, + +```puppet +$override_options = { + 'mysqld' => { + 'replicate-do-db' => ['base1', 'base2'], + } +} +``` + +produces + +``` +[mysqld] +replicate-do-db = base1 +replicate-do-db = base2 +``` + +To implement version specific parameters, specify the version, such as [mysqld-5.5]. This allows one config for different versions of MySQL. + +### Create a database + +To create a database with a user and some assigned privileges: + +```puppet +mysql::db { 'mydb': + user => 'myuser', + password => 'mypass', + host => 'localhost', + grant => ['SELECT', 'UPDATE'], +} +``` + +To use a different resource name with exported resources: + +```puppet + @@mysql::db { "mydb_${fqdn}": + user => 'myuser', + password => 'mypass', + dbname => 'mydb', + host => ${fqdn}, + grant => ['SELECT', 'UPDATE'], + tag => $domain, +} +``` + +Then you can collect it on the remote DB server: + +```puppet +Mysql::Db <<| tag == $domain |>> +``` + +If you set the sql parameter to a file when creating a database, the file is imported into the new database. + +For large sql files, increase the `import_timeout` parameter, which defaults to 300 seconds. + +```puppet +mysql::db { 'mydb': + user => 'myuser', + password => 'mypass', + host => 'localhost', + grant => ['SELECT', 'UPDATE'], + sql => '/path/to/sqlfile.gz', + import_cat_cmd => 'zcat', + import_timeout => 900, +} +``` + +### Customize configuration + +To add custom MySQL configuration, place additional files into `includedir`. This allows you to override settings or add additional ones, which is helpful if you don't use `override_options` in `mysql::server`. The `includedir` location is by default set to `/etc/mysql/conf.d`. + +### Work with an existing server + +To instantiate databases and users on an existing MySQL server, you need a `.my.cnf` file in `root`'s home directory. This file must specify the remote server address and credentials. For example: + +``` +[client] +user=root +host=localhost +password=secret +``` + +This module uses the `mysqld_version` fact to discover the server version being used. By default, this is set to the output of `mysqld -V`. If you're working with a remote MySQL server, you may need to set a custom fact for `mysqld_version` to ensure correct behaviour. + +When working with a remote server, do *not* use the `mysql::server` class in your Puppet manifests. + +### Specify passwords + +In addition to passing passwords as plain text, you can input them as hashes. For example: + +```puppet +mysql::db { 'mydb': + user => 'myuser', + password => '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4', + host => 'localhost', + grant => ['SELECT', 'UPDATE'], +} +``` + +### Install Percona server on CentOS + +This example shows how to do a minimal installation of a Percona server on a +CentOS system. This sets up the Percona server, client, and bindings (including Perl and Python bindings). You can customize this usage and update the version as needed. + +This usage has been tested on Puppet 4.4 / CentOS 7 / Percona Server 5.7. + +**Note:** The installation of the yum repository is not part of this package +and is here only to show a full example of how you can install. + +```puppet +yumrepo { 'percona': + descr => 'CentOS $releasever - Percona', + baseurl => 'http://repo.percona.com/centos/$releasever/os/$basearch/', + gpgkey => 'http://www.percona.com/downloads/percona-release/RPM-GPG-KEY-percona', + enabled => 1, + gpgcheck => 1, +} + +class {'mysql::server': + package_name => 'Percona-Server-server-57', + package_ensure => '5.7.11-4.1.el7', + service_name => 'mysql', + config_file => '/etc/my.cnf', + includedir => '/etc/my.cnf.d', + root_password => 'PutYourOwnPwdHere', + override_options => { + mysqld => { + log-error => '/var/log/mysqld.log', + pid-file => '/var/run/mysqld/mysqld.pid', + }, + mysqld_safe => { + log-error => '/var/log/mysqld.log', + }, + } +} + +# Note: Installing Percona-Server-server-57 also installs Percona-Server-client-57. +# This shows how to install the Percona MySQL client on its own +class {'mysql::client': + package_name => 'Percona-Server-client-57', + package_ensure => '5.7.11-4.1.el7', +} + +# These packages are normally installed along with Percona-Server-server-57 +# If you needed to install the bindings, however, you could do so with this code +class { 'mysql::bindings': + client_dev_package_name => 'Percona-Server-shared-57', + client_dev_package_ensure => '5.7.11-4.1.el7', + client_dev => true, + daemon_dev_package_name => 'Percona-Server-devel-57', + daemon_dev_package_ensure => '5.7.11-4.1.el7', + daemon_dev => true, + perl_enable => true, + perl_package_name => 'perl-DBD-MySQL', + python_enable => true, + python_package_name => 'MySQL-python', +} + +# Dependencies definition +Yumrepo['percona']-> +Class['mysql::server'] + +Yumrepo['percona']-> +Class['mysql::client'] + +Yumrepo['percona']-> +Class['mysql::bindings'] +``` + +### Install MariaDB on Ubuntu + +#### Optional: Install the MariaDB official repo + +In this example, we'll use the latest stable (currently 10.1) from the official MariaDB repository, not the one from the distro repository. You could instead use the package from the Ubuntu repository. Make sure you use the repository corresponding to the version you want. + +**Note:** `sfo1.mirrors.digitalocean.com` is one of many mirrors available. You can use any official mirror. + +``` +include apt + +apt::source { 'mariadb': + location => 'http://sfo1.mirrors.digitalocean.com/mariadb/repo/10.1/ubuntu', + release => $::lsbdistcodename, + repos => 'main', + key => { + id => '199369E5404BD5FC7D2FE43BCBCB082A1BB943DB', + server => 'hkp://keyserver.ubuntu.com:80', + }, + include => { + src => false, + deb => true, + }, +} +``` + +#### Install the MariaDB server + +This example shows MariaDB server installation on Ubuntu Trusty. Adjust the version and the parameters of `my.cnf` as needed. All parameters of the `my.cnf` can be defined using the `override_options` parameter. + +The folders `/var/log/mysql` and `/var/run/mysqld` are created automatically, but if you are using other custom folders, they should exist as prerequisites for this code. + +All the values set here are an example of a working minimal configuration. + +Specify the version of the package you want with the `package_ensure` parameter. + +``` +class {'::mysql::server': + package_name => 'mariadb-server', + package_ensure => '10.1.14+maria-1~trusty', + service_name => 'mysql', + root_password => 'AVeryStrongPasswordUShouldEncrypt!', + override_options => { + mysqld => { + 'log-error' => '/var/log/mysql/mariadb.log', + 'pid-file' => '/var/run/mysqld/mysqld.pid', + }, + mysqld_safe => { + 'log-error' => '/var/log/mysql/mariadb.log', + }, + } +} + +# Dependency management. Only use that part if you are installing the repository +# as shown in the Preliminary step of this example. +Apt::Source['mariadb'] ~> +Class['apt::update'] -> +Class['::mysql::server'] + +``` + +#### Install the MariaDB client + +This example shows how to install the MariaDB client and all of the bindings at once. You can do this installation separately from the server installation. + +Specify the version of the package you want with the `package_ensure` parameter. + +``` +class {'::mysql::client': + package_name => 'mariadb-client', + package_ensure => '10.1.14+maria-1~trusty', + bindings_enable => true, +} + +# Dependency management. Only use that part if you are installing the repository +# as shown in the Preliminary step of this example. +Apt::Source['mariadb'] ~> +Class['apt::update'] -> +Class['::mysql::client'] +``` + +## Reference + +### Classes + +#### Public classes + +* [`mysql::server`](#mysqlserver): Installs and configures MySQL. +* [`mysql::server::monitor`](#mysqlservermonitor): Sets up a monitoring user. +* [`mysql::server::mysqltuner`](#mysqlservermysqltuner): Installs MySQL tuner script. +* [`mysql::server::backup`](#mysqlserverbackup): Sets up MySQL backups via cron. +* [`mysql::bindings`](#mysqlbindings): Installs various MySQL language bindings. +* [`mysql::client`](#mysqlclient): Installs MySQL client (for non-servers). + +#### Private classes + +* `mysql::server::install`: Installs packages. +* `mysql::server::installdb`: Implements setup of mysqld data directory (e.g. /var/lib/mysql) +* `mysql::server::config`: Configures MYSQL. +* `mysql::server::service`: Manages service. +* `mysql::server::account_security`: Deletes default MySQL accounts. +* `mysql::server::root_password`: Sets MySQL root password. +* `mysql::server::providers`: Creates users, grants, and databases. +* `mysql::bindings::client_dev`: Installs MySQL client development package. +* `mysql::bindings::daemon_dev`: Installs MySQL daemon development package. +* `mysql::bindings::java`: Installs Java bindings. +* `mysql::bindings::perl`: Installs Perl bindings. +* `mysql::bindings::php`: Installs PHP bindings. +* `mysql::bindings::python`: Installs Python bindings. +* `mysql::bindings::ruby`: Installs Ruby bindings. +* `mysql::client::install`: Installs MySQL client. +* `mysql::backup::mysqldump`: Implements mysqldump backups. +* `mysql::backup::mysqlbackup`: Implements backups with Oracle MySQL Enterprise Backup. +* `mysql::backup::xtrabackup`: Implements backups with XtraBackup from Percona. + +### Parameters + +#### mysql::server + +##### `create_root_user` + +Whether root user should be created. Valid values are true, false. Defaults to true. + +This is useful for a cluster setup with Galera. The root user has to be created only once. You can set this parameter true on one node and set it to false on the remaining nodes. + +##### `create_root_my_cnf` + +Whether to create `/root/.my.cnf`. Valid values are true, false. Defaults to true. + +`create_root_my_cnf` allows creation of `/root/.my.cnf` independently of `create_root_user`. You can use this for a cluster setup with Galera where you want `/root/.my.cnf` to exist on all nodes. + +##### `root_password` + +The MySQL root password. Puppet attempts to set the root password and update `/root/.my.cnf` with it. + +This is required if `create_root_user` or `create_root_my_cnf` are true. If `root_password` is 'UNSET', then `create_root_user` and `create_root_my_cnf` are assumed to be false --- that is, the MySQL root user and `/root/.my.cnf` are not created. + +Password changes are supported; however, the old password must be set in `/root/.my.cnf`. Effectively, Puppet uses the old password, configured in `/root/my.cnf`, to set the new password in MySQL, and then updates `/root/.my.cnf` with the new password. + +##### `old_root_password` + +This parameter no longer does anything. It exists only for backwards compatibility. See the `root_password` parameter above for details on changing the root password. + +##### `override_options` + +Specifies override options to pass into MySQL. Structured like a hash in the my.cnf file: + +```puppet +$override_options = { + 'section' => { + 'item' => 'thing', + } +} +``` + +See [**Customize Server Options**](#customize-server-options) above for usage details. + +##### `config_file` + +The location, as a path, of the MySQL configuration file. + +##### `manage_config_file` + +Whether the MySQL configuration file should be managed. Valid values are true, false. Defaults to true. + +##### `includedir` +The location, as a path, of !includedir for custom configuration overrides. + +##### `install_options` +Passes [install_options](https://docs.puppetlabs.com/references/latest/type.html#package-attribute-install_options) array to managed package resources. You must pass the appropriate options for the specified package manager. + +##### `purge_conf_dir` + +Whether the `includedir` directory should be purged. Valid values are true, false. Defaults to false. + +##### `restart` + +Whether the service should be restarted when things change. Valid values are true, false. Defaults to false. + +##### `root_group` + +The name of the group used for root. Can be a group name or a group ID. See more about the [`group` file attribute](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-group). + +##### `mysql_group` + +The name of the group of the MySQL daemon user. Can be a group name or a group ID. See more about the [`group` file attribute](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-group). + +##### `package_ensure` + +Whether the package exists or should be a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Defaults to 'present'. + +##### `package_manage` + +Whether to manage the MySQL server package. Defaults to true. + +##### `package_name` + +The name of the MySQL server package to install. + +##### `remove_default_accounts` + +Specifies whether to automatically include `mysql::server::account_security`. Valid values are true, false. Defaults to false. + +##### `service_enabled` + +Specifies whether the service should be enabled. Valid values are true, false. Defaults to true. + +##### `service_manage` + +Specifies whether the service should be managed. Valid values are true, false. Defaults to true. + +##### `service_name` + +The name of the MySQL server service. Defaults are OS dependent, defined in params.pp. + +##### `service_provider` + +The provider to use to manage the service. For Ubuntu, defaults to 'upstart'; otherwise, default is undefined. + +##### `users` + +Optional hash of users to create, which are passed to [mysql_user](#mysql_user). + +``` +users => { + 'someuser@localhost' => { + ensure => 'present', + max_connections_per_hour => '0', + max_queries_per_hour => '0', + max_updates_per_hour => '0', + max_user_connections => '0', + password_hash => '*F3A2A51A9B0F2BE2468926B4132313728C250DBF', + tls_options => ['NONE'], + }, +} +``` + +##### `grants` + +Optional hash of grants, which are passed to [mysql_grant](#mysql_grant). + +``` +grants => { + 'someuser@localhost/somedb.*' => { + ensure => 'present', + options => ['GRANT'], + privileges => ['SELECT', 'INSERT', 'UPDATE', 'DELETE'], + table => 'somedb.*', + user => 'someuser@localhost', + }, +} +``` + +##### `databases` + +Optional hash of databases to create, which are passed to [mysql_database](#mysql_database). + +``` +databases => { + 'somedb' => { + ensure => 'present', + charset => 'utf8', + }, +} +``` + +#### mysql::server::backup + +##### `backupuser` + +MySQL user to create for backups. + +##### `backuppassword` + +MySQL user password for backups. + +##### `backupdir` + +Directory in which to store backups. + +##### `backupdirmode` + +Permissions applied to the backup directory. This parameter is passed directly +to the `file` resource. + +##### `backupdirowner` + +Owner for the backup directory. This parameter is passed directly to the `file` +resource. + +##### `backupdirgroup` + +Group owner for the backup directory. This parameter is passed directly to the +`file` resource. + +##### `backupcompress` + +Whether backups should be compressed. Valid values are true, false. Defaults to true. + +##### `backuprotate` + +How many days to keep backups. Valid value is an integer. Defaults to '30'. + +##### `delete_before_dump` + +Whether to delete old .sql files before backing up. Setting to true deletes old files before backing up, while setting to false deletes them after backup. Valid values are true, false. Defaults to false. + +##### `backupdatabases` + +Specifies an array of databases to back up. + +##### `file_per_database` + +Whether a separate file be used per database. Valid values are true, false. Defaults to false. + +##### `include_routines` + +Whether or not to include routines for each database when doing a `file_per_database` backup. Defaults to false. + +##### `include_triggers` + +Whether or not to include triggers for each database when doing a `file_per_database` backup. Defaults to false. + +##### `ensure` + +Allows you to remove the backup scripts. Valid values are 'present', 'absent'. Defaults to 'present'. + +##### `execpath` + +Allows you to set a custom PATH should your MySQL installation be non-standard places. Defaults to `/usr/bin:/usr/sbin:/bin:/sbin`. + +##### `time` + +An array of two elements to set the backup time. Allows ['23', '5'] (i.e., 23:05) or ['3', '45'] (i.e., 03:45) for HH:MM times. + +##### `postscript` + +A script that is executed when the backup is finished. This could be used to (r)sync the backup to a central store. This script can be either a single line that is directly executed or a number of lines supplied as an array. It could also be one or more externally managed (executable) files. + +##### `prescript` + +A script that is executed before the backup begins. + +##### `provider` + +Sets the server backup implementation. Valid values are: + +* `mysqldump`: Implements backups with mysqldump. Backup type: Logical. This is the default value. +* `mysqlbackup`: Implements backups with MySQL Enterprise Backup from Oracle. Backup type: Physical. To use this type of backup, you'll need the `meb` package, which is available in RPM and TAR formats from Oracle. For Ubuntu, you can use [meb-deb](https://github.com/dveeden/meb-deb) to create a package from an official tarball. +* `xtrabackup`: Implements backups with XtraBackup from Percona. Backup type: Physical. + +##### `maxallowedpacket` + +Defines the maximum SQL statement size for the backup dump script. The default value is 1MB, as this is the default MySQL Server value. + +#### mysql::server::monitor + +##### `mysql_monitor_username` + +The username to create for MySQL monitoring. + +##### `mysql_monitor_password` + +The password to create for MySQL monitoring. + +##### `mysql_monitor_hostname` + +The hostname from which the monitoring user requests are allowed access. + +#### mysql::server::mysqltuner + +**Note**: If you're using this class on a non-network-connected system, you must download the mysqltuner.pl script and have it hosted somewhere accessible via `http(s)://`, `puppet://`, `ftp://`, or a fully qualified file path. + +##### `ensure` + +Ensures that the resource exists. Valid values are `present`, `absent`. Defaults to `present`. + +##### `version` + +The version to install from the major/MySQLTuner-perl github repository. Must be a valid tag. Defaults to 'v1.3.0'. + +##### `source` + +Specifies the source. If not specified, defaults to `https://github.com/major/MySQLTuner-perl/raw/${version}/mysqltuner.pl` + +#### mysql::bindings + +##### `client_dev` + +Specifies whether `::mysql::bindings::client_dev` should be included. Valid values are true', false. Defaults to false. + +##### `daemon_dev` + +Specifies whether `::mysql::bindings::daemon_dev` should be included. Valid values are true, false. Defaults to false. + +##### `java_enable` + +Specifies whether `::mysql::bindings::java` should be included. Valid values are true, false. Defaults to false. + +##### `perl_enable` + +Specifies whether `mysql::bindings::perl` should be included. Valid values are true, false. Defaults to false. + +##### `php_enable` + +Specifies whether `mysql::bindings::php` should be included. Valid values are true, false. Defaults to false. + +##### `python_enable` + +Specifies whether `mysql::bindings::python` should be included. Valid values are true, false. Defaults to false. + +##### `ruby_enable` + +Specifies whether `mysql::bindings::ruby` should be included. Valid values are true, false. Defaults to false. + +##### `install_options` + +Passes `install_options` array to managed package resources. You must pass the [appropriate options](https://docs.puppetlabs.com/references/latest/type.html#package-attribute-install_options) for the package manager(s). + +##### `client_dev_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `client_dev => true`. + +##### `client_dev_package_name` + +The name of the client_dev package to install. Only applies if `client_dev => true`. + +##### `client_dev_package_provider` + +The provider to use to install the client_dev package. Only applies if `client_dev => true`. + +##### `daemon_dev_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `daemon_dev => true`. + +##### `daemon_dev_package_name` + +The name of the daemon_dev package to install. Only applies if `daemon_dev => true`. + +##### `daemon_dev_package_provider` + +The provider to use to install the daemon_dev package. Only applies if `daemon_dev => true`. + +##### `java_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `java_enable => true`. + +##### `java_package_name` + +The name of the Java package to install. Only applies if `java_enable => true`. + +##### `java_package_provider` + +The provider to use to install the Java package. Only applies if `java_enable => true`. + +##### `perl_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `perl_enable => true`. + +##### `perl_package_name` + +The name of the Perl package to install. Only applies if `perl_enable => true`. + +##### `perl_package_provider` + +The provider to use to install the Perl package. Only applies if `perl_enable => true`. + +##### `php_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `php_enable => true`. + +##### `php_package_name` + +The name of the PHP package to install. Only applies if `php_enable => true`. + +##### `python_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `python_enable => true`. + +##### `python_package_name` + +The name of the Python package to install. Only applies if `python_enable => true`. + +##### `python_package_provider` + +The provider to use to install the PHP package. Only applies if `python_enable => true`. + +##### `ruby_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `ruby_enable => true`. + +##### `ruby_package_name` + +The name of the Ruby package to install. Only applies if `ruby_enable => true`. + +##### `ruby_package_provider` + +What provider should be used to install the package. + +#### mysql::client + +##### `bindings_enable` + +Whether to automatically install all bindings. Valid values are true, false. Default to false. + +##### `install_options` +Array of install options for managed package resources. You must pass the appropriate options for the package manager. + +##### `package_ensure` + +Whether the MySQL package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. + +##### `package_manage` + +Whether to manage the MySQL client package. Defaults to true. + +##### `package_name` + +The name of the MySQL client package to install. + +### Defines + +#### mysql::db + +``` +mysql_database { 'information_schema': + ensure => 'present', + charset => 'utf8', + collate => 'utf8_swedish_ci', +} +mysql_database { 'mysql': + ensure => 'present', + charset => 'latin1', + collate => 'latin1_swedish_ci', +} +``` + +##### `user` + +The user for the database you're creating. + +##### `password` + +The password for $user for the database you're creating. + +##### `dbname` + +The name of the database to create. Defaults to $name. + +##### `charset` + +The character set for the database. Defaults to 'utf8'. + +##### `collate` + +The collation for the database. Defaults to 'utf8_general_ci'. + +##### `host` + +The host to use as part of user@host for grants. Defaults to 'localhost'. + +##### `grant` + +The privileges to be granted for user@host on the database. Defaults to 'ALL'. + +##### `sql` + +The path to the sqlfile you want to execute. This can be single file specified as string, or it can be an array of strings. Defaults to undef. + +##### `enforce_sql` + +Specifies whether executing the sqlfiles should happen on every run. If set to false, sqlfiles only run once. Valid values are true, false. Defaults to false. + +##### `ensure` + +Specifies whether to create the database. Valid values are 'present', 'absent'. Defaults to 'present'. + +##### `import_timeout` + +Timeout, in seconds, for loading the sqlfiles. Defaults to '300'. + +##### `import_cat_cmd` + +Command to read the sqlfile for importing the database. Useful for compressed sqlfiles. For example, you can use 'zcat' for .gz files. Defaults to 'cat'. + +### Types + +#### mysql_database + +`mysql_database` creates and manages databases within MySQL. + +##### `ensure` + +Whether the resource is present. Valid values are 'present', 'absent'. Defaults to 'present'. + +##### `name` + +The name of the MySQL database to manage. + +##### `charset` + +The CHARACTER SET setting for the database. Defaults to ':utf8'. + +##### `collate` + +The COLLATE setting for the database. Defaults to ':utf8_general_ci'. + +#### mysql_user + +Creates and manages user grants within MySQL. + +``` +mysql_user { 'root@127.0.0.1': + ensure => 'present', + max_connections_per_hour => '0', + max_queries_per_hour => '0', + max_updates_per_hour => '0', + max_user_connections => '0', +} +``` + +You can also specify an authentication plugin. + +``` +mysql_user{ 'myuser'@'localhost': + ensure => 'present', + plugin => 'unix_socket', +} +``` + +TLS options can be specified for a user. +``` +mysql_user{ 'myuser'@'localhost': + ensure => 'present', + tls_options => ['SSL'], +} +``` + +##### `name` + +The name of the user, as 'username@hostname' or username@hostname. + +##### `password_hash` + +The user's password hash of the user. Use mysql_password() for creating such a hash. + +##### `max_user_connections` + +Maximum concurrent connections for the user. Must be an integer value. A value of '0' specifies no (or global) limit. + +##### `max_connections_per_hour` + +Maximum connections per hour for the user. Must be an integer value. A value of '0' specifies no (or global) limit. + +##### `max_queries_per_hour` + +Maximum queries per hour for the user. Must be an integer value. A value of '0' specifies no (or global) limit. + +##### `max_updates_per_hour` + +Maximum updates per hour for the user. Must be an integer value. A value of '0' specifies no (or global) limit. + +##### `tls_options` + +SSL-related options for a MySQL account, using one or more tls_option values. 'NONE' specifies that the account has no TLS options enforced, and the available options are 'SSL', 'X509', 'CIPHER *cipher*', 'ISSUER *issuer*', 'SUBJECT *subject*'; as stated in the MySQL documentation. + + +#### mysql_grant + +`mysql_grant` creates grant permissions to access databases within MySQL. To create grant permissions to access databases with MySQL, use it you must create the title of the resource as shown below, following the pattern of `username@hostname/database.table`: + +``` +mysql_grant { 'root@localhost/*.*': + ensure => 'present', + options => ['GRANT'], + privileges => ['ALL'], + table => '*.*', + user => 'root@localhost', +} +``` + +It is possible to specify privileges down to the column level: + +``` +mysql_grant { 'root@localhost/mysql.user': + ensure => 'present', + privileges => ['SELECT (Host, User)'], + table => 'mysql.user', + user => 'root@localhost', +} +``` + +To revoke GRANT privilege specify ['NONE']. + +##### `ensure` + +Whether the resource is present. Valid values are 'present', 'absent'. Defaults to 'present'. + +##### `name` + +Name to describe the grant. Must in a 'user/table' format. + +##### `privileges` + +Privileges to grant the user. + +##### `table` + +The table to which privileges are applied. + +##### `user` + +User to whom privileges are granted. + +##### `options` + +MySQL options to grant. Optional. + +#### mysql_plugin + +`mysql_plugin` can be used to load plugins into the MySQL Server. + +``` +mysql_plugin { 'auth_socket': + ensure => 'present', + soname => 'auth_socket.so', +} +``` + +##### `ensure` + +Whether the resource is present. Valid values are 'present', 'absent'. Defaults to 'present'. + +##### `name` + +The name of the MySQL plugin to manage. + +##### `soname` + +The library file name. + +#### `mysql_datadir` + +Initializes the MySQL data directory with version specific code. Pre MySQL 5.7.6 +it uses mysql_install_db. After MySQL 5.7.6 it uses mysqld --initialize-insecure. + +Insecure initialization is needed, as mysqld version 5.7 introduced "secure by default" mode. +This means MySQL generates a random password and writes it to STDOUT. This means puppet +can never accesss the database server afterwards, as no credencials are available. + +This type is an internal type and should not be called directly. + +### Facts + +#### `mysql_version` + +Determines the MySQL version by parsing the output from `mysql --version` + +#### `mysql_server_id` + +Generates a unique id, based on the node's MAC address, which can be used as +`server_id`. This fact will *always* return `0` on nodes that have only +loopback interfaces. Because those nodes aren't connected to the outside world, this shouldn't cause any conflicts. + +## Limitations + +This module has been tested on: + +* RedHat Enterprise Linux 5, 6, 7 +* Debian 6, 7, 8 +* CentOS 5, 6, 7 +* Ubuntu 10.04, 12.04, 14.04, 16.04 +* Scientific Linux 5, 6 +* SLES 11 + +Testing on other platforms has been minimal and cannot be guaranteed. + +**Note:** The mysqlbackup.sh does not work and is not supported on MySQL 5.7 and greater. + +## Development + +Puppet Labs modules on the Puppet Forge are open projects, and community +contributions are essential for keeping them great. We can't access the +huge number of platforms and myriad of hardware, software, and deployment +configurations that Puppet is intended to serve. + +We want to keep it as easy as possible to contribute changes so that our +modules work in your environment. There are a few guidelines that we need +contributors to follow so that we can have a chance of keeping on top of things. + +Check out our the complete [module contribution guide](https://docs.puppetlabs.com/forge/contributing.html). + +### Authors + +This module is based on work by David Schmitt. The following contributors have contributed to this module (beyond Puppet Labs): + +* Larry Ludwig +* Christian G. Warden +* Daniel Black +* Justin Ellison +* Lowe Schmidt +* Matthias Pigulla +* William Van Hevelingen +* Michael Arnold +* Chris Weyl +* Daniël van Eeden +* Jan-Otto Kröpke diff --git a/environments/prod/modules/mysql/Rakefile b/environments/prod/modules/mysql/Rakefile new file mode 100644 index 0000000..3e8d4cb --- /dev/null +++ b/environments/prod/modules/mysql/Rakefile @@ -0,0 +1,38 @@ +require 'puppet_blacksmith/rake_tasks' +require 'puppet-lint/tasks/puppet-lint' +require 'puppetlabs_spec_helper/rake_tasks' + +PuppetLint.configuration.send('relative') +PuppetLint.configuration.send('disable_documentation') +PuppetLint.configuration.send('disable_single_quote_string_with_variables') + +desc 'Generate pooler nodesets' +task :gen_nodeset do + require 'beaker-hostgenerator' + require 'securerandom' + require 'fileutils' + + agent_target = ENV['TEST_TARGET'] + if ! agent_target + STDERR.puts 'TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat-64default."' + agent_target = 'redhat-64default.' + end + + master_target = ENV['MASTER_TEST_TARGET'] + if ! master_target + STDERR.puts 'MASTER_TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat7-64mdcl"' + master_target = 'redhat7-64mdcl' + end + + targets = "#{master_target}-#{agent_target}" + cli = BeakerHostGenerator::CLI.new([targets]) + nodeset_dir = "tmp/nodesets" + nodeset = "#{nodeset_dir}/#{targets}-#{SecureRandom.uuid}.yaml" + FileUtils.mkdir_p(nodeset_dir) + File.open(nodeset, 'w') do |fh| + fh.print(cli.execute) + end + puts nodeset +end diff --git a/environments/prod/modules/mysql/TODO b/environments/prod/modules/mysql/TODO new file mode 100644 index 0000000..3913293 --- /dev/null +++ b/environments/prod/modules/mysql/TODO @@ -0,0 +1,8 @@ +The best that I can tell is that this code traces back to David Schmitt. It has been forked many times since then :) + +1. you cannot add databases to an instance that has a root password +2. you have to specify username as USER@BLAH or it cannot be found +3. mysql_grant does not complain if user does not exist +4. Needs support for pre-seeding on debian +5. the types may need to take user/password +6. rather or not to configure /etc/.my.cnf should be configurable diff --git a/environments/prod/modules/mysql/checksums.json b/environments/prod/modules/mysql/checksums.json new file mode 100644 index 0000000..a07fb79 --- /dev/null +++ b/environments/prod/modules/mysql/checksums.json @@ -0,0 +1,115 @@ +{ + "CHANGELOG.md": "b68d316974b7228a92b8a8c3b65bb9a4", + "CONTRIBUTING.md": "b78f71c1104f00538d50ad2775f58e95", + "Gemfile": "fda543906c8c75b06ea37c4d31b95292", + "LICENSE": "3b83ef96387f14655fc854ddc3c6bd57", + "NOTICE": "d43aacde256c8e55a50e2425e25b3a8a", + "README.md": "b4969d0b8649dd0f9c105ff22b66a871", + "Rakefile": "6db744f1deed7ae0746abe59e3d50863", + "TODO": "88ca4024a37992b46c34cb46e4ac39e6", + "examples/backup.pp": "a61c6f34f153a323209faf25948737f5", + "examples/bindings.pp": "35a8387f5c55fa2e479c513a67918674", + "examples/java.pp": "0ad9de4f9f2c049642bcf08124757085", + "examples/mysql_database.pp": "107ee8793f7b4a12cfca32eddccc6bbd", + "examples/mysql_db.pp": "55d2d603f9fb8ab3c8a781d08119aa69", + "examples/mysql_grant.pp": "cd42336a6c7b2d27f5d5d6d0e310ee1a", + "examples/mysql_plugin.pp": "4f86c988a99b131e736501a309604e94", + "examples/mysql_user.pp": "0b76964aebb01714745548e0f2f32fd3", + "examples/perl.pp": "454f14dc4492fcf04afbe81b2776917e", + "examples/python.pp": "355a7e1ea3978a8fd290b5bc28b63808", + "examples/ruby.pp": "a6ae0381aacc5a8d2c403e606c6df0f0", + "examples/server/account_security.pp": "375442b7886c01b42fbf75a1fcb31822", + "examples/server/config.pp": "659b7c40e9b55634721b3c33a8c6da98", + "examples/server.pp": "72e22552a95b9a5e4a349dbfc13639dc", + "lib/facter/mysql_server_id.rb": "10de205ca9dc83b68cf63b52d97346ec", + "lib/facter/mysql_version.rb": "e30648f3d394a1cbdd4e54eb5c28d28c", + "lib/facter/mysqld_version.rb": "720f447c97dd4ce099006cd5391ade57", + "lib/puppet/parser/functions/mysql_deepmerge.rb": "2b5040ee8cd75a81cf881851e922833a", + "lib/puppet/parser/functions/mysql_dirname.rb": "820ba09a6a0df639da560b41cb31242f", + "lib/puppet/parser/functions/mysql_password.rb": "365a0ba55f0d04d0f5d56abcd577ec7d", + "lib/puppet/parser/functions/mysql_strip_hash.rb": "3efe69f1eb189b2913e178b8472aaede", + "lib/puppet/provider/mysql.rb": "2696893220da9d341d5826c9e9d4ca19", + "lib/puppet/provider/mysql_database/mysql.rb": "5cf9b8044df4ec72a726b5f781c84f8f", + "lib/puppet/provider/mysql_datadir/mysql.rb": "7c256b40cf96bdafde9c762ab867de80", + "lib/puppet/provider/mysql_grant/mysql.rb": "3630023349a4c8f06932938a26aaa2e6", + "lib/puppet/provider/mysql_plugin/mysql.rb": "49128d2a9a547c4945735bfd75fd6d6c", + "lib/puppet/provider/mysql_user/mysql.rb": "dc09eef4e1d879ffe4ee8eb9a7b3026c", + "lib/puppet/type/mysql_database.rb": "438eafbfecc30605462a220d92cf9603", + "lib/puppet/type/mysql_datadir.rb": "f19e548062e81f424646c193b086aaf6", + "lib/puppet/type/mysql_grant.rb": "afcc65b0394a23e95b8bf932bc6110b4", + "lib/puppet/type/mysql_plugin.rb": "0a52cead6c9283c9aa14ea71bdfa80bd", + "lib/puppet/type/mysql_user.rb": "8cc3c0851c06d01b310a7f551945e696", + "manifests/backup/mysqlbackup.pp": "66441b167e682689df21a4b37af175e8", + "manifests/backup/mysqldump.pp": "d858a7dda445c45952f6a7f029d41189", + "manifests/backup/xtrabackup.pp": "ebf4f4765fbbedbdc49acad9dd539a6b", + "manifests/bindings/client_dev.pp": "80753f1bf48de71d2ca1a6cfda4830be", + "manifests/bindings/daemon_dev.pp": "94d2d74afc2b247593877cebd548ed76", + "manifests/bindings/java.pp": "556b743dc162d2f3264708b0b7ba0328", + "manifests/bindings/perl.pp": "4ecbd448ceac580a07df34b5d3e24837", + "manifests/bindings/php.pp": "641139f1f27085b8e72ac73fb8bc39d8", + "manifests/bindings/python.pp": "ef9e674237eddd7e98ab307131b11069", + "manifests/bindings/ruby.pp": "32b0a32161f7a5b50562cb8e154207d9", + "manifests/bindings.pp": "8becf04105d44910f12986a58cd566f7", + "manifests/client/install.pp": "7b5810404cc9411ec38de404749f1266", + "manifests/client.pp": "c350bd6d108acb03a87b860b14d225ef", + "manifests/db.pp": "fada45e451ec7563dab714d12b9e330b", + "manifests/params.pp": "816c5cf78525ab2917da4ce1a888dfe6", + "manifests/server/account_security.pp": "36a293eec189ec1bdfe92b370d087085", + "manifests/server/backup.pp": "6ed4f8c9aac5d7f17bf5c10fceddde41", + "manifests/server/binarylog.pp": "d61af28d0f9c07cfa23c63a7cdd364bf", + "manifests/server/config.pp": "650f0ba40b9148e66f910465e63b1170", + "manifests/server/install.pp": "3cbbf313b940b582e73c229f4a8c0720", + "manifests/server/installdb.pp": "ccc13d3cbeb78b0c144006a256e40079", + "manifests/server/monitor.pp": "3810b5d756a3661e92d709115982cd59", + "manifests/server/mysqltuner.pp": "24d04e0b24cf3b31b6798bc76eed32b6", + "manifests/server/providers.pp": "87a019dce5bbb6b18c9aa61b5f99134c", + "manifests/server/root_password.pp": "5790e04defe2a64d145975abdfcfd3ac", + "manifests/server/service.pp": "e9d4256c2830a8b300822616c408ce95", + "manifests/server.pp": "3f3915a73ff075eca009f5656b225e6d", + "metadata.json": "2cc79c0e6902c12c1b33eca2e192ea29", + "spec/acceptance/mysql_backup_spec.rb": "ef6f0d033e87a8a9f8457f89ad8ea118", + "spec/acceptance/mysql_db_spec.rb": "c093f0d25c7000713b444706b6cfd1c7", + "spec/acceptance/mysql_helper.rb": "b95d8fd15325f1ece1cd652dc60c7608", + "spec/acceptance/mysql_server_spec.rb": "b3362859a6cdc38cfabf1c5a63a4fc57", + "spec/acceptance/nodesets/centos-7-x64.yml": "a713f3abd3657f0ae2878829badd23cd", + "spec/acceptance/nodesets/debian-8-x64.yml": "d2d2977900989f30086ad251a14a1f39", + "spec/acceptance/nodesets/default.yml": "b42da5a1ea0c964567ba7495574b8808", + "spec/acceptance/nodesets/docker/centos-7.yml": "8a3892807bdd62306ae4774f41ba11ae", + "spec/acceptance/nodesets/docker/debian-8.yml": "ac8e871d1068c96de5e85a89daaec6df", + "spec/acceptance/nodesets/docker/ubuntu-14.04.yml": "dc42ee922a96908d85b8f0f08203ce58", + "spec/acceptance/types/mysql_database_spec.rb": "047db055103fa9782bc6714297eb2a09", + "spec/acceptance/types/mysql_grant_spec.rb": "216d93f0937dbdb5fc58a61bd2150d62", + "spec/acceptance/types/mysql_plugin_spec.rb": "107f32d267daa847996ff992ccec8c06", + "spec/acceptance/types/mysql_user_spec.rb": "5d04dc3b3ffd0778f83038833ef72bf2", + "spec/classes/graceful_failures_spec.rb": "91481f693c3f71dff22524189438bcc6", + "spec/classes/mycnf_template_spec.rb": "07fc36d51b592eba1f94d39208c2701f", + "spec/classes/mysql_bindings_spec.rb": "14c5abbe4ae20278d1a4a02254bf312b", + "spec/classes/mysql_client_spec.rb": "b1fa7a5a06585697f7100d1891d359ed", + "spec/classes/mysql_server_account_security_spec.rb": "97b6caf04a7a75a88e58728edcfc11cb", + "spec/classes/mysql_server_backup_spec.rb": "964357b46daa237c92cc61b88a20093b", + "spec/classes/mysql_server_monitor_spec.rb": "aef3aa73265b42b66b963a09e5f32f1f", + "spec/classes/mysql_server_mysqltuner_spec.rb": "55ff6dad45a8dfef97d52dff0b111a36", + "spec/classes/mysql_server_spec.rb": "99806ad51b124bf8ca9dad201962b743", + "spec/defines/mysql_db_spec.rb": "afb2d6cfa051dd4d8301d7aede1aa1c4", + "spec/spec.opts": "a600ded995d948e393fbe2320ba8e51c", + "spec/spec_helper.rb": "b2db3bc02b4ac2fd5142a6621c641b07", + "spec/spec_helper_acceptance.rb": "2d7d8e8a6d1225ba6bf57a4f05dfff0c", + "spec/spec_helper_local.rb": "05db024c91eb5d5141b67d97b01a58b4", + "spec/unit/facter/mysql_server_id_spec.rb": "4a01f2323a400c82d89f37847c3c9611", + "spec/unit/facter/mysql_version_spec.rb": "f593c725b83a7bbf1f0fdc13bf1531df", + "spec/unit/facter/mysqld_version_spec.rb": "f5495c63a64d21be175d329cc5a3a8cd", + "spec/unit/puppet/functions/mysql_deepmerge_spec.rb": "f6102e1f82fb9f4aa38cbf3955ee5973", + "spec/unit/puppet/functions/mysql_password_spec.rb": "8fe68dc4ec13fc6ade18defe54cac8d4", + "spec/unit/puppet/provider/mysql_database/mysql_spec.rb": "98a799433ac10b237ac3ad27441610d4", + "spec/unit/puppet/provider/mysql_plugin/mysql_spec.rb": "914bac73bb9841ec7d7041488a55d442", + "spec/unit/puppet/provider/mysql_user/mysql_spec.rb": "174e7e3a97529fdcc2e6ba24e65cf8d2", + "spec/unit/puppet/type/mysql_database_spec.rb": "9fa0d390c2e15c8a52fc2b981e2a63fc", + "spec/unit/puppet/type/mysql_grant_spec.rb": "1a003358dc88a74ef21fb33fc71debef", + "spec/unit/puppet/type/mysql_plugin_spec.rb": "7ebacf228dfd0c60811bdf8a28a329ff", + "spec/unit/puppet/type/mysql_user_spec.rb": "e902ad1b9578dce35e13750c7967ef1d", + "templates/meb.cnf.erb": "b6422b19ee97b8a2883bfac44fdc0292", + "templates/my.cnf.erb": "535d2ff37fea6b11ad928224965143d3", + "templates/my.cnf.pass.erb": "11f80afb0993a436f074a43f70733999", + "templates/mysqlbackup.sh.erb": "0cc74138c7a5dd5d3864f94227717bd4", + "templates/xtrabackup.sh.erb": "219b487c4faad80a897cda6973b81741" +} \ No newline at end of file diff --git a/environments/prod/modules/mysql/examples/backup.pp b/environments/prod/modules/mysql/examples/backup.pp new file mode 100644 index 0000000..4bdf804 --- /dev/null +++ b/environments/prod/modules/mysql/examples/backup.pp @@ -0,0 +1,9 @@ +class { 'mysql::server': + root_password => 'password' +} + +class { 'mysql::server::backup': + backupuser => 'myuser', + backuppassword => 'mypassword', + backupdir => '/tmp/backups', +} diff --git a/environments/prod/modules/mysql/examples/bindings.pp b/environments/prod/modules/mysql/examples/bindings.pp new file mode 100644 index 0000000..e4e325c --- /dev/null +++ b/environments/prod/modules/mysql/examples/bindings.pp @@ -0,0 +1,3 @@ +class { 'mysql::bindings': + php_enable => true, +} diff --git a/environments/prod/modules/mysql/examples/java.pp b/environments/prod/modules/mysql/examples/java.pp new file mode 100644 index 0000000..0fc009a --- /dev/null +++ b/environments/prod/modules/mysql/examples/java.pp @@ -0,0 +1 @@ +class { 'mysql::java':} diff --git a/environments/prod/modules/mysql/examples/mysql_database.pp b/environments/prod/modules/mysql/examples/mysql_database.pp new file mode 100644 index 0000000..47a328c --- /dev/null +++ b/environments/prod/modules/mysql/examples/mysql_database.pp @@ -0,0 +1,17 @@ +class { 'mysql::server': + root_password => 'password' +} +mysql::db{ ['test1', 'test2', 'test3']: + ensure => present, + charset => 'utf8', + require => Class['mysql::server'], +} +mysql::db{ 'test4': + ensure => present, + charset => 'latin1', +} +mysql::db{ 'test5': + ensure => present, + charset => 'binary', + collate => 'binary', +} diff --git a/environments/prod/modules/mysql/examples/mysql_db.pp b/environments/prod/modules/mysql/examples/mysql_db.pp new file mode 100644 index 0000000..43c619f --- /dev/null +++ b/environments/prod/modules/mysql/examples/mysql_db.pp @@ -0,0 +1,17 @@ +class { 'mysql::server': + root_password => 'password' +} +mysql::db { 'mydb': + user => 'myuser', + password => 'mypass', + host => 'localhost', + grant => ['SELECT', 'UPDATE'], +} +mysql::db { "mydb_${fqdn}": + user => 'myuser', + password => 'mypass', + dbname => 'mydb', + host => $::fqdn, + grant => ['SELECT', 'UPDATE'], + tag => $domain, +} diff --git a/environments/prod/modules/mysql/examples/mysql_grant.pp b/environments/prod/modules/mysql/examples/mysql_grant.pp new file mode 100644 index 0000000..20fe78d --- /dev/null +++ b/environments/prod/modules/mysql/examples/mysql_grant.pp @@ -0,0 +1,5 @@ +mysql_grant{'test1@localhost/redmine.*': + user => 'test1@localhost', + table => 'redmine.*', + privileges => ['UPDATE'], +} diff --git a/environments/prod/modules/mysql/examples/mysql_plugin.pp b/environments/prod/modules/mysql/examples/mysql_plugin.pp new file mode 100644 index 0000000..d802759 --- /dev/null +++ b/environments/prod/modules/mysql/examples/mysql_plugin.pp @@ -0,0 +1,23 @@ +class { 'mysql::server': + root_password => 'password' +} + +$validate_password_soname = $::osfamily ? { + windows => 'validate_password.dll', + default => 'validate_password.so' +} + +mysql::plugin { 'validate_password': + ensure => present, + soname => $validate_password_soname, +} + +$auth_socket_soname = $::osfamily ? { + windows => 'auth_socket.dll', + default => 'auth_socket.so' +} + +mysql::plugin { 'auth_socket': + ensure => present, + soname => $auth_socket_soname, +} diff --git a/environments/prod/modules/mysql/examples/mysql_user.pp b/environments/prod/modules/mysql/examples/mysql_user.pp new file mode 100644 index 0000000..c471868 --- /dev/null +++ b/environments/prod/modules/mysql/examples/mysql_user.pp @@ -0,0 +1,32 @@ +$mysql_root_pw = 'password' + +class { 'mysql::server': + root_password => 'password', +} + +mysql_user{ 'redmine@localhost': + ensure => present, + password_hash => mysql_password('redmine'), + require => Class['mysql::server'], +} + +mysql_user{ 'dan@localhost': + ensure => present, + password_hash => mysql_password('blah') +} + +mysql_user{ 'dan@%': + ensure => present, + password_hash => mysql_password('blah'), +} + +mysql_user{ 'socketplugin@%': + ensure => present, + plugin => 'unix_socket', +} + +mysql_user{ 'socketplugin@%': + ensure => present, + password_hash => mysql_password('blah'), + plugin => 'mysql_native_password', +} diff --git a/environments/prod/modules/mysql/examples/perl.pp b/environments/prod/modules/mysql/examples/perl.pp new file mode 100644 index 0000000..1bbd3ab --- /dev/null +++ b/environments/prod/modules/mysql/examples/perl.pp @@ -0,0 +1 @@ +include mysql::bindings::perl diff --git a/environments/prod/modules/mysql/examples/python.pp b/environments/prod/modules/mysql/examples/python.pp new file mode 100644 index 0000000..49ddddb --- /dev/null +++ b/environments/prod/modules/mysql/examples/python.pp @@ -0,0 +1 @@ +class { 'mysql::bindings::python':} diff --git a/environments/prod/modules/mysql/examples/ruby.pp b/environments/prod/modules/mysql/examples/ruby.pp new file mode 100644 index 0000000..6717256 --- /dev/null +++ b/environments/prod/modules/mysql/examples/ruby.pp @@ -0,0 +1 @@ +include mysql::bindings::ruby diff --git a/environments/prod/modules/mysql/examples/server.pp b/environments/prod/modules/mysql/examples/server.pp new file mode 100644 index 0000000..8afdd00 --- /dev/null +++ b/environments/prod/modules/mysql/examples/server.pp @@ -0,0 +1,3 @@ +class { 'mysql::server': + root_password => 'password', +} diff --git a/environments/prod/modules/mysql/examples/server/account_security.pp b/environments/prod/modules/mysql/examples/server/account_security.pp new file mode 100644 index 0000000..cb59f4f --- /dev/null +++ b/environments/prod/modules/mysql/examples/server/account_security.pp @@ -0,0 +1,4 @@ +class { 'mysql::server': + root_password => 'password', +} +class { 'mysql::server::account_security': } diff --git a/environments/prod/modules/mysql/examples/server/config.pp b/environments/prod/modules/mysql/examples/server/config.pp new file mode 100644 index 0000000..2cde11b --- /dev/null +++ b/environments/prod/modules/mysql/examples/server/config.pp @@ -0,0 +1,3 @@ +mysql::server::config { 'testfile': + +} diff --git a/environments/prod/modules/mysql/lib/facter/mysql_server_id.rb b/environments/prod/modules/mysql/lib/facter/mysql_server_id.rb new file mode 100644 index 0000000..3cb39e5 --- /dev/null +++ b/environments/prod/modules/mysql/lib/facter/mysql_server_id.rb @@ -0,0 +1,9 @@ +def get_mysql_id + Facter.value(:macaddress).split(':')[2..-1].inject(0) { |total,value| (total << 6) + value.hex } +end + +Facter.add("mysql_server_id") do + setcode do + get_mysql_id rescue nil + end +end diff --git a/environments/prod/modules/mysql/lib/facter/mysql_version.rb b/environments/prod/modules/mysql/lib/facter/mysql_version.rb new file mode 100644 index 0000000..62fba61 --- /dev/null +++ b/environments/prod/modules/mysql/lib/facter/mysql_version.rb @@ -0,0 +1,8 @@ +Facter.add("mysql_version") do + setcode do + mysql_ver = Facter::Util::Resolution.exec('mysql --version') + if mysql_ver + mysql_ver.match(/\d+\.\d+\.\d+/)[0] + end + end +end diff --git a/environments/prod/modules/mysql/lib/facter/mysqld_version.rb b/environments/prod/modules/mysql/lib/facter/mysqld_version.rb new file mode 100644 index 0000000..c3711cc --- /dev/null +++ b/environments/prod/modules/mysql/lib/facter/mysqld_version.rb @@ -0,0 +1,5 @@ +Facter.add("mysqld_version") do + setcode do + Facter::Util::Resolution.exec('mysqld -V 2>/dev/null') + end +end diff --git a/environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_deepmerge.rb b/environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_deepmerge.rb new file mode 100644 index 0000000..aca9c7a --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_deepmerge.rb @@ -0,0 +1,58 @@ +module Puppet::Parser::Functions + newfunction(:mysql_deepmerge, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args| + Recursively merges two or more hashes together and returns the resulting hash. + + For example: + + $hash1 = {'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } } + $hash2 = {'two' => 'dos', 'three' => { 'five' => 5 } } + $merged_hash = mysql_deepmerge($hash1, $hash2) + # The resulting hash is equivalent to: + # $merged_hash = { 'one' => 1, 'two' => 'dos', 'three' => { 'four' => 4, 'five' => 5 } } + + When there is a duplicate key that is a hash, they are recursively merged. + When there is a duplicate key that is not a hash, the key in the rightmost hash will "win." + When there are conficting uses of dashes and underscores in two keys (which mysql would otherwise equate), + the rightmost style will win. + + ENDHEREDOC + + if args.length < 2 + raise Puppet::ParseError, ("mysql_deepmerge(): wrong number of arguments (#{args.length}; must be at least 2)") + end + + result = Hash.new + args.each do |arg| + next if arg.is_a? String and arg.empty? # empty string is synonym for puppet's undef + # If the argument was not a hash, skip it. + unless arg.is_a?(Hash) + raise Puppet::ParseError, "mysql_deepmerge: unexpected argument type #{arg.class}, only expects hash arguments" + end + + # Now we have to traverse our hash assigning our non-hash values + # to the matching keys in our result while following our hash values + # and repeating the process. + overlay( result, arg ) + end + return( result ) + end +end + +def has_normalized!(hash, key) + return true if hash.has_key?( key ) + return false unless key.match(/-|_/) + other_key = key.include?('-') ? key.gsub( '-', '_' ) : key.gsub( '_', '-' ) + return false unless hash.has_key?( other_key ) + hash[key] = hash.delete( other_key ) + return true; +end + +def overlay( hash1, hash2 ) + hash2.each do |key, value| + if(has_normalized!( hash1, key ) and value.is_a?(Hash) and hash1[key].is_a?(Hash)) + overlay( hash1[key], value ) + else + hash1[key] = value + end + end +end diff --git a/environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_dirname.rb b/environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_dirname.rb new file mode 100644 index 0000000..5d0ef55 --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_dirname.rb @@ -0,0 +1,15 @@ +module Puppet::Parser::Functions + newfunction(:mysql_dirname, :type => :rvalue, :doc => <<-EOS + Returns the dirname of a path. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "mysql_dirname(): Wrong number of arguments " + + "given (#{arguments.size} for 1)") if arguments.size < 1 + + path = arguments[0] + return File.dirname(path) + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_password.rb b/environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_password.rb new file mode 100644 index 0000000..74d7fa8 --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_password.rb @@ -0,0 +1,17 @@ +# hash a string as mysql's "PASSWORD()" function would do it +require 'digest/sha1' + +module Puppet::Parser::Functions + newfunction(:mysql_password, :type => :rvalue, :doc => <<-EOS + Returns the mysql password hash from the clear text password. + EOS + ) do |args| + + raise(Puppet::ParseError, 'mysql_password(): Wrong number of arguments ' + + "given (#{args.size} for 1)") if args.size != 1 + + return '' if args[0].empty? + return args[0] if args[0] =~ /\*[A-F0-9]{40}$/ + '*' + Digest::SHA1.hexdigest(Digest::SHA1.digest(args[0])).upcase + end +end diff --git a/environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_strip_hash.rb b/environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_strip_hash.rb new file mode 100644 index 0000000..8e850d0 --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/parser/functions/mysql_strip_hash.rb @@ -0,0 +1,21 @@ +module Puppet::Parser::Functions + newfunction(:mysql_strip_hash, :type => :rvalue, :arity => 1, :doc => <<-EOS +TEMPORARY FUNCTION: EXPIRES 2014-03-10 +When given a hash this function strips out all blank entries. +EOS + ) do |args| + + hash = args[0] + unless hash.is_a?(Hash) + raise(Puppet::ParseError, 'mysql_strip_hash(): Requires hash to work with') + end + + # Filter out all the top level blanks. + hash.reject{|k,v| v == ''}.each do |k,v| + if v.is_a?(Hash) + v.reject!{|ki,vi| vi == '' } + end + end + + end +end diff --git a/environments/prod/modules/mysql/lib/puppet/provider/mysql.rb b/environments/prod/modules/mysql/lib/puppet/provider/mysql.rb new file mode 100644 index 0000000..181d788 --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/provider/mysql.rb @@ -0,0 +1,115 @@ +class Puppet::Provider::Mysql < Puppet::Provider + + # Without initvars commands won't work. + initvars + + # Make sure we find mysql commands on CentOS and FreeBSD + ENV['PATH']=ENV['PATH'] + ':/usr/libexec:/usr/local/libexec:/usr/local/bin' + + commands :mysql => 'mysql' + commands :mysqld => 'mysqld' + commands :mysqladmin => 'mysqladmin' + + # Optional defaults file + def self.defaults_file + if File.file?("#{Facter.value(:root_home)}/.my.cnf") + "--defaults-extra-file=#{Facter.value(:root_home)}/.my.cnf" + else + nil + end + end + + def self.mysqld_type + # find the mysql "dialect" like mariadb / mysql etc. + mysqld_version_string.scan(/mariadb/i) { return "mariadb" } + mysqld_version_string.scan(/\s\(percona/i) { return "percona" } + return "mysql" + end + + def mysqld_type + self.class.mysqld_type + end + + def self.mysqld_version_string + # As the possibility of the mysqld being remote we need to allow the version string to be overridden, this can be done by facter.value as seen below. In the case that it has not been set and the facter value is nil we use the mysql -v command to ensure we report the correct version of mysql for later use cases. + @mysqld_version_string ||= Facter.value(:mysqld_version) || mysqld('-V') + end + + def mysqld_version_string + self.class.mysqld_version_string + end + + def self.mysqld_version + # note: be prepared for '5.7.6-rc-log' etc results + # versioncmp detects 5.7.6-log to be newer then 5.7.6 + # this is why we need the trimming. + mysqld_version_string.scan(/\d+\.\d+\.\d+/).first unless mysqld_version_string.nil? + end + + def mysqld_version + self.class.mysqld_version + end + + def defaults_file + self.class.defaults_file + end + + def self.users + mysql([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"].compact).split("\n") + end + + # Optional parameter to run a statement on the MySQL system database. + def self.system_database + '--database=mysql' + end + + def system_database + self.class.system_database + end + + # Take root@localhost and munge it to 'root'@'localhost' + def self.cmd_user(user) + "'#{user.sub('@', "'@'")}'" + end + + # Take root.* and return ON `root`.* + def self.cmd_table(table) + table_string = '' + + # We can't escape *.* so special case this. + if table == '*.*' + table_string << '*.*' + # Special case also for PROCEDURES + elsif table.start_with?('PROCEDURE ') + table_string << table.sub(/^PROCEDURE (.*)(\..*)/, 'PROCEDURE `\1`\2') + else + table_string << table.sub(/^(.*)(\..*)/, '`\1`\2') + end + table_string + end + + def self.cmd_privs(privileges) + if privileges.include?('ALL') + return 'ALL PRIVILEGES' + else + priv_string = '' + privileges.each do |priv| + priv_string << "#{priv}, " + end + end + # Remove trailing , from the last element. + priv_string.sub(/, $/, '') + end + + # Take in potential options and build up a query string with them. + def self.cmd_options(options) + option_string = '' + options.each do |opt| + if opt == 'GRANT' + option_string << ' WITH GRANT OPTION' + end + end + option_string + end + +end diff --git a/environments/prod/modules/mysql/lib/puppet/provider/mysql_database/mysql.rb b/environments/prod/modules/mysql/lib/puppet/provider/mysql_database/mysql.rb new file mode 100644 index 0000000..4587c18 --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/provider/mysql_database/mysql.rb @@ -0,0 +1,68 @@ +require File.expand_path(File.join(File.dirname(__FILE__), '..', 'mysql')) +Puppet::Type.type(:mysql_database).provide(:mysql, :parent => Puppet::Provider::Mysql) do + desc 'Manages MySQL databases.' + + commands :mysql => 'mysql' + + def self.instances + mysql([defaults_file, '-NBe', 'show databases'].compact).split("\n").collect do |name| + attributes = {} + mysql([defaults_file, '-NBe', "show variables like '%_database'", name].compact).split("\n").each do |line| + k,v = line.split(/\s/) + attributes[k] = v + end + new(:name => name, + :ensure => :present, + :charset => attributes['character_set_database'], + :collate => attributes['collation_database'] + ) + end + end + + # We iterate over each mysql_database entry in the catalog and compare it against + # the contents of the property_hash generated by self.instances + def self.prefetch(resources) + databases = instances + resources.keys.each do |database| + if provider = databases.find { |db| db.name == database } + resources[database].provider = provider + end + end + end + + def create + mysql([defaults_file, '-NBe', "create database if not exists `#{@resource[:name]}` character set `#{@resource[:charset]}` collate `#{@resource[:collate]}`"].compact) + + @property_hash[:ensure] = :present + @property_hash[:charset] = @resource[:charset] + @property_hash[:collate] = @resource[:collate] + + exists? ? (return true) : (return false) + end + + def destroy + mysql([defaults_file, '-NBe', "drop database if exists `#{@resource[:name]}`"].compact) + + @property_hash.clear + exists? ? (return false) : (return true) + end + + def exists? + @property_hash[:ensure] == :present || false + end + + mk_resource_methods + + def charset=(value) + mysql([defaults_file, '-NBe', "alter database `#{resource[:name]}` CHARACTER SET #{value}"].compact) + @property_hash[:charset] = value + charset == value ? (return true) : (return false) + end + + def collate=(value) + mysql([defaults_file, '-NBe', "alter database `#{resource[:name]}` COLLATE #{value}"].compact) + @property_hash[:collate] = value + collate == value ? (return true) : (return false) + end + +end diff --git a/environments/prod/modules/mysql/lib/puppet/provider/mysql_datadir/mysql.rb b/environments/prod/modules/mysql/lib/puppet/provider/mysql_datadir/mysql.rb new file mode 100644 index 0000000..620231e --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/provider/mysql_datadir/mysql.rb @@ -0,0 +1,78 @@ +require File.expand_path(File.join(File.dirname(__FILE__), '..', 'mysql')) +Puppet::Type.type(:mysql_datadir).provide(:mysql, :parent => Puppet::Provider::Mysql) do + + desc 'manage data directories for mysql instances' + + initvars + + # Make sure we find mysqld on CentOS and mysql_install_db on Gentoo + ENV['PATH']=ENV['PATH'] + ':/usr/libexec:/usr/share/mysql/scripts:/opt/rh/mysql55/root/usr/bin:/opt/rh/mysql55/root/usr/libexec' + + commands :mysqld => 'mysqld' + commands :mysql_install_db => 'mysql_install_db' + + def create + name = @resource[:name] + insecure = @resource.value(:insecure) || true + defaults_extra_file = @resource.value(:defaults_extra_file) + user = @resource.value(:user) || "mysql" + basedir = @resource.value(:basedir) + datadir = @resource.value(:datadir) || @resource[:name] + log_error = @resource.value(:log_error) || "/var/tmp/mysqld_initialize.log" + + unless defaults_extra_file.nil? + if File.exist?(defaults_extra_file) + defaults_extra_file="--defaults-extra-file=#{defaults_extra_file}" + else + raise ArgumentError, "Defaults-extra-file #{defaults_extra_file} is missing" + end + end + + if insecure == true + initialize="--initialize-insecure" + else + initialize="--initialize" + end + + opts = [ defaults_extra_file ] + %w(basedir datadir user).each do |opt| + val = eval(opt) + opts<<"--#{opt}=#{val}" unless val.nil? + end + + if mysqld_version.nil? + debug("Installing MySQL data directory with mysql_install_db #{opts.compact.join(" ")}") + mysql_install_db(opts.compact) + else + if (mysqld_type == "mysql" or mysqld_type == "percona") and Puppet::Util::Package.versioncmp(mysqld_version, '5.7.6') >= 0 + opts<<"--log-error=#{log_error}" + opts<<"#{initialize}" + debug("Initializing MySQL data directory >= 5.7.6 with mysqld: #{opts.compact.join(" ")}") + mysqld(opts.compact) + else + debug("Installing MySQL data directory with mysql_install_db #{opts.compact.join(" ")}") + mysql_install_db(opts.compact) + end + end + + exists? + end + + def destroy + name = @resource[:name] + raise ArgumentError, "ERROR: Resource can not be removed" + end + + def exists? + datadir = @resource[:datadir] + (File.directory?("#{datadir}/mysql")) && (Dir.entries("#{datadir}/mysql") - %w{ . .. }).any? + end + + ## + ## MySQL datadir properties + ## + + # Generates method for all properties of the property_hash + mk_resource_methods + +end diff --git a/environments/prod/modules/mysql/lib/puppet/provider/mysql_grant/mysql.rb b/environments/prod/modules/mysql/lib/puppet/provider/mysql_grant/mysql.rb new file mode 100644 index 0000000..40623af --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/provider/mysql_grant/mysql.rb @@ -0,0 +1,176 @@ +require File.expand_path(File.join(File.dirname(__FILE__), '..', 'mysql')) +Puppet::Type.type(:mysql_grant).provide(:mysql, :parent => Puppet::Provider::Mysql) do + + desc 'Set grants for users in MySQL.' + + def self.instances + instances = [] + users.select{ |user| user =~ /.+@/ }.collect do |user| + user_string = self.cmd_user(user) + query = "SHOW GRANTS FOR #{user_string};" + begin + grants = mysql([defaults_file, "-NBe", query].compact) + rescue Puppet::ExecutionFailure => e + # Silently ignore users with no grants. Can happen e.g. if user is + # defined with fqdn and server is run with skip-name-resolve. Example: + # Default root user created by mysql_install_db on a host with fqdn + # of myhost.mydomain.my: root@myhost.mydomain.my, when MySQL is started + # with --skip-name-resolve. + if e.inspect =~ /There is no such grant defined for user/ + next + else + raise Puppet::Error, "#mysql had an error -> #{e.inspect}" + end + end + # Once we have the list of grants generate entries for each. + grants.each_line do |grant| + # Match the munges we do in the type. + munged_grant = grant.delete("'").delete("`").delete('"') + # Matching: GRANT (SELECT, UPDATE) PRIVILEGES ON (*.*) TO ('root')@('127.0.0.1') (WITH GRANT OPTION) + if match = munged_grant.match(/^GRANT\s(.+)\sON\s(.+)\sTO\s(.*)@(.*?)(\s.*)?$/) + privileges, table, user, host, rest = match.captures + table.gsub!('\\\\', '\\') + + # split on ',' if it is not a non-'('-containing string followed by a + # closing parenthesis ')'-char - e.g. only split comma separated elements not in + # parentheses + stripped_privileges = privileges.strip.split(/\s*,\s*(?![^(]*\))/).map do |priv| + # split and sort the column_privileges in the parentheses and rejoin + if priv.include?('(') + type, col=priv.strip.split(/\s+|\b/,2) + type.upcase + " (" + col.slice(1...-1).strip.split(/\s*,\s*/).sort.join(', ') + ")" + else + # Once we split privileges up on the , we need to make sure we + # shortern ALL PRIVILEGES to just all. + priv == 'ALL PRIVILEGES' ? 'ALL' : priv.strip + end + end + # Same here, but to remove OPTION leaving just GRANT. + if rest.match(/WITH\sGRANT\sOPTION/) + options = ['GRANT'] + else + options = ['NONE'] + end + # fix double backslash that MySQL prints, so resources match + table.gsub!("\\\\", "\\") + # We need to return an array of instances so capture these + instances << new( + :name => "#{user}@#{host}/#{table}", + :ensure => :present, + :privileges => stripped_privileges.sort, + :table => table, + :user => "#{user}@#{host}", + :options => options + ) + end + end + end + return instances + end + + def self.prefetch(resources) + users = instances + resources.keys.each do |name| + if provider = users.find { |user| user.name == name } + resources[name].provider = provider + end + end + end + + def grant(user, table, privileges, options) + user_string = self.class.cmd_user(user) + priv_string = self.class.cmd_privs(privileges) + table_string = self.class.cmd_table(table) + query = "GRANT #{priv_string}" + query << " ON #{table_string}" + query << " TO #{user_string}" + query << self.class.cmd_options(options) unless options.nil? + mysql([defaults_file, system_database, '-e', query].compact) + end + + def create + grant(@resource[:user], @resource[:table], @resource[:privileges], @resource[:options]) + + @property_hash[:ensure] = :present + @property_hash[:table] = @resource[:table] + @property_hash[:user] = @resource[:user] + @property_hash[:options] = @resource[:options] if @resource[:options] + @property_hash[:privileges] = @resource[:privileges] + + exists? ? (return true) : (return false) + end + + def revoke(user, table, revoke_privileges = ['ALL']) + user_string = self.class.cmd_user(user) + table_string = self.class.cmd_table(table) + priv_string = self.class.cmd_privs(revoke_privileges) + # revoke grant option needs to be a extra query, because + # "REVOKE ALL PRIVILEGES, GRANT OPTION [..]" is only valid mysql syntax + # if no ON clause is used. + # It hast to be executed before "REVOKE ALL [..]" since a GRANT has to + # exist to be executed successfully + if revoke_privileges.include? 'ALL' + query = "REVOKE GRANT OPTION ON #{table_string} FROM #{user_string}" + mysql([defaults_file, system_database, '-e', query].compact) + end + query = "REVOKE #{priv_string} ON #{table_string} FROM #{user_string}" + mysql([defaults_file, system_database, '-e', query].compact) + end + + def destroy + # if the user was dropped, it'll have been removed from the user hash + # as the grants are alraedy removed by the DROP statement + if self.class.users.include? @property_hash[:user] + revoke(@property_hash[:user], @property_hash[:table]) + end + @property_hash.clear + + exists? ? (return false) : (return true) + end + + def exists? + @property_hash[:ensure] == :present || false + end + + def flush + @property_hash.clear + mysql([defaults_file, '-NBe', 'FLUSH PRIVILEGES'].compact) + end + + mk_resource_methods + + def diff_privileges(privileges_old, privileges_new) + diff = {:revoke => Array.new, :grant => Array.new} + if privileges_old.include? 'ALL' + diff[:revoke] = privileges_old + diff[:grant] = privileges_new + elsif privileges_new.include? 'ALL' + diff[:grant] = privileges_new + else + diff[:revoke] = privileges_old - privileges_new + diff[:grant] = privileges_new - privileges_old + end + return diff + end + + def privileges=(privileges) + diff = diff_privileges(@property_hash[:privileges], privileges) + if not diff[:revoke].empty? + revoke(@property_hash[:user], @property_hash[:table], diff[:revoke]) + end + if not diff[:grant].empty? + grant(@property_hash[:user], @property_hash[:table], diff[:grant], @property_hash[:options]) + end + @property_hash[:privileges] = privileges + self.privileges + end + + def options=(options) + revoke(@property_hash[:user], @property_hash[:table]) + grant(@property_hash[:user], @property_hash[:table], @property_hash[:privileges], options) + @property_hash[:options] = options + + self.options + end + +end diff --git a/environments/prod/modules/mysql/lib/puppet/provider/mysql_plugin/mysql.rb b/environments/prod/modules/mysql/lib/puppet/provider/mysql_plugin/mysql.rb new file mode 100644 index 0000000..2cb640b --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/provider/mysql_plugin/mysql.rb @@ -0,0 +1,53 @@ +require File.expand_path(File.join(File.dirname(__FILE__), '..', 'mysql')) +Puppet::Type.type(:mysql_plugin).provide(:mysql, :parent => Puppet::Provider::Mysql) do + desc 'Manages MySQL plugins.' + + commands :mysql => 'mysql' + + def self.instances + mysql([defaults_file, '-NBe', 'show plugins'].compact).split("\n").collect do |line| + name, status, type, library, license = line.split(/\t/) + new(:name => name, + :ensure => :present, + :soname => library + ) + end + end + + # We iterate over each mysql_plugin entry in the catalog and compare it against + # the contents of the property_hash generated by self.instances + def self.prefetch(resources) + plugins = instances + resources.keys.each do |plugin| + if provider = plugins.find { |pl| pl.name == plugin } + resources[plugin].provider = provider + end + end + end + + def create + # Use plugin_name.so as soname if it's not specified. This won't work on windows as + # there it should be plugin_name.dll + @resource[:soname].nil? ? (soname=@resource[:name] + '.so') : (soname=@resource[:soname]) + mysql([defaults_file, '-NBe', "install plugin #{@resource[:name]} soname '#{soname}'"].compact) + + @property_hash[:ensure] = :present + @property_hash[:soname] = @resource[:soname] + + exists? ? (return true) : (return false) + end + + def destroy + mysql([defaults_file, '-NBe', "uninstall plugin #{@resource[:name]}"].compact) + + @property_hash.clear + exists? ? (return false) : (return true) + end + + def exists? + @property_hash[:ensure] == :present || false + end + + mk_resource_methods + +end diff --git a/environments/prod/modules/mysql/lib/puppet/provider/mysql_user/mysql.rb b/environments/prod/modules/mysql/lib/puppet/provider/mysql_user/mysql.rb new file mode 100644 index 0000000..e5200a1 --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/provider/mysql_user/mysql.rb @@ -0,0 +1,197 @@ +require File.expand_path(File.join(File.dirname(__FILE__), '..', 'mysql')) +Puppet::Type.type(:mysql_user).provide(:mysql, :parent => Puppet::Provider::Mysql) do + + desc 'manage users for a mysql database.' + commands :mysql => 'mysql' + + # Build a property_hash containing all the discovered information about MySQL + # users. + def self.instances + users = mysql([defaults_file, '-NBe', + "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"].compact).split("\n") + # To reduce the number of calls to MySQL we collect all the properties in + # one big swoop. + users.collect do |name| + if mysqld_version.nil? + ## Default ... + query = "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{name}'" + else + if (mysqld_type == "mysql" or mysqld_type == "percona") and Puppet::Util::Package.versioncmp(mysqld_version, '5.7.6') >= 0 + query = "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, AUTHENTICATION_STRING, PLUGIN FROM mysql.user WHERE CONCAT(user, '@', host) = '#{name}'" + else + query = "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{name}'" + end + end + @max_user_connections, @max_connections_per_hour, @max_queries_per_hour, + @max_updates_per_hour, ssl_type, ssl_cipher, x509_issuer, x509_subject, + @password, @plugin = mysql([defaults_file, "-NBe", query].compact).split(/\s/) + @tls_options = parse_tls_options(ssl_type, ssl_cipher, x509_issuer, x509_subject) + + new(:name => name, + :ensure => :present, + :password_hash => @password, + :plugin => @plugin, + :max_user_connections => @max_user_connections, + :max_connections_per_hour => @max_connections_per_hour, + :max_queries_per_hour => @max_queries_per_hour, + :max_updates_per_hour => @max_updates_per_hour, + :tls_options => @tls_options, + ) + end + end + + # We iterate over each mysql_user entry in the catalog and compare it against + # the contents of the property_hash generated by self.instances + def self.prefetch(resources) + users = instances + resources.keys.each do |name| + if provider = users.find { |user| user.name == name } + resources[name].provider = provider + end + end + end + + def create + merged_name = @resource[:name].sub('@', "'@'") + password_hash = @resource.value(:password_hash) + plugin = @resource.value(:plugin) + max_user_connections = @resource.value(:max_user_connections) || 0 + max_connections_per_hour = @resource.value(:max_connections_per_hour) || 0 + max_queries_per_hour = @resource.value(:max_queries_per_hour) || 0 + max_updates_per_hour = @resource.value(:max_updates_per_hour) || 0 + tls_options = @resource.value(:tls_options) || ['NONE'] + + # Use CREATE USER to be compatible with NO_AUTO_CREATE_USER sql_mode + # This is also required if you want to specify a authentication plugin + if !plugin.nil? + if plugin == 'sha256_password' and !password_hash.nil? + mysql([defaults_file, system_database, '-e', "CREATE USER '#{merged_name}' IDENTIFIED WITH '#{plugin}' AS '#{password_hash}'"].compact) + else + mysql([defaults_file, system_database, '-e', "CREATE USER '#{merged_name}' IDENTIFIED WITH '#{plugin}'"].compact) + end + @property_hash[:ensure] = :present + @property_hash[:plugin] = plugin + else + mysql([defaults_file, system_database, '-e', "CREATE USER '#{merged_name}' IDENTIFIED BY PASSWORD '#{password_hash}'"].compact) + @property_hash[:ensure] = :present + @property_hash[:password_hash] = password_hash + end + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO '#{merged_name}' WITH MAX_USER_CONNECTIONS #{max_user_connections} MAX_CONNECTIONS_PER_HOUR #{max_connections_per_hour} MAX_QUERIES_PER_HOUR #{max_queries_per_hour} MAX_UPDATES_PER_HOUR #{max_updates_per_hour}"].compact) + @property_hash[:max_user_connections] = max_user_connections + @property_hash[:max_connections_per_hour] = max_connections_per_hour + @property_hash[:max_queries_per_hour] = max_queries_per_hour + @property_hash[:max_updates_per_hour] = max_updates_per_hour + + merged_tls_options = tls_options.join(' AND ') + if (((mysqld_type == "mysql" or mysqld_type == "percona") and Puppet::Util::Package.versioncmp(mysqld_version, '5.7.6') >= 0) or + (mysqld_type == 'mariadb' and Puppet::Util::Package.versioncmp(mysqld_version, '10.2.0') >= 0)) + mysql([defaults_file, system_database, '-e', "ALTER USER '#{merged_name}' REQUIRE #{merged_tls_options}"].compact) + else + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO '#{merged_name}' REQUIRE #{merged_tls_options}"].compact) + end + @property_hash[:tls_options] = tls_options + + exists? ? (return true) : (return false) + end + + def destroy + merged_name = @resource[:name].sub('@', "'@'") + mysql([defaults_file, system_database, '-e', "DROP USER '#{merged_name}'"].compact) + + @property_hash.clear + exists? ? (return false) : (return true) + end + + def exists? + @property_hash[:ensure] == :present || false + end + + ## + ## MySQL user properties + ## + + # Generates method for all properties of the property_hash + mk_resource_methods + + def password_hash=(string) + merged_name = self.class.cmd_user(@resource[:name]) + + # We have a fact for the mysql version ... + if mysqld_version.nil? + # default ... if mysqld_version does not work + mysql([defaults_file, system_database, '-e', "SET PASSWORD FOR #{merged_name} = '#{string}'"].compact) + else + # Version >= 5.7.6 (many password related changes) + if (mysqld_type == "mysql" or mysqld_type == "percona") and Puppet::Util::Package.versioncmp(mysqld_version, '5.7.6') >= 0 + if string.match(/^\*/) + mysql([defaults_file, system_database, '-e', "ALTER USER #{merged_name} IDENTIFIED WITH mysql_native_password AS '#{string}'"].compact) + else + raise ArgumentError, "Only mysql_native_password (*ABCD...XXX) hashes are supported" + end + else + # older versions + mysql([defaults_file, system_database, '-e', "SET PASSWORD FOR #{merged_name} = '#{string}'"].compact) + end + end + + password_hash == string ? (return true) : (return false) + end + + def max_user_connections=(int) + merged_name = self.class.cmd_user(@resource[:name]) + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO #{merged_name} WITH MAX_USER_CONNECTIONS #{int}"].compact).chomp + + max_user_connections == int ? (return true) : (return false) + end + + def max_connections_per_hour=(int) + merged_name = self.class.cmd_user(@resource[:name]) + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO #{merged_name} WITH MAX_CONNECTIONS_PER_HOUR #{int}"].compact).chomp + + max_connections_per_hour == int ? (return true) : (return false) + end + + def max_queries_per_hour=(int) + merged_name = self.class.cmd_user(@resource[:name]) + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO #{merged_name} WITH MAX_QUERIES_PER_HOUR #{int}"].compact).chomp + + max_queries_per_hour == int ? (return true) : (return false) + end + + def max_updates_per_hour=(int) + merged_name = self.class.cmd_user(@resource[:name]) + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO #{merged_name} WITH MAX_UPDATES_PER_HOUR #{int}"].compact).chomp + + max_updates_per_hour == int ? (return true) : (return false) + end + + def tls_options=(array) + merged_name = self.class.cmd_user(@resource[:name]) + merged_tls_options = array.join(' AND ') + if (((mysqld_type == "mysql" or mysqld_type == "percona") and Puppet::Util::Package.versioncmp(mysqld_version, '5.7.6') >= 0) or + (mysqld_type == 'mariadb' and Puppet::Util::Package.versioncmp(mysqld_version, '10.2.0') >= 0)) + mysql([defaults_file, system_database, '-e', "ALTER USER #{merged_name} REQUIRE #{merged_tls_options}"].compact) + else + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO #{merged_name} REQUIRE #{merged_tls_options}"].compact) + end + + tls_options == array ? (return true) : (return false) + end + + def self.parse_tls_options(ssl_type, ssl_cipher, x509_issuer, x509_subject) + if ssl_type == 'ANY' + return ['SSL'] + elsif ssl_type == 'X509' + return ['X509'] + elsif ssl_type == 'SPECIFIED' + options = [] + options << "CIPHER #{ssl_cipher}" if not ssl_cipher.nil? and not ssl_cipher.empty? + options << "ISSUER #{x509_issuer}" if not x509_issuer.nil? and not x509_issuer.empty? + options << "SUBJECT #{x509_subject}" if not x509_subject.nil? and not x509_subject.empty? + return options + else + return ['NONE'] + end + end + +end diff --git a/environments/prod/modules/mysql/lib/puppet/type/mysql_database.rb b/environments/prod/modules/mysql/lib/puppet/type/mysql_database.rb new file mode 100644 index 0000000..1f94d5f --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/type/mysql_database.rb @@ -0,0 +1,25 @@ +Puppet::Type.newtype(:mysql_database) do + @doc = 'Manage MySQL databases.' + + ensurable + + autorequire(:file) { '/root/.my.cnf' } + autorequire(:class) { 'mysql::server' } + + newparam(:name, :namevar => true) do + desc 'The name of the MySQL database to manage.' + end + + newproperty(:charset) do + desc 'The CHARACTER SET setting for the database' + defaultto :utf8 + newvalue(/^\S+$/) + end + + newproperty(:collate) do + desc 'The COLLATE setting for the database' + defaultto :utf8_general_ci + newvalue(/^\S+$/) + end + +end diff --git a/environments/prod/modules/mysql/lib/puppet/type/mysql_datadir.rb b/environments/prod/modules/mysql/lib/puppet/type/mysql_datadir.rb new file mode 100644 index 0000000..367767d --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/type/mysql_datadir.rb @@ -0,0 +1,35 @@ +Puppet::Type.newtype(:mysql_datadir) do + @doc = 'Manage MySQL datadirs with mysql_install_db OR mysqld (5.7.6 and above).' + + ensurable + + autorequire(:package) { 'mysql-server' } + + newparam(:datadir, :namevar => true) do + desc "The datadir name" + end + + newparam(:basedir) do + desc 'The basedir name, default /usr.' + newvalues(/^\//) + end + + newparam(:user) do + desc 'The user for the directory default mysql (name, not uid).' + end + + newparam(:defaults_extra_file) do + desc "MySQL defaults-extra-file with absolute path (*.cnf)." + newvalues(/^\/.*\.cnf$/) + end + + newparam(:insecure, :boolean => true) do + desc "Insecure initialization (needed for 5.7.6++)." + end + + newparam(:log_error) do + desc "The path to the mysqld error log file (used with the --log-error option)" + newvalues(/^\//) + end + +end diff --git a/environments/prod/modules/mysql/lib/puppet/type/mysql_grant.rb b/environments/prod/modules/mysql/lib/puppet/type/mysql_grant.rb new file mode 100644 index 0000000..7385f93 --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/type/mysql_grant.rb @@ -0,0 +1,103 @@ +# This has to be a separate type to enable collecting +Puppet::Type.newtype(:mysql_grant) do + @doc = "Manage a MySQL user's rights." + ensurable + + autorequire(:file) { '/root/.my.cnf' } + autorequire(:mysql_user) { self[:user] } + + def initialize(*args) + super + # Forcibly munge any privilege with 'ALL' in the array to exist of just + # 'ALL'. This can't be done in the munge in the property as that iterates + # over the array and there's no way to replace the entire array before it's + # returned to the provider. + if self[:ensure] == :present and Array(self[:privileges]).count > 1 and self[:privileges].to_s.include?('ALL') + self[:privileges] = 'ALL' + end + # Sort the privileges array in order to ensure the comparision in the provider + # self.instances method match. Otherwise this causes it to keep resetting the + # privileges. + self[:privileges] = Array(self[:privileges]).map{ |priv| + # split and sort the column_privileges in the parentheses and rejoin + if priv.include?('(') + type, col=priv.strip.split(/\s+|\b/,2) + type.upcase + " (" + col.slice(1...-1).strip.split(/\s*,\s*/).sort.join(', ') + ")" + else + priv.strip.upcase + end + }.uniq.reject{|k| k == 'GRANT' or k == 'GRANT OPTION'}.sort! + end + + validate do + fail('privileges parameter is required.') if self[:ensure] == :present and self[:privileges].nil? + fail('table parameter is required.') if self[:ensure] == :present and self[:table].nil? + fail('user parameter is required.') if self[:ensure] == :present and self[:user].nil? + fail('name must match user and table parameters') if self[:name] != "#{self[:user]}/#{self[:table]}" + end + + newparam(:name, :namevar => true) do + desc 'Name to describe the grant.' + + munge do |value| + value.delete("'") + end + end + + newproperty(:privileges, :array_matching => :all) do + desc 'Privileges for user' + end + + newproperty(:table) do + desc 'Table to apply privileges to.' + + munge do |value| + value.delete("`") + end + + newvalues(/.*\..*/,/@/) + end + + newproperty(:user) do + desc 'User to operate on.' + validate do |value| + # http://dev.mysql.com/doc/refman/5.5/en/identifiers.html + # If at least one special char is used, string must be quoted + + # http://stackoverflow.com/questions/8055727/negating-a-backreference-in-regular-expressions/8057827#8057827 + if matches = /^(['`"])((?!\1).)*\1@([\w%\.:\-\/]+)$/.match(value) + user_part = matches[2] + host_part = matches[3] + elsif matches = /^([0-9a-zA-Z$_]*)@([\w%\.:\-\/]+)$/.match(value) + user_part = matches[1] + host_part = matches[2] + elsif matches = /^((?!['`"]).*[^0-9a-zA-Z$_].*)@(.+)$/.match(value) + user_part = matches[1] + host_part = matches[2] + else + raise(ArgumentError, "Invalid database user #{value}") + end + + mysql_version = Facter.value(:mysql_version) + unless mysql_version.nil? + if Puppet::Util::Package.versioncmp(mysql_version, '5.7.8') < 0 and user_part.size > 16 + raise(ArgumentError, 'MySQL usernames are limited to a maximum of 16 characters') + elsif Puppet::Util::Package.versioncmp(mysql_version, '10.0.0') < 0 and user_part.size > 32 + raise(ArgumentError, 'MySQL usernames are limited to a maximum of 32 characters') + elsif Puppet::Util::Package.versioncmp(mysql_version, '10.0.0') > 0 and user_part.size > 80 + raise(ArgumentError, 'MySQL usernames are limited to a maximum of 80 characters') + end + end + end + + munge do |value| + matches = /^((['`"]?).*\2)@(.+)$/.match(value) + "#{matches[1]}@#{matches[3].downcase}" + end + end + + newproperty(:options, :array_matching => :all) do + desc 'Options to grant.' + end + +end diff --git a/environments/prod/modules/mysql/lib/puppet/type/mysql_plugin.rb b/environments/prod/modules/mysql/lib/puppet/type/mysql_plugin.rb new file mode 100644 index 0000000..e827920 --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/type/mysql_plugin.rb @@ -0,0 +1,17 @@ +Puppet::Type.newtype(:mysql_plugin) do + @doc = 'Manage MySQL plugins.' + + ensurable + + autorequire(:file) { '/root/.my.cnf' } + + newparam(:name, :namevar => true) do + desc 'The name of the MySQL plugin to manage.' + end + + newproperty(:soname) do + desc 'The name of the library' + newvalue(/^\w+\.\w+$/) + end + +end diff --git a/environments/prod/modules/mysql/lib/puppet/type/mysql_user.rb b/environments/prod/modules/mysql/lib/puppet/type/mysql_user.rb new file mode 100644 index 0000000..831a531 --- /dev/null +++ b/environments/prod/modules/mysql/lib/puppet/type/mysql_user.rb @@ -0,0 +1,105 @@ +# This has to be a separate type to enable collecting +Puppet::Type.newtype(:mysql_user) do + @doc = 'Manage a MySQL user. This includes management of users password as well as privileges.' + + ensurable + + autorequire(:file) { '/root/.my.cnf' } + autorequire(:class) { 'mysql::server' } + + newparam(:name, :namevar => true) do + desc "The name of the user. This uses the 'username@hostname' or username@hostname." + validate do |value| + # http://dev.mysql.com/doc/refman/5.5/en/identifiers.html + # If at least one special char is used, string must be quoted + + # http://stackoverflow.com/questions/8055727/negating-a-backreference-in-regular-expressions/8057827#8057827 + if matches = /^(['`"])((?:(?!\1).)*)\1@([\w%\.:\-\/]+)$/.match(value) + user_part = matches[2] + host_part = matches[3] + elsif matches = /^([0-9a-zA-Z$_]*)@([\w%\.:\-\/]+)$/.match(value) + user_part = matches[1] + host_part = matches[2] + elsif matches = /^((?!['`"]).*[^0-9a-zA-Z$_].*)@(.+)$/.match(value) + user_part = matches[1] + host_part = matches[2] + else + raise(ArgumentError, "Invalid database user #{value}") + end + + mysql_version = Facter.value(:mysql_version) + unless mysql_version.nil? + if Puppet::Util::Package.versioncmp(mysql_version, '5.7.8') < 0 and user_part.size > 16 + raise(ArgumentError, 'MySQL usernames are limited to a maximum of 16 characters') + elsif Puppet::Util::Package.versioncmp(mysql_version, '10.0.0') < 0 and user_part.size > 32 + raise(ArgumentError, 'MySQL usernames are limited to a maximum of 32 characters') + elsif Puppet::Util::Package.versioncmp(mysql_version, '10.0.0') > 0 and user_part.size > 80 + raise(ArgumentError, 'MySQL usernames are limited to a maximum of 80 characters') + end + end + end + + munge do |value| + matches = /^((['`"]?).*\2)@(.+)$/.match(value) + "#{matches[1]}@#{matches[3].downcase}" + end + end + + newproperty(:password_hash) do + desc 'The password hash of the user. Use mysql_password() for creating such a hash.' + newvalue(/\w*/) + end + + newproperty(:plugin) do + desc 'The authentication plugin of the user.' + newvalue(/\w+/) + end + + newproperty(:max_user_connections) do + desc "Max concurrent connections for the user. 0 means no (or global) limit." + newvalue(/\d+/) + end + + newproperty(:max_connections_per_hour) do + desc "Max connections per hour for the user. 0 means no (or global) limit." + newvalue(/\d+/) + end + + newproperty(:max_queries_per_hour) do + desc "Max queries per hour for the user. 0 means no (or global) limit." + newvalue(/\d+/) + end + + newproperty(:max_updates_per_hour) do + desc "Max updates per hour for the user. 0 means no (or global) limit." + newvalue(/\d+/) + end + + newproperty(:tls_options, :array_matching => :all) do + desc "Options to that set the TLS-related REQUIRE attributes for the user." + validate do |value| + value = [value] if not value.is_a?(Array) + if value.include? 'NONE' or value.include? 'SSL' or value.include? 'X509' + if value.length > 1 + raise(ArgumentError, "REQUIRE tls options NONE, SSL and X509 cannot be used with other options, you may only use one of them.") + end + else + value.each do |opt| + if not o = opt.match(/^(CIPHER|ISSUER|SUBJECT)/i) + raise(ArgumentError, "Invalid tls option #{o}") + end + end + end + end + def insync?(is) + # The current value may be nil and we don't + # want to call sort on it so make sure we have arrays + if is.is_a?(Array) and @should.is_a?(Array) + is.sort == @should.sort + else + is == @should + end + end + end + +end diff --git a/environments/prod/modules/mysql/manifests/backup/mysqlbackup.pp b/environments/prod/modules/mysql/manifests/backup/mysqlbackup.pp new file mode 100644 index 0000000..ae70c1b --- /dev/null +++ b/environments/prod/modules/mysql/manifests/backup/mysqlbackup.pp @@ -0,0 +1,106 @@ +# See README.me for usage. +class mysql::backup::mysqlbackup ( + $backupuser = '', + $backuppassword = '', + $maxallowedpacket = '1M', + $backupdir = '', + $backupdirmode = '0700', + $backupdirowner = 'root', + $backupdirgroup = $mysql::params::root_group, + $backupcompress = true, + $backuprotate = 30, + $ignore_events = true, + $delete_before_dump = false, + $backupdatabases = [], + $file_per_database = false, + $include_triggers = true, + $include_routines = false, + $ensure = 'present', + $time = ['23', '5'], + $prescript = false, + $postscript = false, + $execpath = '/usr/bin:/usr/sbin:/bin:/sbin', +) inherits mysql::params { + + mysql_user { "${backupuser}@localhost": + ensure => $ensure, + password_hash => mysql_password($backuppassword), + require => Class['mysql::server::root_password'], + } + + package { 'meb': + ensure => $ensure, + } + + # http://dev.mysql.com/doc/mysql-enterprise-backup/3.11/en/mysqlbackup.privileges.html + mysql_grant { "${backupuser}@localhost/*.*": + ensure => $ensure, + user => "${backupuser}@localhost", + table => '*.*', + privileges => [ 'RELOAD', 'SUPER', 'REPLICATION CLIENT' ], + require => Mysql_user["${backupuser}@localhost"], + } + + mysql_grant { "${backupuser}@localhost/mysql.backup_progress": + ensure => $ensure, + user => "${backupuser}@localhost", + table => 'mysql.backup_progress', + privileges => [ 'CREATE', 'INSERT', 'DROP', 'UPDATE' ], + require => Mysql_user["${backupuser}@localhost"], + } + + mysql_grant { "${backupuser}@localhost/mysql.backup_history": + ensure => $ensure, + user => "${backupuser}@localhost", + table => 'mysql.backup_history', + privileges => [ 'CREATE', 'INSERT', 'SELECT', 'DROP', 'UPDATE' ], + require => Mysql_user["${backupuser}@localhost"], + } + + cron { 'mysqlbackup-weekly': + ensure => $ensure, + command => 'mysqlbackup backup', + user => 'root', + hour => $time[0], + minute => $time[1], + weekday => '0', + require => Package['meb'], + } + + cron { 'mysqlbackup-daily': + ensure => $ensure, + command => 'mysqlbackup --incremental backup', + user => 'root', + hour => $time[0], + minute => $time[1], + weekday => '1-6', + require => Package['meb'], + } + + $default_options = { + 'mysqlbackup' => { + 'backup-dir' => $backupdir, + 'with-timestamp' => true, + 'incremental_base' => 'history:last_backup', + 'incremental_backup_dir' => $backupdir, + 'user' => $backupuser, + 'password' => $backuppassword, + } + } + $options = mysql_deepmerge($default_options, $mysql::server::override_options) + + file { 'mysqlbackup-config-file': + path => '/etc/mysql/conf.d/meb.cnf', + content => template('mysql/meb.cnf.erb'), + mode => '0600', + } + + file { 'mysqlbackupdir': + ensure => 'directory', + path => $backupdir, + mode => $backupdirmode, + owner => $backupdirowner, + group => $backupdirgroup, + } + +} diff --git a/environments/prod/modules/mysql/manifests/backup/mysqldump.pp b/environments/prod/modules/mysql/manifests/backup/mysqldump.pp new file mode 100644 index 0000000..3ff3c9b --- /dev/null +++ b/environments/prod/modules/mysql/manifests/backup/mysqldump.pp @@ -0,0 +1,73 @@ +# See README.me for usage. +class mysql::backup::mysqldump ( + $backupuser = '', + $backuppassword = '', + $backupdir = '', + $maxallowedpacket = '1M', + $backupdirmode = '0700', + $backupdirowner = 'root', + $backupdirgroup = $mysql::params::root_group, + $backupcompress = true, + $backuprotate = 30, + $ignore_events = true, + $delete_before_dump = false, + $backupdatabases = [], + $file_per_database = false, + $include_triggers = false, + $include_routines = false, + $ensure = 'present', + $time = ['23', '5'], + $prescript = false, + $postscript = false, + $execpath = '/usr/bin:/usr/sbin:/bin:/sbin', +) inherits mysql::params { + + ensure_packages(['bzip2']) + + mysql_user { "${backupuser}@localhost": + ensure => $ensure, + password_hash => mysql_password($backuppassword), + require => Class['mysql::server::root_password'], + } + + if $include_triggers { + $privs = [ 'SELECT', 'RELOAD', 'LOCK TABLES', 'SHOW VIEW', 'PROCESS', 'TRIGGER' ] + } else { + $privs = [ 'SELECT', 'RELOAD', 'LOCK TABLES', 'SHOW VIEW', 'PROCESS' ] + } + + mysql_grant { "${backupuser}@localhost/*.*": + ensure => $ensure, + user => "${backupuser}@localhost", + table => '*.*', + privileges => $privs, + require => Mysql_user["${backupuser}@localhost"], + } + + cron { 'mysql-backup': + ensure => $ensure, + command => '/usr/local/sbin/mysqlbackup.sh', + user => 'root', + hour => $time[0], + minute => $time[1], + require => [File['mysqlbackup.sh'], Package['bzip2']], + } + + file { 'mysqlbackup.sh': + ensure => $ensure, + path => '/usr/local/sbin/mysqlbackup.sh', + mode => '0700', + owner => 'root', + group => $mysql::params::root_group, + content => template('mysql/mysqlbackup.sh.erb'), + } + + file { 'mysqlbackupdir': + ensure => 'directory', + path => $backupdir, + mode => $backupdirmode, + owner => $backupdirowner, + group => $backupdirgroup, + } + +} diff --git a/environments/prod/modules/mysql/manifests/backup/xtrabackup.pp b/environments/prod/modules/mysql/manifests/backup/xtrabackup.pp new file mode 100644 index 0000000..185b29f --- /dev/null +++ b/environments/prod/modules/mysql/manifests/backup/xtrabackup.pp @@ -0,0 +1,67 @@ +# See README.me for usage. +class mysql::backup::xtrabackup ( + $xtrabackup_package_name = $mysql::params::xtrabackup_package_name, + $backupuser = '', + $backuppassword = '', + $backupdir = '', + $maxallowedpacket = '1M', + $backupmethod = 'mysqldump', + $backupdirmode = '0700', + $backupdirowner = 'root', + $backupdirgroup = $mysql::params::root_group, + $backupcompress = true, + $backuprotate = 30, + $ignore_events = true, + $delete_before_dump = false, + $backupdatabases = [], + $file_per_database = false, + $include_triggers = true, + $include_routines = false, + $ensure = 'present', + $time = ['23', '5'], + $prescript = false, + $postscript = false, + $execpath = '/usr/bin:/usr/sbin:/bin:/sbin', +) inherits mysql::params { + + package{ $xtrabackup_package_name: + ensure => $ensure, + } + + cron { 'xtrabackup-weekly': + ensure => $ensure, + command => "/usr/local/sbin/xtrabackup.sh ${backupdir}", + user => 'root', + hour => $time[0], + minute => $time[1], + weekday => '0', + require => Package[$xtrabackup_package_name], + } + + cron { 'xtrabackup-daily': + ensure => $ensure, + command => "/usr/local/sbin/xtrabackup.sh --incremental ${backupdir}", + user => 'root', + hour => $time[0], + minute => $time[1], + weekday => '1-6', + require => Package[$xtrabackup_package_name], + } + + file { 'mysqlbackupdir': + ensure => 'directory', + path => $backupdir, + mode => $backupdirmode, + owner => $backupdirowner, + group => $backupdirgroup, + } + + file { 'xtrabackup.sh': + ensure => $ensure, + path => '/usr/local/sbin/xtrabackup.sh', + mode => '0700', + owner => 'root', + group => $mysql::params::root_group, + content => template('mysql/xtrabackup.sh.erb'), + } +} diff --git a/environments/prod/modules/mysql/manifests/bindings.pp b/environments/prod/modules/mysql/manifests/bindings.pp new file mode 100644 index 0000000..fa7b870 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/bindings.pp @@ -0,0 +1,57 @@ +# See README.md. +class mysql::bindings ( + $install_options = undef, + # Boolean to determine if we should include the classes. + $java_enable = false, + $perl_enable = false, + $php_enable = false, + $python_enable = false, + $ruby_enable = false, + $client_dev = false, + $daemon_dev = false, + # Settings for the various classes. + $java_package_ensure = $mysql::params::java_package_ensure, + $java_package_name = $mysql::params::java_package_name, + $java_package_provider = $mysql::params::java_package_provider, + $perl_package_ensure = $mysql::params::perl_package_ensure, + $perl_package_name = $mysql::params::perl_package_name, + $perl_package_provider = $mysql::params::perl_package_provider, + $php_package_ensure = $mysql::params::php_package_ensure, + $php_package_name = $mysql::params::php_package_name, + $php_package_provider = $mysql::params::php_package_provider, + $python_package_ensure = $mysql::params::python_package_ensure, + $python_package_name = $mysql::params::python_package_name, + $python_package_provider = $mysql::params::python_package_provider, + $ruby_package_ensure = $mysql::params::ruby_package_ensure, + $ruby_package_name = $mysql::params::ruby_package_name, + $ruby_package_provider = $mysql::params::ruby_package_provider, + $client_dev_package_ensure = $mysql::params::client_dev_package_ensure, + $client_dev_package_name = $mysql::params::client_dev_package_name, + $client_dev_package_provider = $mysql::params::client_dev_package_provider, + $daemon_dev_package_ensure = $mysql::params::daemon_dev_package_ensure, + $daemon_dev_package_name = $mysql::params::daemon_dev_package_name, + $daemon_dev_package_provider = $mysql::params::daemon_dev_package_provider +) inherits mysql::params { + + case $::osfamily { + 'Archlinux': { + if $java_enable { fail("::mysql::bindings::java cannot be managed by puppet on ${::osfamily} as it is not in official repositories. Please disable java mysql binding.") } + if $perl_enable { include '::mysql::bindings::perl' } + if $php_enable { warning("::mysql::bindings::php does not need to be managed by puppet on ${::osfamily} as it is included in mysql package by default.") } + if $python_enable { include '::mysql::bindings::python' } + if $ruby_enable { fail("::mysql::bindings::ruby cannot be managed by puppet on ${::osfamily} as it is not in official repositories. Please disable ruby mysql binding.") } + } + + default: { + if $java_enable { include '::mysql::bindings::java' } + if $perl_enable { include '::mysql::bindings::perl' } + if $php_enable { include '::mysql::bindings::php' } + if $python_enable { include '::mysql::bindings::python' } + if $ruby_enable { include '::mysql::bindings::ruby' } + } + } + + if $client_dev { include '::mysql::bindings::client_dev' } + if $daemon_dev { include '::mysql::bindings::daemon_dev' } + +} diff --git a/environments/prod/modules/mysql/manifests/bindings/client_dev.pp b/environments/prod/modules/mysql/manifests/bindings/client_dev.pp new file mode 100644 index 0000000..ee3c2fe --- /dev/null +++ b/environments/prod/modules/mysql/manifests/bindings/client_dev.pp @@ -0,0 +1,15 @@ +# Private class +class mysql::bindings::client_dev { + + if $mysql::bindings::client_dev_package_name { + package { 'mysql-client_dev': + ensure => $mysql::bindings::client_dev_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::client_dev_package_name, + provider => $mysql::bindings::client_dev_package_provider, + } + } else { + warning("No MySQL client development package configured for ${::operatingsystem}.") + } + +} diff --git a/environments/prod/modules/mysql/manifests/bindings/daemon_dev.pp b/environments/prod/modules/mysql/manifests/bindings/daemon_dev.pp new file mode 100644 index 0000000..0515358 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/bindings/daemon_dev.pp @@ -0,0 +1,15 @@ +# Private class +class mysql::bindings::daemon_dev { + + if $mysql::bindings::daemon_dev_package_name { + package { 'mysql-daemon_dev': + ensure => $mysql::bindings::daemon_dev_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::daemon_dev_package_name, + provider => $mysql::bindings::daemon_dev_package_provider, + } + } else { + warning("No MySQL daemon development package configured for ${::operatingsystem}.") + } + +} diff --git a/environments/prod/modules/mysql/manifests/bindings/java.pp b/environments/prod/modules/mysql/manifests/bindings/java.pp new file mode 100644 index 0000000..db93ac2 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/bindings/java.pp @@ -0,0 +1,11 @@ +# Private class +class mysql::bindings::java { + + package { 'mysql-connector-java': + ensure => $mysql::bindings::java_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::java_package_name, + provider => $mysql::bindings::java_package_provider, + } + +} diff --git a/environments/prod/modules/mysql/manifests/bindings/perl.pp b/environments/prod/modules/mysql/manifests/bindings/perl.pp new file mode 100644 index 0000000..99d429c --- /dev/null +++ b/environments/prod/modules/mysql/manifests/bindings/perl.pp @@ -0,0 +1,11 @@ +# Private class +class mysql::bindings::perl { + + package{ 'perl_mysql': + ensure => $mysql::bindings::perl_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::perl_package_name, + provider => $mysql::bindings::perl_package_provider, + } + +} diff --git a/environments/prod/modules/mysql/manifests/bindings/php.pp b/environments/prod/modules/mysql/manifests/bindings/php.pp new file mode 100644 index 0000000..9af7069 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/bindings/php.pp @@ -0,0 +1,11 @@ +# Private class: See README.md +class mysql::bindings::php { + + package { 'php-mysql': + ensure => $mysql::bindings::php_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::php_package_name, + provider => $mysql::bindings::php_package_provider, + } + +} diff --git a/environments/prod/modules/mysql/manifests/bindings/python.pp b/environments/prod/modules/mysql/manifests/bindings/python.pp new file mode 100644 index 0000000..a44c8fa --- /dev/null +++ b/environments/prod/modules/mysql/manifests/bindings/python.pp @@ -0,0 +1,11 @@ +# Private class +class mysql::bindings::python { + + package { 'python-mysqldb': + ensure => $mysql::bindings::python_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::python_package_name, + provider => $mysql::bindings::python_package_provider, + } + +} diff --git a/environments/prod/modules/mysql/manifests/bindings/ruby.pp b/environments/prod/modules/mysql/manifests/bindings/ruby.pp new file mode 100644 index 0000000..d431efe --- /dev/null +++ b/environments/prod/modules/mysql/manifests/bindings/ruby.pp @@ -0,0 +1,11 @@ +# Private class +class mysql::bindings::ruby { + + package{ 'ruby_mysql': + ensure => $mysql::bindings::ruby_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::ruby_package_name, + provider => $mysql::bindings::ruby_package_provider, + } + +} diff --git a/environments/prod/modules/mysql/manifests/client.pp b/environments/prod/modules/mysql/manifests/client.pp new file mode 100644 index 0000000..3d5d706 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/client.pp @@ -0,0 +1,29 @@ +# +class mysql::client ( + $bindings_enable = $mysql::params::bindings_enable, + $install_options = undef, + $package_ensure = $mysql::params::client_package_ensure, + $package_manage = $mysql::params::client_package_manage, + $package_name = $mysql::params::client_package_name, +) inherits mysql::params { + + include '::mysql::client::install' + + if $bindings_enable { + class { 'mysql::bindings': + java_enable => true, + perl_enable => true, + php_enable => true, + python_enable => true, + ruby_enable => true, + } + } + + + # Anchor pattern workaround to avoid resources of mysql::client::install to + # "float off" outside mysql::client + anchor { 'mysql::client::start': } -> + Class['mysql::client::install'] -> + anchor { 'mysql::client::end': } + +} diff --git a/environments/prod/modules/mysql/manifests/client/install.pp b/environments/prod/modules/mysql/manifests/client/install.pp new file mode 100644 index 0000000..26e5ec2 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/client/install.pp @@ -0,0 +1,14 @@ +# See README.md. +class mysql::client::install { + + if $mysql::client::package_manage { + + package { 'mysql_client': + ensure => $mysql::client::package_ensure, + install_options => $mysql::client::install_options, + name => $mysql::client::package_name, + } + + } + +} diff --git a/environments/prod/modules/mysql/manifests/db.pp b/environments/prod/modules/mysql/manifests/db.pp new file mode 100644 index 0000000..f5b2221 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/db.pp @@ -0,0 +1,72 @@ +# See README.md for details. +define mysql::db ( + $user, + $password, + $dbname = $name, + $charset = 'utf8', + $collate = 'utf8_general_ci', + $host = 'localhost', + $grant = 'ALL', + $sql = undef, + $enforce_sql = false, + $ensure = 'present', + $import_timeout = 300, + $import_cat_cmd = 'cat', +) { + #input validation + validate_re($ensure, '^(present|absent)$', + "${ensure} is not supported for ensure. Allowed values are 'present' and 'absent'.") + $table = "${dbname}.*" + + if !(is_array($sql) or is_string($sql)) { + fail('$sql must be either a string or an array.') + } + + $sql_inputs = join([$sql], ' ') + + include '::mysql::client' + + $db_resource = { + ensure => $ensure, + charset => $charset, + collate => $collate, + provider => 'mysql', + require => [ Class['mysql::client'] ], + } + ensure_resource('mysql_database', $dbname, $db_resource) + + $user_resource = { + ensure => $ensure, + password_hash => mysql_password($password), + provider => 'mysql', + } + ensure_resource('mysql_user', "${user}@${host}", $user_resource) + + if $ensure == 'present' { + mysql_grant { "${user}@${host}/${table}": + privileges => $grant, + provider => 'mysql', + user => "${user}@${host}", + table => $table, + require => [ + Mysql_database[$dbname], + Mysql_user["${user}@${host}"], + ], + } + + $refresh = ! $enforce_sql + + if $sql { + exec{ "${dbname}-import": + command => "${import_cat_cmd} ${sql_inputs} | mysql ${dbname}", + logoutput => true, + environment => "HOME=${::root_home}", + refreshonly => $refresh, + path => '/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin', + require => Mysql_grant["${user}@${host}/${table}"], + subscribe => Mysql_database[$dbname], + timeout => $import_timeout, + } + } + } +} diff --git a/environments/prod/modules/mysql/manifests/params.pp b/environments/prod/modules/mysql/manifests/params.pp new file mode 100644 index 0000000..8f65b8f --- /dev/null +++ b/environments/prod/modules/mysql/manifests/params.pp @@ -0,0 +1,450 @@ +# Private class: See README.md. +class mysql::params { + + $manage_config_file = true + $purge_conf_dir = false + $restart = false + $root_password = 'UNSET' + $install_secret_file = '/.mysql_secret' + $server_package_ensure = 'present' + $server_package_manage = true + $server_service_manage = true + $server_service_enabled = true + $client_package_ensure = 'present' + $client_package_manage = true + $create_root_user = true + $create_root_my_cnf = true + # mysql::bindings + $bindings_enable = false + $java_package_ensure = 'present' + $java_package_provider = undef + $perl_package_ensure = 'present' + $perl_package_provider = undef + $php_package_ensure = 'present' + $php_package_provider = undef + $python_package_ensure = 'present' + $python_package_provider = undef + $ruby_package_ensure = 'present' + $ruby_package_provider = undef + $client_dev_package_ensure = 'present' + $client_dev_package_provider = undef + $daemon_dev_package_ensure = 'present' + $daemon_dev_package_provider = undef + $xtrabackup_package_name = 'percona-xtrabackup' + + + case $::osfamily { + 'RedHat': { + case $::operatingsystem { + 'Fedora': { + if versioncmp($::operatingsystemrelease, '19') >= 0 or $::operatingsystemrelease == 'Rawhide' { + $provider = 'mariadb' + } else { + $provider = 'mysql' + } + } + /^(RedHat|CentOS|Scientific|OracleLinux)$/: { + if versioncmp($::operatingsystemmajrelease, '7') >= 0 { + $provider = 'mariadb' + } else { + $provider = 'mysql' + } + } + default: { + $provider = 'mysql' + } + } + + if $provider == 'mariadb' { + $client_package_name = 'mariadb' + $server_package_name = 'mariadb-server' + $server_service_name = 'mariadb' + $log_error = '/var/log/mariadb/mariadb.log' + $config_file = '/etc/my.cnf.d/server.cnf' + # mariadb package by default has !includedir set in my.cnf to /etc/my.cnf.d + $includedir = undef + $pidfile = '/var/run/mariadb/mariadb.pid' + $daemon_dev_package_name = 'mariadb-devel' + } else { + $client_package_name = 'mysql' + $server_package_name = 'mysql-server' + $server_service_name = 'mysqld' + $log_error = '/var/log/mysqld.log' + $config_file = '/etc/my.cnf' + $includedir = '/etc/my.cnf.d' + $pidfile = '/var/run/mysqld/mysqld.pid' + $daemon_dev_package_name = 'mysql-devel' + } + + $basedir = '/usr' + $datadir = '/var/lib/mysql' + $root_group = 'root' + $mysql_group = 'mysql' + $socket = '/var/lib/mysql/mysql.sock' + $ssl_ca = '/etc/mysql/cacert.pem' + $ssl_cert = '/etc/mysql/server-cert.pem' + $ssl_key = '/etc/mysql/server-key.pem' + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'mysql-connector-java' + $perl_package_name = 'perl-DBD-MySQL' + $php_package_name = 'php-mysql' + $python_package_name = 'MySQL-python' + $ruby_package_name = 'ruby-mysql' + $client_dev_package_name = undef + } + + 'Suse': { + case $::operatingsystem { + 'OpenSuSE': { + if versioncmp( $::operatingsystemmajrelease, '12' ) >= 0 { + $client_package_name = 'mariadb-client' + $server_package_name = 'mariadb' + # First service start fails if this is set. Runs fine without + # it being set, in any case. Leaving it as-is for the mysql. + $basedir = undef + } else { + $client_package_name = 'mysql-community-server-client' + $server_package_name = 'mysql-community-server' + $basedir = '/usr' + } + } + 'SLES','SLED': { + if versioncmp($::operatingsystemrelease, '12') >= 0 { + $client_package_name = 'mariadb-client' + $server_package_name = 'mariadb' + $basedir = undef + } else { + $client_package_name = 'mysql-client' + $server_package_name = 'mysql' + $basedir = '/usr' + } + } + default: { + fail("Unsupported platform: puppetlabs-${module_name} currently doesn't support ${::operatingsystem}") + } + } + $config_file = '/etc/my.cnf' + $includedir = '/etc/my.cnf.d' + $datadir = '/var/lib/mysql' + $log_error = $::operatingsystem ? { + /OpenSuSE/ => '/var/log/mysql/mysqld.log', + /(SLES|SLED)/ => '/var/log/mysqld.log', + } + $pidfile = $::operatingsystem ? { + /OpenSuSE/ => '/var/run/mysql/mysqld.pid', + /(SLES|SLED)/ => '/var/lib/mysql/mysqld.pid', + } + $root_group = 'root' + $mysql_group = 'mysql' + $server_service_name = 'mysql' + + if $::operatingsystem =~ /(SLES|SLED)/ { + if versioncmp( $::operatingsystemmajrelease, '12' ) >= 0 { + $socket = '/run/mysql/mysql.sock' + } else { + $socket = '/var/lib/mysql/mysql.sock' + } + } else { + $socket = '/var/run/mysql/mysql.sock' + } + + $ssl_ca = '/etc/mysql/cacert.pem' + $ssl_cert = '/etc/mysql/server-cert.pem' + $ssl_key = '/etc/mysql/server-key.pem' + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'mysql-connector-java' + $perl_package_name = 'perl-DBD-mysql' + $php_package_name = 'apache2-mod_php53' + $python_package_name = 'python-mysql' + $ruby_package_name = $::operatingsystem ? { + /OpenSuSE/ => 'rubygem-mysql', + /(SLES|SLED)/ => 'ruby-mysql', + } + $client_dev_package_name = 'libmysqlclient-devel' + $daemon_dev_package_name = 'mysql-devel' + } + + 'Debian': { + $client_package_name = 'mysql-client' + $server_package_name = 'mysql-server' + + $basedir = '/usr' + $config_file = '/etc/mysql/my.cnf' + $includedir = '/etc/mysql/conf.d' + $datadir = '/var/lib/mysql' + $log_error = '/var/log/mysql/error.log' + $pidfile = '/var/run/mysqld/mysqld.pid' + $root_group = 'root' + $mysql_group = 'adm' + $server_service_name = 'mysql' + $socket = '/var/run/mysqld/mysqld.sock' + $ssl_ca = '/etc/mysql/cacert.pem' + $ssl_cert = '/etc/mysql/server-cert.pem' + $ssl_key = '/etc/mysql/server-key.pem' + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'libmysql-java' + $perl_package_name = 'libdbd-mysql-perl' + $php_package_name = $::lsbdistcodename ? { + 'xenial' => 'php-mysql', + default => 'php5-mysql', + } + $python_package_name = 'python-mysqldb' + $ruby_package_name = $::lsbdistcodename ? { + 'trusty' => 'ruby-mysql', + 'jessie' => 'ruby-mysql', + 'xenial' => 'ruby-mysql', + default => 'libmysql-ruby', + } + $client_dev_package_name = 'libmysqlclient-dev' + $daemon_dev_package_name = 'libmysqld-dev' + } + + 'Archlinux': { + $client_package_name = 'mariadb-clients' + $server_package_name = 'mariadb' + $basedir = '/usr' + $config_file = '/etc/mysql/my.cnf' + $datadir = '/var/lib/mysql' + $log_error = '/var/log/mysqld.log' + $pidfile = '/var/run/mysqld/mysqld.pid' + $root_group = 'root' + $mysql_group = 'mysql' + $server_service_name = 'mysqld' + $socket = '/var/lib/mysql/mysql.sock' + $ssl_ca = '/etc/mysql/cacert.pem' + $ssl_cert = '/etc/mysql/server-cert.pem' + $ssl_key = '/etc/mysql/server-key.pem' + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'mysql-connector-java' + $perl_package_name = 'perl-dbd-mysql' + $php_package_name = undef + $python_package_name = 'mysql-python' + $ruby_package_name = 'mysql-ruby' + } + + 'Gentoo': { + $client_package_name = 'virtual/mysql' + $server_package_name = 'virtual/mysql' + $basedir = '/usr' + $config_file = '/etc/mysql/my.cnf' + $datadir = '/var/lib/mysql' + $log_error = '/var/log/mysql/mysqld.err' + $pidfile = '/run/mysqld/mysqld.pid' + $root_group = 'root' + $mysql_group = 'mysql' + $server_service_name = 'mysql' + $socket = '/run/mysqld/mysqld.sock' + $ssl_ca = '/etc/mysql/cacert.pem' + $ssl_cert = '/etc/mysql/server-cert.pem' + $ssl_key = '/etc/mysql/server-key.pem' + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'dev-java/jdbc-mysql' + $perl_package_name = 'dev-perl/DBD-mysql' + $php_package_name = undef + $python_package_name = 'dev-python/mysql-python' + $ruby_package_name = 'dev-ruby/mysql-ruby' + } + + 'FreeBSD': { + $client_package_name = 'databases/mysql56-client' + $server_package_name = 'databases/mysql56-server' + $basedir = '/usr/local' + $config_file = '/usr/local/etc/my.cnf' + $includedir = '/usr/local/etc/my.cnf.d' + $datadir = '/var/db/mysql' + $log_error = '/var/log/mysqld.log' + $pidfile = '/var/run/mysql.pid' + $root_group = 'wheel' + $mysql_group = 'mysql' + $server_service_name = 'mysql-server' + $socket = '/var/db/mysql/mysql.sock' + $ssl_ca = undef + $ssl_cert = undef + $ssl_key = undef + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'databases/mysql-connector-java' + $perl_package_name = 'p5-DBD-mysql' + $php_package_name = 'php5-mysql' + $python_package_name = 'databases/py-MySQLdb' + $ruby_package_name = 'databases/ruby-mysql' + # The libraries installed by these packages are included in client and server packages, no installation required. + $client_dev_package_name = undef + $daemon_dev_package_name = undef + } + + 'OpenBSD': { + $client_package_name = 'mariadb-client' + $server_package_name = 'mariadb-server' + $basedir = '/usr/local' + $config_file = '/etc/my.cnf' + $includedir = undef + $datadir = '/var/mysql' + $log_error = "/var/mysql/${::hostname}.err" + $pidfile = '/var/mysql/mysql.pid' + $root_group = 'wheel' + $mysql_group = '_mysql' + $server_service_name = 'mysqld' + $socket = '/var/run/mysql/mysql.sock' + $ssl_ca = undef + $ssl_cert = undef + $ssl_key = undef + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = undef + $perl_package_name = 'p5-DBD-mysql' + $php_package_name = 'php-mysql' + $python_package_name = 'py-mysql' + $ruby_package_name = 'ruby-mysql' + # The libraries installed by these packages are included in client and server packages, no installation required. + $client_dev_package_name = undef + $daemon_dev_package_name = undef + } + + 'Solaris': { + $client_package_name = 'database/mysql-55/client' + $server_package_name = 'database/mysql-55' + $basedir = undef + $config_file = '/etc/mysql/5.5/my.cnf' + $datadir = '/var/mysql/5.5/data' + $log_error = "/var/mysql/5.5/data/${::hostname}.err" + $pidfile = "/var/mysql/5.5/data/${::hostname}.pid" + $root_group = 'bin' + $server_service_name = 'application/database/mysql:version_55' + $socket = '/tmp/mysql.sock' + $ssl_ca = undef + $ssl_cert = undef + $ssl_key = undef + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = undef + $perl_package_name = undef + $php_package_name = 'web/php-53/extension/php-mysql' + $python_package_name = 'library/python/python-mysql' + $ruby_package_name = undef + # The libraries installed by these packages are included in client and server packages, no installation required. + $client_dev_package_name = undef + $daemon_dev_package_name = undef + } + + default: { + case $::operatingsystem { + 'Amazon': { + $client_package_name = 'mysql' + $server_package_name = 'mysql-server' + $basedir = '/usr' + $config_file = '/etc/my.cnf' + $includedir = '/etc/my.cnf.d' + $datadir = '/var/lib/mysql' + $log_error = '/var/log/mysqld.log' + $pidfile = '/var/run/mysqld/mysqld.pid' + $root_group = 'root' + $mysql_group = 'mysql' + $server_service_name = 'mysqld' + $socket = '/var/lib/mysql/mysql.sock' + $ssl_ca = '/etc/mysql/cacert.pem' + $ssl_cert = '/etc/mysql/server-cert.pem' + $ssl_key = '/etc/mysql/server-key.pem' + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'mysql-connector-java' + $perl_package_name = 'perl-DBD-MySQL' + $php_package_name = 'php-mysql' + $python_package_name = 'MySQL-python' + $ruby_package_name = 'ruby-mysql' + # The libraries installed by these packages are included in client and server packages, no installation required. + $client_dev_package_name = undef + $daemon_dev_package_name = undef + } + + default: { + fail("Unsupported platform: puppetlabs-${module_name} currently doesn't support ${::osfamily} or ${::operatingsystem}") + } + } + } + } + + case $::operatingsystem { + 'Ubuntu': { + if versioncmp($::operatingsystemmajrelease, '14.10') > 0 { + $server_service_provider = 'systemd' + } else { + $server_service_provider = 'upstart' + } + } + default: { + $server_service_provider = undef + } + } + + $default_options = { + 'client' => { + 'port' => '3306', + 'socket' => $mysql::params::socket, + }, + 'mysqld_safe' => { + 'nice' => '0', + 'log-error' => $mysql::params::log_error, + 'socket' => $mysql::params::socket, + }, + 'mysqld-5.0' => { + 'myisam-recover' => 'BACKUP', + }, + 'mysqld-5.1' => { + 'myisam-recover' => 'BACKUP', + }, + 'mysqld-5.5' => { + 'myisam-recover' => 'BACKUP', + }, + 'mysqld-5.6' => { + 'myisam-recover-options' => 'BACKUP', + }, + 'mysqld-5.7' => { + 'myisam-recover-options' => 'BACKUP', + }, + 'mysqld' => { + 'basedir' => $mysql::params::basedir, + 'bind-address' => '127.0.0.1', + 'datadir' => $mysql::params::datadir, + 'expire_logs_days' => '10', + 'key_buffer_size' => '16M', + 'log-error' => $mysql::params::log_error, + 'max_allowed_packet' => '16M', + 'max_binlog_size' => '100M', + 'max_connections' => '151', + 'pid-file' => $mysql::params::pidfile, + 'port' => '3306', + 'query_cache_limit' => '1M', + 'query_cache_size' => '16M', + 'skip-external-locking' => true, + 'socket' => $mysql::params::socket, + 'ssl' => false, + 'ssl-ca' => $mysql::params::ssl_ca, + 'ssl-cert' => $mysql::params::ssl_cert, + 'ssl-key' => $mysql::params::ssl_key, + 'ssl-disable' => false, + 'thread_cache_size' => '8', + 'thread_stack' => '256K', + 'tmpdir' => $mysql::params::tmpdir, + 'user' => 'mysql', + }, + 'mysqldump' => { + 'max_allowed_packet' => '16M', + 'quick' => true, + 'quote-names' => true, + }, + 'isamchk' => { + 'key_buffer_size' => '16M', + }, + } + + ## Additional graceful failures + if $::osfamily == 'RedHat' and $::operatingsystemmajrelease == '4' and $::operatingsystem != 'Amazon' { + fail("Unsupported platform: puppetlabs-${module_name} only supports RedHat 5.0 and beyond") + } +} diff --git a/environments/prod/modules/mysql/manifests/server.pp b/environments/prod/modules/mysql/manifests/server.pp new file mode 100644 index 0000000..e910c21 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/server.pp @@ -0,0 +1,89 @@ +# Class: mysql::server: See README.md for documentation. +class mysql::server ( + $config_file = $mysql::params::config_file, + $includedir = $mysql::params::includedir, + $install_options = undef, + $install_secret_file = $mysql::params::install_secret_file, + $manage_config_file = $mysql::params::manage_config_file, + $override_options = {}, + $package_ensure = $mysql::params::server_package_ensure, + $package_manage = $mysql::params::server_package_manage, + $package_name = $mysql::params::server_package_name, + $purge_conf_dir = $mysql::params::purge_conf_dir, + $remove_default_accounts = false, + $restart = $mysql::params::restart, + $root_group = $mysql::params::root_group, + $mysql_group = $mysql::params::mysql_group, + $root_password = $mysql::params::root_password, + $service_enabled = $mysql::params::server_service_enabled, + $service_manage = $mysql::params::server_service_manage, + $service_name = $mysql::params::server_service_name, + $service_provider = $mysql::params::server_service_provider, + $create_root_user = $mysql::params::create_root_user, + $create_root_my_cnf = $mysql::params::create_root_my_cnf, + $users = {}, + $grants = {}, + $databases = {}, + + # Deprecated parameters + $enabled = undef, + $manage_service = undef, + $old_root_password = undef +) inherits mysql::params { + + # Deprecated parameters. + if $enabled { + crit('This parameter has been renamed to service_enabled.') + $real_service_enabled = $enabled + } else { + $real_service_enabled = $service_enabled + } + if $manage_service { + crit('This parameter has been renamed to service_manage.') + $real_service_manage = $manage_service + } else { + $real_service_manage = $service_manage + } + if $old_root_password { + warning('old_root_password is no longer used and will be removed in a future release') + } + + # Create a merged together set of options. Rightmost hashes win over left. + $options = mysql_deepmerge($mysql::params::default_options, $override_options) + + Class['mysql::server::root_password'] -> Mysql::Db <| |> + + include '::mysql::server::config' + include '::mysql::server::install' + include '::mysql::server::binarylog' + include '::mysql::server::installdb' + include '::mysql::server::service' + include '::mysql::server::root_password' + include '::mysql::server::providers' + + if $remove_default_accounts { + class { '::mysql::server::account_security': + require => Anchor['mysql::server::end'], + } + } + + anchor { 'mysql::server::start': } + anchor { 'mysql::server::end': } + + if $restart { + Class['mysql::server::config'] ~> + Class['mysql::server::service'] + } + + Anchor['mysql::server::start'] -> + Class['mysql::server::config'] -> + Class['mysql::server::install'] -> + Class['mysql::server::binarylog'] -> + Class['mysql::server::installdb'] -> + Class['mysql::server::service'] -> + Class['mysql::server::root_password'] -> + Class['mysql::server::providers'] -> + Anchor['mysql::server::end'] + + +} diff --git a/environments/prod/modules/mysql/manifests/server/account_security.pp b/environments/prod/modules/mysql/manifests/server/account_security.pp new file mode 100644 index 0000000..3fcdd61 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/server/account_security.pp @@ -0,0 +1,39 @@ +# See README.md. +class mysql::server::account_security { + mysql_user { + [ 'root@127.0.0.1', + 'root@::1', + '@localhost', + '@%']: + ensure => 'absent', + require => Anchor['mysql::server::end'], + } + if ($::fqdn != 'localhost.localdomain') { + mysql_user { + [ 'root@localhost.localdomain', + '@localhost.localdomain']: + ensure => 'absent', + require => Anchor['mysql::server::end'], + } + } + if ($::fqdn and $::fqdn != 'localhost') { + mysql_user { + [ "root@${::fqdn}", + "@${::fqdn}"]: + ensure => 'absent', + require => Anchor['mysql::server::end'], + } + } + if ($::fqdn != $::hostname) { + if ($::hostname != 'localhost') { + mysql_user { ["root@${::hostname}", "@${::hostname}"]: + ensure => 'absent', + require => Anchor['mysql::server::end'], + } + } + } + mysql_database { 'test': + ensure => 'absent', + require => Anchor['mysql::server::end'], + } +} diff --git a/environments/prod/modules/mysql/manifests/server/backup.pp b/environments/prod/modules/mysql/manifests/server/backup.pp new file mode 100644 index 0000000..d31a880 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/server/backup.pp @@ -0,0 +1,55 @@ +# See README.me for usage. +class mysql::server::backup ( + $backupuser = undef, + $backuppassword = undef, + $backupdir = undef, + $backupdirmode = '0700', + $backupdirowner = 'root', + $backupdirgroup = 'root', + $backupcompress = true, + $backuprotate = 30, + $ignore_events = true, + $delete_before_dump = false, + $backupdatabases = [], + $file_per_database = false, + $include_routines = false, + $include_triggers = false, + $ensure = 'present', + $time = ['23', '5'], + $prescript = false, + $postscript = false, + $execpath = '/usr/bin:/usr/sbin:/bin:/sbin', + $provider = 'mysqldump', + $maxallowedpacket = '1M', +) { + + if $prescript and $provider =~ /(mysqldump|mysqlbackup)/ { + warning("The \$prescript option is not currently implemented for the ${provider} backup provider.") + } + + create_resources('class', { + "mysql::backup::${provider}" => { + 'backupuser' => $backupuser, + 'backuppassword' => $backuppassword, + 'backupdir' => $backupdir, + 'backupdirmode' => $backupdirmode, + 'backupdirowner' => $backupdirowner, + 'backupdirgroup' => $backupdirgroup, + 'backupcompress' => $backupcompress, + 'backuprotate' => $backuprotate, + 'ignore_events' => $ignore_events, + 'delete_before_dump' => $delete_before_dump, + 'backupdatabases' => $backupdatabases, + 'file_per_database' => $file_per_database, + 'include_routines' => $include_routines, + 'include_triggers' => $include_triggers, + 'ensure' => $ensure, + 'time' => $time, + 'prescript' => $prescript, + 'postscript' => $postscript, + 'execpath' => $execpath, + 'maxallowedpacket' => $maxallowedpacket, + } + }) + +} diff --git a/environments/prod/modules/mysql/manifests/server/binarylog.pp b/environments/prod/modules/mysql/manifests/server/binarylog.pp new file mode 100644 index 0000000..459915d --- /dev/null +++ b/environments/prod/modules/mysql/manifests/server/binarylog.pp @@ -0,0 +1,22 @@ +# Binary log configuration requires the mysql user to be present. This must be done after package install +class mysql::server::binarylog { + + $options = $mysql::server::options + $includedir = $mysql::server::includedir + + $logbin = pick($options['mysqld']['log-bin'], $options['mysqld']['log_bin'], false) + + if $logbin { + $logbindir = mysql_dirname($logbin) + + #Stop puppet from managing directory if just a filename/prefix is specified + if $logbindir != '.' { + file { $logbindir: + ensure => directory, + mode => '0755', + owner => $options['mysqld']['user'], + group => $options['mysqld']['user'], + } + } + } +} diff --git a/environments/prod/modules/mysql/manifests/server/config.pp b/environments/prod/modules/mysql/manifests/server/config.pp new file mode 100644 index 0000000..efb4940 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/server/config.pp @@ -0,0 +1,56 @@ +# See README.me for options. +class mysql::server::config { + + $options = $mysql::server::options + $includedir = $mysql::server::includedir + + File { + owner => 'root', + group => $mysql::server::root_group, + mode => '0400', + } + + if $includedir and $includedir != '' { + file { $includedir: + ensure => directory, + mode => '0755', + recurse => $mysql::server::purge_conf_dir, + purge => $mysql::server::purge_conf_dir, + } + + # on some systems this is /etc/my.cnf.d, while Debian has /etc/mysql/conf.d and FreeBSD something in /usr/local. For the latter systems, + # managing this basedir is also required, to have it available before the package is installed. + $includeparentdir = mysql_dirname($includedir) + if $includeparentdir != '/' and $includeparentdir != '/etc' { + file { $includeparentdir: + ensure => directory, + mode => '0755', + } + } + } + + if $mysql::server::manage_config_file { + file { 'mysql-config-file': + path => $mysql::server::config_file, + content => template('mysql/my.cnf.erb'), + mode => '0644', + selinux_ignore_defaults => true, + } + + # on mariadb systems, $includedir is not defined, but /etc/my.cnf.d has + # to be managed to place the server.cnf there + $configparentdir = mysql_dirname($mysql::server::config_file) + if $configparentdir != '/' and $configparentdir != '/etc' and $configparentdir != $includedir and $configparentdir != mysql_dirname($includedir) { + file { $configparentdir: + ensure => directory, + mode => '0755', + } + } + } + + if $options['mysqld']['ssl-disable'] { + notify {'ssl-disable': + message =>'Disabling SSL is evil! You should never ever do this except if you are forced to use a mysql version compiled without SSL support' + } + } +} diff --git a/environments/prod/modules/mysql/manifests/server/install.pp b/environments/prod/modules/mysql/manifests/server/install.pp new file mode 100644 index 0000000..3b9601d --- /dev/null +++ b/environments/prod/modules/mysql/manifests/server/install.pp @@ -0,0 +1,13 @@ +# +class mysql::server::install { + + if $mysql::server::package_manage { + + package { 'mysql-server': + ensure => $mysql::server::package_ensure, + install_options => $mysql::server::install_options, + name => $mysql::server::package_name, + } + } + +} diff --git a/environments/prod/modules/mysql/manifests/server/installdb.pp b/environments/prod/modules/mysql/manifests/server/installdb.pp new file mode 100644 index 0000000..5b419f2 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/server/installdb.pp @@ -0,0 +1,46 @@ +# +class mysql::server::installdb { + $options = $mysql::server::options + + if $mysql::server::package_manage { + + # Build the initial databases. + $mysqluser = $mysql::server::options['mysqld']['user'] + $datadir = $mysql::server::options['mysqld']['datadir'] + $basedir = $mysql::server::options['mysqld']['basedir'] + $config_file = $mysql::server::config_file + $log_error = $mysql::server::options['mysqld']['log-error'] + + if $mysql::server::manage_config_file and $config_file != $mysql::params::config_file { + $_config_file=$config_file + } else { + $_config_file=undef + } + + if $options['mysqld']['log-error'] { + file { $options['mysqld']['log-error']: + ensure => present, + owner => $mysqluser, + group => $::mysql::server::mysql_group, + mode => 'u+rw', + before => Mysql_datadir[ $datadir ], + } + } + + mysql_datadir { $datadir: + ensure => 'present', + datadir => $datadir, + basedir => $basedir, + user => $mysqluser, + log_error => $log_error, + defaults_extra_file => $_config_file, + } + + if $mysql::server::restart { + Mysql_datadir[$datadir] { + notify => Class['mysql::server::service'], + } + } + } + +} diff --git a/environments/prod/modules/mysql/manifests/server/monitor.pp b/environments/prod/modules/mysql/manifests/server/monitor.pp new file mode 100644 index 0000000..6b18609 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/server/monitor.pp @@ -0,0 +1,24 @@ +#This is a helper class to add a monitoring user to the database +class mysql::server::monitor ( + $mysql_monitor_username = '', + $mysql_monitor_password = '', + $mysql_monitor_hostname = '' +) { + + Anchor['mysql::server::end'] -> Class['mysql::server::monitor'] + + mysql_user { "${mysql_monitor_username}@${mysql_monitor_hostname}": + ensure => present, + password_hash => mysql_password($mysql_monitor_password), + require => Class['mysql::server::service'], + } + + mysql_grant { "${mysql_monitor_username}@${mysql_monitor_hostname}/*.*": + ensure => present, + user => "${mysql_monitor_username}@${mysql_monitor_hostname}", + table => '*.*', + privileges => [ 'PROCESS', 'SUPER' ], + require => Mysql_user["${mysql_monitor_username}@${mysql_monitor_hostname}"], + } + +} diff --git a/environments/prod/modules/mysql/manifests/server/mysqltuner.pp b/environments/prod/modules/mysql/manifests/server/mysqltuner.pp new file mode 100644 index 0000000..ff1d563 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/server/mysqltuner.pp @@ -0,0 +1,52 @@ +# +class mysql::server::mysqltuner( + $ensure = 'present', + $version = 'v1.3.0', + $source = undef, +) { + + if $source { + $_version = $source + $_source = $source + } else { + $_version = $version + $_source = "https://github.com/major/MySQLTuner-perl/raw/${version}/mysqltuner.pl" + } + + if $ensure == 'present' { + # $::puppetversion doesn't exist in puppet 4.x so would break strict + # variables + if ! $::settings::strict_variables { + $_puppetversion = $::puppetversion + } else { + # defined only works with puppet >= 3.5.0, so don't use it unless we're + # actually using strict variables + $_puppetversion = defined('$puppetversion') ? { + true => $::puppetversion, + default => undef, + } + } + # see https://tickets.puppetlabs.com/browse/ENTERPRISE-258 + if $_puppetversion and $_puppetversion =~ /Puppet Enterprise/ and versioncmp($_puppetversion, '3.8.0') < 0 { + class { '::staging': + path => '/opt/mysql_staging', + } + } else { + class { '::staging': } + } + + staging::file { "mysqltuner-${_version}": + source => $_source, + } + file { '/usr/local/bin/mysqltuner': + ensure => $ensure, + mode => '0550', + source => "${::staging::path}/mysql/mysqltuner-${_version}", + require => Staging::File["mysqltuner-${_version}"], + } + } else { + file { '/usr/local/bin/mysqltuner': + ensure => $ensure, + } + } +} diff --git a/environments/prod/modules/mysql/manifests/server/providers.pp b/environments/prod/modules/mysql/manifests/server/providers.pp new file mode 100644 index 0000000..b651172 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/server/providers.pp @@ -0,0 +1,8 @@ +# Convenience class to call each of the three providers with the corresponding +# hashes provided in mysql::server. +# See README.md for details. +class mysql::server::providers { + create_resources('mysql_user', $mysql::server::users) + create_resources('mysql_grant', $mysql::server::grants) + create_resources('mysql_database', $mysql::server::databases) +} diff --git a/environments/prod/modules/mysql/manifests/server/root_password.pp b/environments/prod/modules/mysql/manifests/server/root_password.pp new file mode 100644 index 0000000..9ebc103 --- /dev/null +++ b/environments/prod/modules/mysql/manifests/server/root_password.pp @@ -0,0 +1,46 @@ +# +class mysql::server::root_password { + + $options = $mysql::server::options + $secret_file = $mysql::server::install_secret_file + + # New installations of MySQL will configure a default random password for the root user + # with an expiration. No actions can be performed until this password is changed. The + # below exec will remove this default password. If the user has supplied a root + # password it will be set further down with the mysql_user resource. + $rm_pass_cmd = join([ + "mysqladmin -u root --password=\$(grep -o '[^ ]\\+\$' ${secret_file}) password ''", + "rm -f ${secret_file}" + ], ' && ') + exec { 'remove install pass': + command => $rm_pass_cmd, + onlyif => "test -f ${secret_file}", + path => '/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin' + } + + # manage root password if it is set + if $mysql::server::create_root_user == true and $mysql::server::root_password != 'UNSET' { + mysql_user { 'root@localhost': + ensure => present, + password_hash => mysql_password($mysql::server::root_password), + require => Exec['remove install pass'] + } + } + + if $mysql::server::create_root_my_cnf == true and $mysql::server::root_password != 'UNSET' { + file { "${::root_home}/.my.cnf": + content => template('mysql/my.cnf.pass.erb'), + owner => 'root', + mode => '0600', + } + + # show_diff was added with puppet 3.0 + if versioncmp($::puppetversion, '3.0') >= 0 { + File["${::root_home}/.my.cnf"] { show_diff => false } + } + if $mysql::server::create_root_user == true { + Mysql_user['root@localhost'] -> File["${::root_home}/.my.cnf"] + } + } + +} diff --git a/environments/prod/modules/mysql/manifests/server/service.pp b/environments/prod/modules/mysql/manifests/server/service.pp new file mode 100644 index 0000000..3617b4b --- /dev/null +++ b/environments/prod/modules/mysql/manifests/server/service.pp @@ -0,0 +1,58 @@ +# +class mysql::server::service { + $options = $mysql::server::options + + if $mysql::server::real_service_manage { + if $mysql::server::real_service_enabled { + $service_ensure = 'running' + } else { + $service_ensure = 'stopped' + } + } else { + $service_ensure = undef + } + + if $mysql::server::override_options and $mysql::server::override_options['mysqld'] and $mysql::server::override_options['mysqld']['user'] { + $mysqluser = $mysql::server::override_options['mysqld']['user'] + } else { + $mysqluser = $options['mysqld']['user'] + } + + if $mysql::server::real_service_manage { + service { 'mysqld': + ensure => $service_ensure, + name => $mysql::server::service_name, + enable => $mysql::server::real_service_enabled, + provider => $mysql::server::service_provider, + } + + # only establish ordering between service and package if + # we're managing the package. + if $mysql::server::package_manage { + Service['mysqld'] { + require => Package['mysql-server'], + } + } + + # only establish ordering between config file and service if + # we're managing the config file. + if $mysql::server::manage_config_file { + File['mysql-config-file'] -> Service['mysqld'] + } + + if $mysql::server::override_options and $mysql::server::override_options['mysqld'] and $mysql::server::override_options['mysqld']['socket'] { + $mysqlsocket = $mysql::server::override_options['mysqld']['socket'] + } else { + $mysqlsocket = $options['mysqld']['socket'] + } + + exec { 'wait_for_mysql_socket_to_open': + command => "test -S ${mysqlsocket}", + unless => "test -S ${mysqlsocket}", + tries => '3', + try_sleep => '10', + require => Service['mysqld'], + path => '/bin:/usr/bin', + } + } +} diff --git a/environments/prod/modules/mysql/metadata.json b/environments/prod/modules/mysql/metadata.json new file mode 100644 index 0000000..41c8da1 --- /dev/null +++ b/environments/prod/modules/mysql/metadata.json @@ -0,0 +1,80 @@ +{ + "name": "puppetlabs-mysql", + "version": "3.10.0", + "author": "Puppet Labs", + "summary": "Installs, configures, and manages the MySQL service.", + "license": "Apache-2.0", + "source": "git://github.com/puppetlabs/puppetlabs-mysql.git", + "project_page": "http://github.com/puppetlabs/puppetlabs-mysql", + "issues_url": "https://tickets.puppetlabs.com/browse/MODULES", + "dependencies": [ + {"name":"puppetlabs/stdlib","version_requirement":">= 3.2.0 < 5.0.0"}, + {"name":"puppet/staging","version_requirement":">= 1.0.1 < 3.0.0"} + ], + "data_provider": null, + "operatingsystem_support": [ + { + "operatingsystem": "RedHat", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "CentOS", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "OracleLinux", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "Scientific", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "SLES", + "operatingsystemrelease": [ + "11 SP1", + "12" + ] + }, + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "6", + "7", + "8" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "10.04", + "12.04", + "14.04", + "16.04" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">= 3.0.0 < 5.0.0" + } + ], + "description": "MySQL module" +} diff --git a/environments/prod/modules/mysql/spec/acceptance/mysql_backup_spec.rb b/environments/prod/modules/mysql/spec/acceptance/mysql_backup_spec.rb new file mode 100644 index 0000000..88a90cc --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/mysql_backup_spec.rb @@ -0,0 +1,205 @@ +require 'spec_helper_acceptance' +require 'puppet' +require 'puppet/util/package' +require_relative './mysql_helper.rb' + +describe 'mysql::server::backup class' do + context 'should work with no errors' do + it 'when configuring mysql backups' do + pp = <<-EOS + class { 'mysql::server': root_password => 'password' } + mysql::db { [ + 'backup1', + 'backup2' + ]: + user => 'backup', + password => 'secret', + } + + class { 'mysql::server::backup': + backupuser => 'myuser', + backuppassword => 'mypassword', + backupdir => '/tmp/backups', + backupcompress => true, + postscript => [ + 'rm -rf /var/tmp/mysqlbackups', + 'rm -f /var/tmp/mysqlbackups.done', + 'cp -r /tmp/backups /var/tmp/mysqlbackups', + 'touch /var/tmp/mysqlbackups.done', + ], + execpath => '/usr/bin:/usr/sbin:/bin:/sbin:/opt/zimbra/bin', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_failures => true) + end + end + + describe 'mysqlbackup.sh' do + it 'should run mysqlbackup.sh with no errors' do + pre_run + if ! version_is_greater_than('5.7.0') + shell("/usr/local/sbin/mysqlbackup.sh") do |r| + expect(r.stderr).to eq("") + end + end + end + + it 'should dump all databases to single file' do + pre_run + if ! version_is_greater_than('5.7.0') + shell('ls -l /tmp/backups/mysql_backup_*-*.sql.bz2 | wc -l') do |r| + expect(r.stdout).to match(/1/) + expect(r.exit_code).to be_zero + end + end + end + + context 'should create one file per database per run' do + it 'executes mysqlbackup.sh a second time' do + pre_run + if ! version_is_greater_than('5.7.0') + shell('sleep 1') + shell('/usr/local/sbin/mysqlbackup.sh') + end + end + + it 'creates at least one backup tarball' do + pre_run + if ! version_is_greater_than('5.7.0') + shell('ls -l /tmp/backups/mysql_backup_*-*.sql.bz2 | wc -l') do |r| + expect(r.stdout).to match(/2/) + expect(r.exit_code).to be_zero + end + end + end + end + end + + context 'with one file per database' do + context 'should work with no errors' do + it 'when configuring mysql backups' do + pp = <<-EOS + class { 'mysql::server': root_password => 'password' } + mysql::db { [ + 'backup1', + 'backup2' + ]: + user => 'backup', + password => 'secret', + } + + class { 'mysql::server::backup': + backupuser => 'myuser', + backuppassword => 'mypassword', + backupdir => '/tmp/backups', + backupcompress => true, + file_per_database => true, + postscript => [ + 'rm -rf /var/tmp/mysqlbackups', + 'rm -f /var/tmp/mysqlbackups.done', + 'cp -r /tmp/backups /var/tmp/mysqlbackups', + 'touch /var/tmp/mysqlbackups.done', + ], + execpath => '/usr/bin:/usr/sbin:/bin:/sbin:/opt/zimbra/bin', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_failures => true) + end + end + + describe 'mysqlbackup.sh' do + it 'should run mysqlbackup.sh with no errors without root credentials' do + pre_run + if ! version_is_greater_than('5.7.0') + shell("HOME=/tmp/dontreadrootcredentials /usr/local/sbin/mysqlbackup.sh") do |r| + expect(r.stderr).to eq("") + end + end + end + + it 'should create one file per database' do + pre_run + if ! version_is_greater_than('5.7.0') + ['backup1', 'backup2'].each do |database| + shell("ls -l /tmp/backups/mysql_backup_#{database}_*-*.sql.bz2 | wc -l") do |r| + expect(r.stdout).to match(/1/) + expect(r.exit_code).to be_zero + end + end + end + end + + context 'should create one file per database per run' do + it 'executes mysqlbackup.sh a second time' do + pre_run + if ! version_is_greater_than('5.7.0') + shell('sleep 1') + shell('HOME=/tmp/dontreadrootcredentials /usr/local/sbin/mysqlbackup.sh') + end + end + + it 'has one file per database per run' do + pre_run + if ! version_is_greater_than('5.7.0') + ['backup1', 'backup2'].each do |database| + shell("ls -l /tmp/backups/mysql_backup_#{database}_*-*.sql.bz2 | wc -l") do |r| + expect(r.stdout).to match(/2/) + expect(r.exit_code).to be_zero + end + end + end + end + end + end + end + + context 'with triggers and routines' do + it 'when configuring mysql backups with triggers and routines' do + pre_run + pp = <<-EOS + class { 'mysql::server': root_password => 'password' } + mysql::db { [ + 'backup1', + 'backup2' + ]: + user => 'backup', + password => 'secret', + } + package { 'bzip2': + ensure => present, + } + class { 'mysql::server::backup': + backupuser => 'myuser', + backuppassword => 'mypassword', + backupdir => '/tmp/backups', + backupcompress => true, + file_per_database => true, + include_triggers => #{version_is_greater_than('5.1.5')}, + include_routines => true, + postscript => [ + 'rm -rf /var/tmp/mysqlbackups', + 'rm -f /var/tmp/mysqlbackups.done', + 'cp -r /tmp/backups /var/tmp/mysqlbackups', + 'touch /var/tmp/mysqlbackups.done', + ], + execpath => '/usr/bin:/usr/sbin:/bin:/sbin:/opt/zimbra/bin', + require => Package['bzip2'], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + it 'should run mysqlbackup.sh with no errors' do + pre_run + if ! version_is_greater_than('5.7.0') + shell("/usr/local/sbin/mysqlbackup.sh") do |r| + expect(r.stderr).to eq("") + end + end + end + end +end diff --git a/environments/prod/modules/mysql/spec/acceptance/mysql_db_spec.rb b/environments/prod/modules/mysql/spec/acceptance/mysql_db_spec.rb new file mode 100644 index 0000000..8c57160 --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/mysql_db_spec.rb @@ -0,0 +1,65 @@ +require 'spec_helper_acceptance' + +describe 'mysql::db define' do + describe 'creating a database' do + let(:pp) do + <<-EOS + class { 'mysql::server': root_password => 'password' } + mysql::db { 'spec1': + user => 'root1', + password => 'password', + } + EOS + end + it_behaves_like "a idempotent resource" + + describe command("mysql -e 'show databases;'") do + its(:exit_status) { is_expected.to eq 0 } + its(:stdout) { is_expected.to match /^spec1$/ } + end + end + + describe 'creating a database with post-sql' do + let(:pp) do + <<-EOS + class { 'mysql::server': override_options => { 'root_password' => 'password' } } + file { '/tmp/spec.sql': + ensure => file, + content => 'CREATE TABLE table1 (id int);', + before => Mysql::Db['spec2'], + } + mysql::db { 'spec2': + user => 'root1', + password => 'password', + sql => '/tmp/spec.sql', + } + EOS + end + it_behaves_like "a idempotent resource" + + describe command("mysql -e 'show tables;' spec2") do + its(:exit_status) { is_expected.to eq 0 } + its(:stdout) { is_expected.to match /^table1$/ } + end + end + + describe 'creating a database with dbname parameter' do + let(:check_command) { " | grep realdb" } + let(:pp) do + <<-EOS + class { 'mysql::server': override_options => { 'root_password' => 'password' } } + mysql::db { 'spec1': + user => 'root1', + password => 'password', + dbname => 'realdb', + } + EOS + end + it_behaves_like "a idempotent resource" + + describe command("mysql -e 'show databases;'") do + its(:exit_status) { is_expected.to eq 0 } + its(:stdout) { is_expected.to match /^realdb$/ } + end + end +end diff --git a/environments/prod/modules/mysql/spec/acceptance/mysql_helper.rb b/environments/prod/modules/mysql/spec/acceptance/mysql_helper.rb new file mode 100644 index 0000000..7a5dd57 --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/mysql_helper.rb @@ -0,0 +1,8 @@ + def pre_run + apply_manifest("class { 'mysql::server': root_password => 'password' }", :catch_failures => true) + @mysql_version = (on default, 'mysql --version').output.chomp.match(/\d+\.\d+\.\d+/)[0] + end + + def version_is_greater_than(version) + return Puppet::Util::Package.versioncmp(@mysql_version, version) > 0 + end diff --git a/environments/prod/modules/mysql/spec/acceptance/mysql_server_spec.rb b/environments/prod/modules/mysql/spec/acceptance/mysql_server_spec.rb new file mode 100644 index 0000000..d8e2f3e --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/mysql_server_spec.rb @@ -0,0 +1,107 @@ +require 'spec_helper_acceptance' + +describe 'mysql class' do + describe 'advanced config' do + before(:all) do + @tmpdir = default.tmpdir('mysql') + end + let(:pp) do + <<-EOS + class { 'mysql::server': + config_file => '#{@tmpdir}/my.cnf', + includedir => '#{@tmpdir}/include', + manage_config_file => 'true', + override_options => { 'mysqld' => { 'key_buffer_size' => '32M' }}, + package_ensure => 'present', + purge_conf_dir => 'true', + remove_default_accounts => 'true', + restart => 'true', + root_group => 'root', + root_password => 'test', + service_enabled => 'true', + service_manage => 'true', + users => { + 'someuser@localhost' => { + ensure => 'present', + max_connections_per_hour => '0', + max_queries_per_hour => '0', + max_updates_per_hour => '0', + max_user_connections => '0', + password_hash => '*F3A2A51A9B0F2BE2468926B4132313728C250DBF', + }}, + grants => { + 'someuser@localhost/somedb.*' => { + ensure => 'present', + options => ['GRANT'], + privileges => ['SELECT', 'INSERT', 'UPDATE', 'DELETE'], + table => 'somedb.*', + user => 'someuser@localhost', + }, + }, + databases => { + 'somedb' => { + ensure => 'present', + charset => 'utf8', + }, + } + } + EOS + end + + it_behaves_like "a idempotent resource" + end + + describe 'minimal config' do + before(:all) do + @tmpdir = default.tmpdir('mysql') + end + let(:pp) do + <<-EOS + class { 'mysql::server': + config_file => '#{@tmpdir}/my.cnf', + includedir => '#{@tmpdir}/include', + manage_config_file => 'false', + override_options => { 'mysqld' => { 'key_buffer_size' => '32M' }}, + package_ensure => 'present', + purge_conf_dir => 'false', + remove_default_accounts => 'false', + restart => 'false', + root_group => 'root', + root_password => 'test', + service_enabled => 'false', + service_manage => 'false', + users => {}, + grants => {}, + databases => {}, + } + EOS + end + + it_behaves_like "a idempotent resource" + end + + describe 'syslog configuration' do + let(:pp) do + <<-EOS + class { 'mysql::server': + override_options => { 'mysqld' => { 'log-error' => undef }, 'mysqld_safe' => { 'log-error' => false, 'syslog' => true }}, + } + EOS + end + + it_behaves_like "a idempotent resource" + end + + context 'when changing the password' do + let(:password) { 'THE NEW SECRET' } + let(:pp) { "class { 'mysql::server': root_password => '#{password}' }" } + + it 'should not display the password' do + result = apply_manifest(pp, :catch_failures => true) + # this does not actually prove anything, as show_diff in the puppet config defaults to false. + expect(result.stdout).not_to match /#{password}/ + end + + it_behaves_like "a idempotent resource" + end +end diff --git a/environments/prod/modules/mysql/spec/acceptance/nodesets/centos-7-x64.yml b/environments/prod/modules/mysql/spec/acceptance/nodesets/centos-7-x64.yml new file mode 100644 index 0000000..5eebdef --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/nodesets/centos-7-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + centos-7-x64: + roles: + - agent + - default + platform: el-7-x86_64 + hypervisor: vagrant + box: puppetlabs/centos-7.2-64-nocm +CONFIG: + type: foss diff --git a/environments/prod/modules/mysql/spec/acceptance/nodesets/debian-8-x64.yml b/environments/prod/modules/mysql/spec/acceptance/nodesets/debian-8-x64.yml new file mode 100644 index 0000000..fef6e63 --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/nodesets/debian-8-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + debian-8-x64: + roles: + - agent + - default + platform: debian-8-amd64 + hypervisor: vagrant + box: puppetlabs/debian-8.2-64-nocm +CONFIG: + type: foss diff --git a/environments/prod/modules/mysql/spec/acceptance/nodesets/default.yml b/environments/prod/modules/mysql/spec/acceptance/nodesets/default.yml new file mode 100644 index 0000000..dba339c --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/nodesets/default.yml @@ -0,0 +1,10 @@ +HOSTS: + ubuntu-1404-x64: + roles: + - agent + - default + platform: ubuntu-14.04-amd64 + hypervisor: vagrant + box: puppetlabs/ubuntu-14.04-64-nocm +CONFIG: + type: foss diff --git a/environments/prod/modules/mysql/spec/acceptance/nodesets/docker/centos-7.yml b/environments/prod/modules/mysql/spec/acceptance/nodesets/docker/centos-7.yml new file mode 100644 index 0000000..a3333aa --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/nodesets/docker/centos-7.yml @@ -0,0 +1,12 @@ +HOSTS: + centos-7-x64: + platform: el-7-x86_64 + hypervisor: docker + image: centos:7 + docker_preserve_image: true + docker_cmd: '["/usr/sbin/init"]' + # install various tools required to get the image up to usable levels + docker_image_commands: + - 'yum install -y crontabs tar wget openssl sysvinit-tools iproute which initscripts' +CONFIG: + trace_limit: 200 diff --git a/environments/prod/modules/mysql/spec/acceptance/nodesets/docker/debian-8.yml b/environments/prod/modules/mysql/spec/acceptance/nodesets/docker/debian-8.yml new file mode 100644 index 0000000..df5c319 --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/nodesets/docker/debian-8.yml @@ -0,0 +1,11 @@ +HOSTS: + debian-8-x64: + platform: debian-8-amd64 + hypervisor: docker + image: debian:8 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get update && apt-get install -y net-tools wget locales strace lsof && echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen' +CONFIG: + trace_limit: 200 diff --git a/environments/prod/modules/mysql/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/environments/prod/modules/mysql/spec/acceptance/nodesets/docker/ubuntu-14.04.yml new file mode 100644 index 0000000..b1efa58 --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/nodesets/docker/ubuntu-14.04.yml @@ -0,0 +1,12 @@ +HOSTS: + ubuntu-1404-x64: + platform: ubuntu-14.04-amd64 + hypervisor: docker + image: ubuntu:14.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + # ensure that upstart is booting correctly in the container + - 'rm /usr/sbin/policy-rc.d && rm /sbin/initctl && dpkg-divert --rename --remove /sbin/initctl && apt-get update && apt-get install -y net-tools wget && locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 diff --git a/environments/prod/modules/mysql/spec/acceptance/types/mysql_database_spec.rb b/environments/prod/modules/mysql/spec/acceptance/types/mysql_database_spec.rb new file mode 100644 index 0000000..b19026d --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/types/mysql_database_spec.rb @@ -0,0 +1,64 @@ +require 'spec_helper_acceptance' + +describe 'mysql_database' do + describe 'setup' do + it 'should work with no errors' do + pp = <<-EOS + class { 'mysql::server': } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + + describe 'creating database' do + it 'should work without errors' do + pp = <<-EOS + mysql_database { 'spec_db': + ensure => present, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the database' do + shell("mysql -NBe \"SHOW DATABASES LIKE 'spec_db'\"") do |r| + expect(r.stdout).to match(/^spec_db$/) + expect(r.stderr).to be_empty + end + end + end + + describe 'charset and collate' do + it 'should create two db of different types idempotently' do + pp = <<-EOS + mysql_database { 'spec_latin1': + charset => 'latin1', + collate => 'latin1_swedish_ci', + } + mysql_database { 'spec_utf8': + charset => 'utf8', + collate => 'utf8_general_ci', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + it 'should find latin1 db' do + shell("mysql -NBe \"SHOW VARIABLES LIKE '%_database'\" spec_latin1") do |r| + expect(r.stdout).to match(/^character_set_database\tlatin1\ncollation_database\tlatin1_swedish_ci$/) + expect(r.stderr).to be_empty + end + end + + it 'should find utf8 db' do + shell("mysql -NBe \"SHOW VARIABLES LIKE '%_database'\" spec_utf8") do |r| + expect(r.stdout).to match(/^character_set_database\tutf8\ncollation_database\tutf8_general_ci$/) + expect(r.stderr).to be_empty + end + end + end +end diff --git a/environments/prod/modules/mysql/spec/acceptance/types/mysql_grant_spec.rb b/environments/prod/modules/mysql/spec/acceptance/types/mysql_grant_spec.rb new file mode 100644 index 0000000..ccf2b27 --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/types/mysql_grant_spec.rb @@ -0,0 +1,578 @@ +require 'spec_helper_acceptance' +require 'puppet' +require 'puppet/util/package' +require_relative '../mysql_helper.rb' + +describe 'mysql_grant' do + before(:all) do + pp = <<-EOS + class { 'mysql::server': + root_password => 'password', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + describe 'missing privileges for user' do + it 'should fail' do + pp = <<-EOS + mysql_user { 'test1@tester': + ensure => present, + } + mysql_grant { 'test1@tester/test.*': + ensure => 'present', + table => 'test.*', + user => 'test1@tester', + require => Mysql_user['test1@tester'], + } + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/privileges parameter is required/) + end + + it 'should not find the user' do + expect(shell("mysql -NBe \"SHOW GRANTS FOR test1@tester\"", { :acceptable_exit_codes => 1}).stderr).to match(/There is no such grant defined for user 'test1' on host 'tester'/) + end + end + + describe 'missing table for user' do + it 'should fail' do + pp = <<-EOS + mysql_user { 'atest@tester': + ensure => present, + } + mysql_grant { 'atest@tester/test.*': + ensure => 'present', + user => 'atest@tester', + privileges => ['ALL'], + require => Mysql_user['atest@tester'], + } + EOS + + apply_manifest(pp, :expect_failures => true) + end + + it 'should not find the user' do + expect(shell("mysql -NBe \"SHOW GRANTS FOR atest@tester\"", {:acceptable_exit_codes => 1}).stderr).to match(/There is no such grant defined for user 'atest' on host 'tester'/) + end + end + + describe 'adding privileges' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'test2@tester': + ensure => present, + } + mysql_grant { 'test2@tester/test.*': + ensure => 'present', + table => 'test.*', + user => 'test2@tester', + privileges => ['SELECT', 'UPDATE'], + require => Mysql_user['test2@tester'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"SHOW GRANTS FOR test2@tester\"") do |r| + expect(r.stdout).to match(/GRANT SELECT, UPDATE.*TO 'test2'@'tester'/) + expect(r.stderr).to be_empty + end + end + end + + describe 'adding privileges with special character in name' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'test-2@tester': + ensure => present, + } + mysql_grant { 'test-2@tester/test.*': + ensure => 'present', + table => 'test.*', + user => 'test-2@tester', + privileges => ['SELECT', 'UPDATE'], + require => Mysql_user['test-2@tester'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"SHOW GRANTS FOR 'test-2'@tester\"") do |r| + expect(r.stdout).to match(/GRANT SELECT, UPDATE.*TO 'test-2'@'tester'/) + expect(r.stderr).to be_empty + end + end + end + + describe 'adding privileges with invalid name' do + it 'should fail' do + pp = <<-EOS + mysql_user { 'test2@tester': + ensure => present, + } + mysql_grant { 'test': + ensure => 'present', + table => 'test.*', + user => 'test2@tester', + privileges => ['SELECT', 'UPDATE'], + require => Mysql_user['test2@tester'], + } + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/name must match user and table parameters/) + end + end + + describe 'adding option' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'test3@tester': + ensure => present, + } + mysql_grant { 'test3@tester/test.*': + ensure => 'present', + table => 'test.*', + user => 'test3@tester', + options => ['GRANT'], + privileges => ['SELECT', 'UPDATE'], + require => Mysql_user['test3@tester'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"SHOW GRANTS FOR test3@tester\"") do |r| + expect(r.stdout).to match(/GRANT SELECT, UPDATE ON `test`.* TO 'test3'@'tester' WITH GRANT OPTION$/) + expect(r.stderr).to be_empty + end + end + end + + describe 'adding all privileges without table' do + it 'should fail' do + pp = <<-EOS + mysql_user { 'test4@tester': + ensure => present, + } + mysql_grant { 'test4@tester/test.*': + ensure => 'present', + user => 'test4@tester', + options => ['GRANT'], + privileges => ['SELECT', 'UPDATE', 'ALL'], + require => Mysql_user['test4@tester'], + } + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/table parameter is required./) + end + end + + describe 'adding all privileges' do + it 'should only try to apply ALL' do + pp = <<-EOS + mysql_user { 'test4@tester': + ensure => present, + } + mysql_grant { 'test4@tester/test.*': + ensure => 'present', + table => 'test.*', + user => 'test4@tester', + options => ['GRANT'], + privileges => ['SELECT', 'UPDATE', 'ALL'], + require => Mysql_user['test4@tester'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"SHOW GRANTS FOR test4@tester\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test4'@'tester' WITH GRANT OPTION/) + expect(r.stderr).to be_empty + end + end + end + + # Test combinations of user@host to ensure all cases work. + describe 'short hostname' do + it 'should apply' do + pp = <<-EOS + mysql_user { 'test@short': + ensure => present, + } + mysql_grant { 'test@short/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@short', + privileges => 'ALL', + require => Mysql_user['test@short'], + } + mysql_user { 'test@long.hostname.com': + ensure => present, + } + mysql_grant { 'test@long.hostname.com/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@long.hostname.com', + privileges => 'ALL', + require => Mysql_user['test@long.hostname.com'], + } + mysql_user { 'test@192.168.5.6': + ensure => present, + } + mysql_grant { 'test@192.168.5.6/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@192.168.5.6', + privileges => 'ALL', + require => Mysql_user['test@192.168.5.6'], + } + mysql_user { 'test@2607:f0d0:1002:0051:0000:0000:0000:0004': + ensure => present, + } + mysql_grant { 'test@2607:f0d0:1002:0051:0000:0000:0000:0004/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@2607:f0d0:1002:0051:0000:0000:0000:0004', + privileges => 'ALL', + require => Mysql_user['test@2607:f0d0:1002:0051:0000:0000:0000:0004'], + } + mysql_user { 'test@::1/128': + ensure => present, + } + mysql_grant { 'test@::1/128/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@::1/128', + privileges => 'ALL', + require => Mysql_user['test@::1/128'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'finds short hostname' do + shell("mysql -NBe \"SHOW GRANTS FOR test@short\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test'@'short'/) + expect(r.stderr).to be_empty + end + end + it 'finds long hostname' do + shell("mysql -NBe \"SHOW GRANTS FOR 'test'@'long.hostname.com'\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test'@'long.hostname.com'/) + expect(r.stderr).to be_empty + end + end + it 'finds ipv4' do + shell("mysql -NBe \"SHOW GRANTS FOR 'test'@'192.168.5.6'\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test'@'192.168.5.6'/) + expect(r.stderr).to be_empty + end + end + it 'finds ipv6' do + shell("mysql -NBe \"SHOW GRANTS FOR 'test'@'2607:f0d0:1002:0051:0000:0000:0000:0004'\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test'@'2607:f0d0:1002:0051:0000:0000:0000:0004'/) + expect(r.stderr).to be_empty + end + end + it 'finds short ipv6' do + shell("mysql -NBe \"SHOW GRANTS FOR 'test'@'::1/128'\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test'@'::1\/128'/) + expect(r.stderr).to be_empty + end + end + end + + describe 'complex test' do + it 'setup mysql::server' do + pp = <<-EOS + $dbSubnet = '10.10.10.%' + + mysql_database { 'foo': + ensure => present, + } + + exec { 'mysql-create-table': + command => '/usr/bin/mysql -NBe "CREATE TABLE foo.bar (name VARCHAR(20))"', + environment => "HOME=${::root_home}", + unless => '/usr/bin/mysql -NBe "SELECT 1 FROM foo.bar LIMIT 1;"', + require => Mysql_database['foo'], + } + + Mysql_grant { + ensure => present, + options => ['GRANT'], + privileges => ['ALL'], + table => '*.*', + require => [ Mysql_database['foo'], Exec['mysql-create-table'] ], + } + + mysql_user { "user1@${dbSubnet}": + ensure => present, + } + mysql_grant { "user1@${dbSubnet}/*.*": + user => "user1@${dbSubnet}", + require => Mysql_user["user1@${dbSubnet}"], + } + mysql_user { "user2@${dbSubnet}": + ensure => present, + } + mysql_grant { "user2@${dbSubnet}/foo.bar": + privileges => ['SELECT', 'INSERT', 'UPDATE'], + user => "user2@${dbSubnet}", + table => 'foo.bar', + require => Mysql_user["user2@${dbSubnet}"], + } + mysql_user { "user3@${dbSubnet}": + ensure => present, + } + mysql_grant { "user3@${dbSubnet}/foo.*": + privileges => ['SELECT', 'INSERT', 'UPDATE'], + user => "user3@${dbSubnet}", + table => 'foo.*', + require => Mysql_user["user3@${dbSubnet}"], + } + mysql_user { 'web@%': + ensure => present, + } + mysql_grant { 'web@%/*.*': + user => 'web@%', + require => Mysql_user['web@%'], + } + mysql_user { "web@${dbSubnet}": + ensure => present, + } + mysql_grant { "web@${dbSubnet}/*.*": + user => "web@${dbSubnet}", + require => Mysql_user["web@${dbSubnet}"], + } + mysql_user { "web@${fqdn}": + ensure => present, + } + mysql_grant { "web@${fqdn}/*.*": + user => "web@${fqdn}", + require => Mysql_user["web@${fqdn}"], + } + mysql_user { 'web@localhost': + ensure => present, + } + mysql_grant { 'web@localhost/*.*': + user => 'web@localhost', + require => Mysql_user['web@localhost'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + end + + describe 'lower case privileges' do + it 'create ALL privs' do + pp = <<-EOS + mysql_user { 'lowercase@localhost': + ensure => present, + } + mysql_grant { 'lowercase@localhost/*.*': + user => 'lowercase@localhost', + privileges => 'ALL', + table => '*.*', + require => Mysql_user['lowercase@localhost'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'create lowercase all privs' do + pp = <<-EOS + mysql_user { 'lowercase@localhost': + ensure => present, + } + mysql_grant { 'lowercase@localhost/*.*': + user => 'lowercase@localhost', + privileges => 'all', + table => '*.*', + require => Mysql_user['lowercase@localhost'], + } + EOS + + expect(apply_manifest(pp, :catch_failures => true).exit_code).to eq(0) + end + end + + describe 'adding procedure privileges' do + it 'should work without errors' do + pp = <<-EOS + if $::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemmajrelease, '16.00') > 0 { + exec { 'simpleproc-create': + command => 'mysql --user="root" --password="password" --database=mysql --delimiter="//" -NBe "CREATE PROCEDURE simpleproc (OUT param1 INT) BEGIN SELECT COUNT(*) INTO param1 FROM t; end//"', + path => '/usr/bin/', + before => Mysql_user['test2@tester'], + } + } + mysql_user { 'test2@tester': + ensure => present, + } + mysql_grant { 'test2@tester/PROCEDURE mysql.simpleproc': + ensure => 'present', + table => 'PROCEDURE mysql.simpleproc', + user => 'test2@tester', + privileges => ['EXECUTE'], + require => Mysql_user['test2@tester'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"SHOW GRANTS FOR test2@tester\"") do |r| + expect(r.stdout).to match(/GRANT EXECUTE ON PROCEDURE `mysql`.`simpleproc` TO 'test2'@'tester'/) + expect(r.stderr).to be_empty + end + end + end + + describe 'grants with skip-name-resolve specified' do + it 'setup mysql::server' do + pp = <<-EOS + class { 'mysql::server': + override_options => { + 'mysqld' => {'skip-name-resolve' => true} + }, + restart => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should apply' do + pp = <<-EOS + mysql_user { 'test@fqdn.com': + ensure => present, + } + mysql_grant { 'test@fqdn.com/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@fqdn.com', + privileges => 'ALL', + require => Mysql_user['test@fqdn.com'], + } + mysql_user { 'test@192.168.5.7': + ensure => present, + } + mysql_grant { 'test@192.168.5.7/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@192.168.5.7', + privileges => 'ALL', + require => Mysql_user['test@192.168.5.7'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should fail with fqdn' do + pre_run + if ! version_is_greater_than('5.7.0') + expect(shell("mysql -NBe \"SHOW GRANTS FOR test@fqdn.com\"", { :acceptable_exit_codes => 1}).stderr).to match(/There is no such grant defined for user 'test' on host 'fqdn.com'/) + end + end + it 'finds ipv4' do + shell("mysql -NBe \"SHOW GRANTS FOR 'test'@'192.168.5.7'\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test'@'192.168.5.7'/) + expect(r.stderr).to be_empty + end + end + + it 'should fail to execute while applying' do + pp = <<-EOS + mysql_user { 'test@fqdn.com': + ensure => present, + } + mysql_grant { 'test@fqdn.com/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@fqdn.com', + privileges => 'ALL', + require => Mysql_user['test@fqdn.com'], + } + EOS + + mysql_cmd = shell('which mysql').stdout.chomp + shell("mv #{mysql_cmd} #{mysql_cmd}.bak") + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Command mysql is missing/) + shell("mv #{mysql_cmd}.bak #{mysql_cmd}") + end + + it 'reset mysql::server config' do + pp = <<-EOS + class { 'mysql::server': + restart => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + + describe 'adding privileges to specific table' do + # Using puppet_apply as a helper + it 'setup mysql server' do + pp = <<-EOS + class { 'mysql::server': override_options => { 'root_password' => 'password' } } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'creates grant on missing table will fail' do + pp = <<-EOS + mysql_user { 'test@localhost': + ensure => present, + } + mysql_grant { 'test@localhost/grant_spec_db.grant_spec_table': + user => 'test@localhost', + privileges => ['SELECT'], + table => 'grant_spec_db.grant_spec_table', + require => Mysql_user['test@localhost'], + } + EOS + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Table 'grant_spec_db\.grant_spec_table' doesn't exist/) + end + + it 'creates table' do + pp = <<-EOS + file { '/tmp/grant_spec_table.sql': + ensure => file, + content => 'CREATE TABLE grant_spec_table (id int);', + before => Mysql::Db['grant_spec_db'], + } + mysql::db { 'grant_spec_db': + user => 'root1', + password => 'password', + sql => '/tmp/grant_spec_table.sql', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should have the table' do + expect(shell("mysql -e 'show tables;' grant_spec_db|grep grant_spec_table").exit_code).to be_zero + end + end +end diff --git a/environments/prod/modules/mysql/spec/acceptance/types/mysql_plugin_spec.rb b/environments/prod/modules/mysql/spec/acceptance/types/mysql_plugin_spec.rb new file mode 100644 index 0000000..538b67c --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/types/mysql_plugin_spec.rb @@ -0,0 +1,76 @@ +require 'spec_helper_acceptance' + +# Different operating systems (and therefore different versions/forks +# of mysql) have varying levels of support for plugins and have +# different plugins available. Choose a plugin that works or don't try +# to test plugins if not available. +if fact('osfamily') =~ /RedHat/ + if fact('operatingsystemrelease') =~ /^5\./ + plugin = nil # Plugins not supported on mysql on RHEL 5 + elsif fact('operatingsystemrelease') =~ /^6\./ + plugin = 'example' + plugin_lib = 'ha_example.so' + elsif fact('operatingsystemrelease') =~ /^7\./ + plugin = 'pam' + plugin_lib = 'auth_pam.so' + end +elsif fact('osfamily') =~ /Debian/ + if fact('operatingsystem') =~ /Debian/ + if fact('operatingsystemrelease') =~ /^6\./ + # Only available plugin is innodb which is already loaded and not unload- or reload-able + plugin = nil + elsif fact('operatingsystemrelease') =~ /^7\./ + plugin = 'example' + plugin_lib = 'ha_example.so' + end + elsif fact('operatingsystem') =~ /Ubuntu/ + if fact('operatingsystemrelease') =~ /^10\.04/ + # Only available plugin is innodb which is already loaded and not unload- or reload-able + plugin = nil + elsif fact('operatingsystemrelease') =~ /^16\.04/ + # On Xenial running 5.7.12, the example plugin does not appear to be available. + plugin = 'validate_password' + plugin_lib = 'validate_password.so' + else + plugin = 'example' + plugin_lib = 'ha_example.so' + end + end +elsif fact('osfamily') =~ /Suse/ + plugin = nil # Plugin library path is broken on Suse http://lists.opensuse.org/opensuse-bugs/2013-08/msg01123.html +end + +describe 'mysql_plugin' do + if plugin # if plugins are supported + describe 'setup' do + it 'should work with no errors' do + pp = <<-EOS + class { 'mysql::server': } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + + describe 'load plugin' do + it 'should work without errors' do + pp = <<-EOS + mysql_plugin { #{plugin}: + ensure => present, + soname => '#{plugin_lib}', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the plugin' do + shell("mysql -NBe \"select plugin_name from information_schema.plugins where plugin_name='#{plugin}'\"") do |r| + expect(r.stdout).to match(/^#{plugin}$/i) + expect(r.stderr).to be_empty + end + end + end + end + +end diff --git a/environments/prod/modules/mysql/spec/acceptance/types/mysql_user_spec.rb b/environments/prod/modules/mysql/spec/acceptance/types/mysql_user_spec.rb new file mode 100644 index 0000000..c91f65a --- /dev/null +++ b/environments/prod/modules/mysql/spec/acceptance/types/mysql_user_spec.rb @@ -0,0 +1,146 @@ +require 'spec_helper_acceptance' + +describe 'mysql_user' do + describe 'setup' do + it 'should work with no errors' do + pp = <<-EOS + class { 'mysql::server': } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + + context 'using ashp@localhost' do + describe 'adding user' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'ashp@localhost': + password_hash => '*F9A8E96790775D196D12F53BCC88B8048FF62ED5', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"select '1' from mysql.user where CONCAT(user, '@', host) = 'ashp@localhost'\"") do |r| + expect(r.stdout).to match(/^1$/) + expect(r.stderr).to be_empty + end + end + it 'has no SSL options' do + shell("mysql -NBe \"select SSL_TYPE from mysql.user where CONCAT(user, '@', host) = 'ashp@localhost'\"") do |r| + expect(r.stdout).to match(/^\s*$/) + expect(r.stderr).to be_empty + end + end + end + end + + context 'using ashp-dash@localhost' do + describe 'adding user' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'ashp-dash@localhost': + password_hash => '*F9A8E96790775D196D12F53BCC88B8048FF62ED5', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"select '1' from mysql.user where CONCAT(user, '@', host) = 'ashp-dash@localhost'\"") do |r| + expect(r.stdout).to match(/^1$/) + expect(r.stderr).to be_empty + end + end + end + end + + context 'using ashp@LocalHost' do + describe 'adding user' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'ashp@LocalHost': + password_hash => '*F9A8E96790775D196D12F53BCC88B8048FF62ED5', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"select '1' from mysql.user where CONCAT(user, '@', host) = 'ashp@localhost'\"") do |r| + expect(r.stdout).to match(/^1$/) + expect(r.stderr).to be_empty + end + end + end + end + context 'using resource should throw no errors' do + describe 'find users' do + it { + on default, puppet('resource mysql_user'), {:catch_failures => true} do |r| + expect(r.stdout).to_not match(/Error:/) + expect(r.stdout).to_not match(/must be properly quoted, invalid character:/) + end + } + end + end + context 'using user-w-ssl@localhost with SSL' do + describe 'adding user' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'user-w-ssl@localhost': + password_hash => '*F9A8E96790775D196D12F53BCC88B8048FF62ED5', + tls_options => ['SSL'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"select '1' from mysql.user where CONCAT(user, '@', host) = 'user-w-ssl@localhost'\"") do |r| + expect(r.stdout).to match(/^1$/) + expect(r.stderr).to be_empty + end + end + it 'should show correct ssl_type' do + shell("mysql -NBe \"select SSL_TYPE from mysql.user where CONCAT(user, '@', host) = 'user-w-ssl@localhost'\"") do |r| + expect(r.stdout).to match(/^ANY$/) + expect(r.stderr).to be_empty + end + end + end + end + context 'using user-w-x509@localhost with X509' do + describe 'adding user' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'user-w-x509@localhost': + password_hash => '*F9A8E96790775D196D12F53BCC88B8048FF62ED5', + tls_options => ['X509'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"select '1' from mysql.user where CONCAT(user, '@', host) = 'user-w-x509@localhost'\"") do |r| + expect(r.stdout).to match(/^1$/) + expect(r.stderr).to be_empty + end + end + it 'should show correct ssl_type' do + shell("mysql -NBe \"select SSL_TYPE from mysql.user where CONCAT(user, '@', host) = 'user-w-x509@localhost'\"") do |r| + expect(r.stdout).to match(/^X509$/) + expect(r.stderr).to be_empty + end + end + end + end +end diff --git a/environments/prod/modules/mysql/spec/classes/graceful_failures_spec.rb b/environments/prod/modules/mysql/spec/classes/graceful_failures_spec.rb new file mode 100644 index 0000000..9fb8117 --- /dev/null +++ b/environments/prod/modules/mysql/spec/classes/graceful_failures_spec.rb @@ -0,0 +1,19 @@ +require 'spec_helper' + +describe 'mysql::server' do + context "on an unsupported OS" do + # fetch any sets of facts to modify them + os, facts = on_supported_os.first + + let(:facts) { + facts.merge({ + :osfamily => 'UNSUPPORTED', + :operatingsystem => 'UNSUPPORTED', + }) + } + + it 'should gracefully fail' do + is_expected.to compile.and_raise_error(/Unsupported platform:/) + end + end +end diff --git a/environments/prod/modules/mysql/spec/classes/mycnf_template_spec.rb b/environments/prod/modules/mysql/spec/classes/mycnf_template_spec.rb new file mode 100644 index 0000000..9c0c433 --- /dev/null +++ b/environments/prod/modules/mysql/spec/classes/mycnf_template_spec.rb @@ -0,0 +1,86 @@ +require 'spec_helper' + +describe 'mysql::server' do + context 'my.cnf template' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + context 'normal entry' do + let(:params) {{ :override_options => { 'mysqld' => { 'socket' => '/var/lib/mysql/mysql.sock' } } }} + it do + is_expected.to contain_file('mysql-config-file').with({ + :mode => '0644', + :selinux_ignore_defaults => true, + }).with_content(/socket = \/var\/lib\/mysql\/mysql.sock/) + end + end + + describe 'array entry' do + let(:params) {{ :override_options => { 'mysqld' => { 'replicate-do-db' => ['base1', 'base2'], } }}} + it do + is_expected.to contain_file('mysql-config-file').with_content( + /.*replicate-do-db = base1\nreplicate-do-db = base2.*/ + ) + end + end + + describe 'skip-name-resolve set to an empty string' do + let(:params) {{ :override_options => { 'mysqld' => { 'skip-name-resolve' => '' }}}} + it { is_expected.to contain_file('mysql-config-file').with_content(/^skip-name-resolve$/) } + end + + describe 'ssl set to true' do + let(:params) {{ :override_options => { 'mysqld' => { 'ssl' => true }}}} + it { is_expected.to contain_file('mysql-config-file').with_content(/ssl/) } + it { is_expected.to contain_file('mysql-config-file').without_content(/ssl = true/) } + end + + describe 'ssl set to false' do + let(:params) {{ :override_options => { 'mysqld' => { 'ssl' => false }}}} + it { is_expected.to contain_file('mysql-config-file').with_content(/ssl = false/) } + end + + # ssl-disable (and ssl) are special cased within mysql. + describe 'possibility of disabling ssl completely' do + let(:params) {{ :override_options => { 'mysqld' => { 'ssl' => true, 'ssl-disable' => true }}}} + it { is_expected.to contain_file('mysql-config-file').without_content(/ssl = true/) } + end + + describe 'a non ssl option set to true' do + let(:params) {{ :override_options => { 'mysqld' => { 'test' => true }}}} + it { is_expected.to contain_file('mysql-config-file').with_content(/^test$/) } + it { is_expected.to contain_file('mysql-config-file').without_content(/test = true/) } + end + + context 'with includedir' do + let(:params) {{ :includedir => '/etc/my.cnf.d' }} + it 'makes the directory' do + is_expected.to contain_file('/etc/my.cnf.d').with({ + :ensure => :directory, + :mode => '0755', + }) + end + + it { is_expected.to contain_file('mysql-config-file').with_content(/!includedir/) } + end + + context 'without includedir' do + let(:params) {{ :includedir => '' }} + it 'shouldnt contain the directory' do + is_expected.not_to contain_file('mysql-config-file').with({ + :ensure => :directory, + :mode => '0755', + }) + end + + it { is_expected.to contain_file('mysql-config-file').without_content(/!includedir/) } + end + end + end + end +end diff --git a/environments/prod/modules/mysql/spec/classes/mysql_bindings_spec.rb b/environments/prod/modules/mysql/spec/classes/mysql_bindings_spec.rb new file mode 100644 index 0000000..066e876 --- /dev/null +++ b/environments/prod/modules/mysql/spec/classes/mysql_bindings_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +describe 'mysql::bindings' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + let(:params) {{ + 'java_enable' => true, + 'perl_enable' => true, + 'php_enable' => true, + 'python_enable' => true, + 'ruby_enable' => true, + 'client_dev' => true, + 'daemon_dev' => true, + 'client_dev_package_name' => 'libmysqlclient-devel', + 'daemon_dev_package_name' => 'mysql-devel', + }} + + it { is_expected.to contain_package('mysql-connector-java') } + it { is_expected.to contain_package('perl_mysql') } + it { is_expected.to contain_package('python-mysqldb') } + it { is_expected.to contain_package('ruby_mysql') } + it { is_expected.to contain_package('mysql-client_dev') } + it { is_expected.to contain_package('mysql-daemon_dev') } + end + end +end diff --git a/environments/prod/modules/mysql/spec/classes/mysql_client_spec.rb b/environments/prod/modules/mysql/spec/classes/mysql_client_spec.rb new file mode 100644 index 0000000..fdbcc19 --- /dev/null +++ b/environments/prod/modules/mysql/spec/classes/mysql_client_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'mysql::client' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + context 'with defaults' do + it { is_expected.not_to contain_class('mysql::bindings') } + it { is_expected.to contain_package('mysql_client') } + end + + context 'with bindings enabled' do + let(:params) {{ :bindings_enable => true }} + + it { is_expected.to contain_class('mysql::bindings') } + it { is_expected.to contain_package('mysql_client') } + end + + context 'with package_manage set to true' do + let(:params) {{ :package_manage => true }} + + it { is_expected.to contain_package('mysql_client') } + end + + context 'with package_manage set to false' do + let(:params) {{ :package_manage => false }} + + it { is_expected.not_to contain_package('mysql_client') } + end + + end + end +end diff --git a/environments/prod/modules/mysql/spec/classes/mysql_server_account_security_spec.rb b/environments/prod/modules/mysql/spec/classes/mysql_server_account_security_spec.rb new file mode 100644 index 0000000..d45c46e --- /dev/null +++ b/environments/prod/modules/mysql/spec/classes/mysql_server_account_security_spec.rb @@ -0,0 +1,86 @@ +require 'spec_helper' + +describe 'mysql::server::account_security' do + on_supported_os.each do |os, facts| + context "on #{os}" do + context "with fqdn==myhost.mydomain" do + let(:facts) { + facts.merge({ + :root_home => '/root', + :fqdn => 'myhost.mydomain', + :hostname => 'myhost', + }) + } + + [ 'root@myhost.mydomain', + 'root@127.0.0.1', + 'root@::1', + '@myhost.mydomain', + '@localhost', + '@%', + ].each do |user| + it "removes Mysql_User[#{user}]" do + is_expected.to contain_mysql_user(user).with_ensure('absent') + end + end + + # When the hostname doesn't match the fqdn we also remove these. + # We don't need to test the inverse as when they match they are + # covered by the above list. + [ 'root@myhost', '@myhost' ].each do |user| + it "removes Mysql_User[#{user}]" do + is_expected.to contain_mysql_user(user).with_ensure('absent') + end + end + + it 'should remove Mysql_database[test]' do + is_expected.to contain_mysql_database('test').with_ensure('absent') + end + end + + context "with fqdn==localhost" do + let(:facts) { + facts.merge({ + :root_home => '/root', + :fqdn => 'localhost', + :hostname => 'localhost', + }) + } + + [ 'root@127.0.0.1', + 'root@::1', + '@localhost', + 'root@localhost.localdomain', + '@localhost.localdomain', + '@%', + ].each do |user| + it "removes Mysql_User[#{user}]" do + is_expected.to contain_mysql_user(user).with_ensure('absent') + end + end + end + + context "with fqdn==localhost.localdomain" do + let(:facts) { + facts.merge({ + :root_home => '/root', + :fqdn => 'localhost.localdomain', + :hostname => 'localhost', + }) + } + + [ 'root@127.0.0.1', + 'root@::1', + '@localhost', + 'root@localhost.localdomain', + '@localhost.localdomain', + '@%', + ].each do |user| + it "removes Mysql_User[#{user}]" do + is_expected.to contain_mysql_user(user).with_ensure('absent') + end + end + end + end + end +end diff --git a/environments/prod/modules/mysql/spec/classes/mysql_server_backup_spec.rb b/environments/prod/modules/mysql/spec/classes/mysql_server_backup_spec.rb new file mode 100644 index 0000000..96cfdf4 --- /dev/null +++ b/environments/prod/modules/mysql/spec/classes/mysql_server_backup_spec.rb @@ -0,0 +1,407 @@ +require 'spec_helper' + +describe 'mysql::server::backup' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + let(:default_params) { + { 'backupuser' => 'testuser', + 'backuppassword' => 'testpass', + 'maxallowedpacket' => '1M', + 'backupdir' => '/tmp', + 'backuprotate' => '25', + 'delete_before_dump' => true, + 'execpath' => '/usr/bin:/usr/sbin:/bin:/sbin:/opt/zimbra/bin', + 'maxallowedpacket' => '1M', + } + } + + context 'standard conditions' do + let(:params) { default_params } + + # Cannot use that_requires here, doesn't work on classes. + it { is_expected.to contain_mysql_user('testuser@localhost').with( + :require => 'Class[Mysql::Server::Root_password]') } + + it { is_expected.to contain_mysql_grant('testuser@localhost/*.*').with( + :privileges => ['SELECT', 'RELOAD', 'LOCK TABLES', 'SHOW VIEW', 'PROCESS'] + ).that_requires('Mysql_user[testuser@localhost]') } + + context 'with triggers included' do + let(:params) do + { :include_triggers => true }.merge(default_params) + end + it { is_expected.to contain_mysql_grant('testuser@localhost/*.*').with( + :privileges => ['SELECT', 'RELOAD', 'LOCK TABLES', 'SHOW VIEW', 'PROCESS', 'TRIGGER'] + ).that_requires('Mysql_user[testuser@localhost]') } + end + + it { is_expected.to contain_cron('mysql-backup').with( + :command => '/usr/local/sbin/mysqlbackup.sh', + :ensure => 'present' + )} + + it { is_expected.to contain_file('mysqlbackup.sh').with( + :path => '/usr/local/sbin/mysqlbackup.sh', + :ensure => 'present' + ) } + + it { is_expected.to contain_file('mysqlbackupdir').with( + :path => '/tmp', + :ensure => 'directory' + )} + + it 'should have compression by default' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /bzcat -zc/ + ) + end + + it 'should skip backing up events table by default' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="--ignore-table=mysql.event"/ + ) + end + + it 'should not mention triggers by default because file_per_database is false' do + is_expected.to contain_file('mysqlbackup.sh').without_content( + /.*triggers.*/ + ) + end + + it 'should not mention routines by default because file_per_database is false' do + is_expected.to contain_file('mysqlbackup.sh').without_content( + /.*routines.*/ + ) + end + + it 'should have 25 days of rotation' do + # MySQL counts from 0 + is_expected.to contain_file('mysqlbackup.sh').with_content(/.*ROTATE=24.*/) + end + + it 'should have a standard PATH' do + is_expected.to contain_file('mysqlbackup.sh').with_content(%r{PATH=/usr/bin:/usr/sbin:/bin:/sbin:/opt/zimbra/bin}) + end + end + + context 'custom ownership and mode for backupdir' do + let(:params) do + { :backupdirmode => '0750', + :backupdirowner => 'testuser', + :backupdirgroup => 'testgrp', + }.merge(default_params) + end + + it { is_expected.to contain_file('mysqlbackupdir').with( + :path => '/tmp', + :ensure => 'directory', + :mode => '0750', + :owner => 'testuser', + :group => 'testgrp' + ) } + end + + context 'with compression disabled' do + let(:params) do + { :backupcompress => false }.merge(default_params) + end + + it { is_expected.to contain_file('mysqlbackup.sh').with( + :path => '/usr/local/sbin/mysqlbackup.sh', + :ensure => 'present' + ) } + + it 'should be able to disable compression' do + is_expected.to contain_file('mysqlbackup.sh').without_content( + /.*bzcat -zc.*/ + ) + end + end + + context 'with mysql.events backedup' do + let(:params) do + { :ignore_events => false }.merge(default_params) + end + + it { is_expected.to contain_file('mysqlbackup.sh').with( + :path => '/usr/local/sbin/mysqlbackup.sh', + :ensure => 'present' + ) } + + it 'should be able to backup events table' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="--events"/ + ) + end + end + + context 'with database list specified' do + let(:params) do + { :backupdatabases => ['mysql'] }.merge(default_params) + end + + it { is_expected.to contain_file('mysqlbackup.sh').with( + :path => '/usr/local/sbin/mysqlbackup.sh', + :ensure => 'present' + ) + } + + it 'should have a backup file for each database' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /mysql | bzcat -zc \${DIR}\\\${PREFIX}mysql_`date'/ + ) + end + + it 'should skip backup triggers by default' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-triggers"/ + ) + end + + it 'should skip backing up routines by default' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-routines"/ + ) + end + + context 'with include_triggers set to true' do + let(:params) do + default_params.merge({ + :backupdatabases => ['mysql'], + :include_triggers => true + }) + end + + it 'should backup triggers when asked' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --triggers"/ + ) + end + end + + context 'with include_triggers set to false' do + let(:params) do + default_params.merge({ + :backupdatabases => ['mysql'], + :include_triggers => false + }) + end + + it 'should skip backing up triggers when asked to skip' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-triggers"/ + ) + end + end + + context 'with include_routines set to true' do + let(:params) do + default_params.merge({ + :backupdatabases => ['mysql'], + :include_routines => true + }) + end + + it 'should backup routines when asked' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --routines"/ + ) + end + end + + context 'with include_routines set to false' do + let(:params) do + default_params.merge({ + :backupdatabases => ['mysql'], + :include_triggers => true + }) + end + + it 'should skip backing up routines when asked to skip' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-routines"/ + ) + end + end + end + + context 'with file per database' do + let(:params) do + default_params.merge({ :file_per_database => true }) + end + + it 'should loop through backup all databases' do + is_expected.to contain_file('mysqlbackup.sh').with_content(/.*SHOW DATABASES.*/) + end + + context 'with compression disabled' do + let(:params) do + default_params.merge({ :file_per_database => true, :backupcompress => false }) + end + + it 'should loop through backup all databases without compression' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /.*SHOW DATABASES.*/ + ) + is_expected.to contain_file('mysqlbackup.sh').without_content( + /.*bzcat -zc.*/ + ) + end + end + + it 'should skip backup triggers by default' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-triggers"/ + ) + end + + it 'should skip backing up routines by default' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-routines"/ + ) + end + + context 'with include_triggers set to true' do + let(:params) do + default_params.merge({ + :file_per_database => true, + :include_triggers => true + }) + end + + it 'should backup triggers when asked' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --triggers"/ + ) + end + end + + context 'with include_triggers set to false' do + let(:params) do + default_params.merge({ + :file_per_database => true, + :include_triggers => false + }) + end + + it 'should skip backing up triggers when asked to skip' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-triggers"/ + ) + end + end + + context 'with include_routines set to true' do + let(:params) do + default_params.merge({ + :file_per_database => true, + :include_routines => true + }) + end + + it 'should backup routines when asked' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --routines"/ + ) + end + end + + context 'with include_routines set to false' do + let(:params) do + default_params.merge({ + :file_per_database => true, + :include_triggers => true + }) + end + + it 'should skip backing up routines when asked to skip' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-routines"/ + ) + end + end + end + + context 'with postscript' do + let(:params) do + default_params.merge({ :postscript => 'rsync -a /tmp backup01.local-lan:' }) + end + + it 'should be add postscript' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /rsync -a \/tmp backup01.local-lan:/ + ) + end + end + + context 'with postscripts' do + let(:params) do + default_params.merge({ :postscript => [ + 'rsync -a /tmp backup01.local-lan:', + 'rsync -a /tmp backup02.local-lan:', + ]}) + end + + it 'should be add postscript' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /.*rsync -a \/tmp backup01.local-lan:\n\nrsync -a \/tmp backup02.local-lan:.*/ + ) + end + end + + context 'with the xtrabackup provider' do + let(:params) do + default_params.merge({:provider => 'xtrabackup'}) + end + + it 'should contain the wrapper script' do + is_expected.to contain_file('xtrabackup.sh').with_content( + /^innobackupex\s+"\$@"/ + ) + end + + context 'with prescript defined' do + let(:params) do + default_params.merge({ + :provider => 'xtrabackup', + :prescript => [ + 'rsync -a /tmp backup01.local-lan:', + 'rsync -a /tmp backup02.local-lan:', + ] + }) + end + + it 'should contain the prescript' do + is_expected.to contain_file('xtrabackup.sh').with_content( + /.*rsync -a \/tmp backup01.local-lan:\n\nrsync -a \/tmp backup02.local-lan:.*/ + ) + end + end + + context 'with postscript defined' do + let(:params) do + default_params.merge({ + :provider => 'xtrabackup', + :postscript => [ + 'rsync -a /tmp backup01.local-lan:', + 'rsync -a /tmp backup02.local-lan:', + ] + }) + end + + it 'should contain the prostscript' do + is_expected.to contain_file('xtrabackup.sh').with_content( + /.*rsync -a \/tmp backup01.local-lan:\n\nrsync -a \/tmp backup02.local-lan:.*/ + ) + end + end + end + end + end +end diff --git a/environments/prod/modules/mysql/spec/classes/mysql_server_monitor_spec.rb b/environments/prod/modules/mysql/spec/classes/mysql_server_monitor_spec.rb new file mode 100644 index 0000000..27fab17 --- /dev/null +++ b/environments/prod/modules/mysql/spec/classes/mysql_server_monitor_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' +describe 'mysql::server::monitor' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + let :pre_condition do + "include 'mysql::server'" + end + + let :default_params do + { + :mysql_monitor_username => 'monitoruser', + :mysql_monitor_password => 'monitorpass', + :mysql_monitor_hostname => 'monitorhost', + } + end + + let :params do + default_params + end + + it { is_expected.to contain_mysql_user('monitoruser@monitorhost')} + + it { is_expected.to contain_mysql_grant('monitoruser@monitorhost/*.*').with( + :ensure => 'present', + :user => 'monitoruser@monitorhost', + :table => '*.*', + :privileges => ["PROCESS", "SUPER"], + :require => 'Mysql_user[monitoruser@monitorhost]' + )} + end + end +end diff --git a/environments/prod/modules/mysql/spec/classes/mysql_server_mysqltuner_spec.rb b/environments/prod/modules/mysql/spec/classes/mysql_server_mysqltuner_spec.rb new file mode 100644 index 0000000..4fef3d5 --- /dev/null +++ b/environments/prod/modules/mysql/spec/classes/mysql_server_mysqltuner_spec.rb @@ -0,0 +1,46 @@ +require 'spec_helper' + +describe 'mysql::server::mysqltuner' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :staging_http_get => 'curl', + :root_home => '/root', + }) + } + + context 'ensure => present' do + it { is_expected.to compile } + it { is_expected.to contain_staging__file('mysqltuner-v1.3.0').with({ + :source => 'https://github.com/major/MySQLTuner-perl/raw/v1.3.0/mysqltuner.pl', + }) + } + end + + context 'ensure => absent' do + let(:params) {{ :ensure => 'absent' }} + it { is_expected.to compile } + it { is_expected.to contain_file('/usr/local/bin/mysqltuner').with(:ensure => 'absent') } + end + + context 'custom version' do + let(:params) {{ :version => 'v1.2.0' }} + it { is_expected.to compile } + it { is_expected.to contain_staging__file('mysqltuner-v1.2.0').with({ + :source => 'https://github.com/major/MySQLTuner-perl/raw/v1.2.0/mysqltuner.pl', + }) + } + end + + context 'custom source' do + let(:params) {{ :source => '/tmp/foo' }} + it { is_expected.to compile } + it { is_expected.to contain_staging__file('mysqltuner-/tmp/foo').with({ + :source => '/tmp/foo', + }) + } + end + end + end +end diff --git a/environments/prod/modules/mysql/spec/classes/mysql_server_spec.rb b/environments/prod/modules/mysql/spec/classes/mysql_server_spec.rb new file mode 100644 index 0000000..2a1ca62 --- /dev/null +++ b/environments/prod/modules/mysql/spec/classes/mysql_server_spec.rb @@ -0,0 +1,220 @@ +require 'spec_helper' + +describe 'mysql::server' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + context 'with defaults' do + it { is_expected.to contain_class('mysql::server::install') } + it { is_expected.to contain_class('mysql::server::config') } + it { is_expected.to contain_class('mysql::server::service') } + it { is_expected.to contain_class('mysql::server::root_password') } + it { is_expected.to contain_class('mysql::server::providers') } + end + + context 'with remove_default_accounts set' do + let(:params) {{ :remove_default_accounts => true }} + it { is_expected.to contain_class('mysql::server::account_security') } + end + + context 'when not managing config file' do + let(:params) {{ :manage_config_file => false }} + it { is_expected.to compile.with_all_deps } + end + + context 'when not managing the service' do + let(:params) {{ :service_manage => false }} + it { is_expected.to compile.with_all_deps } + it { is_expected.not_to contain_service('mysqld') } + end + + context 'mysql::server::install' do + it 'contains the package by default' do + is_expected.to contain_package('mysql-server').with({ + :ensure => :present, + }) + end + context 'with package_manage set to true' do + let(:params) {{ :package_manage => true }} + it { is_expected.to contain_package('mysql-server') } + end + context 'with package_manage set to false' do + let(:params) {{ :package_manage => false }} + it { is_expected.not_to contain_package('mysql-server') } + end + context 'with datadir overridden' do + let(:params) {{ :override_options => { 'mysqld' => { 'datadir' => '/tmp' }} }} + it { is_expected.to contain_mysql_datadir('/tmp') } + end + end + + context 'mysql::server::service' do + context 'with defaults' do + it { is_expected.to contain_service('mysqld') } + end + context 'with package_manage set to true' do + let(:params) {{ :package_manage => true }} + it { is_expected.to contain_service('mysqld').that_requires('Package[mysql-server]') } + end + context 'with package_manage set to false' do + let(:params) {{ :package_manage => false }} + it { is_expected.to contain_service('mysqld') } + it { is_expected.not_to contain_service('mysqld').that_requires('Package[mysql-server]') } + end + context 'service_enabled set to false' do + let(:params) {{ :service_enabled => false }} + + it do + is_expected.to contain_service('mysqld').with({ + :ensure => :stopped + }) + end + context 'with package_manage set to true' do + let(:params) {{ :package_manage => true }} + it { is_expected.to contain_package('mysql-server') } + end + context 'with package_manage set to false' do + let(:params) {{ :package_manage => false }} + it { is_expected.not_to contain_package('mysql-server') } + end + context 'with datadir overridden' do + let(:params) {{ :override_options => { 'mysqld' => { 'datadir' => '/tmp' }} }} + it { is_expected.to contain_mysql_datadir('/tmp') } + end + end + context 'with log-error overridden' do + let(:params) {{ :override_options => { 'mysqld' => { 'log-error' => '/tmp/error.log' }} }} + it { is_expected.to contain_file('/tmp/error.log') } + end + end + + context 'mysql::server::root_password' do + describe 'when defaults' do + it { + is_expected.to contain_exec('remove install pass').with( + :command => 'mysqladmin -u root --password=$(grep -o \'[^ ]\\+$\' /.mysql_secret) password \'\' && rm -f /.mysql_secret', + :onlyif => 'test -f /.mysql_secret', + :path => '/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin' + ) + } + it { is_expected.not_to contain_mysql_user('root@localhost') } + it { is_expected.not_to contain_file('/root/.my.cnf') } + end + describe 'when root_password set' do + let(:params) {{:root_password => 'SET' }} + it { is_expected.to contain_mysql_user('root@localhost') } + if Puppet.version.to_f >= 3.0 + it { is_expected.to contain_file('/root/.my.cnf').with(:show_diff => false).that_requires('Mysql_user[root@localhost]') } + else + it { is_expected.to contain_file('/root/.my.cnf').that_requires('Mysql_user[root@localhost]') } + end + end + describe 'when root_password set, create_root_user set to false' do + let(:params) {{ :root_password => 'SET', :create_root_user => false }} + it { is_expected.not_to contain_mysql_user('root@localhost') } + if Puppet.version.to_f >= 3.0 + it { is_expected.to contain_file('/root/.my.cnf').with(:show_diff => false) } + else + it { is_expected.to contain_file('/root/.my.cnf') } + end + end + describe 'when root_password set, create_root_my_cnf set to false' do + let(:params) {{ :root_password => 'SET', :create_root_my_cnf => false }} + it { is_expected.to contain_mysql_user('root@localhost') } + it { is_expected.not_to contain_file('/root/.my.cnf') } + end + describe 'when root_password set, create_root_user and create_root_my_cnf set to false' do + let(:params) {{ :root_password => 'SET', :create_root_user => false, :create_root_my_cnf => false }} + it { is_expected.not_to contain_mysql_user('root@localhost') } + it { is_expected.not_to contain_file('/root/.my.cnf') } + end + describe 'when install_secret_file set to /root/.mysql_secret' do + let(:params) {{ :install_secret_file => '/root/.mysql_secret' }} + it { + is_expected.to contain_exec('remove install pass').with( + :command => 'mysqladmin -u root --password=$(grep -o \'[^ ]\\+$\' /root/.mysql_secret) password \'\' && rm -f /root/.mysql_secret', + :onlyif => 'test -f /root/.mysql_secret' + ) + } + end + end + + context 'mysql::server::providers' do + describe 'with users' do + let(:params) {{:users => { + 'foo@localhost' => { + 'max_connections_per_hour' => '1', + 'max_queries_per_hour' => '2', + 'max_updates_per_hour' => '3', + 'max_user_connections' => '4', + 'password_hash' => '*F3A2A51A9B0F2BE2468926B4132313728C250DBF' + }, + 'foo2@localhost' => {} + }}} + it { is_expected.to contain_mysql_user('foo@localhost').with( + :max_connections_per_hour => '1', + :max_queries_per_hour => '2', + :max_updates_per_hour => '3', + :max_user_connections => '4', + :password_hash => '*F3A2A51A9B0F2BE2468926B4132313728C250DBF' + )} + it { is_expected.to contain_mysql_user('foo2@localhost').with( + :max_connections_per_hour => nil, + :max_queries_per_hour => nil, + :max_updates_per_hour => nil, + :max_user_connections => nil, + :password_hash => nil + )} + end + + describe 'with grants' do + let(:params) {{:grants => { + 'foo@localhost/somedb.*' => { + 'user' => 'foo@localhost', + 'table' => 'somedb.*', + 'privileges' => ["SELECT", "UPDATE"], + 'options' => ["GRANT"], + }, + 'foo2@localhost/*.*' => { + 'user' => 'foo2@localhost', + 'table' => '*.*', + 'privileges' => ["SELECT"], + }, + }}} + it { is_expected.to contain_mysql_grant('foo@localhost/somedb.*').with( + :user => 'foo@localhost', + :table => 'somedb.*', + :privileges => ["SELECT", "UPDATE"], + :options => ["GRANT"] + )} + it { is_expected.to contain_mysql_grant('foo2@localhost/*.*').with( + :user => 'foo2@localhost', + :table => '*.*', + :privileges => ["SELECT"], + :options => nil + )} + end + + describe 'with databases' do + let(:params) {{:databases => { + 'somedb' => { + 'charset' => 'latin1', + 'collate' => 'latin1', + }, + 'somedb2' => {} + }}} + it { is_expected.to contain_mysql_database('somedb').with( + :charset => 'latin1', + :collate => 'latin1' + )} + it { is_expected.to contain_mysql_database('somedb2')} + end + end + end + end +end diff --git a/environments/prod/modules/mysql/spec/defines/mysql_db_spec.rb b/environments/prod/modules/mysql/spec/defines/mysql_db_spec.rb new file mode 100644 index 0000000..0cd9cb2 --- /dev/null +++ b/environments/prod/modules/mysql/spec/defines/mysql_db_spec.rb @@ -0,0 +1,83 @@ +require 'spec_helper' + +describe 'mysql::db', :type => :define do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + let(:title) { 'test_db' } + + let(:params) { + { 'user' => 'testuser', + 'password' => 'testpass', + } + } + + it 'should report an error when ensure is not present or absent' do + params.merge!({'ensure' => 'invalid_val'}) + expect { catalogue }.to raise_error(Puppet::Error, + /invalid_val is not supported for ensure\. Allowed values are 'present' and 'absent'\./) + end + + it 'should not notify the import sql exec if no sql script was provided' do + is_expected.to contain_mysql_database('test_db').without_notify + end + + it 'should subscribe to database if sql script is given' do + params.merge!({'sql' => 'test_sql'}) + is_expected.to contain_exec('test_db-import').with_subscribe('Mysql_database[test_db]') + end + + it 'should only import sql script on creation if not enforcing' do + params.merge!({'sql' => 'test_sql', 'enforce_sql' => false}) + is_expected.to contain_exec('test_db-import').with_refreshonly(true) + end + + it 'should import sql script on creation if enforcing' do + params.merge!({'sql' => 'test_sql', 'enforce_sql' => true}) + is_expected.to contain_exec('test_db-import').with_refreshonly(false) + is_expected.to contain_exec('test_db-import').with_command('cat test_sql | mysql test_db') + end + + it 'should import sql script with custom command on creation if enforcing' do + params.merge!({'sql' => 'test_sql', 'enforce_sql' => true, 'import_cat_cmd' => 'zcat'}) + is_expected.to contain_exec('test_db-import').with_refreshonly(false) + is_expected.to contain_exec('test_db-import').with_command('zcat test_sql | mysql test_db') + end + + it 'should import sql scripts when more than one is specified' do + params.merge!({'sql' => ['test_sql', 'test_2_sql']}) + is_expected.to contain_exec('test_db-import').with_command('cat test_sql test_2_sql | mysql test_db') + end + + it 'should report an error if sql isn\'t a string or an array' do + params.merge!({'sql' => {'foo' => 'test_sql', 'bar' => 'test_2_sql'}}) + expect { catalogue }.to raise_error(Puppet::Error, + /\$sql must be either a string or an array\./) + end + + it 'should not create database and database user' do + params.merge!({'ensure' => 'absent', 'host' => 'localhost'}) + is_expected.to contain_mysql_database('test_db').with_ensure('absent') + is_expected.to contain_mysql_user('testuser@localhost').with_ensure('absent') + end + + it 'should create with an appropriate collate and charset' do + params.merge!({'charset' => 'utf8', 'collate' => 'utf8_danish_ci'}) + is_expected.to contain_mysql_database('test_db').with({ + 'charset' => 'utf8', + 'collate' => 'utf8_danish_ci', + }) + end + + it 'should use dbname parameter as database name instead of name' do + params.merge!({'dbname' => 'real_db'}) + is_expected.to contain_mysql_database('real_db') + end + end + end +end diff --git a/environments/prod/modules/mysql/spec/spec.opts b/environments/prod/modules/mysql/spec/spec.opts new file mode 100644 index 0000000..91cd642 --- /dev/null +++ b/environments/prod/modules/mysql/spec/spec.opts @@ -0,0 +1,6 @@ +--format +s +--colour +--loadby +mtime +--backtrace diff --git a/environments/prod/modules/mysql/spec/spec_helper.rb b/environments/prod/modules/mysql/spec/spec_helper.rb new file mode 100644 index 0000000..22d5d68 --- /dev/null +++ b/environments/prod/modules/mysql/spec/spec_helper.rb @@ -0,0 +1,8 @@ +#This file is generated by ModuleSync, do not edit. +require 'puppetlabs_spec_helper/module_spec_helper' + +# put local configuration and setup into spec_helper_local +begin + require 'spec_helper_local' +rescue LoadError +end diff --git a/environments/prod/modules/mysql/spec/spec_helper_acceptance.rb b/environments/prod/modules/mysql/spec/spec_helper_acceptance.rb new file mode 100644 index 0000000..07e19bd --- /dev/null +++ b/environments/prod/modules/mysql/spec/spec_helper_acceptance.rb @@ -0,0 +1,66 @@ +require 'beaker-rspec' +require 'beaker/puppet_install_helper' + +run_puppet_install_helper + +UNSUPPORTED_PLATFORMS = [ 'Windows', 'Solaris', 'AIX' ] + +RSpec.configure do |c| + # Project root + proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..')) + + # Readable test descriptions + c.formatter = :documentation + + # detect the situation where PUP-5016 is triggered and skip the idempotency tests in that case + # also note how fact('puppetversion') is not available because of PUP-4359 + if fact('osfamily') == 'Debian' && fact('operatingsystemmajrelease') == '8' && shell('puppet --version').stdout =~ /^4\.2/ + c.filter_run_excluding :skip_pup_5016 => true + end + + # Configure all nodes in nodeset + c.before :suite do + # Install module and dependencies + puppet_module_install(:source => proj_root, :module_name => 'mysql') + hosts.each do |host| + # Required for binding tests. + if fact('osfamily') == 'RedHat' + version = fact("operatingsystemmajrelease") + if fact('operatingsystemmajrelease') =~ /7/ || fact('operatingsystem') =~ /Fedora/ + shell("yum install -y bzip2") + end + end + + # Solaris 11 doesn't ship the SSL CA root for the forgeapi server + # therefore we need to use a different way to deploy the module to + # the host + if host['platform'] =~ /solaris-11/i + apply_manifest_on(host, 'package { "git": }') + # PE 3.x and 2015.2 require different locations to install modules + modulepath = host.puppet['modulepath'] + modulepath = modulepath.split(':').first if modulepath + + environmentpath = host.puppet['environmentpath'] + environmentpath = environmentpath.split(':').first if environmentpath + + destdir = modulepath || "#{environmentpath}/production/modules" + on host, "git clone https://github.com/puppetlabs/puppetlabs-stdlib #{destdir}/stdlib && cd #{destdir}/stdlib && git checkout 3.2.0" + on host, "git clone https://github.com/stahnma/puppet-module-epel.git #{destdir}/epel && cd #{destdir}/epel && git checkout 1.0.2" + else + on host, puppet('module','install','puppetlabs-stdlib','--version','3.2.0') + on host, puppet('module','install','stahnma/epel') + on host, puppet('module','install','puppet/staging') + end + end + end +end + +shared_examples "a idempotent resource" do + it 'should apply with no errors' do + apply_manifest(pp, :catch_failures => true) + end + + it 'should apply a second time without changes', :skip_pup_5016 do + apply_manifest(pp, :catch_changes => true) + end +end diff --git a/environments/prod/modules/mysql/spec/spec_helper_local.rb b/environments/prod/modules/mysql/spec/spec_helper_local.rb new file mode 100644 index 0000000..9a86ccd --- /dev/null +++ b/environments/prod/modules/mysql/spec/spec_helper_local.rb @@ -0,0 +1,3 @@ +require 'rspec-puppet-facts' +include RspecPuppetFacts + diff --git a/environments/prod/modules/mysql/spec/unit/facter/mysql_server_id_spec.rb b/environments/prod/modules/mysql/spec/unit/facter/mysql_server_id_spec.rb new file mode 100644 index 0000000..a2e9fdf --- /dev/null +++ b/environments/prod/modules/mysql/spec/unit/facter/mysql_server_id_spec.rb @@ -0,0 +1,27 @@ +require "spec_helper" + +describe Facter::Util::Fact do + before { + Facter.clear + } + + describe "mysql_server_id" do + context "igalic's laptop" do + before :each do + Facter.fact(:macaddress).stubs(:value).returns('3c:97:0e:69:fb:e1') + end + it do + Facter.fact(:mysql_server_id).value.to_s.should == '4116385' + end + end + + context "node with lo only" do + before :each do + Facter.fact(:macaddress).stubs(:value).returns('00:00:00:00:00:00') + end + it do + Facter.fact(:mysql_server_id).value.to_s.should == '0' + end + end + end +end diff --git a/environments/prod/modules/mysql/spec/unit/facter/mysql_version_spec.rb b/environments/prod/modules/mysql/spec/unit/facter/mysql_version_spec.rb new file mode 100644 index 0000000..60379f6 --- /dev/null +++ b/environments/prod/modules/mysql/spec/unit/facter/mysql_version_spec.rb @@ -0,0 +1,20 @@ +require "spec_helper" + +describe Facter::Util::Fact do + before { + Facter.clear + } + + describe "mysql_version" do + context 'with value' do + before :each do + Facter::Util::Resolution.stubs(:exec).with('mysql --version').returns('mysql Ver 14.12 Distrib 5.0.95, for redhat-linux-gnu (x86_64) using readline 5.1') + end + it { + expect(Facter.fact(:mysql_version).value).to eq('5.0.95') + } + end + + end + +end diff --git a/environments/prod/modules/mysql/spec/unit/facter/mysqld_version_spec.rb b/environments/prod/modules/mysql/spec/unit/facter/mysqld_version_spec.rb new file mode 100644 index 0000000..f0b606f --- /dev/null +++ b/environments/prod/modules/mysql/spec/unit/facter/mysqld_version_spec.rb @@ -0,0 +1,20 @@ +require "spec_helper" + +describe Facter::Util::Fact do + before { + Facter.clear + } + + describe "mysqld_version" do + context 'with value' do + before :each do + Facter::Util::Resolution.stubs(:exec).with('mysqld -V 2>/dev/null').returns('mysqld Ver 5.5.49-37.9 for Linux on x86_64 (Percona Server (GPL), Release 37.9, Revision efa0073)') + end + it { + expect(Facter.fact(:mysqld_version).value).to eq('mysqld Ver 5.5.49-37.9 for Linux on x86_64 (Percona Server (GPL), Release 37.9, Revision efa0073)') + } + end + + end + +end diff --git a/environments/prod/modules/mysql/spec/unit/puppet/functions/mysql_deepmerge_spec.rb b/environments/prod/modules/mysql/spec/unit/puppet/functions/mysql_deepmerge_spec.rb new file mode 100644 index 0000000..18cb26b --- /dev/null +++ b/environments/prod/modules/mysql/spec/unit/puppet/functions/mysql_deepmerge_spec.rb @@ -0,0 +1,91 @@ +#! /usr/bin/env ruby -S rspec + +require 'spec_helper' + +describe Puppet::Parser::Functions.function(:mysql_deepmerge) do + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + describe 'when calling mysql_deepmerge from puppet' do + it "should not compile when no arguments are passed" do + skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./ + Puppet[:code] = '$x = mysql_deepmerge()' + expect { + scope.compiler.compile + }.to raise_error(Puppet::ParseError, /wrong number of arguments/) + end + + it "should not compile when 1 argument is passed" do + skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./ + Puppet[:code] = "$my_hash={'one' => 1}\n$x = mysql_deepmerge($my_hash)" + expect { + scope.compiler.compile + }.to raise_error(Puppet::ParseError, /wrong number of arguments/) + end + end + + describe 'when calling mysql_deepmerge on the scope instance' do + it 'should require all parameters are hashes' do + expect { new_hash = scope.function_mysql_deepmerge([{}, '2'])}.to raise_error(Puppet::ParseError, /unexpected argument type String/) + expect { new_hash = scope.function_mysql_deepmerge([{}, 2])}.to raise_error(Puppet::ParseError, /unexpected argument type Fixnum/) + end + + it 'should accept empty strings as puppet undef' do + expect { new_hash = scope.function_mysql_deepmerge([{}, ''])}.not_to raise_error + end + + it 'should be able to mysql_deepmerge two hashes' do + new_hash = scope.function_mysql_deepmerge([{'one' => '1', 'two' => '1'}, {'two' => '2', 'three' => '2'}]) + expect(new_hash['one']).to eq('1') + expect(new_hash['two']).to eq('2') + expect(new_hash['three']).to eq('2') + end + + it 'should mysql_deepmerge multiple hashes' do + hash = scope.function_mysql_deepmerge([{'one' => 1}, {'one' => '2'}, {'one' => '3'}]) + expect(hash['one']).to eq('3') + end + + it 'should accept empty hashes' do + expect(scope.function_mysql_deepmerge([{},{},{}])).to eq({}) + end + + it 'should mysql_deepmerge subhashes' do + hash = scope.function_mysql_deepmerge([{'one' => 1}, {'two' => 2, 'three' => { 'four' => 4 } }]) + expect(hash['one']).to eq(1) + expect(hash['two']).to eq(2) + expect(hash['three']).to eq({ 'four' => 4 }) + end + + it 'should append to subhashes' do + hash = scope.function_mysql_deepmerge([{'one' => { 'two' => 2 } }, { 'one' => { 'three' => 3 } }]) + expect(hash['one']).to eq({ 'two' => 2, 'three' => 3 }) + end + + it 'should append to subhashes 2' do + hash = scope.function_mysql_deepmerge([{'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } }, {'two' => 'dos', 'three' => { 'five' => 5 } }]) + expect(hash['one']).to eq(1) + expect(hash['two']).to eq('dos') + expect(hash['three']).to eq({ 'four' => 4, 'five' => 5 }) + end + + it 'should append to subhashes 3' do + hash = scope.function_mysql_deepmerge([{ 'key1' => { 'a' => 1, 'b' => 2 }, 'key2' => { 'c' => 3 } }, { 'key1' => { 'b' => 99 } }]) + expect(hash['key1']).to eq({ 'a' => 1, 'b' => 99 }) + expect(hash['key2']).to eq({ 'c' => 3 }) + end + + it 'should equate keys mod dash and underscore' do + hash = scope.function_mysql_deepmerge([{ 'a-b-c' => 1 } , { 'a_b_c' => 10 }]) + expect(hash['a_b_c']).to eq(10) + expect(hash).not_to have_key('a-b-c') + end + + it 'should keep style of the last when keys are euqal mod dash and underscore' do + hash = scope.function_mysql_deepmerge([{ 'a-b-c' => 1, 'b_c_d' => { 'c-d-e' => 2, 'e-f-g' => 3 }} , { 'a_b_c' => 10, 'b-c-d' => { 'c_d_e' => 12 } }]) + expect(hash['a_b_c']).to eq(10) + expect(hash).not_to have_key('a-b-c') + expect(hash['b-c-d']).to eq({ 'e-f-g' => 3, 'c_d_e' => 12 }) + expect(hash).not_to have_key('b_c_d') + end + end +end diff --git a/environments/prod/modules/mysql/spec/unit/puppet/functions/mysql_password_spec.rb b/environments/prod/modules/mysql/spec/unit/puppet/functions/mysql_password_spec.rb new file mode 100644 index 0000000..2d5feea --- /dev/null +++ b/environments/prod/modules/mysql/spec/unit/puppet/functions/mysql_password_spec.rb @@ -0,0 +1,37 @@ +require 'spec_helper' + +describe 'the mysql_password function' do + before :all do + Puppet::Parser::Functions.autoloader.loadall + end + + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + it 'should exist' do + expect(Puppet::Parser::Functions.function('mysql_password')).to eq('function_mysql_password') + end + + it 'should raise a ParseError if there is less than 1 arguments' do + expect { scope.function_mysql_password([]) }.to( raise_error(Puppet::ParseError)) + end + + it 'should raise a ParseError if there is more than 1 arguments' do + expect { scope.function_mysql_password(%w(foo bar)) }.to( raise_error(Puppet::ParseError)) + end + + it 'should convert password into a hash' do + result = scope.function_mysql_password(%w(password)) + expect(result).to(eq('*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19')) + end + + it 'should convert an empty password into a empty string' do + result = scope.function_mysql_password([""]) + expect(result).to(eq('')) + end + + it 'should not convert a password that is already a hash' do + result = scope.function_mysql_password(['*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19']) + expect(result).to(eq('*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19')) + end + +end diff --git a/environments/prod/modules/mysql/spec/unit/puppet/provider/mysql_database/mysql_spec.rb b/environments/prod/modules/mysql/spec/unit/puppet/provider/mysql_database/mysql_spec.rb new file mode 100644 index 0000000..465e59d --- /dev/null +++ b/environments/prod/modules/mysql/spec/unit/puppet/provider/mysql_database/mysql_spec.rb @@ -0,0 +1,118 @@ +require 'spec_helper' + +describe Puppet::Type.type(:mysql_database).provider(:mysql) do + + let(:defaults_file) { '--defaults-extra-file=/root/.my.cnf' } + + let(:raw_databases) do + <<-SQL_OUTPUT +information_schema +mydb +mysql +performance_schema +test + SQL_OUTPUT + end + + let(:parsed_databases) { %w(information_schema mydb mysql performance_schema test) } + + let(:resource) { Puppet::Type.type(:mysql_database).new( + { :ensure => :present, + :charset => 'latin1', + :collate => 'latin1_swedish_ci', + :name => 'new_database', + :provider => described_class.name + } + )} + let(:provider) { resource.provider } + + before :each do + Facter.stubs(:value).with(:root_home).returns('/root') + Puppet::Util.stubs(:which).with('mysql').returns('/usr/bin/mysql') + File.stubs(:file?).with('/root/.my.cnf').returns(true) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', 'show databases']).returns('new_database') + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "show variables like '%_database'", 'new_database']).returns("character_set_database latin1\ncollation_database latin1_swedish_ci\nskip_show_database OFF") + end + + let(:instance) { provider.class.instances.first } + + describe 'self.instances' do + it 'returns an array of databases' do + provider.class.stubs(:mysql).with([defaults_file, '-NBe', 'show databases']).returns(raw_databases) + raw_databases.each_line do |db| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "show variables like '%_database'", db.chomp]).returns("character_set_database latin1\ncollation_database latin1_swedish_ci\nskip_show_database OFF") + end + databases = provider.class.instances.collect {|x| x.name } + expect(parsed_databases).to match_array(databases) + end + end + + describe 'self.prefetch' do + it 'exists' do + provider.class.instances + provider.class.prefetch({}) + end + end + + describe 'create' do + it 'makes a database' do + provider.expects(:mysql).with([defaults_file, '-NBe', "create database if not exists `#{resource[:name]}` character set `#{resource[:charset]}` collate `#{resource[:collate]}`"]) + provider.expects(:exists?).returns(true) + expect(provider.create).to be_truthy + end + end + + describe 'destroy' do + it 'removes a database if present' do + provider.expects(:mysql).with([defaults_file, '-NBe', "drop database if exists `#{resource[:name]}`"]) + provider.expects(:exists?).returns(false) + expect(provider.destroy).to be_truthy + end + end + + describe 'exists?' do + it 'checks if database exists' do + expect(instance.exists?).to be_truthy + end + end + + describe 'self.defaults_file' do + it 'sets --defaults-extra-file' do + File.stubs(:file?).with('/root/.my.cnf').returns(true) + expect(provider.defaults_file).to eq '--defaults-extra-file=/root/.my.cnf' + end + it 'fails if file missing' do + File.stubs(:file?).with('/root/.my.cnf').returns(false) + expect(provider.defaults_file).to be_nil + end + end + + describe 'charset' do + it 'returns a charset' do + expect(instance.charset).to eq('latin1') + end + end + + describe 'charset=' do + it 'changes the charset' do + provider.expects(:mysql).with([defaults_file, '-NBe', "alter database `#{resource[:name]}` CHARACTER SET blah"]).returns('0') + + provider.charset=('blah') + end + end + + describe 'collate' do + it 'returns a collate' do + expect(instance.collate).to eq('latin1_swedish_ci') + end + end + + describe 'collate=' do + it 'changes the collate' do + provider.expects(:mysql).with([defaults_file, '-NBe', "alter database `#{resource[:name]}` COLLATE blah"]).returns('0') + + provider.collate=('blah') + end + end + +end diff --git a/environments/prod/modules/mysql/spec/unit/puppet/provider/mysql_plugin/mysql_spec.rb b/environments/prod/modules/mysql/spec/unit/puppet/provider/mysql_plugin/mysql_spec.rb new file mode 100644 index 0000000..340562f --- /dev/null +++ b/environments/prod/modules/mysql/spec/unit/puppet/provider/mysql_plugin/mysql_spec.rb @@ -0,0 +1,71 @@ +require 'spec_helper' + +describe Puppet::Type.type(:mysql_plugin).provider(:mysql) do + + let(:defaults_file) { '--defaults-extra-file=/root/.my.cnf' } + + let(:resource) { Puppet::Type.type(:mysql_plugin).new( + { :ensure => :present, + :soname => 'auth_socket.so', + :name => 'auth_socket', + :provider => described_class.name + } + )} + let(:provider) { resource.provider } + + before :each do + Facter.stubs(:value).with(:root_home).returns('/root') + Puppet::Util.stubs(:which).with('mysql').returns('/usr/bin/mysql') + File.stubs(:file?).with('/root/.my.cnf').returns(true) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', 'show plugins']).returns('auth_socket ACTIVE AUTHENTICATION auth_socket.so GPL') + end + + let(:instance) { provider.class.instances.first } + + describe 'self.prefetch' do + it 'exists' do + provider.class.instances + provider.class.prefetch({}) + end + end + + describe 'create' do + it 'loads a plugin' do + provider.expects(:mysql).with([defaults_file, '-NBe', "install plugin #{resource[:name]} soname '#{resource[:soname]}'"]) + provider.expects(:exists?).returns(true) + expect(provider.create).to be_truthy + end + end + + describe 'destroy' do + it 'unloads a plugin if present' do + provider.expects(:mysql).with([defaults_file, '-NBe', "uninstall plugin #{resource[:name]}"]) + provider.expects(:exists?).returns(false) + expect(provider.destroy).to be_truthy + end + end + + describe 'exists?' do + it 'checks if plugin exists' do + expect(instance.exists?).to be_truthy + end + end + + describe 'self.defaults_file' do + it 'sets --defaults-extra-file' do + File.stubs(:file?).with('/root/.my.cnf').returns(true) + expect(provider.defaults_file).to eq '--defaults-extra-file=/root/.my.cnf' + end + it 'fails if file missing' do + File.stubs(:file?).with('/root/.my.cnf').returns(false) + expect(provider.defaults_file).to be_nil + end + end + + describe 'soname' do + it 'returns a soname' do + expect(instance.soname).to eq('auth_socket.so') + end + end + +end diff --git a/environments/prod/modules/mysql/spec/unit/puppet/provider/mysql_user/mysql_spec.rb b/environments/prod/modules/mysql/spec/unit/puppet/provider/mysql_user/mysql_spec.rb new file mode 100644 index 0000000..d993f42 --- /dev/null +++ b/environments/prod/modules/mysql/spec/unit/puppet/provider/mysql_user/mysql_spec.rb @@ -0,0 +1,345 @@ +require 'spec_helper' + +describe Puppet::Type.type(:mysql_user).provider(:mysql) do + + # Output of mysqld -V + mysql_version_string_hash = { + 'mysql-5.5' => + { + :version => '5.5.46', + :string => '/usr/sbin/mysqld Ver 5.5.46-log for Linux on x86_64 (MySQL Community Server (GPL))', + :mysql_type => 'mysql', + }, + 'mysql-5.6' => + { + :version => '5.6.27', + :string => '/usr/sbin/mysqld Ver 5.6.27 for Linux on x86_64 (MySQL Community Server (GPL))', + :mysql_type => 'mysql', + }, + 'mysql-5.7.1' => + { + :version => '5.7.1', + :string => '/usr/sbin/mysqld Ver 5.7.1 for Linux on x86_64 (MySQL Community Server (GPL))', + :mysql_type => 'mysql', + }, + 'mysql-5.7.6' => + { + :version => '5.7.8', + :string => '/usr/sbin/mysqld Ver 5.7.8-rc for Linux on x86_64 (MySQL Community Server (GPL))', + :mysql_type => 'mysql', + }, + 'mariadb-10.0' => + { + :version => '10.0.21', + :string => '/usr/sbin/mysqld Ver 10.0.21-MariaDB for Linux on x86_64 (MariaDB Server)', + :mysql_type => 'mariadb', + }, + 'mariadb-10.0-deb8' => + { + :version => '10.0.23', + :string => '/usr/sbin/mysqld (mysqld 10.0.23-MariaDB-0+deb8u1)', + :mysql_type => 'mariadb', + }, + 'percona-5.5' => + { + :version => '5.5.39', + :string => 'mysqld Ver 5.5.39-36.0-55 for Linux on x86_64 (Percona XtraDB Cluster (GPL), Release rel36.0, Revision 824, WSREP version 25.11, wsrep_25.11.r4023)', + :mysql_type => 'percona', + }, + } + + let(:defaults_file) { '--defaults-extra-file=/root/.my.cnf' } + let(:system_database) { '--database=mysql' } + let(:newhash) { '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5' } + + let(:raw_users) do + <<-SQL_OUTPUT +root@127.0.0.1 +root@::1 +@localhost +debian-sys-maint@localhost +root@localhost +usvn_user@localhost +@vagrant-ubuntu-raring-64 + SQL_OUTPUT + end + + let(:parsed_users) { %w(root@127.0.0.1 root@::1 @localhost debian-sys-maint@localhost root@localhost usvn_user@localhost @vagrant-ubuntu-raring-64) } + + let(:resource) { Puppet::Type.type(:mysql_user).new( + { :ensure => :present, + :password_hash => '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4', + :name => 'joe@localhost', + :max_user_connections => '10', + :max_connections_per_hour => '10', + :max_queries_per_hour => '10', + :max_updates_per_hour => '10', + :provider => described_class.name + } + )} + let(:provider) { resource.provider } + + before :each do + # Set up the stubs for an instances call. + Facter.stubs(:value).with(:root_home).returns('/root') + Facter.stubs(:value).with(:mysql_version).returns('5.6.24') + provider.class.instance_variable_set(:@mysqld_version_string, '5.6.24') + Puppet::Util.stubs(:which).with('mysql').returns('/usr/bin/mysql') + Puppet::Util.stubs(:which).with('mysqld').returns('/usr/sbin/mysqld') + File.stubs(:file?).with('/root/.my.cnf').returns(true) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns('joe@localhost') + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = 'joe@localhost'"]).returns('10 10 10 10 *6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4') + end + + let(:instance) { provider.class.instances.first } + + describe 'self.instances' do + it 'returns an array of users MySQL 5.5' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.5'][:string]) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns(raw_users) + parsed_users.each do |user| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{user}'"]).returns('10 10 10 10 ') + end + + usernames = provider.class.instances.collect {|x| x.name } + expect(parsed_users).to match_array(usernames) + end + it 'returns an array of users MySQL 5.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.6'][:string]) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns(raw_users) + parsed_users.each do |user| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{user}'"]).returns('10 10 10 10 ') + end + + usernames = provider.class.instances.collect {|x| x.name } + expect(parsed_users).to match_array(usernames) + end + it 'returns an array of users MySQL >= 5.7.0 < 5.7.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.1'][:string]) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns(raw_users) + parsed_users.each do |user| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{user}'"]).returns('10 10 10 10 ') + end + + usernames = provider.class.instances.collect {|x| x.name } + expect(parsed_users).to match_array(usernames) + end + it 'returns an array of users MySQL >= 5.7.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.6'][:string]) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns(raw_users) + parsed_users.each do |user| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, AUTHENTICATION_STRING, PLUGIN FROM mysql.user WHERE CONCAT(user, '@', host) = '#{user}'"]).returns('10 10 10 10 ') + end + + usernames = provider.class.instances.collect {|x| x.name } + expect(parsed_users).to match_array(usernames) + end + it 'returns an array of users mariadb 10.0' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mariadb-10.0'][:string]) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns(raw_users) + parsed_users.each do |user| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{user}'"]).returns('10 10 10 10 ') + end + + usernames = provider.class.instances.collect {|x| x.name } + expect(parsed_users).to match_array(usernames) + end + it 'returns an array of users percona 5.5' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['percona-5.5'][:string]) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns(raw_users) + parsed_users.each do |user| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{user}'"]).returns('10 10 10 10 ') + end + + usernames = provider.class.instances.collect {|x| x.name } + expect(parsed_users).to match_array(usernames) + end + end + + describe 'mysql version and type detection' do + mysql_version_string_hash.each do |name,line| + version=line[:version] + string=line[:string] + mysql_type=line[:mysql_type] + it "detects type '#{mysql_type}' with version '#{version}'" do + provider.class.instance_variable_set(:@mysqld_version_string, string) + expect(provider.mysqld_version).to eq(version) + expect(provider.mysqld_type).to eq(mysql_type) + end + end + end + + describe 'self.prefetch' do + it 'exists' do + provider.class.instances + provider.class.prefetch({}) + end + end + + describe 'create' do + it 'makes a user' do + provider.expects(:mysql).with([defaults_file, system_database, '-e', "CREATE USER 'joe'@'localhost' IDENTIFIED BY PASSWORD '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4'"]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' WITH MAX_USER_CONNECTIONS 10 MAX_CONNECTIONS_PER_HOUR 10 MAX_QUERIES_PER_HOUR 10 MAX_UPDATES_PER_HOUR 10"]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE NONE"]) + provider.expects(:exists?).returns(true) + expect(provider.create).to be_truthy + end + end + + describe 'destroy' do + it 'removes a user if present' do + provider.expects(:mysql).with([defaults_file, system_database, '-e', "DROP USER 'joe'@'localhost'"]) + provider.expects(:exists?).returns(false) + expect(provider.destroy).to be_truthy + end + end + + describe 'exists?' do + it 'checks if user exists' do + expect(instance.exists?).to be_truthy + end + end + + describe 'self.mysqld_version' do + it 'uses the mysqld_version fact if unset' do + provider.class.instance_variable_set(:@mysqld_version_string, nil) + Facter.stubs(:value).with(:mysqld_version).returns('5.6.24') + expect(provider.mysqld_version).to eq '5.6.24' + end + it 'returns 5.7.6 for "mysqld Ver 5.7.6 for Linux on x86_64 (MySQL Community Server (GPL))"' do + provider.class.instance_variable_set(:@mysqld_version_string, 'mysqld Ver 5.7.6 for Linux on x86_64 (MySQL Community Server (GPL))') + expect(provider.mysqld_version).to eq '5.7.6' + end + it 'returns 5.7.6 for "mysqld Ver 5.7.6-rc for Linux on x86_64 (MySQL Community Server (GPL))"' do + provider.class.instance_variable_set(:@mysqld_version_string, 'mysqld Ver 5.7.6-rc for Linux on x86_64 (MySQL Community Server (GPL))') + expect(provider.mysqld_version).to eq '5.7.6' + end + it 'detects >= 5.7.6 for 5.7.7-log' do + provider.class.instance_variable_set(:@mysqld_version_string, 'mysqld Ver 5.7.7-log for Linux on x86_64 (MySQL Community Server (GPL))') + expect(Puppet::Util::Package.versioncmp(provider.mysqld_version, '5.7.6')).to be >= 0 + end + it 'detects < 5.7.6 for 5.7.5-log' do + provider.class.instance_variable_set(:@mysqld_version_string, 'mysqld Ver 5.7.5-log for Linux on x86_64 (MySQL Community Server (GPL))') + expect(Puppet::Util::Package.versioncmp(provider.mysqld_version, '5.7.6')).to be < 0 + end + end + + describe 'self.defaults_file' do + it 'sets --defaults-extra-file' do + File.stubs(:file?).with('/root/.my.cnf').returns(true) + expect(provider.defaults_file).to eq '--defaults-extra-file=/root/.my.cnf' + end + it 'fails if file missing' do + File.expects(:file?).with('/root/.my.cnf').returns(false) + expect(provider.defaults_file).to be_nil + end + end + + describe 'password_hash' do + it 'returns a hash' do + expect(instance.password_hash).to eq('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4') + end + end + + describe 'password_hash=' do + it 'changes the hash mysql 5.5' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.5'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "SET PASSWORD FOR 'joe'@'localhost' = '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5'"]).returns('0') + + provider.expects(:password_hash).returns('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + provider.password_hash=('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + end + it 'changes the hash mysql 5.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.6'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "SET PASSWORD FOR 'joe'@'localhost' = '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5'"]).returns('0') + + provider.expects(:password_hash).returns('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + provider.password_hash=('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + end + it 'changes the hash mysql < 5.7.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.1'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "SET PASSWORD FOR 'joe'@'localhost' = '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5'"]).returns('0') + + provider.expects(:password_hash).returns('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + provider.password_hash=('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + end + it 'changes the hash MySQL >= 5.7.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.6'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "ALTER USER 'joe'@'localhost' IDENTIFIED WITH mysql_native_password AS '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5'"]).returns('0') + + provider.expects(:password_hash).returns('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + provider.password_hash=('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + end + it 'changes the hash mariadb-10.0' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mariadb-10.0'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "SET PASSWORD FOR 'joe'@'localhost' = '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5'"]).returns('0') + + provider.expects(:password_hash).returns('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + provider.password_hash=('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + end + it 'changes the hash percona-5.5' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['percona-5.5'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "SET PASSWORD FOR 'joe'@'localhost' = '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5'"]).returns('0') + + provider.expects(:password_hash).returns('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + provider.password_hash=('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + end + end + + describe 'tls_options=' do + it 'adds SSL option grant in mysql 5.5' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.5'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE NONE"]).returns('0') + + provider.expects(:tls_options).returns(['NONE']) + provider.tls_options=(['NONE']) + end + it 'adds SSL option grant in mysql 5.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.6'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE NONE"]).returns('0') + + provider.expects(:tls_options).returns(['NONE']) + provider.tls_options=(['NONE']) + end + it 'adds SSL option grant in mysql < 5.7.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.1'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE NONE"]).returns('0') + + provider.expects(:tls_options).returns(['NONE']) + provider.tls_options=(['NONE']) + end + it 'adds SSL option grant in mysql >= 5.7.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.6'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "ALTER USER 'joe'@'localhost' REQUIRE NONE"]).returns('0') + + provider.expects(:tls_options).returns(['NONE']) + provider.tls_options=(['NONE']) + end + it 'adds SSL option grant in mariadb-10.0' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mariadb-10.0'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE NONE"]).returns('0') + + provider.expects(:tls_options).returns(['NONE']) + provider.tls_options=(['NONE']) + end + end + + ['max_user_connections', 'max_connections_per_hour', 'max_queries_per_hour', + 'max_updates_per_hour'].each do |property| + + describe property do + it "returns #{property}" do + expect(instance.send("#{property}".to_sym)).to eq('10') + end + end + + describe "#{property}=" do + it "changes #{property}" do + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' WITH #{property.upcase} 42"]).returns('0') + provider.expects(property.to_sym).returns('42') + provider.send("#{property}=".to_sym, '42') + end + end + end + +end diff --git a/environments/prod/modules/mysql/spec/unit/puppet/type/mysql_database_spec.rb b/environments/prod/modules/mysql/spec/unit/puppet/type/mysql_database_spec.rb new file mode 100644 index 0000000..7897d81 --- /dev/null +++ b/environments/prod/modules/mysql/spec/unit/puppet/type/mysql_database_spec.rb @@ -0,0 +1,29 @@ +require 'puppet' +require 'puppet/type/mysql_database' +describe Puppet::Type.type(:mysql_database) do + + before :each do + @user = Puppet::Type.type(:mysql_database).new(:name => 'test', :charset => 'utf8', :collate => 'utf8_blah_ci') + end + + it 'should accept a database name' do + expect(@user[:name]).to eq('test') + end + + it 'should accept a charset' do + @user[:charset] = 'latin1' + expect(@user[:charset]).to eq('latin1') + end + + it 'should accept a collate' do + @user[:collate] = 'latin1_swedish_ci' + expect(@user[:collate]).to eq('latin1_swedish_ci') + end + + it 'should require a name' do + expect { + Puppet::Type.type(:mysql_database).new({}) + }.to raise_error(Puppet::Error, 'Title or name must be provided') + end + +end diff --git a/environments/prod/modules/mysql/spec/unit/puppet/type/mysql_grant_spec.rb b/environments/prod/modules/mysql/spec/unit/puppet/type/mysql_grant_spec.rb new file mode 100644 index 0000000..9b33058 --- /dev/null +++ b/environments/prod/modules/mysql/spec/unit/puppet/type/mysql_grant_spec.rb @@ -0,0 +1,74 @@ +require 'puppet' +require 'puppet/type/mysql_grant' +describe Puppet::Type.type(:mysql_grant) do + + before :each do + @user = Puppet::Type.type(:mysql_grant).new(:name => 'foo@localhost/*.*', :privileges => ['ALL', 'PROXY'], :table => ['*.*','@'], :user => 'foo@localhost') + end + + it 'should accept a grant name' do + expect(@user[:name]).to eq('foo@localhost/*.*') + end + + it 'should accept ALL privileges' do + @user[:privileges] = 'ALL' + expect(@user[:privileges]).to eq(['ALL']) + end + + it 'should accept PROXY privilege' do + @user[:privileges] = 'PROXY' + expect(@user[:privileges]).to eq(['PROXY']) + end + + it 'should accept a table' do + @user[:table] = '*.*' + expect(@user[:table]).to eq('*.*') + end + + it 'should accept @ for table' do + @user[:table] = '@' + expect(@user[:table]).to eq('@') + end + + it 'should accept a user' do + @user[:user] = 'foo@localhost' + expect(@user[:user]).to eq('foo@localhost') + end + + it 'should require a name' do + expect { + Puppet::Type.type(:mysql_grant).new({}) + }.to raise_error(Puppet::Error, 'Title or name must be provided') + end + + it 'should require the name to match the user and table' do + expect { + Puppet::Type.type(:mysql_grant).new(:name => 'foo', :privileges => ['ALL', 'PROXY'], :table => ['*.*','@'], :user => 'foo@localhost') + }.to raise_error /name must match user and table parameters/ + end + + describe 'it should munge privileges' do + + it 'to just ALL' do + @user = Puppet::Type.type(:mysql_grant).new( + :name => 'foo@localhost/*.*', :table => ['*.*','@'], :user => 'foo@localhost', + :privileges => ['ALL', 'PROXY'] ) + expect(@user[:privileges]).to eq(['ALL']) + end + + it 'to upcase and ordered' do + @user = Puppet::Type.type(:mysql_grant).new( + :name => 'foo@localhost/*.*', :table => ['*.*','@'], :user => 'foo@localhost', + :privileges => ['select', 'Insert'] ) + expect(@user[:privileges]).to eq(['INSERT', 'SELECT']) + end + + it 'ordered including column privileges' do + @user = Puppet::Type.type(:mysql_grant).new( + :name => 'foo@localhost/*.*', :table => ['*.*','@'], :user => 'foo@localhost', + :privileges => ['SELECT(Host,Address)', 'Insert'] ) + expect(@user[:privileges]).to eq(['INSERT', 'SELECT (Address, Host)']) + end + end + +end diff --git a/environments/prod/modules/mysql/spec/unit/puppet/type/mysql_plugin_spec.rb b/environments/prod/modules/mysql/spec/unit/puppet/type/mysql_plugin_spec.rb new file mode 100644 index 0000000..e94c518 --- /dev/null +++ b/environments/prod/modules/mysql/spec/unit/puppet/type/mysql_plugin_spec.rb @@ -0,0 +1,24 @@ +require 'puppet' +require 'puppet/type/mysql_plugin' +describe Puppet::Type.type(:mysql_plugin) do + + before :each do + @plugin = Puppet::Type.type(:mysql_plugin).new(:name => 'test', :soname => 'test.so') + end + + it 'should accept a plugin name' do + expect(@plugin[:name]).to eq('test') + end + + it 'should accept a library name' do + @plugin[:soname] = 'test.so' + expect(@plugin[:soname]).to eq('test.so') + end + + it 'should require a name' do + expect { + Puppet::Type.type(:mysql_plugin).new({}) + }.to raise_error(Puppet::Error, 'Title or name must be provided') + end + +end diff --git a/environments/prod/modules/mysql/spec/unit/puppet/type/mysql_user_spec.rb b/environments/prod/modules/mysql/spec/unit/puppet/type/mysql_user_spec.rb new file mode 100644 index 0000000..3e3ae7d --- /dev/null +++ b/environments/prod/modules/mysql/spec/unit/puppet/type/mysql_user_spec.rb @@ -0,0 +1,136 @@ +require 'puppet' +require 'puppet/type/mysql_user' +describe Puppet::Type.type(:mysql_user) do + + context "On MySQL 5.x" do + before :each do + Facter.stubs(:value).with(:mysql_version).returns("5.6.24") + end + it 'should fail with a long user name' do + expect { + Puppet::Type.type(:mysql_user).new({:name => '12345678901234567@localhost', :password_hash => 'pass'}) + }.to raise_error /MySQL usernames are limited to a maximum of 16 characters/ + end + end + + context "On MariaDB 10.0.0+" do + before :each do + Facter.stubs(:value).with(:mysql_version).returns("10.0.19") + @user = Puppet::Type.type(:mysql_user).new(:name => '12345678901234567@localhost', :password_hash => 'pass') + end + it 'should succeed with a long user name on MariaDB' do + expect(@user[:name]).to eq('12345678901234567@localhost') + end + end + + it 'should require a name' do + expect { + Puppet::Type.type(:mysql_user).new({}) + }.to raise_error(Puppet::Error, 'Title or name must be provided') + end + + context 'using foo@localhost' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => 'foo@localhost', :password_hash => 'pass') + end + + it 'should accept a user name' do + expect(@user[:name]).to eq('foo@localhost') + end + + it 'should accept a password' do + @user[:password_hash] = 'foo' + expect(@user[:password_hash]).to eq('foo') + end + end + + context 'using foo@LocalHost' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => 'foo@LocalHost', :password_hash => 'pass') + end + + it 'should lowercase the user name' do + expect(@user[:name]).to eq('foo@localhost') + end + end + + context 'using foo@192.168.1.0/255.255.255.0' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => 'foo@192.168.1.0/255.255.255.0', :password_hash => 'pass') + end + + it 'should create the user with the netmask' do + expect(@user[:name]).to eq('foo@192.168.1.0/255.255.255.0') + end + end + + context 'using allo_wed$char@localhost' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => 'allo_wed$char@localhost', :password_hash => 'pass') + end + + it 'should accept a user name' do + expect(@user[:name]).to eq('allo_wed$char@localhost') + end + end + + context 'ensure the default \'debian-sys-main\'@localhost user can be parsed' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => '\'debian-sys-maint\'@localhost', :password_hash => 'pass') + end + + it 'should accept a user name' do + expect(@user[:name]).to eq('\'debian-sys-maint\'@localhost') + end + end + + context 'using a quoted 16 char username' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => '"debian-sys-maint"@localhost', :password_hash => 'pass') + end + + it 'should accept a user name' do + expect(@user[:name]).to eq('"debian-sys-maint"@localhost') + end + end + + context 'using a quoted username that is too long ' do + before :each do + Facter.stubs(:value).with(:mysql_version).returns("5.6.24") + end + + it 'should fail with a size error' do + expect { + Puppet::Type.type(:mysql_user).new(:name => '"debian-sys-maint2"@localhost', :password_hash => 'pass') + }.to raise_error /MySQL usernames are limited to a maximum of 16 characters/ + end + end + + context 'using `speci!al#`@localhost' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => '`speci!al#`@localhost', :password_hash => 'pass') + end + + it 'should accept a quoted user name with special chatracters' do + expect(@user[:name]).to eq('`speci!al#`@localhost') + end + end + + context 'using in-valid@localhost' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => 'in-valid@localhost', :password_hash => 'pass') + end + + it 'should accept a user name with special chatracters' do + expect(@user[:name]).to eq('in-valid@localhost') + end + end + + context 'using "misquoted@localhost' do + it 'should fail with a misquoted username is used' do + expect { + Puppet::Type.type(:mysql_user).new(:name => '"misquoted@localhost', :password_hash => 'pass') + }.to raise_error /Invalid database user "misquoted@localhost/ + end + end +end diff --git a/environments/prod/modules/mysql/templates/meb.cnf.erb b/environments/prod/modules/mysql/templates/meb.cnf.erb new file mode 100644 index 0000000..d157af9 --- /dev/null +++ b/environments/prod/modules/mysql/templates/meb.cnf.erb @@ -0,0 +1,18 @@ +### MANAGED BY PUPPET ### + +<% @options.sort.map do |k,v| -%> +<% if v.is_a?(Hash) -%> +[<%= k %>] +<% v.sort.map do |ki, vi| -%> +<% if vi == true or v == '' -%> +<%= ki %> +<% elsif vi.is_a?(Array) -%> +<% vi.each do |vii| -%> +<%= ki %> = <%= vii %> +<% end -%> +<% elsif ![nil, '', :undef].include?(vi) -%> +<%= ki %> = <%= vi %> +<% end -%> +<% end -%> +<% end %> +<% end -%> diff --git a/environments/prod/modules/mysql/templates/my.cnf.erb b/environments/prod/modules/mysql/templates/my.cnf.erb new file mode 100644 index 0000000..7d1f148 --- /dev/null +++ b/environments/prod/modules/mysql/templates/my.cnf.erb @@ -0,0 +1,24 @@ +### MANAGED BY PUPPET ### + +<% @options.sort.map do |k,v| -%> +<% if v.is_a?(Hash) -%> +[<%= k %>] +<% v.sort.map do |ki, vi| -%> +<% if ki == 'ssl-disable' or (ki =~ /^ssl/ and v['ssl-disable'] == true) -%> +<% next %> +<% elsif vi == true or vi == '' -%> +<%= ki %> +<% elsif vi.is_a?(Array) -%> +<% vi.each do |vii| -%> +<%= ki %> = <%= vii %> +<% end -%> +<% elsif ![nil, '', :undef].include?(vi) -%> +<%= ki %> = <%= vi %> +<% end -%> +<% end -%> +<% end %> +<% end -%> + +<% if @includedir and @includedir != '' %> +!includedir <%= @includedir %> +<% end %> diff --git a/environments/prod/modules/mysql/templates/my.cnf.pass.erb b/environments/prod/modules/mysql/templates/my.cnf.pass.erb new file mode 100644 index 0000000..b82cca3 --- /dev/null +++ b/environments/prod/modules/mysql/templates/my.cnf.pass.erb @@ -0,0 +1,11 @@ +### MANAGED BY PUPPET ### + +<% %w(mysql client mysqldump mysqladmin mysqlcheck).each do |section| %> +[<%= section -%>] +user=root +host=localhost +<% unless scope.lookupvar('mysql::server::root_password') == 'UNSET' -%> +password='<%= scope.lookupvar('mysql::server::root_password') %>' +<% end -%> +socket=<%= @options['client']['socket'] %> +<% end %> diff --git a/environments/prod/modules/mysql/templates/mysqlbackup.sh.erb b/environments/prod/modules/mysql/templates/mysqlbackup.sh.erb new file mode 100755 index 0000000..cd193c5 --- /dev/null +++ b/environments/prod/modules/mysql/templates/mysqlbackup.sh.erb @@ -0,0 +1,104 @@ +<%- if @kernel == 'Linux' -%> +#!/bin/bash +<%- else -%> +#!/bin/sh +<%- end -%> +# +# MySQL Backup Script +# Dumps mysql databases to a file for another backup tool to pick up. +# +# MySQL code: +# GRANT SELECT, RELOAD, LOCK TABLES ON *.* TO 'user'@'localhost' +# IDENTIFIED BY 'password'; +# FLUSH PRIVILEGES; +# +##### START CONFIG ################################################### + +USER=<%= @backupuser %> +PASS='<%= @backuppassword %>' +MAX_ALLOWED_PACKET=<%= @maxallowedpacket %> +DIR=<%= @backupdir %> +ROTATE=<%= [ Integer(@backuprotate) - 1, 0 ].max %> + +# Create temporary mysql cnf file. +TMPFILE=`mktemp /tmp/backup.XXXXXX` || exit 1 +echo -e "[client]\npassword=$PASS\nuser=$USER\nmax_allowed_packet=$MAX_ALLOWED_PACKET" > $TMPFILE + +# Ensure backup directory exist. +mkdir -p $DIR + +PREFIX=mysql_backup_ +<% if @ignore_events %> +ADDITIONAL_OPTIONS="--ignore-table=mysql.event" +<% else %> +ADDITIONAL_OPTIONS="--events" +<% end %> +<%# Only include routines or triggers if we're doing a file per database -%> +<%# backup. This happens if we named databases, or if we explicitly set -%> +<%# file per database mode -%> +<% if !@backupdatabases.empty? || @file_per_database -%> +<% if @include_triggers -%> +ADDITIONAL_OPTIONS="$ADDITIONAL_OPTIONS --triggers" +<% else -%> +ADDITIONAL_OPTIONS="$ADDITIONAL_OPTIONS --skip-triggers" +<% end -%> +<% if @include_routines -%> +ADDITIONAL_OPTIONS="$ADDITIONAL_OPTIONS --routines" +<% else -%> +ADDITIONAL_OPTIONS="$ADDITIONAL_OPTIONS --skip-routines" +<% end -%> +<% end -%> + +##### STOP CONFIG #################################################### +PATH=<%= @execpath %> + + + +<%- if @kernel == 'Linux' -%> +set -o pipefail +<%- end -%> + +cleanup() +{ + find "${DIR}/" -maxdepth 1 -type f -name "${PREFIX}*.sql*" -mtime +${ROTATE} -print0 | xargs -0 -r rm -f +} + +<% if @delete_before_dump -%> +cleanup + +<% end -%> +<% if @backupdatabases.empty? -%> +<% if @file_per_database -%> +mysql --defaults-extra-file=$TMPFILE -s -r -N -e 'SHOW DATABASES' | while read dbname +do + mysqldump --defaults-extra-file=$TMPFILE --opt --flush-logs --single-transaction \ + ${ADDITIONAL_OPTIONS} \ + ${dbname} <% if @backupcompress %>| bzcat -zc <% end %>> ${DIR}/${PREFIX}${dbname}_`date +%Y%m%d-%H%M%S`.sql<% if @backupcompress %>.bz2<% end %> +done +<% else -%> +mysqldump --defaults-extra-file=$TMPFILE --opt --flush-logs --single-transaction \ + ${ADDITIONAL_OPTIONS} \ + --all-databases <% if @backupcompress %>| bzcat -zc <% end %>> ${DIR}/${PREFIX}`date +%Y%m%d-%H%M%S`.sql<% if @backupcompress %>.bz2<% end %> +<% end -%> +<% else -%> +<% @backupdatabases.each do |db| -%> +mysqldump --defaults-extra-file=$TMPFILE --opt --flush-logs --single-transaction \ + ${ADDITIONAL_OPTIONS} \ + <%= db %><% if @backupcompress %>| bzcat -zc <% end %>> ${DIR}/${PREFIX}<%= db %>_`date +%Y%m%d-%H%M%S`.sql<% if @backupcompress %>.bz2<% end %> +<% end -%> +<% end -%> + +<% unless @delete_before_dump -%> +if [ $? -eq 0 ] ; then + cleanup +fi +<% end -%> + +<% if @postscript -%> + <%- [@postscript].flatten.compact.each do |script|%> +<%= script %> + <%- end -%> +<% end -%> + +# Remove temporary file +rm -f $TMPFILE diff --git a/environments/prod/modules/mysql/templates/xtrabackup.sh.erb b/environments/prod/modules/mysql/templates/xtrabackup.sh.erb new file mode 100644 index 0000000..1449398 --- /dev/null +++ b/environments/prod/modules/mysql/templates/xtrabackup.sh.erb @@ -0,0 +1,21 @@ +<%- if @kernel == 'Linux' -%> +#!/bin/bash +<%- else -%> +#!/bin/sh +<%- end -%> +# +# A wrapper for Xtrabackup +# +<% if @prescript -%> + <%- [@prescript].flatten.compact.each do |script| %> +<%= script %> + <%- end -%> +<% end -%> + +innobackupex "$@" + +<% if @postscript -%> + <%- [@postscript].flatten.compact.each do |script| %> +<%= script %> + <%- end -%> +<% end -%> diff --git a/environments/prod/modules/staging/CHANGELOG.md b/environments/prod/modules/staging/CHANGELOG.md new file mode 100644 index 0000000..1bdfeef --- /dev/null +++ b/environments/prod/modules/staging/CHANGELOG.md @@ -0,0 +1,30 @@ +# Changelog + +## 2017-02-11 - Release 2.2.0 + +This is the last release with Puppet3 support! +* Modulesync + +## 2016-12-25 - Release 2.1.0 + +* Modulesync with latest Vox Pupuli defaults +* Ability to manage file attributes on target +* Strip trailing slashes off paths +* Improve spec tests + +## 2016-07-09 - Release 2.0.1 + +* Fix some typos/spelling +* modulesync with latest Vox Pupuli defaults + +## 2016-06-10 - Release 2.0.0 + +* Drop of Ruby1.8 support! +* modulesync to latest voxpupli configs +* Add support for OpenBSD +* Allow to pass in the full path to a file instead of specifying the file name explictly +* Revocation of 1.0.6 (wrong semver) + +## 2016-03-20 - Release 1.0.6 + +* Publish the first version of this module in the puppet namespace. diff --git a/environments/prod/modules/staging/CONTRIBUTING.md b/environments/prod/modules/staging/CONTRIBUTING.md new file mode 100644 index 0000000..8cac3bd --- /dev/null +++ b/environments/prod/modules/staging/CONTRIBUTING.md @@ -0,0 +1,97 @@ +This module has grown over time based on a range of contributions from +people using it. If you follow these contributing guidelines your patch +will likely make it into a release a little quicker. + + +## Contributing + +Please note that this project is released with a Contributor Code of Conduct. By participating in this project you agree to abide by its terms. [Contributor Code of Conduct](https://voxpupuli.org/coc/). + +1. Fork the repo. + +1. Create a separate branch for your change. + +1. Run the tests. We only take pull requests with passing tests, and + documentation. + +1. Add a test for your change. Only refactoring and documentation + changes require no new tests. If you are adding functionality + or fixing a bug, please add a test. + +1. Squash your commits down into logical components. Make sure to rebase + against the current master. + +1. Push the branch to your fork and submit a pull request. + +Please be prepared to repeat some of these steps as our contributors review +your code. + +## Dependencies + +The testing and development tools have a bunch of dependencies, +all managed by [bundler](http://bundler.io/) according to the +[Puppet support matrix](http://docs.puppetlabs.com/guides/platforms.html#ruby-versions). + +By default the tests use a baseline version of Puppet. + +If you have Ruby 2.x or want a specific version of Puppet, +you must set an environment variable such as: + + export PUPPET_VERSION="~> 4.2.0" + +Install the dependencies like so... + + bundle install + +## Syntax and style + +The test suite will run [Puppet Lint](http://puppet-lint.com/) and +[Puppet Syntax](https://github.com/gds-operations/puppet-syntax) to +check various syntax and style things. You can run these locally with: + + bundle exec rake lint + bundle exec rake validate + +## Running the unit tests + +The unit test suite covers most of the code, as mentioned above please +add tests if you're adding new functionality. If you've not used +[rspec-puppet](http://rspec-puppet.com/) before then feel free to ask +about how best to test your new feature. + +To run your all the unit tests + + bundle exec rake spec SPEC_OPTS='--format documentation' + +To run a specific spec test set the `SPEC` variable: + + bundle exec rake spec SPEC=spec/foo_spec.rb + +To run the linter, the syntax checker and the unit tests: + + bundle exec rake test + + +## Integration tests + +The unit tests just check the code runs, not that it does exactly what +we want on a real machine. For that we're using +[beaker](https://github.com/puppetlabs/beaker). + +This fires up a new virtual machine (using vagrant) and runs a series of +simple tests against it after applying the module. You can run this +with: + + bundle exec rake acceptance + +This will run the tests on an Ubuntu 12.04 virtual machine. You can also +run the integration tests against Centos 6.5 with. + + BEAKER_set=centos-64-x64 bundle exec rake acceptances + +If you don't want to have to recreate the virtual machine every time you +can use `BEAKER_DESTROY=no` and `BEAKER_PROVISION=no`. On the first run you will +at least need `BEAKER_PROVISION` set to yes (the default). The Vagrantfile +for the created virtual machines will be in `.vagrant/beaker_vagrant_fies`. + +# vim: syntax=markdown diff --git a/environments/prod/modules/staging/Gemfile b/environments/prod/modules/staging/Gemfile new file mode 100644 index 0000000..e8db724 --- /dev/null +++ b/environments/prod/modules/staging/Gemfile @@ -0,0 +1,68 @@ +source ENV['GEM_SOURCE'] || "https://rubygems.org" + +def location_for(place, fake_version = nil) + if place =~ /^(git[:@][^#]*)#(.*)/ + [fake_version, { :git => $1, :branch => $2, :require => false }].compact + elsif place =~ /^file:\/\/(.*)/ + ['>= 0', { :path => File.expand_path($1), :require => false }] + else + [place, { :require => false }] + end +end + +group :test do + gem 'puppetlabs_spec_helper', '~> 1.2.2', :require => false + gem 'rspec-puppet', '~> 2.5', :require => false + gem 'rspec-puppet-facts', :require => false + gem 'rspec-puppet-utils', :require => false + gem 'puppet-lint-absolute_classname-check', :require => false + gem 'puppet-lint-leading_zero-check', :require => false + gem 'puppet-lint-trailing_comma-check', :require => false + gem 'puppet-lint-version_comparison-check', :require => false + gem 'puppet-lint-classes_and_types_beginning_with_digits-check', :require => false + gem 'puppet-lint-unquoted_string-check', :require => false + gem 'puppet-lint-variable_contains_upcase', :require => false + gem 'metadata-json-lint', :require => false + gem 'puppet-blacksmith', :require => false + gem 'voxpupuli-release', :require => false, :git => 'https://github.com/voxpupuli/voxpupuli-release-gem.git' + gem 'puppet-strings', '~> 1.0.0', :require => false + gem 'redcarpet', :require => false + gem 'rubocop', '~> 0.47.0', :require => false if RUBY_VERSION >= '2.3.0' + gem 'rubocop-rspec', '~> 1.10.0', :require => false if RUBY_VERSION >= '2.3.0' + gem 'json_pure', '<= 2.0.1', :require => false if RUBY_VERSION < '2.0.0' + gem 'mocha', '>= 1.2.1', :require => false + gem 'coveralls', :require => false if RUBY_VERSION >= '2.0.0' + gem 'simplecov-console', :require => false if RUBY_VERSION >= '2.0.0' +end + +group :development do + gem 'travis', :require => false + gem 'travis-lint', :require => false + gem 'guard-rake', :require => false +end + +group :system_tests do + if beaker_version = ENV['BEAKER_VERSION'] + gem 'beaker', *location_for(beaker_version) + end + if beaker_rspec_version = ENV['BEAKER_RSPEC_VERSION'] + gem 'beaker-rspec', *location_for(beaker_rspec_version) + else + gem 'beaker-rspec', :require => false + end + gem 'serverspec', :require => false + gem 'beaker-puppet_install_helper', :require => false +end + + + +if facterversion = ENV['FACTER_GEM_VERSION'] + gem 'facter', facterversion.to_s, :require => false, :groups => [:test] +else + gem 'facter', :require => false, :groups => [:test] +end + +ENV['PUPPET_VERSION'].nil? ? puppetversion = '~> 4.0' : puppetversion = ENV['PUPPET_VERSION'].to_s +gem 'puppet', puppetversion, :require => false, :groups => [:test] + +# vim: syntax=ruby diff --git a/environments/prod/modules/staging/LICENSE b/environments/prod/modules/staging/LICENSE new file mode 100644 index 0000000..51fca54 --- /dev/null +++ b/environments/prod/modules/staging/LICENSE @@ -0,0 +1,11 @@ +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/environments/prod/modules/staging/README.md b/environments/prod/modules/staging/README.md new file mode 100644 index 0000000..68a1495 --- /dev/null +++ b/environments/prod/modules/staging/README.md @@ -0,0 +1,79 @@ +# Staging module for Puppet + +[![Build Status](https://travis-ci.org/voxpupuli/puppet-staging.png?branch=master)](https://travis-ci.org/voxpupuli/puppet-staging) +[![Code Coverage](https://coveralls.io/repos/github/voxpupuli/puppet-staging/badge.svg?branch=master)](https://coveralls.io/github/voxpupuli/puppet-staging) +[![Puppet Forge](https://img.shields.io/puppetforge/v/puppet/staging.svg)](https://forge.puppetlabs.com/puppet/staging) +[![Puppet Forge - downloads](https://img.shields.io/puppetforge/dt/puppet/staging.svg)](https://forge.puppetlabs.com/puppet/staging) +[![Puppet Forge - endorsement](https://img.shields.io/puppetforge/e/puppet/staging.svg)](https://forge.puppetlabs.com/puppet/staging) +[![Puppet Forge - scores](https://img.shields.io/puppetforge/f/puppet/staging.svg)](https://forge.puppetlabs.com/puppet/staging) + +Manages staging directory, along with download/extraction of compressed files. + +## Usage + +Specify a different default staging path (must be declared before using resource): + +```puppet +class { 'staging': + path => '/var/staging', + owner => 'puppet', + group => 'puppet', +} +``` + +Staging files from various sources: + +```puppet +staging::file { 'sample': + source => 'puppet://modules/staging/sample', +} + +staging::file { 'apache-tomcat-6.0.35': + source => 'http://apache.cs.utah.edu/tomcat/tomcat-6/v6.0.35/bin/apache-tomcat-6.0.35.tar.gz', +} +``` + +Staging and extracting files: + +```puppet +staging::file { 'sample.tar.gz': + source => 'puppet:///modules/staging/sample.tar.gz' +} + +staging::extract { 'sample.tar.gz': + target => '/tmp/staging', + creates => '/tmp/staging/sample', + require => Staging::File['sample.tar.gz'], +} +``` + +Deploying a file (combining staging and extract): + +```puppet +staging::deploy { 'sample.tar.gz': + source => 'puppet:///modules/staging/sample.tar.gz', + target => '/usr/local', +} +``` + +Staging files currently support the following source: + +* http(s):// +* puppet:// +* ftp:// +* s3:// (requires aws cli to be installed and configured.) +* local (though this doesn't serve any real purpose.) + +## Author + +Primarily authored by Nan Liu + +## Contributors + +* Adrien Thebo +* gizero +* Harald Skoglund +* Hunter Haugen +* Justin Clayton +* Owen Jacobson +* Reid Vandewiele diff --git a/environments/prod/modules/staging/Rakefile b/environments/prod/modules/staging/Rakefile new file mode 100644 index 0000000..d00f247 --- /dev/null +++ b/environments/prod/modules/staging/Rakefile @@ -0,0 +1,33 @@ +require 'puppetlabs_spec_helper/rake_tasks' +require 'puppet_blacksmith/rake_tasks' +require 'voxpupuli/release/rake_tasks' +require 'puppet-strings/tasks' + +PuppetLint.configuration.log_format = '%{path}:%{line}:%{check}:%{KIND}:%{message}' +PuppetLint.configuration.fail_on_warnings = true +PuppetLint.configuration.send('relative') +PuppetLint.configuration.send('disable_140chars') +PuppetLint.configuration.send('disable_class_inherits_from_params_class') +PuppetLint.configuration.send('disable_documentation') +PuppetLint.configuration.send('disable_single_quote_string_with_variables') + +exclude_paths = %w( + pkg/**/* + vendor/**/* + .vendor/**/* + spec/**/* +) +PuppetLint.configuration.ignore_paths = exclude_paths +PuppetSyntax.exclude_paths = exclude_paths + +desc 'Run acceptance tests' +RSpec::Core::RakeTask.new(:acceptance) do |t| + t.pattern = 'spec/acceptance' +end + +desc 'Run tests metadata_lint, release_checks' +task test: [ + :metadata_lint, + :release_checks, +] +# vim: syntax=ruby diff --git a/environments/prod/modules/staging/checksums.json b/environments/prod/modules/staging/checksums.json new file mode 100644 index 0000000..ddabcf1 --- /dev/null +++ b/environments/prod/modules/staging/checksums.json @@ -0,0 +1,60 @@ +{ + "CHANGELOG.md": "f7ed8a26d6ebe0f9a90187e16bb690c1", + "CONTRIBUTING.md": "8df0e5be30b6bca932fb5e34c2264522", + "Gemfile": "38e0d1163b42b36487897d394a6aef55", + "LICENSE": "cdbf8d74b765504fbdf8e154bb4458a1", + "README.md": "a691c44ef6d43d9d8b543d2a11f5f005", + "Rakefile": "5abb3039d1d1652ede4f99b0f646d6ab", + "docs/deploy.html": "d9342a62d811e8d331c83a9521d7cb60", + "docs/extract.html": "ddfc7718ed639b24861b5a1d68cf0b0c", + "docs/file.html": "879efe671f96a8eaeb5fb023ced5b7ab", + "docs/init.html": "c16ebedfb85ab41558ad2fdea679177d", + "examples/deploy.pp": "27e2deca3fd5353dc8aa37c9162b2368", + "examples/extract.pp": "297e67b90bf07b61343973d3b46cb3e3", + "examples/file.pp": "5d658d29f0b99800c463dd3995c9ebc6", + "examples/init.pp": "485c058d83ed2662961ac28c0873c25f", + "examples/scope_defaults.pp": "b620b367fc13aad2ff6f09f0c18463ba", + "examples/staging_parse.pp": "bec31082b383ef5bf6f81e4e82ec3b94", + "files/sample": "c668e2074cc870f9ef59b6b33ffda097", + "files/sample.tar.bz2": "d063a08e52797236df1b769dbdbd2c69", + "files/sample.tar.gz": "eba24f899d8b439f5c461f728563ece6", + "lib/facter/staging_http_get.rb": "07b6449105e1f314e06f83e37c8d07d3", + "lib/facter/staging_windir.rb": "8fc9fd906d84f91eed9a90a32f2843b6", + "lib/puppet/parser/functions/scope_defaults.rb": "398b9a8ed521b8a611536ece0a250b98", + "lib/puppet/parser/functions/staging_parse.rb": "b0cd487f742d5966800dd9ee2d54afc4", + "manifests/deploy.pp": "29b3c7a114f002974760863838715679", + "manifests/extract.pp": "c0f72f295f7648f4f547f7ee297d5118", + "manifests/file.pp": "3cf65fc98691eb104b10fa9992a81138", + "manifests/init.pp": "702557945ee95cf5935ce6ebd910acab", + "manifests/params.pp": "171de83cf4e88f09d3f942c9157c1ff6", + "metadata.json": "74cb40b437d77771662541339790bd1a", + "spec/acceptance/nodesets/centos-511-x64.yml": "ca8258bc835dd985a1754689d124cd66", + "spec/acceptance/nodesets/centos-66-x64-pe.yml": "e68e03dc562bf58f7c5bba54a1a34619", + "spec/acceptance/nodesets/centos-66-x64.yml": "7ffa6d9164a88668fcd51a1988c4dc03", + "spec/acceptance/nodesets/centos-72-x64.yml": "194841a65e8835ac9ee6620e60b58f80", + "spec/acceptance/nodesets/debian-78-x64.yml": "56af2760a64c13a0bccd59404435939c", + "spec/acceptance/nodesets/debian-82-x64.yml": "26f2f696e6073549fe0a844f9a46f85b", + "spec/acceptance/nodesets/docker/centos-5.yml": "7be89192f37653cc187d6d5212d9ff3e", + "spec/acceptance/nodesets/docker/centos-6.yml": "4f135653fce91e0a0547f7caa0ba48b8", + "spec/acceptance/nodesets/docker/centos-7.yml": "5e0899d3028494d59cdcb2fec140ebe9", + "spec/acceptance/nodesets/docker/debian-7.yml": "4fefe3d2526ed8961ec21273799a5e8b", + "spec/acceptance/nodesets/docker/debian-8.yml": "33dfd53fba67debe3962413fd17ffeb9", + "spec/acceptance/nodesets/docker/ubuntu-12.04.yml": "cd32551771ad120f5c060c208ef48f4e", + "spec/acceptance/nodesets/docker/ubuntu-14.04.yml": "e0db14c00ab3c01ff88313df2e7b4d5d", + "spec/acceptance/nodesets/docker/ubuntu-16.04.yml": "936ee4f65c533165cea0c610a9071f8c", + "spec/acceptance/nodesets/fedora-24-x64.yml": "431cd85b87a65a55af193a360aa52f26", + "spec/acceptance/nodesets/fedora-25-x64.yml": "d0f3867787d6eec15fb1da4d9a7ee1ef", + "spec/acceptance/nodesets/ubuntu-server-1204-x64.yml": "0dd7639bf95bfb18169ebba9a2bac163", + "spec/acceptance/nodesets/ubuntu-server-1404-x64.yml": "7455367b784060b921360b29a56cd74c", + "spec/acceptance/nodesets/ubuntu-server-1604-x64.yml": "37673118cc3bf052755d65fb5dd90226", + "spec/classes/coverage_spec.rb": "166c74e93a4e70e9de79ae69f3c10e1d", + "spec/default_facts.yml": "3da74b0aff340a4fbcca9cc4eba104c1", + "spec/defines/staging_deploy_spec.rb": "80a7deb02237002d09f9d307e5e5768c", + "spec/defines/staging_extract_spec.rb": "9fb03aa76736d778aa3d1cffd54c0a7c", + "spec/defines/staging_file_spec.rb": "aad9c03cc4056290c57191985a69ba75", + "spec/fixtures/hiera.yaml": "3ac4663394e6a377d001eee1b1a82887", + "spec/spec.opts": "a600ded995d948e393fbe2320ba8e51c", + "spec/spec_helper.rb": "a177b1e9e840ff9ab649c51178f2c85e", + "spec/unit/puppet/parser/functions/scope_defaults_spec.rb": "e201417c1f5430b21737cbcd945b0840", + "spec/unit/puppet/parser/functions/staging_parse_spec.rb": "0df09ccc71a48119ca99469d1adef648" +} \ No newline at end of file diff --git a/environments/prod/modules/staging/docs/deploy.html b/environments/prod/modules/staging/docs/deploy.html new file mode 100644 index 0000000..fdcdc34 --- /dev/null +++ b/environments/prod/modules/staging/docs/deploy.html @@ -0,0 +1,113 @@ + + + + + deploy.pp + + + +

+
+
+ Jump To … + +
+ + + + + + + + + + + + +

deploy.pp

+
+ +
+

Define: staging::deploy

+ +

The define resource extracts compressed file to a staging location.

+ +

Parameters:

+ +
    +
  • [source]: the source file location, supports local files, puppet://, http://, https://, ftp:// (default: )
    • +
  • [target]: the target extraction directory (default: )
    • +
  • [staging_path]: the staging location for compressed file. defaults to ${staging::path}/${caller_module_name} (default: undef)
    • +
  • [username]: https or ftp username (default: undef)
    • +
  • [certificate]: https certifcate file (default: undef)
    • +
  • [password]: https or ftp user password or https certificate password (default: undef)
    • +
  • [environment]: environment variable for settings such as http_proxy (default: undef)
    • +
  • [timeout]: the time to wait for the file transfer to complete (default: undef)
    • +
  • [user]: extract file as this user (default: undef)
    • +
  • [group]: extract group as this group (default: undef)
    • +
  • [creates]: the file/folder created after extraction. if unspecified defaults to ${target}/${name} (default: undef)
    • +
  • [unless]: alternative way to conditionally extract file (default: undef)
    • +
  • [onlyif]: alternative way to conditionally extract file (default: undef)
    • +
+ + +

Usage:

+ +
staging::deploy { 'sample.tar.gz':
+  source => 'puppet:///modules/staging/sample.tar.gz',
+  target => '/usr/local',
+}
+
+ + 		+ 
define staging::deploy (
+  $source,               
+  $target,               
+  $staging_path = undef, 
+  $username     = undef, 
+  $certificate  = undef, 
+  $password     = undef, 
+  $environment  = undef, 
+  $timeout      = undef, 
+  $user         = undef, 
+  $group        = undef, 
+  $creates      = undef, 
+  $unless       = undef, 
+  $onlyif       = undef  
+) {
+
+  staging::file { $name:
+    source      => $source,
+    target      => $staging_path,
+    username    => $username,
+    certificate => $certificate,
+    password    => $password,
+    environment => $environment,
+    subdir      => $caller_module_name,
+    timeout     => $timeout,
+  }
+
+  staging::extract { $name:
+    target      => $target,
+    source      => $staging_path,
+    user        => $user,
+    group       => $group,
+    environment => $environment,
+    subdir      => $caller_module_name,
+    creates     => $creates,
+    unless      => $unless,
+    onlyif      => $onlyif,
+    require     => Staging::File[$name],
+  }
+
+}
+
+
+ diff --git a/environments/prod/modules/staging/docs/extract.html b/environments/prod/modules/staging/docs/extract.html new file mode 100644 index 0000000..0f46958 --- /dev/null +++ b/environments/prod/modules/staging/docs/extract.html @@ -0,0 +1,176 @@ + + + + + extract.pp + + + +
+
+
+ Jump To … + +
+ + + + + + + + + + + + + + + + +

extract.pp

+
+ +
+

Define: staging::extract

+ +

Define resource to extract files from staging directories to target directories.

+ +

Parameters:

+ +
    +
  • [target]: the target extraction directory (default: )
    • +
  • [source]: the source compression file, supports tar, tar.gz, zip, war (default: undef)
    • +
  • [creates]: the file created after extraction. if unspecified defaults ${staging::path}/${caller_module_name}/${name} ${target}/${name} (default: undef)
    • +
  • [unless]: alternative way to conditionally check whether to extract file. (default: undef)
    • +
  • [onlyif]: alternative way to conditionally check whether to extract file. (default: undef)
    • +
  • [user]: extract file as this user. (default: undef)
    • +
  • [group]: extract file as this group. (default: undef)
    • +
  • [environment]: environment variables. (default: undef)
    • +
  • [subdir]: subdir per module in staging directory. (default: $caller_module_name)
    • +
+ + +

Usage:

+ +
$caller_module_name = 'demo'
+
+class { 'staging':
+  path => '/tmp/staging',
+}
+
+staging::file { 'sample.tar.gz':
+  source => 'puppet:///modules/staging/sample.tar.gz'
+}
+
+staging::extract { 'sample.tar.gz':
+  target  => '/tmp/staging',
+  creates => '/tmp/staging/sample',
+  require => Staging::File['sample.tar.gz'],
+}
+
+ 		+ 
define staging::extract (
+  $target,              
+  $source      = undef, 
+  $creates     = undef, 
+  $unless      = undef, 
+  $onlyif      = undef, 
+  $user        = undef, 
+  $group       = undef, 
+  $environment = undef, 
+  $subdir      = $caller_module_name 
+) {
+
+  include staging
+
+  if $source {
+    $source_path = $source
+  } else {
+    $source_path = "${staging::path}/${subdir}/${name}"
+  }
+
+
+ +
+

Use user supplied creates path, set default value if creates, unless or +onlyif is not supplied.

+ + 		+ 
  if $creates {
+    $creates_path = $creates
+  } elsif ! ($unless or $onlyif) {
+    if $name =~ /.tar.gz$/ {
+      $folder       = staging_parse($name, 'basename', '.tar.gz')
+      $creates_path = "${target}/${folder}"
+    } else {
+      $folder       = staging_parse($name, 'basename')
+      $creates_path = "${target}/${folder}"
+    }
+  }
+
+  if scope_defaults('Exec','path') {
+    Exec{
+      cwd         => $target,
+      user        => $user,
+      group       => $group,
+      environment => $environment,
+      creates     => $creates_path,
+      unless      => $unless,
+      onlyif      => $onlyif,
+      logoutput   => on_failure,
+    }
+  } else {
+    Exec{
+      path        => $::path,
+      cwd         => $target,
+      user        => $user,
+      group       => $group,
+      environment => $environment,
+      creates     => $creates_path,
+      unless      => $unless,
+      onlyif      => $onlyif,
+      logoutput   => on_failure,
+    }
+  }
+
+  case $name {
+    /.tar$/: {
+      $command = "tar xf ${source_path}"
+    }
+
+    /(.tgz|.tar.gz)$/: {
+      if $::osfamily == 'Solaris' {
+        $command = "gunzip -dc < ${source_path} | tar xf - "
+      } else {
+        $command = "tar xzf ${source_path}"
+      }
+    }
+
+    /.zip$/: {
+      $command = "unzip ${source_path}"
+    }
+
+    /.war$/: {
+      $command = "jar xf ${source_path}"
+    }
+
+    default: {
+      fail("staging::extract: unsupported file format ${name}.")
+    }
+  }
+
+  exec { "extract ${name}":
+    command => $command,
+  }
+}
+
+
+ diff --git a/environments/prod/modules/staging/docs/file.html b/environments/prod/modules/staging/docs/file.html new file mode 100644 index 0000000..38aa0da --- /dev/null +++ b/environments/prod/modules/staging/docs/file.html @@ -0,0 +1,178 @@ + + + + + file.pp + + + +
+
+
+ Jump To … + +
+ + + + + + + + + + + + +

file.pp

+
+ +
+

Define: staging::file

+ +

Overview:

+ +

Define resource to retrieve files to staging directories. It is +intententionally not replacing files, as these intend to be large binaries +that are versioned.

+ +

Notes:

+ +

If you specify a different staging location, please manage the file + resource as necessary.

+ +

Parameters:

+ +
    +
  • [source]: the source file location, supports local files, puppet://, http://, https://, ftp:// (default: )
    • +
  • [target]: the target staging directory, if unspecified ${staging::path}/${caller_module_name} (default: undef)
    • +
  • [username]: https or ftp username (default: undef)
    • +
  • [certificate]: https certificate file (default: undef)
    • +
  • [password]: https or ftp user password or https certificate password (default: undef)
    • +
  • [environment]: environment variable for settings such as http_proxy, https_proxy, of ftp_proxy (default: undef)
    • +
  • [timeout]: the the time to wait for the file transfer to complete (default: undef)
    • +
  • [subdir]: (default: $caller_module_name)
    • +
+ + +

Usage:

+ +
$caller_module_name = 'demo'
+
+class { 'staging':
+  path => '/tmp/staging',
+}
+
+staging::file { 'sample':
+  source => 'puppet:///modules/staging/sample',
+}
+
+staging::file { 'passwd':
+  source => '/etc/passwd',
+}
+
+staging::file { 'manpage.html':
+  source => 'http://curl.haxx.se/docs/manpage.html',
+}
+
+ + 		+ 
define staging::file (
+  $source,              
+  $target      = undef, 
+  $username    = undef, 
+  $certificate = undef, 
+  $password    = undef, 
+  $environment = undef, 
+  $timeout     = undef, 
+  $subdir      = $caller_module_name
+) {
+
+  include staging
+
+  if $target {
+    $target_file = $target
+    $staging_dir = staging_parse($target, 'parent')
+  } else {
+    $staging_dir = "${staging::path}/${subdir}"
+    $target_file = "${staging_dir}/${name}"
+
+    if ! defined(File[$staging_dir]) {
+      file { $staging_dir:
+        ensure=>directory,
+      }
+    }
+  }
+
+  Exec {
+    path        => '/usr/local/bin:/usr/bin:/bin',
+    environment => $environment,
+    cwd         => $staging_dir,
+    creates     => $target_file,
+    timeout     => $timeout,
+    logoutput   => on_failure,
+  }
+
+  case $source {
+    /^\//: {
+      file { $target_file:
+        source  => $source,
+        replace => false,
+      }
+    }
+
+    /^puppet:\/\//: {
+      file { $target_file:
+        source  => $source,
+        replace => false,
+      }
+    }
+
+    /^http:\/\//: {
+      exec { $target_file:
+        command     => "curl -L -o ${name} ${source}",
+      }
+    }
+
+    /^https:\/\//: {
+      if $username {
+        $command = "curl -L -o ${name} -u ${username}:${password} ${source}"
+      } elsif $certificate {
+        $command = "curl -L -o ${name} -E ${certificate}:${password} ${source}"
+      } else {
+        $command = "curl -L -o ${name} ${source}"
+      }
+
+      exec { $target_file:
+        command     => $command,
+      }
+    }
+
+    /^ftp:\/\//: {
+      if $username {
+        $command = "curl -o ${name} -u ${username}:${password} ${source}"
+      } else {
+        $command = "curl -o ${name} ${source}"
+      }
+
+      exec { $target_file:
+        command     => $command,
+      }
+    }
+
+    default: {
+      fail("stage::file: do not recognize source ${source}.")
+    }
+  }
+
+}
+
+
+ diff --git a/environments/prod/modules/staging/docs/init.html b/environments/prod/modules/staging/docs/init.html new file mode 100644 index 0000000..da5b2be --- /dev/null +++ b/environments/prod/modules/staging/docs/init.html @@ -0,0 +1,87 @@ + + + + + init.pp + + + +
+
+
+ Jump To … + +
+ + + + + + + + + + + + +

init.pp

+
+ +
+

Class: staging

+ +

This module manages staging and extraction of files from various sources.

+ +

Actions:

+ +

Creates the root staging directory. By default files will be created in a subdirectory matching the caller_module_name.

+ +

/opt/staging/

+ +
          |-- puppet
+          |   `-- puppet.enterprise.2.0.tar.gz
+          `-- tomcat
+              `-- tomcat.5.0.tar.gz
+
+ +

Parameters:

+ +
    +
  • [path]: staging directory filepath (default: ‘/opt/staging’)
    • +
  • [owner]: staging directory owner (default: ‘0’)
    • +
  • [group]: staging directory group (default: ‘0’)
    • +
  • [mode]: staging directory permission (default: ‘0755’)
    • +
+ + +

Usage:

+ +
include staging
+
+ + 		+ 
class staging (
+  $path  = '/opt/staging', 
+  $owner = '0',            
+  $group = '0',            
+  $mode  = '0755'          
+) {
+
+  file { $path:
+    ensure => directory,
+    owner  => $owner,
+    group  => $group,
+    mode   => $mode,
+  }
+
+}
+
+
+ diff --git a/environments/prod/modules/staging/examples/deploy.pp b/environments/prod/modules/staging/examples/deploy.pp new file mode 100644 index 0000000..cf9ac58 --- /dev/null +++ b/environments/prod/modules/staging/examples/deploy.pp @@ -0,0 +1,4 @@ +staging::deploy { 'sample.tar.gz': + source => 'puppet:///modules/staging/sample.tar.gz', + target => '/usr/local', +} diff --git a/environments/prod/modules/staging/examples/extract.pp b/environments/prod/modules/staging/examples/extract.pp new file mode 100644 index 0000000..aca9e81 --- /dev/null +++ b/environments/prod/modules/staging/examples/extract.pp @@ -0,0 +1,25 @@ +$caller_module_name = 'demo' + +class { '::staging': + path => '/tmp/staging', +} + +staging::file { 'sample.tar.gz': + source => 'puppet:///modules/staging/sample.tar.gz', +} + +staging::extract { 'sample.tar.gz': + target => '/tmp/staging', + creates => '/tmp/staging/sample', + require => Staging::File['sample.tar.gz'], +} + +staging::file { 'sample.tar.bz2': + source => 'puppet:///modules/staging/sample.tar.bz2', +} + +staging::extract { 'sample.tar.bz2': + target => '/tmp/staging', + creates => '/tmp/staging/sample-tar-bz2', + require => Staging::File['sample.tar.bz2'], +} diff --git a/environments/prod/modules/staging/examples/file.pp b/environments/prod/modules/staging/examples/file.pp new file mode 100644 index 0000000..ab335fa --- /dev/null +++ b/environments/prod/modules/staging/examples/file.pp @@ -0,0 +1,17 @@ +$caller_module_name = 'demo' + +class { '::staging': + path => '/tmp/staging', +} + +staging::file { 'sample': + source => 'puppet:///modules/staging/sample', +} + +staging::file { 'passwd': + source => '/etc/passwd', +} + +staging::file { 'manpage.html': + source => 'http://curl.haxx.se/docs/manpage.html', +} diff --git a/environments/prod/modules/staging/examples/init.pp b/environments/prod/modules/staging/examples/init.pp new file mode 100644 index 0000000..af50cc7 --- /dev/null +++ b/environments/prod/modules/staging/examples/init.pp @@ -0,0 +1 @@ +include ::staging diff --git a/environments/prod/modules/staging/examples/scope_defaults.pp b/environments/prod/modules/staging/examples/scope_defaults.pp new file mode 100644 index 0000000..3073ff4 --- /dev/null +++ b/environments/prod/modules/staging/examples/scope_defaults.pp @@ -0,0 +1,7 @@ +Exec { + path => '/bin', +} + +if scope_defaults('Exec', 'path') { + notice('good') +} diff --git a/environments/prod/modules/staging/examples/staging_parse.pp b/environments/prod/modules/staging/examples/staging_parse.pp new file mode 100644 index 0000000..117ad16 --- /dev/null +++ b/environments/prod/modules/staging/examples/staging_parse.pp @@ -0,0 +1,12 @@ +$file = '/etc/puppetlabs/foo.bar.tar.gz' +$filename = staging_parse($file) +$basename = staging_parse($file, 'basename') +$extname = staging_parse($file, 'extname') +$parent = staging_parse($file, 'parent') +$rbasename = staging_parse($file, 'basename', '.tar.gz') + +notice($filename) +notice($basename) +notice($extname) +notice($parent) +notice($rbasename) diff --git a/environments/prod/modules/staging/files/sample b/environments/prod/modules/staging/files/sample new file mode 100644 index 0000000..01e34c3 --- /dev/null +++ b/environments/prod/modules/staging/files/sample @@ -0,0 +1 @@ +sample file to test module. diff --git a/environments/prod/modules/staging/files/sample.tar.bz2 b/environments/prod/modules/staging/files/sample.tar.bz2 new file mode 100644 index 0000000000000000000000000000000000000000..f7fbcf229f0fc0c218a89c7de41d9b62ef6406b7 GIT binary patch literal 27984 zcmV($K;yqcT4*^jL0KkKSxQcpxd7Ple}(dp0RVsh|NsC0|Nj5~|N8&}AP@iuV3NLh z_QP%hk8;A99oghyk_A`9`rW>=fj|_X4_C92g1QT^S66m)g(`FwvCS>Z1&?_6NlaPMyd-g-IR8=y?rcN|p!=p5~A-$s;P-romz zj6*9uzM7tZdv_UkPOh~ygR#c3cDfE4RgUIe&34JvX5F-xHEA; z%_-*q$HPqs2m%2B0%@V5V?<=hrlSdyWj2bQ(LE{Yphg;G2q6SUfDlPMDt=V;GgAks zN2!o##AGr6XlTMg5+oBr1k)oafgY4SMu({NG&C9qqyPW_0SQSE5i$m;`VyYd#YRV{ z)714cY>}FSKn8|^pa2MxAP@uu(8;MhfSFA+%_d@sc-1x|O$|>deu{b~6VwuFLIi1~ z1WeFsX{myrq}4r7(^CjXsj_CI007Vce~5p#{~z7|A1`b0$TD}3CW0;o9}9B07H{VI zbHA^yL8V2bK%r><_@6h|&&G>eFZ+L|wEw0*W?<9=XV@4%{v(JDQ8f)w8&Kqm34(`V z&VVAMbdHTW_Lu2@Txb|$;C_#}` zsyj8H&k9)%ZRN02K=<}fIa1OQ1Wh7R%uj2$K|*}eok2?x&4icA7k0*aj&O7h5$j}N zsAIz^g1ci?4vjUfW~Ig}b;L6PD#1ad##PTcGReboT^6X?lZw=_dSoET$qNEIfKP-) z|L3nLC;0bay*+{8mpVW???eD|Tqv9VPq){r!D<9XbBJve`yHswg_1U36Pfy^d!T zUYi}%UGmW4)IyHR;B5Zbk3y37AniP_-R)JyZq8ee01eNl`W>dPkSBusEYo1`loB}q zRT)8V|T5N_^kL&sdW%uMx0X9n5vLtn;?Tgz(fx|xd+s)(D+ihS|@I2 zU9b?CC*j&PFQ{=OJNpM(Ll`|_2X#mC+fCY^5kdTeT7{inc{bIn6=_7KFMS)$R{~j@8yx*?@+unWzSq*GOiL*>wkhh^mMF~K=`WTH}wq371z1kI{ zj*V2&twE1}vhBHM4>=)4O9C~U7yzP{#fY%lcQhuPMlnbcf#xTtn*J-}u+&c~Q%gWa zq0nhEllmnCmuPfpW>2vBP5C742dQ~&pCjOpj$DnIVjSLg|0S7*kro_d1&*;)z0ya1 zvSnu*!Rr2_h_ zNQYxaizYPTMWM<3OgnZOo9Inw;pOr&j~fmoNLBB?BSqb45r~JnWg^KG9Py0Eo2?sp zDkemfGSVWVO_o}HNW5N-ZPh;%Ygo&*Orp^aYbcAY=5O;`)>sQhF{2}I$l9h*EJN(( zWReJqhdJTG6(UdI?pH;-m*Y9sI+e#*#`<1ipS8?t4G@QSal7iS8|ooZVYZ=4KV)6E zyPE-cIAA6;Sja(Wg=6gc?b>Q1S-+qjHSTOmOL0jH#{e)Jt)dSD%Z!5-g!$Ce41w^K zmiG5a#+kwE3xTcfFi{3Wfut?43mJ!y)1`hrfnm%?B6RK%&=7Kh{p?=~UW{pqs>7471V-w$b3-CmoCJgaag_ zDU9k?5!|u$;?ktQh}Xqu9iyl+a99&b7CEzlXz?)f=EgWdduO6v`NbJuMZx+b|4S?0 z);B6myiUv%sE<&Hg|F1meL#q|zN=zTJ_;l=GzukXXj&D$5oQoe%3Mb&6+luJDE&$) z-|Bbo?us?GSzDWg@ELlc>MLHE*qRtJl21rqm&cO)XW%0_kNvZUu|Q2={I5z9M2m>8%pDE5c`{&DzZ}Ic+N+TY%kfG<96VD=On0 z&9o!u1q@rV8HREVlEiMzX}s8KLlRiRv14)=_`7C)yIJzjF9+M_mPut4VeAgJ+uO^$ zZ;_I%gAn2nxxEz^$`ijc`cfoMoN5D38QUq(q+;UP(*|U)&Z$|%D$%)8M$(Wxipm$y?M+Qp1dp>lWb+;wg4Oax<^i93I|A!2XmF=jFcbeKlpTsppRk z;=ulKhr%8eM>VbiQHyZ=->9gmZ6s5RYd~PJvX3%VX?2SCK+K9GF$BA~BAvk@nGd$! zNUMF|PwBDA?ncgtJYNdafWIeJ0BfObNkYl#GyEhQf0Q4U1>kR(-# z6<HV7RcbfvU)cBNE&$G?;1;HltDs9}OYe8=DeG zJK@@x`z|)aBgvzhuIkAx#}NG5L_Sm$eCi%$R0>XE5;H}>E&5u?Yf$B5(cGR?d=_^5;<8G|qelTb4?+5frLqFh+BiF`qX8`G)dsc;TG#$PtWrwc%x zyZjT1zb-+B7Ylqn8hBOnJF%a>;^MpRsvdp>SvVV4mpmXm1$jFsS2+caD_~{boKdg@ zN?~7G&=eex9Q|ZtBb+aRTo4K1?1gaS*m0YH=>cbgGJ6ml&#_W(YbW4F>;%JjbME$2 z^7~MZ=#Y$swCBwi!YjbB8_RZ^DEWp9X~`v@lwC~aai$j9?QVhmAa26Rq?*t2k?#2; zdIRS7*boPzO?%n{pYQcVA74~4j+{j=#;g}fY({f33RBArehbtA?ydX0h4} zKe2~t9PN9$_jt_mM(H=i&@gm9knB4V$qOhC%&G)lp9|Zp2nOPT6p=`<3M;!a>*#Fr zHh#GXh+I?;)@DEA-t}KE*U~s7k7c}zo^{6I{ct|X@11EZud`brA=rRzRcuY|-s|T< z!W@~CmUY<6ZJtHx)e?v8y>r?#PK+(Syft!h)%Z$#m=`F%UY@6=#UmE|2<`jeareA$ zbk19XN`)=J-3(0g$-ILkuZd_NKSM5EF{Y4oAchMv-Wf%OE!xnpijT2qle*knY~w5l zm5a8Kad9hNVC;8R$qK`mhYxfXZdI^mMN8r1aGl_76}EvYkltzj(!0le!=xf2U}mcs zm=9rG7A7t00j>k_Emq?#s5tfyRMfzj@zukfYXM zVA(M2jKdH>p4ALA-I}nqp4Xug1;VP4n@~qQ;3pU&h*W&{^fQt#`Db(Y>yN)}Y5-Pn zy(rnuWyA#dhtDLz8m@V?~utT~N3CT2H*1l4> z?dLtefJ2>x*(mUm<#{Z>Ie+fJdLIcG{-HegoN#8yz~S4_j~RTRNIt&>)$u1ku>1D1?0D46e8J|l-%Bo$4;afUE7GZ%v12FK_n6(7NQN< zc)Ab8rg=}pCTA{1?j6{S9T4jxz*`}ZG#BFBPdr_LzxKP5&VcU2p4YqGuy$|>(U>6z zh{&_)V$bvnu={ovLBqOH4kt9RRDWWYfij+VyK<+cGxODOf^Iy%bM|$HrgBLaZeLFj z=5bHYNLE3K4jw5FMf35ok>b@3bGu!?XWn3q7_-H2S7tbyK!%^?841?IRgLkM(#d5f<&-#dL&HjR|{;&KgU zL{>lIg`@GVD+$6gk2GR+q^OKa4paAU>*Ve2YQQKJ`m}gjS})M-M0c?1)#aFu>V<9y zxU21pY=?W>-kfh(#*h;h;)^Sw8ByTh^mv;$Avt#~^UrxGCJ=Rnvd%>C`n?Rb1cDCq zXvr;;>-Itn@nWlGj04@)(fO7c5$5K=wI#;k#4V^xdPC`rNDzz+u7d%mPw-*1t;#(T z)Mi5Hh=l{)@l717=nnnb1NTgD)pde5&U5{Rxe=J|R{ZiCR=_SF3&O@UBK4n ze|CF%ZwAcw5rFO|;e{USaJH7(mJEnvF`42u)nA|&y$V3);|4?*ly0v~!pcFyli%F; zQ??5o)DQUM(P5#k&<-yCv&g9;=`S^}LPEn+fQjkdq|dw2Ond$@iQdzlY_-W)D_70x zalcJb3fR(}(EFKpb*8LK&9O!op+GY#0sD|LJrbLGMFoG_{rkR0E`~Gz1!+emZ29^1 zCD%9kV)C_8>~h2ulABoU1x|t_Kkn*3!tadYj-S`V>VO^Zj3tiM z7rH>G`)e;2@ox23sP6t{mQ!9AwR5`|pa617Jnc4L^c{0K?3wKX#@GxReAj8t*i@lk zt-Tt_`W^W|ejiWIeqdNLG_-nw&KnZA{GDn)Uju_dwvgQf{Np#e6ObgM^VV$keI*!* zEOB4U<6R#He7EDHAJa0?>gt7L9mIi1M2Q%ekPt*1$0Md2h~9eJstCEO>N#h4 zfrcO{i5zeQ?_qK=5FnAGMU{HlFfXa><6H8rb4{JBd3B&MikrUyg`6f4Y|?l$Z@_sW z=xDQi;y!+?-M(G;DKJAzu!s&ECfP#UJB?%dcj?QbX_uIIKf<;&AHB48kx4jR5^r$V2bx_3_PG%b}=XfzGX% zyNgso9pUH7xN;D!bdxeNDts}<`**MzRp=7zS|ApQYsqc1aA*3T98u5Ftgxk!cQn0Q zik#c{(3~!`p|X9lyyJ)NMV7>CM2H4ICkvd*L;>vXJ89+1@6zB{E!H@OZ2xgJc0we; z8i2kv)dy7yCKOk0YlRE+)JgJd$KN(t`#k6Nwy`#H^=?se4(h4c{Bd zPmBm6QGv{Y6K_!#4xWM(6Zcw54u&%Lm=D!+({(&Iw{F|FAcLY2aTj#9>e2)E1Ukv7 zXB)X_LnQUI`JsUCN)GzX9_JS0IqkY=7I5Hf+@?kM$S(&X(Q+thKB!Zj09@VhD{>A@ zyVR_75X(_e;I0VnZ$j@RRVU%>HSaJT^f=El2vF7#mJ$>3fmgLxm~8RYX=8Ug2V4Nm z2s#UHW%;gfFh%jI{WHXf++gigp1PU3ZDPk2mZ8>TBshg820>3*_*{xG9r1wTUw{;b zsLX4wbMK7MBS>cUBa7t=esmVHsBIcA~dfSX$0a33-=M?+l^4wmW zO0k_kh`?FVd0KKQM+0Q{ht!6_Yf>%Woko}(^G4&gr(9tRA{HP} zUL_ZKdvV@}ZV@Dk?VO?Ny51}u_(40lq%%Z{?jsIhv+olF3_mAwZlqV->|FOZqmIA9 zfxL^uRJH$#-q}!^p2ey4LbHZ|JrH0S@85LK1z@r89Rh@=**=pERFx5$tzQhWYrpU# z$1OC<#_AKJ>^P@^_FR^1U1P5ws?M@JHO~(KY%u_{Fa}FJaq8%<1#jIYC6Mo@WN3Q;L}Eo;ze9qG|DYA3yRhiZw%ru&3H9~fc9oyc^E-V68`jt z+XFfN-{q@}8!;+K>{SO;9;Pul^Diw~uhXx~+%hrr)}eZlKc{N;H%X1y&fsSNMw23P zei2yrL@^s4o7Gs{l^9Z5=Y^I`K-fPp{A_SlRze(hUFd&_#c`eW#}IunSVOyy!a_0^ zAII5q^;3Loo_(XK`+9ccdp61ac#mFnsb?=%`JLNeTu0%4|~(CGT~ z9J`kn-plVQeBHmeNV@`5wygcFLs2Ezc*9|jzWK11VfrRjfw3Z-i=j?&2ai zWB`vIDg!$8gbRq@WB`)UfHmC~y>x~!5#SK}(}^HxBpShGrJ@{{aOpTR>VSg!PWJmI zjE9J-2qR%rw+#{1(TwSvi9{Aip>~i`XQf{1WW-lrI%m9P0Em!D=9{)`2bfghZQ!lFAphYAoQ6tLjF(aPx$n@RK zu|1!L_0p#8!}9TD&s_lsAHqT#(tm&R;GmR(i<+3cHwY7k*qcL{6==BupT_&}5i&K_ z?^xRn9D@-;PQxVlLxXc^_4hzHlujlDQi5j7umDXV?=0jRKd#)11uvh|`rdlG!w-`3 zUX7r){9m*7RoujUsfOitr`9KL=^`YAcVf(XVYcLOjU;+MCt;m|p!1x&nEWTyKh5AL z97aowHGa7K=Yr;qUu5lB=W&cIU_NqagIGT&VOqsjlOadhI9VFHq`Kc82ZM~-!$YKq zk)A=fUkNqx{@J7Ipdrm!8X?Mo0--~Xz~{HueTCL-<<-&-L$}Xq&eN;2MW< z!EohOCP5b3sIn%IkV6>=LFS$nbC|J_*1fWBh9}6?jTx;$u+rN_qLa8zJ$Xj6gv6ir zLT>d_p_{$@tiSM|hsou}GWS{e#) z?HIu2pK+e^5Xd3|em{?Q=&#gG^O-L#C5ouW2F`{W(RdNP zbTG?V_5(-Em}9KQS;-9BQG0&z`rXqZeq5|eMu)^_%RSmbOyEy+Ir_mzR6qH-@V1hmJ2%Zt6D@1B^Yn` z`7yTpY^QCF?!8zZ-rVZrDP1=X+MB4w?ax0&|HpsH{XY*cKbPU=^M3w*zvbKA+x|X2 zKb!RV{yu)cA76W?&DY!C|BqLL$KB=g`n;Xp-mg!m)#?AAPovTFdjE&l5$lwFcXR#= zyyF3=Q+-ESqPwg3UboO$yc>8R3@_9aQJiJli zDoG#`h#>_=B8or|sse^80zaGH75r5JE7U*nzcKeX z0RSKK*cD4nNA{r5M)f|%8%gZZ&AqFTYgMoMtoF$B%ZT`#-ovKRF?y*Aek3UoLX*NX zb%{NwK+F(;1t^DTP*9L<-TQvj_Fv2L9Sgtt!|?M+e_>}2 zi(U7Bb<`U_!+VQ|Xh6#-?GOp0l5m^=PpF|n0Ch%{Cc#5c?%DvlAaOulG z-rRws0w9Q}EMW)!KTBvyVg7iKDM=ypajrMlj=BU+`To7{C%E~DIRy%YuevPWl8js+PwXu8Ej3UGK{KZU|f)Id70X~0s2Ke6DzWBq9 zN7y~?!;jI1g!#kn;OgA}O+*#Pk;XrY$T7aWDZ$GfTf@a6I=|r3f51-PCH)p^f^(X1 z3;0u^G@id$;servAPkL%t55gn;^vk)FPF2<2g`%Xg*cFWhp>Ex@E*@!+&a@oH^DuF zlhg3s=tTE+CxCuFf$#c$Bp~+>&!?b#z6d^FA8%myk8h{D)A9NHzfZh=p#F*V0s4MF zeLXvVkT3J+)6-?;=T~yMdd7bq$I(_YODa98(96G?|Ifad@$Ro@FmVs zoT8sRhn7nccSb-NyB^okV7a2Fk9ro+_vRgySFpojTm2GYFSollh2%$DhiXDT+oXw* zhqMvBuCVf|B`3c8XaGfPJ`Ab7`Tsxb$HzB}PY=gGFiM<5v%YSue6<_6GTvbc0rCzMy^Z5>b{~UO_a$#TQgYQBJ zyzW8>;g|KwepB;@?(zQync*+c`|q;S)Ivoht}%`SrG*08Hai@Ok|`wzDsUkphR+L} z&c=A#VAabuEbum}+jC&x7S_pHc8(iURda4w;@WaYWU7Uzk`~%ggBfg1jsu9G;M0*);wYs4qk`+qoql1n~Re=ccJ(IpPKKfciDF5O}_E7jfMNXy$@0;F?m^ z_WnaN4b^TEV;vQ#bV%P~-B~ayu?@GvOGO7Q4jdCB!U%SR zHxMcW-MkA6o_UrI4j^_emkl4eqCON#uHU<#K4wP;(?2Szs#-h^_&Px0(4bF@SF?8O zA4rz9jx*f!qSaW0IzNfuYM&0EAH*|v73N{lgBnG@h^OK7`;RcV?fPr)(elWXbDue2 zmx}d0Gc2+)4*qY2NT>D&!G%FogxE<+g1`CkHba$iINO6$f>@(0vM+OFI1ng3)KE5J z_Q4$U%(Yb}q%ktc@(YJJC8h~6fE+c~Qy(q4OEuB?%ddLM4}3CtPDfL7HRW$cUy-$VebRS0r%^-g5|vDV|!|*_mC=O z{8(WS%p5_On}uu*ZagF@T-E!Ck;U3lQ|EP|(#RLj5NfXQ9lNT)!dg~N?3c`?j^gsA z{!+5de?+eZ$h#{zf?)lO8wSjzIZYi#Oq1f?kowFv2<++K`9r>;HhI$LNK!09{db23 zp~8sr>xYifjrQe5&bHZPuUvymKXvz&Ca`O9(f=73B=5%xA~)On_VZ*qUrYY7=L^A6 z7JtW%vb;;(M_{mE+nb1*{Tb^C-UX=&NnV> z!@6T0SNkF;E|f3~GgY=x1Quqs!}AsC->bP&lRVn10gCtH-!l+sWo>A|a;p{Xhu0Vt z2JnslL(%b9P+QQ`c#797;bseNYh2U^wMs9a3$!dqjxtWN&{ct|*#V{tzgf&I;u{5l z%6UB9R_NKX4a44c^I1WS8;=HPV79n}1|gt;^VZ1QiuvntvdqGo?49o7();b|x-|w; z0S9Q^5P}^75ku+rO&{q4#U3E}GeH25%^gWRV5GSJ&3?CsCBIkh<2bBgNE!Y~tC$t@ z(4(yE{Ke(PRQL2b9{@MwGoOzd?|w&#$rBPCezQ|l^7u*W`gzU9`S8oT%fsCWht1{e z^zWj|{EqrY$$`uNpTPouVh8I_sgNK7av2XFA0`*q1;7vXf|`z(DBN`WWrOT~d})4K zUM0juan??EH<=h1nyLoa7J;11;oYc)m^Gv`1;D`6plWd-Q6G$^*#N(Xu>RP3DhBMP zLU1>Uy%84(eA0i&y~?ViTVsrxKX*hqUYp)(|0SUXJNE7RcVY?wk)j9N9PpR=(r| zSK2;bexK~B6%bGHpaI(fVS0Q0z3Vr?KqzwvGv!0Hsn+{wx|2?C-S|2cUVROBAAgS?0Pn|h z2+YxN5oFnFGL|q}ZdZ}w zB$7@UYk;oO`otyH9mc7W(f>@$r&|A}RJ~Q;3pYOvuU$9Kb|kC6325Cdnk$F--FOwE zSGMmK<{ia2a+bVuw>v3d1B%U-;!4@8ozndEsVg?cCeWAy5@4j7u2-h9zgp(C_KS=4jMaSd<{MVF3Y<4*%Lr6&&lex`P$3%nVl$qCX78a+;; zgcT}1WLY2avyX9JJ{}HEk2?5nom_l>P39N8m%a&r0CGBb_f;d-7mebY(%S>-deAqF zC)YW6*Ieat7Q;S`%Hzfs)@ZiRtqVfs56Z@@vS>Wqi`S>RJ?%Zud)oROIXO8dPo)f; zoSzpb(CW!{?v6hS(ZRA!n>arcqbEYt9Gsn*Hgragzna0p!NI}V$;r{l$;oRXzJHMY zmsujZ(30G9GW8-)1+eeQf|CaoMY1t9hsjwmqC$w9&*$e)j#DVccOs6xFhfQ_qhNr-fGxMJdH z)F3-8Hwznth_0O?rT{{iz*&IJyC|(Zjl@8_6)`dt)elHpfBAeZ%g2ZAmoE?Uj{BaX z0u(=d`O70v8t(LcUXR?^Q?J6k-*s#!Ux(GCW?zTAvFCN!&pGXFl;wnc+>w3>st37X zMPQ?iR>F(j=!?%ftu@#0}*1N*x6d;Pz2`RJx6`uHMk z2o8lmh?8>A58myq&)3bvbFQ9;waV?GL29C;Aex8(y8WMCKspxa!-YW|4lykwUON>^ z$UYDlgR2N2Qa~sZW9$I~`*+IYaYQH=l(5^~J?$f;i4ui0w0L8W1M7g$zhNiBfnI)& zCODucmn5L`W+H-$0M*J71bW6ENH}Bx2(eZqER+Ef93O`F*xy+lAn@jX))nRQv`P&( z3&Q}Q{QSKK%+jdZx^U}3{++$k(k5~MU0Q?@3mfU1Z|sGumMr72}8mXfJ3Qldji zq^dF^gqomeps|@jC{RK{?P~To>~Iex9r-ZB$0e-p0KPX z2&fAsi*fun73`s`2c72T4`~lSx3^Amx^&~j{=ND$>^_ZukAIDg!|P<-of-sOkwfxi z7y@x2NiHqk+oxAX)g}MvkG)(<*q|liSNe3wm?1TQ@By?AG0YfU`^G7N@TF=3ZqzOu zTXt#?019P_?QRFY?Ht4E=S3!@wfJ~qSib%o3V{y_PZ-!Jz+ojlY6rYdLZJro(~DXt zi|ouj*Q^NCsz50O=sK4iu}2!%DAA$dcw_R9U9cJ~@!`zVp-qjGuo^| ze;9ByK3>UKMZSrn=k<|cq~lR;;qoBC(r45>@CJ<6kwHmrN14;S&+o@SGaS#i**e@e zn}~}AKv+SGAVw-83lu?C9_ng^?`kOy^7K^pq37gzn?2{auN3LF#F8fCx7KoZTm9wB z#t9>8Br!8O$?>pzqYz<>V3Et5!YST`DFz<;avhD4L(}Su4@rtYVOYym;Wt{WqKFb& zvx+(ZA*2v#fHC2>&qd5HDCATd0%KV?HjxyGql&R&-O$dDMBq3r)vpR%JzhSl>pUlK_;coGG@W%hlgppXT-F%qrGm(8G=Y;?*IcFWaH+^Ms0QO>yHfJE0 z(u!7lk=wwaaWl$5@Gek9UDu~RJ(fIe8+hlh;j?l`92D9};7b83p$(Fybbp?~y@WxG z{oXU)mb*-$6ym7XPXpu7>@>?Grw0>KixS=5<06P|10&Bqhn0}1AjpPJ#0j}M^Ok}r ztYGpv3dgEciWzoMJpDcNi6e0s#=)^22Z=yn!Bn;t!-`L(v3dfVwxLybXJ3hgQw8GCB2%s*4|8wY9KXwzaKN6pDxZW}ugz3=q_j$aKs>7L5M8ht7Mif6{$_TQ%z-@w|t#rcIGkEF&Sg@!eNV zbDZ7`WJG{@Xr+NVtZiaM2q-9;klh7QFg1B-Y>q9$J$luj;q)&)IP-V=$LW#;fg>a# z5|E;%C`q6ohA5z>B%q{XNNF$47^=mB9g{#?HpLRfM9C!tRa*zldV79fM{o%3eU9Bb z`6eMEM3G4bMT|m1NkLQ;P}4+FQ3O!cBTzzLM!_i1QBy@xF(joW7{Q`RKcD?r?$ zlScT4oqRp#=fFRF1I7k%8(a4M#lb)695Lot5A)bNow{d{+t$ijsH&uwl?G_CQ-;^6;)76Akb&-zo+rzWdL+o zN8Bw5!UgO1d%gb!Plx62t-W8$z&$tLDSh1Bsoy-w(apT`3G4MQzv)#?gnc4qjx7HS zSuuLE z1tbS!_Us0O|B@djMF+@<{YIwlI)(x0A}jaOf3N*cI{1t=G5n|Jq-O8bZLnA~rH>rt zIC{T8j(m%B@5#-ljFoF89`KF{9YOn!zAr1*Awzt6bPlss8Nl%j}Q%>`8S64ig# z?1yzw+ZyQ~5V3wiqz~~*Qz9HESt$=@1wZw7`o&GE9dM#0sZ*_i~R`=dEiDcUbCFjSY(W0Nm}@r%s+Usk;@|^jn;KY zGN@;R^#{}YJiDRkEiaUj5Ay9C$y#u1YlnU3{y%PG;yvvI)g1uyG!vSLaAD1;0m?<9 zjTw>E3nAeZT38gpm{2-7xE=+|iWv%xI}04IN;LCkHyN{7?= z^WFK4bb;%L2!j?Ni7J4kq$-4{kQF-&cJW8v{vG**fdU3bFN>FI3PgJ?-dTE~2nm29 z2U~>$F&1_%_i%*jNeDWr(ay-Co&CPP3ic=PjSNatN=Zb8SDUpDGMS`8W+EgSIBLSh zQ3RI6%yhfgiCUfcy0Bm>0A$m$1) zA-`RNmqG8o(Ny8KVFA*l!&cw)5IC*@#8Y0Kc%R*l#m-vKzj$ym^XOxs8*!lqC<`C0 z3I&Om!>tVJv^c8?5KVyfpRN$a9$}5AXfayGxNtBL5ggkFT-c2f5Ez$F1qMQU_+ES-U~skg2w1+?#=et4&T_bE*Cf@hL5!3ZBw`|LZN!@xR96e(9sW%!JdSXu!waj=337N@Krw6PQ>!&^Ws{JZzOJO1XtnreqbfZm4tR-2k zo@cWcn8C0(Fdqik+f(QE??YJ)-SxKkt92f4*U;r80PqORZG9(V3U?W4BbQrJBT%&z zENxb^W`eAU+SqY|hza^3Q8WbRoHZ?RVj>8Pa3rW_QZrHzuwlo=OQ>7v1R`YoDDH|U zT4@tlrxFRublV}Gfl+EkQY5{wpmfCsA&L5a2LM&28WQq4{~vrb`Y^V!Mus1U)}XB! z(@~1cW_P;bz6IC;a!A@f2YK3F>7WsOKP?Jv0I?F`)a}W|w{(iK81OMPUyKbzjUiN> ztt1Q-o;wCLlSxUTq{vj!NRO_Z9FT_eS(q}Y#@NQ=gB!{~c9sdY9Xw@V+8YUF%rhGqRWjm(X|@Oo$kO9P z8XH+4+TKdBki070n!%?2yFpQ9X8C2&$M;NLqiYR?*{0gB8qkaJ-9@FvmtB(8m9-FyPX3`AZ;|sORZ_o z>dP!vl{JSdizU(+TCZ|r<3z&BdHvOuv1rkRA`NLBF$WpdLL9JcHOV;?kqH(fsl{Yi z7Z9O>%5L2OmU#~oncrxJS?T#iU*AL3T)^_Qq1^H034l6*eu0J;MutdmRLXui_bN$& zo`*iauzpCg(uDwC*%#&~)1WczG*vlZWc;!_8=;Hxa|MVs(l}|_P)D##Aj$3FvbjL# zHdXp5RN68zVex0n29(IcgSZa@)L2u&A#n@BsO^Cp86oIS($pPWFsuSUA+4}IJ^*tG z>>J`Pq4SJcoKdF5D%*ODB!G6H^7HJOzGvC`v$5ReK9|$U`Sj)*GPXC?z})+K zz=;~S8Y6*}X%BV@f+T}v>h8|F2Rm|LilFVWP^VV#Ld_!fS4P4Q+}EeN6G`doZeKbN z*D0~Wy6a?l*HM>(NtY}Z%)>?yEZAm=vZdH9(d2DOnvB4b&J%R<0B;^sAgW=|k-zlW50hV$rVNMfX^O?Sb2exewspqyaJ%V`@1on<69&)fCW-P7=n{ zz+|%yxFeuJNKqoNz&=3R?3SnK`_}q9!3@u4*xmYo=TSr-}XpuT_EaQo}*G0J- zI}e*v+qAtHcjp{~$QU@iVabNv#0x7phVZ89{Nr#dF~Lg*iqtyo-h9?WXR`nrNXZ%n zksDY}#PmWwJOlix7&?M*12v z(sb9VH{VQT>zVL(Kz+q`fE}*gA-5715L_UL;NLdlOimw%?AhdUcpyHL)$h@x^tsaL*U197%&nQM|#zz4*;W#6L;D)*Z#~ySZ3>(-*;Sv}U zBpHD!`5sFUaC_xayuD1Zh~e^ZMY3mcQn`DU(ar=SXFbmM#{#mCXmJIAo0^McGOUjM z@bzei=?>c+U^7@?co>Z16UB2m0$7AWNO5XR9iE~GLX^ID%QO;cB4PVhr!4f&<+rMA zXF9-rbOd5aU0}L~Y2qyt>Sa=T-0|0A;NCUgVUK-ji&{$vUjI92pp0Y4g_R!Bj4a>Ms~P&_caE;uwN* zL#Xc!V3;VDpHr@a8#|%a6>OeFMk6j_$e88Xoy8x<?Th z;!a?sc)V{OrKllbIF~OGKEeon)|(_aI?)z>TA17* znJRHU?v}fwV=3qD!JH7v2aun%uU&sx@K{ged7i-dW)HT(*Lq_G0FE8NRRru2>tov3 zqY@7@N|Ya_)h8|2Q@NKBMd`bnw;u@MJ)otM8XV#%NK{rBD!Yt`Bj+`jdnw>C^PWG&$f!KpA5P@7hBZKbab4KA1Xog9w5$ zpF~DeAqaVK20aY%eE8njFxzLI3~jBXO47!TvG2WsFbIdvgqc2*6F)(L1t6?R+un$l zC@AbmZ5-}eSeRgJ5GJPW{Q>=2CYXwYhzGI?Qu2f72c!=pvllExH>1eloR;!s>vZ10 z_=G!M8~<{}j9C{l$a@AMr6+1~4e5`LavsJqsFWfI$}ILqN1zv4@#%B9lt#Huv*?PQ z62)(8g2*9E>wa9r&1tu{i5s;R#z z(`lxCr-R%SdJJPjJs&g3@~kA{hp2cH=`KUVkVEpp;TX*7IpBwSFAtf)g03f5$(|^n zje}pe)oFd;B*q>eui#FC#jL5hDhO4kTpE9#v8{y>3Uar=4DU!<*R@8uH_JmohcI zM2dD{RXGw^Q5zs9u_oe2!P|<#gn%;>9G0pWcT8Ns?ocm~tY>#z+Rm;l}3sU!8<8gJm{fng*Eo z@}xT}dTXYkpiz-UFRXU7W8Y;oAer0Zrt~CE{0YU}yTB)iFS2FdwwYvZmzTpGIyM}< znZCT>@$v5oTqds0Zn!gcow8?c!5kmpl|8J;ez@4mI(LwWeDKU7uo)68V~Ak5$0u9O z4-Y3!+zZ^llX92wnmW+Nu&cZV{k!_fMy2@}gsJ`JI08)oaQ9e_b5+P9=)n;IXRT3T zG9e=@Eym6tSp}MtVNY9CLhH6@4i_!Req!zU7~-NcA)ghYdaeYH2H<;6Z&Zfx5zdq8 zJ`G}>_W{T;i%>|xLTOH+!_f<6|k7ZmQywd@`nkQ{iJnmQK{ zywg}sYn94R9E}#BC)ose0fbVJ`eWc7))^tB@$x?ZhrE5HAEL39pfM(j)LMH{FXU@5 zh*5(RAjHWe8M5}5s^z-jW1P*4EjlzBqAh6(D3%&Ci#1lO6O|pxoRg;$3Wcx$M@iR#xnK48tV4x&IsEm|AZnd%R zf&BzA9H3R+D$0a0{`?CHAYQ3M1rr0hkpn>E3P7?Y2P?FIePj^*aR!J0S-f=Sn4yGV zH;5n8`?9-=Oz~vTv-qWl{c83sO`^FF3xwbxfdC;PUG+lI8z*mgati?E9sh>bL4RBo zaU^6Wiszgx%<9X=i4%MSI2m;;QoRxxs{>>RQWlUq&qpz3N(uW6gRnpj-UxA6L{&NR z%Tr=~Dt8*L!tZtufCGYrKM6zQ3jQ(|sKEl@q$*R&ef4_F)UPB%u>u7^NdeuJ9rmDo z(Jvoe5vM{IhMVqcxgS_NJSL06d?S?4R#^!k>5*+$)EWC&4G#@9NAI;_Xl?is&(Yd5 zRw)jY9sP!wlUc7b3c#R}i;U#9FfP&-vw(@{ANUMFG6oq|2X_1n)xq_l$6sz1_7Z*| z_uv=A0Pe}ih<|zfL5lzT^t=bLzaca~s1+~^?(hz2@5o3*{SlB>Kx9!86-8ImoNP6T zqJpU)f|y{Yj$;*aQ%Dt?5K%V9u0{!b|Ig9}?a|pI`0vey*jvH95-ALt1is1p3>B;X z+ZR6gQ04rUk_H@Q0WsqKT9l;&%W6YyLx^;X2~b*vM5sas#Mam&k{f$fGTdoFR3Ygi zX%dElg`j9?Xen5brD~9>f*J;aDN>qgq$#ReK&FwQqJ$|5LXaW`l9Hln5`bD-XekOJ z8b&1|Xrh2=DGH$qR*FJ^pdx4}pokKgkf2%=hzg;igrt^WsA*V$hzfUyxF_+LgJ}EY z8vM`6`>&s4L89U7&jNW&7uz}P zlv4+wdEo9sct=lhUY!|uoC&5O>SiiR7$Pa4h$f-}B&muBh>4k&WU3k_kXc%Sm>~#~ zf+i^#PBDW8#xbgr2wQYNZS)%u`x!CRD2HNIexif2;wD`Y{ zc_YM-C{6Dl)?h!!`o0Ii3BsJ1D4>levJ8MS5{2R!{y8G9Bz}^*dt-4k)z6Fv$=18N zIDUSIxCc`G`xfcVKaT;WGrxyP==V0)KVO6DnDZnsmHY1#%}O7zVRF%viiL6E3CA_ayn*SoU| zV^+f|t^{(8>OwK^lvrS5jlP6sd-n!X5m0`1#aT?$nS*D->S zOArYilsBJ?f=HNfKFaYJ!aWIOs&IM*fRDi5`fg3&=2K80&epHQmZ5&XhMjOgc+}=_Kq(K=HDHUs58G2V@9so9RUUij07^}`?E0S z%yTIIqzFEv1I#ZxAYkPLqooAqoR_me+{EI*HSp56!d3rfRX%(w*Kc0{RHCITBB~^& zl4^DM<|gTcFA%>czwY^bZ_G8{IY7(59vTf}+P8*5`X8(2Tkjw6i2@A6@U7;=FSk1z zZEMPC(#WBl0o2X~-yQM0sKA?m9&4RtY}&;>26t6>V4AYGKxRU}d~uPFngMlvK6TE6 z?=B~w6aah~4$kyb$A?|ue7Ttr%t=N~xL3vU^!#Sopnx#^z;X{tbc_wVzmFB5MFJiF4X{6yM{7iU!?g1&NZbbbXA4@sVhB4xdGU>oNxf z?TUhwB>@pi#8S{xMIcZsKs7K0DM}P5L>&kIOm}TKYSx$VG?pzhL1S`gV9&uM_KhV9oQ5OPHXOgj?U%lq@mI7%2d>mDE9F_xN?#8Gcb$o5h9WUT7J)sSVARYck9bdnZV(=dVp!5~n|Gv- zX@`<OjTQD|th>S|S7(y6lDSVJ^H3p?A@5nLYBXYR!yFetOJs@83h$YMMfx=(&ss_EOBY4W%+9eVfX_+9wJRo;VloG=_SU1 z_nLX*4;x8!S%YyEUUr(EUq)Rd*G+T^IaS-G%QQfbVGPsYXRYXtTSm{G5G9pHMyJOr z#A0w7ipUL(j<|#)VJvDVSzc2xnIw8k1XjthYB6iB4-S2F;te$J*;FSrX{Hths%oPF zw#Ty;L7_q^$+?AM90@o{Cm3MNgwZuv!HuRjb<(w@QrRrWqg5<{ZyCU@7!8jWq>%wF zX)G@ybcN(7orGxE;DuWnw$r2v+{*3l`*241Zf$eRG`G4tLgT=5!UeRvZfk7BN$xo+-YE<5k>n z#xNd$bmJu|@NXr>U-`5OSVEW8XTpbvq2O`#p)-@Vq1U8oKC}RrD%Qrd9 za-sYn)i+QOk-3aajU+)q_@NxfMWN7OaCY(G&_pHNPD5lsalmH*Pj4R+;vM>HIy*am z2uW>ajjF1Y=ZWL|W)`+%iIbx#UW3%|B3Lyh36fbxF-2Akc&Zez(ep{zac%Je0q+R= zeWDCp*MANXEmai}R6lIu zI-Lwl%6@I*Jg@Hhm{Ydi7DKvqiMWZ|17j#fJBV)}{vL;>5l&1IgxC+s8Y)TK`W!%` zn`)$kX2_dcB5ZFNgDa#WJ9Dm*s5JBtRro9EXa7zHtWdwZqckUeO5S`iL-!t3um&7QH5 za0odzB&AzBN}3*F1k;>kB-8_r8&$#KT$UmYwwy`E$L|8A0|Fx9WPDQ=2uLIg${asn z0M)>e@ry_V4hj(sIRMf6}Z_ekyw7i$m z`E+nFvwIi)&W+JAW*uGz*tUd1(R3f%~~u7F|y~StR#kkhBF_Av&=qka%r6b$UR*R z#pWqqaU9}-n0H7*vZdi*n<_OG(5E!_JMC8AVKpJ51a%_Ya9s;=F-DXPO+^ese30Yp z@jY|cFxlJ?b%d&##>#Vs15-qXsfcPSSe787d4bbOtwl`%0TdM#6zf+ps;Gn%B|iTF zP6uU&HKD5`J2&n0nT6;j+d)e;YFM)aE!uZBqa&j6K7sm|_)X<4y-cH3<}k67PQha*5pHsGNO|iOWVrWD}%byx{?*2*rqp zG<7LCK1W1V=A2Lx-y~2_6F5v4vjRK;1@t*}t`*PcL%RLG&xHYY2dYr-h@Eoy+dm## zO?OgBAxHDK8CSeYp|MUyF;e^*TfcaZpNBz;NDr%M*g}>u4yKJ>N8J^q z4%jr{e}!5`!v{0Q3KiE-ZeS}zq)wOvNIiG!hc?hJQa!k1R@x4vHAzh(V-y-AP0A1` z%W!neL_pB8kEXlB7!6(reI>XiL2QF?fgA+@ut9=iq^hE!YH6vWf@FY*s4)c;5_bnP z;G_xD(qvYYTG?WySO1xBUDlBd%SlYrDAlNKyxi~iqueTic5?cZZd>6rWPYn&4R%VMs-PIz1b~&%ZGf4GlsOL|c`1QeNft$f_n5$e zV6hp82x4F$b->|Igt{~oIT7IQ#@y@@Z-BIg1@B_ij|(Y`f3kqUEFmKl5Hg2& z=5O4Fs1^eiT7uY}fPH@*(2(-`e!JY12@AU<`H)0k)VX5P224;ele8Ryl1Kw}{w{Lp zmg#V_Jcp534~&Up5udfhbYx9{(@WQi8Ds`3m~$~)+CpZPt64LXFv1sPpGskqkcU&> znCe<)hF8h}rFCuje6U-U5==0HKL$)YZ^|5)Tw*UoHoDQl>cz3Yj3FJ0 zluc{$e_9ZJMgqn|;tz9s!kR>U(O=c*0A28!UpMDZ-GZ0hI~j`~us)L&LR2EEBE}31 z3@CyIyu#DqYu>_5_YWwFhlKh5HAFLksGMDaj0~ilk=+>rleAv4 zlzUjmGH4eQF^&f13R=)YgR>6g{)^m0g#BtVKoo*13FY;Ibr6*wRi!CFpeQ003KfU~ zhK*?XWO5}!P*NxX;4>uh_ncL*f{|7Sa~Pt|bpjd*Bi4a=2yHJ!v=tICFp?VTxR``i z`!peI&NR{lgCC-m3Y#0N{l(~?mKOglwk(?hbcVe>X`?3ip!z{&&@3R`DxM;qCqQC4 zfOxV61uYDYr?;^3koP0H!vhsEiy$->(e~DN)IYZ9a6Xd^EGg>+qTe-fGUtj&q6CPC z?n$UNKTHqsczgZ!@AG#~Rf!K-$w%F?O%#w&Qc&KLyv>f`yKuGw7!Ri^ab$x{4ssN3 zhDvijdShd8)-@FKat;(zNKh9nUKqvO7HtnKU=vH)78+%N)Sja7n+Lo%WLOi&kR)v_ z(<5m6|8i0)Fnf~il}iX^R|t0_wk5*a;p`2R{&=!vA#^^-6d-CkbNP;b;d^2Qph?ys z+ED={hIBVTqd0aTup+?H6Tvjo=|jZSz=k4#_1=fIboKwBpQT>)JTfTZPFp74S~X825n^PXO{4yog)C52hxTaC#fFw_rdu zBKVyBJ{xrJD+aZi@u!Bcw*w1vXcK-5pTKo+aR_3<0O_xlQ7+KMRg6WWD_9rO zIjQ@KA+Q*0EbgdL#z`IJ0KvipWk8I`D^`>T$nWROJcvv*CE zSg4a4Ga{)SE@epKL$Hn{67d`9dc9rkh+&N=2i;m=CU|9*dxM`$Tf<<{KKY+w_N0%< zqxHjoRWcDpIF}m$RiR^~LkJ{{iGREyMT20$=}cO#tVDk(@Ct`+m$1 zKK>>RcYf2s-W_4IWB`m8k(1j%iSrWBR6-R{)l^aa-R5TO=q9kP8ke zI3ng3B$7Gm22XtZvcbzrROufRY{b`?$jJnJP01Tc`QR-4`eEl%h5*`esp5wQUA@aa@*psQ^k^%dvoTtQ- z)&S3uG<|8krQ$D)g3TpeXaFAQ z4a=~@2qO7$HymBWfOen?DWRc!{do0r47EKXR6fjjS_a7^7{ECRGtS^>SR0k;qb6Po zsv|qvR;qgwl%koFk)R?bWQd4@B9gzmw!w%fc?D`Nwn|AZ#nc+b!)H?v#2hkpa5=C+ z)3FVstCOs9cUFg;aCub{X&hW98)~jtgJi)AMI{3y6!jW*>xSKP94OHoy12zGRSvRO zR_g5(8ZGAC3t>O@b5#E?XIWZ)itX5sU(ser8?_iV8tw#C9gLw#7L4i^7*Ly_L~4QMDI`;r8hkSoa0CZg+KzFmR5+Au z_oX2Y18@sl)@5l zkb(xfb=uNj(w^d6rbnVU=B&ZoC zq9!5X+^%}{i0H|q5z$&Q@(wTs38K3gcnbo_QlU|zB?UY82Z5pSx?%_hQ8KN{hi!vV z#8HyC)3FwnTG>XYTUBtyVb~05po2w@qgL}DVBdlvvi0w5wTMA|3ZkGNh!`d2qa~Vh& zpF-6^3);Cuw1hOJUKZLYjAZXn!AgQ8EVxdBezO84^HSRVG5~(%HCC}30+Hv3U{nq# z`Mopz2%_x-0@x^aS#g=WC7^8rd&ChmI!WC%*DUpcIq>mLPPyfwrVz$It!|)PA$^^) zJV?|z2DpKabyP&vfrrPzHwCanhQV{#h#0|65=~@L96t{?o*Z%~O|N{zY{a0ONt;BL zU@}1KjEsItBy&-@karUP`?o;gP-r5cAOiq4k3D88yQiP)%yd|Xp$?5Wl*D?;x zy?bQjH+JzTH}upnhcV^}%yZYBu2oZ2MIo{HDL%L7NXn`fCnX1v(m2O zhhZXi28Wu)TmS+@_tSj&^(Z{L<)*PC{VS&}z7|d74#f zOL%AG;EWz^tS}Az?NuIx`jMQ-BjH*cX8@9M^jniJs$9AoG<8Z~AiR0Vfz%jMs@H%VNZ(?Ss-@421d$h~7d$}V z5mtOV|6egfg;qt!Adus=_0)HoaD4G%6ACDt?TvB(A=&Kn=lZk@3VQ#i{(t`eYkqu{ z?E^I4K+|gF&NayN2V5V(v6_i)M8u1#6}Qc#MLZx>K#*p9Y%22s zcWe_-$XNboEDVdypdq$&h8{7+9@%|_qJw*xN<0IyDIn=Wg1{+6YODdv?&=sp1|qRX z3@Ruf&9oF(DM`I1(-xM7~JMio5?EwuxiY{LbOrs!>i9sZ5QL66N?*fwfN*YvfK(VHt#-3RkTajQb6O??In<+p>7*RwVuner3_|_kEfR(f zPPYv!QxNngG%BLtac&=j!xUxFAP_=Lmy#3YY((rn$rU0YRbVS8HU$C+#eu24scO8< zV<9jskiic{DcTS*2P*DJnwjEk#jvf6;9m(&G`SDL!rOhO^^VZu4IMB%%&XvsnNI|} zC0DV67b6^HuJ4_>fNfs%o&x7i2@F!VLXEjH3!)C3ZUA>-LrUc89ylv9@DyS&bqE~c zoxyX(9x)bSOCq}`c=pi+o43|iMaV@6Rj1ucT)OKKf}V08>h4)Fj(Eo))20vI+=*B(jXRNEKo9rOhM?T)F3N7L-OJq zkg^PzzU~0zixZba2~QZYISna9hZHAlIES9ZuIb=nhFgP(kkCnCLNH;8h(WY#XSM4G z9x76(Fv%C6f_kjs3^9OBXl@zR#u|YDmd|N7$e|2`=|n9EQy#Jr=;Q&~<_O zj2Qr6@L=yD7>0;!9qAdMP)!&u8lWe5VPGwv4dkvGfufdi+XO8XL$W*melm3RZSd67 zbO&{r2?t<02Kecg@(wWrV99CxqLe;&XPCp^uVjv|Y+E&*nT@cuc>yFB>hkWFlih_bl#ewNX%T-#gZ_aj8w0+Qr<|A9c#p-To^fg`ZkWVC6xj;24sXedC4qnf(g9ZCyc6>*o@L)ioX@q#K2D5k05tZqbbk?4-T{1pJi zK;M=K5703H7-)6Gk>gAS{IFYsAQ*h!ak$3D8I3?m24mhv=%wwCM@uAjR<yEmZLc^qpAz#}VXQ3Bnhgcg{IN&DJ z6HN)U({1gAacQBTCQxdKOl69c*2W6e0j54k$#t>TFj^?GXo?F|V$rt4ENmI88xTz0 zTsT>(#O<>Yj1ddbY);waitbq8(=2dg2?>m{kuvxYwN>%`UOE>>z-ct!XHR}55`M@; z&5+p#3yq9^N>Mnz;P8lqpy-7{kbIZ{XaZUSqr9+GG%0OlSEZhD&3WPwu$~^{4{;x( zuSKvN!&tV6wjgLbd7mlv`wAf`P^ktI5GbOWGBgF()W0%vZSYI(U?n9TU}QkNQLLyF zZCi>%*5QCmLK@m}1qvJ+GA#+F?7fF$(@bfit z45V@>3j>#NLzC~NpF+4BbEA}iEO(qbon+awVtJCxZ$WRA3U$jPs31rp_R&B^m2VT* z=)9JN+ZN!m@iDN`pg*w-K-3a`dEsbp)kEs=lX+~SWg8aYGJK$^$LJgX&YtU0%?Mu~ z;reL0F#{h>kZcFM1J8VWCgcF?Fa~{)Cd`7SV6q?Biy>i_VU`D%*+>#df%xJs?aLsL zmqOi{rDfcGeqDG``Ex%Qbq5y%Q=;@T_*Mto2grC78mK{&z4k@w7jZBpP(nXlRaeio z_#_9`9e%R{%kz-M2j3MuwGsA^TUg&2z?Cp1uWJQdx>WdFmqW@JheVwHe9J;^f&8Md zkWdN|lwMAX0%2(HP#>T4n0qls@H2*Ruzk{(W7Y{uYY>MXVej_∓o7P|O5c_WNWX zjIYM_+7^&}WaltYM5cfW6+-ijjU!Pf(_+$5V!B;0kbn)MhCRu@W!!rJLV3P{{tyZX zGyQ_;*qw&sU0-Z!njso~jljF~Xykt(*6QnOuxhq~pp24gwi7x6A|m0tJ$p}G+4y(- zIy3v9I)fse4f*SH0y$(0w(A>{sBPmn-|c(60uVtzOTqVZV7y!m$q7ePSbhHQZXv&f zmi;X!3Fjv@K&3xy6JtbXT&z^Le4_CiQEDjR6GX|M!;4y397`HaU4M%f>SM*C2#-{x z$dM$Tw?T8erKW(OI7k?%p=nO=1qnF;@j1jia)**bISh;jTm=xIO6Z01+OZFXdFu7z z@-;CgFx>#ohPY-@Ct?l=J3x3ZUuVzG8Z{poz7odRdPs)Ba*+Ogm$0P~K3*kZb7USK zcbzVZTZq)-zgj4$$lMNpEcPB74kB1B3Rng-Hj0giza|JGAWRv3R-cSQLK%sC=DsdE%Uf}{xsK{l!$u+l4tj~VB0Y>`Z$oh6Eag`&x*ZNV7%^34n#D9`D_^jFEXV!fDhWrRk@N2oMDo z<=TsYxOUc_*T}e@k-2Xy~kgPz>P^ZB?d9#&f{Hj zk0IkHH%G=pjSr*CsIiAuhm?rsExX~dMOx&F7GZ{kPtA*?WTo0V=UQbLO1PRF+6!U)NrHUEfv2li4`g{4KJqq@J zkM{rZlP8bd(zn{|uqdd7Jh^<)*&fdGaUUO4UM#M&yd2KUD5U|} zvpR2n<2t^(>lexPWqgB2`t;+$UE2ZF-nV(7e)r{HPY-{H23NyuoaHY%f4JoTs1bUd z{uEm4L?_3uztunS?RWb3=R5enPP8w7=Lzq`?|Z%IGR=#!M*~cH>9jY8QMZ(b?VE`D5p+FUvf-iO1>Hlt!J+@WF_7Fm6}}dM2G*MT0CKB{XUpL6HyZ z9~~7v{LRZYn_hK(r+q(rMk|w~SJyPnN1t_~cuc>5Ua0NunEpqDpy7@p9odlfJjpvY zh5Awd?#p7Br?WELgP-G@SU#m^XlZ_Tm1S4s^Hyo$bYV;!N%;tmMvq!s+cK4p_ zJb6S+?AhnfI$yX)$JF&SE|Yh>O?crE{rB=^@W|*LPmI2M{PgqiW0@p<{&Xk&_%h2U zG51Z+-#y)V7Z;V*=on0=$vC2wdh+=3?#|~=cAixpz!dR1Ch5Q60lt%s!M934i{D@2 zyO%rozs2vEsP#>vwS{kKE9J}2YnsJSDxGd`6VZLSEz94wJHLx6RD{D4kM{b~LvcSH zrNbDUsXxpn`t3HI+*?|VqW`lTD%TUpM<`-}j={%_Hib}$>nzi=oscIxo=l(abbhyz z&S^0Cm5IFW+R+1q6fB4=9u-4eCu=#gHCf4BM&j?)4Dw!_$T z0`*aM2*a835cPpor_&$Fg>efz87AX#F^h-k^y$qELvJxlMl(QvT(Uv|EFnbVyS zoe{~%Jka>>zP!$t`Wa=zqOP+;`aC+Gj*`2uftq&*^Q%HAYPpfW&aa|3$&9X=mPUp# zos2vlmaAGi*pH6niME!q$t<3x$;vSu*aPb{l&3{D?eUg3w#U!4HaNRyB46E-KCsY` zJ&C7^WSk7?n1FPnSMgN0cx9(VFqtK^!P8;OVoZext!f3|C%)} z|7Y9FNnFnJ)m!>fzi(;gIxWg9zhBkLH}Z8`BgAfm<!ewy7*n~vhQcp#z!*|19ES*P6K_BNa*#I*e#DgMH!qGg2`F9&VRaTSMZ9i2tFIbVpE%F6Tb4uu zbxLIn7AbyhTZ6CsWjBB%vumV+RV~wUOqy}T@9#$CbrKO9k_G>A`+B!}k1AgnWOop| z2F3%POUty7ZsZ{^3s_h6A$PUeO;-K7=EA7C9~@ajlf6o&NzQEPHYNQk&n_?1Qk2=5 zO=6tfB;y^(%h5ERkZ$pM|J9L7t=D_@)D-U)*PXBMEv>{}T@x%z^r8}mkW12`;s`bj z*YNoduTRg;kIz>(ZcnW0;7gK}r_q6YILO8$?eoWM2FarMiL@Acf=NbSO(wJJxJaEX z;Sa1P|42Xk{r*ovMK-|0qw|9|$7dJEr>|F!F?i^K!?eMr1+5G&6Z+v7YZRApbeU(9 zh_qz-B94kAC&t)~<^}C7op(C(mrRnyd(jGuj^1=5P>TGd5078%pUF@9AT{N(y2LG+3I{ZI-`hTFmAp&5Nd; z!ZbnBI0VC0BtF-y~oR)8v-6lD$ z-rzn`O*5i9hPd9?4XdY&$aU0@&S@+aGE@^<=PPSu^U;2&ED!$p)P zN6VBk`%LKm|osTllizzXJa02fn!Jd zS6N`k_ybz;TN1-?`0xeoZ&@($(!d5pv$UacL8E+L)777*gJSl@l1xFONaw5I4<6}1 z>1cP$+pJsC!^yv3qp4|;hIg;yr+bP9^UItxu7rmhkBP|8Q~OkzH0m$Q~7bXx4X0R6Lur|&`s~`1dY>wn|!5>=?Gzx|48zz z*jnA`I4OzG)c3gf9d{S^{=r?5ZqRh0kR-o;`coqaV+H+P=xgv^kG|+6E>6 zGwu$$!+)_1vBoi>rlWY0&8MY18gx3#fXl;H-Ur{m7Zx{2h!vH?Yg#2bE3qzBna1FL z#AU(uwN1Y#m+4)XrCiyt zn0lJbm?*F2NkMGxI`;2yqZ2m8-^O6x$ECc6yOmh>WlW3|@A8cb(l2TCnXm&1We^wG z=P40UnM`|g{B=#YFJCu0CR|;l&qT=`dtSS|z3!nRf;*BKG9P}N?|vtoM#0xJ-^esj z42jkvevfN^rF6k>ju6Vo=7&&p}t{T26C(>3EkklVkuZOQ8q~gHR2=4*=}pPz?qfs67V3= z-Ef%9%A#(P2X(ugC)j{c=HaDwH)2KXAu*^RNflku;o|k5VDxyX5Sf(^Gxkx0R_PC` zLksH~)!vF|JEH4qR9urJRDf?_@)M$z8*K3`Nk;wX^b$urr!kiNHFyrK;fTfHsdgQ( z4`wqovT>Cwv8YDu14ALM#6&kp%G-npw@8Q?V!K4tn%-nQ947#sy*d5*&Cz*-zG6>A zuZ}K`-ZZL3Q~0bv1*5c>jpKWe2b-sG+9nBD*=U}#pg)7oCSqu+o*U2?t+409wl$Cp zp*eKDjLHjG@WhFl(+Nw4^luVDEAK|cm{*iAd*1fiP>SX?J`s@yx9f4VBa*y={T zEcy|T{e-@Xbdrwa+M6_BS$0~7#FKfvUN6G>@lp4?H_8%uk93t1qhsDxS)|21Y*;jK zdNvNYW$O&$yyMuPD!F-bHK&Qlns%Es`d;U&-XB<#PYY43E=dBOj)J3n%KCc4N!ABe z9pU4t+ER!(p?M8Rdrz3cg?B;%Os1erHMR75@)eWQJxL_-RZKFElCOKHhSg8Ao)WjT z0R9Lbuaq-qj+o$vBog3F)Smbn9q?6;tCUHfZ%Jyg(?=jl!sY}Py;A7Rbl2S`q{tQ} z@g-)j{27J}=P>uJRLWWO=z0AHMzwVI2wrz_*sAVS%0S=o#n|* znvoiR&;9y`NyjA`y1E)OGvB6d0Z-3KVPyV=X`A(f2{+{Nx=>q9R;`}yJui5;`{@ki zL#L=`^w=YE)Gb(SaTnG*<8#U^Jsr!PpF(o+A5vqBq)k%HbQI^LCcub5-%3COM-Fv` z;OowhpUY0;WOgta$dSAKoz?T$1dG~&v;`H$7li6*Y%q}KVj*FY!hN+yNpDfJ;6mxNM?&x-xWF@-vr^!`Diij5? zW18tCE9GI4UYf_d*ErrijJGJpH+#Qgyf8!Ac=y`Ii-*@4@1w@?KC7Fqo7Z_AL<3J0dS2~Z`_y!}RmWeg-`78qg_4v%DQ$(A$*D0yz zBDIi|BflJ<-8}7SlUrS3q{<*mL~^*E`Eo~hiK;I20loa#`b|WjZC;9}jZ5)Vm*VOF znM?6>aVeZ8N&K;-izpq|>N9?M;>P8Pu{`k%7RLtCCc$SLX6>!$Zy;Y*5MZ;IIx{g( zOw?V7Up6Ia*~vX|4!Z-ZO#z1_jV3o6VhY7sE&zTEQq^>$q?BK{c@g&;7jYkp2upe| zzCyg;pT^}E@>@|tTY(7LddHlrJpxmIi?;TI7FbCSR+29bcgGH{&?-4gwmg5Otz`yc1Rnd){!;n4O-=rxw=1+jJ-fBDQ0)L0h7lC-Z{MMSNTG^>v#p427-}?L%|EGS$mC|Pbm0U^LZRJ9>f8-i8v~mFY`;7ayS^n>$O;qAlOCNG!F3op&v)@=eR0hsPCB9mzHE274c2tPrNO%vp6bc zG`m*!=6Pvg zFr{Th*o?TWI5ehQ6b}>Fc7`IW%Zv0S96(HRbd?oqq?3@q{f-I{x>Cb<4)sV_WTGCe za-=47<(BX!PaxmIkV_ZUqdj7N1!BBgq&<}ynq)ndCmtl}fnb@e{)(3uq#Q3G@eQIH zpIpKf3Yiyku_uw(R*s2>(n*-&UuOnQc@dyuVOjZ%aXVIk{f z(9L2_+>#FM10|tfA#2fI{Yu%XMWJin(FHESf&-s;yxlA~I5jTQTZP|qeh}M!aqPfK zZu~C3WXB3FnAteNmFpy-ekATmyi-(Os>l_w$`o0~{211Ij(hLoQ*PJT4+d5y;cd3?jk`nr-BfocMdq4Mf{VuF4d=NW#l>|u>hwBY z4X>!)7uKa?0(DoNTIH9_BHeTiF25uL^|u;$g07#6VrtADLz%ZzlHgf;-1l)ipcdQg}#Uom}E4F zhwpjgxe4)oUZ;UlN$24@9z&I#$Bk>Sz#KUMNn(oN+bx3YbK!_El^F@O-=7DK?BhW8 zju_{3PM4?{gy2I<%4X(qpzmzI(GW^^z!yR+RT8^Ou|LwXoWAfATW|4#`AEyby-3cn zH>MTu)7cDr#SueJJHy+9gb1Iv)EqM$P%i@-Ae7%xb>MDSRcQq0x@I&*INrP`e3`38 zDqHf>YgBeB&yWB2k&lpYVF~vVc3!i1Z|OwQ&P2Tq_g*nW&dUtGBMC9#a7qvvNh*1= z%}%_`qE^{XsS{z1u2hR>5w1APjCk%ltf8iuK1I-?mC&BBU4 z#5BpCOc>VWvlf+@9USL+ZVJ8LtT|{}VN92xgqtC0W3?52@_$p?WfB`L(?tBh{t>xp*+se!f-%b`<2=hL7; zT3q5)2r`UTtX6EMdSR*sD^c**OnqJi8~oY2??e0+?)ugRoQqtmiWMgeQJZMF!gMiYn$llYETB(w^B`ip~wMAE!kFAx9V z>iw$t2x;klCfcpq%X$_76Ox{^t+wMK5qeC_3`R2qktm~yu2Y(CKD@q%G6NGcJb)Er z0JoxwbBe153T!qtv16foi0L?!$r#(Ga&#{XghIahX_KijNW@~Gl%`=im)4@or zN2R{7=&Y<$MKYVYYG5{5xnmb?DUw|TKHsPqUzW4#t}cDFD*vNG7URn{dKh0e`;E6E z5^9M^%jo1KPT|2D`ZqN{0CWgWQG!+G)pzI7=IQzNqh~uU+B^5lk>G8E!#0}szJ|sB zd>aX2ThUpb-H5p)F!Y@ry)rYc25lg57)~ne-kan`4ZP6_E^XBm@12-4OCa6)H&ixhJiA4L8^>nyS&Aj&4NRSOcI@I97@-QA%QxptBQ7M5 za6tD2l-SZ4=7e9xtnsUgF{|?w>E+|CABsoSV{9FgCdX=8+rI0Oz}dq9deoq};^}lm zf_K3b(sbTm(#pTY%AcCJ&k2RtE64bS>B3eex^HrD$vJmoO+tiQFvVwQP_Zm!M6m48)*&xnsy*Zp> zpvt27)|!r9^cQ*E4qqedK5S&&i;k)_FV4TQDO+<4Bo!)fl~q|fyYE)nWBrXLE?Adh zM0~rFtyId{Nqj%T?&V5I*^15ANrw0O(Lv}y4c{B;ic<%JM94!^@t|S&lo!3%oqMW{ zTh)0yWp=-3O8X67O013qspEc=lcGlEic7R^l`Dd|y5cIfH>aqI-#*SOLdhV(+&j8> z9n~@C@*EUZUdnvU0Ii2fEfHcZJK=3pkuN%u%l(iGu0_JE+&4{9X7J#{M4k&ZahK}4 zWHarU6`KX;Iw=zpN<{|@iV+9j5y=->QWq%vK{zbdfmZ#HWiT11OH`HY8Ou_AkZ{1F zSeK^5`4D_=r^&4+H%MNfMX_KES#>B}_Q;g!9-Q&F(HJKfUuG~H*m0KdH*x<+&?+xk zTxhoaKxY5JNh}a8TB*!E`o!o?vv{iXI&rxsMk}&a&PObcnIwlSRruQwXe&`g zkNCX5v!q9ex;x+yRko^)Q{w5eC*hP7O2A0+DxI28vx3sFq#mdN`zpQyCk17av*r+C zU3_8ejnvB{z=e)To0zR`v|M~6ELrh9B?+8EQYcz)hstcBMNEYWP#uq^h9UN5>S?&XtYLg?w z3E}4&lj4Uzns?u%Ky_{4!@J z{MA&iNH~n)HXTdq#C;3Mtrvs&eAj=jYq+lY9V} zm!)NCxq+s{ksHaDzF$qPha5E`ei#s+U%JLKGt0*5uu;C2CmK4|h2oSekTkn?)JT8& zZEyd)cX)Ji^!5J5k;@F?&Dqc)$@8gg$AlX`A`a+i_1H-j7WaP3D97>M(WovycXe7Vn7Sgy$|`FmBEbh zVnAUj04j(wQcoN>(k&vYn8S(2$uXT7Pa086DQ5#q6cWdE@)3v{1GEKLqEULE)1>E? z$Q5eboO-1|Y|NI7b7Gu<%kM)*L#~c%Y|kfg=}AEnQY`po27#tR{%=#FywsZw>3Yfq z=811B_I^p2!*H2A7ip2R{d>tQZ>328WSi6JA`Ji07sZe6bL5ZC-Uue&34T$ltNIBv z4~kB9j!aM2@p6kpY4XdP6r|k%hSS z#BkM7OkMRC2G7t6cXXeMu55}Oy})oJn1C7QB(4CqZ-}d$nFRy}hUVk!NDJ6Y?iH;; zY}J?Q#f`^lc`t^5(EJ2Tw#H5w+mb=+x~`dU&rG)K(UHk2T!}VP z3kn3Zg-V+#%Q7^JSkQd@S>hMMh~$tk7s;>Q>VL@3U}Je?d>Nt8!j(Fcl%NL5b$pX% zxr=yprcI&(x_8u{ghx4MJw!vnuC;kB&S<=6><%htJp+V?rp9sh4)mhcgG__CG1oDE zU&pB7Rtc}Jcbw7ihd9pX-#On&aENUsf9olx*7fL~?Vo?wc4!s!N{>0-e!vNE3$o4$ zpmD8p0(_gl;sgj8RClcX1klKqPJr#k8b?46%hCz>Rn*^1w$0YJ1dTCbhdM<_4SAqf zyYoh02dHuHe@8)GYY={OKsj;&0^x_33MtcdMq-&KHQV?buZOVsR2r7O1e* zNL&l_cTvs^#-}Qe$QO_rPqgdj>bMaF)jHK|^zfv_W1xjf^t#J|wdD60%5KUyi*BHw zJml)Ak>HNl|AU|zP+Jf)^5b(8JbzjzSa&()sOpZ>Ox~aaP2a#4T)A9qP3a&?QD|fY z$wX{Y72_Rs))VAHlQLwB!iFtfm>880q_F@-^N-WIIt@VK3T&_y@P}XKz;7Kf`%>4r z1JzmtgfNULhCKv1b%J4aG_XEMPnhMBs_{O#cVU$FSvVnpI?=zV$1(c-GL~@Y2El8_ zeOu*s>KE_OKYY{#p3$HoCP=V1fZ!Tr6ro$gG8xR%v7%}fa?%h-j9}w&I>_O%DkZ5q zOs1QLvGdTKNF`>yNAKBi4a`L=c)!*G>`NdAWUi%CvBa}0VS1D18A|Y!(M_DEe1Xwu z-W?vli8g5~J#1dIos`4v+52>RS`?$fmW$0p`=Fn*Zx7D@u)B-fVGiRLO^BYHC6j)U zZSfU%6Q^U76O`uIORs6ZFs3D=rRxXNQHpm)HqmZMABNbCW~6-Yg zDCo?)ZVtt?!g9z{^t1nAUZvdPG6t=0Lg+=H5t$sW3D?|F3`se zs>0uTw?`d#EQYR%(K~j^mUBO3IjfjlL_XZ!PqBPmHh5b85?~hpaF|KB2J)W z2l`z=!tbvi_uZ4mbR8;xHbsChM86UT<`BY`_*Z+3mlD4`P-bA;bcNlcF^%*=eC(+5 zE!*Gv;I!T7@aPTSbVskhX5$3%B(J9FKd_|KNFf)$z-77%9y}VHn{Vn*68yTbt}&+5 zvZ%3>%MSL#>3_s$pVAjztODwgE1&0=enDE8X);HvoG zE=9YVEoGOtLQ#(^dqO*`0=}IkE^w*Nr=XR(Ep}=(PfNd`-*^llPcEFq{eh#;L`+YBb~NXq;3t3M{Wkout-(eHa_)jZQSFEddm0 zfW2K&e-J+@bt-HCMHm?Pr+7FolP|d7<1p^&*oJwjUyy>6viKcFKl@aPSSYQZ+$9_n zsZSlKF!Q%8XHcg@FVx6G3|gIyA-F(~x)QY5v;B*2KD@M91_z=>)T|Qo{{U(8zksEI z$lF*NAB1I==85S;GdEAAbsWxx)nZ(Qi^8!x2Z(+?wwaY85x$>yqRpg#)sH%OarZfX z?(xq@ovkHKSk&`D;Th>FvR2tvj%MJz+Bpz6cTRCjj$c3x7fcF-(KZ)OLIu zcV*gdk~(nNE(g`V$jnc#v_jzX7w@xmfpc_&^n5FcOD=#NA4Q0C8=jUQ`1Ca=PhGN! zlGsK&{4mfM3WSVcYc>HNE#T)dYcE?cfv8)Uvo;Iwa#h@F4kqUi3ijBj?O3V^6#%;r zz8oc1H{nvs4XGuZT0NecCso3=G^Hj4M7!h!ZShX05~Xa}s%*i@lX9L<3zu_aUkaWn zyuF!0sd5Pn5vwf*6J6fB%2Hc8PquIJwx};zC|>G>@k%MDh)YGT#~2jNVsCF{K)T}H zXk-^=)+^#mhlWQ-2BK{?q{Wb!N&bxV$X+oY;`~EvaxvA2TG5c6Vw?hGKhNe@*K~_B zk7S8J7PRUlXR-PQ$grbmbD_1zJG(rZ$2*_3q|Ci+q(zrIL`8kXfWmn(9u6y3>q7^i}90F&pe2bxuN0rf;A;W#h1Ih#si zorXYZQ5@BE%4O|6`uuZWE(?FL4?#whXvl+yGK9rJBEaR+NA(D#B8j^VL)_5i+>nqe ziDt6G1&T#qUWbr3Vj-F$xRMwZH}^9xnX9B4mC5Y|StU))Nf;)FD`KA&TF`mwUD1!f zFj3(VHHvDe#$OcrMh#>P*HV_T)iB~4963S`EYRTt)3&R}j$5^67?w*ive0AQ1PfI) zV9xbV2NSM4zDHIX$8d95hV{WEs$2PZnywz+4SQz8%)y~N$`mC7aQIFlI^r##k%ea& z9AqgDxZdX%7C!8~bmM&SmrCPAr;~g8uBfYkCh^q@8Ytx9vz$VlRbMhAiFy*Wn*?G1 zOy*ZvB5Oa$h;#yyKuSoN&xbXYbas6yDlvyROETLMDhE}CM3+>v!QgHiU5PEwqbDIoa`~^1iJ4T@p1UV4Wwv@nyhE%_jS^n#K3^L(@-Y&DOsk6$e1zuipoq9qP z;&VG_psCCRST2^U&bIPJSJLw!AN|S&L{l&R!g=`k^$XWDeh`tGI=pEG%|kk+CH!4-^KVBTho4IYes#O3i*TWkV5Q{!ov zM->+**DYVp4t7&~C8DEB`Jg}mpNQom&!I3by%gf;6+dnw)0XEh2i%0e87b~<) zM)~b3KjhrEWk?n0q@CAbaM!H%n5$jDh2JYPj;dQ@<(FR)7pTm!MHu1jK;ms6Kp9Rs zX7Ki0t&(T^fYY&nFBVz5imx63!94Mt~Mo4>bn4ASRm~j5&Bs8ZdF| zs1CcIJqlC@{Kck?0+D5DxYC@)SPS&3@t33~X158Os5DlpIe@=qk@*6C2h~E$+g?&9J-1%^(q=ZJbPELz~$b z9Q>7_Rx3)&@=XXBc&1M&Sy{{vBm{H5$l4cUCTp;dS4QfbZ3jVv71Y)0wYvKt z>FT!x&qr^k8jC*lIN7$2NJv4t3tyI_jE#C$RGBT(OsICh>FcUoOPSS&M-j6jypFog z!p#+a%9pw4AEmf}s*$=HZEL4WVrvz|x&<-1IXcyre~lX(@TW|~JWb^hL0#wia%%3=++z|su|U-@XKvn=jjcUW$4UYr&|lBFXdp`l z<4HZ>2}@>nP=_jjgbi0t#pC{7ZOV6WB%tH~&VcBfs4uWI?&LGu>%q;PD5>wPW*&EffYWd?m1^tYOOG@ zU~{nvvF=bnP;pldqMC>W6d{oJd?s3Sb~}~IE~%UyK7Q4G+1u>- zAQ9Gz3slffj~F?gi+Jm?zKuD^J6}+BxyZQqq8y_e$LyAF`Z)z_>0XNtQ<7TSR6)rHmE*;3(v zmWP;|_o%9fD<1$6^TuFjF6Sj?p>Z{Bw*f5mk{Qsl6aGQ(`+7*(K98lcGW=UW`9z!y zk#DeY;*!<@*uF~q4?-NIShn4Ww9FV~7`Xc)0zkdA5DTNx5%Rw=c zJ`ZxuO$Q*Fc%8nBx5aQr8)bNX3jVw-Y4f$M7=%3;WC8IRyMo7Id+VOP;l z8K?zE>y~Tkh1Jx8QgOyX4XDHK#fjw}Z2YeckB+n=uEwJ{FC^9Xj=O$rzDFB*bI;!# z?H}5NK2Z+3Gq?;A!EK$JTFonO_ZGiN;yxh2O_5d#U#Ut5#!<7Y;x*x!&Gi0FBfSS{ ze0(*@uWQ{(M+_II?}j*vKB?5Q zUX&z8S;u(nIu3wjr-~*USec!9he6pyK{b1JSN!(KY}dl+;Fa2X7>BiZWWq+PGCziF zp>UiZNY~8pJ#rq3a?T7po`$1v$-$#cR!ZkOblHmr|v$ZfVxeLD^p}S-lprNV1R$9VD#OMuM#8xaRxV3&6%M$5_NK{Q78*Ms`O-8>SPkP;ix&nr)#E zd&vkJvb*!_dL#GI-HMDsmv1CFk>qLpUQ`d$S$NhcYF8{UT(v3TPzT_-*2AoapQE4P0neVD{3=rzdSxU+KOH#j1jRgCy@2; zs)QUcEh z*U^Ri4+;9=VDd>eatNeS+y)b9VRS4QToR*fIbQbIn%TQ&g6Im-BaF+a)M96bpv{Ub zG-Rg~TPR$ALOg*xfmVjOlY|!TPb~~g(YHAX3e;B@pZ2HepqOz6R20sMr0kvNyS484 zsn(a|B2<-XUX^dKcAq*K=jX;P`x&R;=lS$~PitW-0C-c7jc|a!IVTW@yhw2Ba^>ha z0E=9uAE)qi(<-5)C4JVhvfSE`72cIOqi`(?z1LQxie-HD?Zg7f2WiJw_bvpInpIUv z60{l}g`w|Q{|jA<`U2qy^73$;Ngb@)7DM2FG_Lu7h%|%SS9wUU0hMzh-o28-hS~Q{ zgXSb`*dfR{Uz>1Pf1>POIV5J06{*CsSef-etFer12gp&407H07<3hY|T!{B_kro}+%g^qn9s-;I@x0bjp2Ld{wjWU~d1(JUudrcB1 zc@bkS_2Lu$l#VqFeLSx889?3#gXfZ{Yxt$#FE3|Z{YW-h@LT2E5i5*NmUp%+zC}9Z?`-&Zp&GW=rHnpBaS5@OgOSpREbPdD_+VdH*6(bO*NS+ z7uS5=U*;Jntp82^9A$Hav&g55*1kk)NEfgnvdNG6gyrBqkN*DmZuIvK{f{KpzteL3 zUEtsUenVU)Lb>5$j7&@qzd=SQW)5wLm<5_MBS|YFB8S zIwp;Cb~{f;o1DV?_Vw}iJ<-GON$#5zmI!M(vtsCx;pz5^!B!9*I9no}ip^Y_*aAZ# zj>?b}+%J!IVLtn3XNUV2`)<691i@^HwHyc}T1IB$kI11odvgk1_m6+y_Z958QcP{s z>E0H`aO=jPj$uiwjox7&@}aw(!#T>K^kdCD-!rTWTYxc1q9kpV%zI$|0U?Zd_Djp^ zk>r#=l!8ORnN)onk4e^}M2y=+ayG7Y0JrI*KM;%UMVg8z6T}C9P`7%(_9NvbA%o~x zlDB@&m6bGS&Dm}7Wif}sj=#2d`#W{q6o3q~A@0YUtS4EIE1F2_zXA}z8{asPa)+%1K!aP(Z zxzIl3oYH=8;|UT1TPd%l>KMQ&L1Xl9J2uPq`S~}fY3p$hGB%}zgs;W1fPbM9q6mfjW}rfrY^K2@ODSv{91^+F zjWz(g-?;G-50n&94D3Vm5+=?U4G#(=Ys zrRZ1!G{i1FtK#w)gZ%pZeE;k?+N6JbudNoumQjg!d0~j0!3L=ULCbBJn%~iOeFsHQ z{W%VAHc2$PBi9T=1&SoW>5~&&b0qDUp{diN?7?@kR;so}(_2bv0O~3XPVmP$z6ZO5 zVQ}NoO`6>Hqa%;jVz`)91ldVEye4t6$ANyPoVmiXi@hS7Q3HuI+RlH44qa%H5T(l$ zU@cV;{Q=(BDj-RYt#tnSZ9>8thOsb<_~lxP@X`0*SJ8pCR=H)=Bs0pw5t)S$4i;8- z__oljx3Cm+6AMU}+|BLrjmK4=EsEJ#$dfpl*nb|bTH($+ap~KsI#8E!jwE!GXUjAv zWqe_)2`XM$K%tp7;9TUXBQi>;Eh^ctZ?1@NoA9(KfD8y9n5)>msKMEiWdG-fR{1d+ z=#}{#lgD+q_?fKml=F#UFExM8uRc>+$f$Dc0D@uQ#y}j7-I=B+Gx8YcGdU()` zCK+&`tUEEcbP^x!>~`tL9$)5%=S}wwKD{`4E>qF`^HL-9 z#`i9hr1#R%o9VmMrvv-qdys3~G9WEqQyI2DHt<)qrclFIc|36p$sis`(N2nj*DW3k zlUb2kfaQ9}*Y0Sv`Djb`NETPp91ymbeULiXL3u|-@d|5VKQNz+xk@kRs$$KQXwQim zW0oW>$Sa|nfp|+gnNNI%5I5umqyQh((EBt*N7f<`s5q=37G{WxB%LKj!5bq9SYmQ> zJ#oz)@wH3bFkKk%5z|Yz>8QM31=%aB%=3%{3j%Says#Y0wJnw$mzGRo*!&U@YtX|q z%$*cz{*7~T-b=R1x2hTl1Q6fV5>`#@=zTiQxN%Y>Cj9uT4fRK-fcMZaGDA+=xRNHn z4j%HcW@cn8o=1B-JKqvZobXERe%(CfTw%NUrnzA&qAmju84(t9XW!A)^yy{CAzolktoV zZtf=WU2_iKkZZ9a4E&R;^bGFB8U8Jd!96EYW%CKx!jC=rr6IfYobMU$SGLrG+*dE) zh9hoRzO_=PVeYw_LN|*oQdGRpvGNuPL{s4=>=2F+N;C{YDtv9~0pdf7d!U?%p}5E# zdKxda3=Z0GhD%=ZnMk{d^PD6v-FrBk9D8?3oM7fe_;=6sE|K z9nFWlod~Ew3gJLdjx6~Ujd}T4O_{NL?tmI`ZE%%CgM(buKc<%sdR9D0&=bPGuUF+k40D)7>} z2=TBCVra`5NjHc!V9-}s0y$#-qLLo6#-YfEvld~(J@#o2g}Y|favfVx5@W*A?UK%b z;#h07{1vCl3^HwJN}da4u4ZY=&XG^zw963^f-`Tpit~Jw9$o~}8SEOsx0V6fL+gqg zRDnp_C?1gBHJVR4{phbQR9Cq(%gLz}Z>M&j>{MQdfv#Ha4?%9bE~X7KHd=uC_Q|h_ zY2yx0v95Gs<_&;4ue>?47^+6J!aC6pn~FA9JoT>fROUj2wkmNruz_wAF6>3U5@1UV zI#O2+-QoFFO90^=&XSRE9B-+1RV71XoR%lxc&5c#@=J9VHBP1T6;EmN@s^uazT&~l za<;ka9%HB_#Uc)o{H!WcSSPp?Ts{uKxDSoo^`hN7wJRQF0jbnEqM?odd zOiS!SZPTK`#OsloDH{uSlhslw537YUFkKdi z7@mYxIJkN{X*qMLq8Of`1$UveiLmmptw0}kq^mN8_`UT@eTl>27>ybsgmaSXy8;uU z>Tk+Gy|JXYTU4YJV90Y|$JPMxsuRGK^o~nE|CV6m06KJt|&(*fM1 zdp8@;5pfRx=a``^w(RV3V}bSmpb9zc*H%1sDlp-O4Bnh^Wa>?3T%6dy-L1{xTfstB zm&>P~v#G~prt>hCE=XYlc6rUb0mxK z(HV~Cf+%5W|@<1AubX&i) zV&ldx$|Xaq3)^(fmM#p*MgPMA67#FQHQ;Gap z5{V!tRG&~78n``)Jku+!iuWoV=2?+lini-vHZ`OJh%m8_=yu_tq@GTMxx?JASQqA( zgZN~TTTd2EYS>n*psTj|kroxy@;2g;U3g8Mstni7Zh)}zEP|7ck1k$DqdcaW@Xy{L zPyP|V?-etwZ4a@>y`9HE;coC2SiFu(n|}2aV*^I8?CyREHm}s=?`F=$?}iky^buDS z`b|+{8W{Fz0>Lcj-^GGeNN#2Dz!E%j*P|0NP1to5N0-pldUHc23H{oLK{hnW1!7^# zjJb=UABZVBjy8Jp=sB11Nv0^YWsG1&`3)EFPp?_Y_&kABFWG#m%6uZcsuo65iE3`- zHI;bhwZu=o$b4`(AZR#D9E|*+80@K z(9;&@OZa44l(83HKoRv)oPa&4IPfCLx? zM-o4eK$xm?#tZy{Fv*!(#(A0bpn_gakV9=;{>LV##oZ0bsb<^S=!!3bHj9!W@%r z`Y1|4A5o{VecTM*)d%Z~MUm0-#&+$MmoJW)bf8 zS^sg1Z?HEl$1P4IJh8UG`1<1HRjr&@^TorYMf&3S_?%@$jS)66k%@_9#iWFoLcf>U zFdHMY2Tvuv1RleLjS#>g9Wx`ECD}}~Kph)V$VuEIsOxO0@F{~4L-bHd=Y1;qW3KYg zf_-f|%5t_(2bgXEDV=ki3%b8&L+*7ZK_|R6U_BB6&MssH;}WQKV;w6NP%{8L;N4+* zwHo2FP6WjOKBV-?L>2z^+htC^8BE~(@CgQ3g8vR8R@QhJGt5biV(Z0g{!KFa)sB`` z-U?w}igJ|AO9#q`TV5{sfBp+x?Z=P*4|{c8 z8-D8C5VK8v&=S_-O;qi}`{Wqa+2S036QE7)Pv3Tz3Hcr&Rdb1ielXI?0~@zk9*p1MVNrS(r+th052v?D8v z>A)8SIe}~1lFWH(Mnth*2DqN#ccSB_rxThr0 zOI;nat`q5#aZM>k76YdOjZ$)=QrAz#(h!0&cDzG{a!| zGA6wusUX);^1B0>$c!Aj%*ktyAtL z_VB)%(B_XV3neYJfCob`@(FX{W{QofZN@WdDV9JxhVycp9nARP^!4kb0}p*JrQ20F zaj_mMCP{XR#uBP^!dw`7ADDOBs#=aXbrayOaX_&{CCa zVQadFR@W3v`$^ORMr9|AA=1cFdz}_7m}#gDV3RiAPSZQqzU%H0H{#<)QuOV&jCJ?f zUVr!L=l$KC{%&Q=>=1@WHyCTvcpx=3jmQCkwhU-;-wz!1OG8p;e$z;Ljc0Uq_defp zh9C)-^Hr(WCMn@Tk+e}mk+k*TOnz$wk~1s@CS253Yfk|U>O6+k97$2Ev>99smSVwG z+bqK@tk#BpU2fuKif47R;XjS z$fTMgBR3L&=~SlHD@r1$wd9)^o5XZy^%pqJnwG_`i##pfV-lKj5M-9~I4q!k5Fq8X zSf#+To2^oKg8A_5I;VlGjYUGA%Ny?C1kf0tJdPWQgO7H0Tc#=xHAHIgrD@?$$UxN! zo2@m2_nz)P^)-X>7Y4FT?D$cC&$+aTrO<54Nu_glt&&z3*zF4lZI&%sJ{vQsxOa%mzkyIhEpnBLh1~VDk ztsnXYVwsjlIMNTK5TIDp7AH}m2gMUY0)rT>z4!6qp{)%yTaDhL*f=I?R-(~cl)QppSe!)#&7A7j$0R(Nzwf?{!u^@1R$#S5TEi1 z=BIu`S1-_j^d%LBV9kC&S080B-%c&-%8tj(C79mE`BW>fE5go)u6WGq?97FnskW48 z?n|ve>hIQ6ho_z2kOWefATVa0atJbe3AnF4yokrkT>`isSxbI&_Ub{PM ztjKPE$F9G-dk$!L4iV$0=3DTsl`3*B9bPCjrqj04AAvtjqs{}IT1nT91*SGKpqAa8 z&v#Z~60uHESCN{uTHKRjzrsLo`(zzM8Zh*o-+Gmpz_>7VqlgR#wCm#YzEM zW4`*}Zrh&D2d$9L^32+(&#}GRd%#K6E8`-uX_8O9oERVz=??SL0aaqCY>m-Y~Xy?8j0r~T(%$mC-=72j@sQcB&i-~7xT6g1)|%*QKoa{ikzH-| zZmfU7_~IT+#OEmVqJUA*HzSrR&TTO6jW8%gMgdG`u~|je)iw?05eOa<86$jcDJ-TN z{VXWgmsauAt%WwdS!{)aaZ|VY?tk9!HYrKYG+c4Z$KPrz{%w=!FQMd0MG|v0S#=Iq zY+7E^I#dE2=aGk8ar%Lxoc~}MK@84R+)qmmNnj1y3b0};J*gCH*~OnddFIXH^amd= zI!j!ASyR+CikXAPYo=i8-yj)FQhY$cg<&VPYS@Z+ON$)8*F=jr=)GYZ5uHSI1J~Z> zzi&A}3nL@Ao73q$sbIiZ3zy77YSMG$IxDkT6kCZK-N{cAusF(r=0tZZzx_+~q)R;hV*Ls}P|7uoMMN*{;wmhYklO;@I|+2XqP!R5OF|?| zAI`Y`PnJiD((RKJuvssiQ$uwmGnFD^!Jm$rAwM*fWO#j*HwJ_80|NOFH6(!ViD)EG z+rGM567u@-p%HBm-#7^37y0CQj_ls@5}rOS-{|Aw=Ba!nRA4o)vB|&_vi54hk^F*8 zvc@zjen6sw)>#icZ0n)s^`Ou$H#0~Da=j|dvK+%x6O7Yho98%vNqPZ5aY&G7*7>n_?@5$0FA1A z*S;X*sR73WOU`o<4Q7t3kn)kn1qRJ~Z1!1}PA$`o$s!n!J=8eE$@>=LBR}A8@psL^ zPE3aUhV8dZN-a1pM7FZk)yCaEHVu1r+j#cq>*g`i18#(2H8O`B0Vz~QbJ-G7+%(Lb z3luhuRGu)LYT4uFq3aud^m3W_Gn21cXYFL+P>m9lk5F<#%y;D-8PQsMk~bPP^2r*k zf*$hoLREsW*7)L~4>?53z*=aWAMmTzHpY;=!(sYmhoA3$dBpw!9d_4O(h>6l)c0nR zQm)Z79b+sHW=>G>#YwcF2vFpD?a|}CXRBHi_|%6s*`w#{+hdc*16zBB5!N@y zt;k*xxc~|e4;xtIZJdwRUDKUzZ?|bt*(!p;Gx0!sB<*AKnNWmsXQ%rV|JJSb zBU_TnWazcEyV#|scb`4$qN^vh+j*OL;}xFv$DpX6OMPH2w5}Hs5IrNGVIHJWRHN9D zCU=_ z$^$+5N)A2i(|1}T1z}qYokb1_R6Eg#RX?+hA}G6I#=B`?>>VYBeQ#x}?LDzr&GVI_ z)ek;7m%{^K7r2dc4RYnY9OFu^Dv_qJD`r_xLqNg`MjULW5D3XsGAVudvJ}41Nh&I| znQyNWksbvs+4y7KxD6YXIixJK!M9e;EwUbhu~*q0*_UWD2!dk539Jx?Yo2KoO`rKP z$WB(=83>cRlFJZ;W|HXq_pkgtV)T2i0_d{JKw$&3uamNJQP#-B)G zm_Zp&W;I!R5}Ri5jZk%bP+9yw%#CD0KnQ}K}hP2Ky zIHrtyIM}iYr#lIB!JHc9GKF1Q$J-@9leVyiAh{8dTP>5XKD-{PpqQZ-f(E390oUzD ztsu)iEi9`yi475eD5<3i>&isU+aynX`V7a4W>SxRv8Y}JAX2J{>-96_jB_!rH`3kG zLe?x7jR}VNLE^~7fmMO&c6wRV>ntJ5R?y_KniS>!VnA>kIy4GajN7oC^daUO@b0p6 z_xW1MhG!0RYe;j0=&!j=3roxSS}qH37N>a#;py{h9Ou+ZbrMOwS!@{&X?=R2f1$S6O9o)IUMYPogw&%atzjQJ<#fcfu4~mQ6K` zz6k1x1l$$Q$At+9g$T&ebBt4}TXfBd`S|W`p{5-Uss`MF1Eqf5{@WQ2BKd(&3c#5mI&8MZsw$*+|k-fOfRQD z6W!9}udYtmn{IHdGqC0=~L_KAVx_~MUcR;oB|Nd3I*Znl+6Wv}KOu9o%JDOnB= zfZ_zNRkXaas;#G89(+ip8%xYB#z`{Ms32D!Q)}Gwfn`BLD4UsqCvU#p;p+6oSr=K! zrl`hC5|Qn@ZijBZBT3zqt);voRs~tOOr-8`TgiH5m->rUT5$NOArndqJs3nboHMgf zGS=)9b#wRxi7lkhk znF6G*4a97+SQSh1!D|YAFzJ_K6Vi+G6EevMQ+abrb-{HBQ&d%LsPdAIRU`dno}%Il zgLxcsN#jDZ53X2v)Ofet$r*y>N>`;66=68{$-D-^w=(AQ#xbAsn5o|$_p*lmE!?*! z#V&*DCK$UVwAf%l->F2Xv<0XaMT>$=4>X6hb)&P>vq#~ne z?cfDEtRr0^{@sTn`V!|@C$=;b>F4(qxWGmH{JIKA3n~c!C&6vF&adQTA+BqcX00=G zrES7|8GL(27@{2zV{ly=L06%YM6#qjAF#cc^82|Sn!6!XK z#a@FH{lg!GB%kPlZnEt)3Gw^PmhJ4Q=ydD<(eAIL-6tOV`~%VOlj~1J!_nrV%wd}V z|9DP{D8eNIEN;!W!CEWXx&-^cOe+Xr)P9SxS|+>B+4!JGqQ^o`?I{p%^!Q`t-Tlua z{SQU)|5FKmVcRzqVosB48ni?epzSv?Uoo5$S3y8ALSFUbv+tgA1mQUh4=0EFXY1We zSETOG(jN4dv>AkR#VcwA1W~o9z0|JZ$|_uQ zc%!#r_q#>SH2MDU`26hT^nl<09?oIf zk^5>R?&HQxqSr@%dw2BuJ8tME&bzt_(hMx$HT9mGH{hai11`9n-V9->4~a75tIby% zt5R$b9$8KDe*5OcC^#2RmIW0QG`iTg!?g^2eQgElT?oJwrtagfD*;*TzD*fSW7~pz zn1+4o2nRVR!eDm8BR&wEb4e7d4%F}oeVQyPExdPK=ZnqT8C{4n4NE(yjZ=KHkm`{$ zi_B&hKQ8+dWJn{Bljfz1DJk4@jVF{Wjm`5dmpqIn&fZ=GnZpf-H_%1=Ks&w8Qc(}} zco17bxpNP15v%i05-ImJ%qpprnUF^NVWZ+E+_Eg*Fk8emjbSWw%YKvr(F3QEF}HV> z#(}rMmF+Y?Me2QsCsW@q6g^E=xPCc)SWqOu|9TfbBoXn2wSi+?xQw3sGe3gpxFG+4 z18*@I*;~yZW1*%mYD8f(XHIcho1uUPEw8a$~#16<}u+ID_Qti8IQ zbk(^UkHy5eAToSv-9?f@?X#ctnDXJ&Dk1~vp-9R@E*{9rZIZk zmLY6+zG{D_Ze&%dq8!e8(`=1knBc(%c0A9gLHW&huTKw;PWFGWkZBJ!vKqeRT@n}f z?~0_PcQzkwnMa1EMwEM%R8U7WJj}}s{Y7_MThww1@6TZTzDWPkqR53$Msh2T=WQ|Y z7m7VnM))oI>&dssb#NN(M36HgwDM$kZ_Ag)V>lm`PBnle*OGrZ!Iep(V3rD8aT!<8oX8{R)Cl%Rc!BrSOLS(Y#Zlo%1(moi0--wbi4)81$)CFM6``{R?uwSvd zzU`J3cIBxV$4&oeUuj>}`u~KLu03nNX@&EiCFr!Quz#?%w(1)zLj@@iXs+PY7kWeV zj35P_r4izoC5aYSnO&%W9v+V8ymF&Nkd~3Lk)pct#A==@ZVjs) zD&>pz@wO1%1(7KTiBqLZ6GL4IK*rx{G?CQ%K|&u$(dGm}{hS*ub~?xk&1q{%O5(NZ z#lKL@gp!?^Va_ux#Te5m0NlXT08O#TA3}{VsiP*Fd=p|}X zTnuD>+$Px18wWmTt6(U-JzrC}2=b2keLhT_%x5A;SkF`pGmC}DPaQQi5yF(lImI}q zNtqAV6Ttb=o+Z=^UUB$I12w^>!ibAtAPe)`H2*3*u(|k%huJurZUxHYjFiHeC8yeI zG<2pw=;!BW$34X@(4yypvL`ji>i~*<-lf#st-!X=XHA>Knk(BeLqqf6UH}Rl45Yfj z#fHQ)H3`xkx#z@E=h5@dCqJBT8!7v(^XPv9`mQU{{y%%i-~LzZc#me=%!jcY*y*=# zPS)Gsm~Eg|OMST*R92L2TnHb?L$Jss}|Q6RfhK^C!{%T&HwRtLFlV>=MnO6|rhZ^Y7M!RhnYd#Y>k6 z?)s?pC;EDj!epd)87P%=gJsaJgp$xfw{iEOiKN&i5xQmPoitf`uRpMJayaWUcFtVZ z*Pv16XMQw)4kXCm(i8aF#e>O|!PnIm-F2WP>m>Fr%Z|TM19Oh~k0T(r_5NXG<+d^f z#bVl-BqIAfQcf~!KJ?9~EVpQ#Lm|M4L}6sjt(jXNDpa%i(#*lm!~-SG0d>Q0GEOW! zE`aTJK2^bakX|LIq9}9cQ3Fp_)Eo`AD3d$rPi3fp!_=a<+k?c1O%g3f=)cK3)s~vM7`iius&y{{!+^Tp!`M$z}QzO0FD;wi> z(}=V@QI$_vyLMHhG+UXL^U`B9vbTos6s(umTlly`-!3^6RJ8Vi0cmp;f}r=RWt^V> z<3H_7208tgO<%_q8*}}mm)m8wCBS#kz#j!x99!aFN^Y3}JCEq!rzj^mjOpyc2PPO2 zvfqEtm1URlKyan?^IFS54MH747M`1%4U7H9o&eP<^(jELeJ1OEn@%6?^#Vz)t0Djl zBtGqw8Ot9d^K%K%!YHg+89MJ;H{U~G8NeL_*h7M8F_} z>pc;$LGPyHFo~cdr`&BD9KJCgIr^6(r7qs)x!rcP zG@i{q%viO$I541W%-hi5ifcxvS{{9M$n6+i4U<5v13l@#aTXF*XUG#6qEtIE#GXMy znvHQv5zqy|j)u@%ED<6&TS0iNRX+0f?a)>xkVP!KQncF}M&WwMmRe=RHJ3u6go5hK zv?|HW&Ck+caJss-wOlj9BXmGKuse#qMHMB zBhnXm7p>5mmIrhoTUK#d~A`@qvx zlHPYi9^y_hcgXqNGrms z_CsYd5S&KzY*n@zyoYG#sU zVTEhSK8h~69;4VYZsU7{!IQUY=_8B=(nrG_?Pya&g121JSS}97ybnIoKR0^kUqZ0< zN$55bweT)wuPBOSa6(-zKkq19z#_i$CG-l3PI5ps-2gG98|0xQn8L#_u<2KBvEVch z1yaD^kScJ=ud^k}!eQ2xQbB(#D9k==z2st4Y>;&nURNdjV{^;z8@c88;;EGNSigp; zM0K9KgdK;4ZB1!hY?u(Rq9`;kjw@MsQDLx)h>N@|3)O` zYvZ68G8e{B3WyzQyG!MmB7Jr?j-_N(0p#q-1Zia6*%*pNUg<_g8QwlTIyt&H>MB6R zm7K`G>xVj8?T^!6u8yJ!wzxQj`>Zw_JLM_P~*ir*CQ^~1u6t(bycmBA_|;8veeRqt-bilHBwE5F79d1CqDh(!0cSz6F+u% zbZ+B(s%1V?l2m@hmNjQ>-Ltn8s-y>>#V>0>mpk1UivYz(VO6CyK~NnmsGQMgu2E+} zpOR47t(XwtU@UxHUFtA+LCIX-FyM=zTch#aXg(by3LO%Y0CoP*iZ3q#D`C>G+`jX| z*T|099mLc2YG_gpD|xOQOG5-Je2hexuH$u zLhZ{|Ho=NviRoJ$em?hGQ{Uw>{{31hsMH{aRg-=yRW26ir9w+=c(lA-XntGl@WwNlNiDrSO>V=ty#(l5_~d8ey75e0<4jy9 z<5`ov0H#ws)7;Uk#*SVIiuZILH-Im{;_v&>p~m=dPQ+Y$=jf8=A$-?3gzq%!5ERl7 zZ=}KYVPc6oPb6dC;3?FgW|~&Yxs5BbD9k0pktg2QV$N!71BIqI=+Kono2o_-J<3Py zox8_(d7O*TJ$-NLr)be|RMnz|=qOZ_;9+dC*GPrr&Y3Br&pTV{1QUm%ek>$zYpg*U=Y9+s-t~*vP`q93NR&fvOvOcs*`|;V$(Ukc&{Tj5xXU3*0kWZyJ6e7|~d zH6i-zcm4JGdGEDBd^L@s@?gVY?2*M0Vb6$~o;;jh4iQ1!G&Fvosqk}JxDq4<$34qw z9?Vm#8^=wk?K08aK#uWd@PCeIeQ()-lVk$09T(UwO2bP9>gkQpE$pOHZl$ius+-z= zaX%eiAHHs^Xy6`Ne~SD@o=p+@8^rL`-wOU=O-w6 z-Bz*EJ+#ikIBXlQ6VmA&qX{{jw>uo{xGa1gkx4 zM2sgDH2Rj^J3l*a=BsDN4Le8QR<|b#5`~1tAefoU)egq-^u5pV=>~~s!G^0PpVNIL zR#Z?IDk(vYQ&ND9rdjDD4HE-E$GOzLcq0zQGwpk;i98MAqj7-HzwGQ@?^Om@ki5%Z zf4P0VS8Lv>*G>Mv?LJmBZ$NT9RM9_3^XW!y<$k^;!Sh=Pp7NHjsG(|2|cfy}npIwcw#u6NJ=N?^CNQ(k`|Fb`~KgcsA3&M9B=kH5v6|JG6e7(V^e#~*&Rzit((R-9}C+v&@LTD+0Fc-ZAuR1ah< z2#Q=42Ez7oZI~{@DYN*~w0ip|C#{P{&wSjKVq>6NgI-uPRTxH{nJ}Ei>(karygt=A zIKN-7NJv*^FBKd?kT|#?Y_okYeAH^7aufms<#K*n=KSXZk8U9o%#YxTL9BV67VkNu z4{T3ssFhsf5*jrRBw+jD^lBKs%#40soF1H>&@V?XkH24iy9s`J#W3*+{n#}FI<61^ z?|4Yj|R@v(**6na_uh(%E^eSUx3BzDrb(ZT8AYQ}RR8EW_+Dfm-ValZ`8#z`?h zq!yV^FiG)uF4;sJ$5X9N7`dEGU;@Xv`9BBo2oksiE)XN#5Bw9E8q$#l$n`75DvD~Z z(sNBNTexStO}n+*U?QJZxQN11v!)4S$H)x3EU8YN%~a!!k!oizHH~hsX>@z5NB2@{ z-4YMih|u&O&2Z9>nmT&aunccbXv4-57N<$E_tP@I<8Vwk1$o1V%{P7{`&?xeMWCLU zg4vxmtHzA_LpLm?Df%OG0zdBX4a_J#t~Hv}q}$ zjCWU}4{3`B^u@iDe~+hP)_3Hg#<3-{Rk$*ZtnbO{l{ql^#cIo_;Bw&{Tw#13R|U}c zLVcmx#nfm%Uu8S58y5NxN41!zg+Z+~qR*N}^w~NmCCGQu$)AO-J0hDZsqaP4M#9R9LzW5Z!UGO*G_CVuME3 z5WN4ty(?>O95=%I>|eon9x|Jn)j^$}%4SO=xnl47(3%>1l9wq;q$RE?Qo}>G_SdHm zfQKbFIZ39HR4jwG1rk6L$A|7lqanh)jPnA}=S?;pS(a|F@qXJVLwa(qqg={ij7oKQ zr%j1O5rf+T2$x8_Wg6an9f`N~NECs(Eg*GHqG=A4e}R{45uW)$IYcXs3z;|(E87BC zlChyp(jEwP3`u)PMGMo|VbAeRKrYPoQfX>s>O_EQO9(}#kct{Qu$h;;*`N_C`BwQgXsAs)dY2k4J*Y{UodkqYPO#>0nDDZZbS?|1gBiN57ACgm z;Z|>CP+mCbA=Vy~5D=qsK$3gzLD0EJbvrhkc9C6aBx8zbYYJ$4M-E3+^OX^deUWI7 z@pj=n6J^Mn_cxh15z5ReDAVLvv+El*I`=1Z+JS`+WE)N1u?>=5HRg?w=uS%{Rb&NC zffpomc2$kHc0|sT^wA#3Is5Kf_BdvWkZKB$dYuwR@$xc`LAB6~=ZmNXs?27r1{#P6 zY6=K?ouB-|rmBr+y9mg15$%xJ>R0WBv&nS|fLj>xZkSNpT5Azm6!lu7tk;q|*Yx^k zrYnVrrHE(PX?R?pg-_9p7UdkcXL>n85ZzV!Fy&JD4t4M9QcTY&jo8vIUZ0TEW3R&zHK#2El(6q0H5J5FX94q3Efq7qxxh`Ne78 z+1Vu-%@4U44AVi7ac>P{if5#e30C}*NRtSH9RUPsWeeDE(m!|sj4+D9e+w>s>a>~2 zJ$3}{kqV5VEf%Xf1$9NN=}K6W2JDU`W1(>NiTKzAhhO|&KT~40WP(J_uPbnVBh~NF z)g%D+++I8YMFH|&ezps{=zEJgD)o=t#hyr-2ytBj;xZ)3IOS5!Ai4Ph7LGVv{{zvd zf=lj-=+YI?g$TMwk8l}9`AnTTuJ^L1N@}%AhO{dV>aH-TXCZ1LgI(^tpuwIGc=?J? zr^wtIuu@vBF0Ab*Z=J4{(-4_Hae#M)0sb*~2msbH|DQQ`6KWl3=90!Cb0)PCKsr>L z3_fk8Jys;A zHZ;jqy&|gg1XQ8z)~*}E+;+oiL`VhJT^C1tzQ2klO*CwPr#L; zyy2Z<5{)Ntm#aRAQG0tOIkEoGd2U11&3@tJB$JHHcVRfl1&gD-Cye%SQF_SXjT+nAtSTm?z9^6N1$k`x+GCWbvdgB2r&m9fg(;mx1@YTX4{(&s>rV6)~qTV9t54wS7-kUjUFxHD~e$Wjsz0%^%%E&caFsiulnN@Z%;^z@cn`y^8MC;Z*w~Z1g2jO5ugt zYG-REH718gk6xg>Y1JV@UM;LZlJYWk%+lN`fu~%m$WQepern|wEv~iw^t*!gE}KA6 z!@SY{r-|vf&uI2T8jD~YrfGgrh0rDG|@GDV#03pkg{f?7fMHRTROoEr!@ zr_^;08rj9<*7)zKysHA$*&OijOfdF2bNuCw8N5=U?E=~lofwW{u zjvsu~0PJ`%H8%KoRk=VB#0CP0U7-mKFnlzy>XalR*FZ9TSb-e4NXQ#%pe-V6z|=s5 zsexqGaIi!rtj3vmFPAPGFbHr}Vtcd#UHey4)4lN)J;ME@SM4KoC>8%y(E=hi4Fqgb zuHM)TAacnbY~dD7ln}DXW*;Ji z4JFliHY>!dlvgOTHc}eP%ECo#84B1k&J+=(kQ_t(^Fk=0Ia}a9Mj@Z&fsX&*+Rt3) z$%Kh0G?Y|4=%fWk&B|Ro=!x?y%N7A?C;$?6Qd-csIeo6<7Yh_|X(-^*&CHs<$0}#D zW|+{%mit9{+>6CBMPwREYixUET53P-xr5>XjEjn*MOYdNu#^VcCXVeou&y&dO=6L< zaaDzN)nb(f51B4gZ6nu%Un=&K=xyxNCqW>{cCRX%Q{JA(CakRB!0CYO6eHJn@n9fc zn8+L=q7x3Xq(#?&WS0}TTN)X-qEpy9F#0$cJ45$)xmdVaS?oO(0KXe?8n_7* z(A=bRJcGQMCY}!xiW^h;P4dxN^Vu?y*6HcXM8ZvDbYWfB+UN*?h9(_Eit)Cc`Cd8v z&?A~Y6`#s7ry-CW|K*5vv}d!+3$_(0dD1nWH;zMHOSeQ51O`;Z#!b!+YKZ?)hZi*y z2i`h~@E76+z8zdbgEyU!ckVV;$r{gz^VUma4sx0s{dn9uHsWY;INip3;@BtrOss^3~9YaZZDH`Tsg5DCG<8tQE$r^w%J3M*10aIJk zwUt+EJKj7UA0=Mm)0X&619j8NMK-!u02~SuB^{_}YTS`EZCsts6g?Rs%@5a;zu{l( z6n{DT?)CHk^NDSAnBFAqi1UrgXti4XZr8xSgMN?x!bksYw+EfR0l(X=ZVy7+Xtg`N zR_8mT^^NE$eNyyo1Ed6YAU^lFa$R4zUw$d$-%8^*{JeQ{^ah>SM#jVj$OfhczC*}Q zCZugH#PX>Hp42B32U>~rck0N(l`=O_7IJ6^m|>bX(k61#<f4)!t z5NhPIUOd@;1R3?Z7%s=3jL~LuVdMThDcxpaLtQUjYKLAA!!&d-5<7&GE?~Tk=r(0S zk2m@GgITd=7W3+3*vqR}yPTOyu~)fnz;$ym$1AqI-MTfiuEr3;$xaFhRdDx z>qVV%;uY5Fpoam!K&Mm)tp(SLp714!>E-$ueoei_!wk2gTDT2;tpTW_dUjDtc|hB~ zALExpSnsXv&Hh^hIKdo+iH8_2`MYs}l6iH>_GXif&A|zVQNh-$2IaoJwzrUYXkq|4 zay_~&jliu3uY*+X11=`@2rP#k45Lf?*0buS{>`4xiSA(+!_V~9_;fj)mgwfkoaPvq zkh5^@?&b5ej66qqF7`RY9)?dCPbc-L8$nt%C3%*&F^7AmD+C6g^n?Cn)y3KS5xFWHl=OTbwP$u6W8~k9(L8mFShGg2_t6P zq-%V8X&E;pOb9(Gp0CpF7OE^oR*-^JH}@h-8&XRg1|ZQ;zDQ1K7A7`D%_g~Ts%bcWXV(ya0LG1 zMlctJu`vTK!A*?6MmEbR{9Vk-##jAJzbV6EDMPA=Izvn4!%GR9N6PA?l+~E`k7{Rq zbux9RHP=fTYi5fs)xwuH4uDKvshGXoIj%EgNN1XDx{ytU9>1!Q1qh*YFQgVTO}an| z{cwJ5iRIeSn))fqt#IAJ_ZkD8Bo+3?yra}Ty0mno80tL+o4+^JV=DGwmk(0kr;G=5 zWxc-SJ+Y!TVw7cKc$n*CNLMDAXE$rSuDzXeLvvM8uQ^543#yGrw;%MNuFeU@MPY1o zT9{K=d1Cx4Lj`ls1_}t_Lhkj)4P;szG#yjQ_MaF-M72s!1$2Z0sxq>JFxaiblymBe zHIO~}a-P-tKc)ZWKi^2lcu4( o5;{67bW-$0|DUGq_4E39{k(o&Kd+zH&$s#f13UT6 3 + raise(Puppet::ParseError, 'staging_parse(): Wrong number of arguments ' \ + "given (#{arguments.size} for 1, 2, 3)") + end + + source = arguments[0] + path = URI.parse(source.tr('\\', '/')).path + + if path.nil? + raise Puppet::ParseError, "staging_parse(): #{source.inspect} has no URI " \ + "'path' component" + end + + info = arguments[1] ? arguments[1] : 'filename' + extension = arguments[2] ? arguments[2] : File.extname(path) + + case info + when 'filename' + result = File.basename(path) + when 'basename' + result = File.basename(path, extension) + when 'extname' + result = File.extname(path) + when 'parent' + result = File.expand_path(File.join(path, '..')) + else + raise Puppet::ParseError, "staging_parse(), unknown parse info #{info}." + end + + return result + end +end diff --git a/environments/prod/modules/staging/manifests/deploy.pp b/environments/prod/modules/staging/manifests/deploy.pp new file mode 100644 index 0000000..f502e46 --- /dev/null +++ b/environments/prod/modules/staging/manifests/deploy.pp @@ -0,0 +1,59 @@ +# The define resource extracts compressed file to a staging location. +define staging::deploy ( + $target, #: the target extraction directory + $source = undef, #: the source file location, supports local files, puppet://, http://, https://, ftp:// + $staging_path = undef, #: the staging location for compressed file. defaults to ${staging::path}/${caller_module_name} + $username = undef, #: https or ftp username + $certificate = undef, #: https certifcate file + $password = undef, #: https or ftp user password or https certificate password + $environment = undef, #: environment variable for settings such as http_proxy + $strip = undef, #: extract file with the --strip=X option. Only works with GNU tar. + $unzip_opts = '', #: additional options to pass the unzip command. + $timeout = undef, #: the time to wait for the file transfer to complete + $user = undef, #: extract file as this user + $group = undef, #: extract group as this group + $creates = undef, #: the file/folder created after extraction. if unspecified defaults to ${target}/${name} + $unless = undef, #: alternative way to conditionally extract file + $onlyif = undef #: alternative way to conditionally extract file +) { + + # grab file name if path was passed in + if $name =~ /.*\/(.*)/ { + $file_name = $1 + } else { + $file_name = $name + } + + if $source { + $source_path = $source + } else { + $source_path = $name + } + + staging::file { $file_name: + source => $source_path, + target => $staging_path, + username => $username, + certificate => $certificate, + password => $password, + environment => $environment, + subdir => $caller_module_name, + timeout => $timeout, + } + + staging::extract { $file_name: + target => $target, + source => $staging_path, + user => $user, + group => $group, + environment => $environment, + strip => $strip, + unzip_opts => $unzip_opts, + subdir => $caller_module_name, + creates => $creates, + unless => $unless, + onlyif => $onlyif, + require => Staging::File[$file_name], + } + +} diff --git a/environments/prod/modules/staging/manifests/extract.pp b/environments/prod/modules/staging/manifests/extract.pp new file mode 100644 index 0000000..6bd5490 --- /dev/null +++ b/environments/prod/modules/staging/manifests/extract.pp @@ -0,0 +1,126 @@ +# Define resource to extract files from staging directories to target directories. +define staging::extract ( + $target, #: the target extraction directory + $source = undef, #: the source compression file, supports tar, tar.gz, zip, war + $creates = undef, #: the file created after extraction. if unspecified defaults ${staging::path}/${caller_module_name}/${name} ${target}/${name} + $unless = undef, #: alternative way to conditionally check whether to extract file. + $onlyif = undef, #: alternative way to conditionally check whether to extract file. + $user = undef, #: extract file as this user. + $group = undef, #: extract file as this group. + $environment = undef, #: environment variables. + $strip = undef, #: extract file with the --strip=X option. Only works with GNU tar. + $unzip_opts = '', #: additional options to pass the unzip command. + $subdir = $caller_module_name #: subdir per module in staging directory. +) { + + include ::staging + + if $source { + $source_path = $source + } else { + if $subdir == '' { # eg when $caller_module_name is blank + $source_path = "${staging::_path}/${name}" + } else { + $source_path = "${staging::_path}/${subdir}/${name}" + } + } + + # Use user supplied creates path, set default value if creates, unless or + # onlyif is not supplied. + if $creates { + $creates_path = $creates + } elsif ! ($unless or $onlyif) { + if $name =~ /.tar.gz$/ { + $folder = staging_parse($name, 'basename', '.tar.gz') + } elsif $name =~ /.tar.bz2$/ { + $folder = staging_parse($name, 'basename', '.tar.bz2') + } else { + $folder = staging_parse($name, 'basename') + } + $creates_path = "${target}/${folder}" + } else { + $creates_path = undef + } + + if scope_defaults('Exec','path') { + Exec{ + cwd => $target, + user => $user, + group => $group, + environment => $environment, + creates => $creates_path, + unless => $unless, + onlyif => $onlyif, + logoutput => on_failure, + } + } else { + Exec{ + path => $::path, + cwd => $target, + user => $user, + group => $group, + environment => $environment, + creates => $creates_path, + unless => $unless, + onlyif => $onlyif, + logoutput => on_failure, + } + } + + if $strip { + if $::osfamily == 'Solaris' or $name !~ /(.tar|.tgz|.tar.gz|.tbz2|.tar.bz2)$/ { + warning('strip is only supported with GNU tar, ignoring the parameter') + $strip_opt = '' + } else { + $strip_opt = " --strip=${strip}" + } + } else { + $strip_opt = '' + } + + case $name { + /.tar$/: { + $command = "tar xf ${source_path}${strip_opt}" + } + + /(.tgz|.tar.gz)$/: { + if $::osfamily == 'Solaris' { + $command = "gunzip -dc < ${source_path} | tar xf - " + } else { + $command = "tar xzf ${source_path}${strip_opt}" + } + } + + /(.tbz2|.tar.bz2)$/: { + $command = "tar xjf ${source_path}${strip_opt}" + } + + /.zip$/: { + $command = "unzip ${unzip_opts} ${source_path}" + } + + /(.war|.jar)$/: { + $command = "jar xf ${source_path}" + } + + /.deb$/: { + if $::osfamily == 'Debian' { + $command = "dpkg --extract ${source_path} ." + } else { + fail('The .deb filetype is only supported on Debian family systems.') + } + } + + /.Z$/: { + $command = "uncompress ${source_path}" + } + + default: { + fail("staging::extract: unsupported file format ${name}.") + } + } + + exec { "extract ${name}": + command => $command, + } +} diff --git a/environments/prod/modules/staging/manifests/file.pp b/environments/prod/modules/staging/manifests/file.pp new file mode 100644 index 0000000..12782ac --- /dev/null +++ b/environments/prod/modules/staging/manifests/file.pp @@ -0,0 +1,166 @@ +# #### Overview: +# +# Define resource to retrieve files to staging directories. It is +# intentionally not replacing files, as these intend to be large binaries +# that are versioned. +# +# #### Notes: +# +# If you specify a different staging location, please manage the file +# resource as necessary. +# +define staging::file ( + $source, #: the source file location, supports local files, puppet://, http://, https://, ftp://, s3:// + $target = undef, #: the target file location, if unspecified ${staging::path}/${subdir}/${name} + $username = undef, #: https or ftp username + $certificate = undef, #: https certificate file + $password = undef, #: https or ftp user password or https certificate password + $environment = undef, #: environment variable for settings such as http_proxy, https_proxy, of ftp_proxy + $timeout = undef, #: the time to wait for the file transfer to complete + $curl_option = undef, #: options to pass to curl + $wget_option = undef, #: options to pass to wget + $tries = undef, #: amount of retries for the file transfer when non transient connection errors exist + $try_sleep = undef, #: time to wait between retries for the file transfer + $owner = undef, #: file owner in the local filesystem for the target + $group = undef, #: file group in the local filesystem for the target + $mode = undef, #: file mode in the local filesystem for the target + $subdir = $caller_module_name +) { + + include ::staging + + $quoted_source = shellquote($source) + + if $target { + $target_file = $target + $staging_dir = staging_parse($target, 'parent') + } else { + $staging_dir = regsubst("${staging::_path}/${subdir}", '/$', '') # Strip off trailing slashes + $target_file = "${staging_dir}/${name}" + + if ! defined(File[$staging_dir]) { + file { $staging_dir: + ensure=>directory, + } + } + } + + Exec { + path => $staging::exec_path, + environment => $environment, + cwd => $staging_dir, + creates => $target_file, + timeout => $timeout, + try_sleep => $try_sleep, + tries => $tries, + logoutput => on_failure, + } + + case $::staging_http_get { + 'curl', default: { + $quoted_credentials = shellquote("${username}:${password}") + $http_get = "curl ${curl_option} -f -L -o ${target_file} ${quoted_source}" + $http_get_passwd = "curl ${curl_option} -f -L -o ${target_file} -u ${quoted_credentials} ${quoted_source}" + $http_get_cert = "curl ${curl_option} -f -L -o ${target_file} -E ${certificate}:${password} ${quoted_source}" + $ftp_get = "curl ${curl_option} -o ${target_file} ${quoted_source}" + $ftp_get_passwd = "curl ${curl_option} -o ${target_file} -u ${username}:${password} ${quoted_source}" + } + 'wget': { + $quoted_password = shellquote($password) + $http_get = "wget ${wget_option} -O ${target_file} ${quoted_source}" + $http_get_passwd = "wget ${wget_option} -O ${target_file} --user=${username} --password=${quoted_password} ${quoted_source}" + $http_get_cert = "wget ${wget_option} -O ${target_file} --user=${username} --certificate=${certificate} ${quoted_source}" + $ftp_get = $http_get + $ftp_get_passwd = $http_get_passwd + } + 'powershell':{ + $http_get = "powershell.exe -Command \"\$wc = New-Object System.Net.WebClient;\$wc.DownloadFile('${source}','${target_file}')\"" + $ftp_get = $http_get + $http_get_passwd = "powershell.exe -Command \"\$wc = New-Object System.Net.WebClient;\$wc.Credentials = New-Object System.Net.NetworkCredential('${username}','${password}');\$wc.DownloadFile('${source}','${target_file}')\"" + $ftp_get_passwd = $http_get_passwd + } + } + + case $source { + /^\//: { + file { $target_file: + source => $source, + owner => $owner, + group => $group, + mode => $mode, + replace => false, + } + } + /^[A-Za-z]:/: { + if versioncmp($::puppetversion, '3.4.0') >= 0 { + file { $target_file: + source => $source, + owner => $owner, + group => $group, + mode => $mode, + replace => false, + source_permissions => ignore, + } + } else { + file { $target_file: + source => $source, + owner => $owner, + group => $group, + mode => $mode, + replace => false, + } + } + } + /^puppet:\/\//: { + file { $target_file: + source => $source, + owner => $owner, + group => $group, + mode => $mode, + replace => false, + } + } + /^http:\/\//: { + if $username { $command = $http_get_passwd } + else { $command = $http_get } + exec { $target_file: + command => $command, + } + } + /^https:\/\//: { + if $username { $command = $http_get_passwd } + elsif $certificate { $command = $http_get_cert } + else { $command = $http_get } + exec { $target_file: + command => $command, + } + } + /^ftp:\/\//: { + if $username { $command = $ftp_get_passwd } + else { $command = $ftp_get } + exec { $target_file: + command => $command, + } + } + /^s3:\/\//: { + $command = "aws s3 cp ${source} ${target_file}" + exec { $target_file: + command => $command, + } + } + default: { + fail("staging::file: do not recognize source ${source}.") + } + } + + if $source =~ /^(?:https?|ftp|s3):\/\// { + file { $target_file: + ensure => file, + owner => $owner, + group => $group, + mode => $mode, + require => Exec[$target_file], + } + } + +} diff --git a/environments/prod/modules/staging/manifests/init.pp b/environments/prod/modules/staging/manifests/init.pp new file mode 100644 index 0000000..6fac550 --- /dev/null +++ b/environments/prod/modules/staging/manifests/init.pp @@ -0,0 +1,34 @@ +# This module manages staging and extraction of files from various sources. +# +# #### Actions: +# +# Creates the root staging directory. By default files will be created in a subdirectory matching the caller_module_name. +# +# /opt/staging/ +# |-- puppet +# | `-- puppet.enterprise.2.0.tar.gz +# `-- tomcat +# `-- tomcat.5.0.tar.gz +# +class staging ( + $path = $staging::params::path, #: staging directory filepath + $owner = $staging::params::owner, #: staging directory owner + $group = $staging::params::group, #: staging directory group + $mode = $staging::params::mode, #: staging directory permission + $exec_path = $staging::params::exec_path #: executable default path +) inherits staging::params { + + # Strip off any trailing '/' + $_path = regsubst($path,'/$','') + + # Resolve conflict with pe_staging + if !defined(File[$_path]) { + file { $_path: + ensure => directory, + owner => $owner, + group => $group, + mode => $mode, + } + } + +} diff --git a/environments/prod/modules/staging/manifests/params.pp b/environments/prod/modules/staging/manifests/params.pp new file mode 100644 index 0000000..200b3ad --- /dev/null +++ b/environments/prod/modules/staging/manifests/params.pp @@ -0,0 +1,40 @@ +# OS specific parameters +class staging::params { + case $::osfamily { + default: { + $path = '/opt/staging' + $owner = '0' + $group = '0' + $mode = '0755' + $exec_path = '/usr/local/bin:/usr/bin:/bin' + } + 'Solaris': { + $path = '/opt/staging' + $owner = '0' + $group = '0' + $mode = '0755' + $exec_path = '/usr/local/bin:/usr/bin:/bin:/usr/sfw/bin' + } + 'windows': { + $path = $::staging_windir + $owner = 'S-1-5-32-544' # Adminstrators + $group = 'S-1-5-18' # SYSTEM + $mode = '0660' + $exec_path = $::path + } + 'FreeBSD': { + $path = '/var/tmp/staging' + $owner = '0' + $group = '0' + $mode = '0755' + $exec_path = '/usr/local/bin:/usr/bin:/bin' + } + 'OpenBSD': { + $path = '/var/staging' + $owner = '0' + $group = '0' + $mode = '0755' + $exec_path = '/usr/local/bin:/usr/bin:/bin' + } + } +} diff --git a/environments/prod/modules/staging/metadata.json b/environments/prod/modules/staging/metadata.json new file mode 100644 index 0000000..bdb4a09 --- /dev/null +++ b/environments/prod/modules/staging/metadata.json @@ -0,0 +1,115 @@ +{ + "name": "puppet-staging", + "version": "2.2.0", + "author": "Vox Pupuli", + "summary": "Compressed file staging and deployment", + "license": "Apache-2.0", + "source": "https://github.com/voxpupuli/puppet-staging", + "project_page": "https://github.com/voxpupuli/puppet-staging", + "issues_url": "https://github.com/voxpupuli/puppet-staging/issues", + "dependencies": [ + + ], + "data_provider": null, + "operatingsystem_support": [ + { + "operatingsystem": "RedHat", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "CentOS", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "OracleLinux", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "Scientific", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "SLES", + "operatingsystemrelease": [ + "11 SP1" + ] + }, + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "6", + "7", + "8" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "12.04", + "14.04", + "16.04" + ] + }, + { + "operatingsystem": "Solaris", + "operatingsystemrelease": [ + "10", + "11" + ] + }, + { + "operatingsystem": "Windows", + "operatingsystemrelease": [ + "Server 2003", + "Server 2003 R2", + "Server 2008", + "Server 2008 R2", + "Server 2012", + "Server 2012 R2", + "7", + "8", + "10" + ] + }, + { + "operatingsystem": "AIX", + "operatingsystemrelease": [ + "5.3", + "6.1", + "7.1" + ] + }, + { + "operatingsystem": "OpenBSD", + "operatingsystemrelease": [ + "5.7", + "5.8", + "5.9", + "6.0" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">= 3.8.7 < 5.0.0" + } + ], + "description": "Manages compressed file staging and deployment." +} diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/centos-511-x64.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/centos-511-x64.yml new file mode 100644 index 0000000..089d646 --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/centos-511-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-511-x64: + roles: + - master + platform: el-5-x86_64 + box: puppetlabs/centos-5.11-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/centos-66-x64-pe.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/centos-66-x64-pe.yml new file mode 100644 index 0000000..1e7aea6 --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/centos-66-x64-pe.yml @@ -0,0 +1,17 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-66-x64: + roles: + - master + - database + - dashboard + platform: el-6-x86_64 + box: puppetlabs/centos-6.6-64-puppet-enterprise + hypervisor: vagrant +CONFIG: + type: pe +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/centos-66-x64.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/centos-66-x64.yml new file mode 100644 index 0000000..42455e7 --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/centos-66-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-66-x64: + roles: + - master + platform: el-6-x86_64 + box: puppetlabs/centos-6.6-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/centos-72-x64.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/centos-72-x64.yml new file mode 100644 index 0000000..85af89d --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/centos-72-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-72-x64: + roles: + - master + platform: el-7-x86_64 + box: puppetlabs/centos-7.2-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/debian-78-x64.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/debian-78-x64.yml new file mode 100644 index 0000000..6ef6de8 --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/debian-78-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + debian-78-x64: + roles: + - master + platform: debian-7-amd64 + box: puppetlabs/debian-7.8-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/debian-82-x64.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/debian-82-x64.yml new file mode 100644 index 0000000..9897a8f --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/debian-82-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + debian-82-x64: + roles: + - master + platform: debian-8-amd64 + box: puppetlabs/debian-8.2-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/docker/centos-5.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/centos-5.yml new file mode 100644 index 0000000..c17bc3d --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/centos-5.yml @@ -0,0 +1,19 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-5-x64: + platform: el-5-x86_64 + hypervisor: docker + image: centos:5 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'yum install -y crontabs initscripts iproute openssl sysvinit-tools tar wget which' + - 'sed -i -e "/mingetty/d" /etc/inittab' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/docker/centos-6.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/centos-6.yml new file mode 100644 index 0000000..d93f884 --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/centos-6.yml @@ -0,0 +1,20 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-6-x64: + platform: el-6-x86_64 + hypervisor: docker + image: centos:6 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'rm -rf /var/run/network/*' + - 'yum install -y crontabs initscripts iproute openssl sysvinit-tools tar wget which' + - 'rm /etc/init/tty.conf' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/docker/centos-7.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/centos-7.yml new file mode 100644 index 0000000..886b1ee --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/centos-7.yml @@ -0,0 +1,18 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-7-x64: + platform: el-7-x86_64 + hypervisor: docker + image: centos:7 + docker_preserve_image: true + docker_cmd: '["/usr/sbin/init"]' + docker_image_commands: + - 'yum install -y crontabs initscripts iproute openssl sysvinit-tools tar wget which' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/docker/debian-7.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/debian-7.yml new file mode 100644 index 0000000..071acbf --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/debian-7.yml @@ -0,0 +1,19 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + debian-7-x64: + platform: debian-7-amd64 + hypervisor: docker + image: debian:7 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'echo deb http://ftp.debian.org/debian wheezy-backports main >> /etc/apt/sources.list' + - 'apt-get update && apt-get install -y cron locales-all net-tools wget' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/docker/debian-8.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/debian-8.yml new file mode 100644 index 0000000..500bee5 --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/debian-8.yml @@ -0,0 +1,20 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + debian-8-x64: + platform: debian-8-amd64 + hypervisor: docker + image: debian:8 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'echo deb http://ftp.debian.org/debian jessie-backports main >> /etc/apt/sources.list' + - 'apt-get update && apt-get install -y cron locales-all net-tools wget' + - 'rm -f /usr/sbin/policy-rc.d' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/docker/ubuntu-12.04.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/ubuntu-12.04.yml new file mode 100644 index 0000000..ab77cda --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/ubuntu-12.04.yml @@ -0,0 +1,19 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + ubuntu-1204-x64: + platform: ubuntu-12.04-amd64 + hypervisor: docker + image: ubuntu:12.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get install -y net-tools wget' + - 'locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/ubuntu-14.04.yml new file mode 100644 index 0000000..54d5e5a --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/ubuntu-14.04.yml @@ -0,0 +1,21 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + ubuntu-1404-x64: + platform: ubuntu-14.04-amd64 + hypervisor: docker + image: ubuntu:14.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'rm /usr/sbin/policy-rc.d' + - 'rm /sbin/initctl; dpkg-divert --rename --remove /sbin/initctl' + - 'apt-get install -y net-tools wget' + - 'locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/docker/ubuntu-16.04.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/ubuntu-16.04.yml new file mode 100644 index 0000000..92a93cb --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/docker/ubuntu-16.04.yml @@ -0,0 +1,19 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + ubuntu-1604-x64: + platform: ubuntu-16.04-amd64 + hypervisor: docker + image: ubuntu:16.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get install -y net-tools wget' + - 'locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/fedora-24-x64.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/fedora-24-x64.yml new file mode 100644 index 0000000..820b62d --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/fedora-24-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + fedora-24-x64: + roles: + - master + platform: fedora-24-x86_64 + box: fedora/24-cloud-base + hypervisor: vagrant +CONFIG: + type: aio +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/fedora-25-x64.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/fedora-25-x64.yml new file mode 100644 index 0000000..c3a3cbf --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/fedora-25-x64.yml @@ -0,0 +1,18 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +# +# platform is fedora 24 because there is no +# puppet-agent for fedora 25 by 2016-12-30 +HOSTS: + fedora-25-x64: + roles: + - master + platform: fedora-24-x86_64 + box: fedora/25-cloud-base + hypervisor: vagrant +CONFIG: + type: aio +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/ubuntu-server-1204-x64.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/ubuntu-server-1204-x64.yml new file mode 100644 index 0000000..29102c5 --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/ubuntu-server-1204-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + ubuntu-server-1204-x64: + roles: + - master + platform: ubuntu-12.04-amd64 + box: puppetlabs/ubuntu-12.04-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml new file mode 100644 index 0000000..054e658 --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + ubuntu-server-1404-x64: + roles: + - master + platform: ubuntu-14.04-amd64 + box: puppetlabs/ubuntu-14.04-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/acceptance/nodesets/ubuntu-server-1604-x64.yml b/environments/prod/modules/staging/spec/acceptance/nodesets/ubuntu-server-1604-x64.yml new file mode 100644 index 0000000..bc85e0e --- /dev/null +++ b/environments/prod/modules/staging/spec/acceptance/nodesets/ubuntu-server-1604-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + ubuntu-server-1604-x64: + roles: + - master + platform: ubuntu-16.04-amd64 + box: puppetlabs/ubuntu-16.04-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/prod/modules/staging/spec/classes/coverage_spec.rb b/environments/prod/modules/staging/spec/classes/coverage_spec.rb new file mode 100644 index 0000000..de44654 --- /dev/null +++ b/environments/prod/modules/staging/spec/classes/coverage_spec.rb @@ -0,0 +1,4 @@ +require 'rspec-puppet' + +at_exit { RSpec::Puppet::Coverage.report! } +# vim: syntax=ruby diff --git a/environments/prod/modules/staging/spec/default_facts.yml b/environments/prod/modules/staging/spec/default_facts.yml new file mode 100644 index 0000000..13c4165 --- /dev/null +++ b/environments/prod/modules/staging/spec/default_facts.yml @@ -0,0 +1,14 @@ +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +# +# use default_module_facts.yaml for module specific +# facts. +# +# Hint if using with rspec-puppet-facts ("on_supported_os.each"): +# if a same named fact exists in facterdb it will be overridden. +--- +concat_basedir: "/tmp" +ipaddress: "172.16.254.254" +is_pe: false +macaddress: "AA:AA:AA:AA:AA:AA" diff --git a/environments/prod/modules/staging/spec/defines/staging_deploy_spec.rb b/environments/prod/modules/staging/spec/defines/staging_deploy_spec.rb new file mode 100644 index 0000000..6145cf6 --- /dev/null +++ b/environments/prod/modules/staging/spec/defines/staging_deploy_spec.rb @@ -0,0 +1,104 @@ +require 'spec_helper' +describe 'staging::deploy', type: :define do + let(:facts) do + { + caller_module_name: '', + osfamily: 'RedHat', + staging_http_get: 'curl', + path: '/usr/local/bin:/usr/bin:/bin' + } + end + + describe 'when deploying tar.gz' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { + source: 'puppet:///modules/staging/sample.tar.gz', + target: '/usr/local' + } + end + + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_file('/opt/staging') } + it { is_expected.to contain_file('/opt/staging/sample.tar.gz') } + it do + is_expected.to contain_exec('extract sample.tar.gz').with(command: 'tar xzf /opt/staging/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/usr/local', + creates: '/usr/local/sample') + end + end + + describe 'when deploying tar.gz with full path in title and no source' do + let(:title) { 'puppet:///modules/staging/sample.tar.gz' } + let(:params) do + { + target: '/usr/local' + } + end + + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_file('/opt/staging') } + it { is_expected.to contain_file('/opt/staging/sample.tar.gz') } + it do + is_expected.to contain_exec('extract sample.tar.gz').with(command: 'tar xzf /opt/staging/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/usr/local', + creates: '/usr/local/sample') + end + end + + describe 'fail when deploying tar.gz with filename in title and no source' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { + target: '/usr/local' + } + end + + it do + expect do + is_expected.to contain_exec('extract sample.tar.gz') + end.to raise_error(Puppet::Error, %r{do not recognize source}) + end + end + + describe 'when deploying tar.gz with strip' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { + source: 'puppet:///modules/staging/sample.tar.gz', + target: '/usr/local', + strip: 1 + } + end + + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_file('/opt/staging') } + it { is_expected.to contain_file('/opt/staging/sample.tar.gz') } + it do + is_expected.to contain_exec('extract sample.tar.gz').with(command: 'tar xzf /opt/staging/sample.tar.gz --strip=1', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/usr/local', + creates: '/usr/local/sample') + end + end + + describe 'when deploying zip file with unzip_opts' do + let(:title) { 'sample.zip' } + let(:params) do + { source: 'puppet:///modules/staging/sample.tar.gz', + target: '/usr/local', + unzip_opts: '-o -f' } + end + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_file('/opt/staging') } + it { is_expected.to contain_file('/opt/staging/sample.zip') } + it do + is_expected.to contain_exec('extract sample.zip').with(command: 'unzip -o -f /opt/staging/sample.zip', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/usr/local', + creates: '/usr/local/sample') + end + end +end diff --git a/environments/prod/modules/staging/spec/defines/staging_extract_spec.rb b/environments/prod/modules/staging/spec/defines/staging_extract_spec.rb new file mode 100644 index 0000000..0adc614 --- /dev/null +++ b/environments/prod/modules/staging/spec/defines/staging_extract_spec.rb @@ -0,0 +1,175 @@ +require 'spec_helper' +describe 'staging::extract', type: :define do + # forcing a more sane caller_module_name to match real usage. + let(:facts) do + { + osfamily: 'RedHat', + path: '/usr/local/bin:/usr/bin:/bin' + } + end + + describe 'when deploying tar.gz' do + let(:title) { 'sample.tar.gz' } + let(:params) { { target: '/opt' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.tar.gz').with(command: 'tar xzf /opt/staging/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying tar.gz with strip' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { target: '/opt', + strip: 1 } + end + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.tar.gz').with(command: 'tar xzf /opt/staging/sample.tar.gz --strip=1', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying tbz2' do + let(:title) { 'sample.tbz2' } + let(:params) { { target: '/opt' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.tbz2').with(command: 'tar xjf /opt/staging/sample.tbz2', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying zip' do + let(:title) { 'sample.zip' } + let(:params) { { target: '/opt' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.zip').with(command: 'unzip /opt/staging/sample.zip', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying zip with unzip_opts' do + let(:title) { 'sample.zip' } + let(:params) do + { + target: '/opt', + unzip_opts: '-o -f' + } + end + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.zip').with(command: 'unzip -o -f /opt/staging/sample.zip', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying zip with strip (noop)' do + let(:title) { 'sample.zip' } + let(:params) do + { + target: '/opt', + strip: 1 + } + end + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.zip').with(command: 'unzip /opt/staging/sample.zip', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying war' do + let(:title) { 'sample.war' } + let(:params) { { target: '/opt' } } + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.war').with(command: 'jar xf /opt/staging/sample.war', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying war with strip (noop) and unzip_opts (noop)' do + let(:title) { 'sample.war' } + let(:params) do + { + target: '/opt', + strip: 1, + unzip_opts: '-o -f' + } + end + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.war').with(command: 'jar xf /opt/staging/sample.war', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying deb on a Debian family system' do + let(:facts) do + { + osfamily: 'Debian', + path: '/usr/local/bin:/usr/bin:/bin' + } + end + let(:title) { 'sample.deb' } + let(:params) { { target: '/opt' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.deb').with(command: 'dpkg --extract /opt/staging/sample.deb .', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying deb on a non-Debian family system' do + let(:title) { 'sample.deb' } + let(:params) do + { target: '/opt' } + end + it 'fails' do + is_expected.to compile.and_raise_error(%r{The .deb filetype is only supported on Debian family systems.}) + end + end + + describe 'when deploying unknown' do + let(:title) { 'sample.zzz' } + let(:params) { { target: '/opt' } } + + it { expect { is_expected.to contain_exec('exec sample.zzz') }.to raise_error(Puppet::Error) } + end +end diff --git a/environments/prod/modules/staging/spec/defines/staging_file_spec.rb b/environments/prod/modules/staging/spec/defines/staging_file_spec.rb new file mode 100644 index 0000000..4562561 --- /dev/null +++ b/environments/prod/modules/staging/spec/defines/staging_file_spec.rb @@ -0,0 +1,219 @@ +require 'spec_helper' +describe 'staging::file', type: :define do + # forcing a more sane caller_module_name to match real usage. + let(:facts) do + { + osfamily: 'RedHat', + staging_http_get: 'curl', + puppetversion: Puppet.version + } + end + + describe 'when deploying via puppet' do + let(:title) { 'sample.tar.gz' } + let(:params) { { source: 'puppet:///modules/staging/sample.tar.gz' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_file('/opt/staging/sample.tar.gz') + is_expected.not_to contain_exec('/opt/staging/sample.tar.gz') + end + end + + describe 'when deploying via local' do + let(:title) { 'sample.tar.gz' } + let :params do + { + source: '/nfs/sample.tar.gz', + target: '/usr/local/sample.tar.gz' + } + end + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_file('/usr/local/sample.tar.gz') + is_expected.not_to contain_exec('/opt/staging/sample.tar.gz') + end + end + + describe 'when deploying via Windows local' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { + source: 'S:/nfs/sample.tar.gz', + target: '/usr/local/sample.tar.gz' + } + end + + # it { is_expected.to compile.with_all_deps } # This test will fail unless we're running the tests on Windows. + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_file('/usr/local/sample.tar.gz') + is_expected.not_to contain_exec('/opt/staging/sample.tar.gz') + end + end + + describe 'when deploying via http' do + let(:title) { 'sample.tar.gz' } + let(:params) { { source: 'http://webserver/sample.tar.gz' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -f -L -o /opt/staging/sample.tar.gz http://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + is_expected.to contain_file('/opt/staging/sample.tar.gz').with(owner: nil, + group: nil, + mode: nil) + end + end + + describe 'when deploying via http with file parameters' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { + source: 'http://webserver/sample.tar.gz', + owner: 'root', + group: 'root', + mode: '0644' + } + end + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -f -L -o /opt/staging/sample.tar.gz http://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + is_expected.to contain_file('/opt/staging/sample.tar.gz').with(owner: 'root', + group: 'root', + mode: '0644') + end + end + + describe 'when deploying via http with custom curl options' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { + source: 'http://webserver/sample.tar.gz', + curl_option: '-b' + } + end + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -b -f -L -o /opt/staging/sample.tar.gz http://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + end + end + + describe 'when deploying via http with parameters' do + let(:title) { 'sample.tar.gz' } + let :params do + { + source: 'http://webserver/sample.tar.gz', + target: '/usr/local/sample.tar.gz', + tries: '10', + try_sleep: '6' + } + end + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/usr/local/sample.tar.gz').with(command: 'curl -f -L -o /usr/local/sample.tar.gz http://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/usr/local', + creates: '/usr/local/sample.tar.gz', + tries: '10', + try_sleep: '6') + end + end + + describe 'when deploying via https' do + let(:title) { 'sample.tar.gz' } + let(:params) { { source: 'https://webserver/sample.tar.gz' } } + + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_file('/opt/staging') } + it do + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -f -L -o /opt/staging/sample.tar.gz https://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + end + end + + describe 'when deploying via https with parameters' do + let(:title) { 'sample.tar.gz' } + let :params do + { + source: 'https://webserver/sample.tar.gz', + username: 'puppet', + password: 'puppet' + } + end + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -f -L -o /opt/staging/sample.tar.gz -u puppet:puppet https://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + end + end + + describe 'when deploying via ftp' do + let(:title) { 'sample.tar.gz' } + let(:params) { { source: 'ftp://webserver/sample.tar.gz' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -o /opt/staging/sample.tar.gz ftp://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + end + end + + describe 'when deploying via ftp with parameters' do + let(:title) { 'sample.tar.gz' } + let :params do + { + source: 'ftp://webserver/sample.tar.gz', + username: 'puppet', + password: 'puppet' + } + end + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -o /opt/staging/sample.tar.gz -u puppet:puppet ftp://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + end + end +end diff --git a/environments/prod/modules/staging/spec/fixtures/hiera.yaml b/environments/prod/modules/staging/spec/fixtures/hiera.yaml new file mode 100644 index 0000000..d8adad2 --- /dev/null +++ b/environments/prod/modules/staging/spec/fixtures/hiera.yaml @@ -0,0 +1,9 @@ +--- +:backends: + - puppet + +:hierarchy: + - common + +:puppet: + :datasource: data diff --git a/environments/prod/modules/staging/spec/spec.opts b/environments/prod/modules/staging/spec/spec.opts new file mode 100644 index 0000000..91cd642 --- /dev/null +++ b/environments/prod/modules/staging/spec/spec.opts @@ -0,0 +1,6 @@ +--format +s +--colour +--loadby +mtime +--backtrace diff --git a/environments/prod/modules/staging/spec/spec_helper.rb b/environments/prod/modules/staging/spec/spec_helper.rb new file mode 100644 index 0000000..32709c8 --- /dev/null +++ b/environments/prod/modules/staging/spec/spec_helper.rb @@ -0,0 +1,32 @@ +require 'puppetlabs_spec_helper/module_spec_helper' +require 'rspec-puppet-facts' +include RspecPuppetFacts + +if Dir.exist?(File.expand_path('../../lib', __FILE__)) && RUBY_VERSION !~ %r{^1.9} + require 'coveralls' + require 'simplecov' + require 'simplecov-console' + SimpleCov.formatters = [ + SimpleCov::Formatter::HTMLFormatter, + SimpleCov::Formatter::Console, + Coveralls::SimpleCov::Formatter + ] + SimpleCov.start do + track_files 'lib/**/*.rb' + add_filter '/spec' + add_filter '/vendor' + add_filter '/.vendor' + end +end + +RSpec.configure do |c| + default_facts = { + puppetversion: Puppet.version, + facterversion: Facter.version + } + default_facts.merge!(YAML.load(File.read(File.expand_path('../default_facts.yml', __FILE__)))) if File.exist?(File.expand_path('../default_facts.yml', __FILE__)) + default_facts.merge!(YAML.load(File.read(File.expand_path('../default_module_facts.yml', __FILE__)))) if File.exist?(File.expand_path('../default_module_facts.yml', __FILE__)) + c.default_facts = default_facts +end + +# vim: syntax=ruby diff --git a/environments/prod/modules/staging/spec/unit/puppet/parser/functions/scope_defaults_spec.rb b/environments/prod/modules/staging/spec/unit/puppet/parser/functions/scope_defaults_spec.rb new file mode 100644 index 0000000..3c1b0e5 --- /dev/null +++ b/environments/prod/modules/staging/spec/unit/puppet/parser/functions/scope_defaults_spec.rb @@ -0,0 +1,45 @@ +#!/usr/bin/env rspec +require 'spec_helper' + +describe 'the scope_defaults function' do + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + it 'exists' do + Puppet::Parser::Functions.function('scope_defaults').should == 'function_scope_defaults' + end + + it 'raises a ParseError if there is less than 2 arguments' do + expect { scope.function_scope_defaults([]) }. + to raise_error(Puppet::ParseError) + end + + it 'raises a ParseError if there is more than 2 arguments' do + expect { scope.function_scope_defaults(%w(exec path error)) }. + to raise_error(Puppet::ParseError) + end + + it 'returns false for invalid resource' do + result = scope.function_scope_defaults(%w(foo path)) + result.should(eq(false)) + end + + it 'returns false for resource without default attributes' do + if scope.respond_to? :define_settings + scope.define_settings('Exec', Puppet::Parser::Resource::Param.new(name: :path, value: '/bin')) + else + scope.setdefaults('Exec', Puppet::Parser::Resource::Param.new(name: :path, value: '/bin')) + end + result = scope.function_scope_defaults(%w(Exec foo)) + result.should(eq(false)) + end + + it 'returns true for resource with default attributes' do + if scope.respond_to? :define_settings + scope.define_settings('Exec', Puppet::Parser::Resource::Param.new(name: :path, value: '/bin')) + else + scope.setdefaults('Exec', Puppet::Parser::Resource::Param.new(name: :path, value: '/bin')) + end + result = scope.function_scope_defaults(%w(Exec path)) + result.should(eq(true)) + end +end diff --git a/environments/prod/modules/staging/spec/unit/puppet/parser/functions/staging_parse_spec.rb b/environments/prod/modules/staging/spec/unit/puppet/parser/functions/staging_parse_spec.rb new file mode 100644 index 0000000..100fc69 --- /dev/null +++ b/environments/prod/modules/staging/spec/unit/puppet/parser/functions/staging_parse_spec.rb @@ -0,0 +1,51 @@ +#!/usr/bin/env rspec +require 'spec_helper' + +describe 'the staging parser function' do + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + it 'exists' do + Puppet::Parser::Functions.function('staging_parse').should == 'function_staging_parse' + end + + it 'raises a ParseError if there is less than 1 arguments' do + -> { scope.function_staging_parse([]) }.should(raise_error(Puppet::ParseError)) + end + + it 'raises a ParseError if there is more than 3 arguments' do + -> { scope.function_staging_parse(['/etc', 'filename', '.zip', 'error']) }.should(raise_error(Puppet::ParseError)) + end + + it 'raises a ParseError if there is an invalid info request' do + -> { scope.function_staging_parse(['/etc', 'sheep', '.zip']) }.should(raise_error(Puppet::ParseError)) + end + + it "raises a ParseError if 'source' doesn't have a URI path component" do + -> { scope.function_staging_parse(['uri:without-path']) }.should(raise_error(Puppet::ParseError, %r{has no URI 'path' component})) + end + + it 'returns the filename by default' do + result = scope.function_staging_parse(['/etc/puppet/sample.tar.gz']) + result.should(eq('sample.tar.gz')) + end + + it 'returns the file basename' do + result = scope.function_staging_parse(['/etc/puppet/sample.tar.gz', 'basename']) + result.should(eq('sample.tar')) + end + + it 'returns the file basename with custom extensions' do + result = scope.function_staging_parse(['/etc/puppet/sample.tar.gz', 'basename', '.tar.gz']) + result.should(eq('sample')) + end + + it 'returns the file extname' do + result = scope.function_staging_parse(['/etc/puppet/sample.tar.gz', 'extname']) + result.should(eq('.gz')) + end + + it 'returns the file parent' do + result = scope.function_staging_parse(['/etc/puppet/sample.tar.gz', 'parent']) + result.should(eq('/etc/puppet')) + end +end diff --git a/environments/prod/modules/stdlib/CHANGELOG.md b/environments/prod/modules/stdlib/CHANGELOG.md new file mode 100644 index 0000000..eeca835 --- /dev/null +++ b/environments/prod/modules/stdlib/CHANGELOG.md @@ -0,0 +1,775 @@ +## Supported Release 4.16.0 +### Summary + +This release sees a massive update to all unit tests to test UTF8 characters. There are also multiple cleanups in preparation for internationalization. Alongside this, improvements to ipv6 support, a new length function compatible with Puppet 4, and an update to path types. Also contains multiple bug fixes around functionality and tests. + +#### Features +- Addition of coverage in all unit tests for functions, data and resource types for UTF8 for i18n. +- All strings within the readme and functions that are split over two lines have been combined in preparation for i18n parser/decorator. +- Improvement on the ipv6 support for type - Improves regex to catch some valid (but lesser known) ipv6 strings, mostly those which are a mix of ipv6 strings and embedded ipv6 numbers. +- Adds a new parameter `encoding` to allow non UTF-8 files to specify a file encoding. This prevents receiving the error message "invalid byte sequence in UTF-8" when special characters that are not UTF-8 encoded appear in the input stream, such as the copyright symbol. +- Addition of the new length function. Returns the length of a given string, array or hash. To eventually replace the deprecated size() function as can handle the new type functionality introduced in Puppet 4. +- Permit double slash in absolute/Unix path types. + +#### Bugfixes +- Fix unsupported data type error with rspec-puppet master. +- Now allows test module metadata.json to be read by Puppet. +- Fix acceptance test failure "Hiera is not a class". +- Removal of unsupported platforms and future parser setting in acceptance tests. +- Regex for tuple checking has been loosened. +- Ensure_packages function - Now only tries to apply the resource if not defined. +- (MODULES-4528) Use versioncmp to check Puppet version for 4.10.x compat. +- Adds comments to warn for UTF8 incompatibility of the functions that may not be compatible with UTF8 with Ruby < 2.4.0. + +## Supported Release 4.15.0 +### Summary + +This release introduces multiple new functions, a new fact and the addition of Ubuntu Xenial support. Also includes a bugfix and documentation update. + +#### Features +- Addition of puppet_server fact to return agents server. +- Addition of a pry function. +- Addition of tests for ensure_resources. +- Addition of FQDN UUID generation function. +- Addition of Ubuntu Xenial to OS Support. + +####Bugfixes +- Ensure_packages now works with Ruby < 2.0. +- Updated the documentation of str2bool function. + +## Supported Release 4.14.0 +### Summary + +Adds several new features and updates, especially around refining the deprecation and validate_legacy functions. Also includes a Gemfile update around an issue with parallel_tests dependancy for different versions of Ruby. + +#### Features +- Deprecation function now uses puppet stacktrace if available. +- join_key_to_values function now handles array values. If values are arrays, multiple keys are added for each element. +- Updated Gemfile to deal with parallel_tests Ruby dependancy (MODULES-3983). +- Updated/Fixed ipv4 regex validator (MODULES-3980). +- Deprecation clarification added to README. + +#### Bugfixes +- README typo fixes. +- Use .dup to duplicate classes for modification (MODULES-3829). +- Fixes spec failures that were caused by a change in the tested error message in validate_legacy_spec. +- Broken link to validate_legacy docs fixed. +- Updates deprecation tests to include future parser. + +## Supported Release 4.13.1 +### Summary + +This bugfix release addresses the `undefined method 'optional_repeated_param'` error messages seen by users of puppet 3.7. + +It also improves the user experience around function deprecations by emitting one warning per function(-name) instead of only one deprecation overall. This allows users to identify all deprecated functions used in one agent run, with less back-and-forth. + +#### Bugfixes + +* Emit deprecations warnings for each function, instead of once per process. (MODULES-3961) +* Use a universally available API for the v4 deprecation stubs of `is_*` and `validate_*`. (MODULES-3962) +* Make `getvar()` compatible to ruby 1.8.7. (MODULES-3969) +* Add v4 deprecation stubs for the `is_` counterparts of the deprecated functions to emit the deprecations warnings in all cases. + + +## Supported Release 4.13.0 +### Summary + +This version of stdlib deprecates a whole host of functions, and provides stepping stones to move to Puppet 4 type validations. Be sure to check out the new `deprecation()` and `validate_legacy()` functions to migrate off the deprecated v3-style data validations. + +Many thanks to all community contributors: bob, Dmitry Ilyin, Dominic Cleal, Joris, Joseph Yaworski, Loic Antoine-Gombeaud, Maksym Melnychok, Michiel Brandenburg, Nate Potter, Romain Tartière, Stephen Benjamin, and Steve Moore, as well as anyone contributing in the code review process and by submitting issues. + +Special thanks to [Voxpupuli's](https://voxpupuli.org/) Igor Galić for donating the puppet-tea types to kickstart this part of stdlib. + + +#### Deprecations +* `validate_absolute_path`, `validate_array`, `validate_bool`, `validate_hash`, `validate_integer`, `validate_ip_address`, `validate_ipv4_address`, `validate_ipv6_address`, `validate_numeric`, `validate_re`, `validate_slength`, `validate_string`, and their `is_` counter parts are now deprecated on Puppet 4. See the `validate_legacy()` description in the README for help on migrating away from those functions. +* The `dig` function is provided by core puppet since 4.5.0 with slightly different calling convention. The stdlib version can still be accessed as `dig44` for now. + + +#### Features +* Add Puppet 4 data types for Unix, and Windows paths, and URLs. +* Add `deprecation` function to warn users of functionality that will be removed soon. +* Add `validate_legacy` function to help with migrating to Puppet 4 data types. + +* Add `any2bool` function, a combination of of `string2bool` and `num2bool`. +* Add `delete_regex` function to delete array elements matching a regular expression. +* Add `puppet_environmentpath` fact to expose the `environmentpath` setting. +* Add `regexpescape` function to safely insert arbitrary strings into regular expressions. +* Add `shell_escape`, `shell_join`, and `shell_split` functions for safer working with shell scripts.. + +* The `delete` function now also accepts regular expressions as search term. +* The `loadyaml` function now accepts a default value, which is returned when there is an error loading the file. + +#### Bugfixes +* Fix `file_line.match_for_absence` implementation and description to actually work. (MODULES-3590) +* Fix `getparam` so that it can now also return `false`. (MODULES-3933) +* Fix the fixture setup for testing and adjust `load_module_metadata` and `loadjson` tests. +* Fix `defined_with_params` to handle `undef` correctly on all puppet versions. (PUP-6422, MODULES-3543) +* Fix `file_line.path` validation to use puppet's built in `absolute_path?` matcher. + +#### Minor Improvements +* README changes: improved descriptions of `deep_merge`, `delete`, `ensure_packages`, `file_line.after`, `range`, and `validate_numeric`. +* The `getvar` function now returns nil in all situations where the variable is not found. +* Update the `dig44` function with better `undef`, `nil`, and `false` handling. +* Better wording on `str2bool` argument validation error message. + + +### Known issues +* The `validate_legacy` function relies on internal APIs from Puppet 4.4.0 (PE 2016.1) onwards, and doesn't work on earlier versions. +* Puppet 4.5.0 (PE 2016.2) has a number of improvements around data types - especially error handling - that make working with them much nicer. + +## Supported Release 4.12.0 +###Summary + +This release provides several new functions, bugfixes, modulesync changes, and some documentation updates. + +####Features +- Adds `clamp`. This function keeps values within a specified range. +- Adds `validate_x509_rsa_key_pair`. This function validates an x509 RSA certificate and key pair. +- Adds `dig`. This function performs a deep lookup in nested hashes or arrays. +- Extends the `base64` support to fit `rfc2045` and `rfc4648`. +- Adds `is_ipv6_address` and `is_ipv4_address`. These functions validate the specified ipv4 or ipv6 addresses. +- Adds `enclose_ipv6`. This function encloses IPv6 addresses in square brackets. +- Adds `ensure_resources`. This function takes a list of resources and creates them if they do not exist. +- Extends `suffix` to support applying a suffix to keys in a hash. +- Apply modulesync changes. +- Add validate_email_address function. + +####Bugfixes +- Fixes `fqdn_rand_string` tests, since Puppet 4.4.0 and later have a higher `fqdn_rand` ceiling. +- (MODULES-3152) Adds a check to `package_provider` to prevent failures if Gem is not installed. +- Fixes to README.md. +- Fixes catch StandardError rather than the gratuitous Exception +- Fixes file_line attribute validation. +- Fixes concat with Hash arguments. + +## Supported Release 4.11.0 +###Summary + +Provides a validate_absolute_paths and Debian 8 support. There is a fix to the is_package_provider fact and a test improvement. + +####Features +- Adds new parser called is_absolute_path +- Supports Debian 8 + +####Bugfixes +- Allow package_provider fact to resolve on PE 3.x + +####Improvements +- ensures that the test passes independently of changes to rubygems for ensure_resource + +##2015-12-15 - Supported Release 4.10.0 +###Summary + +Includes the addition of several new functions and considerable improvements to the existing functions, tests and documentation. Includes some bug fixes which includes compatibility, test and fact issues. + +####Features +- Adds service_provider fact +- Adds is_a() function +- Adds package_provider fact +- Adds validate_ip_address function +- Adds seeded_rand function + +####Bugfixes +- Fix backwards compatibility from an improvement to the parseyaml function +- Renaming of load_module_metadata test to include _spec.rb +- Fix root_home fact on AIX 5.x, now '-c' rather than '-C' +- Fixed Gemfile to work with ruby 1.8.7 + +####Improvements +- (MODULES-2462) Improvement of parseyaml function +- Improvement of str2bool function +- Improvement to readme +- Improvement of intersection function +- Improvement of validate_re function +- Improved speed on Facter resolution of service_provider +- empty function now handles numeric values +- Package_provider now prevents deprecation warning about the allow_virtual parameter +- load_module_metadata now succeeds on empty file +- Check added to ensure puppetversion value is not nil +- Improvement to bool2str to return a string of choice using boolean +- Improvement to naming convention in validate_ipv4_address function + +## Supported Release 4.9.1 +###Summary + +Small release for support of newer PE versions. This increments the version of PE in the metadata.json file. + +##2015-09-08 - Supported Release 4.9.0 +###Summary + +This release adds new features including the new functions dos2unix, unix2dos, try_get_value, convert_base as well as other features and improvements. + +####Features +- (MODULES-2370) allow `match` parameter to influence `ensure => absent` behavior +- (MODULES-2410) Add new functions dos2unix and unix2dos +- (MODULE-2456) Modify union to accept more than two arrays +- Adds a convert_base function, which can convert numbers between bases +- Add a new function "try_get_value" + +####Bugfixes +- n/a + +####Improvements +- (MODULES-2478) Support root_home fact on AIX through "lsuser" command +- Acceptance test improvements +- Unit test improvements +- Readme improvements + +## 2015-08-10 - Supported Release 4.8.0 +### Summary +This release adds a function for reading metadata.json from any module, and expands file\_line's abilities. + +#### Features +- New parameter `replace` on `file_line` +- New function `load_module_metadata()` to load metadata.json and return the content as a hash. +- Added hash support to `size()` + +#### Bugfixes +- Fix various docs typos +- Fix `file_line` resource on puppet < 3.3 + +##2015-06-22 - Supported Release 4.7.0 +###Summary + +Adds Solaris 12 support along with improved Puppet 4 support. There are significant test improvements, and some minor fixes. + +####Features +- Add support for Solaris 12 + +####Bugfixes +- Fix for AIO Puppet 4 +- Fix time for ruby 1.8.7 +- Specify rspec-puppet version +- range() fix for typeerror and missing functionality +- Fix pw_hash() on JRuby < 1.7.17 +- fqdn_rand_string: fix argument error message +- catch and rescue from looking up non-existent facts +- Use puppet_install_helper, for Puppet 4 + +####Improvements +- Enforce support for Puppet 4 testing +- fqdn_rotate/fqdn_rand_string acceptance tests and implementation +- Simplify mac address regex +- validate_integer, validate_numeric: explicitely reject hashes in arrays +- Readme edits +- Remove all the pops stuff for rspec-puppet +- Sync via modulesync +- Add validate_slength optional 3rd arg +- Move tests directory to examples directory + +##2015-04-14 - Supported Release 4.6.0 +###Summary + +Adds functions and function argument abilities, and improves compatibility with the new puppet parser + +####Features +- MODULES-444: `concat()` can now take more than two arrays +- `basename()` added to have Ruby File.basename functionality +- `delete()` can now take an array of items to remove +- `prefix()` can now take a hash +- `upcase()` can now take a hash or array of upcaseable things +- `validate_absolute_path()` can now take an array +- `validate_cmd()` can now use % in the command to embed the validation file argument in the string +- MODULES-1473: deprecate `type()` function in favor of `type3x()` +- MODULES-1473: Add `type_of()` to give better type information on future parser +- Deprecate `private()` for `assert_private()` due to future parser +- Adds `ceiling()` to take the ceiling of a number +- Adds `fqdn_rand_string()` to generate random string based on fqdn +- Adds `pw_hash()` to generate password hashes +- Adds `validate_integer()` +- Adds `validate_numeric()` (like `validate_integer()` but also accepts floats) + +####Bugfixes +- Fix seeding of `fqdn_rotate()` +- `ensure_resource()` is more verbose on debug mode +- Stricter argument checking for `dirname()` +- Fix `is_domain_name()` to better match RFC +- Fix `uriescape()` when called with array +- Fix `file_line` resource when using the `after` attribute with `match` + +##2015-01-14 - Supported Release 4.5.1 +###Summary + +This release changes the temporary facter_dot_d cache locations outside of the /tmp directory due to a possible security vunerability. CVE-2015-1029 + +####Bugfixes +- Facter_dot_d cache will now be stored in puppet libdir instead of tmp + +##2014-12-15 - Supported Release 4.5.0 +###Summary + +This release improves functionality of the member function and adds improved future parser support. + +####Features +- MODULES-1329: Update member() to allow the variable to be an array. +- Sync .travis.yml, Gemfile, Rakefile, and CONTRIBUTING.md via modulesync + +####Bugfixes +- Fix range() to work with numeric ranges with the future parser +- Accurately express SLES support in metadata.json (was missing 10SP4 and 12) +- Don't require `line` to match the `match` parameter + +##2014-11-10 - Supported Release 4.4.0 +###Summary +This release has an overhauled readme, new private manifest function, and fixes many future parser bugs. + +####Features +- All new shiny README +- New `private()` function for making private manifests (yay!) + +####Bugfixes +- Code reuse in `bool2num()` and `zip()` +- Fix many functions to handle `generate()` no longer returning a string on new puppets +- `concat()` no longer modifies the first argument (whoops) +- strict variable support for `getvar()`, `member()`, `values_at`, and `has_interface_with()` +- `to_bytes()` handles PB and EB now +- Fix `tempfile` ruby requirement for `validate_augeas()` and `validate_cmd()` +- Fix `validate_cmd()` for windows +- Correct `validate_string()` docs to reflect non-handling of `undef` +- Fix `file_line` matching on older rubies + + +##2014-07-15 - Supported Release 4.3.2 +###Summary + +This release merely updates metadata.json so the module can be uninstalled and +upgraded via the puppet module command. + +##2014-07-14 - Supported Release 4.3.1 +### Summary +This supported release updates the metadata.json to work around upgrade behavior of the PMT. + +#### Bugfixes +- Synchronize metadata.json with PMT-generated metadata to pass checksums + +##2014-06-27 - Supported Release 4.3.0 +### Summary +This release is the first supported release of the stdlib 4 series. It remains +backwards-compatible with the stdlib 3 series. It adds two new functions, one bugfix, and many testing updates. + +#### Features +- New `bool2str()` function +- New `camelcase()` function + +#### Bugfixes +- Fix `has_interface_with()` when interfaces fact is nil + +##2014-06-04 - Release 4.2.2 +### Summary + +This release adds PE3.3 support in the metadata and fixes a few tests. + +## 2014-05-08 - Release - 4.2.1 +### Summary +This release moves a stray symlink that can cause problems. + +## 2014-05-08 - Release - 4.2.0 +### Summary +This release adds many new functions and fixes, and continues to be backwards compatible with stdlib 3.x + +#### Features +- New `base64()` function +- New `deep_merge()` function +- New `delete_undef_values()` function +- New `delete_values()` function +- New `difference()` function +- New `intersection()` function +- New `is_bool()` function +- New `pick_default()` function +- New `union()` function +- New `validate_ipv4_address` function +- New `validate_ipv6_address` function +- Update `ensure_packages()` to take an option hash as a second parameter. +- Update `range()` to take an optional third argument for range step +- Update `validate_slength()` to take an optional third argument for minimum length +- Update `file_line` resource to take `after` and `multiple` attributes + +#### Bugfixes +- Correct `is_string`, `is_domain_name`, `is_array`, `is_float`, and `is_function_available` for parsing odd types such as bools and hashes. +- Allow facts.d facts to contain `=` in the value +- Fix `root_home` fact on darwin systems +- Fix `concat()` to work with a second non-array argument +- Fix `floor()` to work with integer strings +- Fix `is_integer()` to return true if passed integer strings +- Fix `is_numeric()` to return true if passed integer strings +- Fix `merge()` to work with empty strings +- Fix `pick()` to raise the correct error type +- Fix `uriescape()` to use the default URI.escape list +- Add/update unit & acceptance tests. + + +##2014-03-04 - Supported Release - 3.2.1 +###Summary +This is a supported release + +####Bugfixes +- Fixed `is_integer`/`is_float`/`is_numeric` for checking the value of arithmatic expressions. + +####Known bugs +* No known bugs + +--- + +##### 2013-05-06 - Jeff McCune - 4.1.0 + + * (#20582) Restore facter\_dot\_d to stdlib for PE users (3b887c8) + * (maint) Update Gemfile with GEM\_FACTER\_VERSION (f44d535) + +##### 2013-05-06 - Alex Cline - 4.1.0 + + * Terser method of string to array conversion courtesy of ethooz. (d38bce0) + +##### 2013-05-06 - Alex Cline 4.1.0 + + * Refactor ensure\_resource expectations (b33cc24) + +##### 2013-05-06 - Alex Cline 4.1.0 + + * Changed str-to-array conversion and removed abbreviation. (de253db) + +##### 2013-05-03 - Alex Cline 4.1.0 + + * (#20548) Allow an array of resource titles to be passed into the ensure\_resource function (e08734a) + +##### 2013-05-02 - Raphaël Pinson - 4.1.0 + + * Add a dirname function (2ba9e47) + +##### 2013-04-29 - Mark Smith-Guerrero - 4.1.0 + + * (maint) Fix a small typo in hash() description (928036a) + +##### 2013-04-12 - Jeff McCune - 4.0.2 + + * Update user information in gemspec to make the intent of the Gem clear. + +##### 2013-04-11 - Jeff McCune - 4.0.1 + + * Fix README function documentation (ab3e30c) + +##### 2013-04-11 - Jeff McCune - 4.0.0 + + * stdlib 4.0 drops support with Puppet 2.7 + * stdlib 4.0 preserves support with Puppet 3 + +##### 2013-04-11 - Jeff McCune - 4.0.0 + + * Add ability to use puppet from git via bundler (9c5805f) + +##### 2013-04-10 - Jeff McCune - 4.0.0 + + * (maint) Make stdlib usable as a Ruby GEM (e81a45e) + +##### 2013-04-10 - Erik Dalén - 4.0.0 + + * Add a count function (f28550e) + +##### 2013-03-31 - Amos Shapira - 4.0.0 + + * (#19998) Implement any2array (7a2fb80) + +##### 2013-03-29 - Steve Huff - 4.0.0 + + * (19864) num2bool match fix (8d217f0) + +##### 2013-03-20 - Erik Dalén - 4.0.0 + + * Allow comparisons of Numeric and number as String (ff5dd5d) + +##### 2013-03-26 - Richard Soderberg - 4.0.0 + + * add suffix function to accompany the prefix function (88a93ac) + +##### 2013-03-19 - Kristof Willaert - 4.0.0 + + * Add floor function implementation and unit tests (0527341) + +##### 2012-04-03 - Eric Shamow - 4.0.0 + + * (#13610) Add is\_function\_available to stdlib (961dcab) + +##### 2012-12-17 - Justin Lambert - 4.0.0 + + * str2bool should return a boolean if called with a boolean (5d5a4d4) + +##### 2012-10-23 - Uwe Stuehler - 4.0.0 + + * Fix number of arguments check in flatten() (e80207b) + +##### 2013-03-11 - Jeff McCune - 4.0.0 + + * Add contributing document (96e19d0) + +##### 2013-03-04 - Raphaël Pinson - 4.0.0 + + * Add missing documentation for validate\_augeas and validate\_cmd to README.markdown (a1510a1) + +##### 2013-02-14 - Joshua Hoblitt - 4.0.0 + + * (#19272) Add has\_element() function (95cf3fe) + +##### 2013-02-07 - Raphaël Pinson - 4.0.0 + + * validate\_cmd(): Use Puppet::Util::Execution.execute when available (69248df) + +##### 2012-12-06 - Raphaël Pinson - 4.0.0 + + * Add validate\_augeas function (3a97c23) + +##### 2012-12-06 - Raphaël Pinson - 4.0.0 + + * Add validate\_cmd function (6902cc5) + +##### 2013-01-14 - David Schmitt - 4.0.0 + + * Add geppetto project definition (b3fc0a3) + +##### 2013-01-02 - Jaka Hudoklin - 4.0.0 + + * Add getparam function to get defined resource parameters (20e0e07) + +##### 2013-01-05 - Jeff McCune - 4.0.0 + + * (maint) Add Travis CI Support (d082046) + +##### 2012-12-04 - Jeff McCune - 4.0.0 + + * Clarify that stdlib 3 supports Puppet 3 (3a6085f) + +##### 2012-11-30 - Erik Dalén - 4.0.0 + + * maint: style guideline fixes (7742e5f) + +##### 2012-11-09 - James Fryman - 4.0.0 + + * puppet-lint cleanup (88acc52) + +##### 2012-11-06 - Joe Julian - 4.0.0 + + * Add function, uriescape, to URI.escape strings. Redmine #17459 (fd52b8d) + +##### 2012-09-18 - Chad Metcalf - 3.2.0 + + * Add an ensure\_packages function. (8a8c09e) + +##### 2012-11-23 - Erik Dalén - 3.2.0 + + * (#17797) min() and max() functions (9954133) + +##### 2012-05-23 - Peter Meier - 3.2.0 + + * (#14670) autorequire a file\_line resource's path (dfcee63) + +##### 2012-11-19 - Joshua Harlan Lifton - 3.2.0 + + * Add join\_keys\_to\_values function (ee0f2b3) + +##### 2012-11-17 - Joshua Harlan Lifton - 3.2.0 + + * Extend delete function for strings and hashes (7322e4d) + +##### 2012-08-03 - Gary Larizza - 3.2.0 + + * Add the pick() function (ba6dd13) + +##### 2012-03-20 - Wil Cooley - 3.2.0 + + * (#13974) Add predicate functions for interface facts (f819417) + +##### 2012-11-06 - Joe Julian - 3.2.0 + + * Add function, uriescape, to URI.escape strings. Redmine #17459 (70f4a0e) + +##### 2012-10-25 - Jeff McCune - 3.1.1 + + * (maint) Fix spec failures resulting from Facter API changes (97f836f) + +##### 2012-10-23 - Matthaus Owens - 3.1.0 + + * Add PE facts to stdlib (cdf3b05) + +##### 2012-08-16 - Jeff McCune - 3.0.1 + + * Fix accidental removal of facts\_dot\_d.rb in 3.0.0 release + +##### 2012-08-16 - Jeff McCune - 3.0.0 + + * stdlib 3.0 drops support with Puppet 2.6 + * stdlib 3.0 preserves support with Puppet 2.7 + +##### 2012-08-07 - Dan Bode - 3.0.0 + + * Add function ensure\_resource and defined\_with\_params (ba789de) + +##### 2012-07-10 - Hailee Kenney - 3.0.0 + + * (#2157) Remove facter\_dot\_d for compatibility with external facts (f92574f) + +##### 2012-04-10 - Chris Price - 3.0.0 + + * (#13693) moving logic from local spec\_helper to puppetlabs\_spec\_helper (85f96df) + +##### 2012-10-25 - Jeff McCune - 2.5.1 + + * (maint) Fix spec failures resulting from Facter API changes (97f836f) + +##### 2012-10-23 - Matthaus Owens - 2.5.0 + + * Add PE facts to stdlib (cdf3b05) + +##### 2012-08-15 - Dan Bode - 2.5.0 + + * Explicitly load functions used by ensure\_resource (9fc3063) + +##### 2012-08-13 - Dan Bode - 2.5.0 + + * Add better docs about duplicate resource failures (97d327a) + +##### 2012-08-13 - Dan Bode - 2.5.0 + + * Handle undef for parameter argument (4f8b133) + +##### 2012-08-07 - Dan Bode - 2.5.0 + + * Add function ensure\_resource and defined\_with\_params (a0cb8cd) + +##### 2012-08-20 - Jeff McCune - 2.5.0 + + * Disable tests that fail on 2.6.x due to #15912 (c81496e) + +##### 2012-08-20 - Jeff McCune - 2.5.0 + + * (Maint) Fix mis-use of rvalue functions as statements (4492913) + +##### 2012-08-20 - Jeff McCune - 2.5.0 + + * Add .rspec file to repo root (88789e8) + +##### 2012-06-07 - Chris Price - 2.4.0 + + * Add support for a 'match' parameter to file\_line (a06c0d8) + +##### 2012-08-07 - Erik Dalén - 2.4.0 + + * (#15872) Add to\_bytes function (247b69c) + +##### 2012-07-19 - Jeff McCune - 2.4.0 + + * (Maint) use PuppetlabsSpec::PuppetInternals.scope (master) (deafe88) + +##### 2012-07-10 - Hailee Kenney - 2.4.0 + + * (#2157) Make facts\_dot\_d compatible with external facts (5fb0ddc) + +##### 2012-03-16 - Steve Traylen - 2.4.0 + + * (#13205) Rotate array/string randomley based on fqdn, fqdn\_rotate() (fef247b) + +##### 2012-05-22 - Peter Meier - 2.3.3 + + * fix regression in #11017 properly (f0a62c7) + +##### 2012-05-10 - Jeff McCune - 2.3.3 + + * Fix spec tests using the new spec\_helper (7d34333) + +##### 2012-05-10 - Puppet Labs - 2.3.2 + + * Make file\_line default to ensure => present (1373e70) + * Memoize file\_line spec instance variables (20aacc5) + * Fix spec tests using the new spec\_helper (1ebfa5d) + * (#13595) initialize\_everything\_for\_tests couples modules Puppet ver (3222f35) + * (#13439) Fix MRI 1.9 issue with spec\_helper (15c5fd1) + * (#13439) Fix test failures with Puppet 2.6.x (665610b) + * (#13439) refactor spec helper for compatibility with both puppet 2.7 and master (82194ca) + * (#13494) Specify the behavior of zero padded strings (61891bb) + +##### 2012-03-29 Puppet Labs - 2.1.3 + +* (#11607) Add Rakefile to enable spec testing +* (#12377) Avoid infinite loop when retrying require json + +##### 2012-03-13 Puppet Labs - 2.3.1 + +* (#13091) Fix LoadError bug with puppet apply and puppet\_vardir fact + +##### 2012-03-12 Puppet Labs - 2.3.0 + +* Add a large number of new Puppet functions +* Backwards compatibility preserved with 2.2.x + +##### 2011-12-30 Puppet Labs - 2.2.1 + +* Documentation only release for the Forge + +##### 2011-12-30 Puppet Labs - 2.1.2 + +* Documentation only release for PE 2.0.x + +##### 2011-11-08 Puppet Labs - 2.2.0 + +* #10285 - Refactor json to use pson instead. +* Maint - Add watchr autotest script +* Maint - Make rspec tests work with Puppet 2.6.4 +* #9859 - Add root\_home fact and tests + +##### 2011-08-18 Puppet Labs - 2.1.1 + +* Change facts.d paths to match Facter 2.0 paths. +* /etc/facter/facts.d +* /etc/puppetlabs/facter/facts.d + +##### 2011-08-17 Puppet Labs - 2.1.0 + +* Add R.I. Pienaar's facts.d custom facter fact +* facts defined in /etc/facts.d and /etc/puppetlabs/facts.d are + automatically loaded now. + +##### 2011-08-04 Puppet Labs - 2.0.0 + +* Rename whole\_line to file\_line +* This is an API change and as such motivating a 2.0.0 release according to semver.org. + +##### 2011-08-04 Puppet Labs - 1.1.0 + +* Rename append\_line to whole\_line +* This is an API change and as such motivating a 1.1.0 release. + +##### 2011-08-04 Puppet Labs - 1.0.0 + +* Initial stable release +* Add validate\_array and validate\_string functions +* Make merge() function work with Ruby 1.8.5 +* Add hash merging function +* Add has\_key function +* Add loadyaml() function +* Add append\_line native + +##### 2011-06-21 Jeff McCune - 0.1.7 + +* Add validate\_hash() and getvar() functions + +##### 2011-06-15 Jeff McCune - 0.1.6 + +* Add anchor resource type to provide containment for composite classes + +##### 2011-06-03 Jeff McCune - 0.1.5 + +* Add validate\_bool() function to stdlib + +##### 0.1.4 2011-05-26 Jeff McCune + +* Move most stages after main + +##### 0.1.3 2011-05-25 Jeff McCune + +* Add validate\_re() function + +##### 0.1.2 2011-05-24 Jeff McCune + +* Update to add annotated tag + +##### 0.1.1 2011-05-24 Jeff McCune + +* Add stdlib::stages class with a standard set of stages diff --git a/environments/prod/modules/stdlib/CONTRIBUTING.md b/environments/prod/modules/stdlib/CONTRIBUTING.md new file mode 100644 index 0000000..990edba --- /dev/null +++ b/environments/prod/modules/stdlib/CONTRIBUTING.md @@ -0,0 +1,217 @@ +Checklist (and a short version for the impatient) +================================================= + + * Commits: + + - Make commits of logical units. + + - Check for unnecessary whitespace with "git diff --check" before + committing. + + - Commit using Unix line endings (check the settings around "crlf" in + git-config(1)). + + - Do not check in commented out code or unneeded files. + + - The first line of the commit message should be a short + description (50 characters is the soft limit, excluding ticket + number(s)), and should skip the full stop. + + - Associate the issue in the message. The first line should include + the issue number in the form "(#XXXX) Rest of message". + + - The body should provide a meaningful commit message, which: + + - uses the imperative, present tense: "change", not "changed" or + "changes". + + - includes motivation for the change, and contrasts its + implementation with the previous behavior. + + - Make sure that you have tests for the bug you are fixing, or + feature you are adding. + + - Make sure the test suites passes after your commit: + `bundle exec rspec spec/acceptance` More information on [testing](#Testing) below + + - When introducing a new feature, make sure it is properly + documented in the README.md + + * Submission: + + * Pre-requisites: + + - Make sure you have a [GitHub account](https://github.com/join) + + - [Create a ticket](https://tickets.puppet.com/secure/CreateIssue!default.jspa), or [watch the ticket](https://tickets.puppet.com/browse/) you are patching for. + + * Preferred method: + + - Fork the repository on GitHub. + + - Push your changes to a topic branch in your fork of the + repository. (the format ticket/1234-short_description_of_change is + usually preferred for this project). + + - Submit a pull request to the repository in the puppetlabs + organization. + +The long version +================ + + 1. Make separate commits for logically separate changes. + + Please break your commits down into logically consistent units + which include new or changed tests relevant to the rest of the + change. The goal of doing this is to make the diff easier to + read for whoever is reviewing your code. In general, the easier + your diff is to read, the more likely someone will be happy to + review it and get it into the code base. + + If you are going to refactor a piece of code, please do so as a + separate commit from your feature or bug fix changes. + + We also really appreciate changes that include tests to make + sure the bug is not re-introduced, and that the feature is not + accidentally broken. + + Describe the technical detail of the change(s). If your + description starts to get too long, that is a good sign that you + probably need to split up your commit into more finely grained + pieces. + + Commits which plainly describe the things which help + reviewers check the patch and future developers understand the + code are much more likely to be merged in with a minimum of + bike-shedding or requested changes. Ideally, the commit message + would include information, and be in a form suitable for + inclusion in the release notes for the version of Puppet that + includes them. + + Please also check that you are not introducing any trailing + whitespace or other "whitespace errors". You can do this by + running "git diff --check" on your changes before you commit. + + 2. Sending your patches + + To submit your changes via a GitHub pull request, we _highly_ + recommend that you have them on a topic branch, instead of + directly on "master". + It makes things much easier to keep track of, especially if + you decide to work on another thing before your first change + is merged in. + + GitHub has some pretty good + [general documentation](http://help.github.com/) on using + their site. They also have documentation on + [creating pull requests](http://help.github.com/send-pull-requests/). + + In general, after pushing your topic branch up to your + repository on GitHub, you can switch to the branch in the + GitHub UI and click "Pull Request" towards the top of the page + in order to open a pull request. + + + 3. Update the related GitHub issue. + + If there is a GitHub issue associated with the change you + submitted, then you should update the ticket to include the + location of your branch, along with any other commentary you + may wish to make. + +Testing +======= + +Getting Started +--------------- + +Our puppet modules provide [`Gemfile`](./Gemfile)s which can tell a ruby +package manager such as [bundler](http://bundler.io/) what Ruby packages, +or Gems, are required to build, develop, and test this software. + +Please make sure you have [bundler installed](http://bundler.io/#getting-started) +on your system, then use it to install all dependencies needed for this project, +by running + +```shell +% bundle install +Fetching gem metadata from https://rubygems.org/........ +Fetching gem metadata from https://rubygems.org/.. +Using rake (10.1.0) +Using builder (3.2.2) +-- 8><-- many more --><8 -- +Using rspec-system-puppet (2.2.0) +Using serverspec (0.6.3) +Using rspec-system-serverspec (1.0.0) +Using bundler (1.3.5) +Your bundle is complete! +Use `bundle show [gemname]` to see where a bundled gem is installed. +``` + +NOTE some systems may require you to run this command with sudo. + +If you already have those gems installed, make sure they are up-to-date: + +```shell +% bundle update +``` + +With all dependencies in place and up-to-date we can now run the tests: + +```shell +% bundle exec rake spec +``` + +This will execute all the [rspec tests](http://rspec-puppet.com/) tests +under [spec/defines](./spec/defines), [spec/classes](./spec/classes), +and so on. rspec tests may have the same kind of dependencies as the +module they are testing. While the module defines in its [Modulefile](./Modulefile), +rspec tests define them in [.fixtures.yml](./fixtures.yml). + +Some puppet modules also come with [beaker](https://github.com/puppetlabs/beaker) +tests. These tests spin up a virtual machine under +[VirtualBox](https://www.virtualbox.org/)) with, controlling it with +[Vagrant](http://www.vagrantup.com/) to actually simulate scripted test +scenarios. In order to run these, you will need both of those tools +installed on your system. + +You can run them by issuing the following command + +```shell +% bundle exec rake spec_clean +% bundle exec rspec spec/acceptance +``` + +This will now download a pre-fabricated image configured in the [default node-set](./spec/acceptance/nodesets/default.yml), +install puppet, copy this module and install its dependencies per [spec/spec_helper_acceptance.rb](./spec/spec_helper_acceptance.rb) +and then run all the tests under [spec/acceptance](./spec/acceptance). + +Writing Tests +------------- + +XXX getting started writing tests. + +If you have commit access to the repository +=========================================== + +Even if you have commit access to the repository, you will still need to +go through the process above, and have someone else review and merge +in your changes. The rule is that all changes must be reviewed by a +developer on the project (that did not write the code) to ensure that +all changes go through a code review process. + +Having someone other than the author of the topic branch recorded as +performing the merge is the record that they performed the code +review. + + +Additional Resources +==================== + +* [Getting additional help](http://puppet.com/community/get-help) + +* [Writing tests](https://docs.puppet.com/guides/module_guides/bgtm.html#step-three-module-testing) + +* [General GitHub documentation](http://help.github.com/) + +* [GitHub pull request documentation](http://help.github.com/send-pull-requests/) diff --git a/environments/prod/modules/stdlib/Gemfile b/environments/prod/modules/stdlib/Gemfile new file mode 100644 index 0000000..5d86325 --- /dev/null +++ b/environments/prod/modules/stdlib/Gemfile @@ -0,0 +1,86 @@ +#This file is generated by ModuleSync, do not edit. + +source ENV['GEM_SOURCE'] || "https://rubygems.org" + +# Determines what type of gem is requested based on place_or_version. +def gem_type(place_or_version) + if place_or_version =~ /^git:/ + :git + elsif place_or_version =~ /^file:/ + :file + else + :gem + end +end + +# Find a location or specific version for a gem. place_or_version can be a +# version, which is most often used. It can also be git, which is specified as +# `git://somewhere.git#branch`. You can also use a file source location, which +# is specified as `file://some/location/on/disk`. +def location_for(place_or_version, fake_version = nil) + if place_or_version =~ /^(git[:@][^#]*)#(.*)/ + [fake_version, { :git => $1, :branch => $2, :require => false }].compact + elsif place_or_version =~ /^file:\/\/(.*)/ + ['>= 0', { :path => File.expand_path($1), :require => false }] + else + [place_or_version, { :require => false }] + end +end + +# Used for gem conditionals +supports_windows = false + +group :development do + gem 'puppet-lint', :require => false + gem 'metadata-json-lint', :require => false, :platforms => 'ruby' + gem 'puppet_facts', :require => false + gem 'puppet-blacksmith', '>= 3.4.0', :require => false, :platforms => 'ruby' + gem 'puppetlabs_spec_helper', '>= 1.2.1', :require => false + gem 'rspec-puppet', '>= 2.3.2', :require => false + gem 'rspec-puppet-facts', :require => false, :platforms => 'ruby' + gem 'mocha', '< 1.2.0', :require => false + gem 'simplecov', :require => false, :platforms => 'ruby' + gem 'parallel_tests', '< 2.10.0', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'parallel_tests', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.0.0') + gem 'rubocop', '0.41.2', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'rubocop', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.0.0') + gem 'rubocop-rspec', '~> 1.6', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.3.0') + gem 'pry', :require => false + gem 'json_pure', '<= 2.0.1', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'fast_gettext', '1.1.0', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.1.0') + gem 'fast_gettext', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.1.0') + gem 'rainbow', '< 2.2.0', :require => false +end + +group :system_tests do + gem 'beaker', *location_for(ENV['BEAKER_VERSION'] || '>= 3') + gem 'beaker-pe', :require => false + gem 'beaker-rspec', *location_for(ENV['BEAKER_RSPEC_VERSION']) + gem 'beaker-puppet_install_helper', :require => false + gem 'beaker-module_install_helper', :require => false + gem 'master_manipulator', :require => false + gem 'beaker-hostgenerator', *location_for(ENV['BEAKER_HOSTGENERATOR_VERSION']) + gem 'beaker-abs', *location_for(ENV['BEAKER_ABS_VERSION'] || '~> 0.1') +end + +gem 'puppet', *location_for(ENV['PUPPET_GEM_VERSION']) + +# Only explicitly specify Facter/Hiera if a version has been specified. +# Otherwise it can lead to strange bundler behavior. If you are seeing weird +# gem resolution behavior, try setting `DEBUG_RESOLVER` environment variable +# to `1` and then run bundle install. +gem 'facter', *location_for(ENV['FACTER_GEM_VERSION']) if ENV['FACTER_GEM_VERSION'] +gem 'hiera', *location_for(ENV['HIERA_GEM_VERSION']) if ENV['HIERA_GEM_VERSION'] + + +# Evaluate Gemfile.local if it exists +if File.exists? "#{__FILE__}.local" + eval(File.read("#{__FILE__}.local"), binding) +end + +# Evaluate ~/.gemfile if it exists +if File.exists?(File.join(Dir.home, '.gemfile')) + eval(File.read(File.join(Dir.home, '.gemfile')), binding) +end + +# vim:ft=ruby diff --git a/environments/prod/modules/stdlib/LICENSE b/environments/prod/modules/stdlib/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/environments/prod/modules/stdlib/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/environments/prod/modules/stdlib/MAINTAINERS.md b/environments/prod/modules/stdlib/MAINTAINERS.md new file mode 100644 index 0000000..e8004a5 --- /dev/null +++ b/environments/prod/modules/stdlib/MAINTAINERS.md @@ -0,0 +1,6 @@ +## Maintenance + +Maintainers: + - Puppet Forge Modules Team `forge-modules |at| puppet |dot| com` + +Tickets: https://tickets.puppet.com/browse/MODULES. Make sure to set component to `stdlib`. diff --git a/environments/prod/modules/stdlib/NOTICE b/environments/prod/modules/stdlib/NOTICE new file mode 100644 index 0000000..3c8c03a --- /dev/null +++ b/environments/prod/modules/stdlib/NOTICE @@ -0,0 +1,23 @@ +stdlib puppet module + +Copyright (C) 2011-2016 Puppet Labs, Inc. + +and some parts: + +Copyright (C) 2011 Krzysztof Wilczynski + + +Puppet Labs can be contacted at: info@puppetlabs.com + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/environments/prod/modules/stdlib/README.markdown b/environments/prod/modules/stdlib/README.markdown new file mode 100644 index 0000000..03daae9 --- /dev/null +++ b/environments/prod/modules/stdlib/README.markdown @@ -0,0 +1,1791 @@ +# stdlib + +#### Table of Contents + +1. [Overview](#overview) +2. [Module Description - What the module does and why it is useful](#module-description) +3. [Setup - The basics of getting started with stdlib](#setup) +4. [Usage - Configuration options and additional functionality](#usage) +5. [Reference - An under-the-hood peek at what the module is doing and how](#reference) +5. [Limitations - OS compatibility, etc.](#limitations) +6. [Development - Guide for contributing to the module](#development) + +## Overview + +Adds a standard library of resources for Puppet modules. + +## Module Description + +This module provides a standard library of resources for the development of Puppet modules. Puppet modules make heavy use of this standard library. The stdlib module adds the following resources to Puppet: + + * Stages + * Facts + * Functions + * Defined resource types + * Data Types + * Providers + +> *Note:* As of version 3.7, Puppet Enterprise no longer includes the stdlib module. If you're running Puppet Enterprise, you should install the most recent release of stdlib for compatibility with Puppet modules. + +## Setup + +Installing the stdlib module adds the functions, facts, and resources of this standard library to Puppet. + +## Usage + +After you've installed stdlib, all of its functions, facts, and resources are available for module use or development. + +If you want to use a standardized set of run stages for Puppet, `include stdlib` in your manifest. + +* `stdlib`: Most of stdlib's features are automatically loaded by Puppet. To use standardized run stages in Puppet, declare this class in your manifest with `include stdlib`. + + When declared, stdlib declares all other classes in the module. The only other class currently included in the module is `stdlib::stages`. + +The `stdlib::stages` class declares various run stages for deploying infrastructure, language runtimes, and application layers. The high level stages are (in order): + + * setup + * main + * runtime + * setup_infra + * deploy_infra + * setup_app + * deploy_app + * deploy + + Sample usage: + + ~~~ + node default { + include stdlib + class { java: stage => 'runtime' } + } + ~~~ + +## Reference + +### Classes + +#### Public Classes + + The stdlib class has no parameters. + +#### Private Classes + +* `stdlib::stages`: Manages a standard set of run stages for Puppet. It is managed by the stdlib class and should not be declared independently. + +### Resource Types + +#### `file_line` + +Ensures that a given line is contained within a file. The implementation matches the full line, including whitespace at the beginning and end. If the line is not contained in the given file, Puppet appends the line to the end of the file to ensure the desired state. Multiple resources can be declared to manage multiple lines in the same file. + +Example: + + file_line { 'sudo_rule': + path => '/etc/sudoers', + line => '%sudo ALL=(ALL) ALL', + } + + file_line { 'sudo_rule_nopw': + path => '/etc/sudoers', + line => '%sudonopw ALL=(ALL) NOPASSWD: ALL', + } + +In this example, Puppet ensures that both of the specified lines are contained in the file `/etc/sudoers`. + +Match Example: + + file_line { 'bashrc_proxy': + ensure => present, + path => '/etc/bashrc', + line => 'export HTTP_PROXY=http://squid.puppetlabs.vm:3128', + match => '^export\ HTTP_PROXY\=', + } + +In this code example, `match` looks for a line beginning with export followed by HTTP_PROXY and replaces it with the value in line. + +Match Example With `ensure => absent`: + + file_line { 'bashrc_proxy': + ensure => absent, + path => '/etc/bashrc', + line => 'export HTTP_PROXY=http://squid.puppetlabs.vm:3128', + match => '^export\ HTTP_PROXY\=', + match_for_absence => true, + } + +In this code example, `match` looks for a line beginning with export +followed by HTTP_PROXY and delete it. If multiple lines match, an +error will be raised unless the `multiple => true` parameter is set. + +Encoding example: + + file_line { "XScreenSaver": + ensure => present, + path => '/root/XScreenSaver' + line => "*lock: 10:00:00", + match => '^*lock:', + encoding => "iso-8859-1", + } + +Files with special characters that are not valid UTF-8 will give the +error message "invalid byte sequence in UTF-8". In this case, determine +the correct file encoding and specify the correct encoding using the +encoding attribute, the value of which needs to be a valid Ruby character +encoding. + +**Autorequires:** If Puppet is managing the file that contains the line being managed, the `file_line` resource autorequires that file. + +##### Parameters + +All parameters are optional, unless otherwise noted. + +* `after`: Specifies the line after which Puppet adds any new lines using a regular expression. (Existing lines are added in place.) Valid options: String containing a regex. Default: Undefined. +* `ensure`: Ensures whether the resource is present. Valid options: 'present', 'absent'. Default: 'present'. +* `line`: **Required.** Sets the line to be added to the file located by the `path` parameter. Valid options: String. Default: Undefined. +* `match`: Specifies a regular expression to run against existing lines in the file; if a match is found, it is replaced rather than adding a new line. A regex comparison is performed against the line value, and if it does not match, an exception is raised. Valid options: String containing a regex. Default: Undefined. +* `match_for_absence`: An optional value to determine if match should be applied when `ensure => absent`. If set to true and match is set, the line that matches match will be deleted. If set to false (the default), match is ignored when `ensure => absent` and the value of `line` is used instead. Ignored when `ensure => present`. Default: false. +* `multiple`: Determines if `match` and/or `after` can change multiple lines. If set to false, an exception will be raised if more than one line matches. Valid options: 'true', 'false'. Default: Undefined. +* `name`: Sets the name to use as the identity of the resource. This is necessary if you want the resource namevar to differ from the supplied `title` of the resource. Valid options: String. Default: Undefined. +* `path`: **Required.** Defines the file in which Puppet will ensure the line specified by `line`. Must be an absolute path to the file. +* `replace`: Defines whether the resource will overwrite an existing line that matches the `match` parameter. If set to false and a line is found matching the `match` param, the line will not be placed in the file. Valid options: true, false, yes, no. Default: true + +### Data Types + +#### `Stdlib::Absolutepath` + +A strict absolute path type. Uses a Variant of Unixpath and Windowspath types. + +Acceptable input examples: /var/log + /usr2/username/bin:/usr/local/bin:/usr/bin:. + C:\\WINDOWS\\System32 +Unacceptable input example: ../relative_path + +#### `Stdlib::Httpsurl` + +Matches https URLs. + +Acceptable input example: https://hello.com +Unacceptable input example: httds://notquiteright.org + +#### `Stdlib::Httpurl` + +Matches both https and http URLs. + +Acceptable input example: https://hello.com + http://hello.com +Unacceptable input example: httds://notquiteright.org + +#### `Stdlib::Unixpath` + +Matches paths on Unix type Operating Systems. + +Acceptable input example: /usr2/username/bin:/usr/local/bin:/usr/bin:. + /var/tmp +Unacceptable input example: C:/whatever + +#### `Stdlib::Windowspath` + +Matches paths on Windows Operating systems. + +Acceptable input example: C:\\WINDOWS\\System32 + C:\\ + \\\\host\\windows +Unacceptable input example: /usr2/username/bin:/usr/local/bin:/usr/bin:. + +### Functions + +#### `abs` + +Returns the absolute value of a number; for example, '-34.56' becomes '34.56'. Takes a single integer and float value as an argument. *Type*: rvalue. + +#### `any2array` + +Converts any object to an array containing that object. Empty argument lists are converted to an empty array. Arrays are left untouched. Hashes are converted to arrays of alternating keys and values. *Type*: rvalue. + +#### `base64` + +Converts a string to and from base64 encoding. Requires an `action` ('encode', 'decode') and either a plain or base64-encoded `string`, and an optional `method` ('default', 'strict', 'urlsafe') + +For backward compatibility, `method` will be set as `default` if not specified. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +*Examples:* +~~~ +base64('encode', 'hello') +base64('encode', 'hello', 'default') +# return: "aGVsbG8=\n" + +base64('encode', 'hello', 'strict') +# return: "aGVsbG8=" + +base64('decode', 'aGVsbG8=') +base64('decode', 'aGVsbG8=\n') +base64('decode', 'aGVsbG8=', 'default') +base64('decode', 'aGVsbG8=\n', 'default') +base64('decode', 'aGVsbG8=', 'strict') +# return: "hello" + +base64('encode', 'https://puppetlabs.com', 'urlsafe') +# return: "aHR0cHM6Ly9wdXBwZXRsYWJzLmNvbQ==" + +base64('decode', 'aHR0cHM6Ly9wdXBwZXRsYWJzLmNvbQ==', 'urlsafe') +# return: "https://puppetlabs.com" +~~~ + +*Type*: rvalue. + +#### `basename` + +Returns the `basename` of a path (optionally stripping an extension). For example: + * ('/path/to/a/file.ext') returns 'file.ext' + * ('relative/path/file.ext') returns 'file.ext' + * ('/path/to/a/file.ext', '.ext') returns 'file' + +*Type*: rvalue. + +#### `bool2num` + +Converts a boolean to a number. Converts values: + * 'false', 'f', '0', 'n', and 'no' to 0. + * 'true', 't', '1', 'y', and 'yes' to 1. + Requires a single boolean or string as an input. *Type*: rvalue. + +#### `bool2str` + +Converts a boolean to a string using optionally supplied arguments. The optional second and third arguments represent what true and false are converted to respectively. If only one argument is given, it is converted from a boolean to a string containing 'true' or 'false'. + +*Examples:* +~~~ +bool2str(true) => 'true' +bool2str(true, 'yes', 'no') => 'yes' +bool2str(false, 't', 'f') => 'f' +~~~ + +Requires a single boolean as input. *Type*: rvalue. + +#### `camelcase` + +Converts the case of a string or all strings in an array to camel case. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `capitalize` + +Capitalizes the first character of a string or array of strings and lowercases the remaining characters of each string. Requires either a single string or an array as an input. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `ceiling` + +Returns the smallest integer greater than or equal to the argument. Takes a single numeric value as an argument. *Type*: rvalue. + +#### `chomp` + +Removes the record separator from the end of a string or an array of strings; for example, 'hello\n' becomes 'hello'. Requires a single string or array as an input. *Type*: rvalue. + +#### `chop` + +Returns a new string with the last character removed. If the string ends with '\r\n', both characters are removed. Applying `chop` to an empty string returns an empty string. If you want to merely remove record separators, then you should use the `chomp` function. Requires a string or an array of strings as input. *Type*: rvalue. + +#### `clamp` + +Keeps value within the range [Min, X, Max] by sort based on integer value (order of params doesn't matter). Takes strings, arrays or numerics. Strings are converted and compared numerically. Arrays of values are flattened into a list for further handling. For example: + * `clamp('24', [575, 187])` returns 187. + * `clamp(16, 88, 661)` returns 88. + * `clamp([4, 3, '99'])` returns 4. + *Type*: rvalue. + +#### `concat` + +Appends the contents of multiple arrays onto the first array given. For example: + * `concat(['1','2','3'],'4')` returns ['1','2','3','4']. + * `concat(['1','2','3'],'4',['5','6','7'])` returns ['1','2','3','4','5','6','7']. + *Type*: rvalue. + +#### `convert_base` + +Converts a given integer or base 10 string representing an integer to a specified base, as a string. For example: + * `convert_base(5, 2)` results in: '101' + * `convert_base('254', '16')` results in: 'fe' + +#### `count` + +If called with only an array, it counts the number of elements that are **not** nil/undef. If called with a second argument, counts the number of elements in an array that matches the second argument. *Type*: rvalue. + +#### `deep_merge` + +Recursively merges two or more hashes together and returns the resulting hash. + $hash1 = {'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } } + $hash2 = {'two' => 'dos', 'three' => { 'five' => 5 } } + $merged_hash = deep_merge($hash1, $hash2) + +The resulting hash is equivalent to: + $merged_hash = { 'one' => 1, 'two' => 'dos', 'three' => { 'four' => 4, 'five' => 5 } } + +When there is a duplicate key that is a hash, they are recursively merged. When there is a duplicate key that is not a hash, the key in the rightmost hash will "win.". +*Type*: rvalue, rvalue. + +#### `defined_with_params` + +Takes a resource reference and an optional hash of attributes. Returns 'true' if a resource with the specified attributes has already been added to the catalog. Returns 'false' otherwise. + + ~~~ + user { 'dan': + ensure => present, + } + + if ! defined_with_params(User[dan], {'ensure' => 'present' }) { + user { 'dan': ensure => present, } + } + ~~~ + +*Type*: rvalue. + +#### `delete` + +Deletes all instances of a given element from an array, substring from a string, or key from a hash. + +For example, `delete(['a','b','c','b'], 'b')` returns ['a','c']; `delete('abracadabra', 'bra')` returns 'acada'. `delete({'a' => 1,'b' => 2,'c' => 3},['b','c'])` returns {'a'=> 1}, `delete(['ab', 'b'], 'b')` returns ['ab']. + +*Type*: rvalue. + +#### `delete_at` + +Deletes a determined indexed value from an array. For example, `delete_at(['a','b','c'], 1)` returns ['a','c']. *Type*: rvalue. + +#### `delete_regex` + +Deletes all instances of a given element from an array or hash that match a provided regular expression. A string will be treated as a one-item array. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +For example, `delete_regex(['a','b','c','b'], 'b')` returns ['a','c']; `delete_regex({'a' => 1,'b' => 2,'c' => 3},['b','c'])` returns {'a'=> 1}, `delete_regex(['abf', 'ab', 'ac'], '^ab.*')` returns ['ac']. `delete_regex(['ab', 'b'], 'b')` returns ['ab']. + +*Type*: rvalue. + +#### `delete_values` + +Deletes all instances of a given value from a hash. For example, `delete_values({'a'=>'A','b'=>'B','c'=>'C','B'=>'D'}, 'B')` returns {'a'=>'A','c'=>'C','B'=>'D'} *Type*: rvalue. + +#### `delete_undef_values` + +Deletes all instances of the undef value from an array or hash. For example, `$hash = delete_undef_values({a=>'A', b=>'', c=>undef, d => false})` returns {a => 'A', b => '', d => false}. *Type*: rvalue. + +#### `deprecation` + +Prints deprecation warnings and logs a warning once for a given key: + +``` +deprecation(key, message) +``` + +* key: to keep the number of messages low, during the lifetime of a puppet process, only one message per key is logged. +* message: the text to be logged. + +The Puppet settings '[disable_warnings](https://docs.puppet.com/puppet/latest/reference/configuration.html#disablewarnings)', '[max_deprecations](https://docs.puppet.com/puppet/latest/reference/configuration.html#maxdeprecations)', and '[strict](https://docs.puppet.com/puppet/latest/reference/configuration.html#strict)' affect this function. Set 'strict' to `error` to fail immediately with the deprecation message, `off` to output emit no messages at all, or `warning` (default) to log all warnings. + +Additionally you can set the environment variable `STDLIB_LOG_DEPRECATIONS` to decide whether or not to log deprecation warnings: if this environment variable is set to `true`, the functions log a warning, if it is set to `false`, no warnings are logged. If no value is set at all, Puppet 4 will emit warnings, while Puppet 3 will not. Using this setting is especially useful for automated tests to avoid flooding your logs before you are ready to migrate. + +*Type*: String, String. + +#### `difference` + +Returns the difference between two arrays. The returned array is a copy of the original array, removing any items that also appear in the second array. For example, `difference(["a","b","c"],["b","c","d"])` returns ["a"]. *Type*: rvalue. + +#### `dig` + +DEPRECATED: This function has been replaced in Puppet 4.5.0, use dig44() for backwards compatibility or use the new version. + +*Type*: rvalue. + +Retrieves a value within multiple layers of hashes and arrays via an array of keys containing a path. The function goes through the structure by each path component and tries to return the value at the end of the path. + +In addition to the required path argument, the function accepts the default argument. It is returned if the path is not correct, if no value was found, or if any other error has occurred. + +~~~ruby +$data = { + 'a' => { + 'b' => [ + 'b1', + 'b2', + 'b3', + ] + } +} + +$value = dig($data, ['a', 'b', 2]) +# $value = 'b3' + +# with all possible options +$value = dig($data, ['a', 'b', 2], 'not_found') +# $value = 'b3' + +# using the default value +$value = dig($data, ['a', 'b', 'c', 'd'], 'not_found') +# $value = 'not_found' +~~~ + +1. **$data** The data structure we are working with. +2. **['a', 'b', 2]** The path array. +3. **'not_found'** The default value. It will be returned if nothing is found. + (optional, defaults to *undef*) + +#### `dig44` + +*Type*: rvalue. + +Retrieves a value within multiple layers of hashes and arrays via an array of keys containing a path. The function goes through the structure by each path component and tries to return the value at the end of the path. + +In addition to the required path argument, the function accepts the default argument. It is returned if the path is not correct, if no value was found, or if any other error has occurred. + +~~~ruby +$data = { + 'a' => { + 'b' => [ + 'b1', + 'b2', + 'b3', + ] + } +} + +$value = dig44($data, ['a', 'b', 2]) +# $value = 'b3' + +# with all possible options +$value = dig44($data, ['a', 'b', 2], 'not_found') +# $value = 'b3' + +# using the default value +$value = dig44($data, ['a', 'b', 'c', 'd'], 'not_found') +# $value = 'not_found' +~~~ + +1. **$data** The data structure we are working with. +2. **['a', 'b', 2]** The path array. +3. **'not_found'** The default value. It will be returned if nothing is found. + (optional, defaults to *undef*) + +#### `dirname` + +Returns the `dirname` of a path. For example, `dirname('/path/to/a/file.ext')` returns '/path/to/a'. *Type*: rvalue. + +#### `dos2unix` + +Returns the Unix version of the given string. Very useful when using a File resource with a cross-platform template. *Type*: rvalue. + +~~~ +file{$config_file: + ensure => file, + content => dos2unix(template('my_module/settings.conf.erb')), +} +~~~ + +See also [unix2dos](#unix2dos). + +#### `downcase` + +Converts the case of a string or of all strings in an array to lowercase. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `empty` + +Returns true if the argument is an array or hash that contains no elements, or an empty string. Returns false when the argument is a numerical value. *Type*: rvalue. + +#### `enclose_ipv6` + +Takes an array of ip addresses and encloses the ipv6 addresses with square brackets. *Type*: rvalue. + +#### `ensure_packages` + +Takes a list of packages array/hash and only installs them if they don't already exist. It optionally takes a hash as a second parameter to be passed as the third argument to the `ensure_resource()` or `ensure_resources()` function. *Type*: statement. + +For Array: + + ensure_packages(['ksh','openssl'], {'ensure' => 'present'}) + +For Hash: + + ensure_packages({'ksh' => { ensure => '20120801-1' } , 'mypackage' => { source => '/tmp/myrpm-1.0.0.x86_64.rpm', provider => "rpm" }}, {'ensure' => 'present'}) + +#### `ensure_resource` + +Takes a resource type, title, and a hash of attributes that describe the resource(s). + +~~~ +user { 'dan': + ensure => present, +} +~~~ + +This example only creates the resource if it does not already exist: + + `ensure_resource('user', 'dan', {'ensure' => 'present' })` + +If the resource already exists, but does not match the specified parameters, this function attempts to recreate the resource, leading to a duplicate resource definition error. + +An array of resources can also be passed in, and each will be created with the type and parameters specified if it doesn't already exist. + + `ensure_resource('user', ['dan','alex'], {'ensure' => 'present'})` + +*Type*: statement. + +#### `ensure_resources` + +Takes a resource type, title (only hash), and a hash of attributes that describe the resource(s). + +~~~ +user { 'dan': + gid => 'mygroup', + ensure => present, +} + +ensure_resources($user) +~~~ + +An hash of resources should be passed in and each will be created with the type and parameters specified if it doesn't already exist: + + ensure_resources('user', {'dan' => { gid => 'mygroup', uid => '600' } , 'alex' => { gid => 'mygroup' }}, {'ensure' => 'present'}) + +From Hiera Backend: + +~~~ +userlist: + dan: + gid: 'mygroup' + uid: '600' + alex: + gid: 'mygroup' + +ensure_resources('user', hiera_hash('userlist'), {'ensure' => 'present'}) +~~~ + +### `flatten` + +Flattens deeply nested arrays and returns a single flat array as a result. For example, `flatten(['a', ['b', ['c']]])` returns ['a','b','c']. *Type*: rvalue. + +#### `floor` + +Takes a single numeric value as an argument, and returns the largest integer less than or equal to the argument. *Type*: rvalue. + +#### `fqdn_rand_string` + +Generates a random alphanumeric string using an optionally-specified character set (default is alphanumeric), combining the `$fqdn` fact and an optional seed for repeatable randomness. + +*Usage:* +~~~ +fqdn_rand_string(LENGTH, [CHARSET], [SEED]) +~~~ +*Examples:* +~~~ +fqdn_rand_string(10) +fqdn_rand_string(10, 'ABCDEF!@#$%^') +fqdn_rand_string(10, '', 'custom seed') +~~~ + +*Type*: rvalue. + +#### `fqdn_rotate` + +Rotates an array or string a random number of times, combining the `$fqdn` fact and an optional seed for repeatable randomness. + +*Usage:* + +~~~ +fqdn_rotate(VALUE, [SEED]) +~~~ + +*Examples:* + +~~~ +fqdn_rotate(['a', 'b', 'c', 'd']) +fqdn_rotate('abcd') +fqdn_rotate([1, 2, 3], 'custom seed') +~~~ + +*Type*: rvalue. + +#### `fqdn_uuid` + +Returns a rfc4122 valid version 5 UUID based on an FQDN string under the DNS namespace + + * fqdn_uuid('puppetlabs.com') returns '9c70320f-6815-5fc5-ab0f-debe68bf764c' + * fqdn_uuid('google.com') returns '64ee70a4-8cc1-5d25-abf2-dea6c79a09c8' + +*Type*: rvalue. + +#### `get_module_path` + +Returns the absolute path of the specified module for the current environment. + + `$module_path = get_module_path('stdlib')` + +*Type*: rvalue. + +#### `getparam` + +Takes a resource reference and the name of the parameter, and returns the value of the resource's parameter. + +For example, the following returns 'param_value': + + ~~~ + define example_resource($param) { + } + + example_resource { "example_resource_instance": + param => "param_value" + } + + getparam(Example_resource["example_resource_instance"], "param") + ~~~ + +*Type*: rvalue. + +#### `getvar` + +Looks up a variable in a remote namespace. + +For example: + + ~~~ + $foo = getvar('site::data::foo') + # Equivalent to $foo = $site::data::foo + ~~~ + +This is useful if the namespace itself is stored in a string: + + ~~~ + $datalocation = 'site::data' + $bar = getvar("${datalocation}::bar") + # Equivalent to $bar = $site::data::bar + ~~~ + +*Type*: rvalue. + +#### `grep` + +Searches through an array and returns any elements that match the provided regular expression. For example, `grep(['aaa','bbb','ccc','aaaddd'], 'aaa')` returns ['aaa','aaaddd']. *Type*: rvalue. + +#### `has_interface_with` + +Returns a boolean based on kind and value: + * macaddress + * netmask + * ipaddress + * network + +*Examples:* + + ~~~ + has_interface_with("macaddress", "x:x:x:x:x:x") + has_interface_with("ipaddress", "127.0.0.1") => true + ~~~ + +If no kind is given, then the presence of the interface is checked: + + ~~~ + has_interface_with("lo") => true + ~~~ + +*Type*: rvalue. + +#### `has_ip_address` + +Returns 'true' if the client has the requested IP address on some interface. This function iterates through the `interfaces` fact and checks the `ipaddress_IFACE` facts, performing a simple string comparison. *Type*: rvalue. + +#### `has_ip_network` + +Returns 'true' if the client has an IP address within the requested network. This function iterates through the `interfaces` fact and checks the `network_IFACE` facts, performing a simple string comparision. *Type*: rvalue. + +#### `has_key` + +Determines if a hash has a certain key value. + +*Example*: + + ~~~ + $my_hash = {'key_one' => 'value_one'} + if has_key($my_hash, 'key_two') { + notice('we will not reach here') + } + if has_key($my_hash, 'key_one') { + notice('this will be printed') + } + ~~~ + +*Type*: rvalue. + +#### `hash` + +Converts an array into a hash. For example, `hash(['a',1,'b',2,'c',3])` returns {'a'=>1,'b'=>2,'c'=>3}. *Type*: rvalue. + +#### `intersection` + +Returns an array an intersection of two. For example, `intersection(["a","b","c"],["b","c","d"])` returns ["b","c"]. *Type*: rvalue. + +#### `is_a` + +Boolean check to determine whether a variable is of a given data type. This is equivalent to the `=~` type checks. This function is available only in Puppet 4 or in Puppet 3 with the "future" parser. + + ~~~ + foo = 3 + $bar = [1,2,3] + $baz = 'A string!' + + if $foo.is_a(Integer) { + notify { 'foo!': } + } + if $bar.is_a(Array) { + notify { 'bar!': } + } + if $baz.is_a(String) { + notify { 'baz!': } + } + ~~~ + +See the [the Puppet type system](https://docs.puppetlabs.com/references/latest/type.html#about-resource-types) for more information about types. +See the [`assert_type()`](https://docs.puppetlabs.com/references/latest/function.html#asserttype) function for flexible ways to assert the type of a value. + +#### `is_absolute_path` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the given path is absolute. *Type*: rvalue. + +#### `is_array` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable passed to this function is an array. *Type*: rvalue. + +#### `is_bool` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable passed to this function is a boolean. *Type*: rvalue. + +#### `is_domain_name` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the string passed to this function is a syntactically correct domain name. *Type*: rvalue. + +#### `is_float` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable passed to this function is a float. *Type*: rvalue. + +#### `is_function_available` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Accepts a string as an argument and determines whether the Puppet runtime has access to a function by that name. It returns 'true' if the function exists, 'false' if not. *Type*: rvalue. + +#### `is_hash` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable passed to this function is a hash. *Type*: rvalue. + +#### `is_integer` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable returned to this string is an integer. *Type*: rvalue. + +#### `is_ip_address` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the string passed to this function is a valid IP address. *Type*: rvalue. + +#### `is_ipv6_address` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the string passed to this function is a valid IPv6 address. *Type*: rvalue. + +#### `is_ipv4_address` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the string passed to this function is a valid IPv4 address. *Type*: rvalue. + +#### `is_mac_address` + +Returns 'true' if the string passed to this function is a valid MAC address. *Type*: rvalue. + +#### `is_numeric` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable passed to this function is a number. *Type*: rvalue. + +#### `is_string` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable passed to this function is a string. *Type*: rvalue. + +#### `join` + +Joins an array into a string using a separator. For example, `join(['a','b','c'], ",")` results in: "a,b,c". *Type*: rvalue. + +#### `join_keys_to_values` + +Joins each key of a hash to that key's corresponding value with a separator. Keys are cast to strings. +If values are arrays, multiple keys are added for each element. +The return value is an array in which each element is one joined key/value pair. For example, `join_keys_to_values({'a'=>1,'b'=>[2,3]}, " is ")` results in ["a is 1","b is 2","b is 3"]. *Type*: rvalue. + +#### `keys` + +Returns the keys of a hash as an array. *Type*: rvalue. + +#### `length` + +Returns the length of a given string, array or hash. To eventually replace the deprecated size() function as can handle the new type functionality introduced in Puppet 4. *Type*: rvalue. + +#### `loadyaml` + +Loads a YAML file containing an array, string, or hash, and returns the data in the corresponding native data type. + +For example: + + ~~~ + $myhash = loadyaml('/etc/puppet/data/myhash.yaml') + ~~~ + +The second parameter will be returned if the file was not found or could not be parsed. + +For example: + + ~~~ + $myhash = loadyaml('no-file.yaml', {'default'=>'value'}) + ~~~ + +*Type*: rvalue. + +#### `loadjson` + +Loads a JSON file containing an array, string, or hash, and returns the data in the corresponding native data type. + +For example: + + ~~~ + $myhash = loadjson('/etc/puppet/data/myhash.json') + ~~~ + +The second parameter will be returned if the file was not found or could not be parsed. + +For example: + + ~~~ + $myhash = loadjson('no-file.json', {'default'=>'value'}) + ~~~ + +*Type*: rvalue. + +#### `load_module_metadata` + +Loads the metadata.json of a target module. Can be used to determine module version and authorship for dynamic support of modules. + + ~~~ + $metadata = load_module_metadata('archive') + notify { $metadata['author']: } + ~~~ + +If you do not want to fail the catalog compilation when a module's metadata file is absent: + + ~~~ + $metadata = load_module_metadata('mysql', true) + if empty($metadata) { + notify { "This module does not have a metadata.json file.": } + } + ~~~ + +*Type*: rvalue. + +#### `lstrip` + +Strips spaces to the left of a string. *Type*: rvalue. + +#### `max` + +Returns the highest value of all arguments. Requires at least one argument. *Type*: rvalue. + +#### `member` + +This function determines if a variable is a member of an array. The variable can be either a string, array, or fixnum. For example, `member(['a','b'], 'b')` and `member(['a','b','c'], ['b','c'])` return 'true', while `member(['a','b'], 'c')` and `member(['a','b','c'], ['c','d'])` return 'false'. *Note*: This function does not support nested arrays. If the first argument contains nested arrays, it will not recurse through them. + +*Type*: rvalue. + +#### `merge` + +Merges two or more hashes together and returns the resulting hash. + +*Example*: + + ~~~ + $hash1 = {'one' => 1, 'two' => 2} + $hash2 = {'two' => 'dos', 'three' => 'tres'} + $merged_hash = merge($hash1, $hash2) + # The resulting hash is equivalent to: + # $merged_hash = {'one' => 1, 'two' => 'dos', 'three' => 'tres'} + ~~~ + +When there is a duplicate key, the key in the rightmost hash "wins." *Type*: rvalue. + +#### `min` + +Returns the lowest value of all arguments. Requires at least one argument. *Type*: rvalue. + +#### `num2bool` + +Converts a number or a string representation of a number into a true boolean. Zero or anything non-numeric becomes 'false'. Numbers greater than 0 become 'true'. *Type*: rvalue. + +#### `parsejson` + +Converts a string of JSON into the correct Puppet structure. *Type*: rvalue. The optional second argument is returned if the data was not correct. + +#### `parseyaml` + +Converts a string of YAML into the correct Puppet structure. *Type*: rvalue. The optional second argument is returned if the data was not correct. + +#### `pick` + +From a list of values, returns the first value that is not undefined or an empty string. Takes any number of arguments, and raises an error if all values are undefined or empty. + + ~~~ + $real_jenkins_version = pick($::jenkins_version, '1.449') + ~~~ + +*Type*: rvalue. + +#### `pick_default` + +Returns the first value in a list of values. Contrary to the `pick()` function, the `pick_default()` does not fail if all arguments are empty. This allows it to use an empty value as default. *Type*: rvalue. + +#### `prefix` + +Applies a prefix to all elements in an array, or to the keys in a hash. +For example: +* `prefix(['a','b','c'], 'p')` returns ['pa','pb','pc'] +* `prefix({'a'=>'b','b'=>'c','c'=>'d'}, 'p')` returns {'pa'=>'b','pb'=>'c','pc'=>'d'}. + +*Type*: rvalue. + +#### `pry` + +This function invokes a pry debugging session in the current scope object. This is useful for debugging manifest code at specific points during a compilation. Should only be used when running `puppet apply` or running a puppet master in the foreground. This requires the `pry` gem to be installed in puppet's rubygems. + +*Examples:* +```puppet +pry() +``` +Once in a pry session, some interesting commands: + +* Run `catalog` to see the contents currently compiling catalog +* Run `cd catalog` and `ls` to see catalog methods and instance variables +* Run `@resource_table` to see the current catalog resource table + +#### `assert_private` + +Sets the current class or definition as private. Calling the class or definition from outside the current module will fail. + +For example, `assert_private()` called in class `foo::bar` outputs the following message if class is called from outside module `foo`: + + ~~~ + Class foo::bar is private + ~~~ + + To specify the error message you want to use: + + ~~~ + assert_private("You're not supposed to do that!") + ~~~ + +*Type*: statement. + +#### `pw_hash` + +Hashes a password using the crypt function. Provides a hash usable on most POSIX systems. + +The first argument to this function is the password to hash. If it is undef or an empty string, this function returns undef. + +The second argument to this function is which type of hash to use. It will be converted into the appropriate crypt(3) hash specifier. Valid hash types are: + +|Hash type |Specifier| +|---------------------|---------| +|MD5 |1 | +|SHA-256 |5 | +|SHA-512 (recommended)|6 | + +The third argument to this function is the salt to use. + +*Type*: rvalue. + +**Please note:** This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +**Note:** this uses the Puppet master's implementation of crypt(3). If your environment contains several different operating systems, ensure that they are compatible before using this function. + +#### `range` + +Extrapolates a range as an array when given in the form of '(start, stop)'. For example, `range("0", "9")` returns [0,1,2,3,4,5,6,7,8,9]. Zero-padded strings are converted to integers automatically, so `range("00", "09")` returns [0,1,2,3,4,5,6,7,8,9]. + +Non-integer strings are accepted; `range("a", "c")` returns ["a","b","c"], and `range("host01", "host10")` returns ["host01", "host02", ..., "host09", "host10"]. +NB Be explicit in including trailing zeros. Otherwise the underlying ruby function will fail. + +Passing a third argument will cause the generated range to step by that interval, e.g. `range("0", "9", "2")` returns ["0","2","4","6","8"]. + +*Type*: rvalue. + +#### `regexpescape` + +Regexp escape a string or array of strings. Requires either a single string or an array as an input. *Type*: rvalue. + +#### `reject` + +Searches through an array and rejects all elements that match the provided regular expression. For example, `reject(['aaa','bbb','ccc','aaaddd'], 'aaa')` returns ['bbb','ccc']. *Type*: rvalue. + +#### `reverse` + +Reverses the order of a string or array. *Type*: rvalue. + +#### `rstrip` + +Strips spaces to the right of the string. *Type*: rvalue. + +#### `seeded_rand` + +Takes an integer max value and a string seed value and returns a repeatable random integer smaller than max. Like `fqdn_rand`, but does not add node specific data to the seed. *Type*: rvalue. + +#### `shell_escape` + +Escapes a string so that it can be safely used in a Bourne shell command line. Note that the resulting string should be used unquoted and is not intended for use in double quotes nor in single quotes. This function behaves the same as ruby's `Shellwords.shellescape()` function, also see the [ruby documentation](http://ruby-doc.org/stdlib-2.3.0/libdoc/shellwords/rdoc/Shellwords.html#method-c-shellescape). + +*Example:* +~~~ +shell_escape('foo b"ar') => 'foo\ b\"ar' +~~~ + +*Type*: rvalue. + +#### `shell_join` + +Builds a command line string from the given array of strings. Each array item is escaped for Bourne shell. All items are +then joined together, with a single space in between. This function behaves the same as ruby's `Shellwords.shelljoin()` function, also see the [ruby documentation](http://ruby-doc.org/stdlib-2.3.0/libdoc/shellwords/rdoc/Shellwords.html#method-c-shelljoin). + +*Example:* +~~~ +shell_join(['foo bar', 'ba"z']) => 'foo\ bar ba\"z' +~~~ + +*Type*: rvalue. + +#### `shell_split` + +Splits a string into an array of tokens in the same way the Bourne shell does. This function behaves the same as ruby's `Shellwords.shellsplit()` function, also see the [ruby documentation](http://ruby-doc.org/stdlib-2.3.0/libdoc/shellwords/rdoc/Shellwords.html#method-c-shellsplit). + +*Example:* +~~~ +shell_split('foo\ bar ba\"z') => ['foo bar', 'ba"z'] +~~~ + +*Type*: rvalue. + +#### `shuffle` + +Randomizes the order of a string or array elements. *Type*: rvalue. + +#### `size` + +Returns the number of elements in a string, an array or a hash. May get confused around Puppet 4 type values and as such is to be deprecated in the next release and replaced with the new stdlib length function. *Type*: rvalue. + +#### `sort` + +Sorts strings and arrays lexically. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `squeeze` + +Returns a new string where runs of the same character that occur in this set are replaced by a single character. *Type*: rvalue. + +#### `str2bool` + +Converts certain strings to a boolean. This attempts to convert strings that contain the values '1', 'true', 't', 'y', or 'yes' to true. Strings that contain values '0', 'false', 'f', 'n', or 'no', or that are an empty string or undefined are converted to false. Any other value causes an error. These checks are case insensitive. *Type*: rvalue. + +#### `str2saltedsha512` + +Converts a string to a salted-SHA512 password hash, used for OS X versions >= 10.7. Given any string, this function returns a hex version of a salted-SHA512 password hash, which can be inserted into your Puppet +manifests as a valid password attribute. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `strftime` + +Returns formatted time. For example, `strftime("%s")` returns the time since Unix epoch, and `strftime("%Y-%m-%d")` returns the date. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + + *Format:* + + * `%a`: The abbreviated weekday name ('Sun') + * `%A`: The full weekday name ('Sunday') + * `%b`: The abbreviated month name ('Jan') + * `%B`: The full month name ('January') + * `%c`: The preferred local date and time representation + * `%C`: Century (20 in 2009) + * `%d`: Day of the month (01..31) + * `%D`: Date (%m/%d/%y) + * `%e`: Day of the month, blank-padded ( 1..31) + * `%F`: Equivalent to %Y-%m-%d (the ISO 8601 date format) + * `%h`: Equivalent to %b + * `%H`: Hour of the day, 24-hour clock (00..23) + * `%I`: Hour of the day, 12-hour clock (01..12) + * `%j`: Day of the year (001..366) + * `%k`: Hour, 24-hour clock, blank-padded ( 0..23) + * `%l`: Hour, 12-hour clock, blank-padded ( 0..12) + * `%L`: Millisecond of the second (000..999) + * `%m`: Month of the year (01..12) + * `%M`: Minute of the hour (00..59) + * `%n`: Newline (\n) + * `%N`: Fractional seconds digits, default is 9 digits (nanosecond) + * `%3N`: Millisecond (3 digits) + * `%6N`: Microsecond (6 digits) + * `%9N`: Nanosecond (9 digits) + * `%p`: Meridian indicator ('AM' or 'PM') + * `%P`: Meridian indicator ('am' or 'pm') + * `%r`: Time, 12-hour (same as %I:%M:%S %p) + * `%R`: Time, 24-hour (%H:%M) + * `%s`: Number of seconds since the Unix epoch, 1970-01-01 00:00:00 UTC. + * `%S`: Second of the minute (00..60) + * `%t`: Tab character ( ) + * `%T`: Time, 24-hour (%H:%M:%S) + * `%u`: Day of the week as a decimal, Monday being 1. (1..7) + * `%U`: Week number of the current year, starting with the first Sunday as the first day of the first week (00..53) + * `%v`: VMS date (%e-%b-%Y) + * `%V`: Week number of year according to ISO 8601 (01..53) + * `%W`: Week number of the current year, starting with the first Monday as the first day of the first week (00..53) + * `%w`: Day of the week (Sunday is 0, 0..6) + * `%x`: Preferred representation for the date alone, no time + * `%X`: Preferred representation for the time alone, no date + * `%y`: Year without a century (00..99) + * `%Y`: Year with century + * `%z`: Time zone as hour offset from UTC (e.g. +0900) + * `%Z`: Time zone name + * `%%`: Literal '%' character + +#### `strip` + +Removes leading and trailing whitespace from a string or from every string inside an array. For example, `strip(" aaa ")` results in "aaa". *Type*: rvalue. + +#### `suffix` + +Applies a suffix to all elements in an array, or to the keys in a hash. +For example: +* `suffix(['a','b','c'], 'p')` returns ['ap','bp','cp'] +* `suffix({'a'=>'b','b'=>'c','c'=>'d'}, 'p')` returns {'ap'=>'b','bp'=>'c','cp'=>'d'}. + +*Type*: rvalue. + +#### `swapcase` + +Swaps the existing case of a string. For example, `swapcase("aBcD")` results in "AbCd". *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `time` + +Returns the current Unix epoch time as an integer. For example, `time()` returns something like '1311972653'. *Type*: rvalue. + +#### `to_bytes` + +Converts the argument into bytes, for example "4 kB" becomes "4096". Takes a single string value as an argument. *Type*: rvalue. + +#### `try_get_value` + +*Type*: rvalue. + +DEPRECATED: replaced by `dig()`. + +Retrieves a value within multiple layers of hashes and arrays via a string containing a path. The path is a string of hash keys or array indexes starting with zero, separated by the path separator character (default "/"). The function goes through the structure by each path component and tries to return the value at the end of the path. + +In addition to the required path argument, the function accepts the default argument. It is returned if the path is not correct, if no value was found, or if any other error has occurred. The last argument can set the path separator character. + +~~~ruby +$data = { + 'a' => { + 'b' => [ + 'b1', + 'b2', + 'b3', + ] + } +} + +$value = try_get_value($data, 'a/b/2') +# $value = 'b3' + +# with all possible options +$value = try_get_value($data, 'a/b/2', 'not_found', '/') +# $value = 'b3' + +# using the default value +$value = try_get_value($data, 'a/b/c/d', 'not_found') +# $value = 'not_found' + +# using custom separator +$value = try_get_value($data, 'a|b', [], '|') +# $value = ['b1','b2','b3'] +~~~ + +1. **$data** The data structure we are working with. +2. **'a/b/2'** The path string. +3. **'not_found'** The default value. It will be returned if nothing is found. + (optional, defaults to *undef*) +4. **'/'** The path separator character. + (optional, defaults to *'/'*) + +#### `type3x` + +Returns a string description of the type when passed a value. Type can be a string, array, hash, float, integer, or boolean. This function will be removed when Puppet 3 support is dropped and the new type system can be used. *Type*: rvalue. + +#### `type_of` + +This function is provided for backwards compatibility but is generally not preferred over the built-in [type() function](https://docs.puppet.com/puppet/latest/reference/function.html#type) provided by Puppet. + +Returns the literal type when passed a value. Requires the new parser. Useful for comparison of types with `<=` such as in `if type_of($some_value) <= Array[String] { ... }` (which is equivalent to `if $some_value =~ Array[String] { ... }`) *Type*: rvalue. + +#### `union` + +Returns a union of two or more arrays, without duplicates. For example, `union(["a","b","c"],["b","c","d"])` returns ["a","b","c","d"]. *Type*: rvalue. + +#### `unique` + +Removes duplicates from strings and arrays. For example, `unique("aabbcc")` returns 'abc', and `unique(["a","a","b","b","c","c"])` returns ["a","b","c"]. *Type*: rvalue. + +#### `unix2dos` + +Returns the DOS version of the given string. Very useful when using a File resource with a cross-platform template. *Type*: rvalue. + +~~~ +file{$config_file: + ensure => file, + content => unix2dos(template('my_module/settings.conf.erb')), +} +~~~ + +See also [dos2unix](#dos2unix). + +#### `upcase` + +Converts an object, array or hash of objects that respond to upcase to uppercase. For example, `upcase('abcd')` returns 'ABCD'. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `uriescape` + +URLEncodes a string or array of strings. Requires either a single string or an array as an input. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `validate_absolute_path` + +Validates that a given string represents an absolute path in the filesystem. Works for Windows and Unix style paths. + +The following values pass: + +~~~ +$my_path = 'C:/Program Files (x86)/Puppet Labs/Puppet' +validate_absolute_path($my_path) +$my_path2 = '/var/lib/puppet' +validate_absolute_path($my_path2) +$my_path3 = ['C:/Program Files (x86)/Puppet Labs/Puppet','C:/Program Files/Puppet Labs/Puppet'] +validate_absolute_path($my_path3) +$my_path4 = ['/var/lib/puppet','/usr/share/puppet'] +validate_absolute_path($my_path4) +~~~ + +The following values fail, causing compilation to abort: + +~~~ +validate_absolute_path(true) +validate_absolute_path('../var/lib/puppet') +validate_absolute_path('var/lib/puppet') +validate_absolute_path([ 'var/lib/puppet', '/var/foo' ]) +validate_absolute_path([ '/var/lib/puppet', 'var/foo' ]) +$undefined = undef +validate_absolute_path($undefined) +~~~ + +*Type*: statement. + +#### `validate_array` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that all passed values are array data structures. Aborts catalog compilation if any value fails this check. + +The following values pass: + +~~~ +$my_array = [ 'one', 'two' ] +validate_array($my_array) +~~~ + +The following values fail, causing compilation to abort: + +~~~ +validate_array(true) +validate_array('some_string') +$undefined = undef +validate_array($undefined) +~~~ + +*Type*: statement. + +#### `validate_augeas` + +Performs validation of a string using an Augeas lens. The first argument of this function should be the string to test, and the second argument should be the name of the Augeas lens to use. If Augeas fails to parse the string with the lens, the compilation aborts with a parse error. + +A third optional argument lists paths which should **not** be found in the file. The `$file` variable points to the location of the temporary file being tested in the Augeas tree. + +For example, to make sure your $passwdcontent never contains user `foo`: + +~~~ +validate_augeas($passwdcontent, 'Passwd.lns', ['$file/foo']) +~~~ + +To ensure that no users use the '/bin/barsh' shell: + +~~~ +validate_augeas($passwdcontent, 'Passwd.lns', ['$file/*[shell="/bin/barsh"]'] +~~~ + +You can pass a fourth argument as the error message raised and shown to the user: + +~~~ +validate_augeas($sudoerscontent, 'Sudoers.lns', [], 'Failed to validate sudoers content with Augeas') +~~~ + +*Type*: statement. + +#### `validate_bool` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that all passed values are either true or false. Aborts catalog compilation if any value fails this check. + +The following values will pass: + +~~~ +$iamtrue = true +validate_bool(true) +validate_bool(true, true, false, $iamtrue) +~~~ + +The following values will fail, causing compilation to abort: + +~~~ +$some_array = [ true ] +validate_bool("false") +validate_bool("true") +validate_bool($some_array) +~~~ + +*Type*: statement. + +#### `validate_cmd` + +Performs validation of a string with an external command. The first argument of this function should be a string to test, and the second argument should be a path to a test command taking a % as a placeholder for the file path (will default to the end of the command if no % placeholder given). If the command is launched against a tempfile containing the passed string, or returns a non-null value, compilation will abort with a parse error. + +If a third argument is specified, this will be the error message raised and seen by the user. + +~~~ +# Defaults to end of path +validate_cmd($sudoerscontent, '/usr/sbin/visudo -c -f', 'Visudo failed to validate sudoers content') +~~~ +~~~ +# % as file location +validate_cmd($haproxycontent, '/usr/sbin/haproxy -f % -c', 'Haproxy failed to validate config content') +~~~ + +*Type*: statement. + +#### `validate_hash` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that all passed values are hash data structures. Aborts catalog compilation if any value fails this check. + + The following values will pass: + + ~~~ + $my_hash = { 'one' => 'two' } + validate_hash($my_hash) + ~~~ + + The following values will fail, causing compilation to abort: + + ~~~ + validate_hash(true) + validate_hash('some_string') + $undefined = undef + validate_hash($undefined) + ~~~ + +*Type*: statement. + +#### `validate_integer` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that the first argument is an integer (or an array of integers). Aborts catalog compilation if any of the checks fail. + + The second argument is optional and passes a maximum. (All elements of) the first argument has to be less or equal to this max. + + The third argument is optional and passes a minimum. (All elements of) the first argument has to be greater or equal to this min. + If, and only if, a minimum is given, the second argument may be an empty string or undef, which will be handled to just check + if (all elements of) the first argument are greater or equal to the given minimum. + + It will fail if the first argument is not an integer or array of integers, and if arg 2 and arg 3 are not convertable to an integer. + + The following values will pass: + + ~~~ + validate_integer(1) + validate_integer(1, 2) + validate_integer(1, 1) + validate_integer(1, 2, 0) + validate_integer(2, 2, 2) + validate_integer(2, '', 0) + validate_integer(2, undef, 0) + $foo = undef + validate_integer(2, $foo, 0) + validate_integer([1,2,3,4,5], 6) + validate_integer([1,2,3,4,5], 6, 0) + ~~~ + + * Plus all of the above, but any combination of values passed as strings ('1' or "1"). + * Plus all of the above, but with (correct) combinations of negative integer values. + + The following values will fail, causing compilation to abort: + + ~~~ + validate_integer(true) + validate_integer(false) + validate_integer(7.0) + validate_integer({ 1 => 2 }) + $foo = undef + validate_integer($foo) + validate_integer($foobaridontexist) + + validate_integer(1, 0) + validate_integer(1, true) + validate_integer(1, '') + validate_integer(1, undef) + validate_integer(1, , 0) + validate_integer(1, 2, 3) + validate_integer(1, 3, 2) + validate_integer(1, 3, true) + ~~~ + + * Plus all of the above, but any combination of values passed as strings ('false' or "false"). + * Plus all of the above, but with incorrect combinations of negative integer values. + * Plus all of the above, but with non-integer items in arrays or maximum / minimum argument. + + *Type*: statement. + +#### `validate_ip_address` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that the argument is an IP address, regardless of it is an IPv4 or an IPv6 +address. It also validates IP address with netmask. The argument must be given as a string. + +The following values will pass: + + ~~~ + validate_ip_address('0.0.0.0') + validate_ip_address('8.8.8.8') + validate_ip_address('127.0.0.1') + validate_ip_address('194.232.104.150') + validate_ip_address('3ffe:0505:0002::') + validate_ip_address('::1/64') + validate_ip_address('fe80::a00:27ff:fe94:44d6/64') + validate_ip_address('8.8.8.8/32') + ~~~ + +The following values will fail, causing compilation to abort: + + ~~~ + validate_ip_address(1) + validate_ip_address(true) + validate_ip_address(0.0.0.256) + validate_ip_address('::1', {}) + validate_ip_address('0.0.0.0.0') + validate_ip_address('3.3.3') + validate_ip_address('23.43.9.22/64') + validate_ip_address('260.2.32.43') + ~~~ + + +#### `validate_legacy` + +Validates a value against both a specified type and a deprecated validation function. Silently passes if both pass, errors if only one validation passes, and fails if both validations return false. + +Accepts arguments for: +* the type to check the value against, +* the full name of the previous validation function, +* the value to be checked, +* an unspecified number of arguments needed for the previous validation function. + +Example: + +``` +validate_legacy("Optional[String]", "validate_re", "Value to be validated", ["."]) +``` + +This function supports updating modules from Puppet 3 style argument validation (using the stdlib `validate_*` functions) to Puppet 4 data types, without breaking functionality for those depending on Puppet 3 style validation. + +> Note: This function is compatible only with Puppet 4.4.0 (PE 2016.1) and later. + +##### For module users + +If you are running Puppet 4, the `validate_legacy` function can help you find and resolve deprecated Puppet 3 `validate_*` functions. These functions are deprecated as of stdlib version 4.13 and will be removed in a future version of stdlib. + +Puppet 4 allows improved defined type checking using [data types](https://docs.puppet.com/puppet/latest/reference/lang_data.html). Data types avoid some of the problems with Puppet 3's `validate_*` functions, which could sometimes be inconsistent. For example, [validate_numeric](#validate_numeric) unintentionally allowed not only numbers, but also arrays of numbers or strings that looked like numbers. + +If you run Puppet 4 and use modules with deprecated `validate_*` functions, you might encounter deprecation messages. The `validate_legacy` function makes these differences visible and makes it easier to move to the clearer Puppet 4 syntax. + +The deprecation messages you get can vary, depending on the modules and data that you use. These deprecation messages appear by default only in Puppet 4: + +* `Notice: Accepting previously invalid value for target type ''`: This message is informational only. You're using values that are allowed by the new type, but would have been invalid by the old validation function. +* `Warning: This method is deprecated, please use the stdlib validate_legacy function`: The module has not yet upgraded to `validate_legacy`. Use the [deprecation](#deprecation) options to silence warnings for now, or submit a fix with the module's developer. See the information [for module developers](#for-module-developers) below for how to fix the issue. +* `Warning: validate_legacy() expected value, got _`: Your code passes a value that was accepted by the Puppet 3-style validation, but will not be accepted by the next version of the module. Most often, you can fix this by removing quotes from numbers or booleans. +* `Error: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Function Call, validate_legacy() expected value, got `: Your code passes a value that is not acceptable to either the new or the old style validation. + +##### For module developers + +The `validate_legacy` function helps you move from Puppet 3 style validation to Puppet 4 validation without breaking functionality your module's users depend on. + +Moving to Puppet 4 type validation allows much better defined type checking using [data types](https://docs.puppet.com/puppet/latest/reference/lang_data.html). Many of Puppet 3's `validate_*` functions have surprising holes in their validation. For example, [validate_numeric](#validate_numeric) allows not only numbers, but also arrays of numbers or strings that look like numbers, without giving you any control over the specifics. + +For each parameter of your classes and defined types, choose a new Puppet 4 data type to use. In most cases, the new data type allows a different set of values than the original `validate_*` function. The situation then looks like this: + +| | `validate_` pass | `validate_` fail | +| ------------ | ---------------- | ---------------- | +| matches type | pass | pass, notice | +| fails type | pass, deprecated | fail | + +The code after the validation still has to handle all possible values for now, but users of your code can change their manifests to pass only values that match the new type. + +For each `validate_*` function in stdlib, there is a matching `Stdlib::Compat::*` type that allows the appropriate set of values. See the documentation in the `types/` directory in the stdlib source code for caveats. + +For example, given a class that should accept only numbers, like this: + +~~~ +class example($value) { + validate_numeric($value) +~~~ + +the resulting validation code looks like this: + +~~~ +class example( + Variant[Stdlib::Compat::Numeric, Numeric] $value +) { + validate_legacy(Numeric, 'validate_numeric', $value) +~~~ + +Here, the type of `$value` is defined as `Variant[Stdlib::Compat::Numeric, Numeric]`, which allows any `Numeric` (the new type), as well as all values previously accepted by `validate_numeric` (through `Stdlib::Compat::Numeric`). + +The call to `validate_legacy` takes care of triggering the correct log or fail message for you. It requires the new type, the previous validation function name, and all arguments to that function. + +If your module still supported Puppet 3, this is a breaking change. Update your `metadata.json` requirements section to indicate that your module no longer supports Puppet 3, and bump the major version of your module. With this change, all existing tests for your module should still pass. Create additional tests for the new possible values. + +As a breaking change, this is also a good time to call [`deprecation`](#deprecation) for any parameters you want to get rid of, or to add additional constraints on your parameters. + +After releasing this version, you can release another breaking change release where you remove all compat types and all calls to `validate_legacy`. At that time, you can also go through your code and remove any leftovers dealing with the previously possible values. + +Always note such changes in your CHANGELOG and README. + +#### `validate_numeric` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that the first argument is a numeric value (or an array or string of numeric values). Aborts catalog compilation if any of the checks fail. + + The second argument is optional and passes a maximum. (All elements of) the first argument has to be less or equal to this max. + + The third argument is optional and passes a minimum. (All elements of) the first argument has to be greater or equal to this min. + If, and only if, a minimum is given, the second argument may be an empty string or undef, which will be handled to just check + if (all elements of) the first argument are greater or equal to the given minimum. + + It will fail if the first argument is not a numeric (Integer or Float) or array of numerics, and if arg 2 and arg 3 are not convertable to a numeric. + + For passing and failing usage, see `validate_integer()`. It is all the same for validate_numeric, yet now floating point values are allowed, too. + +*Type*: statement. + +#### `validate_re` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Performs simple validation of a string against one or more regular expressions. The first argument of this function should be the string to +test, and the second argument should be a stringified regular expression (without the // delimiters) or an array of regular expressions. If none of the regular expressions match the string passed in, compilation aborts with a parse error. + + You can pass a third argument as the error message raised and shown to the user. + + The following strings validate against the regular expressions: + + ~~~ + validate_re('one', '^one$') + validate_re('one', [ '^one', '^two' ]) + ~~~ + + The following string fails to validate, causing compilation to abort: + + ~~~ + validate_re('one', [ '^two', '^three' ]) + ~~~ + + To set the error message: + + ~~~ + validate_re($::puppetversion, '^2.7', 'The $puppetversion fact value does not match 2.7') + ~~~ + + Note: Compilation terminates if the first argument is not a string. Always use quotes to force stringification: + + ~~~ + validate_re("${::operatingsystemmajrelease}", '^[57]$') + ~~~ + +*Type*: statement. + +#### `validate_slength` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that the first argument is a string (or an array of strings), and is less than or equal to the length of the second argument. It fails if the first argument is not a string or array of strings, or if the second argument is not convertable to a number. Optionally, a minimum string length can be given as the third argument. + + The following values pass: + + ~~~ + validate_slength("discombobulate",17) + validate_slength(["discombobulate","moo"],17) + validate_slength(["discombobulate","moo"],17,3) + ~~~ + + The following values fail: + + ~~~ + validate_slength("discombobulate",1) + validate_slength(["discombobulate","thermometer"],5) + validate_slength(["discombobulate","moo"],17,10) + ~~~ + +*Type*: statement. + +#### `validate_string` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that all passed values are string data structures. Aborts catalog compilation if any value fails this check. + +The following values pass: + + ~~~ + $my_string = "one two" + validate_string($my_string, 'three') + ~~~ + + The following values fail, causing compilation to abort: + + ~~~ + validate_string(true) + validate_string([ 'some', 'array' ]) + ~~~ + +*Note:* validate_string(undef) will not fail in this version of the functions API (incl. current and future parser). + +Instead, use: + + ~~~ + if $var == undef { + fail('...') + } + ~~~ + +*Type*: statement. + +#### `validate_x509_rsa_key_pair` + +Validates a PEM-formatted X.509 certificate and private key using OpenSSL. +Verifies that the certficate's signature was created from the supplied key. + +Fails catalog compilation if any value fails this check. + +Takes two arguments, the first argument must be a X.509 certificate and the +second must be an RSA private key: + + ~~~ + validate_x509_rsa_key_pair($cert, $key) + ~~~ + +*Type*: statement. + +#### `values` + +Returns the values of a given hash. For example, given `$hash = {'a'=1, 'b'=2, 'c'=3} values($hash)` returns [1,2,3]. + +*Type*: rvalue. + +#### `values_at` + +Finds values inside an array based on location. The first argument is the array you want to analyze, and the second argument can be a combination of: + + * A single numeric index + * A range in the form of 'start-stop' (eg. 4-9) + * An array combining the above + + For example, `values_at(['a','b','c'], 2)` returns ['c']; `values_at(['a','b','c'], ["0-1"])` returns ['a','b']; and `values_at(['a','b','c','d','e'], [0, "2-3"])` returns ['a','c','d']. + +*Type*: rvalue. + +#### `zip` + +Takes one element from first array given and merges corresponding elements from second array given. This generates a sequence of n-element arrays, where *n* is one more than the count of arguments. For example, `zip(['1','2','3'],['4','5','6'])` results in ["1", "4"], ["2", "5"], ["3", "6"]. *Type*: rvalue. + +## Limitations + +As of Puppet Enterprise 3.7, the stdlib module is no longer included in PE. PE users should install the most recent release of stdlib for compatibility with Puppet modules. + +### Version Compatibility + +Versions | Puppet 2.6 | Puppet 2.7 | Puppet 3.x | Puppet 4.x | +:---------------|:-----:|:---:|:---:|:----: +**stdlib 2.x** | **yes** | **yes** | no | no +**stdlib 3.x** | no | **yes** | **yes** | no +**stdlib 4.x** | no | **yes** | **yes** | no +**stdlib 4.6+** | no | **yes** | **yes** | **yes** +**stdlib 5.x** | no | no | **yes** | **yes** + +**stdlib 5.x**: When released, stdlib 5.x will drop support for Puppet 2.7.x. Please see [this discussion](https://github.com/puppetlabs/puppetlabs-stdlib/pull/176#issuecomment-30251414). + +## Development + +Puppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can’t access the huge number of platforms and myriad hardware, software, and deployment configurations that Puppet is intended to serve. We want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things. For more information, see our [module contribution guide](https://docs.puppetlabs.com/forge/contributing.html). + +To report or research a bug with any part of this module, please go to +[http://tickets.puppetlabs.com/browse/MODULES](http://tickets.puppetlabs.com/browse/MODULES). + +## Contributors + +The list of contributors can be found at: [https://github.com/puppetlabs/puppetlabs-stdlib/graphs/contributors](https://github.com/puppetlabs/puppetlabs-stdlib/graphs/contributors). diff --git a/environments/prod/modules/stdlib/README_DEVELOPER.markdown b/environments/prod/modules/stdlib/README_DEVELOPER.markdown new file mode 100644 index 0000000..04349ed --- /dev/null +++ b/environments/prod/modules/stdlib/README_DEVELOPER.markdown @@ -0,0 +1,35 @@ +Puppet Specific Facts +===================== + +Facter is meant to stand alone and apart from Puppet. However, Facter often +runs inside Puppet and all custom facts included in the stdlib module will +almost always be evaluated in the context of Puppet and Facter working +together. + +Still, we don't want to write custom facts that blow up in the users face if +Puppet is not loaded in memory. This is often the case if the user runs +`facter` without also supplying the `--puppet` flag. + +Ah! But Jeff, the custom fact won't be in the `$LOAD_PATH` unless the user +supplies `--facter`! You might say... + +Not (always) true I say! If the user happens to have a CWD of +`/stdlib/lib` then the facts will automatically be evaluated and +blow up. + +In any event, it's pretty easy to write a fact that has no value if Puppet is +not loaded. Simply do it like this: + + Facter.add(:node_vardir) do + setcode do + # This will be nil if Puppet is not available. + Facter::Util::PuppetSettings.with_puppet do + Puppet[:vardir] + end + end + end + +The `Facter::Util::PuppetSettings.with_puppet` method accepts a block and +yields to it only if the Puppet library is loaded. If the Puppet library is +not loaded, then the method silently returns `nil` which Facter interprets as +an undefined fact value. The net effect is that the fact won't be set. diff --git a/environments/prod/modules/stdlib/README_SPECS.markdown b/environments/prod/modules/stdlib/README_SPECS.markdown new file mode 100644 index 0000000..917b631 --- /dev/null +++ b/environments/prod/modules/stdlib/README_SPECS.markdown @@ -0,0 +1,7 @@ +NOTE +==== + +This project's specs depend on puppet core, and thus they require the +`puppetlabs_spec_helper` project. For more information please see the README +in that project, which can be found here: [puppetlabs spec +helper](https://github.com/puppetlabs/puppetlabs_spec_helper) diff --git a/environments/prod/modules/stdlib/RELEASE_PROCESS.markdown b/environments/prod/modules/stdlib/RELEASE_PROCESS.markdown new file mode 100644 index 0000000..0f9328e --- /dev/null +++ b/environments/prod/modules/stdlib/RELEASE_PROCESS.markdown @@ -0,0 +1,24 @@ +# Contributing to this module # + + * Work in a topic branch + * Submit a github pull request + * Address any comments / feeback + * Merge into master using --no-ff + +# Releasing this module # + + * This module adheres to http://semver.org/ + * Look for API breaking changes using git diff vX.Y.Z..master + * If no API breaking changes, the minor version may be bumped. + * If there are API breaking changes, the major version must be bumped. + * If there are only small minor changes, the patch version may be bumped. + * Update the CHANGELOG + * Update the Modulefile + * Commit these changes with a message along the lines of "Update CHANGELOG and + Modulefile for release" + * Create an annotated tag with git tag -a vX.Y.Z -m 'version X.Y.Z' (NOTE the + leading v as per semver.org) + * Push the tag with git push origin --tags + * Build a new package with puppet-module or the rake build task if it exists + * Publish the new package to the forge + * Bonus points for an announcement to puppet-users. diff --git a/environments/prod/modules/stdlib/Rakefile b/environments/prod/modules/stdlib/Rakefile new file mode 100644 index 0000000..d12d854 --- /dev/null +++ b/environments/prod/modules/stdlib/Rakefile @@ -0,0 +1,37 @@ +require 'puppetlabs_spec_helper/rake_tasks' +require 'puppet-lint/tasks/puppet-lint' +require 'puppet_blacksmith/rake_tasks' if Bundler.rubygems.find_name('puppet-blacksmith').any? + +PuppetLint.configuration.fail_on_warnings = true +PuppetLint.configuration.send('relative') + +desc 'Generate pooler nodesets' +task :gen_nodeset do + require 'beaker-hostgenerator' + require 'securerandom' + require 'fileutils' + + agent_target = ENV['TEST_TARGET'] + if ! agent_target + STDERR.puts 'TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat-64default."' + agent_target = 'redhat-64default.' + end + + master_target = ENV['MASTER_TEST_TARGET'] + if ! master_target + STDERR.puts 'MASTER_TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat7-64mdcl"' + master_target = 'redhat7-64mdcl' + end + + targets = "#{master_target}-#{agent_target}" + cli = BeakerHostGenerator::CLI.new([targets]) + nodeset_dir = "tmp/nodesets" + nodeset = "#{nodeset_dir}/#{targets}-#{SecureRandom.uuid}.yaml" + FileUtils.mkdir_p(nodeset_dir) + File.open(nodeset, 'w') do |fh| + fh.print(cli.execute) + end + puts nodeset +end diff --git a/environments/prod/modules/stdlib/appveyor.yml b/environments/prod/modules/stdlib/appveyor.yml new file mode 100644 index 0000000..c87ed7c --- /dev/null +++ b/environments/prod/modules/stdlib/appveyor.yml @@ -0,0 +1,40 @@ +version: 1.1.x.{build} +skip_commits: + message: /^\(?doc\)?.*/ +clone_depth: 10 +init: +- SET +- 'mkdir C:\ProgramData\PuppetLabs\code && exit 0' +- 'mkdir C:\ProgramData\PuppetLabs\facter && exit 0' +- 'mkdir C:\ProgramData\PuppetLabs\hiera && exit 0' +- 'mkdir C:\ProgramData\PuppetLabs\puppet\var && exit 0' +environment: + matrix: + - PUPPET_GEM_VERSION: ~> 4.0 + RUBY_VER: 21 + - PUPPET_GEM_VERSION: ~> 4.0 + RUBY_VER: 21-x64 + - PUPPET_GEM_VERSION: ~> 4.0 + RUBY_VER: 23 + - PUPPET_GEM_VERSION: ~> 4.0 + RUBY_VER: 23-x64 + - PUPPET_GEM_VERSION: 4.2.3 + RUBY_VER: 21-x64 +matrix: + fast_finish: true +install: +- SET PATH=C:\Ruby%RUBY_VER%\bin;%PATH% +- bundle install --jobs 4 --retry 2 --without system_tests +- type Gemfile.lock +build: off +test_script: +- bundle exec puppet -V +- ruby -v +- bundle exec rake spec SPEC_OPTS='--format documentation' +notifications: +- provider: Email + to: + - nobody@nowhere.com + on_build_success: false + on_build_failure: false + on_build_status_changed: false diff --git a/environments/prod/modules/stdlib/checksums.json b/environments/prod/modules/stdlib/checksums.json new file mode 100644 index 0000000..2a972d4 --- /dev/null +++ b/environments/prod/modules/stdlib/checksums.json @@ -0,0 +1,508 @@ +{ + "CHANGELOG.md": "54254f2ff8453a9c05c420820f240f0e", + "CONTRIBUTING.md": "77d0440d7cd4206497f99065c60bed46", + "Gemfile": "064893aff1d6bf890eee483af3a79c9e", + "LICENSE": "3b83ef96387f14655fc854ddc3c6bd57", + "MAINTAINERS.md": "b40ec4f2c16145af6f723c2c34bb2ff9", + "NOTICE": "b2e552587e5969886fdd60481e8b0351", + "README.markdown": "c53e1b16e6eb345241addcb867e8c2a6", + "README_DEVELOPER.markdown": "220a8b28521b5c5d2ea87c4ddb511165", + "README_SPECS.markdown": "82bb4c6abbb711f40778b162ec0070c1", + "RELEASE_PROCESS.markdown": "94b92bc99ac4106ba1a74d5c04e520f9", + "Rakefile": "3851f083966b9bbd6d46e50dba5aa52a", + "appveyor.yml": "7e0ff52cc2abe3fa4f2d8d978bf18ad7", + "examples/file_line.pp": "48f7f162127beffea8f8e3e58db2355a", + "examples/has_interface_with.pp": "d69d520cf3ff4d0b495480afaca359ef", + "examples/has_ip_address.pp": "32f42575e49aa66f0f2398a70ae2a9f4", + "examples/has_ip_network.pp": "bfb8db068c58d77c4dd7ae9697536537", + "examples/init.pp": "b52fd907330ddbd9c3e070cf39f7b317", + "lib/facter/facter_dot_d.rb": "d71e93183a680ac78bc0389fd50470a0", + "lib/facter/package_provider.rb": "539766a71dfb2f65e94a7c91bf413fcf", + "lib/facter/pe_version.rb": "60d47406026c8201e51394227ddf780d", + "lib/facter/puppet_settings.rb": "9438c0839ae28dc52fffb8348ae5124f", + "lib/facter/root_home.rb": "35702ae0c7410ec4d2101113e2f697fa", + "lib/facter/service_provider.rb": "66cc42526eae631e306b397391f1f01c", + "lib/facter/util/puppet_settings.rb": "9f1d2593d0ae56bfca89d4b9266aeee1", + "lib/puppet/functions/deprecation.rb": "59b803eaa15b5a559040497bffc172ae", + "lib/puppet/functions/is_a.rb": "9dad7f8c9b75348cd97aca986ac0b29a", + "lib/puppet/functions/is_absolute_path.rb": "96b217f26d06dbac87a2c6a8cfd2d8c8", + "lib/puppet/functions/is_array.rb": "9292a646010d167417a1936b0b0c17b9", + "lib/puppet/functions/is_bool.rb": "73957f9efd75ed8a7ab867f9de6da117", + "lib/puppet/functions/is_float.rb": "af3bd6bb56878bac8cc4fe4f7564e4f9", + "lib/puppet/functions/is_ip_address.rb": "ee231c66c3e039778bf46702d89815a6", + "lib/puppet/functions/is_ipv4_address.rb": "900d33249906c4daa02aa79cac896548", + "lib/puppet/functions/is_ipv6_address.rb": "568fba9af6a83c8b536fafcda82eb448", + "lib/puppet/functions/is_numeric.rb": "33051800b886cc3b2119826b77c9821a", + "lib/puppet/functions/is_string.rb": "230e9eabc5c9e1d8d5fb7b3c6c12b300", + "lib/puppet/functions/length.rb": "03cf801867a919f801d290424fd2bb8d", + "lib/puppet/functions/type_of.rb": "bec00841aae556993c926ab298bc81cd", + "lib/puppet/functions/validate_absolute_path.rb": "54a610baa115c7505f1b35976b632a8e", + "lib/puppet/functions/validate_array.rb": "9052b0026da174636c276a2512cf5acc", + "lib/puppet/functions/validate_bool.rb": "fe979e402a5a3a19d013ce84b39ef06a", + "lib/puppet/functions/validate_hash.rb": "92ea8fc21bbbf6cc41f6bb9cfcaefce7", + "lib/puppet/functions/validate_integer.rb": "b0982b68a599262da2c6f2e032bc7713", + "lib/puppet/functions/validate_ip_address.rb": "65a12af9a2c2a9c70d820d04d19ec891", + "lib/puppet/functions/validate_ipv4_address.rb": "4a5039b99ac97cc0447faa343b9f7416", + "lib/puppet/functions/validate_ipv6_address.rb": "fbdf685432416505fed27d5647c26f9c", + "lib/puppet/functions/validate_legacy.rb": "d9f115f30c511cef536a821b94826094", + "lib/puppet/functions/validate_numeric.rb": "41b2cc7335395f617c2bfbeac8f579da", + "lib/puppet/functions/validate_re.rb": "42092f592ebf89b8a504b10c900230d8", + "lib/puppet/functions/validate_slength.rb": "3ae6fcc3f60032c923d06ab3e457b84e", + "lib/puppet/functions/validate_string.rb": "cc967a9d0ea156b2208d1760d7f6e1b2", + "lib/puppet/parser/functions/abs.rb": "a8e46ecf4fb378d314916599651cebe5", + "lib/puppet/parser/functions/any2array.rb": "a81e71d6b67a551d38770ba9a1948a75", + "lib/puppet/parser/functions/any2bool.rb": "8bbb74cb81ebdb164e1965415364080b", + "lib/puppet/parser/functions/assert_private.rb": "cb9cd79ed4e3d647a48467dfb6237d5c", + "lib/puppet/parser/functions/base64.rb": "0d121a32fbfe25b06a4e91b0259af91d", + "lib/puppet/parser/functions/basename.rb": "c61952b3f68fd86408c84fca2c3febb1", + "lib/puppet/parser/functions/bool2num.rb": "01b070b02611fda7e1491de0a8cd89fc", + "lib/puppet/parser/functions/bool2str.rb": "c00885242abf381ba482644ded70b688", + "lib/puppet/parser/functions/camelcase.rb": "bd5da699dfe1ec27ffe91b06187c5900", + "lib/puppet/parser/functions/capitalize.rb": "c94c50b0f147a22861c3b93c724e4343", + "lib/puppet/parser/functions/ceiling.rb": "7de4a96c8bb645fd5ce5c38438667228", + "lib/puppet/parser/functions/chomp.rb": "35a16c85bc59dc285baae631da1ae771", + "lib/puppet/parser/functions/chop.rb": "3beb80906fa3c759945a2664fe510b20", + "lib/puppet/parser/functions/clamp.rb": "6920e6c11b575fc65dadb21220c01a7a", + "lib/puppet/parser/functions/concat.rb": "d10e5428917895d4bb90c638b148b7fa", + "lib/puppet/parser/functions/convert_base.rb": "c3b3e59a49318af98dcb88aed7156629", + "lib/puppet/parser/functions/count.rb": "325bbd89a29e6ed0f31e0462d0a0d301", + "lib/puppet/parser/functions/deep_merge.rb": "d83696855578fb81b64b9e92b9c7cc7c", + "lib/puppet/parser/functions/defined_with_params.rb": "80eed5cedb1b5134e6a1cf44e86ae60a", + "lib/puppet/parser/functions/delete.rb": "7af1540fee4285d93b6b28fb490db70a", + "lib/puppet/parser/functions/delete_at.rb": "a2cba60ac86a676d4ed1ff846a917014", + "lib/puppet/parser/functions/delete_regex.rb": "91cd012ef5a636ffe541814ed232b909", + "lib/puppet/parser/functions/delete_undef_values.rb": "52beef9ee37f84ed2278a69ec4383125", + "lib/puppet/parser/functions/delete_values.rb": "b410f5618b4a6158a921acb7b2dc628d", + "lib/puppet/parser/functions/deprecation.rb": "4323210434d36e37977251f906a232b8", + "lib/puppet/parser/functions/difference.rb": "467e44aeaebd0ee0a51c8b89e3769f1f", + "lib/puppet/parser/functions/dig.rb": "1a2a8918f646c13dcb9876a22f9295ab", + "lib/puppet/parser/functions/dig44.rb": "3078b97ee941c261944857373d400ed6", + "lib/puppet/parser/functions/dirname.rb": "8a5579f9a9a13fd737ba65eccf8e6d5a", + "lib/puppet/parser/functions/dos2unix.rb": "be8359a5106a7832be4180e8207dd586", + "lib/puppet/parser/functions/downcase.rb": "02376505a00accd0ce6b148f869c9c86", + "lib/puppet/parser/functions/empty.rb": "6d7d2dde2971f6a40fa913f0af1c610c", + "lib/puppet/parser/functions/enclose_ipv6.rb": "ec39936a9a51dc5cb8ada6eeb829b239", + "lib/puppet/parser/functions/ensure_packages.rb": "0fca8d6dc6608dc16e316fcd39f692b7", + "lib/puppet/parser/functions/ensure_resource.rb": "de703fe63392b939fc2b4392975263de", + "lib/puppet/parser/functions/ensure_resources.rb": "c92d8b69d6354eda24aa3a13d88177b2", + "lib/puppet/parser/functions/flatten.rb": "6a27f5b922a24fec6e823f6f51c98090", + "lib/puppet/parser/functions/floor.rb": "07ba3b1662a14c60fe908b51231355ee", + "lib/puppet/parser/functions/fqdn_rand_string.rb": "9ac5f18e563094aee62ef7586267025d", + "lib/puppet/parser/functions/fqdn_rotate.rb": "2483d17df4e6cb25d92b4e8520f30957", + "lib/puppet/parser/functions/fqdn_uuid.rb": "d357e8837ba2ed8196e926f3697be521", + "lib/puppet/parser/functions/get_module_path.rb": "d4bf50da25c0b98d26b75354fa1bcc45", + "lib/puppet/parser/functions/getparam.rb": "440a9c381b9ad589504e2e9919e83c06", + "lib/puppet/parser/functions/getvar.rb": "0c8c5cef7e158e232a8cf6e42c10d0ff", + "lib/puppet/parser/functions/grep.rb": "c2f2dbdf79d16584579c3a7bc7b5902f", + "lib/puppet/parser/functions/has_interface_with.rb": "db65f5aac94e8fe105c7ca0cd1f66403", + "lib/puppet/parser/functions/has_ip_address.rb": "6ce9e6cdfb499b6ce86bf531848a18be", + "lib/puppet/parser/functions/has_ip_network.rb": "3cc7b923fd3cde5062ed9d0eaaa8155f", + "lib/puppet/parser/functions/has_key.rb": "7cd9728c38f0b0065f832dabd62b0e7e", + "lib/puppet/parser/functions/hash.rb": "c1ebb21cc5b984153a87c252a9854db2", + "lib/puppet/parser/functions/intersection.rb": "87469eb81ab00bbacfd744165beeaeec", + "lib/puppet/parser/functions/is_absolute_path.rb": "1ce9a6d1cd0a79087d73cb879ed04542", + "lib/puppet/parser/functions/is_array.rb": "bbce6768b688bc0f36978ecb0f60f7f4", + "lib/puppet/parser/functions/is_bool.rb": "b8800ff7a11b4e8c03616041e218225f", + "lib/puppet/parser/functions/is_domain_name.rb": "5c6106c070945a605c5adbd1852f0691", + "lib/puppet/parser/functions/is_email_address.rb": "1eb786779743e93a7bb9fe8087b38b8d", + "lib/puppet/parser/functions/is_float.rb": "6257620b98c5099293be7aa4088b88ce", + "lib/puppet/parser/functions/is_function_available.rb": "f13934d6b41561ef54d88cf0da86231b", + "lib/puppet/parser/functions/is_hash.rb": "6f1ccf659c41cb5dab4db9fa89f0b364", + "lib/puppet/parser/functions/is_integer.rb": "a4ae475a5a799c0cc46519e86aed2973", + "lib/puppet/parser/functions/is_ip_address.rb": "2eabe60c213df2e642a03ebfd4852497", + "lib/puppet/parser/functions/is_ipv4_address.rb": "ab854b47367921f657410fbe79054f0b", + "lib/puppet/parser/functions/is_ipv6_address.rb": "2a2be7adbdd5ca23c3e21f00d7d8bac7", + "lib/puppet/parser/functions/is_mac_address.rb": "1af27510d3b9b936384192a4e1dfbf8c", + "lib/puppet/parser/functions/is_numeric.rb": "bfd99f39e2506953ad00178db6fa07ea", + "lib/puppet/parser/functions/is_string.rb": "c1405dd293e9e3c738b83c4ef5aab1ef", + "lib/puppet/parser/functions/join.rb": "2ed4f56d296a4535da142e01b11a126d", + "lib/puppet/parser/functions/join_keys_to_values.rb": "71ad24ac1809739713c461141aedd082", + "lib/puppet/parser/functions/keys.rb": "c10485a3d6c53b6d57a891b9852898de", + "lib/puppet/parser/functions/load_module_metadata.rb": "805c5476a6e7083d133e167129885924", + "lib/puppet/parser/functions/loadjson.rb": "ffecf61ba2ec8011915d37009b1a273e", + "lib/puppet/parser/functions/loadyaml.rb": "668265f14327cba1d1400f2078b7b26b", + "lib/puppet/parser/functions/lstrip.rb": "e9cbd5c2233233940e7344478362fb9f", + "lib/puppet/parser/functions/max.rb": "529eb6ac3d88c03caa788167594bd487", + "lib/puppet/parser/functions/member.rb": "03d618926bbb9efd117950e6078c3878", + "lib/puppet/parser/functions/merge.rb": "f3dcc5c83440cdda2036cce69b61a14b", + "lib/puppet/parser/functions/min.rb": "8d829c8a55c9330ab02f962926221d4f", + "lib/puppet/parser/functions/num2bool.rb": "ddb603cf74f92e16a00f1447a4403429", + "lib/puppet/parser/functions/parsejson.rb": "15165fd3807d9f3d657697fa854d643d", + "lib/puppet/parser/functions/parseyaml.rb": "db54578d9d798ced75952217cf11b737", + "lib/puppet/parser/functions/pick.rb": "bf01f13bbfe2318e7f6a302ac7c4433f", + "lib/puppet/parser/functions/pick_default.rb": "ad3ea60262de408767786d37a54d45dc", + "lib/puppet/parser/functions/prefix.rb": "ece9341c5b232a25c58545718a54e92f", + "lib/puppet/parser/functions/private.rb": "1500a21d5cf19961c5b1d476df892d92", + "lib/puppet/parser/functions/pry.rb": "79a48e45196e4bbf0a3e658781513cf4", + "lib/puppet/parser/functions/pw_hash.rb": "3d540eb4c483cc9c111794ac2d24a4a7", + "lib/puppet/parser/functions/range.rb": "ab19430b6b9737cf56263eb65d80cba1", + "lib/puppet/parser/functions/regexpescape.rb": "6378fdd413237a37c322859877147a50", + "lib/puppet/parser/functions/reject.rb": "689f6a7c961a55fe9dcd240921f4c7f9", + "lib/puppet/parser/functions/reverse.rb": "209e7ef512963251571c515e2d0aee10", + "lib/puppet/parser/functions/rstrip.rb": "f3226709247741825f07d9ec20bd3887", + "lib/puppet/parser/functions/seeded_rand.rb": "2ad22e7613d894ae779c0c5b0e65dade", + "lib/puppet/parser/functions/shell_escape.rb": "13662933244e1af42ddca71ced4ac9e5", + "lib/puppet/parser/functions/shell_join.rb": "b99a23d5e62e2e1b98accde5c22e45c9", + "lib/puppet/parser/functions/shell_split.rb": "5317d71f3a7e293624b57aaca23f57d5", + "lib/puppet/parser/functions/shuffle.rb": "6c0555524ebc9ed5dd8295b836fb7163", + "lib/puppet/parser/functions/size.rb": "c171d46b87e377ebcc710ad5a5925a2b", + "lib/puppet/parser/functions/sort.rb": "0b7d1411decc4a92450828809fad0779", + "lib/puppet/parser/functions/squeeze.rb": "403ea46228a8e45e89c91168ed301fb6", + "lib/puppet/parser/functions/str2bool.rb": "ff82f179970a9429614bd37fa7a1ae2a", + "lib/puppet/parser/functions/str2saltedsha512.rb": "457ab12e4329494ae6276cfa4f20eb23", + "lib/puppet/parser/functions/strftime.rb": "8f15e2e3732b6d1d357a1fa1826800d4", + "lib/puppet/parser/functions/strip.rb": "da0ce253cb63a4863f15f9d145217db5", + "lib/puppet/parser/functions/suffix.rb": "1ce493098f17ea47e9435f994adbc6cd", + "lib/puppet/parser/functions/swapcase.rb": "48cad9bf415b5d79584c8e17ab7a06cc", + "lib/puppet/parser/functions/time.rb": "cd96d1f039f8875af083091e3637190b", + "lib/puppet/parser/functions/to_bytes.rb": "45248fd0bba8cfb24eac830fc0add17a", + "lib/puppet/parser/functions/try_get_value.rb": "09cd079ec5f0e5e2ac862c9ebe0f54fe", + "lib/puppet/parser/functions/type.rb": "4709f7ab8a8aad62d77a3c5d91a3aa08", + "lib/puppet/parser/functions/type3x.rb": "5d0391205bd1cfe8de985a44e8c3e8a9", + "lib/puppet/parser/functions/union.rb": "c02fca3fe102875ba020072b7edee532", + "lib/puppet/parser/functions/unique.rb": "0f79a96896149f7034cd85e31eed1e54", + "lib/puppet/parser/functions/unix2dos.rb": "b1f5087fcaca69d9395094204cce887a", + "lib/puppet/parser/functions/upcase.rb": "e875fc4f03adec1ff3b42d22f177441e", + "lib/puppet/parser/functions/uriescape.rb": "ba78def2cd0e60bdc4412df6c7b891ec", + "lib/puppet/parser/functions/validate_absolute_path.rb": "c4b12e101055380386a235cd2c92ad10", + "lib/puppet/parser/functions/validate_array.rb": "bee8327014714d4cd8dbb5c46611f594", + "lib/puppet/parser/functions/validate_augeas.rb": "61e828e7759ba3e1e563e1fdd68aa80f", + "lib/puppet/parser/functions/validate_bool.rb": "971700229c4b581f67f6fadc9019eb2c", + "lib/puppet/parser/functions/validate_cmd.rb": "7df12370db442eddddcf4dd7a5364b5e", + "lib/puppet/parser/functions/validate_email_address.rb": "a72656cbfeda622cdd5cfdafdf464095", + "lib/puppet/parser/functions/validate_hash.rb": "c2ae6299148ea200f8dfcf9204875182", + "lib/puppet/parser/functions/validate_integer.rb": "65aa35f7450794aaadb6ad2c2e114df7", + "lib/puppet/parser/functions/validate_ip_address.rb": "b23c3d5ce6839e32d0186411147a6a44", + "lib/puppet/parser/functions/validate_ipv4_address.rb": "593e8f832469cb6a48c5f16ee66c3b2d", + "lib/puppet/parser/functions/validate_ipv6_address.rb": "48d3733012818993eae662839183d139", + "lib/puppet/parser/functions/validate_numeric.rb": "0e36d370262b8bdef2f88f0a3cb5b30e", + "lib/puppet/parser/functions/validate_re.rb": "d5963c404e3ac1670553f306221c2655", + "lib/puppet/parser/functions/validate_slength.rb": "6cbcfe15378ca4a780bac786223aacac", + "lib/puppet/parser/functions/validate_string.rb": "8afa7b0dcfe17bfbbb5704ad54664cc2", + "lib/puppet/parser/functions/validate_x509_rsa_key_pair.rb": "f17427dfc42128dc1df0ab04f37942e5", + "lib/puppet/parser/functions/values.rb": "c35978761496406cc3dafdccaa014236", + "lib/puppet/parser/functions/values_at.rb": "f7e6ad2a1126acd4fb5f7fcf9bfc2e2b", + "lib/puppet/parser/functions/zip.rb": "133f3d4c54640844e656e2e6e790318e", + "lib/puppet/provider/file_line/ruby.rb": "2bfa44964be201698186b94a60a5eb31", + "lib/puppet/type/anchor.rb": "bbd36bb49c3b554f8602d8d3df366c0c", + "lib/puppet/type/file_line.rb": "d65885f7f0afe49ee199d6bf873a5daf", + "manifests/init.pp": "9560a09f657d7eebbfdb920cefcc1d4f", + "manifests/stages.pp": "72eb4fa624474faf23b39e57cf1590bd", + "metadata.json": "c75558cd574027ce6326bc8f43d3cf07", + "spec/acceptance/abs_spec.rb": "5b60756b2b4da28314025f51989592d7", + "spec/acceptance/anchor_spec.rb": "0fdbe266d8b7c3dc172e338b978109ba", + "spec/acceptance/any2array_spec.rb": "444cfd34154539d896e5ef1488386372", + "spec/acceptance/base64_spec.rb": "6a1dd4144ba354f9bed14eb70f7d2cba", + "spec/acceptance/bool2num_spec.rb": "edc9cb8b89b95410326475d27ce74bd5", + "spec/acceptance/build_csv.rb": "f28ef587de764ade1513091c4906412c", + "spec/acceptance/capitalize_spec.rb": "4bb6471ec3a8a07260da8e249fae6ccd", + "spec/acceptance/ceiling_spec.rb": "46489eef94aa21bb1560383bb17d7d02", + "spec/acceptance/chomp_spec.rb": "8372fe8a875b1a599a89df1191f43bc0", + "spec/acceptance/chop_spec.rb": "d73d1c7c6a44df65677362bd2899bbc1", + "spec/acceptance/clamp_spec.rb": "8afaae07bf89e0af35474da489fd590f", + "spec/acceptance/concat_spec.rb": "bad5f40e0a501b436ec4264cd278290b", + "spec/acceptance/count_spec.rb": "f8abd435b077edd06ad76a96a2e610c0", + "spec/acceptance/deep_merge_spec.rb": "5f16342cb8c1b52d6a08717a2ef87117", + "spec/acceptance/defined_with_params_spec.rb": "8b47a7255b9d662009217f3cfd17ca03", + "spec/acceptance/delete_at_spec.rb": "b0c853ffe5fc121e051233d62f6e72b3", + "spec/acceptance/delete_spec.rb": "6ccb838a13037a56d1413aecb4fdac00", + "spec/acceptance/delete_undef_values_spec.rb": "7d849a978d3ecdaaf5e922acc6038ad8", + "spec/acceptance/delete_values_spec.rb": "b9f3dbffbb89fec32c6a5b2bd3b20901", + "spec/acceptance/deprecation_spec.rb": "cadc56a94cbc2f13965d698f581f582d", + "spec/acceptance/difference_spec.rb": "2f4e8ddd760f2d4dc9a4fb7b653e982f", + "spec/acceptance/dirname_spec.rb": "76e6b66474f070d8a89f3fe5bd187e85", + "spec/acceptance/downcase_spec.rb": "53f0f5b1867e0fd87ba59833c18b5ca2", + "spec/acceptance/empty_spec.rb": "be8a610f87790a321dbd4cc0542e2885", + "spec/acceptance/ensure_resource_spec.rb": "c0193d79f1db1985d313bedb93a4c7ae", + "spec/acceptance/flatten_spec.rb": "3ab1f9c9e761e5d758eeee7a2e32f295", + "spec/acceptance/floor_spec.rb": "4a20f6fc7142ef9357c8d18a408b5e52", + "spec/acceptance/fqdn_rand_string_spec.rb": "7744b45e282013c5fe637dbaf42f85b9", + "spec/acceptance/fqdn_rotate_spec.rb": "366816bb1d3102f64025d61e22eec79c", + "spec/acceptance/get_module_path_spec.rb": "d5d2258b2345359d1e51a638b97523cb", + "spec/acceptance/getparam_spec.rb": "d4037f1f546cf7a3e7dcabe787e637b5", + "spec/acceptance/getvar_spec.rb": "8451bced69bfd5599a552ddf49976d98", + "spec/acceptance/grep_spec.rb": "5e6650532658915d1004a6e6c0f1229d", + "spec/acceptance/has_interface_with_spec.rb": "e028fc7fc1023293ba32c48c9f46752a", + "spec/acceptance/has_ip_address_spec.rb": "f3443be46277f6084ca8e531562d8ac7", + "spec/acceptance/has_ip_network_spec.rb": "fa7a38450bef7e4408deb6b978d5a42f", + "spec/acceptance/has_key_spec.rb": "68e42fb69d15f27916e7943ab727afc6", + "spec/acceptance/hash_spec.rb": "1e8ff803d76d8f9e506c8a366a93ad90", + "spec/acceptance/intersection_spec.rb": "755c135f67811666b3c5152c5c5349c2", + "spec/acceptance/is_a_spec.rb": "4cdd8df78a6285de21d634c032e5a7c9", + "spec/acceptance/is_array_spec.rb": "1de1fb0b55759d4012033ae3ce0723c2", + "spec/acceptance/is_bool_spec.rb": "9984cd966d81c217f8ff4e252a4a66d1", + "spec/acceptance/is_domain_name_spec.rb": "948dc0c7372027e8f2bb9db85b8d66b2", + "spec/acceptance/is_float_spec.rb": "731d9b71e7b4ee5055339d08b2b5f707", + "spec/acceptance/is_function_available_spec.rb": "413964bfe8e18c34d8809590afcc4118", + "spec/acceptance/is_hash_spec.rb": "9095a364cba82a95a1edd0f92d2218c7", + "spec/acceptance/is_integer_spec.rb": "bc4e7192073531638be9f8a4d391a827", + "spec/acceptance/is_ip_address_spec.rb": "c2ee8738d62b4c9d42b3ef1a1b8573fc", + "spec/acceptance/is_ipv4_address_spec.rb": "09f6f3ad6a1c0a9e5dcfaab34a081ffc", + "spec/acceptance/is_ipv6_address_spec.rb": "d19a98176b2b7367e740d338df08c2ae", + "spec/acceptance/is_mac_address_spec.rb": "b53f033cc4943a19f597895df0b5210a", + "spec/acceptance/is_numeric_spec.rb": "95ecae5adde23e6b61cd090704c4572d", + "spec/acceptance/is_string_spec.rb": "d9ad89b30aff62aea4fb805c991c6abf", + "spec/acceptance/join_keys_to_values_spec.rb": "908f62013e1d797ddc0ba68c0fb7913b", + "spec/acceptance/join_spec.rb": "5609c646859140109af4ae1c63cc69d2", + "spec/acceptance/keys_spec.rb": "15edb2f0a5630dfadd9bd6c038e5cf95", + "spec/acceptance/loadjson_spec.rb": "7bf8eb220ed02b77e9956dade1acfcb3", + "spec/acceptance/loadyaml_spec.rb": "3810faad7411bc1d9c9274671bb68a9a", + "spec/acceptance/lstrip_spec.rb": "27a6e2c9e2afc5b3e0e98301798a80ad", + "spec/acceptance/max_spec.rb": "c39a2006dacdbd24a8acc5dc25f1a9f3", + "spec/acceptance/member_spec.rb": "10b9635c1daf636d66aabea6ff796e6a", + "spec/acceptance/merge_spec.rb": "a1502ebd4d069c5f818f7fd8da79e02d", + "spec/acceptance/min_spec.rb": "a6e73a33255bc202de93fd8fe679c510", + "spec/acceptance/nodesets/centos-7-x64.yml": "a713f3abd3657f0ae2878829badd23cd", + "spec/acceptance/nodesets/debian-8-x64.yml": "d2d2977900989f30086ad251a14a1f39", + "spec/acceptance/nodesets/default.yml": "b42da5a1ea0c964567ba7495574b8808", + "spec/acceptance/nodesets/docker/centos-7.yml": "8a3892807bdd62306ae4774f41ba11ae", + "spec/acceptance/nodesets/docker/debian-8.yml": "ac8e871d1068c96de5e85a89daaec6df", + "spec/acceptance/nodesets/docker/ubuntu-14.04.yml": "dc42ee922a96908d85b8f0f08203ce58", + "spec/acceptance/num2bool_spec.rb": "33ab633c5a6aa1e5e9c0cac9ec23c0d5", + "spec/acceptance/parsejson_spec.rb": "56353143de570034f59a87244bb9ff7b", + "spec/acceptance/parseyaml_spec.rb": "a564b2217350398d8a3f1b212d0c2ada", + "spec/acceptance/pick_default_spec.rb": "bc3512e0cc3bc34da5f44ae18573af5d", + "spec/acceptance/pick_spec.rb": "661747652e50bb522ad0c627fb8c3c58", + "spec/acceptance/prefix_spec.rb": "2b9df68e18e16144caa4440fd6acaa01", + "spec/acceptance/pw_hash_spec.rb": "979f0d209f1ef227a31d27a452fc2ed3", + "spec/acceptance/range_spec.rb": "f913a26f4bbe8b9432b6cb80a3b6d1ed", + "spec/acceptance/reject_spec.rb": "c63eb909288cf2210f72d3afa1e07b32", + "spec/acceptance/reverse_spec.rb": "eca705328f8e246a648e3f62434e662a", + "spec/acceptance/rstrip_spec.rb": "bad1e42f66d07b5d09ca1133b392bf6a", + "spec/acceptance/shuffle_spec.rb": "adc420bc01d83dde117b04baa4a5e2d8", + "spec/acceptance/size_spec.rb": "d923ec158f5c2275b9823dd118edd953", + "spec/acceptance/sort_spec.rb": "3ac4acd4233fbe624d926604d58acea6", + "spec/acceptance/squeeze_spec.rb": "2270c35766a5162cd732f0f761f0dc34", + "spec/acceptance/str2bool_spec.rb": "73ca9cbf9079ef52de10f90cb871e80c", + "spec/acceptance/str2saltedsha512_spec.rb": "1e89299c3802ba386589a5133a07dccc", + "spec/acceptance/strftime_spec.rb": "6cdfc95c02af2419eb14d173a23df678", + "spec/acceptance/strip_spec.rb": "711b6b73fce659ab83956c4454500e55", + "spec/acceptance/suffix_spec.rb": "c2ca0539e9e7b71f36ff470d3c18b303", + "spec/acceptance/swapcase_spec.rb": "30290d4378f19fa8bac4bc3347a36298", + "spec/acceptance/time_spec.rb": "74b6d4f21d46ca612a98efed9c48944c", + "spec/acceptance/to_bytes_spec.rb": "ff7d57f85cf1e211b0998235636edfd9", + "spec/acceptance/try_get_value_spec.rb": "8b62b969ece6f02c65f0cf3d365324b1", + "spec/acceptance/type_spec.rb": "909aa4d0c2463b04a3d3ff72cb0d4b42", + "spec/acceptance/union_spec.rb": "41b8705ac890ddd915a5f6c8b33620cd", + "spec/acceptance/unique_spec.rb": "0108f76cc12ecb0551a37a002a9bda85", + "spec/acceptance/upcase_spec.rb": "30721f352edd513a0cc36c94aa0fe760", + "spec/acceptance/uriescape_spec.rb": "69857543c97c35b23094cc6da0828055", + "spec/acceptance/validate_absolute_path_spec.rb": "b7f57e45a4d4d2a187bf9db99c481f98", + "spec/acceptance/validate_array_spec.rb": "ec0db1f08eb8d64fec1025b65b544365", + "spec/acceptance/validate_augeas_spec.rb": "744354dd9726be3624db10935ae2b13f", + "spec/acceptance/validate_bool_spec.rb": "950632bafc509e1965cd6a57646d87f6", + "spec/acceptance/validate_cmd_spec.rb": "1605939801210b1a53dc8873492551e0", + "spec/acceptance/validate_hash_spec.rb": "b79b1ef06301e1b97863281e3c419b0e", + "spec/acceptance/validate_ipv4_address_spec.rb": "547520f1ad1d55c52a257f4fb85ecc33", + "spec/acceptance/validate_ipv6_address_spec.rb": "feedad9317be19409e351011c7b852b9", + "spec/acceptance/validate_re_spec.rb": "bcc18798eccca866883b965baefc3cc9", + "spec/acceptance/validate_slength_spec.rb": "29311e9e910bba57a86be9a4893b43e5", + "spec/acceptance/validate_string_spec.rb": "cd36b419ebb8630618ec795781081101", + "spec/acceptance/values_at_spec.rb": "17e39ac5e094fb05522cb363e12186ab", + "spec/acceptance/values_spec.rb": "25d5abaffd9a108a52cdb156b5120e85", + "spec/acceptance/zip_spec.rb": "30ac38a83f8e92d642a20b53c5b66292", + "spec/aliases/absolute_path_spec.rb": "4326af270230f6d1aef6b1c68a31c53b", + "spec/aliases/absolutepath_spec.rb": "ab9a78b2aa5f6eb102ee648c5f88da61", + "spec/aliases/array_spec.rb": "09c3559333ec646387e4141ed37d671e", + "spec/aliases/bool_spec.rb": "c3f734df3cd334860bba95386b8e8ba6", + "spec/aliases/float_spec.rb": "dda76444d67dcf4e9ab4bf8d1a668b23", + "spec/aliases/hash_spec.rb": "8b0753fbb41a41655235f999a8cd8a17", + "spec/aliases/httpsurl_spec.rb": "49fa0c1da3f055228aaa7ab12471f126", + "spec/aliases/httpurl_spec.rb": "fe92b61091197895e9e0070adcaec1e9", + "spec/aliases/integer_spec.rb": "3d5c27c864e2385251f1c16a46ef717d", + "spec/aliases/ip_address.rb": "297c6577c0763f5121f9ca9c19718dfe", + "spec/aliases/ipv4_spec.rb": "8f3be58256671754f32287609c7a64ba", + "spec/aliases/ipv6_spec.rb": "68bc3bdf8f2dbb049f8f8daf93d78e82", + "spec/aliases/numeric_spec.rb": "a0031bb0085673ec7cc28d9c9b5a72e4", + "spec/aliases/string_spec.rb": "2b4661dbe97d7172b613edd50db91542", + "spec/aliases/unixpath_spec.rb": "1fac6f23e14c3589d26284a081c25c77", + "spec/aliases/windowspath_spec.rb": "4a3aec398b2c6ae86cb6d68ac5e8ab06", + "spec/fixtures/dscacheutil/root": "e1a7622f55f3d1be258c9a5b16b474be", + "spec/fixtures/lsuser/root": "2ed657fa157372a81634539bb1a56be8", + "spec/fixtures/test/manifests/absolute_path.pp": "79e9da69f05adc0e1ed41c20bf14e95f", + "spec/fixtures/test/manifests/absolutepath.pp": "8561fa141028cd38d0b8409cd69a1372", + "spec/fixtures/test/manifests/array.pp": "0e1d4146a9b2dd56063b2cab6f3d7571", + "spec/fixtures/test/manifests/bool.pp": "cf75826f36025bd73ff7f479acf7196d", + "spec/fixtures/test/manifests/ensure_resources.pp": "3265ae7af9382cfe7d9a13527265dcc9", + "spec/fixtures/test/manifests/float.pp": "132f9a63e60bba2fba68be83208c2e28", + "spec/fixtures/test/manifests/hash.pp": "84d647482ef0c7dc35348c13fb0ca23e", + "spec/fixtures/test/manifests/httpsurl.pp": "9047fc382d215ae55c065b0798a82a2d", + "spec/fixtures/test/manifests/httpurl.pp": "7165bf5607a4808f3da3f9baca911240", + "spec/fixtures/test/manifests/integer.pp": "3cb3807714ddcde25cd8eeca61581e3b", + "spec/fixtures/test/manifests/ip_address.pp": "78deea27fe1ff9e85c360eced4d2c256", + "spec/fixtures/test/manifests/ipv4.pp": "b4f0dfe6ae06d4f8b284d24e55f6a6a2", + "spec/fixtures/test/manifests/ipv6.pp": "4764f683b6013556e20d8669b21b5bdc", + "spec/fixtures/test/manifests/numeric.pp": "bffd26d7c0bb53628369f42c14b342cb", + "spec/fixtures/test/manifests/string.pp": "27b69c1eb36250bfbd474a0ef9ba847b", + "spec/fixtures/test/manifests/unixpath.pp": "fd062024efdf731e19026901d3fcc075", + "spec/fixtures/test/manifests/windowspath.pp": "7f942ec8f883a3ac0fcaf960ea24b7d8", + "spec/functions/abs_spec.rb": "7c0ebbd787b788d32b9bb21fe9061a2f", + "spec/functions/any2array_spec.rb": "22b7ce032a34d02b6858360025eb7644", + "spec/functions/any2bool_spec.rb": "d090dde9be26601a38980e8f77fa5970", + "spec/functions/assert_private_spec.rb": "a7e79ac7a1b28610a0e57e38e913c9fa", + "spec/functions/base64_spec.rb": "fa279d9a4f3060ee3f467e35b050d528", + "spec/functions/basename_spec.rb": "4aec9efc4fc6ed35de82d93b34dc0fab", + "spec/functions/bool2num_spec.rb": "6609136ff067b90d41cf27bf8838c3ea", + "spec/functions/bool2str_spec.rb": "52560617234393f960aedb496b49a628", + "spec/functions/camelcase_spec.rb": "4a13d3323535291fef3f40a96710acdb", + "spec/functions/capitalize_spec.rb": "31a8d497b274653d5ede70a0187d4053", + "spec/functions/ceiling_spec.rb": "47bd74569f8979d9195df06a863de93b", + "spec/functions/chomp_spec.rb": "8be3a83a34945dcaa6e8e193cf2751e4", + "spec/functions/chop_spec.rb": "8e1f661e93dd87b8bbeebe293fe16612", + "spec/functions/clamp_spec.rb": "65dab1e9aceb2cb4e41ef9c0c65a7ba3", + "spec/functions/concat_spec.rb": "4161a254ff4c21497e61a62ce84dafe8", + "spec/functions/convert_base_spec.rb": "f031e84b18cb010bc6233be3e4bcff83", + "spec/functions/count_spec.rb": "14ab4e4b10fe33d69d0662357cd4bf8b", + "spec/functions/deep_merge_spec.rb": "5a4e826aaa0a0c0e4247b72e03bdfbd1", + "spec/functions/defined_with_params_spec.rb": "9a0af61ab4bfc380ef4707005344fac2", + "spec/functions/delete_at_spec.rb": "188a3143799bd5cf121982883c7dc1c8", + "spec/functions/delete_regex_spec.rb": "c049a3926aded4b6a804f1c824c57d2f", + "spec/functions/delete_spec.rb": "d7c589404fdc3a6b65da7ecf1f7e0b02", + "spec/functions/delete_undef_values_spec.rb": "a2c138145333e1873ee4bf23d091f86a", + "spec/functions/delete_values_spec.rb": "e20b68a589002f1e2b52873d3dbcfb49", + "spec/functions/deprecation_spec.rb": "f5d7355b687eaaa15c20fdb214671c2a", + "spec/functions/difference_spec.rb": "66ba399c0bace1a131ecdb365e0afd4e", + "spec/functions/dig44_spec.rb": "89631bb7282f7d3c9b75d79f48446c65", + "spec/functions/dig_spec.rb": "61708160da38852c3c78bc8563e0fcb2", + "spec/functions/dirname_spec.rb": "e80baeab6a166284f5069263fb5e37b7", + "spec/functions/dos2unix_spec.rb": "d0cfe5fe19d2bf33320e6f47789826c6", + "spec/functions/downcase_spec.rb": "e2c24d41c6fb840f7b66c5205c942780", + "spec/functions/empty_spec.rb": "e6d06c193869ce8c97d3e67d5c5c5b4f", + "spec/functions/ensure_packages_spec.rb": "81f281f4c4f2146328b65b49ad4e846b", + "spec/functions/ensure_resource_spec.rb": "6461ab093bc10308e1c81b01482c409f", + "spec/functions/flatten_spec.rb": "5d59251fa8da0e4c8a376a513a25bc7a", + "spec/functions/floor_spec.rb": "7d110b1f994432e1c6c7c004a3dedbe4", + "spec/functions/fqdn_rand_string_spec.rb": "950a33e5ad8056fbfe564ec7e3b9a583", + "spec/functions/fqdn_rotate_spec.rb": "83f00ce0c48dec632e1aaa8192bb51cf", + "spec/functions/fqdn_uuid_spec.rb": "1b2980fcbecc4b51bdc6de01e9b001b7", + "spec/functions/get_module_path_spec.rb": "ef22bd80ce5dedb069830d5aa10572c1", + "spec/functions/getparam_spec.rb": "359d7c9349ec0e5666bb38e2d9224621", + "spec/functions/getvar_spec.rb": "3c7884e012bdb596df3d0640533dab96", + "spec/functions/grep_spec.rb": "0e917284860c5f96fdf56301012ba199", + "spec/functions/has_interface_with_spec.rb": "473c000e461c3497f8461eb17cf73430", + "spec/functions/has_ip_address_spec.rb": "7b36b993ea32757e74be9909906bd165", + "spec/functions/has_ip_network_spec.rb": "7086a27623ba91c5ff069397a32172c4", + "spec/functions/has_key_spec.rb": "eaa046db8632d6f76893e4b9df7b3e31", + "spec/functions/hash_spec.rb": "53a059e13781fac6b4f8eb660655d58f", + "spec/functions/intersection_spec.rb": "e906cb8ceb39b644b4b338adcd4dda26", + "spec/functions/is_a_spec.rb": "7d6322426d629e5302c52455d9c4cd55", + "spec/functions/is_array_spec.rb": "26d7eab025f333d2c4a8baf89ef4e36e", + "spec/functions/is_bool_spec.rb": "40569a4cdb50af0cc21ad749ac18e6ef", + "spec/functions/is_domain_name_spec.rb": "4ea3825d5b77a5d75eab8228dcc738f9", + "spec/functions/is_email_address_spec.rb": "699c4573dfd00db8993a18afc0eaf875", + "spec/functions/is_float_spec.rb": "8aedd9e622cd1b861d99523532dc4fc1", + "spec/functions/is_function_available.rb": "f8ab234d536532c3629ff6a5068e7877", + "spec/functions/is_hash_spec.rb": "11563529f0f1f821769edb3131277100", + "spec/functions/is_integer_spec.rb": "21a139f9a87b1561bfec60de26c435a2", + "spec/functions/is_ip_address_spec.rb": "04a15328803bb47ae431eff63aa555df", + "spec/functions/is_ipv4_address_spec.rb": "339b8c79925bb70c0de19468d58ab64a", + "spec/functions/is_ipv6_address_spec.rb": "9743a0f2bfda70ace128d2f476a208b9", + "spec/functions/is_mac_address_spec.rb": "532b8c4c63b37849e7fb9122d163ae3a", + "spec/functions/is_numeric_spec.rb": "cb846f44e8f6d79161686d7b3729967c", + "spec/functions/is_string_spec.rb": "56f34694781dfcf774e43bca06057fec", + "spec/functions/join_keys_to_values_spec.rb": "f99dff6550fdb7c245ed4dcaca0a16a3", + "spec/functions/join_spec.rb": "e190fbce526b3f4f7bb8aac029338ece", + "spec/functions/keys_spec.rb": "fba0bfa928b5684d5c918d6c06edd06d", + "spec/functions/length.rb": "c07a267ccccc4b4edbbfad155dc21475", + "spec/functions/load_module_metadata_spec.rb": "431fbe84d627a5c4398f432caaec96f8", + "spec/functions/loadjson_spec.rb": "76cbe175c90a596892b799d8e4d599e5", + "spec/functions/loadyaml_spec.rb": "60e283bc07adc67bc2c934424bf01b8d", + "spec/functions/lstrip_spec.rb": "892229ce8657490c72fc860fb0dda1b6", + "spec/functions/max_spec.rb": "47de8d59070d8d51b2184731f5d1aa43", + "spec/functions/member_spec.rb": "6a988e6368c1ce090b47fe41efbc041c", + "spec/functions/merge_spec.rb": "56297527d192640bbe82c7ccf1e39815", + "spec/functions/min_spec.rb": "8b38e2a989912406cd2c57dcd3a460c4", + "spec/functions/num2bool_spec.rb": "7c4fd30e41a11b1bd0d9e5233340f16b", + "spec/functions/parsejson_spec.rb": "958db1dde2f2244f458c399e0c3231e0", + "spec/functions/parseyaml_spec.rb": "19a2add90ca08d5a17c4e3aff89fe3c0", + "spec/functions/pick_default_spec.rb": "ab9ef2e9111cfd2709313e0e3c3befa2", + "spec/functions/pick_spec.rb": "786044a71e3bd673212949c12f37b10f", + "spec/functions/prefix_spec.rb": "2402d2ad5108050bb5c20b3ea58b64be", + "spec/functions/private_spec.rb": "f404771c4590a0cd7ce61ddff8f3eb7b", + "spec/functions/pw_hash_spec.rb": "640609cc73b4c8bbcdfc88c3e9797664", + "spec/functions/range_spec.rb": "d3af56cc8a137059423f8738e343ccff", + "spec/functions/regexpescape_spec.rb": "ce027e1b99674f39de8ddffcfed8396e", + "spec/functions/reject_spec.rb": "8ecbca64a9817ebef76be96dcf6cdeeb", + "spec/functions/reverse_spec.rb": "e40754fd34e96ac206308958504ae315", + "spec/functions/rstrip_spec.rb": "748f4587c12b5a590b985f111e282a8d", + "spec/functions/seeded_rand_spec.rb": "eb56445d10962d81ed935b53826da349", + "spec/functions/shell_escape_spec.rb": "bf108573c041f0c228f6d47d367d0aa3", + "spec/functions/shell_join_spec.rb": "92f31bd98d6e8e30e5f758f50bcb8a75", + "spec/functions/shell_split_spec.rb": "430f58733cc7855e56bfc918971b3fc1", + "spec/functions/shuffle_spec.rb": "be5d43184f2ca42db4f452085a4730fd", + "spec/functions/size_spec.rb": "f5e35878331bb12d9639522e38cc81c8", + "spec/functions/sort_spec.rb": "d9533dd37c6263b92895f7eba8485248", + "spec/functions/squeeze_spec.rb": "ffcf3b44cbdd45e14eb1173d2b7d1d99", + "spec/functions/str2bool_spec.rb": "607b25fb0badd0da5acb86c63437c8be", + "spec/functions/str2saltedsha512_spec.rb": "07586b0026757cd39229c12c7221808b", + "spec/functions/strftime_spec.rb": "f1a34fc930940213abfba3095d5d8065", + "spec/functions/strip_spec.rb": "023132b8bd0820da254f74c6fe31bb80", + "spec/functions/suffix_spec.rb": "dfe26a61bf0185291b6ae868e9d0de20", + "spec/functions/swapcase_spec.rb": "90bace1b004aa63d46eb6481c6dce2b1", + "spec/functions/time_spec.rb": "6dc8f5b42cf89345d2de424bfe19be90", + "spec/functions/to_bytes_spec.rb": "b771f8490d922de46a519e407d358139", + "spec/functions/try_get_value_spec.rb": "b917b899f5d29764dd4b1b07e07ec6ce", + "spec/functions/type3x_spec.rb": "eed4ce3a2bc92d14effedefef9690654", + "spec/functions/type_of_spec.rb": "83755d9390b9c00e086a007edff7fd9b", + "spec/functions/type_spec.rb": "7a61b4af7d3d83be590d783a7e5e80f8", + "spec/functions/union_spec.rb": "a290a38e443b856a476d14d4b1dc72fb", + "spec/functions/unique_spec.rb": "97fbcc73a0e0d82e23c723837627c712", + "spec/functions/unix2dos_spec.rb": "628c8a0c608d1fa0dd09bd1b5af97c1f", + "spec/functions/upcase_spec.rb": "4f0461a20c03d618f0c18da39bebcf65", + "spec/functions/uriescape_spec.rb": "1458afbe7e7e11dcaad8d295a7f2be59", + "spec/functions/validate_absolute_path_spec.rb": "5adbf0a0ac8b23e86195deaf3e4bd371", + "spec/functions/validate_array_spec.rb": "3aa76f3731754c637acc94b59c79efb0", + "spec/functions/validate_augeas_spec.rb": "d598e89a23912be9f24d39b809f30b47", + "spec/functions/validate_bool_spec.rb": "d1b43cd294d0588ac6d67d5d3c77a42a", + "spec/functions/validate_cmd_spec.rb": "34a4e623ab0ce7d4c218a837f896c1ea", + "spec/functions/validate_email_address_spec.rb": "1296f9934d102258091379ee07f9a2a8", + "spec/functions/validate_hash_spec.rb": "0b3ac3f7262f13ef14e3df937c8d104c", + "spec/functions/validate_integer_spec.rb": "ec55ab34e3ec4f09722349cd6aac77a6", + "spec/functions/validate_ip_address_spec.rb": "ba8c92e30f1af9e6839a2901e002c3f3", + "spec/functions/validate_ipv4_address_spec.rb": "d5d956651629f95ea531ac03b71e247b", + "spec/functions/validate_ipv6_address_spec.rb": "7ee0d6097666558d8627de424c26ef75", + "spec/functions/validate_legacy_spec.rb": "a1a3af70e71d0a6b848d75c518949b3b", + "spec/functions/validate_numeric_spec.rb": "c2f01b9c9aeae75683563ef7d3951bbb", + "spec/functions/validate_re_spec.rb": "27bcf99cd815b755548cd3979753b2f3", + "spec/functions/validate_slength_spec.rb": "c292023b2e61298499ff1f791fc03005", + "spec/functions/validate_string_spec.rb": "bc6735359ada0b3ccf69f515231e3808", + "spec/functions/validate_x509_rsa_key_pair_spec.rb": "24810bdb8ac473ae1168f1b2c5708170", + "spec/functions/values_at_spec.rb": "866ba43a4b606f6e9e72ac91c07408bd", + "spec/functions/values_spec.rb": "6b8f39665cb8fdb03658d838e50b55b0", + "spec/functions/zip_spec.rb": "986defd43a001ff28fe7c90b0366812e", + "spec/monkey_patches/alias_should_to_must.rb": "b19ee31563afb91a72f9869f9d7362ff", + "spec/monkey_patches/publicize_methods.rb": "c690e444b77c871375d321e413e28ca1", + "spec/spec_helper.rb": "b2db3bc02b4ac2fd5142a6621c641b07", + "spec/spec_helper_acceptance.rb": "cd589056b52031da19d9c31ed86ea922", + "spec/spec_helper_local.rb": "1e3ad3c06a11cbcb813dc1d31973cbda", + "spec/support/shared_data.rb": "9758f8ba2958965d287387a2513dac73", + "spec/unit/ensure_resources_spec.rb": "30cad259a3cc6c73f90209804183c818", + "spec/unit/facter/facter_dot_d_spec.rb": "420339a544851f2c7ee6fa4c651bdce8", + "spec/unit/facter/package_provider_spec.rb": "3a6ba799822fbcabc9adab5880260b7a", + "spec/unit/facter/pe_version_spec.rb": "d0fa6c0d5b01a4b9fd36ed4168635e9f", + "spec/unit/facter/root_home_spec.rb": "036c160d5543f4f3e80a300a3a170b77", + "spec/unit/facter/service_provider_spec.rb": "a97efb411817a44c511cd6cd79d9af8c", + "spec/unit/facter/util/puppet_settings_spec.rb": "6f9df9b10a1b39245ecdf002616a4122", + "spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb": "0145a78254ea716e5e7600d9464318a8", + "spec/unit/puppet/parser/functions/is_absolute_path_spec.rb": "52f8d3b9011fb1fd8a2a429fe8b2ae08", + "spec/unit/puppet/provider/file_line/ruby_spec.rb": "d269e18953fc297786a8393b20842abc", + "spec/unit/puppet/type/anchor_spec.rb": "06a669dffa44d716bf19b4e7f5f1d75d", + "spec/unit/puppet/type/file_line_spec.rb": "83e11166de4abe69cdf0dc7450e79778", + "types/absolutepath.pp": "3ae6f48dd95835df87c5dacea13c88d2", + "types/compat/absolute_path.pp": "6d0e102d1098d85d97c8f13051cb2c10", + "types/compat/array.pp": "43c41022dd743d55c8e9e82ce3ed741c", + "types/compat/bool.pp": "6e0cd7b2a7e1b9efaa0e273937211e58", + "types/compat/float.pp": "fd134a0e0e1abd420cec2107780a7afa", + "types/compat/hash.pp": "3535d98f0f3eaec44d443190f258e9ba", + "types/compat/integer.pp": "e85a20e42b3afaf5ec0718a8d9f9c5e3", + "types/compat/ip_address.pp": "d42c7435de30a469a71b69c45d642da7", + "types/compat/ipv4.pp": "c84eb3764f45b256a09be68afe61b749", + "types/compat/ipv6.pp": "d3c0fada5425d576aeca14ddbee78653", + "types/compat/numeric.pp": "f864539d78e95dabf0bab361b4ccc042", + "types/compat/re.pp": "70b05d4697e61f9af0c212ba063f395d", + "types/compat/string.pp": "b9a179664c85e121aa0277021627d126", + "types/httpsurl.pp": "108225d0273e17d541b239882287ed15", + "types/httpurl.pp": "4ba64825b11af75997c59b5acf07c62d", + "types/unixpath.pp": "5fc80523e7f474dd84056c44fafd9544", + "types/windowspath.pp": "4c1eda331ecb43de98c29ed22d0ad448" +} \ No newline at end of file diff --git a/environments/prod/modules/stdlib/examples/file_line.pp b/environments/prod/modules/stdlib/examples/file_line.pp new file mode 100644 index 0000000..85b1325 --- /dev/null +++ b/environments/prod/modules/stdlib/examples/file_line.pp @@ -0,0 +1,9 @@ +# This is a simple smoke test +# of the file_line resource type. +file { '/tmp/dansfile': + ensure => file, +} -> +file_line { 'dans_line': + line => 'dan is awesome', + path => '/tmp/dansfile', +} diff --git a/environments/prod/modules/stdlib/examples/has_interface_with.pp b/environments/prod/modules/stdlib/examples/has_interface_with.pp new file mode 100644 index 0000000..a578dd2 --- /dev/null +++ b/environments/prod/modules/stdlib/examples/has_interface_with.pp @@ -0,0 +1,9 @@ +include ::stdlib +info('has_interface_with(\'lo\'):', has_interface_with('lo')) +info('has_interface_with(\'loX\'):', has_interface_with('loX')) +info('has_interface_with(\'ipaddress\', \'127.0.0.1\'):', has_interface_with('ipaddress', '127.0.0.1')) +info('has_interface_with(\'ipaddress\', \'127.0.0.100\'):', has_interface_with('ipaddress', '127.0.0.100')) +info('has_interface_with(\'network\', \'127.0.0.0\'):', has_interface_with('network', '127.0.0.0')) +info('has_interface_with(\'network\', \'128.0.0.0\'):', has_interface_with('network', '128.0.0.0')) +info('has_interface_with(\'netmask\', \'255.0.0.0\'):', has_interface_with('netmask', '255.0.0.0')) +info('has_interface_with(\'netmask\', \'256.0.0.0\'):', has_interface_with('netmask', '256.0.0.0')) diff --git a/environments/prod/modules/stdlib/examples/has_ip_address.pp b/environments/prod/modules/stdlib/examples/has_ip_address.pp new file mode 100644 index 0000000..594143d --- /dev/null +++ b/environments/prod/modules/stdlib/examples/has_ip_address.pp @@ -0,0 +1,3 @@ +include ::stdlib +info('has_ip_address(\'192.168.1.256\'):', has_ip_address('192.168.1.256')) +info('has_ip_address(\'127.0.0.1\'):', has_ip_address('127.0.0.1')) diff --git a/environments/prod/modules/stdlib/examples/has_ip_network.pp b/environments/prod/modules/stdlib/examples/has_ip_network.pp new file mode 100644 index 0000000..1f1130d --- /dev/null +++ b/environments/prod/modules/stdlib/examples/has_ip_network.pp @@ -0,0 +1,3 @@ +include ::stdlib +info('has_ip_network(\'127.0.0.0\'):', has_ip_network('127.0.0.0')) +info('has_ip_network(\'128.0.0.0\'):', has_ip_network('128.0.0.0')) diff --git a/environments/prod/modules/stdlib/examples/init.pp b/environments/prod/modules/stdlib/examples/init.pp new file mode 100644 index 0000000..ad27972 --- /dev/null +++ b/environments/prod/modules/stdlib/examples/init.pp @@ -0,0 +1 @@ +include ::stdlib diff --git a/environments/prod/modules/stdlib/lib/facter/facter_dot_d.rb b/environments/prod/modules/stdlib/lib/facter/facter_dot_d.rb new file mode 100644 index 0000000..5c5fb1f --- /dev/null +++ b/environments/prod/modules/stdlib/lib/facter/facter_dot_d.rb @@ -0,0 +1,202 @@ +# A Facter plugin that loads facts from /etc/facter/facts.d +# and /etc/puppetlabs/facter/facts.d. +# +# Facts can be in the form of JSON, YAML or Text files +# and any executable that returns key=value pairs. +# +# In the case of scripts you can also create a file that +# contains a cache TTL. For foo.sh store the ttl as just +# a number in foo.sh.ttl +# +# The cache is stored in $libdir/facts_dot_d.cache as a mode +# 600 file and will have the end result of not calling your +# fact scripts more often than is needed + +class Facter::Util::DotD + require 'yaml' + + def initialize(dir="/etc/facts.d", cache_file=File.join(Puppet[:libdir], "facts_dot_d.cache")) + @dir = dir + @cache_file = cache_file + @cache = nil + @types = {".txt" => :txt, ".json" => :json, ".yaml" => :yaml} + end + + def entries + Dir.entries(@dir).reject { |f| f =~ /^\.|\.ttl$/ }.sort.map { |f| File.join(@dir, f) } + rescue + [] + end + + def fact_type(file) + extension = File.extname(file) + + type = @types[extension] || :unknown + + type = :script if type == :unknown && File.executable?(file) + + return type + end + + def txt_parser(file) + File.readlines(file).each do |line| + if line =~ /^([^=]+)=(.+)$/ + var = $1; val = $2 + + Facter.add(var) do + setcode { val } + end + end + end + rescue StandardError => e + Facter.warn("Failed to handle #{file} as text facts: #{e.class}: #{e}") + end + + def json_parser(file) + begin + require 'json' + rescue LoadError + retry if require 'rubygems' + raise + end + + JSON.load(File.read(file)).each_pair do |f, v| + Facter.add(f) do + setcode { v } + end + end + rescue StandardError => e + Facter.warn("Failed to handle #{file} as json facts: #{e.class}: #{e}") + end + + def yaml_parser(file) + require 'yaml' + + YAML.load_file(file).each_pair do |f, v| + Facter.add(f) do + setcode { v } + end + end + rescue StandardError => e + Facter.warn("Failed to handle #{file} as yaml facts: #{e.class}: #{e}") + end + + def script_parser(file) + result = cache_lookup(file) + ttl = cache_time(file) + + unless result + result = Facter::Util::Resolution.exec(file) + + if ttl > 0 + Facter.debug("Updating cache for #{file}") + cache_store(file, result) + cache_save! + end + else + Facter.debug("Using cached data for #{file}") + end + + result.split("\n").each do |line| + if line =~ /^(.+)=(.+)$/ + var = $1; val = $2 + + Facter.add(var) do + setcode { val } + end + end + end + rescue StandardError => e + Facter.warn("Failed to handle #{file} as script facts: #{e.class}: #{e}") + Facter.debug(e.backtrace.join("\n\t")) + end + + def cache_save! + cache = load_cache + File.open(@cache_file, "w", 0600) { |f| f.write(YAML.dump(cache)) } + rescue + end + + def cache_store(file, data) + load_cache + + @cache[file] = {:data => data, :stored => Time.now.to_i} + rescue + end + + def cache_lookup(file) + cache = load_cache + + return nil if cache.empty? + + ttl = cache_time(file) + + if cache[file] + now = Time.now.to_i + + return cache[file][:data] if ttl == -1 + return cache[file][:data] if (now - cache[file][:stored]) <= ttl + return nil + else + return nil + end + rescue + return nil + end + + def cache_time(file) + meta = file + ".ttl" + + return File.read(meta).chomp.to_i + rescue + return 0 + end + + def load_cache + unless @cache + if File.exist?(@cache_file) + @cache = YAML.load_file(@cache_file) + else + @cache = {} + end + end + + return @cache + rescue + @cache = {} + return @cache + end + + def create + entries.each do |fact| + type = fact_type(fact) + parser = "#{type}_parser" + + if respond_to?("#{type}_parser") + Facter.debug("Parsing #{fact} using #{parser}") + + send(parser, fact) + end + end + end +end + + +mdata = Facter.version.match(/(\d+)\.(\d+)\.(\d+)/) +if mdata + (major, minor, patch) = mdata.captures.map { |v| v.to_i } + if major < 2 + # Facter 1.7 introduced external facts support directly + unless major == 1 and minor > 6 + Facter::Util::DotD.new("/etc/facter/facts.d").create + Facter::Util::DotD.new("/etc/puppetlabs/facter/facts.d").create + + # Windows has a different configuration directory that defaults to a vendor + # specific sub directory of the %COMMON_APPDATA% directory. + if Dir.const_defined? 'COMMON_APPDATA' then + windows_facts_dot_d = File.join(Dir::COMMON_APPDATA, 'PuppetLabs', 'facter', 'facts.d') + Facter::Util::DotD.new(windows_facts_dot_d).create + end + end + end +end diff --git a/environments/prod/modules/stdlib/lib/facter/package_provider.rb b/environments/prod/modules/stdlib/lib/facter/package_provider.rb new file mode 100644 index 0000000..3a9117f --- /dev/null +++ b/environments/prod/modules/stdlib/lib/facter/package_provider.rb @@ -0,0 +1,21 @@ +# Fact: package_provider +# +# Purpose: Returns the default provider Puppet will choose to manage packages +# on this system +# +# Resolution: Instantiates a dummy package resource and return the provider +# +# Caveats: +# +require 'puppet/type' +require 'puppet/type/package' + +Facter.add(:package_provider) do + setcode do + if defined? Gem and Gem::Version.new(Facter.value(:puppetversion).split(' ')[0]) >= Gem::Version.new('3.6') + Puppet::Type.type(:package).newpackage(:name => 'dummy', :allow_virtual => 'true')[:provider].to_s + else + Puppet::Type.type(:package).newpackage(:name => 'dummy')[:provider].to_s + end + end +end diff --git a/environments/prod/modules/stdlib/lib/facter/pe_version.rb b/environments/prod/modules/stdlib/lib/facter/pe_version.rb new file mode 100644 index 0000000..c9f2181 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/facter/pe_version.rb @@ -0,0 +1,58 @@ +# Fact: is_pe, pe_version, pe_major_version, pe_minor_version, pe_patch_version +# +# Purpose: Return various facts about the PE state of the system +# +# Resolution: Uses a regex match against puppetversion to determine whether the +# machine has Puppet Enterprise installed, and what version (overall, major, +# minor, patch) is installed. +# +# Caveats: +# +Facter.add("pe_version") do + setcode do + puppet_ver = Facter.value("puppetversion") + if puppet_ver != nil + pe_ver = puppet_ver.match(/Puppet Enterprise (\d+\.\d+\.\d+)/) + pe_ver[1] if pe_ver + else + nil + end + end +end + +Facter.add("is_pe") do + setcode do + if Facter.value(:pe_version).to_s.empty? then + false + else + true + end + end +end + +Facter.add("pe_major_version") do + confine :is_pe => true + setcode do + if pe_version = Facter.value(:pe_version) + pe_version.to_s.split('.')[0] + end + end +end + +Facter.add("pe_minor_version") do + confine :is_pe => true + setcode do + if pe_version = Facter.value(:pe_version) + pe_version.to_s.split('.')[1] + end + end +end + +Facter.add("pe_patch_version") do + confine :is_pe => true + setcode do + if pe_version = Facter.value(:pe_version) + pe_version.to_s.split('.')[2] + end + end +end diff --git a/environments/prod/modules/stdlib/lib/facter/puppet_settings.rb b/environments/prod/modules/stdlib/lib/facter/puppet_settings.rb new file mode 100644 index 0000000..eac9e97 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/facter/puppet_settings.rb @@ -0,0 +1,43 @@ +# These facter facts return the value of the Puppet vardir and environment path +# settings for the node running puppet or puppet agent. The intent is to +# enable Puppet modules to automatically have insight into a place where they +# can place variable data, or for modules running on the puppet master to know +# where environments are stored. +# +# The values should be directly usable in a File resource path attribute. +# +begin + require 'facter/util/puppet_settings' +rescue LoadError => e + # puppet apply does not add module lib directories to the $LOAD_PATH (See + # #4248). It should (in the future) but for the time being we need to be + # defensive which is what this rescue block is doing. + rb_file = File.join(File.dirname(__FILE__), 'util', 'puppet_settings.rb') + load rb_file if File.exists?(rb_file) or raise e +end + + +# These will be nil if Puppet is not available. +Facter.add(:puppet_vardir) do + setcode do + Facter::Util::PuppetSettings.with_puppet do + Puppet[:vardir] + end + end +end + +Facter.add(:puppet_environmentpath) do + setcode do + Facter::Util::PuppetSettings.with_puppet do + Puppet[:environmentpath] + end + end +end + +Facter.add(:puppet_server) do + setcode do + Facter::Util::PuppetSettings.with_puppet do + Puppet[:server] + end + end +end diff --git a/environments/prod/modules/stdlib/lib/facter/root_home.rb b/environments/prod/modules/stdlib/lib/facter/root_home.rb new file mode 100644 index 0000000..87c7657 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/facter/root_home.rb @@ -0,0 +1,45 @@ +# A facter fact to determine the root home directory. +# This varies on PE supported platforms and may be +# reconfigured by the end user. + +module Facter::Util::RootHome + class << self + def get_root_home + root_ent = Facter::Util::Resolution.exec("getent passwd root") + # The home directory is the sixth element in the passwd entry + # If the platform doesn't have getent, root_ent will be nil and we should + # return it straight away. + root_ent && root_ent.split(":")[5] + end + end +end + +Facter.add(:root_home) do + setcode { Facter::Util::RootHome.get_root_home } +end + +Facter.add(:root_home) do + confine :kernel => :darwin + setcode do + str = Facter::Util::Resolution.exec("dscacheutil -q user -a name root") + hash = {} + str.split("\n").each do |pair| + key,value = pair.split(/:/) + hash[key] = value + end + hash['dir'].strip + end +end + +Facter.add(:root_home) do + confine :kernel => :aix + root_home = nil + setcode do + str = Facter::Util::Resolution.exec("lsuser -c -a home root") + str && str.split("\n").each do |line| + next if line =~ /^#/ + root_home = line.split(/:/)[1] + end + root_home + end +end diff --git a/environments/prod/modules/stdlib/lib/facter/service_provider.rb b/environments/prod/modules/stdlib/lib/facter/service_provider.rb new file mode 100644 index 0000000..a117921 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/facter/service_provider.rb @@ -0,0 +1,17 @@ +# Fact: service_provider +# +# Purpose: Returns the default provider Puppet will choose to manage services +# on this system +# +# Resolution: Instantiates a dummy service resource and return the provider +# +# Caveats: +# +require 'puppet/type' +require 'puppet/type/service' + +Facter.add(:service_provider) do + setcode do + Puppet::Type.type(:service).newservice(:name => 'dummy')[:provider].to_s + end +end diff --git a/environments/prod/modules/stdlib/lib/facter/util/puppet_settings.rb b/environments/prod/modules/stdlib/lib/facter/util/puppet_settings.rb new file mode 100644 index 0000000..1ad9452 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/facter/util/puppet_settings.rb @@ -0,0 +1,21 @@ +module Facter + module Util + module PuppetSettings + # This method is intended to provide a convenient way to evaluate a + # Facter code block only if Puppet is loaded. This is to account for the + # situation where the fact happens to be in the load path, but Puppet is + # not loaded for whatever reason. Perhaps the user is simply running + # facter without the --puppet flag and they happen to be working in a lib + # directory of a module. + def self.with_puppet + begin + Module.const_get("Puppet") + rescue NameError + nil + else + yield + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/deprecation.rb b/environments/prod/modules/stdlib/lib/puppet/functions/deprecation.rb new file mode 100644 index 0000000..39d9bc7 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/deprecation.rb @@ -0,0 +1,29 @@ +# Function to print deprecation warnings, Logs a warning once for a given key. The uniqueness key - can appear once. The msg is the message text including any positional information that is formatted by the user/caller of the method It is affected by the puppet setting 'strict', which can be set to :error (outputs as an error message), :off (no message / error is displayed) and :warning (default, outputs a warning) *Type*: String, String. +# + +Puppet::Functions.create_function(:deprecation) do + dispatch :deprecation do + param 'String', :key + param 'String', :message + end + + def deprecation(key, message) + if defined? Puppet::Pops::PuppetStack.stacktrace() + stacktrace = Puppet::Pops::PuppetStack.stacktrace() + file = stacktrace[0] + line = stacktrace[1] + message = "#{message} at #{file}:#{line}" + end + # depending on configuration setting of strict + case Puppet.settings[:strict] + when :off + # do nothing + when :error + fail("deprecation. #{key}. #{message}") + else + unless ENV['STDLIB_LOG_DEPRECATIONS'] == 'false' + Puppet.deprecation_warning(message, key) + end + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/is_a.rb b/environments/prod/modules/stdlib/lib/puppet/functions/is_a.rb new file mode 100644 index 0000000..da98b03 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/is_a.rb @@ -0,0 +1,32 @@ +# Boolean check to determine whether a variable is of a given data type. This is equivalent to the `=~` type checks. +# +# @example how to check a data type +# # check a data type +# foo = 3 +# $bar = [1,2,3] +# $baz = 'A string!' +# +# if $foo.is_a(Integer) { +# notify { 'foo!': } +# } +# if $bar.is_a(Array) { +# notify { 'bar!': } +# } +# if $baz.is_a(String) { +# notify { 'baz!': } +# } +# +# See the documentation for "The Puppet Type System" for more information about types. +# See the `assert_type()` function for flexible ways to assert the type of a value. +# +Puppet::Functions.create_function(:is_a) do + dispatch :is_a do + param 'Any', :value + param 'Type', :type + end + + def is_a(value, type) + # See puppet's lib/puppet/pops/evaluator/evaluator_impl.rb eval_MatchExpression + Puppet::Pops::Types::TypeCalculator.instance?(type, value) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/is_absolute_path.rb b/environments/prod/modules/stdlib/lib/puppet/functions/is_absolute_path.rb new file mode 100644 index 0000000..b61064a --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/is_absolute_path.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_absolute_path) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_absolute_path', "This method is deprecated, please use match expressions with Stdlib::Compat::Absolute_Path instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_absolute_path", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/is_array.rb b/environments/prod/modules/stdlib/lib/puppet/functions/is_array.rb new file mode 100644 index 0000000..a29fe8a --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/is_array.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_array) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_array', "This method is deprecated, please use match expressions with Stdlib::Compat::Array instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_array", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/is_bool.rb b/environments/prod/modules/stdlib/lib/puppet/functions/is_bool.rb new file mode 100644 index 0000000..6e2c22b --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/is_bool.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_bool) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_bool', "This method is deprecated, please use match expressions with Stdlib::Compat::Bool instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_bool", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/is_float.rb b/environments/prod/modules/stdlib/lib/puppet/functions/is_float.rb new file mode 100644 index 0000000..c91aa5d --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/is_float.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_float) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_float', "This method is deprecated, please use match expressions with Stdlib::Compat::Float instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_float", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/is_ip_address.rb b/environments/prod/modules/stdlib/lib/puppet/functions/is_ip_address.rb new file mode 100644 index 0000000..4c72037 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/is_ip_address.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_ip_address) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_ip_address', "This method is deprecated, please use match expressions with Stdlib::Compat::Ip_address instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_ip_address", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/is_ipv4_address.rb b/environments/prod/modules/stdlib/lib/puppet/functions/is_ipv4_address.rb new file mode 100644 index 0000000..97b01ae --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/is_ipv4_address.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_ipv4_address) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_ipv4_address', "This method is deprecated, please use match expressions with Stdlib::Compat::Ipv4 instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_ipv4_address", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/is_ipv6_address.rb b/environments/prod/modules/stdlib/lib/puppet/functions/is_ipv6_address.rb new file mode 100644 index 0000000..be0c98a --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/is_ipv6_address.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_ipv6_address) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_ipv4_address', "This method is deprecated, please use match expressions with Stdlib::Compat::Ipv6 instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_ipv6_address", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/is_numeric.rb b/environments/prod/modules/stdlib/lib/puppet/functions/is_numeric.rb new file mode 100644 index 0000000..f5e9d41 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/is_numeric.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_numeric) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_numeric', "This method is deprecated, please use match expressions with Stdlib::Compat::Numeric instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_numeric", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/is_string.rb b/environments/prod/modules/stdlib/lib/puppet/functions/is_string.rb new file mode 100644 index 0000000..a05a796 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/is_string.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_string) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_string', "This method is deprecated, please use match expressions with Stdlib::Compat::String instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_string", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/length.rb b/environments/prod/modules/stdlib/lib/puppet/functions/length.rb new file mode 100644 index 0000000..86e735c --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/length.rb @@ -0,0 +1,14 @@ +#A function to eventually replace the old size() function for stdlib - The original size function did not handle Puppets new type capabilities, so this function is a Puppet 4 compatible solution. +Puppet::Functions.create_function(:length) do + dispatch :length do + param 'Variant[String,Array,Hash]', :value + end + def length(value) + if value.is_a?(String) + result = value.length + elsif value.is_a?(Array) || value.is_a?(Hash) + result = value.size + end + return result + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/type_of.rb b/environments/prod/modules/stdlib/lib/puppet/functions/type_of.rb new file mode 100644 index 0000000..01f1f49 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/type_of.rb @@ -0,0 +1,19 @@ +# Returns the type when passed a value. +# +# @example how to compare values' types +# # compare the types of two values +# if type_of($first_value) != type_of($second_value) { fail("first_value and second_value are different types") } +# @example how to compare against an abstract type +# unless type_of($first_value) <= Numeric { fail("first_value must be Numeric") } +# unless type_of{$first_value) <= Collection[1] { fail("first_value must be an Array or Hash, and contain at least one element") } +# +# See the documentation for "The Puppet Type System" for more information about types. +# See the `assert_type()` function for flexible ways to assert the type of a value. +# +# The built-in type() function in puppet is generally preferred over this function +# this function is provided for backwards compatibility. +Puppet::Functions.create_function(:type_of) do + def type_of(value) + Puppet::Pops::Types::TypeCalculator.infer_set(value) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/validate_absolute_path.rb b/environments/prod/modules/stdlib/lib/puppet/functions/validate_absolute_path.rb new file mode 100644 index 0000000..a3c696d --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/validate_absolute_path.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_absolute_path) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_absolute_path', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Absolute_Path. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_absolute_path", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/validate_array.rb b/environments/prod/modules/stdlib/lib/puppet/functions/validate_array.rb new file mode 100644 index 0000000..f59c6b4 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/validate_array.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_array) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_array', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Array. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_array", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/validate_bool.rb b/environments/prod/modules/stdlib/lib/puppet/functions/validate_bool.rb new file mode 100644 index 0000000..5cfb2ac --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/validate_bool.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_bool) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_bool', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Bool. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_bool", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/validate_hash.rb b/environments/prod/modules/stdlib/lib/puppet/functions/validate_hash.rb new file mode 100644 index 0000000..89ad9ab --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/validate_hash.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_hash) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_hash', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Hash. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_hash", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/validate_integer.rb b/environments/prod/modules/stdlib/lib/puppet/functions/validate_integer.rb new file mode 100644 index 0000000..475ea0f --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/validate_integer.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_integer) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_integer', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Integer. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_integer", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/validate_ip_address.rb b/environments/prod/modules/stdlib/lib/puppet/functions/validate_ip_address.rb new file mode 100644 index 0000000..1521c08 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/validate_ip_address.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_ip_address) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_ip_address', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ip_Address. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_ip_address", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/validate_ipv4_address.rb b/environments/prod/modules/stdlib/lib/puppet/functions/validate_ipv4_address.rb new file mode 100644 index 0000000..fe66ab3 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/validate_ipv4_address.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_ipv4_address) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_ipv4_address', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ipv4_Address. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_ipv4_address", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/validate_ipv6_address.rb b/environments/prod/modules/stdlib/lib/puppet/functions/validate_ipv6_address.rb new file mode 100644 index 0000000..7cc3cbd --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/validate_ipv6_address.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_ipv6_address) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_ipv6_address', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ipv6_address. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_ipv6_address", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/validate_legacy.rb b/environments/prod/modules/stdlib/lib/puppet/functions/validate_legacy.rb new file mode 100644 index 0000000..c9d1f56 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/validate_legacy.rb @@ -0,0 +1,62 @@ +Puppet::Functions.create_function(:validate_legacy) do + # The function checks a value against both the target_type (new) and the previous_validation function (old). + + dispatch :validate_legacy do + param 'Any', :scope + param 'Type', :target_type + param 'String', :function_name + param 'Any', :value + repeated_param 'Any', :args + end + + dispatch :validate_legacy_s do + param 'Any', :scope + param 'String', :type_string + param 'String', :function_name + param 'Any', :value + repeated_param 'Any', :args + end + + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + + def validate_legacy_s(scope, type_string, *args) + t = Puppet::Pops::Types::TypeParser.new.parse(type_string, scope) + validate_legacy(scope, t, *args) + end + + def validate_legacy(scope, target_type, function_name, value, *prev_args) + if assert_type(target_type, value) + if previous_validation(scope, function_name, value, *prev_args) + # Silently passes + else + Puppet.notice("Accepting previously invalid value for target type '#{target_type}'") + end + else + inferred_type = Puppet::Pops::Types::TypeCalculator.infer_set(value) + error_msg = Puppet::Pops::Types::TypeMismatchDescriber.new.describe_mismatch("validate_legacy(#{function_name})", target_type, inferred_type) + if previous_validation(scope, function_name, value, *prev_args) + call_function('deprecation', 'validate_legacy', error_msg) + else + call_function('fail', error_msg) + end + end + end + + def previous_validation(scope, function_name, value, *prev_args) + # Call the previous validation function and catch any errors. Return true if no errors are thrown. + begin + scope.send("function_#{function_name}".to_s, [value, *prev_args]) + true + rescue Puppet::ParseError + false + end + end + + def assert_type(type, value) + Puppet::Pops::Types::TypeCalculator.instance?(type, value) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/validate_numeric.rb b/environments/prod/modules/stdlib/lib/puppet/functions/validate_numeric.rb new file mode 100644 index 0000000..3052d35 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/validate_numeric.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_numeric) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_numeric', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Numeric. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_numeric", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/validate_re.rb b/environments/prod/modules/stdlib/lib/puppet/functions/validate_re.rb new file mode 100644 index 0000000..19443a8 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/validate_re.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_re) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_re', "This method is deprecated, please use the stdlib validate_legacy function, with Pattern[]. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_re", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/validate_slength.rb b/environments/prod/modules/stdlib/lib/puppet/functions/validate_slength.rb new file mode 100644 index 0000000..584232a --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/validate_slength.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_slength) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_slength', "This method is deprecated, please use the stdlib validate_legacy function, with String[]. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_slength", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/functions/validate_string.rb b/environments/prod/modules/stdlib/lib/puppet/functions/validate_string.rb new file mode 100644 index 0000000..91ff004 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/functions/validate_string.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_string) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_string', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::String. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_string", args) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/abs.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/abs.rb new file mode 100644 index 0000000..222a902 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/abs.rb @@ -0,0 +1,34 @@ +# +# abs.rb +# + +module Puppet::Parser::Functions + newfunction(:abs, :type => :rvalue, :doc => <<-EOS + Returns the absolute value of a number, for example -34.56 becomes + 34.56. Takes a single integer and float value as an argument. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "abs(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + # Numbers in Puppet are often string-encoded which is troublesome ... + if value.is_a?(String) + if value.match(/^-?(?:\d+)(?:\.\d+){1}$/) + value = value.to_f + elsif value.match(/^-?\d+$/) + value = value.to_i + else + raise(Puppet::ParseError, 'abs(): Requires float or integer to work with') + end + end + + # We have numeric value to handle ... + result = value.abs + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/any2array.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/any2array.rb new file mode 100644 index 0000000..e71407e --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/any2array.rb @@ -0,0 +1,33 @@ +# +# any2array.rb +# + +module Puppet::Parser::Functions + newfunction(:any2array, :type => :rvalue, :doc => <<-EOS +This converts any object to an array containing that object. Empty argument +lists are converted to an empty array. Arrays are left untouched. Hashes are +converted to arrays of alternating keys and values. + EOS + ) do |arguments| + + if arguments.empty? + return [] + end + + if arguments.length == 1 + if arguments[0].kind_of?(Array) + return arguments[0] + elsif arguments[0].kind_of?(Hash) + result = [] + arguments[0].each do |key, value| + result << key << value + end + return result + end + end + + return arguments + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/any2bool.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/any2bool.rb new file mode 100644 index 0000000..17612bf --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/any2bool.rb @@ -0,0 +1,54 @@ +# +# any2bool.rb +# + +module Puppet::Parser::Functions + newfunction(:any2bool, :type => :rvalue, :doc => <<-EOS +This converts 'anything' to a boolean. In practise it does the following: + +* Strings such as Y,y,1,T,t,TRUE,yes,'true' will return true +* Strings such as 0,F,f,N,n,FALSE,no,'false' will return false +* Booleans will just return their original value +* Number (or a string representation of a number) > 0 will return true, otherwise false +* undef will return false +* Anything else will return true + EOS + ) do |arguments| + + raise(Puppet::ParseError, "any2bool(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + # If argument is already Boolean, return it + if !!arguments[0] == arguments[0] + return arguments[0] + end + + arg = arguments[0] + + if arg == nil + return false + end + + if arg == :undef + return false + end + + valid_float = !!Float(arg) rescue false + + if arg.is_a?(Numeric) + return function_num2bool( [ arguments[0] ] ) + end + + if arg.is_a?(String) + if valid_float + return function_num2bool( [ arguments[0] ] ) + else + return function_str2bool( [ arguments[0] ] ) + end + end + + return true + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/assert_private.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/assert_private.rb new file mode 100644 index 0000000..62e2c6b --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/assert_private.rb @@ -0,0 +1,28 @@ +# +# assert_private.rb +# + +module Puppet::Parser::Functions + newfunction(:assert_private, :doc => <<-'EOS' + Sets the current class or definition as private. + Calling the class or definition from outside the current module will fail. + EOS + ) do |args| + + raise(Puppet::ParseError, "assert_private(): Wrong number of arguments given (#{args.size}}) for 0 or 1)") if args.size > 1 + + scope = self + if scope.lookupvar('module_name') != scope.lookupvar('caller_module_name') + message = nil + if args[0] and args[0].is_a? String + message = args[0] + else + manifest_name = scope.source.name + manifest_type = scope.source.type + message = (manifest_type.to_s == 'hostclass') ? 'Class' : 'Definition' + message += " #{manifest_name} is private" + end + raise(Puppet::ParseError, message) + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/base64.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/base64.rb new file mode 100644 index 0000000..d610146 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/base64.rb @@ -0,0 +1,71 @@ + +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +module Puppet::Parser::Functions + + newfunction(:base64, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args| + + Base64 encode or decode a string based on the command and the string submitted + + Usage: + + $encodestring = base64('encode', 'thestring') + $decodestring = base64('decode', 'dGhlc3RyaW5n') + + # explicitly define encode/decode method: default, strict, urlsafe + $method = 'default' + $encodestring = base64('encode', 'thestring', $method) + $decodestring = base64('decode', 'dGhlc3RyaW5n', $method) + + ENDHEREDOC + + require 'base64' + + raise Puppet::ParseError, ("base64(): Wrong number of arguments (#{args.length}; must be >= 2)") unless args.length >= 2 + + actions = ['encode','decode'] + + unless actions.include?(args[0]) + raise Puppet::ParseError, ("base64(): the first argument must be one of 'encode' or 'decode'") + end + + unless args[1].is_a?(String) + raise Puppet::ParseError, ("base64(): the second argument must be a string to base64") + end + + method = ['default','strict','urlsafe'] + + if args.length <= 2 + chosenMethod = 'default' + else + chosenMethod = args[2] + end + + unless method.include?(chosenMethod) + raise Puppet::ParseError, ("base64(): the third argument must be one of 'default', 'strict', or 'urlsafe'") + end + + case args[0] + when 'encode' + case chosenMethod + when 'default' + result = Base64.encode64(args[1]) + when 'strict' + result = Base64.strict_encode64(args[1]) + when 'urlsafe' + result = Base64.urlsafe_encode64(args[1]) + end + when 'decode' + case chosenMethod + when 'default' + result = Base64.decode64(args[1]) + when 'strict' + result = Base64.strict_decode64(args[1]) + when 'urlsafe' + result = Base64.urlsafe_decode64(args[1]) + end + end + + return result + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/basename.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/basename.rb new file mode 100644 index 0000000..f7e4438 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/basename.rb @@ -0,0 +1,34 @@ +module Puppet::Parser::Functions + newfunction(:basename, :type => :rvalue, :doc => <<-EOS + Strips directory (and optional suffix) from a filename + EOS + ) do |arguments| + + if arguments.size < 1 then + raise(Puppet::ParseError, "basename(): No arguments given") + elsif arguments.size > 2 then + raise(Puppet::ParseError, "basename(): Too many arguments given (#{arguments.size})") + else + + unless arguments[0].is_a?(String) + raise(Puppet::ParseError, 'basename(): Requires string as first argument') + end + + if arguments.size == 1 then + rv = File.basename(arguments[0]) + elsif arguments.size == 2 then + + unless arguments[1].is_a?(String) + raise(Puppet::ParseError, 'basename(): Requires string as second argument') + end + + rv = File.basename(arguments[0], arguments[1]) + end + + end + + return rv + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/bool2num.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/bool2num.rb new file mode 100644 index 0000000..92e4dde --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/bool2num.rb @@ -0,0 +1,25 @@ +# +# bool2num.rb +# + +module Puppet::Parser::Functions + newfunction(:bool2num, :type => :rvalue, :doc => <<-EOS + Converts a boolean to a number. Converts the values: + false, f, 0, n, and no to 0 + true, t, 1, y, and yes to 1 + Requires a single boolean or string as an input. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "bool2num(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = function_str2bool([arguments[0]]) + + # We have real boolean values as well ... + result = value ? 1 : 0 + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/bool2str.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/bool2str.rb new file mode 100644 index 0000000..37d4a4e --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/bool2str.rb @@ -0,0 +1,44 @@ +# +# bool2str.rb +# + +module Puppet::Parser::Functions + newfunction(:bool2str, :type => :rvalue, :doc => <<-EOS + Converts a boolean to a string using optionally supplied arguments. The + optional second and third arguments represent what true and false will be + converted to respectively. If only one argument is given, it will be + converted from a boolean to a string containing 'true' or 'false'. + + *Examples:* + + bool2str(true) => 'true' + bool2str(true, 'yes', 'no') => 'yes' + bool2str(false, 't', 'f') => 'f' + + Requires a single boolean as an input. + EOS + ) do |arguments| + + unless arguments.size == 1 or arguments.size == 3 + raise(Puppet::ParseError, "bool2str(): Wrong number of arguments given (#{arguments.size} for 3)") + end + + value = arguments[0] + true_string = arguments[1] || 'true' + false_string = arguments[2] || 'false' + klass = value.class + + # We can have either true or false, and nothing else + unless [FalseClass, TrueClass].include?(klass) + raise(Puppet::ParseError, 'bool2str(): Requires a boolean to work with') + end + + unless [true_string, false_string].all?{|x| x.kind_of?(String)} + raise(Puppet::ParseError, "bool2str(): Requires strings to convert to" ) + end + + return value ? true_string : false_string + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/camelcase.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/camelcase.rb new file mode 100644 index 0000000..085b3c6 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/camelcase.rb @@ -0,0 +1,32 @@ +# +# camelcase.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:camelcase, :type => :rvalue, :doc => <<-EOS +Converts the case of a string or all strings in an array to camel case. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "camelcase(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + klass = value.class + + unless [Array, String].include?(klass) + raise(Puppet::ParseError, 'camelcase(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.split('_').map{|e| e.capitalize}.join : i } + else + result = value.split('_').map{|e| e.capitalize}.join + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/capitalize.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/capitalize.rb new file mode 100644 index 0000000..096bc5d --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/capitalize.rb @@ -0,0 +1,30 @@ +# +# capitalize.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:capitalize, :type => :rvalue, :doc => <<-EOS + Capitalizes the first letter of a string or array of strings. + Requires either a single string or an array as an input. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "capitalize(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'capitalize(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.capitalize : i } + else + result = value.capitalize + end + + return result + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/ceiling.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/ceiling.rb new file mode 100644 index 0000000..bec4266 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/ceiling.rb @@ -0,0 +1,22 @@ +module Puppet::Parser::Functions + newfunction(:ceiling, :type => :rvalue, :doc => <<-EOS + Returns the smallest integer greater or equal to the argument. + Takes a single numeric value as an argument. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "ceiling(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + begin + arg = Float(arguments[0]) + rescue TypeError, ArgumentError => e + raise(Puppet::ParseError, "ceiling(): Wrong argument type given (#{arguments[0]} for Numeric)") + end + + raise(Puppet::ParseError, "ceiling(): Wrong argument type given (#{arg.class} for Numeric)") if arg.is_a?(Numeric) == false + + arg.ceil + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/chomp.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/chomp.rb new file mode 100644 index 0000000..f9da50f --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/chomp.rb @@ -0,0 +1,32 @@ +# +# chomp.rb +# + +module Puppet::Parser::Functions + newfunction(:chomp, :type => :rvalue, :doc => <<-'EOS' + Removes the record separator from the end of a string or an array of + strings, for example `hello\n` becomes `hello`. + Requires a single string or array as an input. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "chomp(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'chomp(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.chomp : i } + else + result = value.chomp + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/chop.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/chop.rb new file mode 100644 index 0000000..809349d --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/chop.rb @@ -0,0 +1,34 @@ +# +# chop.rb +# + +module Puppet::Parser::Functions + newfunction(:chop, :type => :rvalue, :doc => <<-'EOS' + Returns a new string with the last character removed. If the string ends + with `\r\n`, both characters are removed. Applying chop to an empty + string returns an empty string. If you wish to merely remove record + separators then you should use the `chomp` function. + Requires a string or array of strings as input. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "chop(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'chop(): Requires either an array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.chop : i } + else + result = value.chop + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/clamp.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/clamp.rb new file mode 100644 index 0000000..c4503fe --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/clamp.rb @@ -0,0 +1,29 @@ +# +# clamp.rb +# + +module Puppet::Parser::Functions + newfunction(:clamp, :type => :rvalue, :arity => -2, :doc => <<-EOS + Clamps value to a range. + EOS + ) do |args| + + args.flatten! + + raise(Puppet::ParseError, 'clamp(): Wrong number of arguments, need three to clamp') if args.size != 3 + + # check values out + args.each do |value| + case [value.class] + when [String] + raise(Puppet::ParseError, "clamp(): Required explicit numeric (#{value}:String)") unless value =~ /^\d+$/ + when [Hash] + raise(Puppet::ParseError, "clamp(): The Hash type is not allowed (#{value})") + end + end + + # convert to numeric each element + # then sort them and get a middle value + args.map{ |n| n.to_i }.sort[1] + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/concat.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/concat.rb new file mode 100644 index 0000000..0a49cfe --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/concat.rb @@ -0,0 +1,40 @@ +# +# concat.rb +# + +module Puppet::Parser::Functions + newfunction(:concat, :type => :rvalue, :doc => <<-EOS +Appends the contents of multiple arrays into array 1. + +*Example:* + + concat(['1','2','3'],['4','5','6'],['7','8','9']) + +Would result in: + + ['1','2','3','4','5','6','7','8','9'] + EOS + ) do |arguments| + + # Check that more than 2 arguments have been given ... + raise(Puppet::ParseError, "concat(): Wrong number of arguments given (#{arguments.size} for < 2)") if arguments.size < 2 + + a = arguments[0] + + # Check that the first parameter is an array + unless a.is_a?(Array) + raise(Puppet::ParseError, 'concat(): Requires array to work with') + end + + result = a + arguments.shift + + arguments.each do |x| + result = result + (x.is_a?(Array) ? x : [x]) + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/convert_base.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/convert_base.rb new file mode 100644 index 0000000..0fcbafe --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/convert_base.rb @@ -0,0 +1,35 @@ +module Puppet::Parser::Functions + + newfunction(:convert_base, :type => :rvalue, :arity => 2, :doc => <<-'ENDHEREDOC') do |args| + + Converts a given integer or base 10 string representing an integer to a specified base, as a string. + + Usage: + + $binary_repr = convert_base(5, 2) # $binary_repr is now set to "101" + $hex_repr = convert_base("254", "16") # $hex_repr is now set to "fe" + + ENDHEREDOC + + raise Puppet::ParseError, ("convert_base(): First argument must be either a string or an integer") unless (args[0].is_a?(Integer) or args[0].is_a?(String)) + raise Puppet::ParseError, ("convert_base(): Second argument must be either a string or an integer") unless (args[1].is_a?(Integer) or args[1].is_a?(String)) + + if args[0].is_a?(String) + raise Puppet::ParseError, ("convert_base(): First argument must be an integer or a string corresponding to an integer in base 10") unless args[0] =~ /^[0-9]+$/ + end + + if args[1].is_a?(String) + raise Puppet::ParseError, ("convert_base(): First argument must be an integer or a string corresponding to an integer in base 10") unless args[1] =~ /^[0-9]+$/ + end + + number_to_convert = args[0] + new_base = args[1] + + number_to_convert = number_to_convert.to_i() + new_base = new_base.to_i() + + raise Puppet::ParseError, ("convert_base(): base must be at least 2 and must not be greater than 36") unless new_base >= 2 and new_base <= 36 + + return number_to_convert.to_s(new_base) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/count.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/count.rb new file mode 100644 index 0000000..cef2637 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/count.rb @@ -0,0 +1,21 @@ +module Puppet::Parser::Functions + newfunction(:count, :type => :rvalue, :arity => -2, :doc => <<-EOS +Takes an array as first argument and an optional second argument. +Count the number of elements in array that matches second argument. +If called with only an array it counts the number of elements that are not nil/undef. + EOS + ) do |args| + + if (args.size > 2) then + raise(ArgumentError, "count(): Wrong number of arguments given #{args.size} for 1 or 2.") + end + + collection, item = args + + if item then + collection.count item + else + collection.count { |obj| obj != nil && obj != :undef && obj != '' } + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/deep_merge.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/deep_merge.rb new file mode 100644 index 0000000..6df32e9 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/deep_merge.rb @@ -0,0 +1,44 @@ +module Puppet::Parser::Functions + newfunction(:deep_merge, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args| + Recursively merges two or more hashes together and returns the resulting hash. + + For example: + + $hash1 = {'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } } + $hash2 = {'two' => 'dos', 'three' => { 'five' => 5 } } + $merged_hash = deep_merge($hash1, $hash2) + # The resulting hash is equivalent to: + # $merged_hash = { 'one' => 1, 'two' => 'dos', 'three' => { 'four' => 4, 'five' => 5 } } + + When there is a duplicate key that is a hash, they are recursively merged. + When there is a duplicate key that is not a hash, the key in the rightmost hash will "win." + + ENDHEREDOC + + if args.length < 2 + raise Puppet::ParseError, ("deep_merge(): wrong number of arguments (#{args.length}; must be at least 2)") + end + + deep_merge = Proc.new do |hash1,hash2| + hash1.merge(hash2) do |key,old_value,new_value| + if old_value.is_a?(Hash) && new_value.is_a?(Hash) + deep_merge.call(old_value, new_value) + else + new_value + end + end + end + + result = Hash.new + args.each do |arg| + next if arg.is_a? String and arg.empty? # empty string is synonym for puppet's undef + # If the argument was not a hash, skip it. + unless arg.is_a?(Hash) + raise Puppet::ParseError, "deep_merge: unexpected argument type #{arg.class}, only expects hash arguments" + end + + result = deep_merge.call(result, arg) + end + return( result ) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/defined_with_params.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/defined_with_params.rb new file mode 100644 index 0000000..99687ae --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/defined_with_params.rb @@ -0,0 +1,38 @@ +# Test whether a given class or definition is defined +require 'puppet/parser/functions' + +Puppet::Parser::Functions.newfunction(:defined_with_params, + :type => :rvalue, + :doc => <<-'ENDOFDOC' +Takes a resource reference and an optional hash of attributes. + +Returns true if a resource with the specified attributes has already been added +to the catalog, and false otherwise. + + user { 'dan': + ensure => present, + } + + if ! defined_with_params(User[dan], {'ensure' => 'present' }) { + user { 'dan': ensure => present, } + } +ENDOFDOC +) do |vals| + reference, params = vals + raise(ArgumentError, 'Must specify a reference') unless reference + if (! params) || params == '' + params = {} + end + ret = false + if resource = findresource(reference.to_s) + matches = params.collect do |key, value| + # eql? avoids bugs caused by monkeypatching in puppet + resource_is_undef = resource[key].eql?(:undef) || resource[key].nil? + value_is_undef = value.eql?(:undef) || value.nil? + (resource_is_undef && value_is_undef) || (resource[key] == value) + end + ret = params.empty? || !matches.include?(false) + end + Puppet.debug("Resource #{reference} was not determined to be defined") + ret +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete.rb new file mode 100644 index 0000000..9dd5164 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete.rb @@ -0,0 +1,43 @@ +# +# delete.rb +# + +module Puppet::Parser::Functions + newfunction(:delete, :type => :rvalue, :doc => <<-EOS +Deletes all instances of a given element from an array, substring from a +string, or key from a hash. + +*Examples:* + + delete(['a','b','c','b'], 'b') + Would return: ['a','c'] + + delete({'a'=>1,'b'=>2,'c'=>3}, 'b') + Would return: {'a'=>1,'c'=>3} + + delete({'a'=>1,'b'=>2,'c'=>3}, ['b','c']) + Would return: {'a'=>1} + + delete('abracadabra', 'bra') + Would return: 'acada' + EOS + ) do |arguments| + + raise(Puppet::ParseError, "delete(): Wrong number of arguments given #{arguments.size} for 2") unless arguments.size == 2 + + collection = arguments[0].dup + Array(arguments[1]).each do |item| + case collection + when Array, Hash + collection.delete item + when String + collection.gsub! item, '' + else + raise(TypeError, "delete(): First argument must be an Array, String, or Hash. Given an argument of class #{collection.class}.") + end + end + collection + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_at.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_at.rb new file mode 100644 index 0000000..daf3721 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_at.rb @@ -0,0 +1,46 @@ +# +# delete_at.rb +# + +module Puppet::Parser::Functions + newfunction(:delete_at, :type => :rvalue, :doc => <<-EOS +Deletes a determined indexed value from an array. + +*Examples:* + + delete_at(['a','b','c'], 1) + +Would return: ['a','c'] + EOS + ) do |arguments| + + raise(Puppet::ParseError, "delete_at(): Wrong number of arguments given (#{arguments.size} for 2)") if arguments.size < 2 + + array = arguments[0] + + unless array.is_a?(Array) + raise(Puppet::ParseError, 'delete_at(): Requires array to work with') + end + + index = arguments[1] + + if index.is_a?(String) and not index.match(/^\d+$/) + raise(Puppet::ParseError, 'delete_at(): You must provide non-negative numeric index') + end + + result = array.clone + + # Numbers in Puppet are often string-encoded which is troublesome ... + index = index.to_i + + if index > result.size - 1 # First element is at index 0 is it not? + raise(Puppet::ParseError, 'delete_at(): Given index exceeds size of array given') + end + + result.delete_at(index) # We ignore the element that got deleted ... + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_regex.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_regex.rb new file mode 100644 index 0000000..e5dc1fd --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_regex.rb @@ -0,0 +1,44 @@ +# +# delete_regex.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:delete_regex, :type => :rvalue, :doc => <<-EOS +deletes all instances of a given element that match a regular expression +from an array or key from a hash. Multiple regular expressions are assumed +to be matched as an OR. + +*Examples:* + + delete_regex(['a','b','c','b'], 'b') + Would return: ['a','c'] + + delete_regex(['a','b','c','b'], ['b', 'c']) + Would return: ['a'] + + delete_regex({'a'=>1,'b'=>2,'c'=>3}, 'b') + Would return: {'a'=>1,'c'=>3} + + delete_regex({'a'=>1,'b'=>2,'c'=>3}, '^a$') + Would return: {'b'=>2,'c'=>3} + + EOS + ) do |arguments| + + raise(Puppet::ParseError, "delete_regex(): Wrong number of arguments given #{arguments.size} for 2") unless arguments.size == 2 + + collection = arguments[0].dup + Array(arguments[1]).each do |item| + case collection + when Array, Hash, String + collection.reject! { |coll_item| (coll_item =~ %r{\b#{item}\b}) } + else + raise(TypeError, "delete_regex(): First argument must be an Array, Hash, or String. Given an argument of class #{collection.class}.") + end + end + collection + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_undef_values.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_undef_values.rb new file mode 100644 index 0000000..00bd252 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_undef_values.rb @@ -0,0 +1,31 @@ +module Puppet::Parser::Functions + newfunction(:delete_undef_values, :type => :rvalue, :doc => <<-EOS +Returns a copy of input hash or array with all undefs deleted. + +*Examples:* + + $hash = delete_undef_values({a=>'A', b=>'', c=>undef, d => false}) + +Would return: {a => 'A', b => '', d => false} + + $array = delete_undef_values(['A','',undef,false]) + +Would return: ['A','',false] + + EOS + ) do |args| + + raise(Puppet::ParseError, "delete_undef_values(): Wrong number of arguments given (#{args.size})") if args.size < 1 + + unless args[0].is_a? Array or args[0].is_a? Hash + raise(Puppet::ParseError, "delete_undef_values(): expected an array or hash, got #{args[0]} type #{args[0].class} ") + end + result = args[0].dup + if result.is_a?(Hash) + result.delete_if {|key, val| val.equal? :undef} + elsif result.is_a?(Array) + result.delete :undef + end + result + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_values.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_values.rb new file mode 100644 index 0000000..e799aef --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/delete_values.rb @@ -0,0 +1,23 @@ +module Puppet::Parser::Functions + newfunction(:delete_values, :type => :rvalue, :doc => <<-EOS +Deletes all instances of a given value from a hash. + +*Examples:* + + delete_values({'a'=>'A','b'=>'B','c'=>'C','B'=>'D'}, 'B') + +Would return: {'a'=>'A','c'=>'C','B'=>'D'} + + EOS + ) do |arguments| + + raise(Puppet::ParseError, "delete_values(): Wrong number of arguments given (#{arguments.size} of 2)") if arguments.size != 2 + + hash, item = arguments + + if not hash.is_a?(Hash) + raise(TypeError, "delete_values(): First argument must be a Hash. Given an argument of class #{hash.class}.") + end + hash.dup.delete_if { |key, val| item == val } + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/deprecation.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/deprecation.rb new file mode 100644 index 0000000..39d306a --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/deprecation.rb @@ -0,0 +1,16 @@ +module Puppet::Parser::Functions + newfunction(:deprecation, :doc => <<-EOS + Function to print deprecation warnings (this is the 3.X version of it), The uniqueness key - can appear once. The msg is the message text including any positional information that is formatted by the user/caller of the method.). +EOS + ) do |arguments| + + raise(Puppet::ParseError, "deprecation: Wrong number of arguments given (#{arguments.size} for 2)") unless arguments.size == 2 + + key = arguments[0] + message = arguments[1] + + if ENV['STDLIB_LOG_DEPRECATIONS'] == "true" + warning("deprecation. #{key}. #{message}") + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/difference.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/difference.rb new file mode 100644 index 0000000..c9ac478 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/difference.rb @@ -0,0 +1,35 @@ +# +# difference.rb +# + +module Puppet::Parser::Functions + newfunction(:difference, :type => :rvalue, :doc => <<-EOS +This function returns the difference between two arrays. +The returned array is a copy of the original array, removing any items that +also appear in the second array. + +*Examples:* + + difference(["a","b","c"],["b","c","d"]) + +Would return: ["a"] + EOS + ) do |arguments| + + # Two arguments are required + raise(Puppet::ParseError, "difference(): Wrong number of arguments given (#{arguments.size} for 2)") if arguments.size != 2 + + first = arguments[0] + second = arguments[1] + + unless first.is_a?(Array) && second.is_a?(Array) + raise(Puppet::ParseError, 'difference(): Requires 2 arrays') + end + + result = first - second + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/dig.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/dig.rb new file mode 100644 index 0000000..34fa701 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/dig.rb @@ -0,0 +1,16 @@ +# +# dig.rb +# + +module Puppet::Parser::Functions + newfunction(:dig, :type => :rvalue, :doc => <<-EOS + DEPRECATED: This function has been replaced in Puppet 4.5.0, please use dig44() for backwards compatibility or use the new version. + EOS + ) do |arguments| + warning("dig() DEPRECATED: This function has been replaced in Puppet 4.5.0, please use dig44() for backwards compatibility or use the new version.") + if ! Puppet::Parser::Functions.autoloader.loaded?(:dig44) + Puppet::Parser::Functions.autoloader.load(:dig44) + end + function_dig44(arguments) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/dig44.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/dig44.rb new file mode 100644 index 0000000..21c0a8c --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/dig44.rb @@ -0,0 +1,70 @@ +# +# dig44.rb +# + +module Puppet::Parser::Functions + newfunction( + :dig44, + :type => :rvalue, + :arity => -2, + :doc => <<-eos +DEPRECATED: This function has been replaced in puppet 4.5.0. + +Looks up into a complex structure of arrays and hashes and returns a value +or the default value if nothing was found. + +Key can contain slashes to describe path components. The function will go down +the structure and try to extract the required value. + +$data = { + 'a' => { + 'b' => [ + 'b1', + 'b2', + 'b3', + ] + } +} + +$value = dig44($data, ['a', 'b', '2'], 'not_found') +=> $value = 'b3' + +a -> first hash key +b -> second hash key +2 -> array index starting with 0 + +not_found -> (optional) will be returned if there is no value or the path +did not match. Defaults to nil. + +In addition to the required "key" argument, the function accepts a default +argument. It will be returned if no value was found or a path component is +missing. And the fourth argument can set a variable path separator. + eos + ) do |arguments| + # Two arguments are required + raise(Puppet::ParseError, "dig44(): Wrong number of arguments given (#{arguments.size} for at least 2)") if arguments.size < 2 + + data, path, default = *arguments + + unless data.is_a?(Hash) or data.is_a?(Array) + raise(Puppet::ParseError, "dig44(): first argument must be a hash or an array, given #{data.class.name}") + end + + unless path.is_a? Array + raise(Puppet::ParseError, "dig44(): second argument must be an array, given #{path.class.name}") + end + + value = path.reduce(data) do |structure, key| + if structure.is_a? Hash or structure.is_a? Array + if structure.is_a? Array + key = Integer key rescue break + end + break if structure[key].nil? or structure[key] == :undef + structure[key] + else + break + end + end + value.nil? ? default : value + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/dirname.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/dirname.rb new file mode 100644 index 0000000..40b300d --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/dirname.rb @@ -0,0 +1,21 @@ +module Puppet::Parser::Functions + newfunction(:dirname, :type => :rvalue, :doc => <<-EOS + Returns the dirname of a path. + EOS + ) do |arguments| + + if arguments.size < 1 then + raise(Puppet::ParseError, "dirname(): No arguments given") + end + if arguments.size > 1 then + raise(Puppet::ParseError, "dirname(): Too many arguments given (#{arguments.size})") + end + unless arguments[0].is_a?(String) + raise(Puppet::ParseError, 'dirname(): Requires string as argument') + end + + return File.dirname(arguments[0]) + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/dos2unix.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/dos2unix.rb new file mode 100644 index 0000000..ccac899 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/dos2unix.rb @@ -0,0 +1,15 @@ +# Custom Puppet function to convert dos to unix format +module Puppet::Parser::Functions + newfunction(:dos2unix, :type => :rvalue, :arity => 1, :doc => <<-EOS + Returns the Unix version of the given string. + Takes a single string argument. + EOS + ) do |arguments| + + unless arguments[0].is_a?(String) + raise(Puppet::ParseError, 'dos2unix(): Requires string as argument') + end + + arguments[0].gsub(/\r\n/, "\n") + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/downcase.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/downcase.rb new file mode 100644 index 0000000..ab04f8a --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/downcase.rb @@ -0,0 +1,31 @@ +# +# downcase.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:downcase, :type => :rvalue, :doc => <<-EOS +Converts the case of a string or all strings in an array to lower case. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "downcase(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'downcase(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.downcase : i } + else + result = value.downcase + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/empty.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/empty.rb new file mode 100644 index 0000000..4f77ad3 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/empty.rb @@ -0,0 +1,29 @@ +# +# empty.rb +# + +module Puppet::Parser::Functions + newfunction(:empty, :type => :rvalue, :doc => <<-EOS +Returns true if the variable is empty. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "empty(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(Hash) || value.is_a?(String) || value.is_a?(Numeric) + raise(Puppet::ParseError, 'empty(): Requires either array, hash, string or integer to work with') + end + + if value.is_a?(Numeric) + return false + else + result = value.empty? + + return result + end + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/enclose_ipv6.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/enclose_ipv6.rb new file mode 100644 index 0000000..1f8a454 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/enclose_ipv6.rb @@ -0,0 +1,42 @@ +# +# enclose_ipv6.rb +# + +module Puppet::Parser::Functions + newfunction(:enclose_ipv6, :type => :rvalue, :doc => <<-EOS +Takes an array of ip addresses and encloses the ipv6 addresses with square brackets. + EOS + ) do |arguments| + + require 'ipaddr' + + rescuable_exceptions = [ ArgumentError ] + if defined?(IPAddr::InvalidAddressError) + rescuable_exceptions << IPAddr::InvalidAddressError + end + + if (arguments.size != 1) then + raise(Puppet::ParseError, "enclose_ipv6(): Wrong number of arguments given #{arguments.size} for 1") + end + unless arguments[0].is_a?(String) or arguments[0].is_a?(Array) then + raise(Puppet::ParseError, "enclose_ipv6(): Wrong argument type given #{arguments[0].class} expected String or Array") + end + + input = [arguments[0]].flatten.compact + result = [] + + input.each do |val| + unless val == '*' + begin + ip = IPAddr.new(val) + rescue *rescuable_exceptions + raise(Puppet::ParseError, "enclose_ipv6(): Wrong argument given #{val} is not an ip address.") + end + val = "[#{ip.to_s}]" if ip.ipv6? + end + result << val + end + + return result.uniq + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/ensure_packages.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/ensure_packages.rb new file mode 100644 index 0000000..17942b8 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/ensure_packages.rb @@ -0,0 +1,47 @@ +# +# ensure_packages.rb +# + +module Puppet::Parser::Functions + newfunction(:ensure_packages, :type => :statement, :doc => <<-EOS +Takes a list of packages and only installs them if they don't already exist. +It optionally takes a hash as a second parameter that will be passed as the +third argument to the ensure_resource() function. + EOS + ) do |arguments| + + if arguments.size > 2 or arguments.size == 0 + raise(Puppet::ParseError, "ensure_packages(): Wrong number of arguments given (#{arguments.size} for 1 or 2)") + elsif arguments.size == 2 and !arguments[1].is_a?(Hash) + raise(Puppet::ParseError, 'ensure_packages(): Requires second argument to be a Hash') + end + + if arguments[0].is_a?(Hash) + if arguments[1] + defaults = { 'ensure' => 'present' }.merge(arguments[1]) + else + defaults = { 'ensure' => 'present' } + end + + Puppet::Parser::Functions.function(:ensure_resources) + function_ensure_resources(['package', arguments[0].dup, defaults ]) + else + packages = Array(arguments[0]) + + if arguments[1] + defaults = { 'ensure' => 'present' }.merge(arguments[1]) + else + defaults = { 'ensure' => 'present' } + end + + Puppet::Parser::Functions.function(:ensure_resource) + packages.each { |package_name| + if !findresource("Package[#{package_name}]") + function_ensure_resource(['package', package_name, defaults ]) + end + } + end + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/ensure_resource.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/ensure_resource.rb new file mode 100644 index 0000000..1ba6a44 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/ensure_resource.rb @@ -0,0 +1,46 @@ +# Test whether a given class or definition is defined +require 'puppet/parser/functions' + +Puppet::Parser::Functions.newfunction(:ensure_resource, + :type => :statement, + :doc => <<-'ENDOFDOC' +Takes a resource type, title, and a list of attributes that describe a +resource. + + user { 'dan': + ensure => present, + } + +This example only creates the resource if it does not already exist: + + ensure_resource('user', 'dan', {'ensure' => 'present' }) + +If the resource already exists but does not match the specified parameters, +this function will attempt to recreate the resource leading to a duplicate +resource definition error. + +An array of resources can also be passed in and each will be created with +the type and parameters specified if it doesn't already exist. + + ensure_resource('user', ['dan','alex'], {'ensure' => 'present'}) + +ENDOFDOC +) do |vals| + type, title, params = vals + raise(ArgumentError, 'Must specify a type') unless type + raise(ArgumentError, 'Must specify a title') unless title + params ||= {} + + items = [title].flatten + + items.each do |item| + Puppet::Parser::Functions.function(:defined_with_params) + if function_defined_with_params(["#{type}[#{item}]", params]) + Puppet.debug("Resource #{type}[#{item}] with params #{params} not created because it already exists") + else + Puppet.debug("Create new resource #{type}[#{item}] with params #{params}") + Puppet::Parser::Functions.function(:create_resources) + function_create_resources([type.capitalize, { item => params }]) + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/ensure_resources.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/ensure_resources.rb new file mode 100644 index 0000000..b3c51e6 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/ensure_resources.rb @@ -0,0 +1,54 @@ +require 'puppet/parser/functions' + +Puppet::Parser::Functions.newfunction(:ensure_resources, + :type => :statement, + :doc => <<-'ENDOFDOC' +Takes a resource type, title (only hash), and a list of attributes that describe a +resource. + + user { 'dan': + gid => 'mygroup', + ensure => present, + } + +An hash of resources should be passed in and each will be created with +the type and parameters specified if it doesn't already exist. + + ensure_resources('user', {'dan' => { gid => 'mygroup', uid => '600' } , 'alex' => { gid => 'mygroup' }}, {'ensure' => 'present'}) + +From Hiera Backend: + +userlist: + dan: + gid: 'mygroup' + uid: '600' + alex: + gid: 'mygroup' + +Call: +ensure_resources('user', hiera_hash('userlist'), {'ensure' => 'present'}) + +ENDOFDOC +) do |vals| + type, title, params = vals + raise(ArgumentError, 'Must specify a type') unless type + raise(ArgumentError, 'Must specify a title') unless title + params ||= {} + + if title.is_a?(Hash) + resource_hash = title.dup + resources = resource_hash.keys + + Puppet::Parser::Functions.function(:ensure_resource) + resources.each { |resource_name| + if resource_hash[resource_name] + params_merged = params.merge(resource_hash[resource_name]) + else + params_merged = params + end + function_ensure_resource([ type, resource_name, params_merged ]) + } + else + raise(Puppet::ParseError, 'ensure_resources(): Requires second argument to be a Hash') + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/flatten.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/flatten.rb new file mode 100644 index 0000000..4401bdb --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/flatten.rb @@ -0,0 +1,32 @@ +# +# flatten.rb +# + +module Puppet::Parser::Functions + newfunction(:flatten, :type => :rvalue, :doc => <<-EOS +This function flattens any deeply nested arrays and returns a single flat array +as a result. + +*Examples:* + + flatten(['a', ['b', ['c']]]) + +Would return: ['a','b','c'] + EOS + ) do |arguments| + + raise(Puppet::ParseError, "flatten(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + array = arguments[0] + + unless array.is_a?(Array) + raise(Puppet::ParseError, 'flatten(): Requires array to work with') + end + + result = array.flatten + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/floor.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/floor.rb new file mode 100644 index 0000000..9e4b504 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/floor.rb @@ -0,0 +1,22 @@ +module Puppet::Parser::Functions + newfunction(:floor, :type => :rvalue, :doc => <<-EOS + Returns the largest integer less or equal to the argument. + Takes a single numeric value as an argument. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "floor(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + begin + arg = Float(arguments[0]) + rescue TypeError, ArgumentError => e + raise(Puppet::ParseError, "floor(): Wrong argument type given (#{arguments[0]} for Numeric)") + end + + raise(Puppet::ParseError, "floor(): Wrong argument type given (#{arg.class} for Numeric)") if arg.is_a?(Numeric) == false + + arg.floor + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/fqdn_rand_string.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/fqdn_rand_string.rb new file mode 100644 index 0000000..2bb1287 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/fqdn_rand_string.rb @@ -0,0 +1,34 @@ +Puppet::Parser::Functions::newfunction( + :fqdn_rand_string, + :arity => -2, + :type => :rvalue, + :doc => "Usage: `fqdn_rand_string(LENGTH, [CHARSET], [SEED])`. LENGTH is + required and must be a positive integer. CHARSET is optional and may be + `undef` or a string. SEED is optional and may be any number or string. + + Generates a random string LENGTH characters long using the character set + provided by CHARSET, combining the `$fqdn` fact and the value of SEED for + repeatable randomness. (That is, each node will get a different random + string from this function, but a given node's result will be the same every + time unless its hostname changes.) Adding a SEED can be useful if you need + more than one unrelated string. CHARSET will default to alphanumeric if + `undef` or an empty string.") do |args| + raise(ArgumentError, "fqdn_rand_string(): wrong number of arguments (0 for 1)") if args.size == 0 + Puppet::Parser::Functions.function('is_integer') + raise(ArgumentError, "fqdn_rand_string(): first argument must be a positive integer") unless function_is_integer([args[0]]) and args[0].to_i > 0 + raise(ArgumentError, "fqdn_rand_string(): second argument must be undef or a string") unless args[1].nil? or args[1].is_a? String + + Puppet::Parser::Functions.function('fqdn_rand') + + length = args.shift.to_i + charset = args.shift.to_s.chars.to_a + + charset = (0..9).map { |i| i.to_s } + ('A'..'Z').to_a + ('a'..'z').to_a if charset.empty? + + rand_string = '' + for current in 1..length + rand_string << charset[function_fqdn_rand([charset.size, (args + [current.to_s]).join(':')]).to_i] + end + + rand_string +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/fqdn_rotate.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/fqdn_rotate.rb new file mode 100644 index 0000000..05bdcc7 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/fqdn_rotate.rb @@ -0,0 +1,61 @@ +# +# fqdn_rotate.rb +# + +Puppet::Parser::Functions.newfunction( + :fqdn_rotate, + :type => :rvalue, + :doc => "Usage: `fqdn_rotate(VALUE, [SEED])`. VALUE is required and + must be an array or a string. SEED is optional and may be any number + or string. + + Rotates VALUE a random number of times, combining the `$fqdn` fact and + the value of SEED for repeatable randomness. (That is, each node will + get a different random rotation from this function, but a given node's + result will be the same every time unless its hostname changes.) Adding + a SEED can be useful if you need more than one unrelated rotation.") do |args| + + raise(Puppet::ParseError, "fqdn_rotate(): Wrong number of arguments given (#{args.size} for 1)") if args.size < 1 + + value = args.shift + require 'digest/md5' + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'fqdn_rotate(): Requires either array or string to work with') + end + + result = value.clone + + string = value.is_a?(String) ? true : false + + # Check whether it makes sense to rotate ... + return result if result.size <= 1 + + # We turn any string value into an array to be able to rotate ... + result = string ? result.split('') : result + + elements = result.size + + seed = Digest::MD5.hexdigest([lookupvar('::fqdn'),args].join(':')).hex + # deterministic_rand() was added in Puppet 3.2.0; reimplement if necessary + if Puppet::Util.respond_to?(:deterministic_rand) + offset = Puppet::Util.deterministic_rand(seed, elements).to_i + else + if defined?(Random) == 'constant' && Random.class == Class + offset = Random.new(seed).rand(elements) + else + old_seed = srand(seed) + offset = rand(elements) + srand(old_seed) + end + end + offset.times { + result.push result.shift + } + + result = string ? result.join : result + + return result +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/fqdn_uuid.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/fqdn_uuid.rb new file mode 100644 index 0000000..30205d0 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/fqdn_uuid.rb @@ -0,0 +1,92 @@ +require 'digest/sha1' + +module Puppet::Parser::Functions + newfunction(:fqdn_uuid, :type => :rvalue, :doc => <<-END) do |args| + + Creates a UUID based on a given string, assumed to be the FQDN + + For example, to generate a UUID based on the FQDN of a system: + + Usage: + + $uuid = fqdn_uuid($::fqdn) + + The generated UUID will be the same for the given hostname + + The resulting UUID is returned on the form: + + 1d839dea-5e10-5243-88eb-e66815bd7d5c + + (u.e. without any curly braces.) + + The generated UUID is a version 5 UUID with the V5 DNS namespace: + + 6ba7b810-9dad-11d1-80b4-00c04fd430c8 + + This only supports a the V5 SHA-1 hash, using the DNS namespace. + + Please consult http://www.ietf.org/rfc/rfc4122.txt for the details on + UUID generation and example implementation. + + No verification is present at the moment as whether the domain name given + is in fact a correct fully-qualified domain name. Therefore any arbitrary + string and/or alpha-numeric value can subside for a domain name. + EOS + + END + + if args.length == 0 + raise(ArgumentError, "fqdn_uuid: No arguments given") + elsif args.length == 1 + fqdn = args[0] + else + raise(ArgumentError, "fqdn_uuid: Too many arguments given (#{args.length})") + end + + # Code lovingly taken from + # https://github.com/puppetlabs/marionette-collective/blob/master/lib/mcollective/ssl.rb + + # This is the UUID version 5 type DNS name space which is as follows: + # + # 6ba7b810-9dad-11d1-80b4-00c04fd430c8 + # + uuid_name_space_dns = [0x6b, + 0xa7, + 0xb8, + 0x10, + 0x9d, + 0xad, + 0x11, + 0xd1, + 0x80, + 0xb4, + 0x00, + 0xc0, + 0x4f, + 0xd4, + 0x30, + 0xc8 + ].map {|b| b.chr}.join + + sha1 = Digest::SHA1.new + sha1.update(uuid_name_space_dns) + sha1.update(fqdn) + + # first 16 bytes.. + bytes = sha1.digest[0, 16].bytes.to_a + + # version 5 adjustments + bytes[6] &= 0x0f + bytes[6] |= 0x50 + + # variant is DCE 1.1 + bytes[8] &= 0x3f + bytes[8] |= 0x80 + + bytes = [4, 2, 2, 2, 6].collect do |i| + bytes.slice!(0, i).pack('C*').unpack('H*') + end + + bytes.join('-') + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/get_module_path.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/get_module_path.rb new file mode 100644 index 0000000..1421b91 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/get_module_path.rb @@ -0,0 +1,17 @@ +module Puppet::Parser::Functions + newfunction(:get_module_path, :type =>:rvalue, :doc => <<-EOT + Returns the absolute path of the specified module for the current + environment. + + Example: + $module_path = get_module_path('stdlib') + EOT + ) do |args| + raise(Puppet::ParseError, "get_module_path(): Wrong number of arguments, expects one") unless args.size == 1 + if module_path = Puppet::Module.find(args[0], compiler.environment.to_s) + module_path.path + else + raise(Puppet::ParseError, "Could not find module #{args[0]} in environment #{compiler.environment}") + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/getparam.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/getparam.rb new file mode 100644 index 0000000..0a5cbe0 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/getparam.rb @@ -0,0 +1,35 @@ +# Test whether a given class or definition is defined +require 'puppet/parser/functions' + +Puppet::Parser::Functions.newfunction(:getparam, + :type => :rvalue, + :doc => <<-'ENDOFDOC' +Takes a resource reference and name of the parameter and +returns value of resource's parameter. + +*Examples:* + + define example_resource($param) { + } + + example_resource { "example_resource_instance": + param => "param_value" + } + + getparam(Example_resource["example_resource_instance"], "param") + +Would return: param_value +ENDOFDOC +) do |vals| + reference, param = vals + raise(ArgumentError, 'Must specify a reference') unless reference + raise(ArgumentError, 'Must specify name of a parameter') unless param and param.instance_of? String + + return '' if param.empty? + + if resource = findresource(reference.to_s) + return resource[param] unless resource[param].nil? + end + + return '' +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/getvar.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/getvar.rb new file mode 100644 index 0000000..3af8d48 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/getvar.rb @@ -0,0 +1,35 @@ +module Puppet::Parser::Functions + + newfunction(:getvar, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args| + Lookup a variable in a remote namespace. + + For example: + + $foo = getvar('site::data::foo') + # Equivalent to $foo = $site::data::foo + + This is useful if the namespace itself is stored in a string: + + $datalocation = 'site::data' + $bar = getvar("${datalocation}::bar") + # Equivalent to $bar = $site::data::bar + ENDHEREDOC + + unless args.length == 1 + raise Puppet::ParseError, ("getvar(): wrong number of arguments (#{args.length}; must be 1)") + end + + begin + result = nil + catch(:undefined_variable) do + result = self.lookupvar("#{args[0]}") + end + + # avoid relying on incosistent behaviour around ruby return values from catch + result + rescue Puppet::ParseError # Eat the exception if strict_variables = true is set + end + + end + +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/grep.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/grep.rb new file mode 100644 index 0000000..c611a7e --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/grep.rb @@ -0,0 +1,32 @@ +# +# grep.rb +# + +module Puppet::Parser::Functions + newfunction(:grep, :type => :rvalue, :doc => <<-EOS +This function searches through an array and returns any elements that match +the provided regular expression. + +*Examples:* + + grep(['aaa','bbb','ccc','aaaddd'], 'aaa') + +Would return: + + ['aaa','aaaddd'] + EOS + ) do |arguments| + + if (arguments.size != 2) then + raise(Puppet::ParseError, "grep(): Wrong number of arguments given #{arguments.size} for 2") + end + + a = arguments[0] + pattern = Regexp.new(arguments[1]) + + a.grep(pattern) + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/has_interface_with.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/has_interface_with.rb new file mode 100644 index 0000000..f6cb74b --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/has_interface_with.rb @@ -0,0 +1,70 @@ +# +# has_interface_with +# + +module Puppet::Parser::Functions + newfunction(:has_interface_with, :type => :rvalue, :doc => <<-EOS +Returns boolean based on kind and value: + * macaddress + * netmask + * ipaddress + * network + +has_interface_with("macaddress", "x:x:x:x:x:x") +has_interface_with("ipaddress", "127.0.0.1") => true +etc. + +If no "kind" is given, then the presence of the interface is checked: +has_interface_with("lo") => true + EOS + ) do |args| + + raise(Puppet::ParseError, "has_interface_with(): Wrong number of arguments given (#{args.size} for 1 or 2)") if args.size < 1 or args.size > 2 + + interfaces = lookupvar('interfaces') + + # If we do not have any interfaces, then there are no requested attributes + return false if (interfaces == :undefined || interfaces.nil?) + + interfaces = interfaces.split(',') + + if args.size == 1 + return interfaces.member?(args[0]) + end + + kind, value = args + + # Bug with 3.7.1 - 3.7.3 when using future parser throws :undefined_variable + # https://tickets.puppetlabs.com/browse/PUP-3597 + factval = nil + begin + catch :undefined_variable do + factval = lookupvar(kind) + end + rescue Puppet::ParseError # Eat the exception if strict_variables = true is set + end + if factval == value + return true + end + + result = false + interfaces.each do |iface| + iface.downcase! + factval = nil + begin + # Bug with 3.7.1 - 3.7.3 when using future parser throws :undefined_variable + # https://tickets.puppetlabs.com/browse/PUP-3597 + catch :undefined_variable do + factval = lookupvar("#{kind}_#{iface}") + end + rescue Puppet::ParseError # Eat the exception if strict_variables = true is set + end + if value == factval + result = true + break + end + end + + result + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/has_ip_address.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/has_ip_address.rb new file mode 100644 index 0000000..a0071c8 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/has_ip_address.rb @@ -0,0 +1,24 @@ +# +# has_ip_address +# + +module Puppet::Parser::Functions + newfunction(:has_ip_address, :type => :rvalue, :doc => <<-EOS +Returns true if the client has the requested IP address on some interface. + +This function iterates through the 'interfaces' fact and checks the +'ipaddress_IFACE' facts, performing a simple string comparison. + EOS + ) do |args| + + raise(Puppet::ParseError, "has_ip_address(): Wrong number of arguments given (#{args.size} for 1)") if args.size != 1 + + Puppet::Parser::Functions.autoloader.load(:has_interface_with) \ + unless Puppet::Parser::Functions.autoloader.loaded?(:has_interface_with) + + function_has_interface_with(['ipaddress', args[0]]) + + end +end + +# vim:sts=2 sw=2 diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/has_ip_network.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/has_ip_network.rb new file mode 100644 index 0000000..b02c0c0 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/has_ip_network.rb @@ -0,0 +1,24 @@ +# +# has_ip_network +# + +module Puppet::Parser::Functions + newfunction(:has_ip_network, :type => :rvalue, :doc => <<-EOS +Returns true if the client has an IP address within the requested network. + +This function iterates through the 'interfaces' fact and checks the +'network_IFACE' facts, performing a simple string comparision. + EOS + ) do |args| + + raise(Puppet::ParseError, "has_ip_network(): Wrong number of arguments given (#{args.size} for 1)") if args.size != 1 + + Puppet::Parser::Functions.autoloader.load(:has_interface_with) \ + unless Puppet::Parser::Functions.autoloader.loaded?(:has_interface_with) + + function_has_interface_with(['network', args[0]]) + + end +end + +# vim:sts=2 sw=2 diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/has_key.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/has_key.rb new file mode 100644 index 0000000..4657cc2 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/has_key.rb @@ -0,0 +1,28 @@ +module Puppet::Parser::Functions + + newfunction(:has_key, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args| + Determine if a hash has a certain key value. + + Example: + + $my_hash = {'key_one' => 'value_one'} + if has_key($my_hash, 'key_two') { + notice('we will not reach here') + } + if has_key($my_hash, 'key_one') { + notice('this will be printed') + } + + ENDHEREDOC + + unless args.length == 2 + raise Puppet::ParseError, ("has_key(): wrong number of arguments (#{args.length}; must be 2)") + end + unless args[0].is_a?(Hash) + raise Puppet::ParseError, "has_key(): expects the first argument to be a hash, got #{args[0].inspect} which is of type #{args[0].class}" + end + args[0].has_key?(args[1]) + + end + +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/hash.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/hash.rb new file mode 100644 index 0000000..22763f3 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/hash.rb @@ -0,0 +1,39 @@ +# +# hash.rb +# + +module Puppet::Parser::Functions + newfunction(:hash, :type => :rvalue, :doc => <<-EOS +This function converts an array into a hash. + +*Examples:* + + hash(['a',1,'b',2,'c',3]) + +Would return: {'a'=>1,'b'=>2,'c'=>3} + EOS + ) do |arguments| + + raise(Puppet::ParseError, "hash(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + array = arguments[0] + + unless array.is_a?(Array) + raise(Puppet::ParseError, 'hash(): Requires array to work with') + end + + result = {} + + begin + # This is to make it compatible with older version of Ruby ... + array = array.flatten + result = Hash[*array] + rescue StandardError + raise(Puppet::ParseError, 'hash(): Unable to compute hash from array given') + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/intersection.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/intersection.rb new file mode 100644 index 0000000..8a438f4 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/intersection.rb @@ -0,0 +1,33 @@ +# +# intersection.rb +# + +module Puppet::Parser::Functions + newfunction(:intersection, :type => :rvalue, :doc => <<-EOS +This function returns an array of the intersection of two. + +*Examples:* + + intersection(["a","b","c"],["b","c","d"]) # returns ["b","c"] + intersection(["a","b","c"],[1,2,3,4]) # returns [] (true, when evaluated as a Boolean) + + EOS + ) do |arguments| + + # Two arguments are required + raise(Puppet::ParseError, "intersection(): Wrong number of arguments given (#{arguments.size} for 2)") if arguments.size != 2 + + first = arguments[0] + second = arguments[1] + + unless first.is_a?(Array) && second.is_a?(Array) + raise(Puppet::ParseError, 'intersection(): Requires 2 arrays') + end + + result = first & second + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_absolute_path.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_absolute_path.rb new file mode 100644 index 0000000..e64777f --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_absolute_path.rb @@ -0,0 +1,50 @@ +module Puppet::Parser::Functions + newfunction(:is_absolute_path, :type => :rvalue, :arity => 1, :doc => <<-'ENDHEREDOC') do |args| + Returns boolean true if the string represents an absolute path in the filesystem. This function works + for windows and unix style paths. + + The following values will return true: + + $my_path = 'C:/Program Files (x86)/Puppet Labs/Puppet' + is_absolute_path($my_path) + $my_path2 = '/var/lib/puppet' + is_absolute_path($my_path2) + $my_path3 = ['C:/Program Files (x86)/Puppet Labs/Puppet'] + is_absolute_path($my_path3) + $my_path4 = ['/var/lib/puppet'] + is_absolute_path($my_path4) + + The following values will return false: + + is_absolute_path(true) + is_absolute_path('../var/lib/puppet') + is_absolute_path('var/lib/puppet') + $undefined = undef + is_absolute_path($undefined) + + ENDHEREDOC + function_deprecation([:is_absolute_path, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Absolute_path. There is further documentation for validate_legacy function in the README.']) + require 'puppet/util' + + path = args[0] + # This logic was borrowed from + # [lib/puppet/file_serving/base.rb](https://github.com/puppetlabs/puppet/blob/master/lib/puppet/file_serving/base.rb) + # Puppet 2.7 and beyond will have Puppet::Util.absolute_path? Fall back to a back-ported implementation otherwise. + if Puppet::Util.respond_to?(:absolute_path?) then + value = (Puppet::Util.absolute_path?(path, :posix) or Puppet::Util.absolute_path?(path, :windows)) + else + # This code back-ported from 2.7.x's lib/puppet/util.rb Puppet::Util.absolute_path? + # Determine in a platform-specific way whether a path is absolute. This + # defaults to the local platform if none is specified. + # Escape once for the string literal, and once for the regex. + slash = '[\\\\/]' + name = '[^\\\\/]+' + regexes = { + :windows => %r!^(([A-Z]:#{slash})|(#{slash}#{slash}#{name}#{slash}#{name})|(#{slash}#{slash}\?#{slash}#{name}))!i, + :posix => %r!^/! + } + value = (!!(path =~ regexes[:posix])) || (!!(path =~ regexes[:windows])) + end + value + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_array.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_array.rb new file mode 100644 index 0000000..a33afe4 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_array.rb @@ -0,0 +1,21 @@ +# +# is_array.rb +# + +module Puppet::Parser::Functions + newfunction(:is_array, :type => :rvalue, :doc => <<-EOS +Returns true if the variable passed to this function is an array. + EOS + ) do |arguments| + + function_deprecation([:is_array, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Array. There is further documentation for validate_legacy function in the README.']) + + raise(Puppet::ParseError, "is_array(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + type = arguments[0] + + result = type.is_a?(Array) + + return result + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_bool.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_bool.rb new file mode 100644 index 0000000..2ebe430 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_bool.rb @@ -0,0 +1,21 @@ +# +# is_bool.rb +# + +module Puppet::Parser::Functions + newfunction(:is_bool, :type => :rvalue, :doc => <<-EOS +Returns true if the variable passed to this function is a boolean. + EOS + ) do |arguments| + + function_deprecation([:is_bool, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Bool. There is further documentation for validate_legacy function in the README.']) + + raise(Puppet::ParseError, "is_bool(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + type = arguments[0] + + result = type.is_a?(TrueClass) || type.is_a?(FalseClass) + + return result + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_domain_name.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_domain_name.rb new file mode 100644 index 0000000..247db3b --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_domain_name.rb @@ -0,0 +1,53 @@ +# +# is_domain_name.rb +# + +module Puppet::Parser::Functions + newfunction(:is_domain_name, :type => :rvalue, :doc => <<-EOS +Returns true if the string passed to this function is a syntactically correct domain name. + EOS + ) do |arguments| + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_domain_name(): Wrong number of arguments given #{arguments.size} for 1") + end + + # Only allow string types + return false unless arguments[0].is_a?(String) + + domain = arguments[0].dup + + # Limits (rfc1035, 3.1) + domain_max_length=255 + label_min_length=1 + label_max_length=63 + + # Allow ".", it is the top level domain + return true if domain == '.' + + # Remove the final dot, if present. + domain.chomp!('.') + + # Check the whole domain + return false if domain.empty? + return false if domain.length > domain_max_length + + # The top level domain must be alphabetic if there are multiple labels. + # See rfc1123, 2.1 + return false if domain.include? '.' and not /\.[A-Za-z]+$/.match(domain) + + # Check each label in the domain + labels = domain.split('.') + vlabels = labels.each do |label| + break if label.length < label_min_length + break if label.length > label_max_length + break if label[-1..-1] == '-' + break if label[0..0] == '-' + break unless /^[a-z\d-]+$/i.match(label) + end + return vlabels == labels + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_email_address.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_email_address.rb new file mode 100644 index 0000000..bcd7921 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_email_address.rb @@ -0,0 +1,20 @@ +# +# is_email_address.rb +# + +module Puppet::Parser::Functions + newfunction(:is_email_address, :type => :rvalue, :doc => <<-EOS +Returns true if the string passed to this function is a valid email address. + EOS + ) do |arguments| + if arguments.size != 1 + raise(Puppet::ParseError, "is_email_address(): Wrong number of arguments given #{arguments.size} for 1") + end + + # Taken from http://emailregex.com/ (simpler regex) + valid_email_regex = %r{\A([\w+\-].?)+@[a-z\d\-]+(\.[a-z]+)*\.[a-z]+\z} + return (arguments[0] =~ valid_email_regex) == 0 + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_float.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_float.rb new file mode 100644 index 0000000..aa84a2b --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_float.rb @@ -0,0 +1,31 @@ +# +# is_float.rb +# + +module Puppet::Parser::Functions + newfunction(:is_float, :type => :rvalue, :doc => <<-EOS +Returns true if the variable passed to this function is a float. + EOS + ) do |arguments| + + function_deprecation([:is_float, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Float. There is further documentation for validate_legacy function in the README.']) + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_float(): Wrong number of arguments given #{arguments.size} for 1") + end + + value = arguments[0] + + # Only allow Numeric or String types + return false unless value.is_a?(Numeric) or value.is_a?(String) + + if value != value.to_f.to_s and !value.is_a? Float then + return false + else + return true + end + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_function_available.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_function_available.rb new file mode 100644 index 0000000..50cd5e1 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_function_available.rb @@ -0,0 +1,25 @@ +# +# is_function_available.rb +# + +module Puppet::Parser::Functions + newfunction(:is_function_available, :type => :rvalue, :doc => <<-EOS +This function accepts a string as an argument, determines whether the +Puppet runtime has access to a function by that name. It returns a +true if the function exists, false if not. + EOS + ) do |arguments| + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_function_available?(): Wrong number of arguments given #{arguments.size} for 1") + end + + # Only allow String types + return false unless arguments[0].is_a?(String) + + function = Puppet::Parser::Functions.function(arguments[0].to_sym) + function.is_a?(String) and not function.empty? + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_hash.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_hash.rb new file mode 100644 index 0000000..3162f7d --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_hash.rb @@ -0,0 +1,21 @@ +# +# is_hash.rb +# + +module Puppet::Parser::Functions + newfunction(:is_hash, :type => :rvalue, :doc => <<-EOS +Returns true if the variable passed to this function is a hash. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "is_hash(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + type = arguments[0] + + result = type.is_a?(Hash) + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_integer.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_integer.rb new file mode 100644 index 0000000..8965b15 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_integer.rb @@ -0,0 +1,46 @@ +# +# is_integer.rb +# + +module Puppet::Parser::Functions + newfunction(:is_integer, :type => :rvalue, :doc => <<-EOS +Returns true if the variable passed to this function is an Integer or +a decimal (base 10) integer in String form. The string may +start with a '-' (minus). A value of '0' is allowed, but a leading '0' digit may not +be followed by other digits as this indicates that the value is octal (base 8). + +If given any other argument `false` is returned. + EOS + ) do |arguments| + + function_deprecation([:is_integer, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Integer. There is further documentation for validate_legacy function in the README.']) + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_integer(): Wrong number of arguments given #{arguments.size} for 1") + end + + value = arguments[0] + + # Regex is taken from the lexer of puppet + # puppet/pops/parser/lexer.rb but modified to match also + # negative values and disallow numbers prefixed with multiple + # 0's + # + # TODO these parameter should be a constant but I'm not sure + # if there is no risk to declare it inside of the module + # Puppet::Parser::Functions + + # Integer numbers like + # -1234568981273 + # 47291 + numeric = %r{^-?(?:(?:[1-9]\d*)|0)$} + + if value.is_a? Integer or (value.is_a? String and value.match numeric) + return true + else + return false + end + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_ip_address.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_ip_address.rb new file mode 100644 index 0000000..79ddb98 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_ip_address.rb @@ -0,0 +1,33 @@ +# +# is_ip_address.rb +# + +module Puppet::Parser::Functions + newfunction(:is_ip_address, :type => :rvalue, :doc => <<-EOS +Returns true if the string passed to this function is a valid IP address. + EOS + ) do |arguments| + + require 'ipaddr' + + function_deprecation([:is_ip_address, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ip_address. There is further documentation for validate_legacy function in the README.']) + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_ip_address(): Wrong number of arguments given #{arguments.size} for 1") + end + + begin + ip = IPAddr.new(arguments[0]) + rescue ArgumentError + return false + end + + if ip.ipv4? or ip.ipv6? then + return true + else + return false + end + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_ipv4_address.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_ipv4_address.rb new file mode 100644 index 0000000..91869b6 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_ipv4_address.rb @@ -0,0 +1,29 @@ +# +# is_ipv4_address.rb +# + +module Puppet::Parser::Functions + newfunction(:is_ipv4_address, :type => :rvalue, :doc => <<-EOS +Returns true if the string passed to this function is a valid IPv4 address. + EOS + ) do |arguments| + + require 'ipaddr' + + function_deprecation([:is_ipv4_address, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ipv4. There is further documentation for validate_legacy function in the README.']) + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_ipv4_address(): Wrong number of arguments given #{arguments.size} for 1") + end + + begin + ip = IPAddr.new(arguments[0]) + rescue ArgumentError + return false + end + + return ip.ipv4? + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_ipv6_address.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_ipv6_address.rb new file mode 100644 index 0000000..4d96202 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_ipv6_address.rb @@ -0,0 +1,29 @@ +# +# is_ipv6_address.rb +# + +module Puppet::Parser::Functions + newfunction(:is_ipv6_address, :type => :rvalue, :doc => <<-EOS +Returns true if the string passed to this function is a valid IPv6 address. + EOS + ) do |arguments| + + function_deprecation([:is_ipv6_address, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ipv6. There is further documentation for validate_legacy function in the README.']) + + require 'ipaddr' + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_ipv6_address(): Wrong number of arguments given #{arguments.size} for 1") + end + + begin + ip = IPAddr.new(arguments[0]) + rescue ArgumentError + return false + end + + return ip.ipv6? + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_mac_address.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_mac_address.rb new file mode 100644 index 0000000..5993ed2 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_mac_address.rb @@ -0,0 +1,26 @@ +# +# is_mac_address.rb +# + +module Puppet::Parser::Functions + newfunction(:is_mac_address, :type => :rvalue, :doc => <<-EOS +Returns true if the string passed to this function is a valid mac address. + EOS + ) do |arguments| + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_mac_address(): Wrong number of arguments given #{arguments.size} for 1") + end + + mac = arguments[0] + + if /^[a-f0-9]{1,2}(:[a-f0-9]{1,2}){5}$/i.match(mac) then + return true + else + return false + end + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_numeric.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_numeric.rb new file mode 100644 index 0000000..7800edd --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_numeric.rb @@ -0,0 +1,74 @@ +# +# is_numeric.rb +# + +module Puppet::Parser::Functions + newfunction(:is_numeric, :type => :rvalue, :doc => <<-EOS +Returns true if the given argument is a Numeric (Integer or Float), +or a String containing either a valid integer in decimal base 10 form, or +a valid floating point string representation. + +The function recognizes only decimal (base 10) integers and float but not +integers in hex (base 16) or octal (base 8) form. + +The string representation may start with a '-' (minus). If a decimal '.' is used, +it must be followed by at least one digit. + +Valid examples: + + 77435 + 10e-12 + -8475 + 0.2343 + -23.561e3 + EOS + ) do |arguments| + + function_deprecation([:is_numeric, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Numeric. There is further documentation for validate_legacy function in the README.']) + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_numeric(): Wrong number of arguments given #{arguments.size} for 1") + end + + value = arguments[0] + + # Regex is taken from the lexer of puppet + # puppet/pops/parser/lexer.rb but modified to match also + # negative values and disallow invalid octal numbers or + # numbers prefixed with multiple 0's (except in hex numbers) + # + # TODO these parameters should be constants but I'm not sure + # if there is no risk to declare them inside of the module + # Puppet::Parser::Functions + + # TODO decide if this should be used + # HEX numbers like + # 0xaa230F + # 0X1234009C + # 0x0012 + # -12FcD + #numeric_hex = %r{^-?0[xX][0-9A-Fa-f]+$} + + # TODO decide if this should be used + # OCTAL numbers like + # 01234567 + # -045372 + #numeric_oct = %r{^-?0[1-7][0-7]*$} + + # Integer/Float numbers like + # -0.1234568981273 + # 47291 + # 42.12345e-12 + numeric = %r{^-?(?:(?:[1-9]\d*)|0)(?:\.\d+)?(?:[eE]-?\d+)?$} + + if value.is_a? Numeric or (value.is_a? String and ( + value.match(numeric) #or + # value.match(numeric_hex) or + # value.match(numeric_oct) + )) + return true + else + return false + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_string.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_string.rb new file mode 100644 index 0000000..0ed6aec --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/is_string.rb @@ -0,0 +1,28 @@ +# +# is_string.rb +# + +module Puppet::Parser::Functions + newfunction(:is_string, :type => :rvalue, :doc => <<-EOS +Returns true if the variable passed to this function is a string. + EOS + ) do |arguments| + + function_deprecation([:is_string, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::String. There is further documentation for validate_legacy function in the README.']) + + raise(Puppet::ParseError, "is_string(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + type = arguments[0] + + # when called through the v4 API shim, undef gets translated to nil + result = type.is_a?(String) || type.nil? + + if result and (type == type.to_f.to_s or type == type.to_i.to_s) then + return false + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/join.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/join.rb new file mode 100644 index 0000000..1c17997 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/join.rb @@ -0,0 +1,40 @@ +# +# join.rb +# + +module Puppet::Parser::Functions + newfunction(:join, :type => :rvalue, :doc => <<-EOS +This function joins an array into a string using a separator. + +*Examples:* + + join(['a','b','c'], ",") + +Would result in: "a,b,c" + EOS + ) do |arguments| + + # Technically we support two arguments but only first is mandatory ... + raise(Puppet::ParseError, "join(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + array = arguments[0] + + unless array.is_a?(Array) + raise(Puppet::ParseError, 'join(): Requires array to work with') + end + + suffix = arguments[1] if arguments[1] + + if suffix + unless suffix.is_a?(String) + raise(Puppet::ParseError, 'join(): Requires string to work with') + end + end + + result = suffix ? array.join(suffix) : array.join + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/join_keys_to_values.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/join_keys_to_values.rb new file mode 100644 index 0000000..d8966ba --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/join_keys_to_values.rb @@ -0,0 +1,53 @@ +# +# join.rb +# + +module Puppet::Parser::Functions + newfunction(:join_keys_to_values, :type => :rvalue, :doc => <<-EOS +This function joins each key of a hash to that key's corresponding value with a +separator. Keys are cast to strings. If values are arrays, multiple keys +are added for each element. The return value is an array in +which each element is one joined key/value pair. + +*Examples:* + + join_keys_to_values({'a'=>1,'b'=>2}, " is ") + +Would result in: ["a is 1","b is 2"] + + join_keys_to_values({'a'=>1,'b'=>[2,3]}, " is ") + +Would result in: ["a is 1","b is 2","b is 3"] + EOS + ) do |arguments| + + # Validate the number of arguments. + if arguments.size != 2 + raise(Puppet::ParseError, "join_keys_to_values(): Takes exactly two arguments, but #{arguments.size} given.") + end + + # Validate the first argument. + hash = arguments[0] + if not hash.is_a?(Hash) + raise(TypeError, "join_keys_to_values(): The first argument must be a hash, but a #{hash.class} was given.") + end + + # Validate the second argument. + separator = arguments[1] + if not separator.is_a?(String) + raise(TypeError, "join_keys_to_values(): The second argument must be a string, but a #{separator.class} was given.") + end + + # Join the keys to their values. + hash.map do |k,v| + if v.is_a?(Array) + v.map { |va| String(k) + separator + String(va) } + else + String(k) + separator + String(v) + end + end.flatten + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/keys.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/keys.rb new file mode 100644 index 0000000..199e319 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/keys.rb @@ -0,0 +1,25 @@ +# +# keys.rb +# + +module Puppet::Parser::Functions + newfunction(:keys, :type => :rvalue, :doc => <<-EOS +Returns the keys of a hash as an array. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "keys(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + hash = arguments[0] + + unless hash.is_a?(Hash) + raise(Puppet::ParseError, 'keys(): Requires hash to work with') + end + + result = hash.keys + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/load_module_metadata.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/load_module_metadata.rb new file mode 100644 index 0000000..c9b8488 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/load_module_metadata.rb @@ -0,0 +1,24 @@ +module Puppet::Parser::Functions + newfunction(:load_module_metadata, :type => :rvalue, :doc => <<-EOT + EOT + ) do |args| + raise(Puppet::ParseError, "load_module_metadata(): Wrong number of arguments, expects one or two") unless [1,2].include?(args.size) + mod = args[0] + allow_empty_metadata = args[1] + module_path = function_get_module_path([mod]) + metadata_json = File.join(module_path, 'metadata.json') + + metadata_exists = File.exists?(metadata_json) + if metadata_exists + metadata = PSON.load(File.read(metadata_json)) + else + if allow_empty_metadata + metadata = {} + else + raise(Puppet::ParseError, "load_module_metadata(): No metadata.json file for module #{mod}") + end + end + + return metadata + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/loadjson.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/loadjson.rb new file mode 100644 index 0000000..3a3372b --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/loadjson.rb @@ -0,0 +1,34 @@ +module Puppet::Parser::Functions + newfunction(:loadjson, :type => :rvalue, :arity => -2, :doc => <<-'ENDHEREDOC') do |args| +Load a JSON file containing an array, string, or hash, and return the data +in the corresponding native data type. +The second parameter is the default value. It will be returned if the file +was not found or could not be parsed. + +For example: + + $myhash = loadjson('/etc/puppet/data/myhash.json') + $myhash = loadjson('no-file.json', {'default' => 'value'}) + ENDHEREDOC + + raise ArgumentError, 'Wrong number of arguments. 1 or 2 arguments should be provided.' unless args.length >= 1 + + if File.exists?(args[0]) + begin + content = File.read(args[0]) + PSON::load(content) || args[1] + rescue Exception => e + if args[1] + args[1] + else + raise e + end + end + else + warning("Can't load '#{args[0]}' File does not exist!") + args[1] + end + + end + +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/loadyaml.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/loadyaml.rb new file mode 100644 index 0000000..9696362 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/loadyaml.rb @@ -0,0 +1,34 @@ +module Puppet::Parser::Functions + newfunction(:loadyaml, :type => :rvalue, :arity => -2, :doc => <<-'ENDHEREDOC') do |args| +Load a YAML file containing an array, string, or hash, and return the data +in the corresponding native data type. +The second parameter is the default value. It will be returned if the file +was not found or could not be parsed. + +For example: + + $myhash = loadyaml('/etc/puppet/data/myhash.yaml') + $myhash = loadyaml('no-file.yaml', {'default' => 'value'}) + ENDHEREDOC + + raise ArgumentError, 'Wrong number of arguments. 1 or 2 arguments should be provided.' unless args.length >= 1 + require 'yaml' + + if File.exists?(args[0]) + begin + YAML::load_file(args[0]) || args[1] + rescue Exception => e + if args[1] + args[1] + else + raise e + end + end + else + warning("Can't load '#{args[0]}' File does not exist!") + args[1] + end + + end + +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/lstrip.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/lstrip.rb new file mode 100644 index 0000000..9a9ee29 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/lstrip.rb @@ -0,0 +1,30 @@ +# +# lstrip.rb +# + +module Puppet::Parser::Functions + newfunction(:lstrip, :type => :rvalue, :doc => <<-EOS +Strips leading spaces to the left of a string. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "lstrip(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'lstrip(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.lstrip : i } + else + result = value.lstrip + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/max.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/max.rb new file mode 100644 index 0000000..758c42c --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/max.rb @@ -0,0 +1,20 @@ +module Puppet::Parser::Functions + newfunction(:max, :type => :rvalue, :doc => <<-EOS + Returns the highest value of all arguments. + Requires at least one argument. + EOS + ) do |args| + + raise(Puppet::ParseError, "max(): Wrong number of arguments need at least one") if args.size == 0 + + # Sometimes we get numbers as numerics and sometimes as strings. + # We try to compare them as numbers when possible + return args.max do |a,b| + if a.to_s =~ /\A-?\d+(.\d+)?\z/ and b.to_s =~ /\A-?\d+(.\d+)?\z/ then + a.to_f <=> b.to_f + else + a.to_s <=> b.to_s + end + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/member.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/member.rb new file mode 100644 index 0000000..fb93452 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/member.rb @@ -0,0 +1,60 @@ +# +# member.rb +# + +# TODO(Krzysztof Wilczynski): We need to add support for regular expression ... +# TODO(Krzysztof Wilczynski): Support for strings and hashes too ... + +module Puppet::Parser::Functions + newfunction(:member, :type => :rvalue, :doc => <<-EOS +This function determines if a variable is a member of an array. +The variable can be a string, fixnum, or array. + +*Examples:* + + member(['a','b'], 'b') + +Would return: true + + member(['a', 'b', 'c'], ['a', 'b']) + +would return: true + + member(['a','b'], 'c') + +Would return: false + + member(['a', 'b', 'c'], ['d', 'b']) + +would return: false + EOS + ) do |arguments| + + raise(Puppet::ParseError, "member(): Wrong number of arguments given (#{arguments.size} for 2)") if arguments.size < 2 + + array = arguments[0] + + unless array.is_a?(Array) + raise(Puppet::ParseError, 'member(): Requires array to work with') + end + + unless arguments[1].is_a? String or arguments[1].is_a? Fixnum or arguments[1].is_a? Array + raise(Puppet::ParseError, 'member(): Item to search for must be a string, fixnum, or array') + end + + if arguments[1].is_a? String or arguments[1].is_a? Fixnum + item = [arguments[1]] + else + item = arguments[1] + end + + + raise(Puppet::ParseError, 'member(): You must provide item to search for within array given') if item.respond_to?('empty?') && item.empty? + + result = (item - array).empty? + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/merge.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/merge.rb new file mode 100644 index 0000000..1b39f20 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/merge.rb @@ -0,0 +1,34 @@ +module Puppet::Parser::Functions + newfunction(:merge, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args| + Merges two or more hashes together and returns the resulting hash. + + For example: + + $hash1 = {'one' => 1, 'two', => 2} + $hash2 = {'two' => 'dos', 'three', => 'tres'} + $merged_hash = merge($hash1, $hash2) + # The resulting hash is equivalent to: + # $merged_hash = {'one' => 1, 'two' => 'dos', 'three' => 'tres'} + + When there is a duplicate key, the key in the rightmost hash will "win." + + ENDHEREDOC + + if args.length < 2 + raise Puppet::ParseError, ("merge(): wrong number of arguments (#{args.length}; must be at least 2)") + end + + # The hash we accumulate into + accumulator = Hash.new + # Merge into the accumulator hash + args.each do |arg| + next if arg.is_a? String and arg.empty? # empty string is synonym for puppet's undef + unless arg.is_a?(Hash) + raise Puppet::ParseError, "merge: unexpected argument type #{arg.class}, only expects hash arguments" + end + accumulator.merge!(arg) + end + # Return the fully merged hash + accumulator + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/min.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/min.rb new file mode 100644 index 0000000..f10a2b2 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/min.rb @@ -0,0 +1,20 @@ +module Puppet::Parser::Functions + newfunction(:min, :type => :rvalue, :doc => <<-EOS + Returns the lowest value of all arguments. + Requires at least one argument. + EOS + ) do |args| + + raise(Puppet::ParseError, "min(): Wrong number of arguments need at least one") if args.size == 0 + + # Sometimes we get numbers as numerics and sometimes as strings. + # We try to compare them as numbers when possible + return args.min do |a,b| + if a.to_s =~ /\A^-?\d+(.\d+)?\z/ and b.to_s =~ /\A-?\d+(.\d+)?\z/ then + a.to_f <=> b.to_f + else + a.to_s <=> b.to_s + end + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/num2bool.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/num2bool.rb new file mode 100644 index 0000000..9ad59b2 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/num2bool.rb @@ -0,0 +1,42 @@ +# +# num2bool.rb +# + +module Puppet::Parser::Functions + newfunction(:num2bool, :type => :rvalue, :doc => <<-EOS +This function converts a number or a string representation of a number into a +true boolean. Zero or anything non-numeric becomes false. Numbers higher then 0 +become true. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "num2bool(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + number = arguments[0] + + case number + when Numeric + # Yay, it's a number + when String + begin + number = Float(number) + rescue ArgumentError => ex + raise(Puppet::ParseError, "num2bool(): '#{number}' does not look like a number: #{ex.message}") + end + else + begin + number = number.to_s + rescue NoMethodError => ex + raise(Puppet::ParseError, "num2bool(): Unable to parse argument: #{ex.message}") + end + end + + # Truncate Floats + number = number.to_i + + # Return true for any positive number and false otherwise + return number > 0 + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/parsejson.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/parsejson.rb new file mode 100644 index 0000000..f7c2896 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/parsejson.rb @@ -0,0 +1,29 @@ +# +# parsejson.rb +# + +module Puppet::Parser::Functions + newfunction(:parsejson, :type => :rvalue, :doc => <<-EOS +This function accepts JSON as a string and converts it into the correct +Puppet structure. + +The optional second argument can be used to pass a default value that will +be returned if the parsing of YAML string have failed. + EOS + ) do |arguments| + raise ArgumentError, 'Wrong number of arguments. 1 or 2 arguments should be provided.' unless arguments.length >= 1 + + begin + PSON::load(arguments[0]) || arguments[1] + rescue StandardError => e + if arguments[1] + arguments[1] + else + raise e + end + end + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/parseyaml.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/parseyaml.rb new file mode 100644 index 0000000..ba9d98a --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/parseyaml.rb @@ -0,0 +1,33 @@ +# +# parseyaml.rb +# + +module Puppet::Parser::Functions + newfunction(:parseyaml, :type => :rvalue, :doc => <<-EOS +This function accepts YAML as a string and converts it into the correct +Puppet structure. + +The optional second argument can be used to pass a default value that will +be returned if the parsing of YAML string have failed. + EOS + ) do |arguments| + raise ArgumentError, 'Wrong number of arguments. 1 or 2 arguments should be provided.' unless arguments.length >= 1 + require 'yaml' + + begin + YAML::load(arguments[0]) || arguments[1] + # in ruby 1.9.3 Psych::SyntaxError is a RuntimeException + # this still needs to catch that and work also on rubies that + # do not have Psych available. + rescue StandardError, Psych::SyntaxError => e + if arguments[1] + arguments[1] + else + raise e + end + end + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/pick.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/pick.rb new file mode 100644 index 0000000..fdd0aef --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/pick.rb @@ -0,0 +1,29 @@ +module Puppet::Parser::Functions + newfunction(:pick, :type => :rvalue, :doc => <<-EOS + +This function is similar to a coalesce function in SQL in that it will return +the first value in a list of values that is not undefined or an empty string +(two things in Puppet that will return a boolean false value). Typically, +this function is used to check for a value in the Puppet Dashboard/Enterprise +Console, and failover to a default value like the following: + + $real_jenkins_version = pick($::jenkins_version, '1.449') + +The value of $real_jenkins_version will first look for a top-scope variable +called 'jenkins_version' (note that parameters set in the Puppet Dashboard/ +Enterprise Console are brought into Puppet as top-scope variables), and, +failing that, will use a default value of 1.449. + +EOS +) do |args| + args = args.compact + args.delete(:undef) + args.delete(:undefined) + args.delete("") + if args[0].to_s.empty? then + fail Puppet::ParseError, "pick(): must receive at least one non empty value" + else + return args[0] + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/pick_default.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/pick_default.rb new file mode 100644 index 0000000..36e33ab --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/pick_default.rb @@ -0,0 +1,35 @@ +module Puppet::Parser::Functions + newfunction(:pick_default, :type => :rvalue, :doc => <<-EOS + +This function is similar to a coalesce function in SQL in that it will return +the first value in a list of values that is not undefined or an empty string +(two things in Puppet that will return a boolean false value). If no value is +found, it will return the last argument. + +Typically, this function is used to check for a value in the Puppet +Dashboard/Enterprise Console, and failover to a default value like the +following: + + $real_jenkins_version = pick_default($::jenkins_version, '1.449') + +The value of $real_jenkins_version will first look for a top-scope variable +called 'jenkins_version' (note that parameters set in the Puppet Dashboard/ +Enterprise Console are brought into Puppet as top-scope variables), and, +failing that, will use a default value of 1.449. + +Note that, contrary to the pick() function, the pick_default does not fail if +all arguments are empty. This allows pick_default to use an empty value as +default. + +EOS +) do |args| + fail "Must receive at least one argument." if args.empty? + default = args.last + args = args[0..-2].compact + args.delete(:undef) + args.delete(:undefined) + args.delete("") + args << default + return args[0] + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/prefix.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/prefix.rb new file mode 100644 index 0000000..b1c1e35 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/prefix.rb @@ -0,0 +1,51 @@ +# +# prefix.rb +# + +module Puppet::Parser::Functions + newfunction(:prefix, :type => :rvalue, :doc => <<-EOS +This function applies a prefix to all elements in an array or a hash. + +*Examples:* + + prefix(['a','b','c'], 'p') + +Will return: ['pa','pb','pc'] + EOS + ) do |arguments| + + # Technically we support two arguments but only first is mandatory ... + raise(Puppet::ParseError, "prefix(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + enumerable = arguments[0] + + unless enumerable.is_a?(Array) or enumerable.is_a?(Hash) + raise Puppet::ParseError, "prefix(): expected first argument to be an Array or a Hash, got #{enumerable.inspect}" + end + + prefix = arguments[1] if arguments[1] + + if prefix + unless prefix.is_a?(String) + raise Puppet::ParseError, "prefix(): expected second argument to be a String, got #{prefix.inspect}" + end + end + + if enumerable.is_a?(Array) + # Turn everything into string same as join would do ... + result = enumerable.collect do |i| + i = i.to_s + prefix ? prefix + i : i + end + else + result = Hash[enumerable.map do |k,v| + k = k.to_s + [ prefix ? prefix + k : k, v ] + end] + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/private.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/private.rb new file mode 100644 index 0000000..3b00ba1 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/private.rb @@ -0,0 +1,17 @@ +# +# private.rb +# + +module Puppet::Parser::Functions + newfunction(:private, :doc => <<-'EOS' + DEPRECATED: Sets the current class or definition as private. + Calling the class or definition from outside the current module will fail. + EOS + ) do |args| + warning("private() DEPRECATED: This function will cease to function on Puppet 4; please use assert_private() before upgrading to puppet 4 for backwards-compatibility, or migrate to the new parser's typing system.") + if !Puppet::Parser::Functions.autoloader.loaded?(:assert_private) + Puppet::Parser::Functions.autoloader.load(:assert_private) + end + function_assert_private([(args[0] unless args.size < 1)]) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/pry.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/pry.rb new file mode 100644 index 0000000..c18ef7e --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/pry.rb @@ -0,0 +1,30 @@ +# +# pry.rb +# + +module Puppet::Parser::Functions + newfunction(:pry, :type => :statement, :doc => <<-EOS +This function invokes a pry debugging session in the current scope object. This is useful for debugging manifest code at specific points during a compilation. + +*Examples:* + + pry() + EOS + ) do |arguments| + begin + require 'pry' + rescue LoadError + raise(Puppet::Error, "pry(): Requires the 'pry' rubygem to use, but it was not found") + end + # + ## Run `catalog` to see the contents currently compiling catalog + ## Run `cd catalog` and `ls` to see catalog methods and instance variables + ## Run `@resource_table` to see the current catalog resource table + # + if $stdout.isatty + binding.pry # rubocop:disable Lint/Debugger + else + Puppet.warning 'pry(): cowardly refusing to start the debugger on a daemonized master' + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/pw_hash.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/pw_hash.rb new file mode 100644 index 0000000..d99ee5b --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/pw_hash.rb @@ -0,0 +1,59 @@ + +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +Puppet::Parser::Functions::newfunction( + :pw_hash, + :type => :rvalue, + :arity => 3, + :doc => "Hashes a password using the crypt function. Provides a hash + usable on most POSIX systems. + + The first argument to this function is the password to hash. If it is + undef or an empty string, this function returns undef. + + The second argument to this function is which type of hash to use. It + will be converted into the appropriate crypt(3) hash specifier. Valid + hash types are: + + |Hash type |Specifier| + |---------------------|---------| + |MD5 |1 | + |SHA-256 |5 | + |SHA-512 (recommended)|6 | + + The third argument to this function is the salt to use. + + Note: this uses the Puppet Master's implementation of crypt(3). If your + environment contains several different operating systems, ensure that they + are compatible before using this function.") do |args| + raise ArgumentError, "pw_hash(): wrong number of arguments (#{args.size} for 3)" if args.size != 3 + raise ArgumentError, "pw_hash(): first argument must be a string" unless args[0].is_a? String or args[0].nil? + raise ArgumentError, "pw_hash(): second argument must be a string" unless args[1].is_a? String + hashes = { 'md5' => '1', + 'sha-256' => '5', + 'sha-512' => '6' } + hash_type = hashes[args[1].downcase] + raise ArgumentError, "pw_hash(): #{args[1]} is not a valid hash type" if hash_type.nil? + raise ArgumentError, "pw_hash(): third argument must be a string" unless args[2].is_a? String + raise ArgumentError, "pw_hash(): third argument must not be empty" if args[2].empty? + raise ArgumentError, "pw_hash(): characters in salt must be in the set [a-zA-Z0-9./]" unless args[2].match(/\A[a-zA-Z0-9.\/]+\z/) + + password = args[0] + return nil if password.nil? or password.empty? + + salt = "$#{hash_type}$#{args[2]}" + + # handle weak implementations of String#crypt + if 'test'.crypt('$1$1') != '$1$1$Bp8CU9Oujr9SSEw53WV6G.' + # JRuby < 1.7.17 + if RUBY_PLATFORM == 'java' + # puppetserver bundles Apache Commons Codec + org.apache.commons.codec.digest.Crypt.crypt(password.to_java_bytes, salt) + else + # MS Windows and other systems that don't support enhanced salts + raise Puppet::ParseError, 'system does not support enhanced salts' + end + else + password.crypt(salt) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/range.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/range.rb new file mode 100644 index 0000000..72c373a --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/range.rb @@ -0,0 +1,85 @@ +# +# range.rb +# + +# TODO(Krzysztof Wilczynski): We probably need to approach numeric values differently ... + +module Puppet::Parser::Functions + newfunction(:range, :type => :rvalue, :doc => <<-EOS +When given range in the form of (start, stop) it will extrapolate a range as +an array. + +*Examples:* + + range("0", "9") + +Will return: [0,1,2,3,4,5,6,7,8,9] + + range("00", "09") + +Will return: [0,1,2,3,4,5,6,7,8,9] (Zero padded strings are converted to +integers automatically) + + range("a", "c") + +Will return: ["a","b","c"] + + range("host01", "host10") +Will return: ["host01", "host02", ..., "host09", "host10"] +NB Be explicit in including trailing zeros. Otherwise the underlying ruby function will fail. + +Passing a third argument will cause the generated range to step by that +interval, e.g. + + range("0", "9", "2") + +Will return: [0,2,4,6,8] + EOS + ) do |arguments| + + raise(Puppet::ParseError, 'range(): Wrong number of arguments given (0 for 1)') if arguments.size == 0 + + if arguments.size > 1 + start = arguments[0] + stop = arguments[1] + step = arguments[2].nil? ? 1 : arguments[2].to_i.abs + + type = '..' # Use the simplest type of Range available in Ruby + + else # arguments.size == 1 + value = arguments[0] + + if m = value.match(/^(\w+)(\.\.\.?|\-)(\w+)$/) + start = m[1] + stop = m[3] + + type = m[2] + step = 1 + elsif value.match(/^.+$/) + raise(Puppet::ParseError, "range(): Unable to compute range from the value: #{value}") + else + raise(Puppet::ParseError, "range(): Unknown range format: #{value}") + end + end + + # If we were given an integer, ensure we work with one + if start.to_s.match(/^\d+$/) + start = start.to_i + stop = stop.to_i + else + start = start.to_s + stop = stop.to_s + end + + range = case type + when /^(\.\.|\-)$/ then (start .. stop) + when '...' then (start ... stop) # Exclusive of last element + end + + result = range.step(step).to_a + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/regexpescape.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/regexpescape.rb new file mode 100644 index 0000000..2cfa3bb --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/regexpescape.rb @@ -0,0 +1,29 @@ +# +# regexpescape.rb +# +module Puppet::Parser::Functions + newfunction(:regexpescape, :type => :rvalue, :doc => <<-EOS + Regexp escape a string or array of strings. + Requires either a single string or an array as an input. + EOS + ) do |arguments| # rubocop:disable Style/ClosingParenthesisIndentation + raise(Puppet::ParseError, "regexpescape(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.empty? + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'regexpescape(): Requires either array or string to work with') + end + + result = if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + value.collect { |i| i.is_a?(String) ? Regexp.escape(i) : i } + else + Regexp.escape(value) + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/reject.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/reject.rb new file mode 100644 index 0000000..1953ffc --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/reject.rb @@ -0,0 +1,31 @@ +# +# reject.rb +# + +module Puppet::Parser::Functions + newfunction(:reject, :type => :rvalue, :doc => <<-EOS) do |args| +This function searches through an array and rejects all elements that match +the provided regular expression. + +*Examples:* + + reject(['aaa','bbb','ccc','aaaddd'], 'aaa') + +Would return: + + ['bbb','ccc'] +EOS + + if (args.size != 2) + raise Puppet::ParseError, + "reject(): Wrong number of arguments given #{args.size} for 2" + end + + ary = args[0] + pattern = Regexp.new(args[1]) + + ary.reject { |e| e =~ pattern } + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/reverse.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/reverse.rb new file mode 100644 index 0000000..aca98ce --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/reverse.rb @@ -0,0 +1,25 @@ +# +# reverse.rb +# + +module Puppet::Parser::Functions + newfunction(:reverse, :type => :rvalue, :doc => <<-EOS +Reverses the order of a string or array. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "reverse(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'reverse(): Requires either array or string to work with') + end + + result = value.reverse + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/rstrip.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/rstrip.rb new file mode 100644 index 0000000..e24abd5 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/rstrip.rb @@ -0,0 +1,29 @@ +# +# rstrip.rb +# + +module Puppet::Parser::Functions + newfunction(:rstrip, :type => :rvalue, :doc => <<-EOS +Strips leading spaces to the right of the string. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "rstrip(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'rstrip(): Requires either array or string to work with') + end + + if value.is_a?(Array) + result = value.collect { |i| i.is_a?(String) ? i.rstrip : i } + else + result = value.rstrip + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/seeded_rand.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/seeded_rand.rb new file mode 100644 index 0000000..44e27b8 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/seeded_rand.rb @@ -0,0 +1,22 @@ +Puppet::Parser::Functions::newfunction( + :seeded_rand, + :arity => 2, + :type => :rvalue, + :doc => <<-EOS +Usage: `seeded_rand(MAX, SEED)`. MAX must be a positive integer; SEED is any string. + +Generates a random whole number greater than or equal to 0 and less +than MAX, using the value of SEED for repeatable randomness. If SEED +starts with "$fqdn:", this is behaves the same as `fqdn_rand`. + +EOS +) do |args| + require 'digest/md5' + + raise(ArgumentError, "seeded_rand(): first argument must be a positive integer") unless function_is_integer([args[0]]) and args[0].to_i > 0 + raise(ArgumentError, "seeded_rand(): second argument must be a string") unless args[1].is_a? String + + max = args[0].to_i + seed = Digest::MD5.hexdigest(args[1]).hex + Puppet::Util.deterministic_rand(seed,max) +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/shell_escape.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/shell_escape.rb new file mode 100644 index 0000000..7306b7c --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/shell_escape.rb @@ -0,0 +1,29 @@ +# +# shell_escape.rb +# + +require 'shellwords' + +module Puppet::Parser::Functions + newfunction(:shell_escape, :type => :rvalue, :doc => <<-EOS +Escapes a string so that it can be safely used in a Bourne shell command line. + +Note that the resulting string should be used unquoted and is not intended for use in double quotes nor in single +quotes. + +This function behaves the same as ruby's Shellwords.shellescape() function. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "shell_escape(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + # explicit conversion to string is required for ruby 1.9 + string = arguments[0].to_s + + result = Shellwords.shellescape(string) + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/shell_join.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/shell_join.rb new file mode 100644 index 0000000..682ed8d --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/shell_join.rb @@ -0,0 +1,30 @@ +# +# shell_join.rb +# + +require 'shellwords' + +module Puppet::Parser::Functions + newfunction(:shell_join, :type => :rvalue, :doc => <<-EOS +Builds a command line string from the given array of strings. Each array item is escaped for Bourne shell. All items are +then joined together, with a single space in between. + +This function behaves the same as ruby's Shellwords.shelljoin() function + EOS + ) do |arguments| + + raise(Puppet::ParseError, "shell_join(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + array = arguments[0] + + raise Puppet::ParseError, ("First argument is not an Array: #{array.inspect}") unless array.is_a?(Array) + + # explicit conversion to string is required for ruby 1.9 + array = array.map { |item| item.to_s } + result = Shellwords.shelljoin(array) + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/shell_split.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/shell_split.rb new file mode 100644 index 0000000..09e6e78 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/shell_split.rb @@ -0,0 +1,25 @@ +# +# shell_split.rb +# + +require 'shellwords' + +module Puppet::Parser::Functions + newfunction(:shell_split, :type => :rvalue, :doc => <<-EOS +Splits a string into an array of tokens in the same way the Bourne shell does. + +This function behaves the same as ruby's Shellwords.shellsplit() function + EOS + ) do |arguments| + + raise(Puppet::ParseError, "shell_split(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + string = arguments[0].to_s + + result = Shellwords.shellsplit(string) + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/shuffle.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/shuffle.rb new file mode 100644 index 0000000..942cbce --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/shuffle.rb @@ -0,0 +1,43 @@ +# +# shuffle.rb +# + +module Puppet::Parser::Functions + newfunction(:shuffle, :type => :rvalue, :doc => <<-EOS +Randomizes the order of a string or array elements. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "shuffle(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'shuffle(): Requires either array or string to work with') + end + + result = value.clone + + string = value.is_a?(String) ? true : false + + # Check whether it makes sense to shuffle ... + return result if result.size <= 1 + + # We turn any string value into an array to be able to shuffle ... + result = string ? result.split('') : result + + elements = result.size + + # Simple implementation of Fisher–Yates in-place shuffle ... + elements.times do |i| + j = rand(elements - i) + i + result[j], result[i] = result[i], result[j] + end + + result = string ? result.join : result + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/size.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/size.rb new file mode 100644 index 0000000..b503aa0 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/size.rb @@ -0,0 +1,46 @@ +# +# size.rb +# + +module Puppet::Parser::Functions + newfunction(:size, :type => :rvalue, :doc => <<-EOS +Returns the number of elements in a string, an array or a hash + EOS + ) do |arguments| + + raise(Puppet::ParseError, "size(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + item = arguments[0] + + function_deprecation([:size, 'This method is going to be deprecated, please use the stdlib length function.']) + + if item.is_a?(String) + + begin + # + # Check whether your item is a numeric value or not ... + # This will take care about positive and/or negative numbers + # for both integer and floating-point values ... + # + # Please note that Puppet has no notion of hexadecimal + # nor octal numbers for its DSL at this point in time ... + # + Float(item) + + raise(Puppet::ParseError, 'size(): Requires either string, array or hash to work with') + + rescue ArgumentError + result = item.size + end + + elsif item.is_a?(Array) || item.is_a?(Hash) + result = item.size + else + raise(Puppet::ParseError, 'size(): Unknown type given') + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/sort.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/sort.rb new file mode 100644 index 0000000..d7792f5 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/sort.rb @@ -0,0 +1,27 @@ +# +# sort.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:sort, :type => :rvalue, :doc => <<-EOS +Sorts strings and arrays lexically. + EOS + ) do |arguments| + + if (arguments.size != 1) then + raise(Puppet::ParseError, "sort(): Wrong number of arguments given #{arguments.size} for 1") + end + + value = arguments[0] + + if value.is_a?(Array) then + value.sort + elsif value.is_a?(String) then + value.split("").sort.join("") + end + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/squeeze.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/squeeze.rb new file mode 100644 index 0000000..f5757d1 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/squeeze.rb @@ -0,0 +1,35 @@ +# +# squeeze.rb +# + +module Puppet::Parser::Functions + newfunction(:squeeze, :type => :rvalue, :doc => <<-EOS +Returns a new string where runs of the same character that occur in this set are replaced by a single character. + EOS + ) do |arguments| + + if ((arguments.size != 2) and (arguments.size != 1)) then + raise(Puppet::ParseError, "squeeze(): Wrong number of arguments given #{arguments.size} for 2 or 1") + end + + item = arguments[0] + squeezeval = arguments[1] + + if item.is_a?(Array) then + if squeezeval then + item.collect { |i| i.squeeze(squeezeval) } + else + item.collect { |i| i.squeeze } + end + else + if squeezeval then + item.squeeze(squeezeval) + else + item.squeeze + end + end + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/str2bool.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/str2bool.rb new file mode 100644 index 0000000..38ad1ce --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/str2bool.rb @@ -0,0 +1,44 @@ +# +# str2bool.rb +# + +module Puppet::Parser::Functions + newfunction(:str2bool, :type => :rvalue, :doc => <<-EOS +This converts a string to a boolean. This attempt to convert strings that +contain things like: Y,y, 1, T,t, TRUE,true to 'true' and strings that contain things +like: 0, F,f, N,n, false, FALSE, no to 'false'. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "str2bool(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + string = arguments[0] + + # If string is already Boolean, return it + if !!string == string + return string + end + + unless string.is_a?(String) + raise(Puppet::ParseError, 'str2bool(): Requires string to work with') + end + + # We consider all the yes, no, y, n and so on too ... + result = case string + # + # This is how undef looks like in Puppet ... + # We yield false in this case. + # + when /^$/, '' then false # Empty string will be false ... + when /^(1|t|y|true|yes)$/i then true + when /^(0|f|n|false|no)$/i then false + when /^(undef|undefined)$/ then false # This is not likely to happen ... + else + raise(Puppet::ParseError, 'str2bool(): Unknown type of boolean given') + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/str2saltedsha512.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/str2saltedsha512.rb new file mode 100644 index 0000000..0410c62 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/str2saltedsha512.rb @@ -0,0 +1,31 @@ +# +# str2saltedsha512.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:str2saltedsha512, :type => :rvalue, :doc => <<-EOS +This converts a string to a salted-SHA512 password hash (which is used for +OS X versions >= 10.7). Given any simple string, you will get a hex version +of a salted-SHA512 password hash that can be inserted into your Puppet +manifests as a valid password attribute. + EOS + ) do |arguments| + require 'digest/sha2' + + raise(Puppet::ParseError, "str2saltedsha512(): Wrong number of arguments passed (#{arguments.size} but we require 1)") if arguments.size != 1 + + password = arguments[0] + + unless password.is_a?(String) + raise(Puppet::ParseError, "str2saltedsha512(): Requires a String argument, you passed: #{password.class}") + end + + seedint = rand(2**31 - 1) + seedstring = Array(seedint).pack("L") + saltedpass = Digest::SHA512.digest(seedstring + password) + (seedstring + saltedpass).unpack('H*')[0] + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/strftime.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/strftime.rb new file mode 100644 index 0000000..deae329 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/strftime.rb @@ -0,0 +1,106 @@ +# +# strftime.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:strftime, :type => :rvalue, :doc => <<-EOS +This function returns formatted time. + +*Examples:* + +To return the time since epoch: + + strftime("%s") + +To return the date: + + strftime("%Y-%m-%d") + +*Format meaning:* + + %a - The abbreviated weekday name (``Sun'') + %A - The full weekday name (``Sunday'') + %b - The abbreviated month name (``Jan'') + %B - The full month name (``January'') + %c - The preferred local date and time representation + %C - Century (20 in 2009) + %d - Day of the month (01..31) + %D - Date (%m/%d/%y) + %e - Day of the month, blank-padded ( 1..31) + %F - Equivalent to %Y-%m-%d (the ISO 8601 date format) + %h - Equivalent to %b + %H - Hour of the day, 24-hour clock (00..23) + %I - Hour of the day, 12-hour clock (01..12) + %j - Day of the year (001..366) + %k - hour, 24-hour clock, blank-padded ( 0..23) + %l - hour, 12-hour clock, blank-padded ( 0..12) + %L - Millisecond of the second (000..999) + %m - Month of the year (01..12) + %M - Minute of the hour (00..59) + %n - Newline (\n) + %N - Fractional seconds digits, default is 9 digits (nanosecond) + %3N millisecond (3 digits) + %6N microsecond (6 digits) + %9N nanosecond (9 digits) + %p - Meridian indicator (``AM'' or ``PM'') + %P - Meridian indicator (``am'' or ``pm'') + %r - time, 12-hour (same as %I:%M:%S %p) + %R - time, 24-hour (%H:%M) + %s - Number of seconds since 1970-01-01 00:00:00 UTC. + %S - Second of the minute (00..60) + %t - Tab character (\t) + %T - time, 24-hour (%H:%M:%S) + %u - Day of the week as a decimal, Monday being 1. (1..7) + %U - Week number of the current year, + starting with the first Sunday as the first + day of the first week (00..53) + %v - VMS date (%e-%b-%Y) + %V - Week number of year according to ISO 8601 (01..53) + %W - Week number of the current year, + starting with the first Monday as the first + day of the first week (00..53) + %w - Day of the week (Sunday is 0, 0..6) + %x - Preferred representation for the date alone, no time + %X - Preferred representation for the time alone, no date + %y - Year without a century (00..99) + %Y - Year with century + %z - Time zone as hour offset from UTC (e.g. +0900) + %Z - Time zone name + %% - Literal ``%'' character + EOS + ) do |arguments| + + # Technically we support two arguments but only first is mandatory ... + raise(Puppet::ParseError, "strftime(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + format = arguments[0] + + raise(Puppet::ParseError, 'strftime(): You must provide format for evaluation') if format.empty? + + # The Time Zone argument is optional ... + time_zone = arguments[1] if arguments[1] + + time = Time.new + + # There is probably a better way to handle Time Zone ... + if time_zone and not time_zone.empty? + original_zone = ENV['TZ'] + + local_time = time.clone + local_time = local_time.utc + + ENV['TZ'] = time_zone + + time = local_time.localtime + + ENV['TZ'] = original_zone + end + + result = time.strftime(format) + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/strip.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/strip.rb new file mode 100644 index 0000000..9e8366f --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/strip.rb @@ -0,0 +1,36 @@ +# +# strip.rb +# + +module Puppet::Parser::Functions + newfunction(:strip, :type => :rvalue, :doc => <<-EOS +This function removes leading and trailing whitespace from a string or from +every string inside an array. + +*Examples:* + + strip(" aaa ") + +Would result in: "aaa" + EOS + ) do |arguments| + + raise(Puppet::ParseError, "strip(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'strip(): Requires either array or string to work with') + end + + if value.is_a?(Array) + result = value.collect { |i| i.is_a?(String) ? i.strip : i } + else + result = value.strip + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/suffix.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/suffix.rb new file mode 100644 index 0000000..7c5057d --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/suffix.rb @@ -0,0 +1,52 @@ +# +# suffix.rb +# + +module Puppet::Parser::Functions + newfunction(:suffix, :type => :rvalue, :doc => <<-EOS +This function applies a suffix to all elements in an array, or to the keys +in a hash. + +*Examples:* + + suffix(['a','b','c'], 'p') + +Will return: ['ap','bp','cp'] + EOS + ) do |arguments| + + # Technically we support two arguments but only first is mandatory ... + raise(Puppet::ParseError, "suffix(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + enumerable = arguments[0] + + unless enumerable.is_a?(Array) or enumerable.is_a?(Hash) + raise Puppet::ParseError, "suffix(): expected first argument to be an Array or a Hash, got #{enumerable.inspect}" + end + + suffix = arguments[1] if arguments[1] + + if suffix + unless suffix.is_a? String + raise Puppet::ParseError, "suffix(): expected second argument to be a String, got #{suffix.inspect}" + end + end + + if enumerable.is_a?(Array) + # Turn everything into string same as join would do ... + result = enumerable.collect do |i| + i = i.to_s + suffix ? i + suffix : i + end + else + result = Hash[enumerable.map do |k,v| + k = k.to_s + [ suffix ? k + suffix : k, v ] + end] + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/swapcase.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/swapcase.rb new file mode 100644 index 0000000..f3276fb --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/swapcase.rb @@ -0,0 +1,37 @@ +# +# swapcase.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:swapcase, :type => :rvalue, :doc => <<-EOS +This function will swap the existing case of a string. + +*Examples:* + + swapcase("aBcD") + +Would result in: "AbCd" + EOS + ) do |arguments| + + raise(Puppet::ParseError, "swapcase(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'swapcase(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.swapcase : i } + else + result = value.swapcase + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/time.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/time.rb new file mode 100644 index 0000000..d7780c8 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/time.rb @@ -0,0 +1,49 @@ +# +# time.rb +# + +module Puppet::Parser::Functions + newfunction(:time, :type => :rvalue, :doc => <<-EOS +This function will return the current time since epoch as an integer. + +*Examples:* + + time() + +Will return something like: 1311972653 + EOS + ) do |arguments| + + # The Time Zone argument is optional ... + time_zone = arguments[0] if arguments[0] + + if (arguments.size != 0) and (arguments.size != 1) then + raise(Puppet::ParseError, "time(): Wrong number of arguments given #{arguments.size} for 0 or 1") + end + + time = Time.new + + # There is probably a better way to handle Time Zone ... + if time_zone and not time_zone.empty? + original_zone = ENV['TZ'] + + local_time = time.clone + local_time = local_time.utc + + ENV['TZ'] = time_zone + + result = local_time.localtime.strftime('%s') + + ENV['TZ'] = original_zone + else + result = time.localtime.strftime('%s') + end + + # Calling Time#to_i on a receiver changes it. Trust me I am the Doctor. + result = result.to_i + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/to_bytes.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/to_bytes.rb new file mode 100644 index 0000000..bf72503 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/to_bytes.rb @@ -0,0 +1,30 @@ +module Puppet::Parser::Functions + newfunction(:to_bytes, :type => :rvalue, :doc => <<-EOS + Converts the argument into bytes, for example 4 kB becomes 4096. + Takes a single string value as an argument. + These conversions reflect a layperson's understanding of + 1 MB = 1024 KB, when in fact 1 MB = 1000 KB, and 1 MiB = 1024 KiB. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "to_bytes(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + arg = arguments[0] + + return arg if arg.is_a? Numeric + + value,prefix = */([0-9.e+-]*)\s*([^bB]?)/.match(arg)[1,2] + + value = value.to_f + case prefix + when '' then return value.to_i + when 'k' then return (value*(1<<10)).to_i + when 'M' then return (value*(1<<20)).to_i + when 'G' then return (value*(1<<30)).to_i + when 'T' then return (value*(1<<40)).to_i + when 'P' then return (value*(1<<50)).to_i + when 'E' then return (value*(1<<60)).to_i + else raise Puppet::ParseError, "to_bytes(): Unknown prefix #{prefix}" + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/try_get_value.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/try_get_value.rb new file mode 100644 index 0000000..fc19a23 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/try_get_value.rb @@ -0,0 +1,53 @@ +module Puppet::Parser::Functions + newfunction( + :try_get_value, + :type => :rvalue, + :arity => -2, + :doc => <<-eos +DEPRECATED: this function is deprecated, please use dig() instead. + +Looks up into a complex structure of arrays and hashes and returns a value +or the default value if nothing was found. + +Key can contain slashes to describe path components. The function will go down +the structure and try to extract the required value. + +$data = { + 'a' => { + 'b' => [ + 'b1', + 'b2', + 'b3', + ] + } +} + +$value = try_get_value($data, 'a/b/2', 'not_found', '/') +=> $value = 'b3' + +a -> first hash key +b -> second hash key +2 -> array index starting with 0 + +not_found -> (optional) will be returned if there is no value or the path did not match. Defaults to nil. +/ -> (optional) path delimiter. Defaults to '/'. + +In addition to the required "key" argument, "try_get_value" accepts default +argument. It will be returned if no value was found or a path component is +missing. And the fourth argument can set a variable path separator. + eos + ) do |args| + warning("try_get_value() DEPRECATED: this function is deprecated, please use dig() instead.") + data = args[0] + path = args[1] || '' + default = args[2] + + if !(data.is_a?(Hash) || data.is_a?(Array)) || path == '' + return default || data + end + + separator = args[3] || '/' + path = path.split(separator).map{ |key| key =~ /^\d+$/ ? key.to_i : key } + function_dig([data, path, default]) + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/type.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/type.rb new file mode 100644 index 0000000..016529b --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/type.rb @@ -0,0 +1,19 @@ +# +# type.rb +# + +module Puppet::Parser::Functions + newfunction(:type, :type => :rvalue, :doc => <<-EOS + DEPRECATED: This function will cease to function on Puppet 4; please use type3x() before upgrading to puppet 4 for backwards-compatibility, or migrate to the new parser's typing system. + EOS + ) do |args| + + warning("type() DEPRECATED: This function will cease to function on Puppet 4; please use type3x() before upgrading to puppet 4 for backwards-compatibility, or migrate to the new parser's typing system.") + if ! Puppet::Parser::Functions.autoloader.loaded?(:type3x) + Puppet::Parser::Functions.autoloader.load(:type3x) + end + function_type3x(args + [false]) + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/type3x.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/type3x.rb new file mode 100644 index 0000000..b17380e --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/type3x.rb @@ -0,0 +1,50 @@ +# +# type3x.rb +# + +module Puppet::Parser::Functions + newfunction(:type3x, :type => :rvalue, :doc => <<-EOS +DEPRECATED: This function will be removed when puppet 3 support is dropped; please migrate to the new parser's typing system. + +Returns the type when passed a value. Type can be one of: + +* string +* array +* hash +* float +* integer +* boolean + EOS + ) do |args| + raise(Puppet::ParseError, "type3x(): Wrong number of arguments given (#{args.size} for 1)") if args.size < 1 + + value = args[0] + + klass = value.class + + if not [TrueClass, FalseClass, Array, Bignum, Fixnum, Float, Hash, String].include?(klass) + raise(Puppet::ParseError, 'type3x(): Unknown type') + end + + klass = klass.to_s # Ugly ... + + # We note that Integer is the parent to Bignum and Fixnum ... + result = case klass + when /^(?:Big|Fix)num$/ then 'integer' + when /^(?:True|False)Class$/ then 'boolean' + else klass + end + + if result == "String" then + if value == value.to_i.to_s then + result = "Integer" + elsif value == value.to_f.to_s then + result = "Float" + end + end + + return result.downcase + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/union.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/union.rb new file mode 100644 index 0000000..abe2dc8 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/union.rb @@ -0,0 +1,28 @@ +# +# union.rb +# + +module Puppet::Parser::Functions + newfunction(:union, :type => :rvalue, :doc => <<-EOS +This function returns a union of two or more arrays. + +*Examples:* + + union(["a","b","c"],["b","c","d"]) + +Would return: ["a","b","c","d"] + EOS + ) do |arguments| + + # Check that 2 or more arguments have been given ... + raise(Puppet::ParseError, "union(): Wrong number of arguments given (#{arguments.size} for < 2)") if arguments.size < 2 + + arguments.each do |argument| + raise(Puppet::ParseError, 'union(): Every parameter must be an array') unless argument.is_a?(Array) + end + + arguments.reduce(:|) + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/unique.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/unique.rb new file mode 100644 index 0000000..b57431d --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/unique.rb @@ -0,0 +1,48 @@ +# +# unique.rb +# + +module Puppet::Parser::Functions + newfunction(:unique, :type => :rvalue, :doc => <<-EOS +This function will remove duplicates from strings and arrays. + +*Examples:* + + unique("aabbcc") + +Will return: + + abc + +You can also use this with arrays: + + unique(["a","a","b","b","c","c"]) + +This returns: + + ["a","b","c"] + EOS + ) do |arguments| + + raise(Puppet::ParseError, "unique(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'unique(): Requires either array or string to work with') + end + + result = value.clone + + string = value.is_a?(String) ? true : false + + # We turn any string value into an array to be able to shuffle ... + result = string ? result.split('') : result + result = result.uniq # Remove duplicates ... + result = string ? result.join : result + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/unix2dos.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/unix2dos.rb new file mode 100644 index 0000000..0bd9cd1 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/unix2dos.rb @@ -0,0 +1,15 @@ +# Custom Puppet function to convert unix to dos format +module Puppet::Parser::Functions + newfunction(:unix2dos, :type => :rvalue, :arity => 1, :doc => <<-EOS + Returns the DOS version of the given string. + Takes a single string argument. + EOS + ) do |arguments| + + unless arguments[0].is_a?(String) + raise(Puppet::ParseError, 'unix2dos(): Requires string as argument') + end + + arguments[0].gsub(/\r*\n/, "\r\n") + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/upcase.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/upcase.rb new file mode 100644 index 0000000..e847e51 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/upcase.rb @@ -0,0 +1,44 @@ +# +# upcase.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:upcase, :type => :rvalue, :doc => <<-EOS +Converts a string or an array of strings to uppercase. + +*Examples:* + + upcase("abcd") + +Will return: + + ABCD + EOS + ) do |arguments| + + raise(Puppet::ParseError, "upcase(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(Hash) || value.respond_to?(:upcase) + raise(Puppet::ParseError, 'upcase(): Requires an array, hash or object that responds to upcase in order to work') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| function_upcase([i]) } + elsif value.is_a?(Hash) + result = {} + value.each_pair do |k, v| + result[function_upcase([k])] = function_upcase([v]) + end + else + result = value.upcase + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/uriescape.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/uriescape.rb new file mode 100644 index 0000000..4c5c400 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/uriescape.rb @@ -0,0 +1,33 @@ +# +# uriescape.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# +require 'uri' + +module Puppet::Parser::Functions + newfunction(:uriescape, :type => :rvalue, :doc => <<-EOS + Urlencodes a string or array of strings. + Requires either a single string or an array as an input. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "uriescape(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'uriescape(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? URI.escape(i) : i } + else + result = URI.escape(value) + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_absolute_path.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_absolute_path.rb new file mode 100644 index 0000000..c73f3df --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_absolute_path.rb @@ -0,0 +1,54 @@ +module Puppet::Parser::Functions + newfunction(:validate_absolute_path, :doc => <<-'ENDHEREDOC') do |args| + Validate the string represents an absolute path in the filesystem. This function works + for windows and unix style paths. + + The following values will pass: + + $my_path = 'C:/Program Files (x86)/Puppet Labs/Puppet' + validate_absolute_path($my_path) + $my_path2 = '/var/lib/puppet' + validate_absolute_path($my_path2) + $my_path3 = ['C:/Program Files (x86)/Puppet Labs/Puppet','C:/Program Files/Puppet Labs/Puppet'] + validate_absolute_path($my_path3) + $my_path4 = ['/var/lib/puppet','/usr/share/puppet'] + validate_absolute_path($my_path4) + + The following values will fail, causing compilation to abort: + + validate_absolute_path(true) + validate_absolute_path('../var/lib/puppet') + validate_absolute_path('var/lib/puppet') + validate_absolute_path([ 'var/lib/puppet', '/var/foo' ]) + validate_absolute_path([ '/var/lib/puppet', 'var/foo' ]) + $undefined = undef + validate_absolute_path($undefined) + + ENDHEREDOC + + # The deprecation function was being called twice, as validate_absolute_path calls is_absolute_path. I have removed it from here so it only calls deprecation once within is_absolute_path. + # function_deprecation([:validate_absolute_path, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Absolute_path. There is further documentation for validate_legacy function in the README.']) + + require 'puppet/util' + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_absolute_path(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + # put arg to candidate var to be able to replace it + candidates = arg + # if arg is just a string with a path to test, convert it to an array + # to avoid test code duplication + unless arg.is_a?(Array) then + candidates = Array.new(1,arg) + end + # iterate over all paths within the candidates array + candidates.each do |path| + unless function_is_absolute_path([path]) + raise Puppet::ParseError, ("#{path.inspect} is not an absolute path.") + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_array.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_array.rb new file mode 100644 index 0000000..3bf3983 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_array.rb @@ -0,0 +1,35 @@ +module Puppet::Parser::Functions + + newfunction(:validate_array, :doc => <<-'ENDHEREDOC') do |args| + Validate that all passed values are array data structures. Abort catalog + compilation if any value fails this check. + + The following values will pass: + + $my_array = [ 'one', 'two' ] + validate_array($my_array) + + The following values will fail, causing compilation to abort: + + validate_array(true) + validate_array('some_string') + $undefined = undef + validate_array($undefined) + + ENDHEREDOC + + function_deprecation([:validate_array, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Array. There is further documentation for validate_legacy function in the README.']) + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_array(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + unless arg.is_a?(Array) + raise Puppet::ParseError, ("#{arg.inspect} is not an Array. It looks to be a #{arg.class}") + end + end + + end + +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_augeas.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_augeas.rb new file mode 100644 index 0000000..2196c3e --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_augeas.rb @@ -0,0 +1,83 @@ +require 'tempfile' + +module Puppet::Parser::Functions + newfunction(:validate_augeas, :doc => <<-'ENDHEREDOC') do |args| + Perform validation of a string using an Augeas lens + The first argument of this function should be a string to + test, and the second argument should be the name of the Augeas lens to use. + If Augeas fails to parse the string with the lens, the compilation will + abort with a parse error. + + A third argument can be specified, listing paths which should + not be found in the file. The `$file` variable points to the location + of the temporary file being tested in the Augeas tree. + + For example, if you want to make sure your passwd content never contains + a user `foo`, you could write: + + validate_augeas($passwdcontent, 'Passwd.lns', ['$file/foo']) + + Or if you wanted to ensure that no users used the '/bin/barsh' shell, + you could use: + + validate_augeas($passwdcontent, 'Passwd.lns', ['$file/*[shell="/bin/barsh"]'] + + If a fourth argument is specified, this will be the error message raised and + seen by the user. + + A helpful error message can be returned like this: + + validate_augeas($sudoerscontent, 'Sudoers.lns', [], 'Failed to validate sudoers content with Augeas') + + ENDHEREDOC + unless Puppet.features.augeas? + raise Puppet::ParseError, ("validate_augeas(): this function requires the augeas feature. See http://docs.puppetlabs.com/guides/augeas.html#pre-requisites for how to activate it.") + end + + if (args.length < 2) or (args.length > 4) then + raise Puppet::ParseError, ("validate_augeas(): wrong number of arguments (#{args.length}; must be 2, 3, or 4)") + end + + msg = args[3] || "validate_augeas(): Failed to validate content against #{args[1].inspect}" + + require 'augeas' + aug = Augeas::open(nil, nil, Augeas::NO_MODL_AUTOLOAD) + begin + content = args[0] + + # Test content in a temporary file + tmpfile = Tempfile.new("validate_augeas") + begin + tmpfile.write(content) + ensure + tmpfile.close + end + + # Check for syntax + lens = args[1] + aug.transform( + :lens => lens, + :name => 'Validate_augeas', + :incl => tmpfile.path + ) + aug.load! + + unless aug.match("/augeas/files#{tmpfile.path}//error").empty? + error = aug.get("/augeas/files#{tmpfile.path}//error/message") + msg += " with error: #{error}" + raise Puppet::ParseError, (msg) + end + + # Launch unit tests + tests = args[2] || [] + aug.defvar('file', "/files#{tmpfile.path}") + tests.each do |t| + msg += " testing path #{t}" + raise Puppet::ParseError, (msg) unless aug.match(t).empty? + end + ensure + aug.close + tmpfile.unlink + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_bool.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_bool.rb new file mode 100644 index 0000000..49075b8 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_bool.rb @@ -0,0 +1,37 @@ +module Puppet::Parser::Functions + + newfunction(:validate_bool, :doc => <<-'ENDHEREDOC') do |args| + Validate that all passed values are either true or false. Abort catalog + compilation if any value fails this check. + + The following values will pass: + + $iamtrue = true + validate_bool(true) + validate_bool(true, true, false, $iamtrue) + + The following values will fail, causing compilation to abort: + + $some_array = [ true ] + validate_bool("false") + validate_bool("true") + validate_bool($some_array) + + ENDHEREDOC + + # The deprecation function was being called twice, as validate_bool calls is_bool. I have removed it from here so it only calls deprecation once within is_bool. + # function_deprecation([:validate_bool, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Bool. There is further documentation for validate_legacy function in the README.']) + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_bool(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + unless function_is_bool([arg]) + raise Puppet::ParseError, ("#{arg.inspect} is not a boolean. It looks to be a #{arg.class}") + end + end + + end + +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_cmd.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_cmd.rb new file mode 100644 index 0000000..685162b --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_cmd.rb @@ -0,0 +1,63 @@ +require 'puppet/util/execution' +require 'tempfile' + +module Puppet::Parser::Functions + newfunction(:validate_cmd, :doc => <<-'ENDHEREDOC') do |args| + Perform validation of a string with an external command. + The first argument of this function should be a string to + test, and the second argument should be a path to a test command + taking a % as a placeholder for the file path (will default to the end). + If the command, launched against a tempfile containing the passed string, + returns a non-null value, compilation will abort with a parse error. + + If a third argument is specified, this will be the error message raised and + seen by the user. + + A helpful error message can be returned like this: + + Example: + + # Defaults to end of path + validate_cmd($sudoerscontent, '/usr/sbin/visudo -c -f', 'Visudo failed to validate sudoers content') + + # % as file location + validate_cmd($haproxycontent, '/usr/sbin/haproxy -f % -c', 'Haproxy failed to validate config content') + + ENDHEREDOC + if (args.length < 2) or (args.length > 3) then + raise Puppet::ParseError, ("validate_cmd(): wrong number of arguments (#{args.length}; must be 2 or 3)") + end + + msg = args[2] || "validate_cmd(): failed to validate content with command #{args[1].inspect}" + + content = args[0] + checkscript = args[1] + + # Test content in a temporary file + tmpfile = Tempfile.new("validate_cmd") + begin + tmpfile.write(content) + tmpfile.close + + if checkscript =~ /\s%(\s|$)/ + check_with_correct_location = checkscript.gsub(/%/,tmpfile.path) + else + check_with_correct_location = "#{checkscript} #{tmpfile.path}" + end + + if Puppet::Util::Execution.respond_to?('execute') + Puppet::Util::Execution.execute(check_with_correct_location) + else + Puppet::Util.execute(check_with_correct_location) + end + rescue Puppet::ExecutionFailure => detail + msg += "\n#{detail}" + raise Puppet::ParseError, msg + rescue StandardError => detail + msg += "\n#{detail.class.name} #{detail}" + raise Puppet::ParseError, msg + ensure + tmpfile.unlink + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_email_address.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_email_address.rb new file mode 100644 index 0000000..ddd0d25 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_email_address.rb @@ -0,0 +1,31 @@ +module Puppet::Parser::Functions + newfunction(:validate_email_address, :doc => <<-ENDHEREDOC + Validate that all values passed are valid email addresses. + Fail compilation if any value fails this check. + The following values will pass: + $my_email = "waldo@gmail.com" + validate_email_address($my_email) + validate_email_address("bob@gmail.com", "alice@gmail.com", $my_email) + + The following values will fail, causing compilation to abort: + $some_array = [ 'bad_email@/d/efdf.com' ] + validate_email_address($some_array) + ENDHEREDOC + ) do |args| + rescuable_exceptions = [ArgumentError] + + if args.empty? + raise Puppet::ParseError, "validate_email_address(): wrong number of arguments (#{args.length}; must be > 0)" + end + + args.each do |arg| + raise Puppet::ParseError, "#{arg.inspect} is not a string." unless arg.is_a?(String) + + begin + raise Puppet::ParseError, "#{arg.inspect} is not a valid email address" unless function_is_email_address([arg]) + rescue *rescuable_exceptions + raise Puppet::ParseError, "#{arg.inspect} is not a valid email address" + end + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_hash.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_hash.rb new file mode 100644 index 0000000..fcdc7e1 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_hash.rb @@ -0,0 +1,35 @@ +module Puppet::Parser::Functions + + newfunction(:validate_hash, :doc => <<-'ENDHEREDOC') do |args| + Validate that all passed values are hash data structures. Abort catalog + compilation if any value fails this check. + + The following values will pass: + + $my_hash = { 'one' => 'two' } + validate_hash($my_hash) + + The following values will fail, causing compilation to abort: + + validate_hash(true) + validate_hash('some_string') + $undefined = undef + validate_hash($undefined) + + ENDHEREDOC + + function_deprecation([:validate_hash, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Hash. There is further documentation for validate_legacy function in the README.']) + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_hash(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + unless arg.is_a?(Hash) + raise Puppet::ParseError, ("#{arg.inspect} is not a Hash. It looks to be a #{arg.class}") + end + end + + end + +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_integer.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_integer.rb new file mode 100644 index 0000000..2ae0293 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_integer.rb @@ -0,0 +1,134 @@ +module Puppet::Parser::Functions + + newfunction(:validate_integer, :doc => <<-'ENDHEREDOC') do |args| + Validate that the first argument is an integer (or an array of integers). Abort catalog compilation if any of the checks fail. + + The second argument is optional and passes a maximum. (All elements of) the first argument has to be less or equal to this max. + + The third argument is optional and passes a minimum. (All elements of) the first argument has to be greater or equal to this min. + If, and only if, a minimum is given, the second argument may be an empty string or undef, which will be handled to just check + if (all elements of) the first argument are greater or equal to the given minimum. + + It will fail if the first argument is not an integer or array of integers, and if arg 2 and arg 3 are not convertable to an integer. + + The following values will pass: + + validate_integer(1) + validate_integer(1, 2) + validate_integer(1, 1) + validate_integer(1, 2, 0) + validate_integer(2, 2, 2) + validate_integer(2, '', 0) + validate_integer(2, undef, 0) + $foo = undef + validate_integer(2, $foo, 0) + validate_integer([1,2,3,4,5], 6) + validate_integer([1,2,3,4,5], 6, 0) + + Plus all of the above, but any combination of values passed as strings ('1' or "1"). + Plus all of the above, but with (correct) combinations of negative integer values. + + The following values will not: + + validate_integer(true) + validate_integer(false) + validate_integer(7.0) + validate_integer({ 1 => 2 }) + $foo = undef + validate_integer($foo) + validate_integer($foobaridontexist) + + validate_integer(1, 0) + validate_integer(1, true) + validate_integer(1, '') + validate_integer(1, undef) + validate_integer(1, , 0) + validate_integer(1, 2, 3) + validate_integer(1, 3, 2) + validate_integer(1, 3, true) + + Plus all of the above, but any combination of values passed as strings ('false' or "false"). + Plus all of the above, but with incorrect combinations of negative integer values. + Plus all of the above, but with non-integer items in arrays or maximum / minimum argument. + + ENDHEREDOC + + function_deprecation([:validate_integer, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Integer. There is further documentation for validate_legacy function in the README.']) + + # tell the user we need at least one, and optionally up to two other parameters + raise Puppet::ParseError, "validate_integer(): Wrong number of arguments; must be 1, 2 or 3, got #{args.length}" unless args.length > 0 and args.length < 4 + + input, max, min = *args + + # check maximum parameter + if args.length > 1 + max = max.to_s + # allow max to be empty (or undefined) if we have a minimum set + if args.length > 2 and max == '' + max = nil + else + begin + max = Integer(max) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_integer(): Expected second argument to be unset or an Integer, got #{max}:#{max.class}" + end + end + else + max = nil + end + + # check minimum parameter + if args.length > 2 + begin + min = Integer(min.to_s) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_integer(): Expected third argument to be unset or an Integer, got #{min}:#{min.class}" + end + else + min = nil + end + + # ensure that min < max + if min and max and min > max + raise Puppet::ParseError, "validate_integer(): Expected second argument to be larger than third argument, got #{max} < #{min}" + end + + # create lamba validator function + validator = lambda do |num| + # check input < max + if max and num > max + raise Puppet::ParseError, "validate_integer(): Expected #{input.inspect} to be smaller or equal to #{max}, got #{input.inspect}." + end + # check input > min (this will only be checked if no exception has been raised before) + if min and num < min + raise Puppet::ParseError, "validate_integer(): Expected #{input.inspect} to be greater or equal to #{min}, got #{input.inspect}." + end + end + + # if this is an array, handle it. + case input + when Array + # check every element of the array + input.each_with_index do |arg, pos| + begin + raise TypeError if arg.is_a?(Hash) + arg = Integer(arg.to_s) + validator.call(arg) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_integer(): Expected element at array position #{pos} to be an Integer, got #{arg.class}" + end + end + # for the sake of compatibility with ruby 1.8, we need extra handling of hashes + when Hash + raise Puppet::ParseError, "validate_integer(): Expected first argument to be an Integer or Array, got #{input.class}" + # check the input. this will also fail any stuff other than pure, shiny integers + else + begin + input = Integer(input.to_s) + validator.call(input) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_integer(): Expected first argument to be an Integer or Array, got #{input.class}" + end + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_ip_address.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_ip_address.rb new file mode 100644 index 0000000..5d80cfb --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_ip_address.rb @@ -0,0 +1,52 @@ +module Puppet::Parser::Functions + + newfunction(:validate_ip_address, :doc => <<-ENDHEREDOC + Validate that all values passed are valid IP addresses, + regardless they are IPv4 or IPv6 + Fail compilation if any value fails this check. + The following values will pass: + $my_ip = "1.2.3.4" + validate_ip_address($my_ip) + validate_ip_address("8.8.8.8", "172.16.0.1", $my_ip) + + $my_ip = "3ffe:505:2" + validate_ip_address(1) + validate_ip_address($my_ip) + validate_ip_address("fe80::baf6:b1ff:fe19:7507", $my_ip) + + The following values will fail, causing compilation to abort: + $some_array = [ 1, true, false, "garbage string", "3ffe:505:2" ] + validate_ip_address($some_array) + ENDHEREDOC + ) do |args| + + require "ipaddr" + rescuable_exceptions = [ ArgumentError ] + + function_deprecation([:validate_ip_address, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ip_address. There is further documentation for validate_legacy function in the README.']) + + if defined?(IPAddr::InvalidAddressError) + rescuable_exceptions << IPAddr::InvalidAddressError + end + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_ip_address(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + unless arg.is_a?(String) + raise Puppet::ParseError, "#{arg.inspect} is not a string." + end + + begin + unless IPAddr.new(arg).ipv4? or IPAddr.new(arg).ipv6? + raise Puppet::ParseError, "#{arg.inspect} is not a valid IP address." + end + rescue *rescuable_exceptions + raise Puppet::ParseError, "#{arg.inspect} is not a valid IP address." + end + end + + end + +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_ipv4_address.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_ipv4_address.rb new file mode 100644 index 0000000..0660abd --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_ipv4_address.rb @@ -0,0 +1,50 @@ +module Puppet::Parser::Functions + + newfunction(:validate_ipv4_address, :doc => <<-ENDHEREDOC + Validate that all values passed are valid IPv4 addresses. + Fail compilation if any value fails this check. + + The following values will pass: + + $my_ip = "1.2.3.4" + validate_ipv4_address($my_ip) + validate_ipv4_address("8.8.8.8", "172.16.0.1", $my_ip) + + The following values will fail, causing compilation to abort: + + $some_array = [ 1, true, false, "garbage string", "3ffe:505:2" ] + validate_ipv4_address($some_array) + + ENDHEREDOC + ) do |args| + + function_deprecation([:validate_ipv4_address, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ipv4. There is further documentation for validate_legacy function in the README.']) + + require "ipaddr" + rescuable_exceptions = [ ArgumentError ] + + if defined?(IPAddr::InvalidAddressError) + rescuable_exceptions << IPAddr::InvalidAddressError + end + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_ipv4_address(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + unless arg.is_a?(String) + raise Puppet::ParseError, "#{arg.inspect} is not a string." + end + + begin + unless IPAddr.new(arg).ipv4? + raise Puppet::ParseError, "#{arg.inspect} is not a valid IPv4 address." + end + rescue *rescuable_exceptions + raise Puppet::ParseError, "#{arg.inspect} is not a valid IPv4 address." + end + end + + end + +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_ipv6_address.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_ipv6_address.rb new file mode 100644 index 0000000..f5dd9e5 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_ipv6_address.rb @@ -0,0 +1,51 @@ +module Puppet::Parser::Functions + + newfunction(:validate_ipv6_address, :doc => <<-ENDHEREDOC + Validate that all values passed are valid IPv6 addresses. + Fail compilation if any value fails this check. + + The following values will pass: + + $my_ip = "3ffe:505:2" + validate_ipv6_address(1) + validate_ipv6_address($my_ip) + validate_bool("fe80::baf6:b1ff:fe19:7507", $my_ip) + + The following values will fail, causing compilation to abort: + + $some_array = [ true, false, "garbage string", "1.2.3.4" ] + validate_ipv6_address($some_array) + + ENDHEREDOC + ) do |args| + + function_deprecation([:validate_ipv6_address, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ipv6. There is further documentation for validate_legacy function in the README.']) + + require "ipaddr" + rescuable_exceptions = [ ArgumentError ] + + if defined?(IPAddr::InvalidAddressError) + rescuable_exceptions << IPAddr::InvalidAddressError + end + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_ipv6_address(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + unless arg.is_a?(String) + raise Puppet::ParseError, "#{arg.inspect} is not a string." + end + + begin + unless IPAddr.new(arg).ipv6? + raise Puppet::ParseError, "#{arg.inspect} is not a valid IPv6 address." + end + rescue *rescuable_exceptions + raise Puppet::ParseError, "#{arg.inspect} is not a valid IPv6 address." + end + end + + end + +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_numeric.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_numeric.rb new file mode 100644 index 0000000..4205b30 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_numeric.rb @@ -0,0 +1,96 @@ +module Puppet::Parser::Functions + + newfunction(:validate_numeric, :doc => <<-'ENDHEREDOC') do |args| + Validate that the first argument is a numeric value (or an array of numeric values). Abort catalog compilation if any of the checks fail. + + The second argument is optional and passes a maximum. (All elements of) the first argument has to be less or equal to this max. + + The third argument is optional and passes a minimum. (All elements of) the first argument has to be greater or equal to this min. + If, and only if, a minimum is given, the second argument may be an empty string or undef, which will be handled to just check + if (all elements of) the first argument are greater or equal to the given minimum. + + It will fail if the first argument is not a numeric (Integer or Float) or array of numerics, and if arg 2 and arg 3 are not convertable to a numeric. + + For passing and failing usage, see `validate_integer()`. It is all the same for validate_numeric, yet now floating point values are allowed, too. + + ENDHEREDOC + + function_deprecation([:validate_numeric, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Numeric. There is further documentation for validate_legacy function in the README.']) + + # tell the user we need at least one, and optionally up to two other parameters + raise Puppet::ParseError, "validate_numeric(): Wrong number of arguments; must be 1, 2 or 3, got #{args.length}" unless args.length > 0 and args.length < 4 + + input, max, min = *args + + # check maximum parameter + if args.length > 1 + max = max.to_s + # allow max to be empty (or undefined) if we have a minimum set + if args.length > 2 and max == '' + max = nil + else + begin + max = Float(max) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_numeric(): Expected second argument to be unset or a Numeric, got #{max}:#{max.class}" + end + end + else + max = nil + end + + # check minimum parameter + if args.length > 2 + begin + min = Float(min.to_s) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_numeric(): Expected third argument to be unset or a Numeric, got #{min}:#{min.class}" + end + else + min = nil + end + + # ensure that min < max + if min and max and min > max + raise Puppet::ParseError, "validate_numeric(): Expected second argument to be larger than third argument, got #{max} < #{min}" + end + + # create lamba validator function + validator = lambda do |num| + # check input < max + if max and num > max + raise Puppet::ParseError, "validate_numeric(): Expected #{input.inspect} to be smaller or equal to #{max}, got #{input.inspect}." + end + # check input > min (this will only be checked if no exception has been raised before) + if min and num < min + raise Puppet::ParseError, "validate_numeric(): Expected #{input.inspect} to be greater or equal to #{min}, got #{input.inspect}." + end + end + + # if this is an array, handle it. + case input + when Array + # check every element of the array + input.each_with_index do |arg, pos| + begin + raise TypeError if arg.is_a?(Hash) + arg = Float(arg.to_s) + validator.call(arg) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_numeric(): Expected element at array position #{pos} to be a Numeric, got #{arg.class}" + end + end + # for the sake of compatibility with ruby 1.8, we need extra handling of hashes + when Hash + raise Puppet::ParseError, "validate_integer(): Expected first argument to be a Numeric or Array, got #{input.class}" + # check the input. this will also fail any stuff other than pure, shiny integers + else + begin + input = Float(input.to_s) + validator.call(input) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_numeric(): Expected first argument to be a Numeric or Array, got #{input.class}" + end + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_re.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_re.rb new file mode 100644 index 0000000..0ac83dd --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_re.rb @@ -0,0 +1,50 @@ +module Puppet::Parser::Functions + newfunction(:validate_re, :doc => <<-'ENDHEREDOC') do |args| + Perform simple validation of a string against one or more regular + expressions. The first argument of this function should be a string to + test, and the second argument should be a stringified regular expression + (without the // delimiters) or an array of regular expressions. If none + of the regular expressions match the string passed in, compilation will + abort with a parse error. + + If a third argument is specified, this will be the error message raised and + seen by the user. + + The following strings will validate against the regular expressions: + + validate_re('one', '^one$') + validate_re('one', [ '^one', '^two' ]) + + The following strings will fail to validate, causing compilation to abort: + + validate_re('one', [ '^two', '^three' ]) + + A helpful error message can be returned like this: + + validate_re($::puppetversion, '^2.7', 'The $puppetversion fact value does not match 2.7') + + Note: Compilation will also abort, if the first argument is not a String. Always use + quotes to force stringification: + + validate_re("${::operatingsystemmajrelease}", '^[57]$') + + ENDHEREDOC + + function_deprecation([:validate_re, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Re. There is further documentation for validate_legacy function in the README.']) + + if (args.length < 2) or (args.length > 3) then + raise Puppet::ParseError, "validate_re(): wrong number of arguments (#{args.length}; must be 2 or 3)" + end + + raise Puppet::ParseError, "validate_re(): input needs to be a String, not a #{args[0].class}" unless args[0].is_a? String + + msg = args[2] || "validate_re(): #{args[0].inspect} does not match #{args[1].inspect}" + + # We're using a flattened array here because we can't call String#any? in + # Ruby 1.9 like we can in Ruby 1.8 + raise Puppet::ParseError, msg unless [args[1]].flatten.any? do |re_str| + args[0] =~ Regexp.compile(re_str) + end + + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_slength.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_slength.rb new file mode 100644 index 0000000..383855c --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_slength.rb @@ -0,0 +1,71 @@ +module Puppet::Parser::Functions + + newfunction(:validate_slength, :doc => <<-'ENDHEREDOC') do |args| + Validate that the first argument is a string (or an array of strings), and + less/equal to than the length of the second argument. An optional third + parameter can be given the minimum length. It fails if the first + argument is not a string or array of strings, and if arg 2 and arg 3 are + not convertable to a number. + + The following values will pass: + + validate_slength("discombobulate",17) + validate_slength(["discombobulate","moo"],17) + validate_slength(["discombobulate","moo"],17,3) + + The following valueis will not: + + validate_slength("discombobulate",1) + validate_slength(["discombobulate","thermometer"],5) + validate_slength(["discombobulate","moo"],17,10) + + ENDHEREDOC + + function_deprecation([:validate_slength, 'This method is deprecated, please use the stdlib validate_legacy function, with String[]. There is further documentation for validate_legacy function in the README.']) + + raise Puppet::ParseError, "validate_slength(): Wrong number of arguments (#{args.length}; must be 2 or 3)" unless args.length == 2 or args.length == 3 + + input, max_length, min_length = *args + + begin + max_length = Integer(max_length) + raise ArgumentError if max_length <= 0 + rescue ArgumentError, TypeError + raise Puppet::ParseError, "validate_slength(): Expected second argument to be a positive Numeric, got #{max_length}:#{max_length.class}" + end + + if min_length + begin + min_length = Integer(min_length) + raise ArgumentError if min_length < 0 + rescue ArgumentError, TypeError + raise Puppet::ParseError, "validate_slength(): Expected third argument to be unset or a positive Numeric, got #{min_length}:#{min_length.class}" + end + else + min_length = 0 + end + + raise Puppet::ParseError, "validate_slength(): Expected second argument to be equal to or larger than third argument" unless max_length >= min_length + + validator = lambda do |str| + unless str.length <= max_length and str.length >= min_length + raise Puppet::ParseError, "validate_slength(): Expected length of #{input.inspect} to be between #{min_length} and #{max_length}, was #{input.length}" + end + end + + case input + when String + validator.call(input) + when Array + input.each_with_index do |arg, pos| + if arg.is_a? String + validator.call(arg) + else + raise Puppet::ParseError, "validate_slength(): Expected element at array position #{pos} to be a String, got #{arg.class}" + end + end + else + raise Puppet::ParseError, "validate_slength(): Expected first argument to be a String or Array, got #{input.class}" + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_string.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_string.rb new file mode 100644 index 0000000..6675d86 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_string.rb @@ -0,0 +1,41 @@ +module Puppet::Parser::Functions + + newfunction(:validate_string, :doc => <<-'ENDHEREDOC') do |args| + Validate that all passed values are string data structures. Abort catalog + compilation if any value fails this check. + + The following values will pass: + + $my_string = "one two" + validate_string($my_string, 'three') + + The following values will fail, causing compilation to abort: + + validate_string(true) + validate_string([ 'some', 'array' ]) + + Note: validate_string(undef) will not fail in this version of the + functions API (incl. current and future parser). Instead, use: + + if $var == undef { + fail('...') + } + + ENDHEREDOC + + function_deprecation([:validate_string, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::String. There is further documentation for validate_legacy function in the README.']) + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_string(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + # when called through the v4 API shim, undef gets translated to nil + unless arg.is_a?(String) || arg.nil? + raise Puppet::ParseError, ("#{arg.inspect} is not a string. It looks to be a #{arg.class}") + end + end + + end + +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_x509_rsa_key_pair.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_x509_rsa_key_pair.rb new file mode 100644 index 0000000..fc9f23f --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/validate_x509_rsa_key_pair.rb @@ -0,0 +1,47 @@ +module Puppet::Parser::Functions + + newfunction(:validate_x509_rsa_key_pair, :doc => <<-ENDHEREDOC + Validates a PEM-formatted X.509 certificate and RSA private key using + OpenSSL. Verifies that the certficate's signature was created from the + supplied key. + + Fail compilation if any value fails this check. + + validate_x509_rsa_key_pair($cert, $key) + + ENDHEREDOC + ) do |args| + + require 'openssl' + + NUM_ARGS = 2 unless defined? NUM_ARGS + + unless args.length == NUM_ARGS then + raise Puppet::ParseError, + ("validate_x509_rsa_key_pair(): wrong number of arguments (#{args.length}; must be #{NUM_ARGS})") + end + + args.each do |arg| + unless arg.is_a?(String) + raise Puppet::ParseError, "#{arg.inspect} is not a string." + end + end + + begin + cert = OpenSSL::X509::Certificate.new(args[0]) + rescue OpenSSL::X509::CertificateError => e + raise Puppet::ParseError, "Not a valid x509 certificate: #{e}" + end + + begin + key = OpenSSL::PKey::RSA.new(args[1]) + rescue OpenSSL::PKey::RSAError => e + raise Puppet::ParseError, "Not a valid RSA key: #{e}" + end + + unless cert.verify(key) + raise Puppet::ParseError, "Certificate signature does not match supplied key" + end + end + +end diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/values.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/values.rb new file mode 100644 index 0000000..0ca236c --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/values.rb @@ -0,0 +1,38 @@ +# +# values.rb +# + +module Puppet::Parser::Functions + newfunction(:values, :type => :rvalue, :doc => <<-EOS +When given a hash this function will return the values of that hash. + +*Examples:* + + $hash = { + 'a' => 1, + 'b' => 2, + 'c' => 3, + } + values($hash) + +This example would return: + + [1,2,3] + EOS + ) do |arguments| + + raise(Puppet::ParseError, "values(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + hash = arguments[0] + + unless hash.is_a?(Hash) + raise(Puppet::ParseError, 'values(): Requires hash to work with') + end + + result = hash.values + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/values_at.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/values_at.rb new file mode 100644 index 0000000..04a3d1a --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/values_at.rb @@ -0,0 +1,93 @@ +# +# values_at.rb +# + +module Puppet::Parser::Functions + newfunction(:values_at, :type => :rvalue, :doc => <<-EOS +Finds value inside an array based on location. + +The first argument is the array you want to analyze, and the second element can +be a combination of: + +* A single numeric index +* A range in the form of 'start-stop' (eg. 4-9) +* An array combining the above + +*Examples*: + + values_at(['a','b','c'], 2) + +Would return ['c']. + + values_at(['a','b','c'], ["0-1"]) + +Would return ['a','b']. + + values_at(['a','b','c','d','e'], [0, "2-3"]) + +Would return ['a','c','d']. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "values_at(): Wrong number of arguments given (#{arguments.size} for 2)") if arguments.size < 2 + + array = arguments.shift + + unless array.is_a?(Array) + raise(Puppet::ParseError, 'values_at(): Requires array to work with') + end + + indices = [arguments.shift].flatten() # Get them all ... Pokemon ... + + if not indices or indices.empty? + raise(Puppet::ParseError, 'values_at(): You must provide at least one positive index to collect') + end + + result = [] + indices_list = [] + + indices.each do |i| + i = i.to_s + if m = i.match(/^(\d+)(\.\.\.?|\-)(\d+)$/) + start = m[1].to_i + stop = m[3].to_i + + type = m[2] + + if start > stop + raise(Puppet::ParseError, 'values_at(): Stop index in given indices range is smaller than the start index') + elsif stop > array.size - 1 # First element is at index 0 is it not? + raise(Puppet::ParseError, 'values_at(): Stop index in given indices range exceeds array size') + end + + range = case type + when /^(\.\.|\-)$/ then (start .. stop) + when /^(\.\.\.)$/ then (start ... stop) # Exclusive of last element ... + end + + range.each { |i| indices_list << i.to_i } + else + # Only positive numbers allowed in this case ... + if not i.match(/^\d+$/) + raise(Puppet::ParseError, 'values_at(): Unknown format of given index') + end + + # In Puppet numbers are often string-encoded ... + i = i.to_i + + if i > array.size - 1 # Same story. First element is at index 0 ... + raise(Puppet::ParseError, 'values_at(): Given index exceeds array size') + end + + indices_list << i + end + end + + # We remove nil values as they make no sense in Puppet DSL ... + result = indices_list.collect { |i| array[i] }.compact + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/parser/functions/zip.rb b/environments/prod/modules/stdlib/lib/puppet/parser/functions/zip.rb new file mode 100644 index 0000000..13e24b6 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/parser/functions/zip.rb @@ -0,0 +1,38 @@ +# +# zip.rb +# + +module Puppet::Parser::Functions + newfunction(:zip, :type => :rvalue, :doc => <<-EOS +Takes one element from first array and merges corresponding elements from second array. This generates a sequence of n-element arrays, where n is one more than the count of arguments. + +*Example:* + + zip(['1','2','3'],['4','5','6']) + +Would result in: + + ["1", "4"], ["2", "5"], ["3", "6"] + EOS + ) do |arguments| + + # Technically we support three arguments but only first is mandatory ... + raise(Puppet::ParseError, "zip(): Wrong number of arguments given (#{arguments.size} for 2)") if arguments.size < 2 + + a = arguments[0] + b = arguments[1] + + unless a.is_a?(Array) and b.is_a?(Array) + raise(Puppet::ParseError, 'zip(): Requires array to work with') + end + + flatten = function_str2bool([arguments[2]]) if arguments[2] + + result = a.zip(b) + result = flatten ? result.flatten : result + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/prod/modules/stdlib/lib/puppet/provider/file_line/ruby.rb b/environments/prod/modules/stdlib/lib/puppet/provider/file_line/ruby.rb new file mode 100644 index 0000000..fbf7d8e --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/provider/file_line/ruby.rb @@ -0,0 +1,132 @@ +Puppet::Type.type(:file_line).provide(:ruby) do + def exists? + if resource[:replace].to_s != 'true' and count_matches(match_regex) > 0 + true + else + lines.find do |line| + if resource[:ensure].to_s == 'absent' and resource[:match_for_absence].to_s == 'true' + line.chomp =~ Regexp.new(resource[:match]) + else + line.chomp == resource[:line].chomp + end + end + end + end + + def create + unless resource[:replace].to_s != 'true' and count_matches(match_regex) > 0 + if resource[:match] + handle_create_with_match + elsif resource[:after] + handle_create_with_after + else + append_line + end + end + end + + def destroy + if resource[:match_for_absence].to_s == 'true' and resource[:match] + handle_destroy_with_match + else + handle_destroy_line + end + end + + private + def lines + # If this type is ever used with very large files, we should + # write this in a different way, using a temp + # file; for now assuming that this type is only used on + # small-ish config files that can fit into memory without + # too much trouble. + @lines ||= File.readlines(resource[:path], :encoding => resource[:encoding]) + end + + def match_regex + resource[:match] ? Regexp.new(resource[:match]) : nil + end + + def handle_create_with_match() + regex_after = resource[:after] ? Regexp.new(resource[:after]) : nil + match_count = count_matches(match_regex) + + if match_count > 1 && resource[:multiple].to_s != 'true' + raise Puppet::Error, "More than one line in file '#{resource[:path]}' matches pattern '#{resource[:match]}'" + end + + File.open(resource[:path], 'w') do |fh| + lines.each do |l| + fh.puts(match_regex.match(l) ? resource[:line] : l) + if (match_count == 0 and regex_after) + if regex_after.match(l) + fh.puts(resource[:line]) + match_count += 1 #Increment match_count to indicate that the new line has been inserted. + end + end + end + + if (match_count == 0) + fh.puts(resource[:line]) + end + end + end + + def handle_create_with_after + regex = Regexp.new(resource[:after]) + count = count_matches(regex) + + if count > 1 && resource[:multiple].to_s != 'true' + raise Puppet::Error, "#{count} lines match pattern '#{resource[:after]}' in file '#{resource[:path]}'. One or no line must match the pattern." + end + + File.open(resource[:path], 'w') do |fh| + lines.each do |l| + fh.puts(l) + if regex.match(l) then + fh.puts(resource[:line]) + end + end + end + + if (count == 0) # append the line to the end of the file + append_line + end + end + + def count_matches(regex) + lines.select{|l| l.match(regex)}.size + end + + def handle_destroy_with_match + match_count = count_matches(match_regex) + if match_count > 1 && resource[:multiple].to_s != 'true' + raise Puppet::Error, "More than one line in file '#{resource[:path]}' matches pattern '#{resource[:match]}'" + end + + local_lines = lines + File.open(resource[:path],'w') do |fh| + fh.write(local_lines.reject{|l| match_regex.match(l) }.join('')) + end + end + + def handle_destroy_line + local_lines = lines + File.open(resource[:path],'w') do |fh| + fh.write(local_lines.reject{|l| l.chomp == resource[:line] }.join('')) + end + end + + ## + # append the line to the file. + # + # @api private + def append_line + File.open(resource[:path], 'w') do |fh| + lines.each do |l| + fh.puts(l) + end + fh.puts resource[:line] + end + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/type/anchor.rb b/environments/prod/modules/stdlib/lib/puppet/type/anchor.rb new file mode 100644 index 0000000..fe1e5aa --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/type/anchor.rb @@ -0,0 +1,46 @@ +Puppet::Type.newtype(:anchor) do + desc <<-'ENDOFDESC' + A simple resource type intended to be used as an anchor in a composite class. + + In Puppet 2.6, when a class declares another class, the resources in the + interior class are not contained by the exterior class. This interacts badly + with the pattern of composing complex modules from smaller classes, as it + makes it impossible for end users to specify order relationships between the + exterior class and other modules. + + The anchor type lets you work around this. By sandwiching any interior + classes between two no-op resources that _are_ contained by the exterior + class, you can ensure that all resources in the module are contained. + + class ntp { + # These classes will have the correct order relationship with each + # other. However, without anchors, they won't have any order + # relationship to Class['ntp']. + class { 'ntp::package': } + -> class { 'ntp::config': } + -> class { 'ntp::service': } + + # These two resources "anchor" the composed classes within the ntp + # class. + anchor { 'ntp::begin': } -> Class['ntp::package'] + Class['ntp::service'] -> anchor { 'ntp::end': } + } + + This allows the end user of the ntp module to establish require and before + relationships with Class['ntp']: + + class { 'ntp': } -> class { 'mcollective': } + class { 'mcollective': } -> class { 'ntp': } + + ENDOFDESC + + newparam :name do + desc "The name of the anchor resource." + end + + def refresh + # We don't do anything with them, but we need this to + # show that we are "refresh aware" and not break the + # chain of propagation. + end +end diff --git a/environments/prod/modules/stdlib/lib/puppet/type/file_line.rb b/environments/prod/modules/stdlib/lib/puppet/type/file_line.rb new file mode 100644 index 0000000..e82b246 --- /dev/null +++ b/environments/prod/modules/stdlib/lib/puppet/type/file_line.rb @@ -0,0 +1,146 @@ +Puppet::Type.newtype(:file_line) do + + desc <<-EOT + Ensures that a given line is contained within a file. The implementation + matches the full line, including whitespace at the beginning and end. If + the line is not contained in the given file, Puppet will append the line to + the end of the file to ensure the desired state. Multiple resources may + be declared to manage multiple lines in the same file. + + Example: + + file_line { 'sudo_rule': + path => '/etc/sudoers', + line => '%sudo ALL=(ALL) ALL', + } + + file_line { 'sudo_rule_nopw': + path => '/etc/sudoers', + line => '%sudonopw ALL=(ALL) NOPASSWD: ALL', + } + + In this example, Puppet will ensure both of the specified lines are + contained in the file /etc/sudoers. + + Match Example: + + file_line { 'bashrc_proxy': + ensure => present, + path => '/etc/bashrc', + line => 'export HTTP_PROXY=http://squid.puppetlabs.vm:3128', + match => '^export\ HTTP_PROXY\=', + } + + In this code example match will look for a line beginning with export + followed by HTTP_PROXY and replace it with the value in line. + + Match Example With `ensure => absent`: + + file_line { 'bashrc_proxy': + ensure => absent, + path => '/etc/bashrc', + line => 'export HTTP_PROXY=http://squid.puppetlabs.vm:3128', + match => '^export\ HTTP_PROXY\=', + match_for_absence => true, + } + + In this code example match will look for a line beginning with export + followed by HTTP_PROXY and delete it. If multiple lines match, an + error will be raised unless the `multiple => true` parameter is set. + + Encoding example: + + file_line { "XScreenSaver": + ensure => present, + path => '/root/XScreenSaver' + line => "*lock: 10:00:00", + match => '^*lock:', + encoding => "iso-8859-1", + } + + Files with special characters that are not valid UTF-8 will give the + error message "invalid byte sequence in UTF-8". In this case, determine + the correct file encoding and specify the correct encoding using the + encoding attribute, the value of which needs to be a valid Ruby character + encoding. + + **Autorequires:** If Puppet is managing the file that will contain the line + being managed, the file_line resource will autorequire that file. + EOT + + ensurable do + defaultvalues + defaultto :present + end + + newparam(:name, :namevar => true) do + desc 'An arbitrary name used as the identity of the resource.' + end + + newparam(:match) do + desc 'An optional ruby regular expression to run against existing lines in the file.' + + ' If a match is found, we replace that line rather than adding a new line.' + + ' A regex comparison is performed against the line value and if it does not' + + ' match an exception will be raised.' + end + + newparam(:match_for_absence) do + desc 'An optional value to determine if match should be applied when ensure => absent.' + + ' If set to true and match is set, the line that matches match will be deleted.' + + ' If set to false (the default), match is ignored when ensure => absent.' + + ' When `ensure => present`, match_for_absence is ignored.' + newvalues(true, false) + defaultto false + end + + newparam(:multiple) do + desc 'An optional value to determine if match can change multiple lines.' + + ' If set to false, an exception will be raised if more than one line matches' + newvalues(true, false) + end + + newparam(:after) do + desc 'An optional value used to specify the line after which we will add any new lines. (Existing lines are added in place)' + + ' This is also takes a regex.' + end + + newparam(:line) do + desc 'The line to be appended to the file or used to replace matches found by the match attribute.' + end + + newparam(:path) do + desc 'The file Puppet will ensure contains the line specified by the line parameter.' + validate do |value| + unless Puppet::Util.absolute_path?(value) + raise Puppet::Error, "File paths must be fully qualified, not '#{value}'" + end + end + end + + newparam(:replace) do + desc 'If true, replace line that matches. If false, do not write line if a match is found' + newvalues(true, false) + defaultto true + end + + newparam(:encoding) do + desc 'For files that are not UTF-8 encoded, specify encoding such as iso-8859-1' + defaultto 'UTF-8' + end + + # Autorequire the file resource if it's being managed + autorequire(:file) do + self[:path] + end + + validate do + unless self[:line] + unless (self[:ensure].to_s == 'absent') and (self[:match_for_absence].to_s == 'true') and self[:match] + raise(Puppet::Error, "line is a required attribute") + end + end + unless self[:path] + raise(Puppet::Error, "path is a required attribute") + end + end +end diff --git a/environments/prod/modules/stdlib/manifests/init.pp b/environments/prod/modules/stdlib/manifests/init.pp new file mode 100644 index 0000000..9ea22a7 --- /dev/null +++ b/environments/prod/modules/stdlib/manifests/init.pp @@ -0,0 +1,18 @@ +# Class: stdlib +# +# This module manages stdlib. Most of stdlib's features are automatically +# loaded by Puppet, but this class should be declared in order to use the +# standardized run stages. +# +# Parameters: none +# +# Actions: +# +# Declares all other classes in the stdlib module. Currently, this consists +# of stdlib::stages. +# +# Requires: nothing +# +class stdlib { + include ::stdlib::stages +} diff --git a/environments/prod/modules/stdlib/manifests/stages.pp b/environments/prod/modules/stdlib/manifests/stages.pp new file mode 100644 index 0000000..7de254c --- /dev/null +++ b/environments/prod/modules/stdlib/manifests/stages.pp @@ -0,0 +1,43 @@ +# Class: stdlib::stages +# +# This class manages a standard set of run stages for Puppet. It is managed by +# the stdlib class, and should not be declared independently. +# +# The high level stages are (in order): +# +# * setup +# * main +# * runtime +# * setup_infra +# * deploy_infra +# * setup_app +# * deploy_app +# * deploy +# +# Parameters: none +# +# Actions: +# +# Declares various run-stages for deploying infrastructure, +# language runtimes, and application layers. +# +# Requires: nothing +# +# Sample Usage: +# +# node default { +# include ::stdlib +# class { java: stage => 'runtime' } +# } +# +class stdlib::stages { + + stage { 'setup': before => Stage['main'] } + stage { 'runtime': require => Stage['main'] } + -> stage { 'setup_infra': } + -> stage { 'deploy_infra': } + -> stage { 'setup_app': } + -> stage { 'deploy_app': } + -> stage { 'deploy': } + +} diff --git a/environments/prod/modules/stdlib/metadata.json b/environments/prod/modules/stdlib/metadata.json new file mode 100644 index 0000000..419a8af --- /dev/null +++ b/environments/prod/modules/stdlib/metadata.json @@ -0,0 +1,112 @@ +{ + "name": "puppetlabs-stdlib", + "version": "4.16.0", + "author": "puppetlabs", + "summary": "Standard library of resources for Puppet modules.", + "license": "Apache-2.0", + "source": "https://github.com/puppetlabs/puppetlabs-stdlib", + "project_page": "https://github.com/puppetlabs/puppetlabs-stdlib", + "issues_url": "https://tickets.puppetlabs.com/browse/MODULES", + "dependencies": [ + + ], + "data_provider": null, + "operatingsystem_support": [ + { + "operatingsystem": "RedHat", + "operatingsystemrelease": [ + "4", + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "CentOS", + "operatingsystemrelease": [ + "4", + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "OracleLinux", + "operatingsystemrelease": [ + "4", + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "Scientific", + "operatingsystemrelease": [ + "4", + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "SLES", + "operatingsystemrelease": [ + "10 SP4", + "11 SP1", + "12" + ] + }, + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "6", + "7", + "8" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "10.04", + "12.04", + "14.04", + "16.04" + ] + }, + { + "operatingsystem": "Solaris", + "operatingsystemrelease": [ + "10", + "11" + ] + }, + { + "operatingsystem": "Windows", + "operatingsystemrelease": [ + "Server 2003", + "Server 2003 R2", + "Server 2008", + "Server 2008 R2", + "Server 2012", + "Server 2012 R2", + "7", + "8" + ] + }, + { + "operatingsystem": "AIX", + "operatingsystemrelease": [ + "5.3", + "6.1", + "7.1" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">=2.7.20 <5.0.0" + } + ], + "description": "Standard Library for Puppet Modules" +} diff --git a/environments/prod/modules/stdlib/spec/acceptance/abs_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/abs_spec.rb new file mode 100755 index 0000000..5af436f --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/abs_spec.rb @@ -0,0 +1,30 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'abs function' do + describe 'success' do + it 'should accept a string' do + pp = <<-EOS + $input = '-34.56' + $output = abs($input) + notify { "$output": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: 34.56/) + end + end + + it 'should accept a float' do + pp = <<-EOS + $input = -34.56 + $output = abs($input) + notify { "$output": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: 34.56/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/anchor_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/anchor_spec.rb new file mode 100755 index 0000000..24a9064 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/anchor_spec.rb @@ -0,0 +1,26 @@ +require 'spec_helper_acceptance' + +describe 'anchor type' do + describe 'success' do + it 'should effect proper chaining of resources' do + pp = <<-EOS + class anchored { + anchor { 'anchored::begin': } + ~> anchor { 'anchored::end': } + } + + class anchorrefresh { + notify { 'first': } + ~> class { 'anchored': } + ~> anchor { 'final': } + } + + include anchorrefresh + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Anchor\[final\]: Triggered 'refresh'/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/any2array_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/any2array_spec.rb new file mode 100755 index 0000000..8a13911 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/any2array_spec.rb @@ -0,0 +1,49 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'any2array function' do + describe 'success' do + it 'should create an empty array' do + pp = <<-EOS + $input = '' + $output = any2array($input) + validate_array($output) + notify { "Output: ${output}": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: Output: /) + end + end + + it 'should leave arrays modified' do + pp = <<-EOS + $input = ['test', 'array'] + $output = any2array($input) + validate_array($output) + notify { "Output: ${output}": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: Output: (\[|)test(,\s|)array(\]|)/) + end + end + + it 'should turn a hash into an array' do + pp = <<-EOS + $input = {'test' => 'array'} + $output = any2array($input) + + validate_array($output) + # Check each element of the array is a plain string. + validate_string($output[0]) + validate_string($output[1]) + notify { "Output: ${output}": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: Output: (\[|)test(,\s|)array(\]|)/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/base64_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/base64_spec.rb new file mode 100755 index 0000000..e9096a7 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/base64_spec.rb @@ -0,0 +1,18 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'base64 function' do + describe 'success' do + it 'should encode then decode a string' do + pp = <<-EOS + $encodestring = base64('encode', 'thestring') + $decodestring = base64('decode', $encodestring) + notify { $decodestring: } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/thestring/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/bool2num_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/bool2num_spec.rb new file mode 100755 index 0000000..c69acc6 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/bool2num_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'bool2num function' do + describe 'success' do + ['false', 'f', '0', 'n', 'no'].each do |bool| + it "should convert a given boolean, #{bool}, to 0" do + pp = <<-EOS + $input = "#{bool}" + $output = bool2num($input) + notify { "$output": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: 0/) + end + end + end + + ['true', 't', '1', 'y', 'yes'].each do |bool| + it "should convert a given boolean, #{bool}, to 1" do + pp = <<-EOS + $input = "#{bool}" + $output = bool2num($input) + notify { "$output": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: 1/) + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/build_csv.rb b/environments/prod/modules/stdlib/spec/acceptance/build_csv.rb new file mode 100755 index 0000000..62ecbf1 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/build_csv.rb @@ -0,0 +1,83 @@ +#!/usr/bin/env ruby +# vim: set sw=2 sts=2 et tw=80 : +require 'rspec' + +#XXX Super ugly hack to keep from starting beaker nodes +module Kernel + # make an alias of the original require + alias_method :original_require, :require + # rewrite require + def require name + original_require name if name != 'spec_helper_acceptance' + end +end +UNSUPPORTED_PLATFORMS = [] +def fact(*args) [] end +#XXX End hax + +# Get a list of functions for test coverage +function_list = Dir[File.join(File.dirname(__FILE__),"..","..","lib","puppet","parser","functions","*.rb")].collect do |function_rb| + File.basename(function_rb,".rb") +end + +## Configure rspec to parse tests +options = RSpec::Core::ConfigurationOptions.new(['spec/acceptance']) +configuration = RSpec::configuration +world = RSpec::world +options.parse_options +options.configure(configuration) +configuration.load_spec_files + +## Collect up tests and example groups into a hash +def get_tests(children) + children.inject({}) do |memo,c| + memo[c.description] = Hash.new + memo[c.description]["groups"] = get_tests(c.children) unless c.children.empty? + memo[c.description]["tests"] = c.examples.collect { |e| + e.description unless e.pending? + }.compact unless c.examples.empty? + memo[c.description]["pending_tests"] = c.examples.collect { |e| + e.description if e.pending? + }.compact unless c.examples.empty? + memo + end +end + +def count_test_types_in(type,group) + return 0 if group.nil? + group.inject(0) do |m,(k,v)| + m += v.length if k == type + m += count_tests_in(v) if v.is_a?(Hash) + m + end +end +def count_tests_in(group) + count_test_types_in('tests',group) +end +def count_pending_tests_in(group) + count_test_types_in('pending_tests',group) +end + +# Convert tests hash to csv format +def to_csv(function_list,tests) + function_list.collect do |function_name| + if v = tests["#{function_name} function"] + positive_tests = count_tests_in(v["groups"]["success"]) + negative_tests = count_tests_in(v["groups"]["failure"]) + pending_tests = + count_pending_tests_in(v["groups"]["failure"]) + + count_pending_tests_in(v["groups"]["failure"]) + else + positive_tests = 0 + negative_tests = 0 + pending_tests = 0 + end + sprintf("%-25s, %-9d, %-9d, %-9d", function_name,positive_tests,negative_tests,pending_tests) + end.compact +end + +tests = get_tests(world.example_groups) +csv = to_csv(function_list,tests) +percentage_tested = "#{tests.count*100/function_list.count}%" +printf("%-25s, %-9s, %-9s, %-9s\n","#{percentage_tested} have tests.","Positive","Negative","Pending") +puts csv diff --git a/environments/prod/modules/stdlib/spec/acceptance/capitalize_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/capitalize_spec.rb new file mode 100755 index 0000000..03d01a8 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/capitalize_spec.rb @@ -0,0 +1,33 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'capitalize function' do + describe 'success' do + it 'should capitalize the first letter of a string' do + pp = <<-EOS + $input = 'this is a string' + $output = capitalize($input) + notify { $output: } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: This is a string/) + end + end + + it 'should capitalize the first letter of an array of strings' do + pp = <<-EOS + $input = ['this', 'is', 'a', 'string'] + $output = capitalize($input) + notify { $output: } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: This/) + expect(r.stdout).to match(/Notice: Is/) + expect(r.stdout).to match(/Notice: A/) + expect(r.stdout).to match(/Notice: String/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/ceiling_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/ceiling_spec.rb new file mode 100755 index 0000000..895e4a0 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/ceiling_spec.rb @@ -0,0 +1,39 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'ceiling function' do + describe 'success' do + it 'ceilings floats' do + pp = <<-EOS + $a = 12.8 + $b = 13 + $o = ceiling($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'ceilings integers' do + pp = <<-EOS + $a = 7 + $b = 7 + $o = ceiling($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-numbers' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/chomp_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/chomp_spec.rb new file mode 100755 index 0000000..56e0876 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/chomp_spec.rb @@ -0,0 +1,21 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'chomp function' do + describe 'success' do + it 'should eat the newline' do + pp = <<-EOS + $input = "test\n" + if size($input) != 5 { + fail("Size of ${input} is not 5.") + } + $output = chomp($input) + if size($output) != 4 { + fail("Size of ${input} is not 4.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/chop_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/chop_spec.rb new file mode 100755 index 0000000..0993806 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/chop_spec.rb @@ -0,0 +1,45 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'chop function' do + describe 'success' do + it 'should eat the last character' do + pp = <<-EOS + $input = "test" + if size($input) != 4 { + fail("Size of ${input} is not 4.") + } + $output = chop($input) + if size($output) != 3 { + fail("Size of ${input} is not 3.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should eat the last two characters of \r\n' do + pp = <<-'EOS' + $input = "test\r\n" + if size($input) != 6 { + fail("Size of ${input} is not 6.") + } + $output = chop($input) + if size($output) != 4 { + fail("Size of ${input} is not 4.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should not fail on empty strings' do + pp = <<-EOS + $input = "" + $output = chop($input) + EOS + + apply_manifest(pp, :catch_failures => true) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/clamp_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/clamp_spec.rb new file mode 100755 index 0000000..e8ccb96 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/clamp_spec.rb @@ -0,0 +1,40 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'clamp function' do + describe 'success' do + it 'clamps list of values' do + pp = <<-EOS + $x = 17 + $y = 225 + $z = 155 + $o = clamp($x, $y, $z) + if $o == $z { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'clamps array of values' do + pp = <<-EOS + $a = [7, 19, 66] + $b = 19 + $o = clamp($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles no arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/concat_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/concat_spec.rb new file mode 100755 index 0000000..8d184d1 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/concat_spec.rb @@ -0,0 +1,54 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'concat function' do + describe 'success' do + it 'should concat one array to another' do + pp = <<-EOS + $output = concat(['1','2','3'],['4','5','6']) + validate_array($output) + if size($output) != 6 { + fail("${output} should have 6 elements.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'should concat arrays and primitives to array' do + pp = <<-EOS + $output = concat(['1','2','3'],'4','5','6',['7','8','9']) + validate_array($output) + if size($output) != 9 { + fail("${output} should have 9 elements.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'should concat multiple arrays to one' do + pp = <<-EOS + $output = concat(['1','2','3'],['4','5','6'],['7','8','9']) + validate_array($output) + if size($output) != 9 { + fail("${output} should have 9 elements.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'should concat hash arguments' do + pp = <<-EOS + $output = concat([{"a" => "b"}], {"c" => "d", "e" => "f"}) + validate_array($output) + if size($output) != 2 { + fail("${output} should have 2 elements.") + } + if $output[1] != {"c" => "d", "e" => "f"} { + fail("${output} does not have the expected hash for the second element.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/count_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/count_spec.rb new file mode 100755 index 0000000..18c039d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/count_spec.rb @@ -0,0 +1,30 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'count function' do + describe 'success' do + it 'should count elements in an array' do + pp = <<-EOS + $input = [1,2,3,4] + $output = count($input) + notify { "$output": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: 4/) + end + end + + it 'should count elements in an array that match a second argument' do + pp = <<-EOS + $input = [1,1,1,2] + $output = count($input, 1) + notify { "$output": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: 3/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/deep_merge_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/deep_merge_spec.rb new file mode 100755 index 0000000..8222f24 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/deep_merge_spec.rb @@ -0,0 +1,20 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'deep_merge function' do + describe 'success' do + it 'should deep merge two hashes' do + pp = <<-EOS + $hash1 = {'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } } + $hash2 = {'two' => 'dos', 'three' => { 'five' => 5 } } + $merged_hash = deep_merge($hash1, $hash2) + + if $merged_hash != { 'one' => 1, 'two' => 'dos', 'three' => { 'four' => 4, 'five' => 5 } } { + fail("Hash was incorrectly merged.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/defined_with_params_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/defined_with_params_spec.rb new file mode 100755 index 0000000..a332bd6 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/defined_with_params_spec.rb @@ -0,0 +1,22 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'defined_with_params function' do + describe 'success' do + it 'should successfully notify' do + pp = <<-EOS + user { 'dan': + ensure => present, + } + + if defined_with_params(User[dan], {'ensure' => 'present' }) { + notify { 'User defined with ensure=>present': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: User defined with ensure=>present/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/delete_at_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/delete_at_spec.rb new file mode 100755 index 0000000..d4f852a --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/delete_at_spec.rb @@ -0,0 +1,19 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'delete_at function' do + describe 'success' do + it 'should delete elements of the array' do + pp = <<-EOS + $output = delete_at(['a','b','c','b'], 1) + if $output == ['a','c','b'] { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/delete_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/delete_spec.rb new file mode 100755 index 0000000..f85b093 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/delete_spec.rb @@ -0,0 +1,19 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'delete function' do + describe 'success' do + it 'should delete elements of the array' do + pp = <<-EOS + $output = delete(['a','b','c','b'], 'b') + if $output == ['a','c'] { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/delete_undef_values_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/delete_undef_values_spec.rb new file mode 100755 index 0000000..af45a92 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/delete_undef_values_spec.rb @@ -0,0 +1,19 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'delete_undef_values function' do + describe 'success' do + it 'should delete elements of the array' do + pp = <<-EOS + $output = delete_undef_values({a=>'A', b=>'', c=>undef, d => false}) + if $output == { a => 'A', b => '', d => false } { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/delete_values_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/delete_values_spec.rb new file mode 100755 index 0000000..04b6920 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/delete_values_spec.rb @@ -0,0 +1,25 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'delete_values function' do + describe 'success' do + it 'should delete elements of the hash' do + pp = <<-EOS + $a = { 'a' => 'A', 'b' => 'B', 'B' => 'C', 'd' => 'B' } + $b = { 'a' => 'A', 'B' => 'C' } + $o = delete_values($a, 'B') + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles non-hash arguments' + it 'handles improper argument counts' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/deprecation_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/deprecation_spec.rb new file mode 100644 index 0000000..7a0b34c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/deprecation_spec.rb @@ -0,0 +1,102 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'deprecation function' do + + if fact('operatingsystem') == 'windows' + test_file = 'C:/deprecation' + else + test_file = "/tmp/deprecation" + end + + # It seems that Windows needs everything to be on one line when using puppet apply -e, otherwise the manifests would be in an easier format + add_file_manifest = "\"deprecation('key', 'message') file { '#{test_file}': ensure => present, content => 'test', }\"" + remove_file_manifest = "file { '#{test_file}': ensure => absent }" + + before :all do + apply_manifest(remove_file_manifest) + end + + context 'with --strict=error', if: get_puppet_version =~ /^4/ do + before :all do + @result = on(default, puppet('apply', '--strict=error', '-e', add_file_manifest), acceptable_exit_codes: (0...256)) + end + + after :all do + apply_manifest(remove_file_manifest) + end + + it "should return an error" do + expect(@result.exit_code).to eq(1) + end + + it "should show the error message" do + expect(@result.stderr).to match(/deprecation. key. message/) + end + + describe file("#{test_file}") do + it { is_expected.not_to be_file } + end + end + + context 'with --strict=warning', if: get_puppet_version =~ /^4/ do + before :all do + @result = on(default, puppet('apply', '--strict=warning', '-e', add_file_manifest), acceptable_exit_codes: (0...256)) + end + + after :all do + apply_manifest(remove_file_manifest) + end + + it "should not return an error" do + expect(@result.exit_code).to eq(0) + end + + it "should show the error message" do + expect(@result.stderr).to match(/Warning: message/) + end + + describe file("#{test_file}") do + it { is_expected.to be_file } + end + end + + context 'with --strict=off', if: get_puppet_version =~ /^4/ do + before :all do + @result = on(default, puppet('apply', '--strict=off', '-e', add_file_manifest), acceptable_exit_codes: (0...256)) + end + + after :all do + apply_manifest(remove_file_manifest) + end + + it "should not return an error" do + expect(@result.exit_code).to eq(0) + end + + it "should not show the error message" do + expect(@result.stderr).not_to match(/Warning: message/) + end + + describe file("#{test_file}") do + it { is_expected.to be_file } + end + end + + context 'puppet 3 test', if: get_puppet_version =~ /^3/ do + before :all do + @result = on(default, puppet('apply', '--parser=future', '-e', add_file_manifest), acceptable_exit_codes: (0...256)) + end + after :all do + apply_manifest(remove_file_manifest) + end + + it "should return a deprecation error" do + expect(@result.stderr).to match(/Warning: message/) + end + it "should pass without error" do + expect(@result.exit_code).to eq(0) + end + end + +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/difference_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/difference_spec.rb new file mode 100755 index 0000000..68f6bbe --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/difference_spec.rb @@ -0,0 +1,26 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'difference function' do + describe 'success' do + it 'returns non-duplicates in the first array' do + pp = <<-EOS + $a = ['a','b','c'] + $b = ['b','c','d'] + $c = ['a'] + $o = difference($a, $b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles non-array arguments' + it 'handles improper argument counts' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/dirname_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/dirname_spec.rb new file mode 100755 index 0000000..db83f0f --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/dirname_spec.rb @@ -0,0 +1,42 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'dirname function' do + describe 'success' do + context 'absolute path' do + it 'returns the dirname' do + pp = <<-EOS + $a = '/path/to/a/file.txt' + $b = '/path/to/a' + $o = dirname($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + context 'relative path' do + it 'returns the dirname' do + pp = <<-EOS + $a = 'path/to/a/file.txt' + $b = 'path/to/a' + $o = dirname($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/downcase_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/downcase_spec.rb new file mode 100755 index 0000000..300bcfa --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/downcase_spec.rb @@ -0,0 +1,39 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'downcase function' do + describe 'success' do + it 'returns the downcase' do + pp = <<-EOS + $a = 'AOEU' + $b = 'aoeu' + $o = downcase($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'doesn\'t affect lowercase words' do + pp = <<-EOS + $a = 'aoeu aoeu' + $b = 'aoeu aoeu' + $o = downcase($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-strings' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/empty_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/empty_spec.rb new file mode 100755 index 0000000..97b7333 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/empty_spec.rb @@ -0,0 +1,53 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'empty function' do + describe 'success' do + it 'recognizes empty strings' do + pp = <<-EOS + $a = '' + $b = true + $o = empty($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'recognizes non-empty strings' do + pp = <<-EOS + $a = 'aoeu' + $b = false + $o = empty($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'handles numerical values' do + pp = <<-EOS + $a = 7 + $b = false + $o = empty($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-strings' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/ensure_resource_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/ensure_resource_spec.rb new file mode 100755 index 0000000..93f25dd --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/ensure_resource_spec.rb @@ -0,0 +1,30 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'ensure_resource function' do + describe 'success' do + it 'ensures a resource already declared' do + apply_manifest('') + pp = <<-EOS + notify { "test": loglevel => 'err' } + ensure_resource('notify', 'test', { 'loglevel' => 'err' }) + EOS + + apply_manifest(pp, :expect_changes => true) + end + + it 'ensures a undeclared resource' do + apply_manifest('') + pp = <<-EOS + ensure_resource('notify', 'test', { 'loglevel' => 'err' }) + EOS + + apply_manifest(pp, :expect_changes => true) + end + it 'takes defaults arguments' + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/flatten_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/flatten_spec.rb new file mode 100755 index 0000000..289eec9 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/flatten_spec.rb @@ -0,0 +1,39 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'flatten function' do + describe 'success' do + it 'flattens arrays' do + pp = <<-EOS + $a = ["a","b",["c",["d","e"],"f","g"]] + $b = ["a","b","c","d","e","f","g"] + $o = flatten($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'does not affect flat arrays' do + pp = <<-EOS + $a = ["a","b","c","d","e","f","g"] + $b = ["a","b","c","d","e","f","g"] + $o = flatten($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-strings' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/floor_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/floor_spec.rb new file mode 100755 index 0000000..8259d2a --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/floor_spec.rb @@ -0,0 +1,39 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'floor function' do + describe 'success' do + it 'floors floats' do + pp = <<-EOS + $a = 12.8 + $b = 12 + $o = floor($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'floors integers' do + pp = <<-EOS + $a = 7 + $b = 7 + $o = floor($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-numbers' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/fqdn_rand_string_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/fqdn_rand_string_spec.rb new file mode 100644 index 0000000..af1b2a9 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/fqdn_rand_string_spec.rb @@ -0,0 +1,66 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'fqdn_rand_string function' do + describe 'success' do + include_context "with faked facts" + context "when the FQDN is 'fakehost.localdomain'" do + before :each do + fake_fact("fqdn", "fakehost.localdomain") + end + + it 'generates random alphanumeric strings' do + pp = <<-eos + $l = 10 + $o = fqdn_rand_string($l) + notice(inline_template('fqdn_rand_string is <%= @o.inspect %>')) + eos + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rand_string is "(7oDp0KOr1b|9Acvnhkt4J)"/) + end + end + it 'generates random alphanumeric strings with custom charsets' do + pp = <<-eos + $l = 10 + $c = '0123456789' + $o = fqdn_rand_string($l, $c) + notice(inline_template('fqdn_rand_string is <%= @o.inspect %>')) + eos + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rand_string is "(7203048515|2383756694)"/) + end + end + it 'generates random alphanumeric strings with custom seeds' do + pp = <<-eos + $l = 10 + $s = 'seed' + $o = fqdn_rand_string($l, undef, $s) + notice(inline_template('fqdn_rand_string is <%= @o.inspect %>')) + eos + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rand_string is "(3HS4mbuI3E|1jJtAMs94d)"/) + end + end + it 'generates random alphanumeric strings with custom charsets and seeds' do + pp = <<-eos + $l = 10 + $c = '0123456789' + $s = 'seed' + $o = fqdn_rand_string($l, $c, $s) + notice(inline_template('fqdn_rand_string is <%= @o.inspect %>')) + eos + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rand_string is "(3104058232|7100592312)"/) + end + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-numbers for length argument' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/fqdn_rotate_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/fqdn_rotate_spec.rb new file mode 100755 index 0000000..66e94a9 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/fqdn_rotate_spec.rb @@ -0,0 +1,64 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'fqdn_rotate function' do + describe 'success' do + include_context "with faked facts" + context "when the FQDN is 'fakehost.localdomain'" do + before :each do + fake_fact("fqdn", "fakehost.localdomain") + end + + it 'rotates arrays' do + pp = <<-EOS + $a = ['a','b','c','d'] + $o = fqdn_rotate($a) + notice(inline_template('fqdn_rotate is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rotate is \["d", "a", "b", "c"\]/) + end + end + it 'rotates arrays with custom seeds' do + pp = <<-EOS + $a = ['a','b','c','d'] + $s = 'seed' + $o = fqdn_rotate($a, $s) + notice(inline_template('fqdn_rotate is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rotate is \["c", "d", "a", "b"\]/) + end + end + it 'rotates strings' do + pp = <<-EOS + $a = 'abcd' + $o = fqdn_rotate($a) + notice(inline_template('fqdn_rotate is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rotate is "dabc"/) + end + end + it 'rotates strings with custom seeds' do + pp = <<-EOS + $a = 'abcd' + $s = 'seed' + $o = fqdn_rotate($a, $s) + notice(inline_template('fqdn_rotate is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rotate is "cdab"/) + end + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles invalid arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/get_module_path_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/get_module_path_spec.rb new file mode 100755 index 0000000..3d10251 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/get_module_path_spec.rb @@ -0,0 +1,27 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'get_module_path function' do + describe 'success' do + it 'get_module_paths dne' do + pp = <<-EOS + $a = $::is_pe ? { + 'true' => '/etc/puppetlabs/puppet/modules/dne', + 'false' => '/etc/puppet/modules/dne', + } + $o = get_module_path('dne') + if $o == $a { + notify { 'output correct': } + } else { + notify { "failed; module path is '$o'": } + } + EOS + + apply_manifest(pp, :expect_failures => true) + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-numbers' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/getparam_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/getparam_spec.rb new file mode 100755 index 0000000..bd12154 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/getparam_spec.rb @@ -0,0 +1,24 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'getparam function' do + describe 'success' do + it 'getparam a notify' do + pp = <<-EOS + notify { 'rspec': + message => 'custom rspec message', + } + $o = getparam(Notify['rspec'], 'message') + notice(inline_template('getparam is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/getparam is "custom rspec message"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/getvar_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/getvar_spec.rb new file mode 100755 index 0000000..605cdce --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/getvar_spec.rb @@ -0,0 +1,26 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'getvar function' do + describe 'success' do + it 'getvars from classes' do + pp = <<-EOS + class a::data { $foo = 'aoeu' } + include a::data + $b = 'aoeu' + $o = getvar("a::data::foo") + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-numbers' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/grep_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/grep_spec.rb new file mode 100755 index 0000000..7c35ee4 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/grep_spec.rb @@ -0,0 +1,26 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'grep function' do + describe 'success' do + it 'greps arrays' do + pp = <<-EOS + $a = ['aaabbb','bbbccc','dddeee'] + $b = 'bbb' + $c = ['aaabbb','bbbccc'] + $o = grep($a,$b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/has_interface_with_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/has_interface_with_spec.rb new file mode 100755 index 0000000..fd33af5 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/has_interface_with_spec.rb @@ -0,0 +1,54 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'has_interface_with function', :unless => ((fact('osfamily') == 'windows') or (fact('osfamily') == 'AIX')) do + describe 'success' do + it 'has_interface_with existing ipaddress' do + pp = <<-EOS + $a = $::ipaddress + $o = has_interface_with('ipaddress', $a) + notice(inline_template('has_interface_with is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_interface_with is true/) + end + end + it 'has_interface_with absent ipaddress' do + pp = <<-EOS + $a = '128.0.0.1' + $o = has_interface_with('ipaddress', $a) + notice(inline_template('has_interface_with is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_interface_with is false/) + end + end + it 'has_interface_with existing interface' do + pp = <<-EOS + if $osfamily == 'Solaris' or $osfamily == 'Darwin' { + $a = 'lo0' + }elsif $osfamily == 'windows' { + $a = $::kernelmajversion ? { + /6\.(2|3|4)/ => 'Ethernet0', + /6\.(0|1)/ => 'Local_Area_Connection', + /5\.(1|2)/ => undef, #Broken current in facter + } + }else { + $a = 'lo' + } + $o = has_interface_with($a) + notice(inline_template('has_interface_with is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_interface_with is true/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/has_ip_address_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/has_ip_address_spec.rb new file mode 100755 index 0000000..878d921 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/has_ip_address_spec.rb @@ -0,0 +1,33 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'has_ip_address function', :unless => ((fact('osfamily') == 'windows') or (fact('osfamily') == 'AIX')) do + describe 'success' do + it 'has_ip_address existing ipaddress' do + pp = <<-EOS + $a = '127.0.0.1' + $o = has_ip_address($a) + notice(inline_template('has_ip_address is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_ip_address is true/) + end + end + it 'has_ip_address absent ipaddress' do + pp = <<-EOS + $a = '128.0.0.1' + $o = has_ip_address($a) + notice(inline_template('has_ip_address is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_ip_address is false/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/has_ip_network_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/has_ip_network_spec.rb new file mode 100755 index 0000000..f7a7d35 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/has_ip_network_spec.rb @@ -0,0 +1,33 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'has_ip_network function', :unless => ((fact('osfamily') == 'windows') or (fact('osfamily') == 'AIX')) do + describe 'success' do + it 'has_ip_network existing ipaddress' do + pp = <<-EOS + $a = '127.0.0.0' + $o = has_ip_network($a) + notice(inline_template('has_ip_network is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_ip_network is true/) + end + end + it 'has_ip_network absent ipaddress' do + pp = <<-EOS + $a = '128.0.0.0' + $o = has_ip_network($a) + notice(inline_template('has_ip_network is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_ip_network is false/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/has_key_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/has_key_spec.rb new file mode 100755 index 0000000..661c122 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/has_key_spec.rb @@ -0,0 +1,41 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'has_key function' do + describe 'success' do + it 'has_keys in hashes' do + pp = <<-EOS + $a = { 'aaa' => 'bbb','bbb' => 'ccc','ddd' => 'eee' } + $b = 'bbb' + $c = true + $o = has_key($a,$b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'has_keys not in hashes' do + pp = <<-EOS + $a = { 'aaa' => 'bbb','bbb' => 'ccc','ddd' => 'eee' } + $b = 'ccc' + $c = false + $o = has_key($a,$b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-hashes' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/hash_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/hash_spec.rb new file mode 100755 index 0000000..85da50b --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/hash_spec.rb @@ -0,0 +1,26 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'hash function' do + describe 'success' do + it 'hashs arrays' do + pp = <<-EOS + $a = ['aaa','bbb','bbb','ccc','ddd','eee'] + $b = { 'aaa' => 'bbb', 'bbb' => 'ccc', 'ddd' => 'eee' } + $o = hash($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'handles odd-length arrays' + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/intersection_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/intersection_spec.rb new file mode 100755 index 0000000..02d4e7d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/intersection_spec.rb @@ -0,0 +1,27 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'intersection function' do + describe 'success' do + it 'intersections arrays' do + pp = <<-EOS + $a = ['aaa','bbb','ccc'] + $b = ['bbb','ccc','ddd','eee'] + $c = ['bbb','ccc'] + $o = intersection($a,$b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'intersections empty arrays' + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_a_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_a_spec.rb new file mode 100644 index 0000000..fb0019a --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_a_spec.rb @@ -0,0 +1,30 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +if get_puppet_version =~ /^4/ + describe 'is_a function' do + it 'should match a string' do + pp = <<-EOS + if 'hello world'.is_a(String) { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + + it 'should not match a integer as string' do + pp = <<-EOS + if 5.is_a(String) { + notify { 'output wrong': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).not_to match(/Notice: output wrong/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_array_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_array_spec.rb new file mode 100755 index 0000000..1a83417 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_array_spec.rb @@ -0,0 +1,67 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_array function' do + describe 'success' do + it 'is_arrays arrays' do + pp = <<-EOS + $a = ['aaa','bbb','ccc'] + $b = true + $o = is_array($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_arrays empty arrays' do + pp = <<-EOS + $a = [] + $b = true + $o = is_array($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_arrays strings' do + pp = <<-EOS + $a = "aoeu" + $b = false + $o = is_array($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_arrays hashes' do + pp = <<-EOS + $a = {'aaa'=>'bbb'} + $b = false + $o = is_array($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_bool_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_bool_spec.rb new file mode 100755 index 0000000..823cb46 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_bool_spec.rb @@ -0,0 +1,81 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_bool function' do + describe 'success' do + it 'is_bools arrays' do + pp = <<-EOS + $a = ['aaa','bbb','ccc'] + $b = false + $o = is_bool($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_bools true' do + pp = <<-EOS + $a = true + $b = true + $o = is_bool($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_bools false' do + pp = <<-EOS + $a = false + $b = true + $o = is_bool($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_bools strings' do + pp = <<-EOS + $a = "true" + $b = false + $o = is_bool($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_bools hashes' do + pp = <<-EOS + $a = {'aaa'=>'bbb'} + $b = false + $o = is_bool($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_domain_name_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_domain_name_spec.rb new file mode 100755 index 0000000..884b0bc --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_domain_name_spec.rb @@ -0,0 +1,83 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_domain_name function' do + describe 'success' do + it 'is_domain_names arrays' do + pp = <<-EOS + $a = ['aaa.com','bbb','ccc'] + $o = is_domain_name($a) + notice(inline_template('is_domain_name is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_domain_name is false/) + end + end + it 'is_domain_names true' do + pp = <<-EOS + $a = true + $o = is_domain_name($a) + notice(inline_template('is_domain_name is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_domain_name is false/) + end + end + it 'is_domain_names false' do + pp = <<-EOS + $a = false + $o = is_domain_name($a) + notice(inline_template('is_domain_name is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_domain_name is false/) + end + end + it 'is_domain_names strings with hyphens' do + pp = <<-EOS + $a = "3foo-bar.2bar-fuzz.com" + $b = true + $o = is_domain_name($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_domain_names strings beginning with hyphens' do + pp = <<-EOS + $a = "-bar.2bar-fuzz.com" + $b = false + $o = is_domain_name($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_domain_names hashes' do + pp = <<-EOS + $a = {'aaa'=>'www.com'} + $o = is_domain_name($a) + notice(inline_template('is_domain_name is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_domain_name is false/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_float_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_float_spec.rb new file mode 100755 index 0000000..0b38d94 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_float_spec.rb @@ -0,0 +1,86 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_float function' do + describe 'success' do + it 'is_floats arrays' do + pp = <<-EOS + $a = ['aaa.com','bbb','ccc'] + $o = is_float($a) + notice(inline_template('is_float is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_float is false/) + end + end + it 'is_floats true' do + pp = <<-EOS + $a = true + $o = is_float($a) + notice(inline_template('is_float is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_float is false/) + end + end + it 'is_floats strings' do + pp = <<-EOS + $a = "3.5" + $b = true + $o = is_float($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_floats floats' do + pp = <<-EOS + $a = 3.5 + $b = true + $o = is_float($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_floats integers' do + pp = <<-EOS + $a = 3 + $b = false + $o = is_float($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_floats hashes' do + pp = <<-EOS + $a = {'aaa'=>'www.com'} + $o = is_float($a) + notice(inline_template('is_float is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_float is false/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_function_available_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_function_available_spec.rb new file mode 100755 index 0000000..f8191ee --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_function_available_spec.rb @@ -0,0 +1,58 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_function_available function' do + describe 'success' do + it 'is_function_availables arrays' do + pp = <<-EOS + $a = ['fail','include','require'] + $o = is_function_available($a) + notice(inline_template('is_function_available is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_function_available is false/) + end + end + it 'is_function_availables true' do + pp = <<-EOS + $a = true + $o = is_function_available($a) + notice(inline_template('is_function_available is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_function_available is false/) + end + end + it 'is_function_availables strings' do + pp = <<-EOS + $a = "fail" + $b = true + $o = is_function_available($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_function_availables function_availables' do + pp = <<-EOS + $a = "is_function_available" + $o = is_function_available($a) + notice(inline_template('is_function_available is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_function_available is true/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_hash_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_hash_spec.rb new file mode 100755 index 0000000..64f016c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_hash_spec.rb @@ -0,0 +1,63 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_hash function' do + describe 'success' do + it 'is_hashs arrays' do + pp = <<-EOS + $a = ['aaa','bbb','ccc'] + $o = is_hash($a) + notice(inline_template('is_hash is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_hash is false/) + end + end + it 'is_hashs empty hashs' do + pp = <<-EOS + $a = {} + $b = true + $o = is_hash($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_hashs strings' do + pp = <<-EOS + $a = "aoeu" + $b = false + $o = is_hash($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_hashs hashes' do + pp = <<-EOS + $a = {'aaa'=>'bbb'} + $b = true + $o = is_hash($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_integer_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_integer_spec.rb new file mode 100755 index 0000000..7333687 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_integer_spec.rb @@ -0,0 +1,95 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_integer function' do + describe 'success' do + it 'is_integers arrays' do + pp = <<-EOS + $a = ['aaa.com','bbb','ccc'] + $b = false + $o = is_integer($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_integers true' do + pp = <<-EOS + $a = true + $b = false + $o = is_integer($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_integers strings' do + pp = <<-EOS + $a = "3" + $b = true + $o = is_integer($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_integers floats' do + pp = <<-EOS + $a = 3.5 + $b = false + $o = is_integer($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_integers integers' do + pp = <<-EOS + $a = 3 + $b = true + $o = is_integer($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_integers hashes' do + pp = <<-EOS + $a = {'aaa'=>'www.com'} + $b = false + $o = is_integer($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_ip_address_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_ip_address_spec.rb new file mode 100755 index 0000000..2c62c77 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_ip_address_spec.rb @@ -0,0 +1,80 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_ip_address function' do + describe 'success' do + it 'is_ip_addresss ipv4' do + pp = <<-EOS + $a = '1.2.3.4' + $b = true + $o = is_ip_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ip_addresss ipv6' do + pp = <<-EOS + $a = "fe80:0000:cd12:d123:e2f8:47ff:fe09:dd74" + $b = true + $o = is_ip_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ip_addresss ipv6 compressed' do + pp = <<-EOS + $a = "fe00::1" + $b = true + $o = is_ip_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ip_addresss strings' do + pp = <<-EOS + $a = "aoeu" + $b = false + $o = is_ip_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ip_addresss ipv4 out of range' do + pp = <<-EOS + $a = '1.2.3.400' + $b = false + $o = is_ip_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_ipv4_address_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_ipv4_address_spec.rb new file mode 100755 index 0000000..abe26d8 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_ipv4_address_spec.rb @@ -0,0 +1,52 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_ipv4_address function' do + describe 'success' do + it 'is_ipv4_addresss' do + pp = <<-EOS + $a = '1.2.3.4' + $b = true + $o = is_ipv4_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ipv4_addresss strings' do + pp = <<-EOS + $a = "aoeu" + $b = false + $o = is_ipv4_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ipv4_addresss ipv4 out of range' do + pp = <<-EOS + $a = '1.2.3.400' + $b = false + $o = is_ipv4_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_ipv6_address_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_ipv6_address_spec.rb new file mode 100755 index 0000000..73a3fa4 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_ipv6_address_spec.rb @@ -0,0 +1,66 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_ipv6_address function' do + describe 'success' do + it 'is_ipv6_addresss' do + pp = <<-EOS + $a = "fe80:0000:cd12:d123:e2f8:47ff:fe09:dd74" + $b = true + $o = is_ipv6_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ipv6_addresss ipv6 compressed' do + pp = <<-EOS + $a = "fe00::1" + $b = true + $o = is_ipv6_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ipv6_addresss strings' do + pp = <<-EOS + $a = "aoeu" + $b = false + $o = is_ipv6_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ipv6_addresss ip out of range' do + pp = <<-EOS + $a = 'fe80:0000:cd12:d123:e2f8:47ff:fe09:gggg' + $b = false + $o = is_ipv6_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_mac_address_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_mac_address_spec.rb new file mode 100755 index 0000000..617bef6 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_mac_address_spec.rb @@ -0,0 +1,38 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_mac_address function' do + describe 'success' do + it 'is_mac_addresss a mac' do + pp = <<-EOS + $a = '00:a0:1f:12:7f:a0' + $b = true + $o = is_mac_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_mac_addresss a mac out of range' do + pp = <<-EOS + $a = '00:a0:1f:12:7f:g0' + $b = false + $o = is_mac_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_numeric_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_numeric_spec.rb new file mode 100755 index 0000000..7e65384 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_numeric_spec.rb @@ -0,0 +1,95 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_numeric function' do + describe 'success' do + it 'is_numerics arrays' do + pp = <<-EOS + $a = ['aaa.com','bbb','ccc'] + $b = false + $o = is_numeric($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_numerics true' do + pp = <<-EOS + $a = true + $b = false + $o = is_numeric($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_numerics strings' do + pp = <<-EOS + $a = "3" + $b = true + $o = is_numeric($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_numerics floats' do + pp = <<-EOS + $a = 3.5 + $b = true + $o = is_numeric($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_numerics integers' do + pp = <<-EOS + $a = 3 + $b = true + $o = is_numeric($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_numerics hashes' do + pp = <<-EOS + $a = {'aaa'=>'www.com'} + $b = false + $o = is_numeric($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/is_string_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/is_string_spec.rb new file mode 100755 index 0000000..bee5e01 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/is_string_spec.rb @@ -0,0 +1,113 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_string function' do + describe 'success' do + it 'is_strings arrays' do + pp = <<-EOS + $a = ['aaa.com','bbb','ccc'] + $b = false + $o = is_string($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_strings true' do + pp = <<-EOS + $a = true + $b = false + $o = is_string($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_strings strings' do + pp = <<-EOS + $a = "aoeu" + $o = is_string($a) + notice(inline_template('is_string is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_string is true/) + end + end + it 'is_strings number strings' do + pp = <<-EOS + $a = "3" + $o = is_string($a) + notice(inline_template('is_string is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_string is false/) + end + end + it 'is_strings floats' do + pp = <<-EOS + $a = 3.5 + $b = false + $o = is_string($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_strings integers' do + pp = <<-EOS + $a = 3 + $b = false + $o = is_string($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_strings hashes' do + pp = <<-EOS + $a = {'aaa'=>'www.com'} + $b = false + $o = is_string($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_strings undef' do + pp = <<-EOS + $a = undef + $o = is_string($a) + notice(inline_template('is_string is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_string is true/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/join_keys_to_values_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/join_keys_to_values_spec.rb new file mode 100755 index 0000000..ae6947e --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/join_keys_to_values_spec.rb @@ -0,0 +1,24 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'join_keys_to_values function' do + describe 'success' do + it 'join_keys_to_valuess hashes' do + pp = <<-EOS + $a = {'aaa'=>'bbb','ccc'=>'ddd'} + $b = ':' + $o = join_keys_to_values($a,$b) + notice(inline_template('join_keys_to_values is <%= @o.sort.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/join_keys_to_values is \["aaa:bbb", "ccc:ddd"\]/) + end + end + it 'handles non hashes' + it 'handles empty hashes' + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/join_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/join_spec.rb new file mode 100755 index 0000000..75b88d8 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/join_spec.rb @@ -0,0 +1,26 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'join function' do + describe 'success' do + it 'joins arrays' do + pp = <<-EOS + $a = ['aaa','bbb','ccc'] + $b = ':' + $c = 'aaa:bbb:ccc' + $o = join($a,$b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'handles non arrays' + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/keys_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/keys_spec.rb new file mode 100755 index 0000000..65bfe28 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/keys_spec.rb @@ -0,0 +1,23 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'keys function' do + describe 'success' do + it 'keyss hashes' do + pp = <<-EOS + $a = {'aaa'=>'bbb','ccc'=>'ddd'} + $o = keys($a) + notice(inline_template('keys is <%= @o.sort.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/keys is \["aaa", "ccc"\]/) + end + end + it 'handles non hashes' + it 'handles empty hashes' + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/loadjson_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/loadjson_spec.rb new file mode 100644 index 0000000..ebd5307 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/loadjson_spec.rb @@ -0,0 +1,52 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +tmpdir = default.tmpdir('stdlib') + +describe 'loadjson function' do + describe 'success' do + it 'loadjsons array of values' do + shell("echo '{\"aaa\":1,\"bbb\":2,\"ccc\":3,\"ddd\":4}' > #{tmpdir}/testjson.json") + pp = <<-EOS + $o = loadjson('#{tmpdir}/testjson.json') + notice(inline_template('loadjson[aaa] is <%= @o["aaa"].inspect %>')) + notice(inline_template('loadjson[bbb] is <%= @o["bbb"].inspect %>')) + notice(inline_template('loadjson[ccc] is <%= @o["ccc"].inspect %>')) + notice(inline_template('loadjson[ddd] is <%= @o["ddd"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/loadjson\[aaa\] is 1/) + expect(r.stdout).to match(/loadjson\[bbb\] is 2/) + expect(r.stdout).to match(/loadjson\[ccc\] is 3/) + expect(r.stdout).to match(/loadjson\[ddd\] is 4/) + end + end + + it 'returns the default value if there is no file to load' do + pp = <<-EOS + $o = loadjson('#{tmpdir}/no-file.json', {'default' => 'value'}) + notice(inline_template('loadjson[default] is <%= @o["default"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/loadjson\[default\] is "value"/) + end + end + + it 'returns the default value if the file was parsed with an error' do + shell("echo '!' > #{tmpdir}/testjson.json") + pp = <<-EOS + $o = loadjson('#{tmpdir}/testjson.json', {'default' => 'value'}) + notice(inline_template('loadjson[default] is <%= @o["default"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/loadjson\[default\] is "value"/) + end + end + end + describe 'failure' do + it 'fails with no arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/loadyaml_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/loadyaml_spec.rb new file mode 100644 index 0000000..57fb8cb --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/loadyaml_spec.rb @@ -0,0 +1,56 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +tmpdir = default.tmpdir('stdlib') + +describe 'loadyaml function' do + describe 'success' do + it 'loadyamls array of values' do + shell("echo '--- + aaa: 1 + bbb: 2 + ccc: 3 + ddd: 4' > #{tmpdir}/testyaml.yaml") + pp = <<-EOS + $o = loadyaml('#{tmpdir}/testyaml.yaml') + notice(inline_template('loadyaml[aaa] is <%= @o["aaa"].inspect %>')) + notice(inline_template('loadyaml[bbb] is <%= @o["bbb"].inspect %>')) + notice(inline_template('loadyaml[ccc] is <%= @o["ccc"].inspect %>')) + notice(inline_template('loadyaml[ddd] is <%= @o["ddd"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/loadyaml\[aaa\] is 1/) + expect(r.stdout).to match(/loadyaml\[bbb\] is 2/) + expect(r.stdout).to match(/loadyaml\[ccc\] is 3/) + expect(r.stdout).to match(/loadyaml\[ddd\] is 4/) + end + end + + it 'returns the default value if there is no file to load' do + pp = <<-EOS + $o = loadyaml('#{tmpdir}/no-file.yaml', {'default' => 'value'}) + notice(inline_template('loadyaml[default] is <%= @o["default"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/loadyaml\[default\] is "value"/) + end + end + + it 'returns the default value if the file was parsed with an error' do + shell("echo '!' > #{tmpdir}/testyaml.yaml") + pp = <<-EOS + $o = loadyaml('#{tmpdir}/testyaml.yaml', {'default' => 'value'}) + notice(inline_template('loadyaml[default] is <%= @o["default"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/loadyaml\[default\] is "value"/) + end + end + end + describe 'failure' do + it 'fails with no arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/lstrip_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/lstrip_spec.rb new file mode 100755 index 0000000..eba5d0d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/lstrip_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'lstrip function' do + describe 'success' do + it 'lstrips arrays' do + pp = <<-EOS + $a = [" the "," public "," art","galleries "] + # Anagram: Large picture halls, I bet + $o = lstrip($a) + notice(inline_template('lstrip is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/lstrip is \["the ", "public ", "art", "galleries "\]/) + end + end + it 'lstrips strings' do + pp = <<-EOS + $a = " blowzy night-frumps vex'd jack q " + $o = lstrip($a) + notice(inline_template('lstrip is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/lstrip is "blowzy night-frumps vex'd jack q "/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/max_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/max_spec.rb new file mode 100755 index 0000000..3caa813 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/max_spec.rb @@ -0,0 +1,20 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'max function' do + describe 'success' do + it 'maxs arrays' do + pp = <<-EOS + $o = max("the","public","art","galleries") + notice(inline_template('max is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/max is "the"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/member_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/member_spec.rb new file mode 100755 index 0000000..2bcadd3 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/member_spec.rb @@ -0,0 +1,54 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'member function' do + shared_examples 'item found' do + it 'should output correctly' do + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'success' do + it 'members arrays' do + pp = <<-EOS + $a = ['aaa','bbb','ccc'] + $b = 'ccc' + $c = true + $o = member($a,$b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + describe 'members array of integers' do + it_should_behave_like 'item found' do + let(:pp) { <<-EOS + if member( [1,2,3,4], 4 ){ + notify { 'output correct': } + } + EOS + } + end + end + describe 'members of mixed array' do + it_should_behave_like 'item found' do + let(:pp) { <<-EOS + if member( ['a','4',3], 'a' ){ + notify { 'output correct': } +} + EOS + } + end + end + it 'members arrays without members' + end + + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/merge_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/merge_spec.rb new file mode 100755 index 0000000..814db4e --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/merge_spec.rb @@ -0,0 +1,23 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'merge function' do + describe 'success' do + it 'should merge two hashes' do + pp = <<-EOS + $a = {'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } } + $b = {'two' => 'dos', 'three' => { 'five' => 5 } } + $o = merge($a, $b) + notice(inline_template('merge[one] is <%= @o["one"].inspect %>')) + notice(inline_template('merge[two] is <%= @o["two"].inspect %>')) + notice(inline_template('merge[three] is <%= @o["three"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/merge\[one\] is ("1"|1)/) + expect(r.stdout).to match(/merge\[two\] is "dos"/) + expect(r.stdout).to match(/merge\[three\] is {"five"=>("5"|5)}/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/min_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/min_spec.rb new file mode 100755 index 0000000..7b18fac --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/min_spec.rb @@ -0,0 +1,20 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'min function' do + describe 'success' do + it 'mins arrays' do + pp = <<-EOS + $o = min("the","public","art","galleries") + notice(inline_template('min is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/min is "art"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/nodesets/centos-7-x64.yml b/environments/prod/modules/stdlib/spec/acceptance/nodesets/centos-7-x64.yml new file mode 100644 index 0000000..5eebdef --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/nodesets/centos-7-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + centos-7-x64: + roles: + - agent + - default + platform: el-7-x86_64 + hypervisor: vagrant + box: puppetlabs/centos-7.2-64-nocm +CONFIG: + type: foss diff --git a/environments/prod/modules/stdlib/spec/acceptance/nodesets/debian-8-x64.yml b/environments/prod/modules/stdlib/spec/acceptance/nodesets/debian-8-x64.yml new file mode 100644 index 0000000..fef6e63 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/nodesets/debian-8-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + debian-8-x64: + roles: + - agent + - default + platform: debian-8-amd64 + hypervisor: vagrant + box: puppetlabs/debian-8.2-64-nocm +CONFIG: + type: foss diff --git a/environments/prod/modules/stdlib/spec/acceptance/nodesets/default.yml b/environments/prod/modules/stdlib/spec/acceptance/nodesets/default.yml new file mode 100644 index 0000000..dba339c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/nodesets/default.yml @@ -0,0 +1,10 @@ +HOSTS: + ubuntu-1404-x64: + roles: + - agent + - default + platform: ubuntu-14.04-amd64 + hypervisor: vagrant + box: puppetlabs/ubuntu-14.04-64-nocm +CONFIG: + type: foss diff --git a/environments/prod/modules/stdlib/spec/acceptance/nodesets/docker/centos-7.yml b/environments/prod/modules/stdlib/spec/acceptance/nodesets/docker/centos-7.yml new file mode 100644 index 0000000..a3333aa --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/nodesets/docker/centos-7.yml @@ -0,0 +1,12 @@ +HOSTS: + centos-7-x64: + platform: el-7-x86_64 + hypervisor: docker + image: centos:7 + docker_preserve_image: true + docker_cmd: '["/usr/sbin/init"]' + # install various tools required to get the image up to usable levels + docker_image_commands: + - 'yum install -y crontabs tar wget openssl sysvinit-tools iproute which initscripts' +CONFIG: + trace_limit: 200 diff --git a/environments/prod/modules/stdlib/spec/acceptance/nodesets/docker/debian-8.yml b/environments/prod/modules/stdlib/spec/acceptance/nodesets/docker/debian-8.yml new file mode 100644 index 0000000..df5c319 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/nodesets/docker/debian-8.yml @@ -0,0 +1,11 @@ +HOSTS: + debian-8-x64: + platform: debian-8-amd64 + hypervisor: docker + image: debian:8 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get update && apt-get install -y net-tools wget locales strace lsof && echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen' +CONFIG: + trace_limit: 200 diff --git a/environments/prod/modules/stdlib/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/environments/prod/modules/stdlib/spec/acceptance/nodesets/docker/ubuntu-14.04.yml new file mode 100644 index 0000000..b1efa58 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/nodesets/docker/ubuntu-14.04.yml @@ -0,0 +1,12 @@ +HOSTS: + ubuntu-1404-x64: + platform: ubuntu-14.04-amd64 + hypervisor: docker + image: ubuntu:14.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + # ensure that upstart is booting correctly in the container + - 'rm /usr/sbin/policy-rc.d && rm /sbin/initctl && dpkg-divert --rename --remove /sbin/initctl && apt-get update && apt-get install -y net-tools wget && locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 diff --git a/environments/prod/modules/stdlib/spec/acceptance/num2bool_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/num2bool_spec.rb new file mode 100755 index 0000000..00d0ddc --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/num2bool_spec.rb @@ -0,0 +1,76 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'num2bool function' do + describe 'success' do + it 'bools positive numbers and numeric strings as true' do + pp = <<-EOS + $a = 1 + $b = "1" + $c = "50" + $ao = num2bool($a) + $bo = num2bool($b) + $co = num2bool($c) + notice(inline_template('a is <%= @ao.inspect %>')) + notice(inline_template('b is <%= @bo.inspect %>')) + notice(inline_template('c is <%= @co.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/a is true/) + expect(r.stdout).to match(/b is true/) + expect(r.stdout).to match(/c is true/) + end + end + it 'bools negative numbers as false' do + pp = <<-EOS + $a = 0 + $b = -0.1 + $c = ["-50","1"] + $ao = num2bool($a) + $bo = num2bool($b) + $co = num2bool($c) + notice(inline_template('a is <%= @ao.inspect %>')) + notice(inline_template('b is <%= @bo.inspect %>')) + notice(inline_template('c is <%= @co.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/a is false/) + expect(r.stdout).to match(/b is false/) + expect(r.stdout).to match(/c is false/) + end + end + end + describe 'failure' do + it 'fails on words' do + pp = <<-EOS + $a = "a" + $ao = num2bool($a) + notice(inline_template('a is <%= @ao.inspect %>')) + EOS + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/not look like a number/) + end + + it 'fails on numberwords' do + pp = <<-EOS + $b = "1b" + $bo = num2bool($b) + notice(inline_template('b is <%= @bo.inspect %>')) + EOS + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/not look like a number/) + + end + + it 'fails on non-numeric/strings' do + pending "The function will call .to_s.to_i on anything not a Numeric or + String, and results in 0. Is this intended?" + pp = <<-EOS + $c = {"c" => "-50"} + $co = num2bool($c) + notice(inline_template('c is <%= @co.inspect %>')) + EOS + expect(apply_manifest(ppc :expect_failures => true).stderr).to match(/Unable to parse/) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/parsejson_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/parsejson_spec.rb new file mode 100755 index 0000000..52133e4 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/parsejson_spec.rb @@ -0,0 +1,55 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'parsejson function' do + describe 'success' do + it 'parses valid json' do + pp = <<-EOS + $a = '{"hunter": "washere", "tests": "passing"}' + $ao = parsejson($a) + $tests = $ao['tests'] + notice(inline_template('tests are <%= @tests.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/tests are "passing"/) + end + end + end + + describe 'failure' do + it 'raises error on incorrect json' do + pp = <<-EOS + $a = '{"hunter": "washere", "tests": "passing",}' + $ao = parsejson($a, 'tests are using the default value') + notice(inline_template('a is <%= @ao.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/tests are using the default value/) + end + end + + it 'raises error on incorrect json' do + pp = <<-EOS + $a = '{"hunter": "washere", "tests": "passing",}' + $ao = parsejson($a) + notice(inline_template('a is <%= @ao.inspect %>')) + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/expected next name/) + end + end + + it 'raises error on incorrect number of arguments' do + pp = <<-EOS + $o = parsejson() + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/wrong number of arguments/i) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/parseyaml_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/parseyaml_spec.rb new file mode 100755 index 0000000..acbda46 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/parseyaml_spec.rb @@ -0,0 +1,58 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'parseyaml function' do + describe 'success' do + it 'parses valid yaml' do + pp = <<-EOS + $a = "---\nhunter: washere\ntests: passing\n" + $o = parseyaml($a) + $tests = $o['tests'] + notice(inline_template('tests are <%= @tests.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/tests are "passing"/) + end + end + end + + describe 'failure' do + it 'returns the default value on incorrect yaml' do + pp = <<-EOS + $a = "---\nhunter: washere\ntests: passing\n:" + $o = parseyaml($a, {'tests' => 'using the default value'}) + $tests = $o['tests'] + notice(inline_template('tests are <%= @tests.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/tests are "using the default value"/) + end + end + + it 'raises error on incorrect yaml' do + pp = <<-EOS + $a = "---\nhunter: washere\ntests: passing\n:" + $o = parseyaml($a) + $tests = $o['tests'] + notice(inline_template('tests are <%= @tests.inspect %>')) + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/(syntax error|did not find expected key)/) + end + end + + + it 'raises error on incorrect number of arguments' do + pp = <<-EOS + $o = parseyaml() + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/wrong number of arguments/i) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/pick_default_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/pick_default_spec.rb new file mode 100755 index 0000000..e7e25ab --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/pick_default_spec.rb @@ -0,0 +1,54 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'pick_default function' do + describe 'success' do + it 'pick_defaults a default value' do + pp = <<-EOS + $a = undef + $o = pick_default($a, 'default') + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/picked is "default"/) + end + end + it 'pick_defaults with no value' do + pp = <<-EOS + $a = undef + $b = undef + $o = pick_default($a,$b) + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/picked is ""/) + end + end + it 'pick_defaults the first set value' do + pp = <<-EOS + $a = "something" + $b = "long" + $o = pick_default($a, $b, 'default') + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/picked is "something"/) + end + end + end + describe 'failure' do + it 'raises error with no values' do + pp = <<-EOS + $o = pick_default() + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Must receive at least one argument/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/pick_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/pick_spec.rb new file mode 100755 index 0000000..c70b2d9 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/pick_spec.rb @@ -0,0 +1,44 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'pick function' do + describe 'success' do + it 'picks a default value' do + pp = <<-EOS + $a = undef + $o = pick($a, 'default') + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/picked is "default"/) + end + end + it 'picks the first set value' do + pp = <<-EOS + $a = "something" + $b = "long" + $o = pick($a, $b, 'default') + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/picked is "something"/) + end + end + end + describe 'failure' do + it 'raises error with all undef values' do + pp = <<-EOS + $a = undef + $b = undef + $o = pick($a, $b) + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/must receive at least one non empty value/) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/prefix_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/prefix_spec.rb new file mode 100755 index 0000000..58c691d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/prefix_spec.rb @@ -0,0 +1,42 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'prefix function' do + describe 'success' do + it 'prefixes array of values' do + pp = <<-EOS + $o = prefix(['a','b','c'],'p') + notice(inline_template('prefix is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/prefix is \["pa", "pb", "pc"\]/) + end + end + it 'prefixs with empty array' do + pp = <<-EOS + $o = prefix([],'p') + notice(inline_template('prefix is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/prefix is \[\]/) + end + end + it 'prefixs array of values with undef' do + pp = <<-EOS + $o = prefix(['a','b','c'], undef) + notice(inline_template('prefix is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/prefix is \["a", "b", "c"\]/) + end + end + end + describe 'failure' do + it 'fails with no arguments' + it 'fails when first argument is not array' + it 'fails when second argument is not string' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/pw_hash_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/pw_hash_spec.rb new file mode 100644 index 0000000..829d087 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/pw_hash_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +# Windows and OS X do not have useful implementations of crypt(3) +describe 'pw_hash function', :unless => (['windows', 'Darwin', 'SLES']).include?(fact('operatingsystem')) do + describe 'success' do + it 'hashes passwords' do + pp = <<-EOS + $o = pw_hash('password', 'sha-512', 'salt') + notice(inline_template('pw_hash is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/pw_hash is "\$6\$salt\$IxDD3jeSOb5eB1CX5LBsqZFVkJdido3OUILO5Ifz5iwMuTS4XMS130MTSuDDl3aCI6WouIL9AjRbLCelDCy\.g\."/) + end + end + + it 'returns nil if no password is provided' do + pp = <<-EOS + $o = pw_hash('', 'sha-512', 'salt') + notice(inline_template('pw_hash is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/pw_hash is nil/) + end + end + end + describe 'failure' do + it 'handles less than three arguments' + it 'handles more than three arguments' + it 'handles non strings' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/range_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/range_spec.rb new file mode 100755 index 0000000..f57f884 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/range_spec.rb @@ -0,0 +1,36 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'range function' do + describe 'success' do + it 'ranges letters' do + pp = <<-EOS + $o = range('a','d') + notice(inline_template('range is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/range is \["a", "b", "c", "d"\]/) + end + end + it 'ranges letters with a step' do + pp = <<-EOS + $o = range('a','d', '2') + notice(inline_template('range is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/range is \["a", "c"\]/) + end + end + it 'ranges letters with a negative step' + it 'ranges numbers' + it 'ranges numbers with a step' + it 'ranges numbers with a negative step' + it 'ranges numeric strings' + it 'ranges zero padded numbers' + end + describe 'failure' do + it 'fails with no arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/reject_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/reject_spec.rb new file mode 100755 index 0000000..ce4342d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/reject_spec.rb @@ -0,0 +1,42 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'reject function' do + describe 'success' do + it 'rejects array of values' do + pp = <<-EOS + $o = reject(['aaa','bbb','ccc','aaaddd'], 'aaa') + notice(inline_template('reject is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/reject is \["bbb", "ccc"\]/) + end + end + it 'rejects with empty array' do + pp = <<-EOS + $o = reject([],'aaa') + notice(inline_template('reject is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/reject is \[\]/) + end + end + it 'rejects array of values with undef' do + pp = <<-EOS + $o = reject(['aaa','bbb','ccc','aaaddd'], undef) + notice(inline_template('reject is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/reject is \[\]/) + end + end + end + describe 'failure' do + it 'fails with no arguments' + it 'fails when first argument is not array' + it 'fails when second argument is not string' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/reverse_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/reverse_spec.rb new file mode 100755 index 0000000..3b5dfad --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/reverse_spec.rb @@ -0,0 +1,23 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'reverse function' do + describe 'success' do + it 'reverses strings' do + pp = <<-EOS + $a = "the public art galleries" + # Anagram: Large picture halls, I bet + $o = reverse($a) + notice(inline_template('reverse is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/reverse is "seirellag tra cilbup eht"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/rstrip_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/rstrip_spec.rb new file mode 100755 index 0000000..150dac1 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/rstrip_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'rstrip function' do + describe 'success' do + it 'rstrips arrays' do + pp = <<-EOS + $a = [" the "," public "," art","galleries "] + # Anagram: Large picture halls, I bet + $o = rstrip($a) + notice(inline_template('rstrip is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/rstrip is \[" the", " public", " art", "galleries"\]/) + end + end + it 'rstrips strings' do + pp = <<-EOS + $a = " blowzy night-frumps vex'd jack q " + $o = rstrip($a) + notice(inline_template('rstrip is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/rstrip is " blowzy night-frumps vex'd jack q"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/shuffle_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/shuffle_spec.rb new file mode 100755 index 0000000..0738383 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/shuffle_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'shuffle function' do + describe 'success' do + it 'shuffles arrays' do + pp = <<-EOS + $a = ["1", "2", "3", "4", "5", "6", "7", "8", "the","public","art","galleries"] + # Anagram: Large picture halls, I bet + $o = shuffle($a) + notice(inline_template('shuffle is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to_not match(/shuffle is \["1", "2", "3", "4", "5", "6", "7", "8", "the", "public", "art", "galleries"\]/) + end + end + it 'shuffles strings' do + pp = <<-EOS + $a = "blowzy night-frumps vex'd jack q" + $o = shuffle($a) + notice(inline_template('shuffle is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to_not match(/shuffle is "blowzy night-frumps vex'd jack q"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/size_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/size_spec.rb new file mode 100755 index 0000000..6390c20 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/size_spec.rb @@ -0,0 +1,55 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'size function' do + describe 'success' do + it 'single string size' do + pp = <<-EOS + $a = 'discombobulate' + $o = size($a) + notice(inline_template('size is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/size is 14/) + end + end + it 'with empty string' do + pp = <<-EOS + $a = '' + $o = size($a) + notice(inline_template('size is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/size is 0/) + end + end + it 'with undef' do + pp = <<-EOS + $a = undef + $o = size($a) + notice(inline_template('size is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/size is 0/) + end + end + it 'strings in array' do + pp = <<-EOS + $a = ['discombobulate', 'moo'] + $o = size($a) + notice(inline_template('size is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/size is 2/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/sort_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/sort_spec.rb new file mode 100755 index 0000000..e7ff7f7 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/sort_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'sort function' do + describe 'success' do + it 'sorts arrays' do + pp = <<-EOS + $a = ["the","public","art","galleries"] + # Anagram: Large picture halls, I bet + $o = sort($a) + notice(inline_template('sort is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/sort is \["art", "galleries", "public", "the"\]/) + end + end + it 'sorts strings' do + pp = <<-EOS + $a = "blowzy night-frumps vex'd jack q" + $o = sort($a) + notice(inline_template('sort is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/sort is " '-abcdefghijklmnopqrstuvwxyz"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/squeeze_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/squeeze_spec.rb new file mode 100755 index 0000000..3324691 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/squeeze_spec.rb @@ -0,0 +1,47 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'squeeze function' do + describe 'success' do + it 'squeezes arrays' do + pp = <<-EOS + # Real words! + $a = ["wallless", "laparohysterosalpingooophorectomy", "brrr", "goddessship"] + $o = squeeze($a) + notice(inline_template('squeeze is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/squeeze is \["wales", "laparohysterosalpingophorectomy", "br", "godeship"\]/) + end + end + it 'squeezez arrays with an argument' + it 'squeezes strings' do + pp = <<-EOS + $a = "wallless laparohysterosalpingooophorectomy brrr goddessship" + $o = squeeze($a) + notice(inline_template('squeeze is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/squeeze is "wales laparohysterosalpingophorectomy br godeship"/) + end + end + + it 'squeezes strings with an argument' do + pp = <<-EOS + $a = "countessship duchessship governessship hostessship" + $o = squeeze($a, 's') + notice(inline_template('squeeze is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/squeeze is "counteship ducheship governeship hosteship"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/str2bool_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/str2bool_spec.rb new file mode 100755 index 0000000..9a8c06c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/str2bool_spec.rb @@ -0,0 +1,31 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'str2bool function' do + describe 'success' do + it 'works with "y"' do + pp = <<-EOS + $o = str2bool('y') + notice(inline_template('str2bool is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/str2bool is true/) + end + end + it 'works with "Y"' + it 'works with "yes"' + it 'works with "1"' + it 'works with "true"' + it 'works with "n"' + it 'works with "N"' + it 'works with "no"' + it 'works with "0"' + it 'works with "false"' + it 'works with undef' + end + describe 'failure' do + it 'handles no arguments' + it 'handles non arrays or strings' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/str2saltedsha512_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/str2saltedsha512_spec.rb new file mode 100755 index 0000000..5f03924 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/str2saltedsha512_spec.rb @@ -0,0 +1,22 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'str2saltedsha512 function' do + describe 'success' do + it 'works with "y"' do + pp = <<-EOS + $o = str2saltedsha512('password') + notice(inline_template('str2saltedsha512 is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/str2saltedsha512 is "[a-f0-9]{136}"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles more than one argument' + it 'handles non strings' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/strftime_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/strftime_spec.rb new file mode 100755 index 0000000..38521b0 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/strftime_spec.rb @@ -0,0 +1,22 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'strftime function' do + describe 'success' do + it 'gives the Century' do + pp = <<-EOS + $o = strftime('%C') + notice(inline_template('strftime is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/strftime is "20"/) + end + end + it 'takes a timezone argument' + end + describe 'failure' do + it 'handles no arguments' + it 'handles invalid format strings' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/strip_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/strip_spec.rb new file mode 100755 index 0000000..05cd395 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/strip_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'strip function' do + describe 'success' do + it 'strips arrays' do + pp = <<-EOS + $a = [" the "," public "," art","galleries "] + # Anagram: Large picture halls, I bet + $o = strip($a) + notice(inline_template('strip is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/strip is \["the", "public", "art", "galleries"\]/) + end + end + it 'strips strings' do + pp = <<-EOS + $a = " blowzy night-frumps vex'd jack q " + $o = strip($a) + notice(inline_template('strip is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/strip is "blowzy night-frumps vex'd jack q"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/suffix_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/suffix_spec.rb new file mode 100755 index 0000000..60a6264 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/suffix_spec.rb @@ -0,0 +1,42 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'suffix function' do + describe 'success' do + it 'suffixes array of values' do + pp = <<-EOS + $o = suffix(['a','b','c'],'p') + notice(inline_template('suffix is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/suffix is \["ap", "bp", "cp"\]/) + end + end + it 'suffixs with empty array' do + pp = <<-EOS + $o = suffix([],'p') + notice(inline_template('suffix is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/suffix is \[\]/) + end + end + it 'suffixs array of values with undef' do + pp = <<-EOS + $o = suffix(['a','b','c'], undef) + notice(inline_template('suffix is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/suffix is \["a", "b", "c"\]/) + end + end + end + describe 'failure' do + it 'fails with no arguments' + it 'fails when first argument is not array' + it 'fails when second argument is not string' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/swapcase_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/swapcase_spec.rb new file mode 100755 index 0000000..9f94c0d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/swapcase_spec.rb @@ -0,0 +1,22 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'swapcase function' do + describe 'success' do + it 'works with strings' do + pp = <<-EOS + $o = swapcase('aBcD') + notice(inline_template('swapcase is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/swapcase is "AbCd"/) + end + end + it 'works with arrays' + end + describe 'failure' do + it 'handles no arguments' + it 'handles non arrays or strings' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/time_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/time_spec.rb new file mode 100755 index 0000000..dae1166 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/time_spec.rb @@ -0,0 +1,36 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'time function' do + describe 'success' do + it 'gives the time' do + pp = <<-EOS + $o = time() + notice(inline_template('time is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + m = r.stdout.match(/time is (\d+)\D/) + + # When I wrote this test + expect(Integer(m[1])).to be > 1398894170 + end + end + it 'takes a timezone argument' do + pp = <<-EOS + $o = time('UTC') + notice(inline_template('time is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + m = r.stdout.match(/time is (\d+)\D/) + + expect(Integer(m[1])).to be > 1398894170 + end + end + end + describe 'failure' do + it 'handles more arguments' + it 'handles invalid timezones' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/to_bytes_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/to_bytes_spec.rb new file mode 100755 index 0000000..b1015a3 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/to_bytes_spec.rb @@ -0,0 +1,27 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'to_bytes function' do + describe 'success' do + it 'converts kB to B' do + pp = <<-EOS + $o = to_bytes('4 kB') + notice(inline_template('to_bytes is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + m = r.stdout.match(/to_bytes is (\d+)\D/) + expect(m[1]).to eq("4096") + end + end + it 'works without the B in unit' + it 'works without a space before unit' + it 'works without a unit' + it 'converts fractions' + end + describe 'failure' do + it 'handles no arguments' + it 'handles non integer arguments' + it 'handles unknown units like uB' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/try_get_value_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/try_get_value_spec.rb new file mode 100755 index 0000000..716241c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/try_get_value_spec.rb @@ -0,0 +1,47 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'try_get_value function' do + describe 'success' do + it 'gets a value' do + pp = <<-EOS + $data = { + 'a' => { 'b' => 'passing'} + } + + $tests = try_get_value($data, 'a/b') + notice(inline_template('tests are <%= @tests.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/tests are "passing"/) + end + end + end + describe 'failure' do + it 'uses a default value' do + pp = <<-EOS + $data = { + 'a' => { 'b' => 'passing'} + } + + $tests = try_get_value($data, 'c/d', 'using the default value') + notice(inline_template('tests are <%= @tests.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/using the default value/) + end + end + + it 'raises error on incorrect number of arguments' do + pp = <<-EOS + $o = try_get_value() + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/wrong number of arguments/i) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/type_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/type_spec.rb new file mode 100755 index 0000000..5cc9470 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/type_spec.rb @@ -0,0 +1,37 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'type function' do + describe 'success' do + it 'types arrays' do + pp = <<-EOS + $a = ["the","public","art","galleries"] + # Anagram: Large picture halls, I bet + $o = type($a) + notice(inline_template('type is <%= @o.to_s %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/type is Tuple\[String.*, String.*, String.*, String.*\]/) + end + end + it 'types strings' do + pp = <<-EOS + $a = "blowzy night-frumps vex'd jack q" + $o = type($a) + notice(inline_template('type is <%= @o.to_s %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/type is String/) + end + end + it 'types hashes' + it 'types integers' + it 'types floats' + it 'types booleans' + end + describe 'failure' do + it 'handles no arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/union_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/union_spec.rb new file mode 100755 index 0000000..7229bf5 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/union_spec.rb @@ -0,0 +1,25 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'union function' do + describe 'success' do + it 'unions arrays' do + pp = <<-EOS + $a = ["the","public"] + $b = ["art"] + $c = ["galleries"] + # Anagram: Large picture halls, I bet + $o = union($a,$b,$c) + notice(inline_template('union is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/union is \["the", "public", "art", "galleries"\]/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/unique_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/unique_spec.rb new file mode 100755 index 0000000..7fb5eca --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/unique_spec.rb @@ -0,0 +1,33 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'unique function' do + describe 'success' do + it 'uniques arrays' do + pp = <<-EOS + $a = ["wallless", "wallless", "brrr", "goddessship"] + $o = unique($a) + notice(inline_template('unique is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/unique is \["wallless", "brrr", "goddessship"\]/) + end + end + it 'uniques strings' do + pp = <<-EOS + $a = "wallless laparohysterosalpingooophorectomy brrr goddessship" + $o = unique($a) + notice(inline_template('unique is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/unique is "wales prohytingcmbd"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/upcase_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/upcase_spec.rb new file mode 100755 index 0000000..1782309 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/upcase_spec.rb @@ -0,0 +1,33 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'upcase function' do + describe 'success' do + it 'upcases arrays' do + pp = <<-EOS + $a = ["wallless", "laparohysterosalpingooophorectomy", "brrr", "goddessship"] + $o = upcase($a) + notice(inline_template('upcase is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/upcase is \["WALLLESS", "LAPAROHYSTEROSALPINGOOOPHORECTOMY", "BRRR", "GODDESSSHIP"\]/) + end + end + it 'upcases strings' do + pp = <<-EOS + $a = "wallless laparohysterosalpingooophorectomy brrr goddessship" + $o = upcase($a) + notice(inline_template('upcase is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/upcase is "WALLLESS LAPAROHYSTEROSALPINGOOOPHORECTOMY BRRR GODDESSSHIP"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/uriescape_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/uriescape_spec.rb new file mode 100755 index 0000000..e123425 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/uriescape_spec.rb @@ -0,0 +1,23 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'uriescape function' do + describe 'success' do + it 'uriescape strings' do + pp = <<-EOS + $a = ":/?#[]@!$&'()*+,;= \\\"{}" + $o = uriescape($a) + notice(inline_template('uriescape is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/uriescape is ":\/\?%23\[\]@!\$&'\(\)\*\+,;=%20%22%7B%7D"/) + end + end + it 'does nothing if a string is already safe' + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/validate_absolute_path_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/validate_absolute_path_spec.rb new file mode 100755 index 0000000..880850d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/validate_absolute_path_spec.rb @@ -0,0 +1,31 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_absolute_path function' do + describe 'success' do + %w{ + C:/ + C:\\\\ + C:\\\\WINDOWS\\\\System32 + C:/windows/system32 + X:/foo/bar + X:\\\\foo\\\\bar + /var/tmp + /var/lib/puppet + /var/opt/../lib/puppet + }.each do |path| + it "validates a single argument #{path}" do + pp = <<-EOS + $one = '#{path}' + validate_absolute_path($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + end + describe 'failure' do + it 'handles improper number of arguments' + it 'handles relative paths' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/validate_array_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/validate_array_spec.rb new file mode 100755 index 0000000..a76321d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/validate_array_spec.rb @@ -0,0 +1,37 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_array function' do + describe 'success' do + it 'validates a single argument' do + pp = <<-EOS + $one = ['a', 'b'] + validate_array($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an multiple arguments' do + pp = <<-EOS + $one = ['a', 'b'] + $two = [['c'], 'd'] + validate_array($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + [ + %{validate_array({'a' => 'hash' })}, + %{validate_array('string')}, + %{validate_array(false)}, + %{validate_array(undef)} + ].each do |pp| + it "rejects #{pp.inspect}" do + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/is not an Array\. It looks to be a/) + end + end + end + describe 'failure' do + it 'handles improper number of arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/validate_augeas_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/validate_augeas_spec.rb new file mode 100755 index 0000000..be213d3 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/validate_augeas_spec.rb @@ -0,0 +1,63 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_augeas function', :unless => (fact('osfamily') == 'windows') do + describe 'prep' do + it 'installs augeas for tests' + end + describe 'success' do + context 'valid inputs with no 3rd argument' do + { + 'root:x:0:0:root:/root:/bin/bash\n' => 'Passwd.lns', + 'proc /proc proc nodev,noexec,nosuid 0 0\n' => 'Fstab.lns' + }.each do |line,lens| + it "validates a single argument for #{lens}" do + pp = <<-EOS + $line = "#{line}" + $lens = "#{lens}" + validate_augeas($line, $lens) + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + end + context 'valid inputs with 3rd and 4th arguments' do + it "validates a restricted value" do + line = 'root:x:0:0:root:/root:/bin/barsh\n' + lens = 'Passwd.lns' + restriction = '$file/*[shell="/bin/barsh"]' + pp = <<-EOS + $line = "#{line}" + $lens = "#{lens}" + $restriction = ['#{restriction}'] + validate_augeas($line, $lens, $restriction, "my custom failure message") + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/my custom failure message/) + end + end + context 'invalid inputs' do + { + 'root:x:0:0:root' => 'Passwd.lns', + '127.0.1.1' => 'Hosts.lns' + }.each do |line,lens| + it "validates a single argument for #{lens}" do + pp = <<-EOS + $line = "#{line}" + $lens = "#{lens}" + validate_augeas($line, $lens) + EOS + + apply_manifest(pp, :expect_failures => true) + end + end + end + context 'garbage inputs' do + it 'raises an error on invalid inputs' + end + end + describe 'failure' do + it 'handles improper number of arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/validate_bool_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/validate_bool_spec.rb new file mode 100755 index 0000000..993f9ef --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/validate_bool_spec.rb @@ -0,0 +1,37 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_bool function' do + describe 'success' do + it 'validates a single argument' do + pp = <<-EOS + $one = true + validate_bool($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an multiple arguments' do + pp = <<-EOS + $one = true + $two = false + validate_bool($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + [ + %{validate_bool('true')}, + %{validate_bool('false')}, + %{validate_bool([true])}, + %{validate_bool(undef)} + ].each do |pp| + it "rejects #{pp.inspect}" do + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/is not a boolean\. It looks to be a/) + end + end + end + describe 'failure' do + it 'handles improper number of arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/validate_cmd_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/validate_cmd_spec.rb new file mode 100755 index 0000000..5fc7b94 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/validate_cmd_spec.rb @@ -0,0 +1,52 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_cmd function' do + describe 'success' do + it 'validates a true command' do + pp = <<-EOS + $one = 'foo' + if $::osfamily == 'windows' { + $two = 'echo' #shell built-in + } else { + $two = '/bin/echo' + } + validate_cmd($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates a fail command' do + pp = <<-EOS + $one = 'foo' + if $::osfamily == 'windows' { + $two = 'C:/aoeu' + } else { + $two = '/bin/aoeu' + } + validate_cmd($one,$two) + EOS + + apply_manifest(pp, :expect_failures => true) + end + it 'validates a fail command with a custom error message' do + pp = <<-EOS + $one = 'foo' + if $::osfamily == 'windows' { + $two = 'C:/aoeu' + } else { + $two = '/bin/aoeu' + } + validate_cmd($one,$two,"aoeu is dvorak") + EOS + + apply_manifest(pp, :expect_failures => true) do |output| + expect(output.stderr).to match(/aoeu is dvorak/) + end + end + end + describe 'failure' do + it 'handles improper number of arguments' + it 'handles improper argument types' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/validate_hash_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/validate_hash_spec.rb new file mode 100755 index 0000000..fc0f079 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/validate_hash_spec.rb @@ -0,0 +1,37 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_hash function' do + describe 'success' do + it 'validates a single argument' do + pp = <<-EOS + $one = { 'a' => 1 } + validate_hash($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an multiple arguments' do + pp = <<-EOS + $one = { 'a' => 1 } + $two = { 'b' => 2 } + validate_hash($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + [ + %{validate_hash('{ "not" => "hash" }')}, + %{validate_hash('string')}, + %{validate_hash(["array"])}, + %{validate_hash(undef)} + ].each do |pp| + it "rejects #{pp.inspect}" do + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(//) + end + end + end + describe 'failure' do + it 'handles improper number of arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/validate_ipv4_address_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/validate_ipv4_address_spec.rb new file mode 100755 index 0000000..67d3139 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/validate_ipv4_address_spec.rb @@ -0,0 +1,31 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_ipv4_address function' do + describe 'success' do + it 'validates a single argument' do + pp = <<-EOS + $one = '1.2.3.4' + validate_ipv4_address($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an multiple arguments' do + pp = <<-EOS + $one = '1.2.3.4' + $two = '5.6.7.8' + validate_ipv4_address($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + describe 'failure' do + it 'handles improper number of arguments' + it 'handles ipv6 addresses' + it 'handles non-ipv4 strings' + it 'handles numbers' + it 'handles no arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/validate_ipv6_address_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/validate_ipv6_address_spec.rb new file mode 100755 index 0000000..eaa845d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/validate_ipv6_address_spec.rb @@ -0,0 +1,31 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_ipv6_address function' do + describe 'success' do + it 'validates a single argument' do + pp = <<-EOS + $one = '3ffe:0505:0002::' + validate_ipv6_address($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an multiple arguments' do + pp = <<-EOS + $one = '3ffe:0505:0002::' + $two = '3ffe:0505:0001::' + validate_ipv6_address($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + describe 'failure' do + it 'handles improper number of arguments' + it 'handles ipv6 addresses' + it 'handles non-ipv6 strings' + it 'handles numbers' + it 'handles no arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/validate_re_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/validate_re_spec.rb new file mode 100755 index 0000000..eefb286 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/validate_re_spec.rb @@ -0,0 +1,47 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_re function' do + describe 'success' do + it 'validates a string' do + pp = <<-EOS + $one = 'one' + $two = '^one$' + validate_re($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an array' do + pp = <<-EOS + $one = 'one' + $two = ['^one$', '^two'] + validate_re($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates a failed array' do + pp = <<-EOS + $one = 'one' + $two = ['^two$', '^three'] + validate_re($one,$two) + EOS + + apply_manifest(pp, :expect_failures => true) + end + it 'validates a failed array with a custom error message' do + pp = <<-EOS + $one = '3.4.3' + $two = '^2.7' + validate_re($one,$two,"The $puppetversion fact does not match 2.7") + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/does not match/) + end + end + describe 'failure' do + it 'handles improper number of arguments' + it 'handles improper argument types' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/validate_slength_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/validate_slength_spec.rb new file mode 100755 index 0000000..c29fd23 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/validate_slength_spec.rb @@ -0,0 +1,72 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_slength function' do + describe 'success' do + it 'validates a single string max' do + pp = <<-EOS + $one = 'discombobulate' + $two = 17 + validate_slength($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates multiple string maxes' do + pp = <<-EOS + $one = ['discombobulate', 'moo'] + $two = 17 + validate_slength($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates min/max of strings in array' do + pp = <<-EOS + $one = ['discombobulate', 'moo'] + $two = 17 + $three = 3 + validate_slength($one,$two,$three) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates a single string max of incorrect length' do + pp = <<-EOS + $one = 'discombobulate' + $two = 1 + validate_slength($one,$two) + EOS + + apply_manifest(pp, :expect_failures => true) + end + it 'validates multiple string maxes of incorrect length' do + pp = <<-EOS + $one = ['discombobulate', 'moo'] + $two = 3 + validate_slength($one,$two) + EOS + + apply_manifest(pp, :expect_failures => true) + end + it 'validates multiple strings min/maxes of incorrect length' do + pp = <<-EOS + $one = ['discombobulate', 'moo'] + $two = 17 + $three = 10 + validate_slength($one,$two,$three) + EOS + + apply_manifest(pp, :expect_failures => true) + end + end + describe 'failure' do + it 'handles improper number of arguments' + it 'handles improper first argument type' + it 'handles non-strings in array of first argument' + it 'handles improper second argument type' + it 'handles improper third argument type' + it 'handles negative ranges' + it 'handles improper ranges' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/validate_string_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/validate_string_spec.rb new file mode 100755 index 0000000..f04608d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/validate_string_spec.rb @@ -0,0 +1,43 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_string function' do + describe 'success' do + it 'validates a single argument' do + pp = <<-EOS + $one = 'string' + validate_string($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an multiple arguments' do + pp = <<-EOS + $one = 'string' + $two = 'also string' + validate_string($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates undef' do + pp = <<-EOS + validate_string(undef) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates a non-string' do + { + %{validate_string({ 'a' => 'hash' })} => "Hash", + %{validate_string(['array'])} => "Array", + %{validate_string(false)} => "FalseClass", + }.each do |pp,type| + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/a #{type}/) + end + end + end + describe 'failure' do + it 'handles improper number of arguments' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/values_at_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/values_at_spec.rb new file mode 100755 index 0000000..eb0bf4f --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/values_at_spec.rb @@ -0,0 +1,73 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'values_at function' do + describe 'success' do + it 'returns a specific value' do + pp = <<-EOS + $one = ['a','b','c','d','e'] + $two = 1 + $output = values_at($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["b"\]/) + end + it 'returns a specific negative index value' do + pending("negative numbers don't work") + pp = <<-EOS + $one = ['a','b','c','d','e'] + $two = -1 + $output = values_at($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["e"\]/) + end + it 'returns a range of values' do + pp = <<-EOS + $one = ['a','b','c','d','e'] + $two = "1-3" + $output = values_at($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["b", "c", "d"\]/) + end + it 'returns a negative specific value and range of values' do + pp = <<-EOS + $one = ['a','b','c','d','e'] + $two = ["1-3",0] + $output = values_at($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["b", "c", "d", "a"\]/) + end + end + describe 'failure' do + it 'handles improper number of arguments' do + pp = <<-EOS + $one = ['a','b','c','d','e'] + $output = values_at($one) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Wrong number of arguments/) + end + it 'handles non-indicies arguments' do + pp = <<-EOS + $one = ['a','b','c','d','e'] + $two = [] + $output = values_at($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/at least one positive index/) + end + + it 'detects index ranges smaller than the start range' + it 'handles index ranges larger than array' + it 'handles non-integer indicies' + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/values_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/values_spec.rb new file mode 100755 index 0000000..cef1c9d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/values_spec.rb @@ -0,0 +1,30 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'values function' do + describe 'success' do + it 'returns an array of values' do + pp = <<-EOS + $arg = { + 'a' => 1, + 'b' => 2, + 'c' => 3, + } + $output = values($arg) + notice(inline_template('<%= @output.sort.inspect %>')) + EOS + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[1, 2, 3\]/) + end + end + describe 'failure' do + it 'handles non-hash arguments' do + pp = <<-EOS + $arg = "foo" + $output = values($arg) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Requires hash/) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/acceptance/zip_spec.rb b/environments/prod/modules/stdlib/spec/acceptance/zip_spec.rb new file mode 100755 index 0000000..ae22896 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/acceptance/zip_spec.rb @@ -0,0 +1,67 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'zip function' do + describe 'success' do + it 'zips two arrays of numbers together' do + pp = <<-EOS + $one = [1,2,3,4] + $two = [5,6,7,8] + $output = zip($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[\[1, 5\], \[2, 6\], \[3, 7\], \[4, 8\]\]/) + end + it 'zips two arrays of numbers & bools together' do + pp = <<-EOS + $one = [1,2,"three",4] + $two = [true,true,false,false] + $output = zip($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[\[1, true\], \[2, true\], \["three", false\], \[4, false\]\]/) + end + it 'zips two arrays of numbers together and flattens them' do + # XXX This only tests the argument `true`, even though the following are valid: + # 1 t y true yes + # 0 f n false no + # undef undefined + pp = <<-EOS + $one = [1,2,3,4] + $two = [5,6,7,8] + $output = zip($one,$two,true) + notice(inline_template('<%= @output.inspect %>')) + EOS + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[1, 5, 2, 6, 3, 7, 4, 8\]/) + end + it 'handles unmatched length' do + # XXX Is this expected behavior? + pp = <<-EOS + $one = [1,2] + $two = [5,6,7,8] + $output = zip($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[\[1, 5\], \[2, 6\]\]/) + end + end + describe 'failure' do + it 'handles improper number of arguments' do + pp = <<-EOS + $one = [1,2] + $output = zip($one) + notice(inline_template('<%= @output.inspect %>')) + EOS + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Wrong number of arguments/) + end + it 'handles improper argument types' do + pp = <<-EOS + $one = "a string" + $two = [5,6,7,8] + $output = zip($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Requires array/) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/absolute_path_spec.rb b/environments/prod/modules/stdlib/spec/aliases/absolute_path_spec.rb new file mode 100644 index 0000000..308a3aa --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/absolute_path_spec.rb @@ -0,0 +1,67 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::absolute_path', type: :class do + describe 'valid paths handling' do + %w{ + C:/ + C:\\ + C:\\WINDOWS\\System32 + C:/windows/system32 + X:/foo/bar + X:\\foo\\bar + \\\\host\\windows + //host/windows + / + /var/tmp + /var/opt/../lib/puppet + /var/opt//lib/puppet + /var/ůťƒ8 + /var/ネット + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::Compat::Absolute_path/) } + end + end + end + + context 'relative paths' do + %w{ + relative1 + . + .. + ./foo + ../foo + etc/puppetlabs/puppet + opt/puppet/bin + relative\\windows + \var\ůťƒ8 + \var\ネット + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::Compat::Absolute_path/) } + end + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/absolutepath_spec.rb b/environments/prod/modules/stdlib/spec/aliases/absolutepath_spec.rb new file mode 100644 index 0000000..cd442f2 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/absolutepath_spec.rb @@ -0,0 +1,50 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::absolutepath', type: :class do + describe 'valid handling' do + %w{ + /usr2/username/bin:/usr/local/bin:/usr/bin:. + C:/ + C:\\ + C:\\WINDOWS\\System32 + C:/windows/system32 + X:/foo/bar + X:\\foo\\bar + \\\\host\\windows + //host/windows + /var/tmp + /var/opt/../lib/puppet + /var/opt//lib/puppet + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + "*/Users//nope", + "\\Users/hc/wksp/stdlib", + "C:noslashes", + "\\var\\tmp" + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Variant/) } + end + end + end + + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/array_spec.rb b/environments/prod/modules/stdlib/spec/aliases/array_spec.rb new file mode 100644 index 0000000..89cc2af --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/array_spec.rb @@ -0,0 +1,34 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::array', type: :class do + describe 'accepts arrays' do + [ + [], + ['one'], + [1], + [{}], + [[]], + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'rejects other values' do + [ + '', + 'one', + '1', + {}, + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a Stdlib::Compat::Array/) } + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/bool_spec.rb b/environments/prod/modules/stdlib/spec/aliases/bool_spec.rb new file mode 100644 index 0000000..b84ab51 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/bool_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::bool', type: :class do + describe 'accepts booleans' do + [ + true, + false, + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'rejects other values' do + [ + [1], + [{}], + [true], + 'true', + 'false', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a Stdlib::Compat::Bool/) } + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/float_spec.rb b/environments/prod/modules/stdlib/spec/aliases/float_spec.rb new file mode 100644 index 0000000..66079c6 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/float_spec.rb @@ -0,0 +1,28 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::float', type: :class do + describe 'accepts floats' do + [ + 3.7, + '3.7', + -3.7, + '-342.2315e-12', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'rejects other values' do + [ true, 'true', false, 'false', 'iAmAString', '1test', '1 test', 'test 1', 'test 1 test', {}, { 'key' => 'value' }, { 1=> 2 }, '', :undef , 'x', 3, '3', -3, '-3'].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a value of type Float or Pattern(\[.*\]+)?/) } + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/hash_spec.rb b/environments/prod/modules/stdlib/spec/aliases/hash_spec.rb new file mode 100644 index 0000000..6e5060d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/hash_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::hash', type: :class do + describe 'accepts hashes' do + [ + {}, + {'one' => "two"}, + {'wan' => 3}, + {'001' => "helly"}, + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + describe 'rejects other values' do + [ + '', + 'one', + '1', + [], + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a Stdlib::Compat::Hash/) } + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/httpsurl_spec.rb b/environments/prod/modules/stdlib/spec/aliases/httpsurl_spec.rb new file mode 100644 index 0000000..3e51118 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/httpsurl_spec.rb @@ -0,0 +1,44 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::httpsurl', type: :class do + describe 'valid handling' do + %w{ + https://hello.com + https://notcreative.org + https://notexciting.co.uk + https://graphemica.com/❤ + https://graphemica.com/緩 + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + "httds://notquiteright.org", + "hptts:/nah", + "https;//notrightbutclose.org", + "http://graphemica.com/❤", + "http://graphemica.com/緩" + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::HTTPSUrl/) } + end + end + end + + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/httpurl_spec.rb b/environments/prod/modules/stdlib/spec/aliases/httpurl_spec.rb new file mode 100644 index 0000000..fd49a47 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/httpurl_spec.rb @@ -0,0 +1,47 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::httpurl', type: :class do + describe 'valid handling' do + %w{ + https://hello.com + https://notcreative.org + https://canstillaccepthttps.co.uk + http://anhttp.com + http://runningoutofideas.gov + http:// + http://graphemica.com/❤ + http://graphemica.com/緩 + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + "httds://notquiteright.org", + "hptts:/nah", + "https;//notrightbutclose.org", + "hts://graphemica.com/❤", + "https:graphemica.com/緩" + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::HTTPUrl/) } + end + end + end + + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/integer_spec.rb b/environments/prod/modules/stdlib/spec/aliases/integer_spec.rb new file mode 100644 index 0000000..bd00c2a --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/integer_spec.rb @@ -0,0 +1,28 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::integer', type: :class do + describe 'accepts integers' do + [ + 3, + '3', + -3, + '-3', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'rejects other values' do + [ true, 'true', false, 'false', 'iAmAString', '1test', '1 test', 'test 1', 'test 1 test', {}, { 'key' => 'value' }, { 1=> 2 }, '', :undef , 'x', 3.7, '3.7',-3.7, '-342.2315e-12' ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a value of type Integer, Pattern(\[.*\]+)?, or Array/) } + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/ip_address.rb b/environments/prod/modules/stdlib/spec/aliases/ip_address.rb new file mode 100644 index 0000000..67a555c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/ip_address.rb @@ -0,0 +1,34 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::ip_address', type: :class do + describe 'accepts ipv4 and ipv6 addresses' do + [ + '224.0.0.0', + '255.255.255.255', + '0.0.0.0', + '192.88.99.0', + '2001:0db8:85a3:0000:0000:8a2e:0370:7334', + 'fa76:8765:34ac:0823:ab76:eee9:0987:1111' + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + describe 'rejects other values' do + [ + 'nope', + '77', + '4.4.4', + '2001:0db8:85a3:000000:0000:8a2e:0370:7334' + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for/) } + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/ipv4_spec.rb b/environments/prod/modules/stdlib/spec/aliases/ipv4_spec.rb new file mode 100644 index 0000000..6a503ad --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/ipv4_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::ipv4', type: :class do + describe 'accepts ipv4 addresses' do + SharedData::IPV4_PATTERNS.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + describe 'rejects other values' do + SharedData::IPV4_NEGATIVE_PATTERNS.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::Compat::Ipv4/) } + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/ipv6_spec.rb b/environments/prod/modules/stdlib/spec/aliases/ipv6_spec.rb new file mode 100644 index 0000000..ae90f42 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/ipv6_spec.rb @@ -0,0 +1,40 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::ipv6', type: :class do + describe 'accepts ipv6 addresses' do + [ + '2001:0db8:85a3:0000:0000:8a2e:0370:7334', + 'fa76:8765:34ac:0823:ab76:eee9:0987:1111', + 'fe80:0000:0000:0000:0204:61ff:fe9d:f156', + 'fe80:0:0:0:204:61ff:fe9d:f156', + 'fe80::204:61ff:fe9d:f156', + 'fe80:0:0:0:0204:61ff:254.157.241.86', + '::1', + 'fe80::', + '2001::', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + describe 'rejects other values' do + [ + 'nope', + '77', + '4.4.4', + '2000:7334', + '::ffff:2.3.4', + '::ffff:257.1.2.3', + '::ffff:12345678901234567890.1.26', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::Compat::Ipv6/) } + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/numeric_spec.rb b/environments/prod/modules/stdlib/spec/aliases/numeric_spec.rb new file mode 100644 index 0000000..bc17f4f --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/numeric_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::numeric', type: :class do + describe 'accepts numerics' do + [ + 3, + '3', + -3, + '-3', + 3.7, + '3.7', + -3.7, + '-342.2315e-12', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'rejects other values' do + [ true, 'true', false, 'false', 'iAmAString', '1test', '1 test', 'test 1', 'test 1 test', {}, { 'key' => 'value' }, { 1=> 2 }, '', :undef , 'x' ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a value of type Numeric, Pattern(\[.*\]+)?, or Array/) } + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/string_spec.rb b/environments/prod/modules/stdlib/spec/aliases/string_spec.rb new file mode 100644 index 0000000..d8fb885 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/string_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::string', type: :class do + describe 'accepts strings' do + [ + '', + 'one', + nil, + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'rejects other values' do + [ + [], + {}, + 1, + true, + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a String/) } + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/unixpath_spec.rb b/environments/prod/modules/stdlib/spec/aliases/unixpath_spec.rb new file mode 100644 index 0000000..6aecfe7 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/unixpath_spec.rb @@ -0,0 +1,47 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::unixpath', type: :class do + describe 'valid handling' do + %w{ + /usr2/username/bin:/usr/local/bin:/usr/bin:. + /var/tmp + /Users/helencampbell/workspace/puppetlabs-stdlib + /var/ůťƒ8 + /var/ネット + /var//tmp + /var/../tmp + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + "C:/whatever", + "\\var\\tmp", + "\\Users/hc/wksp/stdlib", + "*/Users//nope", + "var\ůťƒ8", + "var\ネット" + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::Unixpath/) } + end + end + end + + end + end +end diff --git a/environments/prod/modules/stdlib/spec/aliases/windowspath_spec.rb b/environments/prod/modules/stdlib/spec/aliases/windowspath_spec.rb new file mode 100644 index 0000000..c20e373 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/aliases/windowspath_spec.rb @@ -0,0 +1,47 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::windowspath', type: :class do + describe 'valid handling' do + %w{ + C:\\ + C:\\WINDOWS\\System32 + C:/windows/system32 + X:/foo/bar + X:\\foo\\bar + \\\\host\\windows + X:/var/ůťƒ8 + X:/var/ネット + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + "httds://notquiteright.org", + "/usr2/username/bin:/usr/local/bin:/usr/bin:.", + "C;//notright/here", + "C:noslashes", + "C:ネット", + "C:ůťƒ8" + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::Windowspath/) } + end + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/fixtures/dscacheutil/root b/environments/prod/modules/stdlib/spec/fixtures/dscacheutil/root new file mode 100644 index 0000000..1e34519 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/dscacheutil/root @@ -0,0 +1,8 @@ +name: root +password: * +uid: 0 +gid: 0 +dir: /var/root +shell: /bin/bash +gecos: rawr Root + diff --git a/environments/prod/modules/stdlib/spec/fixtures/lsuser/root b/environments/prod/modules/stdlib/spec/fixtures/lsuser/root new file mode 100644 index 0000000..afd59ca --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/lsuser/root @@ -0,0 +1,2 @@ +#name:home +root:/root diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/absolute_path.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/absolute_path.pp new file mode 100644 index 0000000..d77f6bd --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/absolute_path.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Compat::Absolute_path type alias +class test::absolute_path( + Stdlib::Compat::Absolute_path $value, + ) { + notice("Success") +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/absolutepath.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/absolutepath.pp new file mode 100644 index 0000000..8321471 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/absolutepath.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Absolutepath type. Not to be confused with Stdlib::Compat::Absolute_path. +class test::absolutepath( + Stdlib::Absolutepath $value, + ) { + notice("Success") +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/array.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/array.pp new file mode 100644 index 0000000..84b6a5b --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/array.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::Array type alias +class test::array( + Stdlib::Compat::Array $value, + ) { + + notice("Success") + +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/bool.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/bool.pp new file mode 100644 index 0000000..ab5b5ea --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/bool.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::Bool type alias +class test::bool( + Stdlib::Compat::Bool $value, + ) { + + notice("Success") + +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/ensure_resources.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/ensure_resources.pp new file mode 100644 index 0000000..bd26002 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/ensure_resources.pp @@ -0,0 +1,4 @@ +# A helper class to test the ensure_resources function +class test::ensure_resources($resource_type, $title_hash, $attributes_hash) { + ensure_resources($resource_type, $title_hash, $attributes_hash) +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/float.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/float.pp new file mode 100644 index 0000000..03a603d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/float.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::Float type alias +class test::float( + Stdlib::Compat::Float $value, + ) { + + notice("Success") + +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/hash.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/hash.pp new file mode 100644 index 0000000..c243570 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/hash.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::Hash type alias +class test::hash( + Stdlib::Compat::Hash $value, + ) { + + notice("Success") + +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/httpsurl.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/httpsurl.pp new file mode 100644 index 0000000..9d6b92d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/httpsurl.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::HTTPSUrl type alias +class test::httpsurl( + Stdlib::HTTPSUrl $value, + ) { + notice("Success") +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/httpurl.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/httpurl.pp new file mode 100644 index 0000000..abf869e --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/httpurl.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::HTTPUrl type alias +class test::httpurl( + Stdlib::HTTPUrl $value, + ) { + notice("Success") +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/integer.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/integer.pp new file mode 100644 index 0000000..a4f26df --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/integer.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::Integer type alias +class test::integer( + Stdlib::Compat::Integer $value, + ) { + + notice("Success") + +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/ip_address.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/ip_address.pp new file mode 100644 index 0000000..bbbd804 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/ip_address.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Compat::Ip_address type alias +class test::ip_address( + Stdlib::Compat::Ip_address $value, + ) { + notice("Success") + } diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/ipv4.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/ipv4.pp new file mode 100644 index 0000000..2e8022d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/ipv4.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Compat::Ipv4 type alias +class test::ipv4( + Stdlib::Compat::Ipv4 $value, + ) { + notice("Success") + } diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/ipv6.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/ipv6.pp new file mode 100644 index 0000000..7912fd6 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/ipv6.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Compat::Ipv6 type alias +class test::ipv6( + Stdlib::Compat::Ipv6 $value, + ) { + notice("Success") +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/numeric.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/numeric.pp new file mode 100644 index 0000000..2657ebc --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/numeric.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::Numeric type alias +class test::numeric( + Stdlib::Compat::Numeric $value, + ) { + + notice("Success") + +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/string.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/string.pp new file mode 100644 index 0000000..6508c70 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/string.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::String type alias +class test::string( + Stdlib::Compat::String $value, + ) { + + notice("Success") + +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/unixpath.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/unixpath.pp new file mode 100644 index 0000000..9311109 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/unixpath.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Unixpath type alias +class test::unixpath( + Stdlib::Unixpath $value, + ) { + notice("Success") +} diff --git a/environments/prod/modules/stdlib/spec/fixtures/test/manifests/windowspath.pp b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/windowspath.pp new file mode 100644 index 0000000..af93ed3 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/fixtures/test/manifests/windowspath.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Windowspath type alias +class test::windowspath( + Stdlib::Windowspath $value, + ) { + notice("Success") +} diff --git a/environments/prod/modules/stdlib/spec/functions/abs_spec.rb b/environments/prod/modules/stdlib/spec/functions/abs_spec.rb new file mode 100755 index 0000000..7d2257b --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/abs_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper' + +describe 'abs' do + it { is_expected.not_to eq(nil) } + + describe 'signature validation in puppet3', :unless => RSpec.configuration.puppet_future do + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params(1, 2).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + end + + describe 'signature validation in puppet4', :if => RSpec.configuration.puppet_future do + it { pending "the puppet 4 implementation"; is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(1, 2).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params([]).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params({}).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(true).and_raise_error(ArgumentError) } + end + + it { is_expected.to run.with_params(-34).and_return(34) } + it { is_expected.to run.with_params("-34").and_return(34) } + it { is_expected.to run.with_params(34).and_return(34) } + it { is_expected.to run.with_params("34").and_return(34) } + it { is_expected.to run.with_params(-34.5).and_return(34.5) } + it { is_expected.to run.with_params("-34.5").and_return(34.5) } + it { is_expected.to run.with_params(34.5).and_return(34.5) } + it { is_expected.to run.with_params("34.5").and_return(34.5) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/any2array_spec.rb b/environments/prod/modules/stdlib/spec/functions/any2array_spec.rb new file mode 100755 index 0000000..631657f --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/any2array_spec.rb @@ -0,0 +1,21 @@ +require 'spec_helper' + +describe "any2array" do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_return([]) } + it { is_expected.to run.with_params(true).and_return([true]) } + it { is_expected.to run.with_params('one').and_return(['one']) } + it { is_expected.to run.with_params('one', 'two').and_return(['one', 'two']) } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['one']).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two']).and_return(['one', 'two']) } + it { is_expected.to run.with_params({}).and_return([]) } + it { is_expected.to run.with_params({ 'key' => 'value' }).and_return(['key', 'value']) } + it { is_expected.to run.with_params({ 'key' => 'value' }).and_return(['key', 'value']) } + + it { is_expected.to run.with_params('‰').and_return(['‰']) } + it { is_expected.to run.with_params('竹').and_return(['竹']) } + it { is_expected.to run.with_params('Ü').and_return(['Ü']) } + it { is_expected.to run.with_params('∇').and_return(['∇']) } + it { is_expected.to run.with_params('€', '万', 'Ö', '♥', '割').and_return(['€', '万', 'Ö', '♥', '割']) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/any2bool_spec.rb b/environments/prod/modules/stdlib/spec/functions/any2bool_spec.rb new file mode 100755 index 0000000..9d351ce --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/any2bool_spec.rb @@ -0,0 +1,42 @@ +require 'spec_helper' + +describe 'any2bool' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + it { is_expected.to run.with_params(true).and_return(true) } + it { is_expected.to run.with_params(false).and_return(false) } + + it { is_expected.to run.with_params('1.5').and_return(true) } + + describe 'when testing stringy values that mean "true"' do + [ 'TRUE','1', 't', 'y', 'true', 'yes'].each do |value| + it { is_expected.to run.with_params(value).and_return(true) } + end + end + + describe 'when testing stringy values that mean "false"' do + [ 'FALSE','', '0', 'f', 'n', 'false', 'no', 'undef', 'undefined', nil, :undef ].each do |value| + it { is_expected.to run.with_params(value).and_return(false) } + end + end + + describe 'when testing numeric values that mean "true"' do + [ 1,'1',1.5, '1.5'].each do |value| + it { is_expected.to run.with_params(value).and_return(true) } + end + end + + describe 'when testing numeric that mean "false"' do + [ -1, '-1', -1.5, '-1.5', '0', 0 ].each do |value| + it { is_expected.to run.with_params(value).and_return(false) } + end + end + + describe 'everything else returns true' do + [ [], {}, ['1'], [1], {:one => 1} ].each do |value| + it { is_expected.to run.with_params(value).and_return(true) } + end + end + +end diff --git a/environments/prod/modules/stdlib/spec/functions/assert_private_spec.rb b/environments/prod/modules/stdlib/spec/functions/assert_private_spec.rb new file mode 100755 index 0000000..355e0dd --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/assert_private_spec.rb @@ -0,0 +1,41 @@ +require 'spec_helper' + +describe 'assert_private' do + context 'when called from inside module' do + it "should not fail" do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('foo') + + is_expected.to run.with_params() + end + end + + context "when called from private class" do + before :each do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('bar') + end + + it "should fail with a class error message" do + scope.source.expects(:name).returns('foo::baz') + scope.source.expects(:type).returns('hostclass') + + is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /Class foo::baz is private/) + end + + context "with an explicit failure message" do + it { is_expected.to run.with_params('failure message!').and_raise_error(Puppet::ParseError, /failure message!/) } + end + end + + context "when called from private definition" do + it "should fail with a class error message" do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('bar') + scope.source.expects(:name).returns('foo::baz') + scope.source.expects(:type).returns('definition') + + is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /Definition foo::baz is private/) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/base64_spec.rb b/environments/prod/modules/stdlib/spec/functions/base64_spec.rb new file mode 100755 index 0000000..842a37a --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/base64_spec.rb @@ -0,0 +1,37 @@ +require 'spec_helper' + +describe 'base64' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("one").and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("one", "two").and_raise_error(Puppet::ParseError, /first argument must be one of/) } + it { is_expected.to run.with_params("encode", ["two"]).and_raise_error(Puppet::ParseError, /second argument must be a string/) } + it { is_expected.to run.with_params("encode", 2).and_raise_error(Puppet::ParseError, /second argument must be a string/) } + it { is_expected.to run.with_params("encode", "thestring", "three").and_raise_error(Puppet::ParseError, /third argument must be one of/) } + it { is_expected.to run.with_params("decode", "dGhlc3RyaW5n\n", "strict").and_raise_error(ArgumentError) } + + it { is_expected.to run.with_params("encode", "thestring").and_return("dGhlc3RyaW5n\n") } + it { is_expected.to run.with_params("decode", "dGhlc3RyaW5n").and_return("thestring") } + it { is_expected.to run.with_params("decode", "dGhlc3RyaW5n\n").and_return("thestring") } + + it { is_expected.to run.with_params("encode", "thestring", "default").and_return("dGhlc3RyaW5n\n") } + it { is_expected.to run.with_params("decode", "dGhlc3RyaW5n", "default").and_return("thestring") } + it { is_expected.to run.with_params("decode", "dGhlc3RyaW5n\n", "default").and_return("thestring") } + + it { is_expected.to run.with_params("encode", "thestring", "strict").and_return("dGhlc3RyaW5n") } + it { is_expected.to run.with_params("decode", "dGhlc3RyaW5n", "strict").and_return("thestring") } + + it { is_expected.to run.with_params("encode", "a very long string that will cause the base64 encoder to produce output with multiple lines").and_return("YSB2ZXJ5IGxvbmcgc3RyaW5nIHRoYXQgd2lsbCBjYXVzZSB0aGUgYmFzZTY0\nIGVuY29kZXIgdG8gcHJvZHVjZSBvdXRwdXQgd2l0aCBtdWx0aXBsZSBsaW5l\ncw==\n") } + it { is_expected.to run.with_params("decode", "YSB2ZXJ5IGxvbmcgc3RyaW5nIHRoYXQgd2lsbCBjYXVzZSB0aGUgYmFzZTY0\nIGVuY29kZXIgdG8gcHJvZHVjZSBvdXRwdXQgd2l0aCBtdWx0aXBsZSBsaW5l\ncw==\n").and_return("a very long string that will cause the base64 encoder to produce output with multiple lines") } + it { is_expected.to run.with_params("decode", "YSB2ZXJ5IGxvbmcgc3RyaW5nIHRoYXQgd2lsbCBjYXVzZSB0aGUgYmFzZTY0IGVuY29kZXIgdG8gcHJvZHVjZSBvdXRwdXQgd2l0aCBtdWx0aXBsZSBsaW5lcw==").and_return("a very long string that will cause the base64 encoder to produce output with multiple lines") } + + it { is_expected.to run.with_params("encode", "a very long string that will cause the base64 encoder to produce output with multiple lines", "strict").and_return("YSB2ZXJ5IGxvbmcgc3RyaW5nIHRoYXQgd2lsbCBjYXVzZSB0aGUgYmFzZTY0IGVuY29kZXIgdG8gcHJvZHVjZSBvdXRwdXQgd2l0aCBtdWx0aXBsZSBsaW5lcw==") } + it { is_expected.to run.with_params("decode", "YSB2ZXJ5IGxvbmcgc3RyaW5nIHRoYXQgd2lsbCBjYXVzZSB0aGUgYmFzZTY0IGVuY29kZXIgdG8gcHJvZHVjZSBvdXRwdXQgd2l0aCBtdWx0aXBsZSBsaW5lcw==").and_return("a very long string that will cause the base64 encoder to produce output with multiple lines") } + it { is_expected.to run.with_params("decode", "YSB2ZXJ5IGxvbmcgc3RyaW5nIHRoYXQgd2lsbCBjYXVzZSB0aGUgYmFzZTY0IGVuY29kZXIgdG8gcHJvZHVjZSBvdXRwdXQgd2l0aCBtdWx0aXBsZSBsaW5lcw==", "strict").and_return("a very long string that will cause the base64 encoder to produce output with multiple lines") } + + it { is_expected.to run.with_params("encode", "https://www.google.com.tw/?gws_rd=ssl#q=hello+world", "urlsafe").and_return("aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS50dy8_Z3dzX3JkPXNzbCNxPWhlbGxvK3dvcmxk") } + it { is_expected.to run.with_params("decode", "aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS50dy8_Z3dzX3JkPXNzbCNxPWhlbGxvK3dvcmxk", "urlsafe").and_return("https://www.google.com.tw/?gws_rd=ssl#q=hello+world") } + + it { is_expected.to run.with_params("encode", "https://github.com/puppetlabs/puppetlabs-stdlib/pulls?utf8=%E2%9C%93&q=is%3Apr+is%3Aopen+Add", "urlsafe").and_return("aHR0cHM6Ly9naXRodWIuY29tL3B1cHBldGxhYnMvcHVwcGV0bGFicy1zdGRsaWIvcHVsbHM_dXRmOD0lRTIlOUMlOTMmcT1pcyUzQXByK2lzJTNBb3BlbitBZGQ=") } + it { is_expected.to run.with_params("decode", "aHR0cHM6Ly9naXRodWIuY29tL3B1cHBldGxhYnMvcHVwcGV0bGFicy1zdGRsaWIvcHVsbHM_dXRmOD0lRTIlOUMlOTMmcT1pcyUzQXByK2lzJTNBb3BlbitBZGQ=", "urlsafe").and_return("https://github.com/puppetlabs/puppetlabs-stdlib/pulls?utf8=%E2%9C%93&q=is%3Apr+is%3Aopen+Add") } +end diff --git a/environments/prod/modules/stdlib/spec/functions/basename_spec.rb b/environments/prod/modules/stdlib/spec/functions/basename_spec.rb new file mode 100755 index 0000000..3e02b01 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/basename_spec.rb @@ -0,0 +1,19 @@ +require 'spec_helper' + +describe 'basename' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two', 'three').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('/path/to/a/file.ext', []).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('/path/to/a/file.ext').and_return('file.ext') } + it { is_expected.to run.with_params('relative_path/to/a/file.ext').and_return('file.ext') } + it { is_expected.to run.with_params('/path/to/a/file.ext', '.ext').and_return('file') } + it { is_expected.to run.with_params('relative_path/to/a/file.ext', '.ext').and_return('file') } + it { is_expected.to run.with_params('scheme:///path/to/a/file.ext').and_return('file.ext') } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('scheme:///√ạĺűē/竹.ext').and_return('竹.ext') } + it { is_expected.to run.with_params('ҝẽγ:/√ạĺűē/竹.ㄘ', '.ㄘ').and_return('竹') } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/bool2num_spec.rb b/environments/prod/modules/stdlib/spec/functions/bool2num_spec.rb new file mode 100755 index 0000000..e506859 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/bool2num_spec.rb @@ -0,0 +1,14 @@ +require 'spec_helper' + +describe 'bool2num' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + + [ true, 'true', AlsoString.new('true') ].each do |truthy| + it { is_expected.to run.with_params(truthy).and_return(1) } + end + + [ false, 'false', AlsoString.new('false') ].each do |falsey| + it { is_expected.to run.with_params(falsey).and_return(0) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/bool2str_spec.rb b/environments/prod/modules/stdlib/spec/functions/bool2str_spec.rb new file mode 100755 index 0000000..23a754b --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/bool2str_spec.rb @@ -0,0 +1,17 @@ +require 'spec_helper' + +describe 'bool2str' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + [ 'true', 'false', nil, :undef, ''].each do |invalid| + it { is_expected.to run.with_params(invalid).and_raise_error(Puppet::ParseError) } + end + it { is_expected.to run.with_params(true, 'yes', 'no', 'maybe').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(true, 'maybe').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(true, 0, 1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(true).and_return("true") } + it { is_expected.to run.with_params(false).and_return("false") } + it { is_expected.to run.with_params(true, 'yes', 'no').and_return("yes") } + it { is_expected.to run.with_params(false, 'yes', 'no').and_return("no") } + +end diff --git a/environments/prod/modules/stdlib/spec/functions/camelcase_spec.rb b/environments/prod/modules/stdlib/spec/functions/camelcase_spec.rb new file mode 100755 index 0000000..c78aa62 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/camelcase_spec.rb @@ -0,0 +1,17 @@ +require 'spec_helper' + +describe 'camelcase' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(100).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("abc").and_return("Abc") } + it { is_expected.to run.with_params("aa_bb_cc").and_return("AaBbCc") } + it { is_expected.to run.with_params("_aa__bb__cc_").and_return("AaBbCc") } + it { is_expected.to run.with_params("100").and_return("100") } + it { is_expected.to run.with_params("1_00").and_return("100") } + it { is_expected.to run.with_params("_").and_return("") } + it { is_expected.to run.with_params("").and_return("") } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(["abc", "aa_bb_cc"]).and_return(["Abc", "AaBbCc"]) } + it { is_expected.to run.with_params(["abc", 1, "aa_bb_cc"]).and_return(["Abc", 1, "AaBbCc"]) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/capitalize_spec.rb b/environments/prod/modules/stdlib/spec/functions/capitalize_spec.rb new file mode 100755 index 0000000..7ce2e16 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/capitalize_spec.rb @@ -0,0 +1,15 @@ +require 'spec_helper' + +describe 'capitalize' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(100).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("one").and_return("One") } + it { is_expected.to run.with_params("one two").and_return("One two") } + it { is_expected.to run.with_params("ONE TWO").and_return("One two") } + + it { is_expected.to run.with_params(AlsoString.new("one")).and_return("One") } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(["one", "two"]).and_return(["One", "Two"]) } + it { is_expected.to run.with_params(["one", 1, "two"]).and_return(["One", 1, "Two"]) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/ceiling_spec.rb b/environments/prod/modules/stdlib/spec/functions/ceiling_spec.rb new file mode 100755 index 0000000..567426f --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/ceiling_spec.rb @@ -0,0 +1,13 @@ +require 'spec_helper' + +describe 'ceiling' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("foo").and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(34).and_return(34) } + it { is_expected.to run.with_params(-34).and_return(-34) } + it { is_expected.to run.with_params(33.1).and_return(34) } + it { is_expected.to run.with_params(-33.1).and_return(-33) } +end + diff --git a/environments/prod/modules/stdlib/spec/functions/chomp_spec.rb b/environments/prod/modules/stdlib/spec/functions/chomp_spec.rb new file mode 100755 index 0000000..56bd9b1 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/chomp_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' + +describe 'chomp' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params("a", "b").and_raise_error(Puppet::ParseError) + } + it { is_expected.to run.with_params("one").and_return("one") } + it { is_expected.to run.with_params("one\n").and_return("one") } + it { is_expected.to run.with_params("one\n\n").and_return("one\n") } + it { is_expected.to run.with_params(["one\n", "two", "three\n"]).and_return(["one", "two", "three"]) } + + it { is_expected.to run.with_params(AlsoString.new("one")).and_return("one") } + it { is_expected.to run.with_params(AlsoString.new("one\n")).and_return("one") } + it { is_expected.to run.with_params(AlsoString.new("one\n\n")).and_return("one\n") } + it { is_expected.to run.with_params([AlsoString.new("one\n"), AlsoString.new("two"), "three\n"]).and_return(["one", "two", "three"]) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params("ůťƒ8\n\n").and_return("ůťƒ8\n") } + it { is_expected.to run.with_params("ネット\n\n").and_return("ネット\n") } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/chop_spec.rb b/environments/prod/modules/stdlib/spec/functions/chop_spec.rb new file mode 100755 index 0000000..b70fc37 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/chop_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' + +describe 'chop' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params("a", "b").and_raise_error(Puppet::ParseError) + } + it { is_expected.to run.with_params("one").and_return("on") } + it { is_expected.to run.with_params("one\n").and_return("one") } + it { is_expected.to run.with_params("one\n\n").and_return("one\n") } + it { is_expected.to run.with_params(["one\n", "two", "three\n"]).and_return(["one", "tw", "three"]) } + + it { is_expected.to run.with_params(AlsoString.new("one")).and_return("on") } + it { is_expected.to run.with_params(AlsoString.new("one\n")).and_return("one") } + it { is_expected.to run.with_params(AlsoString.new("one\n\n")).and_return("one\n") } + it { is_expected.to run.with_params([AlsoString.new("one\n"), AlsoString.new("two"), "three\n"]).and_return(["one", "tw", "three"]) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params("ůťƒ8\n\n").and_return("ůťƒ8\n") } + it { is_expected.to run.with_params("ネット\n\n").and_return("ネット\n") } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/clamp_spec.rb b/environments/prod/modules/stdlib/spec/functions/clamp_spec.rb new file mode 100644 index 0000000..3e2fe7a --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/clamp_spec.rb @@ -0,0 +1,16 @@ +require 'spec_helper' + +describe 'clamp' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(12, 88, 71, 190).and_raise_error(Puppet::ParseError, /Wrong number of arguments, need three to clamp/) } + it { is_expected.to run.with_params('12string', 88, 15).and_raise_error(Puppet::ParseError, /Required explicit numeric/) } + it { is_expected.to run.with_params(1, 2, {'a' => 55}).and_raise_error(Puppet::ParseError, /The Hash type is not allowed/) } + it { is_expected.to run.with_params('24', [575, 187]).and_return(187) } + it { is_expected.to run.with_params([4, 3, '99']).and_return(4) } + it { is_expected.to run.with_params(16, 750, 88).and_return(88) } + it { is_expected.to run.with_params([3, 873], 73).and_return(73) } + it { is_expected.to run.with_params([4], 8, 75).and_return(8) } + it { is_expected.to run.with_params([6], [31], 9911).and_return(31) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/concat_spec.rb b/environments/prod/modules/stdlib/spec/functions/concat_spec.rb new file mode 100755 index 0000000..6ab1b6e --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/concat_spec.rb @@ -0,0 +1,29 @@ +require 'spec_helper' + +describe 'concat' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([1]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1, [2]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([1], [2], [3]).and_return([1, 2, 3]) } + it { is_expected.to run.with_params(['1','2','3'],['4','5','6']).and_return(['1','2','3','4','5','6']) } + it { is_expected.to run.with_params(['1','2','3'],'4').and_return(['1','2','3','4']) } + it { is_expected.to run.with_params(['1','2','3'],[['4','5'],'6']).and_return(['1','2','3',['4','5'],'6']) } + it { is_expected.to run.with_params(['1','2'],['3','4'],['5','6']).and_return(['1','2','3','4','5','6']) } + it { is_expected.to run.with_params(['1','2'],'3','4',['5','6']).and_return(['1','2','3','4','5','6']) } + +context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params([{"a" => "b"}], {"c" => "d", "e" => "f"}).and_return([{"a" => "b"}, {"c" => "d", "e" => "f"}]) } + it { is_expected.to run.with_params(['ấ','β','©'],['đ','ể','文字列']).and_return(['ấ','β','©','đ','ể','文字列']) } +end + + it "should leave the original array intact" do + argument1 = ['1','2','3'] + original1 = argument1.dup + argument2 = ['4','5','6'] + original2 = argument2.dup + result = subject.call([argument1,argument2]) + expect(argument1).to eq(original1) + expect(argument2).to eq(original2) + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/convert_base_spec.rb b/environments/prod/modules/stdlib/spec/functions/convert_base_spec.rb new file mode 100644 index 0000000..8ab2284 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/convert_base_spec.rb @@ -0,0 +1,24 @@ +require 'spec_helper' + +describe 'convert_base' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { is_expected.to run.with_params("asdf").and_raise_error(ArgumentError) } + it { is_expected.to run.with_params("asdf","moo","cow").and_raise_error(ArgumentError) } + it { is_expected.to run.with_params(["1"],"2").and_raise_error(Puppet::ParseError, /argument must be either a string or an integer/) } + it { is_expected.to run.with_params("1",["2"]).and_raise_error(Puppet::ParseError, /argument must be either a string or an integer/) } + it { is_expected.to run.with_params("1",1).and_raise_error(Puppet::ParseError, /base must be at least 2 and must not be greater than 36/) } + it { is_expected.to run.with_params("1",37).and_raise_error(Puppet::ParseError, /base must be at least 2 and must not be greater than 36/) } + + it "should raise a ParseError if argument 1 is a string that does not correspond to an integer in base 10" do + is_expected.to run.with_params("ten",6).and_raise_error(Puppet::ParseError, /argument must be an integer or a string corresponding to an integer in base 10/) + end + + it "should raise a ParseError if argument 2 is a string and does not correspond to an integer in base 10" do + is_expected.to run.with_params(100,"hex").and_raise_error(Puppet::ParseError, /argument must be an integer or a string corresponding to an integer in base 10/) + end + + it { is_expected.to run.with_params("11",'16').and_return('b') } + it { is_expected.to run.with_params("35",'36').and_return('z') } + it { is_expected.to run.with_params(5, 2).and_return('101') } +end diff --git a/environments/prod/modules/stdlib/spec/functions/count_spec.rb b/environments/prod/modules/stdlib/spec/functions/count_spec.rb new file mode 100755 index 0000000..3854cb8 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/count_spec.rb @@ -0,0 +1,23 @@ +require 'spec_helper' + +describe 'count' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { is_expected.to run.with_params("one").and_raise_error(ArgumentError) } + it { is_expected.to run.with_params("one", "two").and_return(1) } + it { + pending("should actually be like this, and not like above") + is_expected.to run.with_params("one", "two").and_raise_error(ArgumentError) + } + it { is_expected.to run.with_params("one", "two", "three").and_raise_error(ArgumentError) } + it { is_expected.to run.with_params(["one", "two", "three"]).and_return(3) } + it { is_expected.to run.with_params(["one", "two", "two"], "two").and_return(2) } + it { is_expected.to run.with_params(["one", nil, "two"]).and_return(2) } + it { is_expected.to run.with_params(["one", "", "two"]).and_return(2) } + it { is_expected.to run.with_params(["one", :undef, "two"]).and_return(2) } + + it { is_expected.to run.with_params(["ổņ℮", "ŧщộ", "three"]).and_return(3) } + it { is_expected.to run.with_params(["ổņ℮", "ŧщộ", "ŧщộ"], "ŧщộ").and_return(2) } + it { is_expected.to run.with_params(["ổņ℮", nil, "ŧщộ"]).and_return(2) } + it { is_expected.to run.with_params(["ổņ℮", :undef, "ŧщộ"]).and_return(2) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/deep_merge_spec.rb b/environments/prod/modules/stdlib/spec/functions/deep_merge_spec.rb new file mode 100755 index 0000000..c91a07e --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/deep_merge_spec.rb @@ -0,0 +1,59 @@ +require 'spec_helper' + +describe 'deep_merge' do + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params({ 'key' => 'value' }).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params({}, '2').and_raise_error(Puppet::ParseError, /unexpected argument type String/) } + it { is_expected.to run.with_params({}, 2).and_raise_error(Puppet::ParseError, /unexpected argument type Fixnum/) } + it { is_expected.to run.with_params({}, '').and_return({}) } + it { is_expected.to run.with_params({}, {}).and_return({}) } + it { is_expected.to run.with_params({}, {}, {}).and_return({}) } + it { is_expected.to run.with_params({}, {}, {}, {}).and_return({}) } + it { is_expected.to run.with_params({'key' => 'value'}, '').and_return({'key' => 'value'}) } + it { is_expected.to run.with_params({'key1' => 'value1'}, {'key2' => 'value2' }).and_return({'key1' => 'value1', 'key2' => 'value2'}) } + + describe 'when arguments have key collisions' do + it 'should prefer values from the last hash' do + is_expected.to run \ + .with_params( + {'key1' => 'value1', 'key2' => 'value2' }, + {'key2' => 'replacement_value', 'key3' => 'value3'}) \ + .and_return( + {'key1' => 'value1', 'key2' => 'replacement_value', 'key3' => 'value3'}) + end + it { is_expected.to run \ + .with_params({'key1' => 'value1'}, {'key1' => 'value2'}, {'key1' => 'value3'}) \ + .and_return({'key1' => 'value3' }) + } + end + + describe 'when arguments have subhashes' do + it { is_expected.to run \ + .with_params({'key1' => 'value1'}, {'key2' => 'value2', 'key3' => {'subkey1' => 'value4'}}) \ + .and_return( {'key1' => 'value1', 'key2' => 'value2', 'key3' => {'subkey1' => 'value4'}}) + } + it { is_expected.to run \ + .with_params({'key1' => {'subkey1' => 'value1'}}, {'key1' => {'subkey2' => 'value2'}}) \ + .and_return( {'key1' => {'subkey1' => 'value1', 'subkey2' => 'value2'}}) + } + it { is_expected.to run \ + .with_params({'key1' => {'subkey1' => {'subsubkey1' => 'value1'}}}, {'key1' => {'subkey1' => {'subsubkey1' => 'value2'}}}) \ + .and_return( {'key1' => {'subkey1' => {'subsubkey1' => 'value2'}}}) + } + end + + it 'should not change the original hashes' do + argument1 = { 'key1' => 'value1' } + original1 = argument1.dup + argument2 = { 'key2' => 'value2' } + original2 = argument2.dup + + subject.call([argument1, argument2]) + expect(argument1).to eq(original1) + expect(argument2).to eq(original2) + end + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params({'ĸέỹ1' => 'ϋǻļủë1'}, {'この文字列' => '万' }).and_return({'ĸέỹ1' => 'ϋǻļủë1', 'この文字列' => '万'}) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/defined_with_params_spec.rb b/environments/prod/modules/stdlib/spec/functions/defined_with_params_spec.rb new file mode 100755 index 0000000..a0db0b7 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/defined_with_params_spec.rb @@ -0,0 +1,40 @@ +require 'spec_helper' + +describe 'defined_with_params' do + describe 'when no resource is specified' do + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + end + describe 'when compared against a resource with no attributes' do + let :pre_condition do + 'user { "dan": }' + end + it { is_expected.to run.with_params('User[dan]', {}).and_return(true) } + it { is_expected.to run.with_params('User[bob]', {}).and_return(false) } + it { is_expected.to run.with_params('User[dan]', {'foo' => 'bar'}).and_return(false) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('User[ĵĭмოү]', {}).and_return(false) } + it { is_expected.to run.with_params('User[ポーラ]', {}).and_return(false) } + end + end + + describe 'when compared against a resource with attributes' do + let :pre_condition do + 'user { "dan": ensure => present, shell => "/bin/csh", managehome => false}' + end + it { is_expected.to run.with_params('User[dan]', {}).and_return(true) } + it { is_expected.to run.with_params('User[dan]', '').and_return(true) } + it { is_expected.to run.with_params('User[dan]', {'ensure' => 'present'}).and_return(true) } + it { is_expected.to run.with_params('User[dan]', {'ensure' => 'present', 'managehome' => false}).and_return(true) } + it { is_expected.to run.with_params('User[dan]', {'ensure' => 'absent', 'managehome' => false}).and_return(false) } + end + + describe 'when passing undef values' do + let :pre_condition do + 'file { "/tmp/a": ensure => present }' + end + + it { is_expected.to run.with_params('File[/tmp/a]', {}).and_return(true) } + it { is_expected.to run.with_params('File[/tmp/a]', { 'ensure' => 'present', 'owner' => :undef }).and_return(true) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/delete_at_spec.rb b/environments/prod/modules/stdlib/spec/functions/delete_at_spec.rb new file mode 100755 index 0000000..0471039 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/delete_at_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper' + +describe 'delete_at' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1, 1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(['one'], 'two').and_raise_error(Puppet::ParseError) } + it { + pending("Current implementation ignores parameters after the first two.") + is_expected.to run.with_params(['one'], 0, 1).and_raise_error(Puppet::ParseError) + } + + describe 'argument validation' do + it { is_expected.to run.with_params([0, 1, 2], 3).and_raise_error(Puppet::ParseError) } + end + + it { is_expected.to run.with_params([0, 1, 2], 1).and_return([0, 2]) } + it { is_expected.to run.with_params([0, 1, 2], -1).and_return([0, 1]) } + it { is_expected.to run.with_params([0, 1, 2], -4).and_return([0, 1, 2]) } + it { is_expected.to run.with_params(["ƒờở", "βāř", "ьầż"], 1).and_return(["ƒờở", "ьầż"]) } + + + it "should leave the original array intact" do + argument = [1, 2, 3] + original = argument.dup + result = subject.call([argument,2]) + expect(argument).to eq(original) + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/delete_regex_spec.rb b/environments/prod/modules/stdlib/spec/functions/delete_regex_spec.rb new file mode 100755 index 0000000..f27a946 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/delete_regex_spec.rb @@ -0,0 +1,54 @@ +require 'spec_helper' + +describe 'delete_regex' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], 'two') } + it { is_expected.to run.with_params({}, 'two') } + it { is_expected.to run.with_params([], 'two', 'three').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], 'two', 'three', 'four').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1, 'two').and_raise_error(TypeError) } + + describe 'deleting from an array' do + it { is_expected.to run.with_params([], '').and_return([]) } + it { is_expected.to run.with_params([], 'two').and_return([]) } + it { is_expected.to run.with_params(['two'], 'two').and_return([]) } + it { is_expected.to run.with_params(['two', 'two'], 'two').and_return([]) } + it { is_expected.to run.with_params(['one', 'two', 'three'], '^t.*').and_return(['one']) } + it { is_expected.to run.with_params(['ab', 'b', 'c', 'b'], 'b').and_return(['ab', 'c']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'four').and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'e').and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'two').and_return(['one', 'three']) } + it { is_expected.to run.with_params(['two', 'one', 'two', 'three', 'two'], 'two').and_return(['one', 'three']) } + it { is_expected.to run.with_params(['abracadabra'], 'abr').and_return(['abracadabra']) } + it { is_expected.to run.with_params(['abracadabra'], '^.*jimbob.*$').and_return(['abracadabra']) } + end + + describe 'deleting from an array' do + it { is_expected.to run.with_params({}, '').and_return({}) } + it { is_expected.to run.with_params({}, 'key').and_return({}) } + it { is_expected.to run.with_params({'key' => 'value'}, 'key').and_return({}) } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3'}, 'key2') \ + .and_return( {'key1' => 'value1', 'key3' => 'value3'}) + } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3'}, ['key1', 'key2']) \ + .and_return( {'key3' => 'value3'}) + } + end + + it "should leave the original array intact" do + argument1 = ['one','two','three'] + original1 = argument1.dup + subject.call([argument1,'two']) + expect(argument1).to eq(original1) + end + it "should leave the original hash intact" do + argument1 = {'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3'} + original1 = argument1.dup + subject.call([argument1,'key2']) + expect(argument1).to eq(original1) + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/delete_spec.rb b/environments/prod/modules/stdlib/spec/functions/delete_spec.rb new file mode 100755 index 0000000..4e37865 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/delete_spec.rb @@ -0,0 +1,76 @@ +require 'spec_helper' + +describe 'delete' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], 'two') } + it { is_expected.to run.with_params([], 'two', 'three').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1, 'two').and_raise_error(TypeError) } + + describe 'deleting from an array' do + it { is_expected.to run.with_params([], '').and_return([]) } + it { is_expected.to run.with_params([], 'two').and_return([]) } + it { is_expected.to run.with_params(['two'], 'two').and_return([]) } + it { is_expected.to run.with_params(['two', 'two'], 'two').and_return([]) } + it { is_expected.to run.with_params(['ab', 'b', 'c', 'b'], 'b').and_return(['ab', 'c']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'four').and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'e').and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'two').and_return(['one', 'three']) } + it { is_expected.to run.with_params(['two', 'one', 'two', 'three', 'two'], 'two').and_return(['one', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'two'], ['one', 'two']).and_return(['three']) } + it { is_expected.to run.with_params(['ồאּẻ', 'ŧẅơ', 'ŧңŗё℮', 'ŧẅơ'], ['ồאּẻ', 'ŧẅơ']).and_return(['ŧңŗё℮']) } + end + + describe 'deleting from a string' do + it { is_expected.to run.with_params('', '').and_return('') } + it { is_expected.to run.with_params('bar', '').and_return('bar') } + it { is_expected.to run.with_params('', 'bar').and_return('') } + it { is_expected.to run.with_params('bar', 'bar').and_return('') } + it { is_expected.to run.with_params('barbar', 'bar').and_return('') } + it { is_expected.to run.with_params('barfoobar', 'bar').and_return('foo') } + it { is_expected.to run.with_params('foobarbabarz', 'bar').and_return('foobaz') } + it { is_expected.to run.with_params('foobarbabarz', ['foo', 'bar']).and_return('baz') } + it { is_expected.to run.with_params('ƒōōβậяβậβậяź', ['ƒōō', 'βậя']).and_return('βậź') } + + it { is_expected.to run.with_params('barfoobar', ['barbar', 'foo']).and_return('barbar') } + it { is_expected.to run.with_params('barfoobar', ['foo', 'barbar']).and_return('') } + end + + describe 'deleting from an array' do + it { is_expected.to run.with_params({}, '').and_return({}) } + it { is_expected.to run.with_params({}, 'key').and_return({}) } + it { is_expected.to run.with_params({'key' => 'value'}, 'key').and_return({}) } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3'}, 'key2') \ + .and_return( {'key1' => 'value1', 'key3' => 'value3'}) + } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3'}, ['key1', 'key2']) \ + .and_return( {'key3' => 'value3'}) + } + it { is_expected.to run \ + .with_params({'ĸəұ1' => 'νãŀủĕ1', 'ĸəұ2' => 'νãŀủĕ2', 'ĸəұ3' => 'νãŀủĕ3'}, ['ĸəұ1', 'ĸəұ2']) \ + .and_return( {'ĸəұ3' => 'νãŀủĕ3'}) + } + end + + it "should leave the original array intact" do + argument1 = ['one','two','three'] + original1 = argument1.dup + result = subject.call([argument1,'two']) + expect(argument1).to eq(original1) + end + it "should leave the original string intact" do + argument1 = 'onetwothree' + original1 = argument1.dup + result = subject.call([argument1,'two']) + expect(argument1).to eq(original1) + end + it "should leave the original hash intact" do + argument1 = {'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3'} + original1 = argument1.dup + result = subject.call([argument1,'key2']) + expect(argument1).to eq(original1) + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/delete_undef_values_spec.rb b/environments/prod/modules/stdlib/spec/functions/delete_undef_values_spec.rb new file mode 100755 index 0000000..c20cee2 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/delete_undef_values_spec.rb @@ -0,0 +1,57 @@ +require 'spec_helper' + +describe 'delete_undef_values' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError) } + + describe 'when deleting from an array' do + [ :undef, '', nil ].each do |undef_value| + describe "when undef is represented by #{undef_value.inspect}" do + before do + pending("review behaviour when being passed undef as #{undef_value.inspect}") if undef_value == '' + pending("review behaviour when being passed undef as #{undef_value.inspect}") if undef_value == nil + end + it { is_expected.to run.with_params([undef_value]).and_return([]) } + it { is_expected.to run.with_params(['one',undef_value,'two','three']).and_return(['one','two','three']) } + it { is_expected.to run.with_params(['ớņέ',undef_value,'ŧשּׁō','ŧħґëə']).and_return(['ớņέ','ŧשּׁō','ŧħґëə']) } + end + + it "should leave the original argument intact" do + argument = ['one',undef_value,'two'] + original = argument.dup + result = subject.call([argument,2]) + expect(argument).to eq(original) + end + end + + it { is_expected.to run.with_params(['undef']).and_return(['undef']) } + end + + describe 'when deleting from a hash' do + [ :undef, '', nil ].each do |undef_value| + describe "when undef is represented by #{undef_value.inspect}" do + before do + pending("review behaviour when being passed undef as #{undef_value.inspect}") if undef_value == '' + pending("review behaviour when being passed undef as #{undef_value.inspect}") if undef_value == nil + end + it { is_expected.to run.with_params({'key' => undef_value}).and_return({}) } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'undef_key' => undef_value, 'key2' => 'value2'}) \ + .and_return({'key1' => 'value1', 'key2' => 'value2'}) + } + end + + it "should leave the original argument intact" do + argument = { 'key1' => 'value1', 'key2' => undef_value } + original = argument.dup + result = subject.call([argument,2]) + expect(argument).to eq(original) + end + end + + it { is_expected.to run.with_params({'key' => 'undef'}).and_return({'key' => 'undef'}) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/delete_values_spec.rb b/environments/prod/modules/stdlib/spec/functions/delete_values_spec.rb new file mode 100755 index 0000000..329fa0b --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/delete_values_spec.rb @@ -0,0 +1,41 @@ +require 'spec_helper' + +describe 'delete_values' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two', 'three').and_raise_error(Puppet::ParseError) } + describe 'when the first argument is not a hash' do + it { is_expected.to run.with_params(1, 'two').and_raise_error(TypeError) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(TypeError) } + it { is_expected.to run.with_params([], 'two').and_raise_error(TypeError) } + end + + describe 'when deleting from a hash' do + it { is_expected.to run.with_params({}, 'value').and_return({}) } + it { is_expected.to run \ + .with_params({'key1' => 'value1'}, 'non-existing value') \ + .and_return({'key1' => 'value1'}) + } + it { is_expected.to run \ + .with_params({'ҝếỵ1 ' => 'νâĺūẹ1', 'ҝếỵ2' => 'value to delete'}, 'value to delete') \ + .and_return({'ҝếỵ1 ' => 'νâĺūẹ1'}) + } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'key2' => 'νǎŀữ℮ ťớ đêłểťė'}, 'νǎŀữ℮ ťớ đêłểťė') \ + .and_return({'key1' => 'value1'}) + } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'key2' => 'value to delete', 'key3' => 'value to delete'}, 'value to delete') \ + .and_return({'key1' => 'value1'}) + } + end + + it "should leave the original argument intact" do + argument = { 'key1' => 'value1', 'key2' => 'value2' } + original = argument.dup + result = subject.call([argument, 'value2']) + expect(argument).to eq(original) + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/deprecation_spec.rb b/environments/prod/modules/stdlib/spec/functions/deprecation_spec.rb new file mode 100644 index 0000000..bde4e89 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/deprecation_spec.rb @@ -0,0 +1,60 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'deprecation' do + before(:each) { + # this is to reset the strict variable to default + Puppet.settings[:strict] = :warning + } + + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + + it 'should display a single warning' do + Puppet.expects(:warning).with(includes('heelo')) + is_expected.to run.with_params('key', 'heelo') + end + + it 'should display a single warning, despite multiple calls' do + Puppet.expects(:warning).with(includes('heelo')).once + is_expected.to run.with_params('key', 'heelo') + is_expected.to run.with_params('key', 'heelo') + end + + it 'should fail twice with message, with multiple calls. when strict= :error' do + Puppet.settings[:strict] = :error + Puppet.expects(:warning).with(includes('heelo')).never + is_expected.to run.with_params('key', 'heelo').and_raise_error(RuntimeError, /deprecation. key. heelo/) + is_expected.to run.with_params('key', 'heelo').and_raise_error(RuntimeError, /deprecation. key. heelo/) + end + + it 'should display nothing, despite multiple calls. strict= :off' do + Puppet.settings[:strict] = :off + Puppet.expects(:warning).with(includes('heelo')).never + is_expected.to run.with_params('key', 'heelo') + is_expected.to run.with_params('key', 'heelo') + end + + after(:all) { + # this is to reset the strict variable to default + Puppet.settings[:strict] = :warning + } + end +elsif Puppet.version.to_f < 4.0 + # Puppet version < 4 will use these tests. + describe 'deprecation' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + before(:all) do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + end + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + it 'should display a single warning' do + scope.expects(:warning).with(includes('heelo')) + is_expected.to run.with_params('key', 'heelo') + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/difference_spec.rb b/environments/prod/modules/stdlib/spec/functions/difference_spec.rb new file mode 100755 index 0000000..0ae3689 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/difference_spec.rb @@ -0,0 +1,23 @@ +require 'spec_helper' + +describe 'difference' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two', 'three').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', []).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], 'two').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params({}, {}).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], []).and_return([]) } + it { is_expected.to run.with_params([], ['one']).and_return([]) } + it { is_expected.to run.with_params(['one'], ['one']).and_return([]) } + it { is_expected.to run.with_params(['ớņέ'], ['']).and_return(['ớņέ']) } + it { is_expected.to run.with_params(['one'], []).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'three']).and_return(['one']) } + it { is_expected.to run.with_params(['ớņέ', 'ŧשּׁō', 'ŧħґëə', 2], ['ŧשּׁō', 'ŧħґëə']).and_return(['ớņέ', 2]) } + it { is_expected.to run.with_params(['one', 'two', 'two', 'three'], ['two', 'three']).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'two', 'three']).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'three', 'four']).and_return(['one']) } + it 'should not confuse types' do is_expected.to run.with_params(['1', '2', '3'], [1, 2]).and_return(['1', '2', '3']) end +end diff --git a/environments/prod/modules/stdlib/spec/functions/dig44_spec.rb b/environments/prod/modules/stdlib/spec/functions/dig44_spec.rb new file mode 100644 index 0000000..a7b8a3d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/dig44_spec.rb @@ -0,0 +1,131 @@ +require 'spec_helper' + +describe 'dig44' do + + let(:data) do + { + 'a' => { + 'g' => '2', + 'e' => [ + 'f0', + 'f1', + { + 'x' => { + 'y' => 'z' + } + }, + 'f3', + ] + }, + 'b' => true, + 'c' => false, + 'd' => '1', + 'e' => :undef, + 'f' => nil, + } + end + + let(:utf8_data) do + { + 'ẵ' => { + 'в' => [ + '©', + 'ĝ', + 'に', + ] + } + } + end + + context 'single values' do + it 'should exist' do + is_expected.not_to be_nil + end + + it 'should require two arguments' do + is_expected.to run.with_params().and_raise_error(ArgumentError) + end + + it 'should fail if the data is not a structure' do + is_expected.to run.with_params('test', []).and_raise_error(Puppet::Error) + end + + it 'should fail if the path is not an array' do + is_expected.to run.with_params({}, '').and_raise_error(Puppet::Error) + end + + it 'should return the value if the value is string' do + is_expected.to run.with_params(data, ['d'], 'default').and_return('1') + end + + it 'should return true if the value is true' do + is_expected.to run.with_params(data, ['b'], 'default').and_return(true) + end + + it 'should return false if the value is false' do + is_expected.to run.with_params(data, ['c'], 'default').and_return(false) + end + + it 'should return the default if the value is nil' do + is_expected.to run.with_params(data, ['f'], 'default').and_return('default') + end + + it 'should return the default if the value is :undef (same as nil)' do + is_expected.to run.with_params(data, ['e'], 'default').and_return('default') + end + + it 'should return the default if the path is not found' do + is_expected.to run.with_params(data, ['missing'], 'default').and_return('default') + end + end + + context 'structure values' do + + it 'should be able to extract a deeply nested hash value' do + is_expected.to run.with_params(data, %w(a g), 'default').and_return('2') + end + + it 'should return the default value if the path is too long' do + is_expected.to run.with_params(data, %w(a g c d), 'default').and_return('default') + end + + it 'should support an array index (number) in the path' do + is_expected.to run.with_params(data, ['a', 'e', 1], 'default').and_return('f1') + end + + it 'should support an array index (string) in the path' do + is_expected.to run.with_params(data, %w(a e 1), 'default').and_return('f1') + end + + it 'should return the default value if an array index is not a number' do + is_expected.to run.with_params(data, %w(a b c), 'default').and_return('default') + end + + it 'should return the default value if and index is out of array length' do + is_expected.to run.with_params(data, %w(a e 5), 'default').and_return('default') + end + + it 'should be able to path though both arrays and hashes' do + is_expected.to run.with_params(data, %w(a e 2 x y), 'default').and_return('z') + end + + it 'should return "nil" if value is not found and no default value is provided' do + is_expected.to run.with_params(data, %w(a 1)).and_return(nil) + end + end + + context 'Internationalization (i18N) values' do + + it 'should be able to return a unicode character' do + is_expected.to run.with_params(utf8_data, ['ẵ', 'в', 0]).and_return('©') + end + + it 'should be able to return a utf8 character' do + is_expected.to run.with_params(utf8_data, ['ẵ', 'в', 1]).and_return('ĝ') + end + + it 'should be able to return a double byte character' do + is_expected.to run.with_params(utf8_data, ['ẵ', 'в', 2]).and_return('に') + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/dig_spec.rb b/environments/prod/modules/stdlib/spec/functions/dig_spec.rb new file mode 100644 index 0000000..ad16fdd --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/dig_spec.rb @@ -0,0 +1,13 @@ +require 'spec_helper' + +describe 'dig' do + + it "should exist" do + expect(Puppet::Parser::Functions.function("dig")).to eq("function_dig") + end + + it "should give a deprecation warning when called" do + scope.expects(:warning).with("dig() DEPRECATED: This function has been replaced in Puppet 4.5.0, please use dig44() for backwards compatibility or use the new version.") + scope.function_dig([{}, []]) + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/dirname_spec.rb b/environments/prod/modules/stdlib/spec/functions/dirname_spec.rb new file mode 100755 index 0000000..c494915 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/dirname_spec.rb @@ -0,0 +1,18 @@ +require 'spec_helper' + +describe 'dirname' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('/path/to/a/file.ext', []).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('/path/to/a/file.ext').and_return('/path/to/a') } + it { is_expected.to run.with_params('relative_path/to/a/file.ext').and_return('relative_path/to/a') } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('scheme:///√ạĺűē/竹.ext').and_return('scheme:///√ạĺűē') } + it { is_expected.to run.with_params('ҝẽγ:/√ạĺűē/竹.ㄘ').and_return('ҝẽγ:/√ạĺűē') } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/dos2unix_spec.rb b/environments/prod/modules/stdlib/spec/functions/dos2unix_spec.rb new file mode 100644 index 0000000..97abae7 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/dos2unix_spec.rb @@ -0,0 +1,47 @@ +require 'spec_helper' + +describe 'dos2unix' do + context 'Checking parameter validity' do + it { is_expected.not_to eq(nil) } + it do + is_expected.to run.with_params.and_raise_error(ArgumentError, /Wrong number of arguments/) + end + it do + is_expected.to run.with_params('one', 'two').and_raise_error(ArgumentError, /Wrong number of arguments/) + end + it do + is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) + end + it do + is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError) + end + it do + is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) + end + end + + context 'Converting from dos to unix format' do + sample_text = "Hello\r\nWorld\r\n" + desired_output = "Hello\nWorld\n" + + it 'should output unix format' do + should run.with_params(sample_text).and_return(desired_output) + end + end + + context 'Internationalization (i18N) values' do + sample_text_utf8 = "Ħ℮ļłǿ\r\nשׁөŕłđ\r\n" + desired_output_utf8 = "Ħ℮ļłǿ\nשׁөŕłđ\n" + + sample_text_doublebyte = "こんにちは\r\n世界\r\n" + desired_output_doublebyte = "こんにちは\n世界\n" + + it 'should output uft8 string' do + should run.with_params(sample_text_utf8).and_return(desired_output_utf8) + end + + it 'should output double byte string' do + should run.with_params(sample_text_doublebyte).and_return(desired_output_doublebyte) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/downcase_spec.rb b/environments/prod/modules/stdlib/spec/functions/downcase_spec.rb new file mode 100755 index 0000000..c594560 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/downcase_spec.rb @@ -0,0 +1,15 @@ +require 'spec_helper' + +describe 'downcase' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(100).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("abc").and_return("abc") } + it { is_expected.to run.with_params("Abc").and_return("abc") } + it { is_expected.to run.with_params("ABC").and_return("abc") } + + it { is_expected.to run.with_params(AlsoString.new("ABC")).and_return("abc") } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(["ONE", "TWO"]).and_return(["one", "two"]) } + it { is_expected.to run.with_params(["One", 1, "Two"]).and_return(["one", 1, "two"]) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/empty_spec.rb b/environments/prod/modules/stdlib/spec/functions/empty_spec.rb new file mode 100755 index 0000000..a3a25d6 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/empty_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' + +describe 'empty' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError) + } + it { is_expected.to run.with_params(0).and_return(false) } + it { is_expected.to run.with_params('').and_return(true) } + it { is_expected.to run.with_params('one').and_return(false) } + + it { is_expected.to run.with_params(AlsoString.new('')).and_return(true) } + it { is_expected.to run.with_params(AlsoString.new('one')).and_return(false) } + + it { is_expected.to run.with_params([]).and_return(true) } + it { is_expected.to run.with_params(['one']).and_return(false) } + + it { is_expected.to run.with_params({}).and_return(true) } + it { is_expected.to run.with_params({'key' => 'value'}).and_return(false) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/ensure_packages_spec.rb b/environments/prod/modules/stdlib/spec/functions/ensure_packages_spec.rb new file mode 100755 index 0000000..6f94d72 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/ensure_packages_spec.rb @@ -0,0 +1,51 @@ +require 'spec_helper' + +describe 'ensure_packages' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { + pending("should not accept numbers as arguments") + is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) + } + it { + pending("should not accept numbers as arguments") + is_expected.to run.with_params(["packagename", 1]).and_raise_error(Puppet::ParseError) + } + it { is_expected.to run.with_params("packagename") } + it { is_expected.to run.with_params(["packagename1", "packagename2"]) } + + context 'given a catalog with "package { puppet: ensure => absent }"' do + let(:pre_condition) { 'package { puppet: ensure => absent }' } + + describe 'after running ensure_package("facter")' do + before { subject.call(['facter']) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_package('puppet').with_ensure('absent') } + it { expect(lambda { catalogue }).to contain_package('facter').with_ensure('present') } + end + + describe 'after running ensure_package("facter", { "provider" => "gem" })' do + before { subject.call(['facter', { "provider" => "gem" }]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_package('puppet').with_ensure('absent').without_provider() } + it { expect(lambda { catalogue }).to contain_package('facter').with_ensure('present').with_provider("gem") } + end + end + + context 'given hash of packages' do + before { subject.call([{"foo" => { "provider" => "rpm" }, "bar" => { "provider" => "gem" }}, { "ensure" => "present"}]) } + before { subject.call([{"パッケージ" => { "ensure" => "absent"}}]) } + before { subject.call([{"ρǻ¢κầģẻ" => { "ensure" => "absent"}}]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_package('foo').with({'provider' => 'rpm', 'ensure' => 'present'}) } + it { expect(lambda { catalogue }).to contain_package('bar').with({'provider' => 'gem', 'ensure' => 'present'}) } + + context 'should run with UTF8 and double byte characters' do + it { expect(lambda { catalogue }).to contain_package('パッケージ').with({'ensure' => 'absent'}) } + it { expect(lambda { catalogue }).to contain_package('ρǻ¢κầģẻ').with({'ensure' => 'absent'}) } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/ensure_resource_spec.rb b/environments/prod/modules/stdlib/spec/functions/ensure_resource_spec.rb new file mode 100755 index 0000000..5366205 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/ensure_resource_spec.rb @@ -0,0 +1,117 @@ +require 'spec_helper' + +describe 'ensure_resource' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /Must specify a type/) } + it { is_expected.to run.with_params('type').and_raise_error(ArgumentError, /Must specify a title/) } + if Puppet::Util::Package.versioncmp(Puppet.version, '4.6.0') >= 0 + it { is_expected.to run.with_params('type', 'title', {}, 'extras').and_raise_error(ArgumentError) } + else + it { is_expected.to run.with_params('type', 'title', {}, 'extras').and_raise_error(Puppet::ParseError) } + end + + it { + pending("should not accept numbers as arguments") + is_expected.to run.with_params(1,2,3).and_raise_error(Puppet::ParseError) + } + + context 'given an empty catalog' do + describe 'after running ensure_resource("user", "username1", {})' do + before { subject.call(['User', 'username1', {}]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').without_ensure } + end + + describe 'after running ensure_resource("user", "username1", { gid => undef })' do + before { subject.call(['User', 'username1', { 'gid' => :undef }]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').without_ensure } + it { expect(lambda { catalogue }).to contain_user('username1').without_gid } + end + + describe 'after running ensure_resource("user", "username1", { ensure => present, gid => undef })' do + before { subject.call(['User', 'username1', { 'ensure' => 'present', 'gid' => :undef }]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').with_ensure('present') } + it { expect(lambda { catalogue }).to contain_user('username1').without_gid } + end + end + + context 'given a catalog with UTF8 chars' do + describe 'after running ensure_resource("user", "Şắოрŀễ Ţëם", {})' do + before { subject.call(['User', 'Şắოрŀễ Ţëם', {}]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('Şắოрŀễ Ţëם').without_ensure } + end + + describe 'after running ensure_resource("user", "Şắოрŀễ Ţëם", { gid => undef })' do + before { subject.call(['User', 'Şắოрŀễ Ţëם', { 'gid' => :undef }]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('Şắოрŀễ Ţëם').without_ensure } + it { expect(lambda { catalogue }).to contain_user('Şắოрŀễ Ţëם').without_gid } + end + + describe 'after running ensure_resource("user", "Şắოрŀễ Ţëם", { ensure => present, gid => undef })' do + before { subject.call(['User', 'Şắოрŀễ Ţëם', { 'ensure' => 'present', 'gid' => :undef }]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('Şắოрŀễ Ţëם').with_ensure('present') } + it { expect(lambda { catalogue }).to contain_user('Şắოрŀễ Ţëם').without_gid } + end + end + + context 'given a catalog with "user { username1: ensure => present }"' do + let(:pre_condition) { 'user { username1: ensure => present }' } + + describe 'after running ensure_resource("user", "username1", {})' do + before { subject.call(['User', 'username1', {}]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').with_ensure('present') } + end + + describe 'after running ensure_resource("user", "username2", {})' do + before { subject.call(['User', 'username2', {}]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').with_ensure('present') } + it { expect(lambda { catalogue }).to contain_user('username2').without_ensure } + end + + describe 'after running ensure_resource("user", "username1", { gid => undef })' do + before { subject.call(['User', 'username1', { 'gid' => :undef }]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').with_ensure('present') } + end + + describe 'after running ensure_resource("user", ["username1", "username2"], {})' do + before { subject.call(['User', ['username1', 'username2'], {}]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').with_ensure('present') } + it { expect(lambda { catalogue }).to contain_user('username2').without_ensure } + end + + describe 'when providing already set params' do + let(:params) { { 'ensure' => 'present' } } + before { subject.call(['User', ['username2', 'username3'], params]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').with(params) } + it { expect(lambda { catalogue }).to contain_user('username2').with(params) } + end + + context 'when trying to add params' do + it { is_expected.to run \ + .with_params('User', 'username1', { 'ensure' => 'present', 'shell' => true }) \ + .and_raise_error(Puppet::Resource::Catalog::DuplicateResourceError, /User\[username1\] is already declared/) + } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/flatten_spec.rb b/environments/prod/modules/stdlib/spec/functions/flatten_spec.rb new file mode 100755 index 0000000..b80f3c5 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/flatten_spec.rb @@ -0,0 +1,15 @@ +require 'spec_helper' + +describe 'flatten' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], []).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['one']).and_return(['one']) } + it { is_expected.to run.with_params([['one']]).and_return(['one']) } + it { is_expected.to run.with_params(["a","b","c","d","e","f","g"]).and_return(["a","b","c","d","e","f","g"]) } + it { is_expected.to run.with_params([["a","b",["c",["d","e"],"f","g"]]]).and_return(["a","b","c","d","e","f","g"]) } + it { is_expected.to run.with_params(["ã","β",["ĉ",["đ","ẽ","ƒ","ġ"]]]).and_return(["ã","β","ĉ","đ","ẽ","ƒ","ġ"]) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/floor_spec.rb b/environments/prod/modules/stdlib/spec/functions/floor_spec.rb new file mode 100755 index 0000000..608c602 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/floor_spec.rb @@ -0,0 +1,12 @@ +require 'spec_helper' + +describe 'floor' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("foo").and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(34).and_return(34) } + it { is_expected.to run.with_params(-34).and_return(-34) } + it { is_expected.to run.with_params(33.1).and_return(33) } + it { is_expected.to run.with_params(-33.1).and_return(-34) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/fqdn_rand_string_spec.rb b/environments/prod/modules/stdlib/spec/functions/fqdn_rand_string_spec.rb new file mode 100644 index 0000000..861a59e --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/fqdn_rand_string_spec.rb @@ -0,0 +1,66 @@ +require 'spec_helper' + +describe 'fqdn_rand_string' do + let(:default_charset) { %r{\A[a-zA-Z0-9]{100}\z} } + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(0).and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params(1.5).and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params(-10).and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params("-10").and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params("string").and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params([]).and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params({}).and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params(1, 1).and_raise_error(ArgumentError, /second argument must be undef or a string/) } + it { is_expected.to run.with_params(1, []).and_raise_error(ArgumentError, /second argument must be undef or a string/) } + it { is_expected.to run.with_params(1, {}).and_raise_error(ArgumentError, /second argument must be undef or a string/) } + it { is_expected.to run.with_params(100).and_return(default_charset) } + it { is_expected.to run.with_params("100").and_return(default_charset) } + it { is_expected.to run.with_params(100, nil).and_return(default_charset) } + it { is_expected.to run.with_params(100, '').and_return(default_charset) } + it { is_expected.to run.with_params(100, 'a').and_return(/\Aa{100}\z/) } + it { is_expected.to run.with_params(100, 'ab').and_return(/\A[ab]{100}\z/) } + it { is_expected.to run.with_params(100, 'ãβ').and_return(/\A[ãβ]{100}\z/) } + + it "provides the same 'random' value on subsequent calls for the same host" do + expect(fqdn_rand_string(10)).to eql(fqdn_rand_string(10)) + end + + it "considers the same host and same extra arguments to have the same random sequence" do + first_random = fqdn_rand_string(10, :extra_identifier => [1, "same", "host"]) + second_random = fqdn_rand_string(10, :extra_identifier => [1, "same", "host"]) + + expect(first_random).to eql(second_random) + end + + it "allows extra arguments to control the random value on a single host" do + first_random = fqdn_rand_string(10, :extra_identifier => [1, "different", "host"]) + second_different_random = fqdn_rand_string(10, :extra_identifier => [2, "different", "host"]) + + expect(first_random).not_to eql(second_different_random) + end + + it "should return different strings for different hosts" do + val1 = fqdn_rand_string(10, :host => "first.host.com") + val2 = fqdn_rand_string(10, :host => "second.host.com") + + expect(val1).not_to eql(val2) + end + + def fqdn_rand_string(max, args = {}) + host = args[:host] || '127.0.0.1' + charset = args[:charset] + extra = args[:extra_identifier] || [] + + # workaround not being able to use let(:facts) because some tests need + # multiple different hostnames in one context + scope.stubs(:lookupvar).with("::fqdn", {}).returns(host) + + function_args = [max] + if args.has_key?(:charset) or !extra.empty? + function_args << charset + end + function_args += extra + scope.function_fqdn_rand_string(function_args) + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/fqdn_rotate_spec.rb b/environments/prod/modules/stdlib/spec/functions/fqdn_rotate_spec.rb new file mode 100755 index 0000000..7c1038a --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/fqdn_rotate_spec.rb @@ -0,0 +1,76 @@ +require 'spec_helper' + +describe 'fqdn_rotate' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(0).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('a').and_return('a') } + it { is_expected.to run.with_params('ã').and_return('ã') } + + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['a']).and_return(['a']) } + + it "should rotate a string and the result should be the same size" do + expect(fqdn_rotate("asdf").size).to eq(4) + end + + it "should rotate a string to give the same results for one host" do + val1 = fqdn_rotate("abcdefg", :host => 'one') + val2 = fqdn_rotate("abcdefg", :host => 'one') + expect(val1).to eq(val2) + end + + it "allows extra arguments to control the random rotation on a single host" do + val1 = fqdn_rotate("abcdefg", :extra_identifier => [1, "different", "host"]) + val2 = fqdn_rotate("abcdefg", :extra_identifier => [2, "different", "host"]) + expect(val1).not_to eq(val2) + end + + it "considers the same host and same extra arguments to have the same random rotation" do + val1 = fqdn_rotate("abcdefg", :extra_identifier => [1, "same", "host"]) + val2 = fqdn_rotate("abcdefg", :extra_identifier => [1, "same", "host"]) + expect(val1).to eq(val2) + end + + it "should rotate a string to give different values on different hosts" do + val1 = fqdn_rotate("abcdefg", :host => 'one') + val2 = fqdn_rotate("abcdefg", :host => 'two') + expect(val1).not_to eq(val2) + end + + it "should accept objects which extend String" do + result = fqdn_rotate(AlsoString.new('asdf')) + expect(result).to eq('dfas') + end + + it "should use the Puppet::Util.deterministic_rand function" do + if Puppet::Util.respond_to?(:deterministic_rand) + Puppet::Util.expects(:deterministic_rand).with(44489829212339698569024999901561968770,4) + fqdn_rotate("asdf") + else + skip 'Puppet::Util#deterministic_rand not available' + end + end + + it "should not leave the global seed in a deterministic state" do + fqdn_rotate("asdf") + rand1 = rand() + fqdn_rotate("asdf") + rand2 = rand() + expect(rand1).not_to eql(rand2) + end + + def fqdn_rotate(value, args = {}) + host = args[:host] || '127.0.0.1' + extra = args[:extra_identifier] || [] + + # workaround not being able to use let(:facts) because some tests need + # multiple different hostnames in one context + scope.stubs(:lookupvar).with("::fqdn").returns(host) + + function_args = [value] + extra + scope.function_fqdn_rotate(function_args) + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/fqdn_uuid_spec.rb b/environments/prod/modules/stdlib/spec/functions/fqdn_uuid_spec.rb new file mode 100644 index 0000000..d0c30d6 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/fqdn_uuid_spec.rb @@ -0,0 +1,13 @@ +require 'spec_helper' + +describe 'fqdn_uuid' do + + context "Invalid parameters" do + it { should run.with_params().and_raise_error(ArgumentError, /No arguments given$/) } + end + + context "given string" do + it { should run.with_params('puppetlabs.com').and_return('9c70320f-6815-5fc5-ab0f-debe68bf764c') } + it { should run.with_params('google.com').and_return('64ee70a4-8cc1-5d25-abf2-dea6c79a09c8') } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/get_module_path_spec.rb b/environments/prod/modules/stdlib/spec/functions/get_module_path_spec.rb new file mode 100755 index 0000000..a39e413 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/get_module_path_spec.rb @@ -0,0 +1,48 @@ +require 'spec_helper' + +describe 'get_module_path' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /Wrong number of arguments, expects one/) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /Wrong number of arguments, expects one/) } + it { is_expected.to run.with_params('one', 'two', 'three').and_raise_error(Puppet::ParseError, /Wrong number of arguments, expects one/) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /Could not find module/) } + + class StubModule + attr_reader :path + def initialize(path) + @path = path + end + end + + describe 'when locating a module' do + let(:modulepath) { "/tmp/does_not_exist" } + let(:path_of_module_foo) { StubModule.new("/tmp/does_not_exist/foo") } + + before(:each) { Puppet[:modulepath] = modulepath } + + context 'in the default environment' do + before(:each) { Puppet::Module.expects(:find).with('foo', 'rp_env').returns(path_of_module_foo) } + + it { is_expected.to run.with_params('foo').and_return(path_of_module_foo.path) } + + context 'when the modulepath is a list' do + before(:each) { Puppet[:modulepath] = modulepath + 'tmp/something_else' } + + it { is_expected.to run.with_params('foo').and_return(path_of_module_foo.path) } + end + end + + context 'in a non-default default environment' do + let(:environment) { 'test' } + before(:each) { Puppet::Module.expects(:find).with('foo', 'test').returns(path_of_module_foo) } + + it { is_expected.to run.with_params('foo').and_return(path_of_module_foo.path) } + + context 'when the modulepath is a list' do + before(:each) { Puppet[:modulepath] = modulepath + 'tmp/something_else' } + + it { is_expected.to run.with_params('foo').and_return(path_of_module_foo.path) } + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/getparam_spec.rb b/environments/prod/modules/stdlib/spec/functions/getparam_spec.rb new file mode 100755 index 0000000..522ed3b --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/getparam_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'getparam' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /Must specify a reference/) } + it { is_expected.to run.with_params('User[one]').and_raise_error(ArgumentError, /Must specify name of a parameter/) } + it { is_expected.to run.with_params('User[one]', 2).and_raise_error(ArgumentError, /Must specify name of a parameter/) } + it { is_expected.to run.with_params('User[one]', []).and_raise_error(ArgumentError, /Must specify name of a parameter/) } + it { is_expected.to run.with_params('User[one]', {}).and_raise_error(ArgumentError, /Must specify name of a parameter/) } + + describe 'when compared against a user resource with no params' do + let(:pre_condition) { 'user { "one": }' } + + it { is_expected.to run.with_params('User[one]', 'ensure').and_return('') } + it { is_expected.to run.with_params('User[two]', 'ensure').and_return('') } + it { is_expected.to run.with_params('User[one]', 'shell').and_return('') } + end + + describe 'when compared against a user resource with params' do + let(:pre_condition) { 'user { "one": ensure => present, shell => "/bin/sh", managehome => false, }' } + + it { is_expected.to run.with_params('User[one]', 'ensure').and_return('present') } + it { is_expected.to run.with_params('User[two]', 'ensure').and_return('') } + it { is_expected.to run.with_params('User[one]', 'shell').and_return('/bin/sh') } + it { is_expected.to run.with_params('User[one]', 'managehome').and_return(false) } + end + + describe 'when compared against a user resource with UTF8 and double byte params' do + let(:pre_condition) { 'user { ["三", "ƒốưř"]: ensure => present }' } + + it { is_expected.to run.with_params('User[三]', 'ensure').and_return('present') } + it { is_expected.to run.with_params('User[ƒốưř]', 'ensure').and_return('present') } + + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/getvar_spec.rb b/environments/prod/modules/stdlib/spec/functions/getvar_spec.rb new file mode 100755 index 0000000..55789d8 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/getvar_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'getvar' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + it { is_expected.to run.with_params('$::foo').and_return(nil) } + + context 'given variables in namespaces' do + let(:pre_condition) { + <<-'ENDofPUPPETcode' + class site::data { $foo = 'baz' } + include site::data + ENDofPUPPETcode + } + + it { is_expected.to run.with_params('site::data::foo').and_return('baz') } + it { is_expected.to run.with_params('::site::data::foo').and_return('baz') } + it { is_expected.to run.with_params('::site::data::bar').and_return(nil) } + end + + context 'given variables in namespaces' do + let(:pre_condition) { + <<-'ENDofPUPPETcode' + class site::info { $lock = 'ŧҺîš íš ắ śţřĭŋĝ' } + class site::new { $item = '万Ü€‰' } + include site::info + include site::new + ENDofPUPPETcode + } + + it { is_expected.to run.with_params('site::info::lock').and_return('ŧҺîš íš ắ śţřĭŋĝ') } + it { is_expected.to run.with_params('::site::new::item').and_return('万Ü€‰') } + end +end + diff --git a/environments/prod/modules/stdlib/spec/functions/grep_spec.rb b/environments/prod/modules/stdlib/spec/functions/grep_spec.rb new file mode 100755 index 0000000..d2152b1 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/grep_spec.rb @@ -0,0 +1,20 @@ +require 'spec_helper' + +describe 'grep' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("grep does not actually check this, and raises NoMethodError instead") + is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /first argument not an array/) + } + it { + pending("grep does not actually check this, and raises NoMethodError instead") + is_expected.to run.with_params(1, 'two').and_raise_error(Puppet::ParseError, /first argument not an array/) + } + it { is_expected.to run.with_params('one', 'two', 'three').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([], 'two').and_return([]) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'two').and_return(['two']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 't(wo|hree)').and_return(['two', 'three']) } + it { is_expected.to run.with_params(['ờאּê', 'ţשּׂỡ', 'ţһŗəè'], 'ţ(שּׂỡ|һŗəè)').and_return(['ţשּׂỡ', 'ţһŗəè']) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/has_interface_with_spec.rb b/environments/prod/modules/stdlib/spec/functions/has_interface_with_spec.rb new file mode 100755 index 0000000..7334d38 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/has_interface_with_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'has_interface_with' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one", "two", "three").and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + # We need to mock out the Facts so we can specify how we expect this function + # to behave on different platforms. + context "On Mac OS X Systems" do + let(:facts) { { :interfaces => 'lo0,gif0,stf0,en1,p2p0,fw0,en0,vmnet1,vmnet8,utun0' } } + it { is_expected.to run.with_params('lo0').and_return(true) } + it { is_expected.to run.with_params('lo').and_return(false) } + end + + context "On Linux Systems" do + let(:facts) do + { + :interfaces => 'eth0,lo', + :ipaddress => '10.0.0.1', + :ipaddress_lo => '127.0.0.1', + :ipaddress_eth0 => '10.0.0.1', + :muppet => 'kermit', + :muppet_lo => 'mspiggy', + :muppet_eth0 => 'kermit', + } + end + + it { is_expected.to run.with_params('lo').and_return(true) } + it { is_expected.to run.with_params('lo0').and_return(false) } + it { is_expected.to run.with_params('ipaddress', '127.0.0.1').and_return(true) } + it { is_expected.to run.with_params('ipaddress', '10.0.0.1').and_return(true) } + it { is_expected.to run.with_params('ipaddress', '8.8.8.8').and_return(false) } + it { is_expected.to run.with_params('muppet', 'kermit').and_return(true) } + it { is_expected.to run.with_params('muppet', 'mspiggy').and_return(true) } + it { is_expected.to run.with_params('muppet', 'bigbird').and_return(false) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/has_ip_address_spec.rb b/environments/prod/modules/stdlib/spec/functions/has_ip_address_spec.rb new file mode 100755 index 0000000..42a5a79 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/has_ip_address_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' + +describe 'has_ip_address' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one", "two").and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + context "On Linux Systems" do + let(:facts) do + { + :interfaces => 'eth0,lo', + :ipaddress => '10.0.0.1', + :ipaddress_lo => '127.0.0.1', + :ipaddress_eth0 => '10.0.0.1', + } + end + + it { is_expected.to run.with_params('127.0.0.1').and_return(true) } + it { is_expected.to run.with_params('10.0.0.1').and_return(true) } + it { is_expected.to run.with_params('8.8.8.8').and_return(false) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/has_ip_network_spec.rb b/environments/prod/modules/stdlib/spec/functions/has_ip_network_spec.rb new file mode 100755 index 0000000..57cf613 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/has_ip_network_spec.rb @@ -0,0 +1,21 @@ +require 'spec_helper' + +describe 'has_ip_network' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one", "two").and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + context "On Linux Systems" do + let(:facts) do + { + :interfaces => 'eth0,lo', + :network_lo => '127.0.0.0', + :network_eth0 => '10.0.0.0', + } + end + + it { is_expected.to run.with_params('127.0.0.0').and_return(true) } + it { is_expected.to run.with_params('10.0.0.0').and_return(true) } + it { is_expected.to run.with_params('8.8.8.0').and_return(false) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/has_key_spec.rb b/environments/prod/modules/stdlib/spec/functions/has_key_spec.rb new file mode 100755 index 0000000..0e0e1cc --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/has_key_spec.rb @@ -0,0 +1,20 @@ +require 'spec_helper' + +describe 'has_key' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one").and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one", "two", "three").and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one", "two").and_raise_error(Puppet::ParseError, /expects the first argument to be a hash/) } + it { is_expected.to run.with_params(1, "two").and_raise_error(Puppet::ParseError, /expects the first argument to be a hash/) } + it { is_expected.to run.with_params([], "two").and_raise_error(Puppet::ParseError, /expects the first argument to be a hash/) } + + it { is_expected.to run.with_params({ 'key' => 'value' }, "key").and_return(true) } + it { is_expected.to run.with_params({}, "key").and_return(false) } + it { is_expected.to run.with_params({ 'key' => 'value'}, "not a key").and_return(false) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params({ 'κéỳ ' => '٧ậļųể' }, "κéỳ ").and_return(true) } + it { is_expected.to run.with_params({ 'キー' => '٧ậļųể' }, "キー").and_return(true) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/hash_spec.rb b/environments/prod/modules/stdlib/spec/functions/hash_spec.rb new file mode 100755 index 0000000..092474b --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/hash_spec.rb @@ -0,0 +1,15 @@ +require 'spec_helper' + +describe 'hash' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], 'two').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(['one']).and_raise_error(Puppet::ParseError, /Unable to compute/) } + it { is_expected.to run.with_params([]).and_return({}) } + it { is_expected.to run.with_params(['key1', 'value1']).and_return({ 'key1' => 'value1' }) } + it { is_expected.to run.with_params(['κ℮ұ1', '√āĺűẻ1']).and_return({ 'κ℮ұ1' => '√āĺűẻ1' }) } + it { is_expected.to run.with_params(['key1', 'value1', 'key2', 'value2']).and_return({ 'key1' => 'value1', 'key2' => 'value2' }) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/intersection_spec.rb b/environments/prod/modules/stdlib/spec/functions/intersection_spec.rb new file mode 100755 index 0000000..ec368a5 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/intersection_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' + +describe 'intersection' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two', 'three').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', []).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], 'two').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params({}, {}).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], []).and_return([]) } + it { is_expected.to run.with_params([], ['one']).and_return([]) } + it { is_expected.to run.with_params(['one'], []).and_return([]) } + it { is_expected.to run.with_params(['one'], ['one']).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'three']).and_return(['two', 'three']) } + it { is_expected.to run.with_params(['ōŋể', 'ŧשợ', 'ţђŕẽё'], ['ŧשợ', 'ţђŕẽё']).and_return(['ŧשợ', 'ţђŕẽё']) } + it { is_expected.to run.with_params(['one', 'two', 'two', 'three'], ['two', 'three']).and_return(['two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'two', 'three']).and_return(['two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'three', 'four']).and_return(['two', 'three']) } + it 'should not confuse types' do is_expected.to run.with_params(['1', '2', '3'], [1, 2]).and_return([]) end +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_a_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_a_spec.rb new file mode 100644 index 0000000..2d6cb46 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_a_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper' + +if ENV["FUTURE_PARSER"] == 'yes' + describe 'type_of' do + pending 'teach rspec-puppet to load future-only functions under 3.7.5' do + it { is_expected.not_to eq(nil) } + end + end +end + +if Puppet.version.to_f >= 4.0 + describe 'is_a' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { is_expected.to run.with_params('', '').and_raise_error(ArgumentError) } + + it 'succeeds when comparing a string and a string' do + is_expected.to run.with_params('hello world', String).and_return(true) + end + + it 'fails when comparing an integer and a string' do + is_expected.to run.with_params(5, String).and_return(false) + end + + it 'suceeds when comparing an UTF8 and double byte characters' do + is_expected.to run.with_params('このテキスト', String).and_return(true) + is_expected.to run.with_params('ŧћịś ŧêχŧ', String).and_return(true) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_array_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_array_spec.rb new file mode 100755 index 0000000..e89f54b --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_array_spec.rb @@ -0,0 +1,36 @@ +require 'spec_helper' + +describe 'is_array' do + + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], []).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params([]).and_return(true) } + it { is_expected.to run.with_params(['one']).and_return(true) } + it { is_expected.to run.with_params([1]).and_return(true) } + it { is_expected.to run.with_params([{}]).and_return(true) } + it { is_expected.to run.with_params([[]]).and_return(true) } + it { is_expected.to run.with_params('').and_return(false) } + it { is_expected.to run.with_params('one').and_return(false) } + it { is_expected.to run.with_params(1).and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + context 'Checking for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(['1.2.3.4']).and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(['1.2.3.4']).and_return(true) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_bool_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_bool_spec.rb new file mode 100755 index 0000000..d21345c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_bool_spec.rb @@ -0,0 +1,33 @@ +require 'spec_helper' + +describe 'is_bool' do + + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(true, false).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(true).and_return(true) } + it { is_expected.to run.with_params(false).and_return(true) } + it { is_expected.to run.with_params([1]).and_return(false) } + it { is_expected.to run.with_params([{}]).and_return(false) } + it { is_expected.to run.with_params([[]]).and_return(false) } + it { is_expected.to run.with_params([true]).and_return(false) } + it { is_expected.to run.with_params('true').and_return(false) } + it { is_expected.to run.with_params('false').and_return(false) } + context 'Checking for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(true).and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(false).and_return(true) + end + end +end + diff --git a/environments/prod/modules/stdlib/spec/functions/is_domain_name_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_domain_name_spec.rb new file mode 100755 index 0000000..c1bf0e3 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_domain_name_spec.rb @@ -0,0 +1,43 @@ +require 'spec_helper' + +describe 'is_domain_name' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_return(false) } + it { is_expected.to run.with_params([]).and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params('').and_return(false) } + it { is_expected.to run.with_params('.').and_return(true) } + it { is_expected.to run.with_params('com').and_return(true) } + it { is_expected.to run.with_params('com.').and_return(true) } + it { is_expected.to run.with_params('x.com').and_return(true) } + it { is_expected.to run.with_params('x.com.').and_return(true) } + it { is_expected.to run.with_params('foo.example.com').and_return(true) } + it { is_expected.to run.with_params('foo.example.com.').and_return(true) } + it { is_expected.to run.with_params('2foo.example.com').and_return(true) } + it { is_expected.to run.with_params('2foo.example.com.').and_return(true) } + it { is_expected.to run.with_params('www.2foo.example.com').and_return(true) } + it { is_expected.to run.with_params('www.2foo.example.com.').and_return(true) } + describe 'inputs with spaces' do + it { is_expected.to run.with_params('invalid domain').and_return(false) } + end + describe 'inputs with hyphens' do + it { is_expected.to run.with_params('foo-bar.example.com').and_return(true) } + it { is_expected.to run.with_params('foo-bar.example.com.').and_return(true) } + it { is_expected.to run.with_params('www.foo-bar.example.com').and_return(true) } + it { is_expected.to run.with_params('www.foo-bar.example.com.').and_return(true) } + it { is_expected.to run.with_params('-foo.example.com').and_return(false) } + it { is_expected.to run.with_params('-foo.example.com').and_return(false) } + end + # Values obtained from Facter values will be frozen strings + # in newer versions of Facter: + it { is_expected.to run.with_params('www.example.com'.freeze).and_return(true) } + describe 'top level domain must be alphabetic if there are multiple labels' do + it { is_expected.to run.with_params('2com').and_return(true) } + it { is_expected.to run.with_params('www.example.2com').and_return(false) } + end + describe 'IP addresses are not domain names' do + it { is_expected.to run.with_params('192.168.1.1').and_return(false) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_email_address_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_email_address_spec.rb new file mode 100755 index 0000000..8b7b358 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_email_address_spec.rb @@ -0,0 +1,14 @@ +require 'spec_helper' + +describe 'is_email_address' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([], []).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('bob@gmail.com').and_return(true) } + it { is_expected.to run.with_params('alice+puppetlabs.com@gmail.com').and_return(true) } + it { is_expected.to run.with_params('peter.parker@gmail.com').and_return(true) } + it { is_expected.to run.with_params('1.2.3@domain').and_return(false) } + it { is_expected.to run.with_params('1.2.3.4.5@').and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params([]).and_return(false) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_float_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_float_spec.rb new file mode 100755 index 0000000..af3322e --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_float_spec.rb @@ -0,0 +1,42 @@ +require 'spec_helper' + +describe 'is_float' do + + it { is_expected.not_to eq(nil) } + + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(0.1, 0.2).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + describe 'passing a string' do + it { is_expected.to run.with_params('0.1').and_return(true) } + it { is_expected.to run.with_params('1.0').and_return(true) } + it { is_expected.to run.with_params('1').and_return(false) } + it { is_expected.to run.with_params('one').and_return(false) } + it { is_expected.to run.with_params('one 1.0').and_return(false) } + it { is_expected.to run.with_params('1.0 one').and_return(false) } + end + + describe 'passing numbers' do + it { is_expected.to run.with_params(0.1).and_return(true) } + it { is_expected.to run.with_params(1.0).and_return(true) } + it { is_expected.to run.with_params(1).and_return(false) } + end + + context 'Checking for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(2.2).and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(1.0).and_return(true) + end + end + +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_function_available.rb b/environments/prod/modules/stdlib/spec/functions/is_function_available.rb new file mode 100755 index 0000000..44f08c0 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_function_available.rb @@ -0,0 +1,9 @@ +require 'spec_helper' + +describe 'is_function_available' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('include').and_return(true) } + it { is_expected.to run.with_params('no_such_function').and_return(false) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_hash_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_hash_spec.rb new file mode 100755 index 0000000..c2599a0 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_hash_spec.rb @@ -0,0 +1,11 @@ +require 'spec_helper' + +describe 'is_hash' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params({}, {}).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('').and_return(false) } + it { is_expected.to run.with_params({}).and_return(true) } + it { is_expected.to run.with_params([]).and_return(false) } + it { is_expected.to run.with_params(1).and_return(false) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_integer_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_integer_spec.rb new file mode 100755 index 0000000..b296830 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_integer_spec.rb @@ -0,0 +1,45 @@ +require 'spec_helper' + +describe 'is_integer' do + + it { is_expected.not_to eq(nil) } + + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1, 2).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + it { is_expected.to run.with_params(3).and_return(true) } + it { is_expected.to run.with_params('3').and_return(true) } + it { is_expected.to run.with_params(-3).and_return(true) } + it { is_expected.to run.with_params('-3').and_return(true) } + + it { is_expected.to run.with_params(3.7).and_return(false) } + it { is_expected.to run.with_params('3.7').and_return(false) } + it { is_expected.to run.with_params(-3.7).and_return(false) } + it { is_expected.to run.with_params('3.7').and_return(false) } + + it { is_expected.to run.with_params('one').and_return(false) } + it { is_expected.to run.with_params([]).and_return(false) } + it { is_expected.to run.with_params([1]).and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params(true).and_return(false) } + it { is_expected.to run.with_params(false).and_return(false) } + it { is_expected.to run.with_params('0001234').and_return(false) } + + context 'Checking for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(50).and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(50).and_return(true) + end + end + +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_ip_address_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_ip_address_spec.rb new file mode 100755 index 0000000..39525d7 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_ip_address_spec.rb @@ -0,0 +1,40 @@ +require 'spec_helper' + +describe 'is_ip_address' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([], []).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('1.2.3.4').and_return(true) } + it { is_expected.to run.with_params('1.2.3.255').and_return(true) } + it { is_expected.to run.with_params('1.2.3.256').and_return(false) } + it { is_expected.to run.with_params('1.2.3').and_return(false) } + it { is_expected.to run.with_params('1.2.3.4.5').and_return(false) } + it { is_expected.to run.with_params('fe00::1').and_return(true) } + it { is_expected.to run.with_params('fe80:0000:cd12:d123:e2f8:47ff:fe09:dd74').and_return(true) } + it { is_expected.to run.with_params('FE80:0000:CD12:D123:E2F8:47FF:FE09:DD74').and_return(true) } + it { is_expected.to run.with_params('fe80:0000:cd12:d123:e2f8:47ff:fe09:zzzz').and_return(false) } + it { is_expected.to run.with_params('fe80:0000:cd12:d123:e2f8:47ff:fe09').and_return(false) } + it { is_expected.to run.with_params('fe80:0000:cd12:d123:e2f8:47ff:fe09:dd74:dd74').and_return(false) } + it { is_expected.to run.with_params('').and_return(false) } + it { is_expected.to run.with_params('one').and_return(false) } + it { is_expected.to run.with_params(1).and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params([]).and_return(false) } + + context 'Checking for deprecation warning', if: Puppet.version.to_f < 4.0 do + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('1.2.3.4').and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params('1.2.3.4').and_return(true) + end + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_ipv4_address_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_ipv4_address_spec.rb new file mode 100644 index 0000000..985260c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_ipv4_address_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +describe 'is_ipv4_address' do + + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + SharedData::IPV4_PATTERNS.each do |value| + it { is_expected.to run.with_params(value).and_return(true) } + end + + SharedData::IPV4_NEGATIVE_PATTERNS.each do |value| + it { is_expected.to run.with_params(value).and_return(false) } + end + + context 'Checking for deprecation warning', if: Puppet.version.to_f < 4.0 do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(SharedData::IPV4_PATTERNS.first).and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(SharedData::IPV4_PATTERNS.first).and_return(true) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_ipv6_address_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_ipv6_address_spec.rb new file mode 100644 index 0000000..acd6a87 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_ipv6_address_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper' + +describe 'is_ipv6_address' do + + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('2001:0db8:85a3:0000:0000:8a2e:0370:7334').and_return(true) } + it { is_expected.to run.with_params('85a3:0000:0000:8a2e:0370:7334:100.100.100.100').and_return(true) } + it { is_expected.to run.with_params('1.2.3').and_return(false) } + it { is_expected.to run.with_params('1.2.3.4.5').and_return(false) } + it { is_expected.to run.with_params('').and_return(false) } + it { is_expected.to run.with_params('one').and_return(false) } + + context 'Checking for deprecation warning', if: Puppet.version.to_f < 4.0 do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('2001:0db8:85a3:0000:0000:8a2e:0370:7334').and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params('2001:0db8:85a3:0000:0000:8a2e:0370:7334').and_return(true) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_mac_address_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_mac_address_spec.rb new file mode 100755 index 0000000..c1e33b8 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_mac_address_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper' + +describe 'is_mac_address' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([], []).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('00:a0:1f:12:7f:a0').and_return(true) } + it { is_expected.to run.with_params('00:A0:1F:12:7F:A0').and_return(true) } + it { is_expected.to run.with_params('00:00:00:00:00:0g').and_return(false) } + it { is_expected.to run.with_params('').and_return(false) } + it { is_expected.to run.with_params('one').and_return(false) } + + context 'function can handle UTF8 and double byte characters' do + it { is_expected.to run.with_params('ƒốưř').and_return(false) } + it { is_expected.to run.with_params('三+').and_return(false) } + end + + it { + pending "should properly typecheck its arguments" + is_expected.to run.with_params(1).and_return(false) + } + it { + pending "should properly typecheck its arguments" + is_expected.to run.with_params({}).and_return(false) + } + it { + pending "should properly typecheck its arguments" + is_expected.to run.with_params([]).and_return(false) + } +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_numeric_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_numeric_spec.rb new file mode 100755 index 0000000..5962d8a --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_numeric_spec.rb @@ -0,0 +1,48 @@ +require 'spec_helper' + +describe 'is_numeric' do + + it { is_expected.not_to eq(nil) } + + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1, 2).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + it { is_expected.to run.with_params(3).and_return(true) } + it { is_expected.to run.with_params('3').and_return(true) } + it { is_expected.to run.with_params(-3).and_return(true) } + it { is_expected.to run.with_params('-3').and_return(true) } + + it { is_expected.to run.with_params(3.7).and_return(true) } + it { is_expected.to run.with_params('3.7').and_return(true) } + it { is_expected.to run.with_params(-3.7).and_return(true) } + it { is_expected.to run.with_params('3.7').and_return(true) } + + it { is_expected.to run.with_params('-342.2315e-12').and_return(true) } + + it { is_expected.to run.with_params('one').and_return(false) } + it { is_expected.to run.with_params([]).and_return(false) } + it { is_expected.to run.with_params([1]).and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params(true).and_return(false) } + it { is_expected.to run.with_params(false).and_return(false) } + it { is_expected.to run.with_params('0001234').and_return(false) } + it { is_expected.to run.with_params(' - 1234').and_return(false) } + + context 'Checking for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(7).and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(7).and_return(true) + end + end + +end diff --git a/environments/prod/modules/stdlib/spec/functions/is_string_spec.rb b/environments/prod/modules/stdlib/spec/functions/is_string_spec.rb new file mode 100755 index 0000000..e92f85c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/is_string_spec.rb @@ -0,0 +1,47 @@ +require 'spec_helper' + +describe 'is_string' do + + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + + it { is_expected.to run.with_params(3).and_return(false) } + it { is_expected.to run.with_params('3').and_return(false) } + it { is_expected.to run.with_params(-3).and_return(false) } + it { is_expected.to run.with_params('-3').and_return(false) } + + it { is_expected.to run.with_params(3.7).and_return(false) } + it { is_expected.to run.with_params('3.7').and_return(false) } + it { is_expected.to run.with_params(-3.7).and_return(false) } + it { is_expected.to run.with_params('3.7').and_return(false) } + + it { is_expected.to run.with_params([]).and_return(false) } + it { is_expected.to run.with_params([1]).and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params(true).and_return(false) } + it { is_expected.to run.with_params(false).and_return(false) } + it { is_expected.to run.with_params('one').and_return(true) } + it { is_expected.to run.with_params('0001234').and_return(true) } + + context 'Checking for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('sponge').and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params('bob').and_return(true) + end + end + +end diff --git a/environments/prod/modules/stdlib/spec/functions/join_keys_to_values_spec.rb b/environments/prod/modules/stdlib/spec/functions/join_keys_to_values_spec.rb new file mode 100755 index 0000000..0a2a50c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/join_keys_to_values_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper' + +describe 'join_keys_to_values' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /Takes exactly two arguments/) } + it { is_expected.to run.with_params({}, '', '').and_raise_error(Puppet::ParseError, /Takes exactly two arguments/) } + it { is_expected.to run.with_params('one', '').and_raise_error(TypeError, /The first argument must be a hash/) } + it { is_expected.to run.with_params({}, 2).and_raise_error(TypeError, /The second argument must be a string/) } + + it { is_expected.to run.with_params({}, '').and_return([]) } + it { is_expected.to run.with_params({}, ':').and_return([]) } + it { is_expected.to run.with_params({ 'key' => 'value' }, '').and_return(['keyvalue']) } + it { is_expected.to run.with_params({ 'key' => 'value' }, ':').and_return(['key:value']) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params({ 'ҝẽγ' => '√ạĺűē' }, ':').and_return(['ҝẽγ:√ạĺűē']) } + it { is_expected.to run.with_params({ 'ҝẽγ' => '√ạĺűē' }, '万').and_return(['ҝẽγ万√ạĺűē']) } + end + + it { is_expected.to run.with_params({ 'key' => nil }, ':').and_return(['key:']) } + it 'should run join_keys_to_values(, ":") and return the proper array' do + result = subject.call([{ 'key1' => 'value1', 'key2' => 'value2' }, ':']) + expect(result.sort).to eq(['key1:value1', 'key2:value2'].sort) + end + it 'should run join_keys_to_values(, " ") and return the proper array' do + result = subject.call([{ 'key1' => 'value1', 'key2' => ['value2', 'value3'] }, ' ']) + expect(result.sort).to eq(['key1 value1', 'key2 value2', 'key2 value3'].sort) + end +end + diff --git a/environments/prod/modules/stdlib/spec/functions/join_spec.rb b/environments/prod/modules/stdlib/spec/functions/join_spec.rb new file mode 100755 index 0000000..98852d5 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/join_spec.rb @@ -0,0 +1,20 @@ +require 'spec_helper' + +describe 'join' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the second.") + is_expected.to run.with_params([], '', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /Requires array to work with/) } + it { is_expected.to run.with_params([], 2).and_raise_error(Puppet::ParseError, /Requires string to work with/) } + + it { is_expected.to run.with_params([]).and_return('') } + it { is_expected.to run.with_params([], ':').and_return('') } + it { is_expected.to run.with_params(['one']).and_return('one') } + it { is_expected.to run.with_params(['one'], ':').and_return('one') } + it { is_expected.to run.with_params(['one', 'two', 'three']).and_return('onetwothree') } + it { is_expected.to run.with_params(['one', 'two', 'three'], ':').and_return('one:two:three') } + it { is_expected.to run.with_params(['ōŋể', 'ŧשợ', 'ţђŕẽё'], ':').and_return('ōŋể:ŧשợ:ţђŕẽё') } +end diff --git a/environments/prod/modules/stdlib/spec/functions/keys_spec.rb b/environments/prod/modules/stdlib/spec/functions/keys_spec.rb new file mode 100755 index 0000000..fc7d6d8 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/keys_spec.rb @@ -0,0 +1,24 @@ +require 'spec_helper' + +describe 'keys' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params({}, {}).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params('').and_raise_error(Puppet::ParseError, /Requires hash to work with/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires hash to work with/) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError, /Requires hash to work with/) } + it { is_expected.to run.with_params({}).and_return([]) } + it { is_expected.to run.with_params({ 'key' => 'value' }).and_return(['key']) } + it 'should return the array of keys' do + result = subject.call([{ 'key1' => 'value1', 'key2' => 'value2' }]) + expect(result).to match_array(['key1', 'key2']) + end + + it 'should run with UTF8 and double byte characters' do + result = subject.call([{ 'ҝểү' => '√ẳŀμệ', 'キー' => '値' }]) + expect(result).to match_array(['ҝểү', 'キー']) + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/length.rb b/environments/prod/modules/stdlib/spec/functions/length.rb new file mode 100755 index 0000000..d1ab003 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/length.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'length' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /'length' expects 1 argument, got none/) } + it { is_expected.to run.with_params([], 'extra').and_raise_error(ArgumentError, /'length' expects 1 argument, got 2/) } + it { is_expected.to run.with_params(1).and_raise_error(ArgumentError, /expects a value of type String, Array, or Hash, got Integer/) } + it { is_expected.to run.with_params(true).and_raise_error(ArgumentError, /expects a value of type String, Array, or Hash, got Boolean/) } + it { is_expected.to run.with_params('1').and_return(1) } + it { is_expected.to run.with_params('1.0').and_return(3) } + it { is_expected.to run.with_params([]).and_return(0) } + it { is_expected.to run.with_params(['a']).and_return(1) } + it { is_expected.to run.with_params(['one', 'two', 'three']).and_return(3) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'four']).and_return(4) } + + it { is_expected.to run.with_params({}).and_return(0) } + it { is_expected.to run.with_params({'1' => '2'}).and_return(1) } + it { is_expected.to run.with_params({'1' => '2', '4' => '4'}).and_return(2) } + it { is_expected.to run.with_params({'€' => '@', '竹' => 'ǿňè'}).and_return(2) } + + it { is_expected.to run.with_params('').and_return(0) } + it { is_expected.to run.with_params('a').and_return(1) } + it { is_expected.to run.with_params('abc').and_return(3) } + it { is_expected.to run.with_params('abcd').and_return(4) } + it { is_expected.to run.with_params('万').and_return(1) } + it { is_expected.to run.with_params('āβćđ').and_return(4) } + + context 'when using a class extending String' do + it 'should call its size method' do + value = AlsoString.new('asdfghjkl') + value.expects(:length).returns('foo') + expect(subject).to run.with_params(value).and_return('foo') + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/load_module_metadata_spec.rb b/environments/prod/modules/stdlib/spec/functions/load_module_metadata_spec.rb new file mode 100755 index 0000000..9496fcb --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/load_module_metadata_spec.rb @@ -0,0 +1,61 @@ +require 'spec_helper' + +describe 'load_module_metadata' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one", "two", "three").and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + describe "when calling with valid arguments" do + before :each do + allow(File).to receive(:read).with(/\/(stdlib|test)\/metadata.json/, {:encoding=>"utf-8"}).and_return('{"name": "puppetlabs-stdlib"}') + allow(File).to receive(:read).with(/\/(stdlib|test)\/metadata.json/).and_return('{"name": "puppetlabs-stdlib"}') + end + + context "when calling with valid utf8 and double byte character arguments" do + before :each do + allow(File).to receive(:read).with(/\/(stdlib|test)\/metadata.json/, {:encoding=>"utf-8"}).and_return('{"ĭďèʼnţĩƒіểя": "ċơņťęאּť ỡƒ ţħíš - +この文字"}') + allow(File).to receive(:read).with(/\/(stdlib|test)\/metadata.json/).and_return('{"ĭďèʼnţĩƒіểя": "ċơņťęאּť ỡƒ ţħíš - +この文字"}') + end + + it "should json parse the file" do + if Puppet::Util::Platform.windows? + allow(scope).to receive(:function_get_module_path).with(['science']).and_return('C:/path/to/module/') + allow(File).to receive(:exists?).with('C:/path/to/module/metadata.json').and_return(true) + allow(File).to receive(:read).with('C:/path/to/module/metadata.json').and_return('{"name": "spencer-science"}') + else + allow(scope).to receive(:function_get_module_path).with(['science']).and_return('/path/to/module/') + allow(File).to receive(:exists?).with('/path/to/module/metadata.json').and_return(true) + allow(File).to receive(:read).with('/path/to/module/metadata.json').and_return('{"name": "spencer-science"}') + end + + result = subject.call(['science']) + expect(result['name']).to eq('spencer-science') + end + + it "should fail by default if there is no metadata.json" do + if Puppet::Util::Platform.windows? + allow(scope).to receive(:function_get_module_path).with(['science']).and_return('C:/path/to/module/') + allow(File).to receive(:exists?).with('C:/path/to/module/metadata.json').and_return(false) + else + allow(scope).to receive(:function_get_module_path).with(['science']).and_return('/path/to/module/') + allow(File).to receive(:exists?).with('/path/to/module/metadata.json').and_return(false) + end + expect {subject.call(['science'])}.to raise_error(Puppet::ParseError) + end + + it "should return nil if user allows empty metadata.json" do + if Puppet::Util::Platform.windows? + allow(scope).to receive(:function_get_module_path).with(['science']).and_return('C:/path/to/module/') + allow(File).to receive(:exists?).with('C:/path/to/module/metadata.json').and_return(false) + else + allow(scope).to receive(:function_get_module_path).with(['science']).and_return('/path/to/module/') + allow(File).to receive(:exists?).with('/path/to/module/metadata.json').and_return(false) + end + result = subject.call(['science', true]) + expect(result).to eq({}) + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/loadjson_spec.rb b/environments/prod/modules/stdlib/spec/functions/loadjson_spec.rb new file mode 100644 index 0000000..dbef805 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/loadjson_spec.rb @@ -0,0 +1,66 @@ +require 'spec_helper' + +describe 'loadjson' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /wrong number of arguments/i) } + + describe "when calling with valid arguments" do + before :each do + allow(File).to receive(:read).with(/\/(stdlib|test)\/metadata.json/, {:encoding=>"utf-8"}).and_return('{"name": "puppetlabs-stdlib"}') + allow(File).to receive(:read).with(/\/(stdlib|test)\/metadata.json/).and_return('{"name": "puppetlabs-stdlib"}') + end + + context 'when a non-existing file is specified' do + let(:filename) { + if Puppet::Util::Platform.windows? + 'C:/tmp/doesnotexist' + else + '/tmp/doesnotexist' + end + } + before { + allow(File).to receive(:exists?).with(filename).and_return(false).once + allow(PSON).to receive(:load).never + } + it { is_expected.to run.with_params(filename, {'default' => 'value'}).and_return({'default' => 'value'}) } + it { is_expected.to run.with_params(filename, {'đẽƒằưļŧ' => '٧ẵłựέ'}).and_return({'đẽƒằưļŧ' => '٧ẵłựέ'}) } + it { is_expected.to run.with_params(filename, {'デフォルト' => '値'}).and_return({'デフォルト' => '値'}) } + end + + context 'when an existing file is specified' do + let(:filename) { + if Puppet::Util::Platform.windows? + 'C:/tmp/doesexist' + else + '/tmp/doesexist' + end + } + let(:data) { { 'key' => 'value', 'ķęŷ' => 'νậŀųề', 'キー' => '値'} } + let(:json) { '{"key":"value", {"ķęŷ":"νậŀųề" }, {"キー":"値" }' } + before { + allow(File).to receive(:exists?).with(filename).and_return(true).once + allow(File).to receive(:read).with(filename).and_return(json).once + allow(File).to receive(:read).with(filename).and_return(json).once + allow(PSON).to receive(:load).with(json).and_return(data).once + } + it { is_expected.to run.with_params(filename).and_return(data) } + end + + context 'when the file could not be parsed' do + let(:filename) { + if Puppet::Util::Platform.windows? + 'C:/tmp/doesexist' + else + '/tmp/doesexist' + end + } + let(:json) { '{"key":"value"}' } + before { + allow(File).to receive(:exists?).with(filename).and_return(true).once + allow(File).to receive(:read).with(filename).and_return(json).once + allow(PSON).to receive(:load).with(json).once.and_raise StandardError, 'Something terrible have happened!' + } + it { is_expected.to run.with_params(filename, {'default' => 'value'}).and_return({'default' => 'value'}) } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/loadyaml_spec.rb b/environments/prod/modules/stdlib/spec/functions/loadyaml_spec.rb new file mode 100755 index 0000000..e9428e3 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/loadyaml_spec.rb @@ -0,0 +1,36 @@ +require 'spec_helper' + +describe 'loadyaml' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /wrong number of arguments/i) } + + context 'when a non-existing file is specified' do + let(:filename) { '/tmp/doesnotexist' } + before { + File.expects(:exists?).with(filename).returns(false).once + YAML.expects(:load_file).never + } + it { is_expected.to run.with_params(filename, {'default' => 'value'}).and_return({'default' => 'value'}) } + it { is_expected.to run.with_params(filename, {'đẽƒằưļŧ' => '٧ẵłựέ'}).and_return({'đẽƒằưļŧ' => '٧ẵłựέ'}) } + it { is_expected.to run.with_params(filename, {'デフォルト' => '値'}).and_return({'デフォルト' => '値'}) } + end + + context 'when an existing file is specified' do + let(:filename) { '/tmp/doesexist' } + let(:data) { { 'key' => 'value', 'ķęŷ' => 'νậŀųề', 'キー' => '値'} } + before { + File.expects(:exists?).with(filename).returns(true).once + YAML.expects(:load_file).with(filename).returns(data).once + } + it { is_expected.to run.with_params(filename).and_return(data) } + end + + context 'when the file could not be parsed' do + let(:filename) { '/tmp/doesexist' } + before { + File.expects(:exists?).with(filename).returns(true).once + YAML.stubs(:load_file).with(filename).once.raises StandardError, 'Something terrible have happened!' + } + it { is_expected.to run.with_params(filename, {'default' => 'value'}).and_return({'default' => 'value'}) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/lstrip_spec.rb b/environments/prod/modules/stdlib/spec/functions/lstrip_spec.rb new file mode 100755 index 0000000..a5a09ed --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/lstrip_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'lstrip' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params(' ').and_return('') } + it { is_expected.to run.with_params(' ').and_return('') } + it { is_expected.to run.with_params("\t").and_return('') } + it { is_expected.to run.with_params("\t ").and_return('') } + it { is_expected.to run.with_params('one').and_return('one') } + it { is_expected.to run.with_params(' one').and_return('one') } + it { is_expected.to run.with_params(' one').and_return('one') } + it { is_expected.to run.with_params("\tone").and_return('one') } + it { is_expected.to run.with_params("\t one").and_return('one') } + it { is_expected.to run.with_params('one ').and_return('one ') } + it { is_expected.to run.with_params(' one ').and_return('one ') } + it { is_expected.to run.with_params(' one ').and_return('one ') } + it { is_expected.to run.with_params(' ǿňè ').and_return('ǿňè ') } + it { is_expected.to run.with_params("\tone ").and_return('one ') } + it { is_expected.to run.with_params("\t one ").and_return('one ') } + it { is_expected.to run.with_params("one \t").and_return("one \t") } + it { is_expected.to run.with_params(" one \t").and_return("one \t") } + it { is_expected.to run.with_params(" one \t").and_return("one \t") } + it { is_expected.to run.with_params("\tone \t").and_return("one \t") } + it { is_expected.to run.with_params("\t one \t").and_return("one \t") } + it { is_expected.to run.with_params(' o n e ').and_return('o n e ') } + it { is_expected.to run.with_params(AlsoString.new(' one ')).and_return('one ') } +end diff --git a/environments/prod/modules/stdlib/spec/functions/max_spec.rb b/environments/prod/modules/stdlib/spec/functions/max_spec.rb new file mode 100755 index 0000000..66fb0c8 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/max_spec.rb @@ -0,0 +1,21 @@ +require 'spec_helper' + +describe 'max' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_return(1) } + it { is_expected.to run.with_params(1, 2).and_return(2) } + it { is_expected.to run.with_params(1, 2, 3).and_return(3) } + it { is_expected.to run.with_params(3, 2, 1).and_return(3) } + it { is_expected.to run.with_params('one').and_return('one') } + it { is_expected.to run.with_params('one', 'two').and_return('two') } + it { is_expected.to run.with_params('one', 'two', 'three').and_return('two') } + it { is_expected.to run.with_params('three', 'two', 'one').and_return('two') } + + describe 'implementation artifacts' do + it { is_expected.to run.with_params(1, 'one').and_return('one') } + it { is_expected.to run.with_params('1', 'one').and_return('one') } + it { is_expected.to run.with_params('1.3e1', '1.4e0').and_return('1.4e0') } + it { is_expected.to run.with_params(1.3e1, 1.4e0).and_return(1.3e1) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/member_spec.rb b/environments/prod/modules/stdlib/spec/functions/member_spec.rb new file mode 100755 index 0000000..8988632 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/member_spec.rb @@ -0,0 +1,23 @@ +require 'spec_helper' + +describe 'member' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], [], []).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params([], '').and_return(false) } + it { is_expected.to run.with_params([], ['']).and_return(false) } + it { is_expected.to run.with_params([''], '').and_return(true) } + it { is_expected.to run.with_params([''], ['']).and_return(true) } + it { is_expected.to run.with_params([], 'one').and_return(false) } + it { is_expected.to run.with_params([], ['one']).and_return(false) } + it { is_expected.to run.with_params(['one'], 'one').and_return(true) } + it { is_expected.to run.with_params(['one'], ['one']).and_return(true) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'four'], ['four', 'two']).and_return(true) } + it { is_expected.to run.with_params(['ọאּẹ', 'ŧẅồ', 'ţҺŗęē', 'ƒơџŕ'], ['ƒơџŕ', 'ŧẅồ']).and_return(true) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'four'], ['four', 'five']).and_return(false) } + it { is_expected.to run.with_params(['ọאּẹ', 'ŧẅồ', 'ţҺŗęē', 'ƒơџŕ'], ['ƒơџŕ', 'ƒί√ə']).and_return(false) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/merge_spec.rb b/environments/prod/modules/stdlib/spec/functions/merge_spec.rb new file mode 100755 index 0000000..7b53363 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/merge_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' + +describe 'merge' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params({}, 'two').and_raise_error(Puppet::ParseError, /unexpected argument type String/) } + it { is_expected.to run.with_params({}, 1).and_raise_error(Puppet::ParseError, /unexpected argument type Fixnum/) } + it { + pending 'should not special case this' + is_expected.to run.with_params({}).and_return({}) + } + it { is_expected.to run.with_params({}, {}).and_return({}) } + it { is_expected.to run.with_params({}, {}, {}).and_return({}) } + describe 'should accept empty strings as puppet undef' do + it { is_expected.to run.with_params({}, '').and_return({}) } + end + it { is_expected.to run.with_params({ 'key' => 'value' }, {}).and_return({ 'key' => 'value' }) } + it { is_expected.to run.with_params({}, { 'key' => 'value' }).and_return({ 'key' => 'value' }) } + it { is_expected.to run.with_params({ 'key' => 'value1' }, { 'key' => 'value2' }).and_return({ 'key' => 'value2' }) } + it { + is_expected.to run \ + .with_params({ 'key1' => 'value1' }, { 'key2' => 'value2' }, { 'key3' => 'value3' }) \ + .and_return({ 'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3' }) + } +end diff --git a/environments/prod/modules/stdlib/spec/functions/min_spec.rb b/environments/prod/modules/stdlib/spec/functions/min_spec.rb new file mode 100755 index 0000000..c840a72 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/min_spec.rb @@ -0,0 +1,21 @@ +require 'spec_helper' + +describe 'min' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_return(1) } + it { is_expected.to run.with_params(1, 2).and_return(1) } + it { is_expected.to run.with_params(1, 2, 3).and_return(1) } + it { is_expected.to run.with_params(3, 2, 1).and_return(1) } + it { is_expected.to run.with_params('one').and_return('one') } + it { is_expected.to run.with_params('one', 'two').and_return('one') } + it { is_expected.to run.with_params('one', 'two', 'three').and_return('one') } + it { is_expected.to run.with_params('three', 'two', 'one').and_return('one') } + + describe 'implementation artifacts' do + it { is_expected.to run.with_params(1, 'one').and_return(1) } + it { is_expected.to run.with_params('1', 'one').and_return('1') } + it { is_expected.to run.with_params('1.3e1', '1.4e0').and_return('1.3e1') } + it { is_expected.to run.with_params(1.3e1, 1.4e0).and_return(1.4e0) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/num2bool_spec.rb b/environments/prod/modules/stdlib/spec/functions/num2bool_spec.rb new file mode 100755 index 0000000..494afff --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/num2bool_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' + +describe 'num2bool' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1, 2).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('abc').and_raise_error(Puppet::ParseError, /does not look like a number/) } + it { is_expected.to run.with_params(1).and_return(true) } + it { is_expected.to run.with_params('1').and_return(true) } + it { is_expected.to run.with_params(1.5).and_return(true) } + it { is_expected.to run.with_params('1.5').and_return(true) } + it { is_expected.to run.with_params(-1).and_return(false) } + it { is_expected.to run.with_params('-1').and_return(false) } + it { is_expected.to run.with_params(-1.5).and_return(false) } + it { is_expected.to run.with_params('-1.5').and_return(false) } + it { is_expected.to run.with_params(0).and_return(false) } + it { is_expected.to run.with_params('0').and_return(false) } + it { is_expected.to run.with_params([]).and_return(false) } + it { is_expected.to run.with_params('[]').and_raise_error(Puppet::ParseError, /does not look like a number/) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params('{}').and_raise_error(Puppet::ParseError, /does not look like a number/) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/parsejson_spec.rb b/environments/prod/modules/stdlib/spec/functions/parsejson_spec.rb new file mode 100755 index 0000000..7b07e49 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/parsejson_spec.rb @@ -0,0 +1,69 @@ +require 'spec_helper' + +describe 'parsejson' do + it 'should exist' do + is_expected.not_to eq(nil) + end + + it 'should raise an error if called without any arguments' do + is_expected.to run.with_params(). + and_raise_error(/wrong number of arguments/i) + end + + context 'with correct JSON data' do + + it 'should be able to parse JSON data with a Hash' do + is_expected.to run.with_params('{"a":"1","b":"2"}'). + and_return({'a'=>'1', 'b'=>'2'}) + end + + it 'should be able to parse JSON data with an Array' do + is_expected.to run.with_params('["a","b","c"]'). + and_return(['a', 'b', 'c']) + end + + it 'should be able to parse empty JSON values' do + is_expected.to run.with_params('[]'). + and_return([]) + is_expected.to run.with_params('{}'). + and_return({}) + end + + it 'should be able to parse JSON data with a mixed structure' do + is_expected.to run.with_params('{"a":"1","b":2,"c":{"d":[true,false]}}'). + and_return({'a' =>'1', 'b' => 2, 'c' => { 'd' => [true, false] } }) + end + + it 'should be able to parse JSON data with a UTF8 and double byte characters' do + is_expected.to run.with_params('{"×":"これ","ý":"記号","です":{"©":["Á","ß"]}}'). + and_return({'×' =>'これ', 'ý' => '記号', 'です' => { '©' => ['Á', 'ß'] } }) + end + + it 'should not return the default value if the data was parsed correctly' do + is_expected.to run.with_params('{"a":"1"}', 'default_value'). + and_return({'a' => '1'}) + end + + end + + context 'with incorrect JSON data' do + it 'should raise an error with invalid JSON and no default' do + is_expected.to run.with_params(''). + and_raise_error(PSON::ParserError) + end + + it 'should support a structure for a default value' do + is_expected.to run.with_params('', {'a' => '1'}). + and_return({'a' => '1'}) + end + + ['', 1, 1.2, nil, true, false, [], {}, :yaml].each do |value| + it "should return the default value for an incorrect #{value.inspect} (#{value.class}) parameter" do + is_expected.to run.with_params(value, 'default_value'). + and_return('default_value') + end + end + + end + +end diff --git a/environments/prod/modules/stdlib/spec/functions/parseyaml_spec.rb b/environments/prod/modules/stdlib/spec/functions/parseyaml_spec.rb new file mode 100755 index 0000000..c2a138c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/parseyaml_spec.rb @@ -0,0 +1,86 @@ +require 'spec_helper' + +describe 'parseyaml' do + it 'should exist' do + is_expected.not_to eq(nil) + end + + it 'should raise an error if called without any arguments' do + is_expected.to run.with_params(). + and_raise_error(/wrong number of arguments/i) + end + + context 'with correct YAML data' do + it 'should be able to parse a YAML data with a String' do + is_expected.to run.with_params('--- just a string'). + and_return('just a string') + is_expected.to run.with_params('just a string'). + and_return('just a string') + end + + it 'should be able to parse YAML data with a Hash' do + is_expected.to run.with_params("---\na: '1'\nb: '2'\n"). + and_return({'a' => '1', 'b' => '2'}) + end + + it 'should be able to parse YAML data with an Array' do + is_expected.to run.with_params("---\n- a\n- b\n- c\n"). + and_return(['a', 'b', 'c']) + end + + it 'should be able to parse YAML data with a mixed structure' do + is_expected.to run.with_params("---\na: '1'\nb: 2\nc:\n d:\n - :a\n - true\n - false\n"). + and_return({'a' => '1', 'b' => 2, 'c' => {'d' => [:a, true, false]}}) + end + + it 'should be able to parse YAML data with a UTF8 and double byte characters' do + is_expected.to run.with_params("---\na: ×\nこれ: 記号\nです:\n ©:\n - Á\n - ß\n"). + and_return({"a"=>"×", "これ"=>"記号", "です"=>{"©"=>["Á", "ß"]} }) + end + + it 'should not return the default value if the data was parsed correctly' do + is_expected.to run.with_params("---\na: '1'\n", 'default_value'). + and_return({'a' => '1'}) + end + + end + + context 'on a modern ruby', :unless => RUBY_VERSION == '1.8.7' do + it 'should raise an error with invalid YAML and no default' do + is_expected.to run.with_params('["one"'). + and_raise_error(Psych::SyntaxError) + end + end + + context 'when running on ruby 1.8.7, which does not have Psych', :if => RUBY_VERSION == '1.8.7' do + it 'should raise an error with invalid YAML and no default' do + is_expected.to run.with_params('["one"'). + and_raise_error(ArgumentError) + end + end + + context 'with incorrect YAML data' do + it 'should support a structure for a default value' do + is_expected.to run.with_params('', {'a' => '1'}). + and_return({'a' => '1'}) + end + + [1, 1.2, nil, true, false, [], {}, :yaml].each do |value| + it "should return the default value for an incorrect #{value.inspect} (#{value.class}) parameter" do + is_expected.to run.with_params(value, 'default_value'). + and_return('default_value') + end + end + + context 'when running on modern rubies', :unless => RUBY_VERSION == '1.8.7' do + ['---', '...', '*8', ''].each do |value| + it "should return the default value for an incorrect #{value.inspect} string parameter" do + is_expected.to run.with_params(value, 'default_value'). + and_return('default_value') + end + end + end + + end + +end diff --git a/environments/prod/modules/stdlib/spec/functions/pick_default_spec.rb b/environments/prod/modules/stdlib/spec/functions/pick_default_spec.rb new file mode 100755 index 0000000..a7ffc86 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/pick_default_spec.rb @@ -0,0 +1,26 @@ +require 'spec_helper' + +describe 'pick_default' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::Error, /Must receive at least one argument/) } + + it { is_expected.to run.with_params('one', 'two').and_return('one') } + it { is_expected.to run.with_params('ớņệ', 'ťωơ').and_return('ớņệ') } + it { is_expected.to run.with_params('', 'two').and_return('two') } + it { is_expected.to run.with_params(:undef, 'two').and_return('two') } + it { is_expected.to run.with_params(:undefined, 'two').and_return('two') } + it { is_expected.to run.with_params(nil, 'two').and_return('two') } + + [ '', :undef, :undefined, nil, {}, [], 1, 'default' ].each do |value| + describe "when providing #{value.inspect} as default" do + it { is_expected.to run.with_params('one', value).and_return('one') } + it { is_expected.to run.with_params('ớņệ', value).and_return('ớņệ') } + it { is_expected.to run.with_params([], value).and_return([]) } + it { is_expected.to run.with_params({}, value).and_return({}) } + it { is_expected.to run.with_params(value, value).and_return(value) } + it { is_expected.to run.with_params(:undef, value).and_return(value) } + it { is_expected.to run.with_params(:undefined, value).and_return(value) } + it { is_expected.to run.with_params(nil, value).and_return(value) } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/pick_spec.rb b/environments/prod/modules/stdlib/spec/functions/pick_spec.rb new file mode 100755 index 0000000..438553b --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/pick_spec.rb @@ -0,0 +1,17 @@ +require 'spec_helper' + +describe 'pick' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /must receive at least one non empty value/) } + it { is_expected.to run.with_params('', nil, :undef, :undefined).and_raise_error(Puppet::ParseError, /must receive at least one non empty value/) } + it { is_expected.to run.with_params('one', 'two').and_return('one') } + it { is_expected.to run.with_params('', 'two').and_return('two') } + it { is_expected.to run.with_params(:undef, 'two').and_return('two') } + it { is_expected.to run.with_params(:undefined, 'two').and_return('two') } + it { is_expected.to run.with_params(nil, 'two').and_return('two') } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params(nil, 'このテキスト').and_return('このテキスト') } + it { is_expected.to run.with_params('', 'ŝẳмрłề џţƒ8 ţẽם', 'このテキスト').and_return('ŝẳмрłề џţƒ8 ţẽם') } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/prefix_spec.rb b/environments/prod/modules/stdlib/spec/functions/prefix_spec.rb new file mode 100755 index 0000000..5510c58 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/prefix_spec.rb @@ -0,0 +1,29 @@ +require 'spec_helper' + +describe 'prefix' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the second.") + is_expected.to run.with_params([], 'a', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /expected first argument to be an Array or a Hash/) } + it { is_expected.to run.with_params([], 2).and_raise_error(Puppet::ParseError, /expected second argument to be a String/) } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['one', 2]).and_return(['one', '2']) } + it { is_expected.to run.with_params(['ớņệ', 2]).and_return(['ớņệ', '2']) } + it { is_expected.to run.with_params([], '').and_return([]) } + it { is_expected.to run.with_params([''], '').and_return(['']) } + it { is_expected.to run.with_params(['one'], 'pre').and_return(['preone']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'pre').and_return(['preone', 'pretwo', 'prethree']) } + it { is_expected.to run.with_params({}).and_return({}) } + it { is_expected.to run.with_params({ 'key1' => 'value1', 2 => 3}).and_return({ 'key1' => 'value1', '2' => 3 }) } + it { is_expected.to run.with_params({}, '').and_return({}) } + it { is_expected.to run.with_params({ 'key' => 'value' }, '').and_return({ 'key' => 'value' }) } + it { is_expected.to run.with_params({ 'key' => 'value' }, 'pre').and_return({ 'prekey' => 'value' }) } + it { + is_expected.to run \ + .with_params({ 'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3' }, 'pre') \ + .and_return({ 'prekey1' => 'value1', 'prekey2' => 'value2', 'prekey3' => 'value3' }) + } +end diff --git a/environments/prod/modules/stdlib/spec/functions/private_spec.rb b/environments/prod/modules/stdlib/spec/functions/private_spec.rb new file mode 100644 index 0000000..a13be64 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/private_spec.rb @@ -0,0 +1,56 @@ +require 'spec_helper' + +describe 'private' do + it 'should issue a warning' do + scope.expects(:warning).with("private() DEPRECATED: This function will cease to function on Puppet 4; please use assert_private() before upgrading to puppet 4 for backwards-compatibility, or migrate to the new parser's typing system.") + begin + subject.call [] + rescue + # ignore this + end + end + + context "when called from inside module" do + it "should not fail" do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('foo') + expect { + subject.call [] + }.not_to raise_error + end + end + + context "with an explicit failure message" do + it "prints the failure message on error" do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('bar') + expect { + subject.call ['failure message!'] + }.to raise_error Puppet::ParseError, /failure message!/ + end + end + + context "when called from private class" do + it "should fail with a class error message" do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('bar') + scope.source.expects(:name).returns('foo::baz') + scope.source.expects(:type).returns('hostclass') + expect { + subject.call [] + }.to raise_error Puppet::ParseError, /Class foo::baz is private/ + end + end + + context "when called from private definition" do + it "should fail with a class error message" do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('bar') + scope.source.expects(:name).returns('foo::baz') + scope.source.expects(:type).returns('definition') + expect { + subject.call [] + }.to raise_error Puppet::ParseError, /Definition foo::baz is private/ + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/pw_hash_spec.rb b/environments/prod/modules/stdlib/spec/functions/pw_hash_spec.rb new file mode 100644 index 0000000..df5348c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/pw_hash_spec.rb @@ -0,0 +1,69 @@ +require 'spec_helper' + +describe 'pw_hash' do + + it { is_expected.not_to eq(nil) } + + context 'when there are less than 3 arguments' do + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('password').and_raise_error(ArgumentError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('password', 'sha-256').and_raise_error(ArgumentError, /wrong number of arguments/i) } + end + + context 'when there are more than 3 arguments' do + it { is_expected.to run.with_params('password', 'sha-256', 'salt', 'extra').and_raise_error(ArgumentError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('password', 'sha-256', 'salt', 'extra', 'extra').and_raise_error(ArgumentError, /wrong number of arguments/i) } + end + + context 'when the first argument is not a string' do + it { is_expected.to run.with_params([], 'sha-256', 'salt').and_raise_error(ArgumentError, /first argument must be a string/) } + it { is_expected.to run.with_params({}, 'sha-256', 'salt').and_raise_error(ArgumentError, /first argument must be a string/) } + it { is_expected.to run.with_params(1, 'sha-256', 'salt').and_raise_error(ArgumentError, /first argument must be a string/) } + it { is_expected.to run.with_params(true, 'sha-256', 'salt').and_raise_error(ArgumentError, /first argument must be a string/) } + end + + context 'when the first argument is undefined' do + it { is_expected.to run.with_params('', 'sha-256', 'salt').and_return(nil) } + it { is_expected.to run.with_params(nil, 'sha-256', 'salt').and_return(nil) } + end + + context 'when the second argument is not a string' do + it { is_expected.to run.with_params('password', [], 'salt').and_raise_error(ArgumentError, /second argument must be a string/) } + it { is_expected.to run.with_params('password', {}, 'salt').and_raise_error(ArgumentError, /second argument must be a string/) } + it { is_expected.to run.with_params('password', 1, 'salt').and_raise_error(ArgumentError, /second argument must be a string/) } + it { is_expected.to run.with_params('password', true, 'salt').and_raise_error(ArgumentError, /second argument must be a string/) } + end + + context 'when the second argument is not one of the supported hashing algorithms' do + it { is_expected.to run.with_params('password', 'no such algo', 'salt').and_raise_error(ArgumentError, /is not a valid hash type/) } + end + + context 'when the third argument is not a string' do + it { is_expected.to run.with_params('password', 'sha-256', []).and_raise_error(ArgumentError, /third argument must be a string/) } + it { is_expected.to run.with_params('password', 'sha-256', {}).and_raise_error(ArgumentError, /third argument must be a string/) } + it { is_expected.to run.with_params('password', 'sha-256', 1).and_raise_error(ArgumentError, /third argument must be a string/) } + it { is_expected.to run.with_params('password', 'sha-256', true).and_raise_error(ArgumentError, /third argument must be a string/) } + end + + context 'when the third argument is empty' do + it { is_expected.to run.with_params('password', 'sha-512', '').and_raise_error(ArgumentError, /third argument must not be empty/) } + end + + context 'when the third argument contains invalid characters' do + it { is_expected.to run.with_params('password', 'sha-512', 'one%').and_raise_error(ArgumentError, /characters in salt must be in the set/) } + end + + context 'when running on a platform with a weak String#crypt implementation' do + before(:each) { allow_any_instance_of(String).to receive(:crypt).with('$1$1').and_return('a bad hash') } + + it { is_expected.to run.with_params('password', 'sha-512', 'salt').and_raise_error(Puppet::ParseError, /system does not support enhanced salts/) } + end + + if RUBY_PLATFORM == 'java' or 'test'.crypt('$1$1') == '$1$1$Bp8CU9Oujr9SSEw53WV6G.' + describe "on systems with enhanced salts support" do + it { is_expected.to run.with_params('password', 'md5', 'salt').and_return('$1$salt$qJH7.N4xYta3aEG/dfqo/0') } + it { is_expected.to run.with_params('password', 'sha-256', 'salt').and_return('$5$salt$Gcm6FsVtF/Qa77ZKD.iwsJlCVPY0XSMgLJL0Hnww/c1') } + it { is_expected.to run.with_params('password', 'sha-512', 'salt').and_return('$6$salt$IxDD3jeSOb5eB1CX5LBsqZFVkJdido3OUILO5Ifz5iwMuTS4XMS130MTSuDDl3aCI6WouIL9AjRbLCelDCy.g.') } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/range_spec.rb b/environments/prod/modules/stdlib/spec/functions/range_spec.rb new file mode 100755 index 0000000..ca569d5 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/range_spec.rb @@ -0,0 +1,126 @@ +require 'spec_helper' + +describe 'range' do + it { is_expected.not_to eq(nil) } + + describe 'signature validation in puppet3', :unless => RSpec.configuration.puppet_future do + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the third.") + is_expected.to run.with_params(1, 2, 3, 4).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params('1..2..3').and_raise_error(Puppet::ParseError, /Unable to compute range/i) } + it { is_expected.to run.with_params('').and_raise_error(Puppet::ParseError, /Unknown range format/i) } + end + + describe 'signature validation in puppet4', :if => RSpec.configuration.puppet_future do + it { pending "the puppet 4 implementation"; is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params('').and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params({}).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params([]).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(true).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(true).and_raise_error(ArgumentError) } + it { is_expected.to run.with_params(1, 2, 'foo').and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(1, 2, []).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(1, 2, {}).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(1, 2, true).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(1, 2, 3, 4).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params('1..2..3').and_raise_error(ArgumentError) } + end + + context 'with characters as bounds' do + it { is_expected.to run.with_params('d', 'a').and_return([]) } + it { is_expected.to run.with_params('a', 'a').and_return(['a']) } + it { is_expected.to run.with_params('a', 'b').and_return(['a', 'b']) } + it { is_expected.to run.with_params('a', 'd').and_return(['a', 'b', 'c', 'd']) } + it { is_expected.to run.with_params('a', 'd', 1).and_return(['a', 'b', 'c', 'd']) } + it { is_expected.to run.with_params('a', 'd', '1').and_return(['a', 'b', 'c', 'd']) } + it { is_expected.to run.with_params('a', 'd', 2).and_return(['a', 'c']) } + it { is_expected.to run.with_params('a', 'd', -2).and_return(['a', 'c']) } + it { is_expected.to run.with_params('a', 'd', 3).and_return(['a', 'd']) } + it { is_expected.to run.with_params('a', 'd', 4).and_return(['a']) } + end + + context 'with strings as bounds' do + it { is_expected.to run.with_params('onea', 'oned').and_return(['onea', 'oneb', 'onec', 'oned']) } + it { is_expected.to run.with_params('two', 'one').and_return([]) } + it { is_expected.to run.with_params('true', 'false').and_return([]) } + it { is_expected.to run.with_params('false', 'true').and_return(['false']) } + end + + context 'with integers as bounds' do + it { is_expected.to run.with_params(4, 1).and_return([]) } + it { is_expected.to run.with_params(1, 1).and_return([1]) } + it { is_expected.to run.with_params(1, 2).and_return([1, 2]) } + it { is_expected.to run.with_params(1, 4).and_return([1, 2, 3, 4]) } + it { is_expected.to run.with_params(1, 4, 1).and_return([1, 2, 3, 4]) } + it { is_expected.to run.with_params(1, 4, '1').and_return([1, 2, 3, 4]) } + it { is_expected.to run.with_params(1, 4, 2).and_return([1, 3]) } + it { is_expected.to run.with_params(1, 4, -2).and_return([1, 3]) } + it { is_expected.to run.with_params(1, 4, 3).and_return([1, 4]) } + it { is_expected.to run.with_params(1, 4, 4).and_return([1]) } + end + + context 'with integers as strings as bounds' do + it { is_expected.to run.with_params('4', '1').and_return([]) } + it { is_expected.to run.with_params('1', '1').and_return([1]) } + it { is_expected.to run.with_params('1', '2').and_return([1, 2]) } + it { is_expected.to run.with_params('1', '4').and_return([1, 2, 3, 4]) } + it { is_expected.to run.with_params('1', '4', 1).and_return([1, 2, 3, 4]) } + it { is_expected.to run.with_params('1', '4', '1').and_return([1, 2, 3, 4]) } + it { is_expected.to run.with_params('1', '4', 2).and_return([1, 3]) } + it { is_expected.to run.with_params('1', '4', -2).and_return([1, 3]) } + it { is_expected.to run.with_params('1', '4', 3).and_return([1, 4]) } + it { is_expected.to run.with_params('1', '4', 4).and_return([1]) } + end + + context 'with prefixed numbers as strings as bounds' do + it { is_expected.to run.with_params('host01', 'host04').and_return(['host01', 'host02', 'host03', 'host04']) } + it { is_expected.to run.with_params('01', '04').and_return([1, 2, 3, 4]) } + end + + context 'with prefixed numbers as utf8 strings as bounds' do + it { is_expected.to run.with_params('ħөŝŧ01', 'ħөŝŧ04').and_return(['ħөŝŧ01', 'ħөŝŧ02', 'ħөŝŧ03', 'ħөŝŧ04']) } + end + + context 'with prefixed numbers as double byte character strings as bounds' do + it { is_expected.to run.with_params('ホスト01', 'ホスト04').and_return(['ホスト01', 'ホスト02', 'ホスト03', 'ホスト04']) } + end + + context 'with dash-range syntax' do + it { is_expected.to run.with_params('4-1').and_return([]) } + it { is_expected.to run.with_params('1-1').and_return([1]) } + it { is_expected.to run.with_params('1-2').and_return([1, 2]) } + it { is_expected.to run.with_params('1-4').and_return([1, 2, 3, 4]) } + end + + context 'with two-dot-range syntax' do + it { is_expected.to run.with_params('4..1').and_return([]) } + it { is_expected.to run.with_params('1..1').and_return([1]) } + it { is_expected.to run.with_params('1..2').and_return([1, 2]) } + it { is_expected.to run.with_params('1..4').and_return([1, 2, 3, 4]) } + end + + context 'with three-dot-range syntax' do + it { is_expected.to run.with_params('4...1').and_return([]) } + it { is_expected.to run.with_params('1...1').and_return([]) } + it { is_expected.to run.with_params('1...2').and_return([1]) } + it { is_expected.to run.with_params('1...3').and_return([1, 2]) } + it { is_expected.to run.with_params('1...5').and_return([1, 2, 3, 4]) } + end + + describe 'when passing mixed arguments as bounds' do + it { + pending('these bounds should not be allowed as ruby will OOM hard. e.g. `(\'host0\'..\'hosta\').to_a` has 3239930 elements on ruby 1.9, adding more \'0\'s and \'a\'s increases that exponentially') + is_expected.to run.with_params('0', 'a').and_raise_error(Puppet::ParseError, /cannot interpolate between numeric and non-numeric bounds/) + } + it { + pending('these bounds should not be allowed as ruby will OOM hard. e.g. `(\'host0\'..\'hosta\').to_a` has 3239930 elements on ruby 1.9, adding more \'0\'s and \'a\'s increases that exponentially') + is_expected.to run.with_params(0, 'a').and_raise_error(Puppet::ParseError, /cannot interpolate between numeric and non-numeric bounds/) + } + it { + pending('these bounds should not be allowed as ruby will OOM hard. e.g. `(\'host0\'..\'hosta\').to_a` has 3239930 elements on ruby 1.9, adding more \'0\'s and \'a\'s increases that exponentially') + is_expected.to run.with_params('h0', 'ha').and_raise_error(Puppet::ParseError, /cannot interpolate between numeric and non-numeric bounds/) + } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/regexpescape_spec.rb b/environments/prod/modules/stdlib/spec/functions/regexpescape_spec.rb new file mode 100644 index 0000000..36dbe70 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/regexpescape_spec.rb @@ -0,0 +1,41 @@ +require 'spec_helper' + +describe 'regexpescape' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + end + + describe 'handling normal strings' do + it 'should call ruby\'s Regexp.escape function' do + Regexp.expects(:escape).with('regexp_string').returns('escaped_regexp_string').once + is_expected.to run.with_params('regexp_string').and_return('escaped_regexp_string') + end + end + + describe 'handling classes derived from String' do + it 'should call ruby\'s Regexp.escape function' do + regexp_string = AlsoString.new('regexp_string') + Regexp.expects(:escape).with(regexp_string).returns('escaped_regexp_string').once + is_expected.to run.with_params(regexp_string).and_return("escaped_regexp_string") + end + end + + describe 'strings in arrays handling' do + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['one*', "two"]).and_return(['one\*', "two"]) } + it { is_expected.to run.with_params(['one*', 1, true, {}, "two"]).and_return(['one\*', 1, true, {}, "two"]) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params(['ŏʼnε*']).and_return(['ŏʼnε\*']) } + it { is_expected.to run.with_params(['インターネット*']).and_return(['インターネット\*']) } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/reject_spec.rb b/environments/prod/modules/stdlib/spec/functions/reject_spec.rb new file mode 100755 index 0000000..86db7c7 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/reject_spec.rb @@ -0,0 +1,20 @@ +require 'spec_helper' + +describe 'reject' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([], 'pattern', 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + it { + pending("reject does not actually check this, and raises NoMethodError instead") + is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /first argument not an array/) + } + it { + pending("reject does not actually check this, and raises NoMethodError instead") + is_expected.to run.with_params(1, 'two').and_raise_error(Puppet::ParseError, /first argument not an array/) + } + it { is_expected.to run.with_params([], 'two').and_return([]) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'two').and_return(['one', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 't(wo|hree)').and_return(['one']) } + it { is_expected.to run.with_params(['όʼnệ', 'ţщồ', 'ţңяέέ'], 'ţ(щồ|ңяέέ)').and_return(['όʼnệ']) } +end diff --git a/environments/prod/modules/stdlib/spec/functions/reverse_spec.rb b/environments/prod/modules/stdlib/spec/functions/reverse_spec.rb new file mode 100755 index 0000000..79bc0ad --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/reverse_spec.rb @@ -0,0 +1,33 @@ +require 'spec_helper' + +describe 'reverse' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['a']).and_return(['a']) } + it { is_expected.to run.with_params(['one']).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two', 'three']).and_return(['three', 'two', 'one']) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'four']).and_return(['four', 'three', 'two', 'one']) } + it { is_expected.to run.with_params(['ổňë', 'ťŵọ', 'ŧңяəė', 'ƒŏůŗ']).and_return(['ƒŏůŗ', 'ŧңяəė', 'ťŵọ', 'ổňë']) } + + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('a').and_return('a') } + it { is_expected.to run.with_params('abc').and_return('cba') } + it { is_expected.to run.with_params('abcd').and_return('dcba') } + it { is_expected.to run.with_params('āβćđ').and_return('đćβā') } + + context 'when using a class extending String' do + it 'should call its reverse method' do + value = AlsoString.new('asdfghjkl') + value.expects(:reverse).returns('foo') + expect(subject).to run.with_params(value).and_return('foo') + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/rstrip_spec.rb b/environments/prod/modules/stdlib/spec/functions/rstrip_spec.rb new file mode 100755 index 0000000..a7663e2 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/rstrip_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'rstrip' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params(' ').and_return('') } + it { is_expected.to run.with_params(' ').and_return('') } + it { is_expected.to run.with_params("\t").and_return('') } + it { is_expected.to run.with_params("\t ").and_return('') } + it { is_expected.to run.with_params('one').and_return('one') } + it { is_expected.to run.with_params(' one').and_return(' one') } + it { is_expected.to run.with_params(' one').and_return(' one') } + it { is_expected.to run.with_params("\tone").and_return("\tone") } + it { is_expected.to run.with_params("\t one").and_return("\t one") } + it { is_expected.to run.with_params('one ').and_return('one') } + it { is_expected.to run.with_params(' one ').and_return(' one') } + it { is_expected.to run.with_params(' one ').and_return(' one') } + it { is_expected.to run.with_params(' ǿňè ').and_return(' ǿňè') } + it { is_expected.to run.with_params("\tone ").and_return("\tone") } + it { is_expected.to run.with_params("\t one ").and_return("\t one") } + it { is_expected.to run.with_params("one\t").and_return('one') } + it { is_expected.to run.with_params(" one\t").and_return(' one') } + it { is_expected.to run.with_params(" one\t").and_return(' one') } + it { is_expected.to run.with_params("\tone\t").and_return("\tone") } + it { is_expected.to run.with_params("\t one\t").and_return("\t one") } + it { is_expected.to run.with_params(' o n e ').and_return(' o n e') } + it { is_expected.to run.with_params(AlsoString.new(' one ')).and_return(' one') } +end diff --git a/environments/prod/modules/stdlib/spec/functions/seeded_rand_spec.rb b/environments/prod/modules/stdlib/spec/functions/seeded_rand_spec.rb new file mode 100644 index 0000000..ac108f4 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/seeded_rand_spec.rb @@ -0,0 +1,58 @@ +require 'spec_helper' + +describe 'seeded_rand' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_raise_error(ArgumentError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(0, '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params(1.5, '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params(-10, '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params("-10", '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params("string", '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params([], '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params({}, '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params(1, 1).and_raise_error(ArgumentError, /second argument must be a string/) } + it { is_expected.to run.with_params(1, []).and_raise_error(ArgumentError, /second argument must be a string/) } + it { is_expected.to run.with_params(1, {}).and_raise_error(ArgumentError, /second argument must be a string/) } + + it "provides a random number strictly less than the given max" do + expect(seeded_rand(3, 'seed')).to satisfy {|n| n.to_i < 3 } + end + + it "provides a random number greater or equal to zero" do + expect(seeded_rand(3, 'seed')).to satisfy {|n| n.to_i >= 0 } + end + + it "provides the same 'random' value on subsequent calls for the same host" do + expect(seeded_rand(10, 'seed')).to eql(seeded_rand(10, 'seed')) + end + + it "allows seed to control the random value on a single host" do + first_random = seeded_rand(1000, 'seed1') + second_different_random = seeded_rand(1000, 'seed2') + + expect(first_random).not_to eql(second_different_random) + end + + it "should not return different values for different hosts" do + val1 = seeded_rand(1000, 'foo', :host => "first.host.com") + val2 = seeded_rand(1000, 'foo', :host => "second.host.com") + + expect(val1).to eql(val2) + end + + def seeded_rand(max, seed, args = {}) + host = args[:host] || '127.0.0.1' + + # workaround not being able to use let(:facts) because some tests need + # multiple different hostnames in one context + scope.stubs(:lookupvar).with("::fqdn", {}).returns(host) + + scope.function_seeded_rand([max, seed]) + end + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params(1000, 'ǿňè')} + it { is_expected.to run.with_params(1000, '文字列')} + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/shell_escape_spec.rb b/environments/prod/modules/stdlib/spec/functions/shell_escape_spec.rb new file mode 100644 index 0000000..77917dd --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/shell_escape_spec.rb @@ -0,0 +1,27 @@ +require 'spec_helper' + +describe 'shell_escape' do + it { is_expected.not_to eq(nil) } + + describe 'signature validation' do + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('foo', 'bar').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + describe 'stringification' do + it { is_expected.to run.with_params(10).and_return('10') } + it { is_expected.to run.with_params(false).and_return('false') } + end + + describe 'escaping' do + it { is_expected.to run.with_params('foo').and_return('foo') } + it { is_expected.to run.with_params('foo bar').and_return('foo\ bar') } + it { is_expected.to run.with_params('~`!@#$%^&*()_+-=[]\{}|;\':",./<>?') + .and_return('\~\`\!@\#\$\%\^\&\*\(\)_\+-\=\[\]\\\\\{\}\|\;\\\':\",./\<\>\?') } + end + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('スペー スを含むテ キスト').and_return('\\ス\\ペ\\ー\\ \\ス\\を\\含\\む\\テ\\ \\ \\キ\\ス\\ト') } + it { is_expected.to run.with_params('μťƒ 8 ŧĕχť').and_return('\\μ\\ť\\ƒ\\ 8\\ \\ \\ŧ\\ĕ\\χ\\ť') } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/shell_join_spec.rb b/environments/prod/modules/stdlib/spec/functions/shell_join_spec.rb new file mode 100644 index 0000000..46305bf --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/shell_join_spec.rb @@ -0,0 +1,28 @@ +require 'spec_helper' + +describe 'shell_join' do + it { is_expected.not_to eq(nil) } + + describe 'signature validation' do + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(['foo'], ['bar']).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('foo').and_raise_error(Puppet::ParseError, /is not an Array/i) } + end + + describe 'shell argument joining' do + it { is_expected.to run.with_params(['foo']).and_return('foo') } + it { is_expected.to run.with_params(['foo', 'bar']).and_return('foo bar') } + it { is_expected.to run.with_params(['foo', 'bar baz']).and_return('foo bar\ baz') } + it { is_expected.to run.with_params(['~`!@#$', '%^&*()_+-=', '[]\{}|;\':"', ',./<>?']) + .and_return('\~\`\!@\#\$ \%\^\&\*\(\)_\+-\= \[\]\\\\\{\}\|\;\\\':\" ,./\<\>\?') } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params(['μťƒ', '8', 'ŧĕχť']).and_return('\\μ\\ť\\ƒ 8 \\ŧ\\ĕ\\χ\\ť') } + it { is_expected.to run.with_params(['スペー', 'スを含むテ', ' キスト']).and_return('\\ス\\ペ\\ー \\ス\\を\\含\\む\\テ \\ \\キ\\ス\\ト') } + end + end + + describe 'stringification' do + it { is_expected.to run.with_params([10, false, 'foo']).and_return('10 false foo') } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/shell_split_spec.rb b/environments/prod/modules/stdlib/spec/functions/shell_split_spec.rb new file mode 100644 index 0000000..f8f9c90 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/shell_split_spec.rb @@ -0,0 +1,29 @@ +require 'spec_helper' + +describe 'shell_split' do + it { is_expected.not_to eq(nil) } + + describe 'signature validation' do + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('foo', 'bar').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + describe 'stringification' do + it { is_expected.to run.with_params(10).and_return(['10']) } + it { is_expected.to run.with_params(false).and_return(['false']) } + end + + describe 'shell line spliting' do + it { is_expected.to run.with_params('foo').and_return(['foo']) } + it { is_expected.to run.with_params('foo bar').and_return(['foo', 'bar']) } + it { is_expected.to run.with_params('\~\`\!@\#\$\%\^\&\*\(\)_\+-\=\[\]\\\\\{\}\|\;\\\':\",./\<\>\?') + .and_return(['~`!@#$%^&*()_+-=[]\{}|;\':",./<>?']) } + it { is_expected.to run.with_params('\~\`\!@\#\$ \%\^\&\*\(\)_\+-\= \[\]\\\\\{\}\|\;\\\':\" ,./\<\>\?') + .and_return(['~`!@#$', '%^&*()_+-=', '[]\{}|;\':"', ',./<>?']) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('\\μ\\ť\\ƒ 8 \\ŧ\\ĕ\\χ\\ť').and_return(['μťƒ', '8', 'ŧĕχť']) } + it { is_expected.to run.with_params('\\ス\\ペ\\ー \\ス\\を\\含\\む\\テ \\ \\キ\\ス\\ト').and_return(['スペー', 'スを含むテ', ' キスト']) } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/shuffle_spec.rb b/environments/prod/modules/stdlib/spec/functions/shuffle_spec.rb new file mode 100755 index 0000000..4673daa --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/shuffle_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'shuffle' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + + context 'when running with a specific seed' do + # make tests deterministic + before(:each) { srand(2) } + + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['a']).and_return(['a']) } + it { is_expected.to run.with_params(['one']).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two', 'three']).and_return(['two', 'one', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'four']).and_return(['four', 'three', 'two', 'one']) } + + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('a').and_return('a') } + it { is_expected.to run.with_params('abc').and_return('bac') } + it { is_expected.to run.with_params('abcd').and_return('dcba') } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('ůţƒ8 ŧέχŧ şŧґíńģ').and_return('ģńş ůχţέƒŧí8ґŧŧ ') } + it { is_expected.to run.with_params('日本語の文字列').and_return('字本日語文列の') } + end + + context 'when using a class extending String' do + it { is_expected.to run.with_params(AlsoString.new('asdfghjkl')).and_return('lkhdsfajg') } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/size_spec.rb b/environments/prod/modules/stdlib/spec/functions/size_spec.rb new file mode 100755 index 0000000..2047423 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/size_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'size' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Unknown type given/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Unknown type given/) } + it { is_expected.to run.with_params('1').and_raise_error(Puppet::ParseError, /Requires either string, array or hash to work/) } + it { is_expected.to run.with_params('1.0').and_raise_error(Puppet::ParseError, /Requires either string, array or hash to work/) } + it { is_expected.to run.with_params([]).and_return(0) } + it { is_expected.to run.with_params(['a']).and_return(1) } + it { is_expected.to run.with_params(['one', 'two', 'three']).and_return(3) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'four']).and_return(4) } + + it { is_expected.to run.with_params({}).and_return(0) } + it { is_expected.to run.with_params({'1' => '2'}).and_return(1) } + it { is_expected.to run.with_params({'1' => '2', '4' => '4'}).and_return(2) } + it { is_expected.to run.with_params({'€' => '@', '竹' => 'ǿňè'}).and_return(2) } + + it { is_expected.to run.with_params('').and_return(0) } + it { is_expected.to run.with_params('a').and_return(1) } + it { is_expected.to run.with_params('abc').and_return(3) } + it { is_expected.to run.with_params('abcd').and_return(4) } + it { is_expected.to run.with_params('万').and_return(1) } + it { is_expected.to run.with_params('āβćđ').and_return(4) } + + context 'when using a class extending String' do + it 'should call its size method' do + value = AlsoString.new('asdfghjkl') + value.expects(:size).returns('foo') + expect(subject).to run.with_params(value).and_return('foo') + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/sort_spec.rb b/environments/prod/modules/stdlib/spec/functions/sort_spec.rb new file mode 100755 index 0000000..9abd039 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/sort_spec.rb @@ -0,0 +1,24 @@ +require 'spec_helper' + +describe 'sort' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([], 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { pending('stricter input checking'); is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /requires string or array/) } + it { pending('stricter input checking'); is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /requires string or array/) } + it { pending('stricter input checking'); is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /requires string or array/) } + end + + context 'when called with an array' do + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['a']).and_return(['a']) } + it { is_expected.to run.with_params(['c', 'b', 'a']).and_return(['a', 'b', 'c']) } + end + + context 'when called with a string' do + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('a').and_return('a') } + it { is_expected.to run.with_params('cbda').and_return('abcd') } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/squeeze_spec.rb b/environments/prod/modules/stdlib/spec/functions/squeeze_spec.rb new file mode 100755 index 0000000..b267d9a --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/squeeze_spec.rb @@ -0,0 +1,50 @@ +require 'spec_helper' + +describe 'squeeze' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', '', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_raise_error(NoMethodError) } + it { is_expected.to run.with_params({}).and_raise_error(NoMethodError) } + it { is_expected.to run.with_params(true).and_raise_error(NoMethodError) } + + context 'when squeezing a single string' do + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('a').and_return('a') } + it { is_expected.to run.with_params('aaaaaaaaa').and_return('a') } + it { is_expected.to run.with_params('aaaaaaaaa', 'a').and_return('a') } + it { is_expected.to run.with_params('aaaaaaaaabbbbbbbbbbcccccccccc', 'b-c').and_return('aaaaaaaaabc') } + end + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('ậậậậậậậậậậậậậậậậậậậậ').and_return('ậ') } + it { is_expected.to run.with_params('語語語語語語語', '語').and_return('語') } + it { is_expected.to run.with_params('ậậậậậậậậậậậậậậậậậ語語語語©©©©©', '©').and_return('ậậậậậậậậậậậậậậậậậ語語語語©') } + end + + context 'when squeezing values in an array' do + it { + is_expected.to run \ + .with_params(['', 'a', 'aaaaaaaaa', 'aaaaaaaaabbbbbbbbbbcccccccccc']) \ + .and_return( ['', 'a', 'a', 'abc']) + } + it { + is_expected.to run \ + .with_params(['', 'a', 'aaaaaaaaa', 'aaaaaaaaabbbbbbbbbbcccccccccc'], 'a') \ + .and_return( ['', 'a', 'a', 'abbbbbbbbbbcccccccccc']) + } + it { + is_expected.to run \ + .with_params(['', 'a', 'aaaaaaaaa', 'aaaaaaaaabbbbbbbbbbcccccccccc'], 'b-c') \ + .and_return( ['', 'a', 'aaaaaaaaa', 'aaaaaaaaabc']) + } + end + + context 'when using a class extending String' do + it 'should call its squeeze method' do + value = AlsoString.new('aaaaaaaaa') + value.expects(:squeeze).returns('foo') + expect(subject).to run.with_params(value).and_return('foo') + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/str2bool_spec.rb b/environments/prod/modules/stdlib/spec/functions/str2bool_spec.rb new file mode 100755 index 0000000..7d8c47c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/str2bool_spec.rb @@ -0,0 +1,23 @@ +require 'spec_helper' + +describe 'str2bool' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('true', 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /Unknown type of boolean given/) } + + describe 'when testing values that mean "true"' do + [ 'TRUE','1', 't', 'y', 'true', 'yes', true ].each do |value| + it { is_expected.to run.with_params(value).and_return(true) } + end + end + + describe 'when testing values that mean "false"' do + [ 'FALSE','', '0', 'f', 'n', 'false', 'no', false, 'undef', 'undefined' ].each do |value| + it { is_expected.to run.with_params(value).and_return(false) } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/str2saltedsha512_spec.rb b/environments/prod/modules/stdlib/spec/functions/str2saltedsha512_spec.rb new file mode 100755 index 0000000..2e1e818 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/str2saltedsha512_spec.rb @@ -0,0 +1,17 @@ +require 'spec_helper' + +describe 'str2saltedsha512' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('password', 2).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires a String argument/) } + + context 'when running with a specific seed' do + # make tests deterministic + before(:each) { srand(2) } + + it { is_expected.to run.with_params('').and_return('0f8a612f4eeed08e47b3875d00f33c5688f7926298f2d9b5fe19d1323f910bc78b6f7b5892596d2fabaa65e7a8d99b3768c102610cf0432c4827eee01f09451e3fae4f7a') } + it { is_expected.to run.with_params('password').and_return('0f8a612f43134376566c5707718d600effcfb17581fc9d3fa64d7f447dfda317c174ffdb498d2c5bd5c2075dab41c9d7ada5afbdc6b55354980eb5ba61802371e6b64956') } + it { is_expected.to run.with_params('verylongpassword').and_return('0f8a612f7a448537540e062daa8621f9bae326ca8ccb899e1bdb10e7c218cebfceae2530b856662565fdc4d81e986fc50cfbbc46d50436610ed9429ff5e43f2c45b5d039') } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/strftime_spec.rb b/environments/prod/modules/stdlib/spec/functions/strftime_spec.rb new file mode 100755 index 0000000..e76774a --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/strftime_spec.rb @@ -0,0 +1,26 @@ +require 'spec_helper' + +describe 'strftime' do + it "should exist" do + expect(Puppet::Parser::Functions.function("strftime")).to eq("function_strftime") + end + + it "should raise a ParseError if there is less than 1 arguments" do + expect { scope.function_strftime([]) }.to( raise_error(Puppet::ParseError)) + end + + it "using %s should be higher then when I wrote this test" do + result = scope.function_strftime(["%s"]) + expect(result.to_i).to(be > 1311953157) + end + + it "using %s should be lower then 1.5 trillion" do + result = scope.function_strftime(["%s"]) + expect(result.to_i).to(be < 1500000000) + end + + it "should return a date when given %Y-%m-%d" do + result = scope.function_strftime(["%Y-%m-%d"]) + expect(result).to match(/^\d{4}-\d{2}-\d{2}$/) + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/strip_spec.rb b/environments/prod/modules/stdlib/spec/functions/strip_spec.rb new file mode 100755 index 0000000..18e943d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/strip_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'strip' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params(' ').and_return('') } + it { is_expected.to run.with_params(' ').and_return('') } + it { is_expected.to run.with_params("\t").and_return('') } + it { is_expected.to run.with_params("\t ").and_return('') } + it { is_expected.to run.with_params('one').and_return('one') } + it { is_expected.to run.with_params(' one').and_return('one') } + it { is_expected.to run.with_params(' one').and_return('one') } + it { is_expected.to run.with_params("\tone").and_return('one') } + it { is_expected.to run.with_params("\t one").and_return('one') } + it { is_expected.to run.with_params('one ').and_return('one') } + it { is_expected.to run.with_params(' one ').and_return('one') } + it { is_expected.to run.with_params(' one ').and_return('one') } + it { is_expected.to run.with_params("\tone ").and_return('one') } + it { is_expected.to run.with_params("\t one ").and_return('one') } + it { is_expected.to run.with_params("one \t").and_return('one') } + it { is_expected.to run.with_params(" one \t").and_return('one') } + it { is_expected.to run.with_params(" one \t").and_return('one') } + it { is_expected.to run.with_params("\tone \t").and_return('one') } + it { is_expected.to run.with_params("\t one \t").and_return('one') } + it { is_expected.to run.with_params(' o n e ').and_return('o n e') } + it { is_expected.to run.with_params(' ỏŋέ ').and_return('ỏŋέ') } + it { is_expected.to run.with_params(AlsoString.new(' one ')).and_return('one') } +end diff --git a/environments/prod/modules/stdlib/spec/functions/suffix_spec.rb b/environments/prod/modules/stdlib/spec/functions/suffix_spec.rb new file mode 100755 index 0000000..e0eafb1 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/suffix_spec.rb @@ -0,0 +1,40 @@ +require 'spec_helper' + +describe 'suffix' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the second.") + is_expected.to run.with_params([], 'a', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /expected first argument to be an Array/) } + it { is_expected.to run.with_params([], 2).and_raise_error(Puppet::ParseError, /expected second argument to be a String/) } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['one', 2]).and_return(['one', '2']) } + it { is_expected.to run.with_params([], '').and_return([]) } + it { is_expected.to run.with_params([''], '').and_return(['']) } + it { is_expected.to run.with_params(['one'], 'post').and_return(['onepost']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'post').and_return(['onepost', 'twopost', 'threepost']) } + it { is_expected.to run.with_params(['ỗńέ', 'ťשׂǿ', 'ŧҺř℮ə'], 'рổŝţ').and_return(['ỗńέрổŝţ', 'ťשׂǿрổŝţ', 'ŧҺř℮əрổŝţ']) } + + it { + is_expected.to run.with_params({}).and_return({}) + } + it { + is_expected.to run.with_params({ 'key1' => 'value1', 2 => 3}).and_return({ 'key1' => 'value1', '2' => 3 }) + } + it { + is_expected.to run.with_params({}, '').and_return({}) + } + it { + is_expected.to run.with_params({ 'key' => 'value' }, '').and_return({ 'key' => 'value' }) + } + it { + is_expected.to run.with_params({ 'key' => 'value' }, 'post').and_return({ 'keypost' => 'value' }) + } + it { + is_expected.to run \ + .with_params({ 'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3' }, 'post') \ + .and_return({ 'key1post' => 'value1', 'key2post' => 'value2', 'key3post' => 'value3' }) + } +end diff --git a/environments/prod/modules/stdlib/spec/functions/swapcase_spec.rb b/environments/prod/modules/stdlib/spec/functions/swapcase_spec.rb new file mode 100755 index 0000000..c175a15 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/swapcase_spec.rb @@ -0,0 +1,40 @@ +require 'spec_helper' + +describe 'swapcase' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('a', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + describe 'with strings as inputs' do + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('one').and_return('ONE') } + it { is_expected.to run.with_params('ONE').and_return('one') } + it { is_expected.to run.with_params('oNe').and_return('OnE') } + end + describe 'with arrays as inputs' do + it { is_expected.to run.with_params([]).and_return([]) } + describe 'only containing strings' do + it { is_expected.to run.with_params(['']).and_return(['']) } + it { is_expected.to run.with_params(['one']).and_return(['ONE']) } + it { is_expected.to run.with_params(['ONE']).and_return(['one']) } + it { is_expected.to run.with_params(['oNe']).and_return(['OnE']) } + it { is_expected.to run.with_params(['one', 'ONE']).and_return(['ONE', 'one']) } + it { is_expected.to run.with_params(['ONE', 'OnE']).and_return(['one', 'oNe']) } + it { is_expected.to run.with_params(['oNe', 'one']).and_return(['OnE', 'ONE']) } + end + describe 'containing mixed types' do + it { is_expected.to run.with_params(['OnE', {}]).and_return(['oNe', {}]) } + it { is_expected.to run.with_params(['OnE', 1]).and_return(['oNe', 1]) } + it { is_expected.to run.with_params(['OnE', []]).and_return(['oNe', []]) } + it { is_expected.to run.with_params(['OnE', ['two']]).and_return(['oNe', ['two']]) } + end + end + it "should accept objects which extend String" do + is_expected.to run.with_params(AlsoString.new("OnE")).and_return('oNe') + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/time_spec.rb b/environments/prod/modules/stdlib/spec/functions/time_spec.rb new file mode 100755 index 0000000..d157939 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/time_spec.rb @@ -0,0 +1,21 @@ +require 'spec_helper' + +describe 'time' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params('a', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + context 'when running at a specific time' do + before(:each) { + # get a value before stubbing the function + test_time = Time.utc(2006, 10, 13, 8, 15, 11) + Time.expects(:new).with().returns(test_time).once + } + it { is_expected.to run.with_params().and_return(1160727311) } + it { is_expected.to run.with_params('').and_return(1160727311) } + it { is_expected.to run.with_params([]).and_return(1160727311) } + it { is_expected.to run.with_params({}).and_return(1160727311) } + it { is_expected.to run.with_params('foo').and_return(1160727311) } + it { is_expected.to run.with_params('UTC').and_return(1160727311) } + it { is_expected.to run.with_params('America/New_York').and_return(1160727311) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/to_bytes_spec.rb b/environments/prod/modules/stdlib/spec/functions/to_bytes_spec.rb new file mode 100755 index 0000000..2be23ff --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/to_bytes_spec.rb @@ -0,0 +1,72 @@ +require 'spec_helper' + +describe 'to_bytes' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('1', 'extras').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([]).and_raise_error(TypeError, /(can't convert|no implicit conversion of) Array (in)?to String/) } + it { is_expected.to run.with_params({}).and_raise_error(TypeError, /(can't convert|no implicit conversion of) Hash (in)?to String/) } + it { is_expected.to run.with_params(true).and_raise_error(TypeError, /(can't convert|no implicit conversion of) (TrueClass|true) (in)?to String/) } + + describe 'when passing numbers' do + it { is_expected.to run.with_params(0).and_return(0) } + it { is_expected.to run.with_params(1).and_return(1) } + it { is_expected.to run.with_params(-1).and_return(-1) } + it { is_expected.to run.with_params(1.1).and_return(1.1) } + it { is_expected.to run.with_params(-1.1).and_return(-1.1) } + end + + describe 'when passing numbers as strings' do + describe 'without a unit' do + it { is_expected.to run.with_params('1').and_return(1) } + it { is_expected.to run.with_params('-1').and_return(-1) } + # these are so wrong + it { is_expected.to run.with_params('1.1').and_return(1) } + it { is_expected.to run.with_params('-1.1').and_return(-1) } + end + + describe 'with a unit' do + it { is_expected.to run.with_params('1k').and_return(1024) } + it { is_expected.to run.with_params('-1kB').and_return(-1024) } + it { is_expected.to run.with_params('1k').and_return(1024) } + it { is_expected.to run.with_params('1M').and_return(1024*1024) } + it { is_expected.to run.with_params('1G').and_return(1024*1024*1024) } + it { is_expected.to run.with_params('1T').and_return(1024*1024*1024*1024) } + it { is_expected.to run.with_params('1P').and_return(1024*1024*1024*1024*1024) } + it { is_expected.to run.with_params('1E').and_return(1024*1024*1024*1024*1024*1024) } + it { is_expected.to run.with_params('1.5e3M').and_return(1572864000) } + + it { is_expected.to run.with_params('4k').and_return(4*1024) } + it { is_expected.to run.with_params('-4kB').and_return(4*-1024) } + it { is_expected.to run.with_params('4k').and_return(4*1024) } + it { is_expected.to run.with_params('4M').and_return(4*1024*1024) } + it { is_expected.to run.with_params('4G').and_return(4*1024*1024*1024) } + it { is_expected.to run.with_params('4T').and_return(4*1024*1024*1024*1024) } + it { is_expected.to run.with_params('4P').and_return(4*1024*1024*1024*1024*1024) } + it { is_expected.to run.with_params('4E').and_return(4*1024*1024*1024*1024*1024*1024) } + + # these are so wrong + it { is_expected.to run.with_params('1.0001 k').and_return(1024) } + it { is_expected.to run.with_params('-1.0001 kB').and_return(-1024) } + end + + describe 'with a unknown unit' do + it { is_expected.to run.with_params('1KB').and_raise_error(Puppet::ParseError, /Unknown prefix/) } + it { is_expected.to run.with_params('1K').and_raise_error(Puppet::ParseError, /Unknown prefix/) } + it { is_expected.to run.with_params('1mb').and_raise_error(Puppet::ParseError, /Unknown prefix/) } + it { is_expected.to run.with_params('1m').and_raise_error(Puppet::ParseError, /Unknown prefix/) } + it { is_expected.to run.with_params('1%').and_raise_error(Puppet::ParseError, /Unknown prefix/) } + it { is_expected.to run.with_params('1 p').and_raise_error(Puppet::ParseError, /Unknown prefix/) } + end + end + + # these are so wrong + describe 'when passing random stuff' do + it { is_expected.to run.with_params('-1....1').and_return(-1) } + it { is_expected.to run.with_params('-1.e.e.e.1').and_return(-1) } + it { is_expected.to run.with_params('-1+1').and_return(-1) } + it { is_expected.to run.with_params('1-1').and_return(1) } + it { is_expected.to run.with_params('1 kaboom').and_return(1024) } + it { is_expected.to run.with_params('kaboom').and_return(0) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/try_get_value_spec.rb b/environments/prod/modules/stdlib/spec/functions/try_get_value_spec.rb new file mode 100644 index 0000000..38c0efd --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/try_get_value_spec.rb @@ -0,0 +1,100 @@ +require 'spec_helper' + +describe 'try_get_value' do + + let(:data) do + { + 'a' => { + 'g' => '2', + 'e' => [ + 'f0', + 'f1', + { + 'x' => { + 'y' => 'z' + } + }, + 'f3', + ] + }, + 'b' => true, + 'c' => false, + 'd' => '1', + } + end + + context 'single values' do + it 'should exist' do + is_expected.not_to eq(nil) + end + + it 'should be able to return a single value' do + is_expected.to run.with_params('test').and_return('test') + end + + it 'should use the default value if data is a single value and path is present' do + is_expected.to run.with_params('test', 'path', 'default').and_return('default') + end + + it 'should return default if there is no data' do + is_expected.to run.with_params(nil, nil, 'default').and_return('default') + end + + it 'should be able to use data structures as default values' do + is_expected.to run.with_params('test', 'path', data).and_return(data) + end + end + + context 'structure values' do + it 'should be able to extracts a single hash value' do + is_expected.to run.with_params(data, 'd', 'default').and_return('1') + end + + it 'should be able to extract a deeply nested hash value' do + is_expected.to run.with_params(data, 'a/g', 'default').and_return('2') + end + + it 'should return the default value if the path is not found' do + is_expected.to run.with_params(data, 'missing', 'default').and_return('default') + end + + it 'should return the default value if the path is too long' do + is_expected.to run.with_params(data, 'a/g/c/d', 'default').and_return('default') + end + + it 'should support an array index in the path' do + is_expected.to run.with_params(data, 'a/e/1', 'default').and_return('f1') + end + + it 'should return the default value if an array index is not a number' do + is_expected.to run.with_params(data, 'a/b/c', 'default').and_return('default') + end + + it 'should return the default value if and index is out of array length' do + is_expected.to run.with_params(data, 'a/e/5', 'default').and_return('default') + end + + it 'should be able to path though both arrays and hashes' do + is_expected.to run.with_params(data, 'a/e/2/x/y', 'default').and_return('z') + end + + it 'should be able to return "true" value' do + is_expected.to run.with_params(data, 'b', 'default').and_return(true) + is_expected.to run.with_params(data, 'm', true).and_return(true) + end + + it 'should be able to return "false" value' do + is_expected.to run.with_params(data, 'c', 'default').and_return(false) + is_expected.to run.with_params(data, 'm', false).and_return(false) + end + + it 'should return "nil" if value is not found and no default value is provided' do + is_expected.to run.with_params(data, 'a/1').and_return(nil) + end + + it 'should be able to use a custom path separator' do + is_expected.to run.with_params(data, 'a::g', 'default', '::').and_return('2') + is_expected.to run.with_params(data, 'a::c', 'default', '::').and_return('default') + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/type3x_spec.rb b/environments/prod/modules/stdlib/spec/functions/type3x_spec.rb new file mode 100644 index 0000000..c3eb1de --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/type3x_spec.rb @@ -0,0 +1,41 @@ +require 'spec_helper' + +describe 'type3x' do + it "should exist" do + expect(Puppet::Parser::Functions.function("type3x")).to eq("function_type3x") + end + + it "should raise a ParseError if there is less than 1 arguments" do + expect { scope.function_type3x([]) }.to( raise_error(Puppet::ParseError)) + end + + it "should return string when given a string" do + result = scope.function_type3x(["aaabbbbcccc"]) + expect(result).to(eq('string')) + end + + it "should return array when given an array" do + result = scope.function_type3x([["aaabbbbcccc","asdf"]]) + expect(result).to(eq('array')) + end + + it "should return hash when given a hash" do + result = scope.function_type3x([{"a"=>1,"b"=>2}]) + expect(result).to(eq('hash')) + end + + it "should return integer when given an integer" do + result = scope.function_type3x(["1"]) + expect(result).to(eq('integer')) + end + + it "should return float when given a float" do + result = scope.function_type3x(["1.34"]) + expect(result).to(eq('float')) + end + + it "should return boolean when given a boolean" do + result = scope.function_type3x([true]) + expect(result).to(eq('boolean')) + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/type_of_spec.rb b/environments/prod/modules/stdlib/spec/functions/type_of_spec.rb new file mode 100644 index 0000000..cc9ef78 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/type_of_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' + +if ENV["FUTURE_PARSER"] == 'yes' + describe 'type_of' do + pending 'teach rspec-puppet to load future-only functions under 3.7.5' do + it { is_expected.not_to eq(nil) } + end + end +end + +if Puppet.version.to_f >= 4.0 + describe 'type_of' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { is_expected.to run.with_params('', '').and_raise_error(ArgumentError) } + + it 'gives the type of a string' do + expect(subject.call({}, 'hello world')).to be_kind_of(Puppet::Pops::Types::PStringType) + end + + it 'gives the type of an integer' do + expect(subject.call({}, 5)).to be_kind_of(Puppet::Pops::Types::PIntegerType) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/type_spec.rb b/environments/prod/modules/stdlib/spec/functions/type_spec.rb new file mode 100755 index 0000000..4288df0 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/type_spec.rb @@ -0,0 +1,42 @@ +require 'spec_helper' + +describe 'type' do + it "should exist" do + expect(Puppet::Parser::Functions.function("type")).to eq("function_type") + end + + it "should give a deprecation warning when called" do + scope.expects(:warning).with("type() DEPRECATED: This function will cease to function on Puppet 4; please use type3x() before upgrading to puppet 4 for backwards-compatibility, or migrate to the new parser's typing system.") + scope.function_type(["aoeu"]) + end + + it "should return string when given a string" do + result = scope.function_type(["aaabbbbcccc"]) + expect(result).to(eq('string')) + end + + it "should return array when given an array" do + result = scope.function_type([["aaabbbbcccc","asdf"]]) + expect(result).to(eq('array')) + end + + it "should return hash when given a hash" do + result = scope.function_type([{"a"=>1,"b"=>2}]) + expect(result).to(eq('hash')) + end + + it "should return integer when given an integer" do + result = scope.function_type(["1"]) + expect(result).to(eq('integer')) + end + + it "should return float when given a float" do + result = scope.function_type(["1.34"]) + expect(result).to(eq('float')) + end + + it "should return boolean when given a boolean" do + result = scope.function_type([true]) + expect(result).to(eq('boolean')) + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/union_spec.rb b/environments/prod/modules/stdlib/spec/functions/union_spec.rb new file mode 100755 index 0000000..3f36f24 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/union_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' + +describe 'union' do + describe 'argument checking' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one', []).and_raise_error(Puppet::ParseError, /Every parameter must be an array/) } + it { is_expected.to run.with_params([], 'two').and_raise_error(Puppet::ParseError, /Every parameter must be an array/) } + it { is_expected.to run.with_params({}, {}).and_raise_error(Puppet::ParseError, /Every parameter must be an array/) } + end + + it { is_expected.to run.with_params([], []).and_return([]) } + it { is_expected.to run.with_params([], ['one']).and_return(['one']) } + it { is_expected.to run.with_params(['one'], []).and_return(['one']) } + it { is_expected.to run.with_params(['one'], ['one']).and_return(['one']) } + it { is_expected.to run.with_params(['one'], ['two']).and_return(['one', 'two']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'three']).and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'two', 'three'], ['two', 'three']).and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'two', 'three']).and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two'], ['two', 'three'], ['one', 'three']).and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two'], ['three', 'four'], ['one', 'two', 'three'], ['four']).and_return(['one', 'two', 'three', 'four']) } + it { is_expected.to run.with_params(['ốńə', 'ţשׂợ'], ['ŧĥяếệ', 'ƒởųŗ'], ['ốńə', 'ţשׂợ', 'ŧĥяếệ'], ['ƒởųŗ']).and_return(['ốńə', 'ţשׂợ', 'ŧĥяếệ', 'ƒởųŗ']) } + it 'should not confuse types' do is_expected.to run.with_params(['1', '2', '3'], [1, 2]).and_return(['1', '2', '3', 1, 2]) end +end diff --git a/environments/prod/modules/stdlib/spec/functions/unique_spec.rb b/environments/prod/modules/stdlib/spec/functions/unique_spec.rb new file mode 100755 index 0000000..7955acb --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/unique_spec.rb @@ -0,0 +1,29 @@ +require 'spec_helper' + +describe 'unique' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + end + + context 'when called with an array' do + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['a']).and_return(['a']) } + it { is_expected.to run.with_params(['a', 'b', 'a']).and_return(['a', 'b']) } + it { is_expected.to run.with_params(['ã', 'ъ', 'ã']).and_return(['ã', 'ъ']) } + end + + context 'when called with a string' do + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('a').and_return('a') } + it { is_expected.to run.with_params('aaba').and_return('ab') } + it { is_expected.to run.with_params('ããъã').and_return('ãъ') } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/unix2dos_spec.rb b/environments/prod/modules/stdlib/spec/functions/unix2dos_spec.rb new file mode 100644 index 0000000..8537a26 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/unix2dos_spec.rb @@ -0,0 +1,40 @@ +require 'spec_helper' + +describe 'unix2dos' do + context 'Checking parameter validity' do + it { is_expected.not_to eq(nil) } + it do + is_expected.to run.with_params.and_raise_error(ArgumentError, /Wrong number of arguments/) + end + it do + is_expected.to run.with_params('one', 'two').and_raise_error(ArgumentError, /Wrong number of arguments/) + end + it do + is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) + end + it do + is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError) + end + it do + is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) + end + end + + context 'Converting from unix to dos format' do + sample_text = "Hello\nWorld\n" + desired_output = "Hello\r\nWorld\r\n" + + it 'should output dos format' do + should run.with_params(sample_text).and_return(desired_output) + end + end + + context 'Converting from dos to dos format' do + sample_text = "Hello\r\nWorld\r\n" + desired_output = "Hello\r\nWorld\r\n" + + it 'should output dos format' do + should run.with_params(sample_text).and_return(desired_output) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/upcase_spec.rb b/environments/prod/modules/stdlib/spec/functions/upcase_spec.rb new file mode 100755 index 0000000..3b7b02d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/upcase_spec.rb @@ -0,0 +1,26 @@ +require 'spec_helper' + +describe 'upcase' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires an array, hash or object that responds to upcase/) } + it { is_expected.to run.with_params([1]).and_raise_error(Puppet::ParseError, /Requires an array, hash or object that responds to upcase/) } + end + + describe 'normal string handling' do + it { is_expected.to run.with_params("abc").and_return("ABC") } + it { is_expected.to run.with_params("Abc").and_return("ABC") } + it { is_expected.to run.with_params("ABC").and_return("ABC") } + end + + describe 'handling classes derived from String' do + it { is_expected.to run.with_params(AlsoString.new("ABC")).and_return("ABC") } + end + + describe 'strings in arrays handling' do + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(["One", "twO"]).and_return(["ONE", "TWO"]) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/uriescape_spec.rb b/environments/prod/modules/stdlib/spec/functions/uriescape_spec.rb new file mode 100755 index 0000000..f05ec08 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/uriescape_spec.rb @@ -0,0 +1,36 @@ +require 'spec_helper' + +describe 'uriescape' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + end + + describe 'handling normal strings' do + it 'should call ruby\'s URI.escape function' do + URI.expects(:escape).with('uri_string').returns('escaped_uri_string').once + is_expected.to run.with_params('uri_string').and_return('escaped_uri_string') + end + end + + describe 'handling classes derived from String' do + it 'should call ruby\'s URI.escape function' do + uri_string = AlsoString.new('uri_string') + URI.expects(:escape).with(uri_string).returns('escaped_uri_string').once + is_expected.to run.with_params(uri_string).and_return("escaped_uri_string") + end + end + + describe 'strings in arrays handling' do + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(["one}", "two"]).and_return(["one%7D", "two"]) } + it { is_expected.to run.with_params(["one}", 1, true, {}, "two"]).and_return(["one%7D", 1, true, {}, "two"]) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_absolute_path_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_absolute_path_spec.rb new file mode 100755 index 0000000..9397da5 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_absolute_path_spec.rb @@ -0,0 +1,73 @@ +require 'spec_helper' + +describe 'validate_absolute_path' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('c:/') + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + describe "valid paths handling" do + %w{ + C:/ + C:\\ + C:\\WINDOWS\\System32 + C:/windows/system32 + X:/foo/bar + X:\\foo\\bar + \\\\host\\windows + //host/windows + / + /var/tmp + /var/opt/../lib/puppet + }.each do |path| + it { is_expected.to run.with_params(path) } + it { is_expected.to run.with_params(['/tmp', path]) } + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + ].each do |path| + it { is_expected.to run.with_params(path).and_raise_error(Puppet::ParseError, /is not an absolute path/) } + it { is_expected.to run.with_params([path]).and_raise_error(Puppet::ParseError, /is not an absolute path/) } + it { is_expected.to run.with_params(['/tmp', path]).and_raise_error(Puppet::ParseError, /is not an absolute path/) } + end + end + + context 'relative paths' do + %w{ + relative1 + . + .. + ./foo + ../foo + etc/puppetlabs/puppet + opt/puppet/bin + relative\\windows + }.each do |path| + it { is_expected.to run.with_params(path).and_raise_error(Puppet::ParseError, /is not an absolute path/) } + it { is_expected.to run.with_params([path]).and_raise_error(Puppet::ParseError, /is not an absolute path/) } + it { is_expected.to run.with_params(['/tmp', path]).and_raise_error(Puppet::ParseError, /is not an absolute path/) } + end + end + end +end + diff --git a/environments/prod/modules/stdlib/spec/functions/validate_array_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_array_spec.rb new file mode 100755 index 0000000..409b3dc --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_array_spec.rb @@ -0,0 +1,37 @@ +require 'spec_helper' + +describe 'validate_array' do + + describe 'signature validation' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + it { is_expected.not_to eq(nil) } + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params([]) + end + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + describe 'valid inputs' do + it { is_expected.to run.with_params([]) } + it { is_expected.to run.with_params(['one']) } + it { is_expected.to run.with_params([], ['two']) } + it { is_expected.to run.with_params(['one'], ['two']) } + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params([], {}).and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params([], 1).and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params([], true).and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params([], 'one').and_raise_error(Puppet::ParseError, /is not an Array/) } + end + end +end + diff --git a/environments/prod/modules/stdlib/spec/functions/validate_augeas_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_augeas_spec.rb new file mode 100755 index 0000000..4236649 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_augeas_spec.rb @@ -0,0 +1,75 @@ +require 'spec_helper' + +describe 'validate_augeas' do + unless Puppet.features.augeas? + skip "ruby-augeas not installed" + else + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', '', [], '', 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one', 'one', 'MSG to User', '4th arg').and_raise_error(NoMethodError) } + end + + describe 'valid inputs' do + inputs = [ + [ "root:x:0:0:root:/root:/bin/bash\n", 'Passwd.lns' ], + [ "proc /proc proc nodev,noexec,nosuid 0 0\n", 'Fstab.lns'], + ] + + inputs.each do |input| + it { is_expected.to run.with_params(*input) } + end + end + + describe 'valid inputs which fail augeas validation' do + # The intent here is to make sure valid inputs raise exceptions when they + # don't specify an error message to display. This is the behvior in + # 2.2.x and prior. + inputs = [ + [ "root:x:0:0:root\n", 'Passwd.lns' ], + [ "127.0.1.1\n", 'Hosts.lns' ], + ] + + inputs.each do |input| + it { is_expected.to run.with_params(*input).and_raise_error(Puppet::ParseError, /validate_augeas.*?matched less than it should/) } + end + end + + describe "when specifying nice error messages" do + # The intent here is to make sure the function returns the 4th argument + # in the exception thrown + inputs = [ + [ "root:x:0:0:root\n", 'Passwd.lns', [], 'Failed to validate passwd content' ], + [ "127.0.1.1\n", 'Hosts.lns', [], 'Wrong hosts content' ], + ] + + inputs.each do |input| + it { is_expected.to run.with_params(*input).and_raise_error(Puppet::ParseError, /#{input[3]}/) } + end + end + + describe "matching additional tests" do + inputs = [ + [ "root:x:0:0:root:/root:/bin/bash\n", 'Passwd.lns', ['$file/foobar']], + [ "root:x:0:0:root:/root:/bin/bash\n", 'Passwd.lns', ['$file/root/shell[.="/bin/sh"]', 'foobar']], + ] + + inputs.each do |input| + it { is_expected.to run.with_params(*input) } + end + end + + describe "failing additional tests" do + inputs = [ + [ "foobar:x:0:0:root:/root:/bin/bash\n", 'Passwd.lns', ['$file/foobar']], + [ "root:x:0:0:root:/root:/bin/sh\n", 'Passwd.lns', ['$file/root/shell[.="/bin/sh"]', 'foobar']], + ] + + inputs.each do |input| + it { is_expected.to run.with_params(*input).and_raise_error(Puppet::ParseError, /testing path/) } + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_bool_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_bool_spec.rb new file mode 100755 index 0000000..3074d88 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_bool_spec.rb @@ -0,0 +1,36 @@ +require 'spec_helper' + +describe 'validate_bool' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(true) + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + describe 'acceptable values' do + it { is_expected.to run.with_params(true) } + it { is_expected.to run.with_params(false) } + it { is_expected.to run.with_params(true, false, false, true) } + end + + describe 'validation failures' do + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params(true, 'one').and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params('one', false).and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params("true").and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params("false").and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params(true, "false").and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params("true", false).and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params("true", false, false, false, false, false).and_raise_error(Puppet::ParseError, /is not a boolean/) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_cmd_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_cmd_spec.rb new file mode 100755 index 0000000..c6559e8 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_cmd_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'validate_cmd', :unless => Puppet::Util::Platform.windows? do + let(:touch) { File.exists?('/usr/bin/touch') ? '/usr/bin/touch' : '/bin/touch' } + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', '', '', 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending('should implement stricter type checking') + is_expected.to run.with_params([], '', '').and_raise_error(Puppet::ParseError, /content must be a string/) + } + it { + pending('should implement stricter type checking') + is_expected.to run.with_params('', [], '').and_raise_error(Puppet::ParseError, /checkscript must be a string/) + } + it { + pending('should implement stricter type checking') + is_expected.to run.with_params('', '', []).and_raise_error(Puppet::ParseError, /custom error message must be a string/) + } + end + + context 'when validation fails' do + context 'with % placeholder' do + it { is_expected.to run.with_params('', "#{touch} % /no/such/file").and_raise_error(Puppet::ParseError, /Execution of '#{touch} \S+ \/no\/such\/file' returned 1:.*(cannot touch|o such file or)/) } + it { is_expected.to run.with_params('', "#{touch} % /no/such/file", 'custom error').and_raise_error(Puppet::ParseError, /custom error/) } + end + context 'without % placeholder' do + it { is_expected.to run.with_params('', "#{touch} /no/such/file").and_raise_error(Puppet::ParseError, /Execution of '#{touch} \/no\/such\/file \S+' returned 1:.*(cannot touch|o such file or)/) } + it { is_expected.to run.with_params('', "#{touch} /no/such/file", 'custom error').and_raise_error(Puppet::ParseError, /custom error/) } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_email_address_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_email_address_spec.rb new file mode 100644 index 0000000..7628383 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_email_address_spec.rb @@ -0,0 +1,23 @@ +require 'spec_helper' + +describe 'validate_email_address' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + describe 'valid inputs' do + it { is_expected.to run.with_params('bob@gmail.com') } + it { is_expected.to run.with_params('alice+puppetlabs.com@gmail.com') } + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /is not a valid email/) } + it { is_expected.to run.with_params('bob@gmail.com', {}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('bob@gmail.com', true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('bob@gmail.com', 'one').and_raise_error(Puppet::ParseError, /is not a valid email/) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_hash_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_hash_spec.rb new file mode 100755 index 0000000..7533abe --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_hash_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'validate_hash' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + describe 'check for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params({'key' => 'value'}) + end + end + + describe 'valid inputs' do + it { is_expected.to run.with_params({}) } + it { is_expected.to run.with_params({'key' => 'value'}) } + it { is_expected.to run.with_params({}, {'key' => 'value'}) } + it { is_expected.to run.with_params({'key1' => 'value1'}, {'key2' => 'value2'}) } + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params({}, []).and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params({}, 1).and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params({}, true).and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params({}, 'one').and_raise_error(Puppet::ParseError, /is not a Hash/) } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_integer_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_integer_spec.rb new file mode 100755 index 0000000..6558d00 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_integer_spec.rb @@ -0,0 +1,101 @@ +require 'spec_helper' + +describe 'validate_integer' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(3) + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1, 2, 3, 4).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + [ true, 'true', false, 'false', 'iAmAString', '1test', '1 test', 'test 1', 'test 1 test', 7.0, -7.0, {}, { 'key' => 'value' }, { 1=> 2 }, '', :undef , 'x'].each do |invalid| + it { is_expected.to run.with_params(invalid).and_raise_error(Puppet::ParseError, /to be an Integer/) } + it { is_expected.to run.with_params(invalid, 10).and_raise_error(Puppet::ParseError, /to be an Integer/) } + it { is_expected.to run.with_params(invalid, 10, -10).and_raise_error(Puppet::ParseError, /to be an Integer/) } + it { is_expected.to run.with_params([0, 1, 2, invalid, 3, 4], 10, -10).and_raise_error(Puppet::ParseError, /to be an Integer/) } + end + + context 'when running on modern rubies', :unless => RUBY_VERSION == '1.8.7' do + it { is_expected.to run.with_params([0, 1, 2, {1=>2}, 3, 4], 10, -10).and_raise_error(Puppet::ParseError, /to be an Integer/) } + end + + context 'when running on ruby, which munges hashes weirdly', :if => RUBY_VERSION == '1.8.7' do + it { is_expected.to run.with_params([0, 1, 2, {1=>2}, 3, 4], 10, -10).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([0, 1, 2, {0=>2}, 3, 4], 10, -10).and_raise_error(Puppet::ParseError) } + end + + it { is_expected.to run.with_params(1, '').and_raise_error(Puppet::ParseError, /to be unset or an Integer/) } + it { is_expected.to run.with_params(1, 2, '').and_raise_error(Puppet::ParseError, /to be unset or an Integer/) } + it { is_expected.to run.with_params(1, 2, 3).and_raise_error(Puppet::ParseError, /second argument to be larger than third argument/) } + end + + context 'with no range constraints' do + it { is_expected.to run.with_params(1) } + it { is_expected.to run.with_params(-1) } + it { is_expected.to run.with_params('1') } + it { is_expected.to run.with_params('-1') } + it { is_expected.to run.with_params([1, 2, 3, 4]) } + it { is_expected.to run.with_params([1, '2', '3', 4]) } + end + + context "with a maximum limit of 10" do + describe 'rejects numbers greater than the limit' do + it { is_expected.to run.with_params(11, 10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(100, 10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(2**65, 10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params([1,2,10,100], 10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + end + + describe 'accepts numbers less or equal to the limit' do + it { is_expected.to run.with_params(10, 10) } + it { is_expected.to run.with_params(1, 10) } + it { is_expected.to run.with_params(-1, 10) } + it { is_expected.to run.with_params('1', 10) } + it { is_expected.to run.with_params('-1', 10) } + it { is_expected.to run.with_params([1, 2, 3, 4], 10) } + it { is_expected.to run.with_params([1, '2', '3', 4], 10) } + end + + context "with a minimum limit of -10" do + describe 'rejects numbers greater than the upper limit' do + it { is_expected.to run.with_params(11, 10, -10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(100, 10, -10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(2**65, 10, -10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params([1,2,10,100], 10, -10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + end + + describe 'rejects numbers smaller than the lower limit' do + it { is_expected.to run.with_params(-11, 10, -10).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + it { is_expected.to run.with_params(-100, 10, -10).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + it { is_expected.to run.with_params(-2**65, 10, -10).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + it { is_expected.to run.with_params([-10, 1,2,10,-100], 10, -10).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + end + + describe 'accepts numbers between and including the limits' do + it { is_expected.to run.with_params(10, 10, -10) } + it { is_expected.to run.with_params(-10, 10, -10) } + it { is_expected.to run.with_params(1, 10, -10) } + it { is_expected.to run.with_params(-1, 10, -10) } + it { is_expected.to run.with_params('1', 10, -10) } + it { is_expected.to run.with_params('-1', 10, -10) } + it { is_expected.to run.with_params([1, 2, 3, 4], 10, -10) } + it { is_expected.to run.with_params([1, '2', '3', 4], 10, -10) } + end + end + end + + it { is_expected.to run.with_params(10, 10, 10) } + + describe 'empty upper limit is interpreted as infinity' do + it { is_expected.to run.with_params(11, '', 10) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_ip_address_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_ip_address_spec.rb new file mode 100644 index 0000000..0414f5e --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_ip_address_spec.rb @@ -0,0 +1,65 @@ +require 'spec_helper' + +describe 'validate_ip_address' do + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + describe 'valid inputs' do + it { is_expected.to run.with_params('0.0.0.0') } + it { is_expected.to run.with_params('8.8.8.8') } + it { is_expected.to run.with_params('127.0.0.1') } + it { is_expected.to run.with_params('10.10.10.10') } + it { is_expected.to run.with_params('194.232.104.150') } + it { is_expected.to run.with_params('244.24.24.24') } + it { is_expected.to run.with_params('255.255.255.255') } + it { is_expected.to run.with_params('1.2.3.4', '5.6.7.8') } + it { is_expected.to run.with_params('3ffe:0505:0002::') } + it { is_expected.to run.with_params('3ffe:0505:0002::', '3ffe:0505:0002::2') } + it { is_expected.to run.with_params('::1/64') } + it { is_expected.to run.with_params('fe80::a00:27ff:fe94:44d6/64') } + + context 'Checking for deprecation warning', if: Puppet.version.to_f < 4.0 do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('1.2.3.4') + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params('1.2.3.4') + end + end + + context 'with netmasks' do + it { is_expected.to run.with_params('8.8.8.8/0') } + it { is_expected.to run.with_params('8.8.8.8/16') } + it { is_expected.to run.with_params('8.8.8.8/32') } + it { is_expected.to run.with_params('8.8.8.8/255.255.0.0') } + end + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /is not a valid IP/) } + it { is_expected.to run.with_params('0.0.0').and_raise_error(Puppet::ParseError, /is not a valid IP/) } + it { is_expected.to run.with_params('0.0.0.256').and_raise_error(Puppet::ParseError, /is not a valid IP/) } + it { is_expected.to run.with_params('0.0.0.0.0').and_raise_error(Puppet::ParseError, /is not a valid IP/) } + it { is_expected.to run.with_params('1.2.3.4', {}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('1.2.3.4', 1).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('1.2.3.4', true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('1.2.3.4', 'one').and_raise_error(Puppet::ParseError, /is not a valid IP/) } + it { is_expected.to run.with_params('::1', {}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('::1', true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('::1', 'one').and_raise_error(Puppet::ParseError, /is not a valid IP/) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_ipv4_address_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_ipv4_address_spec.rb new file mode 100755 index 0000000..6e4ca05 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_ipv4_address_spec.rb @@ -0,0 +1,41 @@ +require 'spec_helper' + +describe 'validate_ipv4_address' do + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + context 'Checking for deprecation warning', if: Puppet.version.to_f < 4.0 do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(SharedData::IPV4_PATTERNS.first) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(SharedData::IPV4_PATTERNS.first) + end + end + + SharedData::IPV4_PATTERNS.each do |value| + it { is_expected.to run.with_params(value) } + end + + SharedData::IPV4_NEGATIVE_PATTERNS.each do |value| + it { is_expected.to run.with_params(value).and_raise_error(Puppet::ParseError, /is not a valid IPv4/) } + end + + describe 'invalid inputs' do + [ {}, [], 1, true ].each do |invalid| + it { is_expected.to run.with_params(invalid).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(SharedData::IPV4_PATTERNS.first, invalid).and_raise_error(Puppet::ParseError, /is not a string/) } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_ipv6_address_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_ipv6_address_spec.rb new file mode 100755 index 0000000..137db36 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_ipv6_address_spec.rb @@ -0,0 +1,60 @@ +require 'spec_helper' + +describe 'validate_ipv6_address' do + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + context 'Checking for deprecation warning', if: Puppet.version.to_f < 4.0 do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('3ffe:0505:0002::') + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params('3ffe:0505:0002::') + end + end + + describe 'valid inputs' do + it { is_expected.to run.with_params('3ffe:0505:0002::') } + it { is_expected.to run.with_params('3ffe:0505:0002::', '3ffe:0505:0002::2') } + it { is_expected.to run.with_params('::1/64') } + it { is_expected.to run.with_params('fe80::a00:27ff:fe94:44d6/64') } + it { is_expected.to run.with_params('fe80:0000:0000:0000:0204:61ff:fe9d:f156') } + it { is_expected.to run.with_params('fe80:0:0:0:204:61ff:fe9d:f156') } + it { is_expected.to run.with_params('fe80::204:61ff:fe9d:f156') } + it { is_expected.to run.with_params('fe80:0:0:0:0204:61ff:254.157.241.86') } + it { is_expected.to run.with_params('::1') } + it { is_expected.to run.with_params('fe80::') } + it { is_expected.to run.with_params('2001::') } + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('0.0.0').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('0.0.0.256').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('0.0.0.0.0').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('::ffff:2.3.4').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('::ffff:257.1.2.3').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('::ffff:12345678901234567890.1.26').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('affe:beef').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('::1', {}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('::1', true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('::1', 'one').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + context 'unless running on ruby 1.8.7', :if => RUBY_VERSION != '1.8.7' do + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('::1', 1).and_raise_error(Puppet::ParseError, /is not a string/) } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_legacy_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_legacy_spec.rb new file mode 100644 index 0000000..7b48f12 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_legacy_spec.rb @@ -0,0 +1,68 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.4.0') >= 0 + describe 'validate_legacy' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params.and_raise_error(ArgumentError) } + + describe 'when passing the type assertion and passing the previous validation' do + before do + scope.expects(:function_validate_foo).with([5]).once + Puppet.expects(:notice).never + end + it 'passes without notice' do + is_expected.to run.with_params('Integer', 'validate_foo', 5) + end + end + + describe 'when passing the type assertion and failing the previous validation' do + before do + scope.expects(:function_validate_foo).with([5]).raises(Puppet::ParseError, 'foo').once + Puppet.expects(:notice).with(includes('Accepting previously invalid value for target type')) + end + it 'passes with a notice about newly accepted value' do + is_expected.to run.with_params('Integer', 'validate_foo', 5) + end + end + + describe 'when failing the type assertion and passing the previous validation' do + before do + scope.expects(:function_validate_foo).with(['5']).once + subject.func.expects(:call_function).with('deprecation', 'validate_legacy', includes('Integer')).once + end + it 'passes with a deprecation message' do + is_expected.to run.with_params('Integer', 'validate_foo', '5') + end + end + + describe 'when failing the type assertion and failing the previous validation' do + before do + scope.expects(:function_validate_foo).with(['5']).raises(Puppet::ParseError, 'foo').once + subject.func.expects(:call_function).with('fail', includes('Integer')).once + end + it 'fails with a helpful message' do + is_expected.to run.with_params('Integer', 'validate_foo', '5') + end + end + + describe 'when passing in undef' do + before do + scope.expects(:function_validate_foo).with([:undef]).once + Puppet.expects(:notice).never + end + it 'works' do + is_expected.to run.with_params('Optional[Integer]', 'validate_foo', :undef) + end + end + + describe 'when passing in multiple arguments' do + before do + scope.expects(:function_validate_foo).with([:undef, 1, 'foo']).once + Puppet.expects(:notice).never + end + it 'passes with a deprecation message' do + is_expected.to run.with_params('Optional[Integer]', 'validate_foo', :undef, 1, 'foo') + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_numeric_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_numeric_spec.rb new file mode 100755 index 0000000..4c0e24d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_numeric_spec.rb @@ -0,0 +1,100 @@ +require 'spec_helper' + +describe 'validate_numeric' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(3) + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1, 2, 3, 4).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + [ true, 'true', false, 'false', 'iAmAString', '1test', '1 test', 'test 1', 'test 1 test', {}, { 'key' => 'value' }, { 1=> 2 }, '', :undef , 'x'].each do |invalid| + it { is_expected.to run.with_params(invalid).and_raise_error(Puppet::ParseError, /to be a Numeric/) } + it { is_expected.to run.with_params(invalid, 10.0).and_raise_error(Puppet::ParseError, /to be a Numeric/) } + it { is_expected.to run.with_params(invalid, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be a Numeric/) } + end + + context 'when running on modern rubies', :unless => RUBY_VERSION == '1.8.7' do + it { is_expected.to run.with_params([0, 1, 2, {1=>2}, 3, 4], 10, -10).and_raise_error(Puppet::ParseError, /to be a Numeric/) } + end + + context 'when running on ruby, which munges hashes weirdly', :if => RUBY_VERSION == '1.8.7' do + it { is_expected.to run.with_params([0, 1, 2, {1=>2}, 3, 4], 10, -10).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([0, 1, 2, {0=>2}, 3, 4], 10, -10).and_raise_error(Puppet::ParseError) } + end + + it { is_expected.to run.with_params(1, '').and_raise_error(Puppet::ParseError, /to be unset or a Numeric/) } + it { is_expected.to run.with_params(1, 2, '').and_raise_error(Puppet::ParseError, /to be unset or a Numeric/) } + it { is_expected.to run.with_params(1, 2, 3).and_raise_error(Puppet::ParseError, /second argument to be larger than third argument/) } + end + + context 'with no range constraints' do + it { is_expected.to run.with_params(1) } + it { is_expected.to run.with_params(-1) } + it { is_expected.to run.with_params('1') } + it { is_expected.to run.with_params('-1') } + it { is_expected.to run.with_params([1, 2, 3, 4]) } + it { is_expected.to run.with_params([1, '2', '3', 4]) } + end + + context "with a maximum limit of 10.0" do + describe 'rejects numbers greater than the limit' do + it { is_expected.to run.with_params(11, 10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(100, 10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(2**65, 10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params([1,2,10.0,100], 10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + end + + describe 'accepts numbers less or equal to the limit' do + it { is_expected.to run.with_params(10.0, 10.0) } + it { is_expected.to run.with_params(1, 10.0) } + it { is_expected.to run.with_params(-1, 10.0) } + it { is_expected.to run.with_params('1', 10.0) } + it { is_expected.to run.with_params('-1', 10.0) } + it { is_expected.to run.with_params([1, 2, 3, 4], 10.0) } + it { is_expected.to run.with_params([1, '2', '3', 4], 10.0) } + end + + context "with a minimum limit of -10.0" do + describe 'rejects numbers greater than the upper limit' do + it { is_expected.to run.with_params(11, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(100, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(2**65, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params([1,2,10.0,100], 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + end + + describe 'rejects numbers smaller than the lower limit' do + it { is_expected.to run.with_params(-11, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + it { is_expected.to run.with_params(-100, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + it { is_expected.to run.with_params(-2**65, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + it { is_expected.to run.with_params([-10.0, 1,2,10.0,-100], 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + end + + describe 'accepts numbers between and including the limits' do + it { is_expected.to run.with_params(10.0, 10.0, -10.0) } + it { is_expected.to run.with_params(-10.0, 10.0, -10.0) } + it { is_expected.to run.with_params(1, 10.0, -10.0) } + it { is_expected.to run.with_params(-1, 10.0, -10.0) } + it { is_expected.to run.with_params('1', 10.0, -10.0) } + it { is_expected.to run.with_params('-1', 10.0, -10.0) } + it { is_expected.to run.with_params([1, 2, 3, 4], 10.0, -10.0) } + it { is_expected.to run.with_params([1, '2', '3', 4], 10.0, -10.0) } + end + end + end + + it { is_expected.to run.with_params(10.0, 10.0, 10.0) } + + describe 'empty upper limit is interpreted as infinity' do + it { is_expected.to run.with_params(11, '', 10.0) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_re_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_re_spec.rb new file mode 100755 index 0000000..3531182 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_re_spec.rb @@ -0,0 +1,56 @@ +require 'spec_helper' + +describe 'validate_re' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('', '') + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', '', '', 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + describe 'valid inputs' do + it { is_expected.to run.with_params('', '') } + it { is_expected.to run.with_params('', ['']) } + it { is_expected.to run.with_params('', [''], 'custom error') } + it { is_expected.to run.with_params('one', '^one') } + it { is_expected.to run.with_params('one', [ '^one', '^two' ]) } + it { is_expected.to run.with_params('one', [ '^one', '^two' ], 'custom error') } + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params('', []).and_raise_error(Puppet::ParseError, /does not match/) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /does not match/) } + it { is_expected.to run.with_params('', 'two').and_raise_error(Puppet::ParseError, /does not match/) } + it { is_expected.to run.with_params('', ['two']).and_raise_error(Puppet::ParseError, /does not match/) } + it { is_expected.to run.with_params('', ['two'], 'custom error').and_raise_error(Puppet::ParseError, /custom error/) } + it { is_expected.to run.with_params('notone', '^one').and_raise_error(Puppet::ParseError, /does not match/) } + it { is_expected.to run.with_params('notone', [ '^one', '^two' ]).and_raise_error(Puppet::ParseError, /does not match/) } + it { is_expected.to run.with_params('notone', [ '^one', '^two' ], 'custom error').and_raise_error(Puppet::ParseError, /custom error/) } + + describe 'non-string inputs' do + [ + 1, # Fixnum + 3.14, # Float + nil, # NilClass + true, # TrueClass + false, # FalseClass + ["10"], # Array + :key, # Symbol + {:key=>"val"}, # Hash + ].each do |input| + it { is_expected.to run.with_params(input, '.*').and_raise_error(Puppet::ParseError, /needs to be a String/) } + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_slength_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_slength_spec.rb new file mode 100755 index 0000000..e4162de --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_slength_spec.rb @@ -0,0 +1,72 @@ +require 'spec_helper' + +describe 'validate_slength' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('1234567890', 10) + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', 2, 3, 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /second argument to be a positive Numeric/) } + it { is_expected.to run.with_params('', -1).and_raise_error(Puppet::ParseError, /second argument to be a positive Numeric/) } + it { is_expected.to run.with_params('', 1, '').and_raise_error(Puppet::ParseError, /third argument to be unset or a positive Numeric/) } + it { is_expected.to run.with_params('', 1, -1).and_raise_error(Puppet::ParseError, /third argument to be unset or a positive Numeric/) } + it { is_expected.to run.with_params('', 1, 2).and_raise_error(Puppet::ParseError, /argument to be equal to or larger than third argument/) } + end + + context "with a maximum length of 10" do + describe 'rejects strings longer than the limit' do + it { is_expected.to run.with_params('1234567890a', 10).and_raise_error(Puppet::ParseError, /Expected length/) } + it { is_expected.to run.with_params('1234567890abcdef', 10).and_raise_error(Puppet::ParseError, /Expected length/) } + it { is_expected.to run.with_params([ 'one', '1234567890abcdef' ], 10).and_raise_error(Puppet::ParseError, /Expected length/) } + end + + describe 'accepts strings shorter or equal to the limit' do + it { is_expected.to run.with_params('1234567890', 10) } + it { is_expected.to run.with_params('12345', 10) } + it { is_expected.to run.with_params([ 'one', 'two' ], 10) } + end + + context "with a minimum length of 5" do + describe 'rejects strings longer than the upper limit' do + it { is_expected.to run.with_params('1234567890a', 10, 5).and_raise_error(Puppet::ParseError, /Expected length/) } + it { is_expected.to run.with_params('1234567890abcdef', 10, 5).and_raise_error(Puppet::ParseError, /Expected length/) } + end + + describe 'rejects numbers shorter than the lower limit' do + it { is_expected.to run.with_params('one', 10, 5).and_raise_error(Puppet::ParseError, /Expected length/) } + it { is_expected.to run.with_params(['12345678', 'two'], 10, 5).and_raise_error(Puppet::ParseError, /Expected length/) } + end + + describe 'accepts strings of length between and including the limits' do + it { is_expected.to run.with_params('12345', 10, 5) } + it { is_expected.to run.with_params('123456', 10, 5) } + it { is_expected.to run.with_params('1234567', 10, 5) } + it { is_expected.to run.with_params('12345678', 10, 5) } + it { is_expected.to run.with_params('123456789', 10, 5) } + it { is_expected.to run.with_params('1234567890', 10, 5) } + it { is_expected.to run.with_params(['1233456', '12345678'], 10, 5) } + end + end + end + + describe 'corner cases' do + it { pending('this should work'); is_expected.to run.with_params('', 0, 0) } + it { is_expected.to run.with_params('1234567890', 10, 10) } + end + + describe 'empty upper limit is interpreted as infinity' do + it { pending('not implemented'); is_expected.to run.with_params('1234567890ab', '', 10) } + it { pending('not implemented'); is_expected.to run.with_params('12345678', '', 10).and_raise_error(Puppet::ParseError, /Expected length/) } + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_string_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_string_spec.rb new file mode 100755 index 0000000..0907ede --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_string_spec.rb @@ -0,0 +1,33 @@ +require 'spec_helper' + +describe 'validate_string' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('', '') + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + describe 'valid inputs' do + it { is_expected.to run.with_params('') } + it { is_expected.to run.with_params(nil) } + it { is_expected.to run.with_params('one') } + it { is_expected.to run.with_params('one', 'two') } + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /is not a string/) } + end + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/validate_x509_rsa_key_pair_spec.rb b/environments/prod/modules/stdlib/spec/functions/validate_x509_rsa_key_pair_spec.rb new file mode 100755 index 0000000..eb63310 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/validate_x509_rsa_key_pair_spec.rb @@ -0,0 +1,180 @@ +require 'spec_helper' + +describe 'validate_x509_rsa_key_pair' do + + let(:valid_cert) do + < 'value' }).and_return(['value']) } + it 'should return the array of values' do + result = subject.call([{ 'key1' => 'value1', 'key2' => 'value2', 'duplicate_value_key' => 'value2' }]) + expect(result).to match_array(['value1', 'value2', 'value2']) + end + + it 'should run with UTF8 and double byte characters' do + result = subject.call([{ 'かぎ' => '使用', 'ҝĕұ' => '√ẩŀứệ', 'ҝĕұďŭрļǐçằťè' => '√ẩŀứệ' }]) + expect(result).to match_array(['使用', '√ẩŀứệ', '√ẩŀứệ']) + end +end diff --git a/environments/prod/modules/stdlib/spec/functions/zip_spec.rb b/environments/prod/modules/stdlib/spec/functions/zip_spec.rb new file mode 100755 index 0000000..e1ae8ee --- /dev/null +++ b/environments/prod/modules/stdlib/spec/functions/zip_spec.rb @@ -0,0 +1,21 @@ +require 'spec_helper' + +describe 'zip' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the third.") + is_expected.to run.with_params([], [], true, []).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params([], []).and_return([]) } + it { is_expected.to run.with_params([1,2,3], [4,5,6]).and_return([[1,4], [2,5], [3,6]]) } + it { is_expected.to run.with_params([1,2,3], [4,5,6], false).and_return([[1,4], [2,5], [3,6]]) } + it { is_expected.to run.with_params([1,2,3], [4,5,6], true).and_return([1, 4, 2, 5, 3, 6]) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params(['ầ', 'ь', 'ć'], ['đ', 'ề', 'ƒ']).and_return([['ầ','đ'], ['ь','ề'], ['ć', 'ƒ']]) } + it { is_expected.to run.with_params(['ペ', '含', '値'], ['ッ', '文', 'イ']).and_return([['ペ','ッ'], ['含','文'], ['値', 'イ']]) } + end +end + diff --git a/environments/prod/modules/stdlib/spec/monkey_patches/alias_should_to_must.rb b/environments/prod/modules/stdlib/spec/monkey_patches/alias_should_to_must.rb new file mode 100755 index 0000000..505e240 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/monkey_patches/alias_should_to_must.rb @@ -0,0 +1,9 @@ +#! /usr/bin/env ruby -S rspec +require 'rspec' + +class Object + # This is necessary because the RAL has a 'should' + # method. + alias :must :should + alias :must_not :should_not +end diff --git a/environments/prod/modules/stdlib/spec/monkey_patches/publicize_methods.rb b/environments/prod/modules/stdlib/spec/monkey_patches/publicize_methods.rb new file mode 100755 index 0000000..3ae59f9 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/monkey_patches/publicize_methods.rb @@ -0,0 +1,11 @@ +#! /usr/bin/env ruby -S rspec +# Some monkey-patching to allow us to test private methods. +class Class + def publicize_methods(*methods) + saved_private_instance_methods = methods.empty? ? self.private_instance_methods : methods + + self.class_eval { public(*saved_private_instance_methods) } + yield + self.class_eval { private(*saved_private_instance_methods) } + end +end diff --git a/environments/prod/modules/stdlib/spec/spec_helper.rb b/environments/prod/modules/stdlib/spec/spec_helper.rb new file mode 100755 index 0000000..22d5d68 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/spec_helper.rb @@ -0,0 +1,8 @@ +#This file is generated by ModuleSync, do not edit. +require 'puppetlabs_spec_helper/module_spec_helper' + +# put local configuration and setup into spec_helper_local +begin + require 'spec_helper_local' +rescue LoadError +end diff --git a/environments/prod/modules/stdlib/spec/spec_helper_acceptance.rb b/environments/prod/modules/stdlib/spec/spec_helper_acceptance.rb new file mode 100755 index 0000000..4d85e7d --- /dev/null +++ b/environments/prod/modules/stdlib/spec/spec_helper_acceptance.rb @@ -0,0 +1,55 @@ +#! /usr/bin/env ruby -S rspec +require 'puppet' +require 'beaker-rspec' +require 'beaker/puppet_install_helper' +require 'beaker/module_install_helper' + +run_puppet_install_helper +install_ca_certs unless ENV['PUPPET_INSTALL_TYPE'] =~ /pe/i +install_module_on(hosts) +install_module_dependencies_on(hosts) + +RSpec.configure do |c| + # Readable test descriptions + c.formatter = :documentation + + # Configure all nodes in nodeset + c.before :suite do + end +end + +def get_puppet_version + (on default, puppet('--version')).output.chomp +end + +RSpec.shared_context "with faked facts" do + let(:facts_d) do + puppet_version = get_puppet_version + if fact('osfamily') =~ /windows/i + if fact('kernelmajversion').to_f < 6.0 + 'C:/Documents and Settings/All Users/Application Data/PuppetLabs/facter/facts.d' + else + 'C:/ProgramData/PuppetLabs/facter/facts.d' + end + elsif Puppet::Util::Package.versioncmp(puppet_version, '4.0.0') < 0 and fact('is_pe', '--puppet') == "true" + '/etc/puppetlabs/facter/facts.d' + else + '/etc/facter/facts.d' + end + end + + before :each do + #No need to create on windows, PE creates by default + if fact('osfamily') !~ /windows/i + shell("mkdir -p '#{facts_d}'") + end + end + + after :each do + shell("rm -f '#{facts_d}/fqdn.txt'", :acceptable_exit_codes => [0,1]) + end + + def fake_fact(name, value) + shell("echo #{name}=#{value} > '#{facts_d}/#{name}.txt'") + end +end diff --git a/environments/prod/modules/stdlib/spec/spec_helper_local.rb b/environments/prod/modules/stdlib/spec/spec_helper_local.rb new file mode 100644 index 0000000..616490c --- /dev/null +++ b/environments/prod/modules/stdlib/spec/spec_helper_local.rb @@ -0,0 +1,31 @@ +# automatically load any shared examples or contexts +Dir["./spec/support/**/*.rb"].sort.each { |f| require f } + +# hack to enable all the expect syntax (like allow_any_instance_of) in rspec-puppet examples +RSpec::Mocks::Syntax.enable_expect(RSpec::Puppet::ManifestMatchers) + +RSpec.configure do |config| + # supply tests with a possibility to test for the future parser + config.add_setting :puppet_future + config.puppet_future = Puppet.version.to_f >= 4.0 + + config.before :each do + # Ensure that we don't accidentally cache facts and environment between + # test cases. This requires each example group to explicitly load the + # facts being exercised with something like + # Facter.collection.loader.load(:ipaddress) + Facter.clear + Facter.clear_messages + + RSpec::Mocks.setup + end + + config.after :each do + RSpec::Mocks.verify + RSpec::Mocks.teardown + end +end + +# Helper class to test handling of arguments which are derived from string +class AlsoString < String +end diff --git a/environments/prod/modules/stdlib/spec/support/shared_data.rb b/environments/prod/modules/stdlib/spec/support/shared_data.rb new file mode 100644 index 0000000..ea9b7a0 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/support/shared_data.rb @@ -0,0 +1,38 @@ +module SharedData + IPV4_PATTERNS = [ + '0.0.0.0', + '1.2.3.4', + '10.10.10.10', + '127.0.0.1', + '192.88.99.0', + '194.232.104.150', + '224.0.0.0', + '244.24.24.24', + '255.255.255.255', + '8.8.8.8', + '8.8.8.8/0', + '8.8.8.8/16', + '8.8.8.8/255.255.0.0', + '8.8.8.8/32', + ] + IPV4_NEGATIVE_PATTERNS = [ + '', + '0000', + '0.0.0.0.', + '0.0.0.0./0.0.0.0.', + '0.0.0.0./1', + '0.0.0.0.0', + '0.0.0.0/0.0.0.0.', + '0.0.0.256', + '0.0.0', + '1.2.3.4.5', + '1.2.3', + '10.010.10.10', + '2001:0db8:85a3:0000:0000:8a2e:0370:73342001:0db8:85a3:0000:0000:8a2e:0370:7334', + '4.4.4', + '77', + '9999.9999.9999.9999', + 'affe::beef', + 'nope', + ] +end diff --git a/environments/prod/modules/stdlib/spec/unit/ensure_resources_spec.rb b/environments/prod/modules/stdlib/spec/unit/ensure_resources_spec.rb new file mode 100644 index 0000000..aea723e --- /dev/null +++ b/environments/prod/modules/stdlib/spec/unit/ensure_resources_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' + +describe 'test::ensure_resources', type: :class do + let(:params) {{ resource_type: 'user', title_hash: title_param, attributes_hash: {'ensure' => 'present'} }} + + describe 'given a title hash of multiple resources' do + + let(:title_param) { {'dan' => { 'gid' => 'mygroup', 'uid' => '600' }, 'alex' => { 'gid' => 'mygroup', 'uid' => '700'}} } + + it { is_expected.to compile } + it { is_expected.to contain_user('dan').with({ 'gid' => 'mygroup', 'uid' => '600', 'ensure' => 'present'}) } + it { is_expected.to contain_user('alex').with({ 'gid' => 'mygroup', 'uid' => '700', 'ensure' => 'present'}) } + end + + describe 'given a title hash of a single resource' do + + let(:title_param) { {'dan' => { 'gid' => 'mygroup', 'uid' => '600' }} } + + it { is_expected.to compile } + it { is_expected.to contain_user('dan').with({ 'gid' => 'mygroup', 'uid' => '600', 'ensure' => 'present'}) } + end +end diff --git a/environments/prod/modules/stdlib/spec/unit/facter/facter_dot_d_spec.rb b/environments/prod/modules/stdlib/spec/unit/facter/facter_dot_d_spec.rb new file mode 100755 index 0000000..0afadb2 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/unit/facter/facter_dot_d_spec.rb @@ -0,0 +1,32 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'facter/facter_dot_d' + +describe Facter::Util::DotD do + + context 'returns a simple fact' do + before :each do + Facter.stubs(:version).returns('1.6.1') + subject.stubs(:entries).returns(['/etc/facter/facts.d/fake_fact.txt']) + File.stubs(:readlines).with('/etc/facter/facts.d/fake_fact.txt').returns(['fake_fact=fake fact']) + subject.create + end + + it 'should return successfully' do + expect(Facter.fact(:fake_fact).value).to eq('fake fact') + end + end + + context 'returns a fact with equals signs' do + before :each do + Facter.stubs(:version).returns('1.6.1') + subject.stubs(:entries).returns(['/etc/facter/facts.d/foo.txt']) + File.stubs(:readlines).with('/etc/facter/facts.d/foo.txt').returns(['foo=1+1=2']) + subject.create + end + + it 'should return successfully' do + expect(Facter.fact(:foo).value).to eq('1+1=2') + end + end +end diff --git a/environments/prod/modules/stdlib/spec/unit/facter/package_provider_spec.rb b/environments/prod/modules/stdlib/spec/unit/facter/package_provider_spec.rb new file mode 100644 index 0000000..3954faf --- /dev/null +++ b/environments/prod/modules/stdlib/spec/unit/facter/package_provider_spec.rb @@ -0,0 +1,44 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'puppet/type' +require 'puppet/type/package' + +describe 'package_provider', :type => :fact do + before { Facter.clear } + after { Facter.clear } + + ['4.2.2', '3.7.1 (Puppet Enterprise 3.2.1)'].each do |puppetversion| + describe "on puppet ''#{puppetversion}''" do + before :each do + Facter.stubs(:value).returns puppetversion + end + + context "darwin" do + it "should return pkgdmg" do + provider = Puppet::Type.type(:package).provider(:pkgdmg) + Puppet::Type.type(:package).stubs(:defaultprovider).returns provider + + expect(Facter.fact(:package_provider).value).to eq('pkgdmg') + end + end + + context "centos 7" do + it "should return yum" do + provider = Puppet::Type.type(:package).provider(:yum) + Puppet::Type.type(:package).stubs(:defaultprovider).returns provider + + expect(Facter.fact(:package_provider).value).to eq('yum') + end + end + + context "ubuntu" do + it "should return apt" do + provider = Puppet::Type.type(:package).provider(:apt) + Puppet::Type.type(:package).stubs(:defaultprovider).returns provider + + expect(Facter.fact(:package_provider).value).to eq('apt') + end + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/unit/facter/pe_version_spec.rb b/environments/prod/modules/stdlib/spec/unit/facter/pe_version_spec.rb new file mode 100755 index 0000000..c11a1cd --- /dev/null +++ b/environments/prod/modules/stdlib/spec/unit/facter/pe_version_spec.rb @@ -0,0 +1,88 @@ +#!/usr/bin/env rspec + +require 'spec_helper' + +describe "PE Version specs" do + before :each do + # Explicitly load the pe_version.rb file which contains generated facts + # that cannot be automatically loaded. Puppet 2.x implements + # Facter.collection.load while Facter 1.x markes Facter.collection.load as + # a private method. + if Facter.collection.respond_to? :load + Facter.collection.load(:pe_version) + else + Facter.collection.loader.load(:pe_version) + end + end + + context "When puppetversion is nil" do + before :each do + Facter.fact(:puppetversion).stubs(:value).returns(nil) + end + + it "pe_version is nil" do + expect(Facter.fact(:puppetversion).value).to be_nil + expect(Facter.fact(:pe_version).value).to be_nil + end + end + + context "If PE is installed" do + %w{ 2.6.1 2.10.300 }.each do |version| + puppetversion = "2.7.19 (Puppet Enterprise #{version})" + context "puppetversion => #{puppetversion}" do + before :each do + Facter.fact(:puppetversion).stubs(:value).returns(puppetversion) + end + + (major,minor,patch) = version.split(".") + + it "Should return true" do + expect(Facter.fact(:is_pe).value).to eq(true) + end + + it "Should have a version of #{version}" do + expect(Facter.fact(:pe_version).value).to eq(version) + end + + it "Should have a major version of #{major}" do + expect(Facter.fact(:pe_major_version).value).to eq(major) + end + + it "Should have a minor version of #{minor}" do + expect(Facter.fact(:pe_minor_version).value).to eq(minor) + end + + it "Should have a patch version of #{patch}" do + expect(Facter.fact(:pe_patch_version).value).to eq(patch) + end + end + end + end + + context "When PE is not installed" do + before :each do + Facter.fact(:puppetversion).stubs(:value).returns("2.7.19") + end + + it "is_pe is false" do + expect(Facter.fact(:is_pe).value).to eq(false) + end + + it "pe_version is nil" do + expect(Facter.fact(:pe_version).value).to be_nil + end + + it "pe_major_version is nil" do + expect(Facter.fact(:pe_major_version).value).to be_nil + end + + it "pe_minor_version is nil" do + expect(Facter.fact(:pe_minor_version).value).to be_nil + end + + it "Should have a patch version" do + expect(Facter.fact(:pe_patch_version).value).to be_nil + end + end + +end diff --git a/environments/prod/modules/stdlib/spec/unit/facter/root_home_spec.rb b/environments/prod/modules/stdlib/spec/unit/facter/root_home_spec.rb new file mode 100755 index 0000000..a5c2846 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/unit/facter/root_home_spec.rb @@ -0,0 +1,65 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'facter/root_home' + +describe Facter::Util::RootHome do + context "solaris" do + let(:root_ent) { "root:x:0:0:Super-User:/:/sbin/sh" } + let(:expected_root_home) { "/" } + + it "should return /" do + Facter::Util::Resolution.expects(:exec).with("getent passwd root").returns(root_ent) + expect(Facter::Util::RootHome.get_root_home).to eq(expected_root_home) + end + end + context "linux" do + let(:root_ent) { "root:x:0:0:root:/root:/bin/bash" } + let(:expected_root_home) { "/root" } + + it "should return /root" do + Facter::Util::Resolution.expects(:exec).with("getent passwd root").returns(root_ent) + expect(Facter::Util::RootHome.get_root_home).to eq(expected_root_home) + end + end + context "windows" do + before :each do + Facter::Util::Resolution.expects(:exec).with("getent passwd root").returns(nil) + end + it "should be nil on windows" do + expect(Facter::Util::RootHome.get_root_home).to be_nil + end + end +end + +describe 'root_home', :type => :fact do + before { Facter.clear } + after { Facter.clear } + + context "macosx" do + before do + Facter.fact(:kernel).stubs(:value).returns("Darwin") + Facter.fact(:osfamily).stubs(:value).returns("Darwin") + end + let(:expected_root_home) { "/var/root" } + sample_dscacheutil = File.read(fixtures('dscacheutil','root')) + + it "should return /var/root" do + Facter::Util::Resolution.stubs(:exec).with("dscacheutil -q user -a name root").returns(sample_dscacheutil) + expect(Facter.fact(:root_home).value).to eq(expected_root_home) + end + end + + context "aix" do + before do + Facter.fact(:kernel).stubs(:value).returns("AIX") + Facter.fact(:osfamily).stubs(:value).returns("AIX") + end + let(:expected_root_home) { "/root" } + sample_lsuser = File.read(fixtures('lsuser','root')) + + it "should return /root" do + Facter::Util::Resolution.stubs(:exec).with("lsuser -c -a home root").returns(sample_lsuser) + expect(Facter.fact(:root_home).value).to eq(expected_root_home) + end + end +end diff --git a/environments/prod/modules/stdlib/spec/unit/facter/service_provider_spec.rb b/environments/prod/modules/stdlib/spec/unit/facter/service_provider_spec.rb new file mode 100644 index 0000000..ad8a5fc --- /dev/null +++ b/environments/prod/modules/stdlib/spec/unit/facter/service_provider_spec.rb @@ -0,0 +1,37 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'puppet/type' +require 'puppet/type/service' + +describe 'service_provider', :type => :fact do + before { Facter.clear } + after { Facter.clear } + + context "macosx" do + it "should return launchd" do + provider = Puppet::Type.type(:service).provider(:launchd) + Puppet::Type.type(:service).stubs(:defaultprovider).returns provider + + expect(Facter.fact(:service_provider).value).to eq('launchd') + end + end + + context "systemd" do + it "should return systemd" do + provider = Puppet::Type.type(:service).provider(:systemd) + Puppet::Type.type(:service).stubs(:defaultprovider).returns provider + + expect(Facter.fact(:service_provider).value).to eq('systemd') + end + end + + context "redhat" do + it "should return redhat" do + provider = Puppet::Type.type(:service).provider(:redhat) + Puppet::Type.type(:service).stubs(:defaultprovider).returns provider + + expect(Facter.fact(:service_provider).value).to eq('redhat') + end + end + +end diff --git a/environments/prod/modules/stdlib/spec/unit/facter/util/puppet_settings_spec.rb b/environments/prod/modules/stdlib/spec/unit/facter/util/puppet_settings_spec.rb new file mode 100755 index 0000000..c278b79 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/unit/facter/util/puppet_settings_spec.rb @@ -0,0 +1,37 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'facter/util/puppet_settings' + +describe Facter::Util::PuppetSettings do + + describe "#with_puppet" do + context "Without Puppet loaded" do + before(:each) do + Module.expects(:const_get).with("Puppet").raises(NameError) + end + + it 'should be nil' do + expect(subject.with_puppet { Puppet[:vardir] }).to be_nil + end + it 'should not yield to the block' do + Puppet.expects(:[]).never + expect(subject.with_puppet { Puppet[:vardir] }).to be_nil + end + end + context "With Puppet loaded" do + module Puppet; end + let(:vardir) { "/var/lib/puppet" } + + before :each do + Puppet.expects(:[]).with(:vardir).returns vardir + end + + it 'should yield to the block' do + subject.with_puppet { Puppet[:vardir] } + end + it 'should return the nodes vardir' do + expect(subject.with_puppet { Puppet[:vardir] }).to eq vardir + end + end + end +end diff --git a/environments/prod/modules/stdlib/spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb b/environments/prod/modules/stdlib/spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb new file mode 100644 index 0000000..b162127 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb @@ -0,0 +1,69 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' + +describe "the enclose_ipv6 function" do + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + it "should exist" do + expect(Puppet::Parser::Functions.function("enclose_ipv6")).to eq("function_enclose_ipv6") + end + + it "should raise a ParseError if there is less than 1 arguments" do + expect { scope.function_enclose_ipv6([]) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError if there is more than 1 arguments" do + expect { scope.function_enclose_ipv6(['argument1','argument2']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError when given garbage" do + expect { scope.function_enclose_ipv6(['garbage']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError when given something else than a string or an array" do + expect { scope.function_enclose_ipv6([['1' => '127.0.0.1']]) }.to( raise_error(Puppet::ParseError) ) + end + + it "should not raise a ParseError when given a single ip string" do + expect { scope.function_enclose_ipv6(['127.0.0.1']) }.to_not raise_error + end + + it "should not raise a ParseError when given * as ip string" do + expect { scope.function_enclose_ipv6(['*']) }.to_not raise_error + end + + it "should not raise a ParseError when given an array of ip strings" do + expect { scope.function_enclose_ipv6([['127.0.0.1','fe80::1']]) }.to_not raise_error + end + + it "should not raise a ParseError when given differently notations of ip addresses" do + expect { scope.function_enclose_ipv6([['127.0.0.1','fe80::1','[fe80::1]']]) }.to_not raise_error + end + + it "should raise a ParseError when given a wrong ipv4 address" do + expect { scope.function_enclose_ipv6(['127..0.0.1']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError when given a ipv4 address with square brackets" do + expect { scope.function_enclose_ipv6(['[127.0.0.1]']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError when given a wrong ipv6 address" do + expect { scope.function_enclose_ipv6(['fe80:::1']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should embrace ipv6 adresses within an array of ip addresses" do + result = scope.function_enclose_ipv6([['127.0.0.1','fe80::1','[fe80::2]']]) + expect(result).to(eq(['127.0.0.1','[fe80::1]','[fe80::2]'])) + end + + it "should embrace a single ipv6 adresse" do + result = scope.function_enclose_ipv6(['fe80::1']) + expect(result).to(eq(['[fe80::1]'])) + end + + it "should not embrace a single ipv4 adresse" do + result = scope.function_enclose_ipv6(['127.0.0.1']) + expect(result).to(eq(['127.0.0.1'])) + end +end diff --git a/environments/prod/modules/stdlib/spec/unit/puppet/parser/functions/is_absolute_path_spec.rb b/environments/prod/modules/stdlib/spec/unit/puppet/parser/functions/is_absolute_path_spec.rb new file mode 100644 index 0000000..8931208 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/unit/puppet/parser/functions/is_absolute_path_spec.rb @@ -0,0 +1,86 @@ +require 'spec_helper' + +describe :is_absolute_path do + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + let(:function_args) do + [] + end + + let(:function) do + scope.function_is_absolute_path(function_args) + end + + + describe 'validate arity' do + let(:function_args) do + [1,2] + end + it "should raise a ParseError if there is more than 1 arguments" do + lambda { function }.should( raise_error(ArgumentError)) + end + + end + + it "should exist" do + Puppet::Parser::Functions.function(subject).should == "function_#{subject}" + end + + # help enforce good function defination + it 'should contain arity' do + + end + + it "should raise a ParseError if there is less than 1 arguments" do + lambda { function }.should( raise_error(ArgumentError)) + end + + + describe 'should retrun true' do + let(:return_value) do + true + end + + describe 'windows' do + let(:function_args) do + ['c:\temp\test.txt'] + end + it 'should return data' do + function.should eq(return_value) + end + end + + describe 'non-windows' do + let(:function_args) do + ['/temp/test.txt'] + end + + it 'should return data' do + function.should eq(return_value) + end + end + end + + describe 'should return false' do + let(:return_value) do + false + end + describe 'windows' do + let(:function_args) do + ['..\temp\test.txt'] + end + it 'should return data' do + function.should eq(return_value) + end + end + + describe 'non-windows' do + let(:function_args) do + ['../var/lib/puppet'] + end + it 'should return data' do + function.should eq(return_value) + end + end + end +end \ No newline at end of file diff --git a/environments/prod/modules/stdlib/spec/unit/puppet/provider/file_line/ruby_spec.rb b/environments/prod/modules/stdlib/spec/unit/puppet/provider/file_line/ruby_spec.rb new file mode 100755 index 0000000..1f41f62 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/unit/puppet/provider/file_line/ruby_spec.rb @@ -0,0 +1,447 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'tempfile' +provider_class = Puppet::Type.type(:file_line).provider(:ruby) +describe provider_class do + context "when adding" do + let :tmpfile do + tmp = Tempfile.new('tmp') + path = tmp.path + tmp.close! + path + end + let :resource do + Puppet::Type::File_line.new( + {:name => 'foo', :path => tmpfile, :line => 'foo'} + ) + end + let :provider do + provider_class.new(resource) + end + + it 'should detect if the line exists in the file' do + File.open(tmpfile, 'w') do |fh| + fh.write('foo') + end + expect(provider.exists?).to be_truthy + end + it 'should detect if the line does not exist in the file' do + File.open(tmpfile, 'w') do |fh| + fh.write('foo1') + end + expect(provider.exists?).to be_nil + end + it 'should append to an existing file when creating' do + provider.create + expect(File.read(tmpfile).chomp).to eq('foo') + end + end + context 'when using replace' do + before :each do + # TODO: these should be ported over to use the PuppetLabs spec_helper + # file fixtures once the following pull request has been merged: + # https://github.com/puppetlabs/puppetlabs-stdlib/pull/73/files + tmp = Tempfile.new('tmp') + @tmpfile = tmp.path + tmp.close! + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo = bar', + :match => '^foo\s*=.*$', + :replace => false, + } + ) + @provider = provider_class.new(@resource) + end + + it 'should not replace the matching line' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo=blah\nfoo2\nfoo3") + end + expect(@provider.exists?).to be_truthy + @provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\nfoo=blah\nfoo2\nfoo3") + end + + it 'should append the line if no matches are found' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo2") + end + expect(@provider.exists?).to be_nil + @provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\nfoo2\nfoo = bar") + end + + it 'should raise an error with invalid values' do + expect { + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo = bar', + :match => '^foo\s*=.*$', + :replace => 'asgadga', + } + ) + }.to raise_error(Puppet::Error, /Invalid value "asgadga"\. Valid values are true, false\./) + end + end + context "when matching" do + before :each do + # TODO: these should be ported over to use the PuppetLabs spec_helper + # file fixtures once the following pull request has been merged: + # https://github.com/puppetlabs/puppetlabs-stdlib/pull/73/files + tmp = Tempfile.new('tmp') + @tmpfile = tmp.path + tmp.close! + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo = bar', + :match => '^foo\s*=.*$', + } + ) + @provider = provider_class.new(@resource) + end + + describe 'using match' do + it 'should raise an error if more than one line matches, and should not have modified the file' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo=blah\nfoo2\nfoo=baz") + end + expect(@provider.exists?).to be_nil + expect { @provider.create }.to raise_error(Puppet::Error, /More than one line.*matches/) + expect(File.read(@tmpfile)).to eql("foo1\nfoo=blah\nfoo2\nfoo=baz") + end + + it 'should replace all lines that matches' do + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo = bar', + :match => '^foo\s*=.*$', + :multiple => true, + } + ) + @provider = provider_class.new(@resource) + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo=blah\nfoo2\nfoo=baz") + end + expect(@provider.exists?).to be_nil + @provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\nfoo = bar\nfoo2\nfoo = bar") + end + + it 'should raise an error with invalid values' do + expect { + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo = bar', + :match => '^foo\s*=.*$', + :multiple => 'asgadga', + } + ) + }.to raise_error(Puppet::Error, /Invalid value "asgadga"\. Valid values are true, false\./) + end + + it 'should replace a line that matches' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo=blah\nfoo2") + end + expect(@provider.exists?).to be_nil + @provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\nfoo = bar\nfoo2") + end + it 'should add a new line if no lines match' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo2") + end + expect(@provider.exists?).to be_nil + @provider.create + expect(File.read(@tmpfile)).to eql("foo1\nfoo2\nfoo = bar\n") + end + it 'should do nothing if the exact line already exists' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo = bar\nfoo2") + end + expect(@provider.exists?).to be_truthy + @provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\nfoo = bar\nfoo2") + end + end + + describe 'using after' do + let :resource do + Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'inserted = line', + :after => '^foo1', + } + ) + end + + let :provider do + provider_class.new(resource) + end + context 'match and after set' do + shared_context 'resource_create' do + let(:match) { '^foo2$' } + let(:after) { '^foo1$' } + let(:resource) { + Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'inserted = line', + :after => after, + :match => match, + } + ) + } + end + before :each do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo2\nfoo = baz") + end + end + describe 'inserts at match' do + include_context 'resource_create' + it { + provider.create + expect(File.read(@tmpfile).chomp).to eq("foo1\ninserted = line\nfoo = baz") + } + end + describe 'inserts a new line after when no match' do + include_context 'resource_create' do + let(:match) { '^nevergoingtomatch$' } + end + it { + provider.create + expect(File.read(@tmpfile).chomp).to eq("foo1\ninserted = line\nfoo2\nfoo = baz") + } + end + describe 'append to end of file if no match for both after and match' do + include_context 'resource_create' do + let(:match) { '^nevergoingtomatch$' } + let(:after) { '^stillneverafter' } + end + it { + provider.create + expect(File.read(@tmpfile).chomp).to eq("foo1\nfoo2\nfoo = baz\ninserted = line") + } + end + end + context 'with one line matching the after expression' do + before :each do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo = blah\nfoo2\nfoo = baz") + end + end + + it 'inserts the specified line after the line matching the "after" expression' do + provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\ninserted = line\nfoo = blah\nfoo2\nfoo = baz") + end + end + + context 'with multiple lines matching the after expression' do + before :each do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo = blah\nfoo2\nfoo1\nfoo = baz") + end + end + + it 'errors out stating "One or no line must match the pattern"' do + expect { provider.create }.to raise_error(Puppet::Error, /One or no line must match the pattern/) + end + + it 'adds the line after all lines matching the after expression' do + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'inserted = line', + :after => '^foo1$', + :multiple => true, + } + ) + @provider = provider_class.new(@resource) + expect(@provider.exists?).to be_nil + @provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\ninserted = line\nfoo = blah\nfoo2\nfoo1\ninserted = line\nfoo = baz") + end + end + + context 'with no lines matching the after expression' do + let :content do + "foo3\nfoo = blah\nfoo2\nfoo = baz\n" + end + + before :each do + File.open(@tmpfile, 'w') do |fh| + fh.write(content) + end + end + + it 'appends the specified line to the file' do + provider.create + expect(File.read(@tmpfile)).to eq(content << resource[:line] << "\n") + end + end + end + end + + context "when removing" do + before :each do + # TODO: these should be ported over to use the PuppetLabs spec_helper + # file fixtures once the following pull request has been merged: + # https://github.com/puppetlabs/puppetlabs-stdlib/pull/73/files + tmp = Tempfile.new('tmp') + @tmpfile = tmp.path + tmp.close! + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo', + :ensure => 'absent', + } + ) + @provider = provider_class.new(@resource) + end + it 'should remove the line if it exists' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo2") + end + + it 'should remove the line without touching the last new line' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2\n") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo2\n") + end + + it 'should remove any occurence of the line' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2\nfoo\nfoo") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo2\n") + end + end + + context "when removing with a match" do + before :each do + # TODO: these should be ported over to use the PuppetLabs spec_helper + # file fixtures once the following pull request has been merged: + # https://github.com/puppetlabs/puppetlabs-stdlib/pull/73/files + tmp = Tempfile.new('tmp') + @tmpfile = tmp.path + tmp.close! + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo2', + :ensure => 'absent', + :match => 'o$', + :match_for_absence => true, + } + ) + @provider = provider_class.new(@resource) + end + + it 'should find a line to match' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2") + end + expect(@provider.exists?).to be_truthy + end + + it 'should remove one line if it matches' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo2") + end + + it 'should raise an error if more than one line matches' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2\nfoo\nfoo") + end + expect { @provider.destroy }.to raise_error(Puppet::Error, /More than one line/) + end + + it 'should remove multiple lines if :multiple is true' do + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo2', + :ensure => 'absent', + :match => 'o$', + :multiple => true, + :match_for_absence => true, + } + ) + @provider = provider_class.new(@resource) + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2\nfoo\nfoo") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo2\n") + end + + it 'should ignore the match if match_for_absence is not specified' do + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo2', + :ensure => 'absent', + :match => 'o$', + } + ) + @provider = provider_class.new(@resource) + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo\n") + end + + it 'should ignore the match if match_for_absence is false' do + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo2', + :ensure => 'absent', + :match => 'o$', + :match_for_absence => false, + } + ) + @provider = provider_class.new(@resource) + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo\n") + end + + end + +end diff --git a/environments/prod/modules/stdlib/spec/unit/puppet/type/anchor_spec.rb b/environments/prod/modules/stdlib/spec/unit/puppet/type/anchor_spec.rb new file mode 100755 index 0000000..c738a27 --- /dev/null +++ b/environments/prod/modules/stdlib/spec/unit/puppet/type/anchor_spec.rb @@ -0,0 +1,11 @@ +#!/usr/bin/env ruby + +require 'spec_helper' + +anchor = Puppet::Type.type(:anchor).new(:name => "ntp::begin") + +describe anchor do + it "should stringify normally" do + expect(anchor.to_s).to eq("Anchor[ntp::begin]") + end +end diff --git a/environments/prod/modules/stdlib/spec/unit/puppet/type/file_line_spec.rb b/environments/prod/modules/stdlib/spec/unit/puppet/type/file_line_spec.rb new file mode 100755 index 0000000..150149b --- /dev/null +++ b/environments/prod/modules/stdlib/spec/unit/puppet/type/file_line_spec.rb @@ -0,0 +1,113 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'tempfile' +describe Puppet::Type.type(:file_line) do + let :tmp_path do + if Puppet::Util::Platform.windows? + 'C:\tmp\path' + else + '/tmp/path' + end + end + let :my_path do + if Puppet::Util::Platform.windows? + 'C:\my\path' + else + '/my/path' + end + end + let :file_line do + Puppet::Type.type(:file_line).new(:name => 'foo', :line => 'line', :path => tmp_path) + end + it 'should accept a line and path' do + file_line[:line] = 'my_line' + expect(file_line[:line]).to eq('my_line') + file_line[:path] = my_path + expect(file_line[:path]).to eq(my_path) + end + it 'should accept a match regex' do + file_line[:match] = '^foo.*$' + expect(file_line[:match]).to eq('^foo.*$') + end + it 'should accept a match regex that does not match the specified line' do + expect { + Puppet::Type.type(:file_line).new( + :name => 'foo', + :path => my_path, + :line => 'foo=bar', + :match => '^bar=blah$' + )}.not_to raise_error + end + it 'should accept a match regex that does match the specified line' do + expect { + Puppet::Type.type(:file_line).new( + :name => 'foo', + :path => my_path, + :line => 'foo=bar', + :match => '^\s*foo=.*$' + )}.not_to raise_error + end + it 'should accept utf8 characters' do + expect { + Puppet::Type.type(:file_line).new( + :name => 'ƒồỗ', + :path => my_path, + :line => 'ƒồỗ=ьåя', + :match => '^ьåя=βļάħ$' + )}.not_to raise_error + end + it 'should accept double byte characters' do + expect { + Puppet::Type.type(:file_line).new( + :name => 'フーバー', + :path => my_path, + :line => 'この=それ', + :match => '^この=ああ$' + )}.not_to raise_error + end + it 'should accept posix filenames' do + file_line[:path] = tmp_path + expect(file_line[:path]).to eq(tmp_path) + end + it 'should not accept unqualified path' do + expect { file_line[:path] = 'file' }.to raise_error(Puppet::Error, /File paths must be fully qualified/) + end + it 'should require that a line is specified' do + expect { Puppet::Type.type(:file_line).new(:name => 'foo', :path => tmp_path) }.to raise_error(Puppet::Error, /line is a required attribute/) + end + it 'should not require that a line is specified when matching for absence' do + expect { Puppet::Type.type(:file_line).new(:name => 'foo', :path => tmp_path, :ensure => :absent, :match_for_absence => :true, :match => 'match') }.not_to raise_error + end + it 'should require that a file is specified' do + expect { Puppet::Type.type(:file_line).new(:name => 'foo', :line => 'path') }.to raise_error(Puppet::Error, /path is a required attribute/) + end + it 'should default to ensure => present' do + expect(file_line[:ensure]).to eq :present + end + it 'should default to replace => true' do + expect(file_line[:replace]).to eq :true + end + it 'should default to encoding => UTF-8' do + expect(file_line[:encoding]).to eq 'UTF-8' + end + it 'should accept encoding => iso-8859-1' do + expect { Puppet::Type.type(:file_line).new(:name => 'foo', :path => tmp_path, :ensure => :present, :encoding => 'iso-8859-1', :line => 'bar') }.not_to raise_error + end + it "should autorequire the file it manages" do + catalog = Puppet::Resource::Catalog.new + file = Puppet::Type.type(:file).new(:name => tmp_path) + catalog.add_resource file + catalog.add_resource file_line + + relationship = file_line.autorequire.find do |rel| + (rel.source.to_s == "File[#{tmp_path}]") and (rel.target.to_s == file_line.to_s) + end + expect(relationship).to be_a Puppet::Relationship + end + + it "should not autorequire the file it manages if it is not managed" do + catalog = Puppet::Resource::Catalog.new + catalog.add_resource file_line + expect(file_line.autorequire).to be_empty + end +end diff --git a/environments/prod/modules/stdlib/types/absolutepath.pp b/environments/prod/modules/stdlib/types/absolutepath.pp new file mode 100644 index 0000000..70ec916 --- /dev/null +++ b/environments/prod/modules/stdlib/types/absolutepath.pp @@ -0,0 +1,2 @@ +# A strict absolutepath type +type Stdlib::Absolutepath = Variant[Stdlib::Windowspath, Stdlib::Unixpath] diff --git a/environments/prod/modules/stdlib/types/compat/absolute_path.pp b/environments/prod/modules/stdlib/types/compat/absolute_path.pp new file mode 100644 index 0000000..d11784e --- /dev/null +++ b/environments/prod/modules/stdlib/types/compat/absolute_path.pp @@ -0,0 +1,7 @@ +# Emulate the is_absolute_path and validate_absolute_path functions +# +# The first pattern is originally from is_absolute_path, which had it from 2.7.x's lib/puppet/util.rb Puppet::Util.absolute_path? +# slash = '[\\\\/]' +# name = '[^\\\\/]+' +# %r!^(([A-Z]:#{slash})|(#{slash}#{slash}#{name}#{slash}#{name})|(#{slash}#{slash}\?#{slash}#{name}))!i, +type Stdlib::Compat::Absolute_path = Variant[Pattern[/^(([a-zA-Z]:[\\\/])|([\\\/][\\\/][^\\\/]+[\\\/][^\\\/]+)|([\\\/][\\\/]\?[\\\/][^\\\/]+))/], Pattern[/^\//]] diff --git a/environments/prod/modules/stdlib/types/compat/array.pp b/environments/prod/modules/stdlib/types/compat/array.pp new file mode 100644 index 0000000..ba65dc4 --- /dev/null +++ b/environments/prod/modules/stdlib/types/compat/array.pp @@ -0,0 +1,2 @@ +# Emulate the is_array and validate_array functions +type Stdlib::Compat::Array = Array[Any] diff --git a/environments/prod/modules/stdlib/types/compat/bool.pp b/environments/prod/modules/stdlib/types/compat/bool.pp new file mode 100644 index 0000000..5d8e27e --- /dev/null +++ b/environments/prod/modules/stdlib/types/compat/bool.pp @@ -0,0 +1,2 @@ +# Emulate the is_bool and validate_bool functions +type Stdlib::Compat::Bool = Boolean diff --git a/environments/prod/modules/stdlib/types/compat/float.pp b/environments/prod/modules/stdlib/types/compat/float.pp new file mode 100644 index 0000000..7f98bd2 --- /dev/null +++ b/environments/prod/modules/stdlib/types/compat/float.pp @@ -0,0 +1,19 @@ +# Emulate the is_float function +# The regex is what's currently used in is_float +# To keep your development moving forward, you can also add a deprecation warning using the Integer type: +# +# ```class example($value) { validate_float($value,) }``` +# +# would turn into +# +# ``` +# class example(Stdlib::Compat::Float $value) { +# validate_float($value, 10, 0) +# assert_type(Integer[0, 10], $value) |$expected, $actual| { +# warning("The 'value' parameter for the 'ntp' class has type ${actual}, but should be ${expected}.") +# } +# } +# ``` +# +# This allows you to find all places where a consumers of your code call it with unexpected values. +type Stdlib::Compat::Float = Variant[Float, Pattern[/^-?(?:(?:[1-9]\d*)|0)(?:\.\d+)(?:[eE]-?\d+)?$/]] diff --git a/environments/prod/modules/stdlib/types/compat/hash.pp b/environments/prod/modules/stdlib/types/compat/hash.pp new file mode 100644 index 0000000..e84a10b --- /dev/null +++ b/environments/prod/modules/stdlib/types/compat/hash.pp @@ -0,0 +1,2 @@ +# Emulate the is_hash and validate_hash functions +type Stdlib::Compat::Hash = Hash[Any, Any] diff --git a/environments/prod/modules/stdlib/types/compat/integer.pp b/environments/prod/modules/stdlib/types/compat/integer.pp new file mode 100644 index 0000000..e5cadb6 --- /dev/null +++ b/environments/prod/modules/stdlib/types/compat/integer.pp @@ -0,0 +1,23 @@ +# Emulate the is_integer and validate_integer functions +# The regex is what's currently used in is_integer +# validate_numeric also allows range checking, which cannot be mapped to the string parsing inside the function. +# For full backwards compatibility, you will need to keep the validate_numeric call around to catch everything. +# To keep your development moving forward, you can also add a deprecation warning using the Integer type: +# +# ```class example($value) { validate_integer($value, 10, 0) }``` +# +# would turn into +# +# ``` +# class example(Stdlib::Compat::Integer $value) { +# validate_numeric($value, 10, 0) +# assert_type(Integer[0, 10], $value) |$expected, $actual| { +# warning("The 'value' parameter for the 'ntp' class has type ${actual}, but should be ${expected}.") +# } +# } +# ``` +# +# > Note that you need to use Variant[Integer[0, 10], Float[0, 10]] if you want to match both integers and floating point numbers. +# +# This allows you to find all places where a consumers of your code call it with unexpected values. +type Stdlib::Compat::Integer = Variant[Integer, Pattern[/^-?(?:(?:[1-9]\d*)|0)$/], Array[Variant[Integer, Pattern[/^-?(?:(?:[1-9]\d*)|0)$/]]]] diff --git a/environments/prod/modules/stdlib/types/compat/ip_address.pp b/environments/prod/modules/stdlib/types/compat/ip_address.pp new file mode 100644 index 0000000..bf4c4b4 --- /dev/null +++ b/environments/prod/modules/stdlib/types/compat/ip_address.pp @@ -0,0 +1 @@ +type Stdlib::Compat::Ip_address = Variant[Stdlib::Compat::Ipv4, Stdlib::Compat::Ipv6] diff --git a/environments/prod/modules/stdlib/types/compat/ipv4.pp b/environments/prod/modules/stdlib/types/compat/ipv4.pp new file mode 100644 index 0000000..a0ba0d6 --- /dev/null +++ b/environments/prod/modules/stdlib/types/compat/ipv4.pp @@ -0,0 +1,2 @@ +# Emulate the validate_ipv4_address and is_ipv4_address functions +type Stdlib::Compat::Ipv4 = Pattern[/^((([0-9](?!\d)|[1-9][0-9](?!\d)|1[0-9]{2}(?!\d)|2[0-4][0-9](?!\d)|25[0-5](?!\d))[.]){3}([0-9](?!\d)|[1-9][0-9](?!\d)|1[0-9]{2}(?!\d)|2[0-4][0-9](?!\d)|25[0-5](?!\d)))(\/((([0-9](?!\d)|[1-9][0-9](?!\d)|1[0-9]{2}(?!\d)|2[0-4][0-9](?!\d)|25[0-5](?!\d))[.]){3}([0-9](?!\d)|[1-9][0-9](?!\d)|1[0-9]{2}(?!\d)|2[0-4][0-9](?!\d)|25[0-5](?!\d))|[0-9]+))?$/] diff --git a/environments/prod/modules/stdlib/types/compat/ipv6.pp b/environments/prod/modules/stdlib/types/compat/ipv6.pp new file mode 100644 index 0000000..8b82f1a --- /dev/null +++ b/environments/prod/modules/stdlib/types/compat/ipv6.pp @@ -0,0 +1 @@ +type Stdlib::Compat::Ipv6 = Pattern[/\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\s*$/] diff --git a/environments/prod/modules/stdlib/types/compat/numeric.pp b/environments/prod/modules/stdlib/types/compat/numeric.pp new file mode 100644 index 0000000..5bfc3d3 --- /dev/null +++ b/environments/prod/modules/stdlib/types/compat/numeric.pp @@ -0,0 +1,23 @@ +# Emulate the is_numeric and validate_numeric functions +# The regex is what's currently used in is_numeric +# validate_numeric also allows range checking, which cannot be mapped to the string parsing inside the function. +# For full backwards compatibility, you will need to keep the validate_numeric call around to catch everything. +# To keep your development moving forward, you can also add a deprecation warning using the Integer type: +# +# ```class example($value) { validate_numeric($value, 10, 0) }``` +# +# would turn into +# +# ``` +# class example(Stdlib::Compat::Numeric $value) { +# validate_numeric($value, 10, 0) +# assert_type(Integer[0, 10], $value) |$expected, $actual| { +# warning("The 'value' parameter for the 'ntp' class has type ${actual}, but should be ${expected}.") +# } +# } +# ``` +# +# > Note that you need to use Variant[Integer[0, 10], Float[0, 10]] if you want to match both integers and floating point numbers. +# +# This allows you to find all places where a consumers of your code call it with unexpected values. +type Stdlib::Compat::Numeric = Variant[Numeric, Pattern[/^-?(?:(?:[1-9]\d*)|0)(?:\.\d+)?(?:[eE]-?\d+)?$/], Array[Variant[Numeric, Pattern[/^-?(?:(?:[1-9]\d*)|0)(?:\.\d+)?(?:[eE]-?\d+)?$/]]]] diff --git a/environments/prod/modules/stdlib/types/compat/re.pp b/environments/prod/modules/stdlib/types/compat/re.pp new file mode 100644 index 0000000..e4b5f30 --- /dev/null +++ b/environments/prod/modules/stdlib/types/compat/re.pp @@ -0,0 +1,3 @@ +# Emulate the validate_re function +# validate_re(value, re) translates to Pattern[re], which is not directly mappable as a type alias, but can be specified as Pattern[re]. +# Therefore this needs to be translated directly. diff --git a/environments/prod/modules/stdlib/types/compat/string.pp b/environments/prod/modules/stdlib/types/compat/string.pp new file mode 100644 index 0000000..b06255d --- /dev/null +++ b/environments/prod/modules/stdlib/types/compat/string.pp @@ -0,0 +1,2 @@ +# Emulate the is_string and validate_string functions +type Stdlib::Compat::String = Optional[String] diff --git a/environments/prod/modules/stdlib/types/httpsurl.pp b/environments/prod/modules/stdlib/types/httpsurl.pp new file mode 100644 index 0000000..36fd30f --- /dev/null +++ b/environments/prod/modules/stdlib/types/httpsurl.pp @@ -0,0 +1 @@ +type Stdlib::HTTPSUrl = Pattern[/^https:\/\//] diff --git a/environments/prod/modules/stdlib/types/httpurl.pp b/environments/prod/modules/stdlib/types/httpurl.pp new file mode 100644 index 0000000..0d93a95 --- /dev/null +++ b/environments/prod/modules/stdlib/types/httpurl.pp @@ -0,0 +1 @@ +type Stdlib::HTTPUrl = Pattern[/^https?:\/\//] diff --git a/environments/prod/modules/stdlib/types/unixpath.pp b/environments/prod/modules/stdlib/types/unixpath.pp new file mode 100644 index 0000000..ec3bf7d --- /dev/null +++ b/environments/prod/modules/stdlib/types/unixpath.pp @@ -0,0 +1,2 @@ +# this regex rejects any path component that is a / or a NUL +type Stdlib::Unixpath = Pattern[/^\/([^\/\0]+\/*)+$/] diff --git a/environments/prod/modules/stdlib/types/windowspath.pp b/environments/prod/modules/stdlib/types/windowspath.pp new file mode 100644 index 0000000..bc1ee9c --- /dev/null +++ b/environments/prod/modules/stdlib/types/windowspath.pp @@ -0,0 +1 @@ +type Stdlib::Windowspath = Pattern[/^(([a-zA-Z]:[\\\/])|([\\\/][\\\/][^\\\/]+[\\\/][^\\\/]+)|([\\\/][\\\/]\?[\\\/][^\\\/]+))/] diff --git a/environments/prod/modules/task13/manifests/mysql.pp b/environments/prod/modules/task13/manifests/mysql.pp new file mode 100644 index 0000000..52ca18e --- /dev/null +++ b/environments/prod/modules/task13/manifests/mysql.pp @@ -0,0 +1,19 @@ +class task13::mysql { + class { '::mysql::server': + root_password => 'strongpassword', + } + mysql_database { 'prod_mdb': + ensure => present, + charset => 'utf8', + } + mysql_user { 'prod_user@localhost': + ensure => present, + } + mysql_grant { 'prod_user@localhost/prod_mdb.*': + ensure => present, + options => ['GRANT'], + privileges => ['ALL'], + table => 'prod_mdb.*', + user => 'prod_user@localhost', + } +} diff --git a/environments/prod/modules/task13/manifests/nginx.pp b/environments/prod/modules/task13/manifests/nginx.pp new file mode 100644 index 0000000..272c5b5 --- /dev/null +++ b/environments/prod/modules/task13/manifests/nginx.pp @@ -0,0 +1,10 @@ +class task13::nginx { + package { 'nginx': + ensure => installed + } + service { 'nginx': + ensure => running, + enable => true, + require => Package['nginx'] + } +} diff --git a/environments/production/environment.conf b/environments/production/environment.conf new file mode 100644 index 0000000..c39193f --- /dev/null +++ b/environments/production/environment.conf @@ -0,0 +1,18 @@ +# Each environment can have an environment.conf file. Its settings will only +# affect its own environment. See docs for more info: +# https://docs.puppetlabs.com/puppet/latest/reference/config_file_environment.html + +# Any unspecified settings use default values; some of those defaults are based +# on puppet.conf settings. + +# If these settings include relative file paths, they'll be resolved relative to +# this environment's directory. + +# Allowed settings and default values: + +# modulepath = ./modules:$basemodulepath +# manifest = (default_manifest from puppet.conf, which defaults to ./manifests) +# config_version = (no script; Puppet will use the time the catalog was compiled) +# environment_timeout = (environment_timeout from puppet.conf, which defaults to 0) + # Note: unless you have a specific reason, we recommend only setting + # environment_timeout in puppet.conf. diff --git a/environments/production/manifests/site.pp b/environments/production/manifests/site.pp new file mode 100644 index 0000000..e839b30 --- /dev/null +++ b/environments/production/manifests/site.pp @@ -0,0 +1,48 @@ +node 'puppet.loc' { + class { 'puppetdb': } + class { 'puppetdb::master::config': } + class {'::puppetexplorer': + vhost_options => { + rewrites => [ { rewrite_rule => ['^/api/metrics/v1/mbeans/puppetlabs.puppetdb.query.population:type=default,name=(.*)$ https://%{HTTP_HOST}/api/metrics/v1/mbeans/puppetlabs.puppetdb.population:name=$1 [R=301,L]'] } ] } + } +} +node 'node.loc' { + class { '::mysql::server': + root_password => 'strongpassword' + } + mysql_database { 'test_mdb': + ensure => present, + charset => 'utf8', + } + mysql_user { 'test_user@node.loc': + ensure => present, + } + mysql_grant { 'test_user@node.loc/test_mdb.*': + + ensure => present, + options => ['GRANT'], + privileges => ['ALL'], + table => 'test_mdb.*', + user => 'test_user@node.loc', + } +} +node 'node1.loc' { + class { '::mysql::server': + root_password => 'strongpassword' + } + mysql_database { 'test_mdb': + ensure => present, + charset => 'utf8', + } + mysql_user { 'test_user@node.loc': + ensure => present, + } + mysql_grant { 'test_user@node.loc/test_mdb.*': + + ensure => present, + options => ['GRANT'], + privileges => ['ALL'], + table => 'test_mdb.*', + user => 'test_user@node.loc', + } +} diff --git a/environments/production/modules/apache/CHANGELOG.md b/environments/production/modules/apache/CHANGELOG.md new file mode 100644 index 0000000..e921ccc --- /dev/null +++ b/environments/production/modules/apache/CHANGELOG.md @@ -0,0 +1,816 @@ +## Supported Release 1.11.0 +#### Summary +This release adds SLES12 Support and many more features and bugfixes. + +#### Features +- (MODULES-4049) Adds SLES 12 Support +- Adds additional directories options for LDAP Auth + - `auth_ldap_url` + - `auth_ldap_bind_dn` + - `auth_ldap_bind_password` + - `auth_ldap_group_attribute` + - `auth_ldap_group_attribute_is_dn` +- Allows `mod_event` parameters to be unset +- Allows management of default root directory access rights +- Adds class `apache::vhosts` to create apache::vhost resources +- Adds class `apache::mod::proxy_wstunnel` +- Adds class `apache::mod::dumpio` +- Adds class `apache::mod::socache_shmcb` +- Adds class `apache::mod::authn_dbd` +- Adds support for apache 2.4 on Amazon Linux +- Support the newer `mod_auth_cas` config options +- Adds `wsgi_script_aliases_match` parameter to `apache::vhost` +- Allow to override all SecDefaultAction attributes +- Add audit_log_relevant_status parameter to apache::mod::security +- Allow absolute path to $apache::mod::security::activated_rules +- Allow setting SecAuditLog +- Adds `passenger_max_instances_per_app` to `mod::passenger` +- Allow the proxy_via setting to be configured +- Allow no_proxy_uris to be used within proxy_pass +- Add rpaf.conf template parameter to `mod::rpaf` +- Allow user to specify alternative package and library names for shibboleth module +- Allows configuration of shibboleth lib path +- Adds parameter `passenger_data_buffer_dir` to `mod::passenger` +- Adds SSL stapling +- Allows use of `balance_manager` with `mod_proxy_balancer` +- Raises lower bound of `stdlib` dependency to version 4.2 +- Adds support for Passenger repo on Amazon Linux +- Add ability to set SSLStaplingReturnResponderErrors on server level +- (MODULES-4213) Allow global rewrite rules inheritance in vhosts +- Moves `mod_env` to its own class and load it when required + +#### Bugfixes +- Deny access to .ht and .hg, which are created by mercurial hg. +- Instead of failing, include apache::mod::prefork in manifests/mod/itk.pp instead. +- Only set SSLCompression when it is set to true. +- Remove duplicate shib2 hash element +- (MODULES-3388) Include mpm_module classes instead of class declaration +- Updates `apache::balancer` to respect `apache::confd_dir` +- Wrap mod_security directives in an IfModule +- Fixes to various mods for Ubuntu Xenial +- Fix /etc/modsecurity perms to match package +- Fix PassengerRoot under Debian stretch +- (MODULES-3476) Updates regex in apache_version custom fact to work with EL5 +- Dont sql_injection_attacks.data +- Add force option to confd file resource to purge directory without warnings +- Patch httpoxy through mod_security +- Fixes config ordering of IncludeOptional +- Fixes bug where port numbers were unquoted +- Fixes bug where empty servername for vhost were written to template +- Auto-load `slotmem_shm` and `lbmethod_byrequests` with `proxy_balancer` on 2.4 +- Simplify MPM setup on FreeBSD +- Adds requirement for httpd package +- Do not set ssl_certs_dir on FreeBSD +- Fixes bug that produces a duplicate `Listen 443` after a package update on EL7 +- Fixes bug where custom facts break structured facts +- Avoid relative classname inclusion +- Fixes a failure in `vhost` if the first element of `$rewrites` is not a hash +- (MODULES-3744) Process $crs_package before $modsec_dir +- (MODULES-1491) Adds `::apache` include to mods that need it + +## Supported Release 1.10.0 +#### Summary +This release fixes backwards compatibility bugs introduced in 1.9.0. Also includes a new mod class and a new vhost feature. + +#### Features +- Allow setting KeepAlive related options per vhost + - `apache::vhost::keepalive` + - `apache::vhost::keepalive_timeout` + - `apache::vhost::max_keepalive_requests` +- Adds new class `apache::mod::cluster` + +#### Bugfixes +- MODULES-2890: Allow php_version != 5 +- MODULES-2890: mod::php: Explicit test on jessie +- MODULES-2890: Fix PHP on Debian stretch and Ubuntu Xenial +- MODULES-2890: Fix mod_php SetHandler and cleanup +- Fixed trailing slash in lib_path on Suse +- Revert "MODULES-2956: Enable options within location block on proxy_match". Bug introduced in release 1.9.0. +- Revert "changed rpaf Configuration Directives: RPAF -> RPAF_". Bug introduced in release 1.9.0. +- Set actual path to apachectl on FreeBSD. Fixes snippets verification. + +## Supported Release 1.9.0 [DELETED] +#### Features +- Added `apache_version` fact +- Added `apache::balancer::target` attribute +- Added `apache::fastcgi::server::pass_header` attribute +- Added ability for `apache::fastcgi::server::host` using sockets +- Added `apache::root_directory_options` attribute +- Added for `apache::mod::ldap`: + - `ldap_shared_cache_size` + - `ldap_cache_entries` + - `ldap_cache_ttl` + - `ldap_opcache_entries` + - `ldap_opcache_ttl` +- Added `apache::mod::pagespeed::package_ensure` attribute +- Added `apache::mod::passenger` attributes: + - `passenger_log_level` + - `manage_repo` +- Added upstream repo for `apache::mod::passenger` +- Added `apache::mod::proxy_fcgi` class +- Added `apache::mod::security` attributes: + - `audit_log_parts` + - `secpcrematchlimit` + - `secpcrematchlimitrecursion` + - `secdefaultaction` + - `anomaly_score_blocking` + - `inbound_anomaly_threshold` + - `outbound_anomaly_threshold` +- Added `apache::mod::ssl` attributes: + - `ssl_mutex` + - `apache_version` +- Added ubuntu 16.04 support +- Added `apache::mod::authnz_ldap::package_name` attribute +- Added `apache::mod::ldap::package_name` attribute +- Added `apache::mod::proxy::package_name` attribute +- Added `apache::vhost` attributes: + - `ssl_proxy_check_peen_expire` + - `ssl_proxy_protocol` + - `logroot_owner` + - `logroot_group` + - `setenvifnocase` + - `passenger_user` + - `passenger_high_performance` + - `jk_mounts` + - `fastcgi_idle_timeout` + - `modsec_disable_msgs` + - `modsec_disable_tags` +- Added ability for 2.4-style `RequireAll|RequireNone|RequireAny` directory permissions +- Added ability for includes in vhost directory +- Added directory values: + - `AuthMerging` + - `MellonSPMetadataFile` +- Adds Configurability of Collaborative Detection Severity Levels for OWASP Core Rule Set to `apache::mod::security` class + - `critical_anomaly_score` + - `error_anomaly_score` + - `warning_anomaly_score` + - `notice_anomaly_score` +- Adds ability to configure `info_path` in `apache::mod::info` class +- Adds ability to configure `verify_config` in `apache::vhost::custom` + +#### Bugfixes +- Fixed apache mod setup for event/worker failing syntax +- Fixed concat deprecation warnings +- Fixed pagespeed mod +- Fixed service restart on mod update +- Fixed mod dir purging to happen after package installs +- Fixed various `apache::mod::*` file modes +- Fixed `apache::mod::authnz_ldap` parameter `verifyServerCert` to be `verify_server_cert` +- Fixed loadfile name in `apache::mod::fcgid` +- Fixed `apache::mod::remoteip` to fail on apache < 2.4 (because it is not available) +- Fixed `apache::mod::ssl::ssl_honorcipherorder` interpolation +- Lint fixes +- Strict variable fixes +- Fixed `apache::vhost` attribute `redirectmatch_status` to be optional +- Fixed SSLv3 on by default in mod\_nss +- Fixed mod\_rpaf directive names in template +- Fixed mod\_worker needing MaxClients with ThreadLimit +- Fixed quoting on vhost php\_value +- Fixed xml2enc for proxy\_html on debian +- Fixed a problem where the apache service restarts too fast + +## Supported Release 1.8.1 +### Summary +This release includes bug fixes and a documentation update. + +#### Bugfixes +- Fixes a bug that occurs when using the module in combination with puppetlabs-concat 2.x. +- Fixes a bug where passenger.conf was vulnerable to purging. +- Removes the pin of the concat module dependency. + +## 2016-01-26 - Supported Release 1.8.0 +### Summary +This release includes a lot of bug fixes and feature updates, including support for Debian 8, as well as many test improvements. + +#### Features +- Debian 8 Support. +- Added the 'file_mode' property to allow a custom permission setting for config files. +- Enable 'PassengerMaxRequestQueueSize' to be set for mod_passenger. +- MODULES-2956: Enable options within location block on proxy_match. +- Support itk on redhat. +- Support the mod_ssl SSLProxyVerify directive. +- Support ProxPassReverseCookieDomain directive (mod_proxy). +- Support proxy provider for vhost directories. +- Added new 'apache::vhost::custom' resource. + +#### Bugfixes +- Fixed ProxyPassReverse configuration. +- Fixed error in Amazon operatingsystem detection. +- Fixed mod_security catalog ordering issues for RedHat 7. +- Fixed paths and packages for the shib2 apache module on Debian pre Jessie. +- Fixed EL7 directory path for apache modules. +- Fixed validation error when empty array is passed for the rewrites parameter. +- Idempotency fixes with regards to '::apache::mod_enable_dir'. +- ITK fixes. +- (MODULES-2865) fix $mpm_module logic for 'false'. +- Set SSLProxy directives even if ssl is false, due to issue with RewriteRules and ProxyPass directives. +- Enable setting LimitRequestFieldSize globally, and remove it from vhost. + +#### Improvements +- apache::mod::php now uses FilesMatch to configure the php handler. This is following the recommended upstream configuration guidelines (http://php.net/manual/en/install.unix.apache2.php#example-20) and distribution's default config (e.g.: http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/vivid/php5/vivid/view/head:/debian/php5.conf). It avoids inadvertently exposing the PHP handler to executing uploads with names like 'file.php.jpg', but might impact setups with unusual requirements. +- Improved compatibility for Gentoo. +- Vhosts can now be supplied with a wildcard listen value. +- Numerous test improvements. +- Removed workarounds for https://bz.apache.org/bugzilla/show_bug.cgi?id=38864 as the issues have been fixed in Apache. +- Documentation updates. +- Ensureed order of ProxyPass and ProxyPassMatch parameters. +- Ensure that ProxyPreserveHost is set to off mode explicitly if not set in manifest. +- Put headers and request headers before proxy with regards to template generation. +- Added X-Forwarded-For into log_formats defaults. +- (MODULES-2703) Allow mod pagespeed to take an array of lines as additional_configuration. + +## Supported Release 1.7.1 +###Summary + +Small release for support of newer PE versions. This increments the version of PE in the metadata.json file. + +## 2015-11-17 - Supported Release 1.7.0 +### Summary +This release includes many new features and bugfixes. There are test, documentation and misc improvements. + +#### Features +- allow groups with - like vhost-users +- ability to enable/disable the secruleengine through a parameter +- add mod_auth_kerb parameters to vhost +- client auth for reverse proxy +- support for mod_auth_mellon +- change SSLProtocol in apache::vhost to be space separated +- RewriteLock support + +#### Bugfixes +- fix apache::mod::cgid so it can be used with the event MPM +- load unixd before fcgid on all operating systems +- fixes conditional in vhost aliases +- corrects mod_cgid worker/event defaults +- ProxyPassMatch parameters were ending up on a newline +- catch that mod_authz_default has been removed in Apache 2.4 +- mod::ssl fails on SLES +- fix typo of MPM_PREFORK for FreeBSD package install +- install all modules before adding custom configs +- fix acceptance testing for SSLProtocol behaviour for real +- fix ordering issue with conf_file and ports_file + +#### Known Issues +- mod_passenger is having issues installing on Redhat/Centos 6, This is due to package dependency issues. + +#### Improvements +- added docs for forcetype directive +- removes ruby 1.8.7 from the travisci test matrix +- readme reorganisation, minor fixups +- support the mod_proxy ProxyPassReverseCookiePath directive +- the purge_vhost_configs parameter is actually called purge_vhost_dir +- add ListenBacklog for mod worker +- deflate application/json by default +- install mod_authn_alias as default mod in debian for apache < 2.4 +- optionally set LimitRequestFieldSize on an apache::vhost +- add SecUploadDir parameter to support file uploads with mod_security +- optionally set parameters for mod_ext_filter module +- allow SetOutputFilter to be set on a directory +- RC4 is deprecated +- allow empty docroot +- add option to configure the include pattern for the vhost_enable dir +- allow multiple IP addresses per vhost +- default document root update for Ubuntu 14.04 and Debian 8 + +## 2015-07-28 - Supported Release 1.6.0 +### Summary +This release includes a couple of new features, along with test and documentation updates, and support for the latest AIO puppet builds. + +#### Features +- Add `scan_proxy_header_field` parameter to `apache::mod::geoip` +- Add `ssl_openssl_conf_cmd` parameter to `apache::vhost` and `apache::mod::ssl` +- Add `filters` parameter to `apache::vhost` + +#### Bugfixes +- Test updates +- Do not use systemd on Amazon Linux +- Add missing docs for `timeout` parameter (MODULES-2148) + +## 2015-06-11 - Supported Release 1.5.0 +### Summary +This release primarily adds Suse compatibility. It also adds a handful of other +parameters for greater configuration control. + +#### Features +- Add `apache::lib_path` parameter +- Add `apache::service_restart` parameter +- Add `apache::vhost::geoip_enable` parameter +- Add `apache::mod::geoip` class +- Add `apache::mod::remoteip` class +- Add parameters to `apache::mod::expires` class +- Add `index_style_sheet` handling to `apache::vhost::directories` +- Add some compatibility for SLES 11 +- Add `apache::mod::ssl::ssl_sessioncachetimeout` parameter +- Add `apache::mod::ssl::ssl_cryptodevice` parameter +- Add `apache::mod::ssl::ssl_honorcipherorder` parameter +- Add `apache::mod::userdir::options` parameter + +#### Bugfixes +- Document `apache::user` parameter +- Document `apache::group` parameter +- Fix apache::dev on FreeBSD +- Fix proxy\_connect on apache >= 2.2 +- Validate log levels better +- Fix `apache::apache_name` for package and vhost +- Fix Debian Jessie mod\_prefork package name +- Fix alias module being declared even when vhost is absent +- Fix proxy\_pass\_match handling in vhost's proxy template +- Fix userdir access permissions +- Fix issue where the module was trying to use systemd on Amazon Linux. + +## 2015-04-28 - Supported Release 1.4.1 + +This release corrects a metadata issue that has been present since release 1.2.0. The refactoring of `apache::vhost` to use `puppetlabs-concat` requires a version of concat newer than the version required in PE. If you are using PE 3.3.0 or earlier you will need to use version 1.1.1 or earlier of the `puppetlabs-apache` module. + +## 2015-03-17 - Supported Release 1.4.0 +###Summary + +This release fixes the issue where the docroot was still managed even if the default vhosts were disabled and has many other features and bugfixes including improved support for 'deny' and 'require' as arrays in the 'directories' parameter under `apache::vhost` + +#### Features +- New parameters to `apache` + - `default_charset` + - `default_type` +- New parameters to `apache::vhost` + - `proxy_error_override` + - `passenger_app_env` (MODULES-1776) + - `proxy_dest_match` + - `proxy_dest_reverse_match` + - `proxy_pass_match` + - `no_proxy_uris_match` +- New parameters to `apache::mod::passenger` + - `passenger_app_env` + - `passenger_min_instances` +- New parameter to `apache::mod::alias` + - `icons_options` +- New classes added under `apache::mod::*` + - `authn_file` + - `authz_default` + - `authz_user` +- Added support for 'deny' as an array in 'directories' under `apache::vhost` +- Added support for RewriteMap +- Improved support for FreeBSD. (Note: If using apache < 2.4.12, see the discussion [here](https://github.com/puppetlabs/puppetlabs-apache/pull/1030)) +- Added check for deprecated options in directories and fail when they are unsupported +- Added gentoo compatibility +- Added proper array support for `require` in the `directories` parameter in `apache::vhost` +- Added support for `setenv` inside proxy locations + +### Bugfixes +- Fix issue in `apache::vhost` that was preventing the scriptalias fragment from being included (MODULES-1784) +- Install required `mod_ldap` package for EL7 (MODULES-1779) +- Change default value of `maxrequestworkers` in `apache::mod::event` to be a multiple of the default `ThreadsPerChild` of 25. +- Use the correct `mod_prefork` package name for trusty and jessie +- Don't manage docroot when default vhosts are disabled +- Ensure resources notify `Class['Apache::Service']` instead of `Service['httpd']` (MODULES-1829) +- Change the loadfile name for `mod_passenger` so `mod_proxy` will load by default before `mod_passenger` +- Remove old Debian work-around that removed `passenger_extra.conf` + +## 2015-02-17 - Supported Release 1.3.0 +### Summary + +This release has many new features and bugfixes, including the ability to optionally not trigger service restarts on config changes. + +#### Features +- New parameters - `apache` + - `service_manage` + - `use_optional_includes` +- New parameters - `apache::service` + - `service_manage` +- New parameters - `apache::vhost` + - `access_logs` + - `php_flags` + - `php_values` + - `modsec_disable_vhost` + - `modsec_disable_ids` + - `modsec_disable_ips` + - `modsec_body_limit` +- Improved FreeBSD support +- Add ability to omit priority prefix if `$priority` is set to false +- Add `apache::security::rule_link` define +- Improvements to `apache::mod::*` + - Add `apache::mod::auth_cas` class + - Add `threadlimit`, `listenbacklog`, `maxrequestworkers`, `maxconnectionsperchild` parameters to `apache::mod::event` + - Add `apache::mod::filter` class + - Add `root_group` to `apache::mod::php` + - Add `apache::mod::proxy_connect` class + - Add `apache::mod::security` class + - Add `ssl_pass_phrase_dialog` and `ssl_random_seed_bytes` parameters to `apache::mod::ssl` (MODULES-1719) + - Add `status_path` parameter to `apache::mod::status` + - Add `apache_version` parameter to `apache::mod::version` + - Add `package_name` and `mod_path` parameters to `apache::mod::wsgi` (MODULES-1458) +- Improved SCL support + - Add support for specifying the docroot +- Updated `_directories.erb` to add support for SetEnv +- Support multiple access log directives (MODULES-1382) +- Add passenger support for Debian Jessie +- Add support for not having puppet restart the apache service (MODULES-1559) + +#### Bugfixes +- For apache 2.4 `mod_itk` requires `mod_prefork` (MODULES-825) +- Allow SSLCACertificatePath to be unset in `apache::vhost` (MODULES-1457) +- Load fcgid after unixd on RHEL7 +- Allow disabling default vhost for Apache 2.4 +- Test fixes +- `mod_version` is now built-in (MODULES-1446) +- Sort LogFormats for idempotency +- `allow_encoded_slashes` was omitted from `apache::vhost` +- Fix documentation bug (MODULES-1403, MODULES-1510) +- Sort `wsgi_script_aliases` for idempotency (MODULES-1384) +- lint fixes +- Fix automatic version detection for Debian Jessie +- Fix error docs and icons path for RHEL7-based systems (MODULES-1554) +- Sort php_* hashes for idempotency (MODULES-1680) +- Ensure `mod::setenvif` is included if needed (MODULES-1696) +- Fix indentation in `vhost/_directories.erb` template (MODULES-1688) +- Create symlinks on all distros if `vhost_enable_dir` is specified + +## 2014-09-30 - Supported Release 1.2.0 +### Summary + +This release features many improvements and bugfixes, including several new defines, a reworking of apache::vhost for more extensibility, and many new parameters for more customization. This release also includes improved support for strict variables and the future parser. + +#### Features +- Convert apache::vhost to use concat for easier extensions +- Test improvements +- Synchronize files with modulesync +- Strict variable and future parser support +- Added apache::custom_config defined type to allow validation of configs before they are created +- Added bool2httpd function to convert true/false to apache 'On' and 'Off'. Intended for internal use in the module. +- Improved SCL support + - allow overriding of the mod_ssl package name +- Add support for reverse_urls/ProxyPassReverse in apache::vhost +- Add satisfy directive in apache::vhost::directories +- Add apache::fastcgi::server defined type +- New parameters - apache + - allow_encoded_slashes + - apache_name + - conf_dir + - default_ssl_crl_check + - docroot + - logroot_mode + - purge_vhost_dir +- New parameters - apache::vhost + - add_default_charset + - allow_encoded_slashes + - logroot_ensure + - logroot_mode + - manage_docroot + - passenger_app_root + - passenger_min_instances + - passenger_pre_start + - passenger_ruby + - passenger_start_timeout + - proxy_preserve_host + - redirectmatch_dest + - ssl_crl_check + - wsgi_chunked_request + - wsgi_pass_authorization +- Add support for ScriptAlias and ScriptAliasMatch in the apache::vhost::aliases parameter +- Add support for rewrites in the apache::vhost::directories parameter +- If the service_ensure parameter in apache::service is set to anything other than true, false, running, or stopped, ensure will not be passed to the service resource, allowing for the service to not be managed by puppet +- Turn of SSLv3 by default +- Improvements to apache::mod* + - Add restrict_access parameter to apache::mod::info + - Add force_language_priority and language_priority parameters to apache::mod::negotiation + - Add threadlimit parameter to apache::mod::worker + - Add content, template, and source parameters to apache::mod::php + - Add mod_authz_svn support via the authz_svn_enabled parameter in apache::mod::dav_svn + - Add loadfile_name parameter to apache::mod + - Add apache::mod::deflate class + - Add options parameter to apache::mod::fcgid + - Add timeouts parameter to apache::mod::reqtimeout + - Add apache::mod::shib + - Add apache_version parameter to apache::mod::ldap + - Add magic_file parameter to apache::mod::mime_magic + - Add apache_version parameter to apache::mod::pagespeed + - Add passenger_default_ruby parameter to apache::mod::passenger + - Add content, template, and source parameters to apache::mod::php + - Add apache_version parameter to apache::mod::proxy + - Add loadfiles parameter to apache::mod::proxy_html + - Add ssl_protocol and package_name parameters to apache::mod::ssl + - Add apache_version parameter to apache::mod::status + - Add apache_version parameter to apache::mod::userdir + - Add apache::mod::version class + +#### Bugfixes +- Set osfamily defaults for wsgi_socket_prefix +- Support multiple balancermembers with the same url +- Validate apache::vhost::custom_fragment +- Add support for itk with mod_php +- Allow apache::vhost::ssl_certs_dir to not be set +- Improved passenger support for Debian +- Improved 2.4 support without mod_access_compat +- Support for more than one 'Allow from'-directive in _directories.erb +- Don't load systemd on Amazon linux based on CentOS6 with apache 2.4 +- Fix missing newline in ModPagespeed filter and memcached servers directive +- Use interpolated strings instead of numbers where required by future parser +- Make auth_require take precedence over default with apache 2.4 +- Lint fixes +- Set default for php_admin_flags and php_admin_values to be empty hash instead of empty array +- Correct typo in mod::pagespeed +- spec_helper fixes +- Install mod packages before dealing with the configuration +- Use absolute scope to check class definition in apache::mod::php +- Fix dependency loop in apache::vhost +- Properly scope variables in the inline template in apache::balancer +- Documentation clarification, typos, and formatting +- Set apache::mod::ssl::ssl_mutex to default for debian on apache >= 2.4 +- Strict variables fixes +- Add authn_core mode to Ubuntu trusty defaults +- Keep default loadfile for authz_svn on Debian +- Remove '.conf' from the site-include regexp for better Ubuntu/Debian support +- Load unixd before fcgid for EL7 +- Fix RedirectMatch rules +- Fix misleading error message in apache::version + +#### Known Bugs +* By default, the version of Apache that ships with Ubuntu 10.04 does not work with `wsgi_import_script`. +* SLES is unsupported. + +## 2014-07-15 - Supported Release 1.1.1 +### Summary + +This release merely updates metadata.json so the module can be uninstalled and +upgraded via the puppet module command. + +## 2014-04-14 Supported Release 1.1.0 + +### Summary + +This release primarily focuses on extending the httpd 2.4 support, tested +through adding RHEL7 and Ubuntu 14.04 support. It also includes Passenger +4 support, as well as several new modules and important bugfixes. + +#### Features + +- Add support for RHEL7 and Ubuntu 14.04 +- More complete apache24 support +- Passenger 4 support +- Add support for max_keepalive_requests and log_formats parameters +- Add mod_pagespeed support +- Add mod_speling support +- Added several parameters for mod_passenger +- Added ssl_cipher parameter to apache::mod::ssl +- Improved examples in documentation +- Added docroot_mode, action, and suexec_user_group parameters to apache::vhost +- Add support for custom extensions for mod_php +- Improve proxy_html support for Debian + +#### Bugfixes + +- Remove NameVirtualHost directive for apache >= 2.4 +- Order proxy_set option so it doesn't change between runs +- Fix inverted SSL compression +- Fix missing ensure on concat::fragment resources +- Fix bad dependencies in apache::mod and apache::mod::mime + +#### Known Bugs +* By default, the version of Apache that ships with Ubuntu 10.04 does not work with `wsgi_import_script`. +* SLES is unsupported. + +## 2014-03-04 Supported Release 1.0.1 +### Summary + +This is a supported release. This release removes a testing symlink that can +cause trouble on systems where /var is on a seperate filesystem from the +modulepath. + +#### Features +#### Bugfixes +#### Known Bugs +* By default, the version of Apache that ships with Ubuntu 10.04 does not work with `wsgi_import_script`. +* SLES is unsupported. + +## 2014-03-04 Supported Release 1.0.0 +### Summary + +This is a supported release. This release introduces Apache 2.4 support for +Debian and RHEL based osfamilies. + +#### Features + +- Add apache24 support +- Add rewrite_base functionality to rewrites +- Updated README documentation +- Add WSGIApplicationGroup and WSGIImportScript directives + +#### Bugfixes + +- Replace mutating hashes with merge() for Puppet 3.5 +- Fix WSGI import_script and mod_ssl issues on Lucid + +#### Known Bugs +* By default, the version of Apache that ships with Ubuntu 10.04 does not work with `wsgi_import_script`. +* SLES is unsupported. + +--- + +## 2014-01-31 Release 0.11.0 +### Summary: + +This release adds preliminary support for Windows compatibility and multiple rewrite support. + +#### Backwards-incompatible Changes: + +- The rewrite_rule parameter is deprecated in favor of the new rewrite parameter + and will be removed in a future release. + +#### Features: + +- add Match directive +- quote paths for windows compatibility +- add auth_group_file option to README.md +- allow AuthGroupFile directive for vhosts +- Support Header directives in vhost context +- Don't purge mods-available dir when separate enable dir is used +- Fix the servername used in log file name +- Added support for mod_include +- Remove index parameters. +- Support environment variable control for CustomLog +- added redirectmatch support +- Setting up the ability to do multiple rewrites and conditions. +- Convert spec tests to beaker. +- Support php_admin_(flag|value)s + +#### Bugfixes: + +- directories are either a Hash or an Array of Hashes +- Configure Passenger in separate .conf file on RH so PassengerRoot isn't lost +- (docs) Update list of `apache::mod::[name]` classes +- (docs) Fix apache::namevirtualhost example call style +- Fix $ports_file reference in apache::listen. +- Fix $ports_file reference in Namevirtualhost. + + +## 2013-12-05 Release 0.10.0 +### Summary: + +This release adds FreeBSD osfamily support and various other improvements to some mods. + +#### Features: + +- Add suPHP_UserGroup directive to directory context +- Add support for ScriptAliasMatch directives +- Set SSLOptions StdEnvVars in server context +- No implicit entry for ScriptAlias path +- Add support for overriding ErrorDocument +- Add support for AliasMatch directives +- Disable default "allow from all" in vhost-directories +- Add WSGIPythonPath as an optional parameter to mod_wsgi. +- Add mod_rpaf support +- Add directives: IndexOptions, IndexOrderDefault +- Add ability to include additional external configurations in vhost +- need to use the provider variable not the provider key value from the directory hash for matches +- Support for FreeBSD and few other features +- Add new params to apache::mod::mime class +- Allow apache::mod to specify module id and path +- added $server_root parameter +- Add Allow and ExtendedStatus support to mod_status +- Expand vhost/_directories.pp directive support +- Add initial support for nss module (no directives in vhost template yet) +- added peruser and event mpms +- added $service_name parameter +- add parameter for TraceEnable +- Make LogLevel configurable for server and vhost +- Add documentation about $ip +- Add ability to pass ip (instead of wildcard) in default vhost files + +#### Bugfixes: + +- Don't listen on port or set NameVirtualHost for non-existent vhost +- only apply Directory defaults when provider is a directory +- Working mod_authnz_ldap support on Debian/Ubuntu + +## 2013-09-06 Release 0.9.0 +### Summary: +This release adds more parameters to the base apache class and apache defined +resource to make the module more flexible. It also adds or enhances SuPHP, +WSGI, and Passenger mod support, and support for the ITK mpm module. + +#### Backwards-incompatible Changes: +- Remove many default mods that are not normally needed. +- Remove `rewrite_base` `apache::vhost` parameter; did not work anyway. +- Specify dependencies on stdlib >=2.4.0 (this was already the case, but +making explicit) +- Deprecate `a2mod` in favor of the `apache::mod::*` classes and `apache::mod` +defined resource. + +#### Features: +- `apache` class + - Add `httpd_dir` parameter to change the location of the configuration + files. + - Add `logroot` parameter to change the logroot + - Add `ports_file` parameter to changes the `ports.conf` file location + - Add `keepalive` parameter to enable persistent connections + - Add `keepalive_timeout` parameter to change the timeout + - Update `default_mods` to be able to take an array of mods to enable. +- `apache::vhost` + - Add `wsgi_daemon_process`, `wsgi_daemon_process_options`, + `wsgi_process_group`, and `wsgi_script_aliases` parameters for per-vhost + WSGI configuration. + - Add `access_log_syslog` parameter to enable syslogging. + - Add `error_log_syslog` parameter to enable syslogging of errors. + - Add `directories` hash parameter. Please see README for documentation. + - Add `sslproxyengine` parameter to enable SSLProxyEngine + - Add `suphp_addhandler`, `suphp_engine`, and `suphp_configpath` for + configuring SuPHP. + - Add `custom_fragment` parameter to allow for arbitrary apache + configuration injection. (Feature pull requests are prefered over using + this, but it is available in a pinch.) +- Add `apache::mod::suphp` class for configuring SuPHP. +- Add `apache::mod::itk` class for configuring ITK mpm module. +- Update `apache::mod::wsgi` class for global WSGI configuration with +`wsgi_socket_prefix` and `wsgi_python_home` parameters. +- Add README.passenger.md to document the `apache::mod::passenger` usage. +Added `passenger_high_performance`, `passenger_pool_idle_time`, +`passenger_max_requests`, `passenger_stat_throttle_rate`, `rack_autodetect`, +and `rails_autodetect` parameters. +- Separate the httpd service resource into a new `apache::service` class for +dependency chaining of `Class['apache'] -> ~> +Class['apache::service']` +- Added `apache::mod::proxy_balancer` class for `apache::balancer` + +#### Bugfixes: +- Change dependency to puppetlabs-concat +- Fix ruby 1.9 bug for `a2mod` +- Change servername to be `$::hostname` if there is no `$::fqdn` +- Make `/etc/ssl/certs` the default ssl certs directory for RedHat non-5. +- Make `php` the default php package for RedHat non-5. +- Made `aliases` able to take a single alias hash instead of requiring an +array. + +## 2013-07-26 Release 0.8.1 +#### Bugfixes: +- Update `apache::mpm_module` detection for worker/prefork +- Update `apache::mod::cgi` and `apache::mod::cgid` detection for +worker/prefork + +## 2013-07-16 Release 0.8.0 +#### Features: +- Add `servername` parameter to `apache` class +- Add `proxy_set` parameter to `apache::balancer` define + +#### Bugfixes: +- Fix ordering for multiple `apache::balancer` clusters +- Fix symlinking for sites-available on Debian-based OSs +- Fix dependency ordering for recursive confdir management +- Fix `apache::mod::*` to notify the service on config change +- Documentation updates + +## 2013-07-09 Release 0.7.0 +#### Changes: +- Essentially rewrite the module -- too many to list +- `apache::vhost` has many abilities -- see README.md for details +- `apache::mod::*` classes provide httpd mod-loading capabilities +- `apache` base class is much more configurable + +#### Bugfixes: +- Many. And many more to come + +## 2013-03-2 Release 0.6.0 +- update travis tests (add more supported versions) +- add access log_parameter +- make purging of vhost dir configurable + +## 2012-08-24 Release 0.4.0 +#### Changes: +- `include apache` is now required when using `apache::mod::*` + +#### Bugfixes: +- Fix syntax for validate_re +- Fix formatting in vhost template +- Fix spec tests such that they pass + +## 2012-05-08 Puppet Labs - 0.0.4 +* e62e362 Fix broken tests for ssl, vhost, vhost::* +* 42c6363 Changes to match style guide and pass puppet-lint without error +* 42bc8ba changed name => path for file resources in order to name namevar by it's name +* 72e13de One end too much +* 0739641 style guide fixes: 'true' <> true, $operatingsystem needs to be $::operatingsystem, etc. +* 273f94d fix tests +* a35ede5 (#13860) Make a2enmod/a2dismo commands optional +* 98d774e (#13860) Autorequire Package['httpd'] +* 05fcec5 (#13073) Add missing puppet spec tests +* 541afda (#6899) Remove virtual a2mod definition +* 976cb69 (#13072) Move mod python and wsgi package names to params +* 323915a (#13060) Add .gitignore to repo +* fdf40af (#13060) Remove pkg directory from source tree +* fd90015 Add LICENSE file and update the ModuleFile +* d3d0d23 Re-enable local php class +* d7516c7 Make management of firewalls configurable for vhosts +* 60f83ba Explicitly lookup scope of apache_name in templates. +* f4d287f (#12581) Add explicit ordering for vdir directory +* 88a2ac6 (#11706) puppetlabs-apache depends on puppetlabs-firewall +* a776a8b (#11071) Fix to work with latest firewall module +* 2b79e8b (#11070) Add support for Scientific Linux +* 405b3e9 Fix for a2mod +* 57b9048 Commit apache::vhost::redirect Manifest +* 8862d01 Commit apache::vhost::proxy Manifest +* d5c1fd0 Commit apache::mod::wsgi Manifest +* a825ac7 Commit apache::mod::python Manifest +* b77062f Commit Templates +* 9a51b4a Vhost File Declarations +* 6cf7312 Defaults for Parameters +* 6a5b11a Ensure installed +* f672e46 a2mod fix +* 8a56ee9 add pthon support to apache diff --git a/environments/production/modules/apache/CONTRIBUTING.md b/environments/production/modules/apache/CONTRIBUTING.md new file mode 100644 index 0000000..3c3f1e7 --- /dev/null +++ b/environments/production/modules/apache/CONTRIBUTING.md @@ -0,0 +1,218 @@ +Checklist (and a short version for the impatient) +================================================= + + * Commits: + + - Make commits of logical units. + + - Check for unnecessary whitespace with "git diff --check" before + committing. + + - Commit using Unix line endings (check the settings around "crlf" in + git-config(1)). + + - Do not check in commented out code or unneeded files. + + - The first line of the commit message should be a short + description (50 characters is the soft limit, excluding ticket + number(s)), and should skip the full stop. + + - Associate the issue in the message. The first line should include + the issue number in the form "(#XXXX) Rest of message". + + - The body should provide a meaningful commit message, which: + + - uses the imperative, present tense: "change", not "changed" or + "changes". + + - includes motivation for the change, and contrasts its + implementation with the previous behavior. + + - Make sure that you have tests for the bug you are fixing, or + feature you are adding. + + - Make sure the test suites passes after your commit: + `bundle exec rspec spec/acceptance` More information on [testing](#Testing) below + + - When introducing a new feature, make sure it is properly + documented in the README.md + + * Submission: + + * Pre-requisites: + + - Make sure you have a [GitHub account](https://github.com/join) + + - [Create a ticket](https://tickets.puppetlabs.com/secure/CreateIssue!default.jspa), or [watch the ticket](https://tickets.puppetlabs.com/browse/) you are patching for. + + * Preferred method: + + - Fork the repository on GitHub. + + - Push your changes to a topic branch in your fork of the + repository. (the format ticket/1234-short_description_of_change is + usually preferred for this project). + + - Submit a pull request to the repository in the puppetlabs + organization. + +The long version +================ + + 1. Make separate commits for logically separate changes. + + Please break your commits down into logically consistent units + which include new or changed tests relevant to the rest of the + change. The goal of doing this is to make the diff easier to + read for whoever is reviewing your code. In general, the easier + your diff is to read, the more likely someone will be happy to + review it and get it into the code base. + + If you are going to refactor a piece of code, please do so as a + separate commit from your feature or bug fix changes. + + We also really appreciate changes that include tests to make + sure the bug is not re-introduced, and that the feature is not + accidentally broken. + + Describe the technical detail of the change(s). If your + description starts to get too long, that is a good sign that you + probably need to split up your commit into more finely grained + pieces. + + Commits which plainly describe the things which help + reviewers check the patch and future developers understand the + code are much more likely to be merged in with a minimum of + bike-shedding or requested changes. Ideally, the commit message + would include information, and be in a form suitable for + inclusion in the release notes for the version of Puppet that + includes them. + + Please also check that you are not introducing any trailing + whitespace or other "whitespace errors". You can do this by + running "git diff --check" on your changes before you commit. + + 2. Sending your patches + + To submit your changes via a GitHub pull request, we _highly_ + recommend that you have them on a topic branch, instead of + directly on "master". + It makes things much easier to keep track of, especially if + you decide to work on another thing before your first change + is merged in. + + GitHub has some pretty good + [general documentation](http://help.github.com/) on using + their site. They also have documentation on + [creating pull requests](http://help.github.com/send-pull-requests/). + + In general, after pushing your topic branch up to your + repository on GitHub, you can switch to the branch in the + GitHub UI and click "Pull Request" towards the top of the page + in order to open a pull request. + + + 3. Update the related GitHub issue. + + If there is a GitHub issue associated with the change you + submitted, then you should update the ticket to include the + location of your branch, along with any other commentary you + may wish to make. + +Testing +======= + +Getting Started +--------------- + +Our puppet modules provide [`Gemfile`](./Gemfile)s which can tell a ruby +package manager such as [bundler](http://bundler.io/) what Ruby packages, +or Gems, are required to build, develop, and test this software. + +Please make sure you have [bundler installed](http://bundler.io/#getting-started) +on your system, then use it to install all dependencies needed for this project, +by running + +```shell +% bundle install +Fetching gem metadata from https://rubygems.org/........ +Fetching gem metadata from https://rubygems.org/.. +Using rake (10.1.0) +Using builder (3.2.2) +-- 8><-- many more --><8 -- +Using rspec-system-puppet (2.2.0) +Using serverspec (0.6.3) +Using rspec-system-serverspec (1.0.0) +Using bundler (1.3.5) +Your bundle is complete! +Use `bundle show [gemname]` to see where a bundled gem is installed. +``` + +NOTE some systems may require you to run this command with sudo. + +If you already have those gems installed, make sure they are up-to-date: + +```shell +% bundle update +``` + +With all dependencies in place and up-to-date we can now run the tests: + +```shell +% bundle exec rake spec +``` + +This will execute all the [rspec tests](http://rspec-puppet.com/) tests +under [spec/defines](./spec/defines), [spec/classes](./spec/classes), +and so on. rspec tests may have the same kind of dependencies as the +module they are testing. While the module defines in its [Modulefile](./Modulefile), +rspec tests define them in [.fixtures.yml](./fixtures.yml). + +Some puppet modules also come with [beaker](https://github.com/puppetlabs/beaker) +tests. These tests spin up a virtual machine under +[VirtualBox](https://www.virtualbox.org/)) with, controlling it with +[Vagrant](http://www.vagrantup.com/) to actually simulate scripted test +scenarios. In order to run these, you will need both of those tools +installed on your system. + +You can run them by issuing the following command + +```shell +% bundle exec rake spec_clean +% bundle exec rspec spec/acceptance +``` + +This will now download a pre-fabricated image configured in the [default node-set](./spec/acceptance/nodesets/default.yml), +install puppet, copy this module and install its dependencies per [spec/spec_helper_acceptance.rb](./spec/spec_helper_acceptance.rb) +and then run all the tests under [spec/acceptance](./spec/acceptance). + +Writing Tests +------------- + +XXX getting started writing tests. + +If you have commit access to the repository +=========================================== + +Even if you have commit access to the repository, you will still need to +go through the process above, and have someone else review and merge +in your changes. The rule is that all changes must be reviewed by a +developer on the project (that did not write the code) to ensure that +all changes go through a code review process. + +Having someone other than the author of the topic branch recorded as +performing the merge is the record that they performed the code +review. + + +Additional Resources +==================== + +* [Getting additional help](http://puppet.com/community/get-help) + +* [Writing tests](https://docs.puppet.com/guides/module_guides/bgtm.html#step-three-module-testing) + +* [General GitHub documentation](http://help.github.com/) + +* [GitHub pull request documentation](http://help.github.com/send-pull-requests/) + diff --git a/environments/production/modules/apache/Gemfile b/environments/production/modules/apache/Gemfile new file mode 100644 index 0000000..3d46720 --- /dev/null +++ b/environments/production/modules/apache/Gemfile @@ -0,0 +1,87 @@ +#This file is generated by ModuleSync, do not edit. + +source ENV['GEM_SOURCE'] || "https://rubygems.org" + +# Determines what type of gem is requested based on place_or_version. +def gem_type(place_or_version) + if place_or_version =~ /^git:/ + :git + elsif place_or_version =~ /^file:/ + :file + else + :gem + end +end + +# Find a location or specific version for a gem. place_or_version can be a +# version, which is most often used. It can also be git, which is specified as +# `git://somewhere.git#branch`. You can also use a file source location, which +# is specified as `file://some/location/on/disk`. +def location_for(place_or_version, fake_version = nil) + if place_or_version =~ /^(git[:@][^#]*)#(.*)/ + [fake_version, { :git => $1, :branch => $2, :require => false }].compact + elsif place_or_version =~ /^file:\/\/(.*)/ + ['>= 0', { :path => File.expand_path($1), :require => false }] + else + [place_or_version, { :require => false }] + end +end + +# Used for gem conditionals +supports_windows = false + +group :development do + gem 'puppet-lint', :require => false + gem 'metadata-json-lint', :require => false, :platforms => 'ruby' + gem 'puppet_facts', :require => false + gem 'puppet-blacksmith', '>= 3.4.0', :require => false, :platforms => 'ruby' + gem 'puppetlabs_spec_helper', '>= 1.2.1', :require => false + gem 'rspec-puppet', '>= 2.3.2', :require => false + gem 'rspec-puppet-facts', :require => false, :platforms => 'ruby' + gem 'mocha', '< 1.2.0', :require => false + gem 'simplecov', :require => false, :platforms => 'ruby' + gem 'parallel_tests', '< 2.10.0', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'parallel_tests', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.0.0') + gem 'rubocop', '0.41.2', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'rubocop', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.0.0') + gem 'rubocop-rspec', '~> 1.6', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.3.0') + gem 'pry', :require => false + gem 'json_pure', '<= 2.0.1', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'fast_gettext', '1.1.0', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.1.0') + gem 'fast_gettext', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.1.0') +end + +group :system_tests do + gem 'beaker', *location_for(ENV['BEAKER_VERSION'] || '~> 2.20') if supports_windows + gem 'beaker', *location_for(ENV['BEAKER_VERSION']) if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.3.0') and ! supports_windows + gem 'beaker', *location_for(ENV['BEAKER_VERSION'] || '< 3') if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.3.0') and ! supports_windows + gem 'beaker-pe', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.3.0') + gem 'beaker-rspec', *location_for(ENV['BEAKER_RSPEC_VERSION'] || '>= 3.4') if ! supports_windows + gem 'beaker-rspec', *location_for(ENV['BEAKER_RSPEC_VERSION'] || '~> 5.1') if supports_windows + gem 'beaker-puppet_install_helper', :require => false + gem 'master_manipulator', :require => false + gem 'beaker-hostgenerator', *location_for(ENV['BEAKER_HOSTGENERATOR_VERSION']) + gem 'beaker-abs', *location_for(ENV['BEAKER_ABS_VERSION'] || '~> 0.1') +end + +gem 'puppet', *location_for(ENV['PUPPET_GEM_VERSION']) + +# Only explicitly specify Facter/Hiera if a version has been specified. +# Otherwise it can lead to strange bundler behavior. If you are seeing weird +# gem resolution behavior, try setting `DEBUG_RESOLVER` environment variable +# to `1` and then run bundle install. +gem 'facter', *location_for(ENV['FACTER_GEM_VERSION']) if ENV['FACTER_GEM_VERSION'] +gem 'hiera', *location_for(ENV['HIERA_GEM_VERSION']) if ENV['HIERA_GEM_VERSION'] + + +# Evaluate Gemfile.local if it exists +if File.exists? "#{__FILE__}.local" + eval(File.read("#{__FILE__}.local"), binding) +end + +# Evaluate ~/.gemfile if it exists +if File.exists?(File.join(Dir.home, '.gemfile')) + eval(File.read(File.join(Dir.home, '.gemfile')), binding) +end + +# vim:ft=ruby diff --git a/environments/production/modules/apache/LICENSE b/environments/production/modules/apache/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/environments/production/modules/apache/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/environments/production/modules/apache/NOTICE b/environments/production/modules/apache/NOTICE new file mode 100644 index 0000000..c07b29d --- /dev/null +++ b/environments/production/modules/apache/NOTICE @@ -0,0 +1,17 @@ +apache puppet module + +Copyright (C) 2012-2016 Puppet Labs, Inc. + +Puppet Labs can be contacted at: info@puppetlabs.com + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/environments/production/modules/apache/README.md b/environments/production/modules/apache/README.md new file mode 100644 index 0000000..ae4a81b --- /dev/null +++ b/environments/production/modules/apache/README.md @@ -0,0 +1,4097 @@ +# apache + +[Module description]: #module-description + +[Setup]: #setup +[Beginning with Apache]: #beginning-with-apache + +[Usage]: #usage +[Configuring virtual hosts]: #configuring-virtual-hosts +[Configuring virtual hosts with SSL]: #configuring-virtual-hosts-with-ssl +[Configuring virtual host port and address bindings]: #configuring-virtual-host-port-and-address-bindings +[Configuring virtual hosts for apps and processors]: #configuring-virtual-hosts-for-apps-and-processors +[Configuring IP-based virtual hosts]: #configuring-ip-based-virtual-hosts +[Installing Apache modules]: #installing-apache-modules +[Installing arbitrary modules]: #installing-arbitrary-modules +[Installing specific modules]: #installing-specific-modules +[Configuring FastCGI servers]: #configuring-fastcgi-servers-to-handle-php-files +[Load balancing examples]: #load-balancing-examples + +[Reference]: #reference +[Public classes]: #public-classes +[Private classes]: #private-classes +[Public defined types]: #public-defined-types +[Private defined types]: #private-defined-types +[Templates]: #templates + +[Limitations]: #limitations + +[Development]: #development +[Contributing]: #contributing +[Running tests]: #running-tests + +[`AddDefaultCharset`]: https://httpd.apache.org/docs/current/mod/core.html#adddefaultcharset +[`add_listen`]: #add_listen +[`Alias`]: https://httpd.apache.org/docs/current/mod/mod_alias.html#alias +[`AliasMatch`]: https://httpd.apache.org/docs/current/mod/mod_alias.html#aliasmatch +[aliased servers]: https://httpd.apache.org/docs/current/urlmapping.html +[`AllowEncodedSlashes`]: https://httpd.apache.org/docs/current/mod/core.html#allowencodedslashes +[`apache`]: #class-apache +[`apache_version`]: #apache_version +[`apache::balancer`]: #defined-type-apachebalancer +[`apache::balancermember`]: #defined-type-apachebalancermember +[`apache::fastcgi::server`]: #defined-type-apachefastcgiserver +[`apache::mod`]: #defined-type-apachemod +[`apache::mod::`]: #classes-apachemodmodule-name +[`apache::mod::alias`]: #class-apachemodalias +[`apache::mod::auth_cas`]: #class-apachemodauth_cas +[`apache::mod::auth_mellon`]: #class-apachemodauth_mellon +[`apache::mod::authn_dbd`]: #class-apachemodauthn_dbd +[`apache::mod::authnz_ldap`]: #class-apachemodauthnz_ldap +[`apache::mod::cluster`]: #class-apachemodcluster +[`apache::mod::disk_cache`]: #class-apachemoddisk_cache +[`apache::mod::dumpio`]: #class-apachemoddumpio +[`apache::mod::event`]: #class-apachemodevent +[`apache::mod::ext_filter`]: #class-apachemodext_filter +[`apache::mod::geoip`]: #class-apachemodgeoip +[`apache::mod::itk`]: #class-apachemoditk +[`apache::mod::ldap`]: #class-apachemodldap +[`apache::mod::passenger`]: #class-apachemodpassenger +[`apache::mod::peruser`]: #class-apachemodperuser +[`apache::mod::prefork`]: #class-apachemodprefork +[`apache::mod::proxy`]: #class-apachemodproxy +[`apache::mod::proxy_balancer`]: #class-apachemodproxybalancer +[`apache::mod::proxy_fcgi`]: #class-apachemodproxy_fcgi +[`apache::mod::proxy_html`]: #class-apachemodproxy_html +[`apache::mod::security`]: #class-apachemodsecurity +[`apache::mod::shib`]: #class-apachemodshib +[`apache::mod::ssl`]: #class-apachemodssl +[`apache::mod::status`]: #class-apachemodstatus +[`apache::mod::worker`]: #class-apachemodworker +[`apache::mod::wsgi`]: #class-apachemodwsgi +[`apache::params`]: #class-apacheparams +[`apache::version`]: #class-apacheversion +[`apache::vhost`]: #defined-type-apachevhost +[`apache::vhost::custom`]: #defined-type-apachevhostcustom +[`apache::vhost::WSGIImportScript`]: #wsgiimportscript +[Apache HTTP Server]: https://httpd.apache.org +[Apache modules]: https://httpd.apache.org/docs/current/mod/ +[array]: https://docs.puppetlabs.com/puppet/latest/reference/lang_data_array.html + +[audit log]: https://github.com/SpiderLabs/ModSecurity/wiki/ModSecurity-2-Data-Formats#audit-log + +[beaker-rspec]: https://github.com/puppetlabs/beaker-rspec + +[certificate revocation list]: https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcarevocationfile +[certificate revocation list path]: https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcarevocationpath +[common gateway interface]: https://httpd.apache.org/docs/current/howto/cgi.html +[`confd_dir`]: #confd_dir +[`content`]: #content +[custom error documents]: https://httpd.apache.org/docs/current/custom-error.html +[`custom_fragment`]: #custom_fragment + +[`default_mods`]: #default_mods +[`default_ssl_crl`]: #default_ssl_crl +[`default_ssl_crl_path`]: #default_ssl_crl_path +[`default_ssl_vhost`]: #default_ssl_vhost +[`dev_packages`]: #dev_packages +[`directory`]: #directory +[`directories`]: #parameter-directories-for-apachevhost +[`DirectoryIndex`]: https://httpd.apache.org/docs/current/mod/mod_dir.html#directoryindex +[`docroot`]: #docroot +[`docroot_owner`]: #docroot_owner +[`docroot_group`]: #docroot_group +[`DocumentRoot`]: https://httpd.apache.org/docs/current/mod/core.html#documentroot + +[`EnableSendfile`]: https://httpd.apache.org/docs/current/mod/core.html#enablesendfile +[enforcing mode]: http://selinuxproject.org/page/Guide/Mode +[`ensure`]: https://docs.puppetlabs.com/references/latest/type.html#package-attribute-ensure +[`error_log_file`]: #error_log_file +[`error_log_syslog`]: #error_log_syslog +[`error_log_pipe`]: #error_log_pipe +[`ExpiresByType`]: https://httpd.apache.org/docs/current/mod/mod_expires.html#expiresbytype +[exported resources]: http://docs.puppetlabs.com/latest/reference/lang_exported.md +[`ExtendedStatus`]: https://httpd.apache.org/docs/current/mod/core.html#extendedstatus + +[Facter]: http://docs.puppetlabs.com/facter/ +[FastCGI]: http://www.fastcgi.com/ +[FallbackResource]: https://httpd.apache.org/docs/current/mod/mod_dir.html#fallbackresource +[`fallbackresource`]: #fallbackresource +[filter rules]: https://httpd.apache.org/docs/current/filter.html +[`filters`]: #filters +[`ForceType`]: https://httpd.apache.org/docs/current/mod/core.html#forcetype + +[GeoIPScanProxyHeaders]: http://dev.maxmind.com/geoip/legacy/mod_geoip2/#Proxy-Related_Directives +[`gentoo/puppet-portage`]: https://github.com/gentoo/puppet-portage + +[Hash]: https://docs.puppetlabs.com/puppet/latest/reference/lang_data_hash.html + +[`IncludeOptional`]: https://httpd.apache.org/docs/current/mod/core.html#includeoptional +[`Include`]: https://httpd.apache.org/docs/current/mod/core.html#include +[interval syntax]: https://httpd.apache.org/docs/current/mod/mod_expires.html#AltSyn +[`ip`]: #ip +[`ip_based`]: #ip_based +[IP-based virtual hosts]: https://httpd.apache.org/docs/current/vhosts/ip-based.html + +[`KeepAlive`]: https://httpd.apache.org/docs/current/mod/core.html#keepalive +[`KeepAliveTimeout`]: https://httpd.apache.org/docs/current/mod/core.html#keepalivetimeout +[`keepalive` parameter]: #keepalive +[`keepalive_timeout`]: #keepalive_timeout +[`limitreqfieldsize`]: https://httpd.apache.org/docs/current/mod/core.html#limitrequestfieldsize + +[`lib`]: #lib +[`lib_path`]: #lib_path +[`Listen`]: https://httpd.apache.org/docs/current/bind.html +[`ListenBackLog`]: https://httpd.apache.org/docs/current/mod/mpm_common.html#listenbacklog +[`LoadFile`]: https://httpd.apache.org/docs/current/mod/mod_so.html#loadfile +[`LogFormat`]: https://httpd.apache.org/docs/current/mod/mod_log_config.html#logformat +[`logroot`]: #logroot +[Log security]: https://httpd.apache.org/docs/current/logs.html#security + +[`manage_docroot`]: #manage_docroot +[`manage_user`]: #manage_user +[`manage_group`]: #manage_group +[`MaxConnectionsPerChild`]: https://httpd.apache.org/docs/current/mod/mpm_common.html#maxconnectionsperchild +[`max_keepalive_requests`]: #max_keepalive_requests +[`MaxRequestWorkers`]: https://httpd.apache.org/docs/current/mod/mpm_common.html#maxrequestworkers +[`MaxSpareThreads`]: https://httpd.apache.org/docs/current/mod/mpm_common.html#maxsparethreads +[MIME `content-type`]: https://www.iana.org/assignments/media-types/media-types.xhtml +[`MinSpareThreads`]: https://httpd.apache.org/docs/current/mod/mpm_common.html#minsparethreads +[`mod_alias`]: https://httpd.apache.org/docs/current/mod/mod_alias.html +[`mod_auth_cas`]: https://github.com/Jasig/mod_auth_cas +[`mod_auth_kerb`]: http://modauthkerb.sourceforge.net/configure.html +[`mod_authnz_external`]: https://github.com/phokz/mod-auth-external +[`mod_auth_dbd`]: http://httpd.apache.org/docs/current/mod/mod_authn_dbd.html +[`mod_auth_mellon`]: https://github.com/UNINETT/mod_auth_mellon +[`mod_dbd`]: http://httpd.apache.org/docs/current/mod/mod_dbd.html +[`mod_disk_cache`]: https://httpd.apache.org/docs/2.2/mod/mod_disk_cache.html +[`mod_dumpio`]: https://httpd.apache.org/docs/2.4/mod/mod_dumpio.html +[`mod_env`]: http://httpd.apache.org/docs/current/mod/mod_env.html +[`mod_expires`]: https://httpd.apache.org/docs/current/mod/mod_expires.html +[`mod_ext_filter`]: https://httpd.apache.org/docs/current/mod/mod_ext_filter.html +[`mod_fcgid`]: https://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html +[`mod_geoip`]: http://dev.maxmind.com/geoip/legacy/mod_geoip2/ +[`mod_info`]: https://httpd.apache.org/docs/current/mod/mod_info.html +[`mod_ldap`]: https://httpd.apache.org/docs/2.2/mod/mod_ldap.html +[`mod_mpm_event`]: https://httpd.apache.org/docs/current/mod/event.html +[`mod_negotiation`]: https://httpd.apache.org/docs/current/mod/mod_negotiation.html +[`mod_pagespeed`]: https://developers.google.com/speed/pagespeed/module/?hl=en +[`mod_passenger`]: https://www.phusionpassenger.com/library/config/apache/reference/ +[`mod_php`]: http://php.net/manual/en/book.apache.php +[`mod_proxy`]: https://httpd.apache.org/docs/current/mod/mod_proxy.html +[`mod_proxy_balancer`]: https://httpd.apache.org/docs/current/mod/mod_proxy_balancer.html +[`mod_reqtimeout`]: https://httpd.apache.org/docs/current/mod/mod_reqtimeout.html +[`mod_rewrite`]: https://httpd.apache.org/docs/current/mod/mod_rewrite.html +[`mod_security`]: https://www.modsecurity.org/ +[`mod_ssl`]: https://httpd.apache.org/docs/current/mod/mod_ssl.html +[`mod_status`]: https://httpd.apache.org/docs/current/mod/mod_status.html +[`mod_version`]: https://httpd.apache.org/docs/current/mod/mod_version.html +[`mod_wsgi`]: https://modwsgi.readthedocs.org/en/latest/ +[module contribution guide]: https://docs.puppetlabs.com/forge/contributing.html +[`mpm_module`]: #mpm_module +[multi-processing module]: https://httpd.apache.org/docs/current/mpm.html + +[name-based virtual hosts]: https://httpd.apache.org/docs/current/vhosts/name-based.html +[`no_proxy_uris`]: #no_proxy_uris + +[open source Puppet]: https://docs.puppetlabs.com/puppet/ +[`Options`]: https://httpd.apache.org/docs/current/mod/core.html#options + +[`path`]: #path +[`Peruser`]: https://www.freebsd.org/cgi/url.cgi?ports/www/apache22-peruser-mpm/pkg-descr +[`port`]: #port +[`priority`]: #defined-types-apachevhost +[`proxy_dest`]: #proxy_dest +[`proxy_dest_match`]: #proxy_dest_match +[`proxy_pass`]: #proxy_pass +[`ProxyPass`]: https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxypass +[`ProxySet`]: https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxyset +[Puppet Enterprise]: https://docs.puppetlabs.com/pe/ +[Puppet Forge]: https://forge.puppetlabs.com +[Puppet Labs]: https://puppetlabs.com +[Puppet module]: https://docs.puppetlabs.com/puppet/latest/reference/modules_fundamentals.html +[Puppet module's code]: https://github.com/puppetlabs/puppetlabs-apache/blob/master/manifests/default_mods.pp +[`purge_configs`]: #purge_configs +[`purge_vhost_dir`]: #purge_vhost_dir +[Python]: https://www.python.org/ + +[Rack]: http://rack.github.io/ +[`rack_base_uris`]: #rack_base_uris +[RFC 2616]: https://www.ietf.org/rfc/rfc2616.txt +[`RequestReadTimeout`]: https://httpd.apache.org/docs/current/mod/mod_reqtimeout.html#requestreadtimeout +[rspec-puppet]: http://rspec-puppet.com/ + +[`ScriptAlias`]: https://httpd.apache.org/docs/current/mod/mod_alias.html#scriptalias +[`ScriptAliasMatch`]: https://httpd.apache.org/docs/current/mod/mod_alias.html#scriptaliasmatch +[`scriptalias`]: #scriptalias +[SELinux]: http://selinuxproject.org/ +[`ServerAdmin`]: https://httpd.apache.org/docs/current/mod/core.html#serveradmin +[`serveraliases`]: #serveraliases +[`ServerLimit`]: https://httpd.apache.org/docs/current/mod/mpm_common.html#serverlimit +[`ServerName`]: https://httpd.apache.org/docs/current/mod/core.html#servername +[`ServerRoot`]: https://httpd.apache.org/docs/current/mod/core.html#serverroot +[`ServerTokens`]: https://httpd.apache.org/docs/current/mod/core.html#servertokens +[`ServerSignature`]: https://httpd.apache.org/docs/current/mod/core.html#serversignature +[Service attribute restart]: http://docs.puppetlabs.com/references/latest/type.html#service-attribute-restart +[`source`]: #source +[`SSLCARevocationCheck`]: https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcarevocationcheck +[SSL certificate key file]: https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcertificatekeyfile +[SSL chain]: https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcertificatechainfile +[SSL encryption]: https://httpd.apache.org/docs/current/ssl/index.html +[`ssl`]: #ssl +[`ssl_cert`]: #ssl_cert +[`ssl_compression`]: #ssl_compression +[`ssl_key`]: #ssl_key +[`StartServers`]: https://httpd.apache.org/docs/current/mod/mpm_common.html#startservers +[suPHP]: http://www.suphp.org/Home.html +[`suphp_addhandler`]: #suphp_addhandler +[`suphp_configpath`]: #suphp_configpath +[`suphp_engine`]: #suphp_engine +[supported operating system]: https://forge.puppetlabs.com/supported#puppet-supported-modules-compatibility-matrix + +[`ThreadLimit`]: https://httpd.apache.org/docs/current/mod/mpm_common.html#threadlimit +[`ThreadsPerChild`]: https://httpd.apache.org/docs/current/mod/mpm_common.html#threadsperchild +[`TimeOut`]: https://httpd.apache.org/docs/current/mod/core.html#timeout +[template]: http://docs.puppetlabs.com/puppet/latest/reference/lang_template.html +[`TraceEnable`]: https://httpd.apache.org/docs/current/mod/core.html#traceenable + +[`verify_config`]: #verify_config +[`vhost`]: #defined-type-apachevhost +[`vhost_dir`]: #vhost_dir +[`virtual_docroot`]: #virtual_docroot + +[Web Server Gateway Interface]: https://www.python.org/dev/peps/pep-3333/#abstract +[`WSGIPythonPath`]: http://modwsgi.readthedocs.org/en/develop/configuration-directives/WSGIPythonPath.html +[`WSGIPythonHome`]: http://modwsgi.readthedocs.org/en/develop/configuration-directives/WSGIPythonHome.html + +#### Table of Contents + +1. [Module description - What is the apache module, and what does it do?][Module description] +2. [Setup - The basics of getting started with apache][Setup] + - [Beginning with Apache - Installation][Beginning with Apache] +3. [Usage - The classes and defined types available for configuration][Usage] + - [Configuring virtual hosts - Examples to help get started][Configuring virtual hosts] + - [Configuring FastCGI servers to handle PHP files][Configuring FastCGI servers] + - [Load balancing with exported and non-exported resources][Load balancing examples] +4. [Reference - An under-the-hood peek at what the module is doing and how][Reference] + - [Public classes][] + - [Private classes][] + - [Public defined types][] + - [Private defined types][] + - [Templates][] +5. [Limitations - OS compatibility, etc.][Limitations] +6. [Development - Guide for contributing to the module][Development] + - [Contributing to the apache module][Contributing] + - [Running tests - A quick guide][Running tests] + +## Module description + +[Apache HTTP Server][] (also called Apache HTTPD, or simply Apache) is a widely used web server. This [Puppet module][] simplifies the task of creating configurations to manage Apache servers in your infrastructure. It can configure and manage a range of virtual host setups and provides a streamlined way to install and configure [Apache modules][]. + +## Setup + +**What the apache Puppet module affects:** + +- Configuration files and directories (created and written to) + - **WARNING**: Configurations *not* managed by Puppet will be purged. +- Package/service/configuration files for Apache +- Apache modules +- Virtual hosts +- Listened-to ports +- `/etc/make.conf` on FreeBSD and Gentoo + +On Gentoo, this module depends on the [`gentoo/puppet-portage`][] Puppet module. Note that while several options apply or enable certain features and settings for Gentoo, it is not a [supported operating system][] for this module. + +> **Note**: This module modifies Apache configuration files and directories and purges any configuration not managed by Puppet. Apache configuration should be managed by Puppet, as unmanaged configuration files can cause unexpected failures. + +To temporarily disable full Puppet management, set the [`purge_configs`][] parameter in the [`apache`][] class declaration to false. We recommend using this only as a temporary means of saving and relocating customized configurations. + +### Beginning with Apache + +To have Puppet install Apache with the default parameters, declare the [`apache`][] class: + +``` puppet +class { 'apache': } +``` + +The Puppet module applies a default configuration based on your operating system; Debian, Red Hat, FreeBSD, and Gentoo systems each have unique default configurations. These defaults work in testing environments but are not suggested for production, and Puppet recommends customizing the class's parameters to suit your site. Use the [Reference](#reference) section to find information about the class's parameters and their default values. + +You can customize parameters when declaring the `apache` class. For instance, this declaration installs Apache without the apache module's [default virtual host configuration][Configuring virtual hosts], allowing you to customize all Apache virtual hosts: + +``` puppet +class { 'apache': + default_vhost => false, +} +``` + +> **Note**: When `default_vhost` is set to `false` you have to add at least one `apache::vhost` resource or Apache will not start. + +## Usage + +### Configuring virtual hosts + +The default [`apache`][] class sets up a virtual host on port 80, listening on all interfaces and serving the [`docroot`][] parameter's default directory of `/var/www`. + +> **Note**: See the [`apache::vhost`][] defined type's reference for a list of all virtual host parameters. + +To configure basic [name-based virtual hosts][], specify the [`port`][] and [`docroot`][] parameters in the [`apache::vhost`][] defined type: + +``` puppet +apache::vhost { 'vhost.example.com': + port => '80', + docroot => '/var/www/vhost', +} +``` + +> **Note**: Apache processes virtual hosts in alphabetical order, and server administrators can prioritize Apache's virtual host processing by prefixing a virtual host's configuration file name with a number. The [`apache::vhost`][] defined type applies a default [`priority`][] of 15, which Puppet interprets by prefixing the virtual host's file name with `15-`. This all means that if multiple sites have the same priority, or if you disable priority numbers by setting the `priority` parameter's value to false, Apache still processes virtual hosts in alphabetical order. + +To configure user and group ownership for `docroot`, use the [`docroot_owner`][] and [`docroot_group`][] parameters: + +``` puppet +apache::vhost { 'user.example.com': + port => '80', + docroot => '/var/www/user', + docroot_owner => 'www-data', + docroot_group => 'www-data', +} +``` + +#### Configuring virtual hosts with SSL + +To configure a virtual host to use [SSL encryption][] and default SSL certificates, set the [`ssl`][] parameter. You must also specify the [`port`][] parameter, typically with a value of '443', to accommodate HTTPS requests: + +``` puppet +apache::vhost { 'ssl.example.com': + port => '443', + docroot => '/var/www/ssl', + ssl => true, +} +``` + +To configure a virtual host to use SSL and specific SSL certificates, use the paths to the certificate and key in the [`ssl_cert`][] and [`ssl_key`][] parameters, respectively: + +``` puppet +apache::vhost { 'cert.example.com': + port => '443', + docroot => '/var/www/cert', + ssl => true, + ssl_cert => '/etc/ssl/fourth.example.com.cert', + ssl_key => '/etc/ssl/fourth.example.com.key', +} +``` + +To configure a mix of SSL and unencrypted virtual hosts at the same domain, declare them with separate [`apache::vhost`][] defined types: + +``` puppet +# The non-ssl virtual host +apache::vhost { 'mix.example.com non-ssl': + servername => 'mix.example.com', + port => '80', + docroot => '/var/www/mix', +} + +# The SSL virtual host at the same domain +apache::vhost { 'mix.example.com ssl': + servername => 'mix.example.com', + port => '443', + docroot => '/var/www/mix', + ssl => true, +} +``` + +To configure a virtual host to redirect unencrypted connections to SSL, declare them with separate [`apache::vhost`][] defined types and redirect unencrypted requests to the virtual host with SSL enabled: + +``` puppet +apache::vhost { 'redirect.example.com non-ssl': + servername => 'redirect.example.com', + port => '80', + docroot => '/var/www/redirect', + redirect_status => 'permanent', + redirect_dest => 'https://redirect.example.com/' +} + +apache::vhost { 'redirect.example.com ssl': + servername => 'redirect.example.com', + port => '443', + docroot => '/var/www/redirect', + ssl => true, +} +``` + +#### Configuring virtual host port and address bindings + +Virtual hosts listen on all IP addresses ('\*') by default. To configure the virtual host to listen on a specific IP address, use the [`ip`][] parameter: + +``` puppet +apache::vhost { 'ip.example.com': + ip => '127.0.0.1', + port => '80', + docroot => '/var/www/ip', +} +``` + +It is also possible to configure more than one IP address per virtual host by using an array of IP addresses for the [`ip`][] parameter: + +``` puppet +apache::vhost { 'ip.example.com': + ip => ['127.0.0.1','169.254.1.1'], + port => '80', + docroot => '/var/www/ip', +} +``` + +To configure a virtual host with [aliased servers][], refer to the aliases using the [`serveraliases`][] parameter: + +``` puppet +apache::vhost { 'aliases.example.com': + serveraliases => [ + 'aliases.example.org', + 'aliases.example.net', + ], + port => '80', + docroot => '/var/www/aliases', +} +``` + +To set up a virtual host with a wildcard alias for the subdomain mapped to a same-named directory, such as 'http://example.com.loc' mapped to `/var/www/example.com`, define the wildcard alias using the [`serveraliases`][] parameter and the document root with the [`virtual_docroot`][] parameter: + +``` puppet +apache::vhost { 'subdomain.loc': + vhost_name => '*', + port => '80', + virtual_docroot => '/var/www/%-2+', + docroot => '/var/www', + serveraliases => ['*.loc',], +} +``` + +To configure a virtual host with [filter rules][], pass the filter directives as an [array][] using the [`filters`][] parameter: + +``` puppet +apache::vhost { 'subdomain.loc': + port => '80', + filters => [ + 'FilterDeclare COMPRESS', + 'FilterProvider COMPRESS DEFLATE resp=Content-Type $text/html', + 'FilterChain COMPRESS', + 'FilterProtocol COMPRESS DEFLATE change=yes;byteranges=no', + ], + docroot => '/var/www/html', +} +``` + +#### Configuring virtual hosts for apps and processors + +To set up a virtual host with [suPHP][], use the [`suphp_engine`][] parameter to enable the suPHP engine, [`suphp_addhandler`][] parameter to define a MIME type, [`suphp_configpath`][] to set which path suPHP passes to the PHP interpreter, and the [`directory`][] parameter to configure Directory, File, and Location directive blocks: + +``` puppet +apache::vhost { 'suphp.example.com': + port => '80', + docroot => '/home/appuser/myphpapp', + suphp_addhandler => 'x-httpd-php', + suphp_engine => 'on', + suphp_configpath => '/etc/php5/apache2', + directories => [ + { 'path' => '/home/appuser/myphpapp', + 'suphp' => { + user => 'myappuser', + group => 'myappgroup', + }, + }, + ], +} +``` + +You can use a set of parameters to configure a virtual host to use the [Web Server Gateway Interface][] (WSGI) for [Python][] applications: + +``` puppet +apache::vhost { 'wsgi.example.com': + port => '80', + docroot => '/var/www/pythonapp', + wsgi_application_group => '%{GLOBAL}', + wsgi_daemon_process => 'wsgi', + wsgi_daemon_process_options => { + processes => '2', + threads => '15', + display-name => '%{GROUP}', + }, + wsgi_import_script => '/var/www/demo.wsgi', + wsgi_import_script_options => { + process-group => 'wsgi', + application-group => '%{GLOBAL}', + }, + wsgi_process_group => 'wsgi', + wsgi_script_aliases => { '/' => '/var/www/demo.wsgi' }, +} +``` + +Starting in Apache 2.2.16, Apache supports [FallbackResource][], a simple replacement for common RewriteRules. You can set a FallbackResource using the [`fallbackresource`][] parameter: + +``` puppet +apache::vhost { 'wordpress.example.com': + port => '80', + docroot => '/var/www/wordpress', + fallbackresource => '/index.php', +} +``` + +> **Note**: The `fallbackresource` parameter only supports the 'disabled' value since Apache 2.2.24. + +To configure a virtual host with a designated directory for [Common Gateway Interface][] (CGI) files, use the [`scriptalias`][] parameter to define the `cgi-bin` path: + +``` puppet +apache::vhost { 'cgi.example.com': + port => '80', + docroot => '/var/www/cgi', + scriptalias => '/usr/lib/cgi-bin', +} +``` + +To configure a virtual host for [Rack][], use the [`rack_base_uris`][] parameter: + +``` puppet +apache::vhost { 'rack.example.com': + port => '80', + docroot => '/var/www/rack', + rack_base_uris => ['/rackapp1', '/rackapp2'], +} +``` + +#### Configuring IP-based virtual hosts + +You can configure [IP-based virtual hosts][] to listen on any port and have them respond to requests on specific IP addresses. In this example, we set the server to listen on ports 80 and 81 because the example virtual hosts are _not_ declared with a [`port`][] parameter: + +``` puppet +apache::listen { '80': } + +apache::listen { '81': } +``` + +Then we configure the IP-based virtual hosts with the [`ip_based`][] parameter: + +``` puppet +apache::vhost { 'first.example.com': + ip => '10.0.0.10', + docroot => '/var/www/first', + ip_based => true, +} + +apache::vhost { 'second.example.com': + ip => '10.0.0.11', + docroot => '/var/www/second', + ip_based => true, +} +``` + +You can also configure a mix of IP- and [name-based virtual hosts][], and in any combination of [SSL][SSL encryption] and unencrypted configurations. First, we add two IP-based virtual hosts on an IP address (in this example, 10.0.0.10). One uses SSL and the other is unencrypted: + +``` puppet +apache::vhost { 'The first IP-based virtual host, non-ssl': + servername => 'first.example.com', + ip => '10.0.0.10', + port => '80', + ip_based => true, + docroot => '/var/www/first', +} + +apache::vhost { 'The first IP-based vhost, ssl': + servername => 'first.example.com', + ip => '10.0.0.10', + port => '443', + ip_based => true, + docroot => '/var/www/first-ssl', + ssl => true, +} +``` + +Next, we add two name-based virtual hosts listening on a second IP address (10.0.0.20): + +``` puppet +apache::vhost { 'second.example.com': + ip => '10.0.0.20', + port => '80', + docroot => '/var/www/second', +} + +apache::vhost { 'third.example.com': + ip => '10.0.0.20', + port => '80', + docroot => '/var/www/third', +} +``` + +To add name-based virtual hosts that answer on either 10.0.0.10 or 10.0.0.20, you **must** set the [`add_listen`][] parameter to false to disable the default Apache setting of `Listen 80`, as it conflicts with the preceding IP-based virtual hosts. + +``` puppet +apache::vhost { 'fourth.example.com': + port => '80', + docroot => '/var/www/fourth', + add_listen => false, +} + +apache::vhost { 'fifth.example.com': + port => '80', + docroot => '/var/www/fifth', + add_listen => false, +} +``` + +### Installing Apache modules + +There are two ways to install [Apache modules][] using the Puppet apache module: + +- Use the [`apache::mod::`][] classes to [install specific Apache modules with parameters][Installing specific modules]. +- Use the [`apache::mod`][] defined type to [install arbitrary Apache modules][Installing arbitrary modules]. + +#### Installing specific modules + +The Puppet apache module supports installing many common [Apache modules][], often with parameterized configuration options. For a list of supported Apache modules, see the [`apache::mod::`][] class references. + +For example, you can install the `mod_ssl` Apache module with default settings by declaring the [`apache::mod::ssl`][] class: + +``` puppet +class { 'apache::mod::ssl': } +``` + +[`apache::mod::ssl`][] has several parameterized options that you can set when declaring it. For instance, to enable `mod_ssl` with compression enabled, set the [`ssl_compression`][] parameter to true: + +``` puppet +class { 'apache::mod::ssl': + ssl_compression => true, +} +``` + +Note that some modules have prerequisites, which are documented in their references under [`apache::mod::`][]. + +#### Installing arbitrary modules + +You can pass the name of any module that your operating system's package manager can install to the [`apache::mod`][] defined type to install it. Unlike the specific-module classes, the [`apache::mod`][] defined type doesn't tailor the installation based on other installed modules or with specific parameters---Puppet only grabs and installs the module's package, leaving detailed configuration up to you. + +For example, to install the [`mod_authnz_external`][] Apache module, declare the defined type with the 'mod_authnz_external' name: + +``` puppet +apache::mod { 'mod_authnz_external': } +``` + +There are several optional parameters you can specify when defining Apache modules this way. See the [defined type's reference][`apache::mod`] for details. + +### Configuring FastCGI servers to handle PHP files + +Add the [`apache::fastcgi::server`][] defined type to allow [FastCGI][] servers to handle requests for specific files. For example, the following defines a FastCGI server at 127.0.0.1 (localhost) on port 9000 to handle PHP requests: + +``` puppet +apache::fastcgi::server { 'php': + host => '127.0.0.1:9000', + timeout => 15, + flush => false, + faux_path => '/var/www/php.fcgi', + fcgi_alias => '/php.fcgi', + file_type => 'application/x-httpd-php' +} +``` + +You can then use the [`custom_fragment`][] parameter to configure the virtual host to have the FastCGI server handle the specified file type: + +``` puppet +apache::vhost { 'www': + ... + custom_fragment => 'AddType application/x-httpd-php .php' + ... +} +``` + +### Load balancing examples + +Apache supports load balancing across groups of servers through the [`mod_proxy`][] Apache module. Puppet supports configuring Apache load balancing groups (also known as balancer clusters) through the [`apache::balancer`][] and [`apache::balancermember`][] defined types. + +To enable load balancing with [exported resources][], export the [`apache::balancermember`][] defined type from the load balancer member server: + +``` puppet +@@apache::balancermember { "${::fqdn}-puppet00": + balancer_cluster => 'puppet00', + url => "ajp://${::fqdn}:8009", + options => ['ping=5', 'disablereuse=on', 'retry=5', 'ttl=120'], +} +``` + +Then, on the proxy server, create the load balancing group: + +``` puppet +apache::balancer { 'puppet00': } +``` + +To enable load balancing without exporting resources, declare the following on the proxy server: + +``` puppet +apache::balancer { 'puppet00': } + +apache::balancermember { "${::fqdn}-puppet00": + balancer_cluster => 'puppet00', + url => "ajp://${::fqdn}:8009", + options => ['ping=5', 'disablereuse=on', 'retry=5', 'ttl=120'], +} +``` + +Then declare the `apache::balancer` and `apache::balancermember` defined types on the proxy server. + +If you need to use the [ProxySet](https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxyset) directive on the balancer, use the [`proxy_set`](#proxy_set) parameter of `apache::balancer`: + +``` puppet +apache::balancer { 'puppet01': + proxy_set => { + 'stickysession' => 'JSESSIONID', + 'lbmethod' => 'bytraffic', + }, +} +``` + +Load balancing scheduler algorithms (`lbmethod`) are listed [in mod_proxy_balancer documentation](https://httpd.apache.org/docs/current/mod/mod_proxy_balancer.html). + +## Reference + +- [**Public classes**](#public-classes) + - [Class: apache](#class-apache) + - [Class: apache::dev](#class-apachedev) + - [Class: apache::vhosts](#class-apachevhosts) + - [Classes: apache::mod::\*](#classes-apachemodname) +- [**Private classes**](#private-classes) + - [Class: apache::confd::no_accf](#class-apacheconfdno_accf) + - [Class: apache::default_confd_files](#class-apachedefault_confd_files) + - [Class: apache::default_mods](#class-apachedefault_mods) + - [Class: apache::package](#class-apachepackage) + - [Class: apache::params](#class-apacheparams) + - [Class: apache::service](#class-apacheservice) + - [Class: apache::version](#class-apacheversion) +- [**Public defined types**](#public-defined-types) + - [Defined type: apache::balancer](#defined-type-apachebalancer) + - [Defined type: apache::balancermember](#defined-type-apachebalancermember) + - [Defined type: apache::custom_config](#defined-type-apachecustom_config) + - [Defined type: apache::fastcgi::server](#defined-type-fastcgi-server) + - [Defined type: apache::listen](#defined-type-apachelisten) + - [Defined type: apache::mod](#defined-type-apachemod) + - [Defined type: apache::namevirtualhost](#defined-type-apachenamevirtualhost) + - [Defined type: apache::vhost](#defined-type-apachevhost) + - [Defined type: apache::vhost::custom](#defined-type-apachevhostcustom) +- [**Private defined types**](#private-defined-types) + - [Defined type: apache::default_mods::load](#defined-type-default_mods-load) + - [Defined type: apache::peruser::multiplexer](#defined-type-apacheperusermultiplexer) + - [Defined type: apache::peruser::processor](#defined-type-apacheperuserprocessor) + - [Defined type: apache::security::file_link](#defined-type-apachesecurityfile_link) +- [**Templates**](#templates) + +### Public Classes + +#### Class: `apache` + +Guides the basic setup and installation of Apache on your system. + +When this class is declared with the default options, Puppet: + +- Installs the appropriate Apache software package and [required Apache modules](#default_mods) for your operating system. +- Places the required configuration files in a directory, with the [default location](#conf_dir) determined by your operating system. +- Configures the server with a default virtual host and standard port ('80') and address ('\*') bindings. +- Creates a document root directory determined by your operating system, typically `/var/www`. +- Starts the Apache service. + +You can simply declare the default `apache` class: + +``` puppet +class { 'apache': } +``` + +You can establish a default virtual host in this class, by using the [`apache::vhost`][] defined type, or both. You can also configure additional specific virtual hosts with the [`apache::vhost`][] defined type. Puppet recommends customizing the `apache` class's declaration with the following parameters, as its default settings are not optimized for production. + +**Parameters within `apache`:** + +##### `allow_encoded_slashes` + +Sets the server default for the [`AllowEncodedSlashes`][] declaration, which modifies the responses to URLs containing '\' and '/' characters. Valid options: 'on', 'off', 'nodecode'. Default: undef, which omits the declaration from the server's configuration and uses Apache's default setting of 'off'. + +##### `apache_version` + +Configures module template behavior, package names, and default Apache modules by defining the version of Apache to use. Default: Determined by your operating system family and release via the [`apache::version`][] class. Puppet recommends against manually configuring this parameter without reason. + +##### `conf_dir` + +Sets the directory where the Apache server's main configuration file is located. Default: Depends on your operating system. + +- **Debian**: `/etc/apache2` +- **FreeBSD**: `/usr/local/etc/apache22` +- **Gentoo**: `/etc/apache2` +- **Red Hat**: `/etc/httpd/conf` + +##### `conf_template` + +Defines the [template][] used for the main Apache configuration file. Default: `apache/httpd.conf.erb`. Modifying this parameter is potentially risky, as the apache Puppet module is designed to use a minimal configuration file customized by `conf.d` entries. + +##### `confd_dir` + +Sets the location of the Apache server's custom configuration directory. Default: Depends on your operating system. + +- **Debian**: `/etc/apache2/conf.d` +- **FreeBSD**: `/usr/local/etc/apache22` +- **Gentoo**: `/etc/apache2/conf.d` +- **Red Hat**: `/etc/httpd/conf.d` + +##### `default_charset` + +Used as the [`AddDefaultCharset`][] directive in the main configuration file. Default: undef. + +##### `default_confd_files` + +Determines whether Puppet generates a default set of includable Apache configuration files in the directory defined by the [`confd_dir`][] parameter. These configuration files correspond to what is typically installed with the Apache package on the server's operating system. Valid options: Boolean. Default: true. + +##### `default_mods` + +Determines whether to configure and enable a set of default [Apache modules][] depending on your operating system. Valid options: true, false, or an array of Apache module names. Default: true. + +If this parameter's value is false, Puppet includes only the Apache modules required to make the HTTP daemon work on your operating system, and you can declare any other modules separately using the [`apache::mod::`][] class or [`apache::mod`][] defined type. + +If true, Puppet installs additional modules, the list of which depends on the operating system as well as the [`apache_version`][] and [`mpm_module`][] parameters' values. As these lists of modules can change frequently, consult the [Puppet module's code][] for up-to-date lists. + +If this parameter contains an array, Puppet instead enables all passed Apache modules. + +##### `default_ssl_ca` + +Sets the default certificate authority for the Apache server. Default: undef. + +While this default value results in a functioning Apache server, you **must** update this parameter with your certificate authority information before deploying this server in a production environment. + +##### `default_ssl_cert` + +Sets the [SSL encryption][] certificate location. Default: Determined by your operating system. + +- **Debian**: `/etc/ssl/certs/ssl-cert-snakeoil.pem` +- **FreeBSD**: `/usr/local/etc/apache22/server.crt` +- **Gentoo**: `/etc/ssl/apache2/server.crt` +- **Red Hat**: `/etc/pki/tls/certs/localhost.crt` + +While the default value results in a functioning Apache server, you **must** update this parameter with your certificate location before deploying this server in a production environment. + +##### `default_ssl_chain` + +Sets the default [SSL chain][] location. Default: undef. + +While this default value results in a functioning Apache server, you **must** update this parameter with your SSL chain before deploying this server in a production environment. + +##### `default_ssl_crl` + +Sets the path of the default [certificate revocation list][] (CRL) file to use. Default: undef. + +While this default value results in a functioning Apache server, you **must** update this parameter with your CRL file's path before deploying this server in a production environment. You can use this parameter with or in place of the [`default_ssl_crl_path`][]. + +##### `default_ssl_crl_path` + +Sets the server's [certificate revocation list path][], which contains your CRLs. Default: undef. + +While this default value results in a functioning Apache server, you **must** update this parameter with the CRL path before deploying this server in a production environment. + +##### `default_ssl_crl_check` + +Sets the default certificate revocation check level via the [`SSLCARevocationCheck`][] directive. Default: undef. + +While this default value results in a functioning Apache server, you **must** specify this parameter when using certificate revocation lists in a production environment. + +This parameter only applies to Apache 2.4 or higher and is ignored on older versions. + +##### `default_ssl_key` + +Sets the [SSL certificate key file][] location. Default: Determined by your operating system. + +- **Debian**: `/etc/ssl/private/ssl-cert-snakeoil.key` +- **FreeBSD**: `/usr/local/etc/apache22/server.key` +- **Gentoo**: `/etc/ssl/apache2/server.key` +- **Red Hat**: `/etc/pki/tls/private/localhost.key` + +While these default values result in a functioning Apache server, you **must** update this parameter with your SSL key's location before deploying this server in a production environment. + +##### `default_ssl_vhost` + +Configures a default [SSL][SSL encryption] virtual host. Valid options: Boolean. Default: false. + +If true, Puppet automatically configures the following virtual host using the [`apache::vhost`][] defined type: + +``` puppet +apache::vhost { 'default-ssl': + port => 443, + ssl => true, + docroot => $docroot, + scriptalias => $scriptalias, + serveradmin => $serveradmin, + access_log_file => "ssl_${access_log_file}", + } +``` + +> **Note**: SSL virtual hosts only respond to HTTPS queries. + +##### `default_type` + +_Apache 2.2 only_. Sets the [MIME `content-type`][] sent if the server cannot otherwise determine an appropriate `content-type`. This directive is deprecated in Apache 2.4 and newer and only exists for backwards compatibility in configuration files. Default: undef. + +##### `default_vhost` + +Configures a default virtual host when the class is declared. Valid options: Boolean. Default: true. + +To configure [customized virtual hosts][Configuring virtual hosts], set this parameter's value to false. + +> **Note**: Apache will not start without at least one virtual host. If you set this to false be sure to configure one elsewhere. + +##### `dev_packages` + +Configures a specific dev package to use. Valid options: A string or array of strings. Default: Depends on the operating system. + +- **Red Hat:** 'httpd-devel' +- **Debian 8/Ubuntu 13.10 or newer:** ['libaprutil1-dev', 'libapr1-dev', 'apache2-dev'] +- **Older Debian/Ubuntu versions:** ['libaprutil1-dev', 'libapr1-dev', 'apache2-prefork-dev'] +- **FreeBSD, Gentoo:** undef +- **Suse:** ['libapr-util1-devel', 'libapr1-devel'] + +Example for using httpd 2.4 from the IUS yum repo: + +``` puppet +include ::apache::dev +class { 'apache': + apache_name => 'httpd24u', + dev_packages => 'httpd24u-devel', +} +``` + +##### `docroot` + +Sets the default [`DocumentRoot`][] location. Default: Determined by your operating system. + +- **Debian**: `/var/www/html` +- **FreeBSD**: `/usr/local/www/apache22/data` +- **Gentoo**: `/var/www/localhost/htdocs` +- **Red Hat**: `/var/www/html` + +##### `error_documents` + +Determines whether to enable [custom error documents][] on the Apache server. Valid options: Boolean. Default: false. + +##### `group` + +Sets the group ID that owns any Apache processes spawned to answer requests. + +By default, Puppet attempts to manage this group as a resource under the `apache` class, determining the group based on the operating system as detected by the [`apache::params`][] class. To to prevent the group resource from being created and use a group created by another Puppet module, set the [`manage_group`][] parameter's value to false. + +> **Note**: Modifying this parameter only changes the group ID that Apache uses to spawn child processes to access resources. It does not change the user that owns the parent server process. + +##### `httpd_dir` + +Sets the Apache server's base configuration directory. This is useful for specially repackaged Apache server builds but might have unintended consequences when combined with the default distribution packages. Default: Determined by your operating system. + +- **Debian**: `/etc/apache2` +- **FreeBSD**: `/usr/local/etc/apache22` +- **Gentoo**: `/etc/apache2` +- **Red Hat**: `/etc/httpd` + +##### `keepalive` + +Determines whether to enable persistent HTTP connections with the [`KeepAlive`][] directive. Valid options: 'Off', 'On'. Default: 'Off'. + +If 'On', use the [`keepalive_timeout`][] and [`max_keepalive_requests`][] parameters to set relevant options. + +##### `keepalive_timeout` + +Sets the [`KeepAliveTimeout`] directive, which determines the amount of time the Apache server waits for subsequent requests on a persistent HTTP connection. Default: '15'. + +This parameter is only relevant if the [`keepalive` parameter][] is enabled. + +##### `max_keepalive_requests` + +Limits the number of requests allowed per connection when the [`keepalive` parameter][] is enabled. Default: '100'. + +##### `lib_path` + +Specifies the location where [Apache module][Apache modules] files are stored. Default: Depends on the operating system. + +- **Debian** and **Gentoo**: `/usr/lib/apache2/modules` +- **FreeBSD**: `/usr/local/libexec/apache24` +- **Red Hat**: `modules` + +> **Note**: Do not configure this parameter manually without special reason. + +##### `loadfile_name` + +Sets the [`LoadFile`] directive's filename. Valid options: Filenames in the format `\*.load`. + +This can be used to set the module load order. + +##### `log_level` + +Changes the error log's verbosity. Valid options: 'alert', 'crit', 'debug', 'emerg', 'error', 'info', 'notice', 'warn'. Default: 'warn'. + +##### `log_formats` + +Define additional [`LogFormat`][] directives. Valid options: A [hash][], such as: + +``` puppet +$log_formats = { vhost_common => '%v %h %l %u %t \"%r\" %>s %b' } +``` + +There are a number of predefined `LogFormats` in the `httpd.conf` that Puppet creates: + +``` httpd +LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined +LogFormat "%h %l %u %t \"%r\" %>s %b" common +LogFormat "%{Referer}i -> %U" referer +LogFormat "%{User-agent}i" agent +LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-agent}i\"" forwarded +``` + +If your `log_formats` parameter contains one of those, it will be overwritten with **your** definition. + +##### `logroot` + +Changes the directory of Apache log files for the virtual host. Default: Determined by your operating system. + +- **Debian**: `/var/log/apache2` +- **FreeBSD**: `/var/log/apache22` +- **Gentoo**: `/var/log/apache2` +- **Red Hat**: `/var/log/httpd` + +##### `logroot_mode` + +Overrides the default [`logroot`][] directory's mode. Default: undef. + +> **Note**: Do _not_ grant write access to the directory where the logs are stored without being aware of the consequences. See the [Apache documentation][Log security] for details. + +##### `manage_group` + +When false, stops Puppet from creating the group resource. Valid options: Boolean. Default: true. + +If you have a group created from another Puppet module that you want to use to run Apache, set this to false. Without this parameter, attempting to use a previously established group results in a duplicate resource error. + +##### `manage_user` + +When false, stops Puppet from creating the user resource. Valid options: Boolean. Default: true. + +This is for instances when you have a user, created from another Puppet module, you want to use to run Apache. Without this parameter, attempting to use a previously established user would result in a duplicate resource error. + +##### `mod_dir` + +Sets where Puppet places configuration files for your [Apache modules][]. Default: Determined by your operating system. + +- **Debian**: `/etc/apache2/mods-available` +- **FreeBSD**: `/usr/local/etc/apache22/Modules` +- **Gentoo**: `/etc/apache2/modules.d` +- **Red Hat**: `/etc/httpd/conf.d` + +##### `mpm_module` + +Determines which [multi-processing module][] (MPM) is loaded and configured for the HTTPD process. Valid options: 'event', 'itk', 'peruser', 'prefork', 'worker', or false. Default: Determined by your operating system. + +- **Debian**: 'worker' +- **FreeBSD, Gentoo, and Red Hat**: 'prefork' + +You must set this to false to explicitly declare the following classes with custom parameters: + +- [`apache::mod::event`][] +- [`apache::mod::itk`][] +- [`apache::mod::peruser`][] +- [`apache::mod::prefork`][] +- [`apache::mod::worker`][] + +##### `package_ensure` + +Controls the `package` resource's [`ensure`][] attribute. Valid options: 'absent', 'installed' (or the equivalent 'present'), or a version string. Default: 'installed'. + +##### `pidfile` + +Allows settting a custom location for the pid file - useful if using a custom built Apache rpm. Default: Depends on operating system. + +- **Debian:** '\${APACHE_PID_FILE}' +- **FreeBSD:** '/var/run/httpd.pid' +- **Red Hat:** 'run/httpd.pid' + +##### `ports_file` + +Sets the path to the file containing Apache ports configuration. Default: '{$conf_dir}/ports.conf'. + +##### `purge_configs` + +Removes all other Apache configs and virtual hosts. Valid options: Boolean. Default: true. + +Setting this to false is a stopgap measure to allow the apache Puppet module to coexist with existing or unmanaged configurations. We recommend moving your configuration to resources within this module. For virtual host configurations, see [`purge_vhost_dir`][]. + +##### `purge_vhost_dir` + +If the [`vhost_dir`][] parameter's value differs from the [`confd_dir`][] parameter's, the Boolean parameter `purge_vhost_dir` determines whether Puppet removes any configurations inside `vhost_dir` _not_ managed by Puppet. Valid options: Boolean. Default: same as [`purge_configs`][]. + +Setting `purge_vhost_dir` to false is a stopgap measure to allow the apache Puppet module to coexist with existing or otherwise unmanaged configurations within `vhost_dir`. + +##### `rewrite_lock` + +Allows setting a custom location for a rewrite lock - considered best practice if using a RewriteMap of type prg in the [`rewrites`][] parameter of your virtual host. Default: undef. + +This parameter only applies to Apache version 2.2 or lower and is ignored on newer versions. + +##### `sendfile` + +Forces Apache to use the Linux kernel's `sendfile` support to serve static files, via the [`EnableSendfile`][] directive. Valid options: 'On', 'Off'. Default: 'On'. + +##### `serveradmin` + +Sets the Apache server administrator's contact information via Apache's [`ServerAdmin`][] directive. Default: 'root@localhost'. + +##### `servername` + +Sets the Apache server name via Apache's [`ServerName`][] directive. Default: the 'fqdn' fact reported by [Facter][]. + +Setting to false will not set ServerName at all. + +##### `server_root` + +Sets the Apache server's root directory via Apache's [`ServerRoot`][] directive. Default: determined by your operating system. + +- **Debian**: `/etc/apache2` +- **FreeBSD**: `/usr/local` +- **Gentoo**: `/var/www` +- **Red Hat**: `/etc/httpd` + +##### `server_signature` + +Configures a trailing footer line to display at the bottom of server-generated documents, such as error documents and output of certain [Apache modules][], via Apache's [`ServerSignature`][] directive. Valid options: 'Off', 'On'. Default: 'On'. + +##### `server_tokens` + +Controls how much information Apache sends to the browser about itself and the operating system, via Apache's [`ServerTokens`][] directive. Default: 'OS'. + +##### `service_enable` + +Determines whether Puppet enables the Apache HTTPD service when the system is booted. Valid options: Boolean. Default: true. + +##### `service_ensure` + +Determines whether Puppet should make sure the service is running. Valid options: 'true' (equivalent to 'running'), 'false' (equivalent to 'stopped'). Default: 'running'. + +The 'false' or 'stopped' values set the 'httpd' service resource's `ensure` parameter to 'false', which is useful when you want to let the service be managed by another application, such as Pacemaker. + +##### `service_name` + +Sets the name of the Apache service. Default: determined by your operating system. + +- **Debian and Gentoo**: 'apache2' +- **FreeBSD**: 'apache22' +- **Red Hat**: 'httpd' + +##### `service_manage` + +Determines whether Puppet manages the HTTPD service's state. Valid options: Boolean. Default: true. + +##### `service_restart` + +Determines whether Puppet should use a specific command to restart the HTTPD service. Valid options: a command to restart the Apache service. Default: undef, which uses the [default Puppet behavior][Service attribute restart]. + +##### `ssl_stapling` + +Specifies whether or not to use [SSLUseStapling](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslusestapling). Valid options: Boolean. Default: false. It is possible to override this on a vhost level. + +This parameter only applies to Apache 2.4 or higher and is ignored on older versions. + +##### `ssl_stapling_return_errors` + +Can be used to set the [SSLStaplingReturnResponderErrors](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslstaplingreturnrespondererrors) directive. No default. It is possible to override this on a vhost level. + +This parameter only applies to Apache 2.4 or higher and is ignored on older versions. + +##### `timeout` + +Sets Apache's [`TimeOut`][] directive, which defines the number of seconds Apache waits for certain events before failing a request. Default: 120. + +##### `trace_enable` + +Controls how Apache handles `TRACE` requests (per [RFC 2616][]) via the [`TraceEnable`][] directive. Valid options: 'Off', 'On'. Default: 'On'. + +##### `use_systemd` + +Controls whether the systemd module should be installed on Centos 7 servers, this is especially useful if using custom-built RPMs. Valid options: Boolean. Default: true. + +##### `file_mode` + +Sets the desired permissions mode for config files, in symbolic or numeric notation. Valid options: A string. Default: '0644'. + +##### `root_directory_options` + +Array of the desired options for the / directory in httpd.conf. Defaults to 'FollowSymLinks'. + +##### `root_directory_secured` + +Sets the default access policy for the / directory in httpd.conf. A value of 'false' allows access to all resources that are missing a more specific access policy. A value of 'true' denies access to all resources by default. In this case more specific rules must be used to allow access to these resources (e.g. in a directory block using the [`directories`](#parameter-directories-for-apachevhost) parameter). Valid options: Boolean. Default: false. + +##### `vhost_dir` + +Changes your virtual host configuration files' location. Default: determined by your operating system. + +- **Debian**: `/etc/apache2/sites-available` +- **FreeBSD**: `/usr/local/etc/apache22/Vhosts` +- **Gentoo**: `/etc/apache2/vhosts.d` +- **Red Hat**: `/etc/httpd/conf.d` + +##### `vhost_include_pattern` + +Defines the pattern for files included from the `vhost_dir`. Default: '*', also for BC with previous versions of this module. + +However, you might want to set this to a value like '[^.#]\*.conf[^~]' to make sure files accidentally created in this directory (such as files created by version control systems or editor backups) are *not* included in your server configuration. + +Some operating systems ship with a value of '*.conf'. Also note that this module will, by default, create configuration files ending in '.conf'. + +##### `user` + +Changes the user Apache uses to answer requests. Apache's parent process will continue to be run as root, but child processes will access resources as the user defined by this parameter. + +Default: Puppet sets the default value via the [`apache::params`][] class, which manages the user based on your operating system: + +- **Debian**: 'www-data' +- **FreeBSD**: 'www' +- **Gentoo** and **Red Hat**: 'apache' + +To prevent Puppet from managing the user, set the [`manage_user`][] parameter to false. + +##### `apache_name` + +The name of the Apache package to install. Default: Puppet sets the default value via the [`apache::params`][] class, which manages the user based on your operating system: + +The default value is determined by your operating system: + +- **Debian**: 'apache2' +- **FreeBSD**: 'apache24' +- **Gentoo**: 'www-servers/apache' +- **Red Hat**: 'httpd' + +You might need to override this if you are using a non-standard Apache package, such as those from Red Hat's software collections. + +##### `error_log` + +The name of the error log file for the main server instance + +The default value is determined by your operating system: + +- **Debian**: 'error.log' +- **FreeBSD**: 'httpd-error.log' +- **Gentoo**: 'error.log' +- **Red Hat**: 'error_log' +- **Suse**: 'error.log' + +If the string starts with / or | or syslog: the full path will be set. Otherwise the filename will be prefixed with $logroot + +##### `scriptalias` + +Directory to use for global script alias + +The default value is determined by your operating system: + +- **Debian**: '/usr/lib/cgi-bin' +- **FreeBSD**: '/usr/local/www/apache24/cgi-bin' +- **Gentoo**: 'var/www/localhost/cgi-bin' +- **Red Hat**: '/var/www/cgi-bin' +- **Suse**: '/usr/lib/cgi-bin' + +##### `access_log_file` + +The name of the access log file for the main server instance + +The default value is determined by your operating system: + +- **Debian**: 'error.log' +- **FreeBSD**: 'httpd-access.log' +- **Gentoo**: 'access.log' +- **Red Hat**: 'access_log' +- **Suse**: 'access.log' + +#### Class: `apache::dev` + +Installs Apache development libraries. By default, the package name is defined by the [`dev_packages`][] parameter of the [`apache::params`][] class based on your operating system: + +The default value is determined by your operating system: + +- **Debian** : 'libaprutil1-dev', 'libapr1-dev'; 'apache2-dev' on Ubuntu 13.10 and Debian 8; 'apache2-prefork-dev' on other versions +- **FreeBSD**: 'undef'; see note below +- **Gentoo**: 'undef' +- **Red Hat**: 'httpd-devel' + +> **Note**: On FreeBSD, you must declare the `apache::package` or `apache` classes before declaring `apache::dev`. + +#### Class: `apache::vhosts` + +Creates [`apache::vhost`][] defined types. + +**Parameters within `apache::vhosts`**: + +- `vhosts`: A [hash][] where the key represents the name and the value represents a [hash][] of [`apache::vhost`][] defined type's parameters. Default: '{}' + +> **Note**: See the [`apache::vhost`][] defined type's reference for a list of all virtual host parameters or [Configuring virtual hosts]. + +For example, to create a [name-based virtual host][name-based virtual hosts] 'custom_vhost_1, you can declare the class with the `vhosts` parameter set to '{ "custom_vhost_1" => { "docroot" => "/var/www/custom_vhost_1", "port" => "81" }': + +``` puppet +class { 'apache::vhosts': + vhosts => { + 'custom_vhost_1' => { + 'docroot' => '/var/www/custom_vhost_1', + 'port' => '81', + }, + }, +} +``` + +#### Classes: `apache::mod::` + +Enables specific [Apache modules][]. You can enable and configure an Apache module by declaring its class. For example, to install and enable [`mod_alias`][] with no icons, you can declare the [`apache::mod::alias`][] class with the `icons_options` parameter set to 'None': + +``` puppet +class { 'apache::mod::alias': + icons_options => 'None', +} +``` + +The following Apache modules have supported classes, many of which allow for parameterized configuration. You can install other Apache modules with the [`apache::mod`][] defined type. + +* `actions` +* `alias` (see [`apache::mod::alias`][]) +* `auth_basic` +* `auth_cas`\* (see [`apache::mod::auth_cas`][]) +* `auth_mellon`\* (see [`apache::mod::auth_mellon`][]) +* `auth_kerb` +* `authn_core` +* `authn_dbd`\* (see [`apache::mod::authn_dbd`][]) +* `authn_file` +* `authnz_ldap`\* (see [`apache::mod::authnz_ldap`][]) +* `authz_default` +* `authz_user` +* `autoindex` +* `cache` +* `cgi` +* `cgid` +* `cluster` (see [`apache::mod::cluster`][]) +* `dav` +* `dav_fs` +* `dav_svn`\* +* `dbd` +* `deflate\` +* `dev` +* `dir`\* +* `disk_cache` (see [`apache::mod::disk_cache`][]) +* `dumpio` (see [`apache::mod::dumpio`][]) +* `env` +* `event` (see [`apache::mod::event`][]) +* `expires` +* `ext_filter` (see [`apache::mod::ext_filter`][]) +* `fastcgi` +* `fcgid` +* `filter` +* `geoip` (see [`apache::mod::geoip`][]) +* `headers` +* `include` +* `info`\* +* `itk` +* `ldap` (see [`apache::mod::ldap`][]) +* `mime` +* `mime_magic`\* +* `negotiation` +* `nss`\* +* `pagespeed` (see [`apache::mod::pagespeed`][]) +* `passenger`\* (see [`apache::mod::passenger`][]) +* `perl` +* `peruser` +* `php` (requires [`mpm_module`][] set to `prefork`) +* `prefork`\* +* `proxy`\* (see [`apache::mod::proxy`][]) +* `proxy_ajp` +* `proxy_balancer`\* (see [`apache::mod::proxy_balancer`][]) +* `proxy_balancer` +* `proxy_html` (see [`apache::mod::proxy_html`][]) +* `proxy_http` +* `python` +* `reqtimeout` +* `remoteip`\* +* `rewrite` +* `rpaf`\* +* `setenvif` +* `security` +* `shib`\* (see [`apache::mod::shib`]) +* `speling` +* `ssl`\* (see [`apache::mod::ssl`][]) +* `status`\* (see [`apache::mod::status`][]) +* `suphp` +* `userdir`\* +* `version` +* `vhost_alias` +* `worker`\* +* `wsgi` (see [`apache::mod::wsgi`][]) +* `xsendfile` + +Modules noted with a * indicate that the module has settings and a template that includes parameters to configure the module. Most Apache module class parameters have default values and don't require configuration. For modules with templates, Puppet installs template files with the module; these template files are required for the module to work. + +##### Class: `apache::mod::alias` + +Installs and manages [`mod_alias`][]. + +**Parameters within `apache::mod::alias`**: + +* `icons_options`: Disables directory listings for the icons directory, via Apache [`Options`] directive. Default: 'Indexes MultiViews'. +* `icons_path`: Sets the local path for an `/icons/` Alias. Default: depends on your operating system. + +- **Debian**: `/usr/share/apache2/icons` +- **FreeBSD**: `/usr/local/www/apache24/icons` +- **Gentoo**: `/var/www/icons` +- **Red Hat**: `/var/www/icons`, except on Apache 2.4, where it's `/usr/share/httpd/icons` + +#### Class: `apache::mod::disk_cache` + +Installs and configures [`mod_disk_cache`][] on Apache 2.2, or [`mod_cache_disk`][] on Apache 2.4. The default cache root depends on the Apache version and operating system: + +- **Debian**: `/var/cache/apache2/mod_cache_disk` +- **FreeBSD**: `/var/cache/mod_cache_disk` +- **Red Hat, Apache 2.4**: `/var/cache/httpd/proxy` +- **Red Hat, Apache 2.2**: `/var/cache/mod_proxy` + +You can specify the cache root by passing a path as a string to the `cache_root` parameter. + +``` puppet +class {'::apache::mod::disk_cache': + cache_root => '/path/to/cache', +} +``` +##### Class: `apache::mod::diskio` + +Installs and configures [`mod_diskio`][]. + +```puppet +class{'apache': + default_mods => false, + log_level => 'dumpio:trace7', +} +class{'apache::mod::diskio': + disk_io_input => 'On', + disk_io_output => 'Off', +} +``` + + +**Parameters withing `apache::mod::diskio`**: + +- `dump_io_input`: Dump all input data to the error log. Must be `On` or `Off`, defaults to `Off` +- `dump_io_output`: Dump all output data to the error log. Must be `On` or `Off`, defaults to `Off` + +##### Class: `apache::mod::event` + +Installs and manages [`mod_mpm_event`][]. You can't include both `apache::mod::event` and [`apache::mod::itk`][], [`apache::mod::peruser`][], [`apache::mod::prefork`][], or [`apache::mod::worker`][] on the same server. + +**Parameters within `apache::mod::event`**: + +- `listenbacklog`: Sets the maximum length of the pending connections queue via the module's [`ListenBackLog`][] directive. Default: '511'. Setting this to 'false' removes the parameter. +- `maxrequestworkers` (_Apache 2.3.12 or older_: `maxclients`): Sets the maximum number of connections Apache can simultaneously process, via the module's [`MaxRequestWorkers`][] directive. Default: '150'. Setting these to 'false' removes the parameters. +- `maxconnectionsperchild` (_Apache 2.3.8 or older_: `maxrequestsperchild`): Limits the number of connections a child server handles during its life, via the module's [`MaxConnectionsPerChild`][] directive. Default: '0'. Setting these to 'false' removes the parameters. +- `maxsparethreads` and `minsparethreads`: Sets the maximum and minimum number of idle threads, via the [`MaxSpareThreads`][] and [`MinSpareThreads`][] directives. Default: '75' and '25', respectively. Setting these to 'false' removes the parameters. +- `serverlimit`: Limits the configurable number of processes via the [`ServerLimit`][] directive. Default: '25'. Setting this to 'false' removes the parameter. +- `startservers`: Sets the number of child server processes created at startup, via the module's [`StartServers`][] directive. Default: '2'. Setting this to 'false' removes the parameter. +- `threadlimit`: Limits the number of event threads via the module's [`ThreadLimit`][] directive. Default: '64'. Setting this to 'false' removes the parameter. +- `threadsperchild`: Sets the number of threads created by each child process, via the [`ThreadsPerChild`][] directive. Default: '25'. Setting this to 'false' removes the parameter. + +##### Class: `apache::mod::auth_cas` + +Installs and manages [`mod_auth_cas`][]. Its parameters share names with the Apache module's directives. + +The `cas_login_url` and `cas_validate_url` parameters are required; several other parameters have 'undef' default values. + +**Note**: The auth\_cas module isn't available on RH/CentOS without providing dependency packages provided by EPEL. See [https://github.com/Jasig/mod_auth_cas]() + +**Parameters within `apache::mod::auth_cas`**: + +- `cas_attribute_prefix`: Adds a header with the value of this header being the attribute values when SAML + validation is enabled. Default: CAS_ +- `cas_attribute_delimiter`: The delimiter between attribute values in the header created by `cas_attribute_prefix`. + Default: , +- `cas_authoritative`: Determines whether an optional authorization directive is authoritative and binding. Default: undef. +- `cas_certificate_path`: Sets the path to the X509 certificate of the Certificate Authority for the server in `cas_login_url` and `cas_validate_url`. Default: undef. +- `cas_cache_clean_interval`: Sets the minimum number of seconds that must pass between cache cleanings. Default: undef. +- `cas_cookie_domain`: Sets the value of the `Domain=` parameter in the `Set-Cookie` HTTP header. Default: undef. +- `cas_cookie_entropy`: Sets the number of bytes to use when creating session identifiers. Default: undef. +- `cas_cookie_http_only`: Sets the optional `HttpOnly` flag when `mod_auth_cas` issues cookies. Default: undef. +- `cas_cookie_path`: Where cas cookie session data is stored. Should be writable by web server user. Default: OS dependent. +- `cas_cookie_path_mode`: The mode of `cas_cookie_path`. Default: '0750'. +- `cas_debug`: Determines whether to enable the module's debugging mode. Default: 'Off'. +- `cas_idle_timeout`: Default: undef. +- `cas_login_url`: **Required**. Sets the URL to which the module redirects users when they attempt to access a CAS-protected resource and don't have an active session. +- `cas_proxy_validate_url`: The URL to use when performing a proxy validation. Default: undef. +- `cas_root_proxied_as`: Sets the URL end users see when access to this Apache server is proxied. Default: undef. +- `cas_scrub_request_headers`: Remove inbound request headers that may have special meaning within mod_auth_cas. +- `cas_sso_enabled`: Enables experimental support for single sign out (may mangle POST data). Default: off +- `cas_timeout`: Limits the number of seconds a `mod_auth_cas` session can remain active. Default: undef. +- `cas_validate_depth`: Limits the depth for chained certificate validation. Default: undef. +- `cas_validate_saml`: Parse response from CAS server for SAML. Default: Off +- `cas_validate_server`: Should we validate the cert of the CAS server (depreciated in 1.1 - RedHat 7). Default: undef. +- `cas_validate_url`: **Required**. Sets the URL to use when validating a client-presented ticket in an HTTP query string. +- `cas_version`: The CAS protocol version to adhere to. Valid options: '1', '2'. Default: '2'. +- `suppress_warning`: Don't wine about being on RedHat (Hint: mod_auth_cas package is now available in epel-testing repo). Default: false. + +##### Class: `apache::mod::auth_mellon` + +Installs and manages [`mod_auth_mellon`][]. Its parameters share names with the Apache module's directives. + +``` puppet +class{ 'apache::mod::auth_mellon': + mellon_cache_size => 101, +} +``` + +**Parameters within `apache::mod::auth_mellon`**: + +- `mellon_cache_entry_size`: Maximum size for a single session. Default: undef. +- `mellon_cache_size`: Size in megabytes of the mellon cache. Default: 100. +- `mellon_lock_file`: Location of lock file. Default: '`/run/mod_auth_mellon/lock`'. +- `mellon_post_directory`: Full path where post requests are saved. Default: '`/var/cache/apache2/mod_auth_mellon/`' +- `mellon_post_ttl`: Time to keep post requests. Default: undef. +- `mellon_post_size`: Maximum size of post requests. Default: undef. +- `mellon_post_count`: Maximum number of post requests. Default: undef. + +##### Class: `apache::mod::authn_dbd` + +Installs `mod_authn_dbd` and uses `authn_dbd.conf.erb` template to generate its configuration. Optionally creates AuthnProviderAlias. + +``` puppet +class { 'apache::mod::authn_dbd': + $authn_dbd_params => + 'host=db01 port=3306 user=apache password=xxxxxx dbname=apacheauth', + $authn_dbd_query => 'SELECT password FROM authn WHERE user = %s', + $authn_dbd_alias => 'db_auth', +} +``` + +** Parameters within `apache::mod::authn_dbd` +- `authn_dbd_alias`: Name for the AuthnProviderAlias. +- `authn_dbd_dbdriver`: Which db driver to use. Default: mysql. +- `authn_dbd_exptime`: corresponds to DBDExptime. Default: 300. +- `authn_dbd_keep`: corresponds to DBDKeep. Default: 8. +- `authn_dbd_max`: corresponds to DBDMax. Default: 20. +- `authn_dbd_min`: corresponds to DBDMin. Default: 4. +- `authn_dbd_params`: **Required**. Corresponds to DBDParams for the connection string. +- `authn_dbd_query`: is the query used to test a user and password for authentication. + +##### Class: `apache::mod::authnz_ldap` + +Installs `mod_authnz_ldap` and uses the `authnz_ldap.conf.erb` template to generate its configuration. + +**Parameters within `apache::mod::authnz_ldap`**: + +- `package_name`: Default: `undef`. +- `verify_server_cert`: Default: `undef`. + +##### Class: `apache::mod::cluster` + +**Note**: There is no official package available for mod\_cluster and thus it must be made available by means outside of the control of the apache module. Binaries can be found at http://mod-cluster.jboss.org/ + +``` puppet +class { '::apache::mod::cluster': + ip => '172.17.0.1', + allowed_network => '172.17.0.', + balancer_name => 'mycluster', + version => '1.3.1' +} +``` + +**Parameters within `apache::mod::cluster`**: + +- `port`: mod_cluster listen port. Default: '6666'. +- `server_advertise`: Whether the server should advertise. Default: true. +- `manager_allowed_network`: Network allowed to access the mod_cluster_manager. Default: '127.0.0.1'. +- `keep_alive_timeout`: Keep-alive timeout. Default: 60. +- `max_keep_alive_requests`: Max number of requests kept alive. Default: 0 +- `enable_mcpm_receive`: Whether MCPM should be enabled: Default: true. +- `ip`: Listen ip address.. +- `allowed_network`: Balanced members network. +- `version`: mod_cluster version. >= 1.3.0 is required for httpd 2.4. + +##### Class: `apache::mod::deflate` + +Installs and configures [`mod_deflate`][]. + +**Parameters within `apache::mod::deflate`**: + +- `types`: An [array][] of [MIME types][MIME `content-type`] to be deflated. Default: [ 'text/html text/plain text/xml', 'text/css', 'application/x-javascript application/javascript application/ecmascript', 'application/rss+xml', 'application/json' ]. +- `notes`: A [Hash][] where the key represents the type and the value represents the note name. Default: { 'Input' => 'instream', 'Output' => 'outstream', 'Ratio' => 'ratio' } + +##### Class: `apache::mod::expires` + +Installs [`mod_expires`][] and uses the `expires.conf.erb` template to generate its configuration. + +**Parameters within `apache::mod::expires`**: + +- `expires_active`: Enables generation of `Expires` headers for a document realm. Valid options: Boolean. Default: true. +- `expires_default`: Default algorithm for calculating expiration time using [`ExpiresByType`][] syntax or [interval syntax][]. Default: undef. +- `expires_by_type`: Describes a set of [MIME `content-type`][] and their expiration times. Valid options: An [array][] of [Hashes][Hash], with each Hash's key a valid MIME `content-type` (i.e. 'text/json') and its value following valid [interval syntax][]. Default: undef. + +##### Class: `apache::mod::ext_filter` + +Installs and configures [`mod_ext_filter`][]. + +``` puppet +class { 'apache::mod::ext_filter': + ext_filter_define => { + 'slowdown' => 'mode=output cmd=/bin/cat preservescontentlength', + 'puppetdb-strip' => 'mode=output outtype=application/json cmd="pdb-resource-filter"', + }, +} +``` + +**Parameters within `apache::mod::ext_filter`**: + +- `ext_filter_define`: A hash of filter names and their parameters. Default: undef. + +##### Class: `apache::mod::fcgid` + +Installs and configures [`mod_fcgid`][]. + +The class makes no effort to individually parameterize all available options. Instead, configure `mod_fcgid` using the `options` [hash][]. For example: + +``` puppet +class { 'apache::mod::fcgid': + options => { + 'FcgidIPCDir' => '/var/run/fcgidsock', + 'SharememPath' => '/var/run/fcgid_shm', + 'AddHandler' => 'fcgid-script .fcgi', + }, +} +``` + +For a full list of options, see the [official `mod_fcgid` documentation][`mod_fcgid`]. + +If you include `apache::mod::fcgid`, you can set the [`FcgidWrapper`][] per directory, per virtual host. The module must be loaded first; Puppet will not automatically enable it if you set the `fcgiwrapper` parameter in `apache::vhost`. + +``` puppet +include apache::mod::fcgid + +apache::vhost { 'example.org': + docroot => '/var/www/html', + directories => { + path => '/var/www/html', + fcgiwrapper => { + command => '/usr/local/bin/fcgiwrapper', + } + }, +} +``` + +##### Class: `apache::mod::geoip` + +Installs and manages [`mod_geoip`][]. + +**Parameters within `apache::mod::geoip`**: + +- `db_file`: Sets the path to your GeoIP database file. Valid options: a path, or an [array][] paths for multiple GeoIP database files. Default: `/usr/share/GeoIP/GeoIP.dat`. +- `enable`: Determines whether to globally enable [`mod_geoip`][]. Valid options: Boolean. Default: false. +- `flag`: Sets the GeoIP flag. Valid options: 'CheckCache', 'IndexCache', 'MemoryCache', 'Standard'. Default: 'Standard'. +- `output`: Defines which output variables to use. Valid options: 'All', 'Env', 'Request', 'Notes'. Default: 'All'. +- `enable_utf8`: Changes the output from ISO-8859-1 (Latin-1) to UTF-8. Valid options: Boolean. Default: undef. +- `scan_proxy_headers`: Enables the [GeoIPScanProxyHeaders][] option. Valid options: Boolean. Default: undef. +- `scan_proxy_header_field`: Specifies which header [`mod_geoip`][] should look at to determine the client's IP address. Default: undef. +- `use_last_xforwarededfor_ip` (sic): Determines whether to use the first or last IP address for the client's IP if a comma-separated list of IP addresses is found. Valid options: Boolean. Default: undef. + +##### Class: `apache::mod::info` + +Installs and manages [`mod_info`][], which provides a comprehensive overview of the server configuration. + +**Parameters within `apache::mod::info`**: + +- `allow_from`: Whitelist of IPv4 or IPv6 addresses or ranges that can access `/server-info`. Valid options: One or more octets of an IPv4 address, an IPv6 address or range, or an array of either. Default: ['127.0.0.1','::1']. +- `apache_version`: Apache's version number as a string, such as '2.2' or '2.4'. Default: the value of [`$::apache::apache_version`][`apache_version`]. +- `restrict_access`: Determines whether to enable access restrictions. If false, the `allow_from` whitelist is ignored and any IP address can access `/server-info`. Valid options: Boolean. Default: true. + +##### Class: `apache::mod::passenger` + +Installs and manages [`mod_passenger`][]. For RedHat based systems, please ensure that you meet the minimum requirements as described in the [passenger docs](https://www.phusionpassenger.com/library/install/apache/install/oss/el6/#step-1:-upgrade-your-kernel,-or-disable-selinux) + +**Parameters within `apache::mod::passenger`**: + +- `passenger_high_performance` Sets the [`PassengerHighPerformance`](https://www.phusionpassenger.com/library/config/apache/reference/#passengerhighperformance). Valid options: 'on', 'off'. Default: undef. +- `passenger_pool_idle_time` Sets the [`PassengerPoolIdleTime`](https://www.phusionpassenger.com/library/config/apache/reference/#passengerpoolidletime). Default: undef. +- `passenger_max_pool_size` Sets the [`PassengerMaxPoolSize`](https://www.phusionpassenger.com/library/config/apache/reference/#passengermaxpoolsize). Default: undef. +- `passenger_max_request_queue_size` Sets the [`PassengerMaxRequestQueueSize`](https://www.phusionpassenger.com/library/config/apache/reference/#passengermaxrequestqueuesize). Default: undef. +- `passenger_max_requests` Sets the [`PassengerMaxRequests`](https://www.phusionpassenger.com/library/config/apache/reference/#passengermaxrequests). Default: undef. +- `passenger_data_buffer_dir` Sets the [`PassengerDataBufferDir`](https://www.phusionpassenger.com/library/config/apache/reference/#passengerdatabufferdir). Default: undef. + +##### Class: `apache::mod::ldap` + +Installs and configures [`mod_ldap`][], and allows you to modify the +[`LDAPTrustedGlobalCert`](https://httpd.apache.org/docs/current/mod/mod_ldap.html#ldaptrustedglobalcert) Directive: + +``` puppet +class { 'apache::mod::ldap': + ldap_trusted_global_cert_file => '/etc/pki/tls/certs/ldap-trust.crt', + ldap_trusted_global_cert_type => 'CA_DER', + ldap_shared_cache_size => '500000', + ldap_cache_entries => '1024', + ldap_cache_ttl => '600', + ldap_opcache_entries => '1024', + ldap_opcache_ttl => '600', +} +``` + +**Parameters within `apache::mod::ldap`:** + +- `apache_version`: The installed Apache version. Defaults to `undef`. +- `ldap_trusted_global_cert_file`: Path and file name of the trusted CA certificates to use when establishing SSL or TLS connections to an LDAP server. +- `ldap_trusted_global_cert_type`: The global trust certificate format. Default: 'CA_BASE64'. +- `ldap_shared_cache_size`: Size in bytes of the shared-memory cache. +- `ldap_cache_entries`: Maximum number of entries in the primary LDAP cache. +- `ldap_cache_ttl`: Time that cached items remain valid. +- `ldap_opcache_entries`: Number of entries used to cache LDAP compare operations. +- `ldap_opcache_ttl`: Time that entries in the operation cache remain valid. +- `package_name`: Custom package name. Defaults to `undef`. + +##### Class: `apache::mod::negotiation` + +Installs and configures [`mod_negotiation`][]. + +**Parameters within `apache::mod::negotiation`:** + +- `force_language_priority`: Sets the `ForceLanguagePriority` option. Valid option: String. Default: `Prefer Fallback`. +- `language_priority`: An [array][] of languages to set the `LanguagePriority` option of the module. Default: [ 'en', 'ca', 'cs', 'da', 'de', 'el', 'eo', 'es', 'et', 'fr', 'he', 'hr', 'it', 'ja', 'ko', 'ltz', 'nl', 'nn', 'no', 'pl', 'pt', 'pt-BR', 'ru', 'sv', 'zh-CN', 'zh-TW' ] + +##### Class: `apache::mod::pagespeed` + +Installs and manages [`mod_pagespeed`][], a Google module that rewrites web pages to reduce latency and bandwidth. + +While this Apache module requires the `mod-pagespeed-stable` package, Puppet **doesn't** manage the software repositories required to automatically install the package. If you declare this class when the package is either not installed or not available to your package manager, your Puppet run will fail. + +**Note:** Verify that your system is compatible with the latest Google Pagespeed requirements. + +**Parameters within `apache::mod::pagespeed`**: + +- `inherit_vhost_config`: Default: 'on'. +- `filter_xhtml`: Default: false. +- `cache_path`: Default: '/var/cache/mod\_pagespeed/'. +- `log_dir`: Default: '/var/log/pagespeed'. +- `memcache_servers`: Default: []. +- `rewrite_level`: Default: 'CoreFilters'. +- `disable_filters`: Default: []. +- `enable_filters`: Default: []. +- `forbid_filters`: Default: []. +- `rewrite_deadline_per_flush_ms`: Default: 10. +- `additional_domains`: Default: undef. +- `file_cache_size_kb`: Default: 102400. +- `file_cache_clean_interval_ms`: Default: 3600000. +- `lru_cache_per_process`: Default: 1024. +- `lru_cache_byte_limit`: Default: 16384. +- `css_flatten_max_bytes`: Default: 2048. +- `css_inline_max_bytes`: Default: 2048. +- `css_image_inline_max_bytes`: Default: 2048. +- `image_inline_max_bytes`: Default: 2048. +- `js_inline_max_bytes`: Default: 2048. +- `css_outline_min_bytes`: Default: 3000. +- `js_outline_min_bytes`: Default: 3000. +- `inode_limit`: Default: 500000. +- `image_max_rewrites_at_once`: Default: 8. +- `num_rewrite_threads`: Default: 4. +- `num_expensive_rewrite_threads`: Default: 4. +- `collect_statistics`: Default: 'on'. +- `statistics_logging`: Default: 'on'. +- `allow_view_stats`: Default: []. +- `allow_pagespeed_console`: Default: []. +- `allow_pagespeed_message`: Default: []. +- `message_buffer_size`: Default: 100000. +- `additional_configuration`: A hash of directive-value pairs or an array of lines to insert at the end of the pagespeed configuration. Default: '{ }'. + +The class's parameters correspond to the module's directives. See the [module's documentation][`mod_pagespeed`] for details. + +##### Class: `apache::mod::passenger` + +Installs and configures mod\_passenger + +**Parameters within `apache::mod::passenger`**: + +- `manage_repo`: Manage phusionpassenger.com repository. Default: true. + +TODO: The parameters section is incomplete. + +**Note**: The passenger module isn't available on RH/CentOS without providing dependency packages provided by EPEL and mod\_passengers own custom repository. See the `manage_repo` parameter above and [https://www.phusionpassenger.com/library/install/apache/install/oss/el7/]() + +##### Class: `apache::mod::proxy` + +Installs `mod_proxy` and uses the `proxy.conf.erb` template to generate its configuration. + +**Parameters within `apache::mod::proxy`**: + +- `allow_from`: Default: `undef`. +- `apache_version`: Default: `undef`. +- `package_name`: Default: `undef`. +- `proxy_requests`: Default: 'Off'. +- `proxy_via`: Default: 'On'. + +##### Class: `apache::mod::proxy_balancer` + +Installs and manages [`mod_proxy_balancer`][], which provides load balancing. + +**Parameters within `apache::mod::proxy_balancer`**: + +- `manager`: Determines whether to enable balancer manager support. Default: `false`. +- `manager_path`: The server location of the balancer manager. Default: '/balancer-manager'. +- `allow_from`: An [array][] of IPv4 or IPv6 addresses that can access `/balancer-manager`. Default: ['127.0.0.1','::1']. +- `apache_version`: Apache's version number as a string, such as '2.2' or '2.4'. Default: the value of [`$::apache::apache_version`][`apache_version`]. + - On Apache >= 2.4, `mod_slotmem_shm` is loaded. + + +##### Class: `apache::mod::php` + +Installs and configures [`mod_php`][]. + +**Parameters within `apache::mod::php`**: + +Default values depend on your operating system. + +> **Note**: This list is incomplete. Most of this class's parameters correspond to `mod_php` directives; see the [module's documentation][`mod_php`] for details. + +- `package_name`: Names the package that installs `mod_php`. +- `path`: Defines the path to the `mod_php` shared object (`.so`) file. +- `source`: Defines the path to the default configuration. Valid options include a `puppet:///` path. +- `template`: Defines the path to the `php.conf` template Puppet uses to generate the configuration file. +- `content`: Adds arbitrary content to `php.conf`. + +##### Class: `apache::mod::proxy_html` + +**Note**: There is no official package available for mod\_proxy\_html and thus it must be made available by means outside of the control of the apache module. + +##### Class: `apache::mod::reqtimeout` + +Installs and configures [`mod_reqtimeout`][]. + +**Parameters within `apache::mod::reqtimeout`**: + +- `timeouts`: A string or [array][] that sets the [`RequestReadTimeout`][] option. Default: ['header=20-40,MinRate=500', 'body=20,MinRate=500']. + +##### Class: `apache::mod::shib` + +Installs the [Shibboleth](http://shibboleth.net/) Apache module `mod_shib`, which enables SAML2 single sign-on (SSO) authentication by Shibboleth Identity Providers and Shibboleth Federations. This class only installs and configures the Apache components of a web application that consumes Shibboleth SSO identities, also known as a Shibboleth Service Provider. You can manage the Shibboleth configuration manually, with Puppet, or using a [Shibboleth Puppet Module](https://github.com/aethylred/puppet-shibboleth). + +Defining this class enables Shibboleth-specific parameters in `apache::vhost` instances. + +**Note**: The shibboleth module isn't available on RH/CentOS without providing dependency packages provided by Shibboleth's repositories. See [http://wiki.aaf.edu.au/tech-info/sp-install-guide]() + +##### Class: `apache::mod::ssl` + +Installs [Apache SSL features][`mod_ssl`] and uses the `ssl.conf.erb` template to generate its configuration. On most operating systems, this ssl.conf is placed in the module configuration directory, however on Red Hat-based operating systems it is placed in the confd directory (/etc/httpd/conf.d), the same location the RPM stores the configuration. + +**Parameters within `apache::mod::ssl`**: + +- `ssl_cipher`: Default: 'HIGH:MEDIUM:!aNULL:!MD5:!RC4'. +- `ssl_compression`: Default: false. +- `ssl_cryptodevice`: Default: 'builtin'. +- `ssl_honorcipherorder`: Default: true. +- `ssl_openssl_conf_cmd`: Default: undef. +- `ssl_options`: Default: [ 'StdEnvVars' ] +- `ssl_pass_phrase_dialog`: Default: 'builtin'. +- `ssl_protocol`: Default: [ 'all', '-SSLv2', '-SSLv3' ]. +- `ssl_random_seed_bytes`: Valid options: A string. Default: '512'. +- `ssl_sessioncachetimeout`: Valid options: A string. Default: '300'. +- `ssl_mutex`: Default: Determined based on the OS. Valid options: See [mod_ssl][mod_ssl] documentation. + - RedHat/FreeBSD/Suse/Gentoo: 'default' + - Debian/Ubuntu + Apache >= 2.4: 'default' + - Debian/Ubuntu + Apache < 2.4: 'file:\${APACHE_RUN_DIR}/ssl_mutex' + - Ubuntu 10.04: 'file:/var/run/apache2/ssl_mutex' + +To use SSL with a virtual host, you must either set the [`default_ssl_vhost`][] parameter in `::apache` to true **or** the [`ssl`][] parameter in [`apache::vhost`][] to true. + +##### Class: `apache::mod::status` + +Installs [`mod_status`][] and uses the `status.conf.erb` template to generate its configuration. + +**Parameters within `apache::mod::status`**: + +- `allow_from`: An [array][] of IPv4 or IPv6 addresses that can access `/server-status`. Default: ['127.0.0.1','::1']. +- `extended_status`: Determines whether to track extended status information for each request, via the [`ExtendedStatus`][] directive. Valid options: 'Off', 'On'. Default: 'On'. +- `status_path`: The server location of the status page. Default: '/server-status'. + +##### Class: `apache::mod::version` + +Installs [`mod_version`][] on many operating systems and Apache configurations. + +If Debian and Ubuntu systems with Apache 2.4 are classified with `apache::mod::version`, Puppet warns that `mod_version` is built-in and can't be loaded. + +##### Class: `apache::mod::security` + +Installs and configures Trustwave's [`mod_security`][]. It is enabled and runs by default on all virtual hosts. + +**Parameters within `apache::mod::security`**: + +- `activated_rules`: An [array][] of rules from the `modsec_crs_path` or absolute to activate via symlinks. Default: `modsec_default_rules` in [`apache::params`][]. +- `allowed_methods`: A space-separated list of allowed HTTP methods. Default: 'GET HEAD POST OPTIONS'. +- `content_types`: A list of one or more allowed [MIME types][MIME `content-type`]. Default: 'application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/x-amf' +- `crs_package`: Names the package that installs CRS rules. Default: `modsec_crs_package` in [`apache::params`][]. +- `modsec_dir`: Defines the path where Puppet installs the modsec configuration and activated rules links. Default: 'On', set by `modsec_dir` in [`apache::params`][]. +${modsec\_dir}/activated\_rules. +- `modsec_secruleengine`: Configures the modsec rules engine. Valid options: 'On', 'Off', and 'DetectionOnly'. Default: `modsec_secruleengine` in [`apache::params`][]. +- `restricted_extensions`: A space-separated list of prohibited file extensions. Default: '.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'. +- `restricted_headers`: A list of restricted headers separated by slashes and spaces. Default: 'Proxy-Connection/ /Lock-Token/ /Content-Range/ /Translate/ /via/ /if/'. +- `secdefaultaction`: Configures the Mode of Operation, Self-Contained ('deny') vs. Collaborative Detection ('pass'), for the OWASP ModSecurity Core Rule Set. Default: 'deny'. Fuller values can be set too like "log,auditlog,deny,status:406,tag:'SLA 24/7'" +- `secpcrematchlimit`: Sets the number for the match limit in the PCRE library. Default: '1500' +- `secpcrematchlimitrecursion`: Sets the number for the match limit recursion in the PCRE library. Default: '1500' +- `logroot`: Configures the location of audit and debug logs. Defaults to apache log directory (Redhat: /var/log/httpd Debian: /var/log/apache2) +- `audit_log_releavant_status`: Configures which response status code is to be considered relevant for the purpose of audit logging. Defaults: '^(?:5|4(?!04))'. +- `audit_log_parts`: Sets the sections to be put in the [audit log][]. Default: 'ABIJDEFHZ' +- `anomaly_score_blocking`: De-/Activates the Collaborative Detection Blocking of the OWASP ModSecurity Core Rule Set. Default: off. +- `inbound_anomaly_threshold`: Sets the scoring threshold level of the inbound blocking rules for the Collaborative Detection Mode in the OWASP ModSecurity Core Rule Set. Default: '5'. +- `outbound_anomaly_threshold`: Sets the scoring threshold level of the outbound blocking rules for the Collaborative Detection Mode in the OWASP ModSecurity Core Rule Set. Default: '4'. +- `critical_anomaly_score`: Sets the scoring points of the critical severity level for the Collaborative Detection Mode in the OWASP ModSecurity Core Rule Set. Default: '5'. +- `error_anomaly_score`: Sets the scoring points of the error severity level for the Collaborative Detection Mode in the OWASP ModSecurity Core Rule Set. Default: '4'. +- `warning_anomaly_score`: Sets the scoring points of the warning severity level for the Collaborative Detection Mode in the OWASP ModSecurity Core Rule Set. Default: '3'. +- `notice_anomaly_score`: Sets the scoring points of the notice severity level for the Collaborative Detection Mode in the OWASP ModSecurity Core Rule Set. Default: '2'. +- `secrequestmaxnumargs`: Sets the Maximum number of arguments in the request. Default: '255'. +- `secrequestbodylimit`: Sets the maximum request body size ModSecurity will accept for buffering.. Default: '13107200'. +- `secrequestbodynofileslimit`: Sets the maximum request body size ModSecurity will accept for buffering, excluding the size of any files being transported in the request. Default: '131072'. +- `secrequestbodyinmemorylimit`: Sets the maximum request body size that ModSecurity will store in memory. Default: '131072' + +##### Class: `apache::mod::wsgi` + +Enables Python support via [`mod_wsgi`][]. + +**Parameters within `apache::mod::wsgi`**: + +- `mod_path`: Defines the path to the `mod_wsgi` shared object (`.so`) file. Default: undef. + - If the `mod_path` parameter doesn't contain `/`, Puppet prefixes it with your operating system's default module path. +Otherwise, Puppet follows it literally. +- `package_name`: Names the package that installs `mod_wsgi`. Default: undef. +- `wsgi_python_home`: Defines the [`WSGIPythonHome`][] directive, such as '/path/to/venv'. Valid options: path. Default: undef. +- `wsgi_python_path`: Defines the [`WSGIPythonPath`][] directive, such as '/path/to/venv/site-packages'. Valid options: path. Default: undef. +- `wsgi_socket_prefix`: Defines the [`WSGISocketPrefix`][] directive, such as "\${APACHE\_RUN\_DIR}WSGI". Default: `wsgi_socket_prefix` in [`apache::params`][]. + +The class's parameters correspond to the module's directives. See the [module's documentation][`mod_wsgi`] for details. + +### Private Classes + +#### Class: `apache::confd::no_accf` + +Creates the `no-accf.conf` configuration file in `conf.d`, required by FreeBSD's Apache 2.4. + +#### Class: `apache::default_confd_files` + +Includes `conf.d` files for FreeBSD. + +#### Class: `apache::default_mods` + +Installs the Apache modules required to run the default configuration. See the `apache` class's [`default_mods`][] parameter for details. + +#### Class: `apache::package` + +Installs and configures basic Apache packages. + +#### Class: `apache::params` + +Manages Apache parameters for different operating systems. + +#### Class: `apache::service` + +Manages the Apache daemon. + +#### Class: `apache::version` + +Attempts to automatically detect the Apache version based on the operating system. + +### Public defined types + +#### Defined type: `apache::balancer` + +Creates an Apache load balancing group, also known as a balancer cluster, using [`mod_proxy`][]. Each load balancing group needs one or more balancer members, which you can declare in Puppet with the [`apache::balancermember`][] define. + +Declare one `apache::balancer` define for each Apache load balancing group. You can export `apache::balancermember` defined types for all balancer members and collect them on a single Apache load balancer server using [exported resources][]. + +**Parameters within `apache::balancer`**: + +##### `name` + +Sets the title of the balancer cluster and name of the `conf.d` file containing its configuration. + +##### `proxy_set` + +Configures key-value pairs as [`ProxySet`][] lines. Valid options: a [hash][]. Default: '{}'. + +##### `collect_exported` + +Determines whether to use [exported resources][]. Valid options: Boolean. Default: true. + +If you statically declare all of your backend servers, set this parameter to false to rely on existing, declared balancer member resources. Also, use `apache::balancermember` with [array][] arguments. + +To dynamically declare backend servers via exported resources collected on a central node, set this parameter to true to collect the balancer member resources exported by the balancer member nodes. + +If you don't use exported resources, a single Puppet run configures all balancer members. If you use exported resources, Puppet has to run on the balanced nodes first, then run on the balancer. + +#### Defined type: `apache::balancermember` + +Defines members of [`mod_proxy_balancer`][], which sets up a balancer member inside a listening service configuration block in the load balancer's `apache.cfg`. + +**Parameters within `apache::balancermember`**: + +##### `balancer_cluster` + +**Required**. Sets the Apache service's instance name, and must match the name of a declared [`apache::balancer`][] resource. + +##### `url` + +Specifies the URL used to contact the balancer member server. Default: 'http://${::fqdn}/'. + +##### `options` + +Specifies an [array][] of [options](https://httpd.apache.org/docs/current/mod/mod_proxy.html#balancermember) after the URL, and accepts any key-value pairs available to [`ProxyPass`][]. Default: an empty array. + +#### Defined type: `apache::custom_config` + +Adds a custom configuration file to the Apache server's `conf.d` directory. If the file is invalid and this defined type's [`verify_config`][] parameter's value is true, Puppet throws an error during a Puppet run. + +**Parameters within `apache::custom_config`**: + +##### `ensure` + +Specifies whether the configuration file should be present. Valid options: 'absent', 'present'. Default: 'present'. + +##### `confdir` + +Sets the directory in which Puppet places configuration files. Default: the value of [`$::apache::confd_dir`][`confd_dir`]. + +##### `content` + +Sets the configuration file's content. The `content` and [`source`][] parameters are exclusive of each other. + +##### `filename` + +Sets the name of the file under `confdir` in which Puppet stores the configuration. The default behavior is to generate the filename from the `priority` parameter and the resource name. + +##### `priority` + +Sets the configuration file's priority by prefixing its filename with this parameter's numeric value, as Apache processes configuration files in alphanumeric order. Default: '25'. + +To omit the priority prefix in the configuration file's name, set this parameter to false. + +##### `source` + +Points to the configuration file's source. The [`content`][] and `source` parameters are exclusive of each other. + +##### `verify_command` + +Specifies the command Puppet uses to verify the configuration file. Use a fully qualified command. Default: `/usr/sbin/apachectl -t`. + +This parameter is only used if the [`verify_config`][] parameter's value is 'true'. If the `verify_command` fails, the Puppet run deletes the configuration file, does not notify the Apache service, and raises an error. + +##### `verify_config` + +Specifies whether to validate the configuration file before notifying the Apache service. Valid options: Boolean. Default: true. + +#### Defined type: `apache::fastcgi::server` + +Defines one or more external FastCGI servers to handle specific file types. Use this defined type with [`mod_fastcgi`][FastCGI]. + +**Parameters within `apache::fastcgi::server`:** + +##### `host` + +Determines the FastCGI's hostname or IP address and TCP port number (1-65535). + +##### `timeout` + +Sets the number of seconds a [FastCGI][] application can be inactive before aborting the request and logging the event at the error LogLevel. The inactivity timer applies only as long as a connection is pending with the FastCGI application. If a request is queued to an application, but the application doesn't respond by writing and flushing within this period, the request is aborted. If communication is complete with the application but incomplete with the client (the response is buffered), the timeout does not apply. + +##### `flush` + +Forces [`mod_fastcgi`][FastCGI] to write to the client as data is received from the application. By default, `mod_fastcgi` buffers data in order to free the application as quickly as possible. + +##### `faux_path` + +Apache has [FastCGI][] handle URIs that resolve to this filename. The path set in this parameter does not have to exist in the local filesystem. + +##### `alias` + +Internally links actions with the FastCGI server. This alias must be unique. + +##### `file_type` + +Sets the [MIME `content-type`][] of the file to be processed by the FastCGI server. + +#### Defined type: `apache::listen` + +Adds [`Listen`][] directives to `ports.conf` in the Apache configuration directory that define the Apache server's or a virtual host's listening address and port. The [`apache::vhost`][] class uses this defined type, and titles take the form '', ':', or ':'. + +#### Defined type: `apache::mod` + +Installs packages for an Apache module that doesn't have a corresponding [`apache::mod::`][] class, and checks for or places the module's default configuration files in the Apache server's `module` and `enable` directories. The default locations depend on your operating system. + +**Parameters within `apache::mod`**: + +##### `package` + +**Required**. Names the package Puppet uses to install the Apache module. + +##### `package_ensure` + +Determines whether Puppet ensures the Apache module should be installed. Valid options: 'absent', 'present'. Default: 'present'. + +##### `lib` + +Defines the module's shared object name. Its default value is `mod_$name.so`, and it should not be configured manually without special reason. + +##### `lib_path` + +Specifies a path to the module's libraries. Default: the `apache` class's [`lib_path`][] parameter. + +Don't manually set this parameter without special reason. The [`path`][] parameter overrides this value. + +##### `loadfile_name` + +Sets the filename for the module's [`LoadFile`][] directive, which can also set the module load order as Apache processes them in alphanumeric order. Valid options: filenames formatted `\*.load`. Default: the resource's name followed by 'load', as in '$name.load'. + +##### `loadfiles` + +Specifies an array of [`LoadFile`][] directives. Default: undef. + +##### `path` + +Specifies a path to the module. Default: [`lib_path`][]/[`lib`][]. + +> **Note:** Don't manually set this parameter without a specific reason. + +#### Defined type: `apache::namevirtualhost` +Enables [name-based virtual hosts][] and adds all related directives to the `ports.conf` file in the Apache HTTPD configuration directory. Titles can take the forms '\*', '\*:\', '\_default\_:\, '\', or '\:\'. + + +#### Defined type: `apache::vhost` + +The Apache module allows a lot of flexibility in the setup and configuration of virtual hosts. This flexibility is due, in part, to `vhost` being a defined resource type, which allows Apache to evaluate it multiple times with different parameters. + +The `apache::vhost` defined type allows you to have specialized configurations for virtual hosts that have requirements outside the defaults. You can set up a default virtual host within the base `::apache` class, as well as set a customized virtual host as the default. Customized virtual hosts have a lower numeric [`priority`][] than the base class's, causing Apache to process the customized virtual host first. + +The `apache::vhost` defined type uses `concat::fragment` to build the configuration file. To inject custom fragments for pieces of the configuration that the defined type doesn't inherently support, add a custom fragment. + +For the custom fragment's `order` parameter, the `apache::vhost` defined type uses multiples of 10, so any `order` that isn't a multiple of 10 should work. + +**Parameters within `apache::vhost`**: + +##### `access_log` + +Determines whether to configure `*_access.log` directives (`*_file`,`*_pipe`, or `*_syslog`). Valid options: Boolean. Default: true. + +##### `access_log_env_var` + +Specifies that only requests with particular environment variables be logged. Default: undef. + +##### `access_log_file` + +Sets the filename of the `*_access.log` placed in [`logroot`][]. Given a virtual host---for instance, example.com---it defaults to 'example.com\_ssl.log' for [SSL-encrypted][SSL encryption] virtual hosts and 'example.com\_access.log' for unencrypted virtual hosts. + +##### `access_log_format` + +Specifies the use of either a [`LogFormat`][] nickname or a custom-formatted string for the access log. Default: 'combined'. + +##### `access_log_pipe` + +Specifies a pipe where Apache sends access log messages. Default: undef. + +##### `access_log_syslog` + +Sends all access log messages to syslog. Default: undef. + +##### `add_default_charset` + +Sets a default media charset value for the [`AddDefaultCharset`][] directive, which is added to `text/plain` and `text/html` responses. + +##### `add_listen` + +Determines whether the virtual host creates a [`Listen`][] statement. Valid options: Boolean. Default: true. + +Setting `add_listen` to false prevents the virtual host from creating a `Listen` statement. This is important when combining virtual hosts that aren't passed an `ip` parameter with those that are. + +##### `use_optional_includes` + +Specifies whether Apache uses the [`IncludeOptional`][] directive instead of [`Include`][] for `additional_includes` in Apache 2.4 or newer. Valid options: Boolean. Default: false. + +##### `additional_includes` + +Specifies paths to additional static, virtual host-specific Apache configuration files. You can use this parameter to implement a unique, custom configuration not supported by this module. Valid options: a string path or [array][] of them. Default: an empty array. + +##### `aliases` + +Passes a list of [hashes][hash] to the virtual host to create [`Alias`][], [`AliasMatch`][], [`ScriptAlias`][] or [`ScriptAliasMatch`][] directives as per the [`mod_alias`][] documentation. + +For example: + +``` puppet +aliases => [ + { aliasmatch => '^/image/(.*)\.jpg$', + path => '/files/jpg.images/$1.jpg', + }, + { alias => '/image', + path => '/ftp/pub/image', + }, + { scriptaliasmatch => '^/cgi-bin(.*)', + path => '/usr/local/share/cgi-bin$1', + }, + { scriptalias => '/nagios/cgi-bin/', + path => '/usr/lib/nagios/cgi-bin/', + }, + { alias => '/nagios', + path => '/usr/share/nagios/html', + }, +], +``` + +For the `alias`, `aliasmatch`, `scriptalias` and `scriptaliasmatch` keys to work, each needs a corresponding context, such as `` or ``. Puppet creates the directives in the order specified in the `aliases` parameter. As described in the [`mod_alias`][] documentation, add more specific `alias`, `aliasmatch`, `scriptalias` or `scriptaliasmatch` parameters before the more general ones to avoid shadowing. + +> **Note**: Use the `aliases` parameter instead of the `scriptaliases` parameter because you can precisely control the various alias directives' order. Defining `ScriptAliases` using the `scriptaliases` parameter means *all* `ScriptAlias` directives will come after *all* `Alias` directives, which can lead to `Alias` directives shadowing `ScriptAlias` directives. This often causes problems, for example with Nagios. + +If [`apache::mod::passenger`][] is loaded and `PassengerHighPerformance` is 'true', the `Alias` directive might not be able to honor the `PassengerEnabled => off` statement. See [this article](http://www.conandalton.net/2010/06/passengerenabled-off-not-working.html) for details. + +##### `allow_encoded_slashes` + +Sets the [`AllowEncodedSlashes`][] declaration for the virtual host, overriding the server default. This modifies the virtual host responses to URLs with `\` and `/` characters. Valid options: 'nodecode', 'off', 'on'. Default: undef, which omits the declaration from the server configuration and selects the Apache default setting of `Off`. + +##### `block` + +Specifies the list of things to which Apache blocks access. Valid option: 'scm', which blocks web access to `.svn`, `.git`, and `.bzr` directories. Default: an empty [array][]. + +##### `cas_attribute_prefix` + +Adds a header with the value of this header being the attribute values when SAML validation is enabled. Defaults to +the value set by [`apache::mod::auth_cas`][] + +##### `cas_attribute_delimiter` + +The delimiter between attribute values in the header created by `cas_attribute_prefix`. Defaults to the value +set by [`apache::mod::auth_cas`][] + +##### `cas_login_url` + +Sets the URL to which the module redirects users when they attempt to access a CAS-protected resource and +don't have an active session. Defaults to the value set by [`apache::mod::auth_cas`][] + +##### `cas_scrub_request_headers` + +Remove inbound request headers that may have special meaning within mod_auth_cas. Defaults to the value +set by [`apache::mod::auth_cas`][] + +##### `cas_sso_enabled` + +Enables experimental support for single sign out (may mangle POST data). Defaults to the value +set by [`apache::mod::auth_cas`][] + +##### `cas_validate_saml` + +Parse response from CAS server for SAML. Defaults to the value set by [`apache::mod::auth_cas`][] + +##### `cas_validate_url` + +Sets the URL to use when validating a client-presented ticket in an HTTP query string. Defaults to the value set by +[`apache::mod::auth_cas`][] + +##### `custom_fragment` + +Passes a string of custom configuration directives to place at the end of the virtual host configuration. Default: undef. + +##### `default_vhost` + +Sets a given `apache::vhost` defined type as the default to serve requests that do not match any other `apache::vhost` defined types. Default: false. + +##### `directories` + +See the [`directories`](#parameter-directories-for-apachevhost) section. + +##### `directoryindex` + +Sets the list of resources to look for when a client requests an index of the directory by specifying a '/' at the end of the directory name. See the [`DirectoryIndex`][] directive documentation for details. Default: undef. + +##### `docroot` + +**Required**. Sets the [`DocumentRoot`][] location, from which Apache serves files. + +If `docroot` and [`manage_docroot`][] are both set to false, no [`DocumentRoot`][] will be set and the accompanying `` block will not be created. + +##### `docroot_group` + +Sets group access to the [`docroot`][] directory. Valid options: A string representing a system group. Default: 'root'. + +##### `docroot_owner` + +Sets individual user access to the [`docroot`][] directory. Valid options: A string representing a user account. Default: 'root'. + +##### `docroot_mode` + +Sets access permissions for the [`docroot`][] directory, in numeric notation. Valid options: A string. Default: undef. + +##### `manage_docroot` + +Determines whether Puppet manages the [`docroot`][] directory. Valid options: Boolean. Default: true. + +##### `error_log` + +Specifies whether `*_error.log` directives should be configured. Valid options: Boolean. Default: true. + +##### `error_log_file` + +Points the virtual host's error logs to a `*_error.log` file. If this parameter is undefined, Puppet checks for values in [`error_log_pipe`][], then [`error_log_syslog`][]. + +If none of these parameters is set, given a virtual host `example.com`, Puppet defaults to '$logroot/example.com_error_ssl.log' for SSL virtual hosts and '$logroot/example.com_error.log' for non-SSL virtual hosts. + +##### `error_log_pipe` + +Specifies a pipe to send error log messages to. Default: undef. + +This parameter has no effect if the [`error_log_file`][] parameter has a value. If neither this parameter nor `error_log_file` has a value, Puppet then checks [`error_log_syslog`][]. + +##### `error_log_syslog` + +Determines whether to send all error log messages to syslog. Valid options: Boolean. Default: undef. + +This parameter has no effect if either of the [`error_log_file`][] or [`error_log_pipe`][] parameters has a value. If none of these parameters has a value, given a virtual host `example.com`, Puppet defaults to '$logroot/example.com_error_ssl.log' for SSL virtual hosts and '$logroot/example.com_error.log' for non-SSL virtual hosts. + +##### `error_documents` + +A list of hashes which can be used to override the [ErrorDocument](https://httpd.apache.org/docs/current/mod/core.html#errordocument) settings for this virtual host. Default: '[]'. + +An example: + +``` puppet +apache::vhost { 'sample.example.net': + error_documents => [ + { 'error_code' => '503', 'document' => '/service-unavail' }, + { 'error_code' => '407', 'document' => 'https://example.com/proxy/login' }, + ], +} +``` + +##### `ensure` + +Specifies if the virtual host is present or absent. Valid options: 'absent', 'present'. Default: 'present'. + +##### `fallbackresource` + +Sets the [FallbackResource](https://httpd.apache.org/docs/current/mod/mod_dir.html#fallbackresource) directive, which specifies an action to take for any URL that doesn't map to anything in your filesystem and would otherwise return 'HTTP 404 (Not Found)'. Valid options must either begin with a '/' or be 'disabled'. Default: undef. + +#####`fastcgi_idle_timeout` + +If using fastcgi, this option sets the timeout for the server to respond. + +##### `filters` + +[Filters](https://httpd.apache.org/docs/current/mod/mod_filter.html) enable smart, context-sensitive configuration of output content filters. + +``` puppet +apache::vhost { "$::fqdn": + filters => [ + 'FilterDeclare COMPRESS', + 'FilterProvider COMPRESS DEFLATE resp=Content-Type $text/html', + 'FilterChain COMPRESS', + 'FilterProtocol COMPRESS DEFLATE change=yes;byteranges=no', + ], +} +``` + +##### `force_type` + +Sets the [`ForceType`][] directive, which forces Apache to serve all matching files with a [MIME `content-type`][] matching this parameter's value. + +##### `headers` + +Adds lines to replace, merge, or remove response headers. See [Apache's mod_headers documentation](https://httpd.apache.org/docs/current/mod/mod_headers.html#header) for more information. Valid options: A string, an array of strings, or undef. Default: undef. + +##### `ip` + +Sets the IP address the virtual host listens on. Valid options: Strings. Default: undef, which uses Apache's default behavior of listening on all IPs. + +##### `ip_based` + +Enables an [IP-based](https://httpd.apache.org/docs/current/vhosts/ip-based.html) virtual host. This parameter inhibits the creation of a NameVirtualHost directive, since those are used to funnel requests to name-based virtual hosts. Default: false. + +##### `itk` + +Configures [ITK](http://mpm-itk.sesse.net/) in a hash. Keys can be: + +* user + group +* `assignuseridexpr` +* `assigngroupidexpr` +* `maxclientvhost` +* `nice` +* `limituidrange` (Linux 3.5.0 or newer) +* `limitgidrange` (Linux 3.5.0 or newer) + +Usage typically looks like: + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + itk => { + user => 'someuser', + group => 'somegroup', + }, +} +``` + +##### `jk_mounts` + +Sets up a virtual host with 'JkMount' and 'JkUnMount' directives to handle the paths for URL mapping between Tomcat and Apache. Default: undef. + +The parameter must be an array of hashes where each hash must contain the 'worker' and either the 'mount' or 'unmount' keys. + +Usage typically looks like: + +``` puppet +apache::vhost { 'sample.example.net': + jk_mounts => [ + { mount => '/*', worker => 'tcnode1', }, + { unmount => '/*.jpg', worker => 'tcnode1', }, + ], +} +``` + +##### `keepalive` + +Determines whether to enable persistent HTTP connections with the [`KeepAlive`][] directive for the virtual host. Valid options: 'Off', 'On' and `undef`. Default: `undef`, meaning the global, server-wide [`KeepAlive`][] setting is in effect. + +Use the `keepalive_timeout` and `max_keepalive_requests` parameters to set relevant options for the virtual host. + +##### `keepalive_timeout` + +Sets the [`KeepAliveTimeout`] directive for the virtual host, which determines the amount of time to wait for subsequent requests on a persistent HTTP connection. Default: `undef`, meaning the global, server-wide [`KeepAlive`][] setting is in effect. + +This parameter is only relevant if either the global, server-wide [`keepalive` parameter][] or the per-vhost `keepalive` parameter is enabled. + +##### `max_keepalive_requests` + +Limits the number of requests allowed per connection to the virtual host. Default: `undef`, meaning the global, server-wide [`KeepAlive`][] setting is in effect. + +This parameter is only relevant if either the global, server-wide [`keepalive` parameter][] or the per-vhost `keepalive` parameter is enabled. + +##### `auth_kerb` + +Enable [`mod_auth_kerb`][] parameters for a virtual host. Valid options: Boolean. Default: false. + +Usage typically looks like: + +``` puppet +apache::vhost { 'sample.example.net': + auth_kerb => true, + krb_method_negotiate => 'on', + krb_auth_realms => ['EXAMPLE.ORG'], + krb_local_user_mapping => 'on', + directories => { + path => '/var/www/html', + auth_name => 'Kerberos Login', + auth_type => 'Kerberos', + auth_require => 'valid-user', + }, +} +``` + +Related parameters follow the names of `mod_auth_kerb` directives: + +- `krb_method_negotiate`: Determines whether to use the Negotiate method. Default: 'on'. +- `krb_method_k5passwd`: Determines whether to use password-based authentication for Kerberos v5. Default: 'on'. +- `krb_authoritative`: If set to 'off', authentication controls can be passed on to another module. Default: 'on'. +- `krb_auth_realms`: Specifies an array of Kerberos realms to use for authentication. Default: '[]'. +- `krb_5keytab`: Specifies the Kerberos v5 keytab file's location. Default: undef. +- `krb_local_user_mapping`: Strips @REALM from usernames for further use. Default: undef. + +##### `krb_verify_kdc` + +This option can be used to disable the verification tickets against local keytab to prevent KDC spoofing attacks. Default: 'on'. + +##### `krb_servicename` + +Specifies the service name that will be used by Apache for authentication. Corresponding key of this name must be stored in the keytab. Default: 'HTTP'. + +##### `krb_save_credentials` + +This option enables credential saving functionality. Default is 'off' + +##### `logroot` + +Specifies the location of the virtual host's logfiles. Default: '/var/log//'. + +##### `$logroot_ensure` + +Determines whether or not to remove the logroot directory for a virtual host. Valid options: 'directory', 'absent'. + +##### `logroot_mode` + +Overrides the mode the logroot directory is set to. Default: undef. Do *not* grant write access to the directory the logs are stored in without being aware of the consequences; for more information, see [Apache's log security documentation](https://httpd.apache.org/docs/2.4/logs.html#security). + +##### `logroot_owner` + +Sets individual user access to the logroot directory. Defaults to 'undef'. + +##### `logroot_group` + +Sets group access to the [`logroot`][] directory. Defaults to 'undef'. + +##### `log_level` + +Specifies the verbosity of the error log. Valid options: 'emerg', 'alert', 'crit', 'error', 'warn', 'notice', 'info' or 'debug'. Default: 'warn' for the global server configuration, which can be overridden on a per-virtual host basis. + +###### `modsec_body_limit` + +Configures the maximum request body size (in bytes) ModSecurity will accept for buffering + +###### `modsec_disable_vhost` + +Disables [`mod_security`][] on a virtual host. Only valid if [`apache::mod::security`][] is included. Valid options: Boolean. Default: undef. + +###### `modsec_disable_ids` + +Array of mod_security IDs to remove from the virtual host. Also takes a hash allowing removal of an ID from a specific location. + +``` puppet +apache::vhost { 'sample.example.net': + modsec_disable_ids => [ 90015, 90016 ], +} +``` + +``` puppet +apache::vhost { 'sample.example.net': + modsec_disable_ids => { '/location1' => [ 90015, 90016 ] }, +} +``` + +###### `modsec_disable_ips` + +Specifies an array of IP addresses to exclude from [`mod_security`][] rule matching. Default: undef. + +###### `modsec_disable_msgs` + +Array of mod_security Msgs to remove from the virtual host. Also takes a hash allowing removal of an Msg from a specific location. Default: undef. + +``` puppet +apache::vhost { 'sample.example.net': + modsec_disable_msgs => [ 'Blind SQL Injection Attack', 'Session Fixation Attack' ], +} +``` + +``` puppet +apache::vhost { 'sample.example.net': + modsec_disable_msgs => { '/location1' => [ 'Blind SQL Injection Attack', 'Session Fixation Attack' ] }, +} +``` + +###### `modsec_disable_tags` + +Array of mod_security Tags to remove from the virtual host. Also takes a hash allowing removal of an Tag from a specific location. Default: undef. + +``` puppet +apache::vhost { 'sample.example.net': + modsec_disable_tags => [ 'WEB_ATTACK/SQL_INJECTION', 'WEB_ATTACK/XSS' ], +} +``` + +``` puppet +apache::vhost { 'sample.example.net': + modsec_disable_tags => { '/location1' => [ 'WEB_ATTACK/SQL_INJECTION', 'WEB_ATTACK/XSS' ] }, +} +``` + +##### `modsec_audit_log` & `modsec_audit_log_file` & `modsec_audit_log_pipe` + +Determines how to send mod_security audit log ([SecAuditLog](https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#SecAuditLog)). + +If `modsec_audit_log_file` is set, it is relative to [`logroot`][]. Default: undef. + +If `modsec_audit_log_pipe` is set, it should start with a pipe. Example '|/path/to/mlogc /path/to/mlogc.conf'. Default: undef. + +If `modsec_audit_log` is true, given a virtual host---for instance, example.com---it defaults to 'example.com\_security\_ssl.log' for [SSL-encrypted][SSL encryption] virtual hosts and 'example.com\_security.log' for unencrypted virtual hosts. Default: false. + +When none of those parameters is set, the global audit log is used (i.e. ''/var/log/apache2/modsec\_audit.log'' on Debian and derivatives, ''/var/log/httpd/modsec\_audit.log'' on others). + +##### `no_proxy_uris` + +Specifies URLs you do not want to proxy. This parameter is meant to be used in combination with [`proxy_dest`](#proxy_dest). + +##### `no_proxy_uris_match` + +This directive is equivalent to [`no_proxy_uris`][], but takes regular expressions. + +##### `proxy_preserve_host` + +Sets the [ProxyPreserveHost Directive](https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxypreservehost). Valid options: Boolean. Default: false. + +Setting this parameter to true enables the `Host:` line from an incoming request to be proxied to the host instead of hostname. Setting it to false sets this directive to 'Off'. + +##### `proxy_add_headers` + +Sets the [ProxyAddHeaders Directive](https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxyaddheaders). Valid Options: Boolean. Default: false. + +This parameter controlls whether proxy-related HTTP headers (X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server) get sent to the backend server. + +##### `proxy_error_override` + +Sets the [ProxyErrorOverride Directive](https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxyerroroverride). This directive controls whether Apache should override error pages for proxied content. Default: false. + +##### `options` + +Sets the [`Options`][] for the specified virtual host. Default: ['Indexes','FollowSymLinks','MultiViews'], as demonstrated below: + +``` puppet +apache::vhost { 'site.name.fdqn': + … + options => ['Indexes','FollowSymLinks','MultiViews'], +} +``` + +> **Note**: If you use the [`directories`][] parameter of [`apache::vhost`][], 'Options', 'Override', and 'DirectoryIndex' are ignored because they are parameters within `directories`. + +##### `override` + +Sets the overrides for the specified virtual host. Accepts an array of [AllowOverride](https://httpd.apache.org/docs/current/mod/core.html#allowoverride) arguments. Default: '[none]'. + +##### `passenger_app_root` + +Sets [PassengerRoot](https://www.phusionpassenger.com/library/config/apache/reference/#passengerapproot), the location of the Passenger application root if different from the DocumentRoot. + +##### `passenger_app_env` + +Sets [PassengerAppEnv](https://www.phusionpassenger.com/library/config/apache/reference/#passengerappenv), the environment for the Passenger application. If not specifies, defaults to the global setting or 'production'. + +##### `passenger_log_file` + +By default, Passenger log messages are written to the Apache global error log. With [PassengerLogFile](https://www.phusionpassenger.com/library/config/apache/reference/#passengerlogfile), you can configure those messages to be logged to a different file. This option is only available since Passenger 5.0.5. + +##### `passenger_log_level` + +This option allows to specify how much information should be written to the log file. If not set, [PassengerLogLevel](https://www.phusionpassenger.com/library/config/apache/reference/#passengerloglevel) will not show up in the configuration file and the defaults are used. For Passenger > 3.0.0 the default is '0', since 5.0.0 it's '3'. + +##### `passenger_ruby` + +Sets [PassengerRuby](https://www.phusionpassenger.com/library/config/apache/reference/#passengerruby), the Ruby interpreter to use for the application, on this virtual host. + +##### `passenger_min_instances` + +Sets [PassengerMinInstances](https://www.phusionpassenger.com/library/config/apache/reference/#passengermininstances), the minimum number of application processes to run. + +##### `passenger_max_instances_per_app` + +Sets [PassengerMaxInstancesPerApp](https://www.phusionpassenger.com/library/config/apache/reference/#passengermaxinstancesperapp), the maximum number of application processes that may simultaneously exist for a single application. + +##### `passenger_start_timeout` + +Sets [PassengerStartTimeout](https://www.phusionpassenger.com/library/config/apache/reference/#passengerstarttimeout), the timeout for the application startup. + +##### `passenger_pre_start` + +Sets [PassengerPreStart](https://www.phusionpassenger.com/library/config/apache/reference/#passengerprestart), the URL of the application if pre-starting is required. + +##### `passenger_user` + +Sets [PassengerUser](https://www.phusionpassenger.com/library/config/apache/reference/#passengeruser), the running user for sandboxing applications. + +##### `passenger_high_performance` + +Sets the [`PassengerHighPerformance`](https://www.phusionpassenger.com/library/config/apache/reference/#passengerhighperformance) parameter. Valid options: 'true', 'false'. Default: undef. + +##### `passenger_nodejs` + +Sets the [`PassengerNodejs`](https://www.phusionpassenger.com/library/config/apache/reference/#passengernodejs), the NodeJS interpreter to use for the application, on this virtual host. + +##### `passenger_sticky_sessions` + +Sets the [`PassengerStickySessions`](https://www.phusionpassenger.com/library/config/apache/reference/#passengerstickysessions) parameter. Valid options: 'true', 'false'. Default: undef. + +##### `passenger_startup_file` + +Sets the [`PassengerStartupFile`](https://www.phusionpassenger.com/library/config/apache/reference/#passengerstartupfile) path. This path is relative to the application root. + +##### `php_flags & values` + +Allows per-virtual host setting [`php_value`s or `php_flag`s](http://php.net/manual/en/configuration.changes.php). These flags or values can be overwritten by a user or an application. Default: '{}'. + +##### `php_admin_flags & values` + +Allows per-virtual host setting [`php_admin_value`s or `php_admin_flag`s](http://php.net/manual/en/configuration.changes.php). These flags or values cannot be overwritten by a user or an application. Default: '{}'. + +##### `port` + +Sets the port the host is configured on. The module's defaults ensure the host listens on port 80 for non-SSL virtual hosts and port 443 for SSL virtual hosts. The host only listens on the port set in this parameter. + +##### `priority` + +Sets the relative load-order for Apache HTTPD VirtualHost configuration files. Default: '25'. + +If nothing matches the priority, the first name-based virtual host is used. Likewise, passing a higher priority causes the alphabetically first name-based virtual host to be used if no other names match. + +> **Note:** You should not need to use this parameter. However, if you do use it, be aware that the `default_vhost` parameter for `apache::vhost` passes a priority of '15'. + +To omit the priority prefix in file names, pass a priority of false. + +##### `proxy_dest` + +Specifies the destination address of a [ProxyPass](https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxypass) configuration. Default: undef. + +##### `proxy_pass` + +Specifies an array of `path => URI` values for a [ProxyPass](https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxypass) configuration. Defaults to 'undef'. Optionally parameters can be added as an array. + +``` puppet +apache::vhost { 'site.name.fdqn': + … + proxy_pass => [ + { 'path' => '/a', 'url' => 'http://backend-a/' }, + { 'path' => '/b', 'url' => 'http://backend-b/' }, + { 'path' => '/c', 'url' => 'http://backend-a/c', 'params' => {'max'=>20, 'ttl'=>120, 'retry'=>300}}, + { 'path' => '/l', 'url' => 'http://backend-xy', + 'reverse_urls' => ['http://backend-x', 'http://backend-y'] }, + { 'path' => '/d', 'url' => 'http://backend-a/d', + 'params' => { 'retry' => '0', 'timeout' => '5' }, }, + { 'path' => '/e', 'url' => 'http://backend-a/e', + 'keywords' => ['nocanon', 'interpolate'] }, + { 'path' => '/f', 'url' => 'http://backend-f/', + 'setenv' => ['proxy-nokeepalive 1','force-proxy-request-1.0 1']}, + { 'path' => '/g', 'url' => 'http://backend-g/', + 'reverse_cookies' => [{'path' => '/g', 'url' => 'http://backend-g/',}, {'domain' => 'http://backend-g', 'url' => 'http:://backend-g',},], }, + { 'path' => '/h', 'url' => 'http://backend-h/h', + 'no_proxy_uris' => ['/h/admin', '/h/server-status'] }, + ], +} +``` + +* `reverse_urls`. *Optional.* This setting is useful when used with `mod_proxy_balancer`. Valid options: an array or string. +* `reverse_cookies`. *Optional.* Sets `ProxyPassReverseCookiePath` and `ProxyPassReverseCookieDomain`. +* `params`. *Optional.* Allows for ProxyPass key-value parameters, such as connection settings. +* `setenv`. *Optional.* Sets [environment variables](https://httpd.apache.org/docs/current/mod/mod_proxy.html#envsettings) for the proxy directive. Valid options: array. + +##### `proxy_dest_match` + +This directive is equivalent to [`proxy_dest`][], but takes regular expressions, see [ProxyPassMatch](https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxypassmatch) for details. + +##### `proxy_dest_reverse_match` + +Allows you to pass a ProxyPassReverse if [`proxy_dest_match`][] is specified. See [ProxyPassReverse](https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxypassreverse) for details. + +##### `proxy_pass_match` + +This directive is equivalent to [`proxy_pass`][], but takes regular expressions, see [ProxyPassMatch](https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxypassmatch) for details. + +##### `rack_base_uris` + +Specifies the resource identifiers for a rack configuration. The file paths specified are listed as rack application roots for [Phusion Passenger](http://www.modrails.com/documentation/Users%20guide%20Apache.html#_railsbaseuri_and_rackbaseuri) in the _rack.erb template. Default: undef. + +#####`passenger_base_uris` + +Used to specify that the given URI is a Phusion Passenger-served application. The file paths specified are listed as passenger application roots for [Phusion Passenger](https://www.phusionpassenger.com/documentation/Users%20guide%20Apache.html#PassengerBaseURI) in the _passenger_base_uris.erb template. Default: undef. + +##### `redirect_dest` + +Specifies the address to redirect to. Default: undef. + +##### `redirect_source` + +Specifies the source URIs that redirect to the destination specified in `redirect_dest`. If more than one item for redirect is supplied, the source and destination must be the same length, and the items are order-dependent. + +``` puppet +apache::vhost { 'site.name.fdqn': + … + redirect_source => ['/images','/downloads'], + redirect_dest => ['http://img.example.com/','http://downloads.example.com/'], +} +``` + +##### `redirect_status` + +Specifies the status to append to the redirect. Default: undef. + +``` puppet +apache::vhost { 'site.name.fdqn': + … + redirect_status => ['temp','permanent'], +} +``` + +##### `redirectmatch_regexp` & `redirectmatch_status` & `redirectmatch_dest` + +Determines which server status should be raised for a given regular expression and where to forward the user to. Entered as arrays. Default: undef. + +``` puppet +apache::vhost { 'site.name.fdqn': + … + redirectmatch_status => ['404','404'], + redirectmatch_regexp => ['\.git(/.*|$)/','\.svn(/.*|$)'], + redirectmatch_dest => ['http://www.example.com/1','http://www.example.com/2'], +} +``` + +##### `request_headers` + +Modifies collected [request headers](https://httpd.apache.org/docs/current/mod/mod_headers.html#requestheader) in various ways, including adding additional request headers, removing request headers, etc. Default: undef. + +``` puppet +apache::vhost { 'site.name.fdqn': + … + request_headers => [ + 'append MirrorID "mirror 12"', + 'unset MirrorID', + ], +} +``` +##### `rewrites` + +Creates URL rewrite rules. Expects an array of hashes, and the hash keys can be any of 'comment', 'rewrite_base', 'rewrite_cond', 'rewrite_rule' or 'rewrite_map'. Default: undef. + +For example, you can specify that anyone trying to access index.html is served welcome.html + +``` puppet +apache::vhost { 'site.name.fdqn': + … + rewrites => [ { rewrite_rule => ['^index\.html$ welcome.html'] } ] +} +``` + +The parameter allows rewrite conditions that, when true, execute the associated rule. For instance, if you wanted to rewrite URLs only if the visitor is using IE + +``` puppet +apache::vhost { 'site.name.fdqn': + … + rewrites => [ + { + comment => 'redirect IE', + rewrite_cond => ['%{HTTP_USER_AGENT} ^MSIE'], + rewrite_rule => ['^index\.html$ welcome.html'], + }, + ], +} +``` + +You can also apply multiple conditions. For instance, rewrite index.html to welcome.html only when the browser is Lynx or Mozilla (version 1 or 2) + +``` puppet +apache::vhost { 'site.name.fdqn': + … + rewrites => [ + { + comment => 'Lynx or Mozilla v1/2', + rewrite_cond => ['%{HTTP_USER_AGENT} ^Lynx/ [OR]', '%{HTTP_USER_AGENT} ^Mozilla/[12]'], + rewrite_rule => ['^index\.html$ welcome.html'], + }, + ], +} +``` + +Multiple rewrites and conditions are also possible + +``` puppet +apache::vhost { 'site.name.fdqn': + … + rewrites => [ + { + comment => 'Lynx or Mozilla v1/2', + rewrite_cond => ['%{HTTP_USER_AGENT} ^Lynx/ [OR]', '%{HTTP_USER_AGENT} ^Mozilla/[12]'], + rewrite_rule => ['^index\.html$ welcome.html'], + }, + { + comment => 'Internet Explorer', + rewrite_cond => ['%{HTTP_USER_AGENT} ^MSIE'], + rewrite_rule => ['^index\.html$ /index.IE.html [L]'], + }, + { + rewrite_base => /apps/, + rewrite_rule => ['^index\.cgi$ index.php', '^index\.html$ index.php', '^index\.asp$ index.html'], + }, + { comment => 'Rewrite to lower case', + rewrite_cond => ['%{REQUEST_URI} [A-Z]'], + rewrite_map => ['lc int:tolower'], + rewrite_rule => ['(.*) ${lc:$1} [R=301,L]'], + }, + ], +} +``` + +Refer to the [`mod_rewrite` documentation][`mod_rewrite`] for more details on what is possible with rewrite rules and conditions. + +##### `rewrite_inherit` + +Determines whether the virtual host inherits global rewrite rules. Default: false. + +Rewrite rules may be specified globally (in `$conf_file` or `$confd_dir`) or inside the virtual host `.conf` file. By default, virtual hosts do not inherit global settings. To activate inheritance, specify the `rewrites` parameter and set `rewrite_inherit` parameter to `true`: + +``` puppet +apache::vhost { 'site.name.fdqn': + … + rewrites => [ + , + ], + rewrite_inherit => true, +} +``` + +> **Note**: The `rewrites` parameter is **required** for this to have effect + +###### Some background + +Apache activates global `Rewrite` rules inheritance if the virtual host files contains the following directives: + +``` ApacheConf +RewriteEngine On +RewriteOptions Inherit +``` + +Refer to the [official `mod_rewrite` documentation](https://httpd.apache.org/docs/2.2/mod/mod_rewrite.html), section "Rewriting in Virtual Hosts". + +##### `scriptalias` + +Defines a directory of CGI scripts to be aliased to the path '/cgi-bin', such as '/usr/scripts'. Default: undef. + +##### `scriptaliases` + +> **Note**: This parameter is deprecated in favor of the `aliases` parameter. + +Passes an array of hashes to the virtual host to create either ScriptAlias or ScriptAliasMatch statements per the [`mod_alias` documentation][`mod_alias`]. + +``` puppet +scriptaliases => [ + { + alias => '/myscript', + path => '/usr/share/myscript', + }, + { + aliasmatch => '^/foo(.*)', + path => '/usr/share/fooscripts$1', + }, + { + aliasmatch => '^/bar/(.*)', + path => '/usr/share/bar/wrapper.sh/$1', + }, + { + alias => '/neatscript', + path => '/usr/share/neatscript', + }, +] +``` + +The ScriptAlias and ScriptAliasMatch directives are created in the order specified. As with [Alias and AliasMatch](#aliases) directives, specify more specific aliases before more general ones to avoid shadowing. + +##### `serveradmin` + +Specifies the email address Apache displays when it renders one of its error pages. Default: undef. + +##### `serveraliases` + +Sets the [ServerAliases](https://httpd.apache.org/docs/current/mod/core.html#serveralias) of the site. Default: '[]'. + +##### `servername` + +Sets the servername corresponding to the hostname you connect to the virtual host at. Default: the title of the resource. + +##### `setenv` + +Used by HTTPD to set environment variables for virtual hosts. Default: '[]'. + +Example: + +``` puppet +apache::vhost { 'setenv.example.com': + setenv => ['SPECIAL_PATH /foo/bin'], +} +``` + +##### `setenvif` + +Used by HTTPD to conditionally set environment variables for virtual hosts. Default: '[]'. + +##### `setenvifnocase` + +Used by HTTPD to conditionally set environment variables for virtual hosts (caseless matching). Default: '[]'. + +##### `suphp_addhandler`, `suphp_configpath`, & `suphp_engine` + +Sets up a virtual host with [suPHP](http://suphp.org/DocumentationView.html?file=apache/CONFIG). + +* `suphp_addhandler`. Default: 'php5-script' on RedHat and FreeBSD, and 'x-httpd-php' on Debian and Gentoo. +* `suphp_configpath`. Default: undef on RedHat and FreeBSD, and '/etc/php5/apache2' on Debian and Gentoo. +* `suphp_engine`. Valid options: 'on' or 'off'. Default: 'off'. + +An example virtual host configuration with suPHP: + +``` puppet +apache::vhost { 'suphp.example.com': + port => '80', + docroot => '/home/appuser/myphpapp', + suphp_addhandler => 'x-httpd-php', + suphp_engine => 'on', + suphp_configpath => '/etc/php5/apache2', + directories => { path => '/home/appuser/myphpapp', + 'suphp' => { user => 'myappuser', group => 'myappgroup' }, + } +} +``` + +##### `vhost_name` + +Enables name-based virtual hosting. If no IP is passed to the virtual host, but the virtual host is assigned a port, then the virtual host name is 'vhost_name:port'. If the virtual host has no assigned IP or port, the virtual host name is set to the title of the resource. Default: '*'. + +##### `virtual_docroot` + +Sets up a virtual host with a wildcard alias subdomain mapped to a directory with the same name. For example, 'http://example.com' would map to '/var/www/example.com'. Default: false. + +``` puppet +apache::vhost { 'subdomain.loc': + vhost_name => '*', + port => '80', + virtual_docroot => '/var/www/%-2+', + docroot => '/var/www', + serveraliases => ['*.loc',], +} +``` + +##### `wsgi_daemon_process`, `wsgi_daemon_process_options`, `wsgi_process_group`, `wsgi_script_aliases`, & `wsgi_pass_authorization` + +Sets up a virtual host with [WSGI](https://github.com/GrahamDumpleton/mod_wsgi). + +* `wsgi_daemon_process`: A hash that sets the name of the WSGI daemon, accepting [certain keys](http://modwsgi.readthedocs.org/en/latest/configuration-directives/WSGIDaemonProcess.html). Default: undef. +* `wsgi_daemon_process_options`. _Optional._ Default: undef. +* `wsgi_process_group`: Sets the group ID that the virtual host runs under. Default: undef. +* `wsgi_script_aliases`: Requires a hash of web paths to filesystem .wsgi paths. Default: undef. +* `wsgi_script_aliases_match`: Requires a hash of web path regexes to filesystem .wsgi paths. Default: undef +* `wsgi_pass_authorization`: Uses the WSGI application to handle authorization instead of Apache when set to 'On'. For more information, see [mod_wsgi's WSGIPassAuthorization documentation] (https://modwsgi.readthedocs.org/en/latest/configuration-directives/WSGIPassAuthorization.html). Default: undef, leading Apache to use its default value of 'Off'. +* `wsgi_chunked_request`: Enables support for chunked requests. Default: undef. + +An example virtual host configuration with WSGI: + +``` puppet +apache::vhost { 'wsgi.example.com': + port => '80', + docroot => '/var/www/pythonapp', + wsgi_daemon_process => 'wsgi', + wsgi_daemon_process_options => + { processes => '2', + threads => '15', + display-name => '%{GROUP}', + }, + wsgi_process_group => 'wsgi', + wsgi_script_aliases => { '/' => '/var/www/demo.wsgi' }, + wsgi_chunked_request => 'On', +} +``` + +#### Parameter `directories` for `apache::vhost` + +The `directories` parameter within the `apache::vhost` class passes an array of hashes to the virtual host to create [Directory](https://httpd.apache.org/docs/current/mod/core.html#directory), [File](https://httpd.apache.org/docs/current/mod/core.html#files), and [Location](https://httpd.apache.org/docs/current/mod/core.html#location) directive blocks. These blocks take the form, '< Directory /path/to/directory>...< /Directory>'. + +The `path` key sets the path for the directory, files, and location blocks. Its value must be a path for the 'directory', 'files', and 'location' providers, or a regex for the 'directorymatch', 'filesmatch', or 'locationmatch' providers. Each hash passed to `directories` **must** contain `path` as one of the keys. + +The `provider` key is optional. If missing, this key defaults to 'directory'. Valid options: 'directory', 'files', 'proxy', 'location', 'directorymatch', 'filesmatch', 'proxymatch' or 'locationmatch'. If you set `provider` to 'directorymatch', it uses the keyword 'DirectoryMatch' in the Apache config file. + +An example use of `directories`: + +``` puppet +apache::vhost { 'files.example.net': + docroot => '/var/www/files', + directories => [ + { 'path' => '/var/www/files', + 'provider' => 'files', + 'deny' => 'from all', + }, + ], +} +``` + +> **Note:** At least one directory should match the `docroot` parameter. After you start declaring directories, `apache::vhost` assumes that all required Directory blocks will be declared. If not defined, a single default Directory block is created that matches the `docroot` parameter. + +Available handlers, represented as keys, should be placed within the `directory`, `files`, or `location` hashes. This looks like + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ { path => '/path/to/directory', handler => value } ], +} +``` + +Any handlers you do not set in these hashes are considered 'undefined' within Puppet and are not added to the virtual host, resulting in the module using their default values. Supported handlers are: + +###### `addhandlers` + +Sets [AddHandler](https://httpd.apache.org/docs/current/mod/mod_mime.html#addhandler) directives, which map filename extensions to the specified handler. Accepts a list of hashes, with `extensions` serving to list the extensions being managed by the handler, and takes the form: `{ handler => 'handler-name', extensions => ['extension'] }`. + +An example: + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + addhandlers => [{ handler => 'cgi-script', extensions => ['.cgi']}], + }, + ], +} +``` + +###### `allow` + +Sets an [Allow](https://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#allow) directive, which groups authorizations based on hostnames or IPs. **Deprecated:** This parameter is being deprecated due to a change in Apache. It only works with Apache 2.2 and lower. You can use it as a single string for one rule or as an array for more than one. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + allow => 'from example.org', + }, + ], +} +``` + +###### `allow_override` + +Sets the types of directives allowed in [.htaccess](https://httpd.apache.org/docs/current/mod/core.html#allowoverride) files. Accepts an array. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + allow_override => ['AuthConfig', 'Indexes'], + }, + ], +} +``` + +###### `auth_basic_authoritative` + +Sets the value for [AuthBasicAuthoritative](https://httpd.apache.org/docs/current/mod/mod_auth_basic.html#authbasicauthoritative), which determines whether authorization and authentication are passed to lower level Apache modules. + +###### `auth_basic_fake` + +Sets the value for [AuthBasicFake](https://httpd.apache.org/docs/current/mod/mod_auth_basic.html#authbasicfake), which statically configures authorization credentials for a given directive block. + +###### `auth_basic_provider` + +Sets the value for [AuthBasicProvider](https://httpd.apache.org/docs/current/mod/mod_auth_basic.html#authbasicprovider), which sets the authentication provider for a given location. + +###### `auth_digest_algorithm` + +Sets the value for [AuthDigestAlgorithm](https://httpd.apache.org/docs/current/mod/mod_auth_digest.html#authdigestalgorithm), which selects the algorithm used to calculate the challenge and response hashes. + +###### `auth_digest_domain` + +Sets the value for [AuthDigestDomain](https://httpd.apache.org/docs/current/mod/mod_auth_digest.html#authdigestdomain), which allows you to specify one or more URIs in the same protection space for digest authentication. + +###### `auth_digest_nonce_lifetime` + +Sets the value for [AuthDigestNonceLifetime](https://httpd.apache.org/docs/current/mod/mod_auth_digest.html#authdigestnoncelifetime), which controls how long the server nonce is valid. + +###### `auth_digest_provider` + +Sets the value for [AuthDigestProvider](https://httpd.apache.org/docs/current/mod/mod_auth_digest.html#authdigestprovider), which sets the authentication provider for a given location. + +###### `auth_digest_qop` + +Sets the value for [AuthDigestQop](https://httpd.apache.org/docs/current/mod/mod_auth_digest.html#authdigestqop), which determines the quality-of-protection to use in digest authentication. + +###### `auth_digest_shmem_size` + +Sets the value for [AuthAuthDigestShmemSize](https://httpd.apache.org/docs/current/mod/mod_auth_digest.html#authdigestshmemsize), which defines the amount of shared memory allocated to the server for keeping track of clients. + +###### `auth_group_file` + +Sets the value for [AuthGroupFile](https://httpd.apache.org/docs/current/mod/mod_authz_groupfile.html#authgroupfile), which sets the name of the text file containing the list of user groups for authorization. + +###### `auth_name` + +Sets the value for [AuthName](https://httpd.apache.org/docs/current/mod/mod_authn_core.html#authname), which sets the name of the authorization realm. + +###### `auth_require` + +Sets the entity name you're requiring to allow access. Read more about [Require](https://httpd.apache.org/docs/current/mod/mod_authz_host.html#requiredirectives). + +###### `auth_type` + +Sets the value for [AuthType](https://httpd.apache.org/docs/current/mod/mod_authn_core.html#authtype), which guides the type of user authentication. + +###### `auth_user_file` + +Sets the value for [AuthUserFile](https://httpd.apache.org/docs/current/mod/mod_authn_file.html#authuserfile), which sets the name of the text file containing the users/passwords for authentication. + +###### `auth_merging` + +Sets the value for [AuthMerging](https://httpd.apache.org/docs/current/mod/mod_authz_core.html#authmerging), which determines if authorization logic should be combined + +###### `auth_ldap_url` + +Sets the value for [AuthLDAPURL](https://httpd.apache.org/docs/current/mod/mod_authnz_ldap.html#authldapurl), which determines URL of LDAP-server(s) if AuthBasicProvider 'ldap' is used + +###### `auth_ldap_bind_dn` + +Sets the value for [AuthLDAPBindDN](https://httpd.apache.org/docs/current/mod/mod_authnz_ldap.html#authldapbinddn), which allows use of an optional DN used to bind to the LDAP-server when searching for entries if AuthBasicProvider 'ldap' is used + +###### `auth_ldap_bind_password` + +Sets the value for [AuthLDAPBindPassword](https://httpd.apache.org/docs/current/mod/mod_authnz_ldap.html#authldapbindpassword), which allows use of an optional bind password to use in conjunction with the bind DN if AuthBasicProvider 'ldap' is used + +###### `auth_ldap_group_attribute` + +Array of values for [AuthLDAPGroupAttribute](https://httpd.apache.org/docs/current/mod/mod_authnz_ldap.html#authldapgroupattribute), specifies which LDAP attributes are used to check for user members within ldap-groups. defaults are: "member" and "uniquemember" + +###### `auth_ldap_group_attribute_is_dn` + +Sets value for [AuthLDAPGroupAttributeIsDN](https://httpd.apache.org/docs/current/mod/mod_authnz_ldap.html#authldapgroupattributeisdn), specifies if member of a ldapgroup is a dn or simple username. When set on, this directive says to use the distinguished name of the client username when checking for group membership. Otherwise, the username will be used. valid values are: "on" or "off" + +###### `custom_fragment` + +Pass a string of custom configuration directives to be placed at the end of the directory configuration. + +``` puppet +apache::vhost { 'monitor': + … + directories => [ + { + path => '/path/to/directory', + custom_fragment => ' + + SetHandler balancer-manager + Order allow,deny + Allow from all + + + SetHandler server-status + Order allow,deny + Allow from all + +ProxyStatus On', + }, + ] +} +``` + +###### `dav` + +Sets the value for [Dav](http://httpd.apache.org/docs/current/mod/mod_dav.html#dav), which determines if the WebDAV HTTP methods should be enabled. The value can be either `On`, `Off` or the name of the provider. A value of `On` enables the default filesystem provider implemented by the `mod_dav_fs` module. + +###### `dav_depth_infinity` + +Sets the value for [DavDepthInfinity](http://httpd.apache.org/docs/current/mod/mod_dav.html#davdepthinfinity), which is used to enable the processing of `PROPFIND` requests having a `Depth: Infinity` header. + +###### `dav_min_timeout` + +Sets the value for [DavMinTimeout](http://httpd.apache.org/docs/current/mod/mod_dav.html#davmintimeout), which sets the time the server holds a lock on a DAV resource. The value should be the number of seconds to set. + +###### `deny` + +Sets a [Deny](https://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#deny) directive, specifying which hosts are denied access to the server. **Deprecated:** This parameter is being deprecated due to a change in Apache. It only works with Apache 2.2 and lower. You can use it as a single string for one rule or as an array for more than one. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + deny => 'from example.org', + }, + ], +} +``` + +###### `error_documents` + +An array of hashes used to override the [ErrorDocument](https://httpd.apache.org/docs/current/mod/core.html#errordocument) settings for the directory. + +``` puppet +apache::vhost { 'sample.example.net': + directories => [ + { path => '/srv/www', + error_documents => [ + { 'error_code' => '503', + 'document' => '/service-unavail', + }, + ], + }, + ], +} +``` + +###### `ext_filter_options` + +Sets the [ExtFilterOptions](https://httpd.apache.org/docs/current/mod/mod_ext_filter.html) directive. +Note that you must declare `class { 'apache::mod::ext_filter': }` before using this directive. + +``` puppet +apache::vhost { 'filter.example.org': + docroot => '/var/www/filter', + directories => [ + { path => '/var/www/filter', + ext_filter_options => 'LogStderr Onfail=abort', + }, + ], +} +``` + +###### `geoip_enable` + +Sets the [GeoIPEnable](http://dev.maxmind.com/geoip/legacy/mod_geoip2/#Configuration) directive. +Note that you must declare `class {'apache::mod::geoip': }` before using this directive. + +``` puppet +apache::vhost { 'first.example.com': + docroot => '/var/www/first', + directories => [ + { path => '/var/www/first', + geoip_enable => true, + }, + ], +} +``` + +###### `headers` + +Adds lines for [Header](https://httpd.apache.org/docs/current/mod/mod_headers.html#header) directives. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => { + path => '/path/to/directory', + headers => 'Set X-Robots-Tag "noindex, noarchive, nosnippet"', + }, +} +``` + +###### `index_options` + +Allows configuration settings for [directory indexing](https://httpd.apache.org/docs/current/mod/mod_autoindex.html#indexoptions). + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + directoryindex => 'disabled', # this is needed on Apache 2.4 or mod_autoindex doesn't work + options => ['Indexes','FollowSymLinks','MultiViews'], + index_options => ['IgnoreCase', 'FancyIndexing', 'FoldersFirst', 'NameWidth=*', 'DescriptionWidth=*', 'SuppressHTMLPreamble'], + }, + ], +} +``` + +###### `index_order_default` + +Sets the [default ordering](https://httpd.apache.org/docs/current/mod/mod_autoindex.html#indexorderdefault) of the directory index. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + order => 'Allow,Deny', + index_order_default => ['Descending', 'Date'], + }, + ], +} +``` + +###### `index_style_sheet` + +Sets the [IndexStyleSheet](https://httpd.apache.org/docs/current/mod/mod_autoindex.html#indexstylesheet), which adds a CSS stylesheet to the directory index. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + options => ['Indexes','FollowSymLinks','MultiViews'], + index_options => ['FancyIndexing'], + index_style_sheet => '/styles/style.css', + }, + ], +} +``` + +###### `limit` + +Creates a [Limit](https://httpd.apache.org/docs/current/mod/core.html#limit) block inside the Directory block, which can also contain `require` directives. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/docroot', + directories => [ + { path => '/', + provider => 'location', + limit => [ + { methods => 'GET HEAD', + require => ['valid-user'] + }, + ], + }, + ], +} +``` + +###### `mellon_enable` + +Sets the [MellonEnable][`mod_auth_mellon`] directory to enable [`mod_auth_mellon`][]. You can use [`apache::mod::auth_mellon`][] to install `mod_auth_mellon`. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/', + provider => 'directory', + mellon_enable => 'info', + mellon_sp_private_key_file => '/etc/certs/${::fqdn}.key', + mellon_endpoint_path => '/mellon', + mellon_set_env_no_prefix => { 'ADFS_GROUP' => 'http://schemas.xmlsoap.org/claims/Group', + 'ADFS_EMAIL' => 'http://schemas.xmlsoap.org/claims/EmailAddress', }, + mellon_user => 'ADFS_LOGIN', + }, + { path => '/protected', + provider => 'location', + mellon_enable => 'auth', + auth_type => 'Mellon', + auth_require => 'valid-user', + mellon_cond => ['ADFS_LOGIN userA [MAP]','ADFS_LOGIN userB [MAP]'], + }, + ] +} +``` + +Related parameters follow the names of `mod_auth_mellon` directives: + +- `mellon_cond`: Takes an array of mellon conditions that must be met to grant access, and creates a [MellonCond][`mod_auth_mellon`] directive for each item in the array. +- `mellon_endpoint_path`: Sets the [MellonEndpointPath][`mod_auth_mellon`] to set the mellon endpoint path. +- `mellon_sp_metadata_file`: Sets the [MellonSPMetadataFile][`mod_auth_mellon`] location of the SP metadata file. +- `mellon_idp_metadata_file`: Sets the [MellonIDPMetadataFile][`mod_auth_mellon`] location of the IDP metadata file. +- `mellon_saml_rsponse_dump`: Sets the [MellonSamlResponseDump][`mod_auth_mellon`] directive to enable debug of SAML. +- `mellon_set_env_no_prefix`: Sets the [MellonSetEnvNoPrefix][`mod_auth_mellon`] directive to a hash of attribute names to map +to environment variables. +- `mellon_sp_private_key_file`: Sets the [MellonSPPrivateKeyFile][`mod_auth_mellon`] directive for the private key location of the service provider. +- `mellon_sp_cert_file`: Sets the [MellonSPCertFile][`mod_auth_mellon`] directive for the public key location of the service provider. +- `mellon_user`: Sets the [MellonUser][`mod_auth_mellon`] attribute to use for the username. + +###### `options` + +Lists the [Options](https://httpd.apache.org/docs/current/mod/core.html#options) for the given Directory block. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + options => ['Indexes','FollowSymLinks','MultiViews'], + }, + ], +} +``` + +###### `order` + +Sets the order of processing Allow and Deny statements as per [Apache core documentation](https://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#order). **Deprecated:** This parameter is being deprecated due to a change in Apache. It only works with Apache 2.2 and lower. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + order => 'Allow,Deny', + }, + ], +} +``` + +###### `passenger_enabled` + +Sets the value for the [PassengerEnabled](http://www.modrails.com/documentation/Users%20guide%20Apache.html#PassengerEnabled) directive to 'on' or 'off'. Requires `apache::mod::passenger` to be included. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + passenger_enabled => 'on', + }, + ], +} +``` + +> **Note:** There is an [issue](http://www.conandalton.net/2010/06/passengerenabled-off-not-working.html) using the PassengerEnabled directive with the PassengerHighPerformance directive. + +###### `php_value` and `php_flag` + +`php_value` sets the value of the directory, and `php_flag` uses a boolean to configure the directory. Further information can be found [here](http://php.net/manual/en/configuration.changes.php). + +###### `php_admin_value` and `php_admin_flag` + +`php_admin_value` sets the value of the directory, and `php_admin_flag` uses a boolean to configure the directory. Further information can be found [here](http://php.net/manual/en/configuration.changes.php). + + +###### `require` + + +Sets a `Require` directive as per the [Apache Authz documentation](https://httpd.apache.org/docs/current/mod/mod_authz_core.html#require). If no `require` is set, it will default to `Require all granted`. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + require => 'ip 10.17.42.23', + } + ], +} +``` + +When more complex sets of requirement are needed, apache >= 2.4 provides the use of [RequireAll](https://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#requireall), [RequireNone](https://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#requirenone) or [RequireAny](https://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#requireany) directives. +Using the 'enforce' key, which only supports 'any','none','all' (other values are silently ignored), this could be established like: + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + require => { + enforce => 'any', + requires => [ + 'ip 1.2.3.4', + 'not host host.example.com', + 'user xyz', + ], + }, + }, + ], +} +``` + +If `require` is set to `unmanaged` it will not be set at all. This is useful for complex authentication/authorization requirements which are handled in a custom fragment. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + require => 'unmanaged', + } + ], +} +``` + + + +###### `satisfy` + +Sets a `Satisfy` directive per the [Apache Core documentation](https://httpd.apache.org/docs/2.2/mod/core.html#satisfy). **Deprecated:** This parameter is deprecated due to a change in Apache and only works with Apache 2.2 and lower. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + satisfy => 'Any', + } + ], +} +``` + +###### `sethandler` + +Sets a `SetHandler` directive per the [Apache Core documentation](https://httpd.apache.org/docs/2.2/mod/core.html#sethandler). + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + sethandler => 'None', + } + ], +} +``` + +###### `set_output_filter` + +Sets a `SetOutputFilter` directive per the [Apache Core documentation](https://httpd.apache.org/docs/current/mod/core.html#setoutputfilter). + +``` puppet +apache::vhost{ 'filter.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + set_output_filter => puppetdb-strip-resource-params, + }, + ], +} +``` + +###### `rewrites` + +Creates URL [`rewrites`](#rewrites) rules in virtual host directories. Expects an array of hashes, and the hash keys can be any of 'comment', 'rewrite_base', 'rewrite_cond', or 'rewrite_rule'. + +``` puppet +apache::vhost { 'secure.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + rewrites => [ { comment => 'Permalink Rewrites', + rewrite_base => '/' + }, + { rewrite_rule => [ '^index\.php$ - [L]' ] + }, + { rewrite_cond => [ '%{REQUEST_FILENAME} !-f', + '%{REQUEST_FILENAME} !-d', + ], + rewrite_rule => [ '. /index.php [L]' ], + } + ], + }, + ], +} +``` + +> **Note**: If you include rewrites in your directories, also include `apache::mod::rewrite` and consider setting the rewrites using the `rewrites` parameter in `apache::vhost` rather than setting the rewrites in the virtual host's directories. + +###### `shib_request_settings` + +Allows a valid content setting to be set or altered for the application request. This command takes two parameters: the name of the content setting, and the value to set it to. Check the Shibboleth [content setting documentation](https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSettings) for valid settings. This key is disabled if `apache::mod::shib` is not defined. Check the [`mod_shib` documentation](https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig#NativeSPApacheConfig-Server/VirtualHostOptions) for more details. + +``` puppet +apache::vhost { 'secure.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + shib_request_settings => { 'requiresession' => 'On' }, + shib_use_headers => 'On', + }, + ], +} +``` + +###### `shib_use_headers` + +When set to 'On', this turns on the use of request headers to publish attributes to applications. Valid options for this key is 'On' or 'Off', and the default value is 'Off'. This key is disabled if `apache::mod::shib` is not defined. Check the [`mod_shib` documentation](https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig#NativeSPApacheConfig-Server/VirtualHostOptions) for more details. + +###### `ssl_options` + +String or list of [SSLOptions](https://httpd.apache.org/docs/current/mod/mod_ssl.html#ssloptions), which configure SSL engine run-time options. This handler takes precedence over SSLOptions set in the parent block of the virtual host. + +``` puppet +apache::vhost { 'secure.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + ssl_options => '+ExportCertData', + }, + { path => '/path/to/different/dir', + ssl_options => [ '-StdEnvVars', '+ExportCertData'], + }, + ], +} +``` + +###### `suphp` + +A hash containing the 'user' and 'group' keys for the [suPHP_UserGroup](http://www.suphp.org/DocumentationView.html?file=apache/CONFIG) setting. It must be used with `suphp_engine => on` in the virtual host declaration, and can only be passed within `directories`. + +``` puppet +apache::vhost { 'secure.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/directory', + suphp => { + user => 'myappuser', + group => 'myappgroup', + }, + }, + ], +} +``` +###### `additional_includes` + +Specifies paths to additional static, specific Apache configuration files in virtual host directories. Valid options: a array of string path. + +``` puppet +apache::vhost { 'sample.example.net': + docroot => '/path/to/directory', + directories => [ + { path => '/path/to/different/dir', + additional_includes => [ '/custom/path/includes', '/custom/path/another_includes', ], + }, + ], +} +``` + +#### SSL parameters for `apache::vhost` + +All of the SSL parameters for `::vhost` default to whatever is set in the base `apache` class. Use the below parameters to tweak individual SSL settings for specific virtual hosts. + +##### `ssl` + +Enables SSL for the virtual host. SSL virtual hosts only respond to HTTPS queries. Valid options: Boolean. Default: false. + +##### `ssl_ca` + +Specifies the SSL certificate authority. Default: undef. + +##### `ssl_cert` + +Specifies the SSL certification. Defaults are based on your OS: '/etc/pki/tls/certs/localhost.crt' for RedHat, '/etc/ssl/certs/ssl-cert-snakeoil.pem' for Debian, '/usr/local/etc/apache22/server.crt' for FreeBSD, and '/etc/ssl/apache2/server.crt' on Gentoo. + +##### `ssl_protocol` + +Specifies [SSLProtocol](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslprotocol). Expects an array or space separated string of accepted protocols. Defaults: 'all', '-SSLv2', '-SSLv3'. + +##### `ssl_cipher` + +Specifies [SSLCipherSuite](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslciphersuite). Default: 'HIGH:MEDIUM:!aNULL:!MD5'. + +##### `ssl_honorcipherorder` + +Sets [SSLHonorCipherOrder](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhonorcipherorder), to cause Apache to use the server's preferred order of ciphers rather than the client's preferred order. Default: true. In addition to true/false Boolean values, will also accept case-insensitive Strings 'on' or 'off'. + +##### `ssl_certs_dir` + +Specifies the location of the SSL certification directory. Default: Depends on the operating system. + +- **Debian:** '/etc/ssl/certs' +- **Red Hat:** '/etc/pki/tls/certs' +- **FreeBSD:** undef +- **Gentoo:** '/etc/ssl/apache2' + +##### `ssl_chain` + +Specifies the SSL chain. Default: undef. This default works out of the box, but it must be updated in the base `apache` class with your specific certificate information before being used in production. + +##### `ssl_crl` + +Specifies the certificate revocation list to use. Default: undef. (This default works out of the box but must be updated in the base `apache` class with your specific certificate information before being used in production.) + +##### `ssl_crl_path` + +Specifies the location of the certificate revocation list. Default: undef. (This default works out of the box but must be updated in the base `apache` class with your specific certificate information before being used in production.) + +##### `ssl_crl_check` + +Sets the certificate revocation check level via the [SSLCARevocationCheck directive](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcarevocationcheck). Default: undef. This default works out of the box but must be specified when using CRLs in production. Only applicable to Apache 2.4 or higher; the value is ignored on older versions. + +##### `ssl_key` + +Specifies the SSL key. Defaults are based on your operating system: '/etc/pki/tls/private/localhost.key' for RedHat, '/etc/ssl/private/ssl-cert-snakeoil.key' for Debian, '/usr/local/etc/apache22/server.key' for FreeBSD, and '/etc/ssl/apache2/server.key' on Gentoo. (This default works out of the box but must be updated in the base `apache` class with your specific certificate information before being used in production.) + +##### `ssl_verify_client` + +Sets the [SSLVerifyClient](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslverifyclient) directive, which sets the certificate verification level for client authentication. Valid options are: 'none', 'optional', 'require', and 'optional_no_ca'. Default: undef. + +``` puppet +apache::vhost { 'sample.example.net': + … + ssl_verify_client => 'optional', +} +``` + +##### `ssl_verify_depth` + +Sets the [SSLVerifyDepth](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslverifydepth) directive, which specifies the maximum depth of CA certificates in client certificate verification. Default: undef. + +``` puppet +apache::vhost { 'sample.example.net': + … + ssl_verify_depth => 1, +} +``` +##### `ssl_proxy_protocol` + +Sets the [SSLProxyProtocol](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslproxyprotocol) directive, which controls the SSL protocol flavors mod_ssl should use when establishing its server environment for proxy. It will only connect to servers using one of the provided protocols. Default: undef. + + +##### `ssl_proxy_verify` + +Sets the [SSLProxyVerify](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslproxyverify) directive, which configures certificate verification of the remote server when a proxy is configured to forward requests to a remote SSL server. Default: undef. + +##### `ssl_proxy_machine_cert` + +Sets the [SSLProxyMachineCertificateFile](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslproxymachinecertificatefile) directive, which specifies an all-in-one file where you keep the certs and keys used for this server to authenticate itself to remote servers. This file should be a concatenation of the PEM-encoded certificate files in order of preference. Default: undef. + +``` puppet +apache::vhost { 'sample.example.net': + … + ssl_proxy_machine_cert => '/etc/httpd/ssl/client_certificate.pem', +} +``` + +##### `ssl_proxy_check_peer_cn` + +Sets the [SSLProxyCheckPeerCN](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslproxycheckpeercn) directive, which specifies whether the remote server certificate's CN field is compared against the hostname of the request URL. Valid options: 'on', 'off'. Default: undef. + +##### `ssl_proxy_check_peer_name` + +Sets the [SSLProxyCheckPeerName](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslproxycheckpeername) directive, which specifies whether the remote server certificate's CN field is compared against the hostname of the request URL. Valid options: 'on', 'off'. Default: undef. + +##### `ssl_proxy_check_peer_expire` + +Sets the [SSLProxyCheckPeerExpire](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslproxycheckpeerexpire) directive, which specifies whether the remote server certificate is checked for expiration or not. Valid options: 'on', 'off'. Default: undef. + +##### `ssl_options` + +Sets the [SSLOptions](https://httpd.apache.org/docs/current/mod/mod_ssl.html#ssloptions) directive, which configures various SSL engine run-time options. This is the global setting for the given virtual host and can be a string or an array. Default: undef. + +A string: + +``` puppet +apache::vhost { 'sample.example.net': + … + ssl_options => '+ExportCertData', +} +``` + +An array: + +``` puppet +apache::vhost { 'sample.example.net': + … + ssl_options => [ '+StrictRequire', '+ExportCertData' ], +} +``` + +##### `ssl_openssl_conf_cmd` + +Sets the [SSLOpenSSLConfCmd](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslopensslconfcmd) directive, which provides direct configuration of OpenSSL parameters. Default: undef. + +##### `ssl_proxyengine` + +Specifies whether or not to use [SSLProxyEngine](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslproxyengine). Valid options: Boolean. Default: true. + +##### `ssl_stapling` + +Specifies whether or not to use [SSLUseStapling](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslusestapling). Valid options: Boolean or undef. Default: undef, meaning use what is set globally. + +This parameter only applies to Apache 2.4 or higher and is ignored on older versions. + +##### `ssl_stapling_timeout` + +Can be used to set the [SSLStaplingResponderTimeout](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslstaplingrespondertimeout) directive. No default. + +This parameter only applies to Apache 2.4 or higher and is ignored on older versions. + +##### `ssl_stapling_return_errors` + +Can be used to set the [SSLStaplingReturnResponderErrors](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslstaplingreturnrespondererrors) directive. No default. + +This parameter only applies to Apache 2.4 or higher and is ignored on older versions. + +#### Defined type: FastCGI Server + +This type is intended for use with mod\_fastcgi. It allows you to define one or more external FastCGI servers to handle specific file types. + +** Note ** If using Ubuntu 10.04+, you'll need to manually enable the multiverse repository. + +Ex: + +``` puppet +apache::fastcgi::server { 'php': + host => '127.0.0.1:9000', + timeout => 15, + flush => false, + faux_path => '/var/www/php.fcgi', + fcgi_alias => '/php.fcgi', + file_type => 'application/x-httpd-php', + pass_header => '' +} +``` + +Within your virtual host, you can then configure the specified file type to be handled by the fastcgi server specified above. + +``` puppet +apache::vhost { 'www': + ... + custom_fragment => 'AddType application/x-httpd-php .php' + ... +} +``` + +##### `host` + +The hostname or IP address and TCP port number (1-65535) of the FastCGI server. + +It is also possible to pass a unix socket: + +``` puppet +apache::fastcgi::server { 'php': + host => '/var/run/fcgi.sock', +} +``` + +##### `timeout` + +The number of seconds of FastCGI application inactivity allowed before the request is aborted and the event is logged (at the error LogLevel). The inactivity timer applies only as long as a connection is pending with the FastCGI application. If a request is queued to an application, but the application doesn't respond (by writing and flushing) within this period, the request is aborted. If communication is complete with the application but incomplete with the client (the response is buffered), the timeout does not apply. + +##### `flush` + +Force a write to the client as data is received from the application. By default, mod\_fastcgi buffers data in order to free the application as quickly as possible. + +##### `faux_path` + +`faux_path` does not have to exist in the local filesystem. URIs that Apache resolves to this filename are handled by this external FastCGI application. + +##### `alias` + +A unique alias. This is used internally to link the action with the FastCGI server. + +##### `file_type` + +The MIME-type of the file to be processed by the FastCGI server. + +##### `pass_header` + +The name of an HTTP Request Header to be passed in the request environment. This option makes available the contents of headers which are normally not available (e.g. Authorization) to a CGI environment. + +#### Defined type: `apache::vhost::custom` + +The `apache::vhost::custom` defined type is a thin wrapper around the `apache::custom_config` defined type, and simply overrides some of its default settings specific to the virtual host directory in Apache. + +**Parameters within `apache::vhost::custom`**: + +##### `content` + +Sets the configuration file's content. + +##### `ensure` + +Specifies if the virtual host file is present or absent. Valid options: 'absent', 'present'. Default: 'present'. + +##### `priority` + +Sets the relative load order for Apache HTTPD VirtualHost configuration files. Default: '25'. + +##### `verify_config` + +Specifies whether to validate the configuration file before notifying the Apache service. Valid options: Boolean. Default: true. + + +### Private defined types + +#### Defined type: `apache::peruser::multiplexer` + +This defined type checks if an Apache module has a class. If it does, it includes that class. If it does not, it passes the module name to the [`apache::mod`][] defined type. + +#### Defined type: `apache::peruser::multiplexer` + +Enables the [`Peruser`][] module for FreeBSD only. + +#### Defined type: `apache::peruser::processor` + +Enables the [`Peruser`][] module for FreeBSD only. + +#### Defined type: `apache::security::file_link` + +Links the `activated_rules` from [`apache::mod::security`][] to the respective CRS rules on disk. + +### Templates + +The Apache module relies heavily on templates to enable the [`apache::vhost`][] and [`apache::mod`][] defined types. These templates are built based on [Facter][] facts specific to your operating system. Unless explicitly called out, most templates are not meant for configuration. + +## Limitations + +### Ubuntu 10.04 + +The [`apache::vhost::WSGIImportScript`][] parameter creates a statement inside the virtual host that is unsupported on older versions of Apache, causing it to fail. This will be remedied in a future refactoring. + +### Ubuntu 16.04 +The [`apache::mod::suphp`][] class is untested since repositories are missing compatible packages. + +### RHEL/CentOS 5 + +The [`apache::mod::passenger`][] and [`apache::mod::proxy_html`][] classes are untested since repositories are missing compatible packages. + +### RHEL/CentOS 6 + +The [`apache::mod::passenger`][] class is not installing as the the EL6 repository is missing compatible packages. + +### RHEL/CentOS 7 + +The [`apache::mod::passenger`][] and [`apache::mod::proxy_html`][] classes are untested as the EL7 repository is missing compatible packages, which also blocks us from testing the [`apache::vhost`][] defined type's [`rack_base_uris`][] parameter. + +### General + +This module is CI tested against both [open source Puppet][] and [Puppet Enterprise][] on: + +- CentOS 5 and 6 +- Ubuntu 12.04 and 14.04 +- Debian 7 +- RHEL 5, 6, and 7 + +This module also provides functions for other distributions and operating systems, such as FreeBSD, Gentoo, and Amazon Linux, but is not formally tested on them and are subject to regressions. + +### Ubuntu 10.04 + +The [`apache::vhost::wsgi_import_script`][] parameter creates a statement inside the virtual host that is unsupported on older versions of Apache, causing it to fail. This will be remedied in a future refactoring. + +### RHEL/CentOS +The [`apache::mod::auth_cas`][], [`apache::mod::passenger`][], [`apache::mod::proxy_html`][] and [`apache::mod::shib`][] classes are not functional on RH/CentOS without providing dependency packages from extra repositories. + +See their respective documentation above for related repositories and packages. + +### SELinux and custom paths + +If [SELinux][] is in [enforcing mode][] and you want to use custom paths for `logroot`, `mod_dir`, `vhost_dir`, and `docroot`, you need to manage the files' context yourself. + +You can do this with Puppet: + +``` puppet +exec { 'set_apache_defaults': + command => 'semanage fcontext -a -t httpd_sys_content_t "/custom/path(/.*)?"', + path => '/bin:/usr/bin/:/sbin:/usr/sbin', + require => Package['policycoreutils-python'], +} + +package { 'policycoreutils-python': + ensure => installed, +} + +exec { 'restorecon_apache': + command => 'restorecon -Rv /apache_spec', + path => '/bin:/usr/bin/:/sbin:/usr/sbin', + before => Class['Apache::Service'], + require => Class['apache'], +} + +class { 'apache': } + +host { 'test.server': + ip => '127.0.0.1', +} + +file { '/custom/path': + ensure => directory, +} + +file { '/custom/path/include': + ensure => present, + content => '#additional_includes', +} + +apache::vhost { 'test.server': + docroot => '/custom/path', + additional_includes => '/custom/path/include', +} +``` + +You need to set the contexts using `semanage fcontext` instead of `chcon` because Puppet's `file` resources reset the values' context in the database if the resource doesn't specify it. + +### FreeBSD + +In order to use this module on FreeBSD, you _must_ use apache24-2.4.12 (www/apache24) or newer. + +## Development + +### Contributing + +[Puppet Labs][] modules on the [Puppet Forge][] are open projects, and community contributions are essential for keeping them great. We can’t access the huge number of platforms and myriad hardware, software, and deployment configurations that Puppet is intended to serve. + +We want to make it as easy as possible to contribute changes so our modules work in your environment, but we also need contributors to follow a few guidelines to help us maintain and improve the modules' quality. + +For more information, please read the complete [module contribution guide][]. + +### Running tests + +This project contains tests for both [rspec-puppet][] and [beaker-rspec][] to verify functionality. For detailed information on using these tools, please see their respective documentation. + +#### Testing quickstart: Ruby > 1.8.7 + +``` +gem install bundler +bundle install +bundle exec rake spec +bundle exec rspec spec/acceptance +RS_DEBUG=yes bundle exec rspec spec/acceptance +``` + +#### Testing quickstart: Ruby = 1.8.7 + +``` +gem install bundler +bundle install --without system_tests +bundle exec rake spec +``` diff --git a/environments/production/modules/apache/Rakefile b/environments/production/modules/apache/Rakefile new file mode 100644 index 0000000..f4c70b8 --- /dev/null +++ b/environments/production/modules/apache/Rakefile @@ -0,0 +1,39 @@ +require 'puppet_blacksmith/rake_tasks' +require 'puppet-lint/tasks/puppet-lint' +require 'puppetlabs_spec_helper/rake_tasks' + +PuppetLint.configuration.send('relative') +PuppetLint.configuration.send('disable_documentation') +PuppetLint.configuration.send('disable_single_quote_string_with_variables') +PuppetLint.configuration.send('disable_only_variable_string') + +desc 'Generate pooler nodesets' +task :gen_nodeset do + require 'beaker-hostgenerator' + require 'securerandom' + require 'fileutils' + + agent_target = ENV['TEST_TARGET'] + if ! agent_target + STDERR.puts 'TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat-64default."' + agent_target = 'redhat-64default.' + end + + master_target = ENV['MASTER_TEST_TARGET'] + if ! master_target + STDERR.puts 'MASTER_TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat7-64mdcl"' + master_target = 'redhat7-64mdcl' + end + + targets = "#{master_target}-#{agent_target}" + cli = BeakerHostGenerator::CLI.new([targets]) + nodeset_dir = "tmp/nodesets" + nodeset = "#{nodeset_dir}/#{targets}-#{SecureRandom.uuid}.yaml" + FileUtils.mkdir_p(nodeset_dir) + File.open(nodeset, 'w') do |fh| + fh.print(cli.execute) + end + puts nodeset +end diff --git a/environments/production/modules/apache/checksums.json b/environments/production/modules/apache/checksums.json new file mode 100644 index 0000000..076f703 --- /dev/null +++ b/environments/production/modules/apache/checksums.json @@ -0,0 +1,336 @@ +{ + "CHANGELOG.md": "3cf646fb26cf26763a7cfb5aad950d1a", + "CONTRIBUTING.md": "b78f71c1104f00538d50ad2775f58e95", + "Gemfile": "8229b2c0196b32a14403f99450c801af", + "LICENSE": "3b83ef96387f14655fc854ddc3c6bd57", + "NOTICE": "b7f979f1e3cd132677e1cd7762547e6b", + "README.md": "320bd7f9fb5e88b097805076c39b6b02", + "Rakefile": "3a104cbf874d68f98be0c43522d54a27", + "examples/apache.pp": "41e97262421ea5734fac16a338701a78", + "examples/dev.pp": "8da0d50d9d06834dd06329b8945f06d5", + "examples/init.pp": "d27415f33028c26d4031d30305eec5e0", + "examples/mod_load_params.pp": "e8d1c1b1b96d560c8288c51a76bffc87", + "examples/mods.pp": "78a25c9e226265353eabefd3ddfd4218", + "examples/mods_custom.pp": "bc9e6959c282984cf9cdd93869c89499", + "examples/php.pp": "afa0871b94040e3ae91fce9c375fb725", + "examples/vhost.pp": "2e9880fd36401c2f0b083054e7c69f3c", + "examples/vhost_directories.pp": "95aa446a2fccf9f3561581a5d71c61a7", + "examples/vhost_filter.pp": "62c5af7868af9887b7d71769c319c1e5", + "examples/vhost_ip_based.pp": "7a4d4c1c00147c45e4534f58d2fbf4ed", + "examples/vhost_proxypass.pp": "2f0bd33b34a48554adcdf20d6d31a4c2", + "examples/vhost_ssl.pp": "ddd3c45964df56837d6c051a7d692378", + "examples/vhosts_without_listen.pp": "226afb3e87129a56fc9add21b120feb2", + "files/httpd": "295f5e924afe6f752d29327e73fe6d0a", + "lib/facter/apache_version.rb": "babb22b1d567021995b4b5fa9328047b", + "lib/puppet/parser/functions/bool2httpd.rb": "05d5deeb6e0c31acee7c55b249ec8e06", + "lib/puppet/parser/functions/enclose_ipv6.rb": "581bc163291824909d1700909db96512", + "lib/puppet/parser/functions/validate_apache_log_level.rb": "d75bc4ef17ff5c9a1f94dd3948e733d1", + "lib/puppet/provider/a2mod/a2mod.rb": "d986d8e8373f3f31c97359381c180628", + "lib/puppet/provider/a2mod/gentoo.rb": "2492d446adbb68f678e86a75eb7ff3bd", + "lib/puppet/provider/a2mod/modfix.rb": "b689a1c83c9ccd8590399c67f3e588e5", + "lib/puppet/provider/a2mod/redhat.rb": "c39b80e75e7d0666def31c2a6cdedb0b", + "lib/puppet/provider/a2mod.rb": "03ed73d680787dd126ea37a03be0b236", + "lib/puppet/type/a2mod.rb": "9042ccc045bfeecca28bebb834114f05", + "manifests/balancer.pp": "b444ff1415ba0bd6c8ec1497bcc9cfb3", + "manifests/balancermember.pp": "d74ab23d74fa198853b13ad837df925c", + "manifests/confd/no_accf.pp": "406d0ca41c3b90f83740ca218dc3f484", + "manifests/custom_config.pp": "c5df4d455ff918f39e6341784457bca9", + "manifests/default_confd_files.pp": "86fdbe5773abb7c2da26db096973865c", + "manifests/default_mods/load.pp": "bc0b3b65edd1ba6178c09672352f9bce", + "manifests/default_mods.pp": "e4a7aa787443fce2e76c37e8fec99012", + "manifests/dev.pp": "8a7ead42f991e5dfdd364ba1aa1304e0", + "manifests/fastcgi/server.pp": "f177293f02a2878b43a863e8ab3015db", + "manifests/init.pp": "e76413e0c82c2ae13b658bcd97f31c5a", + "manifests/listen.pp": "6e44a9f49376cefb5694d52be5bc5a88", + "manifests/mod/actions.pp": "ec2a5d1cf54790204750f9b67938d230", + "manifests/mod/alias.pp": "1ef0d98a941bd796d428297b74acc8c4", + "manifests/mod/auth_basic.pp": "dffef6ff10145393cb78fcaa27220c53", + "manifests/mod/auth_cas.pp": "73dcf3f9ba2421a271f6c21bcae2fcbb", + "manifests/mod/auth_kerb.pp": "8759cab3dc12d6ba4cc12fcdbb699418", + "manifests/mod/auth_mellon.pp": "5bfbc604dd79923bdb65ecab02353059", + "manifests/mod/authn_core.pp": "4db773ddbc0d875230085782d4521951", + "manifests/mod/authn_dbd.pp": "8f03863a483184ca53b9bc3a45b2297f", + "manifests/mod/authn_file.pp": "eeb11513490beee901574746faaeabdf", + "manifests/mod/authnz_ldap.pp": "41b00baeb26144b889f4f0be4601dae5", + "manifests/mod/authz_default.pp": "b7c94cfa4e008155fffd241d35834064", + "manifests/mod/authz_user.pp": "d446c90c44304594206bd2a0112be625", + "manifests/mod/autoindex.pp": "3b50dc082dba420c3d564309601fd419", + "manifests/mod/cache.pp": "b56d68b9401ba3e02a1f2fe55cdfbcca", + "manifests/mod/cgi.pp": "32d6da37e010b5abe19b1a3be87a6d44", + "manifests/mod/cgid.pp": "fb9ae9b5012d41e22cb85c0b50e17361", + "manifests/mod/cluster.pp": "3d86d95713aea6107ff9e056d1b1698f", + "manifests/mod/dav.pp": "9df80d36dd609be9032a8260aa9d10c1", + "manifests/mod/dav_fs.pp": "9ad2359d64b0b6f219bd8a338917d114", + "manifests/mod/dav_svn.pp": "abc1ba954033b0b0187c079f310eb0e2", + "manifests/mod/dbd.pp": "4471dbd9fd67d0db885d4ba2a47a194a", + "manifests/mod/deflate.pp": "20231a22aba12eb905f1d7f1853e383e", + "manifests/mod/dev.pp": "42673bab60b6fc0f3aa6e2357ec0a27c", + "manifests/mod/dir.pp": "c7327a2a0ff02bdab2f5421359d6f300", + "manifests/mod/disk_cache.pp": "da18cbefced9bb32fc009e999c5b76e2", + "manifests/mod/dumpio.pp": "755f6072ef3130fa670022f26da7e429", + "manifests/mod/env.pp": "2a0321180a59161565b2b5f1b79d6b15", + "manifests/mod/event.pp": "a82a7ab979cc351eb660576bdc91d0e8", + "manifests/mod/expires.pp": "6f12edcf6863958af832db73b56e5f08", + "manifests/mod/ext_filter.pp": "df12ff3935ffa64f32bf897e433fc0ce", + "manifests/mod/fastcgi.pp": "96a3fcf0508a7eb8c9601eac329622eb", + "manifests/mod/fcgid.pp": "96e0a5f09c2d1ba21b2209a6e21b6847", + "manifests/mod/filter.pp": "b0039f3ae932b1204994ef2180dd76d2", + "manifests/mod/geoip.pp": "41762c637ab45dac05e564d1b3d03c3e", + "manifests/mod/headers.pp": "ef3de538a0a4c9406236faf43eb89710", + "manifests/mod/include.pp": "a3b66eda88e38d90825c16b834bacd8d", + "manifests/mod/info.pp": "c3e815ed9912bb9147805f7274508489", + "manifests/mod/itk.pp": "f631157ebdff68b6fc2bb6dbd5b8e8c4", + "manifests/mod/ldap.pp": "3fdd5ed6f1db898fc2499ed0ece0abe1", + "manifests/mod/mime.pp": "24fe99c65367a3f606441605a2ff26dd", + "manifests/mod/mime_magic.pp": "d31702cee9007c2e65c8d3ccbed1fda3", + "manifests/mod/negotiation.pp": "35fb1e9fa643054271804e215bb47299", + "manifests/mod/nss.pp": "3cc69b59bba579181b0ceb1dfd2976d0", + "manifests/mod/pagespeed.pp": "1fcf4c30084bd1e4fa3006b4d3265c1a", + "manifests/mod/passenger.pp": "55c68abd56d7838bbd6d9cb48bc941bb", + "manifests/mod/perl.pp": "b8180ca0e1e7f8d60030321f52c28d6d", + "manifests/mod/peruser.pp": "13761222709094653bca7bad4435fcdb", + "manifests/mod/php.pp": "64737f2ea2ad8532aaf515b713e9cac7", + "manifests/mod/prefork.pp": "3deff89f43a1f55dda643ac66e3fc4dc", + "manifests/mod/proxy.pp": "a65065f0c7705b7b75b1dd6fc2222e27", + "manifests/mod/proxy_ajp.pp": "073e2406aea7822750d4c21f02d8ac80", + "manifests/mod/proxy_balancer.pp": "a13221d222df646e84910cabd2902dee", + "manifests/mod/proxy_connect.pp": "7cd9b4b61ec6feb020f753ee74910a48", + "manifests/mod/proxy_fcgi.pp": "8c7fd559419b159e27218a17463d850d", + "manifests/mod/proxy_html.pp": "5ce01879add843832f756962dceec845", + "manifests/mod/proxy_http.pp": "0db1b26f8b4036b0d46ba86b7eaac561", + "manifests/mod/proxy_wstunnel.pp": "88ee88d6d56a70f0000e690f80f64acb", + "manifests/mod/python.pp": "6f65b22271cf356832fe7a1949163861", + "manifests/mod/remoteip.pp": "9ad1d5712477f11ae2643f209bb08ce3", + "manifests/mod/reqtimeout.pp": "17b245b5d14f3f7b8c1d5fa07e5c159e", + "manifests/mod/rewrite.pp": "292f2d6ce2078fa9df7f686105ea7b95", + "manifests/mod/rpaf.pp": "54991f51a06e2b4171956e6ce1caf3a3", + "manifests/mod/security.pp": "eaae214a25fcfa9fc9e4db4d2b88a37d", + "manifests/mod/setenvif.pp": "fa3b3e5f3a7e029f9db5b66ae499c6c8", + "manifests/mod/shib.pp": "8b75f8818fe9dc5728a478fc27962447", + "manifests/mod/socache_shmcb.pp": "c94ae23ab8cce744acad2f7e33dbfa9c", + "manifests/mod/speling.pp": "b6971e10caf22837e410b94910b66b1a", + "manifests/mod/ssl.pp": "a6c6ed342ef96db622671ed99ae0fe0d", + "manifests/mod/status.pp": "2e54208b8e669a7768b8bc4c2ca216a1", + "manifests/mod/suexec.pp": "2a8671856a0ece597e9b57867dc35e76", + "manifests/mod/suphp.pp": "5a7390ef0a0ceaa2d7e684bcb6300587", + "manifests/mod/userdir.pp": "bb20504fc72d66b8cf80bb270db7bb66", + "manifests/mod/version.pp": "6cb31057ebffa796f95642cc95f9499d", + "manifests/mod/vhost_alias.pp": "ee1225a748daaf50aca39a6d93fb8470", + "manifests/mod/worker.pp": "41137580c48b89f2795c1295d87962c0", + "manifests/mod/wsgi.pp": "186a34169367a2e64af4faf3036e3af3", + "manifests/mod/xsendfile.pp": "fba06f05a19c466654aca5ecaa705bf0", + "manifests/mod.pp": "0986292ef7477c30f6d07209f0591bdf", + "manifests/mpm.pp": "d4bfe77df34110cb253557104b2e6310", + "manifests/namevirtualhost.pp": "5ad54a441ff26a55cc536069d8fad238", + "manifests/package.pp": "ebd1e1e815ef744ebd4e9d8a6c94a07a", + "manifests/params.pp": "42d971519adb39970cf87f33180b1f5d", + "manifests/peruser/multiplexer.pp": "0ea75341b7a93e55bcfb431a93b1a6c9", + "manifests/peruser/processor.pp": "62f0ad5ed2ec36dadc7f40ad2a9e1bb9", + "manifests/php.pp": "9c9d07e12bf5d112b0b54f5bd69046fc", + "manifests/proxy.pp": "7c8515b88406922e148322ee15044b29", + "manifests/python.pp": "ddef4cd73850fdc2dc126d4579c30adf", + "manifests/security/rule_link.pp": "9c879ecfd7534347ccc8cf3ea77fa859", + "manifests/service.pp": "8e51ebf5af2e943030aec043face1bac", + "manifests/ssl.pp": "173f3d6a7fd2b5f4100c4ff03d84e13b", + "manifests/version.pp": "3388b1978b04cba63ed7fc8e2ec3f692", + "manifests/vhost/custom.pp": "421081f6c4f33e1aca07ff789e53345e", + "manifests/vhost.pp": "da0c608533e3010de53a42a09748c633", + "manifests/vhosts.pp": "d5cd9e6b701b7b2948c011546bc55497", + "metadata.json": "0090c6941acc9416730e7a48d0f6b231", + "spec/acceptance/apache_parameters_spec.rb": "5b95e67d474cc8a132c45f6e91714037", + "spec/acceptance/apache_ssl_spec.rb": "9cddf1b1b3a4ed2fe971fabe8785e9ed", + "spec/acceptance/class_spec.rb": "9d77ee23b734dd48ecea4353dee3d616", + "spec/acceptance/custom_config_spec.rb": "61e03d814d0671d194dd40e6b1ad5c9b", + "spec/acceptance/default_mods_spec.rb": "5d2bf768511d2fb34bd7057801d0fc4e", + "spec/acceptance/itk_spec.rb": "812c855013c08ebb13e642dc5199b41a", + "spec/acceptance/mod_dav_svn_spec.rb": "e792a6d585026dd7bded38e62c8786f6", + "spec/acceptance/mod_deflate_spec.rb": "dd39bfb069e0233bf134caaeb1dc6fe6", + "spec/acceptance/mod_fcgid_spec.rb": "ef0e3368ea14247c05ff43217b5856ee", + "spec/acceptance/mod_mime_spec.rb": "0869792d98c1b2577f02d97c92f1765e", + "spec/acceptance/mod_negotiation_spec.rb": "017f6b0cc1496c25aa9b8a33ef8dbbb3", + "spec/acceptance/mod_pagespeed_spec.rb": "7d7732a41eae79bd6b816bb1e165a530", + "spec/acceptance/mod_passenger_spec.rb": "a66264ef73ad6c5396a06ab9b5444c7c", + "spec/acceptance/mod_php_spec.rb": "81218711d2e27b24e36a99eab74ccf19", + "spec/acceptance/mod_proxy_html_spec.rb": "34478fc2f12a23cd5a95d424f85da150", + "spec/acceptance/mod_security_spec.rb": "c783d44cf3ccba2fa6a3c14de0e486a0", + "spec/acceptance/mod_suphp_spec.rb": "f5c1f21e4c5323b81afc354c82e7ceb9", + "spec/acceptance/nodesets/centos-7-x64.yml": "a713f3abd3657f0ae2878829badd23cd", + "spec/acceptance/nodesets/debian-8-x64.yml": "d2d2977900989f30086ad251a14a1f39", + "spec/acceptance/nodesets/default.yml": "b42da5a1ea0c964567ba7495574b8808", + "spec/acceptance/nodesets/docker/centos-7.yml": "8a3892807bdd62306ae4774f41ba11ae", + "spec/acceptance/nodesets/docker/debian-8.yml": "ac8e871d1068c96de5e85a89daaec6df", + "spec/acceptance/nodesets/docker/ubuntu-14.04.yml": "dc42ee922a96908d85b8f0f08203ce58", + "spec/acceptance/nodesets/suse.yml": "eff62186e4de2ffed45a72a375380338", + "spec/acceptance/prefork_worker_spec.rb": "1570eefe61d667a1b43824adc0b2bb78", + "spec/acceptance/service_spec.rb": "341f157cb33fa48d5166d2274ad3bc65", + "spec/acceptance/version.rb": "6a1f2db3e369f3dc2b5bd76f4921891a", + "spec/acceptance/vhost_spec.rb": "69a14b4e593fa9ecfdccda1ab23b453a", + "spec/acceptance/vhosts_spec.rb": "c9635037681d569a053da6eb7ae5f4f4", + "spec/classes/apache_spec.rb": "fe0d844ef6cb3bad10e2d935ea16e737", + "spec/classes/dev_spec.rb": "6bc9ff7cffb77aac52c5bd3acc157d2d", + "spec/classes/mod/alias_spec.rb": "e62706d9925b0dc1821db78d01986a7e", + "spec/classes/mod/auth_cas_spec.rb": "46a7ba3fe31d3fc6175b8dce5105326e", + "spec/classes/mod/auth_kerb_spec.rb": "a32949cf0f8f93786b58589b102b1fe0", + "spec/classes/mod/auth_mellon_spec.rb": "81d3ea4b7567718ca810b625fd36d231", + "spec/classes/mod/authn_dbd_spec.rb": "8c794faaa5244e16f432c76679cb12d7", + "spec/classes/mod/authnz_ldap_spec.rb": "bef6980f85489c5fd7388511cb65b644", + "spec/classes/mod/cluster_spec.rb": "c1d01cc4a4f9ce10d692294019791e2f", + "spec/classes/mod/dav_svn_spec.rb": "6b3c4123a067e249f6c78c5b0cbcbcc7", + "spec/classes/mod/deflate_spec.rb": "adf6e41357fefe4ff1128e8fea4d3057", + "spec/classes/mod/dev_spec.rb": "1a30ef5fb18073fd2bf6f7923ff9c57f", + "spec/classes/mod/dir_spec.rb": "9e25507c094cb3b2fe6eb1106668b484", + "spec/classes/mod/disk_cache_spec.rb": "e821fa50ace7ab3398c43b16034748e9", + "spec/classes/mod/dumpio_spec.rb": "689d167b05e669c29709fc36940e7b05", + "spec/classes/mod/event_spec.rb": "46a304c796ac3928be0a67bec1f46b4f", + "spec/classes/mod/expires_spec.rb": "0d27e3438627f2ad34abacf582fb8b0b", + "spec/classes/mod/ext_filter_spec.rb": "7af18fdf1376f17e68dc99e5627ba067", + "spec/classes/mod/fastcgi_spec.rb": "59f7ea857b0fa614e8808270c529300f", + "spec/classes/mod/fcgid_spec.rb": "bda06cc347a8da8d7c7374add2654248", + "spec/classes/mod/info_spec.rb": "d51c6a9e6ae4d944488a43c8c15b95c0", + "spec/classes/mod/itk_spec.rb": "622f23a1346383846cbc98e38388034d", + "spec/classes/mod/ldap_spec.rb": "12863d495558fbe9f6cb7a50ab37688c", + "spec/classes/mod/mime_magic_spec.rb": "259304a80e92e4ba15e7cd719fe25c17", + "spec/classes/mod/mime_spec.rb": "d946fb96659b67bf7117ad7ed4b25cce", + "spec/classes/mod/negotiation_spec.rb": "44d50f7e6ef8c6388baa4c7cfc07be43", + "spec/classes/mod/pagespeed_spec.rb": "56bd7d82920cb734ea8139c9fed97de7", + "spec/classes/mod/passenger_spec.rb": "a7cb67b8f93b462dc9a1bf29ad7f2436", + "spec/classes/mod/perl_spec.rb": "1daa227f563ac19ff8dcdea0d0005ec4", + "spec/classes/mod/peruser_spec.rb": "c379ce85a997789856b12c27957bf994", + "spec/classes/mod/php_spec.rb": "2cc1a1d5d097be26eef3139b4e8eafaf", + "spec/classes/mod/prefork_spec.rb": "d82f0f25691ba019b912cd000dbb845f", + "spec/classes/mod/proxy_balancer_spec.rb": "c0bd0c3ebf39d7c66120b3837551f6b1", + "spec/classes/mod/proxy_connect_spec.rb": "baef920356c839b698c2adb865e79b5f", + "spec/classes/mod/proxy_html_spec.rb": "c6fc0e6b0cbcd3d5f9e65d533366ee32", + "spec/classes/mod/proxy_wstunnel.rb": "69bcef5e88aeb115290d8428186c80ec", + "spec/classes/mod/python_spec.rb": "5ca2dd0829b7baa1022c551b66548b20", + "spec/classes/mod/remoteip_spec.rb": "f9bf0bc64fef6d570f7b798ceef0d598", + "spec/classes/mod/reqtimeout_spec.rb": "2af2919e8253100fbc2e001d30a5cd15", + "spec/classes/mod/rpaf_spec.rb": "5c4725a4bcab9339d7309765390aaed1", + "spec/classes/mod/security_spec.rb": "adabc64a0a847c9f448c3282a4de1b94", + "spec/classes/mod/shib_spec.rb": "b4ec345e387f8d7186048f5d286bb71d", + "spec/classes/mod/speling_spec.rb": "96919b9fbd1e894fcfd649044c3dafb5", + "spec/classes/mod/ssl_spec.rb": "54219eac9b409a833a57ecfdce66a196", + "spec/classes/mod/status_spec.rb": "1eeaf906baf6ca82bf24c4e23494c71c", + "spec/classes/mod/suphp_spec.rb": "cc7c02c42e985aa133f9d868e14d9435", + "spec/classes/mod/worker_spec.rb": "c326e36fbcfe9f0c59dc1db389a33926", + "spec/classes/mod/wsgi_spec.rb": "5c76026d8f08ac7d17d7b34f089979a3", + "spec/classes/params_spec.rb": "adbd9f0dee677ea9439b9ce0d620894f", + "spec/classes/service_spec.rb": "d23f6cd3eac018e368e0ba32cbf95f11", + "spec/classes/vhosts_spec.rb": "9baf23eb534e944a1bd593e72dd3050e", + "spec/defines/balancer_spec.rb": "8793815eb22b5190977b154fcd97e85e", + "spec/defines/balancermember_spec.rb": "e93ded8b51cc1d73e52f453880b3576e", + "spec/defines/custom_config_spec.rb": "a7e3392933cabc8ed6bb57deaebb36d9", + "spec/defines/fastcgi_server_spec.rb": "8e167c1525cb9a7473efdde01efe0ca3", + "spec/defines/mod_spec.rb": "a10e5b2570419737c03cd0f6347cc985", + "spec/defines/modsec_link_spec.rb": "3421b21f8234637dd1c32ebcf89e44c3", + "spec/defines/vhost_custom_spec.rb": "d5596a7a0c239d4c0ed8bebbb6a124ab", + "spec/defines/vhost_spec.rb": "b9fc940b93fa4bde6e6d1ce1ef91d234", + "spec/fixtures/files/negotiation.conf": "9c11872e26327ec880749b5dfdea25d6", + "spec/fixtures/files/spec": "e964ecac35c35baa9b4c57dac4ff5b3e", + "spec/fixtures/templates/negotiation.conf.erb": "c838e612ce6f82a5efd12871ad562011", + "spec/spec_helper.rb": "b2db3bc02b4ac2fd5142a6621c641b07", + "spec/spec_helper_acceptance.rb": "bd3dc8d42f3774c2c5cea26df7488b07", + "spec/spec_helper_local.rb": "1b6ccd9b2f6946b81560239881774e94", + "spec/unit/apache_version_spec.rb": "c9d7b8ab46fb21d370702f02088281a2", + "spec/unit/provider/a2mod/gentoo_spec.rb": "02f7510cbf4945c5e1094ebcb967c8e0", + "spec/unit/puppet/parser/functions/bool2httpd_spec.rb": "0c9bca53eb43b5fc888126514b2a174c", + "spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb": "0145a78254ea716e5e7600d9464318a8", + "spec/unit/puppet/parser/functions/validate_apache_log_level.rb": "8f558fd81d1655e9ab20896152eca512", + "templates/confd/no-accf.conf.erb": "a614f28c4b54370e4fa88403dfe93eb0", + "templates/fastcgi/server.erb": "30cdd04393bdb4f68678d00e2930721b", + "templates/httpd.conf.erb": "5a8eacfe858789a1e2059cd0452b6b01", + "templates/listen.erb": "6286aa08f9e28caee54b1e1ee031b9d6", + "templates/mod/alias.conf.erb": "370e9d394dd462d3ebc0dd345ab68f6f", + "templates/mod/auth_cas.conf.erb": "35e1291a5fa05067d7623c02bafb0ada", + "templates/mod/auth_mellon.conf.erb": "4e17d22a8f1bc312e976e8513199c945", + "templates/mod/authn_dbd.conf.erb": "7a84f5d3b3a4b92a88fe052b13376f8e", + "templates/mod/authnz_ldap.conf.erb": "d648a09c5625a7da5715f03526f2fefd", + "templates/mod/autoindex.conf.erb": "2421a3c6df32c7e38c2a7a22afdf5728", + "templates/mod/cgid.conf.erb": "f8ce27d60bc495bab16de2696ebb2fd0", + "templates/mod/cluster.conf.erb": "1b12d0b30352527474986eba1973b9b1", + "templates/mod/dav_fs.conf.erb": "10c1131168e35319e22b3fbfe51aebfd", + "templates/mod/deflate.conf.erb": "e866ecf2bfe8e42ea984267f569723db", + "templates/mod/dir.conf.erb": "2485da78a2506c14bf51dde38dd03360", + "templates/mod/disk_cache.conf.erb": "48d1b54ec1dedea7f68451bc0774790e", + "templates/mod/dumpio.conf.erb": "260a03d5f5b450095a5374690fbb34b2", + "templates/mod/event.conf.erb": "5e4095242d8e5dd99fe0823cfa2f1434", + "templates/mod/expires.conf.erb": "7a77f8b1d50c53ee77a6cb798c51a2b9", + "templates/mod/ext_filter.conf.erb": "4e4e4143ab402a9f9d51301b1a192202", + "templates/mod/fastcgi.conf.erb": "2404caa7d91dea083fc4f8b6f18acd24", + "templates/mod/fcgid.conf.erb": "1780c7808bb3811deaf0007c890df4dc", + "templates/mod/geoip.conf.erb": "93b95f44ec733ee8231be82381e02782", + "templates/mod/info.conf.erb": "c8580f35594e8f76da9c961def618739", + "templates/mod/itk.conf.erb": "eff84b78e4f2f8c5c3a2e9fc4b8aad16", + "templates/mod/ldap.conf.erb": "03ef6f461e4778342e6b94b8b4f3cd3a", + "templates/mod/load.erb": "01132434e6101080c41548b0ba7e57d8", + "templates/mod/mime.conf.erb": "2fa5a10d06ff979de1d5d2544586ab45", + "templates/mod/mime_magic.conf.erb": "067c3180b4216439b039822114144e78", + "templates/mod/mpm_event.conf.erb": "80097a19d063a4f973465d9ef5c0c0bf", + "templates/mod/negotiation.conf.erb": "a2f0fb40cd038cb17bedc2b84d9f48ea", + "templates/mod/nss.conf.erb": "03a7a3721b19706e00df00e457c5df69", + "templates/mod/pagespeed.conf.erb": "d1d8dfb00e528aab10a24518c7f148a6", + "templates/mod/passenger.conf.erb": "81512838f2fb7f01bf7fd674f023d086", + "templates/mod/peruser.conf.erb": "c4f4054aee899249ea6fef5a9e5c14ff", + "templates/mod/php.conf.erb": "c535da6adea16bdcb0586260eedf8c93", + "templates/mod/prefork.conf.erb": "f9ec5a7eaea78a19b04fa69f8acd8a84", + "templates/mod/proxy.conf.erb": "33a6a57edd324ba56e879a7b077ecf08", + "templates/mod/proxy_balancer.conf.erb": "a9f8d51a2a7169e5fd0c8415a3f9c662", + "templates/mod/proxy_html.conf.erb": "69c9ce9b7f24e1337065f1ce26b057a0", + "templates/mod/remoteip.conf.erb": "ad58e174410e3ff46ff93d4ad1e7b8a0", + "templates/mod/reqtimeout.conf.erb": "314ef068b786ae5afded290a8b6eab15", + "templates/mod/rpaf.conf.erb": "5447539c083ae54f3a9e93c1ac8c988b", + "templates/mod/security.conf.erb": "e309716298ed8709df5496c27d47fe36", + "templates/mod/security_crs.conf.erb": "5c7bc134c0675d75b66a5c8faaf11eb6", + "templates/mod/setenvif.conf.erb": "c7ede4173da1915b7ec088201f030c28", + "templates/mod/ssl.conf.erb": "6f9557964b967bb6715d1f19f266367a", + "templates/mod/status.conf.erb": "574ecc6f74e8b75d84710a44c4260210", + "templates/mod/suphp.conf.erb": "05bb7b3ea23976b032ce405bfd4edd18", + "templates/mod/userdir.conf.erb": "b555d16697b030d34ad18d41d4084c4c", + "templates/mod/worker.conf.erb": "dc4c7049af7312f5e82b3e72e8fccdfd", + "templates/mod/wsgi.conf.erb": "9a416fa3b71be0795679069809686300", + "templates/namevirtualhost.erb": "fbfca19a639e18e6c477e191344ac8ae", + "templates/ports_header.erb": "afe35cb5747574b700ebaa0f0b3a626e", + "templates/vhost/_access_log.erb": "522414033856b19a50a7ebb1c729438a", + "templates/vhost/_action.erb": "a004dfcac2e63cef65cf8aa0e270b636", + "templates/vhost/_additional_includes.erb": "10e9c0056e962c49459839a1576b082e", + "templates/vhost/_aliases.erb": "6412f695e911feac18986da38f290dae", + "templates/vhost/_allow_encoded_slashes.erb": "37dee0b6fe9287342a10b533955dff81", + "templates/vhost/_auth_cas.erb": "96fb19c558e7e187fe9160f00f39061c", + "templates/vhost/_auth_kerb.erb": "3d0de0c3066440dffcbc75215174705b", + "templates/vhost/_block.erb": "8fa2f970222dbc0a38898b5a0ab80411", + "templates/vhost/_charsets.erb": "d152b6a7815e9edc0fe9bf9acbe2f1ec", + "templates/vhost/_custom_fragment.erb": "325ff48cefc06db035daa3491c391a88", + "templates/vhost/_directories.erb": "f981420e239cc4a615ccb9a7852b37f4", + "templates/vhost/_docroot.erb": "65d882a3c9d6b6bdd2f9b771f378035a", + "templates/vhost/_error_document.erb": "81d3007c1301a5c5f244c082cfee9de2", + "templates/vhost/_fallbackresource.erb": "e6c103bee7f6f76b10f244fc9fd1cd3b", + "templates/vhost/_fastcgi.erb": "e6d743e11b776e155dc4f80c602fb7e1", + "templates/vhost/_file_footer.erb": "e27b2525783e590ca1820f1e2118285d", + "templates/vhost/_file_header.erb": "7c3c04eb4ac67403604113e2628696cf", + "templates/vhost/_filters.erb": "597b9de5ae210af9182a1c95172115e7", + "templates/vhost/_header.erb": "9eb9d4075f288183d8224ddec5b2f126", + "templates/vhost/_itk.erb": "8bf90b9855a9277f7a665b10f6c57fe9", + "templates/vhost/_jk_mounts.erb": "ce997ee7b5602af04062cd5f785da345", + "templates/vhost/_keepalive_options.erb": "16876858bac1e55b13545866b0428d90", + "templates/vhost/_logging.erb": "5bc4cbb1bc8a292acc0ba0420f96ca4e", + "templates/vhost/_passenger.erb": "54089ef42f49bf8285d2d5ccdcba0699", + "templates/vhost/_passenger_base_uris.erb": "c8d7f4da1434078e856c72671942dcd8", + "templates/vhost/_php.erb": "a16a9f3e146ce463481205e083d4bf79", + "templates/vhost/_php_admin.erb": "107a57e9e7b3f86d1abcf743f672a292", + "templates/vhost/_proxy.erb": "18b9bbb791d248179a08eb36ab895e12", + "templates/vhost/_rack.erb": "ebe187c1bdc81eec9c8e0d9026120b18", + "templates/vhost/_redirect.erb": "2d40ece74203cc00b861a058db91962c", + "templates/vhost/_requestheader.erb": "db1b0cdda069ae809b5b83b0871ef991", + "templates/vhost/_require.erb": "8a90d4c632b65ae1d89c66220f73ee80", + "templates/vhost/_rewrite.erb": "b7858eac95352744196006b57d4091df", + "templates/vhost/_scriptalias.erb": "98713f33cca15b22c749bd35ea9a7b41", + "templates/vhost/_security.erb": "0ade536a9d25342e7128996add04be56", + "templates/vhost/_serveralias.erb": "95fed45853629924467aefc271d5b396", + "templates/vhost/_serversignature.erb": "9bf5a458783ab459e5043e1cdf671fa7", + "templates/vhost/_setenv.erb": "6e6a7efb1b168da9673c9e6d00eadec5", + "templates/vhost/_ssl.erb": "788b293b65736aead0007fe3bc52448b", + "templates/vhost/_sslproxy.erb": "c327d73e1669bde19a64e53109d4b57e", + "templates/vhost/_suexec.erb": "f2b3f9b9ff8fbac4e468e02cd824675a", + "templates/vhost/_suphp.erb": "a1c4a5e4461adbfce870df0abd158b59", + "templates/vhost/_wsgi.erb": "8ae86dff3014767479a71441b0e6536e" +} \ No newline at end of file diff --git a/environments/production/modules/apache/examples/apache.pp b/environments/production/modules/apache/examples/apache.pp new file mode 100644 index 0000000..18ec553 --- /dev/null +++ b/environments/production/modules/apache/examples/apache.pp @@ -0,0 +1,6 @@ +include ::apache +include ::apache::mod::php +include ::apache::mod::cgi +include ::apache::mod::userdir +include ::apache::mod::disk_cache +include ::apache::mod::proxy_http diff --git a/environments/production/modules/apache/examples/dev.pp b/environments/production/modules/apache/examples/dev.pp new file mode 100644 index 0000000..5616e32 --- /dev/null +++ b/environments/production/modules/apache/examples/dev.pp @@ -0,0 +1 @@ +include ::apache::mod::dev diff --git a/environments/production/modules/apache/examples/init.pp b/environments/production/modules/apache/examples/init.pp new file mode 100644 index 0000000..3391107 --- /dev/null +++ b/environments/production/modules/apache/examples/init.pp @@ -0,0 +1 @@ +include ::apache diff --git a/environments/production/modules/apache/examples/mod_load_params.pp b/environments/production/modules/apache/examples/mod_load_params.pp new file mode 100644 index 0000000..fa43132 --- /dev/null +++ b/environments/production/modules/apache/examples/mod_load_params.pp @@ -0,0 +1,11 @@ +# Tests the path and identifier parameters for the apache::mod class + +# Base class for clarity: +class { '::apache': } + + +# Exaple parameter usage: +apache::mod { 'testmod': + path => '/usr/some/path/mod_testmod.so', + id => 'testmod_custom_name', +} diff --git a/environments/production/modules/apache/examples/mods.pp b/environments/production/modules/apache/examples/mods.pp new file mode 100644 index 0000000..6996382 --- /dev/null +++ b/environments/production/modules/apache/examples/mods.pp @@ -0,0 +1,9 @@ +## Default mods + +# Base class. Declares default vhost on port 80 and default ssl +# vhost on port 443 listening on all interfaces and serving +# $apache::docroot, and declaring our default set of modules. +class { '::apache': + default_mods => true, +} + diff --git a/environments/production/modules/apache/examples/mods_custom.pp b/environments/production/modules/apache/examples/mods_custom.pp new file mode 100644 index 0000000..4098c83 --- /dev/null +++ b/environments/production/modules/apache/examples/mods_custom.pp @@ -0,0 +1,16 @@ +## custom mods + +# Base class. Declares default vhost on port 80 and default ssl +# vhost on port 443 listening on all interfaces and serving +# $apache::docroot, and declaring a custom set of modules. +class { '::apache': + default_mods => [ + 'info', + 'alias', + 'mime', + 'env', + 'setenv', + 'expires', + ], +} + diff --git a/environments/production/modules/apache/examples/php.pp b/environments/production/modules/apache/examples/php.pp new file mode 100644 index 0000000..ee18771 --- /dev/null +++ b/environments/production/modules/apache/examples/php.pp @@ -0,0 +1,4 @@ +class { '::apache': + mpm_module => 'prefork', +} +include ::apache::mod::php diff --git a/environments/production/modules/apache/examples/vhost.pp b/environments/production/modules/apache/examples/vhost.pp new file mode 100644 index 0000000..28edf25 --- /dev/null +++ b/environments/production/modules/apache/examples/vhost.pp @@ -0,0 +1,261 @@ +## Default vhosts, and custom vhosts +# NB: Please see the other vhost_*.pp example files for further +# examples. + +# Base class. Declares default vhost on port 80 and default ssl +# vhost on port 443 listening on all interfaces and serving +# $apache::docroot +class { '::apache': } + +# Most basic vhost +apache::vhost { 'first.example.com': + port => '80', + docroot => '/var/www/first', +} + +# Vhost with different docroot owner/group/mode +apache::vhost { 'second.example.com': + port => '80', + docroot => '/var/www/second', + docroot_owner => 'third', + docroot_group => 'third', + docroot_mode => '0770', +} + +# Vhost with serveradmin +apache::vhost { 'third.example.com': + port => '80', + docroot => '/var/www/third', + serveradmin => 'admin@example.com', +} + +# Vhost with ssl (uses default ssl certs) +apache::vhost { 'ssl.example.com': + port => '443', + docroot => '/var/www/ssl', + ssl => true, +} + +# Vhost with ssl and specific ssl certs +apache::vhost { 'fourth.example.com': + port => '443', + docroot => '/var/www/fourth', + ssl => true, + ssl_cert => '/etc/ssl/fourth.example.com.cert', + ssl_key => '/etc/ssl/fourth.example.com.key', +} + +# Vhost with english title and servername parameter +apache::vhost { 'The fifth vhost': + servername => 'fifth.example.com', + port => '80', + docroot => '/var/www/fifth', +} + +# Vhost with server aliases +apache::vhost { 'sixth.example.com': + serveraliases => [ + 'sixth.example.org', + 'sixth.example.net', + ], + port => '80', + docroot => '/var/www/fifth', +} + +# Vhost with alternate options +apache::vhost { 'seventh.example.com': + port => '80', + docroot => '/var/www/seventh', + options => [ + 'Indexes', + 'MultiViews', + ], +} + +# Vhost with AllowOverride for .htaccess +apache::vhost { 'eighth.example.com': + port => '80', + docroot => '/var/www/eighth', + override => 'All', +} + +# Vhost with access and error logs disabled +apache::vhost { 'ninth.example.com': + port => '80', + docroot => '/var/www/ninth', + access_log => false, + error_log => false, +} + +# Vhost with custom access and error logs and logroot +apache::vhost { 'tenth.example.com': + port => '80', + docroot => '/var/www/tenth', + access_log_file => 'tenth_vhost.log', + error_log_file => 'tenth_vhost_error.log', + logroot => '/var/log', +} + +# Vhost with a cgi-bin +apache::vhost { 'eleventh.example.com': + port => '80', + docroot => '/var/www/eleventh', + scriptalias => '/usr/lib/cgi-bin', +} + +# Vhost with a proxypass configuration +apache::vhost { 'twelfth.example.com': + port => '80', + docroot => '/var/www/twelfth', + proxy_dest => 'http://internal.example.com:8080/twelfth', + no_proxy_uris => ['/login','/logout'], +} + +# Vhost to redirect /login and /logout +apache::vhost { 'thirteenth.example.com': + port => '80', + docroot => '/var/www/thirteenth', + redirect_source => [ + '/login', + '/logout', + ], + redirect_dest => [ + 'http://10.0.0.10/login', + 'http://10.0.0.10/logout', + ], +} + +# Vhost to permamently redirect +apache::vhost { 'fourteenth.example.com': + port => '80', + docroot => '/var/www/fourteenth', + redirect_source => '/blog', + redirect_dest => 'http://blog.example.com', + redirect_status => 'permanent', +} + +# Vhost with a rack configuration +apache::vhost { 'fifteenth.example.com': + port => '80', + docroot => '/var/www/fifteenth', + rack_base_uris => ['/rackapp1', '/rackapp2'], +} + + +# Vhost to redirect non-ssl to ssl +apache::vhost { 'sixteenth.example.com non-ssl': + servername => 'sixteenth.example.com', + port => '80', + docroot => '/var/www/sixteenth', + rewrites => [ + { + comment => 'redirect non-SSL traffic to SSL site', + rewrite_cond => ['%{HTTPS} off'], + rewrite_rule => ['(.*) https://%{HTTP_HOST}%{REQUEST_URI}'], + } + ], +} + +# Rewrite a URL to lower case +apache::vhost { 'sixteenth.example.com non-ssl': + servername => 'sixteenth.example.com', + port => '80', + docroot => '/var/www/sixteenth', + rewrites => [ + { comment => 'Rewrite to lower case', + rewrite_cond => ['%{REQUEST_URI} [A-Z]'], + rewrite_map => ['lc int:tolower'], + rewrite_rule => ['(.*) ${lc:$1} [R=301,L]'], + } + ], +} + +apache::vhost { 'sixteenth.example.com ssl': + servername => 'sixteenth.example.com', + port => '443', + docroot => '/var/www/sixteenth', + ssl => true, +} + +# Vhost to redirect non-ssl to ssl using old rewrite method +apache::vhost { 'sixteenth.example.com non-ssl old rewrite': + servername => 'sixteenth.example.com', + port => '80', + docroot => '/var/www/sixteenth', + rewrite_cond => '%{HTTPS} off', + rewrite_rule => '(.*) https://%{HTTP_HOST}%{REQUEST_URI}', +} +apache::vhost { 'sixteenth.example.com ssl old rewrite': + servername => 'sixteenth.example.com', + port => '443', + docroot => '/var/www/sixteenth', + ssl => true, +} + +# Vhost to block repository files +apache::vhost { 'seventeenth.example.com': + port => '80', + docroot => '/var/www/seventeenth', + block => 'scm', +} + +# Vhost with special environment variables +apache::vhost { 'eighteenth.example.com': + port => '80', + docroot => '/var/www/eighteenth', + setenv => ['SPECIAL_PATH /foo/bin','KILROY was_here'], +} + +apache::vhost { 'nineteenth.example.com': + port => '80', + docroot => '/var/www/nineteenth', + setenvif => 'Host "^([^\.]*)\.website\.com$" CLIENT_NAME=$1', +} + +# Vhost with additional include files +apache::vhost { 'twentyieth.example.com': + port => '80', + docroot => '/var/www/twelfth', + additional_includes => ['/tmp/proxy_group_a','/tmp/proxy_group_b'], +} + +# Vhost with alias for subdomain mapped to same named directory +# http://example.com.loc => /var/www/example.com +apache::vhost { 'subdomain.loc': + vhost_name => '*', + port => '80', + virtual_docroot => '/var/www/%-2+', + docroot => '/var/www', + serveraliases => ['*.loc',], +} + +# Vhost with SSLProtocol,SSLCipherSuite, SSLHonorCipherOrder +apache::vhost { 'securedomain.com': + priority => '10', + vhost_name => 'www.securedomain.com', + port => '443', + docroot => '/var/www/secure', + ssl => true, + ssl_cert => '/etc/ssl/securedomain.cert', + ssl_key => '/etc/ssl/securedomain.key', + ssl_chain => '/etc/ssl/securedomain.crt', + ssl_protocol => '-ALL +TLSv1', + ssl_cipher => 'ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM', + ssl_honorcipherorder => 'On', + add_listen => false, +} + +# Vhost with access log environment variables writing control +apache::vhost { 'twentyfirst.example.com': + port => '80', + docroot => '/var/www/twentyfirst', + access_log_env_var => 'admin', +} + +# Vhost with a passenger_base configuration +apache::vhost { 'twentysecond.example.com': + port => '80', + docroot => '/var/www/twentysecond', + rack_base_uris => ['/passengerapp1', '/passengerapp2'], +} + diff --git a/environments/production/modules/apache/examples/vhost_directories.pp b/environments/production/modules/apache/examples/vhost_directories.pp new file mode 100644 index 0000000..df5a2d5 --- /dev/null +++ b/environments/production/modules/apache/examples/vhost_directories.pp @@ -0,0 +1,44 @@ +# Base class. Declares default vhost on port 80 and default ssl +# vhost on port 443 listening on all interfaces and serving +# $apache::docroot +class { '::apache': } + +# Example from README adapted. +apache::vhost { 'readme.example.net': + docroot => '/var/www/readme', + directories => [ + { + 'path' => '/var/www/readme', + 'ServerTokens' => 'prod' , + }, + { + 'path' => '/usr/share/empty', + 'allow' => 'from all', + }, + ], +} + +# location test +apache::vhost { 'location.example.net': + docroot => '/var/www/location', + directories => [ + { + 'path' => '/location', + 'provider' => 'location', + 'ServerTokens' => 'prod' + }, + ], +} + +# files test, curedly disable access to accidental backup files. +apache::vhost { 'files.example.net': + docroot => '/var/www/files', + directories => [ + { + 'path' => '(\.swp|\.bak|~)$', + 'provider' => 'filesmatch', + 'deny' => 'from all' + }, + ], +} + diff --git a/environments/production/modules/apache/examples/vhost_filter.pp b/environments/production/modules/apache/examples/vhost_filter.pp new file mode 100644 index 0000000..1a66b85 --- /dev/null +++ b/environments/production/modules/apache/examples/vhost_filter.pp @@ -0,0 +1,17 @@ +# Base class. Declares default vhost on port 80 with filters. +class { '::apache': } + +# Example from README adapted. +apache::vhost { 'readme.example.net': + docroot => '/var/www/html', + filters => [ + 'FilterDeclare COMPRESS', + 'FilterProvider COMPRESS DEFLATE resp=Content-Type $text/html', + 'FilterProvider COMPRESS DEFLATE resp=Content-Type $text/css', + 'FilterProvider COMPRESS DEFLATE resp=Content-Type $text/plain', + 'FilterProvider COMPRESS DEFLATE resp=Content-Type $text/xml', + 'FilterChain COMPRESS', + 'FilterProtocol COMPRESS DEFLATE change=yes;byteranges=no', + ], +} + diff --git a/environments/production/modules/apache/examples/vhost_ip_based.pp b/environments/production/modules/apache/examples/vhost_ip_based.pp new file mode 100644 index 0000000..249c419 --- /dev/null +++ b/environments/production/modules/apache/examples/vhost_ip_based.pp @@ -0,0 +1,25 @@ +## IP-based vhosts on any listen port +# IP-based vhosts respond to requests on specific IP addresses. + +# Base class. Turn off the default vhosts; we will be declaring +# all vhosts below. +class { '::apache': + default_vhost => false, +} + +# Listen on port 80 and 81; required because the following vhosts +# are not declared with a port parameter. +apache::listen { '80': } +apache::listen { '81': } + +# IP-based vhosts +apache::vhost { 'first.example.com': + ip => '10.0.0.10', + docroot => '/var/www/first', + ip_based => true, +} +apache::vhost { 'second.example.com': + ip => '10.0.0.11', + docroot => '/var/www/second', + ip_based => true, +} diff --git a/environments/production/modules/apache/examples/vhost_proxypass.pp b/environments/production/modules/apache/examples/vhost_proxypass.pp new file mode 100644 index 0000000..8edd0de --- /dev/null +++ b/environments/production/modules/apache/examples/vhost_proxypass.pp @@ -0,0 +1,66 @@ +## vhost with proxyPass directive +# NB: Please see the other vhost_*.pp example files for further +# examples. + +# Base class. Declares default vhost on port 80 and default ssl +# vhost on port 443 listening on all interfaces and serving +# $apache::docroot +class { '::apache': } + +# Most basic vhost with proxy_pass +apache::vhost { 'first.example.com': + port => 80, + docroot => '/var/www/first', + proxy_pass => [ + { + 'path' => '/first', + 'url' => 'http://localhost:8080/first' + }, + ], +} + +# vhost with proxy_pass and parameters +apache::vhost { 'second.example.com': + port => 80, + docroot => '/var/www/second', + proxy_pass => [ + { + 'path' => '/second', + 'url' => 'http://localhost:8080/second', + 'params' => { + 'retry' => '0', + 'timeout' => '5', + } + }, + ], +} + +# vhost with proxy_pass and keywords +apache::vhost { 'third.example.com': + port => 80, + docroot => '/var/www/third', + proxy_pass => [ + { + 'path' => '/third', + 'url' => 'http://localhost:8080/third', + 'keywords' => ['noquery', 'interpolate'] + }, + ], +} + +# vhost with proxy_pass, parameters and keywords +apache::vhost { 'fourth.example.com': + port => 80, + docroot => '/var/www/fourth', + proxy_pass => [ + { + 'path' => '/fourth', + 'url' => 'http://localhost:8080/fourth', + 'params' => { + 'retry' => '0', + 'timeout' => '5', + }, + 'keywords' => ['noquery', 'interpolate'] + }, + ], +} diff --git a/environments/production/modules/apache/examples/vhost_ssl.pp b/environments/production/modules/apache/examples/vhost_ssl.pp new file mode 100644 index 0000000..53989ff --- /dev/null +++ b/environments/production/modules/apache/examples/vhost_ssl.pp @@ -0,0 +1,23 @@ +## SSL-enabled vhosts +# SSL-enabled vhosts respond only to HTTPS queries. + +# Base class. Turn off the default vhosts; we will be declaring +# all vhosts below. +class { '::apache': + default_vhost => false, +} + +# Non-ssl vhost +apache::vhost { 'first.example.com non-ssl': + servername => 'first.example.com', + port => '80', + docroot => '/var/www/first', +} + +# SSL vhost at the same domain +apache::vhost { 'first.example.com ssl': + servername => 'first.example.com', + port => '443', + docroot => '/var/www/first', + ssl => true, +} diff --git a/environments/production/modules/apache/examples/vhosts_without_listen.pp b/environments/production/modules/apache/examples/vhosts_without_listen.pp new file mode 100644 index 0000000..0e97a02 --- /dev/null +++ b/environments/production/modules/apache/examples/vhosts_without_listen.pp @@ -0,0 +1,53 @@ +## Declare ip-based and name-based vhosts +# Mixing Name-based vhost with IP-specific vhosts requires `add_listen => +# 'false'` on the non-IP vhosts + +# Base class. Turn off the default vhosts; we will be declaring +# all vhosts below. +class { '::apache': + default_vhost => false, +} + + +# Add two an IP-based vhost on 10.0.0.10, ssl and non-ssl +apache::vhost { 'The first IP-based vhost, non-ssl': + servername => 'first.example.com', + ip => '10.0.0.10', + port => '80', + ip_based => true, + docroot => '/var/www/first', +} +apache::vhost { 'The first IP-based vhost, ssl': + servername => 'first.example.com', + ip => '10.0.0.10', + port => '443', + ip_based => true, + docroot => '/var/www/first-ssl', + ssl => true, +} + +# Two name-based vhost listening on 10.0.0.20 +apache::vhost { 'second.example.com': + ip => '10.0.0.20', + port => '80', + docroot => '/var/www/second', +} +apache::vhost { 'third.example.com': + ip => '10.0.0.20', + port => '80', + docroot => '/var/www/third', +} + +# Two name-based vhosts without IPs specified, so that they will answer on either 10.0.0.10 or 10.0.0.20 . It is requried to declare +# `add_listen => 'false'` to disable declaring "Listen 80" which will conflict +# with the IP-based preceeding vhosts. +apache::vhost { 'fourth.example.com': + port => '80', + docroot => '/var/www/fourth', + add_listen => false, +} +apache::vhost { 'fifth.example.com': + port => '80', + docroot => '/var/www/fifth', + add_listen => false, +} diff --git a/environments/production/modules/apache/files/httpd b/environments/production/modules/apache/files/httpd new file mode 100644 index 0000000..d65a8d4 --- /dev/null +++ b/environments/production/modules/apache/files/httpd @@ -0,0 +1,24 @@ +# Configuration file for the httpd service. + +# +# The default processing model (MPM) is the process-based +# 'prefork' model. A thread-based model, 'worker', is also +# available, but does not work with some modules (such as PHP). +# The service must be stopped before changing this variable. +# +#HTTPD=/usr/sbin/httpd.worker + +# +# To pass additional options (for instance, -D definitions) to the +# httpd binary at startup, set OPTIONS here. +# +#OPTIONS= +#OPTIONS=-DDOWN + +# +# By default, the httpd process is started in the C locale; to +# change the locale in which the server runs, the HTTPD_LANG +# variable can be set. +# +#HTTPD_LANG=C +export SHORTHOST=`hostname -s` diff --git a/environments/production/modules/apache/lib/facter/apache_version.rb b/environments/production/modules/apache/lib/facter/apache_version.rb new file mode 100644 index 0000000..63e4e1c --- /dev/null +++ b/environments/production/modules/apache/lib/facter/apache_version.rb @@ -0,0 +1,13 @@ +Facter.add(:apache_version) do + setcode do + if Facter::Util::Resolution.which('apachectl') + apache_version = Facter::Util::Resolution.exec('apachectl -v 2>&1') + Facter.debug "Matching apachectl '#{apache_version}'" + %r{^Server version: Apache\/(\d+.\d+(.\d+)?)}.match(apache_version)[1] + elsif Facter::Util::Resolution.which('apache2ctl') + apache_version = Facter::Util::Resolution.exec('apache2ctl -v 2>&1') + Facter.debug "Matching apache2ctl '#{apache_version}'" + %r{^Server version: Apache\/(\d+.\d+(.\d+)?)}.match(apache_version)[1] + end + end +end diff --git a/environments/production/modules/apache/lib/puppet/parser/functions/bool2httpd.rb b/environments/production/modules/apache/lib/puppet/parser/functions/bool2httpd.rb new file mode 100644 index 0000000..5fb79f6 --- /dev/null +++ b/environments/production/modules/apache/lib/puppet/parser/functions/bool2httpd.rb @@ -0,0 +1,30 @@ +Puppet::Parser::Functions::newfunction(:bool2httpd, :type => :rvalue, :doc => <<-EOS +Transform a supposed boolean to On or Off. Pass all other values through. +Given a nil value (undef), bool2httpd will return 'Off' + +Example: + + $trace_enable = false + $server_signature = 'mail' + + bool2httpd($trace_enable) + # => 'Off' + bool2httpd($server_signature) + # => 'mail' + bool2httpd(undef) + # => 'Off' + +EOS +) do |args| + raise(Puppet::ParseError, "bool2httpd() wrong number of arguments. Given: #{args.size} for 1)") if args.size != 1 + + arg = args[0] + + if arg.nil? or arg == false or arg =~ /false/i or arg == :undef + return 'Off' + elsif arg == true or arg =~ /true/i + return 'On' + end + + return arg.to_s +end diff --git a/environments/production/modules/apache/lib/puppet/parser/functions/enclose_ipv6.rb b/environments/production/modules/apache/lib/puppet/parser/functions/enclose_ipv6.rb new file mode 100644 index 0000000..80ffc3a --- /dev/null +++ b/environments/production/modules/apache/lib/puppet/parser/functions/enclose_ipv6.rb @@ -0,0 +1,45 @@ +# +# enclose_ipv6.rb +# + +module Puppet::Parser::Functions + newfunction(:enclose_ipv6, :type => :rvalue, :doc => <<-EOS +Takes an array of ip addresses and encloses the ipv6 addresses with square brackets. + EOS + ) do |arguments| + + require 'ipaddr' + + rescuable_exceptions = [ ArgumentError ] + if defined?(IPAddr::InvalidAddressError) + rescuable_exceptions << IPAddr::InvalidAddressError + end + + if (arguments.size != 1) then + raise(Puppet::ParseError, "enclose_ipv6(): Wrong number of arguments "+ + "given #{arguments.size} for 1") + end + unless arguments[0].is_a?(String) or arguments[0].is_a?(Array) then + raise(Puppet::ParseError, "enclose_ipv6(): Wrong argument type "+ + "given #{arguments[0].class} expected String or Array") + end + + input = [arguments[0]].flatten.compact + result = [] + + input.each do |val| + unless val == '*' + begin + ip = IPAddr.new(val) + rescue *rescuable_exceptions + raise(Puppet::ParseError, "enclose_ipv6(): Wrong argument "+ + "given #{val} is not an ip address.") + end + val = "[#{ip.to_s}]" if ip.ipv6? + end + result << val + end + + return result.uniq + end +end diff --git a/environments/production/modules/apache/lib/puppet/parser/functions/validate_apache_log_level.rb b/environments/production/modules/apache/lib/puppet/parser/functions/validate_apache_log_level.rb new file mode 100644 index 0000000..8a1ade0 --- /dev/null +++ b/environments/production/modules/apache/lib/puppet/parser/functions/validate_apache_log_level.rb @@ -0,0 +1,27 @@ +module Puppet::Parser::Functions + newfunction(:validate_apache_log_level, :doc => <<-'ENDHEREDOC') do |args| + Perform simple validation of a string against the list of known log + levels as per http://httpd.apache.org/docs/current/mod/core.html#loglevel + validate_apache_loglevel('info') + + Modules maybe specified with their own levels like these: + validate_apache_loglevel('warn ssl:info') + validate_apache_loglevel('warn mod_ssl.c:info') + validate_apache_loglevel('warn ssl_module:info') + + Expected to be used from the main or vhost. + + Might be used from directory too later as apaceh supports that + + ENDHEREDOC + if (args.size != 1) then + raise Puppet::ParseError, ("validate_apache_loglevel(): wrong number of arguments (#{args.length}; must be 1)") + end + + log_level = args[0] + msg = "Log level '${log_level}' is not one of the supported Apache HTTP Server log levels." + + raise Puppet::ParseError, (msg) unless log_level =~ Regexp.compile('(emerg|alert|crit|error|warn|notice|info|debug|trace[1-8])') + + end +end diff --git a/environments/production/modules/apache/lib/puppet/provider/a2mod.rb b/environments/production/modules/apache/lib/puppet/provider/a2mod.rb new file mode 100644 index 0000000..670aca3 --- /dev/null +++ b/environments/production/modules/apache/lib/puppet/provider/a2mod.rb @@ -0,0 +1,34 @@ +class Puppet::Provider::A2mod < Puppet::Provider + def self.prefetch(mods) + instances.each do |prov| + if mod = mods[prov.name] + mod.provider = prov + end + end + end + + def flush + @property_hash.clear + end + + def properties + if @property_hash.empty? + @property_hash = query || {:ensure => :absent} + @property_hash[:ensure] = :absent if @property_hash.empty? + end + @property_hash.dup + end + + def query + self.class.instances.each do |mod| + if mod.name == self.name or mod.name.downcase == self.name + return mod.properties + end + end + nil + end + + def exists? + properties[:ensure] != :absent + end +end diff --git a/environments/production/modules/apache/lib/puppet/provider/a2mod/a2mod.rb b/environments/production/modules/apache/lib/puppet/provider/a2mod/a2mod.rb new file mode 100644 index 0000000..e257a57 --- /dev/null +++ b/environments/production/modules/apache/lib/puppet/provider/a2mod/a2mod.rb @@ -0,0 +1,35 @@ +require 'puppet/provider/a2mod' + +Puppet::Type.type(:a2mod).provide(:a2mod, :parent => Puppet::Provider::A2mod) do + desc "Manage Apache 2 modules on Debian and Ubuntu" + + optional_commands :encmd => "a2enmod" + optional_commands :discmd => "a2dismod" + commands :apache2ctl => "apache2ctl" + + confine :osfamily => :debian + defaultfor :operatingsystem => [:debian, :ubuntu] + + def self.instances + modules = apache2ctl("-M").lines.collect { |line| + m = line.match(/(\w+)_module \(shared\)$/) + m[1] if m + }.compact + + modules.map do |mod| + new( + :name => mod, + :ensure => :present, + :provider => :a2mod + ) + end + end + + def create + encmd resource[:name] + end + + def destroy + discmd resource[:name] + end +end diff --git a/environments/production/modules/apache/lib/puppet/provider/a2mod/gentoo.rb b/environments/production/modules/apache/lib/puppet/provider/a2mod/gentoo.rb new file mode 100644 index 0000000..07319df --- /dev/null +++ b/environments/production/modules/apache/lib/puppet/provider/a2mod/gentoo.rb @@ -0,0 +1,116 @@ +require 'puppet/util/filetype' +Puppet::Type.type(:a2mod).provide(:gentoo, :parent => Puppet::Provider) do + desc "Manage Apache 2 modules on Gentoo" + + confine :operatingsystem => :gentoo + defaultfor :operatingsystem => :gentoo + + attr_accessor :property_hash + + def create + @property_hash[:ensure] = :present + end + + def exists? + (!(@property_hash[:ensure].nil?) and @property_hash[:ensure] == :present) + end + + def destroy + @property_hash[:ensure] = :absent + end + + def flush + self.class.flush + end + + class << self + attr_reader :conf_file + end + + def self.clear + @mod_resources = [] + @modules = [] + @other_args = "" + end + + def self.initvars + @conf_file = "/etc/conf.d/apache2" + @filetype = Puppet::Util::FileType.filetype(:flat).new(conf_file) + @mod_resources = [] + @modules = [] + @other_args = "" + end + + self.initvars + + # Retrieve an array of all existing modules + def self.modules + if @modules.length <= 0 + # Locate the APACHE_OPTS variable + records = filetype.read.split(/\n/) + apache2_opts = records.grep(/^\s*APACHE2_OPTS=/).first + + # Extract all defines + while apache2_opts.sub!(/-D\s+(\w+)/, '') + @modules << $1.downcase + end + + # Hang on to any remaining options. + if apache2_opts.match(/APACHE2_OPTS="(.+)"/) + @other_args = $1.strip + end + + @modules.sort!.uniq! + end + + @modules + end + + def self.prefetch(resources={}) + # Match resources with existing providers + instances.each do |provider| + if resource = resources[provider.name] + resource.provider = provider + end + end + + # Store all resources using this provider for flushing + resources.each do |name, resource| + @mod_resources << resource + end + end + + def self.instances + modules.map {|mod| new(:name => mod, :provider => :gentoo, :ensure => :present)} + end + + def self.flush + + mod_list = modules + mods_to_remove = @mod_resources.select {|mod| mod.should(:ensure) == :absent}.map {|mod| mod[:name]} + mods_to_add = @mod_resources.select {|mod| mod.should(:ensure) == :present}.map {|mod| mod[:name]} + + mod_list -= mods_to_remove + mod_list += mods_to_add + mod_list.sort!.uniq! + + if modules != mod_list + opts = @other_args + " " + opts << mod_list.map {|mod| "-D #{mod.upcase}"}.join(" ") + opts.strip! + opts.gsub!(/\s+/, ' ') + + apache2_opts = %Q{APACHE2_OPTS="#{opts}"} + Puppet.debug("Writing back \"#{apache2_opts}\" to #{conf_file}") + + records = filetype.read.split(/\n/) + + opts_index = records.find_index {|i| i.match(/^\s*APACHE2_OPTS/)} + records[opts_index] = apache2_opts + + filetype.backup + filetype.write(records.join("\n")) + @modules = mod_list + end + end +end diff --git a/environments/production/modules/apache/lib/puppet/provider/a2mod/modfix.rb b/environments/production/modules/apache/lib/puppet/provider/a2mod/modfix.rb new file mode 100644 index 0000000..8f35b2e --- /dev/null +++ b/environments/production/modules/apache/lib/puppet/provider/a2mod/modfix.rb @@ -0,0 +1,12 @@ +Puppet::Type.type(:a2mod).provide :modfix do + desc "Dummy provider for A2mod. + + Fake nil resources when there is no crontab binary available. Allows + puppetd to run on a bootstrapped machine before a Cron package has been + installed. Workaround for: http://projects.puppetlabs.com/issues/2384 + " + + def self.instances + [] + end +end \ No newline at end of file diff --git a/environments/production/modules/apache/lib/puppet/provider/a2mod/redhat.rb b/environments/production/modules/apache/lib/puppet/provider/a2mod/redhat.rb new file mode 100644 index 0000000..ea5494c --- /dev/null +++ b/environments/production/modules/apache/lib/puppet/provider/a2mod/redhat.rb @@ -0,0 +1,60 @@ +require 'puppet/provider/a2mod' + +Puppet::Type.type(:a2mod).provide(:redhat, :parent => Puppet::Provider::A2mod) do + desc "Manage Apache 2 modules on RedHat family OSs" + + commands :apachectl => "apachectl" + + confine :osfamily => :redhat + defaultfor :osfamily => :redhat + + require 'pathname' + + # modpath: Path to default apache modules directory /etc/httpd/mod.d + # modfile: Path to module load configuration file; Default: resides under modpath directory + # libfile: Path to actual apache module library. Added in modfile LoadModule + + attr_accessor :modfile, :libfile + class << self + attr_accessor :modpath + def preinit + @modpath = "/etc/httpd/mod.d" + end + end + + self.preinit + + def create + File.open(modfile,'w') do |f| + f.puts "LoadModule #{resource[:identifier]} #{libfile}" + end + end + + def destroy + File.delete(modfile) + end + + def self.instances + modules = apachectl("-M").lines.collect { |line| + m = line.match(/(\w+)_module \(shared\)$/) + m[1] if m + }.compact + + modules.map do |mod| + new( + :name => mod, + :ensure => :present, + :provider => :redhat + ) + end + end + + def modfile + modfile ||= "#{self.class.modpath}/#{resource[:name]}.load" + end + + # Set libfile path: If absolute path is passed, then maintain it. Else, make it default from 'modules' dir. + def libfile + libfile = Pathname.new(resource[:lib]).absolute? ? resource[:lib] : "modules/#{resource[:lib]}" + end +end diff --git a/environments/production/modules/apache/lib/puppet/type/a2mod.rb b/environments/production/modules/apache/lib/puppet/type/a2mod.rb new file mode 100644 index 0000000..07a911e --- /dev/null +++ b/environments/production/modules/apache/lib/puppet/type/a2mod.rb @@ -0,0 +1,30 @@ +Puppet::Type.newtype(:a2mod) do + @doc = "Manage Apache 2 modules" + + ensurable + + newparam(:name) do + Puppet.warning "The a2mod provider is deprecated, please use apache::mod instead" + desc "The name of the module to be managed" + + isnamevar + + end + + newparam(:lib) do + desc "The name of the .so library to be loaded" + + defaultto { "mod_#{@resource[:name]}.so" } + end + + newparam(:identifier) do + desc "Module identifier string used by LoadModule. Default: module-name_module" + + # http://httpd.apache.org/docs/2.2/mod/module-dict.html#ModuleIdentifier + + defaultto { "#{resource[:name]}_module" } + end + + autorequire(:package) { catalog.resource(:package, 'httpd')} + +end diff --git a/environments/production/modules/apache/manifests/balancer.pp b/environments/production/modules/apache/manifests/balancer.pp new file mode 100644 index 0000000..41db8a8 --- /dev/null +++ b/environments/production/modules/apache/manifests/balancer.pp @@ -0,0 +1,97 @@ +# == Define Resource Type: apache::balancer +# +# This type will create an apache balancer cluster file inside the conf.d +# directory. Each balancer cluster needs one or more balancer members (that can +# be declared with the apache::balancermember defined resource type). Using +# storeconfigs, you can export the apache::balancermember resources on all +# balancer members, and then collect them on a single apache load balancer +# server. +# +# === Requirement/Dependencies: +# +# Currently requires the puppetlabs/concat module on the Puppet Forge and uses +# storeconfigs on the Puppet Master to export/collect resources from all +# balancer members. +# +# === Parameters +# +# [*name*] +# The namevar of the defined resource type is the balancer clusters name. +# This name is also used in the name of the conf.d file +# +# [*proxy_set*] +# Hash, default empty. If given, each key-value pair will be used as a ProxySet +# line in the configuration. +# +# [*target*] +# String, default undef. If given, path to the file the balancer definition will +# be written. +# +# [*collect_exported*] +# Boolean, default 'true'. True means 'collect exported @@balancermember +# resources' (for the case when every balancermember node exports itself), +# false means 'rely on the existing declared balancermember resources' (for the +# case when you know the full set of balancermembers in advance and use +# apache::balancermember with array arguments, which allows you to deploy +# everything in 1 run) +# +# +# === Examples +# +# Exporting the resource for a balancer member: +# +# apache::balancer { 'puppet00': } +# +define apache::balancer ( + $proxy_set = {}, + $collect_exported = true, + $target = undef, +) { + include ::apache::mod::proxy_balancer + + if versioncmp($apache::mod::proxy_balancer::apache_version, '2.4') >= 0 { + $lbmethod = $proxy_set['lbmethod'] ? { + undef => 'byrequests', + default => $proxy_set['lbmethod'], + } + ensure_resource('apache::mod', "lbmethod_${lbmethod}") + } + + if $target { + $_target = $target + } else { + $_target = "${::apache::confd_dir}/balancer_${name}.conf" + } + + concat { "apache_balancer_${name}": + owner => '0', + group => '0', + path => $_target, + mode => $::apache::file_mode, + notify => Class['Apache::Service'], + } + + concat::fragment { "00-${name}-header": + target => "apache_balancer_${name}", + order => '01', + content => "\n", + } + + if $collect_exported { + Apache::Balancermember <<| balancer_cluster == $name |>> + } + # else: the resources have been created and they introduced their + # concat fragments. We don't have to do anything about them. + + concat::fragment { "01-${name}-proxyset": + target => "apache_balancer_${name}", + order => '19', + content => inline_template("<% @proxy_set.keys.sort.each do |key| %> Proxyset <%= key %>=<%= @proxy_set[key] %>\n<% end %>"), + } + + concat::fragment { "01-${name}-footer": + target => "apache_balancer_${name}", + order => '20', + content => "\n", + } +} diff --git a/environments/production/modules/apache/manifests/balancermember.pp b/environments/production/modules/apache/manifests/balancermember.pp new file mode 100644 index 0000000..6e8b29f --- /dev/null +++ b/environments/production/modules/apache/manifests/balancermember.pp @@ -0,0 +1,52 @@ +# == Define Resource Type: apache::balancermember +# +# This type will setup a balancer member inside a listening service +# configuration block in /etc/apache/apache.cfg on the load balancer. +# currently it only has the ability to specify the instance name, url and an +# array of options. More features can be added as needed. The best way to +# implement this is to export this resource for all apache balancer member +# servers, and then collect them on the main apache load balancer. +# +# === Requirement/Dependencies: +# +# Currently requires the puppetlabs/concat module on the Puppet Forge and +# uses storeconfigs on the Puppet Master to export/collect resources +# from all balancer members. +# +# === Parameters +# +# [*name*] +# The title of the resource is arbitrary and only utilized in the concat +# fragment name. +# +# [*balancer_cluster*] +# The apache service's instance name (or, the title of the apache::balancer +# resource). This must match up with a declared apache::balancer resource. +# +# [*url*] +# The url used to contact the balancer member server. +# +# [*options*] +# An array of options to be specified after the url. +# +# === Examples +# +# Exporting the resource for a balancer member: +# +# @@apache::balancermember { 'apache': +# balancer_cluster => 'puppet00', +# url => "ajp://${::fqdn}:8009" +# options => ['ping=5', 'disablereuse=on', 'retry=5', 'ttl=120'], +# } +# +define apache::balancermember( + $balancer_cluster, + $url = "http://${::fqdn}/", + $options = [], +) { + + concat::fragment { "BalancerMember ${name}": + target => "apache_balancer_${balancer_cluster}", + content => inline_template(" BalancerMember ${url} <%= @options.join ' ' %>\n"), + } +} diff --git a/environments/production/modules/apache/manifests/confd/no_accf.pp b/environments/production/modules/apache/manifests/confd/no_accf.pp new file mode 100644 index 0000000..f35c0c8 --- /dev/null +++ b/environments/production/modules/apache/manifests/confd/no_accf.pp @@ -0,0 +1,10 @@ +class apache::confd::no_accf { + # Template uses no variables + file { 'no-accf.conf': + ensure => 'file', + path => "${::apache::confd_dir}/no-accf.conf", + content => template('apache/confd/no-accf.conf.erb'), + require => Exec["mkdir ${::apache::confd_dir}"], + before => File[$::apache::confd_dir], + } +} diff --git a/environments/production/modules/apache/manifests/custom_config.pp b/environments/production/modules/apache/manifests/custom_config.pp new file mode 100644 index 0000000..188f3ba --- /dev/null +++ b/environments/production/modules/apache/manifests/custom_config.pp @@ -0,0 +1,73 @@ +# See README.md for usage information +define apache::custom_config ( + $ensure = 'present', + $confdir = $::apache::confd_dir, + $content = undef, + $priority = '25', + $source = undef, + $verify_command = $::apache::params::verify_command, + $verify_config = true, + $filename = undef, +) { + + if $content and $source { + fail('Only one of $content and $source can be specified.') + } + + if $ensure == 'present' and ! $content and ! $source { + fail('One of $content and $source must be specified.') + } + + validate_re($ensure, '^(present|absent)$', + "${ensure} is not supported for ensure. + Allowed values are 'present' and 'absent'.") + + validate_bool($verify_config) + + if $filename { + $_filename = $filename + } else { + if $priority { + $priority_prefix = "${priority}-" + } else { + $priority_prefix = '' + } + + ## Apache include does not always work with spaces in the filename + $filename_middle = regsubst($name, ' ', '_', 'G') + $_filename = "${priority_prefix}${filename_middle}.conf" + } + + if ! $verify_config or $ensure == 'absent' { + $notifies = Class['Apache::Service'] + } else { + $notifies = undef + } + + file { "apache_${name}": + ensure => $ensure, + path => "${confdir}/${_filename}", + content => $content, + source => $source, + require => Package['httpd'], + notify => $notifies, + } + + if $ensure == 'present' and $verify_config { + exec { "syntax verification for ${name}": + command => $verify_command, + subscribe => File["apache_${name}"], + refreshonly => true, + notify => Class['Apache::Service'], + before => Exec["remove ${name} if invalid"], + require => Anchor['::apache::modules_set_up'], + } + + exec { "remove ${name} if invalid": + command => "/bin/rm ${confdir}/${_filename}", + unless => $verify_command, + subscribe => File["apache_${name}"], + refreshonly => true, + } + } +} diff --git a/environments/production/modules/apache/manifests/default_confd_files.pp b/environments/production/modules/apache/manifests/default_confd_files.pp new file mode 100644 index 0000000..c06b30c --- /dev/null +++ b/environments/production/modules/apache/manifests/default_confd_files.pp @@ -0,0 +1,15 @@ +class apache::default_confd_files ( + $all = true, +) { + # The rest of the conf.d/* files only get loaded if we want them + if $all { + case $::osfamily { + 'freebsd': { + include ::apache::confd::no_accf + } + default: { + # do nothing + } + } + } +} diff --git a/environments/production/modules/apache/manifests/default_mods.pp b/environments/production/modules/apache/manifests/default_mods.pp new file mode 100644 index 0000000..879df59 --- /dev/null +++ b/environments/production/modules/apache/manifests/default_mods.pp @@ -0,0 +1,179 @@ +class apache::default_mods ( + $all = true, + $mods = undef, + $apache_version = $::apache::apache_version, + $use_systemd = $::apache::use_systemd, +) { + # These are modules required to run the default configuration. + # They are not configurable at this time, so we just include + # them to make sure it works. + case $::osfamily { + 'redhat': { + ::apache::mod { 'log_config': } + if versioncmp($apache_version, '2.4') >= 0 { + # Lets fork it + # Do not try to load mod_systemd on RHEL/CentOS 6 SCL. + if ( !($::osfamily == 'redhat' and versioncmp($::operatingsystemrelease, '7.0') == -1) and !($::operatingsystem == 'Amazon') ) { + if ($use_systemd) { + ::apache::mod { 'systemd': } + } + } + ::apache::mod { 'unixd': } + } + } + 'freebsd': { + ::apache::mod { 'log_config': } + ::apache::mod { 'unixd': } + } + 'Suse': { + ::apache::mod { 'log_config': } + } + default: {} + } + case $::osfamily { + 'gentoo': {} + default: { + ::apache::mod { 'authz_host': } + } + } + # The rest of the modules only get loaded if we want all modules enabled + if $all { + case $::osfamily { + 'debian': { + include ::apache::mod::authn_core + include ::apache::mod::reqtimeout + if versioncmp($apache_version, '2.4') < 0 { + ::apache::mod { 'authn_alias': } + } + } + 'redhat': { + include ::apache::mod::actions + include ::apache::mod::authn_core + include ::apache::mod::cache + include ::apache::mod::ext_filter + include ::apache::mod::mime + include ::apache::mod::mime_magic + include ::apache::mod::rewrite + include ::apache::mod::speling + include ::apache::mod::suexec + include ::apache::mod::version + include ::apache::mod::vhost_alias + ::apache::mod { 'auth_digest': } + ::apache::mod { 'authn_anon': } + ::apache::mod { 'authn_dbm': } + ::apache::mod { 'authz_dbm': } + ::apache::mod { 'authz_owner': } + ::apache::mod { 'expires': } + ::apache::mod { 'include': } + ::apache::mod { 'logio': } + ::apache::mod { 'substitute': } + ::apache::mod { 'usertrack': } + + if versioncmp($apache_version, '2.4') < 0 { + ::apache::mod { 'authn_alias': } + ::apache::mod { 'authn_default': } + } + } + 'freebsd': { + include ::apache::mod::actions + include ::apache::mod::authn_core + include ::apache::mod::cache + include ::apache::mod::disk_cache + include ::apache::mod::headers + include ::apache::mod::info + include ::apache::mod::mime_magic + include ::apache::mod::reqtimeout + include ::apache::mod::rewrite + include ::apache::mod::userdir + include ::apache::mod::version + include ::apache::mod::vhost_alias + include ::apache::mod::speling + include ::apache::mod::filter + + ::apache::mod { 'asis': } + ::apache::mod { 'auth_digest': } + ::apache::mod { 'auth_form': } + ::apache::mod { 'authn_anon': } + ::apache::mod { 'authn_dbm': } + ::apache::mod { 'authn_socache': } + ::apache::mod { 'authz_dbd': } + ::apache::mod { 'authz_dbm': } + ::apache::mod { 'authz_owner': } + ::apache::mod { 'dumpio': } + ::apache::mod { 'expires': } + ::apache::mod { 'file_cache': } + ::apache::mod { 'imagemap':} + ::apache::mod { 'include': } + ::apache::mod { 'logio': } + ::apache::mod { 'request': } + ::apache::mod { 'session': } + ::apache::mod { 'unique_id': } + } + default: {} + } + case $::apache::mpm_module { + 'prefork': { + include ::apache::mod::cgi + } + 'worker': { + include ::apache::mod::cgid + } + default: { + # do nothing + } + } + include ::apache::mod::alias + include ::apache::mod::authn_file + include ::apache::mod::autoindex + include ::apache::mod::dav + include ::apache::mod::dav_fs + include ::apache::mod::deflate + include ::apache::mod::dir + include ::apache::mod::mime + include ::apache::mod::negotiation + include ::apache::mod::setenvif + ::apache::mod { 'auth_basic': } + + if versioncmp($apache_version, '2.4') >= 0 { + # filter is needed by mod_deflate + include ::apache::mod::filter + + # authz_core is needed for 'Require' directive + ::apache::mod { 'authz_core': + id => 'authz_core_module', + } + + # lots of stuff seems to break without access_compat + ::apache::mod { 'access_compat': } + } else { + include ::apache::mod::authz_default + } + + include ::apache::mod::authz_user + + ::apache::mod { 'authz_groupfile': } + include ::apache::mod::env + } elsif $mods { + ::apache::default_mods::load { $mods: } + + if versioncmp($apache_version, '2.4') >= 0 { + # authz_core is needed for 'Require' directive + ::apache::mod { 'authz_core': + id => 'authz_core_module', + } + + # filter is needed by mod_deflate + include ::apache::mod::filter + } + } else { + if versioncmp($apache_version, '2.4') >= 0 { + # authz_core is needed for 'Require' directive + ::apache::mod { 'authz_core': + id => 'authz_core_module', + } + + # filter is needed by mod_deflate + include ::apache::mod::filter + } + } +} diff --git a/environments/production/modules/apache/manifests/default_mods/load.pp b/environments/production/modules/apache/manifests/default_mods/load.pp new file mode 100644 index 0000000..356e9fa --- /dev/null +++ b/environments/production/modules/apache/manifests/default_mods/load.pp @@ -0,0 +1,8 @@ +# private define +define apache::default_mods::load ($module = $title) { + if defined("apache::mod::${module}") { + include "::apache::mod::${module}" + } else { + ::apache::mod { $module: } + } +} diff --git a/environments/production/modules/apache/manifests/dev.pp b/environments/production/modules/apache/manifests/dev.pp new file mode 100644 index 0000000..d4a25a7 --- /dev/null +++ b/environments/production/modules/apache/manifests/dev.pp @@ -0,0 +1,14 @@ +class apache::dev { + + if ! defined(Class['apache']) { + fail('You must include the apache base class before using any apache defined resources') + } + + $packages = $::apache::dev_packages + if $packages { # FreeBSD doesn't have dev packages to install + package { $packages: + ensure => present, + require => Package['httpd'], + } + } +} diff --git a/environments/production/modules/apache/manifests/fastcgi/server.pp b/environments/production/modules/apache/manifests/fastcgi/server.pp new file mode 100644 index 0000000..7836306 --- /dev/null +++ b/environments/production/modules/apache/manifests/fastcgi/server.pp @@ -0,0 +1,29 @@ +define apache::fastcgi::server ( + $host = '127.0.0.1:9000', + $timeout = 15, + $flush = false, + $faux_path = "/var/www/${name}.fcgi", + $fcgi_alias = "/${name}.fcgi", + $file_type = 'application/x-httpd-php', + $pass_header = undef, +) { + include ::apache::mod::fastcgi + + Apache::Mod['fastcgi'] -> Apache::Fastcgi::Server[$title] + + if is_absolute_path($host) { + $socket = $host + } + + file { "fastcgi-pool-${name}.conf": + ensure => present, + path => "${::apache::confd_dir}/fastcgi-pool-${name}.conf", + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + content => template('apache/fastcgi/server.erb'), + require => Exec["mkdir ${::apache::confd_dir}"], + before => File[$::apache::confd_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/init.pp b/environments/production/modules/apache/manifests/init.pp new file mode 100644 index 0000000..3ad7b29 --- /dev/null +++ b/environments/production/modules/apache/manifests/init.pp @@ -0,0 +1,395 @@ +# Class: apache +# +# This class installs Apache +# +# Parameters: +# +# Actions: +# - Install Apache +# - Manage Apache service +# +# Requires: +# +# Sample Usage: +# +class apache ( + $apache_name = $::apache::params::apache_name, + $service_name = $::apache::params::service_name, + $default_mods = true, + $default_vhost = true, + $default_charset = undef, + $default_confd_files = true, + $default_ssl_vhost = false, + $default_ssl_cert = $::apache::params::default_ssl_cert, + $default_ssl_key = $::apache::params::default_ssl_key, + $default_ssl_chain = undef, + $default_ssl_ca = undef, + $default_ssl_crl_path = undef, + $default_ssl_crl = undef, + $default_ssl_crl_check = undef, + $default_type = 'none', + $dev_packages = $::apache::params::dev_packages, + $ip = undef, + $service_enable = true, + $service_manage = true, + $service_ensure = 'running', + $service_restart = undef, + $purge_configs = true, + $purge_vhost_dir = undef, + $purge_vdir = false, + $serveradmin = 'root@localhost', + $sendfile = 'On', + $error_documents = false, + $timeout = '120', + $httpd_dir = $::apache::params::httpd_dir, + $server_root = $::apache::params::server_root, + $conf_dir = $::apache::params::conf_dir, + $confd_dir = $::apache::params::confd_dir, + $vhost_dir = $::apache::params::vhost_dir, + $vhost_enable_dir = $::apache::params::vhost_enable_dir, + $vhost_include_pattern = $::apache::params::vhost_include_pattern, + $mod_dir = $::apache::params::mod_dir, + $mod_enable_dir = $::apache::params::mod_enable_dir, + $mpm_module = $::apache::params::mpm_module, + $lib_path = $::apache::params::lib_path, + $conf_template = $::apache::params::conf_template, + $servername = $::apache::params::servername, + $pidfile = $::apache::params::pidfile, + $rewrite_lock = undef, + $manage_user = true, + $manage_group = true, + $user = $::apache::params::user, + $group = $::apache::params::group, + $keepalive = $::apache::params::keepalive, + $keepalive_timeout = $::apache::params::keepalive_timeout, + $max_keepalive_requests = $::apache::params::max_keepalive_requests, + $limitreqfieldsize = '8190', + $logroot = $::apache::params::logroot, + $logroot_mode = $::apache::params::logroot_mode, + $log_level = $::apache::params::log_level, + $log_formats = {}, + $ssl_file = $::apache::params::ssl_file, + $ports_file = $::apache::params::ports_file, + $docroot = $::apache::params::docroot, + $apache_version = $::apache::version::default, + $server_tokens = 'OS', + $server_signature = 'On', + $trace_enable = 'On', + $allow_encoded_slashes = undef, + $package_ensure = 'installed', + $use_optional_includes = $::apache::params::use_optional_includes, + $use_systemd = $::apache::params::use_systemd, + $mime_types_additional = $::apache::params::mime_types_additional, + $file_mode = $::apache::params::file_mode, + $root_directory_options = $::apache::params::root_directory_options, + $root_directory_secured = false, + $error_log = $::apache::params::error_log, + $scriptalias = $::apache::params::scriptalias, + $access_log_file = $::apache::params::access_log_file, +) inherits ::apache::params { + validate_bool($default_vhost) + validate_bool($default_ssl_vhost) + validate_bool($default_confd_files) + # true/false is sufficient for both ensure and enable + validate_bool($service_enable) + validate_bool($service_manage) + validate_bool($use_optional_includes) + validate_bool($root_directory_secured) + + $valid_mpms_re = $apache_version ? { + '2.4' => '(event|itk|peruser|prefork|worker)', + default => '(event|itk|prefork|worker)' + } + + if $mpm_module and $mpm_module != 'false' { # lint:ignore:quoted_booleans + validate_re($mpm_module, $valid_mpms_re) + } + + if $allow_encoded_slashes { + validate_re($allow_encoded_slashes, '(^on$|^off$|^nodecode$)', "${allow_encoded_slashes} is not permitted for allow_encoded_slashes. Allowed values are 'on', 'off' or 'nodecode'.") + } + + # NOTE: on FreeBSD it's mpm module's responsibility to install httpd package. + # NOTE: the same strategy may be introduced for other OSes. For this, you + # should delete the 'if' block below and modify all MPM modules' manifests + # such that they include apache::package class (currently event.pp, itk.pp, + # peruser.pp, prefork.pp, worker.pp). + if $::osfamily != 'FreeBSD' { + package { 'httpd': + ensure => $package_ensure, + name => $apache_name, + notify => Class['Apache::Service'], + } + } + validate_re($sendfile, [ '^[oO]n$' , '^[oO]ff$' ]) + + # declare the web server user and group + # Note: requiring the package means the package ought to create them and not puppet + validate_bool($manage_user) + if $manage_user { + user { $user: + ensure => present, + gid => $group, + require => Package['httpd'], + } + } + validate_bool($manage_group) + if $manage_group { + group { $group: + ensure => present, + require => Package['httpd'], + } + } + + validate_apache_log_level($log_level) + + class { '::apache::service': + service_name => $service_name, + service_enable => $service_enable, + service_manage => $service_manage, + service_ensure => $service_ensure, + service_restart => $service_restart, + } + + # Deprecated backwards-compatibility + if $purge_vdir { + warning('Class[\'apache\'] parameter purge_vdir is deprecated in favor of purge_configs') + $purge_confd = $purge_vdir + } else { + $purge_confd = $purge_configs + } + + # Set purge vhostd appropriately + if $purge_vhost_dir == undef { + $purge_vhostd = $purge_confd + } else { + $purge_vhostd = $purge_vhost_dir + } + + Exec { + path => '/bin:/sbin:/usr/bin:/usr/sbin', + } + + exec { "mkdir ${confd_dir}": + creates => $confd_dir, + require => Package['httpd'], + } + file { $confd_dir: + ensure => directory, + recurse => true, + purge => $purge_confd, + force => $purge_confd, + notify => Class['Apache::Service'], + require => Package['httpd'], + } + + if ! defined(File[$mod_dir]) { + exec { "mkdir ${mod_dir}": + creates => $mod_dir, + require => Package['httpd'], + } + # Don't purge available modules if an enable dir is used + $purge_mod_dir = $purge_configs and !$mod_enable_dir + file { $mod_dir: + ensure => directory, + recurse => true, + purge => $purge_mod_dir, + notify => Class['Apache::Service'], + require => Package['httpd'], + before => Anchor['::apache::modules_set_up'], + } + } + + if $mod_enable_dir and ! defined(File[$mod_enable_dir]) { + $mod_load_dir = $mod_enable_dir + exec { "mkdir ${mod_enable_dir}": + creates => $mod_enable_dir, + require => Package['httpd'], + } + file { $mod_enable_dir: + ensure => directory, + recurse => true, + purge => $purge_configs, + notify => Class['Apache::Service'], + require => Package['httpd'], + } + } else { + $mod_load_dir = $mod_dir + } + + if ! defined(File[$vhost_dir]) { + exec { "mkdir ${vhost_dir}": + creates => $vhost_dir, + require => Package['httpd'], + } + file { $vhost_dir: + ensure => directory, + recurse => true, + purge => $purge_vhostd, + notify => Class['Apache::Service'], + require => Package['httpd'], + } + } + + if $vhost_enable_dir and ! defined(File[$vhost_enable_dir]) { + $vhost_load_dir = $vhost_enable_dir + exec { "mkdir ${vhost_load_dir}": + creates => $vhost_load_dir, + require => Package['httpd'], + } + file { $vhost_enable_dir: + ensure => directory, + recurse => true, + purge => $purge_vhostd, + notify => Class['Apache::Service'], + require => Package['httpd'], + } + } else { + $vhost_load_dir = $vhost_dir + } + + concat { $ports_file: + ensure => present, + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + notify => Class['Apache::Service'], + require => Package['httpd'], + } + concat::fragment { 'Apache ports header': + target => $ports_file, + content => template('apache/ports_header.erb'), + } + + if $::apache::conf_dir and $::apache::params::conf_file { + if $::osfamily == 'gentoo' { + $error_documents_path = '/usr/share/apache2/error' + if is_array($default_mods) { + if versioncmp($apache_version, '2.4') >= 0 { + if defined('apache::mod::ssl') { + ::portage::makeconf { 'apache2_modules': + content => concat($default_mods, [ 'authz_core', 'socache_shmcb' ]), + } + } else { + ::portage::makeconf { 'apache2_modules': + content => concat($default_mods, 'authz_core'), + } + } + } else { + ::portage::makeconf { 'apache2_modules': + content => $default_mods, + } + } + } + + file { [ + '/etc/apache2/modules.d/.keep_www-servers_apache-2', + '/etc/apache2/vhosts.d/.keep_www-servers_apache-2', + ]: + ensure => absent, + require => Package['httpd'], + } + } + + $apxs_workaround = $::osfamily ? { + 'freebsd' => true, + default => false + } + + if $rewrite_lock { + validate_absolute_path($rewrite_lock) + } + + # Template uses: + # - $pidfile + # - $user + # - $group + # - $logroot + # - $error_log + # - $sendfile + # - $mod_dir + # - $ports_file + # - $confd_dir + # - $vhost_dir + # - $error_documents + # - $error_documents_path + # - $apxs_workaround + # - $keepalive + # - $keepalive_timeout + # - $max_keepalive_requests + # - $server_root + # - $server_tokens + # - $server_signature + # - $trace_enable + # - $rewrite_lock + # - $root_directory_secured + file { "${::apache::conf_dir}/${::apache::params::conf_file}": + ensure => file, + content => template($conf_template), + notify => Class['Apache::Service'], + require => [Package['httpd'], Concat[$ports_file]], + } + + # preserve back-wards compatibility to the times when default_mods was + # only a boolean value. Now it can be an array (too) + if is_array($default_mods) { + class { '::apache::default_mods': + all => false, + mods => $default_mods, + } + } else { + class { '::apache::default_mods': + all => $default_mods, + } + } + class { '::apache::default_confd_files': + all => $default_confd_files, + } + if $mpm_module and $mpm_module != 'false' { # lint:ignore:quoted_booleans + include "::apache::mod::${mpm_module}" + } + + $default_vhost_ensure = $default_vhost ? { + true => 'present', + false => 'absent' + } + $default_ssl_vhost_ensure = $default_ssl_vhost ? { + true => 'present', + false => 'absent' + } + + ::apache::vhost { 'default': + ensure => $default_vhost_ensure, + port => '80', + docroot => $docroot, + scriptalias => $scriptalias, + serveradmin => $serveradmin, + access_log_file => $access_log_file, + priority => '15', + ip => $ip, + logroot_mode => $logroot_mode, + manage_docroot => $default_vhost, + } + $ssl_access_log_file = $::osfamily ? { + 'freebsd' => $access_log_file, + default => "ssl_${access_log_file}", + } + ::apache::vhost { 'default-ssl': + ensure => $default_ssl_vhost_ensure, + port => '443', + ssl => true, + docroot => $docroot, + scriptalias => $scriptalias, + serveradmin => $serveradmin, + access_log_file => $ssl_access_log_file, + priority => '15', + ip => $ip, + logroot_mode => $logroot_mode, + manage_docroot => $default_ssl_vhost, + } + } + + # This anchor can be used as a reference point for things that need to happen *after* + # all modules have been put in place. + anchor { '::apache::modules_set_up': } +} diff --git a/environments/production/modules/apache/manifests/listen.pp b/environments/production/modules/apache/manifests/listen.pp new file mode 100644 index 0000000..503ee88 --- /dev/null +++ b/environments/production/modules/apache/manifests/listen.pp @@ -0,0 +1,9 @@ +define apache::listen { + $listen_addr_port = $name + + # Template uses: $listen_addr_port + concat::fragment { "Listen ${listen_addr_port}": + target => $::apache::ports_file, + content => template('apache/listen.erb'), + } +} diff --git a/environments/production/modules/apache/manifests/mod.pp b/environments/production/modules/apache/manifests/mod.pp new file mode 100644 index 0000000..8958d12 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod.pp @@ -0,0 +1,176 @@ +define apache::mod ( + $package = undef, + $package_ensure = 'present', + $lib = undef, + $lib_path = $::apache::lib_path, + $id = undef, + $path = undef, + $loadfile_name = undef, + $loadfiles = undef, +) { + if ! defined(Class['apache']) { + fail('You must include the apache base class before using any apache defined resources') + } + + $mod = $name + #include apache #This creates duplicate resources in rspec-puppet + $mod_dir = $::apache::mod_dir + + # Determine if we have special lib + $mod_libs = $::apache::params::mod_libs + if $lib { + $_lib = $lib + } elsif has_key($mod_libs, $mod) { # 2.6 compatibility hack + $_lib = $mod_libs[$mod] + } else { + $_lib = "mod_${mod}.so" + } + + # Determine if declaration specified a path to the module + if $path { + $_path = $path + } else { + $_path = "${lib_path}/${_lib}" + } + + if $id { + $_id = $id + } else { + $_id = "${mod}_module" + } + + if $loadfile_name { + $_loadfile_name = $loadfile_name + } else { + $_loadfile_name = "${mod}.load" + } + + # Determine if we have a package + $mod_packages = $::apache::params::mod_packages + if $package { + $_package = $package + } elsif has_key($mod_packages, $mod) { # 2.6 compatibility hack + if ($::apache::apache_version == '2.4' and $::operatingsystem =~ /^[Aa]mazon$/) { + # On amazon linux we need to prefix our package name with mod24 instead of mod to support apache 2.4 + $_package = regsubst($mod_packages[$mod],'^(mod_)?(.*)','mod24_\2') + } else { + $_package = $mod_packages[$mod] + } + } else { + $_package = undef + } + if $_package and ! defined(Package[$_package]) { + # note: FreeBSD/ports uses apxs tool to activate modules; apxs clutters + # httpd.conf with 'LoadModule' directives; here, by proper resource + # ordering, we ensure that our version of httpd.conf is reverted after + # the module gets installed. + $package_before = $::osfamily ? { + 'freebsd' => [ + File[$_loadfile_name], + File["${::apache::conf_dir}/${::apache::params::conf_file}"] + ], + default => [ + File[$_loadfile_name], + File[$::apache::confd_dir], + ], + } + # if there are any packages, they should be installed before the associated conf file + Package[$_package] -> File<| title == "${mod}.conf" |> + # $_package may be an array + package { $_package: + ensure => $package_ensure, + require => Package['httpd'], + before => $package_before, + notify => Class['apache::service'], + } + } + + file { $_loadfile_name: + ensure => file, + path => "${mod_dir}/${_loadfile_name}", + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + content => template('apache/mod/load.erb'), + require => [ + Package['httpd'], + Exec["mkdir ${mod_dir}"], + ], + before => File[$mod_dir], + notify => Class['apache::service'], + } + + if $::osfamily == 'Debian' { + $enable_dir = $::apache::mod_enable_dir + file{ "${_loadfile_name} symlink": + ensure => link, + path => "${enable_dir}/${_loadfile_name}", + target => "${mod_dir}/${_loadfile_name}", + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + require => [ + File[$_loadfile_name], + Exec["mkdir ${enable_dir}"], + ], + before => File[$enable_dir], + notify => Class['apache::service'], + } + # Each module may have a .conf file as well, which should be + # defined in the class apache::mod::module + # Some modules do not require this file. + if defined(File["${mod}.conf"]) { + file{ "${mod}.conf symlink": + ensure => link, + path => "${enable_dir}/${mod}.conf", + target => "${mod_dir}/${mod}.conf", + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + require => [ + File["${mod}.conf"], + Exec["mkdir ${enable_dir}"], + ], + before => File[$enable_dir], + notify => Class['apache::service'], + } + } + } elsif $::osfamily == 'Suse' { + $enable_dir = $::apache::mod_enable_dir + file{ "${_loadfile_name} symlink": + ensure => link, + path => "${enable_dir}/${_loadfile_name}", + target => "${mod_dir}/${_loadfile_name}", + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + require => [ + File[$_loadfile_name], + Exec["mkdir ${enable_dir}"], + ], + before => File[$enable_dir], + notify => Class['apache::service'], + } + # Each module may have a .conf file as well, which should be + # defined in the class apache::mod::module + # Some modules do not require this file. + if defined(File["${mod}.conf"]) { + file{ "${mod}.conf symlink": + ensure => link, + path => "${enable_dir}/${mod}.conf", + target => "${mod_dir}/${mod}.conf", + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + require => [ + File["${mod}.conf"], + Exec["mkdir ${enable_dir}"], + ], + before => File[$enable_dir], + notify => Class['apache::service'], + } + } + } + + Apache::Mod[$name] -> Anchor['::apache::modules_set_up'] +} diff --git a/environments/production/modules/apache/manifests/mod/actions.pp b/environments/production/modules/apache/manifests/mod/actions.pp new file mode 100644 index 0000000..3b60f29 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/actions.pp @@ -0,0 +1,3 @@ +class apache::mod::actions { + apache::mod { 'actions': } +} diff --git a/environments/production/modules/apache/manifests/mod/alias.pp b/environments/production/modules/apache/manifests/mod/alias.pp new file mode 100644 index 0000000..4eb42ac --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/alias.pp @@ -0,0 +1,23 @@ +class apache::mod::alias( + $apache_version = undef, + $icons_options = 'Indexes MultiViews', + # set icons_path to false to disable the alias + $icons_path = $::apache::params::alias_icons_path, +) inherits ::apache::params { + include ::apache + $_apache_version = pick($apache_version, $apache::apache_version) + apache::mod { 'alias': } + + # Template uses $icons_path, $_apache_version + if $icons_path { + file { 'alias.conf': + ensure => file, + path => "${::apache::mod_dir}/alias.conf", + mode => $::apache::file_mode, + content => template('apache/mod/alias.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + } +} diff --git a/environments/production/modules/apache/manifests/mod/auth_basic.pp b/environments/production/modules/apache/manifests/mod/auth_basic.pp new file mode 100644 index 0000000..cacfafa --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/auth_basic.pp @@ -0,0 +1,3 @@ +class apache::mod::auth_basic { + ::apache::mod { 'auth_basic': } +} diff --git a/environments/production/modules/apache/manifests/mod/auth_cas.pp b/environments/production/modules/apache/manifests/mod/auth_cas.pp new file mode 100644 index 0000000..673cfb1 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/auth_cas.pp @@ -0,0 +1,57 @@ +class apache::mod::auth_cas ( + $cas_login_url, + $cas_validate_url, + $cas_cookie_path = $::apache::params::cas_cookie_path, + $cas_cookie_path_mode = '0750', + $cas_version = 2, + $cas_debug = 'Off', + $cas_validate_server = undef, + $cas_validate_depth = undef, + $cas_certificate_path = undef, + $cas_proxy_validate_url = undef, + $cas_root_proxied_as = undef, + $cas_cookie_entropy = undef, + $cas_timeout = undef, + $cas_idle_timeout = undef, + $cas_cache_clean_interval = undef, + $cas_cookie_domain = undef, + $cas_cookie_http_only = undef, + $cas_authoritative = undef, + $cas_validate_saml = undef, + $cas_sso_enabled = undef, + $cas_attribute_prefix = undef, + $cas_attribute_delimiter = undef, + $cas_scrub_request_headers = undef, + $suppress_warning = false, +) inherits ::apache::params { + + validate_string($cas_login_url, $cas_validate_url, $cas_cookie_path) + + if $::osfamily == 'RedHat' and ! $suppress_warning { + warning('RedHat distributions do not have Apache mod_auth_cas in their default package repositories.') + } + + include ::apache + ::apache::mod { 'auth_cas': } + + file { $cas_cookie_path: + ensure => directory, + before => File['auth_cas.conf'], + mode => $cas_cookie_path_mode, + owner => $apache::user, + group => $apache::group, + } + + # Template uses + # - All variables beginning with cas_ + file { 'auth_cas.conf': + ensure => file, + path => "${::apache::mod_dir}/auth_cas.conf", + mode => $::apache::file_mode, + content => template('apache/mod/auth_cas.conf.erb'), + require => [ Exec["mkdir ${::apache::mod_dir}"], ], + before => File[$::apache::mod_dir], + notify => Class['Apache::Service'], + } + +} diff --git a/environments/production/modules/apache/manifests/mod/auth_kerb.pp b/environments/production/modules/apache/manifests/mod/auth_kerb.pp new file mode 100644 index 0000000..4b4887f --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/auth_kerb.pp @@ -0,0 +1,7 @@ +class apache::mod::auth_kerb { + include ::apache + include ::apache::mod::authn_core + ::apache::mod { 'auth_kerb': } +} + + diff --git a/environments/production/modules/apache/manifests/mod/auth_mellon.pp b/environments/production/modules/apache/manifests/mod/auth_mellon.pp new file mode 100644 index 0000000..5dbb6b5 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/auth_mellon.pp @@ -0,0 +1,26 @@ +class apache::mod::auth_mellon ( + $mellon_cache_size = $::apache::params::mellon_cache_size, + $mellon_lock_file = $::apache::params::mellon_lock_file, + $mellon_post_directory = $::apache::params::mellon_post_directory, + $mellon_cache_entry_size = undef, + $mellon_post_ttl = undef, + $mellon_post_size = undef, + $mellon_post_count = undef +) inherits ::apache::params { + + include ::apache + ::apache::mod { 'auth_mellon': } + + # Template uses + # - All variables beginning with mellon_ + file { 'auth_mellon.conf': + ensure => file, + path => "${::apache::mod_dir}/auth_mellon.conf", + mode => $::apache::file_mode, + content => template('apache/mod/auth_mellon.conf.erb'), + require => [ Exec["mkdir ${::apache::mod_dir}"], ], + before => File[$::apache::mod_dir], + notify => Class['Apache::Service'], + } + +} diff --git a/environments/production/modules/apache/manifests/mod/authn_core.pp b/environments/production/modules/apache/manifests/mod/authn_core.pp new file mode 100644 index 0000000..c5ce5b1 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/authn_core.pp @@ -0,0 +1,7 @@ +class apache::mod::authn_core( + $apache_version = $::apache::apache_version +) { + if versioncmp($apache_version, '2.4') >= 0 { + ::apache::mod { 'authn_core': } + } +} diff --git a/environments/production/modules/apache/manifests/mod/authn_dbd.pp b/environments/production/modules/apache/manifests/mod/authn_dbd.pp new file mode 100644 index 0000000..be6ff3e --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/authn_dbd.pp @@ -0,0 +1,30 @@ +class apache::mod::authn_dbd ( + $authn_dbd_params, + $authn_dbd_dbdriver = 'mysql', + $authn_dbd_query = undef, + $authn_dbd_min = '4', + $authn_dbd_max = '20', + $authn_dbd_keep = '8', + $authn_dbd_exptime = '300', + $authn_dbd_alias = undef, +) inherits ::apache::params { + include ::apache + include ::apache::mod::dbd + ::apache::mod { 'authn_dbd': } + + if $authn_dbd_alias { + include ::apache::mod::authn_core + } + + # Template uses + # - All variables beginning with authn_dbd + file { 'authn_dbd.conf': + ensure => file, + path => "${::apache::mod_dir}/authn_dbd.conf", + mode => $::apache::file_mode, + content => template('apache/mod/authn_dbd.conf.erb'), + require => [ Exec["mkdir ${::apache::mod_dir}"], ], + before => File[$::apache::mod_dir], + notify => Class['Apache::Service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/authn_file.pp b/environments/production/modules/apache/manifests/mod/authn_file.pp new file mode 100644 index 0000000..bc78724 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/authn_file.pp @@ -0,0 +1,3 @@ +class apache::mod::authn_file { + ::apache::mod { 'authn_file': } +} diff --git a/environments/production/modules/apache/manifests/mod/authnz_ldap.pp b/environments/production/modules/apache/manifests/mod/authnz_ldap.pp new file mode 100644 index 0000000..033c1be --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/authnz_ldap.pp @@ -0,0 +1,34 @@ +# lint:ignore:variable_is_lowercase required for compatibility +class apache::mod::authnz_ldap ( + $verify_server_cert = true, + $verifyServerCert = undef, + $package_name = undef, +) { + include ::apache + include '::apache::mod::ldap' + ::apache::mod { 'authnz_ldap': + package => $package_name, + } + + if $verifyServerCert { + warning('Class[\'apache::mod::authnz_ldap\'] parameter verifyServerCert is deprecated in favor of verify_server_cert') + $_verify_server_cert = $verifyServerCert + } else { + $_verify_server_cert = $verify_server_cert + } + + validate_bool($_verify_server_cert) + + # Template uses: + # - $_verify_server_cert + file { 'authnz_ldap.conf': + ensure => file, + path => "${::apache::mod_dir}/authnz_ldap.conf", + mode => $::apache::file_mode, + content => template('apache/mod/authnz_ldap.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} +# lint:endignore diff --git a/environments/production/modules/apache/manifests/mod/authz_default.pp b/environments/production/modules/apache/manifests/mod/authz_default.pp new file mode 100644 index 0000000..e457774 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/authz_default.pp @@ -0,0 +1,9 @@ +class apache::mod::authz_default( + $apache_version = $::apache::apache_version +) { + if versioncmp($apache_version, '2.4') >= 0 { + warning('apache::mod::authz_default has been removed in Apache 2.4') + } else { + ::apache::mod { 'authz_default': } + } +} diff --git a/environments/production/modules/apache/manifests/mod/authz_user.pp b/environments/production/modules/apache/manifests/mod/authz_user.pp new file mode 100644 index 0000000..948a3e2 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/authz_user.pp @@ -0,0 +1,3 @@ +class apache::mod::authz_user { + ::apache::mod { 'authz_user': } +} diff --git a/environments/production/modules/apache/manifests/mod/autoindex.pp b/environments/production/modules/apache/manifests/mod/autoindex.pp new file mode 100644 index 0000000..67c7580 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/autoindex.pp @@ -0,0 +1,14 @@ +class apache::mod::autoindex { + include ::apache + ::apache::mod { 'autoindex': } + # Template uses no variables + file { 'autoindex.conf': + ensure => file, + path => "${::apache::mod_dir}/autoindex.conf", + mode => $::apache::file_mode, + content => template('apache/mod/autoindex.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/cache.pp b/environments/production/modules/apache/manifests/mod/cache.pp new file mode 100644 index 0000000..4ab9f44 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/cache.pp @@ -0,0 +1,3 @@ +class apache::mod::cache { + ::apache::mod { 'cache': } +} diff --git a/environments/production/modules/apache/manifests/mod/cgi.pp b/environments/production/modules/apache/manifests/mod/cgi.pp new file mode 100644 index 0000000..a41bb6d --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/cgi.pp @@ -0,0 +1,17 @@ +class apache::mod::cgi { + case $::osfamily { + 'FreeBSD': {} + default: { + Class['::apache::mod::prefork'] -> Class['::apache::mod::cgi'] + } + } + + if $::osfamily == 'Suse' { + ::apache::mod { 'cgi': + lib_path => '/usr/lib64/apache2-prefork', + } + } else { + ::apache::mod { 'cgi': } + } + +} diff --git a/environments/production/modules/apache/manifests/mod/cgid.pp b/environments/production/modules/apache/manifests/mod/cgid.pp new file mode 100644 index 0000000..b2cb016 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/cgid.pp @@ -0,0 +1,42 @@ +class apache::mod::cgid { + include ::apache + case $::osfamily { + 'FreeBSD': {} + default: { + if defined(Class['::apache::mod::event']) { + Class['::apache::mod::event'] -> Class['::apache::mod::cgid'] + } else { + Class['::apache::mod::worker'] -> Class['::apache::mod::cgid'] + } + } + } + + # Debian specifies it's cgid sock path, but RedHat uses the default value + # with no config file + $cgisock_path = $::osfamily ? { + 'debian' => "\${APACHE_RUN_DIR}/cgisock", + 'freebsd' => 'cgisock', + default => undef, + } + + if $::osfamily == 'Suse' { + ::apache::mod { 'cgid': + lib_path => '/usr/lib64/apache2-worker', + } + } else { + ::apache::mod { 'cgid': } + } + + if $cgisock_path { + # Template uses $cgisock_path + file { 'cgid.conf': + ensure => file, + path => "${::apache::mod_dir}/cgid.conf", + mode => $::apache::file_mode, + content => template('apache/mod/cgid.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + } +} diff --git a/environments/production/modules/apache/manifests/mod/cluster.pp b/environments/production/modules/apache/manifests/mod/cluster.pp new file mode 100644 index 0000000..a3a9f6c --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/cluster.pp @@ -0,0 +1,38 @@ +class apache::mod::cluster ( + $allowed_network, + $balancer_name, + $ip, + $version, + $enable_mcpm_receive = true, + $port = '6666', + $keep_alive_timeout = 60, + $manager_allowed_network = '127.0.0.1', + $max_keep_alive_requests = 0, + $server_advertise = true, +) { + + include ::apache + + ::apache::mod { 'proxy': } + ::apache::mod { 'proxy_ajp': } + ::apache::mod { 'manager': } + ::apache::mod { 'proxy_cluster': } + ::apache::mod { 'advertise': } + + if (versioncmp($version, '1.3.0') >= 0 ) { + ::apache::mod { 'cluster_slotmem': } + } else { + ::apache::mod { 'slotmem': } + } + + file {'cluster.conf': + ensure => file, + path => "${::apache::mod_dir}/cluster.conf", + mode => $::apache::file_mode, + content => template('apache/mod/cluster.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + +} diff --git a/environments/production/modules/apache/manifests/mod/dav.pp b/environments/production/modules/apache/manifests/mod/dav.pp new file mode 100644 index 0000000..ade9c08 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/dav.pp @@ -0,0 +1,3 @@ +class apache::mod::dav { + ::apache::mod { 'dav': } +} diff --git a/environments/production/modules/apache/manifests/mod/dav_fs.pp b/environments/production/modules/apache/manifests/mod/dav_fs.pp new file mode 100644 index 0000000..60127e3 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/dav_fs.pp @@ -0,0 +1,22 @@ +class apache::mod::dav_fs { + include ::apache + $dav_lock = $::osfamily ? { + 'debian' => "\${APACHE_LOCK_DIR}/DAVLock", + 'freebsd' => '/usr/local/var/DavLock', + default => '/var/lib/dav/lockdb', + } + + Class['::apache::mod::dav'] -> Class['::apache::mod::dav_fs'] + ::apache::mod { 'dav_fs': } + + # Template uses: $dav_lock + file { 'dav_fs.conf': + ensure => file, + path => "${::apache::mod_dir}/dav_fs.conf", + mode => $::apache::file_mode, + content => template('apache/mod/dav_fs.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/dav_svn.pp b/environments/production/modules/apache/manifests/mod/dav_svn.pp new file mode 100644 index 0000000..35d5417 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/dav_svn.pp @@ -0,0 +1,28 @@ +class apache::mod::dav_svn ( + $authz_svn_enabled = false, +) { + Class['::apache::mod::dav'] -> Class['::apache::mod::dav_svn'] + include ::apache + include ::apache::mod::dav + if($::operatingsystem == 'SLES' and $::operatingsystemmajrelease < '12'){ + package { 'subversion-server': + ensure => 'installed', + provider => 'zypper', + } + } + + ::apache::mod { 'dav_svn': } + + if $::osfamily == 'Debian' and ($::operatingsystemmajrelease != '6' and $::operatingsystemmajrelease != '10.04' and $::operatingsystemrelease != '10.04' and $::operatingsystemmajrelease != '16.04') { + $loadfile_name = undef + } else { + $loadfile_name = 'dav_svn_authz_svn.load' + } + + if $authz_svn_enabled { + ::apache::mod { 'authz_svn': + loadfile_name => $loadfile_name, + require => Apache::Mod['dav_svn'], + } + } +} diff --git a/environments/production/modules/apache/manifests/mod/dbd.pp b/environments/production/modules/apache/manifests/mod/dbd.pp new file mode 100644 index 0000000..547acc7 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/dbd.pp @@ -0,0 +1,3 @@ +class apache::mod::dbd { + ::apache::mod { 'dbd': } +} diff --git a/environments/production/modules/apache/manifests/mod/deflate.pp b/environments/production/modules/apache/manifests/mod/deflate.pp new file mode 100644 index 0000000..70ac5be --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/deflate.pp @@ -0,0 +1,27 @@ +class apache::mod::deflate ( + $types = [ + 'text/html text/plain text/xml', + 'text/css', + 'application/x-javascript application/javascript application/ecmascript', + 'application/rss+xml', + 'application/json', + ], + $notes = { + 'Input' => 'instream', + 'Output' => 'outstream', + 'Ratio' => 'ratio', + } +) { + include ::apache + ::apache::mod { 'deflate': } + + file { 'deflate.conf': + ensure => file, + path => "${::apache::mod_dir}/deflate.conf", + mode => $::apache::file_mode, + content => template('apache/mod/deflate.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/dev.pp b/environments/production/modules/apache/manifests/mod/dev.pp new file mode 100644 index 0000000..5abdedd --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/dev.pp @@ -0,0 +1,5 @@ +class apache::mod::dev { + # Development packages are not apache modules + warning('apache::mod::dev is deprecated; please use apache::dev') + include ::apache::dev +} diff --git a/environments/production/modules/apache/manifests/mod/dir.pp b/environments/production/modules/apache/manifests/mod/dir.pp new file mode 100644 index 0000000..e41aa86 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/dir.pp @@ -0,0 +1,23 @@ +# Note: this sets the global DirectoryIndex directive, it may be necessary to consider being able to modify the apache::vhost to declare DirectoryIndex statements in a vhost configuration +# Parameters: +# - $indexes provides a string for the DirectoryIndex directive http://httpd.apache.org/docs/current/mod/mod_dir.html#directoryindex +class apache::mod::dir ( + $dir = 'public_html', + $indexes = ['index.html','index.html.var','index.cgi','index.pl','index.php','index.xhtml'], +) { + validate_array($indexes) + include ::apache + ::apache::mod { 'dir': } + + # Template uses + # - $indexes + file { 'dir.conf': + ensure => file, + path => "${::apache::mod_dir}/dir.conf", + mode => $::apache::file_mode, + content => template('apache/mod/dir.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/disk_cache.pp b/environments/production/modules/apache/manifests/mod/disk_cache.pp new file mode 100644 index 0000000..7cd7270 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/disk_cache.pp @@ -0,0 +1,42 @@ +class apache::mod::disk_cache ( + $cache_root = undef, +) { + include ::apache + if $cache_root { + $_cache_root = $cache_root + } + elsif versioncmp($::apache::apache_version, '2.4') >= 0 { + $_cache_root = $::osfamily ? { + 'debian' => '/var/cache/apache2/mod_cache_disk', + 'redhat' => '/var/cache/httpd/proxy', + 'freebsd' => '/var/cache/mod_cache_disk', + } + } + else { + $_cache_root = $::osfamily ? { + 'debian' => '/var/cache/apache2/mod_disk_cache', + 'redhat' => '/var/cache/mod_proxy', + 'freebsd' => '/var/cache/mod_disk_cache', + } + } + + if versioncmp($::apache::apache_version, '2.4') >= 0 { + apache::mod { 'cache_disk': } + } + else { + apache::mod { 'disk_cache': } + } + + Class['::apache::mod::cache'] -> Class['::apache::mod::disk_cache'] + + # Template uses $_cache_root + file { 'disk_cache.conf': + ensure => file, + path => "${::apache::mod_dir}/disk_cache.conf", + mode => $::apache::file_mode, + content => template('apache/mod/disk_cache.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/dumpio.pp b/environments/production/modules/apache/manifests/mod/dumpio.pp new file mode 100644 index 0000000..6227616 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/dumpio.pp @@ -0,0 +1,20 @@ +class apache::mod::dumpio( + $dump_io_input = 'Off', + $dump_io_output = 'Off', +) { + include ::apache + validate_re(downcase($dump_io_input), '^(on|off)$', "${dump_io_input} is not supported for dump_io_input. Allowed values are 'On' and 'Off'.") + validate_re(downcase($dump_io_output), '^(on|off)$', "${dump_io_output} is not supported for dump_io_output. Allowed values are 'On' and 'Off'.") + + ::apache::mod { 'dumpio': } + file{'dumpio.conf': + ensure => file, + path => "${::apache::mod_dir}/dumpio.conf", + mode => $::apache::file_mode, + content => template('apache/mod/dumpio.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + +} diff --git a/environments/production/modules/apache/manifests/mod/env.pp b/environments/production/modules/apache/manifests/mod/env.pp new file mode 100644 index 0000000..b973005 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/env.pp @@ -0,0 +1,3 @@ +class apache::mod::env { + ::apache::mod { 'env': } +} diff --git a/environments/production/modules/apache/manifests/mod/event.pp b/environments/production/modules/apache/manifests/mod/event.pp new file mode 100644 index 0000000..a873959 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/event.pp @@ -0,0 +1,76 @@ +class apache::mod::event ( + $startservers = '2', + $maxclients = '150', + $maxrequestworkers = undef, + $minsparethreads = '25', + $maxsparethreads = '75', + $threadsperchild = '25', + $maxrequestsperchild = '0', + $maxconnectionsperchild = undef, + $serverlimit = '25', + $apache_version = undef, + $threadlimit = '64', + $listenbacklog = '511', +) { + include ::apache + + $_apache_version = pick($apache_version, $apache::apache_version) + + if defined(Class['apache::mod::itk']) { + fail('May not include both apache::mod::event and apache::mod::itk on the same node') + } + if defined(Class['apache::mod::peruser']) { + fail('May not include both apache::mod::event and apache::mod::peruser on the same node') + } + if defined(Class['apache::mod::prefork']) { + fail('May not include both apache::mod::event and apache::mod::prefork on the same node') + } + if defined(Class['apache::mod::worker']) { + fail('May not include both apache::mod::event and apache::mod::worker on the same node') + } + File { + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + } + + # Template uses: + # - $startservers + # - $maxclients + # - $minsparethreads + # - $maxsparethreads + # - $threadsperchild + # - $maxrequestsperchild + # - $serverlimit + file { "${::apache::mod_dir}/event.conf": + ensure => file, + mode => $::apache::file_mode, + content => template('apache/mod/event.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + + case $::osfamily { + 'redhat': { + if versioncmp($_apache_version, '2.4') >= 0 { + apache::mpm{ 'event': + apache_version => $_apache_version, + } + } + } + 'debian','freebsd' : { + apache::mpm{ 'event': + apache_version => $_apache_version, + } + } + 'gentoo': { + ::portage::makeconf { 'apache2_mpms': + content => 'event', + } + } + default: { + fail("Unsupported osfamily ${::osfamily}") + } + } +} diff --git a/environments/production/modules/apache/manifests/mod/expires.pp b/environments/production/modules/apache/manifests/mod/expires.pp new file mode 100644 index 0000000..07ec82e --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/expires.pp @@ -0,0 +1,22 @@ +class apache::mod::expires ( + $expires_active = true, + $expires_default = undef, + $expires_by_type = undef, +) { + include ::apache + ::apache::mod { 'expires': } + + # Template uses + # $expires_active + # $expires_default + # $expires_by_type + file { 'expires.conf': + ensure => file, + path => "${::apache::mod_dir}/expires.conf", + mode => $::apache::file_mode, + content => template('apache/mod/expires.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/ext_filter.pp b/environments/production/modules/apache/manifests/mod/ext_filter.pp new file mode 100644 index 0000000..aa14c10 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/ext_filter.pp @@ -0,0 +1,25 @@ +class apache::mod::ext_filter( + $ext_filter_define = undef +) { + include ::apache + if $ext_filter_define { + validate_hash($ext_filter_define) + } + + ::apache::mod { 'ext_filter': } + + # Template uses + # -$ext_filter_define + + if $ext_filter_define { + file { 'ext_filter.conf': + ensure => file, + path => "${::apache::mod_dir}/ext_filter.conf", + mode => $::apache::file_mode, + content => template('apache/mod/ext_filter.conf.erb'), + require => [ Exec["mkdir ${::apache::mod_dir}"], ], + before => File[$::apache::mod_dir], + notify => Class['Apache::Service'], + } + } +} diff --git a/environments/production/modules/apache/manifests/mod/fastcgi.pp b/environments/production/modules/apache/manifests/mod/fastcgi.pp new file mode 100644 index 0000000..543a322 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/fastcgi.pp @@ -0,0 +1,26 @@ +class apache::mod::fastcgi { + include ::apache + + # Debian specifies it's fastcgi lib path, but RedHat uses the default value + # with no config file + $fastcgi_lib_path = $::apache::params::fastcgi_lib_path + + ::apache::mod { 'fastcgi': } + + if $fastcgi_lib_path { + # Template uses: + # - $fastcgi_server + # - $fastcgi_socket + # - $fastcgi_dir + file { 'fastcgi.conf': + ensure => file, + path => "${::apache::mod_dir}/fastcgi.conf", + mode => $::apache::file_mode, + content => template('apache/mod/fastcgi.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + } + +} diff --git a/environments/production/modules/apache/manifests/mod/fcgid.pp b/environments/production/modules/apache/manifests/mod/fcgid.pp new file mode 100644 index 0000000..0e99a9b --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/fcgid.pp @@ -0,0 +1,28 @@ +class apache::mod::fcgid( + $options = {}, +) { + include ::apache + if ($::osfamily == 'RedHat' and $::operatingsystemmajrelease == '7') or $::osfamily == 'FreeBSD' { + $loadfile_name = 'unixd_fcgid.load' + $conf_name = 'unixd_fcgid.conf' + } else { + $loadfile_name = undef + $conf_name = 'fcgid.conf' + } + + ::apache::mod { 'fcgid': + loadfile_name => $loadfile_name, + } + + # Template uses: + # - $options + file { $conf_name: + ensure => file, + path => "${::apache::mod_dir}/${conf_name}", + mode => $::apache::file_mode, + content => template('apache/mod/fcgid.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/filter.pp b/environments/production/modules/apache/manifests/mod/filter.pp new file mode 100644 index 0000000..26dc488 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/filter.pp @@ -0,0 +1,3 @@ +class apache::mod::filter { + ::apache::mod { 'filter': } +} diff --git a/environments/production/modules/apache/manifests/mod/geoip.pp b/environments/production/modules/apache/manifests/mod/geoip.pp new file mode 100644 index 0000000..66ae887 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/geoip.pp @@ -0,0 +1,33 @@ +class apache::mod::geoip ( + $enable = false, + $db_file = '/usr/share/GeoIP/GeoIP.dat', + $flag = 'Standard', + $output = 'All', + $enable_utf8 = undef, + $scan_proxy_headers = undef, + $scan_proxy_header_field = undef, + $use_last_xforwarededfor_ip = undef, +) { + include ::apache + ::apache::mod { 'geoip': } + + # Template uses: + # - enable + # - db_file + # - flag + # - output + # - enable_utf8 + # - scan_proxy_headers + # - scan_proxy_header_field + # - use_last_xforwarededfor_ip + file { 'geoip.conf': + ensure => file, + path => "${::apache::mod_dir}/geoip.conf", + mode => $::apache::file_mode, + content => template('apache/mod/geoip.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + +} diff --git a/environments/production/modules/apache/manifests/mod/headers.pp b/environments/production/modules/apache/manifests/mod/headers.pp new file mode 100644 index 0000000..d18c5e2 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/headers.pp @@ -0,0 +1,3 @@ +class apache::mod::headers { + ::apache::mod { 'headers': } +} diff --git a/environments/production/modules/apache/manifests/mod/include.pp b/environments/production/modules/apache/manifests/mod/include.pp new file mode 100644 index 0000000..edbe81f --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/include.pp @@ -0,0 +1,3 @@ +class apache::mod::include { + ::apache::mod { 'include': } +} diff --git a/environments/production/modules/apache/manifests/mod/info.pp b/environments/production/modules/apache/manifests/mod/info.pp new file mode 100644 index 0000000..c6f1355 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/info.pp @@ -0,0 +1,33 @@ +class apache::mod::info ( + $allow_from = ['127.0.0.1','::1'], + $apache_version = undef, + $restrict_access = true, + $info_path = '/server-info', +){ + include ::apache + $_apache_version = pick($apache_version, $apache::apache_version) + + if $::osfamily == 'Suse' { + if defined(Class['::apache::mod::worker']){ + $suse_path = '/usr/lib64/apache2-worker' + } else { + $suse_path = '/usr/lib64/apache2-prefork' + } + ::apache::mod { 'info': + lib_path => $suse_path, + } + } else { + ::apache::mod { 'info': } + } + + # Template uses $allow_from, $_apache_version + file { 'info.conf': + ensure => file, + path => "${::apache::mod_dir}/info.conf", + mode => $::apache::file_mode, + content => template('apache/mod/info.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/itk.pp b/environments/production/modules/apache/manifests/mod/itk.pp new file mode 100644 index 0000000..8ceb56d --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/itk.pp @@ -0,0 +1,96 @@ +class apache::mod::itk ( + $startservers = '8', + $minspareservers = '5', + $maxspareservers = '20', + $serverlimit = '256', + $maxclients = '256', + $maxrequestsperchild = '4000', + $apache_version = undef, +) { + include ::apache + + $_apache_version = pick($apache_version, $apache::apache_version) + + if defined(Class['apache::mod::event']) { + fail('May not include both apache::mod::itk and apache::mod::event on the same node') + } + if defined(Class['apache::mod::peruser']) { + fail('May not include both apache::mod::itk and apache::mod::peruser on the same node') + } + if versioncmp($_apache_version, '2.4') < 0 { + if defined(Class['apache::mod::prefork']) { + fail('May not include both apache::mod::itk and apache::mod::prefork on the same node') + } + } else { + # prefork is a requirement for itk in 2.4; except on FreeBSD and Gentoo, which are special + if $::osfamily =~ /^(FreeBSD|Gentoo)/ { + if defined(Class['apache::mod::prefork']) { + fail('May not include both apache::mod::itk and apache::mod::prefork on the same node') + } + } else { + if ! defined(Class['apache::mod::prefork']) { + include ::apache::mod::prefork + } + } + } + if defined(Class['apache::mod::worker']) { + fail('May not include both apache::mod::itk and apache::mod::worker on the same node') + } + File { + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + } + + # Template uses: + # - $startservers + # - $minspareservers + # - $maxspareservers + # - $serverlimit + # - $maxclients + # - $maxrequestsperchild + file { "${::apache::mod_dir}/itk.conf": + ensure => file, + mode => $::apache::file_mode, + content => template('apache/mod/itk.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + + case $::osfamily { + 'redhat': { + package { 'httpd-itk': + ensure => present, + } + if versioncmp($_apache_version, '2.4') >= 0 { + ::apache::mpm{ 'itk': + apache_version => $_apache_version, + } + } + else { + file_line { '/etc/sysconfig/httpd itk enable': + ensure => present, + path => '/etc/sysconfig/httpd', + line => 'HTTPD=/usr/sbin/httpd.itk', + match => '#?HTTPD=/usr/sbin/httpd.itk', + require => Package['httpd'], + notify => Class['apache::service'], + } + } + } + 'debian', 'freebsd': { + apache::mpm{ 'itk': + apache_version => $_apache_version, + } + } + 'gentoo': { + ::portage::makeconf { 'apache2_mpms': + content => 'itk', + } + } + default: { + fail("Unsupported osfamily ${::osfamily}") + } + } +} diff --git a/environments/production/modules/apache/manifests/mod/ldap.pp b/environments/production/modules/apache/manifests/mod/ldap.pp new file mode 100644 index 0000000..c3fbb26 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/ldap.pp @@ -0,0 +1,30 @@ +class apache::mod::ldap ( + $apache_version = undef, + $package_name = undef, + $ldap_trusted_global_cert_file = undef, + $ldap_trusted_global_cert_type = 'CA_BASE64', + $ldap_shared_cache_size = undef, + $ldap_cache_entries = undef, + $ldap_cache_ttl = undef, + $ldap_opcache_entries = undef, + $ldap_opcache_ttl = undef, +){ + include ::apache + $_apache_version = pick($apache_version, $apache::apache_version) + if ($ldap_trusted_global_cert_file) { + validate_string($ldap_trusted_global_cert_type) + } + ::apache::mod { 'ldap': + package => $package_name, + } + # Template uses $_apache_version + file { 'ldap.conf': + ensure => file, + path => "${::apache::mod_dir}/ldap.conf", + mode => $::apache::file_mode, + content => template('apache/mod/ldap.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/mime.pp b/environments/production/modules/apache/manifests/mod/mime.pp new file mode 100644 index 0000000..f686930 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/mime.pp @@ -0,0 +1,25 @@ +class apache::mod::mime ( + $mime_support_package = $::apache::params::mime_support_package, + $mime_types_config = $::apache::params::mime_types_config, + $mime_types_additional = undef, +) inherits ::apache::params { + include ::apache + $_mime_types_additional = pick($mime_types_additional, $apache::mime_types_additional) + apache::mod { 'mime': } + # Template uses $_mime_types_config + file { 'mime.conf': + ensure => file, + path => "${::apache::mod_dir}/mime.conf", + mode => $::apache::file_mode, + content => template('apache/mod/mime.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + if $mime_support_package { + package { $mime_support_package: + ensure => 'installed', + before => File['mime.conf'], + } + } +} diff --git a/environments/production/modules/apache/manifests/mod/mime_magic.pp b/environments/production/modules/apache/manifests/mod/mime_magic.pp new file mode 100644 index 0000000..ecc74cf --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/mime_magic.pp @@ -0,0 +1,17 @@ +class apache::mod::mime_magic ( + $magic_file = undef, +) { + include ::apache + $_magic_file = pick($magic_file, "${::apache::conf_dir}/magic") + apache::mod { 'mime_magic': } + # Template uses $magic_file + file { 'mime_magic.conf': + ensure => file, + path => "${::apache::mod_dir}/mime_magic.conf", + mode => $::apache::file_mode, + content => template('apache/mod/mime_magic.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/negotiation.pp b/environments/production/modules/apache/manifests/mod/negotiation.pp new file mode 100644 index 0000000..c7c34b8 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/negotiation.pp @@ -0,0 +1,27 @@ +class apache::mod::negotiation ( + $force_language_priority = 'Prefer Fallback', + $language_priority = [ 'en', 'ca', 'cs', 'da', 'de', 'el', 'eo', 'es', 'et', + 'fr', 'he', 'hr', 'it', 'ja', 'ko', 'ltz', 'nl', 'nn', + 'no', 'pl', 'pt', 'pt-BR', 'ru', 'sv', 'zh-CN', + 'zh-TW' ], +) { + include ::apache + if !is_array($force_language_priority) and !is_string($force_language_priority) { + fail('force_languague_priority must be a string or array of strings') + } + if !is_array($language_priority) and !is_string($language_priority) { + fail('force_languague_priority must be a string or array of strings') + } + + ::apache::mod { 'negotiation': } + # Template uses no variables + file { 'negotiation.conf': + ensure => file, + mode => $::apache::file_mode, + path => "${::apache::mod_dir}/negotiation.conf", + content => template('apache/mod/negotiation.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/nss.pp b/environments/production/modules/apache/manifests/mod/nss.pp new file mode 100644 index 0000000..8814c93 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/nss.pp @@ -0,0 +1,28 @@ +class apache::mod::nss ( + $transfer_log = "${::apache::params::logroot}/access.log", + $error_log = "${::apache::params::logroot}/error.log", + $passwd_file = undef, + $port = 8443, +) { + include ::apache + include ::apache::mod::mime + + apache::mod { 'nss': } + + $httpd_dir = $::apache::httpd_dir + + # Template uses: + # $transfer_log + # $error_log + # $http_dir + # passwd_file + file { 'nss.conf': + ensure => file, + path => "${::apache::mod_dir}/nss.conf", + mode => $::apache::file_mode, + content => template('apache/mod/nss.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/pagespeed.pp b/environments/production/modules/apache/manifests/mod/pagespeed.pp new file mode 100644 index 0000000..052dad0 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/pagespeed.pp @@ -0,0 +1,60 @@ +class apache::mod::pagespeed ( + $inherit_vhost_config = 'on', + $filter_xhtml = false, + $cache_path = '/var/cache/mod_pagespeed/', + $log_dir = '/var/log/pagespeed', + $memcache_servers = [], + $rewrite_level = 'CoreFilters', + $disable_filters = [], + $enable_filters = [], + $forbid_filters = [], + $rewrite_deadline_per_flush_ms = 10, + $additional_domains = undef, + $file_cache_size_kb = 102400, + $file_cache_clean_interval_ms = 3600000, + $lru_cache_per_process = 1024, + $lru_cache_byte_limit = 16384, + $css_flatten_max_bytes = 2048, + $css_inline_max_bytes = 2048, + $css_image_inline_max_bytes = 2048, + $image_inline_max_bytes = 2048, + $js_inline_max_bytes = 2048, + $css_outline_min_bytes = 3000, + $js_outline_min_bytes = 3000, + $inode_limit = 500000, + $image_max_rewrites_at_once = 8, + $num_rewrite_threads = 4, + $num_expensive_rewrite_threads = 4, + $collect_statistics = 'on', + $statistics_logging = 'on', + $allow_view_stats = [], + $allow_pagespeed_console = [], + $allow_pagespeed_message = [], + $message_buffer_size = 100000, + $additional_configuration = {}, + $apache_version = undef, + $package_ensure = undef, +){ + include ::apache + $_apache_version = pick($apache_version, $apache::apache_version) + $_lib = $_apache_version ? { + '2.4' => 'mod_pagespeed_ap24.so', + default => undef + } + + apache::mod { 'pagespeed': + lib => $_lib, + package_ensure => $package_ensure, + } + + # Template uses $_apache_version + file { 'pagespeed.conf': + ensure => file, + path => "${::apache::mod_dir}/pagespeed.conf", + mode => $::apache::file_mode, + content => template('apache/mod/pagespeed.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/passenger.pp b/environments/production/modules/apache/manifests/mod/passenger.pp new file mode 100644 index 0000000..35b4eff --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/passenger.pp @@ -0,0 +1,120 @@ +class apache::mod::passenger ( + $passenger_conf_file = $::apache::params::passenger_conf_file, + $passenger_conf_package_file = $::apache::params::passenger_conf_package_file, + $passenger_high_performance = undef, + $passenger_pool_idle_time = undef, + $passenger_max_request_queue_size = undef, + $passenger_max_requests = undef, + $passenger_spawn_method = undef, + $passenger_stat_throttle_rate = undef, + $rack_autodetect = undef, + $rails_autodetect = undef, + $passenger_root = $::apache::params::passenger_root, + $passenger_ruby = $::apache::params::passenger_ruby, + $passenger_default_ruby = $::apache::params::passenger_default_ruby, + $passenger_max_pool_size = undef, + $passenger_min_instances = undef, + $passenger_max_instances_per_app = undef, + $passenger_use_global_queue = undef, + $passenger_app_env = undef, + $passenger_log_file = undef, + $passenger_log_level = undef, + $passenger_data_buffer_dir = undef, + $manage_repo = true, + $mod_package = undef, + $mod_package_ensure = undef, + $mod_lib = undef, + $mod_lib_path = undef, + $mod_id = undef, + $mod_path = undef, +) inherits ::apache::params { + include ::apache + if $passenger_spawn_method { + validate_re($passenger_spawn_method, '(^smart$|^direct$|^smart-lv2$|^conservative$)', "${passenger_spawn_method} is not permitted for passenger_spawn_method. Allowed values are 'smart', 'direct', 'smart-lv2', or 'conservative'.") + } + if $passenger_log_file { + validate_absolute_path($passenger_log_file) + } + + # Managed by the package, but declare it to avoid purging + if $passenger_conf_package_file { + file { 'passenger_package.conf': + path => "${::apache::confd_dir}/${passenger_conf_package_file}", + } + } + + $_package = $mod_package + $_package_ensure = $mod_package_ensure + $_lib = $mod_lib + if $::osfamily == 'FreeBSD' { + if $mod_lib_path { + $_lib_path = $mod_lib_path + } else { + $_lib_path = "${passenger_root}/buildout/apache2" + } + } else { + $_lib_path = $mod_lib_path + } + + if $::osfamily == 'RedHat' and $manage_repo { + if $::operatingsystem == 'Amazon' { + $baseurl = 'https://oss-binaries.phusionpassenger.com/yum/passenger/el/6Server/$basearch' + } else { + $baseurl = 'https://oss-binaries.phusionpassenger.com/yum/passenger/el/$releasever/$basearch' + } + + yumrepo { 'passenger': + ensure => 'present', + baseurl => $baseurl, + descr => 'passenger', + enabled => '1', + gpgcheck => '0', + gpgkey => 'https://packagecloud.io/gpg.key', + repo_gpgcheck => '1', + sslcacert => '/etc/pki/tls/certs/ca-bundle.crt', + sslverify => '1', + before => Apache::Mod['passenger'], + } + } + + unless ($::operatingsystem == 'SLES') { + $_id = $mod_id + $_path = $mod_path + ::apache::mod { 'passenger': + package => $_package, + package_ensure => $_package_ensure, + lib => $_lib, + lib_path => $_lib_path, + id => $_id, + path => $_path, + loadfile_name => 'zpassenger.load', + } + } + + # Template uses: + # - $passenger_root + # - $passenger_ruby + # - $passenger_default_ruby + # - $passenger_max_pool_size + # - $passenger_min_instances + # - $passenger_max_instances_per_app + # - $passenger_high_performance + # - $passenger_max_requests + # - $passenger_spawn_method + # - $passenger_stat_throttle_rate + # - $passenger_use_global_queue + # - $passenger_log_file + # - $passenger_log_level + # - $passenger_app_env + # - $passenger_data_buffer_dir + # - $rack_autodetect + # - $rails_autodetect + file { 'passenger.conf': + ensure => file, + path => "${::apache::mod_dir}/${passenger_conf_file}", + content => template('apache/mod/passenger.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/perl.pp b/environments/production/modules/apache/manifests/mod/perl.pp new file mode 100644 index 0000000..3bfeac9 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/perl.pp @@ -0,0 +1,4 @@ +class apache::mod::perl { + include ::apache + ::apache::mod { 'perl': } +} diff --git a/environments/production/modules/apache/manifests/mod/peruser.pp b/environments/production/modules/apache/manifests/mod/peruser.pp new file mode 100644 index 0000000..5683dd6 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/peruser.pp @@ -0,0 +1,77 @@ +class apache::mod::peruser ( + $minspareprocessors = '2', + $minprocessors = '2', + $maxprocessors = '10', + $maxclients = '150', + $maxrequestsperchild = '1000', + $idletimeout = '120', + $expiretimeout = '120', + $keepalive = 'Off', +) { + include ::apache + case $::osfamily { + 'freebsd' : { + fail("Unsupported osfamily ${::osfamily}") + } + default: { + if $::osfamily == 'gentoo' { + ::portage::makeconf { 'apache2_mpms': + content => 'peruser', + } + } + + if defined(Class['apache::mod::event']) { + fail('May not include both apache::mod::peruser and apache::mod::event on the same node') + } + if defined(Class['apache::mod::itk']) { + fail('May not include both apache::mod::peruser and apache::mod::itk on the same node') + } + if defined(Class['apache::mod::prefork']) { + fail('May not include both apache::mod::peruser and apache::mod::prefork on the same node') + } + if defined(Class['apache::mod::worker']) { + fail('May not include both apache::mod::peruser and apache::mod::worker on the same node') + } + File { + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + } + + $mod_dir = $::apache::mod_dir + + # Template uses: + # - $minspareprocessors + # - $minprocessors + # - $maxprocessors + # - $maxclients + # - $maxrequestsperchild + # - $idletimeout + # - $expiretimeout + # - $keepalive + # - $mod_dir + file { "${::apache::mod_dir}/peruser.conf": + ensure => file, + mode => $::apache::file_mode, + content => template('apache/mod/peruser.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + file { "${::apache::mod_dir}/peruser": + ensure => directory, + require => File[$::apache::mod_dir], + } + file { "${::apache::mod_dir}/peruser/multiplexers": + ensure => directory, + require => File["${::apache::mod_dir}/peruser"], + } + file { "${::apache::mod_dir}/peruser/processors": + ensure => directory, + require => File["${::apache::mod_dir}/peruser"], + } + + ::apache::peruser::multiplexer { '01-default': } + } + } +} diff --git a/environments/production/modules/apache/manifests/mod/php.pp b/environments/production/modules/apache/manifests/mod/php.pp new file mode 100644 index 0000000..9b3b5b8 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/php.pp @@ -0,0 +1,94 @@ +class apache::mod::php ( + $package_name = undef, + $package_ensure = 'present', + $path = undef, + $extensions = ['.php'], + $content = undef, + $template = 'apache/mod/php.conf.erb', + $source = undef, + $root_group = $::apache::params::root_group, + $php_version = $::apache::params::php_version, +) inherits apache::params { + include ::apache + $mod = "php${php_version}" + + if defined(Class['::apache::mod::prefork']) { + Class['::apache::mod::prefork']->File["${mod}.conf"] + } + elsif defined(Class['::apache::mod::itk']) { + Class['::apache::mod::itk']->File["${mod}.conf"] + } + else { + fail('apache::mod::php requires apache::mod::prefork or apache::mod::itk; please enable mpm_module => \'prefork\' or mpm_module => \'itk\' on Class[\'apache\']') + } + validate_array($extensions) + + if $source and ($content or $template != 'apache/mod/php.conf.erb') { + warning('source and content or template parameters are provided. source parameter will be used') + } elsif $content and $template != 'apache/mod/php.conf.erb' { + warning('content and template parameters are provided. content parameter will be used') + } + + $manage_content = $source ? { + undef => $content ? { + undef => template($template), + default => $content, + }, + default => undef, + } + + # Determine if we have a package + $mod_packages = $::apache::params::mod_packages + if $package_name { + $_package_name = $package_name + } elsif has_key($mod_packages, $mod) { # 2.6 compatibility hack + $_package_name = $mod_packages[$mod] + } elsif has_key($mod_packages, 'phpXXX') { # 2.6 compatibility hack + $_package_name = regsubst($mod_packages['phpXXX'], 'XXX', $php_version) + } else { + $_package_name = undef + } + + $_lib = "libphp${php_version}.so" + $_php_major = regsubst($php_version, '^(\d+)\..*$', '\1') + + if $::operatingsystem == 'SLES' { + ::apache::mod { $mod: + package => $_package_name, + package_ensure => $package_ensure, + lib => 'mod_php5.so', + id => "php${_php_major}_module", + path => "${::apache::lib_path}/mod_php5.so", + } + } else { + ::apache::mod { $mod: + package => $_package_name, + package_ensure => $package_ensure, + lib => $_lib, + id => "php${_php_major}_module", + path => $path, + } + + } + + + include ::apache::mod::mime + include ::apache::mod::dir + Class['::apache::mod::mime'] -> Class['::apache::mod::dir'] -> Class['::apache::mod::php'] + + # Template uses $extensions + file { "${mod}.conf": + ensure => file, + path => "${::apache::mod_dir}/${mod}.conf", + owner => 'root', + group => $root_group, + mode => $::apache::file_mode, + content => $manage_content, + source => $source, + require => [ + Exec["mkdir ${::apache::mod_dir}"], + ], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/prefork.pp b/environments/production/modules/apache/manifests/mod/prefork.pp new file mode 100644 index 0000000..f35551c --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/prefork.pp @@ -0,0 +1,85 @@ +class apache::mod::prefork ( + $startservers = '8', + $minspareservers = '5', + $maxspareservers = '20', + $serverlimit = '256', + $maxclients = '256', + $maxrequestsperchild = '4000', + $apache_version = undef, +) { + include ::apache + $_apache_version = pick($apache_version, $apache::apache_version) + if defined(Class['apache::mod::event']) { + fail('May not include both apache::mod::prefork and apache::mod::event on the same node') + } + if versioncmp($_apache_version, '2.4') < 0 { + if defined(Class['apache::mod::itk']) { + fail('May not include both apache::mod::prefork and apache::mod::itk on the same node') + } + } + if defined(Class['apache::mod::peruser']) { + fail('May not include both apache::mod::prefork and apache::mod::peruser on the same node') + } + if defined(Class['apache::mod::worker']) { + fail('May not include both apache::mod::prefork and apache::mod::worker on the same node') + } + File { + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + } + + # Template uses: + # - $startservers + # - $minspareservers + # - $maxspareservers + # - $serverlimit + # - $maxclients + # - $maxrequestsperchild + file { "${::apache::mod_dir}/prefork.conf": + ensure => file, + content => template('apache/mod/prefork.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + + case $::osfamily { + 'redhat': { + if versioncmp($_apache_version, '2.4') >= 0 { + ::apache::mpm{ 'prefork': + apache_version => $_apache_version, + } + } + else { + file_line { '/etc/sysconfig/httpd prefork enable': + ensure => present, + path => '/etc/sysconfig/httpd', + line => '#HTTPD=/usr/sbin/httpd.worker', + match => '#?HTTPD=/usr/sbin/httpd.worker', + require => Package['httpd'], + notify => Class['apache::service'], + } + } + } + 'debian', 'freebsd': { + ::apache::mpm{ 'prefork': + apache_version => $_apache_version, + } + } + 'Suse': { + ::apache::mpm{ 'prefork': + apache_version => $apache_version, + lib_path => '/usr/lib64/apache2-prefork', + } + } + 'gentoo': { + ::portage::makeconf { 'apache2_mpms': + content => 'prefork', + } + } + default: { + fail("Unsupported osfamily ${::osfamily}") + } + } +} diff --git a/environments/production/modules/apache/manifests/mod/proxy.pp b/environments/production/modules/apache/manifests/mod/proxy.pp new file mode 100644 index 0000000..ce82cb3 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/proxy.pp @@ -0,0 +1,23 @@ +class apache::mod::proxy ( + $proxy_requests = 'Off', + $allow_from = undef, + $apache_version = undef, + $package_name = undef, + $proxy_via = 'On', +) { + include ::apache + $_apache_version = pick($apache_version, $apache::apache_version) + ::apache::mod { 'proxy': + package => $package_name, + } + # Template uses $proxy_requests, $_apache_version + file { 'proxy.conf': + ensure => file, + path => "${::apache::mod_dir}/proxy.conf", + mode => $::apache::file_mode, + content => template('apache/mod/proxy.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/proxy_ajp.pp b/environments/production/modules/apache/manifests/mod/proxy_ajp.pp new file mode 100644 index 0000000..a011a17 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/proxy_ajp.pp @@ -0,0 +1,4 @@ +class apache::mod::proxy_ajp { + Class['::apache::mod::proxy'] -> Class['::apache::mod::proxy_ajp'] + ::apache::mod { 'proxy_ajp': } +} diff --git a/environments/production/modules/apache/manifests/mod/proxy_balancer.pp b/environments/production/modules/apache/manifests/mod/proxy_balancer.pp new file mode 100644 index 0000000..fdb4b83 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/proxy_balancer.pp @@ -0,0 +1,32 @@ +class apache::mod::proxy_balancer( + $manager = false, + $manager_path = '/balancer-manager', + $allow_from = ['127.0.0.1','::1'], + $apache_version = $::apache::apache_version, +) { + validate_bool($manager) + validate_string($manager_path) + validate_array($allow_from) + + include ::apache::mod::proxy + include ::apache::mod::proxy_http + if versioncmp($apache_version, '2.4') >= 0 { + ::apache::mod { 'slotmem_shm': } + } + + Class['::apache::mod::proxy'] -> Class['::apache::mod::proxy_balancer'] + Class['::apache::mod::proxy_http'] -> Class['::apache::mod::proxy_balancer'] + ::apache::mod { 'proxy_balancer': } + if $manager { + include ::apache::mod::status + file { 'proxy_balancer.conf': + ensure => file, + path => "${::apache::mod_dir}/proxy_balancer.conf", + mode => $::apache::file_mode, + content => template('apache/mod/proxy_balancer.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + } +} diff --git a/environments/production/modules/apache/manifests/mod/proxy_connect.pp b/environments/production/modules/apache/manifests/mod/proxy_connect.pp new file mode 100644 index 0000000..cda5b89 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/proxy_connect.pp @@ -0,0 +1,10 @@ +class apache::mod::proxy_connect ( + $apache_version = undef, +) { + include ::apache + $_apache_version = pick($apache_version, $apache::apache_version) + if versioncmp($_apache_version, '2.2') >= 0 { + Class['::apache::mod::proxy'] -> Class['::apache::mod::proxy_connect'] + ::apache::mod { 'proxy_connect': } + } +} diff --git a/environments/production/modules/apache/manifests/mod/proxy_fcgi.pp b/environments/production/modules/apache/manifests/mod/proxy_fcgi.pp new file mode 100644 index 0000000..21473eb --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/proxy_fcgi.pp @@ -0,0 +1,4 @@ +class apache::mod::proxy_fcgi { + Class['::apache::mod::proxy'] -> Class['::apache::mod::proxy_fcgi'] + ::apache::mod { 'proxy_fcgi': } +} diff --git a/environments/production/modules/apache/manifests/mod/proxy_html.pp b/environments/production/modules/apache/manifests/mod/proxy_html.pp new file mode 100644 index 0000000..f4f4b44 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/proxy_html.pp @@ -0,0 +1,42 @@ +class apache::mod::proxy_html { + include ::apache + Class['::apache::mod::proxy'] -> Class['::apache::mod::proxy_html'] + Class['::apache::mod::proxy_http'] -> Class['::apache::mod::proxy_html'] + + # Add libxml2 + case $::osfamily { + /RedHat|FreeBSD|Gentoo/: { + ::apache::mod { 'xml2enc': } + $loadfiles = undef + } + 'Debian': { + $gnu_path = $::hardwaremodel ? { + 'i686' => 'i386', + default => $::hardwaremodel, + } + $loadfiles = $::apache::params::distrelease ? { + '6' => ['/usr/lib/libxml2.so.2'], + '10' => ['/usr/lib/libxml2.so.2'], + default => ["/usr/lib/${gnu_path}-linux-gnu/libxml2.so.2"], + } + if versioncmp($::apache::apache_version, '2.4') >= 0 { + ::apache::mod { 'xml2enc': } + } + } + } + + ::apache::mod { 'proxy_html': + loadfiles => $loadfiles, + } + + # Template uses $icons_path + file { 'proxy_html.conf': + ensure => file, + path => "${::apache::mod_dir}/proxy_html.conf", + mode => $::apache::file_mode, + content => template('apache/mod/proxy_html.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/proxy_http.pp b/environments/production/modules/apache/manifests/mod/proxy_http.pp new file mode 100644 index 0000000..1579e68 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/proxy_http.pp @@ -0,0 +1,4 @@ +class apache::mod::proxy_http { + Class['::apache::mod::proxy'] -> Class['::apache::mod::proxy_http'] + ::apache::mod { 'proxy_http': } +} diff --git a/environments/production/modules/apache/manifests/mod/proxy_wstunnel.pp b/environments/production/modules/apache/manifests/mod/proxy_wstunnel.pp new file mode 100644 index 0000000..290954b --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/proxy_wstunnel.pp @@ -0,0 +1,5 @@ +class apache::mod::proxy_wstunnel { + include ::apache, ::apache::mod::proxy + Class['::apache::mod::proxy'] -> Class['::apache::mod::proxy_wstunnel'] + ::apache::mod { 'proxy_wstunnel': } +} diff --git a/environments/production/modules/apache/manifests/mod/python.pp b/environments/production/modules/apache/manifests/mod/python.pp new file mode 100644 index 0000000..75af350 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/python.pp @@ -0,0 +1,6 @@ +class apache::mod::python { + include ::apache + ::apache::mod { 'python': } +} + + diff --git a/environments/production/modules/apache/manifests/mod/remoteip.pp b/environments/production/modules/apache/manifests/mod/remoteip.pp new file mode 100644 index 0000000..92010cf --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/remoteip.pp @@ -0,0 +1,30 @@ +class apache::mod::remoteip ( + $header = 'X-Forwarded-For', + $proxy_ips = [ '127.0.0.1' ], + $proxies_header = undef, + $trusted_proxy_ips = undef, + $apache_version = undef, +) { + include ::apache + $_apache_version = pick($apache_version, $apache::apache_version) + if versioncmp($_apache_version, '2.4') < 0 { + fail('mod_remoteip is only available in Apache 2.4') + } + + ::apache::mod { 'remoteip': } + + # Template uses: + # - $header + # - $proxy_ips + # - $proxies_header + # - $trusted_proxy_ips + file { 'remoteip.conf': + ensure => file, + path => "${::apache::mod_dir}/remoteip.conf", + mode => $::apache::file_mode, + content => template('apache/mod/remoteip.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Service['httpd'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/reqtimeout.pp b/environments/production/modules/apache/manifests/mod/reqtimeout.pp new file mode 100644 index 0000000..f166f6d --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/reqtimeout.pp @@ -0,0 +1,15 @@ +class apache::mod::reqtimeout ( + $timeouts = ['header=20-40,minrate=500', 'body=10,minrate=500'] +){ + include ::apache + ::apache::mod { 'reqtimeout': } + # Template uses no variables + file { 'reqtimeout.conf': + ensure => file, + path => "${::apache::mod_dir}/reqtimeout.conf", + content => template('apache/mod/reqtimeout.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/rewrite.pp b/environments/production/modules/apache/manifests/mod/rewrite.pp new file mode 100644 index 0000000..694f0b6 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/rewrite.pp @@ -0,0 +1,4 @@ +class apache::mod::rewrite { + include ::apache::params + ::apache::mod { 'rewrite': } +} diff --git a/environments/production/modules/apache/manifests/mod/rpaf.pp b/environments/production/modules/apache/manifests/mod/rpaf.pp new file mode 100644 index 0000000..b9afa14 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/rpaf.pp @@ -0,0 +1,23 @@ +class apache::mod::rpaf ( + $sethostname = true, + $proxy_ips = [ '127.0.0.1' ], + $header = 'X-Forwarded-For', + $template = 'apache/mod/rpaf.conf.erb' +) { + include ::apache + ::apache::mod { 'rpaf': } + + # Template uses: + # - $sethostname + # - $proxy_ips + # - $header + file { 'rpaf.conf': + ensure => file, + path => "${::apache::mod_dir}/rpaf.conf", + mode => $::apache::file_mode, + content => template($template), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/security.pp b/environments/production/modules/apache/manifests/mod/security.pp new file mode 100644 index 0000000..4fab446 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/security.pp @@ -0,0 +1,130 @@ +class apache::mod::security ( + $logroot = $::apache::params::logroot, + $crs_package = $::apache::params::modsec_crs_package, + $activated_rules = $::apache::params::modsec_default_rules, + $modsec_dir = $::apache::params::modsec_dir, + $modsec_secruleengine = $::apache::params::modsec_secruleengine, + $audit_log_relevant_status = '^(?:5|4(?!04))', + $audit_log_parts = $::apache::params::modsec_audit_log_parts, + $secpcrematchlimit = $::apache::params::secpcrematchlimit, + $secpcrematchlimitrecursion = $::apache::params::secpcrematchlimitrecursion, + $allowed_methods = 'GET HEAD POST OPTIONS', + $content_types = 'application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/x-amf', + $restricted_extensions = '.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/', + $restricted_headers = '/Proxy-Connection/ /Lock-Token/ /Content-Range/ /Translate/ /via/ /if/', + $secdefaultaction = 'deny', + $anomaly_score_blocking = 'off', + $inbound_anomaly_threshold = '5', + $outbound_anomaly_threshold = '4', + $critical_anomaly_score = '5', + $error_anomaly_score = '4', + $warning_anomaly_score = '3', + $notice_anomaly_score = '2', + $secrequestmaxnumargs = '255', + $secrequestbodylimit = '13107200', + $secrequestbodynofileslimit = '131072', + $secrequestbodyinmemorylimit = '131072', +) inherits ::apache::params { + include ::apache + + $_secdefaultaction = $secdefaultaction ? { + /log/ => $secdefaultaction, # it has log or nolog,auditlog or log,noauditlog + default => "${secdefaultaction},log", + } + + if $::osfamily == 'FreeBSD' { + fail('FreeBSD is not currently supported') + } + + if ($::osfamily == 'Suse' and $::operatingsystemrelease < '11') { + fail('SLES 10 is not currently supported.') + } + + ::apache::mod { 'security': + id => 'security2_module', + lib => 'mod_security2.so', + } + + + ::apache::mod { 'unique_id_module': + id => 'unique_id_module', + lib => 'mod_unique_id.so', + } + + if $crs_package { + package { $crs_package: + ensure => 'latest', + before => [ + File[$::apache::confd_dir], + File[$modsec_dir], + ], + } + } + + # Template uses: + # - logroot + # - $modsec_dir + # - $audit_log_parts + # - secpcrematchlimit + # - secpcrematchlimitrecursion + # - secrequestbodylimit + # - secrequestbodynofileslimit + # - secrequestbodyinmemorylimit + file { 'security.conf': + ensure => file, + content => template('apache/mod/security.conf.erb'), + mode => $::apache::file_mode, + path => "${::apache::mod_dir}/security.conf", + owner => $::apache::params::user, + group => $::apache::params::group, + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + + file { $modsec_dir: + ensure => directory, + owner => 'root', + group => 'root', + mode => '0755', + purge => true, + force => true, + recurse => true, + require => Package['httpd'], + } + + file { "${modsec_dir}/activated_rules": + ensure => directory, + owner => $::apache::params::user, + group => $::apache::params::group, + mode => '0555', + purge => true, + force => true, + recurse => true, + notify => Class['apache::service'], + } + + # Template uses: + # - $_secdefaultaction + # - $critical_anomaly_score + # - $error_anomaly_score + # - $warning_anomaly_score + # - $notice_anomaly_score + # - $inbound_anomaly_threshold + # - $outbound_anomaly_threshold + # - $anomaly_score_blocking + # - $allowed_methods + # - $content_types + # - $restricted_extensions + # - $restricted_headers + # - $secrequestmaxnumargs + file { "${modsec_dir}/security_crs.conf": + ensure => file, + content => template('apache/mod/security_crs.conf.erb'), + require => File[$modsec_dir], + notify => Class['apache::service'], + } + + unless $::operatingsystem == 'SLES' { apache::security::rule_link { $activated_rules: } } + +} diff --git a/environments/production/modules/apache/manifests/mod/setenvif.pp b/environments/production/modules/apache/manifests/mod/setenvif.pp new file mode 100644 index 0000000..d7baf58 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/setenvif.pp @@ -0,0 +1,14 @@ +class apache::mod::setenvif { + include ::apache + ::apache::mod { 'setenvif': } + # Template uses no variables + file { 'setenvif.conf': + ensure => file, + path => "${::apache::mod_dir}/setenvif.conf", + mode => $::apache::file_mode, + content => template('apache/mod/setenvif.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/shib.pp b/environments/production/modules/apache/manifests/mod/shib.pp new file mode 100644 index 0000000..318a3a3 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/shib.pp @@ -0,0 +1,20 @@ +class apache::mod::shib ( + $suppress_warning = false, + $mod_full_path = undef, + $package_name = undef, + $mod_lib = undef, +) { + include ::apache + if $::osfamily == 'RedHat' and ! $suppress_warning { + warning('RedHat distributions do not have Apache mod_shib in their default package repositories.') + } + + $mod_shib = 'shib2' + + apache::mod {$mod_shib: + id => 'mod_shib', + path => $mod_full_path, + package => $package_name, + lib => $mod_lib, + } +} diff --git a/environments/production/modules/apache/manifests/mod/socache_shmcb.pp b/environments/production/modules/apache/manifests/mod/socache_shmcb.pp new file mode 100644 index 0000000..7bfb4c6 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/socache_shmcb.pp @@ -0,0 +1,3 @@ +class apache::mod::socache_shmcb { + ::apache::mod { 'socache_shmcb': } +} \ No newline at end of file diff --git a/environments/production/modules/apache/manifests/mod/speling.pp b/environments/production/modules/apache/manifests/mod/speling.pp new file mode 100644 index 0000000..fbd19d3 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/speling.pp @@ -0,0 +1,4 @@ +class apache::mod::speling { + include ::apache + ::apache::mod { 'speling': } +} diff --git a/environments/production/modules/apache/manifests/mod/ssl.pp b/environments/production/modules/apache/manifests/mod/ssl.pp new file mode 100644 index 0000000..92c4563 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/ssl.pp @@ -0,0 +1,129 @@ +class apache::mod::ssl ( + $ssl_compression = false, + $ssl_cryptodevice = 'builtin', + $ssl_options = [ 'StdEnvVars' ], + $ssl_openssl_conf_cmd = undef, + $ssl_cipher = 'HIGH:MEDIUM:!aNULL:!MD5:!RC4', + $ssl_honorcipherorder = true, + $ssl_protocol = [ 'all', '-SSLv2', '-SSLv3' ], + $ssl_pass_phrase_dialog = 'builtin', + $ssl_random_seed_bytes = '512', + $ssl_sessioncachetimeout = '300', + $ssl_stapling = false, + $ssl_stapling_return_errors = undef, + $ssl_mutex = undef, + $apache_version = undef, + $package_name = undef, +) { + include ::apache + include ::apache::mod::mime + $_apache_version = pick($apache_version, $apache::apache_version) + if $ssl_mutex { + $_ssl_mutex = $ssl_mutex + } else { + case $::osfamily { + 'debian': { + if versioncmp($_apache_version, '2.4') >= 0 { + $_ssl_mutex = 'default' + } elsif $::operatingsystem == 'Ubuntu' and $::operatingsystemrelease == '10.04' { + $_ssl_mutex = 'file:/var/run/apache2/ssl_mutex' + } else { + $_ssl_mutex = "file:\${APACHE_RUN_DIR}/ssl_mutex" + } + } + 'redhat': { + $_ssl_mutex = 'default' + } + 'freebsd': { + $_ssl_mutex = 'default' + } + 'gentoo': { + $_ssl_mutex = 'default' + } + 'Suse': { + $_ssl_mutex = 'default' + } + default: { + fail("Unsupported osfamily ${::osfamily}, please explicitly pass in \$ssl_mutex") + } + } + } + + validate_bool($ssl_compression) + + if is_bool($ssl_honorcipherorder) { + $_ssl_honorcipherorder = $ssl_honorcipherorder + } else { + $_ssl_honorcipherorder = $ssl_honorcipherorder ? { + 'on' => true, + 'off' => false, + default => true, + } + } + + $session_cache = $::osfamily ? { + 'debian' => "\${APACHE_RUN_DIR}/ssl_scache(512000)", + 'redhat' => '/var/cache/mod_ssl/scache(512000)', + 'freebsd' => '/var/run/ssl_scache(512000)', + 'gentoo' => '/var/run/ssl_scache(512000)', + 'Suse' => '/var/lib/apache2/ssl_scache(512000)' + } + + validate_bool($ssl_stapling) + + if $ssl_stapling_return_errors != undef { + validate_bool($ssl_stapling_return_errors) + } + + $stapling_cache = $::osfamily ? { + 'debian' => "\${APACHE_RUN_DIR}/ocsp(32768)", + 'redhat' => '/run/httpd/ssl_stapling(32768)', + 'freebsd' => '/var/run/ssl_stapling(32768)', + 'gentoo' => '/var/run/ssl_stapling(32768)', + 'Suse' => '/var/lib/apache2/ssl_stapling(32768)', + } + + if $::osfamily == 'Suse' { + if defined(Class['::apache::mod::worker']){ + $suse_path = '/usr/lib64/apache2-worker' + } else { + $suse_path = '/usr/lib64/apache2-worker' + } + ::apache::mod { 'ssl': + package => $package_name, + lib_path => $suse_path, + } + } else { + ::apache::mod { 'ssl': + package => $package_name, + } + } + + if versioncmp($_apache_version, '2.4') >= 0 { + include ::apache::mod::socache_shmcb + } + + # Template uses + # + # $ssl_compression + # $ssl_cryptodevice + # $ssl_cipher + # $ssl_honorcipherorder + # $ssl_options + # $ssl_openssl_conf_cmd + # $session_cache + # $stapling_cache + # $ssl_mutex + # $ssl_random_seed_bytes + # $ssl_sessioncachetimeout + # $_apache_version + file { 'ssl.conf': + ensure => file, + path => $::apache::ssl_file, + mode => $::apache::file_mode, + content => template('apache/mod/ssl.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/status.pp b/environments/production/modules/apache/manifests/mod/status.pp new file mode 100644 index 0000000..d30a690 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/status.pp @@ -0,0 +1,49 @@ +# Class: apache::mod::status +# +# This class enables and configures Apache mod_status +# See: http://httpd.apache.org/docs/current/mod/mod_status.html +# +# Parameters: +# - $allow_from is an array of hosts, ip addresses, partial network numbers +# or networks in CIDR notation specifying what hosts can view the special +# /server-status URL. Defaults to ['127.0.0.1', '::1']. +# - $extended_status track and display extended status information. Valid +# values are 'On' or 'Off'. Defaults to 'On'. +# - $status_path is the path assigned to the Location directive which +# defines the URL to access the server status. Defaults to '/server-status'. +# +# Actions: +# - Enable and configure Apache mod_status +# +# Requires: +# - The apache class +# +# Sample Usage: +# +# # Simple usage allowing access from localhost and a private subnet +# class { 'apache::mod::status': +# $allow_from => ['127.0.0.1', '10.10.10.10/24'], +# } +# +class apache::mod::status ( + $allow_from = ['127.0.0.1','::1'], + $extended_status = 'On', + $apache_version = undef, + $status_path = '/server-status', +) inherits ::apache::params { + include ::apache + $_apache_version = pick($apache_version, $apache::apache_version) + validate_array($allow_from) + validate_re(downcase($extended_status), '^(on|off)$', "${extended_status} is not supported for extended_status. Allowed values are 'On' and 'Off'.") + ::apache::mod { 'status': } + # Template uses $allow_from, $extended_status, $_apache_version, $status_path + file { 'status.conf': + ensure => file, + path => "${::apache::mod_dir}/status.conf", + mode => $::apache::file_mode, + content => template('apache/mod/status.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/suexec.pp b/environments/production/modules/apache/manifests/mod/suexec.pp new file mode 100644 index 0000000..ded013d --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/suexec.pp @@ -0,0 +1,3 @@ +class apache::mod::suexec { + ::apache::mod { 'suexec': } +} diff --git a/environments/production/modules/apache/manifests/mod/suphp.pp b/environments/production/modules/apache/manifests/mod/suphp.pp new file mode 100644 index 0000000..955bba3 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/suphp.pp @@ -0,0 +1,16 @@ +class apache::mod::suphp ( +){ + include ::apache + ::apache::mod { 'suphp': } + + file {'suphp.conf': + ensure => file, + path => "${::apache::mod_dir}/suphp.conf", + mode => $::apache::file_mode, + content => template('apache/mod/suphp.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} + diff --git a/environments/production/modules/apache/manifests/mod/userdir.pp b/environments/production/modules/apache/manifests/mod/userdir.pp new file mode 100644 index 0000000..11e7cd5 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/userdir.pp @@ -0,0 +1,23 @@ +class apache::mod::userdir ( + $home = '/home', + $dir = 'public_html', + $disable_root = true, + $apache_version = undef, + $options = [ 'MultiViews', 'Indexes', 'SymLinksIfOwnerMatch', 'IncludesNoExec' ], +) { + include ::apache + $_apache_version = pick($apache_version, $apache::apache_version) + + ::apache::mod { 'userdir': } + + # Template uses $home, $dir, $disable_root, $_apache_version + file { 'userdir.conf': + ensure => file, + path => "${::apache::mod_dir}/userdir.conf", + mode => $::apache::file_mode, + content => template('apache/mod/userdir.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/mod/version.pp b/environments/production/modules/apache/manifests/mod/version.pp new file mode 100644 index 0000000..1cc4412 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/version.pp @@ -0,0 +1,10 @@ +class apache::mod::version( + $apache_version = $::apache::apache_version +) { + + if ($::osfamily == 'debian' and versioncmp($apache_version, '2.4') >= 0) { + warning("${module_name}: module version_module is built-in and can't be loaded") + } else { + ::apache::mod { 'version': } + } +} diff --git a/environments/production/modules/apache/manifests/mod/vhost_alias.pp b/environments/production/modules/apache/manifests/mod/vhost_alias.pp new file mode 100644 index 0000000..30ae122 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/vhost_alias.pp @@ -0,0 +1,3 @@ +class apache::mod::vhost_alias { + ::apache::mod { 'vhost_alias': } +} diff --git a/environments/production/modules/apache/manifests/mod/worker.pp b/environments/production/modules/apache/manifests/mod/worker.pp new file mode 100644 index 0000000..00a9439 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/worker.pp @@ -0,0 +1,147 @@ +# == Class: apache::mod::worker +# +# +# === Parameters +# +# [*startservers*] +# (optional) The number of child server processes created on startup +# Defaults is '2' +# +# [*maxclients*] +# (optional) The max number of simultaneous requests that will be served. +# This is the old name and is still supported. The new name is +# MaxRequestWorkers as of 2.3.13. +# Default is '150' +# +# [*minsparethreads*] +# (optional) Minimum number of idle threads to handle request spikes. +# Default is '25' +# +# [*maxsparethreads*] +# (optional) Maximum number of idle threads. +# Default is '75' +# +# [*threadsperchild*] +# (optional) The number of threads created by each child process. +# Default is '25' +# +# [*maxrequestsperchild*] +# (optional) Limit on the number of connectiojns an individual child server +# process will handle. This is the old name and is still supported. The new +# name is MaxConnectionsPerChild as of 2.3.9+. +# Default is '0' +# +# [*serverlimit*] +# (optional) With worker, use this directive only if your MaxRequestWorkers +# and ThreadsPerChild settings require more than 16 server processes +# (default). Do not set the value of this directive any higher than the +# number of server processes required by what you may want for +# MaxRequestWorkers and ThreadsPerChild. +# Default is '25' +# +# [*threadlimit*] +# (optional) This directive sets the maximum configured value for +# ThreadsPerChild for the lifetime of the Apache httpd process. +# Default is '64' +# +# [*listenbacklog*] +# (optional) Maximum length of the queue of pending connections. +# Defaults is '511' +# +# [*apache_version*] +# (optional) +# Default is $::apache::apache_version +# +class apache::mod::worker ( + $startservers = '2', + $maxclients = '150', + $minsparethreads = '25', + $maxsparethreads = '75', + $threadsperchild = '25', + $maxrequestsperchild = '0', + $serverlimit = '25', + $threadlimit = '64', + $listenbacklog = '511', + $apache_version = undef, +) { + include ::apache + $_apache_version = pick($apache_version, $apache::apache_version) + + if defined(Class['apache::mod::event']) { + fail('May not include both apache::mod::worker and apache::mod::event on the same node') + } + if defined(Class['apache::mod::itk']) { + fail('May not include both apache::mod::worker and apache::mod::itk on the same node') + } + if defined(Class['apache::mod::peruser']) { + fail('May not include both apache::mod::worker and apache::mod::peruser on the same node') + } + if defined(Class['apache::mod::prefork']) { + fail('May not include both apache::mod::worker and apache::mod::prefork on the same node') + } + File { + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + } + + # Template uses: + # - $startservers + # - $maxclients + # - $minsparethreads + # - $maxsparethreads + # - $threadsperchild + # - $maxrequestsperchild + # - $serverlimit + # - $threadLimit + # - $listenbacklog + file { "${::apache::mod_dir}/worker.conf": + ensure => file, + content => template('apache/mod/worker.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } + + case $::osfamily { + 'redhat': { + + if versioncmp($_apache_version, '2.4') >= 0 { + ::apache::mpm{ 'worker': + apache_version => $_apache_version, + } + } + else { + file_line { '/etc/sysconfig/httpd worker enable': + ensure => present, + path => '/etc/sysconfig/httpd', + line => 'HTTPD=/usr/sbin/httpd.worker', + match => '#?HTTPD=/usr/sbin/httpd.worker', + require => Package['httpd'], + notify => Class['apache::service'], + } + } + } + + 'debian', 'freebsd': { + ::apache::mpm{ 'worker': + apache_version => $_apache_version, + } + } + 'Suse': { + ::apache::mpm { 'worker': + apache_version => $apache_version, + lib_path => '/usr/lib64/apache2-worker', + } + } + + 'gentoo': { + ::portage::makeconf { 'apache2_mpms': + content => 'worker', + } + } + default: { + fail("Unsupported osfamily ${::osfamily}") + } + } +} diff --git a/environments/production/modules/apache/manifests/mod/wsgi.pp b/environments/production/modules/apache/manifests/mod/wsgi.pp new file mode 100644 index 0000000..e726bcf --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/wsgi.pp @@ -0,0 +1,42 @@ +class apache::mod::wsgi ( + $wsgi_socket_prefix = $::apache::params::wsgi_socket_prefix, + $wsgi_python_path = undef, + $wsgi_python_home = undef, + $package_name = undef, + $mod_path = undef, +) inherits ::apache::params { + include ::apache + if ($package_name != undef and $mod_path == undef) or ($package_name == undef and $mod_path != undef) { + fail('apache::mod::wsgi - both package_name and mod_path must be specified!') + } + + if $package_name != undef { + if $mod_path =~ /\// { + $_mod_path = $mod_path + } else { + $_mod_path = "${::apache::lib_path}/${mod_path}" + } + ::apache::mod { 'wsgi': + package => $package_name, + path => $_mod_path, + } + } + else { + ::apache::mod { 'wsgi': } + } + + # Template uses: + # - $wsgi_socket_prefix + # - $wsgi_python_path + # - $wsgi_python_home + file {'wsgi.conf': + ensure => file, + path => "${::apache::mod_dir}/wsgi.conf", + mode => $::apache::file_mode, + content => template('apache/mod/wsgi.conf.erb'), + require => Exec["mkdir ${::apache::mod_dir}"], + before => File[$::apache::mod_dir], + notify => Class['apache::service'], + } +} + diff --git a/environments/production/modules/apache/manifests/mod/xsendfile.pp b/environments/production/modules/apache/manifests/mod/xsendfile.pp new file mode 100644 index 0000000..7c5e884 --- /dev/null +++ b/environments/production/modules/apache/manifests/mod/xsendfile.pp @@ -0,0 +1,4 @@ +class apache::mod::xsendfile { + include ::apache::params + ::apache::mod { 'xsendfile': } +} diff --git a/environments/production/modules/apache/manifests/mpm.pp b/environments/production/modules/apache/manifests/mpm.pp new file mode 100644 index 0000000..119fedf --- /dev/null +++ b/environments/production/modules/apache/manifests/mpm.pp @@ -0,0 +1,148 @@ +define apache::mpm ( + $lib_path = $::apache::lib_path, + $apache_version = $::apache::apache_version, +) { + if ! defined(Class['apache']) { + fail('You must include the apache base class before using any apache defined resources') + } + + $mpm = $name + $mod_dir = $::apache::mod_dir + + $_lib = "mod_mpm_${mpm}.so" + $_path = "${lib_path}/${_lib}" + $_id = "mpm_${mpm}_module" + + if $::osfamily == 'Suse' { + #mpms on Suse 12 don't use .so libraries so create a placeholder load file + if versioncmp($apache_version, '2.4') >= 0 { + file { "${mod_dir}/${mpm}.load": + ensure => file, + path => "${mod_dir}/${mpm}.load", + content => '', + require => [ + Package['httpd'], + Exec["mkdir ${mod_dir}"], + ], + before => File[$mod_dir], + notify => Class['apache::service'], + } + } + } else { + if versioncmp($apache_version, '2.4') >= 0 { + file { "${mod_dir}/${mpm}.load": + ensure => file, + path => "${mod_dir}/${mpm}.load", + content => "LoadModule ${_id} ${_path}\n", + require => [ + Package['httpd'], + Exec["mkdir ${mod_dir}"], + ], + before => File[$mod_dir], + notify => Class['apache::service'], + } + } + } + + case $::osfamily { + 'debian': { + file { "${::apache::mod_enable_dir}/${mpm}.conf": + ensure => link, + target => "${::apache::mod_dir}/${mpm}.conf", + require => Exec["mkdir ${::apache::mod_enable_dir}"], + before => File[$::apache::mod_enable_dir], + notify => Class['apache::service'], + } + + if versioncmp($apache_version, '2.4') >= 0 { + file { "${::apache::mod_enable_dir}/${mpm}.load": + ensure => link, + target => "${::apache::mod_dir}/${mpm}.load", + require => Exec["mkdir ${::apache::mod_enable_dir}"], + before => File[$::apache::mod_enable_dir], + notify => Class['apache::service'], + } + + if $mpm == 'itk' { + file { "${lib_path}/mod_mpm_itk.so": + ensure => link, + target => "${lib_path}/mpm_itk.so", + require => Package['httpd'], + before => Class['apache::service'], + } + } + } + + if $mpm == 'itk' and $::operatingsystem == 'Ubuntu' and $::operatingsystemrelease == '14.04' { + # workaround https://bugs.launchpad.net/ubuntu/+source/mpm-itk/+bug/1286882 + exec { + '/usr/sbin/a2dismod mpm_event': + onlyif => '/usr/bin/test -e /etc/apache2/mods-enabled/mpm_event.load', + require => Package['httpd'], + before => Package['apache2-mpm-itk'], + } + } + + if $mpm == 'itk' and $::operatingsystem == 'Ubuntu' and $::operatingsystemrelease == '16.04' { + $packagename = 'libapache2-mpm-itk' + } else { + $packagename = "apache2-mpm-${mpm}" + } + + if versioncmp($apache_version, '2.4') < 0 or $mpm == 'itk' { + package { $packagename: + ensure => present, + } + if $::apache::mod_enable_dir { + Package[$packagename] { + before => File[$::apache::mod_enable_dir], + } + } + } + } + 'freebsd': { + class { '::apache::package': + mpm_module => $mpm, + } + } + 'gentoo': { + # so we don't fail + } + 'redhat': { + # so we don't fail + } + 'Suse': { + file { "${::apache::mod_enable_dir}/${mpm}.conf": + ensure => link, + target => "${::apache::mod_dir}/${mpm}.conf", + require => Exec["mkdir ${::apache::mod_enable_dir}"], + before => File[$::apache::mod_enable_dir], + notify => Class['apache::service'], + } + + if versioncmp($apache_version, '2.4') >= 0 { + file { "${::apache::mod_enable_dir}/${mpm}.load": + ensure => link, + target => "${::apache::mod_dir}/${mpm}.load", + require => Exec["mkdir ${::apache::mod_enable_dir}"], + before => File[$::apache::mod_enable_dir], + notify => Class['apache::service'], + } + + if $mpm == 'itk' { + file { "${lib_path}/mod_mpm_itk.so": + ensure => link, + target => "${lib_path}/mpm_itk.so", + } + } + } + + package { "apache2-${mpm}": + ensure => present, + } + } + default: { + fail("Unsupported osfamily ${::osfamily}") + } + } +} diff --git a/environments/production/modules/apache/manifests/namevirtualhost.pp b/environments/production/modules/apache/manifests/namevirtualhost.pp new file mode 100644 index 0000000..4fa8795 --- /dev/null +++ b/environments/production/modules/apache/manifests/namevirtualhost.pp @@ -0,0 +1,9 @@ +define apache::namevirtualhost { + $addr_port = $name + + # Template uses: $addr_port + concat::fragment { "NameVirtualHost ${addr_port}": + target => $::apache::ports_file, + content => template('apache/namevirtualhost.erb'), + } +} diff --git a/environments/production/modules/apache/manifests/package.pp b/environments/production/modules/apache/manifests/package.pp new file mode 100644 index 0000000..7c95f99 --- /dev/null +++ b/environments/production/modules/apache/manifests/package.pp @@ -0,0 +1,37 @@ +class apache::package ( + $ensure = 'present', + $mpm_module = $::apache::params::mpm_module, +) inherits ::apache::params { + + # The base class must be included first because it is used by parameter defaults + if ! defined(Class['apache']) { + fail('You must include the apache base class before using any apache defined resources') + } + + case $::osfamily { + 'FreeBSD': { + case $mpm_module { + 'prefork': { + } + 'worker': { + } + 'event': { + } + 'itk': { + package { 'www/mod_mpm_itk': + ensure => installed, + } + } + default: { fail("MPM module ${mpm_module} not supported on FreeBSD") } + } + } + default: { + } + } + + package { 'httpd': + ensure => $ensure, + name => $::apache::apache_name, + notify => Class['Apache::Service'], + } +} diff --git a/environments/production/modules/apache/manifests/params.pp b/environments/production/modules/apache/manifests/params.pp new file mode 100644 index 0000000..e1ca7b3 --- /dev/null +++ b/environments/production/modules/apache/manifests/params.pp @@ -0,0 +1,566 @@ +# Class: apache::params +# +# This class manages Apache parameters +# +# Parameters: +# - The $user that Apache runs as +# - The $group that Apache runs as +# - The $apache_name is the name of the package and service on the relevant +# distribution +# - The $php_package is the name of the package that provided PHP +# - The $ssl_package is the name of the Apache SSL package +# - The $apache_dev is the name of the Apache development libraries package +# - The $conf_contents is the contents of the Apache configuration file +# +# Actions: +# +# Requires: +# +# Sample Usage: +# +class apache::params inherits ::apache::version { + if($::fqdn) { + $servername = $::fqdn + } else { + $servername = $::hostname + } + + # The default error log level + $log_level = 'warn' + $use_optional_includes = false + + # Default mime types settings + $mime_types_additional = { + 'AddHandler' => { 'type-map' => 'var', }, + 'AddType' => { 'text/html' => '.shtml', }, + 'AddOutputFilter' => { 'INCLUDES' => '.shtml', }, + } + + # should we use systemd module? + $use_systemd = true + + # Default mode for files + $file_mode = '0644' + + # Default options for / directory + $root_directory_options = ['FollowSymLinks'] + + $vhost_include_pattern = '*' + + $modsec_audit_log_parts = 'ABIJDEFHZ' + + if ($::operatingsystem == 'Ubuntu' and $::lsbdistrelease == '10.04') or ($::operatingsystem == 'SLES') { + $verify_command = '/usr/sbin/apache2ctl -t' + } elsif $::operatingsystem == 'FreeBSD' { + $verify_command = '/usr/local/sbin/apachectl -t' + } else { + $verify_command = '/usr/sbin/apachectl -t' + } + if $::osfamily == 'RedHat' or $::operatingsystem =~ /^[Aa]mazon$/ { + $user = 'apache' + $group = 'apache' + $root_group = 'root' + $apache_name = 'httpd' + $service_name = 'httpd' + $httpd_dir = '/etc/httpd' + $server_root = '/etc/httpd' + $conf_dir = "${httpd_dir}/conf" + $confd_dir = "${httpd_dir}/conf.d" + $mod_dir = $::apache::version::distrelease ? { + '7' => "${httpd_dir}/conf.modules.d", + default => "${httpd_dir}/conf.d", + } + $mod_enable_dir = undef + $vhost_dir = "${httpd_dir}/conf.d" + $vhost_enable_dir = undef + $conf_file = 'httpd.conf' + $ssl_file = "${confd_dir}/ssl.conf" + $ports_file = "${conf_dir}/ports.conf" + $pidfile = 'run/httpd.pid' + $logroot = '/var/log/httpd' + $logroot_mode = undef + $lib_path = 'modules' + $mpm_module = 'prefork' + $dev_packages = 'httpd-devel' + $default_ssl_cert = '/etc/pki/tls/certs/localhost.crt' + $default_ssl_key = '/etc/pki/tls/private/localhost.key' + $ssl_certs_dir = '/etc/pki/tls/certs' + $passenger_conf_file = 'passenger_extra.conf' + $passenger_conf_package_file = 'passenger.conf' + $passenger_root = undef + $passenger_ruby = undef + $passenger_default_ruby = undef + $suphp_addhandler = 'php5-script' + $suphp_engine = 'off' + $suphp_configpath = undef + $php_version = '5' + $mod_packages = { + # NOTE: The auth_cas module isn't available on RH/CentOS without providing dependency packages provided by EPEL. + 'auth_cas' => 'mod_auth_cas', + 'auth_kerb' => 'mod_auth_kerb', + 'auth_mellon' => 'mod_auth_mellon', + 'authnz_ldap' => $::apache::version::distrelease ? { + '7' => 'mod_ldap', + default => 'mod_authz_ldap', + }, + 'fastcgi' => 'mod_fastcgi', + 'fcgid' => 'mod_fcgid', + 'geoip' => 'mod_geoip', + 'ldap' => $::apache::version::distrelease ? { + '7' => 'mod_ldap', + default => undef, + }, + 'pagespeed' => 'mod-pagespeed-stable', + # NOTE: The passenger module isn't available on RH/CentOS without + # providing dependency packages provided by EPEL and passenger + # repositories. See + # https://www.phusionpassenger.com/library/install/apache/install/oss/el7/ + 'passenger' => 'mod_passenger', + 'perl' => 'mod_perl', + 'php5' => $::apache::version::distrelease ? { + '5' => 'php53', + default => 'php', + }, + 'phpXXX' => 'php', + 'proxy_html' => 'mod_proxy_html', + 'python' => 'mod_python', + 'security' => 'mod_security', + # NOTE: The module for Shibboleth is not available on RH/CentOS without + # providing dependency packages provided by Shibboleth's repositories. + # See http://wiki.aaf.edu.au/tech-info/sp-install-guide + 'shibboleth' => 'shibboleth', + 'ssl' => 'mod_ssl', + 'wsgi' => 'mod_wsgi', + 'dav_svn' => 'mod_dav_svn', + 'suphp' => 'mod_suphp', + 'xsendfile' => 'mod_xsendfile', + 'nss' => 'mod_nss', + 'shib2' => 'shibboleth', + } + $mod_libs = { + 'nss' => 'libmodnss.so', + } + $conf_template = 'apache/httpd.conf.erb' + $keepalive = 'Off' + $keepalive_timeout = 15 + $max_keepalive_requests = 100 + $fastcgi_lib_path = undef + $mime_support_package = 'mailcap' + $mime_types_config = '/etc/mime.types' + $docroot = '/var/www/html' + $alias_icons_path = $::apache::version::distrelease ? { + '7' => '/usr/share/httpd/icons', + default => '/var/www/icons', + } + $error_documents_path = $::apache::version::distrelease ? { + '7' => '/usr/share/httpd/error', + default => '/var/www/error' + } + if $::osfamily == 'RedHat' { + $wsgi_socket_prefix = '/var/run/wsgi' + } else { + $wsgi_socket_prefix = undef + } + $cas_cookie_path = '/var/cache/mod_auth_cas/' + $mellon_lock_file = '/run/mod_auth_mellon/lock' + $mellon_cache_size = 100 + $mellon_post_directory = undef + $modsec_crs_package = 'mod_security_crs' + $modsec_crs_path = '/usr/lib/modsecurity.d' + $modsec_dir = '/etc/httpd/modsecurity.d' + $secpcrematchlimit = 1500 + $secpcrematchlimitrecursion = 1500 + $modsec_secruleengine = 'On' + $modsec_default_rules = [ + 'base_rules/modsecurity_35_bad_robots.data', + 'base_rules/modsecurity_35_scanners.data', + 'base_rules/modsecurity_40_generic_attacks.data', + 'base_rules/modsecurity_50_outbound.data', + 'base_rules/modsecurity_50_outbound_malware.data', + 'base_rules/modsecurity_crs_20_protocol_violations.conf', + 'base_rules/modsecurity_crs_21_protocol_anomalies.conf', + 'base_rules/modsecurity_crs_23_request_limits.conf', + 'base_rules/modsecurity_crs_30_http_policy.conf', + 'base_rules/modsecurity_crs_35_bad_robots.conf', + 'base_rules/modsecurity_crs_40_generic_attacks.conf', + 'base_rules/modsecurity_crs_41_sql_injection_attacks.conf', + 'base_rules/modsecurity_crs_41_xss_attacks.conf', + 'base_rules/modsecurity_crs_42_tight_security.conf', + 'base_rules/modsecurity_crs_45_trojans.conf', + 'base_rules/modsecurity_crs_47_common_exceptions.conf', + 'base_rules/modsecurity_crs_49_inbound_blocking.conf', + 'base_rules/modsecurity_crs_50_outbound.conf', + 'base_rules/modsecurity_crs_59_outbound_blocking.conf', + 'base_rules/modsecurity_crs_60_correlation.conf', + ] + $error_log = 'error_log' + $scriptalias = '/var/www/cgi-bin' + $access_log_file = 'access_log' + } elsif $::osfamily == 'Debian' { + $user = 'www-data' + $group = 'www-data' + $root_group = 'root' + $apache_name = 'apache2' + $service_name = 'apache2' + $httpd_dir = '/etc/apache2' + $server_root = '/etc/apache2' + $conf_dir = $httpd_dir + $confd_dir = "${httpd_dir}/conf.d" + $mod_dir = "${httpd_dir}/mods-available" + $mod_enable_dir = "${httpd_dir}/mods-enabled" + $vhost_dir = "${httpd_dir}/sites-available" + $vhost_enable_dir = "${httpd_dir}/sites-enabled" + $conf_file = 'apache2.conf' + $ssl_file = "${mod_dir}/ssl.conf" + $ports_file = "${conf_dir}/ports.conf" + $pidfile = "\${APACHE_PID_FILE}" + $logroot = '/var/log/apache2' + $logroot_mode = undef + $lib_path = '/usr/lib/apache2/modules' + $mpm_module = 'worker' + $default_ssl_cert = '/etc/ssl/certs/ssl-cert-snakeoil.pem' + $default_ssl_key = '/etc/ssl/private/ssl-cert-snakeoil.key' + $ssl_certs_dir = '/etc/ssl/certs' + $suphp_addhandler = 'x-httpd-php' + $suphp_engine = 'off' + $suphp_configpath = '/etc/php5/apache2' + if ($::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemrelease, '16.04') < 0) or ($::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '9') < 0) { + # Only the major version is used here + $php_version = '5' + } else { + # major.minor version used since Debian stretch and Ubuntu Xenial + $php_version = '7.0' + } + $mod_packages = { + 'auth_cas' => 'libapache2-mod-auth-cas', + 'auth_kerb' => 'libapache2-mod-auth-kerb', + 'auth_mellon' => 'libapache2-mod-auth-mellon', + 'dav_svn' => 'libapache2-svn', + 'fastcgi' => 'libapache2-mod-fastcgi', + 'fcgid' => 'libapache2-mod-fcgid', + 'geoip' => 'libapache2-mod-geoip', + 'nss' => 'libapache2-mod-nss', + 'pagespeed' => 'mod-pagespeed-stable', + 'passenger' => 'libapache2-mod-passenger', + 'perl' => 'libapache2-mod-perl2', + 'phpXXX' => 'libapache2-mod-phpXXX', + 'proxy_html' => 'libapache2-mod-proxy-html', + 'python' => 'libapache2-mod-python', + 'rpaf' => 'libapache2-mod-rpaf', + 'security' => 'libapache2-modsecurity', + 'shib2' => 'libapache2-mod-shib2', + 'suphp' => 'libapache2-mod-suphp', + 'wsgi' => 'libapache2-mod-wsgi', + 'xsendfile' => 'libapache2-mod-xsendfile', + } + $error_log = 'error.log' + $scriptalias = '/usr/lib/cgi-bin' + $access_log_file = 'access.log' + if $::osfamily == 'Debian' and versioncmp($::operatingsystemrelease, '8') < 0 { + $shib2_lib = 'mod_shib_22.so' + } else { + $shib2_lib = 'mod_shib2.so' + } + $mod_libs = { + 'shib2' => $shib2_lib, + } + $conf_template = 'apache/httpd.conf.erb' + $keepalive = 'Off' + $keepalive_timeout = 15 + $max_keepalive_requests = 100 + $fastcgi_lib_path = '/var/lib/apache2/fastcgi' + $mime_support_package = 'mime-support' + $mime_types_config = '/etc/mime.types' + if ($::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemrelease, '13.10') >= 0) or ($::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '8') >= 0) { + $docroot = '/var/www/html' + } else { + $docroot = '/var/www' + } + $cas_cookie_path = '/var/cache/apache2/mod_auth_cas/' + $mellon_lock_file = undef + $mellon_cache_size = undef + $mellon_post_directory = '/var/cache/apache2/mod_auth_mellon/' + $modsec_crs_package = 'modsecurity-crs' + $modsec_crs_path = '/usr/share/modsecurity-crs' + $modsec_dir = '/etc/modsecurity' + $secpcrematchlimit = 1500 + $secpcrematchlimitrecursion = 1500 + $modsec_secruleengine = 'On' + $modsec_default_rules = [ + 'base_rules/modsecurity_35_bad_robots.data', + 'base_rules/modsecurity_35_scanners.data', + 'base_rules/modsecurity_40_generic_attacks.data', + 'base_rules/modsecurity_50_outbound.data', + 'base_rules/modsecurity_50_outbound_malware.data', + 'base_rules/modsecurity_crs_20_protocol_violations.conf', + 'base_rules/modsecurity_crs_21_protocol_anomalies.conf', + 'base_rules/modsecurity_crs_23_request_limits.conf', + 'base_rules/modsecurity_crs_30_http_policy.conf', + 'base_rules/modsecurity_crs_35_bad_robots.conf', + 'base_rules/modsecurity_crs_40_generic_attacks.conf', + 'base_rules/modsecurity_crs_41_sql_injection_attacks.conf', + 'base_rules/modsecurity_crs_41_xss_attacks.conf', + 'base_rules/modsecurity_crs_42_tight_security.conf', + 'base_rules/modsecurity_crs_45_trojans.conf', + 'base_rules/modsecurity_crs_47_common_exceptions.conf', + 'base_rules/modsecurity_crs_49_inbound_blocking.conf', + 'base_rules/modsecurity_crs_50_outbound.conf', + 'base_rules/modsecurity_crs_59_outbound_blocking.conf', + 'base_rules/modsecurity_crs_60_correlation.conf', + ] + $alias_icons_path = '/usr/share/apache2/icons' + $error_documents_path = '/usr/share/apache2/error' + if ($::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemrelease, '13.10') >= 0) or ($::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '8') >= 0) { + $dev_packages = ['libaprutil1-dev', 'libapr1-dev', 'apache2-dev'] + } else { + $dev_packages = ['libaprutil1-dev', 'libapr1-dev', 'apache2-prefork-dev'] + } + + # + # Passenger-specific settings + # + + $passenger_conf_file = 'passenger.conf' + $passenger_conf_package_file = undef + + if ($::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemrelease, '14.04') < 0) or ($::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '8') < 0) { + $passenger_root = '/usr' + $passenger_ruby = '/usr/bin/ruby' + $passenger_default_ruby = undef + } else { + $passenger_root = '/usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini' + $passenger_ruby = undef + $passenger_default_ruby = '/usr/bin/ruby' + } + $wsgi_socket_prefix = undef + } elsif $::osfamily == 'FreeBSD' { + $user = 'www' + $group = 'www' + $root_group = 'wheel' + $apache_name = 'apache24' + $service_name = 'apache24' + $httpd_dir = '/usr/local/etc/apache24' + $server_root = '/usr/local' + $conf_dir = $httpd_dir + $confd_dir = "${httpd_dir}/Includes" + $mod_dir = "${httpd_dir}/Modules" + $mod_enable_dir = undef + $vhost_dir = "${httpd_dir}/Vhosts" + $vhost_enable_dir = undef + $conf_file = 'httpd.conf' + $ssl_file = "${mod_dir}/ssl.conf" + $ports_file = "${conf_dir}/ports.conf" + $pidfile = '/var/run/httpd.pid' + $logroot = '/var/log/apache24' + $logroot_mode = undef + $lib_path = '/usr/local/libexec/apache24' + $mpm_module = 'prefork' + $dev_packages = undef + $default_ssl_cert = '/usr/local/etc/apache24/server.crt' + $default_ssl_key = '/usr/local/etc/apache24/server.key' + $ssl_certs_dir = undef + $passenger_conf_file = 'passenger.conf' + $passenger_conf_package_file = undef + $passenger_root = '/usr/local/lib/ruby/gems/2.0/gems/passenger-4.0.58' + $passenger_ruby = '/usr/local/bin/ruby' + $passenger_default_ruby = undef + $suphp_addhandler = 'php5-script' + $suphp_engine = 'off' + $suphp_configpath = undef + $php_version = '5' + $mod_packages = { + # NOTE: I list here only modules that are not included in www/apache24 + # NOTE: 'passenger' needs to enable APACHE_SUPPORT in make config + # NOTE: 'php' needs to enable APACHE option in make config + # NOTE: 'dav_svn' needs to enable MOD_DAV_SVN make config + # NOTE: not sure where the shibboleth should come from + 'auth_kerb' => 'www/mod_auth_kerb2', + 'fcgid' => 'www/mod_fcgid', + 'passenger' => 'www/rubygem-passenger', + 'perl' => 'www/mod_perl2', + 'phpXXX' => 'www/mod_phpXXX', + 'proxy_html' => 'www/mod_proxy_html', + 'python' => 'www/mod_python3', + 'wsgi' => 'www/mod_wsgi', + 'dav_svn' => 'devel/subversion', + 'xsendfile' => 'www/mod_xsendfile', + 'rpaf' => 'www/mod_rpaf2', + 'shib2' => 'security/shibboleth2-sp', + } + $mod_libs = { + } + $conf_template = 'apache/httpd.conf.erb' + $keepalive = 'Off' + $keepalive_timeout = 15 + $max_keepalive_requests = 100 + $fastcgi_lib_path = undef # TODO: revisit + $mime_support_package = 'misc/mime-support' + $mime_types_config = '/usr/local/etc/mime.types' + $wsgi_socket_prefix = undef + $docroot = '/usr/local/www/apache24/data' + $alias_icons_path = '/usr/local/www/apache24/icons' + $error_documents_path = '/usr/local/www/apache24/error' + $error_log = 'httpd-error.log' + $scriptalias = '/usr/local/www/apache24/cgi-bin' + $access_log_file = 'httpd-access.log' + } elsif $::osfamily == 'Gentoo' { + $user = 'apache' + $group = 'apache' + $root_group = 'wheel' + $apache_name = 'www-servers/apache' + $service_name = 'apache2' + $httpd_dir = '/etc/apache2' + $server_root = '/var/www' + $conf_dir = $httpd_dir + $confd_dir = "${httpd_dir}/conf.d" + $mod_dir = "${httpd_dir}/modules.d" + $mod_enable_dir = undef + $vhost_dir = "${httpd_dir}/vhosts.d" + $vhost_enable_dir = undef + $conf_file = 'httpd.conf' + $ssl_file = "${mod_dir}/ssl.conf" + $ports_file = "${conf_dir}/ports.conf" + $logroot = '/var/log/apache2' + $logroot_mode = undef + $lib_path = '/usr/lib/apache2/modules' + $mpm_module = 'prefork' + $dev_packages = undef + $default_ssl_cert = '/etc/ssl/apache2/server.crt' + $default_ssl_key = '/etc/ssl/apache2/server.key' + $ssl_certs_dir = '/etc/ssl/apache2' + $passenger_root = '/usr' + $passenger_ruby = '/usr/bin/ruby' + $passenger_conf_file = 'passenger.conf' + $passenger_conf_package_file = undef + $passenger_default_ruby = undef + $suphp_addhandler = 'x-httpd-php' + $suphp_engine = 'off' + $suphp_configpath = '/etc/php5/apache2' + $php_version = '5' + $mod_packages = { + # NOTE: I list here only modules that are not included in www-servers/apache + 'auth_kerb' => 'www-apache/mod_auth_kerb', + 'authnz_external' => 'www-apache/mod_authnz_external', + 'fcgid' => 'www-apache/mod_fcgid', + 'passenger' => 'www-apache/passenger', + 'perl' => 'www-apache/mod_perl', + 'phpXXX' => 'dev-lang/php', + 'proxy_html' => 'www-apache/mod_proxy_html', + 'proxy_fcgi' => 'www-apache/mod_proxy_fcgi', + 'python' => 'www-apache/mod_python', + 'wsgi' => 'www-apache/mod_wsgi', + 'dav_svn' => 'dev-vcs/subversion', + 'xsendfile' => 'www-apache/mod_xsendfile', + 'rpaf' => 'www-apache/mod_rpaf', + 'xml2enc' => 'www-apache/mod_xml2enc', + } + $mod_libs = { + } + $conf_template = 'apache/httpd.conf.erb' + $keepalive = 'Off' + $keepalive_timeout = 15 + $max_keepalive_requests = 100 + $fastcgi_lib_path = undef # TODO: revisit + $mime_support_package = 'app-misc/mime-types' + $mime_types_config = '/etc/mime.types' + $wsgi_socket_prefix = undef + $docroot = '/var/www/localhost/htdocs' + $alias_icons_path = '/usr/share/apache2/icons' + $error_documents_path = '/usr/share/apache2/error' + $pidfile = '/var/run/apache2.pid' + $error_log = 'error.log' + $scriptalias = '/var/www/localhost/cgi-bin' + $access_log_file = 'access.log' + } elsif $::osfamily == 'Suse' { + $user = 'wwwrun' + $group = 'wwwrun' + $root_group = 'root' + $apache_name = 'apache2' + $service_name = 'apache2' + $httpd_dir = '/etc/apache2' + $server_root = '/etc/apache2' + $conf_dir = $httpd_dir + $confd_dir = "${httpd_dir}/conf.d" + $mod_dir = "${httpd_dir}/mods-available" + $mod_enable_dir = "${httpd_dir}/mods-enabled" + $vhost_dir = "${httpd_dir}/sites-available" + $vhost_enable_dir = "${httpd_dir}/sites-enabled" + $conf_file = 'httpd.conf' + $ssl_file = "${mod_dir}/ssl.conf" + $ports_file = "${conf_dir}/ports.conf" + $pidfile = '/var/run/httpd2.pid' + $logroot = '/var/log/apache2' + $logroot_mode = undef + $lib_path = '/usr/lib64/apache2' #changes for some modules based on mpm + $mpm_module = 'prefork' + $default_ssl_cert = '/etc/apache2/ssl.crt/server.crt' + $default_ssl_key = '/etc/apache2/ssl.key/server.key' + $ssl_certs_dir = '/etc/ssl/certs' + $suphp_addhandler = 'x-httpd-php' + $suphp_engine = 'off' + $suphp_configpath = '/etc/php5/apache2' + $php_version = '5' + if $::operatingsystemrelease < '11' or $::operatingsystemrelease >= '12' { + $mod_packages = { + 'auth_kerb' => 'apache2-mod_auth_kerb', + 'perl' => 'apache2-mod_perl', + 'php5' => 'apache2-mod_php5', + 'python' => 'apache2-mod_python', + 'security' => 'apache2-mod_security2', + 'worker' => 'apache2-worker', + } + } else { + $mod_packages = { + 'auth_kerb' => 'apache2-mod_auth_kerb', + 'perl' => 'apache2-mod_perl', + 'php5' => 'apache2-mod_php53', + 'python' => 'apache2-mod_python', + 'security' => 'apache2-mod_security2', + } + } + $mod_libs = { + 'security' => '/usr/lib64/apache2/mod_security2.so', + 'php53' => '/usr/lib64/apache2/mod_php5.so', + } + $conf_template = 'apache/httpd.conf.erb' + $keepalive = 'Off' + $keepalive_timeout = 15 + $max_keepalive_requests = 100 + $fastcgi_lib_path = '/var/lib/apache2/fastcgi' + $mime_support_package = 'aaa_base' + $mime_types_config = '/etc/mime.types' + $docroot = '/srv/www' + $cas_cookie_path = '/var/cache/apache2/mod_auth_cas/' + $mellon_lock_file = undef + $mellon_cache_size = undef + $mellon_post_directory = undef + $alias_icons_path = '/usr/share/apache2/icons' + $error_documents_path = '/usr/share/apache2/error' + $dev_packages = ['libapr-util1-devel', 'libapr1-devel', 'libcurl-devel'] + $modsec_crs_package = undef + $modsec_crs_path = undef + $modsec_default_rules = undef + $modsec_dir = '/etc/apache2/modsecurity' + $secpcrematchlimit = 1500 + $secpcrematchlimitrecursion = 1500 + $modsec_secruleengine = 'On' + $error_log = 'error.log' + $scriptalias = '/usr/lib/cgi-bin' + $access_log_file = 'access.log' + + # + # Passenger-specific settings + # + + $passenger_conf_file = 'passenger.conf' + $passenger_conf_package_file = undef + + $passenger_root = '/usr/lib64/ruby/gems/1.8/gems/passenger-5.0.30' + $passenger_ruby = '/usr/bin/ruby' + $passenger_default_ruby = '/usr/bin/ruby' + $wsgi_socket_prefix = undef + + } else { + fail("Class['apache::params']: Unsupported osfamily: ${::osfamily}") + } +} diff --git a/environments/production/modules/apache/manifests/peruser/multiplexer.pp b/environments/production/modules/apache/manifests/peruser/multiplexer.pp new file mode 100644 index 0000000..97143a1 --- /dev/null +++ b/environments/production/modules/apache/manifests/peruser/multiplexer.pp @@ -0,0 +1,17 @@ +define apache::peruser::multiplexer ( + $user = $::apache::user, + $group = $::apache::group, + $file = undef, +) { + if ! $file { + $filename = "${name}.conf" + } else { + $filename = $file + } + file { "${::apache::mod_dir}/peruser/multiplexers/${filename}": + ensure => file, + content => "Multiplexer ${user} ${group}\n", + require => File["${::apache::mod_dir}/peruser/multiplexers"], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/peruser/processor.pp b/environments/production/modules/apache/manifests/peruser/processor.pp new file mode 100644 index 0000000..30de61d --- /dev/null +++ b/environments/production/modules/apache/manifests/peruser/processor.pp @@ -0,0 +1,17 @@ +define apache::peruser::processor ( + $user, + $group, + $file = undef, +) { + if ! $file { + $filename = "${name}.conf" + } else { + $filename = $file + } + file { "${::apache::mod_dir}/peruser/processors/${filename}": + ensure => file, + content => "Processor ${user} ${group}\n", + require => File["${::apache::mod_dir}/peruser/processors"], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/php.pp b/environments/production/modules/apache/manifests/php.pp new file mode 100644 index 0000000..9fa9c68 --- /dev/null +++ b/environments/production/modules/apache/manifests/php.pp @@ -0,0 +1,18 @@ +# Class: apache::php +# +# This class installs PHP for Apache +# +# Parameters: +# - $php_package +# +# Actions: +# - Install Apache PHP package +# +# Requires: +# +# Sample Usage: +# +class apache::php { + warning('apache::php is deprecated; please use apache::mod::php') + include ::apache::mod::php +} diff --git a/environments/production/modules/apache/manifests/proxy.pp b/environments/production/modules/apache/manifests/proxy.pp new file mode 100644 index 0000000..050f36c --- /dev/null +++ b/environments/production/modules/apache/manifests/proxy.pp @@ -0,0 +1,15 @@ +# Class: apache::proxy +# +# This class enabled the proxy module for Apache +# +# Actions: +# - Enables Apache Proxy module +# +# Requires: +# +# Sample Usage: +# +class apache::proxy { + warning('apache::proxy is deprecated; please use apache::mod::proxy') + include ::apache::mod::proxy +} diff --git a/environments/production/modules/apache/manifests/python.pp b/environments/production/modules/apache/manifests/python.pp new file mode 100644 index 0000000..723a753 --- /dev/null +++ b/environments/production/modules/apache/manifests/python.pp @@ -0,0 +1,18 @@ +# Class: apache::python +# +# This class installs Python for Apache +# +# Parameters: +# - $php_package +# +# Actions: +# - Install Apache Python package +# +# Requires: +# +# Sample Usage: +# +class apache::python { + warning('apache::python is deprecated; please use apache::mod::python') + include ::apache::mod::python +} diff --git a/environments/production/modules/apache/manifests/security/rule_link.pp b/environments/production/modules/apache/manifests/security/rule_link.pp new file mode 100644 index 0000000..7edb1f4 --- /dev/null +++ b/environments/production/modules/apache/manifests/security/rule_link.pp @@ -0,0 +1,18 @@ +define apache::security::rule_link () { + + $parts = split($title, '/') + $filename = $parts[-1] + + $target = $title ? { + /^\// => $title, + default => "${::apache::params::modsec_crs_path}/${title}", + } + + file { $filename: + ensure => 'link', + path => "${::apache::mod::security::modsec_dir}/activated_rules/${filename}", + target => $target , + require => File["${::apache::mod::security::modsec_dir}/activated_rules"], + notify => Class['apache::service'], + } +} diff --git a/environments/production/modules/apache/manifests/service.pp b/environments/production/modules/apache/manifests/service.pp new file mode 100644 index 0000000..f90097d --- /dev/null +++ b/environments/production/modules/apache/manifests/service.pp @@ -0,0 +1,53 @@ +# Class: apache::service +# +# Manages the Apache daemon +# +# Parameters: +# +# Actions: +# - Manage Apache service +# +# Requires: +# +# Sample Usage: +# +# sometype { 'foo': +# notify => Class['apache::service'], +# } +# +# +class apache::service ( + $service_name = $::apache::params::service_name, + $service_enable = true, + $service_ensure = 'running', + $service_manage = true, + $service_restart = undef +) { + # The base class must be included first because parameter defaults depend on it + if ! defined(Class['apache::params']) { + fail('You must include the apache::params class before using any apache defined resources') + } + validate_bool($service_enable) + validate_bool($service_manage) + + case $service_ensure { + true, false, 'running', 'stopped': { + $_service_ensure = $service_ensure + } + default: { + $_service_ensure = undef + } + } + + $service_hasrestart = $service_restart == undef + + if $service_manage { + service { 'httpd': + ensure => $_service_ensure, + name => $service_name, + enable => $service_enable, + restart => $service_restart, + hasrestart => $service_hasrestart, + } + } +} diff --git a/environments/production/modules/apache/manifests/ssl.pp b/environments/production/modules/apache/manifests/ssl.pp new file mode 100644 index 0000000..d0b3659 --- /dev/null +++ b/environments/production/modules/apache/manifests/ssl.pp @@ -0,0 +1,18 @@ +# Class: apache::ssl +# +# This class installs Apache SSL capabilities +# +# Parameters: +# - The $ssl_package name from the apache::params class +# +# Actions: +# - Install Apache SSL capabilities +# +# Requires: +# +# Sample Usage: +# +class apache::ssl { + warning('apache::ssl is deprecated; please use apache::mod::ssl') + include ::apache::mod::ssl +} diff --git a/environments/production/modules/apache/manifests/version.pp b/environments/production/modules/apache/manifests/version.pp new file mode 100644 index 0000000..2d33a5f --- /dev/null +++ b/environments/production/modules/apache/manifests/version.pp @@ -0,0 +1,49 @@ +# Class: apache::version +# +# Try to automatically detect the version by OS +# +class apache::version { + # This will be 5 or 6 on RedHat, 6 or wheezy on Debian, 12 or quantal on Ubuntu, etc. + $osr_array = split($::operatingsystemrelease,'[\/\.]') + $distrelease = $osr_array[0] + if ! $distrelease { + fail("Class['apache::version']: Unparsable \$::operatingsystemrelease: ${::operatingsystemrelease}") + } + + case $::osfamily { + 'RedHat': { + if ($::operatingsystem == 'Amazon') { + $default = '2.2' + } elsif ($::operatingsystem == 'Fedora' and versioncmp($distrelease, '18') >= 0) or ($::operatingsystem != 'Fedora' and versioncmp($distrelease, '7') >= 0) { + $default = '2.4' + } else { + $default = '2.2' + } + } + 'Debian': { + if $::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemrelease, '13.10') >= 0 { + $default = '2.4' + } elsif $::operatingsystem == 'Debian' and versioncmp($distrelease, '8') >= 0 { + $default = '2.4' + } else { + $default = '2.2' + } + } + 'FreeBSD': { + $default = '2.4' + } + 'Gentoo': { + $default = '2.4' + } + 'Suse': { + if $::operatingsystem == 'SLES' and $::operatingsystemrelease >= '12' { + $default = '2.4' + } else { + $default = '2.2' + } + } + default: { + fail("Class['apache::version']: Unsupported osfamily: ${::osfamily}") + } + } +} diff --git a/environments/production/modules/apache/manifests/vhost.pp b/environments/production/modules/apache/manifests/vhost.pp new file mode 100644 index 0000000..fbd297f --- /dev/null +++ b/environments/production/modules/apache/manifests/vhost.pp @@ -0,0 +1,1164 @@ +# See README.md for usage information +define apache::vhost( + $docroot, + $manage_docroot = true, + $virtual_docroot = false, + $port = undef, + $ip = undef, + $ip_based = false, + $add_listen = true, + $docroot_owner = 'root', + $docroot_group = $::apache::params::root_group, + $docroot_mode = undef, + $serveradmin = undef, + $ssl = false, + $ssl_cert = $::apache::default_ssl_cert, + $ssl_key = $::apache::default_ssl_key, + $ssl_chain = $::apache::default_ssl_chain, + $ssl_ca = $::apache::default_ssl_ca, + $ssl_crl_path = $::apache::default_ssl_crl_path, + $ssl_crl = $::apache::default_ssl_crl, + $ssl_crl_check = $::apache::default_ssl_crl_check, + $ssl_certs_dir = $::apache::params::ssl_certs_dir, + $ssl_protocol = undef, + $ssl_cipher = undef, + $ssl_honorcipherorder = undef, + $ssl_verify_client = undef, + $ssl_verify_depth = undef, + $ssl_proxy_verify = undef, + $ssl_proxy_check_peer_cn = undef, + $ssl_proxy_check_peer_name = undef, + $ssl_proxy_check_peer_expire = undef, + $ssl_proxy_machine_cert = undef, + $ssl_proxy_protocol = undef, + $ssl_options = undef, + $ssl_openssl_conf_cmd = undef, + $ssl_proxyengine = false, + $ssl_stapling = undef, + $ssl_stapling_timeout = undef, + $ssl_stapling_return_errors = undef, + $priority = undef, + $default_vhost = false, + $servername = $name, + $serveraliases = [], + $options = ['Indexes','FollowSymLinks','MultiViews'], + $override = ['None'], + $directoryindex = '', + $vhost_name = '*', + $logroot = $::apache::logroot, + $logroot_ensure = 'directory', + $logroot_mode = undef, + $logroot_owner = undef, + $logroot_group = undef, + $log_level = undef, + $access_log = true, + $access_log_file = false, + $access_log_pipe = false, + $access_log_syslog = false, + $access_log_format = false, + $access_log_env_var = false, + $access_logs = undef, + $aliases = undef, + $directories = undef, + $error_log = true, + $error_log_file = undef, + $error_log_pipe = undef, + $error_log_syslog = undef, + $modsec_audit_log = undef, + $modsec_audit_log_file = undef, + $modsec_audit_log_pipe = undef, + $error_documents = [], + $fallbackresource = undef, + $scriptalias = undef, + $scriptaliases = [], + $proxy_dest = undef, + $proxy_dest_match = undef, + $proxy_dest_reverse_match = undef, + $proxy_pass = undef, + $proxy_pass_match = undef, + $suphp_addhandler = $::apache::params::suphp_addhandler, + $suphp_engine = $::apache::params::suphp_engine, + $suphp_configpath = $::apache::params::suphp_configpath, + $php_flags = {}, + $php_values = {}, + $php_admin_flags = {}, + $php_admin_values = {}, + $no_proxy_uris = [], + $no_proxy_uris_match = [], + $proxy_preserve_host = false, + $proxy_add_headers = undef, + $proxy_error_override = false, + $redirect_source = '/', + $redirect_dest = undef, + $redirect_status = undef, + $redirectmatch_status = undef, + $redirectmatch_regexp = undef, + $redirectmatch_dest = undef, + $rack_base_uris = undef, + $passenger_base_uris = undef, + $headers = undef, + $request_headers = undef, + $filters = undef, + $rewrites = undef, + $rewrite_base = undef, + $rewrite_rule = undef, + $rewrite_cond = undef, + $rewrite_inherit = false, + $setenv = [], + $setenvif = [], + $setenvifnocase = [], + $block = [], + $ensure = 'present', + $wsgi_application_group = undef, + $wsgi_daemon_process = undef, + $wsgi_daemon_process_options = undef, + $wsgi_import_script = undef, + $wsgi_import_script_options = undef, + $wsgi_process_group = undef, + $wsgi_script_aliases_match = undef, + $wsgi_script_aliases = undef, + $wsgi_pass_authorization = undef, + $wsgi_chunked_request = undef, + $custom_fragment = undef, + $itk = undef, + $action = undef, + $fastcgi_server = undef, + $fastcgi_socket = undef, + $fastcgi_dir = undef, + $fastcgi_idle_timeout = undef, + $additional_includes = [], + $use_optional_includes = $::apache::use_optional_includes, + $apache_version = $::apache::apache_version, + $allow_encoded_slashes = undef, + $suexec_user_group = undef, + $passenger_app_root = undef, + $passenger_app_env = undef, + $passenger_ruby = undef, + $passenger_min_instances = undef, + $passenger_start_timeout = undef, + $passenger_pre_start = undef, + $passenger_user = undef, + $passenger_high_performance = undef, + $passenger_nodejs = undef, + $passenger_sticky_sessions = undef, + $passenger_startup_file = undef, + $add_default_charset = undef, + $modsec_disable_vhost = undef, + $modsec_disable_ids = undef, + $modsec_disable_ips = undef, + $modsec_disable_msgs = undef, + $modsec_disable_tags = undef, + $modsec_body_limit = undef, + $jk_mounts = undef, + $auth_kerb = false, + $krb_method_negotiate = 'on', + $krb_method_k5passwd = 'on', + $krb_authoritative = 'on', + $krb_auth_realms = [], + $krb_5keytab = undef, + $krb_local_user_mapping = undef, + $krb_verify_kdc = 'on', + $krb_servicename = 'HTTP', + $krb_save_credentials = 'off', + $keepalive = undef, + $keepalive_timeout = undef, + $max_keepalive_requests = undef, + $cas_attribute_prefix = undef, + $cas_attribute_delimiter = undef, + $cas_scrub_request_headers = undef, + $cas_sso_enabled = undef, + $cas_login_url = undef, + $cas_validate_url = undef, + $cas_validate_saml = undef, +) { + # The base class must be included first because it is used by parameter defaults + if ! defined(Class['apache']) { + fail('You must include the apache base class before using any apache defined resources') + } + + $apache_name = $::apache::apache_name + + validate_re($ensure, '^(present|absent)$', + "${ensure} is not supported for ensure. + Allowed values are 'present' and 'absent'.") + validate_re($suphp_engine, '^(on|off)$', + "${suphp_engine} is not supported for suphp_engine. + Allowed values are 'on' and 'off'.") + validate_bool($ip_based) + validate_bool($access_log) + validate_bool($error_log) + if $modsec_audit_log != undef { + validate_bool($modsec_audit_log) + } + validate_bool($ssl) + validate_bool($default_vhost) + validate_bool($ssl_proxyengine) + if $ssl_stapling != undef { + validate_bool($ssl_stapling) + } + if $rewrites { + validate_array($rewrites) + unless empty($rewrites) { + $rewrites_flattened = delete_undef_values(flatten([$rewrites])) + validate_hash($rewrites_flattened[0]) + } + } + + # Input validation begins + + if $suexec_user_group { + validate_re($suexec_user_group, '^[\w-]+ [\w-]+$', + "${suexec_user_group} is not supported for suexec_user_group. Must be 'user group'.") + } + + if $wsgi_pass_authorization { + validate_re(downcase($wsgi_pass_authorization), '^(on|off)$', + "${wsgi_pass_authorization} is not supported for wsgi_pass_authorization. + Allowed values are 'on' and 'off'.") + } + + if $wsgi_chunked_request { + validate_re(downcase($wsgi_chunked_request), '^(on|off)$', + "${wsgi_chunked_request} is not supported for wsgi_chunked_request. + Allowed values are 'on' and 'off'.") + } + + # Deprecated backwards-compatibility + if $rewrite_base { + warning('Apache::Vhost: parameter rewrite_base is deprecated in favor of rewrites') + } + if $rewrite_rule { + warning('Apache::Vhost: parameter rewrite_rule is deprecated in favor of rewrites') + } + if $rewrite_cond { + warning('Apache::Vhost parameter rewrite_cond is deprecated in favor of rewrites') + } + + if $wsgi_script_aliases { + validate_hash($wsgi_script_aliases) + } + if $wsgi_script_aliases_match { + validate_hash($wsgi_script_aliases_match) + } + if $wsgi_daemon_process_options { + validate_hash($wsgi_daemon_process_options) + } + if $wsgi_import_script_options { + validate_hash($wsgi_import_script_options) + } + if $itk { + validate_hash($itk) + } + + validate_re($logroot_ensure, '^(directory|absent)$', + "${logroot_ensure} is not supported for logroot_ensure. + Allowed values are 'directory' and 'absent'.") + + if $log_level { + validate_apache_log_level($log_level) + } + + if $access_log_file and $access_log_pipe { + fail("Apache::Vhost[${name}]: 'access_log_file' and 'access_log_pipe' cannot be defined at the same time") + } + + if $error_log_file and $error_log_pipe { + fail("Apache::Vhost[${name}]: 'error_log_file' and 'error_log_pipe' cannot be defined at the same time") + } + + if $modsec_audit_log_file and $modsec_audit_log_pipe { + fail("Apache::Vhost[${name}]: 'modsec_audit_log_file' and 'modsec_audit_log_pipe' cannot be defined at the same time") + } + + if $fallbackresource { + validate_re($fallbackresource, '^/|disabled', 'Please make sure fallbackresource starts with a / (or is "disabled")') + } + + if $custom_fragment { + validate_string($custom_fragment) + } + + if $allow_encoded_slashes { + validate_re($allow_encoded_slashes, '(^on$|^off$|^nodecode$)', "${allow_encoded_slashes} is not permitted for allow_encoded_slashes. Allowed values are 'on', 'off' or 'nodecode'.") + } + + validate_bool($auth_kerb) + + # Validate the docroot as a string if: + # - $manage_docroot is true + if $manage_docroot { + validate_string($docroot) + } + + if $ssl_proxy_verify { + validate_re($ssl_proxy_verify,'^(none|optional|require|optional_no_ca)$',"${ssl_proxy_verify} is not permitted for ssl_proxy_verify. Allowed values are 'none', 'optional', 'require' or 'optional_no_ca'.") + } + + if $ssl_proxy_check_peer_cn { + validate_re($ssl_proxy_check_peer_cn,'(^on$|^off$)',"${ssl_proxy_check_peer_cn} is not permitted for ssl_proxy_check_peer_cn. Allowed values are 'on' or 'off'.") + } + if $ssl_proxy_check_peer_name { + validate_re($ssl_proxy_check_peer_name,'(^on$|^off$)',"${ssl_proxy_check_peer_name} is not permitted for ssl_proxy_check_peer_name. Allowed values are 'on' or 'off'.") + } + + if $ssl_proxy_check_peer_expire { + validate_re($ssl_proxy_check_peer_expire,'(^on$|^off$)',"${ssl_proxy_check_peer_expire} is not permitted for ssl_proxy_check_peer_expire. Allowed values are 'on' or 'off'.") + } + + if $keepalive { + validate_re($keepalive,'(^on$|^off$)',"${keepalive} is not permitted for keepalive. Allowed values are 'on' or 'off'.") + } + + if $passenger_sticky_sessions { + validate_bool($passenger_sticky_sessions) + } + + # Input validation ends + + if $ssl and $ensure == 'present' { + include ::apache::mod::ssl + # Required for the AddType lines. + include ::apache::mod::mime + } + + if $auth_kerb and $ensure == 'present' { + include ::apache::mod::auth_kerb + } + + if $virtual_docroot { + include ::apache::mod::vhost_alias + } + + if $wsgi_daemon_process { + include ::apache::mod::wsgi + } + + if $suexec_user_group { + include ::apache::mod::suexec + } + + if $passenger_app_root or $passenger_app_env or $passenger_ruby or $passenger_min_instances or $passenger_start_timeout or $passenger_pre_start or $passenger_user or $passenger_high_performance or $passenger_nodejs or $passenger_sticky_sessions or $passenger_startup_file { + include ::apache::mod::passenger + } + + # Configure the defaultness of a vhost + if $priority { + $priority_real = "${priority}-" + } elsif $priority == false { + $priority_real = '' + } elsif $default_vhost { + $priority_real = '10-' + } else { + $priority_real = '25-' + } + + ## Apache include does not always work with spaces in the filename + $filename = regsubst($name, ' ', '_', 'G') + + # This ensures that the docroot exists + # But enables it to be specified across multiple vhost resources + if $manage_docroot and $docroot and ! defined(File[$docroot]) { + file { $docroot: + ensure => directory, + owner => $docroot_owner, + group => $docroot_group, + mode => $docroot_mode, + require => Package['httpd'], + before => Concat["${priority_real}${filename}.conf"], + } + } + + # Same as above, but for logroot + if ! defined(File[$logroot]) { + file { $logroot: + ensure => $logroot_ensure, + owner => $logroot_owner, + group => $logroot_group, + mode => $logroot_mode, + require => Package['httpd'], + before => Concat["${priority_real}${filename}.conf"], + } + } + + + # Is apache::mod::passenger enabled (or apache::mod['passenger']) + $passenger_enabled = defined(Apache::Mod['passenger']) + + # Is apache::mod::shib enabled (or apache::mod['shib2']) + $shibboleth_enabled = defined(Apache::Mod['shib2']) + + # Is apache::mod::cas enabled (or apache::mod['cas']) + $cas_enabled = defined(Apache::Mod['auth_cas']) + + if $access_log and !$access_logs { + if $access_log_file { + $_logs_dest = "${logroot}/${access_log_file}" + } elsif $access_log_pipe { + $_logs_dest = $access_log_pipe + } elsif $access_log_syslog { + $_logs_dest = $access_log_syslog + } else { + $_logs_dest = undef + } + $_access_logs = [{ + 'file' => $access_log_file, + 'pipe' => $access_log_pipe, + 'syslog' => $access_log_syslog, + 'format' => $access_log_format, + 'env' => $access_log_env_var + }] + } elsif $access_logs { + if !is_array($access_logs) { + fail("Apache::Vhost[${name}]: access_logs must be an array of hashes") + } + $_access_logs = $access_logs + } + + if $error_log_file { + $error_log_destination = "${logroot}/${error_log_file}" + } elsif $error_log_pipe { + $error_log_destination = $error_log_pipe + } elsif $error_log_syslog { + $error_log_destination = $error_log_syslog + } else { + if $ssl { + $error_log_destination = "${logroot}/${name}_error_ssl.log" + } else { + $error_log_destination = "${logroot}/${name}_error.log" + } + } + + if $modsec_audit_log == false { + $modsec_audit_log_destination = undef + } elsif $modsec_audit_log_file { + $modsec_audit_log_destination = "${logroot}/${modsec_audit_log_file}" + } elsif $modsec_audit_log_pipe { + $modsec_audit_log_destination = $modsec_audit_log_pipe + } elsif $modsec_audit_log { + if $ssl { + $modsec_audit_log_destination = "${logroot}/${name}_security_ssl.log" + } else { + $modsec_audit_log_destination = "${logroot}/${name}_security.log" + } + } else { + $modsec_audit_log_destination = undef + } + + + if $ip { + $_ip = enclose_ipv6($ip) + if $port { + $listen_addr_port = suffix(any2array($_ip),":${port}") + $nvh_addr_port = suffix(any2array($_ip),":${port}") + } else { + $listen_addr_port = undef + $nvh_addr_port = $_ip + if ! $servername and ! $ip_based { + fail("Apache::Vhost[${name}]: must pass 'ip' and/or 'port' parameters for name-based vhosts") + } + } + } else { + if $port { + $listen_addr_port = $port + $nvh_addr_port = "${vhost_name}:${port}" + } else { + $listen_addr_port = undef + $nvh_addr_port = $name + if ! $servername and $servername != '' { + fail("Apache::Vhost[${name}]: must pass 'ip' and/or 'port' parameters, and/or 'servername' parameter") + } + } + } + if $add_listen { + if $ip and defined(Apache::Listen["${port}"]) { + fail("Apache::Vhost[${name}]: Mixing IP and non-IP Listen directives is not possible; check the add_listen parameter of the apache::vhost define to disable this") + } + if $listen_addr_port and $ensure == 'present' { + ensure_resource('apache::listen', $listen_addr_port) + } + } + if ! $ip_based { + if $ensure == 'present' and (versioncmp($apache_version, '2.4') < 0) { + ensure_resource('apache::namevirtualhost', $nvh_addr_port) + } + } + + # Load mod_rewrite if needed and not yet loaded + if $rewrites or $rewrite_cond { + if ! defined(Class['apache::mod::rewrite']) { + include ::apache::mod::rewrite + } + } + + # Load mod_alias if needed and not yet loaded + if ($scriptalias or $scriptaliases != []) or ($aliases and $aliases != []) or ($redirect_source and $redirect_dest) { + if ! defined(Class['apache::mod::alias']) and ($ensure == 'present') { + include ::apache::mod::alias + } + } + + # Load mod_proxy if needed and not yet loaded + if ($proxy_dest or $proxy_pass or $proxy_pass_match or $proxy_dest_match) { + if ! defined(Class['apache::mod::proxy']) { + include ::apache::mod::proxy + } + if ! defined(Class['apache::mod::proxy_http']) { + include ::apache::mod::proxy_http + } + } + + # Load mod_passenger if needed and not yet loaded + if $rack_base_uris { + if ! defined(Class['apache::mod::passenger']) { + include ::apache::mod::passenger + } + } + + # Load mod_passenger if needed and not yet loaded + if $passenger_base_uris { + include ::apache::mod::passenger + } + + # Load mod_fastci if needed and not yet loaded + if $fastcgi_server and $fastcgi_socket { + if ! defined(Class['apache::mod::fastcgi']) { + include ::apache::mod::fastcgi + } + } + + # Check if mod_headers is required to process $headers/$request_headers + if $headers or $request_headers { + if ! defined(Class['apache::mod::headers']) { + include ::apache::mod::headers + } + } + + # Check if mod_filter is required to process $filters + if $filters { + if ! defined(Class['apache::mod::filter']) { + include ::apache::mod::filter + } + } + + # Check if mod_env is required and not yet loaded. + # create an expression to simplify the conditional check + $use_env_mod = $setenv and ! empty($setenv) + if ($use_env_mod) { + if ! defined(Class['apache::mod::env']) { + include ::apache::mod::env + } + } + # Check if mod_setenvif is required and not yet loaded. + # create an expression to simplify the conditional check + $use_setenvif_mod = ($setenvif and ! empty($setenvif)) or ($setenvifnocase and ! empty($setenvifnocase)) + + if ($use_setenvif_mod) { + if ! defined(Class['apache::mod::setenvif']) { + include ::apache::mod::setenvif + } + } + + ## Create a default directory list if none defined + if $directories { + if !is_hash($directories) and !(is_array($directories) and is_hash($directories[0])) { + fail("Apache::Vhost[${name}]: 'directories' must be either a Hash or an Array of Hashes") + } + $_directories = $directories + } elsif $docroot { + $_directory = { + provider => 'directory', + path => $docroot, + options => $options, + allow_override => $override, + directoryindex => $directoryindex, + } + + if versioncmp($apache_version, '2.4') >= 0 { + $_directory_version = { + require => 'all granted', + } + } else { + $_directory_version = { + order => 'allow,deny', + allow => 'from all', + } + } + + $_directories = [ merge($_directory, $_directory_version) ] + } else { + $_directories = undef + } + + ## Create a global LocationMatch if locations aren't defined + if $modsec_disable_ids { + if is_hash($modsec_disable_ids) { + $_modsec_disable_ids = $modsec_disable_ids + } elsif is_array($modsec_disable_ids) { + $_modsec_disable_ids = { '.*' => $modsec_disable_ids } + } else { + fail("Apache::Vhost[${name}]: 'modsec_disable_ids' must be either a Hash of location/IDs or an Array of IDs") + } + } + + if $modsec_disable_msgs { + if is_hash($modsec_disable_msgs) { + $_modsec_disable_msgs = $modsec_disable_msgs + } elsif is_array($modsec_disable_msgs) { + $_modsec_disable_msgs = { '.*' => $modsec_disable_msgs } + } else { + fail("Apache::Vhost[${name}]: 'modsec_disable_msgs' must be either a Hash of location/Msgs or an Array of Msgs") + } + } + + if $modsec_disable_tags { + if is_hash($modsec_disable_tags) { + $_modsec_disable_tags = $modsec_disable_tags + } elsif is_array($modsec_disable_tags) { + $_modsec_disable_tags = { '.*' => $modsec_disable_tags } + } else { + fail("Apache::Vhost[${name}]: 'modsec_disable_tags' must be either a Hash of location/Tags or an Array of Tags") + } + } + + concat { "${priority_real}${filename}.conf": + ensure => $ensure, + path => "${::apache::vhost_dir}/${priority_real}${filename}.conf", + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + order => 'numeric', + require => Package['httpd'], + notify => Class['apache::service'], + } + # NOTE(pabelanger): This code is duplicated in ::apache::vhost::custom and + # needs to be converted into something generic. + if $::apache::vhost_enable_dir { + $vhost_enable_dir = $::apache::vhost_enable_dir + $vhost_symlink_ensure = $ensure ? { + present => link, + default => $ensure, + } + file{ "${priority_real}${filename}.conf symlink": + ensure => $vhost_symlink_ensure, + path => "${vhost_enable_dir}/${priority_real}${filename}.conf", + target => "${::apache::vhost_dir}/${priority_real}${filename}.conf", + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + require => Concat["${priority_real}${filename}.conf"], + notify => Class['apache::service'], + } + } + + # Template uses: + # - $nvh_addr_port + # - $servername + # - $serveradmin + concat::fragment { "${name}-apache-header": + target => "${priority_real}${filename}.conf", + order => 0, + content => template('apache/vhost/_file_header.erb'), + } + + # Template uses: + # - $virtual_docroot + # - $docroot + if $docroot { + concat::fragment { "${name}-docroot": + target => "${priority_real}${filename}.conf", + order => 10, + content => template('apache/vhost/_docroot.erb'), + } + } + + # Template uses: + # - $aliases + if $aliases and ! empty($aliases) { + concat::fragment { "${name}-aliases": + target => "${priority_real}${filename}.conf", + order => 20, + content => template('apache/vhost/_aliases.erb'), + } + } + + # Template uses: + # - $itk + # - $::kernelversion + if $itk and ! empty($itk) { + concat::fragment { "${name}-itk": + target => "${priority_real}${filename}.conf", + order => 30, + content => template('apache/vhost/_itk.erb'), + } + } + + # Template uses: + # - $fallbackresource + if $fallbackresource { + concat::fragment { "${name}-fallbackresource": + target => "${priority_real}${filename}.conf", + order => 40, + content => template('apache/vhost/_fallbackresource.erb'), + } + } + + # Template uses: + # - $allow_encoded_slashes + if $allow_encoded_slashes { + concat::fragment { "${name}-allow_encoded_slashes": + target => "${priority_real}${filename}.conf", + order => 50, + content => template('apache/vhost/_allow_encoded_slashes.erb'), + } + } + + # Template uses: + # - $_directories + # - $docroot + # - $apache_version + # - $suphp_engine + # - $shibboleth_enabled + if $_directories and ! empty($_directories) { + concat::fragment { "${name}-directories": + target => "${priority_real}${filename}.conf", + order => 60, + content => template('apache/vhost/_directories.erb'), + } + } + + # Template uses: + # - $additional_includes + if $additional_includes and ! empty($additional_includes) { + concat::fragment { "${name}-additional_includes": + target => "${priority_real}${filename}.conf", + order => 70, + content => template('apache/vhost/_additional_includes.erb'), + } + } + + # Template uses: + # - $error_log + # - $log_level + # - $error_log_destination + # - $log_level + if $error_log or $log_level { + concat::fragment { "${name}-logging": + target => "${priority_real}${filename}.conf", + order => 80, + content => template('apache/vhost/_logging.erb'), + } + } + + # Template uses no variables + concat::fragment { "${name}-serversignature": + target => "${priority_real}${filename}.conf", + order => 90, + content => template('apache/vhost/_serversignature.erb'), + } + + # Template uses: + # - $access_log + # - $_access_log_env_var + # - $access_log_destination + # - $_access_log_format + # - $_access_log_env_var + # - $access_logs + if $access_log or $access_logs { + concat::fragment { "${name}-access_log": + target => "${priority_real}${filename}.conf", + order => 100, + content => template('apache/vhost/_access_log.erb'), + } + } + + # Template uses: + # - $action + if $action { + concat::fragment { "${name}-action": + target => "${priority_real}${filename}.conf", + order => 110, + content => template('apache/vhost/_action.erb'), + } + } + + # Template uses: + # - $block + # - $apache_version + if $block and ! empty($block) { + concat::fragment { "${name}-block": + target => "${priority_real}${filename}.conf", + order => 120, + content => template('apache/vhost/_block.erb'), + } + } + + # Template uses: + # - $error_documents + if $error_documents and ! empty($error_documents) { + concat::fragment { "${name}-error_document": + target => "${priority_real}${filename}.conf", + order => 130, + content => template('apache/vhost/_error_document.erb'), + } + } + + # Template uses: + # - $headers + if $headers and ! empty($headers) { + concat::fragment { "${name}-header": + target => "${priority_real}${filename}.conf", + order => 140, + content => template('apache/vhost/_header.erb'), + } + } + + # Template uses: + # - $request_headers + if $request_headers and ! empty($request_headers) { + concat::fragment { "${name}-requestheader": + target => "${priority_real}${filename}.conf", + order => 150, + content => template('apache/vhost/_requestheader.erb'), + } + } + + # Template uses: + # - $proxy_dest + # - $proxy_pass + # - $proxy_pass_match + # - $proxy_preserve_host + # - $proxy_add_headers + # - $no_proxy_uris + if $proxy_dest or $proxy_pass or $proxy_pass_match or $proxy_dest_match { + concat::fragment { "${name}-proxy": + target => "${priority_real}${filename}.conf", + order => 160, + content => template('apache/vhost/_proxy.erb'), + } + } + + # Template uses: + # - $rack_base_uris + if $rack_base_uris { + concat::fragment { "${name}-rack": + target => "${priority_real}${filename}.conf", + order => 170, + content => template('apache/vhost/_rack.erb'), + } + } + + # Template uses: + # - $passenger_base_uris + if $passenger_base_uris { + concat::fragment { "${name}-passenger_uris": + target => "${priority_real}${filename}.conf", + order => 175, + content => template('apache/vhost/_passenger_base_uris.erb'), + } + } + + # Template uses: + # - $redirect_source + # - $redirect_dest + # - $redirect_status + # - $redirect_dest_a + # - $redirect_source_a + # - $redirect_status_a + # - $redirectmatch_status + # - $redirectmatch_regexp + # - $redirectmatch_dest + # - $redirectmatch_status_a + # - $redirectmatch_regexp_a + # - $redirectmatch_dest + if ($redirect_source and $redirect_dest) or ($redirectmatch_regexp and $redirectmatch_dest) { + concat::fragment { "${name}-redirect": + target => "${priority_real}${filename}.conf", + order => 180, + content => template('apache/vhost/_redirect.erb'), + } + } + + # Template uses: + # - $rewrites + # - $rewrite_base + # - $rewrite_rule + # - $rewrite_cond + # - $rewrite_map + if $rewrites or $rewrite_rule { + concat::fragment { "${name}-rewrite": + target => "${priority_real}${filename}.conf", + order => 190, + content => template('apache/vhost/_rewrite.erb'), + } + } + + # Template uses: + # - $scriptaliases + # - $scriptalias + if ( $scriptalias or $scriptaliases != [] ) { + concat::fragment { "${name}-scriptalias": + target => "${priority_real}${filename}.conf", + order => 200, + content => template('apache/vhost/_scriptalias.erb'), + } + } + + # Template uses: + # - $serveraliases + if $serveraliases and ! empty($serveraliases) { + concat::fragment { "${name}-serveralias": + target => "${priority_real}${filename}.conf", + order => 210, + content => template('apache/vhost/_serveralias.erb'), + } + } + + # Template uses: + # - $setenv + # - $setenvif + if ($use_env_mod or $use_setenvif_mod) { + concat::fragment { "${name}-setenv": + target => "${priority_real}${filename}.conf", + order => 220, + content => template('apache/vhost/_setenv.erb'), + } + } + + # Template uses: + # - $ssl + # - $ssl_cert + # - $ssl_key + # - $ssl_chain + # - $ssl_certs_dir + # - $ssl_ca + # - $ssl_crl_path + # - $ssl_crl + # - $ssl_crl_check + # - $ssl_protocol + # - $ssl_cipher + # - $ssl_honorcipherorder + # - $ssl_verify_client + # - $ssl_verify_depth + # - $ssl_options + # - $ssl_openssl_conf_cmd + # - $ssl_stapling + # - $apache_version + if $ssl { + concat::fragment { "${name}-ssl": + target => "${priority_real}${filename}.conf", + order => 230, + content => template('apache/vhost/_ssl.erb'), + } + } + + # Template uses: + # - $ssl_proxyengine + # - $ssl_proxy_verify + # - $ssl_proxy_check_peer_cn + # - $ssl_proxy_check_peer_name + # - $ssl_proxy_check_peer_expire + # - $ssl_proxy_machine_cert + # - $ssl_proxy_protocol + if $ssl_proxyengine { + concat::fragment { "${name}-sslproxy": + target => "${priority_real}${filename}.conf", + order => 230, + content => template('apache/vhost/_sslproxy.erb'), + } + } + + # Template uses: + # - $auth_kerb + # - $krb_method_negotiate + # - $krb_method_k5passwd + # - $krb_authoritative + # - $krb_auth_realms + # - $krb_5keytab + # - $krb_local_user_mapping + if $auth_kerb { + concat::fragment { "${name}-auth_kerb": + target => "${priority_real}${filename}.conf", + order => 230, + content => template('apache/vhost/_auth_kerb.erb'), + } + } + + # Template uses: + # - $suphp_engine + # - $suphp_addhandler + # - $suphp_configpath + if $suphp_engine == 'on' { + concat::fragment { "${name}-suphp": + target => "${priority_real}${filename}.conf", + order => 240, + content => template('apache/vhost/_suphp.erb'), + } + } + + # Template uses: + # - $php_values + # - $php_flags + if ($php_values and ! empty($php_values)) or ($php_flags and ! empty($php_flags)) { + concat::fragment { "${name}-php": + target => "${priority_real}${filename}.conf", + order => 240, + content => template('apache/vhost/_php.erb'), + } + } + + # Template uses: + # - $php_admin_values + # - $php_admin_flags + if ($php_admin_values and ! empty($php_admin_values)) or ($php_admin_flags and ! empty($php_admin_flags)) { + concat::fragment { "${name}-php_admin": + target => "${priority_real}${filename}.conf", + order => 250, + content => template('apache/vhost/_php_admin.erb'), + } + } + + # Template uses: + # - $wsgi_application_group + # - $wsgi_daemon_process + # - $wsgi_daemon_process_options + # - $wsgi_import_script + # - $wsgi_import_script_options + # - $wsgi_process_group + # - $wsgi_script_aliases + # - $wsgi_pass_authorization + if $wsgi_application_group or $wsgi_daemon_process or ($wsgi_import_script and $wsgi_import_script_options) or $wsgi_process_group or ($wsgi_script_aliases and ! empty($wsgi_script_aliases)) or $wsgi_pass_authorization { + concat::fragment { "${name}-wsgi": + target => "${priority_real}${filename}.conf", + order => 260, + content => template('apache/vhost/_wsgi.erb'), + } + } + + # Template uses: + # - $custom_fragment + if $custom_fragment { + concat::fragment { "${name}-custom_fragment": + target => "${priority_real}${filename}.conf", + order => 270, + content => template('apache/vhost/_custom_fragment.erb'), + } + } + + # Template uses: + # - $fastcgi_server + # - $fastcgi_socket + # - $fastcgi_dir + # - $fastcgi_idle_timeout + # - $apache_version + if $fastcgi_server or $fastcgi_dir { + concat::fragment { "${name}-fastcgi": + target => "${priority_real}${filename}.conf", + order => 280, + content => template('apache/vhost/_fastcgi.erb'), + } + } + + # Template uses: + # - $suexec_user_group + if $suexec_user_group { + concat::fragment { "${name}-suexec": + target => "${priority_real}${filename}.conf", + order => 290, + content => template('apache/vhost/_suexec.erb'), + } + } + + # Template uses: + # - $passenger_app_root + # - $passenger_app_env + # - $passenger_ruby + # - $passenger_min_instances + # - $passenger_start_timeout + # - $passenger_pre_start + # - $passenger_user + # - $passenger_nodejs + # - $passenger_sticky_sessions + # - $passenger_startup_file + if $passenger_app_root or $passenger_app_env or $passenger_ruby or $passenger_min_instances or $passenger_start_timeout or $passenger_pre_start or $passenger_user or $passenger_nodejs or $passenger_sticky_sessions or $passenger_startup_file{ + concat::fragment { "${name}-passenger": + target => "${priority_real}${filename}.conf", + order => 300, + content => template('apache/vhost/_passenger.erb'), + } + } + + # Template uses: + # - $add_default_charset + if $add_default_charset { + concat::fragment { "${name}-charsets": + target => "${priority_real}${filename}.conf", + order => 310, + content => template('apache/vhost/_charsets.erb'), + } + } + + # Template uses: + # - $modsec_disable_vhost + # - $modsec_disable_ids + # - $modsec_disable_ips + # - $modsec_disable_msgs + # - $modsec_disable_tags + # - $modsec_body_limit + # - $modsec_audit_log_destination + if $modsec_disable_vhost or $modsec_disable_ids or $modsec_disable_ips or $modsec_disable_msgs or $modsec_disable_tags or $modsec_audit_log_destination { + concat::fragment { "${name}-security": + target => "${priority_real}${filename}.conf", + order => 320, + content => template('apache/vhost/_security.erb'), + } + } + + # Template uses: + # - $filters + if $filters and ! empty($filters) { + concat::fragment { "${name}-filters": + target => "${priority_real}${filename}.conf", + order => 330, + content => template('apache/vhost/_filters.erb'), + } + } + + # Template uses: + # - $jk_mounts + if $jk_mounts and ! empty($jk_mounts) { + concat::fragment { "${name}-jk_mounts": + target => "${priority_real}${filename}.conf", + order => 340, + content => template('apache/vhost/_jk_mounts.erb'), + } + } + + # Template uses: + # - $keepalive + # - $keepalive_timeout + # - $max_keepalive_requests + if $keepalive or $keepalive_timeout or $max_keepalive_requests { + concat::fragment { "${name}-keepalive_options": + target => "${priority_real}${filename}.conf", + order => 350, + content => template('apache/vhost/_keepalive_options.erb'), + } + } + + # Template uses: + # - $cas_* + if $cas_enabled { + concat::fragment { "${name}-auth_cas": + target => "${priority_real}${filename}.conf", + order => 350, + content => template('apache/vhost/_auth_cas.erb'), + } + } + + # Template uses no variables + concat::fragment { "${name}-file_footer": + target => "${priority_real}${filename}.conf", + order => 999, + content => template('apache/vhost/_file_footer.erb'), + } +} diff --git a/environments/production/modules/apache/manifests/vhost/custom.pp b/environments/production/modules/apache/manifests/vhost/custom.pp new file mode 100644 index 0000000..cfb06c2 --- /dev/null +++ b/environments/production/modules/apache/manifests/vhost/custom.pp @@ -0,0 +1,40 @@ +# See README.md for usage information +define apache::vhost::custom( + $content, + $ensure = 'present', + $priority = '25', + $verify_config = true, +) { + include ::apache + + ## Apache include does not always work with spaces in the filename + $filename = regsubst($name, ' ', '_', 'G') + + ::apache::custom_config { $filename: + ensure => $ensure, + confdir => $::apache::vhost_dir, + content => $content, + priority => $priority, + verify_config => $verify_config, + } + + # NOTE(pabelanger): This code is duplicated in ::apache::vhost and needs to + # converted into something generic. + if $::apache::vhost_enable_dir { + $vhost_symlink_ensure = $ensure ? { + present => link, + default => $ensure, + } + + file { "${priority}-${filename}.conf symlink": + ensure => $vhost_symlink_ensure, + path => "${::apache::vhost_enable_dir}/${priority}-${filename}.conf", + target => "${::apache::vhost_dir}/${priority}-${filename}.conf", + owner => 'root', + group => $::apache::params::root_group, + mode => $::apache::file_mode, + require => Apache::Custom_config[$filename], + notify => Class['apache::service'], + } + } +} diff --git a/environments/production/modules/apache/manifests/vhosts.pp b/environments/production/modules/apache/manifests/vhosts.pp new file mode 100644 index 0000000..cf212c4 --- /dev/null +++ b/environments/production/modules/apache/manifests/vhosts.pp @@ -0,0 +1,6 @@ +class apache::vhosts ( + $vhosts = {}, +) { + include ::apache + create_resources('apache::vhost', $vhosts) +} diff --git a/environments/production/modules/apache/metadata.json b/environments/production/modules/apache/metadata.json new file mode 100644 index 0000000..7bb2f12 --- /dev/null +++ b/environments/production/modules/apache/metadata.json @@ -0,0 +1,79 @@ +{ + "name": "puppetlabs-apache", + "version": "1.11.0", + "author": "puppetlabs", + "summary": "Installs, configures, and manages Apache virtual hosts, web services, and modules.", + "license": "Apache-2.0", + "source": "git://github.com/puppetlabs/puppetlabs-apache.git", + "project_page": "https://github.com/puppetlabs/puppetlabs-apache", + "issues_url": "https://tickets.puppetlabs.com/browse/MODULES", + "dependencies": [ + {"name":"puppetlabs/stdlib","version_requirement":">= 4.2.0 < 5.0.0"}, + {"name":"puppetlabs/concat","version_requirement":">= 1.1.1 < 3.0.0"} + ], + "data_provider": null, + "operatingsystem_support": [ + { + "operatingsystem": "RedHat", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "CentOS", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "OracleLinux", + "operatingsystemrelease": [ + "6", + "7" + ] + }, + { + "operatingsystem": "Scientific", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "6", + "7", + "8" + ] + }, + { + "operatingsystem": "SLES", + "operatingsystemrelease": [ + "11 SP1", + "12" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "10.04", + "12.04", + "14.04", + "16.04" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">= 3.0.0 < 5.0.0" + } + ], + "description": "Module for Apache configuration" +} diff --git a/environments/production/modules/apache/spec/acceptance/apache_parameters_spec.rb b/environments/production/modules/apache/spec/acceptance/apache_parameters_spec.rb new file mode 100644 index 0000000..923df66 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/apache_parameters_spec.rb @@ -0,0 +1,501 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +describe 'apache parameters' do + + # Currently this test only does something on FreeBSD. + describe 'default_confd_files => false' do + it 'doesnt do anything' do + pp = "class { 'apache': default_confd_files => false }" + apply_manifest(pp, :catch_failures => true) + end + + if fact('osfamily') == 'FreeBSD' + describe file("#{$confd_dir}/no-accf.conf.erb") do + it { is_expected.not_to be_file } + end + end + end + describe 'default_confd_files => true' do + it 'copies conf.d files' do + pp = "class { 'apache': default_confd_files => true }" + apply_manifest(pp, :catch_failures => true) + end + + if fact('osfamily') == 'FreeBSD' + describe file("#{$confd_dir}/no-accf.conf.erb") do + it { is_expected.to be_file } + end + end + end + + describe 'when set adds a listen statement' do + it 'applys cleanly' do + pp = "class { 'apache': ip => '10.1.1.1', service_ensure => stopped }" + apply_manifest(pp, :catch_failures => true) + end + + describe file($ports_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'Listen 10.1.1.1' } + end + end + + describe 'service tests => true' do + it 'starts the service' do + pp = <<-EOS + class { 'apache': + service_enable => true, + service_manage => true, + service_ensure => running, + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + it { is_expected.to be_running } + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { is_expected.to be_enabled } + end + end + end + + describe 'service tests => false' do + it 'stops the service' do + pp = <<-EOS + class { 'apache': + service_enable => false, + service_ensure => stopped, + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + it { is_expected.not_to be_running } + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { is_expected.not_to be_enabled } + end + end + end + + describe 'service manage => false' do + it 'we dont manage the service, so it shouldnt start the service' do + pp = <<-EOS + class { 'apache': + service_enable => true, + service_manage => false, + service_ensure => true, + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + it { is_expected.not_to be_running } + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { is_expected.not_to be_enabled } + end + end + end + + describe 'purge parameters => false' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': + purge_configs => false, + purge_vhost_dir => false, + vhost_dir => "#{$confd_dir}.vhosts" + } + EOS + shell("touch #{$confd_dir}/test.conf") + shell("mkdir -p #{$confd_dir}.vhosts && touch #{$confd_dir}.vhosts/test.conf") + apply_manifest(pp, :catch_failures => true) + end + + # Ensure the files didn't disappear. + describe file("#{$confd_dir}/test.conf") do + it { is_expected.to be_file } + end + describe file("#{$confd_dir}.vhosts/test.conf") do + it { is_expected.to be_file } + end + end + + if fact('osfamily') != 'Debian' + describe 'purge parameters => true' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': + purge_configs => true, + purge_vhost_dir => true, + vhost_dir => "#{$confd_dir}.vhosts" + } + EOS + shell("touch #{$confd_dir}/test.conf") + shell("mkdir -p #{$confd_dir}.vhosts && touch #{$confd_dir}.vhosts/test.conf") + apply_manifest(pp, :catch_failures => true) + end + + # File should be gone + describe file("#{$confd_dir}/test.conf") do + it { is_expected.not_to be_file } + end + describe file("#{$confd_dir}.vhosts/test.conf") do + it { is_expected.not_to be_file } + end + end + end + + describe 'serveradmin' do + it 'applies cleanly' do + pp = "class { 'apache': serveradmin => 'test@example.com' }" + apply_manifest(pp, :catch_failures => true) + end + + describe file($vhost) do + it { is_expected.to be_file } + it { is_expected.to contain 'ServerAdmin test@example.com' } + end + end + + describe 'sendfile' do + describe 'setup' do + it 'applies cleanly' do + pp = "class { 'apache': sendfile => 'On' }" + apply_manifest(pp, :catch_failures => true) + end + end + + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'EnableSendfile On' } + end + + describe 'setup' do + it 'applies cleanly' do + pp = "class { 'apache': sendfile => 'Off' }" + apply_manifest(pp, :catch_failures => true) + end + end + + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'Sendfile Off' } + end + end + + describe 'error_documents' do + describe 'setup' do + it 'applies cleanly' do + pp = "class { 'apache': error_documents => true }" + apply_manifest(pp, :catch_failures => true) + end + end + + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'Alias /error/' } + end + end + + describe 'timeout' do + describe 'setup' do + it 'applies cleanly' do + pp = "class { 'apache': timeout => '1234' }" + apply_manifest(pp, :catch_failures => true) + end + end + + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'Timeout 1234' } + end + end + + describe 'httpd_dir' do + describe 'setup' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': httpd_dir => '/tmp', service_ensure => stopped } + include 'apache::mod::mime' + EOS + apply_manifest(pp, :catch_failures => true) + end + end + + describe file("#{$mod_dir}/mime.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'AddLanguage eo .eo' } + end + end + + describe 'server_root' do + describe 'setup' do + it 'applies cleanly' do + pp = "class { 'apache': server_root => '/tmp/root', service_ensure => stopped }" + apply_manifest(pp, :catch_failures => true) + end + end + + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'ServerRoot "/tmp/root"' } + end + end + + describe 'confd_dir' do + describe 'setup' do + it 'applies cleanly' do + pp = "class { 'apache': confd_dir => '/tmp/root', service_ensure => stopped, use_optional_includes => true }" + apply_manifest(pp, :catch_failures => true) + end + end + + if $apache_version == '2.4' + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'IncludeOptional "/tmp/root/*.conf"' } + end + else + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'Include "/tmp/root/*.conf"' } + end + end + end + + describe 'conf_template' do + describe 'setup' do + it 'applies cleanly' do + pp = "class { 'apache': conf_template => 'another/test.conf.erb', service_ensure => stopped }" + shell("mkdir -p #{default['distmoduledir']}/another/templates") + shell("echo 'testcontent' >> #{default['distmoduledir']}/another/templates/test.conf.erb") + apply_manifest(pp, :catch_failures => true) + end + end + + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'testcontent' } + end + end + + describe 'servername' do + describe 'setup' do + it 'applies cleanly' do + pp = "class { 'apache': servername => 'test.server', service_ensure => stopped }" + apply_manifest(pp, :catch_failures => true) + end + end + + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'ServerName "test.server"' } + end + end + + describe 'user' do + describe 'setup' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': + manage_user => true, + manage_group => true, + user => 'testweb', + group => 'testweb', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + end + + describe user('testweb') do + it { is_expected.to exist } + it { is_expected.to belong_to_group 'testweb' } + end + + describe group('testweb') do + it { is_expected.to exist } + end + end + + describe 'logformats' do + describe 'setup' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': + log_formats => { + 'vhost_common' => '%v %h %l %u %t \\\"%r\\\" %>s %b', + 'vhost_combined' => '%v %h %l %u %t \\\"%r\\\" %>s %b \\\"%{Referer}i\\\" \\\"%{User-agent}i\\\"', + } + } + EOS + apply_manifest(pp, :catch_failures => true) + end + end + + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common' } + it { is_expected.to contain 'LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined' } + end + end + + + describe 'keepalive' do + describe 'setup' do + it 'applies cleanly' do + pp = "class { 'apache': keepalive => 'On', keepalive_timeout => '30', max_keepalive_requests => '200' }" + apply_manifest(pp, :catch_failures => true) + end + end + + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'KeepAlive On' } + it { is_expected.to contain 'KeepAliveTimeout 30' } + it { is_expected.to contain 'MaxKeepAliveRequests 200' } + end + end + + describe 'limitrequestfieldsize' do + describe 'setup' do + it 'applies cleanly' do + pp = "class { 'apache': limitreqfieldsize => '16830' }" + apply_manifest(pp, :catch_failures => true) + end + end + + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'LimitRequestFieldSize 16830' } + end + end + + describe 'logging' do + describe 'setup' do + it 'applies cleanly' do + pp = <<-EOS + if $::osfamily == 'RedHat' and "$::selinux" == "true" { + $semanage_package = $::operatingsystemmajrelease ? { + '5' => 'policycoreutils', + default => 'policycoreutils-python', + } + + package { $semanage_package: ensure => installed } + exec { 'set_apache_defaults': + command => 'semanage fcontext -a -t httpd_log_t "/apache_spec(/.*)?"', + path => '/bin:/usr/bin/:/sbin:/usr/sbin', + require => Package[$semanage_package], + } + exec { 'restorecon_apache': + command => 'restorecon -Rv /apache_spec', + path => '/bin:/usr/bin/:/sbin:/usr/sbin', + before => Service['httpd'], + require => Class['apache'], + } + } + file { '/apache_spec': ensure => directory, } + class { 'apache': logroot => '/apache_spec' } + EOS + apply_manifest(pp, :catch_failures => true) + end + end + + describe file("/apache_spec/#{$error_log}") do + it { is_expected.to be_file } + end + end + + describe 'ports_file' do + it 'applys cleanly' do + pp = <<-EOS + file { '/apache_spec': ensure => directory, } + class { 'apache': + ports_file => '/apache_spec/ports_file', + ip => '10.1.1.1', + service_ensure => stopped + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file('/apache_spec/ports_file') do + it { is_expected.to be_file } + it { is_expected.to contain 'Listen 10.1.1.1' } + end + end + + describe 'server_tokens' do + it 'applys cleanly' do + pp = <<-EOS + class { 'apache': + server_tokens => 'Minor', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'ServerTokens Minor' } + end + end + + describe 'server_signature' do + it 'applys cleanly' do + pp = <<-EOS + class { 'apache': + server_signature => 'testsig', + service_ensure => stopped, + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'ServerSignature testsig' } + end + end + + describe 'trace_enable' do + it 'applys cleanly' do + pp = <<-EOS + class { 'apache': + trace_enable => 'Off', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file($conf_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'TraceEnable Off' } + end + end + + describe 'package_ensure' do + it 'applys cleanly' do + pp = <<-EOS + class { 'apache': + package_ensure => present, + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe package($package_name) do + it { is_expected.to be_installed } + end + end + +end diff --git a/environments/production/modules/apache/spec/acceptance/apache_ssl_spec.rb b/environments/production/modules/apache/spec/acceptance/apache_ssl_spec.rb new file mode 100644 index 0000000..5df551a --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/apache_ssl_spec.rb @@ -0,0 +1,94 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +describe 'apache ssl' do + + describe 'ssl parameters' do + it 'runs without error' do + pp = <<-EOS + class { 'apache': + service_ensure => stopped, + default_ssl_vhost => true, + default_ssl_cert => '/tmp/ssl_cert', + default_ssl_key => '/tmp/ssl_key', + default_ssl_chain => '/tmp/ssl_chain', + default_ssl_ca => '/tmp/ssl_ca', + default_ssl_crl_path => '/tmp/ssl_crl_path', + default_ssl_crl => '/tmp/ssl_crl', + default_ssl_crl_check => 'chain', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/15-default-ssl.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'SSLCertificateFile "/tmp/ssl_cert"' } + it { is_expected.to contain 'SSLCertificateKeyFile "/tmp/ssl_key"' } + it { is_expected.to contain 'SSLCertificateChainFile "/tmp/ssl_chain"' } + it { is_expected.to contain 'SSLCACertificateFile "/tmp/ssl_ca"' } + it { is_expected.to contain 'SSLCARevocationPath "/tmp/ssl_crl_path"' } + it { is_expected.to contain 'SSLCARevocationFile "/tmp/ssl_crl"' } + if $apache_version == '2.4' + it { is_expected.to contain 'SSLCARevocationCheck "chain"' } + else + it { is_expected.not_to contain 'SSLCARevocationCheck' } + end + end + end + + describe 'vhost ssl parameters' do + it 'runs without error' do + pp = <<-EOS + class { 'apache': + service_ensure => stopped, + } + + apache::vhost { 'test_ssl': + docroot => '/tmp/test', + ssl => true, + ssl_cert => '/tmp/ssl_cert', + ssl_key => '/tmp/ssl_key', + ssl_chain => '/tmp/ssl_chain', + ssl_ca => '/tmp/ssl_ca', + ssl_crl_path => '/tmp/ssl_crl_path', + ssl_crl => '/tmp/ssl_crl', + ssl_crl_check => 'chain', + ssl_certs_dir => '/tmp', + ssl_protocol => 'test', + ssl_cipher => 'test', + ssl_honorcipherorder => 'test', + ssl_verify_client => 'test', + ssl_verify_depth => 'test', + ssl_options => ['test', 'test1'], + ssl_proxyengine => true, + ssl_proxy_protocol => 'TLSv1.2', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test_ssl.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'SSLCertificateFile "/tmp/ssl_cert"' } + it { is_expected.to contain 'SSLCertificateKeyFile "/tmp/ssl_key"' } + it { is_expected.to contain 'SSLCertificateChainFile "/tmp/ssl_chain"' } + it { is_expected.to contain 'SSLCACertificateFile "/tmp/ssl_ca"' } + it { is_expected.to contain 'SSLCARevocationPath "/tmp/ssl_crl_path"' } + it { is_expected.to contain 'SSLCARevocationFile "/tmp/ssl_crl"' } + it { is_expected.to contain 'SSLProxyEngine On' } + it { is_expected.to contain 'SSLProtocol test' } + it { is_expected.to contain 'SSLCipherSuite test' } + it { is_expected.to contain 'SSLHonorCipherOrder test' } + it { is_expected.to contain 'SSLVerifyClient test' } + it { is_expected.to contain 'SSLVerifyDepth test' } + it { is_expected.to contain 'SSLOptions test test1' } + if $apache_version == '2.4' + it { is_expected.to contain 'SSLCARevocationCheck "chain"' } + else + it { is_expected.not_to contain 'SSLCARevocationCheck' } + end + end + end + +end diff --git a/environments/production/modules/apache/spec/acceptance/class_spec.rb b/environments/production/modules/apache/spec/acceptance/class_spec.rb new file mode 100644 index 0000000..d67b1a8 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/class_spec.rb @@ -0,0 +1,89 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +describe 'apache class' do + context 'default parameters' do + let(:pp) { "class { 'apache': }" } + + it_behaves_like "a idempotent resource" + + describe 'apache_version fact' do + before :all do + apply_manifest("include apache", :catch_failures => true) + version_check_pp = <<-EOS + notice("apache_version = >${apache_version}<") + EOS + @result = apply_manifest(version_check_pp, :catch_failures => true) + end + + it { + expect(@result.output).to match(/apache_version = >#{$apache_version}.* 'policycoreutils', + default => 'policycoreutils-python', + } + + package { $semanage_package: ensure => installed } + exec { 'set_apache_defaults': + command => 'semanage fcontext -a -t httpd_sys_content_t "/apache_spec(/.*)?"', + path => '/bin:/usr/bin/:/sbin:/usr/sbin', + subscribe => Package[$semanage_package], + refreshonly => true, + } + exec { 'restorecon_apache': + command => 'restorecon -Rv /apache_spec', + path => '/bin:/usr/bin/:/sbin:/usr/sbin', + before => Service['httpd'], + require => Class['apache'], + subscribe => Exec['set_apache_defaults'], + refreshonly => true, + } + } + file { '/apache_spec': ensure => directory, } + file { '/apache_spec/apache_custom': ensure => directory, } + class { 'apache': + mod_dir => '/apache_spec/apache_custom/mods', + vhost_dir => '/apache_spec/apache_custom/vhosts', + } + EOS + end + + # Run it twice and test for idempotency + it_behaves_like "a idempotent resource" + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/custom_config_spec.rb b/environments/production/modules/apache/spec/acceptance/custom_config_spec.rb new file mode 100644 index 0000000..c8e254e --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/custom_config_spec.rb @@ -0,0 +1,94 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +describe 'apache::custom_config define' do + context 'invalid config' do + it 'should not add the config' do + pp = <<-EOS + class { 'apache': } + apache::custom_config { 'acceptance_test': + content => 'INVALID', + } + EOS + + apply_manifest(pp, :expect_failures => true) + end + + describe file("#{$confd_dir}/25-acceptance_test.conf") do + it { is_expected.not_to be_file } + end + end + + context 'valid config' do + it 'should add the config' do + pp = <<-EOS + class { 'apache': } + apache::custom_config { 'acceptance_test': + content => '# just a comment', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$confd_dir}/25-acceptance_test.conf") do + it { is_expected.to contain '# just a comment' } + end + end + + context 'with a custom filename' do + it 'should store content in the described file' do + pp = <<-EOS + class { 'apache': } + apache::custom_config { 'filename_test': + filename => 'custom_filename', + content => '# just another comment', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$confd_dir}/custom_filename") do + it { is_expected.to contain '# just another comment' } + end + end + + describe 'custom_config without priority prefix' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + apache::custom_config { 'prefix_test': + priority => false, + content => '# just a comment', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$confd_dir}/prefix_test.conf") do + it { is_expected.to be_file } + end + end + + describe 'custom_config only applied after configs are written' do + it 'applies in the right order' do + pp = <<-EOS + class { 'apache': } + + apache::custom_config { 'ordering_test': + content => '# just a comment', + } + + # Try to wedge the apache::custom_config call between when httpd.conf is written and + # ports.conf is written. This should trigger a dependency cycle + File["#{$conf_file}"] -> Apache::Custom_config['ordering_test'] -> Concat["#{$ports_file}"] + EOS + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Found 1 dependency cycle/i) + end + + describe file("#{$confd_dir}/25-ordering_test.conf") do + it { is_expected.not_to be_file } + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/default_mods_spec.rb b/environments/production/modules/apache/spec/acceptance/default_mods_spec.rb new file mode 100644 index 0000000..ab241e4 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/default_mods_spec.rb @@ -0,0 +1,109 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +describe 'apache::default_mods class' do + describe 'no default mods' do + # Using puppet_apply as a helper + let(:pp) do + <<-EOS + class { 'apache': + default_mods => false, + } + EOS + end + + # Run it twice and test for idempotency + it_behaves_like "a idempotent resource" + describe service($service_name) do + it { is_expected.to be_running } + end + end + + describe 'no default mods and failing' do + before :all do + pp = <<-PP + include apache::params + class { 'apache': default_mods => false, service_ensure => stopped, } + PP + apply_manifest(pp) + end + # Using puppet_apply as a helper + it 'should apply with errors' do + pp = <<-EOS + class { 'apache': + default_mods => false, + } + apache::vhost { 'defaults.example.com': + docroot => '#{$doc_root}/defaults', + aliases => { + alias => '/css', + path => '#{$doc_root}/css', + }, + directories => [ + { + 'path' => "#{$doc_root}/admin", + 'auth_basic_fake' => 'demo demopass', + } + ], + setenv => 'TEST1 one', + } + EOS + + apply_manifest(pp, { :expect_failures => true }) + end + + describe service($service_name) do + it { is_expected.not_to be_running } + end + end + + describe 'alternative default mods' do + # Using puppet_apply as a helper + let(:pp) do + <<-EOS + class { 'apache': + default_mods => [ + 'info', + 'alias', + 'mime', + 'env', + 'expires', + ], + } + apache::vhost { 'defaults.example.com': + docroot => '#{$doc_root}/defaults', + aliases => { + alias => '/css', + path => '#{$doc_root}/css', + }, + setenv => 'TEST1 one', + } + EOS + end + it_behaves_like "a idempotent resource" + + describe service($service_name) do + it { is_expected.to be_running } + end + end + + describe 'change loadfile name' do + let(:pp) do + <<-EOS + class { 'apache': default_mods => false } + ::apache::mod { 'auth_basic': + loadfile_name => 'zz_auth_basic.load', + } + EOS + end + # Run it twice and test for idempotency + it_behaves_like "a idempotent resource" + describe service($service_name) do + it { is_expected.to be_running } + end + + describe file("#{$mod_dir}/zz_auth_basic.load") do + it { is_expected.to be_file } + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/itk_spec.rb b/environments/production/modules/apache/spec/acceptance/itk_spec.rb new file mode 100644 index 0000000..059589a --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/itk_spec.rb @@ -0,0 +1,60 @@ +require 'spec_helper_acceptance' + +case fact('osfamily') +when 'Debian' + service_name = 'apache2' + majrelease = fact('operatingsystemmajrelease') + if ['6', '7', '10.04', '12.04'].include?(majrelease) + variant = :itk_only + else + variant = :prefork + end +when 'RedHat' + unless fact('operatingsystemmajrelease') == '5' + service_name = 'httpd' + majrelease = fact('operatingsystemmajrelease') + if ['6'].include?(majrelease) + variant = :itk_only + else + variant = :prefork + end + end +when 'FreeBSD' + service_name = 'apache24' + majrelease = fact('operatingsystemmajrelease') + variant = :prefork +end + +describe 'apache::mod::itk class', :if => service_name do + describe 'running puppet code' do + # Using puppet_apply as a helper + let(:pp) do + case variant + when :prefork + <<-EOS + class { 'apache': + mpm_module => 'prefork', + } + class { 'apache::mod::itk': } + EOS + when :itk_only + <<-EOS + class { 'apache': + mpm_module => 'itk', + } + EOS + end + end + # Run it twice and test for idempotency + it_behaves_like "a idempotent resource" + end + + describe service(service_name) do + it { is_expected.to be_running } + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/mod_dav_svn_spec.rb b/environments/production/modules/apache/spec/acceptance/mod_dav_svn_spec.rb new file mode 100644 index 0000000..2b15225 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/mod_dav_svn_spec.rb @@ -0,0 +1,63 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +describe 'apache::mod::dav_svn class', :unless => (fact('operatingsystem') == 'OracleLinux' and fact('operatingsystemmajrelease') == '7') || (fact('operatingsystem') == 'SLES' and fact('operatingsystemmajorrelease') < '11') do + case fact('osfamily') + when 'Debian' + if fact('operatingsystemmajrelease') == '6' or fact('operatingsystemmajrelease') == '10.04' or fact('operatingsystemrelease') == '10.04' or fact('operatingsystemmajrelease') == '16.04' + authz_svn_load_file = 'dav_svn_authz_svn.load' + else + authz_svn_load_file = 'authz_svn.load' + end + else + authz_svn_load_file = 'dav_svn_authz_svn.load' + end + + context "default dav_svn config" do + it 'succeeds in puppeting dav_svn' do + pp= <<-EOS + class { 'apache': } + include apache::mod::dav_svn + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file("#{$mod_dir}/dav_svn.load") do + it { is_expected.to contain "LoadModule dav_svn_module" } + end + end + + context "dav_svn with enabled authz_svn config" do + it 'succeeds in puppeting dav_svn' do + pp= <<-EOS + class { 'apache': } + class { 'apache::mod::dav_svn': + authz_svn_enabled => true, + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file("#{$mod_dir}/#{authz_svn_load_file}") do + it { is_expected.to contain "LoadModule authz_svn_module" } + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/mod_deflate_spec.rb b/environments/production/modules/apache/spec/acceptance/mod_deflate_spec.rb new file mode 100644 index 0000000..1b55e08 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/mod_deflate_spec.rb @@ -0,0 +1,33 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +describe 'apache::mod::deflate class' do + context "default deflate config" do + it 'succeeds in puppeting deflate' do + pp= <<-EOS + class { 'apache': } + include apache::mod::deflate + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file("#{$mod_dir}/deflate.conf") do + it { is_expected.to contain "AddOutputFilterByType DEFLATE text/html text/plain text/xml" } + it { is_expected.to contain "AddOutputFilterByType DEFLATE text/css" } + it { is_expected.to contain "AddOutputFilterByType DEFLATE application/x-javascript application/javascript application/ecmascript" } + it { is_expected.to contain "AddOutputFilterByType DEFLATE application/rss+xml" } + it { is_expected.to contain "DeflateFilterNote Input instream" } + it { is_expected.to contain "DeflateFilterNote Output outstream" } + it { is_expected.to contain "DeflateFilterNote Ratio ratio" } + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/mod_fcgid_spec.rb b/environments/production/modules/apache/spec/acceptance/mod_fcgid_spec.rb new file mode 100644 index 0000000..ce3b5b5 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/mod_fcgid_spec.rb @@ -0,0 +1,57 @@ +require 'spec_helper_acceptance' + +describe 'apache::mod::fcgid class', :if => ((fact('osfamily') == 'RedHat' and fact('operatingsystemmajrelease') != '5') and !(fact('operatingsystem') == 'OracleLinux' and fact('operatingsystemmajrelease') == '7')) do + context "default fcgid config" do + it 'succeeds in puppeting fcgid' do + pp = <<-EOS + class { 'epel': } # mod_fcgid lives in epel + class { 'apache': } + class { 'apache::mod::php': } # For /usr/bin/php-cgi + class { 'apache::mod::fcgid': + options => { + 'FcgidIPCDir' => '/var/run/fcgidsock', + }, + } + apache::vhost { 'fcgid.example.com': + port => '80', + docroot => '/var/www/fcgid', + directories => { + path => '/var/www/fcgid', + options => '+ExecCGI', + addhandlers => { + handler => 'fcgid-script', + extensions => '.php', + }, + fcgiwrapper => { + command => '/usr/bin/php-cgi', + suffix => '.php', + } + }, + } + file { '/var/www/fcgid/index.php': + ensure => file, + owner => 'root', + group => 'root', + content => "\\n", + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service('httpd') do + it { is_expected.to be_enabled } + it { is_expected.to be_running } + end + + it 'should answer to fcgid.example.com' do + shell("/usr/bin/curl -H 'Host: fcgid.example.com' 127.0.0.1:80") do |r| + expect(r.stdout).to match(/^Hello world$/) + expect(r.exit_code).to eq(0) + end + end + + it 'should run a php-cgi process' do + shell("pgrep -u apache php-cgi", :acceptable_exit_codes => [0]) + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/mod_mime_spec.rb b/environments/production/modules/apache/spec/acceptance/mod_mime_spec.rb new file mode 100644 index 0000000..f8bc7c1 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/mod_mime_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +describe 'apache::mod::mime class' do + context "default mime config" do + it 'succeeds in puppeting mime' do + pp= <<-EOS + class { 'apache': } + include apache::mod::mime + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file("#{$mod_dir}/mime.conf") do + it { is_expected.to contain "AddType application/x-compress .Z" } + it { is_expected.to contain "AddHandler type-map var\n" } + it { is_expected.to contain "AddType text/html .shtml\n" } + it { is_expected.to contain "AddOutputFilter INCLUDES .shtml\n" } + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/mod_negotiation_spec.rb b/environments/production/modules/apache/spec/acceptance/mod_negotiation_spec.rb new file mode 100644 index 0000000..56c29e3 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/mod_negotiation_spec.rb @@ -0,0 +1,78 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +describe 'apache::mod::negotiation class' do + context "default negotiation config" do + it 'succeeds in puppeting negotiation' do + pp= <<-EOS + class { '::apache': default_mods => false } + class { '::apache::mod::negotiation': } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$mod_dir}/negotiation.conf") do + it { should contain "LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv zh-CN zh-TW +ForceLanguagePriority Prefer Fallback" } + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { should be_running } + end + end + + context "with alternative force_language_priority" do + it 'succeeds in puppeting negotiation' do + pp= <<-EOS + class { '::apache': default_mods => false } + class { '::apache::mod::negotiation': + force_language_priority => 'Prefer', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$mod_dir}/negotiation.conf") do + it { should contain "ForceLanguagePriority Prefer" } + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { should be_running } + end + end + + context "with alternative language_priority" do + it 'succeeds in puppeting negotiation' do + pp= <<-EOS + class { '::apache': default_mods => false } + class { '::apache::mod::negotiation': + language_priority => [ 'en', 'es' ], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$mod_dir}/negotiation.conf") do + it { should contain "LanguagePriority en es" } + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { should be_running } + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/mod_pagespeed_spec.rb b/environments/production/modules/apache/spec/acceptance/mod_pagespeed_spec.rb new file mode 100644 index 0000000..c88d594 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/mod_pagespeed_spec.rb @@ -0,0 +1,80 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +# Don't run this test on Debian < 8 or Ubuntu < 12, because Debian doesn't like +# updating packages and Pagespeed doesn't like old packages. +describe 'apache::mod::pagespeed class', :unless => + ((fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') < '8') or + (fact('operatingsystem') == 'Ubuntu' && fact('operatingsystemmajrelease') < '12') or + (fact('operatingsystem') == 'SLES' )) do + context "default pagespeed config" do + it 'succeeds in puppeting pagespeed' do + pp= <<-EOS + if $::osfamily == 'Debian' { + class { 'apt': } + + apt::source { 'mod-pagespeed': + key => '7FAC5991', + key_server => 'pgp.mit.edu', + location => 'http://dl.google.com/linux/mod-pagespeed/deb/', + release => 'stable', + repos => 'main', + include_src => false, + before => Class['apache'], + } + } elsif $::osfamily == 'RedHat' { + yumrepo { 'mod-pagespeed': + baseurl => "http://dl.google.com/linux/mod-pagespeed/rpm/stable/$::architecture", + enabled => 1, + gpgcheck => 1, + gpgkey => 'https://dl-ssl.google.com/linux/linux_signing_key.pub', + before => Class['apache'], + } + } + + class { 'apache': + mpm_module => 'prefork', + } + class { 'apache::mod::pagespeed': + enable_filters => ['remove_comments'], + disable_filters => ['extend_cache'], + forbid_filters => ['rewrite_javascript'], + } + apache::vhost { 'pagespeed.example.com': + port => '80', + docroot => '#{$doc_root}/pagespeed', + } + host { 'pagespeed.example.com': ip => '127.0.0.1', } + file { '#{$doc_root}/pagespeed/index.html': + ensure => file, + content => "\n\n\n

Hello World!

\n\n", + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file("#{$mod_dir}/pagespeed.conf") do + it { is_expected.to contain "AddOutputFilterByType MOD_PAGESPEED_OUTPUT_FILTER text/html" } + it { is_expected.to contain "ModPagespeedEnableFilters remove_comments" } + it { is_expected.to contain "ModPagespeedDisableFilters extend_cache" } + it { is_expected.to contain "ModPagespeedForbidFilters rewrite_javascript" } + end + + it 'should answer to pagespeed.example.com and include and be stripped of comments by mod_pagespeed' do + shell("/usr/bin/curl pagespeed.example.com:80") do |r| + expect(r.stdout).to match(//) + expect(r.stdout).not_to match(//) + expect(r.exit_code).to eq(0) + end + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/mod_passenger_spec.rb b/environments/production/modules/apache/spec/acceptance/mod_passenger_spec.rb new file mode 100644 index 0000000..4761d2c --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/mod_passenger_spec.rb @@ -0,0 +1,208 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +describe 'apache::mod::passenger class' do + pending 'This cannot run in the same test run as apache::vhost with passenger + as the passenger.conf file is not yet managed by puppet and will be wiped out + between tests and not replaced' + case fact('osfamily') + when 'Debian' + conf_file = "#{$mod_dir}/passenger.conf" + load_file = "#{$mod_dir}/zpassenger.load" + + case fact('operatingsystem') + when 'Ubuntu' + case fact('lsbdistrelease') + when '10.04' + passenger_root = '/usr' + passenger_ruby = '/usr/bin/ruby' + when '12.04' + passenger_root = '/usr' + passenger_ruby = '/usr/bin/ruby' + when '14.04' + passenger_root = '/usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini' + passenger_ruby = '/usr/bin/ruby' + passenger_default_ruby = '/usr/bin/ruby' + when '16.04' + passenger_root = '/usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini' + passenger_ruby = '/usr/bin/ruby' + passenger_default_ruby = '/usr/bin/ruby' + else + # This may or may not work on Ubuntu releases other than the above + passenger_root = '/usr' + passenger_ruby = '/usr/bin/ruby' + end + when 'Debian' + case fact('lsbdistcodename') + when 'wheezy' + passenger_root = '/usr' + passenger_ruby = '/usr/bin/ruby' + when 'jessie' + passenger_root = '/usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini' + passenger_ruby = '/usr/bin/ruby' + passenger_default_ruby = '/usr/bin/ruby' + else + # This may or may not work on Debian releases other than the above + passenger_root = '/usr' + passenger_ruby = '/usr/bin/ruby' + end + end + + passenger_module_path = '/usr/lib/apache2/modules/mod_passenger.so' + rackapp_user = 'www-data' + rackapp_group = 'www-data' + when 'RedHat' + conf_file = "#{$mod_dir}/passenger.conf" + load_file = "#{$mod_dir}/zpassenger.load" + # sometimes installs as 3.0.12, sometimes as 3.0.19 - so just check for the stable part + passenger_root = '/usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini' + passenger_ruby = '/usr/bin/ruby' + passenger_module_path = 'modules/mod_passenger.so' + rackapp_user = 'apache' + rackapp_group = 'apache' + end + + pp_rackapp = <<-EOS + /* a simple ruby rack 'hello world' app */ + file { '/var/www/passenger': + ensure => directory, + owner => '#{rackapp_user}', + group => '#{rackapp_group}', + } + file { '/var/www/passenger/config.ru': + ensure => file, + owner => '#{rackapp_user}', + group => '#{rackapp_group}', + content => "app = proc { |env| [200, { \\"Content-Type\\" => \\"text/html\\" }, [\\"hello world\\"]] }\\nrun app", + } + apache::vhost { 'passenger.example.com': + port => '80', + docroot => '/var/www/passenger/public', + docroot_group => '#{rackapp_group}', + docroot_owner => '#{rackapp_user}', + require => File['/var/www/passenger/config.ru'], + } + host { 'passenger.example.com': ip => '127.0.0.1', } + EOS + + case fact('osfamily') + when 'Debian' + context "default passenger config" do + it 'succeeds in puppeting passenger' do + pp = <<-EOS + /* stock apache and mod_passenger */ + class { 'apache': } + class { 'apache::mod::passenger': } + #{pp_rackapp} + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file(conf_file) do + it { is_expected.to contain "PassengerRoot \"#{passenger_root}\"" } + + case fact('operatingsystem') + when 'Ubuntu' + case fact('lsbdistrelease') + when '10.04' + it { is_expected.to contain "PassengerRuby \"#{passenger_ruby}\"" } + it { is_expected.not_to contain "/PassengerDefaultRuby/" } + when '12.04' + it { is_expected.to contain "PassengerRuby \"#{passenger_ruby}\"" } + it { is_expected.not_to contain "/PassengerDefaultRuby/" } + when '14.04' + it { is_expected.to contain "PassengerDefaultRuby \"#{passenger_ruby}\"" } + it { is_expected.not_to contain "/PassengerRuby/" } + when '16.04' + it { is_expected.to contain "PassengerDefaultRuby \"#{passenger_ruby}\"" } + it { is_expected.not_to contain "/PassengerRuby/" } + else + # This may or may not work on Ubuntu releases other than the above + it { is_expected.to contain "PassengerRuby \"#{passenger_ruby}\"" } + it { is_expected.not_to contain "/PassengerDefaultRuby/" } + end + when 'Debian' + case fact('lsbdistcodename') + when 'wheezy' + it { is_expected.to contain "PassengerRuby \"#{passenger_ruby}\"" } + it { is_expected.not_to contain "/PassengerDefaultRuby/" } + when 'jessie' + it { is_expected.to contain "PassengerDefaultRuby \"#{passenger_ruby}\"" } + it { is_expected.not_to contain "/PassengerRuby/" } + else + # This may or may not work on Debian releases other than the above + it { is_expected.to contain "PassengerRuby \"#{passenger_ruby}\"" } + it { is_expected.not_to contain "/PassengerDefaultRuby/" } + end + end + end + + describe file(load_file) do + it { is_expected.to contain "LoadModule passenger_module #{passenger_module_path}" } + end + + it 'should output status via passenger-memory-stats' do + shell("PATH=/usr/bin:$PATH /usr/sbin/passenger-memory-stats") do |r| + expect(r.stdout).to match(/Apache processes/) + expect(r.stdout).to match(/Nginx processes/) + expect(r.stdout).to match(/Passenger processes/) + + # passenger-memory-stats output on newer Debian/Ubuntu verions do not contain + # these two lines + unless ((fact('operatingsystem') == 'Ubuntu' && fact('operatingsystemrelease') == '14.04') or + (fact('operatingsystem') == 'Ubuntu' && fact('operatingsystemrelease') == '16.04') or + (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8')) + expect(r.stdout).to match(/### Processes: [0-9]+/) + expect(r.stdout).to match(/### Total private dirty RSS: [0-9\.]+ MB/) + end + + expect(r.exit_code).to eq(0) + end + end + + # passenger-status fails under stock ubuntu-server-12042-x64 + mod_passenger, + # even when the passenger process is successfully installed and running + unless fact('operatingsystem') == 'Ubuntu' && fact('operatingsystemrelease') == '12.04' + it 'should output status via passenger-status' do + # xml output not available on ubunutu <= 10.04, so sticking with default pool output + shell("PATH=/usr/bin:$PATH /usr/sbin/passenger-status") do |r| + # spacing may vary + expect(r.stdout).to match(/[\-]+ General information [\-]+/) + if fact('operatingsystem') == 'Ubuntu' && fact('operatingsystemrelease') == '14.04' or + (fact('operatingsystem') == 'Ubuntu' && fact('operatingsystemrelease') == '16.04') or + fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8' + expect(r.stdout).to match(/Max pool size[ ]+: [0-9]+/) + expect(r.stdout).to match(/Processes[ ]+: [0-9]+/) + expect(r.stdout).to match(/Requests in top-level queue[ ]+: [0-9]+/) + else + expect(r.stdout).to match(/max[ ]+= [0-9]+/) + expect(r.stdout).to match(/count[ ]+= [0-9]+/) + expect(r.stdout).to match(/active[ ]+= [0-9]+/) + expect(r.stdout).to match(/inactive[ ]+= [0-9]+/) + expect(r.stdout).to match(/Waiting on global queue: [0-9]+/) + end + + expect(r.exit_code).to eq(0) + end + end + end + + it 'should answer to passenger.example.com' do + shell("/usr/bin/curl passenger.example.com:80") do |r| + expect(r.stdout).to match(/^hello world<\/b>$/) + expect(r.exit_code).to eq(0) + end + end + + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/mod_php_spec.rb b/environments/production/modules/apache/spec/acceptance/mod_php_spec.rb new file mode 100644 index 0000000..45b901f --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/mod_php_spec.rb @@ -0,0 +1,152 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +unless (fact('operatingsystem') == 'SLES' && fact('operatingsystemrelease') == '12.0') + describe 'apache::mod::php class' do + context "default php config" do + it 'succeeds in puppeting php' do + pp= <<-EOS + class { 'apache': + mpm_module => 'prefork', + } + class { 'apache::mod::php': } + apache::vhost { 'php.example.com': + port => '80', + docroot => '#{$doc_root}/php', + } + host { 'php.example.com': ip => '127.0.0.1', } + file { '#{$doc_root}/php/index.php': + ensure => file, + content => "\\n", + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + if (fact('operatingsystem') == 'Ubuntu' && fact('operatingsystemmajrelease') == '16.04') + describe file("#{$mod_dir}/php7.0.conf") do + it { is_expected.to contain "DirectoryIndex index.php" } + end + else + describe file("#{$mod_dir}/php5.conf") do + it { is_expected.to contain "DirectoryIndex index.php" } + end + end + + it 'should answer to php.example.com' do + shell("/usr/bin/curl php.example.com:80") do |r| + expect(r.stdout).to match(/PHP Version/) + expect(r.exit_code).to eq(0) + end + end + end + + context "custom extensions, php_flag, php_value, php_admin_flag, and php_admin_value" do + it 'succeeds in puppeting php' do + pp= <<-EOS + class { 'apache': + mpm_module => 'prefork', + } + class { 'apache::mod::php': + extensions => ['.php','.php5'], + } + apache::vhost { 'php.example.com': + port => '80', + docroot => '#{$doc_root}/php', + php_values => { 'include_path' => '.:/usr/share/pear:/usr/bin/php', }, + php_flags => { 'display_errors' => 'on', }, + php_admin_values => { 'open_basedir' => '/var/www/php/:/usr/share/pear/', }, + php_admin_flags => { 'engine' => 'on', }, + } + host { 'php.example.com': ip => '127.0.0.1', } + file { '#{$doc_root}/php/index.php5': + ensure => file, + content => "\\n", + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file("#{$vhost_dir}/25-php.example.com.conf") do + it { is_expected.to contain " php_flag display_errors on" } + it { is_expected.to contain " php_value include_path \".:/usr/share/pear:/usr/bin/php\"" } + it { is_expected.to contain " php_admin_flag engine on" } + it { is_expected.to contain " php_admin_value open_basedir /var/www/php/:/usr/share/pear/" } + end + + it 'should answer to php.example.com' do + shell("/usr/bin/curl php.example.com:80") do |r| + expect(r.stdout).to match(/\/usr\/share\/pear\//) + expect(r.exit_code).to eq(0) + end + end + end + + context "provide custom config file" do + it 'succeeds in puppeting php' do + pp= <<-EOS + class {'apache': + mpm_module => 'prefork', + } + class {'apache::mod::php': + content => '# somecontent', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + if (fact('operatingsystem') == 'Ubuntu' && fact('operatingsystemmajrelease') == '16.04') + describe file("#{$mod_dir}/php7.0.conf") do + it { should contain "# somecontent" } + end + else + describe file("#{$mod_dir}/php5.conf") do + it { should contain "# somecontent" } + end + end + end + + context "provide content and template config file" do + it 'succeeds in puppeting php' do + pp= <<-EOS + class {'apache': + mpm_module => 'prefork', + } + class {'apache::mod::php': + content => '# somecontent', + template => 'apache/mod/php5.conf.erb', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + if (fact('operatingsystem') == 'Ubuntu' && fact('operatingsystemmajrelease') == '16.04') + describe file("#{$mod_dir}/php7.0.conf") do + it { should contain "# somecontent" } + end + else + describe file("#{$mod_dir}/php5.conf") do + it { should contain "# somecontent" } + end + end + end + + end +end diff --git a/environments/production/modules/apache/spec/acceptance/mod_proxy_html_spec.rb b/environments/production/modules/apache/spec/acceptance/mod_proxy_html_spec.rb new file mode 100644 index 0000000..ce8aad6 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/mod_proxy_html_spec.rb @@ -0,0 +1,36 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +# Don't run proxy_html tests on RHEL7 because the yum repos are missing packages required by it. +describe 'apache::mod::proxy_html class', :unless => (fact('osfamily') == 'RedHat' and fact('operatingsystemmajrelease') == '7') do + context "default proxy_html config" do + if fact('osfamily') == 'RedHat' and fact('operatingsystemmajrelease') =~ /(5|6)/ + it 'adds epel' do + pp = "class { 'epel': }" + apply_manifest(pp, :catch_failures => true) + end + end + + it 'succeeds in puppeting proxy_html' do + pp= <<-EOS + class { 'apache': } + class { 'apache::mod::proxy': } + class { 'apache::mod::proxy_http': } + # mod_proxy_html doesn't exist in RHEL5 + if $::osfamily == 'RedHat' and $::operatingsystemmajrelease != '5' { + class { 'apache::mod::proxy_html': } + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/mod_security_spec.rb b/environments/production/modules/apache/spec/acceptance/mod_security_spec.rb new file mode 100644 index 0000000..095cce9 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/mod_security_spec.rb @@ -0,0 +1,386 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +describe 'apache::mod::security class', :unless => (fact('osfamily') == 'Debian' and (fact('lsbdistcodename') == 'squeeze' or fact('lsbdistcodename') == 'lucid' or fact('lsbdistcodename') == 'precise' or fact('lsbdistcodename') == 'wheezy')) || (fact('operatingsystem') == 'SLES' and fact('operatingsystemrelease') < '11') do + context "default mod_security config" do + if fact('osfamily') == 'RedHat' and fact('operatingsystemmajrelease') =~ /(5|6)/ + it 'adds epel' do + pp = "class { 'epel': }" + apply_manifest(pp, :catch_failures => true) + end + elsif fact('osfamily') == 'RedHat' and fact('operatingsystemmajrelease') == '7' + it 'changes obsoletes, per PUP-4497' do + pp = <<-EOS + ini_setting { 'obsoletes': + path => '/etc/yum.conf', + section => 'main', + setting => 'obsoletes', + value => '0', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + end + + it 'succeeds in puppeting mod_security' do + pp= <<-EOS + host { 'modsec.example.com': ip => '127.0.0.1', } + class { 'apache': } + class { 'apache::mod::security': } + apache::vhost { 'modsec.example.com': + port => '80', + docroot => '#{$doc_root}/html', + } + file { '#{$doc_root}/html/index.html': + ensure => file, + content => 'Index page', + } + EOS + apply_manifest(pp, :catch_failures => true) + + #Need to add a short sleep here because on RHEL6 the service takes a bit longer to init + if fact('osfamily') == 'RedHat' and fact('operatingsystemmajrelease') =~ /(5|6)/ + sleep 5 + end + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe package($package_name) do + it { is_expected.to be_installed } + end + + describe file("#{$mod_dir}/security.conf") do + it { is_expected.to contain "mod_security2.c" } + end + + describe 'should be listening on port 80' do + it 'should return index page' do + shell('/usr/bin/curl -A beaker modsec.example.com:80') do |r| + expect(r.stdout).to match(/Index page/) + expect(r.exit_code).to eq(0) + end + end + + unless fact('operatingsystem') == 'SLES' + it 'should block query with SQL' do + shell '/usr/bin/curl -A beaker -f modsec.example.com:80?SELECT%20*FROM%20mysql.users', :acceptable_exit_codes => [22] + end + end + end + + end #default mod_security config + + context "mod_security should allow disabling by vhost" do + it 'succeeds in puppeting mod_security' do + pp= <<-EOS + host { 'modsec.example.com': ip => '127.0.0.1', } + class { 'apache': } + class { 'apache::mod::security': } + apache::vhost { 'modsec.example.com': + port => '80', + docroot => '#{$doc_root}/html', + } + file { '#{$doc_root}/html/index.html': + ensure => file, + content => 'Index page', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file("#{$mod_dir}/security.conf") do + it { is_expected.to contain "mod_security2.c" } + end + + unless fact('operatingsystem') == 'SLES' + it 'should block query with SQL' do + shell '/usr/bin/curl -A beaker -f modsec.example.com:80?SELECT%20*FROM%20mysql.users', :acceptable_exit_codes => [22] + end + end + + it 'should disable mod_security per vhost' do + pp= <<-EOS + class { 'apache': } + class { 'apache::mod::security': } + apache::vhost { 'modsec.example.com': + port => '80', + docroot => '#{$doc_root}/html', + modsec_disable_vhost => true, + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + it 'should return index page' do + shell('/usr/bin/curl -A beaker -f modsec.example.com:80?SELECT%20*FROM%20mysql.users') do |r| + expect(r.stdout).to match(/Index page/) + expect(r.exit_code).to eq(0) + end + end + end #mod_security should allow disabling by vhost + + context "mod_security should allow disabling by ip" do + it 'succeeds in puppeting mod_security' do + pp= <<-EOS + host { 'modsec.example.com': ip => '127.0.0.1', } + class { 'apache': } + class { 'apache::mod::security': } + apache::vhost { 'modsec.example.com': + port => '80', + docroot => '#{$doc_root}/html', + } + file { '#{$doc_root}/html/index.html': + ensure => file, + content => 'Index page', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file("#{$mod_dir}/security.conf") do + it { is_expected.to contain "mod_security2.c" } + end + + unless fact('operatingsystem') == 'SLES' + it 'should block query with SQL' do + shell '/usr/bin/curl -A beaker -f modsec.example.com:80?SELECT%20*FROM%20mysql.users', :acceptable_exit_codes => [22] + end + end + + it 'should disable mod_security per vhost' do + pp= <<-EOS + class { 'apache': } + class { 'apache::mod::security': } + apache::vhost { 'modsec.example.com': + port => '80', + docroot => '#{$doc_root}/html', + modsec_disable_ips => [ '127.0.0.1' ], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + it 'should return index page' do + shell('/usr/bin/curl -A beaker modsec.example.com:80') do |r| + expect(r.stdout).to match(/Index page/) + expect(r.exit_code).to eq(0) + end + end + end #mod_security should allow disabling by ip + + context "mod_security should allow disabling by id" do + it 'succeeds in puppeting mod_security' do + pp= <<-EOS + host { 'modsec.example.com': ip => '127.0.0.1', } + class { 'apache': } + class { 'apache::mod::security': } + apache::vhost { 'modsec.example.com': + port => '80', + docroot => '#{$doc_root}/html', + } + file { '#{$doc_root}/html/index.html': + ensure => file, + content => 'Index page', + } + file { '#{$doc_root}/html/index2.html': + ensure => file, + content => 'Page 2', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file("#{$mod_dir}/security.conf") do + it { is_expected.to contain "mod_security2.c" } + end + + unless fact('operatingsystem') == 'SLES' + it 'should block query with SQL' do + shell '/usr/bin/curl -A beaker -f modsec.example.com:80?SELECT%20*FROM%20mysql.users', :acceptable_exit_codes => [22] + end + end + + it 'should disable mod_security per vhost' do + pp= <<-EOS + class { 'apache': } + class { 'apache::mod::security': } + apache::vhost { 'modsec.example.com': + port => '80', + docroot => '#{$doc_root}/html', + modsec_disable_ids => [ '950007' ], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + it 'should return index page' do + shell('/usr/bin/curl -A beaker -f modsec.example.com:80?SELECT%20*FROM%20mysql.users') do |r| + expect(r.stdout).to match(/Index page/) + expect(r.exit_code).to eq(0) + end + end + + end #mod_security should allow disabling by id + + context "mod_security should allow disabling by msg" do + it 'succeeds in puppeting mod_security' do + pp= <<-EOS + host { 'modsec.example.com': ip => '127.0.0.1', } + class { 'apache': } + class { 'apache::mod::security': } + apache::vhost { 'modsec.example.com': + port => '80', + docroot => '#{$doc_root}/html', + } + file { '#{$doc_root}/html/index.html': + ensure => file, + content => 'Index page', + } + file { '#{$doc_root}/html/index2.html': + ensure => file, + content => 'Page 2', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file("#{$mod_dir}/security.conf") do + it { is_expected.to contain "mod_security2.c" } + end + + unless fact('operatingsystem') == 'SLES' + it 'should block query with SQL' do + shell '/usr/bin/curl -A beaker -f modsec.example.com:80?SELECT%20*FROM%20mysql.users', :acceptable_exit_codes => [22] + end + end + + it 'should disable mod_security per vhost' do + pp= <<-EOS + class { 'apache': } + class { 'apache::mod::security': } + apache::vhost { 'modsec.example.com': + port => '80', + docroot => '#{$doc_root}/html', + modsec_disable_msgs => [ 'Blind SQL Injection Attack' ], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + it 'should return index page' do + shell('/usr/bin/curl -A beaker -f modsec.example.com:80?SELECT%20*FROM%20mysql.users') do |r| + expect(r.stdout).to match(/Index page/) + expect(r.exit_code).to eq(0) + end + end + + end #mod_security should allow disabling by msg + + context "mod_security should allow disabling by tag" do + it 'succeeds in puppeting mod_security' do + pp= <<-EOS + host { 'modsec.example.com': ip => '127.0.0.1', } + class { 'apache': } + class { 'apache::mod::security': } + apache::vhost { 'modsec.example.com': + port => '80', + docroot => '#{$doc_root}/html', + } + file { '#{$doc_root}/html/index.html': + ensure => file, + content => 'Index page', + } + file { '#{$doc_root}/html/index2.html': + ensure => file, + content => 'Page 2', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file("#{$mod_dir}/security.conf") do + it { is_expected.to contain "mod_security2.c" } + end + + unless fact('operatingsystem') == 'SLES' + it 'should block query with SQL' do + shell '/usr/bin/curl -A beaker -f modsec.example.com:80?SELECT%20*FROM%20mysql.users', :acceptable_exit_codes => [22] + end + end + + it 'should disable mod_security per vhost' do + pp= <<-EOS + class { 'apache': } + class { 'apache::mod::security': } + apache::vhost { 'modsec.example.com': + port => '80', + docroot => '#{$doc_root}/html', + modsec_disable_tags => [ 'WEB_ATTACK/SQL_INJECTION' ], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + it 'should return index page' do + shell('/usr/bin/curl -A beaker -f modsec.example.com:80?SELECT%20*FROM%20mysql.users') do |r| + expect(r.stdout).to match(/Index page/) + expect(r.exit_code).to eq(0) + end + end + + end #mod_security should allow disabling by tag + +end #apache::mod::security class diff --git a/environments/production/modules/apache/spec/acceptance/mod_suphp_spec.rb b/environments/production/modules/apache/spec/acceptance/mod_suphp_spec.rb new file mode 100644 index 0000000..0748667 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/mod_suphp_spec.rb @@ -0,0 +1,57 @@ +require 'spec_helper_acceptance' + +describe 'apache::mod::suphp class', :if => (fact('operatingsystem') == 'Ubuntu' and fact('operatingsystemmajrelease') != '16.04') do + context "default suphp config" do + it 'succeeds in puppeting suphp' do + pp = <<-EOS +class { 'apache': + mpm_module => 'prefork', +} +host { 'suphp.example.com': ip => '127.0.0.1', } +apache::vhost { 'suphp.example.com': + port => '80', + docroot => '/var/www/suphp', +} +file { '/var/www/suphp/index.php': + ensure => file, + owner => 'daemon', + group => 'daemon', + content => "\\n", + require => File['/var/www/suphp'], + before => Class['apache::mod::php'], +} +class { 'apache::mod::php': } +class { 'apache::mod::suphp': } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service('apache2') do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + it 'should answer to suphp.example.com' do + timeout = 0 + loop do + r = shell('curl suphp.example.com:80') + timeout += 1 + break if r.stdout =~ /^daemon$/ + if timeout > 40 + expect(timeout < 40).to be true + break + end + sleep(1) + end + shell("/usr/bin/curl suphp.example.com:80") do |r| + expect(r.stdout).to match(/^daemon$/) + expect(r.exit_code).to eq(0) + end + end + + end +end diff --git a/environments/production/modules/apache/spec/acceptance/nodesets/centos-7-x64.yml b/environments/production/modules/apache/spec/acceptance/nodesets/centos-7-x64.yml new file mode 100644 index 0000000..5eebdef --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/nodesets/centos-7-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + centos-7-x64: + roles: + - agent + - default + platform: el-7-x86_64 + hypervisor: vagrant + box: puppetlabs/centos-7.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/apache/spec/acceptance/nodesets/debian-8-x64.yml b/environments/production/modules/apache/spec/acceptance/nodesets/debian-8-x64.yml new file mode 100644 index 0000000..fef6e63 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/nodesets/debian-8-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + debian-8-x64: + roles: + - agent + - default + platform: debian-8-amd64 + hypervisor: vagrant + box: puppetlabs/debian-8.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/apache/spec/acceptance/nodesets/default.yml b/environments/production/modules/apache/spec/acceptance/nodesets/default.yml new file mode 100644 index 0000000..dba339c --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/nodesets/default.yml @@ -0,0 +1,10 @@ +HOSTS: + ubuntu-1404-x64: + roles: + - agent + - default + platform: ubuntu-14.04-amd64 + hypervisor: vagrant + box: puppetlabs/ubuntu-14.04-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/apache/spec/acceptance/nodesets/docker/centos-7.yml b/environments/production/modules/apache/spec/acceptance/nodesets/docker/centos-7.yml new file mode 100644 index 0000000..a3333aa --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/nodesets/docker/centos-7.yml @@ -0,0 +1,12 @@ +HOSTS: + centos-7-x64: + platform: el-7-x86_64 + hypervisor: docker + image: centos:7 + docker_preserve_image: true + docker_cmd: '["/usr/sbin/init"]' + # install various tools required to get the image up to usable levels + docker_image_commands: + - 'yum install -y crontabs tar wget openssl sysvinit-tools iproute which initscripts' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/apache/spec/acceptance/nodesets/docker/debian-8.yml b/environments/production/modules/apache/spec/acceptance/nodesets/docker/debian-8.yml new file mode 100644 index 0000000..df5c319 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/nodesets/docker/debian-8.yml @@ -0,0 +1,11 @@ +HOSTS: + debian-8-x64: + platform: debian-8-amd64 + hypervisor: docker + image: debian:8 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get update && apt-get install -y net-tools wget locales strace lsof && echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/apache/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/environments/production/modules/apache/spec/acceptance/nodesets/docker/ubuntu-14.04.yml new file mode 100644 index 0000000..b1efa58 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/nodesets/docker/ubuntu-14.04.yml @@ -0,0 +1,12 @@ +HOSTS: + ubuntu-1404-x64: + platform: ubuntu-14.04-amd64 + hypervisor: docker + image: ubuntu:14.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + # ensure that upstart is booting correctly in the container + - 'rm /usr/sbin/policy-rc.d && rm /sbin/initctl && dpkg-divert --rename --remove /sbin/initctl && apt-get update && apt-get install -y net-tools wget && locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/apache/spec/acceptance/nodesets/suse.yml b/environments/production/modules/apache/spec/acceptance/nodesets/suse.yml new file mode 100644 index 0000000..ac04926 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/nodesets/suse.yml @@ -0,0 +1,25 @@ +--- +HOSTS: + sles-11-x86_64-agent: + roles: + - agent + - default + platform: sles-11-x86_64 + template: sles-11-x86_64 + hypervisor: virtualbox + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: virtualbox +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ diff --git a/environments/production/modules/apache/spec/acceptance/prefork_worker_spec.rb b/environments/production/modules/apache/spec/acceptance/prefork_worker_spec.rb new file mode 100644 index 0000000..6687161 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/prefork_worker_spec.rb @@ -0,0 +1,80 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +case fact('osfamily') +when 'FreeBSD' + describe 'apache::mod::event class' do + describe 'running puppet code' do + # Using puppet_apply as a helper + it 'should work with no errors' do + pp = <<-EOS + class { 'apache': + mpm_module => 'event', + } + EOS + + # Run it twice and test for idempotency + apply_manifest(pp, :catch_failures => true) + expect(apply_manifest(pp, :catch_failures => true).exit_code).to be_zero + end + end + + describe service($service_name) do + it { is_expected.to be_running } + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + end + end +end + +describe 'apache::mod::worker class' do + describe 'running puppet code' do + # Using puppet_apply as a helper + let(:pp) do + <<-EOS + class { 'apache': + mpm_module => 'worker', + } + EOS + end + + # Run it twice and test for idempotency + it_behaves_like "a idempotent resource" + end + + describe service($service_name) do + it { is_expected.to be_running } + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + end +end + +describe 'apache::mod::prefork class' do + describe 'running puppet code' do + # Using puppet_apply as a helper + let(:pp) do + <<-EOS + class { 'apache': + mpm_module => 'prefork', + } + EOS + end + # Run it twice and test for idempotency + it_behaves_like "a idempotent resource" + end + + describe service($service_name) do + it { is_expected.to be_running } + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/service_spec.rb b/environments/production/modules/apache/spec/acceptance/service_spec.rb new file mode 100644 index 0000000..c62a349 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/service_spec.rb @@ -0,0 +1,18 @@ +require 'spec_helper_acceptance' + +describe 'apache::service class' do + describe 'adding dependencies in between the base class and service class' do + let(:pp) do + <<-EOS + class { 'apache': } + file { '/tmp/test': + require => Class['apache'], + notify => Class['apache::service'], + } + EOS + end + + # Run it twice and test for idempotency + it_behaves_like "a idempotent resource" + end +end diff --git a/environments/production/modules/apache/spec/acceptance/version.rb b/environments/production/modules/apache/spec/acceptance/version.rb new file mode 100644 index 0000000..fac4071 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/version.rb @@ -0,0 +1,96 @@ +_osfamily = fact('osfamily') +_operatingsystem = fact('operatingsystem') +_operatingsystemrelease = fact('operatingsystemrelease').to_f + +case _osfamily +when 'RedHat' + $confd_dir = '/etc/httpd/conf.d' + $conf_file = '/etc/httpd/conf/httpd.conf' + $ports_file = '/etc/httpd/conf/ports.conf' + $vhost_dir = '/etc/httpd/conf.d' + $vhost = '/etc/httpd/conf.d/15-default.conf' + $run_dir = '/var/run/httpd' + $doc_root = '/var/www' + $service_name = 'httpd' + $package_name = 'httpd' + $error_log = 'error_log' + $suphp_handler = 'php5-script' + $suphp_configpath = 'undef' + + if (_operatingsystem == 'Fedora' and _operatingsystemrelease >= 18) or (_operatingsystem != 'Fedora' and _operatingsystemrelease >= 7) + $apache_version = '2.4' + $mod_dir = '/etc/httpd/conf.modules.d' + else + $apache_version = '2.2' + $mod_dir = '/etc/httpd/conf.d' + end +when 'Debian' + $confd_dir = '/etc/apache2/conf.d' + $mod_dir = '/etc/apache2/mods-available' + $conf_file = '/etc/apache2/apache2.conf' + $ports_file = '/etc/apache2/ports.conf' + $vhost = '/etc/apache2/sites-available/15-default.conf' + $vhost_dir = '/etc/apache2/sites-enabled' + $run_dir = '/var/run/apache2' + $doc_root = '/var/www' + $service_name = 'apache2' + $package_name = 'apache2' + $error_log = 'error.log' + $suphp_handler = 'x-httpd-php' + $suphp_configpath = '/etc/php5/apache2' + + if _operatingsystem == 'Ubuntu' and _operatingsystemrelease >= 13.10 + $apache_version = '2.4' + elsif _operatingsystem == 'Debian' and _operatingsystemrelease >= 8.0 + $apache_version = '2.4' + else + $apache_version = '2.2' + end +when 'FreeBSD' + $confd_dir = '/usr/local/etc/apache24/Includes' + $mod_dir = '/usr/local/etc/apache24/Modules' + $conf_file = '/usr/local/etc/apache24/httpd.conf' + $ports_file = '/usr/local/etc/apache24/Includes/ports.conf' + $vhost = '/usr/local/etc/apache24/Vhosts/15-default.conf' + $vhost_dir = '/usr/local/etc/apache24/Vhosts' + $run_dir = '/var/run/apache24' + $doc_root = '/var/www' + $service_name = 'apache24' + $package_name = 'apache24' + $error_log = 'http-error.log' + + $apache_version = '2.2' +when 'Gentoo' + $confd_dir = '/etc/apache2/conf.d' + $mod_dir = '/etc/apache2/modules.d' + $conf_file = '/etc/apache2/httpd.conf' + $ports_file = '/etc/apache2/ports.conf' + $vhost = '/etc/apache2/vhosts.d/15-default.conf' + $vhost_dir = '/etc/apache2/vhosts.d' + $run_dir = '/var/run/apache2' + $doc_root = '/var/www' + $service_name = 'apache2' + $package_name = 'www-servers/apache' + $error_log = 'http-error.log' + + $apache_version = '2.4' +when 'Suse' + $confd_dir = '/etc/apache2/conf.d' + $mod_dir = '/etc/apache2/mods-available' + $conf_file = '/etc/apache2/httpd.conf' + $ports_file = '/etc/apache2/ports.conf' + $vhost = '/etc/apache2/sites-available/15-default.conf' + $vhost_dir = '/etc/apache2/sites-available' + $run_dir = '/var/run/apache2' + $doc_root = '/srv/www' + $service_name = 'apache2' + $package_name = 'apache2' + $error_log = 'error.log' + if _operatingsystemrelease < 12 + $apache_version = '2.2' + else + $apache_version = '2.4' + end +else + $apache_version = '0' +end diff --git a/environments/production/modules/apache/spec/acceptance/vhost_spec.rb b/environments/production/modules/apache/spec/acceptance/vhost_spec.rb new file mode 100644 index 0000000..200a83d --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/vhost_spec.rb @@ -0,0 +1,1590 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +describe 'apache::vhost define' do + context 'no default vhosts' do + it 'should create no default vhosts' do + pp = <<-EOS + class { 'apache': + default_vhost => false, + default_ssl_vhost => false, + service_ensure => stopped, + } + if ($::osfamily == 'Suse') { + exec { '/usr/bin/gensslcert': + require => Class['apache'], + } + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/15-default.conf") do + it { is_expected.not_to be_file } + end + + describe file("#{$vhost_dir}/15-default-ssl.conf") do + it { is_expected.not_to be_file } + end + end + + context "default vhost without ssl" do + it 'should create a default vhost config' do + pp = <<-EOS + class { 'apache': } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/15-default.conf") do + it { is_expected.to contain '' } + end + + describe file("#{$vhost_dir}/15-default-ssl.conf") do + it { is_expected.not_to be_file } + end + end + + context 'default vhost with ssl' do + it 'should create default vhost configs' do + pp = <<-EOS + file { '#{$run_dir}': + ensure => 'directory', + recurse => true, + } + + class { 'apache': + default_ssl_vhost => true, + require => File['#{$run_dir}'], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/15-default.conf") do + it { is_expected.to contain '' } + end + + describe file("#{$vhost_dir}/15-default-ssl.conf") do + it { is_expected.to contain '' } + it { is_expected.to contain "SSLEngine on" } + end + end + + context 'new vhost on port 80' do + it 'should configure an apache vhost' do + pp = <<-EOS + class { 'apache': } + file { '/var/www': + ensure => 'directory', + recurse => true, + } + + apache::vhost { 'first.example.com': + port => '80', + docroot => '/var/www/first', + require => File['/var/www'], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-first.example.com.conf") do + it { is_expected.to contain '' } + it { is_expected.to contain "ServerName first.example.com" } + end + end + + context 'new proxy vhost on port 80' do + it 'should configure an apache proxy vhost' do + pp = <<-EOS + class { 'apache': } + apache::vhost { 'proxy.example.com': + port => '80', + docroot => '/var/www/proxy', + proxy_pass => [ + { 'path' => '/foo', 'url' => 'http://backend-foo/'}, + ], + proxy_preserve_host => true, + proxy_error_override => true, + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-proxy.example.com.conf") do + it { is_expected.to contain '' } + it { is_expected.to contain "ServerName proxy.example.com" } + it { is_expected.to contain "ProxyPass" } + it { is_expected.to contain "ProxyPreserveHost On" } + it { is_expected.to contain "ProxyErrorOverride On" } + it { is_expected.not_to contain "ProxyAddHeaders" } + it { is_expected.not_to contain "" } + end + end + + unless (fact('operatingsystem') == 'SLES' and fact('operatingsystemmajorrelease') <= '10') + context 'new proxy vhost on port 80' do + it 'should configure an apache proxy vhost' do + pp = <<-EOS + class { 'apache': } + apache::vhost { 'proxy.example.com': + port => '80', + docroot => '#{$docroot}/proxy', + proxy_pass_match => [ + { 'path' => '/foo', 'url' => 'http://backend-foo/'}, + ], + proxy_preserve_host => true, + proxy_error_override => true, + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-proxy.example.com.conf") do + it { is_expected.to contain '' } + it { is_expected.to contain "ServerName proxy.example.com" } + it { is_expected.to contain "ProxyPassMatch /foo http://backend-foo/" } + it { is_expected.to contain "ProxyPreserveHost On" } + it { is_expected.to contain "ProxyErrorOverride On" } + it { is_expected.not_to contain "ProxyAddHeaders" } + it { is_expected.not_to contain "" } + end + end + end + + context 'new vhost on port 80' do + it 'should configure two apache vhosts' do + pp = <<-EOS + class { 'apache': } + apache::vhost { 'first.example.com': + port => '80', + docroot => '/var/www/first', + } + host { 'first.example.com': ip => '127.0.0.1', } + file { '/var/www/first/index.html': + ensure => file, + content => "Hello from first\\n", + } + apache::vhost { 'second.example.com': + port => '80', + docroot => '/var/www/second', + } + host { 'second.example.com': ip => '127.0.0.1', } + file { '/var/www/second/index.html': + ensure => file, + content => "Hello from second\\n", + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + it 'should answer to first.example.com' do + shell("/usr/bin/curl first.example.com:80", {:acceptable_exit_codes => 0}) do |r| + expect(r.stdout).to eq("Hello from first\n") + end + end + + it 'should answer to second.example.com' do + shell("/usr/bin/curl second.example.com:80", {:acceptable_exit_codes => 0}) do |r| + expect(r.stdout).to eq("Hello from second\n") + end + end + end + + context 'new vhost with multiple IP addresses on port 80' do + it 'should configure one apache vhost with 2 ip addresses' do + pp = <<-EOS + class { 'apache': + default_vhost => false, + } + apache::vhost { 'example.com': + port => '80', + ip => ['127.0.0.1','127.0.0.2'], + ip_based => true, + docroot => '/var/www/html', + } + host { 'host1.example.com': ip => '127.0.0.1', } + host { 'host2.example.com': ip => '127.0.0.2', } + file { '/var/www/html/index.html': + ensure => file, + content => "Hello from vhost\\n", + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file("#{$vhost_dir}/25-example.com.conf") do + it { is_expected.to contain '' } + it { is_expected.to contain "ServerName example.com" } + end + + describe file($ports_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'Listen 127.0.0.1:80' } + it { is_expected.to contain 'Listen 127.0.0.2:80' } + it { is_expected.not_to contain 'NameVirtualHost 127.0.0.1:80' } + it { is_expected.not_to contain 'NameVirtualHost 127.0.0.2:80' } + end + + it 'should answer to host1.example.com' do + shell("/usr/bin/curl host1.example.com:80", {:acceptable_exit_codes => 0}) do |r| + expect(r.stdout).to eq("Hello from vhost\n") + end + end + + it 'should answer to host2.example.com' do + shell("/usr/bin/curl host2.example.com:80", {:acceptable_exit_codes => 0}) do |r| + expect(r.stdout).to eq("Hello from vhost\n") + end + end + end + + context 'new vhost with IPv6 address on port 80', :ipv6 do + it 'should configure one apache vhost with an ipv6 address' do + pp = <<-EOS + class { 'apache': + default_vhost => false, + } + apache::vhost { 'example.com': + port => '80', + ip => '::1', + ip_based => true, + docroot => '/var/www/html', + } + host { 'ipv6.example.com': ip => '::1', } + file { '/var/www/html/index.html': + ensure => file, + content => "Hello from vhost\\n", + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + describe file("#{$vhost_dir}/25-example.com.conf") do + it { is_expected.to contain '' } + it { is_expected.to contain "ServerName example.com" } + end + + describe file($ports_file) do + it { is_expected.to be_file } + it { is_expected.to contain 'Listen [::1]:80' } + it { is_expected.not_to contain 'NameVirtualHost [::1]:80' } + end + + it 'should answer to ipv6.example.com' do + shell("/usr/bin/curl ipv6.example.com:80", {:acceptable_exit_codes => 0}) do |r| + expect(r.stdout).to eq("Hello from vhost\n") + end + end + end + + context 'apache_directories' do + describe 'readme example, adapted' do + it 'should configure a vhost with Files' do + pp = <<-EOS + class { 'apache': } + + if versioncmp($apache_version, '2.4') >= 0 { + $_files_match_directory = { 'path' => '(\.swp|\.bak|~)$', 'provider' => 'filesmatch', 'require' => 'all denied', } + } else { + $_files_match_directory = { 'path' => '(\.swp|\.bak|~)$', 'provider' => 'filesmatch', 'deny' => 'from all', } + } + + $_directories = [ + { 'path' => '/var/www/files', }, + $_files_match_directory, + ] + + apache::vhost { 'files.example.net': + docroot => '/var/www/files', + directories => $_directories, + } + file { '/var/www/files/index.html': + ensure => file, + content => "Hello World\\n", + } + file { '/var/www/files/index.html.bak': + ensure => file, + content => "Hello World\\n", + } + host { 'files.example.net': ip => '127.0.0.1', } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + it 'should answer to files.example.net' do + expect(shell("/usr/bin/curl -sSf files.example.net:80/index.html").stdout).to eq("Hello World\n") + expect(shell("/usr/bin/curl -sSf files.example.net:80/index.html.bak", {:acceptable_exit_codes => 22}).stderr).to match(/curl: \(22\) The requested URL returned error: 403/) + end + end + + describe 'other Directory options' do + it 'should configure a vhost with multiple Directory sections' do + pp = <<-EOS + class { 'apache': } + + if versioncmp($apache_version, '2.4') >= 0 { + $_files_match_directory = { 'path' => 'private.html$', 'provider' => 'filesmatch', 'require' => 'all denied' } + } else { + $_files_match_directory = [ + { 'path' => 'private.html$', 'provider' => 'filesmatch', 'deny' => 'from all' }, + { 'path' => '/bar/bar.html', 'provider' => 'location', allow => [ 'from 127.0.0.1', ] }, + ] + } + + $_directories = [ + { 'path' => '/var/www/files', }, + { 'path' => '/foo/', 'provider' => 'location', 'directoryindex' => 'notindex.html', }, + $_files_match_directory, + ] + + apache::vhost { 'files.example.net': + docroot => '/var/www/files', + directories => $_directories, + } + file { '/var/www/files/foo': + ensure => directory, + } + file { '/var/www/files/foo/notindex.html': + ensure => file, + content => "Hello Foo\\n", + } + file { '/var/www/files/private.html': + ensure => file, + content => "Hello World\\n", + } + file { '/var/www/files/bar': + ensure => directory, + } + file { '/var/www/files/bar/bar.html': + ensure => file, + content => "Hello Bar\\n", + } + host { 'files.example.net': ip => '127.0.0.1', } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + it 'should answer to files.example.net' do + expect(shell("/usr/bin/curl -sSf files.example.net:80/").stdout).to eq("Hello World\n") + expect(shell("/usr/bin/curl -sSf files.example.net:80/foo/").stdout).to eq("Hello Foo\n") + expect(shell("/usr/bin/curl -sSf files.example.net:80/private.html", {:acceptable_exit_codes => 22}).stderr).to match(/curl: \(22\) The requested URL returned error: 403/) + expect(shell("/usr/bin/curl -sSf files.example.net:80/bar/bar.html").stdout).to eq("Hello Bar\n") + end + end + + describe 'SetHandler directive' do + it 'should configure a vhost with a SetHandler directive' do + pp = <<-EOS + class { 'apache': } + apache::mod { 'status': } + host { 'files.example.net': ip => '127.0.0.1', } + apache::vhost { 'files.example.net': + docroot => '/var/www/files', + directories => [ + { path => '/var/www/files', }, + { path => '/server-status', provider => 'location', sethandler => 'server-status', }, + ], + } + file { '/var/www/files/index.html': + ensure => file, + content => "Hello World\\n", + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + it 'should answer to files.example.net' do + expect(shell("/usr/bin/curl -sSf files.example.net:80/index.html").stdout).to eq("Hello World\n") + expect(shell("/usr/bin/curl -sSf files.example.net:80/server-status?auto").stdout).to match(/Scoreboard: /) + end + end + + describe 'Satisfy and Auth directive', :unless => $apache_version == '2.4' do + it 'should configure a vhost with Satisfy and Auth directive' do + pp = <<-EOS + class { 'apache': } + host { 'files.example.net': ip => '127.0.0.1', } + apache::vhost { 'files.example.net': + docroot => '/var/www/files', + directories => [ + { + path => '/var/www/files/foo', + auth_type => 'Basic', + auth_name => 'Basic Auth', + auth_user_file => '/var/www/htpasswd', + auth_require => "valid-user", + }, + { + path => '/var/www/files/bar', + auth_type => 'Basic', + auth_name => 'Basic Auth', + auth_user_file => '/var/www/htpasswd', + auth_require => 'valid-user', + satisfy => 'Any', + }, + { + path => '/var/www/files/baz', + allow => 'from 10.10.10.10', + auth_type => 'Basic', + auth_name => 'Basic Auth', + auth_user_file => '/var/www/htpasswd', + auth_require => 'valid-user', + satisfy => 'Any', + }, + ], + } + file { '/var/www/files/foo': + ensure => directory, + } + file { '/var/www/files/bar': + ensure => directory, + } + file { '/var/www/files/baz': + ensure => directory, + } + file { '/var/www/files/foo/index.html': + ensure => file, + content => "Hello World\\n", + } + file { '/var/www/files/bar/index.html': + ensure => file, + content => "Hello World\\n", + } + file { '/var/www/files/baz/index.html': + ensure => file, + content => "Hello World\\n", + } + file { '/var/www/htpasswd': + ensure => file, + content => "login:IZ7jMcLSx0oQk", # "password" as password + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { should be_running } + end + + it 'should answer to files.example.net' do + shell("/usr/bin/curl -sSf files.example.net:80/foo/index.html", {:acceptable_exit_codes => 22}).stderr.should match(/curl: \(22\) The requested URL returned error: 401/) + shell("/usr/bin/curl -sSf -u login:password files.example.net:80/foo/index.html").stdout.should eq("Hello World\n") + shell("/usr/bin/curl -sSf files.example.net:80/bar/index.html").stdout.should eq("Hello World\n") + shell("/usr/bin/curl -sSf -u login:password files.example.net:80/bar/index.html").stdout.should eq("Hello World\n") + shell("/usr/bin/curl -sSf files.example.net:80/baz/index.html", {:acceptable_exit_codes => 22}).stderr.should match(/curl: \(22\) The requested URL returned error: 401/) + shell("/usr/bin/curl -sSf -u login:password files.example.net:80/baz/index.html").stdout.should eq("Hello World\n") + end + end + end + + case fact('lsbdistcodename') + when 'precise', 'wheezy' + context 'vhost FallbackResource example' do + it 'should configure a vhost with FallbackResource' do + pp = <<-EOS + class { 'apache': } + apache::vhost { 'fallback.example.net': + docroot => '/var/www/fallback', + fallbackresource => '/index.html' + } + file { '/var/www/fallback/index.html': + ensure => file, + content => "Hello World\\n", + } + host { 'fallback.example.net': ip => '127.0.0.1', } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + it 'should answer to fallback.example.net' do + shell("/usr/bin/curl fallback.example.net:80/Does/Not/Exist") do |r| + expect(r.stdout).to eq("Hello World\n") + end + end + + end + else + # The current stable RHEL release (6.4) comes with Apache httpd 2.2.15 + # That was released March 6, 2010. + # FallbackResource was backported to 2.2.16, and released July 25, 2010. + # Ubuntu Lucid (10.04) comes with apache2 2.2.14, released October 3, 2009. + # https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/STATUS + end + + context 'virtual_docroot hosting separate sites' do + it 'should configure a vhost with VirtualDocumentRoot' do + pp = <<-EOS + class { 'apache': } + apache::vhost { 'virt.example.com': + vhost_name => '*', + serveraliases => '*virt.example.com', + port => '80', + docroot => '/var/www/virt', + virtual_docroot => '/var/www/virt/%1', + } + host { 'virt.example.com': ip => '127.0.0.1', } + host { 'a.virt.example.com': ip => '127.0.0.1', } + host { 'b.virt.example.com': ip => '127.0.0.1', } + file { [ '/var/www/virt/a', '/var/www/virt/b', ]: ensure => directory, } + file { '/var/www/virt/a/index.html': ensure => file, content => "Hello from a.virt\\n", } + file { '/var/www/virt/b/index.html': ensure => file, content => "Hello from b.virt\\n", } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + it 'should answer to a.virt.example.com' do + shell("/usr/bin/curl a.virt.example.com:80", {:acceptable_exit_codes => 0}) do |r| + expect(r.stdout).to eq("Hello from a.virt\n") + end + end + + it 'should answer to b.virt.example.com' do + shell("/usr/bin/curl b.virt.example.com:80", {:acceptable_exit_codes => 0}) do |r| + expect(r.stdout).to eq("Hello from b.virt\n") + end + end + end + + context 'proxy_pass for alternative vhost' do + it 'should configure a local vhost and a proxy vhost' do + apply_manifest(%{ + class { 'apache': default_vhost => false, } + apache::vhost { 'localhost': + docroot => '/var/www/local', + ip => '127.0.0.1', + port => '8888', + } + apache::listen { '*:80': } + apache::vhost { 'proxy.example.com': + docroot => '/var/www', + port => '80', + add_listen => false, + proxy_pass => { + 'path' => '/', + 'url' => 'http://localhost:8888/subdir/', + }, + } + host { 'proxy.example.com': ip => '127.0.0.1', } + file { ['/var/www/local', '/var/www/local/subdir']: ensure => directory, } + file { '/var/www/local/subdir/index.html': + ensure => file, + content => "Hello from localhost\\n", + } + }, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + it 'should get a response from the back end' do + shell("/usr/bin/curl --max-redirs 0 proxy.example.com:80") do |r| + expect(r.stdout).to eq("Hello from localhost\n") + expect(r.exit_code).to eq(0) + end + end + end + + unless (fact('operatingsystem') == 'SLES' and fact('operatingsystemmajorrelease') <= '10') + context 'proxy_pass_match for alternative vhost' do + it 'should configure a local vhost and a proxy vhost' do + apply_manifest(%{ + class { 'apache': default_vhost => false, } + apache::vhost { 'localhost': + docroot => '/var/www/local', + ip => '127.0.0.1', + port => '8888', + } + apache::listen { '*:80': } + apache::vhost { 'proxy.example.com': + docroot => '/var/www', + port => '80', + add_listen => false, + proxy_pass_match => { + 'path' => '/', + 'url' => 'http://localhost:8888/subdir/', + }, + } + host { 'proxy.example.com': ip => '127.0.0.1', } + file { ['/var/www/local', '/var/www/local/subdir']: ensure => directory, } + file { '/var/www/local/subdir/index.html': + ensure => file, + content => "Hello from localhost\\n", + } + }, :catch_failures => true) + end + + describe service($service_name) do + if (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '8') + pending 'Should be enabled - Bug 760616 on Debian 8' + else + it { should be_enabled } + end + it { is_expected.to be_running } + end + + it 'should get a response from the back end' do + shell("/usr/bin/curl --max-redirs 0 proxy.example.com:80") do |r| + expect(r.stdout).to eq("Hello from localhost\n") + expect(r.exit_code).to eq(0) + end + end + end + end + + describe 'ip_based' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + ip_based => true, + servername => 'test.server', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file($ports_file) do + it { is_expected.to be_file } + it { is_expected.not_to contain 'NameVirtualHost test.server' } + end + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain "ServerName test.server" } + end + end + + describe 'ip_based and no servername' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + ip_based => true, + servername => '', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file($ports_file) do + it { is_expected.to be_file } + it { is_expected.not_to contain 'NameVirtualHost test.server' } + end + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.not_to contain "ServerName" } + end + end + + describe 'add_listen' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': default_vhost => false } + host { 'testlisten.server': ip => '127.0.0.1' } + apache::listen { '81': } + apache::vhost { 'testlisten.server': + docroot => '/tmp', + port => '80', + add_listen => false, + servername => 'testlisten.server', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file($ports_file) do + it { is_expected.to be_file } + it { is_expected.not_to contain 'Listen 80' } + it { is_expected.to contain 'Listen 81' } + end + end + + describe 'docroot' do + it 'applies cleanly' do + pp = <<-EOS + user { 'test_owner': ensure => present, } + group { 'test_group': ensure => present, } + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp/test', + docroot_owner => 'test_owner', + docroot_group => 'test_group', + docroot_mode => '0750', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file('/tmp/test') do + it { is_expected.to be_directory } + it { is_expected.to be_owned_by 'test_owner' } + it { is_expected.to be_grouped_into 'test_group' } + it { is_expected.to be_mode 750 } + end + end + + describe 'default_vhost' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + default_vhost => true, + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file($ports_file) do + it { is_expected.to be_file } + if fact('osfamily') == 'RedHat' and fact('operatingsystemmajrelease') == '7' + it { is_expected.not_to contain 'NameVirtualHost test.server' } + elsif fact('operatingsystem') == 'Ubuntu' and fact('operatingsystemrelease') =~ /(14\.04|13\.10|16\.04)/ + it { is_expected.not_to contain 'NameVirtualHost test.server' } + elsif fact('operatingsystem') == 'Debian' and fact('operatingsystemmajrelease') == '8' + it { is_expected.not_to contain 'NameVirtualHost test.server' } + elsif fact('operatingsystem') == 'SLES' and fact('operatingsystemrelease') >= '12' + it { is_expected.not_to contain 'NameVirtualHost test.server' } + else + it { is_expected.to contain 'NameVirtualHost test.server' } + end + end + + describe file("#{$vhost_dir}/10-test.server.conf") do + it { is_expected.to be_file } + end + end + + describe 'options' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + options => ['Indexes','FollowSymLinks', 'ExecCGI'], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'Options Indexes FollowSymLinks ExecCGI' } + end + end + + describe 'override' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + override => ['All'], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'AllowOverride All' } + end + end + + describe 'logroot' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + logroot => '/tmp', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain ' CustomLog "/tmp' } + end + end + + ['access', 'error'].each do |logtype| + case logtype + when 'access' + logname = 'CustomLog' + when 'error' + logname = 'ErrorLog' + end + + describe "#{logtype}_log" do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + logroot => '/tmp', + #{logtype}_log => false, + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.not_to contain " #{logname} \"/tmp" } + end + end + + describe "#{logtype}_log_pipe" do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + logroot => '/tmp', + #{logtype}_log_pipe => '|/bin/sh', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain " #{logname} \"|/bin/sh" } + end + end + + describe "#{logtype}_log_syslog" do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + logroot => '/tmp', + #{logtype}_log_syslog => 'syslog', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain " #{logname} \"syslog\"" } + end + end + end + + describe 'access_log_format' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + logroot => '/tmp', + access_log_syslog => 'syslog', + access_log_format => '%h %l', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'CustomLog "syslog" "%h %l"' } + end + end + + describe 'access_log_env_var' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + logroot => '/tmp', + access_log_syslog => 'syslog', + access_log_env_var => 'admin', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'CustomLog "syslog" combined env=admin' } + end + end + + describe 'multiple access_logs' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + logroot => '/tmp', + access_logs => [ + {'file' => 'log1'}, + {'file' => 'log2', 'env' => 'admin' }, + {'file' => '/var/tmp/log3', 'format' => '%h %l'}, + {'syslog' => 'syslog' } + ] + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'CustomLog "/tmp/log1" combined' } + it { is_expected.to contain 'CustomLog "/tmp/log2" combined env=admin' } + it { is_expected.to contain 'CustomLog "/var/tmp/log3" "%h %l"' } + it { is_expected.to contain 'CustomLog "syslog" combined' } + end + end + + describe 'aliases' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + aliases => [ + { alias => '/image' , path => '/ftp/pub/image' } , + { scriptalias => '/myscript' , path => '/usr/share/myscript' } + ], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'Alias /image "/ftp/pub/image"' } + it { is_expected.to contain 'ScriptAlias /myscript "/usr/share/myscript"' } + end + end + + describe 'scriptaliases' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + scriptaliases => [{ alias => '/myscript', path => '/usr/share/myscript', }], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'ScriptAlias /myscript "/usr/share/myscript"' } + end + end + + describe 'proxy' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': service_ensure => stopped, } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + proxy_dest => 'test2', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'ProxyPass / test2/' } + end + end + + describe 'actions' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + action => 'php-fastcgi', + } + EOS + pp = pp + "\nclass { 'apache::mod::actions': }" if fact('osfamily') == 'Debian' || fact('osfamily') == 'Suse' + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'Action php-fastcgi /cgi-bin virtual' } + end + end + + describe 'suphp' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': service_ensure => stopped, } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + suphp_addhandler => '#{$suphp_handler}', + suphp_engine => 'on', + suphp_configpath => '#{$suphp_configpath}', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain "suPHP_AddHandler #{$suphp_handler}" } + it { is_expected.to contain 'suPHP_Engine on' } + it { is_expected.to contain "suPHP_ConfigPath \"#{$suphp_configpath}\"" } + end + end + + describe 'rack_base_uris' do + unless fact('osfamily') == 'RedHat' or fact('operatingsystem') == 'SLES' + it 'applies cleanly' do + test = lambda do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + rack_base_uris => ['/test'], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + test.call + end + end + end + + describe 'no_proxy_uris' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': service_ensure => stopped, } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + proxy_dest => 'http://test2', + no_proxy_uris => [ 'http://test2/test' ], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'ProxyPass http://test2/test !' } + it { is_expected.to contain 'ProxyPass / http://test2/' } + end + end + + describe 'redirect' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + redirect_source => ['/images'], + redirect_dest => ['http://test.server/'], + redirect_status => ['permanent'], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'Redirect permanent /images http://test.server/' } + end + end + + describe 'request_headers' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + request_headers => ['append MirrorID "mirror 12"'], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'append MirrorID "mirror 12"' } + end + end + + describe 'rewrite rules' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + rewrites => [ + { comment => 'test', + rewrite_cond => '%{HTTP_USER_AGENT} ^Lynx/ [OR]', + rewrite_rule => ['^index\.html$ welcome.html'], + rewrite_map => ['lc int:tolower'], + } + ], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain '#test' } + it { is_expected.to contain 'RewriteCond %{HTTP_USER_AGENT} ^Lynx/ [OR]' } + it { is_expected.to contain 'RewriteRule ^index.html$ welcome.html' } + it { is_expected.to contain 'RewriteMap lc int:tolower' } + end + end + + describe 'directory rewrite rules' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + if ! defined(Class['apache::mod::rewrite']) { + include ::apache::mod::rewrite + } + apache::vhost { 'test.server': + docroot => '/tmp', + directories => [ + { + path => '/tmp', + rewrites => [ + { + comment => 'Permalink Rewrites', + rewrite_base => '/', + }, + { rewrite_rule => [ '^index\\.php$ - [L]' ] }, + { rewrite_cond => [ + '%{REQUEST_FILENAME} !-f', + '%{REQUEST_FILENAME} !-d', ], rewrite_rule => [ '. /index.php [L]' ], } + ], + }, + ], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { should be_file } + it { should contain '#Permalink Rewrites' } + it { should contain 'RewriteEngine On' } + it { should contain 'RewriteBase /' } + it { should contain 'RewriteRule ^index\.php$ - [L]' } + it { should contain 'RewriteCond %{REQUEST_FILENAME} !-f' } + it { should contain 'RewriteCond %{REQUEST_FILENAME} !-d' } + it { should contain 'RewriteRule . /index.php [L]' } + end + end + + describe 'setenv/setenvif' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + setenv => ['TEST /test'], + setenvif => ['Request_URI "\.gif$" object_is_image=gif'] + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'SetEnv TEST /test' } + it { is_expected.to contain 'SetEnvIf Request_URI "\.gif$" object_is_image=gif' } + end + end + + describe 'block' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + block => 'scm', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain '' } + end + end + + describe 'wsgi' do + context 'on lucid', :if => fact('lsbdistcodename') == 'lucid' do + it 'import_script applies cleanly' do + pp = <<-EOS + class { 'apache': } + class { 'apache::mod::wsgi': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + wsgi_application_group => '%{GLOBAL}', + wsgi_daemon_process => 'wsgi', + wsgi_daemon_process_options => {processes => '2'}, + wsgi_process_group => 'nobody', + wsgi_script_aliases => { '/test' => '/test1' }, + wsgi_script_aliases_match => { '/test/([^/*])' => '/test1' }, + wsgi_pass_authorization => 'On', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + end + + context 'on everything but lucid', :unless => (fact('lsbdistcodename') == 'lucid' or fact('operatingsystem') == 'SLES') do + it 'import_script applies cleanly' do + pp = <<-EOS + class { 'apache': } + class { 'apache::mod::wsgi': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + wsgi_application_group => '%{GLOBAL}', + wsgi_daemon_process => 'wsgi', + wsgi_daemon_process_options => {processes => '2'}, + wsgi_import_script => '/test1', + wsgi_import_script_options => { application-group => '%{GLOBAL}', process-group => 'wsgi' }, + wsgi_process_group => 'nobody', + wsgi_script_aliases => { '/test' => '/test1' }, + wsgi_script_aliases_match => { '/test/([^/*])' => '/test1' }, + wsgi_pass_authorization => 'On', + wsgi_chunked_request => 'On', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'WSGIApplicationGroup %{GLOBAL}' } + it { is_expected.to contain 'WSGIDaemonProcess wsgi processes=2' } + it { is_expected.to contain 'WSGIImportScript /test1 application-group=%{GLOBAL} process-group=wsgi' } + it { is_expected.to contain 'WSGIProcessGroup nobody' } + it { is_expected.to contain 'WSGIScriptAlias /test "/test1"' } + it { is_expected.to contain 'WSGIPassAuthorization On' } + it { is_expected.to contain 'WSGIChunkedRequest On' } + end + end + end + + describe 'custom_fragment' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + custom_fragment => inline_template('#weird test string'), + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain '#weird test string' } + end + end + + describe 'itk' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + itk => { user => 'nobody', group => 'nobody' } + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'AssignUserId nobody nobody' } + end + end + + # Limit testing to Debian, since Centos does not have fastcgi package. + case fact('osfamily') + when 'Debian' + describe 'fastcgi' do + it 'applies cleanly' do + pp = <<-EOS + $_os = $::operatingsystem + + if $_os == 'Ubuntu' { + $_location = "http://archive.ubuntu.com/ubuntu/" + $_security_location = "http://archive.ubuntu.com/ubuntu/" + $_release = $::lsbdistcodename + $_release_security = "${_release}-security" + $_repos = "main universe multiverse" + } else { + $_location = "http://httpredir.debian.org/debian/" + $_security_location = "http://security.debian.org/" + $_release = $::lsbdistcodename + $_release_security = "${_release}/updates" + $_repos = "main contrib non-free" + } + + include ::apt + apt::source { "${_os}_${_release}": + location => $_location, + release => $_release, + repos => $_repos, + include_src => false, + } + + apt::source { "${_os}_${_release}-updates": + location => $_location, + release => "${_release}-updates", + repos => $_repos, + include_src => false, + } + + apt::source { "${_os}_${_release}-security": + location => $_security_location, + release => $_release_security, + repos => $_repos, + include_src => false, + } + EOS + + #apt-get update may not run clean here. Should be OK. + apply_manifest(pp, :catch_failures => false) + + pp2 = <<-EOS + class { 'apache': } + class { 'apache::mod::fastcgi': } + host { 'test.server': ip => '127.0.0.1' } + apache::vhost { 'test.server': + docroot => '/tmp', + fastcgi_server => 'localhost', + fastcgi_socket => '/tmp/fast/1234', + fastcgi_dir => '/tmp/fast', + } + EOS + apply_manifest(pp2, :catch_failures => true, :acceptable_exit_codes => [0, 2]) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'FastCgiExternalServer localhost -socket /tmp/fast/1234' } + it { is_expected.to contain '' } + end + end + end + + describe 'additional_includes' do + it 'applies cleanly' do + pp = <<-EOS + if $::osfamily == 'RedHat' and "$::selinux" == "true" { + $semanage_package = $::operatingsystemmajrelease ? { + '5' => 'policycoreutils', + default => 'policycoreutils-python', + } + exec { 'set_apache_defaults': + command => 'semanage fcontext -a -t httpd_sys_content_t "/apache_spec(/.*)?"', + path => '/bin:/usr/bin/:/sbin:/usr/sbin', + require => Package[$semanage_package], + } + package { $semanage_package: ensure => installed } + exec { 'restorecon_apache': + command => 'restorecon -Rv /apache_spec', + path => '/bin:/usr/bin/:/sbin:/usr/sbin', + before => Service['httpd'], + require => Class['apache'], + } + } + class { 'apache': } + host { 'test.server': ip => '127.0.0.1' } + file { '/apache_spec': ensure => directory, } + file { '/apache_spec/include': ensure => present, content => '#additional_includes' } + apache::vhost { 'test.server': + docroot => '/apache_spec', + additional_includes => '/apache_spec/include', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'Include "/apache_spec/include"' } + end + end + + describe 'virtualhost without priority prefix' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + apache::vhost { 'test.server': + priority => false, + docroot => '/tmp' + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/test.server.conf") do + it { is_expected.to be_file } + end + end + + describe 'SSLProtocol directive' do + it 'applies cleanly' do + pp = <<-EOS + class { 'apache': } + apache::vhost { 'test.server': + docroot => '/tmp', + ssl => true, + ssl_protocol => ['All', '-SSLv2'], + } + apache::vhost { 'test2.server': + docroot => '/tmp', + ssl => true, + ssl_protocol => 'All -SSLv2', + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-test.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'SSLProtocol *All -SSLv2' } + end + + describe file("#{$vhost_dir}/25-test2.server.conf") do + it { is_expected.to be_file } + it { is_expected.to contain 'SSLProtocol *All -SSLv2' } + end + end +end diff --git a/environments/production/modules/apache/spec/acceptance/vhosts_spec.rb b/environments/production/modules/apache/spec/acceptance/vhosts_spec.rb new file mode 100644 index 0000000..d8fb062 --- /dev/null +++ b/environments/production/modules/apache/spec/acceptance/vhosts_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper_acceptance' +require_relative './version.rb' + +describe 'apache::vhosts class' do + context 'custom vhosts defined via class apache::vhosts' do + it 'should create custom vhost config files' do + pp = <<-EOS + class { 'apache::vhosts': + vhosts => { + 'custom_vhost_1' => { + 'docroot' => '/var/www/custom_vhost_1', + 'port' => '81', + }, + 'custom_vhost_2' => { + 'docroot' => '/var/www/custom_vhost_2', + 'port' => '82', + }, + }, + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + describe file("#{$vhost_dir}/25-custom_vhost_1.conf") do + it { is_expected.to contain '' } + end + + describe file("#{$vhost_dir}/25-custom_vhost_2.conf") do + it { is_expected.to contain '' } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/apache_spec.rb b/environments/production/modules/apache/spec/classes/apache_spec.rb new file mode 100644 index 0000000..6eef4ba --- /dev/null +++ b/environments/production/modules/apache/spec/classes/apache_spec.rb @@ -0,0 +1,908 @@ +require 'spec_helper' + +describe 'apache', :type => :class do + context "on a Debian OS" do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :lsbdistcodename => 'squeeze', + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_package("httpd").with( + 'notify' => 'Class[Apache::Service]', + 'ensure' => 'installed' + ) + } + it { is_expected.to contain_user("www-data") } + it { is_expected.to contain_group("www-data") } + it { is_expected.to contain_class("apache::service") } + it { is_expected.to contain_file("/var/www").with( + 'ensure' => 'directory' + ) + } + it { is_expected.to contain_file("/etc/apache2/sites-enabled").with( + 'ensure' => 'directory', + 'recurse' => 'true', + 'purge' => 'true', + 'notify' => 'Class[Apache::Service]', + 'require' => 'Package[httpd]' + ) + } + it { is_expected.to contain_file("/etc/apache2/mods-enabled").with( + 'ensure' => 'directory', + 'recurse' => 'true', + 'purge' => 'true', + 'notify' => 'Class[Apache::Service]', + 'require' => 'Package[httpd]' + ) + } + it { is_expected.to contain_file("/etc/apache2/mods-available").with( + 'ensure' => 'directory', + 'recurse' => 'true', + 'purge' => 'false', + 'notify' => 'Class[Apache::Service]', + 'require' => 'Package[httpd]' + ) + } + it { is_expected.to contain_concat("/etc/apache2/ports.conf").with( + 'owner' => 'root', + 'group' => 'root', + 'mode' => '0644', + 'notify' => 'Class[Apache::Service]' + ) + } + # Assert that load files are placed and symlinked for these mods, but no conf file. + [ + 'auth_basic', + 'authn_file', + 'authz_default', + 'authz_groupfile', + 'authz_host', + 'authz_user', + 'dav', + 'env' + ].each do |modname| + it { is_expected.to contain_file("#{modname}.load").with( + 'path' => "/etc/apache2/mods-available/#{modname}.load", + 'ensure' => 'file' + ) } + it { is_expected.to contain_file("#{modname}.load symlink").with( + 'path' => "/etc/apache2/mods-enabled/#{modname}.load", + 'ensure' => 'link', + 'target' => "/etc/apache2/mods-available/#{modname}.load" + ) } + it { is_expected.not_to contain_file("#{modname}.conf") } + it { is_expected.not_to contain_file("#{modname}.conf symlink") } + end + + context "with Apache version < 2.4" do + let :params do + { :apache_version => '2.2' } + end + + it { is_expected.to contain_file("/etc/apache2/apache2.conf").with_content %r{^Include "/etc/apache2/conf\.d/\*\.conf"$} } + end + + context "with Apache version >= 2.4" do + let :params do + { + :apache_version => '2.4', + :use_optional_includes => true + } + end + + it { is_expected.to contain_file("/etc/apache2/apache2.conf").with_content %r{^IncludeOptional "/etc/apache2/conf\.d/\*\.conf"$} } + end + + context "when specifying slash encoding behaviour" do + let :params do + { :allow_encoded_slashes => 'nodecode' } + end + + it { is_expected.to contain_file("/etc/apache2/apache2.conf").with_content %r{^AllowEncodedSlashes nodecode$} } + end + + context "when specifying default character set" do + let :params do + { :default_charset => 'none' } + end + + it { is_expected.to contain_file("/etc/apache2/apache2.conf").with_content %r{^AddDefaultCharset none$} } + end + + # Assert that both load files and conf files are placed and symlinked for these mods + [ + 'alias', + 'autoindex', + 'dav_fs', + 'deflate', + 'dir', + 'mime', + 'negotiation', + 'setenvif', + ].each do |modname| + it { is_expected.to contain_file("#{modname}.load").with( + 'path' => "/etc/apache2/mods-available/#{modname}.load", + 'ensure' => 'file' + ) } + it { is_expected.to contain_file("#{modname}.load symlink").with( + 'path' => "/etc/apache2/mods-enabled/#{modname}.load", + 'ensure' => 'link', + 'target' => "/etc/apache2/mods-available/#{modname}.load" + ) } + it { is_expected.to contain_file("#{modname}.conf").with( + 'path' => "/etc/apache2/mods-available/#{modname}.conf", + 'ensure' => 'file' + ) } + it { is_expected.to contain_file("#{modname}.conf symlink").with( + 'path' => "/etc/apache2/mods-enabled/#{modname}.conf", + 'ensure' => 'link', + 'target' => "/etc/apache2/mods-available/#{modname}.conf" + ) } + end + + describe "Check default type" do + context "with Apache version < 2.4" do + let :params do + { + :apache_version => '2.2', + } + end + + context "when default_type => 'none'" do + let :params do + { :default_type => 'none' } + end + + it { is_expected.to contain_file("/etc/apache2/apache2.conf").with_content %r{^DefaultType none$} } + end + context "when default_type => 'text/plain'" do + let :params do + { :default_type => 'text/plain' } + end + + it { is_expected.to contain_file("/etc/apache2/apache2.conf").with_content %r{^DefaultType text/plain$} } + end + end + + context "with Apache version >= 2.4" do + let :params do + { + :apache_version => '2.4', + } + end + it { is_expected.to contain_file("/etc/apache2/apache2.conf").without_content %r{^DefaultType [.]*$} } + end + end + + describe "Don't create user resource" do + context "when parameter manage_user is false" do + let :params do + { :manage_user => false } + end + + it { is_expected.not_to contain_user('www-data') } + it { is_expected.to contain_file("/etc/apache2/apache2.conf").with_content %r{^User www-data\n} } + end + end + describe "Don't create group resource" do + context "when parameter manage_group is false" do + let :params do + { :manage_group => false } + end + + it { is_expected.not_to contain_group('www-data') } + it { is_expected.to contain_file("/etc/apache2/apache2.conf").with_content %r{^Group www-data\n} } + end + end + + describe "Add extra LogFormats" do + context "When parameter log_formats is a hash" do + let :params do + { :log_formats => { + 'vhost_common' => "%v %h %l %u %t \"%r\" %>s %b", + 'vhost_combined' => "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" + } } + end + + it { is_expected.to contain_file("/etc/apache2/apache2.conf").with_content %r{^LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common\n} } + it { is_expected.to contain_file("/etc/apache2/apache2.conf").with_content %r{^LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%\{Referer\}i\" \"%\{User-agent\}i\"" vhost_combined\n} } + end + end + + describe "Override existing LogFormats" do + context "When parameter log_formats is a hash" do + let :params do + { :log_formats => { + 'common' => "%v %h %l %u %t \"%r\" %>s %b", + 'combined' => "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" + } } + end + + it { is_expected.to contain_file("/etc/apache2/apache2.conf").with_content %r{^LogFormat "%v %h %l %u %t \"%r\" %>s %b" common\n} } + it { is_expected.to contain_file("/etc/apache2/apache2.conf").without_content %r{^LogFormat "%h %l %u %t \"%r\" %>s %b \"%\{Referer\}i\" \"%\{User-agent\}i\"" combined\n} } + it { is_expected.to contain_file("/etc/apache2/apache2.conf").with_content %r{^LogFormat "%v %h %l %u %t \"%r\" %>s %b" common\n} } + it { is_expected.to contain_file("/etc/apache2/apache2.conf").with_content %r{^LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%\{Referer\}i\" \"%\{User-agent\}i\"" combined\n} } + it { is_expected.to contain_file("/etc/apache2/apache2.conf").without_content %r{^LogFormat "%h %l %u %t \"%r\" %>s %b \"%\{Referer\}i\" \"%\{User-agent\}i\"" combined\n} } + end + end + + context "8" do + let :facts do + super().merge({ + :lsbdistcodename => 'jessie', + :operatingsystemrelease => '8' + }) + end + it { is_expected.to contain_file("/var/www/html").with( + 'ensure' => 'directory' + ) + } + end + context "on Ubuntu" do + let :facts do + super().merge({ + :operatingsystem => 'Ubuntu' + }) + end + + context "14.04" do + let :facts do + super().merge({ + :lsbdistrelease => '14.04', + :operatingsystemrelease => '14.04' + }) + end + it { is_expected.to contain_file("/var/www/html").with( + 'ensure' => 'directory' + ) + } + end + context "13.10" do + let :facts do + super().merge({ + :lsbdistrelease => '13.10', + :operatingsystemrelease => '13.10' + }) + end + it { is_expected.to contain_class('apache').with_apache_version('2.4') } + end + context "12.04" do + let :facts do + super().merge({ + :lsbdistrelease => '12.04', + :operatingsystemrelease => '12.04' + }) + end + it { is_expected.to contain_class('apache').with_apache_version('2.2') } + end + context "13.04" do + let :facts do + super().merge({ + :lsbdistrelease => '13.04', + :operatingsystemrelease => '13.04' + }) + end + it { is_expected.to contain_class('apache').with_apache_version('2.2') } + end + end + end + context "on a RedHat 5 OS" do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '5', + :concat_basedir => '/dne', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_package("httpd").with( + 'notify' => 'Class[Apache::Service]', + 'ensure' => 'installed' + ) + } + it { is_expected.to contain_user("apache") } + it { is_expected.to contain_group("apache") } + it { is_expected.to contain_class("apache::service") } + it { is_expected.to contain_file("/var/www/html").with( + 'ensure' => 'directory' + ) + } + it { is_expected.to contain_file("/etc/httpd/conf.d").with( + 'ensure' => 'directory', + 'recurse' => 'true', + 'purge' => 'true', + 'notify' => 'Class[Apache::Service]', + 'require' => 'Package[httpd]' + ) + } + it { is_expected.to contain_concat("/etc/httpd/conf/ports.conf").with( + 'owner' => 'root', + 'group' => 'root', + 'mode' => '0644', + 'notify' => 'Class[Apache::Service]' + ) + } + describe "Alternate confd/mod/vhosts directory" do + let :params do + { + :vhost_dir => '/etc/httpd/site.d', + :confd_dir => '/etc/httpd/conf.d', + :mod_dir => '/etc/httpd/mod.d', + } + end + + ['mod.d','site.d','conf.d'].each do |dir| + it { is_expected.to contain_file("/etc/httpd/#{dir}").with( + 'ensure' => 'directory', + 'recurse' => 'true', + 'purge' => 'true', + 'notify' => 'Class[Apache::Service]', + 'require' => 'Package[httpd]' + ) } + end + + # Assert that load files are placed for these mods, but no conf file. + [ + 'auth_basic', + 'authn_file', + 'authz_default', + 'authz_groupfile', + 'authz_host', + 'authz_user', + 'dav', + 'env', + ].each do |modname| + it { is_expected.to contain_file("#{modname}.load").with_path( + "/etc/httpd/mod.d/#{modname}.load" + ) } + it { is_expected.not_to contain_file("#{modname}.conf").with_path( + "/etc/httpd/mod.d/#{modname}.conf" + ) } + end + + # Assert that both load files and conf files are placed for these mods + [ + 'alias', + 'autoindex', + 'dav_fs', + 'deflate', + 'dir', + 'mime', + 'negotiation', + 'setenvif', + ].each do |modname| + it { is_expected.to contain_file("#{modname}.load").with_path( + "/etc/httpd/mod.d/#{modname}.load" + ) } + it { is_expected.to contain_file("#{modname}.conf").with_path( + "/etc/httpd/mod.d/#{modname}.conf" + ) } + end + + context "with Apache version < 2.4" do + let :params do + { :apache_version => '2.2' } + end + + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^Include "/etc/httpd/conf\.d/\*\.conf"$} } + end + + context "with Apache version >= 2.4" do + let :params do + { + :apache_version => '2.4', + :use_optional_includes => true + } + end + + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^IncludeOptional "/etc/httpd/conf\.d/\*\.conf"$} } + end + + context "with Apache version < 2.4" do + let :params do + { + :apache_version => '2.2', + :rewrite_lock => '/var/lock/subsys/rewrite-lock' + } + end + + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^RewriteLock /var/lock/subsys/rewrite-lock$} } + end + + context "with Apache version < 2.4" do + let :params do + { + :apache_version => '2.2' + } + end + + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").without_content %r{^RewriteLock [.]*$} } + end + + context "with Apache version >= 2.4" do + let :params do + { + :apache_version => '2.4', + :rewrite_lock => '/var/lock/subsys/rewrite-lock' + } + end + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").without_content %r{^RewriteLock [.]*$} } + end + + context "when specifying slash encoding behaviour" do + let :params do + { :allow_encoded_slashes => 'nodecode' } + end + + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^AllowEncodedSlashes nodecode$} } + end + + context "when specifying default character set" do + let :params do + { :default_charset => 'none' } + end + + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^AddDefaultCharset none$} } + end + + context "with Apache version < 2.4" do + let :params do + { + :apache_version => '2.2', + } + end + + context "when default_type => 'none'" do + let :params do + { :default_type => 'none' } + end + + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^DefaultType none$} } + end + context "when default_type => 'text/plain'" do + let :params do + { :default_type => 'text/plain' } + end + + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^DefaultType text/plain$} } + end + end + + context "with Apache version >= 2.4" do + let :params do + { + :apache_version => '2.4', + } + end + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").without_content %r{^DefaultType [.]*$} } + end + + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^Include "/etc/httpd/site\.d/\*"$} } + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^Include "/etc/httpd/mod\.d/\*\.conf"$} } + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^Include "/etc/httpd/mod\.d/\*\.load"$} } + end + + describe "Alternate conf directory" do + let :params do + { :conf_dir => '/opt/rh/root/etc/httpd/conf' } + end + + it { is_expected.to contain_file("/opt/rh/root/etc/httpd/conf/httpd.conf").with( + 'ensure' => 'file', + 'notify' => 'Class[Apache::Service]', + 'require' => ['Package[httpd]', 'Concat[/etc/httpd/conf/ports.conf]'], + ) } + end + + describe "Alternate conf.d directory" do + let :params do + { :confd_dir => '/etc/httpd/special_conf.d' } + end + + it { is_expected.to contain_file("/etc/httpd/special_conf.d").with( + 'ensure' => 'directory', + 'recurse' => 'true', + 'purge' => 'true', + 'notify' => 'Class[Apache::Service]', + 'require' => 'Package[httpd]' + ) } + end + + describe "Alternate mpm_modules" do + context "when declaring mpm_module is false" do + let :params do + { :mpm_module => false } + end + it 'should not declare mpm modules' do + is_expected.not_to contain_class('apache::mod::event') + is_expected.not_to contain_class('apache::mod::itk') + is_expected.not_to contain_class('apache::mod::peruser') + is_expected.not_to contain_class('apache::mod::prefork') + is_expected.not_to contain_class('apache::mod::worker') + end + end + context "when declaring mpm_module => prefork" do + let :params do + { :mpm_module => 'prefork' } + end + it { is_expected.to contain_class('apache::mod::prefork') } + it { is_expected.not_to contain_class('apache::mod::event') } + it { is_expected.not_to contain_class('apache::mod::itk') } + it { is_expected.not_to contain_class('apache::mod::peruser') } + it { is_expected.not_to contain_class('apache::mod::worker') } + end + context "when declaring mpm_module => worker" do + let :params do + { :mpm_module => 'worker' } + end + it { is_expected.to contain_class('apache::mod::worker') } + it { is_expected.not_to contain_class('apache::mod::event') } + it { is_expected.not_to contain_class('apache::mod::itk') } + it { is_expected.not_to contain_class('apache::mod::peruser') } + it { is_expected.not_to contain_class('apache::mod::prefork') } + end + context "when declaring mpm_module => breakme" do + let :params do + { :mpm_module => 'breakme' } + end + it { expect { catalogue }.to raise_error Puppet::Error, /does not match/ } + end + end + + describe "different templates for httpd.conf" do + context "with default" do + let :params do + { :conf_template => 'apache/httpd.conf.erb' } + end + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^# Security\n} } + end + context "with non-default" do + let :params do + { :conf_template => 'site_apache/fake.conf.erb' } + end + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^Fake template for rspec.$} } + end + end + + describe "default mods" do + context "without" do + let :params do + { :default_mods => false } + end + + it { is_expected.to contain_apache__mod('authz_host') } + it { is_expected.not_to contain_apache__mod('env') } + end + context "custom" do + let :params do + { :default_mods => [ + 'info', + 'alias', + 'mime', + 'env', + 'setenv', + 'expires', + ]} + end + + it { is_expected.to contain_apache__mod('authz_host') } + it { is_expected.to contain_apache__mod('env') } + it { is_expected.to contain_class('apache::mod::info') } + it { is_expected.to contain_class('apache::mod::mime') } + end + end + describe "Don't create user resource" do + context "when parameter manage_user is false" do + let :params do + { :manage_user => false } + end + + it { is_expected.not_to contain_user('apache') } + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^User apache\n} } + end + end + describe "Don't create group resource" do + context "when parameter manage_group is false" do + let :params do + { :manage_group => false } + end + + it { is_expected.not_to contain_group('apache') } + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^Group apache\n} } + + end + end + describe "sendfile" do + context "with invalid value" do + let :params do + { :sendfile => 'foo' } + end + it "should fail" do + expect do + catalogue + end.to raise_error(Puppet::Error, /"foo" does not match/) + end + end + context "On" do + let :params do + { :sendfile => 'On' } + end + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^EnableSendfile On\n} } + end + context "Off" do + let :params do + { :sendfile => 'Off' } + end + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{^EnableSendfile Off\n} } + end + end + context "on Fedora" do + let :facts do + super().merge({ + :operatingsystem => 'Fedora' + }) + end + + context "21" do + let :facts do + super().merge({ + :lsbdistrelease => '21', + :operatingsystemrelease => '21' + }) + end + it { is_expected.to contain_class('apache').with_apache_version('2.4') } + end + context "Rawhide" do + let :facts do + super().merge({ + :lsbdistrelease => 'Rawhide', + :operatingsystemrelease => 'Rawhide' + }) + end + it { is_expected.to contain_class('apache').with_apache_version('2.4') } + end + # kinda obsolete + context "17" do + let :facts do + super().merge({ + :lsbdistrelease => '17', + :operatingsystemrelease => '17' + }) + end + it { is_expected.to contain_class('apache').with_apache_version('2.2') } + end + end + end + context "on a FreeBSD OS" do + let :facts do + { + :id => 'root', + :kernel => 'FreeBSD', + :osfamily => 'FreeBSD', + :operatingsystem => 'FreeBSD', + :operatingsystemrelease => '10', + :concat_basedir => '/dne', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_class("apache::package").with({'ensure' => 'present'}) } + it { is_expected.to contain_user("www") } + it { is_expected.to contain_group("www") } + it { is_expected.to contain_class("apache::service") } + it { is_expected.to contain_file("/usr/local/www/apache24/data").with( + 'ensure' => 'directory' + ) + } + it { is_expected.to contain_file("/usr/local/etc/apache24/Vhosts").with( + 'ensure' => 'directory', + 'recurse' => 'true', + 'purge' => 'true', + 'notify' => 'Class[Apache::Service]', + 'require' => 'Package[httpd]' + ) } + it { is_expected.to contain_file("/usr/local/etc/apache24/Modules").with( + 'ensure' => 'directory', + 'recurse' => 'true', + 'purge' => 'true', + 'notify' => 'Class[Apache::Service]', + 'require' => 'Package[httpd]' + ) } + it { is_expected.to contain_concat("/usr/local/etc/apache24/ports.conf").with( + 'owner' => 'root', + 'group' => 'wheel', + 'mode' => '0644', + 'notify' => 'Class[Apache::Service]' + ) } + # Assert that load files are placed for these mods, but no conf file. + [ + 'auth_basic', + 'authn_core', + 'authn_file', + 'authz_groupfile', + 'authz_host', + 'authz_user', + 'dav', + 'env' + ].each do |modname| + it { is_expected.to contain_file("#{modname}.load").with( + 'path' => "/usr/local/etc/apache24/Modules/#{modname}.load", + 'ensure' => 'file' + ) } + it { is_expected.not_to contain_file("#{modname}.conf") } + end + + # Assert that both load files and conf files are placed for these mods + [ + 'alias', + 'autoindex', + 'dav_fs', + 'deflate', + 'dir', + 'mime', + 'negotiation', + 'setenvif', + ].each do |modname| + it { is_expected.to contain_file("#{modname}.load").with( + 'path' => "/usr/local/etc/apache24/Modules/#{modname}.load", + 'ensure' => 'file' + ) } + it { is_expected.to contain_file("#{modname}.conf").with( + 'path' => "/usr/local/etc/apache24/Modules/#{modname}.conf", + 'ensure' => 'file' + ) } + end + end + context "on a Gentoo OS" do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_user("apache") } + it { is_expected.to contain_group("apache") } + it { is_expected.to contain_class("apache::service") } + it { is_expected.to contain_file("/var/www/localhost/htdocs").with( + 'ensure' => 'directory' + ) + } + it { is_expected.to contain_file("/etc/apache2/vhosts.d").with( + 'ensure' => 'directory', + 'recurse' => 'true', + 'purge' => 'true', + 'notify' => 'Class[Apache::Service]', + 'require' => 'Package[httpd]' + ) } + it { is_expected.to contain_file("/etc/apache2/modules.d").with( + 'ensure' => 'directory', + 'recurse' => 'true', + 'purge' => 'true', + 'notify' => 'Class[Apache::Service]', + 'require' => 'Package[httpd]' + ) } + it { is_expected.to contain_concat("/etc/apache2/ports.conf").with( + 'owner' => 'root', + 'group' => 'wheel', + 'mode' => '0644', + 'notify' => 'Class[Apache::Service]' + ) } + end + context 'on all OSes' do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context 'with a custom apache_name parameter' do + let :params do { + :apache_name => 'httpd24-httpd' + } + end + it { is_expected.to contain_package("httpd").with( + 'notify' => 'Class[Apache::Service]', + 'ensure' => 'installed', + 'name' => 'httpd24-httpd' + ) + } + end + context 'with a custom file_mode parameter' do + let :params do { + :file_mode => '0640' + } + end + it { is_expected.to contain_concat("/etc/httpd/conf/ports.conf").with( + 'mode' => '0640', + ) + } + end + context 'with a custom root_directory_options parameter' do + let :params do { + :root_directory_options => ['-Indexes', '-FollowSymLinks'] + } + end + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{Options -Indexes -FollowSymLinks} } + end + context 'with a custom root_directory_secured parameter and Apache < 2.4' do + let :params do { + :apache_version => '2.2', + :root_directory_secured => true + } + end + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{Options FollowSymLinks\n\s+AllowOverride None\n\s+Order deny,allow\n\s+Deny from all} } + end + context 'with a custom root_directory_secured parameter and Apache >= 2.4' do + let :params do { + :apache_version => '2.4', + :root_directory_secured => true + } + end + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{Options FollowSymLinks\n\s+AllowOverride None\n\s+Require all denied} } + end + context 'default vhost defaults' do + it { is_expected.to contain_apache__vhost('default').with_ensure('present') } + it { is_expected.to contain_apache__vhost('default-ssl').with_ensure('absent') } + it { is_expected.to contain_file("/etc/httpd/conf/httpd.conf").with_content %r{Options FollowSymLinks} } + end + context 'without default non-ssl vhost' do + let :params do { + :default_vhost => false + } + end + it { is_expected.to contain_apache__vhost('default').with_ensure('absent') } + it { is_expected.not_to contain_file('/var/www/html') } + end + context 'with default ssl vhost' do + let :params do { + :default_ssl_vhost => true + } + end + it { is_expected.to contain_apache__vhost('default-ssl').with_ensure('present') } + it { is_expected.to contain_file('/var/www/html') } + end + end + context 'with unsupported osfamily' do + let :facts do + { :osfamily => 'Darwin', + :operatingsystemrelease => '13.1.0', + :concat_basedir => '/dne', + :is_pe => false, + } + end + + it do + expect { + catalogue + }.to raise_error(Puppet::Error, /Unsupported osfamily/) + end + end +end diff --git a/environments/production/modules/apache/spec/classes/dev_spec.rb b/environments/production/modules/apache/spec/classes/dev_spec.rb new file mode 100644 index 0000000..933d677 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/dev_spec.rb @@ -0,0 +1,89 @@ +require 'spec_helper' + +describe 'apache::dev', :type => :class do + let(:pre_condition) {[ + 'include apache' + ]} + context "on a Debian OS" do + let :facts do + { + :lsbdistcodename => 'squeeze', + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :is_pe => false, + :concat_basedir => '/foo', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin', + :kernel => 'Linux' + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_package("libaprutil1-dev") } + it { is_expected.to contain_package("libapr1-dev") } + it { is_expected.to contain_package("apache2-prefork-dev") } + end + context "on an Ubuntu 14 OS" do + let :facts do + { + :lsbdistrelease => '14.04', + :lsbdistcodename => 'trusty', + :osfamily => 'Debian', + :operatingsystem => 'Ubuntu', + :operatingsystemrelease => '14.04', + :is_pe => false, + :concat_basedir => '/foo', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin', + :kernel => 'Linux' + } + end + it { is_expected.to contain_package("apache2-dev") } + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6', + :is_pe => false, + :concat_basedir => '/foo', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin', + :kernel => 'Linux' + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_package("httpd-devel") } + end + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystem => 'FreeBSD', + :operatingsystemrelease => '9', + :is_pe => false, + :concat_basedir => '/foo', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin', + :kernel => 'FreeBSD' + } + end + it { is_expected.to contain_class("apache::params") } + end + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :is_pe => false, + :concat_basedir => '/foo', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin', + :kernel => 'Linux' + } + end + it { is_expected.to contain_class("apache::params") } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/alias_spec.rb b/environments/production/modules/apache/spec/classes/mod/alias_spec.rb new file mode 100644 index 0000000..99854e8 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/alias_spec.rb @@ -0,0 +1,97 @@ +require 'spec_helper' + +describe 'apache::mod::alias', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "default configuration with parameters" do + context "on a Debian OS", :compile do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :lsbdistcodename => 'squeeze', + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_apache__mod("alias") } + it { is_expected.to contain_file("alias.conf").with(:content => /Alias \/icons\/ "\/usr\/share\/apache2\/icons\/"/) } + end + context "on a RedHat 6-based OS", :compile do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_apache__mod("alias") } + it { is_expected.to contain_file("alias.conf").with(:content => /Alias \/icons\/ "\/var\/www\/icons\/"/) } + end + context "on a RedHat 7-based OS", :compile do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '7', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_apache__mod("alias") } + it { is_expected.to contain_file("alias.conf").with(:content => /Alias \/icons\/ "\/usr\/share\/httpd\/icons\/"/) } + end + context "with icons options", :compile do + let :pre_condition do + 'class { apache: default_mods => false }' + end + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '7', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + let :params do + { + 'icons_options' => 'foo' + } + end + it { is_expected.to contain_apache__mod("alias") } + it { is_expected.to contain_file("alias.conf").with(:content => /Options foo/) } + end + context "on a FreeBSD OS", :compile do + let :facts do + { + :id => 'root', + :kernel => 'FreeBSD', + :osfamily => 'FreeBSD', + :operatingsystem => 'FreeBSD', + :operatingsystemrelease => '10', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_apache__mod("alias") } + it { is_expected.to contain_file("alias.conf").with(:content => /Alias \/icons\/ "\/usr\/local\/www\/apache24\/icons\/"/) } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/auth_cas_spec.rb b/environments/production/modules/apache/spec/classes/mod/auth_cas_spec.rb new file mode 100644 index 0000000..aee3f8c --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/auth_cas_spec.rb @@ -0,0 +1,64 @@ +require 'spec_helper' + +describe 'apache::mod::auth_cas', :type => :class do + context "default params" do + let :params do + { + :cas_login_url => 'https://cas.example.com/login', + :cas_validate_url => 'https://cas.example.com/validate', + :cas_cookie_path => '/var/cache/apache2/mod_auth_cas/' + } + end + + it_behaves_like "a mod class, without including apache" + end + + context "default configuration with parameters" do + let :params do + { + :cas_login_url => 'https://cas.example.com/login', + :cas_validate_url => 'https://cas.example.com/validate', + } + end + + context "on a Debian OS", :compile do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :lsbdistcodename => 'squeeze', + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod("auth_cas") } + it { is_expected.to contain_package("libapache2-mod-auth-cas") } + it { is_expected.to contain_file("auth_cas.conf").with_path('/etc/apache2/mods-available/auth_cas.conf') } + it { is_expected.to contain_file("/var/cache/apache2/mod_auth_cas/").with_owner('www-data') } + end + context "on a RedHat OS", :compile do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod("auth_cas") } + it { is_expected.to contain_package("mod_auth_cas") } + it { is_expected.to contain_file("auth_cas.conf").with_path('/etc/httpd/conf.d/auth_cas.conf') } + it { is_expected.to contain_file("/var/cache/mod_auth_cas/").with_owner('apache') } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/auth_kerb_spec.rb b/environments/production/modules/apache/spec/classes/mod/auth_kerb_spec.rb new file mode 100644 index 0000000..74b6827 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/auth_kerb_spec.rb @@ -0,0 +1,77 @@ +require 'spec_helper' + +describe 'apache::mod::auth_kerb', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "default configuration with parameters" do + context "on a Debian OS", :compile do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :lsbdistcodename => 'squeeze', + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod("auth_kerb") } + it { is_expected.to contain_package("libapache2-mod-auth-kerb") } + end + context "on a RedHat OS", :compile do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod("auth_kerb") } + it { is_expected.to contain_package("mod_auth_kerb") } + end + context "on a FreeBSD OS", :compile do + let :facts do + { + :id => 'root', + :kernel => 'FreeBSD', + :osfamily => 'FreeBSD', + :operatingsystem => 'FreeBSD', + :operatingsystemrelease => '9', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod("auth_kerb") } + it { is_expected.to contain_package("www/mod_auth_kerb2") } + end + context "on a Gentoo OS", :compile do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod("auth_kerb") } + it { is_expected.to contain_package("www-apache/mod_auth_kerb") } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/auth_mellon_spec.rb b/environments/production/modules/apache/spec/classes/mod/auth_mellon_spec.rb new file mode 100644 index 0000000..7d0826f --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/auth_mellon_spec.rb @@ -0,0 +1,90 @@ +require 'spec_helper' + +describe 'apache::mod::auth_mellon', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "default configuration with parameters" do + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :fqdn => 'test.example.com', + :is_pe => false, + } + end + describe 'with no parameters' do + it { should contain_apache__mod('auth_mellon') } + it { should contain_package('libapache2-mod-auth-mellon') } + it { should contain_file('auth_mellon.conf').with_path('/etc/apache2/mods-available/auth_mellon.conf') } + it { should contain_file('auth_mellon.conf').with_content("MellonPostDirectory \"\/var\/cache\/apache2\/mod_auth_mellon\/\"\n") } + end + describe 'with parameters' do + let :params do + { :mellon_cache_size => '200', + :mellon_cache_entry_size => '2010', + :mellon_lock_file => '/tmp/junk', + :mellon_post_directory => '/tmp/post', + :mellon_post_ttl => '5', + :mellon_post_size => '8', + :mellon_post_count => '10' + } + end + it { should contain_file('auth_mellon.conf').with_content(/^MellonCacheSize\s+200$/) } + it { should contain_file('auth_mellon.conf').with_content(/^MellonCacheEntrySize\s+2010$/) } + it { should contain_file('auth_mellon.conf').with_content(/^MellonLockFile\s+"\/tmp\/junk"$/) } + it { should contain_file('auth_mellon.conf').with_content(/^MellonPostDirectory\s+"\/tmp\/post"$/) } + it { should contain_file('auth_mellon.conf').with_content(/^MellonPostTTL\s+5$/) } + it { should contain_file('auth_mellon.conf').with_content(/^MellonPostSize\s+8$/) } + it { should contain_file('auth_mellon.conf').with_content(/^MellonPostCount\s+10$/) } + end + + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :fqdn => 'test.example.com', + :is_pe => false, + } + end + describe 'with no parameters' do + it { should contain_apache__mod('auth_mellon') } + it { should contain_package('mod_auth_mellon') } + it { should contain_file('auth_mellon.conf').with_path('/etc/httpd/conf.d/auth_mellon.conf') } + it { should contain_file('auth_mellon.conf').with_content("MellonCacheSize 100\nMellonLockFile \"/run/mod_auth_mellon/lock\"\n") } + end + describe 'with parameters' do + let :params do + { :mellon_cache_size => '200', + :mellon_cache_entry_size => '2010', + :mellon_lock_file => '/tmp/junk', + :mellon_post_directory => '/tmp/post', + :mellon_post_ttl => '5', + :mellon_post_size => '8', + :mellon_post_count => '10' + } + end + it { should contain_file('auth_mellon.conf').with_content(/^MellonCacheSize\s+200$/) } + it { should contain_file('auth_mellon.conf').with_content(/^MellonCacheEntrySize\s+2010$/) } + it { should contain_file('auth_mellon.conf').with_content(/^MellonLockFile\s+"\/tmp\/junk"$/) } + it { should contain_file('auth_mellon.conf').with_content(/^MellonPostDirectory\s+"\/tmp\/post"$/) } + it { should contain_file('auth_mellon.conf').with_content(/^MellonPostTTL\s+5$/) } + it { should contain_file('auth_mellon.conf').with_content(/^MellonPostSize\s+8$/) } + it { should contain_file('auth_mellon.conf').with_content(/^MellonPostCount\s+10$/) } + end + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/authn_dbd_spec.rb b/environments/production/modules/apache/spec/classes/mod/authn_dbd_spec.rb new file mode 100644 index 0000000..4e101d1 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/authn_dbd_spec.rb @@ -0,0 +1,62 @@ +require 'spec_helper' + +describe 'apache::mod::authn_dbd', :type => :class do + context "default params" do + let :params do + { + :authn_dbd_params => 'host=db_host port=3306 user=apache password=###### dbname=apache_auth', + } + end + + it_behaves_like "a mod class, without including apache" + end + + context "default configuration with parameters" do + let :params do + { + :authn_dbd_params => 'host=db_host port=3306 user=apache password=###### dbname=apache_auth', + :authn_dbd_alias => 'db_authn', + :authn_dbd_query => 'SELECT password FROM authn WHERE username = %s' + } + end + + context "on a Debian OS", :compile do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :lsbdistcodename => 'squeeze', + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod("authn_dbd") } + it { is_expected.to contain_apache__mod("dbd") } + it { is_expected.to contain_file("authn_dbd.conf").with_path('/etc/apache2/mods-available/authn_dbd.conf') } + end + + context "on a RedHat OS", :compile do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod("authn_dbd") } + it { is_expected.to contain_apache__mod("dbd") } + it { is_expected.to contain_file("authn_dbd.conf").with_path('/etc/httpd/conf.d/authn_dbd.conf') } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/authnz_ldap_spec.rb b/environments/production/modules/apache/spec/classes/mod/authnz_ldap_spec.rb new file mode 100644 index 0000000..7469d16 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/authnz_ldap_spec.rb @@ -0,0 +1,76 @@ +require 'spec_helper' + +describe 'apache::mod::authnz_ldap', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "default configuration with parameters" do + context "on a Debian OS" do + let :facts do + { + :lsbdistcodename => 'squeeze', + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :operatingsystem => 'Debian', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_class("apache::mod::ldap") } + it { is_expected.to contain_apache__mod('authnz_ldap') } + + context 'default verify_server_cert' do + it { is_expected.to contain_file('authnz_ldap.conf').with_content(/^LDAPVerifyServerCert On$/) } + end + + context 'verify_server_cert = false' do + let(:params) { { :verify_server_cert => false } } + it { is_expected.to contain_file('authnz_ldap.conf').with_content(/^LDAPVerifyServerCert Off$/) } + end + + context 'verify_server_cert = wrong' do + let(:params) { { :verify_server_cert => 'wrong' } } + it 'should raise an error' do + expect { is_expected.to raise_error Puppet::Error } + end + end + end #Debian + + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :operatingsystem => 'RedHat', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_class("apache::mod::ldap") } + it { is_expected.to contain_apache__mod('authnz_ldap') } + + context 'default verify_server_cert' do + it { is_expected.to contain_file('authnz_ldap.conf').with_content(/^LDAPVerifyServerCert On$/) } + end + + context 'verify_server_cert = false' do + let(:params) { { :verify_server_cert => false } } + it { is_expected.to contain_file('authnz_ldap.conf').with_content(/^LDAPVerifyServerCert Off$/) } + end + + context 'verify_server_cert = wrong' do + let(:params) { { :verify_server_cert => 'wrong' } } + it 'should raise an error' do + expect { is_expected.to raise_error Puppet::Error } + end + end + end # Redhat + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/cluster_spec.rb b/environments/production/modules/apache/spec/classes/mod/cluster_spec.rb new file mode 100644 index 0000000..b5f74ba --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/cluster_spec.rb @@ -0,0 +1,105 @@ +require 'spec_helper' + +describe 'apache::mod::cluster', :type => :class do + context 'on a RedHat OS Release 7 with mod version = 1.3.0' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '7', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + let(:params) { + { + :allowed_network => '172.17.0', + :balancer_name => 'mycluster', + :ip => '172.17.0.1', + :version => '1.3.0' + } + } + + it { is_expected.to contain_class("apache") } + it { is_expected.to contain_apache__mod('proxy') } + it { is_expected.to contain_apache__mod('proxy_ajp') } + it { is_expected.to contain_apache__mod('manager') } + it { is_expected.to contain_apache__mod('proxy_cluster') } + it { is_expected.to contain_apache__mod('advertise') } + it { is_expected.to contain_apache__mod('cluster_slotmem') } + + it { is_expected.to contain_file('cluster.conf') } + end + + context 'on a RedHat OS Release 7 with mod version > 1.3.0' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '7', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + let(:params) { + { + :allowed_network => '172.17.0', + :balancer_name => 'mycluster', + :ip => '172.17.0.1', + :version => '1.3.1' + } + } + + it { is_expected.to contain_class('apache') } + it { is_expected.to contain_apache__mod('proxy') } + it { is_expected.to contain_apache__mod('proxy_ajp') } + it { is_expected.to contain_apache__mod('manager') } + it { is_expected.to contain_apache__mod('proxy_cluster') } + it { is_expected.to contain_apache__mod('advertise') } + it { is_expected.to contain_apache__mod('cluster_slotmem') } + + it { is_expected.to contain_file('cluster.conf') } + end + + context 'on a RedHat OS Release 6 with mod version < 1.3.0' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + let(:params) { + { + :allowed_network => '172.17.0', + :balancer_name => 'mycluster', + :ip => '172.17.0.1', + :version => '1.2.0' + } + } + + it { is_expected.to contain_class('apache') } + it { is_expected.to contain_apache__mod('proxy') } + it { is_expected.to contain_apache__mod('proxy_ajp') } + it { is_expected.to contain_apache__mod('manager') } + it { is_expected.to contain_apache__mod('proxy_cluster') } + it { is_expected.to contain_apache__mod('advertise') } + it { is_expected.to contain_apache__mod('slotmem') } + + it { is_expected.to contain_file('cluster.conf') } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/dav_svn_spec.rb b/environments/production/modules/apache/spec/classes/mod/dav_svn_spec.rb new file mode 100644 index 0000000..426b547 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/dav_svn_spec.rb @@ -0,0 +1,80 @@ +require 'spec_helper' + +describe 'apache::mod::dav_svn', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "default configuration with parameters" do + context "on a Debian OS" do + let :facts do + { + :lsbdistcodename => 'squeeze', + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :operatingsystemmajrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('dav_svn') } + it { is_expected.to contain_package("libapache2-svn") } + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :operatingsystemmajrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('dav_svn') } + it { is_expected.to contain_package("mod_dav_svn") } + end + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :operatingsystemmajrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('dav_svn') } + it { is_expected.to contain_package("devel/subversion") } + end + context "on a Gentoo OS", :compile do + let :facts do + { + :id => 'root', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :kernel => 'Linux', + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('dav_svn') } + it { is_expected.to contain_package("dev-vcs/subversion") } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/deflate_spec.rb b/environments/production/modules/apache/spec/classes/mod/deflate_spec.rb new file mode 100644 index 0000000..264c70f --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/deflate_spec.rb @@ -0,0 +1,127 @@ +require 'spec_helper' + +# This function is called inside the OS specific contexts +def general_deflate_specs + it { is_expected.to contain_apache__mod("deflate") } + + it do + is_expected.to contain_file("deflate.conf").with_content( + "AddOutputFilterByType DEFLATE text/css\n"\ + "AddOutputFilterByType DEFLATE text/html\n"\ + "\n"\ + "DeflateFilterNote Input instream\n"\ + "DeflateFilterNote Ratio ratio\n" + ) + end +end + +describe 'apache::mod::deflate', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "default configuration with parameters" do + let :pre_condition do + 'class { "apache::mod::deflate": + types => [ "text/html", "text/css" ], + notes => { + "Input" => "instream", + "Ratio" => "ratio", + } + } + ' + end + + context "On a Debian OS with default params" do + let :facts do + { + :id => 'root', + :lsbdistcodename => 'squeeze', + :kernel => 'Linux', + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + + # Load the more generic tests for this context + general_deflate_specs() + + it { is_expected.to contain_file("deflate.conf").with({ + :ensure => 'file', + :path => '/etc/apache2/mods-available/deflate.conf', + } ) } + it { is_expected.to contain_file("deflate.conf symlink").with({ + :ensure => 'link', + :path => '/etc/apache2/mods-enabled/deflate.conf', + } ) } + end + + context "on a RedHat OS with default params" do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + + # Load the more generic tests for this context + general_deflate_specs() + + it { is_expected.to contain_file("deflate.conf").with_path("/etc/httpd/conf.d/deflate.conf") } + end + + context "On a FreeBSD OS with default params" do + let :facts do + { + :id => 'root', + :kernel => 'FreeBSD', + :osfamily => 'FreeBSD', + :operatingsystem => 'FreeBSD', + :operatingsystemrelease => '9', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + + # Load the more generic tests for this context + general_deflate_specs() + + it { is_expected.to contain_file("deflate.conf").with({ + :ensure => 'file', + :path => '/usr/local/etc/apache24/Modules/deflate.conf', + } ) } + end + + context "On a Gentoo OS with default params" do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :is_pe => false, + } + end + + # Load the more generic tests for this context + general_deflate_specs() + + it { is_expected.to contain_file("deflate.conf").with({ + :ensure => 'file', + :path => '/etc/apache2/modules.d/deflate.conf', + } ) } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/dev_spec.rb b/environments/production/modules/apache/spec/classes/mod/dev_spec.rb new file mode 100644 index 0000000..4c9f324 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/dev_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +describe 'apache::mod::dev', :type => :class do + let(:pre_condition) {[ + 'include apache' + ]} + + it_behaves_like "a mod class, without including apache" + + [ + ['RedHat', '6', 'Santiago', 'Linux'], + ['Debian', '6', 'squeeze', 'Linux'], + ['FreeBSD', '9', 'FreeBSD', 'FreeBSD'], + ].each do |osfamily, operatingsystemrelease, lsbdistcodename, kernel| + context "on a #{osfamily} OS" do + let :facts do + { + :lsbdistcodename => lsbdistcodename, + :osfamily => osfamily, + :operatingsystem => osfamily, + :operatingsystemrelease => operatingsystemrelease, + :is_pe => false, + :concat_basedir => '/foo', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin', + :kernel => kernel + } + end + it { is_expected.to contain_class('apache::dev') } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/dir_spec.rb b/environments/production/modules/apache/spec/classes/mod/dir_spec.rb new file mode 100644 index 0000000..9aad0d3 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/dir_spec.rb @@ -0,0 +1,137 @@ +require 'spec_helper' + +describe 'apache::mod::dir', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "default configuration with parameters" do + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :lsbdistcodename => 'squeeze', + :is_pe => false, + } + end + context "passing no parameters" do + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('dir') } + it { is_expected.to contain_file('dir.conf').with_content(/^DirectoryIndex /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.html /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.html\.var /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.cgi /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.pl /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.php /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.xhtml$/) } + end + context "passing indexes => ['example.txt','fearsome.aspx']" do + let :params do + {:indexes => ['example.txt','fearsome.aspx']} + end + it { is_expected.to contain_file('dir.conf').with_content(/ example\.txt /) } + it { is_expected.to contain_file('dir.conf').with_content(/ fearsome\.aspx$/) } + end + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'Redhat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context "passing no parameters" do + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('dir') } + it { is_expected.to contain_file('dir.conf').with_content(/^DirectoryIndex /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.html /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.html\.var /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.cgi /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.pl /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.php /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.xhtml$/) } + end + context "passing indexes => ['example.txt','fearsome.aspx']" do + let :params do + {:indexes => ['example.txt','fearsome.aspx']} + end + it { is_expected.to contain_file('dir.conf').with_content(/ example\.txt /) } + it { is_expected.to contain_file('dir.conf').with_content(/ fearsome\.aspx$/) } + end + end + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context "passing no parameters" do + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('dir') } + it { is_expected.to contain_file('dir.conf').with_content(/^DirectoryIndex /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.html /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.html\.var /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.cgi /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.pl /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.php /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.xhtml$/) } + end + context "passing indexes => ['example.txt','fearsome.aspx']" do + let :params do + {:indexes => ['example.txt','fearsome.aspx']} + end + it { is_expected.to contain_file('dir.conf').with_content(/ example\.txt /) } + it { is_expected.to contain_file('dir.conf').with_content(/ fearsome\.aspx$/) } + end + end + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + context "passing no parameters" do + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('dir') } + it { is_expected.to contain_file('dir.conf').with_content(/^DirectoryIndex /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.html /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.html\.var /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.cgi /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.pl /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.php /) } + it { is_expected.to contain_file('dir.conf').with_content(/ index\.xhtml$/) } + end + context "passing indexes => ['example.txt','fearsome.aspx']" do + let :params do + {:indexes => ['example.txt','fearsome.aspx']} + end + it { is_expected.to contain_file('dir.conf').with_content(/ example\.txt /) } + it { is_expected.to contain_file('dir.conf').with_content(/ fearsome\.aspx$/) } + end + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/disk_cache_spec.rb b/environments/production/modules/apache/spec/classes/mod/disk_cache_spec.rb new file mode 100644 index 0000000..ebb5ef6 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/disk_cache_spec.rb @@ -0,0 +1,125 @@ +require 'spec_helper' + +describe 'apache::mod::disk_cache', :type => :class do + context "on a Debian OS" do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :lsbdistcodename => 'squeeze', + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + context "with Apache version < 2.4" do + let :pre_condition do + 'class{ "apache": + apache_version => "2.2", + default_mods => ["cache"], + mod_dir => "/tmp/junk", + }' + end + it { should compile } + it { should contain_class('apache::mod::disk_cache') } + it { is_expected.to contain_apache__mod("disk_cache") } + it { is_expected.to contain_file("disk_cache.conf").with(:content => /CacheEnable disk \/\nCacheRoot \"\/var\/cache\/apache2\/mod_disk_cache\"\nCacheDirLevels 2\nCacheDirLength 1/) } + end + context "with Apache version >= 2.4" do + let :pre_condition do + 'class{ "apache": + apache_version => "2.4", + default_mods => ["cache"], + mod_dir => "/tmp/junk", + }' + end + it { should compile } + it { should contain_class('apache::mod::disk_cache') } + it { should contain_class('apache::mod::cache').that_comes_before('Class[Apache::Mod::Disk_cache]') } + it { is_expected.to contain_apache__mod("cache_disk") } + it { is_expected.to contain_file("disk_cache.conf").with(:content => /CacheEnable disk \/\nCacheRoot \"\/var\/cache\/apache2\/mod_cache_disk\"\nCacheDirLevels 2\nCacheDirLength 1/) } + end + end + + context "on a RedHat 6-based OS" do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + context "with Apache version < 2.4" do + let :pre_condition do + 'class{ "apache": + apache_version => "2.2", + default_mods => ["cache"], + mod_dir => "/tmp/junk", + }' + end + it { is_expected.to contain_apache__mod("disk_cache") } + it { is_expected.to contain_file("disk_cache.conf").with(:content => /CacheEnable disk \/\nCacheRoot \"\/var\/cache\/mod_proxy\"\nCacheDirLevels 2\nCacheDirLength 1/) } + end + context "with Apache version >= 2.4" do + let :pre_condition do + 'class{ "apache": + apache_version => "2.4", + default_mods => ["cache"], + mod_dir => "/tmp/junk", + }' + end + it { is_expected.to contain_apache__mod("cache_disk") } + it { is_expected.to contain_file("disk_cache.conf").with(:content => /CacheEnable disk \/\nCacheRoot \"\/var\/cache\/httpd\/proxy\"\nCacheDirLevels 2\nCacheDirLength 1/) } + end + end + context "on a FreeBSD OS" do + let :facts do + { + :id => 'root', + :kernel => 'FreeBSD', + :osfamily => 'FreeBSD', + :operatingsystem => 'FreeBSD', + :operatingsystemrelease => '10', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + context "with Apache version < 2.4" do + let :pre_condition do + 'class{ "apache": + apache_version => "2.2", + default_mods => ["cache"], + mod_dir => "/tmp/junk", + }' + end + it { should compile } + it { should contain_class('apache::mod::disk_cache') } + it { should contain_class('apache::mod::cache').that_comes_before('Class[Apache::Mod::Disk_cache]') } + it { is_expected.to contain_apache__mod("disk_cache") } + it { is_expected.to contain_file("disk_cache.conf").with(:content => /CacheEnable disk \/\nCacheRoot \"\/var\/cache\/mod_disk_cache\"\nCacheDirLevels 2\nCacheDirLength 1/) } + end + context "with Apache version >= 2.4" do + let :pre_condition do + 'class{ "apache": + apache_version => "2.4", + default_mods => ["cache"], + mod_dir => "/tmp/junk", + }' + end + it { should compile } + it { should contain_class('apache::mod::disk_cache') } + it { should contain_class('apache::mod::cache').that_comes_before('Class[Apache::Mod::Disk_cache]') } + it { is_expected.to contain_apache__mod("cache_disk") } + it { is_expected.to contain_file("disk_cache.conf").with(:content => /CacheEnable disk \/\nCacheRoot \"\/var\/cache\/mod_cache_disk\"\nCacheDirLevels 2\nCacheDirLength 1/) } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/dumpio_spec.rb b/environments/production/modules/apache/spec/classes/mod/dumpio_spec.rb new file mode 100644 index 0000000..106b23a --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/dumpio_spec.rb @@ -0,0 +1,51 @@ +require 'spec_helper' + +describe 'apache::mod::dumpio', :type => :class do + context "on a Debian OS" do + let :pre_condition do + 'class{"apache": + default_mods => false, + mod_dir => "/tmp/junk", + }' + end + let :facts do + { + :lsbdistcodename => 'squeeze', + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :operatingsystemmajrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context "default configuration fore parameters" do + it { should compile } + it { should contain_class('apache::mod::dumpio') } + it { should contain_file("dumpio.conf").with_path("/tmp/junk/dumpio.conf") } + it { should contain_file("dumpio.conf").with_content(/^\s*DumpIOInput\s+"Off"$/)} + it { should contain_file("dumpio.conf").with_content(/^\s*DumpIOOutput\s+"Off"$/)} + end + context "with dumpio_input set to On" do + let :params do + { + :dump_io_input => 'On', + } + end + it { should contain_file("dumpio.conf").with_content(/^\s*DumpIOInput\s+"On"$/)} + it { should contain_file("dumpio.conf").with_content(/^\s*DumpIOOutput\s+"Off"$/)} + end + context "with dumpio_ouput set to On" do + let :params do + { + :dump_io_output => 'On', + } + end + it { should contain_file("dumpio.conf").with_content(/^\s*DumpIOInput\s+"Off"$/)} + it { should contain_file("dumpio.conf").with_content(/^\s*DumpIOOutput\s+"On"$/)} + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/event_spec.rb b/environments/production/modules/apache/spec/classes/mod/event_spec.rb new file mode 100644 index 0000000..b010d4c --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/event_spec.rb @@ -0,0 +1,214 @@ +require 'spec_helper' + +describe 'apache::mod::event', :type => :class do + let :pre_condition do + 'class { "apache": mpm_module => false, }' + end + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('event') } + it { is_expected.to contain_file("/usr/local/etc/apache24/Modules/event.conf").with_ensure('file') } + end + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('event') } + it { is_expected.to contain_file("/etc/apache2/modules.d/event.conf").with_ensure('file') } + end + context "on a Debian OS" do + let :facts do + { + :lsbdistcodename => 'squeeze', + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('event') } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file') } + it { is_expected.to contain_file("/etc/apache2/mods-enabled/event.conf").with_ensure('link') } + + context "Test mpm_event new params" do + let :params do + { + :serverlimit => '0', + :startservers => '1', + :maxclients => '2', + :minsparethreads => '3', + :maxsparethreads => '4', + :threadsperchild => '5', + :maxrequestsperchild => '6', + :threadlimit => '7', + :listenbacklog => '8', + :maxrequestworkers => '9', + :maxconnectionsperchild => '10', + } + end + + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*ServerLimit\s*0/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*StartServers\s*1/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*MaxClients/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*MinSpareThreads\s*3/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*MaxSpareThreads\s*4/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*ThreadsPerChild\s*5/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*MaxRequestsPerChild/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*ThreadLimit\s*7/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*ListenBacklog\s*8/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*MaxRequestWorkers\s*9/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*MaxConnectionsPerChild\s*10/) } + end + + context "Test mpm_event old style params" do + let :params do + { + :serverlimit => '0', + :startservers => '1', + :maxclients => '2', + :minsparethreads => '3', + :maxsparethreads => '4', + :threadsperchild => '5', + :maxrequestsperchild => '6', + :threadlimit => '7', + :listenbacklog => '8', + :maxrequestworkers => :undef, + :maxconnectionsperchild => :undef, + } + end + + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*ServerLimit\s*0/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*StartServers\s*1/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*MaxClients\s*2/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*MinSpareThreads\s*3/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*MaxSpareThreads\s*4/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*ThreadsPerChild\s*5/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*MaxRequestsPerChild\s*6/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*ThreadLimit\s*7/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').with_content(/^\s*ListenBacklog\s*8/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*MaxRequestWorkers/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*MaxConnectionsPerChild/) } + end + + context "Test mpm_event false params" do + let :params do + { + :serverlimit => false, + :startservers => false, + :maxclients => false, + :minsparethreads => false, + :maxsparethreads => false, + :threadsperchild => false, + :maxrequestsperchild => false, + :threadlimit => false, + :listenbacklog => false, + :maxrequestworkers => false, + :maxconnectionsperchild => false, + } + end + + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*ServerLimit/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*StartServers/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*MaxClients/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*MinSpareThreads/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*MaxSpareThreads/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*ThreadsPerChild/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*MaxRequestsPerChild/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*ThreadLimit/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*ListenBacklog/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*MaxRequestWorkers/) } + it { is_expected.to contain_file("/etc/apache2/mods-available/event.conf").with_ensure('file').without_content(/^\s*MaxConnectionsPerChild/) } + end + + context "with Apache version < 2.4" do + let :params do + { + :apache_version => '2.2', + } + end + + it { is_expected.not_to contain_file("/etc/apache2/mods-available/event.load") } + it { is_expected.not_to contain_file("/etc/apache2/mods-enabled/event.load") } + + it { is_expected.to contain_package("apache2-mpm-event") } + end + + context "with Apache version >= 2.4" do + let :params do + { + :apache_version => '2.4', + } + end + + it { is_expected.to contain_file("/etc/apache2/mods-available/event.load").with({ + 'ensure' => 'file', + 'content' => "LoadModule mpm_event_module /usr/lib/apache2/modules/mod_mpm_event.so\n" + }) + } + it { is_expected.to contain_file("/etc/apache2/mods-enabled/event.load").with_ensure('link') } + end + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + context "with Apache version >= 2.4" do + let :params do + { + :apache_version => '2.4', + } + end + + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('worker') } + it { is_expected.not_to contain_apache__mod('prefork') } + + it { is_expected.to contain_file("/etc/httpd/conf.d/event.conf").with_ensure('file') } + + it { is_expected.to contain_file("/etc/httpd/conf.d/event.load").with({ + 'ensure' => 'file', + 'content' => "LoadModule mpm_event_module modules/mod_mpm_event.so\n", + }) + } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/expires_spec.rb b/environments/production/modules/apache/spec/classes/mod/expires_spec.rb new file mode 100644 index 0000000..397fee0 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/expires_spec.rb @@ -0,0 +1,83 @@ +require 'spec_helper' + +describe 'apache::mod::expires', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "with expires active", :compile do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :lsbdistcodename => 'squeeze', + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + it { is_expected.to contain_apache__mod("expires") } + it { is_expected.to contain_file("expires.conf").with(:content => /ExpiresActive On\n/) } + end + context "with expires default", :compile do + let :pre_condition do + 'class { apache: default_mods => false }' + end + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '7', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + let :params do + { + 'expires_default' => 'access plus 1 month' + } + end + it { is_expected.to contain_apache__mod("expires") } + it { is_expected.to contain_file("expires.conf").with_content( + "ExpiresActive On\n" \ + "ExpiresDefault \"access plus 1 month\"\n" + ) + } + end + context "with expires by type", :compile do + let :pre_condition do + 'class { apache: default_mods => false }' + end + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '7', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + } + end + let :params do + { + 'expires_by_type' => [ + { 'text/json' => 'mod plus 1 day' }, + { 'text/html' => 'access plus 1 year' }, + ] + } + end + it { is_expected.to contain_apache__mod("expires") } + it { is_expected.to contain_file("expires.conf").with_content( + "ExpiresActive On\n" \ + "ExpiresByType text/json \"mod plus 1 day\"\n" \ + "ExpiresByType text/html \"access plus 1 year\"\n" + ) + } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/ext_filter_spec.rb b/environments/production/modules/apache/spec/classes/mod/ext_filter_spec.rb new file mode 100644 index 0000000..a0cf37c --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/ext_filter_spec.rb @@ -0,0 +1,64 @@ +require 'spec_helper' + +describe 'apache::mod::ext_filter', :type => :class do + it_behaves_like "a mod class, without including apache" + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :fqdn => 'test.example.com', + :is_pe => false, + } + end + describe 'with no parameters' do + it { is_expected.to contain_apache__mod('ext_filter') } + it { is_expected.not_to contain_file('ext_filter.conf') } + end + describe 'with parameters' do + let :params do + { :ext_filter_define => {'filtA' => 'input=A output=B', + 'filtB' => 'input=C cmd="C"' }, + } + end + it { is_expected.to contain_file('ext_filter.conf').with_content(/^ExtFilterDefine\s+filtA\s+input=A output=B$/) } + it { is_expected.to contain_file('ext_filter.conf').with_content(/^ExtFilterDefine\s+filtB\s+input=C cmd="C"$/) } + end + + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :fqdn => 'test.example.com', + :is_pe => false, + } + end + describe 'with no parameters' do + it { is_expected.to contain_apache__mod('ext_filter') } + it { is_expected.not_to contain_file('ext_filter.conf') } + end + describe 'with parameters' do + let :params do + { :ext_filter_define => {'filtA' => 'input=A output=B', + 'filtB' => 'input=C cmd="C"' }, + } + end + it { is_expected.to contain_file('ext_filter.conf').with_path('/etc/httpd/conf.d/ext_filter.conf') } + it { is_expected.to contain_file('ext_filter.conf').with_content(/^ExtFilterDefine\s+filtA\s+input=A output=B$/) } + it { is_expected.to contain_file('ext_filter.conf').with_content(/^ExtFilterDefine\s+filtB\s+input=C cmd="C"$/) } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/fastcgi_spec.rb b/environments/production/modules/apache/spec/classes/mod/fastcgi_spec.rb new file mode 100644 index 0000000..778d27c --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/fastcgi_spec.rb @@ -0,0 +1,43 @@ +require 'spec_helper' + +describe 'apache::mod::fastcgi', :type => :class do + it_behaves_like "a mod class, without including apache" + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('fastcgi') } + it { is_expected.to contain_package("libapache2-mod-fastcgi") } + it { is_expected.to contain_file('fastcgi.conf') } + end + + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('fastcgi') } + it { is_expected.to contain_package("mod_fastcgi") } + it { is_expected.not_to contain_file('fastcgi.conf') } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/fcgid_spec.rb b/environments/production/modules/apache/spec/classes/mod/fcgid_spec.rb new file mode 100644 index 0000000..f08596b --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/fcgid_spec.rb @@ -0,0 +1,141 @@ +require 'spec_helper' + +describe 'apache::mod::fcgid', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :operatingsystemmajrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('fcgid').with({ + 'loadfile_name' => nil + }) } + it { is_expected.to contain_package("libapache2-mod-fcgid") } + end + + context "on a RHEL6" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :operatingsystemmajrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + describe 'without parameters' do + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('fcgid').with({ + 'loadfile_name' => nil + }) } + it { is_expected.to contain_package("mod_fcgid") } + end + + describe 'with parameters' do + let :params do { + :options => { + 'FcgidIPCDir' => '/var/run/fcgidsock', + 'SharememPath' => '/var/run/fcgid_shm', + 'FcgidMinProcessesPerClass' => '0', + 'AddHandler' => 'fcgid-script .fcgi', + } + } end + + it 'should contain the correct config' do + content = catalogue.resource('file', 'fcgid.conf').send(:parameters)[:content] + expect(content.split("\n").reject { |c| c =~ /(^#|^$)/ }).to eq([ + '', + ' AddHandler fcgid-script .fcgi', + ' FcgidIPCDir /var/run/fcgidsock', + ' FcgidMinProcessesPerClass 0', + ' SharememPath /var/run/fcgid_shm', + '', + ]) + end + end + end + + context "on RHEL7" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '7', + :operatingsystemmajrelease => '7', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + describe 'without parameters' do + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('fcgid').with({ + 'loadfile_name' => 'unixd_fcgid.load' + }) } + it { is_expected.to contain_package("mod_fcgid") } + end + end + + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '10', + :operatingsystemmajrelease => '10', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('fcgid').with({ + 'loadfile_name' => 'unixd_fcgid.load' + }) } + it { is_expected.to contain_package("www/mod_fcgid") } + end + + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('fcgid').with({ + 'loadfile_name' => nil, + }) } + it { is_expected.to contain_package("www-apache/mod_fcgid") } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/info_spec.rb b/environments/production/modules/apache/spec/classes/mod/info_spec.rb new file mode 100644 index 0000000..766a9e4 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/info_spec.rb @@ -0,0 +1,222 @@ +require 'spec_helper' + +# This function is called inside the OS specific contexts +def general_info_specs_22 + it { is_expected.to contain_apache__mod('info') } + + context 'passing no parameters' do + it { + is_expected.to contain_file('info.conf').with_content( + "\n"\ + " SetHandler server-info\n"\ + " Order deny,allow\n"\ + " Deny from all\n"\ + " Allow from 127.0.0.1\n"\ + " Allow from ::1\n"\ + "\n" + ) + } + end + context 'passing restrict_access => false' do + let :params do { + :restrict_access => false + } + end + it { + is_expected.to contain_file('info.conf').with_content( + "\n"\ + " SetHandler server-info\n"\ + "\n" + ) + } + end + context "passing allow_from => ['10.10.1.2', '192.168.1.2', '127.0.0.1']" do + let :params do + {:allow_from => ['10.10.1.2', '192.168.1.2', '127.0.0.1']} + end + it { + is_expected.to contain_file('info.conf').with_content( + "\n"\ + " SetHandler server-info\n"\ + " Order deny,allow\n"\ + " Deny from all\n"\ + " Allow from 10.10.1.2\n"\ + " Allow from 192.168.1.2\n"\ + " Allow from 127.0.0.1\n"\ + "\n" + ) + } + end + context 'passing both restrict_access and allow_from' do + let :params do + { + :restrict_access => false, + :allow_from => ['10.10.1.2', '192.168.1.2', '127.0.0.1'] + } + end + it { + is_expected.to contain_file('info.conf').with_content( + "\n"\ + " SetHandler server-info\n"\ + "\n" + ) + } + end +end + +def general_info_specs_24 + it { is_expected.to contain_apache__mod('info') } + + context 'passing no parameters' do + it { + is_expected.to contain_file('info.conf').with_content( + "\n"\ + " SetHandler server-info\n"\ + " Require ip 127.0.0.1 ::1\n"\ + "\n" + ) + } + end + context 'passing restrict_access => false' do + let :params do { + :restrict_access => false + } + end + it { + is_expected.to contain_file('info.conf').with_content( + "\n"\ + " SetHandler server-info\n"\ + "\n" + ) + } + end + context "passing allow_from => ['10.10.1.2', '192.168.1.2', '127.0.0.1']" do + let :params do + {:allow_from => ['10.10.1.2', '192.168.1.2', '127.0.0.1']} + end + it { + is_expected.to contain_file('info.conf').with_content( + "\n"\ + " SetHandler server-info\n"\ + " Require ip 10.10.1.2 192.168.1.2 127.0.0.1\n"\ + "\n" + ) + } + end + context 'passing both restrict_access and allow_from' do + let :params do + { + :restrict_access => false, + :allow_from => ['10.10.1.2', '192.168.1.2', '127.0.0.1'] + } + end + it { + is_expected.to contain_file('info.conf').with_content( + "\n"\ + " SetHandler server-info\n"\ + "\n" + ) + } + end +end + +describe 'apache::mod::info', :type => :class do + it_behaves_like "a mod class, without including apache" + + context 'On a Debian OS' do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + # Load the more generic tests for this context + general_info_specs_22() + + it { is_expected.to contain_file('info.conf').with({ + :ensure => 'file', + :path => '/etc/apache2/mods-available/info.conf', + } ) } + it { is_expected.to contain_file('info.conf symlink').with({ + :ensure => 'link', + :path => '/etc/apache2/mods-enabled/info.conf', + } ) } + end + + context 'on a RedHat OS' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + # Load the more generic tests for this context + general_info_specs_22() + + it { is_expected.to contain_file('info.conf').with({ + :ensure => 'file', + :path => '/etc/httpd/conf.d/info.conf', + } ) } + end + + context 'on a FreeBSD OS' do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '10', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + # Load the more generic tests for this context + general_info_specs_24() + + it { is_expected.to contain_file('info.conf').with({ + :ensure => 'file', + :path => '/usr/local/etc/apache24/Modules/info.conf', + } ) } + end + + context 'on a Gentoo OS' do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + + # Load the more generic tests for this context + general_info_specs_24() + + it { is_expected.to contain_file('info.conf').with({ + :ensure => 'file', + :path => '/etc/apache2/modules.d/info.conf', + } ) } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/itk_spec.rb b/environments/production/modules/apache/spec/classes/mod/itk_spec.rb new file mode 100644 index 0000000..27369f1 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/itk_spec.rb @@ -0,0 +1,130 @@ +require 'spec_helper' + +describe 'apache::mod::itk', :type => :class do + let :pre_condition do + 'class { "apache": mpm_module => false, }' + end + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('itk') } + it { is_expected.to contain_file("/etc/apache2/mods-available/itk.conf").with_ensure('file') } + it { is_expected.to contain_file("/etc/apache2/mods-enabled/itk.conf").with_ensure('link') } + + context "with Apache version < 2.4" do + let :params do + { + :apache_version => '2.2', + } + end + + it { is_expected.not_to contain_file("/etc/apache2/mods-available/itk.load") } + it { is_expected.not_to contain_file("/etc/apache2/mods-enabled/itk.load") } + + it { is_expected.to contain_package("apache2-mpm-itk") } + end + + context "with Apache version >= 2.4" do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + + let :params do + { + :apache_version => '2.4', + } + end + + it { is_expected.to contain_file("/etc/apache2/mods-available/itk.load").with({ + 'ensure' => 'file', + 'content' => "LoadModule mpm_itk_module /usr/lib/apache2/modules/mod_mpm_itk.so\n" + }) + } + it { is_expected.to contain_file("/etc/apache2/mods-enabled/itk.load").with_ensure('link') } + end + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('itk') } + it { is_expected.to contain_file("/etc/httpd/conf.d/itk.conf").with_ensure('file') } + it { is_expected.to contain_package("httpd-itk") } + + context "with Apache version < 2.4" do + let :params do + { + :apache_version => '2.2', + } + end + + it { is_expected.to contain_file_line("/etc/sysconfig/httpd itk enable").with({ + 'require' => 'Package[httpd]', + }) + } + end + + context "with Apache version >= 2.4" do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + + let :params do + { + :apache_version => '2.4', + } + end + + it { is_expected.to contain_file("/etc/httpd/conf.d/itk.load").with({ + 'ensure' => 'file', + 'content' => "LoadModule mpm_itk_module modules/mod_mpm_itk.so\n" + }) + } + end + end + context "on a FreeBSD OS" do + let :pre_condition do + 'class { "apache": mpm_module => false, }' + end + + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '10', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + :mpm_module => 'itk', + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('itk') } + it { is_expected.to contain_file("/usr/local/etc/apache24/Modules/itk.conf").with_ensure('file') } + it { is_expected.to contain_package("www/mod_mpm_itk") } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/ldap_spec.rb b/environments/production/modules/apache/spec/classes/mod/ldap_spec.rb new file mode 100644 index 0000000..73c51ad --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/ldap_spec.rb @@ -0,0 +1,86 @@ +require 'spec_helper' + +describe 'apache::mod::ldap', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "on a Debian OS" do + let :facts do + { + :lsbdistcodename => 'squeeze', + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :operatingsystem => 'Debian', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_class("apache::mod::ldap") } + it { is_expected.to contain_apache__mod('ldap') } + + context 'default ldap_trusted_global_cert_file' do + it { is_expected.to contain_file('ldap.conf').without_content(/^LDAPTrustedGlobalCert/) } + end + + context 'ldap_trusted_global_cert_file param' do + let(:params) { { :ldap_trusted_global_cert_file => 'ca.pem' } } + it { is_expected.to contain_file('ldap.conf').with_content(/^LDAPTrustedGlobalCert CA_BASE64 ca\.pem$/) } + end + + context 'set multiple ldap params' do + let(:params) {{ + :ldap_trusted_global_cert_file => 'ca.pem', + :ldap_trusted_global_cert_type => 'CA_DER', + :ldap_shared_cache_size => '500000', + :ldap_cache_entries => '1024', + :ldap_cache_ttl => '600', + :ldap_opcache_entries => '1024', + :ldap_opcache_ttl => '600' + }} + it { is_expected.to contain_file('ldap.conf').with_content(/^LDAPTrustedGlobalCert CA_DER ca\.pem$/) } + it { is_expected.to contain_file('ldap.conf').with_content(/^LDAPSharedCacheSize 500000$/) } + it { is_expected.to contain_file('ldap.conf').with_content(/^LDAPCacheEntries 1024$/) } + it { is_expected.to contain_file('ldap.conf').with_content(/^LDAPCacheTTL 600$/) } + it { is_expected.to contain_file('ldap.conf').with_content(/^LDAPOpCacheEntries 1024$/) } + it { is_expected.to contain_file('ldap.conf').with_content(/^LDAPOpCacheTTL 600$/) } + end + end #Debian + + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :operatingsystem => 'RedHat', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_class("apache::mod::ldap") } + it { is_expected.to contain_apache__mod('ldap') } + + context 'default ldap_trusted_global_cert_file' do + it { is_expected.to contain_file('ldap.conf').without_content(/^LDAPTrustedGlobalCert/) } + end + + context 'ldap_trusted_global_cert_file param' do + let(:params) { { :ldap_trusted_global_cert_file => 'ca.pem' } } + it { is_expected.to contain_file('ldap.conf').with_content(/^LDAPTrustedGlobalCert CA_BASE64 ca\.pem$/) } + end + + context 'ldap_trusted_global_cert_file and ldap_trusted_global_cert_type params' do + let(:params) {{ + :ldap_trusted_global_cert_file => 'ca.pem', + :ldap_trusted_global_cert_type => 'CA_DER' + }} + it { is_expected.to contain_file('ldap.conf').with_content(/^LDAPTrustedGlobalCert CA_DER ca\.pem$/) } + end + end # Redhat +end diff --git a/environments/production/modules/apache/spec/classes/mod/mime_magic_spec.rb b/environments/production/modules/apache/spec/classes/mod/mime_magic_spec.rb new file mode 100644 index 0000000..cf8f898 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/mime_magic_spec.rb @@ -0,0 +1,110 @@ +require 'spec_helper' + +# This function is called inside the OS specific contexts +def general_mime_magic_specs + it { is_expected.to contain_apache__mod("mime_magic") } +end + +describe 'apache::mod::mime_magic', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "On a Debian OS with default params" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + general_mime_magic_specs() + + it do + is_expected.to contain_file("mime_magic.conf").with_content( + "MIMEMagicFile \"/etc/apache2/magic\"\n" + ) + end + + it { is_expected.to contain_file("mime_magic.conf").with({ + :ensure => 'file', + :path => '/etc/apache2/mods-available/mime_magic.conf', + } ) } + it { is_expected.to contain_file("mime_magic.conf symlink").with({ + :ensure => 'link', + :path => '/etc/apache2/mods-enabled/mime_magic.conf', + } ) } + + context "with magic_file => /tmp/Debian_magic" do + let :params do + { :magic_file => "/tmp/Debian_magic" } + end + + it do + is_expected.to contain_file("mime_magic.conf").with_content( + "MIMEMagicFile \"/tmp/Debian_magic\"\n" + ) + end + end + + end + + context "on a RedHat OS with default params" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + general_mime_magic_specs() + + it do + is_expected.to contain_file("mime_magic.conf").with_content( + "MIMEMagicFile \"/etc/httpd/conf/magic\"\n" + ) + end + + it { is_expected.to contain_file("mime_magic.conf").with_path("/etc/httpd/conf.d/mime_magic.conf") } + + end + + context "with magic_file => /tmp/magic" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + let :params do + { :magic_file => "/tmp/magic" } + end + + it do + is_expected.to contain_file("mime_magic.conf").with_content( + "MIMEMagicFile \"/tmp/magic\"\n" + ) + end + end + + +end diff --git a/environments/production/modules/apache/spec/classes/mod/mime_spec.rb b/environments/production/modules/apache/spec/classes/mod/mime_spec.rb new file mode 100644 index 0000000..b0675a3 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/mime_spec.rb @@ -0,0 +1,52 @@ +require 'spec_helper' + +# This function is called inside the OS specific conte, :compilexts +def general_mime_specs + it { is_expected.to contain_apache__mod("mime") } +end + +describe 'apache::mod::mime', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "On a Debian OS with default params", :compile do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + general_mime_specs() + + it { is_expected.to contain_file("mime.conf").with_path('/etc/apache2/mods-available/mime.conf') } + + end + + context "on a RedHat OS with default params", :compile do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + general_mime_specs() + + it { is_expected.to contain_file("mime.conf").with_path("/etc/httpd/conf.d/mime.conf") } + + end + +end diff --git a/environments/production/modules/apache/spec/classes/mod/negotiation_spec.rb b/environments/production/modules/apache/spec/classes/mod/negotiation_spec.rb new file mode 100644 index 0000000..9dadb76 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/negotiation_spec.rb @@ -0,0 +1,56 @@ +require 'spec_helper' + +describe 'apache::mod::negotiation', :type => :class do + it_behaves_like "a mod class, without including apache" + describe "OS independent tests" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :kernel => 'Linux', + :lsbdistcodename => 'squeeze', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + context "default params" do + it { should contain_class("apache") } + it do + should contain_file('negotiation.conf').with( { + :ensure => 'file', + :content => 'LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv zh-CN zh-TW +ForceLanguagePriority Prefer Fallback +', + } ) + end + end + + context 'with force_language_priority parameter' do + let :params do + { :force_language_priority => 'Prefer' } + end + it do + should contain_file('negotiation.conf').with( { + :ensure => 'file', + :content => /^ForceLanguagePriority Prefer$/, + } ) + end + end + + context 'with language_priority parameter' do + let :params do + { :language_priority => [ 'en', 'es' ] } + end + it do + should contain_file('negotiation.conf').with( { + :ensure => 'file', + :content => /^LanguagePriority en es$/, + } ) + end + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/pagespeed_spec.rb b/environments/production/modules/apache/spec/classes/mod/pagespeed_spec.rb new file mode 100644 index 0000000..2cbc3d1 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/pagespeed_spec.rb @@ -0,0 +1,51 @@ +require 'spec_helper' + +describe 'apache::mod::pagespeed', :type => :class do + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('pagespeed') } + it { is_expected.to contain_package("mod-pagespeed-stable") } + + context "when setting additional_configuration to a Hash" do + let :params do { :additional_configuration => { 'Key' => 'Value' } } end + it { is_expected.to contain_file('pagespeed.conf').with_content /Key Value/ } + end + + context "when setting additional_configuration to an Array" do + let :params do { :additional_configuration => [ 'Key Value' ] } end + it { is_expected.to contain_file('pagespeed.conf').with_content /Key Value/ } + end + end + + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('pagespeed') } + it { is_expected.to contain_package("mod-pagespeed-stable") } + it { is_expected.to contain_file('pagespeed.conf') } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/passenger_spec.rb b/environments/production/modules/apache/spec/classes/mod/passenger_spec.rb new file mode 100644 index 0000000..3f485b4 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/passenger_spec.rb @@ -0,0 +1,337 @@ +require 'spec_helper' + +describe 'apache::mod::passenger', :type => :class do + it_behaves_like "a mod class, without including apache" + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :kernel => 'Linux', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('passenger') } + it { is_expected.to contain_package("libapache2-mod-passenger") } + it { is_expected.to contain_file('zpassenger.load').with({ + 'path' => '/etc/apache2/mods-available/zpassenger.load', + }) } + it { is_expected.to contain_file('passenger.conf').with({ + 'path' => '/etc/apache2/mods-available/passenger.conf', + }) } + describe "with passenger_root => '/usr/lib/example'" do + let :params do + { :passenger_root => '/usr/lib/example' } + end + it { is_expected.to contain_file('passenger.conf').with_content(%r{PassengerRoot "/usr/lib/example"}) } + end + describe "with passenger_ruby => /usr/lib/example/ruby" do + let :params do + { :passenger_ruby => '/usr/lib/example/ruby' } + end + it { is_expected.to contain_file('passenger.conf').with_content(%r{PassengerRuby "/usr/lib/example/ruby"}) } + end + describe "with passenger_default_ruby => /usr/lib/example/ruby1.9.3" do + let :params do + { :passenger_ruby => '/usr/lib/example/ruby1.9.3' } + end + it { is_expected.to contain_file('passenger.conf').with_content(%r{PassengerRuby "/usr/lib/example/ruby1.9.3"}) } + end + describe "with passenger_high_performance => on" do + let :params do + { :passenger_high_performance => 'on' } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ PassengerHighPerformance on$/) } + end + describe "with passenger_pool_idle_time => 1200" do + let :params do + { :passenger_pool_idle_time => 1200 } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ PassengerPoolIdleTime 1200$/) } + end + describe "with passenger_max_request_queue_size => 100" do + let :params do + { :passenger_max_request_queue_size => 100 } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ PassengerMaxRequestQueueSize 100$/) } + end + + describe "with passenger_max_requests => 20" do + let :params do + { :passenger_max_requests => 20 } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ PassengerMaxRequests 20$/) } + end + describe "with passenger_spawn_method => bogus" do + let :params do + { :passenger_spawn_method => 'bogus' } + end + it { is_expected.to raise_error(Puppet::Error, /not permitted for passenger_spawn_method/) } + end + describe "with passenger_spawn_method => direct" do + let :params do + { :passenger_spawn_method => 'direct' } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ PassengerSpawnMethod direct$/) } + end + describe "with passenger_stat_throttle_rate => 10" do + let :params do + { :passenger_stat_throttle_rate => 10 } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ PassengerStatThrottleRate 10$/) } + end + describe "with passenger_max_pool_size => 16" do + let :params do + { :passenger_max_pool_size => 16 } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ PassengerMaxPoolSize 16$/) } + end + describe "with passenger_min_instances => 5" do + let :params do + { :passenger_min_instances => 5 } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ PassengerMinInstances 5$/) } + end + describe "with passenger_max_instances_per_app => 8" do + let :params do + { :passenger_max_instances_per_app => 8 } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ PassengerMaxInstancesPerApp 8$/) } + end + describe "with rack_autodetect => on" do + let :params do + { :rack_autodetect => 'on' } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ RackAutoDetect on$/) } + end + describe "with rails_autodetect => on" do + let :params do + { :rails_autodetect => 'on' } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ RailsAutoDetect on$/) } + end + describe "with passenger_use_global_queue => on" do + let :params do + { :passenger_use_global_queue => 'on' } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ PassengerUseGlobalQueue on$/) } + end + describe "with passenger_app_env => 'foo'" do + let :params do + { :passenger_app_env => 'foo' } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ PassengerAppEnv foo$/) } + end + describe "with passenger_log_file => '/var/log/apache2/passenger.log'" do + let :params do + { :passenger_log_file => '/var/log/apache2/passenger.log' } + end + it { is_expected.to contain_file('passenger.conf').with_content(%r{^ PassengerLogFile /var/log/apache2/passenger.log$}) } + end + describe "with passenger_log_level => 3" do + let :params do + { :passenger_log_level => 3 } + end + it { is_expected.to contain_file('passenger.conf').with_content(%r{^ PassengerLogLevel 3$}) } + end + describe "with mod_path => '/usr/lib/foo/mod_foo.so'" do + let :params do + { :mod_path => '/usr/lib/foo/mod_foo.so' } + end + it { is_expected.to contain_file('zpassenger.load').with_content(/^LoadModule passenger_module \/usr\/lib\/foo\/mod_foo\.so$/) } + end + describe "with mod_lib_path => '/usr/lib/foo'" do + let :params do + { :mod_lib_path => '/usr/lib/foo' } + end + it { is_expected.to contain_file('zpassenger.load').with_content(/^LoadModule passenger_module \/usr\/lib\/foo\/mod_passenger\.so$/) } + end + describe "with mod_lib => 'mod_foo.so'" do + let :params do + { :mod_lib => 'mod_foo.so' } + end + it { is_expected.to contain_file('zpassenger.load').with_content(/^LoadModule passenger_module \/usr\/lib\/apache2\/modules\/mod_foo\.so$/) } + end + describe "with mod_id => 'mod_foo'" do + let :params do + { :mod_id => 'mod_foo' } + end + it { is_expected.to contain_file('zpassenger.load').with_content(/^LoadModule mod_foo \/usr\/lib\/apache2\/modules\/mod_passenger\.so$/) } + end + + context "with Ubuntu 12.04 defaults" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '12.04', + :kernel => 'Linux', + :operatingsystem => 'Ubuntu', + :lsbdistrelease => '12.04', + :concat_basedir => '/dne', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + it { is_expected.to contain_file('passenger.conf').with_content(%r{PassengerRoot "/usr"}) } + it { is_expected.to contain_file('passenger.conf').with_content(%r{PassengerRuby "/usr/bin/ruby"}) } + it { is_expected.to contain_file('passenger.conf').without_content(/PassengerDefaultRuby/) } + end + + context "with Ubuntu 14.04 defaults" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '14.04', + :operatingsystem => 'Ubuntu', + :kernel => 'Linux', + :lsbdistrelease => '14.04', + :concat_basedir => '/dne', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + it { is_expected.to contain_file('passenger.conf').with_content(%r{PassengerRoot "/usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini"}) } + it { is_expected.to contain_file('passenger.conf').without_content(/PassengerRuby/) } + it { is_expected.to contain_file('passenger.conf').with_content(%r{PassengerDefaultRuby "/usr/bin/ruby"}) } + end + + context "with Debian 7 defaults" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '7.3', + :operatingsystem => 'Debian', + :kernel => 'Linux', + :lsbdistcodename => 'wheezy', + :concat_basedir => '/dne', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + it { is_expected.to contain_file('passenger.conf').with_content(%r{PassengerRoot "/usr"}) } + it { is_expected.to contain_file('passenger.conf').with_content(%r{PassengerRuby "/usr/bin/ruby"}) } + it { is_expected.to contain_file('passenger.conf').without_content(/PassengerDefaultRuby/) } + end + + context "with Debian 8 defaults" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '8.0', + :operatingsystem => 'Debian', + :kernel => 'Linux', + :lsbdistcodename => 'jessie', + :concat_basedir => '/dne', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + it { is_expected.to contain_file('passenger.conf').with_content(%r{PassengerRoot "/usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini"}) } + it { is_expected.to contain_file('passenger.conf').without_content(/PassengerRuby/) } + it { is_expected.to contain_file('passenger.conf').with_content(%r{PassengerDefaultRuby "/usr/bin/ruby"}) } + end + end + + context "on a RedHat OS" do + let :rh_facts do + { + :osfamily => 'RedHat', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + context "on EL6" do + let(:facts) { rh_facts.merge(:operatingsystemrelease => '6') } + + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('passenger') } + it { is_expected.to contain_package("mod_passenger") } + it { is_expected.to contain_file('passenger_package.conf').with({ + 'path' => '/etc/httpd/conf.d/passenger.conf', + }) } + it { is_expected.to contain_file('passenger_package.conf').without_content } + it { is_expected.to contain_file('passenger_package.conf').without_source } + it { is_expected.to contain_file('zpassenger.load').with({ + 'path' => '/etc/httpd/conf.d/zpassenger.load', + }) } + it { is_expected.to contain_file('passenger.conf').without_content(/PassengerRoot/) } + it { is_expected.to contain_file('passenger.conf').without_content(/PassengerRuby/) } + describe "with passenger_root => '/usr/lib/example'" do + let :params do + { :passenger_root => '/usr/lib/example' } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ PassengerRoot "\/usr\/lib\/example"$/) } + end + describe "with passenger_ruby => /usr/lib/example/ruby" do + let :params do + { :passenger_ruby => '/usr/lib/example/ruby' } + end + it { is_expected.to contain_file('passenger.conf').with_content(/^ PassengerRuby "\/usr\/lib\/example\/ruby"$/) } + end + end + + context "on EL7" do + let(:facts) { rh_facts.merge(:operatingsystemrelease => '7') } + + it { is_expected.to contain_file('passenger_package.conf').with({ + 'path' => '/etc/httpd/conf.d/passenger.conf', + }) } + it { is_expected.to contain_file('zpassenger.load').with({ + 'path' => '/etc/httpd/conf.modules.d/zpassenger.load', + }) } + end + end + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('passenger') } + it { is_expected.to contain_package("www/rubygem-passenger") } + end + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('passenger') } + it { is_expected.to contain_package("www-apache/passenger") } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/perl_spec.rb b/environments/production/modules/apache/spec/classes/mod/perl_spec.rb new file mode 100644 index 0000000..f5b61fe --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/perl_spec.rb @@ -0,0 +1,74 @@ +require 'spec_helper' + +describe 'apache::mod::perl', :type => :class do + it_behaves_like "a mod class, without including apache" + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('perl') } + it { is_expected.to contain_package("libapache2-mod-perl2") } + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('perl') } + it { is_expected.to contain_package("mod_perl") } + end + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('perl') } + it { is_expected.to contain_package("www/mod_perl2") } + end + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :operatingsystem => 'Gentoo', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('perl') } + it { is_expected.to contain_package("www-apache/mod_perl") } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/peruser_spec.rb b/environments/production/modules/apache/spec/classes/mod/peruser_spec.rb new file mode 100644 index 0000000..097a36f --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/peruser_spec.rb @@ -0,0 +1,43 @@ +require 'spec_helper' + +describe 'apache::mod::peruser', :type => :class do + let :pre_condition do + 'class { "apache": mpm_module => false, }' + end + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '10', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it do + expect { + catalogue + }.to raise_error(Puppet::Error, /Unsupported osfamily FreeBSD/) + end + end + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('peruser') } + it { is_expected.to contain_file("/etc/apache2/modules.d/peruser.conf").with_ensure('file') } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/php_spec.rb b/environments/production/modules/apache/spec/classes/mod/php_spec.rb new file mode 100644 index 0000000..ad61e89 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/php_spec.rb @@ -0,0 +1,319 @@ +require 'spec_helper' + +describe 'apache::mod::php', :type => :class do + describe "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context "with mpm_module => prefork" do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_class("apache::mod::prefork") } + it { is_expected.to contain_apache__mod('php5') } + it { is_expected.to contain_package("libapache2-mod-php5") } + it { is_expected.to contain_file("php5.load").with( + :content => "LoadModule php5_module /usr/lib/apache2/modules/libphp5.so\n" + ) } + end + context "with mpm_module => itk" do + let :pre_condition do + 'class { "apache": mpm_module => itk, }' + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_class("apache::mod::itk") } + it { is_expected.to contain_apache__mod('php5') } + it { is_expected.to contain_package("libapache2-mod-php5") } + it { is_expected.to contain_file("php5.load").with( + :content => "LoadModule php5_module /usr/lib/apache2/modules/libphp5.so\n" + ) } + end + context "on jessie" do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + let(:facts) { super().merge({ + :operatingsystemrelease => '8', + :lsbdistcodename => 'jessie', + }) } + it { is_expected.to contain_file("php5.load").with( + :content => "LoadModule php5_module /usr/lib/apache2/modules/libphp5.so\n" + ) } + end + context "on stretch" do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + let(:facts) { super().merge({ + :operatingsystemrelease => '9', + :lsbdistcodename => 'stretch', + }) } + it { is_expected.to contain_apache__mod('php7.0') } + it { is_expected.to contain_package("libapache2-mod-php7.0") } + it { is_expected.to contain_file("php7.0.load").with( + :content => "LoadModule php7_module /usr/lib/apache2/modules/libphp7.0.so\n" + ) } + end + end + describe "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context "with default params" do + let :pre_condition do + 'class { "apache": }' + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('php5') } + it { is_expected.to contain_package("php") } + it { is_expected.to contain_file("php5.load").with( + :content => "LoadModule php5_module modules/libphp5.so\n" + ) } + end + context "with alternative package name" do let :pre_condition do + 'class { "apache": }' + end + let :params do + { :package_name => 'php54'} + end + it { is_expected.to contain_package("php54") } + end + context "with alternative path" do let :pre_condition do + 'class { "apache": }' + end + let :params do + { :path => 'alternative-path'} + end + it { is_expected.to contain_file("php5.load").with( + :content => "LoadModule php5_module alternative-path\n" + ) } + end + context "with alternative extensions" do let :pre_condition do + 'class { "apache": }' + end + let :params do + { :extensions => ['.php','.php5']} + end + it { is_expected.to contain_file("php5.conf").with_content(Regexp.new(Regexp.escape(''))) } + end + context "with specific version" do + let :pre_condition do + 'class { "apache": }' + end + let :params do + { :package_ensure => '5.3.13'} + end + it { is_expected.to contain_package("php").with( + :ensure => '5.3.13' + ) } + end + context "with mpm_module => prefork" do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_class("apache::mod::prefork") } + it { is_expected.to contain_apache__mod('php5') } + it { is_expected.to contain_package("php") } + it { is_expected.to contain_file("php5.load").with( + :content => "LoadModule php5_module modules/libphp5.so\n" + ) } + end + context "with mpm_module => itk" do + let :pre_condition do + 'class { "apache": mpm_module => itk, }' + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_class("apache::mod::itk") } + it { is_expected.to contain_apache__mod('php5') } + it { is_expected.to contain_package("php") } + it { is_expected.to contain_file("php5.load").with( + :content => "LoadModule php5_module modules/libphp5.so\n" + ) } + end + end + describe "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '10', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context "with mpm_module => prefork" do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + it { is_expected.to contain_class('apache::params') } + it { is_expected.to contain_apache__mod('php5') } + it { is_expected.to contain_package("www/mod_php5") } + it { is_expected.to contain_file('php5.load') } + end + context "with mpm_module => itk" do + let :pre_condition do + 'class { "apache": mpm_module => itk, }' + end + it { is_expected.to contain_class('apache::params') } + it { is_expected.to contain_class('apache::mod::itk') } + it { is_expected.to contain_apache__mod('php5') } + it { is_expected.to contain_package("www/mod_php5") } + it { is_expected.to contain_file('php5.load') } + end + end + describe "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + context "with mpm_module => prefork" do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + it { is_expected.to contain_class('apache::params') } + it { is_expected.to contain_apache__mod('php5') } + it { is_expected.to contain_package("dev-lang/php") } + it { is_expected.to contain_file('php5.load') } + end + context "with mpm_module => itk" do + let :pre_condition do + 'class { "apache": mpm_module => itk, }' + end + it { is_expected.to contain_class('apache::params') } + it { is_expected.to contain_class('apache::mod::itk') } + it { is_expected.to contain_apache__mod('php5') } + it { is_expected.to contain_package("dev-lang/php") } + it { is_expected.to contain_file('php5.load') } + end + end + describe "OS independent tests" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :kernel => 'Linux', + :lsbdistcodename => 'squeeze', + :concat_basedir => '/dne', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context 'with content param' do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + let :params do + { :content => 'somecontent' } + end + it { should contain_file('php5.conf').with( + :content => 'somecontent' + ) } + end + context 'with template param' do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + let :params do + { :template => 'apache/mod/php.conf.erb' } + end + it { should contain_file('php5.conf').with( + :content => /^# PHP is an HTML-embedded scripting language which attempts to make it/ + ) } + end + context 'with source param' do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + let :params do + { :source => 'some-path' } + end + it { should contain_file('php5.conf').with( + :source => 'some-path' + ) } + end + context 'content has priority over template' do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + let :params do + { + :template => 'apache/mod/php5.conf.erb', + :content => 'somecontent' + } + end + it { should contain_file('php5.conf').with( + :content => 'somecontent' + ) } + end + context 'source has priority over template' do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + let :params do + { + :template => 'apache/mod/php5.conf.erb', + :source => 'some-path' + } + end + it { should contain_file('php5.conf').with( + :source => 'some-path' + ) } + end + context 'source has priority over content' do + let :pre_condition do + 'class { "apache": mpm_module => prefork, }' + end + let :params do + { + :content => 'somecontent', + :source => 'some-path' + } + end + it { should contain_file('php5.conf').with( + :source => 'some-path' + ) } + end + context 'with mpm_module => worker' do + let :pre_condition do + 'class { "apache": mpm_module => worker, }' + end + it 'should raise an error' do + expect { expect(subject).to contain_apache__mod('php5') }.to raise_error Puppet::Error, /mpm_module => 'prefork' or mpm_module => 'itk'/ + end + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/prefork_spec.rb b/environments/production/modules/apache/spec/classes/mod/prefork_spec.rb new file mode 100644 index 0000000..3e2954f --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/prefork_spec.rb @@ -0,0 +1,134 @@ +require 'spec_helper' + +describe 'apache::mod::prefork', :type => :class do + let :pre_condition do + 'class { "apache": mpm_module => false, }' + end + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('prefork') } + it { is_expected.to contain_file("/etc/apache2/mods-available/prefork.conf").with_ensure('file') } + it { is_expected.to contain_file("/etc/apache2/mods-enabled/prefork.conf").with_ensure('link') } + + context "with Apache version < 2.4" do + let :params do + { + :apache_version => '2.2', + } + end + + it { is_expected.not_to contain_file("/etc/apache2/mods-available/prefork.load") } + it { is_expected.not_to contain_file("/etc/apache2/mods-enabled/prefork.load") } + + it { is_expected.to contain_package("apache2-mpm-prefork") } + end + + context "with Apache version >= 2.4" do + let :params do + { + :apache_version => '2.4', + } + end + + it { is_expected.to contain_file("/etc/apache2/mods-available/prefork.load").with({ + 'ensure' => 'file', + 'content' => "LoadModule mpm_prefork_module /usr/lib/apache2/modules/mod_mpm_prefork.so\n" + }) + } + it { is_expected.to contain_file("/etc/apache2/mods-enabled/prefork.load").with_ensure('link') } + end + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('prefork') } + it { is_expected.to contain_file("/etc/httpd/conf.d/prefork.conf").with_ensure('file') } + + context "with Apache version < 2.4" do + let :params do + { + :apache_version => '2.2', + } + end + + it { is_expected.to contain_file_line("/etc/sysconfig/httpd prefork enable").with({ + 'require' => 'Package[httpd]', + }) + } + end + + context "with Apache version >= 2.4" do + let :params do + { + :apache_version => '2.4', + } + end + + it { is_expected.not_to contain_apache__mod('event') } + + it { is_expected.to contain_file("/etc/httpd/conf.d/prefork.load").with({ + 'ensure' => 'file', + 'content' => "LoadModule mpm_prefork_module modules/mod_mpm_prefork.so\n", + }) + } + end + end + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('prefork') } + it { is_expected.to contain_file("/usr/local/etc/apache24/Modules/prefork.conf").with_ensure('file') } + end + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('prefork') } + it { is_expected.to contain_file("/etc/apache2/modules.d/prefork.conf").with_ensure('file') } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/proxy_balancer_spec.rb b/environments/production/modules/apache/spec/classes/mod/proxy_balancer_spec.rb new file mode 100644 index 0000000..d646ba7 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/proxy_balancer_spec.rb @@ -0,0 +1,95 @@ +require 'spec_helper' + +# Helper function for testing the contents of `proxy_balancer.conf` +def balancer_manager_conf_spec(allow_from, manager_path) + it do + is_expected.to contain_file("proxy_balancer.conf").with_content( + "\n"\ + " SetHandler balancer-manager\n"\ + " Require ip #{Array(allow_from).join(' ')}\n"\ + "\n" + ) + end +end + +describe 'apache::mod::proxy_balancer', :type => :class do + let :pre_condition do + [ + 'include apache::mod::proxy', + ] + end + it_behaves_like "a mod class, without including apache" + + context "default configuration with default parameters" do + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '8', + :concat_basedir => '/dne', + :lsbdistcodename => 'jessie', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + it { is_expected.to contain_apache__mod("proxy_balancer") } + + it { is_expected.to_not contain_file("proxy_balancer.conf") } + it { is_expected.to_not contain_file("proxy_balancer.conf symlink") } + + end + + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + it { is_expected.to contain_apache__mod("proxy_balancer") } + + it { is_expected.to_not contain_file("proxy_balancer.conf") } + it { is_expected.to_not contain_file("proxy_balancer.conf symlink") } + + end + end + + context "default configuration with custom parameters $manager => true, $allow_from => ['10.10.10.10','11.11.11.11'], $status_path => '/custom-manager'" do + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '8', + :concat_basedir => '/dne', + :lsbdistcodename => 'jessie', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :params do + { + :manager => true, + :allow_from => ['10.10.10.10','11.11.11.11'], + :manager_path => '/custom-manager', + } + end + + balancer_manager_conf_spec(["10.10.10.10", "11.11.11.11"], "/custom-manager") + + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/proxy_connect_spec.rb b/environments/production/modules/apache/spec/classes/mod/proxy_connect_spec.rb new file mode 100644 index 0000000..33059c0 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/proxy_connect_spec.rb @@ -0,0 +1,65 @@ +require 'spec_helper' + +describe 'apache::mod::proxy_connect', :type => :class do + let :pre_condition do + [ + 'include apache::mod::proxy', + ] + end + it_behaves_like "a mod class, without including apache" + context 'on a Debian OS' do + let :facts do + { + :osfamily => 'Debian', + :concat_basedir => '/dne', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context 'with Apache version < 2.2' do + let :facts do + super().merge({ + :operatingsystemrelease => '7.0', + :lsbdistcodename => 'wheezy', + }) + end + let :params do + { + :apache_version => '2.1', + } + end + it { is_expected.not_to contain_apache__mod('proxy_connect') } + end + context 'with Apache version = 2.2' do + let :facts do + super().merge({ + :operatingsystemrelease => '7.0', + :lsbdistcodename => 'wheezy', + }) + end + let :params do + { + :apache_version => '2.2', + } + end + it { is_expected.to contain_apache__mod('proxy_connect') } + end + context 'with Apache version >= 2.4' do + let :facts do + super().merge({ + :operatingsystemrelease => '8.0', + :lsbdistcodename => 'jessie', + }) + end + let :params do + { + :apache_version => '2.4', + } + end + it { is_expected.to contain_apache__mod('proxy_connect') } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/proxy_html_spec.rb b/environments/production/modules/apache/spec/classes/mod/proxy_html_spec.rb new file mode 100644 index 0000000..0d70276 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/proxy_html_spec.rb @@ -0,0 +1,128 @@ +require 'spec_helper' + +describe 'apache::mod::proxy_html', :type => :class do + let :pre_condition do + [ + 'include apache::mod::proxy', + 'include apache::mod::proxy_http', + ] + end + it_behaves_like "a mod class, without including apache" + context "on a Debian OS" do + shared_examples "debian" do |loadfiles| + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('proxy_html').with(:loadfiles => loadfiles) } + it { is_expected.to contain_package("libapache2-mod-proxy-html") } + end + let :facts do + { + :osfamily => 'Debian', + :concat_basedir => '/dne', + :architecture => 'i386', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :hardwaremodel => 'i386', + :is_pe => false, + } + end + + context "on squeeze" do + let(:facts) { super().merge({ :operatingsystemrelease => '6' }) } + it_behaves_like "debian", ['/usr/lib/libxml2.so.2'] + it { is_expected.to_not contain_apache__mod('xml2enc') } + end + context "on wheezy" do + let(:facts) { super().merge({ :operatingsystemrelease => '7' }) } + it { is_expected.to_not contain_apache__mod('xml2enc') } + context "i386" do + let(:facts) { super().merge({ + :hardwaremodel => 'i686', + :architecture => 'i386' + })} + it_behaves_like "debian", ["/usr/lib/i386-linux-gnu/libxml2.so.2"] + end + context "x64" do + let(:facts) { super().merge({ + :hardwaremodel => 'x86_64', + :architecture => 'amd64' + })} + it_behaves_like "debian", ["/usr/lib/x86_64-linux-gnu/libxml2.so.2"] + end + end + context "on jessie" do + let(:facts) { super().merge({ :operatingsystemrelease => '8' }) } + it { is_expected.to contain_apache__mod('xml2enc').with(:loadfiles => nil) } + context "i386" do + let(:facts) { super().merge({ + :hardwaremodel => 'i686', + :architecture => 'i386' + })} + it_behaves_like "debian", ["/usr/lib/i386-linux-gnu/libxml2.so.2"] + end + context "x64" do + let(:facts) { super().merge({ + :hardwaremodel => 'x86_64', + :architecture => 'amd64' + })} + it_behaves_like "debian", ["/usr/lib/x86_64-linux-gnu/libxml2.so.2"] + end + end + end + context "on a RedHat OS", :compile do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('proxy_html').with(:loadfiles => nil) } + it { is_expected.to contain_package("mod_proxy_html") } + it { is_expected.to contain_apache__mod('xml2enc').with(:loadfiles => nil) } + end + context "on a FreeBSD OS", :compile do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('proxy_html').with(:loadfiles => nil) } + it { is_expected.to contain_apache__mod('xml2enc').with(:loadfiles => nil) } + it { is_expected.to contain_package("www/mod_proxy_html") } + end + context "on a Gentoo OS", :compile do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('proxy_html').with(:loadfiles => nil) } + it { is_expected.to contain_apache__mod('xml2enc').with(:loadfiles => nil) } + it { is_expected.to contain_package("www-apache/mod_proxy_html") } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/proxy_wstunnel.rb b/environments/production/modules/apache/spec/classes/mod/proxy_wstunnel.rb new file mode 100644 index 0000000..5af217a --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/proxy_wstunnel.rb @@ -0,0 +1,5 @@ +require 'spec_helper' + +describe 'apache::mod::proxy_wstunnel', :type => :class do + it_behaves_like "a mod class, without including apache" +end diff --git a/environments/production/modules/apache/spec/classes/mod/python_spec.rb b/environments/production/modules/apache/spec/classes/mod/python_spec.rb new file mode 100644 index 0000000..1393293 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/python_spec.rb @@ -0,0 +1,75 @@ +require 'spec_helper' + +describe 'apache::mod::python', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod("python") } + it { is_expected.to contain_package("libapache2-mod-python") } + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod("python") } + it { is_expected.to contain_package("mod_python") } + end + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod("python") } + it { is_expected.to contain_package("www/mod_python3") } + end + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod("python") } + it { is_expected.to contain_package("www-apache/mod_python") } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/remoteip_spec.rb b/environments/production/modules/apache/spec/classes/mod/remoteip_spec.rb new file mode 100644 index 0000000..d75ea56 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/remoteip_spec.rb @@ -0,0 +1,48 @@ +require 'spec_helper' + +describe 'apache::mod::remoteip', :type => :class do + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '8', + :concat_basedir => '/dne', + :lsbdistcodename => 'jessie', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + let :params do + { :apache_version => '2.4' } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('remoteip') } + it { is_expected.to contain_file('remoteip.conf').with({ + 'path' => '/etc/apache2/mods-available/remoteip.conf', + }) } + + describe "with header X-Forwarded-For" do + let :params do + { :header => 'X-Forwarded-For' } + end + it { is_expected.to contain_file('remoteip.conf').with_content(/^RemoteIPHeader X-Forwarded-For$/) } + end + describe "with proxy_ips => [ 10.42.17.8, 10.42.18.99 ]" do + let :params do + { :proxy_ips => [ '10.42.17.8', '10.42.18.99' ] } + end + it { is_expected.to contain_file('remoteip.conf').with_content(/^RemoteIPInternalProxy 10.42.17.8$/) } + it { is_expected.to contain_file('remoteip.conf').with_content(/^RemoteIPInternalProxy 10.42.18.99$/) } + end + describe "with Apache version < 2.4" do + let :params do + { :apache_version => '2.2' } + end + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /mod_remoteip is only available in Apache 2.4/) + end + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/reqtimeout_spec.rb b/environments/production/modules/apache/spec/classes/mod/reqtimeout_spec.rb new file mode 100644 index 0000000..c3a0977 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/reqtimeout_spec.rb @@ -0,0 +1,146 @@ +require 'spec_helper' + +describe 'apache::mod::reqtimeout', :type => :class do + it_behaves_like "a mod class, without including apache" + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :lsbdistcodename => 'squeeze', + :is_pe => false, + } + end + context "passing no parameters" do + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('reqtimeout') } + it { is_expected.to contain_file('reqtimeout.conf').with_content(/^RequestReadTimeout header=20-40,minrate=500\nRequestReadTimeout body=10,minrate=500$/) } + end + context "passing timeouts => ['header=20-60,minrate=600', 'body=60,minrate=600']" do + let :params do + {:timeouts => ['header=20-60,minrate=600', 'body=60,minrate=600']} + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('reqtimeout') } + it { is_expected.to contain_file('reqtimeout.conf').with_content(/^RequestReadTimeout header=20-60,minrate=600\nRequestReadTimeout body=60,minrate=600$/) } + end + context "passing timeouts => 'header=20-60,minrate=600'" do + let :params do + {:timeouts => 'header=20-60,minrate=600'} + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('reqtimeout') } + it { is_expected.to contain_file('reqtimeout.conf').with_content(/^RequestReadTimeout header=20-60,minrate=600$/) } + end + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'Redhat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context "passing no parameters" do + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('reqtimeout') } + it { is_expected.to contain_file('reqtimeout.conf').with_content(/^RequestReadTimeout header=20-40,minrate=500\nRequestReadTimeout body=10,minrate=500$/) } + end + context "passing timeouts => ['header=20-60,minrate=600', 'body=60,minrate=600']" do + let :params do + {:timeouts => ['header=20-60,minrate=600', 'body=60,minrate=600']} + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('reqtimeout') } + it { is_expected.to contain_file('reqtimeout.conf').with_content(/^RequestReadTimeout header=20-60,minrate=600\nRequestReadTimeout body=60,minrate=600$/) } + end + context "passing timeouts => 'header=20-60,minrate=600'" do + let :params do + {:timeouts => 'header=20-60,minrate=600'} + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('reqtimeout') } + it { is_expected.to contain_file('reqtimeout.conf').with_content(/^RequestReadTimeout header=20-60,minrate=600$/) } + end + end + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context "passing no parameters" do + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('reqtimeout') } + it { is_expected.to contain_file('reqtimeout.conf').with_content(/^RequestReadTimeout header=20-40,minrate=500\nRequestReadTimeout body=10,minrate=500$/) } + end + context "passing timeouts => ['header=20-60,minrate=600', 'body=60,minrate=600']" do + let :params do + {:timeouts => ['header=20-60,minrate=600', 'body=60,minrate=600']} + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('reqtimeout') } + it { is_expected.to contain_file('reqtimeout.conf').with_content(/^RequestReadTimeout header=20-60,minrate=600\nRequestReadTimeout body=60,minrate=600$/) } + end + context "passing timeouts => 'header=20-60,minrate=600'" do + let :params do + {:timeouts => 'header=20-60,minrate=600'} + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('reqtimeout') } + it { is_expected.to contain_file('reqtimeout.conf').with_content(/^RequestReadTimeout header=20-60,minrate=600$/) } + end + end + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + context "passing no parameters" do + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('reqtimeout') } + it { is_expected.to contain_file('reqtimeout.conf').with_content(/^RequestReadTimeout header=20-40,minrate=500\nRequestReadTimeout body=10,minrate=500$/) } + end + context "passing timeouts => ['header=20-60,minrate=600', 'body=60,minrate=600']" do + let :params do + {:timeouts => ['header=20-60,minrate=600', 'body=60,minrate=600']} + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('reqtimeout') } + it { is_expected.to contain_file('reqtimeout.conf').with_content(/^RequestReadTimeout header=20-60,minrate=600\nRequestReadTimeout body=60,minrate=600$/) } + end + context "passing timeouts => 'header=20-60,minrate=600'" do + let :params do + {:timeouts => 'header=20-60,minrate=600'} + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('reqtimeout') } + it { is_expected.to contain_file('reqtimeout.conf').with_content(/^RequestReadTimeout header=20-60,minrate=600$/) } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/rpaf_spec.rb b/environments/production/modules/apache/spec/classes/mod/rpaf_spec.rb new file mode 100644 index 0000000..13f0e6c --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/rpaf_spec.rb @@ -0,0 +1,126 @@ +require 'spec_helper' + +describe 'apache::mod::rpaf', :type => :class do + it_behaves_like "a mod class, without including apache" + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('rpaf') } + it { is_expected.to contain_package("libapache2-mod-rpaf") } + it { is_expected.to contain_file('rpaf.conf').with({ + 'path' => '/etc/apache2/mods-available/rpaf.conf', + }) } + it { is_expected.to contain_file('rpaf.conf').with_content(/^RPAFenable On$/) } + + describe "with sethostname => true" do + let :params do + { :sethostname => 'true' } + end + it { is_expected.to contain_file('rpaf.conf').with_content(/^RPAFsethostname On$/) } + end + describe "with proxy_ips => [ 10.42.17.8, 10.42.18.99 ]" do + let :params do + { :proxy_ips => [ '10.42.17.8', '10.42.18.99' ] } + end + it { is_expected.to contain_file('rpaf.conf').with_content(/^RPAFproxy_ips 10.42.17.8 10.42.18.99$/) } + end + describe "with header => X-Real-IP" do + let :params do + { :header => 'X-Real-IP' } + end + it { is_expected.to contain_file('rpaf.conf').with_content(/^RPAFheader X-Real-IP$/) } + end + end + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('rpaf') } + it { is_expected.to contain_package("www/mod_rpaf2") } + it { is_expected.to contain_file('rpaf.conf').with({ + 'path' => '/usr/local/etc/apache24/Modules/rpaf.conf', + }) } + it { is_expected.to contain_file('rpaf.conf').with_content(/^RPAFenable On$/) } + + describe "with sethostname => true" do + let :params do + { :sethostname => 'true' } + end + it { is_expected.to contain_file('rpaf.conf').with_content(/^RPAFsethostname On$/) } + end + describe "with proxy_ips => [ 10.42.17.8, 10.42.18.99 ]" do + let :params do + { :proxy_ips => [ '10.42.17.8', '10.42.18.99' ] } + end + it { is_expected.to contain_file('rpaf.conf').with_content(/^RPAFproxy_ips 10.42.17.8 10.42.18.99$/) } + end + describe "with header => X-Real-IP" do + let :params do + { :header => 'X-Real-IP' } + end + it { is_expected.to contain_file('rpaf.conf').with_content(/^RPAFheader X-Real-IP$/) } + end + end + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__mod('rpaf') } + it { is_expected.to contain_package("www-apache/mod_rpaf") } + it { is_expected.to contain_file('rpaf.conf').with({ + 'path' => '/etc/apache2/modules.d/rpaf.conf', + }) } + it { is_expected.to contain_file('rpaf.conf').with_content(/^RPAFenable On$/) } + + describe "with sethostname => true" do + let :params do + { :sethostname => 'true' } + end + it { is_expected.to contain_file('rpaf.conf').with_content(/^RPAFsethostname On$/) } + end + describe "with proxy_ips => [ 10.42.17.8, 10.42.18.99 ]" do + let :params do + { :proxy_ips => [ '10.42.17.8', '10.42.18.99' ] } + end + it { is_expected.to contain_file('rpaf.conf').with_content(/^RPAFproxy_ips 10.42.17.8 10.42.18.99$/) } + end + describe "with header => X-Real-IP" do + let :params do + { :header => 'X-Real-IP' } + end + it { is_expected.to contain_file('rpaf.conf').with_content(/^RPAFheader X-Real-IP$/) } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/security_spec.rb b/environments/production/modules/apache/spec/classes/mod/security_spec.rb new file mode 100644 index 0000000..28b5e26 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/security_spec.rb @@ -0,0 +1,155 @@ + +require 'spec_helper' + +describe 'apache::mod::security', :type => :class do + it_behaves_like "a mod class, without including apache" + context "on RedHat based systems" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'CentOS', + :operatingsystemrelease => '7', + :kernel => 'Linux', + :id => 'root', + :concat_basedir => '/', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { should contain_apache__mod('security').with( + :id => 'security2_module', + :lib => 'mod_security2.so' + ) } + it { should contain_apache__mod('unique_id_module').with( + :id => 'unique_id_module', + :lib => 'mod_unique_id.so' + ) } + it { should contain_package('mod_security_crs') } + it { should contain_file('security.conf').with( + :path => '/etc/httpd/conf.modules.d/security.conf' + ) } + it { should contain_file('security.conf') + .with_content(%r{^\s+SecAuditLogRelevantStatus "\^\(\?:5\|4\(\?!04\)\)"$}) + .with_content(%r{^\s+SecAuditLogParts ABIJDEFHZ$}) + .with_content(%r{^\s+SecDebugLog /var/log/httpd/modsec_debug.log$}) + .with_content(%r{^\s+SecAuditLog /var/log/httpd/modsec_audit.log$}) + } + it { should contain_file('/etc/httpd/modsecurity.d').with( + :ensure => 'directory', + :path => '/etc/httpd/modsecurity.d', + :owner => 'root', + :group => 'root', + :mode => '0755', + ) } + it { should contain_file('/etc/httpd/modsecurity.d/activated_rules').with( + :ensure => 'directory', + :path => '/etc/httpd/modsecurity.d/activated_rules', + :owner => 'apache', + :group => 'apache' + ) } + it { should contain_file('/etc/httpd/modsecurity.d/security_crs.conf').with( + :path => '/etc/httpd/modsecurity.d/security_crs.conf' + ) } + it { should contain_apache__security__rule_link('base_rules/modsecurity_35_bad_robots.data') } + it { should contain_file('modsecurity_35_bad_robots.data').with( + :path => '/etc/httpd/modsecurity.d/activated_rules/modsecurity_35_bad_robots.data', + :target => '/usr/lib/modsecurity.d/base_rules/modsecurity_35_bad_robots.data', + ) } + + describe 'with parameters' do + let :params do + { + :activated_rules => [ + '/tmp/foo/bar.conf', + ], + :audit_log_relevant_status => "^(?:5|4(?!01|04))", + :audit_log_parts => "ABCDZ", + :secdefaultaction => "deny,status:406,nolog,auditlog", + } + end + it { should contain_file('security.conf').with_content %r{^\s+SecAuditLogRelevantStatus "\^\(\?:5\|4\(\?!01\|04\)\)"$} } + it { should contain_file('security.conf').with_content %r{^\s+SecAuditLogParts ABCDZ$} } + it { should contain_file('/etc/httpd/modsecurity.d/security_crs.conf').with_content %r{^\s*SecDefaultAction "phase:2,deny,status:406,nolog,auditlog"$} } + it { should contain_file('bar.conf').with( + :path => '/etc/httpd/modsecurity.d/activated_rules/bar.conf', + :target => '/tmp/foo/bar.conf', + ) } + end + end + + context "on Debian based systems" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/', + :lsbdistcodename => 'squeeze', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :kernel => 'Linux', + :is_pe => false, + } + end + it { should contain_apache__mod('security').with( + :id => 'security2_module', + :lib => 'mod_security2.so' + ) } + it { should contain_apache__mod('unique_id_module').with( + :id => 'unique_id_module', + :lib => 'mod_unique_id.so' + ) } + it { should contain_package('modsecurity-crs') } + it { should contain_file('security.conf').with( + :path => '/etc/apache2/mods-available/security.conf' + ) } + it { should contain_file('security.conf') + .with_content(%r{^\s+SecAuditLogRelevantStatus "\^\(\?:5\|4\(\?!04\)\)"$}) + .with_content(%r{^\s+SecAuditLogParts ABIJDEFHZ$}) + .with_content(%r{^\s+SecDebugLog /var/log/apache2/modsec_debug.log$}) + .with_content(%r{^\s+SecAuditLog /var/log/apache2/modsec_audit.log$}) + } + it { should contain_file('/etc/modsecurity').with( + :ensure => 'directory', + :path => '/etc/modsecurity', + :owner => 'root', + :group => 'root', + :mode => '0755', + ) } + it { should contain_file('/etc/modsecurity/activated_rules').with( + :ensure => 'directory', + :path => '/etc/modsecurity/activated_rules', + :owner => 'www-data', + :group => 'www-data' + ) } + it { should contain_file('/etc/modsecurity/security_crs.conf').with( + :path => '/etc/modsecurity/security_crs.conf' + ) } + it { should contain_apache__security__rule_link('base_rules/modsecurity_35_bad_robots.data') } + it { should contain_file('modsecurity_35_bad_robots.data').with( + :path => '/etc/modsecurity/activated_rules/modsecurity_35_bad_robots.data', + :target => '/usr/share/modsecurity-crs/base_rules/modsecurity_35_bad_robots.data', + ) } + + describe 'with parameters' do + let :params do + { + :activated_rules => [ + '/tmp/foo/bar.conf', + ], + :audit_log_relevant_status => "^(?:5|4(?!01|04))", + :audit_log_parts => "ABCDZ", + :secdefaultaction => "deny,status:406,nolog,auditlog", + } + end + it { should contain_file('security.conf').with_content %r{^\s+SecAuditLogRelevantStatus "\^\(\?:5\|4\(\?!01\|04\)\)"$} } + it { should contain_file('security.conf').with_content %r{^\s+SecAuditLogParts ABCDZ$} } + it { should contain_file('/etc/modsecurity/security_crs.conf').with_content %r{^\s*SecDefaultAction "phase:2,deny,status:406,nolog,auditlog"$} } + it { should contain_file('bar.conf').with( + :path => '/etc/modsecurity/activated_rules/bar.conf', + :target => '/tmp/foo/bar.conf', + ) } + end + end + +end diff --git a/environments/production/modules/apache/spec/classes/mod/shib_spec.rb b/environments/production/modules/apache/spec/classes/mod/shib_spec.rb new file mode 100644 index 0000000..a651c28 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/shib_spec.rb @@ -0,0 +1,42 @@ +require 'spec_helper' + +describe 'apache::mod::shib', :type => :class do + it_behaves_like "a mod class, without including apache" + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :fqdn => 'test.example.com', + :is_pe => false, + } + end + describe 'with no parameters' do + it { should contain_apache__mod('shib2').with_id('mod_shib') } + end + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :fqdn => 'test.example.com', + :is_pe => false, + } + end + describe 'with no parameters' do + it { should contain_apache__mod('shib2').with_id('mod_shib') } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/speling_spec.rb b/environments/production/modules/apache/spec/classes/mod/speling_spec.rb new file mode 100644 index 0000000..b4844ec --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/speling_spec.rb @@ -0,0 +1,37 @@ +require 'spec_helper' + +describe 'apache::mod::speling', :type => :class do + it_behaves_like "a mod class, without including apache" + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_apache__mod('speling') } + end + + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_apache__mod('speling') } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/ssl_spec.rb b/environments/production/modules/apache/spec/classes/mod/ssl_spec.rb new file mode 100644 index 0000000..10badfa --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/ssl_spec.rb @@ -0,0 +1,238 @@ +require 'spec_helper' + +describe 'apache::mod::ssl', :type => :class do + it_behaves_like "a mod class, without including apache" + context 'on an unsupported OS' do + let :facts do + { + :osfamily => 'Magic', + :operatingsystemrelease => '0', + :concat_basedir => '/dne', + :operatingsystem => 'Magic', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { expect { catalogue }.to raise_error(Puppet::Error, /Unsupported osfamily:/) } + end + + context 'on a RedHat OS' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class('apache::params') } + it { is_expected.to contain_apache__mod('ssl') } + it { is_expected.to contain_package('mod_ssl') } + context 'with a custom package_name parameter' do + let :params do + { :package_name => 'httpd24-mod_ssl' } + end + it { is_expected.to contain_class('apache::params') } + it { is_expected.to contain_apache__mod('ssl') } + it { is_expected.to contain_package('httpd24-mod_ssl') } + it { is_expected.not_to contain_package('mod_ssl') } + end + end + + context 'on a Debian OS' do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class('apache::params') } + it { is_expected.to contain_apache__mod('ssl') } + it { is_expected.not_to contain_package('libapache2-mod-ssl') } + end + + context 'on a FreeBSD OS' do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class('apache::params') } + it { is_expected.to contain_apache__mod('ssl') } + end + + context 'on a Gentoo OS' do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class('apache::params') } + it { is_expected.to contain_apache__mod('ssl') } + end + + context 'on a Suse OS' do + let :facts do + { + :osfamily => 'Suse', + :operatingsystem => 'SLES', + :operatingsystemrelease => '12', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class('apache::params') } + it { is_expected.to contain_apache__mod('ssl') } + end + # Template config doesn't vary by distro + context "on all distros" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'CentOS', + :operatingsystemrelease => '6', + :kernel => 'Linux', + :id => 'root', + :concat_basedir => '/dne', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + context 'not setting ssl_pass_phrase_dialog' do + it { is_expected.to contain_file('ssl.conf').with_content(/^ SSLPassPhraseDialog builtin$/)} + end + + context "with Apache version < 2.4" do + let :params do + { + :apache_version => '2.2', + } + end + context 'ssl_compression with default value' do + it { is_expected.not_to contain_file('ssl.conf').with_content(/^ SSLCompression Off$/)} + end + + context 'setting ssl_compression to true' do + let :params do + { + :ssl_compression => true, + } + end + it { is_expected.not_to contain_file('ssl.conf').with_content(/^ SSLCompression On$/)} + end + context 'setting ssl_stapling to true' do + let :params do + { + :ssl_stapling => true, + } + end + it { is_expected.not_to contain_file('ssl.conf').with_content(/^ SSLUseStapling/)} + end + end + context "with Apache version >= 2.4" do + let :params do + { + :apache_version => '2.4', + } + end + context 'ssl_compression with default value' do + it { is_expected.not_to contain_file('ssl.conf').with_content(/^ SSLCompression Off$/)} + end + + context 'setting ssl_compression to true' do + let :params do + { + :apache_version => '2.4', + :ssl_compression => true, + } + end + it { is_expected.to contain_file('ssl.conf').with_content(/^ SSLCompression On$/)} + end + context 'setting ssl_stapling to true' do + let :params do + { + :apache_version => '2.4', + :ssl_stapling => true, + } + end + it { is_expected.to contain_file('ssl.conf').with_content(/^ SSLUseStapling On$/)} + end + context 'setting ssl_stapling_return_errors to true' do + let :params do + { + :apache_version => '2.4', + :ssl_stapling_return_errors => true, + } + end + it { is_expected.to contain_file('ssl.conf').with_content(/^ SSLStaplingReturnResponderErrors On$/)} + end + end + + context 'setting ssl_pass_phrase_dialog' do + let :params do + { + :ssl_pass_phrase_dialog => 'exec:/path/to/program', + } + end + it { is_expected.to contain_file('ssl.conf').with_content(/^ SSLPassPhraseDialog exec:\/path\/to\/program$/)} + end + + context 'setting ssl_random_seed_bytes' do + let :params do + { + :ssl_random_seed_bytes => '1024', + } + end + it { is_expected.to contain_file('ssl.conf').with_content(%r{^ SSLRandomSeed startup file:/dev/urandom 1024$})} + end + + context 'setting ssl_openssl_conf_cmd' do + let :params do + { + :ssl_openssl_conf_cmd => 'DHParameters "foo.pem"', + } + end + it { is_expected.to contain_file('ssl.conf').with_content(/^\s+SSLOpenSSLConfCmd DHParameters "foo.pem"$/)} + end + + context 'setting ssl_mutex' do + let :params do + { + :ssl_mutex => 'posixsem', + } + end + it { is_expected.to contain_file('ssl.conf').with_content(%r{^ SSLMutex posixsem$})} + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/status_spec.rb b/environments/production/modules/apache/spec/classes/mod/status_spec.rb new file mode 100644 index 0000000..7bc7831 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/status_spec.rb @@ -0,0 +1,205 @@ +require 'spec_helper' + +# Helper function for testing the contents of `status.conf` +def status_conf_spec(allow_from, extended_status, status_path) + it do + is_expected.to contain_file("status.conf").with_content( + "\n"\ + " SetHandler server-status\n"\ + " Order deny,allow\n"\ + " Deny from all\n"\ + " Allow from #{Array(allow_from).join(' ')}\n"\ + "\n"\ + "ExtendedStatus #{extended_status}\n"\ + "\n"\ + "\n"\ + " # Show Proxy LoadBalancer status in mod_status\n"\ + " ProxyStatus On\n"\ + "\n" + ) + end +end + +describe 'apache::mod::status', :type => :class do + it_behaves_like "a mod class, without including apache" + + context "default configuration with parameters" do + context "on a Debian OS with default params" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + it { is_expected.to contain_apache__mod("status") } + + status_conf_spec(["127.0.0.1", "::1"], "On", "/server-status") + + it { is_expected.to contain_file("status.conf").with({ + :ensure => 'file', + :path => '/etc/apache2/mods-available/status.conf', + } ) } + + it { is_expected.to contain_file("status.conf symlink").with({ + :ensure => 'link', + :path => '/etc/apache2/mods-enabled/status.conf', + } ) } + + end + + context "on a RedHat OS with default params" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + it { is_expected.to contain_apache__mod("status") } + + status_conf_spec(["127.0.0.1", "::1"], "On", "/server-status") + + it { is_expected.to contain_file("status.conf").with_path("/etc/httpd/conf.d/status.conf") } + + end + + context "with custom parameters $allow_from => ['10.10.10.10','11.11.11.11'], $extended_status => 'Off', $status_path => '/custom-status'" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :params do + { + :allow_from => ['10.10.10.10','11.11.11.11'], + :extended_status => 'Off', + :status_path => '/custom-status', + } + end + + status_conf_spec(["10.10.10.10", "11.11.11.11"], "Off", "/custom-status") + + end + + context "with valid parameter type $allow_from => ['10.10.10.10']" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :params do + { :allow_from => ['10.10.10.10'] } + end + it 'should expect to succeed array validation' do + expect { + is_expected.to contain_file("status.conf") + }.not_to raise_error() + end + end + + context "with invalid parameter type $allow_from => '10.10.10.10'" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :params do + { :allow_from => '10.10.10.10' } + end + it 'should expect to fail array validation' do + expect { + is_expected.to contain_file("status.conf") + }.to raise_error(Puppet::Error) + end + end + + # Only On or Off are valid options + ['On', 'Off'].each do |valid_param| + context "with valid value $extended_status => '#{valid_param}'" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :params do + { :extended_status => valid_param } + end + it 'should expect to succeed regular expression validation' do + expect { + is_expected.to contain_file("status.conf") + }.not_to raise_error() + end + end + end + + ['Yes', 'No'].each do |invalid_param| + context "with invalid value $extended_status => '#{invalid_param}'" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :params do + { :extended_status => invalid_param } + end + it 'should expect to fail regular expression validation' do + expect { + is_expected.to contain_file("status.conf") + }.to raise_error(Puppet::Error) + end + end + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/suphp_spec.rb b/environments/production/modules/apache/spec/classes/mod/suphp_spec.rb new file mode 100644 index 0000000..71dbab3 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/suphp_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'apache::mod::suphp', :type => :class do + it_behaves_like "a mod class, without including apache" + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_package("libapache2-mod-suphp") } + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_package("mod_suphp") } + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/worker_spec.rb b/environments/production/modules/apache/spec/classes/mod/worker_spec.rb new file mode 100644 index 0000000..9d0d8e5 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/worker_spec.rb @@ -0,0 +1,189 @@ +require 'spec_helper' + +describe 'apache::mod::worker', :type => :class do + let :pre_condition do + 'class { "apache": mpm_module => false, }' + end + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('worker') } + it { is_expected.to contain_file("/etc/apache2/mods-available/worker.conf").with_ensure('file') } + it { is_expected.to contain_file("/etc/apache2/mods-enabled/worker.conf").with_ensure('link') } + + context "with Apache version < 2.4" do + let :params do + { + :apache_version => '2.2', + } + end + + it { is_expected.not_to contain_file("/etc/apache2/mods-available/worker.load") } + it { is_expected.not_to contain_file("/etc/apache2/mods-enabled/worker.load") } + + it { is_expected.to contain_package("apache2-mpm-worker") } + end + + context "with Apache version >= 2.4" do + let :params do + { + :apache_version => '2.4', + } + end + + it { is_expected.to contain_file("/etc/apache2/mods-available/worker.load").with({ + 'ensure' => 'file', + 'content' => "LoadModule mpm_worker_module /usr/lib/apache2/modules/mod_mpm_worker.so\n" + }) + } + it { is_expected.to contain_file("/etc/apache2/mods-enabled/worker.load").with_ensure('link') } + end + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('worker') } + it { is_expected.to contain_file("/etc/httpd/conf.d/worker.conf").with_ensure('file') } + + context "with Apache version < 2.4" do + let :params do + { + :apache_version => '2.2', + } + end + + it { is_expected.to contain_file_line("/etc/sysconfig/httpd worker enable").with({ + 'require' => 'Package[httpd]', + }) + } + end + + context "with Apache version >= 2.4" do + let :params do + { + :apache_version => '2.4', + } + end + + it { is_expected.not_to contain_apache__mod('event') } + + it { is_expected.to contain_file("/etc/httpd/conf.d/worker.load").with({ + 'ensure' => 'file', + 'content' => "LoadModule mpm_worker_module modules/mod_mpm_worker.so\n", + }) + } + end + end + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('worker') } + it { is_expected.to contain_file("/usr/local/etc/apache24/Modules/worker.conf").with_ensure('file') } + end + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.not_to contain_apache__mod('worker') } + it { is_expected.to contain_file("/etc/apache2/modules.d/worker.conf").with_ensure('file') } + end + + # Template config doesn't vary by distro + context "on all distros" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'CentOS', + :operatingsystemrelease => '6', + :kernel => 'Linux', + :id => 'root', + :concat_basedir => '/dne', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + context 'defaults' do + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+ServerLimit\s+25$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+StartServers\s+2$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+MaxClients\s+150$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+MinSpareThreads\s+25$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+MaxSpareThreads\s+75$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+ThreadsPerChild\s+25$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+MaxRequestsPerChild\s+0$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+ThreadLimit\s+64$/) } + it { should contain_file("/etc/httpd/conf.d/worker.conf").with(:content => /^\s*ListenBacklog\s*511/) } + end + + context 'setting params' do + let :params do + { + :serverlimit => 10, + :startservers => 11, + :maxclients => 12, + :minsparethreads => 13, + :maxsparethreads => 14, + :threadsperchild => 15, + :maxrequestsperchild => 16, + :threadlimit => 17, + :listenbacklog => 8, + } + end + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+ServerLimit\s+10$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+StartServers\s+11$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+MaxClients\s+12$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+MinSpareThreads\s+13$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+MaxSpareThreads\s+14$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+ThreadsPerChild\s+15$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+MaxRequestsPerChild\s+16$/) } + it { should contain_file('/etc/httpd/conf.d/worker.conf').with(:content => /^\s+ThreadLimit\s+17$/) } + it { should contain_file("/etc/httpd/conf.d/worker.conf").with(:content => /^\s*ListenBacklog\s*8/) } + end + end +end diff --git a/environments/production/modules/apache/spec/classes/mod/wsgi_spec.rb b/environments/production/modules/apache/spec/classes/mod/wsgi_spec.rb new file mode 100644 index 0000000..1d54c54 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/mod/wsgi_spec.rb @@ -0,0 +1,145 @@ +require 'spec_helper' + +describe 'apache::mod::wsgi', :type => :class do + it_behaves_like "a mod class, without including apache" + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_class('apache::mod::wsgi').with( + 'wsgi_socket_prefix' => nil + ) + } + it { is_expected.to contain_package("libapache2-mod-wsgi") } + end + context "on a RedHat OS" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_class('apache::mod::wsgi').with( + 'wsgi_socket_prefix' => '/var/run/wsgi' + ) + } + it { is_expected.to contain_package("mod_wsgi") } + + describe "with custom WSGISocketPrefix" do + let :params do + { :wsgi_socket_prefix => 'run/wsgi' } + end + it {is_expected.to contain_file('wsgi.conf').with_content(/^ WSGISocketPrefix run\/wsgi$/)} + end + describe "with custom WSGIPythonHome" do + let :params do + { :wsgi_python_home => '/path/to/virtenv' } + end + it {is_expected.to contain_file('wsgi.conf').with_content(/^ WSGIPythonHome "\/path\/to\/virtenv"$/)} + end + describe "with custom package_name and mod_path" do + let :params do + { + :package_name => 'mod_wsgi_package', + :mod_path => '/foo/bar/baz', + } + end + it { is_expected.to contain_apache__mod('wsgi').with({ + 'package' => 'mod_wsgi_package', + 'path' => '/foo/bar/baz', + }) + } + it { is_expected.to contain_package("mod_wsgi_package") } + it { is_expected.to contain_file('wsgi.load').with_content(%r"LoadModule wsgi_module /foo/bar/baz") } + end + describe "with custom mod_path not containing /" do + let :params do + { + :package_name => 'mod_wsgi_package', + :mod_path => 'wsgi_mod_name.so', + } + end + it { is_expected.to contain_apache__mod('wsgi').with({ + 'path' => 'modules/wsgi_mod_name.so', + 'package' => 'mod_wsgi_package', + }) + } + it { is_expected.to contain_file('wsgi.load').with_content(%r"LoadModule wsgi_module modules/wsgi_mod_name.so") } + + end + describe "with package_name but no mod_path" do + let :params do + { + :mod_path => '/foo/bar/baz', + } + end + it { expect { catalogue }.to raise_error Puppet::Error, /apache::mod::wsgi - both package_name and mod_path must be specified!/ } + end + describe "with mod_path but no package_name" do + let :params do + { + :package_name => '/foo/bar/baz', + } + end + it { expect { catalogue }.to raise_error Puppet::Error, /apache::mod::wsgi - both package_name and mod_path must be specified!/ } + end + end + context "on a FreeBSD OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_class('apache::mod::wsgi').with( + 'wsgi_socket_prefix' => nil + ) + } + it { is_expected.to contain_package("www/mod_wsgi") } + end + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_class('apache::mod::wsgi').with( + 'wsgi_socket_prefix' => nil + ) + } + it { is_expected.to contain_package("www-apache/mod_wsgi") } + end +end diff --git a/environments/production/modules/apache/spec/classes/params_spec.rb b/environments/production/modules/apache/spec/classes/params_spec.rb new file mode 100644 index 0000000..32ccd31 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/params_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' + +describe 'apache::params', :type => :class do + context "On a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + it { is_expected.to compile.with_all_deps } + it { is_expected.to have_resource_count(0) } + end +end diff --git a/environments/production/modules/apache/spec/classes/service_spec.rb b/environments/production/modules/apache/spec/classes/service_spec.rb new file mode 100644 index 0000000..f53937a --- /dev/null +++ b/environments/production/modules/apache/spec/classes/service_spec.rb @@ -0,0 +1,173 @@ +require 'spec_helper' + +describe 'apache::service', :type => :class do + let :pre_condition do + 'include apache::params' + end + context "on a Debian OS" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_service("httpd").with( + 'name' => 'apache2', + 'ensure' => 'running', + 'enable' => 'true' + ) + } + + context "with $service_name => 'foo'" do + let (:params) {{ :service_name => 'foo' }} + it { is_expected.to contain_service("httpd").with( + 'name' => 'foo' + ) + } + end + + context "with $service_enable => true" do + let (:params) {{ :service_enable => true }} + it { is_expected.to contain_service("httpd").with( + 'name' => 'apache2', + 'ensure' => 'running', + 'enable' => 'true' + ) + } + end + + context "with $service_enable => false" do + let (:params) {{ :service_enable => false }} + it { is_expected.to contain_service("httpd").with( + 'name' => 'apache2', + 'ensure' => 'running', + 'enable' => 'false' + ) + } + end + + context "$service_enable must be a bool" do + let (:params) {{ :service_enable => 'not-a-boolean' }} + + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not a boolean/) + end + end + + context "$service_manage must be a bool" do + let (:params) {{ :service_manage => 'not-a-boolean' }} + + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not a boolean/) + end + end + + context "with $service_ensure => 'running'" do + let (:params) {{ :service_ensure => 'running', }} + it { is_expected.to contain_service("httpd").with( + 'ensure' => 'running', + 'enable' => 'true' + ) + } + end + + context "with $service_ensure => 'stopped'" do + let (:params) {{ :service_ensure => 'stopped', }} + it { is_expected.to contain_service("httpd").with( + 'ensure' => 'stopped', + 'enable' => 'true' + ) + } + end + + context "with $service_ensure => 'UNDEF'" do + let (:params) {{ :service_ensure => 'UNDEF' }} + it { is_expected.to contain_service("httpd").without_ensure } + end + + context "with $service_restart unset" do + it { is_expected.to contain_service("httpd").without_restart } + end + + context "with $service_restart => '/usr/sbin/apachectl graceful'" do + let (:params) {{ :service_restart => '/usr/sbin/apachectl graceful' }} + it { is_expected.to contain_service("httpd").with( + 'restart' => '/usr/sbin/apachectl graceful' + ) + } + end + end + + + context "on a RedHat 5 OS, do not manage service" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '5', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let(:params) do + { + 'service_ensure' => 'running', + 'service_name' => 'httpd', + 'service_manage' => false + } + end + it { is_expected.not_to contain_service('httpd') } + end + + context "on a FreeBSD 5 OS" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { is_expected.to contain_service("httpd").with( + 'name' => 'apache24', + 'ensure' => 'running', + 'enable' => 'true' + ) + } + end + + context "on a Gentoo OS" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + it { is_expected.to contain_service("httpd").with( + 'name' => 'apache2', + 'ensure' => 'running', + 'enable' => 'true' + ) + } + end +end diff --git a/environments/production/modules/apache/spec/classes/vhosts_spec.rb b/environments/production/modules/apache/spec/classes/vhosts_spec.rb new file mode 100644 index 0000000..3220079 --- /dev/null +++ b/environments/production/modules/apache/spec/classes/vhosts_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'apache::vhosts', :type => :class do + context 'on all OSes' do + let :facts do + { + :id => 'root', + :kernel => 'Linux', + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context 'with custom vhosts parameter' do + let :params do { + :vhosts => { + 'custom_vhost_1' => { + 'docroot' => '/var/www/custom_vhost_1', + 'port' => '81', + }, + 'custom_vhost_2' => { + 'docroot' => '/var/www/custom_vhost_2', + 'port' => '82', + }, + }, + } + end + it { is_expected.to contain_apache__vhost('custom_vhost_1') } + it { is_expected.to contain_apache__vhost('custom_vhost_2') } + end + end +end diff --git a/environments/production/modules/apache/spec/defines/balancer_spec.rb b/environments/production/modules/apache/spec/defines/balancer_spec.rb new file mode 100644 index 0000000..3b43e3f --- /dev/null +++ b/environments/production/modules/apache/spec/defines/balancer_spec.rb @@ -0,0 +1,72 @@ +require 'spec_helper' + +describe 'apache::balancer', :type => :define do + let :title do + 'myapp' + end + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :lsbdistcodename => 'squeeze', + :id => 'root', + :concat_basedir => '/dne', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :kernel => 'Linux', + :is_pe => false, + } + end + describe 'apache pre_condition with defaults' do + let :pre_condition do + 'include apache' + end + describe "accept a target parameter and use it" do + let :params do + { + :target => '/tmp/myapp.conf' + } + end + it { should contain_concat('apache_balancer_myapp').with({ + :path => "/tmp/myapp.conf", + })} + it { should_not contain_apache__mod('slotmem_shm') } + it { should_not contain_apache__mod('lbmethod_byrequests') } + end + context "on jessie" do + let(:facts) { super().merge({ + :operatingsystemrelease => '8', + :lsbdistcodename => 'jessie', + }) } + it { should contain_apache__mod('slotmem_shm') } + it { should contain_apache__mod('lbmethod_byrequests') } + end + end + describe 'apache pre_condition with conf_dir set' do + let :pre_condition do + 'class{"apache": + confd_dir => "/junk/path" + }' + end + it { should contain_concat('apache_balancer_myapp').with({ + :path => "/junk/path/balancer_myapp.conf", + })} + end + + describe 'with lbmethod and with apache::mod::proxy_balancer::apache_version set' do + let :pre_condition do + 'class{"apache::mod::proxy_balancer": + apache_version => "2.4" + }' + end + let :params do + { + :proxy_set => { + 'lbmethod' => 'bytraffic', + }, + } + end + it { should contain_apache__mod('slotmem_shm') } + it { should contain_apache__mod('lbmethod_bytraffic') } + end +end diff --git a/environments/production/modules/apache/spec/defines/balancermember_spec.rb b/environments/production/modules/apache/spec/defines/balancermember_spec.rb new file mode 100644 index 0000000..6221290 --- /dev/null +++ b/environments/production/modules/apache/spec/defines/balancermember_spec.rb @@ -0,0 +1,61 @@ +require 'spec_helper' + +describe 'apache::balancermember', :type => :define do + let :pre_condition do + 'include apache' + end + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :lsbdistcodename => 'squeeze', + :id => 'root', + :concat_basedir => '/dne', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :kernel => 'Linux', + :is_pe => false, + } + end + describe "allows multiple balancermembers with the same url" do + let :pre_condition do + 'include apache + apache::balancer {"balancer":} + apache::balancer {"balancer-external":} + apache::balancermember {"http://127.0.0.1:8080-external": url => "http://127.0.0.1:8080/", balancer_cluster => "balancer-external"} + ' + end + let :title do + 'http://127.0.0.1:8080/' + end + let :params do + { + :options => [], + :url => 'http://127.0.0.1:8080/', + :balancer_cluster => 'balancer-internal' + } + end + it { should contain_concat__fragment('BalancerMember http://127.0.0.1:8080/') } + end + describe "allows balancermember with a different target" do + let :pre_condition do + 'include apache + apache::balancer {"balancername": target => "/etc/apache/balancer.conf"} + apache::balancermember {"http://127.0.0.1:8080-external": url => "http://127.0.0.1:8080/", balancer_cluster => "balancername"} + ' + end + let :title do + 'http://127.0.0.1:8080/' + end + let :params do + { + :options => [], + :url => 'http://127.0.0.1:8080/', + :balancer_cluster => 'balancername' + } + end + it { should contain_concat__fragment('BalancerMember http://127.0.0.1:8080/').with({ + :target => "apache_balancer_balancername", + })} + end +end diff --git a/environments/production/modules/apache/spec/defines/custom_config_spec.rb b/environments/production/modules/apache/spec/defines/custom_config_spec.rb new file mode 100644 index 0000000..7d566b0 --- /dev/null +++ b/environments/production/modules/apache/spec/defines/custom_config_spec.rb @@ -0,0 +1,138 @@ +require 'spec_helper' + +describe 'apache::custom_config', :type => :define do + let :pre_condition do + 'class { "apache": }' + end + let :title do + 'rspec' + end + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context 'defaults with content' do + let :params do + { + 'content' => '# Test', + } + end + it { is_expected.to contain_exec("syntax verification for rspec").with({ + 'refreshonly' => 'true', + 'subscribe' => 'File[apache_rspec]', + 'command' => '/usr/sbin/apachectl -t', + 'notify' => 'Class[Apache::Service]', + 'before' => 'Exec[remove rspec if invalid]', + }) + } + it { is_expected.to contain_exec("remove rspec if invalid").with({ + 'unless' => '/usr/sbin/apachectl -t', + 'subscribe' => 'File[apache_rspec]', + 'refreshonly' => 'true', + }) + } + it { is_expected.to contain_file("apache_rspec").with({ + 'ensure' => 'present', + 'content' => '# Test', + 'require' => 'Package[httpd]', + }) + } + end + context 'set everything with source' do + let :params do + { + 'confdir' => '/dne', + 'priority' => '30', + 'source' => 'puppet:///modules/apache/test', + 'verify_command' => '/bin/true', + } + end + it { is_expected.to contain_exec("syntax verification for rspec").with({ + 'command' => '/bin/true', + }) + } + it { is_expected.to contain_exec("remove rspec if invalid").with({ + 'command' => '/bin/rm /dne/30-rspec.conf', + 'unless' => '/bin/true', + }) + } + it { is_expected.to contain_file("apache_rspec").with({ + 'path' => '/dne/30-rspec.conf', + 'ensure' => 'present', + 'source' => 'puppet:///modules/apache/test', + 'require' => 'Package[httpd]', + }) + } + end + context 'verify_config => false' do + let :params do + { + 'content' => '# test', + 'verify_config' => false, + } + end + it { is_expected.to_not contain_exec('syntax verification for rspec') } + it { is_expected.to_not contain_exec('remove rspec if invalid') } + it { is_expected.to contain_file('apache_rspec').with({ + 'notify' => 'Class[Apache::Service]' + }) + } + end + context 'ensure => absent' do + let :params do + { + 'ensure' => 'absent' + } + end + it { is_expected.to_not contain_exec('syntax verification for rspec') } + it { is_expected.to_not contain_exec('remove rspec if invalid') } + it { is_expected.to contain_file('apache_rspec').with({ + 'ensure' => 'absent', + }) + } + end + describe 'validation' do + context 'both content and source' do + let :params do + { + 'content' => 'foo', + 'source' => 'bar', + } + end + it do + expect { + catalogue + }.to raise_error(Puppet::Error, /Only one of \$content and \$source can be specified\./) + end + end + context 'neither content nor source' do + it do + expect { + catalogue + }.to raise_error(Puppet::Error, /One of \$content and \$source must be specified\./) + end + end + context 'bad ensure' do + let :params do + { + 'content' => 'foo', + 'ensure' => 'foo', + } + end + it do + expect { + catalogue + }.to raise_error(Puppet::Error, /is not supported for ensure/) + end + end + end +end diff --git a/environments/production/modules/apache/spec/defines/fastcgi_server_spec.rb b/environments/production/modules/apache/spec/defines/fastcgi_server_spec.rb new file mode 100644 index 0000000..e415461 --- /dev/null +++ b/environments/production/modules/apache/spec/defines/fastcgi_server_spec.rb @@ -0,0 +1,156 @@ +require 'spec_helper' + +describe 'apache::fastcgi::server', :type => :define do + let :pre_condition do + 'include apache' + end + let :title do + 'www' + end + describe 'os-dependent items' do + context "on RedHat based systems" do + let :default_facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'CentOS', + :operatingsystemrelease => '6', + :kernel => 'Linux', + :id => 'root', + :concat_basedir => '/dne', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :facts do default_facts end + it { should contain_class("apache") } + it { should contain_class("apache::mod::fastcgi") } + it { should contain_file("fastcgi-pool-#{title}.conf").with( + :ensure => 'present', + :path => "/etc/httpd/conf.d/fastcgi-pool-#{title}.conf" + ) } + end + context "on Debian based systems" do + let :default_facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :lsbdistcodename => 'squeeze', + :kernel => 'Linux', + :id => 'root', + :concat_basedir => '/dne', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :facts do default_facts end + it { should contain_class("apache") } + it { should contain_class("apache::mod::fastcgi") } + it { should contain_file("fastcgi-pool-#{title}.conf").with( + :ensure => 'present', + :path => "/etc/apache2/conf.d/fastcgi-pool-#{title}.conf" + ) } + end + context "on FreeBSD systems" do + let :default_facts do + { + :osfamily => 'FreeBSD', + :operatingsystem => 'FreeBSD', + :operatingsystemrelease => '9', + :kernel => 'FreeBSD', + :id => 'root', + :concat_basedir => '/dne', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :facts do default_facts end + it { should contain_class("apache") } + it { should contain_class("apache::mod::fastcgi") } + it { should contain_file("fastcgi-pool-#{title}.conf").with( + :ensure => 'present', + :path => "/usr/local/etc/apache24/Includes/fastcgi-pool-#{title}.conf" + ) } + end + context "on Gentoo systems" do + let :default_facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :kernel => 'Linux', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + let :facts do default_facts end + it { should contain_class("apache") } + it { should contain_class("apache::mod::fastcgi") } + it { should contain_file("fastcgi-pool-#{title}.conf").with( + :ensure => 'present', + :path => "/etc/apache2/conf.d/fastcgi-pool-#{title}.conf" + ) } + end + end + describe 'os-independent items' do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :lsbdistcodename => 'squeeze', + :kernel => 'Linux', + :id => 'root', + :concat_basedir => '/dne', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + describe ".conf content using TCP communication" do + let :params do + { + :host => '127.0.0.1:9001', + :timeout => 30, + :flush => true, + :faux_path => '/var/www/php-www.fcgi', + :fcgi_alias => '/php-www.fcgi', + :file_type => 'application/x-httpd-php', + :pass_header => 'Authorization' + } + end + let :expected do +'FastCGIExternalServer /var/www/php-www.fcgi -idle-timeout 30 -flush -host 127.0.0.1:9001 -pass-header Authorization +Alias /php-www.fcgi /var/www/php-www.fcgi +Action application/x-httpd-php /php-www.fcgi +' + end + it do + should contain_file("fastcgi-pool-www.conf").with_content(expected) + end + end + describe ".conf content using socket communication" do + let :params do + { + :host => '/var/run/fcgi.sock', + :timeout => 30, + :flush => true, + :faux_path => '/var/www/php-www.fcgi', + :fcgi_alias => '/php-www.fcgi', + :file_type => 'application/x-httpd-php' + } + end + let :expected do +'FastCGIExternalServer /var/www/php-www.fcgi -idle-timeout 30 -flush -socket /var/run/fcgi.sock +Alias /php-www.fcgi /var/www/php-www.fcgi +Action application/x-httpd-php /php-www.fcgi +' + end + it do + should contain_file("fastcgi-pool-www.conf").with_content(expected) + end + end + + end +end diff --git a/environments/production/modules/apache/spec/defines/mod_spec.rb b/environments/production/modules/apache/spec/defines/mod_spec.rb new file mode 100644 index 0000000..1697190 --- /dev/null +++ b/environments/production/modules/apache/spec/defines/mod_spec.rb @@ -0,0 +1,166 @@ +require 'spec_helper' + +describe 'apache::mod', :type => :define do + let :pre_condition do + 'include apache' + end + context "on a RedHat osfamily" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + describe "for non-special modules" do + let :title do + 'spec_m' + end + it { is_expected.to contain_class("apache::params") } + it "should manage the module load file" do + is_expected.to contain_file('spec_m.load').with({ + :path => '/etc/httpd/conf.d/spec_m.load', + :content => "LoadModule spec_m_module modules/mod_spec_m.so\n", + :owner => 'root', + :group => 'root', + :mode => '0644', + } ) + end + end + + describe "with file_mode set" do + let :pre_condition do + "class {'::apache': file_mode => '0640'}" + end + let :title do + 'spec_m' + end + it "should manage the module load file" do + is_expected.to contain_file('spec_m.load').with({ + :mode => '0640', + } ) + end + end + + describe "with shibboleth module and package param passed" do + # name/title for the apache::mod define + let :title do + 'xsendfile' + end + # parameters + let(:params) { {:package => 'mod_xsendfile'} } + + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_package('mod_xsendfile') } + end + end + + context "on a Debian osfamily" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + describe "for non-special modules" do + let :title do + 'spec_m' + end + it { is_expected.to contain_class("apache::params") } + it "should manage the module load file" do + is_expected.to contain_file('spec_m.load').with({ + :path => '/etc/apache2/mods-available/spec_m.load', + :content => "LoadModule spec_m_module /usr/lib/apache2/modules/mod_spec_m.so\n", + :owner => 'root', + :group => 'root', + :mode => '0644', + } ) + end + it "should link the module load file" do + is_expected.to contain_file('spec_m.load symlink').with({ + :path => '/etc/apache2/mods-enabled/spec_m.load', + :target => '/etc/apache2/mods-available/spec_m.load', + :owner => 'root', + :group => 'root', + :mode => '0644', + } ) + end + end + end + + context "on a FreeBSD osfamily" do + let :facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + + describe "for non-special modules" do + let :title do + 'spec_m' + end + it { is_expected.to contain_class("apache::params") } + it "should manage the module load file" do + is_expected.to contain_file('spec_m.load').with({ + :path => '/usr/local/etc/apache24/Modules/spec_m.load', + :content => "LoadModule spec_m_module /usr/local/libexec/apache24/mod_spec_m.so\n", + :owner => 'root', + :group => 'wheel', + :mode => '0644', + } ) + end + end + end + + context "on a Gentoo osfamily" do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + + describe "for non-special modules" do + let :title do + 'spec_m' + end + it { is_expected.to contain_class("apache::params") } + it "should manage the module load file" do + is_expected.to contain_file('spec_m.load').with({ + :path => '/etc/apache2/modules.d/spec_m.load', + :content => "LoadModule spec_m_module /usr/lib/apache2/modules/mod_spec_m.so\n", + :owner => 'root', + :group => 'wheel', + :mode => '0644', + } ) + end + end + end +end diff --git a/environments/production/modules/apache/spec/defines/modsec_link_spec.rb b/environments/production/modules/apache/spec/defines/modsec_link_spec.rb new file mode 100644 index 0000000..a5b4c53 --- /dev/null +++ b/environments/production/modules/apache/spec/defines/modsec_link_spec.rb @@ -0,0 +1,53 @@ +require 'spec_helper' + +describe 'apache::security::rule_link', :type => :define do + let :pre_condition do + 'class { "apache": } + class { "apache::mod::security": activated_rules => [] } + ' + end + + let :title do + 'base_rules/modsecurity_35_bad_robots.data' + end + + context "on RedHat based systems" do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'CentOS', + :operatingsystemrelease => '7', + :kernel => 'Linux', + :id => 'root', + :concat_basedir => '/', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + it { should contain_file('modsecurity_35_bad_robots.data').with( + :path => '/etc/httpd/modsecurity.d/activated_rules/modsecurity_35_bad_robots.data', + :target => '/usr/lib/modsecurity.d/base_rules/modsecurity_35_bad_robots.data' + ) } + end + + context "on Debian based systems" do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/', + :lsbdistcodename => 'squeeze', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :kernel => 'Linux', + :is_pe => false, + } + end + it { should contain_file('modsecurity_35_bad_robots.data').with( + :path => '/etc/modsecurity/activated_rules/modsecurity_35_bad_robots.data', + :target => '/usr/share/modsecurity-crs/base_rules/modsecurity_35_bad_robots.data' + ) } + end + +end diff --git a/environments/production/modules/apache/spec/defines/vhost_custom_spec.rb b/environments/production/modules/apache/spec/defines/vhost_custom_spec.rb new file mode 100644 index 0000000..804be86 --- /dev/null +++ b/environments/production/modules/apache/spec/defines/vhost_custom_spec.rb @@ -0,0 +1,99 @@ +require 'spec_helper' + +describe 'apache::vhost::custom', :type => :define do + let :title do + 'rspec.example.com' + end + let :default_params do + { + :content => 'foobar' + } + end + describe 'os-dependent items' do + context "on RedHat based systems" do + let :default_facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :operatingsystem => 'RedHat', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :params do default_params end + let :facts do default_facts end + end + context "on Debian based systems" do + let :default_facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :params do default_params end + let :facts do default_facts end + it { is_expected.to contain_file("apache_rspec.example.com").with( + :ensure => 'present', + :content => 'foobar', + :path => '/etc/apache2/sites-available/25-rspec.example.com.conf', + ) } + it { is_expected.to contain_file("25-rspec.example.com.conf symlink").with( + :ensure => 'link', + :path => '/etc/apache2/sites-enabled/25-rspec.example.com.conf', + :target => '/etc/apache2/sites-available/25-rspec.example.com.conf' + ) } + end + context "on FreeBSD systems" do + let :default_facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :operatingsystem => 'FreeBSD', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :params do default_params end + let :facts do default_facts end + it { is_expected.to contain_file("apache_rspec.example.com").with( + :ensure => 'present', + :content => 'foobar', + :path => '/usr/local/etc/apache24/Vhosts/25-rspec.example.com.conf', + ) } + end + context "on Gentoo systems" do + let :default_facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + let :params do default_params end + let :facts do default_facts end + it { is_expected.to contain_file("apache_rspec.example.com").with( + :ensure => 'present', + :content => 'foobar', + :path => '/etc/apache2/vhosts.d/25-rspec.example.com.conf', + ) } + end + end +end diff --git a/environments/production/modules/apache/spec/defines/vhost_spec.rb b/environments/production/modules/apache/spec/defines/vhost_spec.rb new file mode 100644 index 0000000..3fd94bd --- /dev/null +++ b/environments/production/modules/apache/spec/defines/vhost_spec.rb @@ -0,0 +1,1311 @@ +require 'spec_helper' + +describe 'apache::vhost', :type => :define do + let :pre_condition do + 'class { "apache": default_vhost => false, default_mods => false, vhost_enable_dir => "/etc/apache2/sites-enabled"}' + end + let :title do + 'rspec.example.com' + end + let :default_params do + { + :docroot => '/rspec/docroot', + :port => '84', + } + end + describe 'os-dependent items' do + context "on RedHat based systems" do + let :default_facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :params do default_params end + let :facts do default_facts end + it { is_expected.to contain_class("apache") } + it { is_expected.to contain_class("apache::params") } + end + context "on Debian based systems" do + let :default_facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :params do default_params end + let :facts do default_facts end + it { is_expected.to contain_class("apache") } + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_concat("25-rspec.example.com.conf").with( + :ensure => 'present', + :path => '/etc/apache2/sites-available/25-rspec.example.com.conf' + ) } + it { is_expected.to contain_file("25-rspec.example.com.conf symlink").with( + :ensure => 'link', + :path => '/etc/apache2/sites-enabled/25-rspec.example.com.conf', + :target => '/etc/apache2/sites-available/25-rspec.example.com.conf' + ) } + end + context "on FreeBSD systems" do + let :default_facts do + { + :osfamily => 'FreeBSD', + :operatingsystemrelease => '9', + :concat_basedir => '/dne', + :operatingsystem => 'FreeBSD', + :id => 'root', + :kernel => 'FreeBSD', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + let :params do default_params end + let :facts do default_facts end + it { is_expected.to contain_class("apache") } + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_concat("25-rspec.example.com.conf").with( + :ensure => 'present', + :path => '/usr/local/etc/apache24/Vhosts/25-rspec.example.com.conf' + ) } + end + context "on Gentoo systems" do + let :default_facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => '3.16.1-gentoo', + :concat_basedir => '/dne', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin', + :is_pe => false, + } + end + let :params do default_params end + let :facts do default_facts end + it { is_expected.to contain_class("apache") } + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_concat("25-rspec.example.com.conf").with( + :ensure => 'present', + :path => '/etc/apache2/vhosts.d/25-rspec.example.com.conf' + ) } + end + end + describe 'os-independent items' do + let :facts do + { + :osfamily => 'Debian', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :lsbdistcodename => 'squeeze', + :operatingsystem => 'Debian', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + describe 'basic assumptions' do + let :params do default_params end + it { is_expected.to contain_class("apache") } + it { is_expected.to contain_class("apache::params") } + it { is_expected.to contain_apache__listen(params[:port]) } + it { is_expected.to contain_apache__namevirtualhost("*:#{params[:port]}") } + end + context 'set everything!' do + let :params do + { + 'docroot' => '/var/www/foo', + 'manage_docroot' => false, + 'virtual_docroot' => true, + 'port' => '8080', + 'ip' => '127.0.0.1', + 'ip_based' => true, + 'add_listen' => false, + 'docroot_owner' => 'user', + 'docroot_group' => 'wheel', + 'docroot_mode' => '0664', + 'serveradmin' => 'foo@localhost', + 'ssl' => true, + 'ssl_cert' => '/ssl/cert', + 'ssl_key' => '/ssl/key', + 'ssl_chain' => '/ssl/chain', + 'ssl_crl_path' => '/ssl/crl', + 'ssl_crl' => 'foo.crl', + 'ssl_certs_dir' => '/ssl/certs', + 'ssl_protocol' => 'SSLv2', + 'ssl_cipher' => 'HIGH', + 'ssl_honorcipherorder' => 'Off', + 'ssl_verify_client' => 'optional', + 'ssl_verify_depth' => '3', + 'ssl_options' => '+ExportCertData', + 'ssl_openssl_conf_cmd' => 'DHParameters "foo.pem"', + 'ssl_proxy_verify' => 'require', + 'ssl_proxy_check_peer_cn' => 'on', + 'ssl_proxy_check_peer_name' => 'on', + 'ssl_proxy_check_peer_expire' => 'on', + 'ssl_proxyengine' => true, + 'ssl_proxy_protocol' => 'TLSv1.2', + + 'priority' => '30', + 'default_vhost' => true, + 'servername' => 'example.com', + 'serveraliases' => ['test-example.com'], + 'options' => ['MultiView'], + 'override' => ['All'], + 'directoryindex' => 'index.html', + 'vhost_name' => 'test', + 'logroot' => '/var/www/logs', + 'logroot_ensure' => 'directory', + 'logroot_mode' => '0600', + 'logroot_owner' => 'root', + 'logroot_group' => 'root', + 'log_level' => 'crit', + 'access_log' => false, + 'access_log_file' => 'httpd_access_log', + 'access_log_syslog' => true, + 'access_log_format' => '%h %l %u %t \"%r\" %>s %b', + 'access_log_env_var' => '', + 'aliases' => '/image', + 'directories' => [ + { + 'path' => '/var/www/files', + 'provider' => 'files', + 'require' => [ 'valid-user', 'all denied', ], + }, + { + 'path' => '/var/www/files', + 'provider' => 'files', + 'additional_includes' => [ '/custom/path/includes', '/custom/path/another_includes', ], + }, + { + 'path' => '/var/www/files', + 'provider' => 'files', + 'require' => 'all granted', + }, + { + 'path' => '/var/www/files', + 'provider' => 'files', + 'require' => + { + 'enforce' => 'all', + 'requires' => ['all-valid1', 'all-valid2'], + }, + }, + { + 'path' => '/var/www/files', + 'provider' => 'files', + 'require' => + { + 'enforce' => 'none', + 'requires' => ['none-valid1', 'none-valid2'], + }, + }, + { + 'path' => '/var/www/files', + 'provider' => 'files', + 'require' => + { + 'enforce' => 'any', + 'requires' => ['any-valid1', 'any-valid2'], + }, + }, + { + 'path' => '*', + 'provider' => 'proxy', + }, + { 'path' => '/var/www/files/indexed_directory', + 'directoryindex' => 'disabled', + 'options' => ['Indexes','FollowSymLinks','MultiViews'], + 'index_options' => ['FancyIndexing'], + 'index_style_sheet' => '/styles/style.css', + }, + { 'path' => '/var/www/files/output_filtered', + 'set_output_filter' => 'output_filter', + }, + { 'path' => '/var/www/files', + 'provider' => 'location', + 'limit' => [ + { 'methods' => 'GET HEAD', + 'require' => ['valid-user'] + }, + ], + }, + { 'path' => '/var/www/dav', + 'dav' => 'filesystem', + 'dav_depth_infinity' => true, + 'dav_min_timeout' => '600', + }, + ], + 'error_log' => false, + 'error_log_file' => 'httpd_error_log', + 'error_log_syslog' => true, + 'error_documents' => 'true', + 'fallbackresource' => '/index.php', + 'scriptalias' => '/usr/lib/cgi-bin', + 'scriptaliases' => [ + { + 'alias' => '/myscript', + 'path' => '/usr/share/myscript', + }, + { + 'aliasmatch' => '^/foo(.*)', + 'path' => '/usr/share/fooscripts$1', + }, + ], + 'proxy_dest' => '/', + 'proxy_pass' => [ + { + 'path' => '/a', + 'url' => 'http://backend-a/', + 'keywords' => ['noquery', 'interpolate'], + 'no_proxy_uris' => ['/a/foo', '/a/bar'], + 'no_proxy_uris_match' => ['/a/foomatch'], + 'reverse_cookies' => [ + { + 'path' => '/a', + 'url' => 'http://backend-a/', + }, + { + 'domain' => 'foo', + 'url' => 'http://foo', + } + ], + 'params' => { + 'retry' => '0', + 'timeout' => '5' + }, + 'setenv' => ['proxy-nokeepalive 1','force-proxy-request-1.0 1'], + } + ], + 'proxy_pass_match' => [ + { + 'path' => '/a', + 'url' => 'http://backend-a/', + 'keywords' => ['noquery', 'interpolate'], + 'no_proxy_uris' => ['/a/foo', '/a/bar'], + 'no_proxy_uris_match' => ['/a/foomatch'], + 'params' => { + 'retry' => '0', + 'timeout' => '5' + }, + 'setenv' => ['proxy-nokeepalive 1','force-proxy-request-1.0 1'], + } + ], + 'suphp_addhandler' => 'foo', + 'suphp_engine' => 'on', + 'suphp_configpath' => '/var/www/html', + 'php_admin_flags' => ['foo', 'bar'], + 'php_admin_values' => ['true', 'false'], + 'no_proxy_uris' => '/foo', + 'no_proxy_uris_match' => '/foomatch', + 'proxy_preserve_host' => true, + 'proxy_add_headers' => true, + 'proxy_error_override' => true, + 'redirect_source' => '/bar', + 'redirect_dest' => '/', + 'redirect_status' => 'temp', + 'redirectmatch_status' => ['404'], + 'redirectmatch_regexp' => ['\.git$'], + 'redirectmatch_dest' => ['http://www.example.com'], + 'rack_base_uris' => ['/rackapp1'], + 'passenger_base_uris' => ['/passengerapp1'], + 'headers' => 'Set X-Robots-Tag "noindex, noarchive, nosnippet"', + 'request_headers' => ['append MirrorID "mirror 12"'], + 'rewrites' => [ + { + 'rewrite_rule' => ['^index\.html$ welcome.html'] + } + ], + 'filters' => [ + 'FilterDeclare COMPRESS', + 'FilterProvider COMPRESS DEFLATE resp=Content-Type $text/html', + 'FilterProvider COMPRESS DEFLATE resp=Content-Type $text/css', + 'FilterProvider COMPRESS DEFLATE resp=Content-Type $text/plain', + 'FilterProvider COMPRESS DEFLATE resp=Content-Type $text/xml', + 'FilterChain COMPRESS', + 'FilterProtocol COMPRESS DEFLATE change=yes;byteranges=no', + ], + 'rewrite_base' => '/', + 'rewrite_rule' => '^index\.html$ welcome.html', + 'rewrite_cond' => '%{HTTP_USER_AGENT} ^MSIE', + 'rewrite_inherit' => true, + 'setenv' => ['FOO=/bin/true'], + 'setenvif' => 'Request_URI "\.gif$" object_is_image=gif', + 'setenvifnocase' => 'REMOTE_ADDR ^127.0.0.1 localhost=true', + 'block' => 'scm', + 'wsgi_application_group' => '%{GLOBAL}', + 'wsgi_daemon_process' => 'wsgi', + 'wsgi_daemon_process_options' => { + 'processes' => '2', + 'threads' => '15', + 'display-name' => '%{GROUP}', + }, + 'wsgi_import_script' => '/var/www/demo.wsgi', + 'wsgi_import_script_options' => { + 'process-group' => 'wsgi', + 'application-group' => '%{GLOBAL}' + }, + 'wsgi_process_group' => 'wsgi', + 'wsgi_script_aliases' => { + '/' => '/var/www/demo.wsgi' + }, + 'wsgi_script_aliases_match' => { + '^/test/(^[/*)' => '/var/www/demo.wsgi' + }, + 'wsgi_pass_authorization' => 'On', + 'custom_fragment' => '#custom string', + 'itk' => { + 'user' => 'someuser', + 'group' => 'somegroup' + }, + 'wsgi_chunked_request' => 'On', + 'action' => 'foo', + 'fastcgi_server' => 'localhost', + 'fastcgi_socket' => '/tmp/fastcgi.socket', + 'fastcgi_dir' => '/tmp', + 'fastcgi_idle_timeout' => '120', + 'additional_includes' => '/custom/path/includes', + 'apache_version' => '2.4', + 'use_optional_includes' => true, + 'suexec_user_group' => 'root root', + 'allow_encoded_slashes' => 'nodecode', + 'passenger_app_root' => '/usr/share/myapp', + 'passenger_app_env' => 'test', + 'passenger_ruby' => '/usr/bin/ruby1.9.1', + 'passenger_min_instances' => '1', + 'passenger_start_timeout' => '600', + 'passenger_pre_start' => 'http://localhost/myapp', + 'passenger_high_performance' => true, + 'passenger_user' => 'sandbox', + 'passenger_nodejs' => '/usr/bin/node', + 'passenger_sticky_sessions' => true, + 'passenger_startup_file' => 'bin/www', + 'add_default_charset' => 'UTF-8', + 'jk_mounts' => [ + { 'mount' => '/*', 'worker' => 'tcnode1', }, + { 'unmount' => '/*.jpg', 'worker' => 'tcnode1', }, + ], + 'auth_kerb' => true, + 'krb_method_negotiate' => 'off', + 'krb_method_k5passwd' => 'off', + 'krb_authoritative' => 'off', + 'krb_auth_realms' => ['EXAMPLE.ORG','EXAMPLE.NET'], + 'krb_5keytab' => '/tmp/keytab5', + 'krb_local_user_mapping' => 'off', + 'keepalive' => 'on', + 'keepalive_timeout' => '100', + 'max_keepalive_requests' => '1000', + } + end + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '7', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :kernelversion => '3.6.2', + :is_pe => false, + } + end + + it { is_expected.to compile } + it { is_expected.to_not contain_file('/var/www/foo') } + it { is_expected.to contain_class('apache::mod::ssl') } + it { is_expected.to contain_file('ssl.conf').with( + :content => /^\s+SSLHonorCipherOrder On$/ ) } + it { is_expected.to contain_file('ssl.conf').with( + :content => /^\s+SSLPassPhraseDialog builtin$/ ) } + it { is_expected.to contain_file('ssl.conf').with( + :content => /^\s+SSLSessionCacheTimeout 300$/ ) } + it { is_expected.to contain_class('apache::mod::mime') } + it { is_expected.to contain_class('apache::mod::vhost_alias') } + it { is_expected.to contain_class('apache::mod::wsgi') } + it { is_expected.to contain_class('apache::mod::suexec') } + it { is_expected.to contain_class('apache::mod::passenger') } + it { is_expected.to contain_file('/var/www/logs').with({ + 'ensure' => 'directory', + 'mode' => '0600', + }) + } + it { is_expected.to contain_class('apache::mod::rewrite') } + it { is_expected.to contain_class('apache::mod::alias') } + it { is_expected.to contain_class('apache::mod::proxy') } + it { is_expected.to contain_class('apache::mod::proxy_http') } + it { is_expected.to contain_class('apache::mod::passenger') } + it { is_expected.to contain_class('apache::mod::passenger') } + it { is_expected.to contain_class('apache::mod::fastcgi') } + it { is_expected.to contain_class('apache::mod::headers') } + it { is_expected.to contain_class('apache::mod::filter') } + it { is_expected.to contain_class('apache::mod::env') } + it { is_expected.to contain_class('apache::mod::setenvif') } + it { is_expected.to contain_concat('30-rspec.example.com.conf').with({ + 'owner' => 'root', + 'mode' => '0644', + 'require' => 'Package[httpd]', + 'notify' => 'Class[Apache::Service]', + }) + } + it { is_expected.to contain_file('30-rspec.example.com.conf symlink').with({ + 'ensure' => 'link', + 'path' => '/etc/apache2/sites-enabled/30-rspec.example.com.conf', + }) + } + it { is_expected.to contain_concat__fragment('rspec.example.com-apache-header') } + it { is_expected.to contain_concat__fragment('rspec.example.com-docroot') } + it { is_expected.to contain_concat__fragment('rspec.example.com-aliases') } + it { is_expected.to contain_concat__fragment('rspec.example.com-itk') } + it { is_expected.to contain_concat__fragment('rspec.example.com-fallbackresource') } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories') } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Include\s'\/custom\/path\/includes'$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Include\s'\/custom\/path\/another_includes'$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Require valid-user$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Require all denied$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Require all granted$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+<\/RequireAll>$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Require all-valid1$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Require all-valid2$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+<\/RequireNone>$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Require none-valid1$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Require none-valid2$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+<\/RequireAny>$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Require any-valid1$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Require any-valid2$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Options\sIndexes\sFollowSymLinks\sMultiViews$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+IndexOptions\sFancyIndexing$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+IndexStyleSheet\s'\/styles\/style\.css'$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+DirectoryIndex\sdisabled$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+SetOutputFilter\soutput_filter$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /\s+\s*Require valid-user\s*<\/Limit>/m ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Dav\sfilesystem$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+DavDepthInfinity\sOn$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+DavMinTimeout\s600$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-additional_includes') } + it { is_expected.to contain_concat__fragment('rspec.example.com-logging') } + it { is_expected.to contain_concat__fragment('rspec.example.com-serversignature') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-access_log') } + it { is_expected.to contain_concat__fragment('rspec.example.com-action') } + it { is_expected.to contain_concat__fragment('rspec.example.com-block') } + it { is_expected.to contain_concat__fragment('rspec.example.com-error_document') } + it { is_expected.to contain_concat__fragment('rspec.example.com-proxy').with_content( + /retry=0/) } + it { is_expected.to contain_concat__fragment('rspec.example.com-proxy').with_content( + /timeout=5/) } + it { is_expected.to contain_concat__fragment('rspec.example.com-proxy').with_content( + /SetEnv force-proxy-request-1.0 1/) } + it { is_expected.to contain_concat__fragment('rspec.example.com-proxy').with_content( + /SetEnv proxy-nokeepalive 1/) } + it { is_expected.to contain_concat__fragment('rspec.example.com-proxy').with_content( + /noquery interpolate/) } + it { is_expected.to contain_concat__fragment('rspec.example.com-proxy').with_content( + /ProxyPreserveHost On/) } + it { is_expected.to contain_concat__fragment('rspec.example.com-proxy').with_content( + /ProxyAddHeaders On/) } + it { is_expected.to contain_concat__fragment('rspec.example.com-proxy').with_content( + /ProxyPassReverseCookiePath\s+\/a\s+http:\/\//) } + it { is_expected.to contain_concat__fragment('rspec.example.com-proxy').with_content( + /ProxyPassReverseCookieDomain\s+foo\s+http:\/\/foo/) } + it { is_expected.to contain_concat__fragment('rspec.example.com-rack') } + it { is_expected.to contain_concat__fragment('rspec.example.com-redirect') } + it { is_expected.to contain_concat__fragment('rspec.example.com-rewrite') } + it { is_expected.to contain_concat__fragment('rspec.example.com-rewrite').with( + :content => /^\s+RewriteOptions Inherit$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-scriptalias') } + it { is_expected.to contain_concat__fragment('rspec.example.com-serveralias') } + it { is_expected.to contain_concat__fragment('rspec.example.com-setenv').with_content( + %r{SetEnv FOO=/bin/true}) } + it { is_expected.to contain_concat__fragment('rspec.example.com-setenv').with_content( + %r{SetEnvIf Request_URI "\\.gif\$" object_is_image=gif}) } + it { is_expected.to contain_concat__fragment('rspec.example.com-setenv').with_content( + %r{SetEnvIfNoCase REMOTE_ADDR \^127.0.0.1 localhost=true}) } + it { is_expected.to contain_concat__fragment('rspec.example.com-ssl') } + it { is_expected.to contain_concat__fragment('rspec.example.com-ssl').with( + :content => /^\s+SSLOpenSSLConfCmd\s+DHParameters "foo.pem"$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-sslproxy') } + it { is_expected.to contain_concat__fragment('rspec.example.com-sslproxy').with( + :content => /^\s+SSLProxyEngine On$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-sslproxy').with( + :content => /^\s+SSLProxyCheckPeerCN\s+on$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-sslproxy').with( + :content => /^\s+SSLProxyCheckPeerName\s+on$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-sslproxy').with( + :content => /^\s+SSLProxyCheckPeerExpire\s+on$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-sslproxy').with( + :content => /^\s+SSLProxyProtocol\s+TLSv1.2$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-suphp') } + it { is_expected.to contain_concat__fragment('rspec.example.com-php_admin') } + it { is_expected.to contain_concat__fragment('rspec.example.com-header') } + it { is_expected.to contain_concat__fragment('rspec.example.com-filters').with( + :content => /^\s+FilterDeclare COMPRESS$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-requestheader') } + it { is_expected.to contain_concat__fragment('rspec.example.com-wsgi') } + it { is_expected.to contain_concat__fragment('rspec.example.com-custom_fragment') } + it { is_expected.to contain_concat__fragment('rspec.example.com-fastcgi') } + it { is_expected.to contain_concat__fragment('rspec.example.com-suexec') } + it { is_expected.to contain_concat__fragment('rspec.example.com-allow_encoded_slashes') } + it { is_expected.to contain_concat__fragment('rspec.example.com-passenger') } + it { is_expected.to contain_concat__fragment('rspec.example.com-charsets') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-security') } + it { is_expected.to contain_concat__fragment('rspec.example.com-file_footer') } + it { is_expected.to contain_concat__fragment('rspec.example.com-jk_mounts').with( + :content => /^\s+JkMount\s+\/\*\s+tcnode1$/)} + it { is_expected.to contain_concat__fragment('rspec.example.com-jk_mounts').with( + :content => /^\s+JkUnMount\s+\/\*\.jpg\s+tcnode1$/)} + it { is_expected.to contain_concat__fragment('rspec.example.com-auth_kerb').with( + :content => /^\s+KrbMethodNegotiate\soff$/)} + it { is_expected.to contain_concat__fragment('rspec.example.com-auth_kerb').with( + :content => /^\s+KrbAuthoritative\soff$/)} + it { is_expected.to contain_concat__fragment('rspec.example.com-auth_kerb').with( + :content => /^\s+KrbAuthRealms\sEXAMPLE.ORG\sEXAMPLE.NET$/)} + it { is_expected.to contain_concat__fragment('rspec.example.com-auth_kerb').with( + :content => /^\s+Krb5Keytab\s\/tmp\/keytab5$/)} + it { is_expected.to contain_concat__fragment('rspec.example.com-auth_kerb').with( + :content => /^\s+KrbLocalUserMapping\soff$/)} + it { is_expected.to contain_concat__fragment('rspec.example.com-auth_kerb').with( + :content => /^\s+KrbServiceName\sHTTP$/)} + it { is_expected.to contain_concat__fragment('rspec.example.com-auth_kerb').with( + :content => /^\s+KrbSaveCredentials\soff$/)} + it { is_expected.to contain_concat__fragment('rspec.example.com-auth_kerb').with( + :content => /^\s+KrbVerifyKDC\son$/)} + it { is_expected.to contain_concat__fragment('rspec.example.com-keepalive_options').with( + :content => /^\s+KeepAlive\son$/)} + it { is_expected.to contain_concat__fragment('rspec.example.com-keepalive_options').with( + :content => /^\s+KeepAliveTimeout\s100$/)} + it { is_expected.to contain_concat__fragment('rspec.example.com-keepalive_options').with( + :content => /^\s+MaxKeepAliveRequests\s1000$/)} + end + context 'vhost with multiple ip addresses' do + let :params do + { + 'port' => '80', + 'ip' => ['127.0.0.1','::1'], + 'ip_based' => true, + 'servername' => 'example.com', + 'docroot' => '/var/www/html', + 'add_listen' => true, + 'ensure' => 'present' + } + end + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '7', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :kernelversion => '3.6.2', + :is_pe => false, + } + end + + it { is_expected.to compile } + it { is_expected.to contain_concat__fragment('rspec.example.com-apache-header').with( + :content => /[.\/m]*[.\/m]*$/ ) } + it { is_expected.to contain_concat__fragment('Listen 127.0.0.1:80') } + it { is_expected.to contain_concat__fragment('Listen [::1]:80') } + it { is_expected.to_not contain_concat__fragment('NameVirtualHost 127.0.0.1:80') } + it { is_expected.to_not contain_concat__fragment('NameVirtualHost [::1]:80') } + end + + context 'vhost with ipv6 address' do + let :params do + { + 'port' => '80', + 'ip' => '::1', + 'ip_based' => true, + 'servername' => 'example.com', + 'docroot' => '/var/www/html', + 'add_listen' => true, + 'ensure' => 'present' + } + end + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '7', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :kernelversion => '3.6.2', + :is_pe => false, + } + end + + it { is_expected.to compile } + it { is_expected.to contain_concat__fragment('rspec.example.com-apache-header').with( + :content => /[.\/m]*[.\/m]*$/ ) } + it { is_expected.to contain_concat__fragment('Listen [::1]:80') } + it { is_expected.to_not contain_concat__fragment('NameVirtualHost [::1]:80') } + end + + context 'vhost with wildcard ip address' do + let :params do + { + 'port' => '80', + 'ip' => '*', + 'ip_based' => true, + 'servername' => 'example.com', + 'docroot' => '/var/www/html', + 'add_listen' => true, + 'ensure' => 'present' + } + end + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '7', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :kernelversion => '3.6.2', + :is_pe => false, + } + end + + it { is_expected.to compile } + it { is_expected.to contain_concat__fragment('rspec.example.com-apache-header').with( + :content => /[.\/m]*[.\/m]*$/ ) } + it { is_expected.to contain_concat__fragment('Listen *:80') } + it { is_expected.to_not contain_concat__fragment('NameVirtualHost *:80') } + end + + context 'modsec_audit_log' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'modsec_audit_log' => true, + } + end + it { is_expected.to compile } + it { is_expected.to contain_concat__fragment('rspec.example.com-security').with( + :content => /^\s*SecAuditLog "\/var\/log\/apache2\/rspec\.example\.com_security\.log"$/ ) } + end + context 'modsec_audit_log_file' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'modsec_audit_log_file' => 'foo.log', + } + end + it { is_expected.to compile } + it { is_expected.to contain_concat__fragment('rspec.example.com-security').with( + :content => /\s*SecAuditLog "\/var\/log\/apache2\/foo.log"$/ ) } + end + context 'set only aliases' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'aliases' => [ + { + 'alias' => '/alias', + 'path' => '/rspec/docroot', + }, + ] + } + end + it { is_expected.to contain_class('apache::mod::alias')} + end + context 'proxy_pass_match' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'proxy_pass_match' => [ + { + 'path' => '.*', + 'url' => 'http://backend-a/', + 'params' => { 'timeout' => 300 }, + } + ], + } + end + it { is_expected.to contain_concat__fragment('rspec.example.com-proxy').with_content( + /ProxyPassMatch .* http:\/\/backend-a\/ timeout=300/).with_content(/## Proxy rules/) } + end + context 'proxy_dest_match' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'proxy_dest_match' => '/' + } + end + it { is_expected.to contain_concat__fragment('rspec.example.com-proxy').with_content(/## Proxy rules/) } + end + context 'not everything can be set together...' do + let :params do + { + 'access_log_pipe' => '/dev/null', + 'error_log_pipe' => '/dev/null', + 'docroot' => '/var/www/foo', + 'ensure' => 'absent', + 'manage_docroot' => true, + 'logroot' => '/tmp/logroot', + 'logroot_ensure' => 'absent', + 'directories' => [ + { + 'path' => '/var/www/files', + 'provider' => 'files', + 'allow' => [ 'from 127.0.0.1', 'from 127.0.0.2', ], + 'deny' => [ 'from 127.0.0.3', 'from 127.0.0.4', ], + 'satisfy' => 'any', + }, + { + 'path' => '/var/www/foo', + 'provider' => 'files', + 'allow' => 'from 127.0.0.5', + 'deny' => 'from all', + 'order' => 'deny,allow', + }, + ], + + } + end + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :kernelversion => '3.6.2', + :is_pe => false, + } + end + + it { is_expected.to compile } + it { is_expected.to_not contain_class('apache::mod::ssl') } + it { is_expected.to_not contain_class('apache::mod::mime') } + it { is_expected.to_not contain_class('apache::mod::vhost_alias') } + it { is_expected.to_not contain_class('apache::mod::wsgi') } + it { is_expected.to_not contain_class('apache::mod::passenger') } + it { is_expected.to_not contain_class('apache::mod::suexec') } + it { is_expected.to_not contain_class('apache::mod::rewrite') } + it { is_expected.to_not contain_class('apache::mod::alias') } + it { is_expected.to_not contain_class('apache::mod::proxy') } + it { is_expected.to_not contain_class('apache::mod::proxy_http') } + it { is_expected.to_not contain_class('apache::mod::passenger') } + it { is_expected.to_not contain_class('apache::mod::headers') } + it { is_expected.to contain_file('/var/www/foo') } + it { is_expected.to contain_file('/tmp/logroot').with({ + 'ensure' => 'absent', + }) + } + it { is_expected.to contain_concat('25-rspec.example.com.conf').with({ + 'ensure' => 'absent', + }) + } + it { is_expected.to contain_concat__fragment('rspec.example.com-apache-header') } + it { is_expected.to contain_concat__fragment('rspec.example.com-docroot') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-aliases') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-itk') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-fallbackresource') } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories') } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Allow from 127\.0\.0\.1$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Allow from 127\.0\.0\.2$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Allow from 127\.0\.0\.5$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Deny from 127\.0\.0\.3$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Deny from 127\.0\.0\.4$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Deny from all$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Satisfy any$/ ) } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Order deny,allow$/ ) } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-additional_includes') } + it { is_expected.to contain_concat__fragment('rspec.example.com-logging') } + it { is_expected.to contain_concat__fragment('rspec.example.com-serversignature') } + it { is_expected.to contain_concat__fragment('rspec.example.com-access_log') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-action') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-block') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-error_document') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-proxy') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-rack') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-redirect') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-rewrite') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-scriptalias') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-serveralias') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-setenv') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-ssl') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-sslproxy') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-suphp') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-php_admin') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-header') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-requestheader') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-wsgi') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-custom_fragment') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-fastcgi') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-suexec') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-charsets') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-limits') } + it { is_expected.to contain_concat__fragment('rspec.example.com-file_footer') } + end + context 'when not setting nor managing the docroot' do + let :params do + { + 'docroot' => false, + 'manage_docroot' => false, + } + end + it { is_expected.to compile } + it { is_expected.not_to contain_concat__fragment('rspec.example.com-docroot') } + end + context 'ssl_proxyengine without ssl' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'ssl' => false, + 'ssl_proxyengine' => true, + } + end + it { is_expected.to compile } + it { is_expected.not_to contain_concat__fragment('rspec.example.com-ssl') } + it { is_expected.to contain_concat__fragment('rspec.example.com-sslproxy') } + end + context 'ssl_proxy_protocol without ssl_proxyengine' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'ssl' => true, + 'ssl_proxyengine' => false, + 'ssl_proxy_protocol' => 'TLSv1.2', + } + end + it { is_expected.to compile } + it { is_expected.to contain_concat__fragment('rspec.example.com-ssl') } + it { is_expected.not_to contain_concat__fragment('rspec.example.com-sslproxy') } + end + end + describe 'access logs' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context 'single log file' do + let(:params) do + { + 'docroot' => '/rspec/docroot', + 'access_log_file' => 'my_log_file', + } + end + it { is_expected.to contain_concat__fragment('rspec.example.com-access_log').with( + :content => /^\s+CustomLog.*my_log_file" combined\s*$/ + )} + end + context 'single log file with environment' do + let(:params) do + { + 'docroot' => '/rspec/docroot', + 'access_log_file' => 'my_log_file', + 'access_log_env_var' => 'prod' + } + end + it { is_expected.to contain_concat__fragment('rspec.example.com-access_log').with( + :content => /^\s+CustomLog.*my_log_file" combined\s+env=prod$/ + )} + end + context 'multiple log files' do + let(:params) do + { + 'docroot' => '/rspec/docroot', + 'access_logs' => [ + { 'file' => '/tmp/log1', 'env' => 'dev' }, + { 'file' => 'log2' }, + { 'syslog' => 'syslog', 'format' => '%h %l' } + ], + } + end + it { is_expected.to contain_concat__fragment('rspec.example.com-access_log').with( + :content => /^\s+CustomLog "\/tmp\/log1"\s+combined\s+env=dev$/ + )} + it { is_expected.to contain_concat__fragment('rspec.example.com-access_log').with( + :content => /^\s+CustomLog "\/var\/log\/httpd\/log2"\s+combined\s*$/ + )} + it { is_expected.to contain_concat__fragment('rspec.example.com-access_log').with( + :content => /^\s+CustomLog "syslog" "%h %l"\s*$/ + )} + end + end # access logs + describe 'validation' do + let :default_facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '6', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :is_pe => false, + } + end + context 'bad ensure' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'ensure' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad suphp_engine' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'suphp_engine' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad ip_based' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'ip_based' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad access_log' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'access_log' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad error_log' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'error_log' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad_ssl' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'ssl' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad default_vhost' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'default_vhost' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad ssl_proxyengine' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'ssl_proxyengine' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad rewrites' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'rewrites' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad rewrites 2' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'rewrites' => ['bogus'], + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'empty rewrites' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'rewrites' => [], + } + end + let :facts do default_facts end + it { is_expected.to compile } + end + context 'bad suexec_user_group' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'suexec_user_group' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad wsgi_script_alias' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'wsgi_script_alias' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad wsgi_daemon_process_options' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'wsgi_daemon_process_options' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad wsgi_import_script_alias' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'wsgi_import_script_alias' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad itk' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'itk' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad logroot_ensure' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'log_level' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad log_level' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'log_level' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'access_log_file and access_log_pipe' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'access_log_file' => 'bogus', + 'access_log_pipe' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'error_log_file and error_log_pipe' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'error_log_file' => 'bogus', + 'error_log_pipe' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad fallbackresource' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'fallbackresource' => 'bogus', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad custom_fragment' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'custom_fragment' => true, + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'bad access_logs' do + let :params do + { + 'docroot' => '/rspec/docroot', + 'access_logs' => '/var/log/somewhere', + } + end + let :facts do default_facts end + it { expect { is_expected.to compile }.to raise_error } + end + context 'default of require all granted' do + let :params do + { + 'docroot' => '/var/www/foo', + 'directories' => [ + { + 'path' => '/var/www/foo/files', + 'provider' => 'files', + }, + ], + + } + end + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '7', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :kernelversion => '3.19.2', + :is_pe => false, + } + end + + it { is_expected.to compile } + it { is_expected.to contain_concat('25-rspec.example.com.conf') } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories') } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Require all granted$/ ) } + end + context 'require unmanaged' do + let :params do + { + 'docroot' => '/var/www/foo', + 'directories' => [ + { + 'path' => '/var/www/foo', + 'require' => 'unmanaged', + }, + ], + + } + end + let :facts do + { + :osfamily => 'RedHat', + :operatingsystemrelease => '7', + :concat_basedir => '/dne', + :operatingsystem => 'RedHat', + :id => 'root', + :kernel => 'Linux', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :kernelversion => '3.19.2', + :is_pe => false, + } + end + + it { is_expected.to compile } + it { is_expected.to contain_concat('25-rspec.example.com.conf') } + it { is_expected.to contain_concat__fragment('rspec.example.com-directories') } + it { is_expected.to_not contain_concat__fragment('rspec.example.com-directories').with( + :content => /^\s+Require all granted$/ ) + } + end + end +end diff --git a/environments/production/modules/apache/spec/fixtures/files/negotiation.conf b/environments/production/modules/apache/spec/fixtures/files/negotiation.conf new file mode 100644 index 0000000..c0bb8b9 --- /dev/null +++ b/environments/production/modules/apache/spec/fixtures/files/negotiation.conf @@ -0,0 +1,4 @@ +# This is a file only for spec testing + +LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv zh-CN zh-TW +ForceLanguagePriority Prefer Fallback diff --git a/environments/production/modules/apache/spec/fixtures/files/spec b/environments/production/modules/apache/spec/fixtures/files/spec new file mode 100644 index 0000000..76e9a14 --- /dev/null +++ b/environments/production/modules/apache/spec/fixtures/files/spec @@ -0,0 +1 @@ +# This is a file only for spec testing diff --git a/environments/production/modules/apache/spec/fixtures/templates/negotiation.conf.erb b/environments/production/modules/apache/spec/fixtures/templates/negotiation.conf.erb new file mode 100644 index 0000000..5575022 --- /dev/null +++ b/environments/production/modules/apache/spec/fixtures/templates/negotiation.conf.erb @@ -0,0 +1,4 @@ +# This is a template only for spec testing + +LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv zh-CN zh-TW +ForceLanguagePriority Prefer Fallback diff --git a/environments/production/modules/apache/spec/spec_helper.rb b/environments/production/modules/apache/spec/spec_helper.rb new file mode 100644 index 0000000..22d5d68 --- /dev/null +++ b/environments/production/modules/apache/spec/spec_helper.rb @@ -0,0 +1,8 @@ +#This file is generated by ModuleSync, do not edit. +require 'puppetlabs_spec_helper/module_spec_helper' + +# put local configuration and setup into spec_helper_local +begin + require 'spec_helper_local' +rescue LoadError +end diff --git a/environments/production/modules/apache/spec/spec_helper_acceptance.rb b/environments/production/modules/apache/spec/spec_helper_acceptance.rb new file mode 100644 index 0000000..5d93612 --- /dev/null +++ b/environments/production/modules/apache/spec/spec_helper_acceptance.rb @@ -0,0 +1,82 @@ +require 'beaker-rspec/spec_helper' +require 'beaker-rspec/helpers/serverspec' +require 'beaker/puppet_install_helper' + +run_puppet_install_helper + +RSpec.configure do |c| + c.filter_run :focus => true + c.run_all_when_everything_filtered = true + # apache on Ubuntu 10.04 and 12.04 doesn't like IPv6 VirtualHosts, so we skip ipv6 tests on those systems + if fact('operatingsystem') == 'Ubuntu' and (fact('operatingsystemrelease') == '10.04' or fact('operatingsystemrelease') == '12.04') + c.filter_run_excluding :ipv6 => true + end + + # Project root + proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..')) + + # Readable test descriptions + c.formatter = :documentation + + # detect the situation where PUP-5016 is triggered and skip the idempotency tests in that case + # also note how fact('puppetversion') is not available because of PUP-4359 + if fact('osfamily') == 'Debian' && fact('operatingsystemmajrelease') == '8' && shell('puppet --version').stdout =~ /^4\.2/ + c.filter_run_excluding :skip_pup_5016 => true + end + + # Configure all nodes in nodeset + c.before :suite do + # net-tools required for netstat utility being used by be_listening + if fact('osfamily') == 'RedHat' && fact('operatingsystemmajrelease') == '7' + pp = <<-EOS + package { 'net-tools': ensure => installed } + EOS + + apply_manifest_on(agents, pp, :catch_failures => false) + end + + if fact('osfamily') == 'Debian' + # Make sure snake-oil certs are installed. + shell 'apt-get install -y ssl-cert' + end + + # Install module and dependencies + hosts.each do |host| + copy_module_to(host, :source => proj_root, :module_name => 'apache') + + on host, puppet('module','install','puppetlabs-stdlib') + on host, puppet('module','install','puppetlabs-concat') + + # Required for mod_passenger tests. + if fact('osfamily') == 'RedHat' + on host, puppet('module','install','stahnma/epel') + on host, puppet('module','install','puppetlabs/inifile') + #we need epel installed, so we can get plugins, wsgi, mime ... + pp = <<-EOS + class { 'epel': } + EOS + + apply_manifest_on(host, pp, :catch_failures => true) + end + + # Required for manifest to make mod_pagespeed repository available + if fact('osfamily') == 'Debian' + on host, puppet('module','install','puppetlabs-apt') + end + + # Make sure selinux is disabled so the tests work. + on host, puppet('apply', '-e', + %{"exec { 'setenforce 0': path => '/bin:/sbin:/usr/bin:/usr/sbin', onlyif => 'which setenforce && getenforce | grep Enforcing', }"}) + end + end +end + +shared_examples "a idempotent resource" do + it 'should apply with no errors' do + apply_manifest(pp, :catch_failures => true) + end + + it 'should apply a second time without changes', :skip_pup_5016 do + apply_manifest(pp, :catch_changes => true) + end +end diff --git a/environments/production/modules/apache/spec/spec_helper_local.rb b/environments/production/modules/apache/spec/spec_helper_local.rb new file mode 100644 index 0000000..d861a1c --- /dev/null +++ b/environments/production/modules/apache/spec/spec_helper_local.rb @@ -0,0 +1,39 @@ +RSpec.configure do |c| + c.before :each do + # Ensure that we don't accidentally cache facts and environment + # between test cases. + Facter::Util::Loader.any_instance.stubs(:load_all) + Facter.clear + Facter.clear_messages + end +end + +RSpec.configure do |config| + config.filter_run focus: true + config.run_all_when_everything_filtered = true + #as soon as psh is updated, the following line can be removed + config.mock_with :rspec +end + +shared_examples :compile, :compile => true do + it { should compile.with_all_deps } +end + +shared_examples 'a mod class, without including apache' do + let :facts do + { + :id => 'root', + :lsbdistcodename => 'squeeze', + :kernel => 'Linux', + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6', + :operatingsystemmajrelease => nil, + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :concat_basedir => '/dne', + :is_pe => false, + :hardwaremodel => 'x86_64', + } + end + it { should compile.with_all_deps } +end diff --git a/environments/production/modules/apache/spec/unit/apache_version_spec.rb b/environments/production/modules/apache/spec/unit/apache_version_spec.rb new file mode 100644 index 0000000..2036449 --- /dev/null +++ b/environments/production/modules/apache/spec/unit/apache_version_spec.rb @@ -0,0 +1,33 @@ +require 'spec_helper' + +describe Facter::Util::Fact do + before do + Facter.clear + end + + describe 'apache_version' do + context 'with value' do + before :each do + expect(Facter::Util::Resolution).to receive(:which).with('apachectl') { true } + expect(Facter::Util::Resolution).to receive(:exec).with('apachectl -v 2>&1') {'Server version: Apache/2.4.16 (Unix) + Server built: Jul 31 2015 15:53:26'} + end + it do + expect(Facter.fact(:apache_version).value).to eq('2.4.16') + end + end + end + + describe 'apache_version with empty OS' do + context 'with value' do + before :each do + expect(Facter::Util::Resolution).to receive(:which).with('apachectl') { true } + expect(Facter::Util::Resolution).to receive(:exec).with('apachectl -v 2>&1') {'Server version: Apache/2.4.6 () + Server built: Nov 21 2015 05:34:59' } + end + it do + expect(Facter.fact(:apache_version).value).to eq('2.4.6') + end + end + end +end diff --git a/environments/production/modules/apache/spec/unit/provider/a2mod/gentoo_spec.rb b/environments/production/modules/apache/spec/unit/provider/a2mod/gentoo_spec.rb new file mode 100644 index 0000000..1bccc94 --- /dev/null +++ b/environments/production/modules/apache/spec/unit/provider/a2mod/gentoo_spec.rb @@ -0,0 +1,182 @@ +require 'spec_helper' + +provider_class = Puppet::Type.type(:a2mod).provider(:gentoo) + +describe provider_class do + before :each do + provider_class.clear + end + + [:conf_file, :instances, :modules, :initvars, :conf_file, :clear].each do |method| + it "should respond to the class method #{method}" do + expect(provider_class).to respond_to(method) + end + end + + describe "when fetching modules" do + before do + @filetype = double() + end + + it "should return a sorted array of the defined parameters" do + expect(@filetype).to receive(:read) { %Q{APACHE2_OPTS="-D FOO -D BAR -D BAZ"\n} } + expect(provider_class).to receive(:filetype) { @filetype } + + expect(provider_class.modules).to eq(%w{bar baz foo}) + end + + it "should cache the module list" do + expect(@filetype).to receive(:read).once { %Q{APACHE2_OPTS="-D FOO -D BAR -D BAZ"\n} } + expect(provider_class).to receive(:filetype).once { @filetype } + + 2.times { expect(provider_class.modules).to eq(%w{bar baz foo}) } + end + + it "should normalize parameters" do + @filetype.expects(:read).returns(%Q{APACHE2_OPTS="-D FOO -D BAR -D BAR"\n}) + provider_class.expects(:filetype).returns(@filetype) + + expect(provider_class.modules).to eq(%w{bar foo}) + end + end + + describe "when prefetching" do + it "should match providers to resources" do + provider = double("ssl_provider", :name => "ssl") + resource = double("ssl_resource") + resource.expects(:provider=).with(provider) + + expect(provider_class).to receive(:instances) { [provider] } + provider_class.prefetch("ssl" => resource) + end + end + + describe "when flushing" do + before :each do + @filetype = double() + allow(@filetype).to receive(:backup) + allow(provider_class).to receive(:filetype).at_least(:once) { @filetype } + + @info = double() + allow(@info).to receive(:[]).with(:name) { "info" } + allow(@info).to receive(:provider=) + + @mpm = double() + allow(@mpm).to receive(:[]).with(:name) { "mpm" } + allow(@mpm).to receive(:provider=) + + @ssl = double() + allow(@ssl).to receive(:[]).with(:name) { "ssl" } + allow(@ssl).to receive(:provider=) + end + + it "should add modules whose ensure is present" do + expect(@filetype).to receive(:read).at_least(:once) { %Q{APACHE2_OPTS=""} } + expect(@filetype).to receive(:write).with(%Q{APACHE2_OPTS="-D INFO"}) + + allow(@info).to receive(:should).with(:ensure) { :present } + provider_class.prefetch("info" => @info) + + provider_class.flush + end + + it "should remove modules whose ensure is present" do + expect(@filetype).to receive(:read).at_least(:once) { %Q{APACHE2_OPTS="-D INFO"} } + expect(@filetype).to receive(:write).with(%Q{APACHE2_OPTS=""}) + + allow(@info).to receive(:should).with(:ensure) { :absent } + allow(@info).to receive(:provider=) + provider_class.prefetch("info" => @info) + + provider_class.flush + end + + it "should not modify providers without resources" do + expect(@filetype).to receive(:read).at_least(:once) { %Q{APACHE2_OPTS="-D INFO -D MPM"} } + expect(@filetype).to receive(:write).with(%Q{APACHE2_OPTS="-D MPM -D SSL"}) + + allow(@info).to receive(:should).with(:ensure) { :absent } + provider_class.prefetch("info" => @info) + + allow(@ssl).to receive(:should).with(:ensure) { :present } + provider_class.prefetch("ssl" => @ssl) + + provider_class.flush + end + + it "should write the modules in sorted order" do + expect(@filetype).to receive(:read).at_least(:once) { %Q{APACHE2_OPTS=""} } + expect(@filetype).to receive(:write).with(%Q{APACHE2_OPTS="-D INFO -D MPM -D SSL"}) + + allow(@mpm).to receive(:should).with(:ensure) { :present } + provider_class.prefetch("mpm" => @mpm) + allow(@info).to receive(:should).with(:ensure) { :present } + provider_class.prefetch("info" => @info) + allow(@ssl).to receive(:should).with(:ensure) { :present } + provider_class.prefetch("ssl" => @ssl) + + provider_class.flush + end + + it "should write the records back once" do + expect(@filetype).to receive(:read).at_least(:once) { %Q{APACHE2_OPTS=""} } + expect(@filetype).to receive(:write).once.with(%Q{APACHE2_OPTS="-D INFO -D SSL"}) + + allow(@info).to receive(:should).with(:ensure) { :present } + provider_class.prefetch("info" => @info) + + allow(@ssl).to receive(:should).with(:ensure) { :present } + provider_class.prefetch("ssl" => @ssl) + + provider_class.flush + end + + it "should only modify the line containing APACHE2_OPTS" do + expect(@filetype).to receive(:read).at_least(:once) { %Q{# Comment\nAPACHE2_OPTS=""\n# Another comment} } + expect(@filetype).to receive(:write).once.with(%Q{# Comment\nAPACHE2_OPTS="-D INFO"\n# Another comment}) + + allow(@info).to receive(:should).with(:ensure) { :present } + provider_class.prefetch("info" => @info) + provider_class.flush + end + + it "should restore any arbitrary arguments" do + expect(@filetype).to receive(:read).at_least(:once) { %Q{APACHE2_OPTS="-Y -D MPM -X"} } + expect(@filetype).to receive(:write).once.with(%Q{APACHE2_OPTS="-Y -X -D INFO -D MPM"}) + + allow(@info).to receive(:should).with(:ensure) { :present } + provider_class.prefetch("info" => @info) + provider_class.flush + end + + it "should backup the file once if changes were made" do + expect(@filetype).to receive(:read).at_least(:once) { %Q{APACHE2_OPTS=""} } + expect(@filetype).to receive(:write).once.with(%Q{APACHE2_OPTS="-D INFO -D SSL"}) + + allow(@info).to receive(:should).with(:ensure) { :present } + provider_class.prefetch("info" => @info) + + allow(@ssl).to receive(:should).with(:ensure) { :present } + provider_class.prefetch("ssl" => @ssl) + + @filetype.unstub(:backup) + @filetype.expects(:backup) + provider_class.flush + end + + it "should not write the file or run backups if no changes were made" do + expect(@filetype).to receive(:read).at_least(:once) { %Q{APACHE2_OPTS="-X -D INFO -D SSL -Y"} } + expect(@filetype).to receive(:write).never + + allow(@info).to receive(:should).with(:ensure) { :present } + provider_class.prefetch("info" => @info) + + allow(@ssl).to receive(:should).with(:ensure) { :present } + provider_class.prefetch("ssl" => @ssl) + + @filetype.unstub(:backup) + @filetype.expects(:backup).never + provider_class.flush + end + end +end diff --git a/environments/production/modules/apache/spec/unit/puppet/parser/functions/bool2httpd_spec.rb b/environments/production/modules/apache/spec/unit/puppet/parser/functions/bool2httpd_spec.rb new file mode 100644 index 0000000..19d35e5 --- /dev/null +++ b/environments/production/modules/apache/spec/unit/puppet/parser/functions/bool2httpd_spec.rb @@ -0,0 +1,53 @@ +require 'spec_helper' + +describe "the bool2httpd function" do + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + it "should exist" do + expect(Puppet::Parser::Functions.function("bool2httpd")).to eq("function_bool2httpd") + end + + it "should raise a ParseError if there is less than 1 arguments" do + expect { scope.function_bool2httpd([]) }.to( raise_error(Puppet::ParseError)) + end + + it "should convert true to 'On'" do + result = scope.function_bool2httpd([true]) + expect(result).to(eq('On')) + end + + it "should convert true to a string" do + result = scope.function_bool2httpd([true]) + expect(result.class).to(eq(String)) + end + + it "should convert false to 'Off'" do + result = scope.function_bool2httpd([false]) + expect(result).to(eq('Off')) + end + + it "should convert false to a string" do + result = scope.function_bool2httpd([false]) + expect(result.class).to(eq(String)) + end + + it "should accept (and return) any string" do + result = scope.function_bool2httpd(["mail"]) + expect(result).to(eq('mail')) + end + + it "should accept a nil value (and return Off)" do + result = scope.function_bool2httpd([nil]) + expect(result).to(eq('Off')) + end + + it "should accept an undef value (and return 'Off')" do + result = scope.function_bool2httpd([:undef]) + expect(result).to(eq('Off')) + end + + it "should return a default value on non-matches" do + result = scope.function_bool2httpd(['foo']) + expect(result).to(eq('foo')) + end +end diff --git a/environments/production/modules/apache/spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb b/environments/production/modules/apache/spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb new file mode 100644 index 0000000..b162127 --- /dev/null +++ b/environments/production/modules/apache/spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb @@ -0,0 +1,69 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' + +describe "the enclose_ipv6 function" do + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + it "should exist" do + expect(Puppet::Parser::Functions.function("enclose_ipv6")).to eq("function_enclose_ipv6") + end + + it "should raise a ParseError if there is less than 1 arguments" do + expect { scope.function_enclose_ipv6([]) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError if there is more than 1 arguments" do + expect { scope.function_enclose_ipv6(['argument1','argument2']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError when given garbage" do + expect { scope.function_enclose_ipv6(['garbage']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError when given something else than a string or an array" do + expect { scope.function_enclose_ipv6([['1' => '127.0.0.1']]) }.to( raise_error(Puppet::ParseError) ) + end + + it "should not raise a ParseError when given a single ip string" do + expect { scope.function_enclose_ipv6(['127.0.0.1']) }.to_not raise_error + end + + it "should not raise a ParseError when given * as ip string" do + expect { scope.function_enclose_ipv6(['*']) }.to_not raise_error + end + + it "should not raise a ParseError when given an array of ip strings" do + expect { scope.function_enclose_ipv6([['127.0.0.1','fe80::1']]) }.to_not raise_error + end + + it "should not raise a ParseError when given differently notations of ip addresses" do + expect { scope.function_enclose_ipv6([['127.0.0.1','fe80::1','[fe80::1]']]) }.to_not raise_error + end + + it "should raise a ParseError when given a wrong ipv4 address" do + expect { scope.function_enclose_ipv6(['127..0.0.1']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError when given a ipv4 address with square brackets" do + expect { scope.function_enclose_ipv6(['[127.0.0.1]']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError when given a wrong ipv6 address" do + expect { scope.function_enclose_ipv6(['fe80:::1']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should embrace ipv6 adresses within an array of ip addresses" do + result = scope.function_enclose_ipv6([['127.0.0.1','fe80::1','[fe80::2]']]) + expect(result).to(eq(['127.0.0.1','[fe80::1]','[fe80::2]'])) + end + + it "should embrace a single ipv6 adresse" do + result = scope.function_enclose_ipv6(['fe80::1']) + expect(result).to(eq(['[fe80::1]'])) + end + + it "should not embrace a single ipv4 adresse" do + result = scope.function_enclose_ipv6(['127.0.0.1']) + expect(result).to(eq(['127.0.0.1'])) + end +end diff --git a/environments/production/modules/apache/spec/unit/puppet/parser/functions/validate_apache_log_level.rb b/environments/production/modules/apache/spec/unit/puppet/parser/functions/validate_apache_log_level.rb new file mode 100644 index 0000000..dfef66e --- /dev/null +++ b/environments/production/modules/apache/spec/unit/puppet/parser/functions/validate_apache_log_level.rb @@ -0,0 +1,39 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' + +describe "the validate_apache_log_level function" do + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + it "should exist" do + expect(Puppet::Parser::Functions.function("validate_apache_log_level")).to eq("function_validate_apache_log_level") + end + + it "should raise a ParseError if there is less than 1 arguments" do + expect { scope.function_validate_apache_log_level([]) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError when given garbage" do + expect { scope.function_validate_apache_log_level(['garbage']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should not raise a ParseError when given a plain log level" do + expect { scope.function_validate_apache_log_level(['info']) }.to_not raise_error + end + + it "should not raise a ParseError when given a log level and module log level" do + expect { scope.function_validate_apache_log_level(['warn ssl:info']) }.to_not raise_error + end + + it "should not raise a ParseError when given a log level and module log level" do + expect { scope.function_validate_apache_log_level(['warn mod_ssl.c:info']) }.to_not raise_error + end + + it "should not raise a ParseError when given a log level and module log level" do + expect { scope.function_validate_apache_log_level(['warn ssl_module:info']) }.to_not raise_error + end + + it "should not raise a ParseError when given a trace level" do + expect { scope.function_validate_apache_log_level(['trace4']) }.to_not raise_error + end + +end diff --git a/environments/production/modules/apache/templates/confd/no-accf.conf.erb b/environments/production/modules/apache/templates/confd/no-accf.conf.erb new file mode 100644 index 0000000..10e5164 --- /dev/null +++ b/environments/production/modules/apache/templates/confd/no-accf.conf.erb @@ -0,0 +1,4 @@ + + AcceptFilter http none + AcceptFilter https none + diff --git a/environments/production/modules/apache/templates/fastcgi/server.erb b/environments/production/modules/apache/templates/fastcgi/server.erb new file mode 100644 index 0000000..bae56d4 --- /dev/null +++ b/environments/production/modules/apache/templates/fastcgi/server.erb @@ -0,0 +1,22 @@ +<% + timeout = " -idle-timeout #{@timeout}" + flush = "" + if @flush + flush = " -flush" + end + if @socket + host_or_socket = " -socket #{@socket}" + else + host_or_socket = " -host #{@host}" + end + + pass_header = "" + if @pass_header and ! @pass_header.empty? + pass_header = " -pass-header #{@pass_header}" + end + + options = timeout + flush + host_or_socket + pass_header +-%> +FastCGIExternalServer <%= @faux_path %><%= options %> +Alias <%= @fcgi_alias %> <%= @faux_path %> +Action <%= @file_type %> <%= @fcgi_alias %> diff --git a/environments/production/modules/apache/templates/httpd.conf.erb b/environments/production/modules/apache/templates/httpd.conf.erb new file mode 100644 index 0000000..4445d75 --- /dev/null +++ b/environments/production/modules/apache/templates/httpd.conf.erb @@ -0,0 +1,150 @@ +# Security +ServerTokens <%= @server_tokens %> +ServerSignature <%= scope.function_bool2httpd([@server_signature]) %> +TraceEnable <%= scope.function_bool2httpd([@trace_enable]) %> + +ServerName "<%= @servername %>" +ServerRoot "<%= @server_root %>" +PidFile <%= @pidfile %> +Timeout <%= @timeout %> +KeepAlive <%= @keepalive %> +MaxKeepAliveRequests <%= @max_keepalive_requests %> +KeepAliveTimeout <%= @keepalive_timeout %> +LimitRequestFieldSize <%= @limitreqfieldsize %> + +<%- if @rewrite_lock and scope.function_versioncmp([@apache_version, '2.2']) <= 0 -%> +RewriteLock <%= @rewrite_lock %> +<%- end -%> + +User <%= @user %> +Group <%= @group %> + +AccessFileName .htaccess + +<%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%> + Require all denied +<%- else -%> + Order allow,deny + Deny from all + Satisfy all +<%- end -%> + + + + Options <%= Array(@root_directory_options).join(' ') %> + AllowOverride None +<%- if @root_directory_secured -%> +<%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%> + Require all denied +<%- else -%> + Order deny,allow + Deny from all +<%- end -%> +<%- end -%> + + +<% if @default_charset -%> +AddDefaultCharset <%= @default_charset %> +<% end -%> + +<%- if scope.function_versioncmp([@apache_version, '2.4']) < 0 -%> +DefaultType <%= @default_type %> +<%- end -%> +HostnameLookups Off +<%- if /^[|\/]/.match(@error_log) || /^syslog:/.match(@error_log) -%> +ErrorLog "<%= @error_log %>" +<%- else -%> +ErrorLog "<%= @logroot %>/<%= @error_log %>" +<%- end -%> +LogLevel <%= @log_level %> +EnableSendfile <%= @sendfile %> +<%- if @allow_encoded_slashes -%> +AllowEncodedSlashes <%= @allow_encoded_slashes %> +<%- end -%> + +#Listen 80 + +<% if @apxs_workaround -%> +# Workaround: without this hack apxs would be confused about where to put +# LoadModule directives and fail entire procedure of apache package +# installation/reinstallation. This problem was observed on FreeBSD (apache22). +#LoadModule fake_module libexec/apache22/mod_fake.so +<% end -%> + +Include "<%= @mod_load_dir %>/*.load" +<% if @mod_load_dir != @confd_dir and @mod_load_dir != @vhost_load_dir -%> +Include "<%= @mod_load_dir %>/*.conf" +<% end -%> +Include "<%= @ports_file %>" + +<% unless @log_formats.has_key?('combined') -%> +LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined +<% end -%> +<% unless @log_formats.has_key?('common') -%> +LogFormat "%h %l %u %t \"%r\" %>s %b" common +<% end -%> +<% unless @log_formats.has_key?('referer') -%> +LogFormat "%{Referer}i -> %U" referer +<% end -%> +<% unless @log_formats.has_key?('agent') -%> +LogFormat "%{User-agent}i" agent +<% end -%> +<% unless @log_formats.has_key?('forwarded') -%> +LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-agent}i\"" forwarded +<% end -%> +<% if @log_formats and !@log_formats.empty? -%> + <%- @log_formats.sort.each do |nickname,format| -%> +LogFormat "<%= format -%>" <%= nickname %> + <%- end -%> +<% end -%> + +<%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%> +IncludeOptional "<%= @confd_dir %>/*.conf" +<%- else -%> +Include "<%= @confd_dir %>/*.conf" +<%- end -%> +<% if @vhost_load_dir != @confd_dir -%> +<%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%> +IncludeOptional "<%= @vhost_load_dir %>/<%= @vhost_include_pattern %>" +<%- else -%> +Include "<%= @vhost_load_dir %>/<%= @vhost_include_pattern %>" +<%- end -%> +<% end -%> + +<% if @error_documents -%> +# /usr/share/apache2/error on debian +Alias /error/ "<%= @error_documents_path %>/" + +"> + AllowOverride None + Options IncludesNoExec + AddOutputFilter Includes html + AddHandler type-map var +<%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%> + Require all granted +<%- else -%> + Order allow,deny + Allow from all +<%- end -%> + LanguagePriority en cs de es fr it nl sv pt-br ro + ForceLanguagePriority Prefer Fallback + + +ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var +ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var +ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var +ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var +ErrorDocument 405 /error/HTTP_METHOD_NOT_ALLOWED.html.var +ErrorDocument 408 /error/HTTP_REQUEST_TIME_OUT.html.var +ErrorDocument 410 /error/HTTP_GONE.html.var +ErrorDocument 411 /error/HTTP_LENGTH_REQUIRED.html.var +ErrorDocument 412 /error/HTTP_PRECONDITION_FAILED.html.var +ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var +ErrorDocument 414 /error/HTTP_REQUEST_URI_TOO_LARGE.html.var +ErrorDocument 415 /error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var +ErrorDocument 500 /error/HTTP_INTERNAL_SERVER_ERROR.html.var +ErrorDocument 501 /error/HTTP_NOT_IMPLEMENTED.html.var +ErrorDocument 502 /error/HTTP_BAD_GATEWAY.html.var +ErrorDocument 503 /error/HTTP_SERVICE_UNAVAILABLE.html.var +ErrorDocument 506 /error/HTTP_VARIANT_ALSO_VARIES.html.var +<% end -%> diff --git a/environments/production/modules/apache/templates/listen.erb b/environments/production/modules/apache/templates/listen.erb new file mode 100644 index 0000000..8fc871b --- /dev/null +++ b/environments/production/modules/apache/templates/listen.erb @@ -0,0 +1,6 @@ +<%# Listen should always be one of: + - + - : + - [ +-%> +Listen <%= @listen_addr_port %> diff --git a/environments/production/modules/apache/templates/mod/alias.conf.erb b/environments/production/modules/apache/templates/mod/alias.conf.erb new file mode 100644 index 0000000..8580f70 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/alias.conf.erb @@ -0,0 +1,13 @@ + +Alias /icons/ "<%= @icons_path %>/" +"> + Options <%= @icons_options %> + AllowOverride None +<%- if scope.function_versioncmp([@_apache_version, '2.4']) >= 0 -%> + Require all granted +<%- else -%> + Order allow,deny + Allow from all +<%- end -%> + + diff --git a/environments/production/modules/apache/templates/mod/auth_cas.conf.erb b/environments/production/modules/apache/templates/mod/auth_cas.conf.erb new file mode 100644 index 0000000..b59c535 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/auth_cas.conf.erb @@ -0,0 +1,58 @@ +CASCookiePath <%= @cas_cookie_path %> +CASLoginURL <%= @cas_login_url %> +CASValidateURL <%= @cas_validate_url %> + +CASVersion <%= @cas_version %> +CASDebug <%= @cas_debug %> + +<% if @cas_certificate_path -%> +CASCertificatePath <%= @cas_certificate_path %> +<% end -%> +<% if @cas_proxy_validate_url -%> +CASProxyValidateURL <%= @cas_proxy_validate_url %> +<% end -%> +<% if @cas_validate_server -%> +CASValidateServer <%= @cas_validate_server %> +<% end -%> +<% if @cas_validate_depth -%> +CASValidateDepth <%= @cas_validate_depth %> +<% end -%> +<% if @cas_root_proxied_as -%> +CASRootProxiedAs <%= @cas_root_proxied_as %> +<% end -%> +<% if @cas_cookie_entropy -%> +CASCookieEntropy <%= @cas_cookie_entropy %> +<% end -%> +<% if @cas_timeout -%> +CASTimeout <%= @cas_timeout %> +<% end -%> +<% if @cas_idle_timeout -%> +CASIdleTimeout <%= @cas_idle_timeout %> +<% end -%> +<% if @cas_cache_clean_interval -%> +CASCacheCleanInterval <%= @cas_cache_clean_interval %> +<% end -%> +<% if @cas_cookie_domain -%> +CASCookieDomain <%= @cas_cookie_domain %> +<% end -%> +<% if @cas_cookie_http_only -%> +CASCookieHttpOnly <%= @cas_cookie_http_only %> +<% end -%> +<% if @cas_authoritative -%> +CASAuthoritative <%= @cas_authoritative %> +<% end -%> +<%- if @cas_sso_enabled -%> +CASSSOEnabled On +<%- end -%> +<%- if @cas_validate_saml -%> +CASValidateSAML On +<%- end -%> +<%- if @cas_attribute_prefix -%> +CASAttributePrefix <%= @cas_attribute_prefix %> +<%- end -%> +<%- if @cas_attribute_delimiter -%> +CASAttributeDelimiter <%= @cas_attribute_delimiter %> +<%- end -%> +<%- if @cas_scrub_request_headers -%> +CASAttributeDelimiter On +<%- end -%> diff --git a/environments/production/modules/apache/templates/mod/auth_mellon.conf.erb b/environments/production/modules/apache/templates/mod/auth_mellon.conf.erb new file mode 100644 index 0000000..e36a733 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/auth_mellon.conf.erb @@ -0,0 +1,21 @@ +<%- if @mellon_cache_size -%> +MellonCacheSize <%= @mellon_cache_size %> +<%- end -%> +<%- if @mellon_cache_entry_size -%> +MellonCacheEntrySize <%= @mellon_cache_entry_size %> +<%- end -%> +<%- if @mellon_lock_file -%> +MellonLockFile "<%= @mellon_lock_file %>" +<%- end -%> +<%- if @mellon_post_directory -%> +MellonPostDirectory "<%= @mellon_post_directory %>" +<%- end -%> +<%- if @mellon_post_ttl -%> +MellonPostTTL <%= @mellon_post_ttl %> +<%- end -%> +<%- if @mellon_post_size -%> +MellonPostSize <%= @mellon_post_size %> +<%- end -%> +<%- if @mellon_post_count -%> +MellonPostCount <%= @mellon_post_count %> +<%- end -%> diff --git a/environments/production/modules/apache/templates/mod/authn_dbd.conf.erb b/environments/production/modules/apache/templates/mod/authn_dbd.conf.erb new file mode 100644 index 0000000..e04fb3e --- /dev/null +++ b/environments/production/modules/apache/templates/mod/authn_dbd.conf.erb @@ -0,0 +1,17 @@ +#Database Management +DBDriver <%= @authn_dbd_dbdriver %> + +#Connection string: database name and login credentials +DBDParams "<%= @authn_dbd_params %>" + +#Parameters for Connection Pool Management +DBDMin <%= @authn_dbd_min %> +DBDMax <%= @authn_dbd_max %> +DBDKeep <%= @authn_dbd_keep %> +DBDExptime <%= @authn_dbd_exptime %> + +<%- if @authn_dbd_alias -%> +> + AuthDBDUserPWQuery "<%= @authn_dbd_query %>" + +<%- end -%> diff --git a/environments/production/modules/apache/templates/mod/authnz_ldap.conf.erb b/environments/production/modules/apache/templates/mod/authnz_ldap.conf.erb new file mode 100644 index 0000000..8d73b23 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/authnz_ldap.conf.erb @@ -0,0 +1,5 @@ +<% if @_verify_server_cert == true -%> +LDAPVerifyServerCert On +<% else -%> +LDAPVerifyServerCert Off +<% end -%> diff --git a/environments/production/modules/apache/templates/mod/autoindex.conf.erb b/environments/production/modules/apache/templates/mod/autoindex.conf.erb new file mode 100644 index 0000000..ef6bbeb --- /dev/null +++ b/environments/production/modules/apache/templates/mod/autoindex.conf.erb @@ -0,0 +1,56 @@ +IndexOptions FancyIndexing VersionSort HTMLTable NameWidth=* DescriptionWidth=* Charset=UTF-8 +AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip x-bzip2 + +AddIconByType (TXT,/icons/text.gif) text/* +AddIconByType (IMG,/icons/image2.gif) image/* +AddIconByType (SND,/icons/sound2.gif) audio/* +AddIconByType (VID,/icons/movie.gif) video/* + +AddIcon /icons/binary.gif .bin .exe +AddIcon /icons/binhex.gif .hqx +AddIcon /icons/tar.gif .tar +AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv +AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip +AddIcon /icons/a.gif .ps .ai .eps +AddIcon /icons/layout.gif .html .shtml .htm .pdf +AddIcon /icons/text.gif .txt +AddIcon /icons/c.gif .c +AddIcon /icons/p.gif .pl .py +AddIcon /icons/f.gif .for +AddIcon /icons/dvi.gif .dvi +AddIcon /icons/uuencoded.gif .uu +AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl +AddIcon /icons/tex.gif .tex +AddIcon /icons/bomb.gif /core +AddIcon (SND,/icons/sound2.gif) .ogg +AddIcon (VID,/icons/movie.gif) .ogm + +AddIcon /icons/back.gif .. +AddIcon /icons/hand.right.gif README +AddIcon /icons/folder.gif ^^DIRECTORY^^ +AddIcon /icons/blank.gif ^^BLANKICON^^ + +AddIcon /icons/odf6odt-20x22.png .odt +AddIcon /icons/odf6ods-20x22.png .ods +AddIcon /icons/odf6odp-20x22.png .odp +AddIcon /icons/odf6odg-20x22.png .odg +AddIcon /icons/odf6odc-20x22.png .odc +AddIcon /icons/odf6odf-20x22.png .odf +AddIcon /icons/odf6odb-20x22.png .odb +AddIcon /icons/odf6odi-20x22.png .odi +AddIcon /icons/odf6odm-20x22.png .odm + +AddIcon /icons/odf6ott-20x22.png .ott +AddIcon /icons/odf6ots-20x22.png .ots +AddIcon /icons/odf6otp-20x22.png .otp +AddIcon /icons/odf6otg-20x22.png .otg +AddIcon /icons/odf6otc-20x22.png .otc +AddIcon /icons/odf6otf-20x22.png .otf +AddIcon /icons/odf6oti-20x22.png .oti +AddIcon /icons/odf6oth-20x22.png .oth + +DefaultIcon /icons/unknown.gif +ReadmeName README.html +HeaderName HEADER.html + +IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t diff --git a/environments/production/modules/apache/templates/mod/cgid.conf.erb b/environments/production/modules/apache/templates/mod/cgid.conf.erb new file mode 100644 index 0000000..5f82d74 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/cgid.conf.erb @@ -0,0 +1 @@ +ScriptSock "<%= @cgisock_path %>" diff --git a/environments/production/modules/apache/templates/mod/cluster.conf.erb b/environments/production/modules/apache/templates/mod/cluster.conf.erb new file mode 100644 index 0000000..6a998a0 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/cluster.conf.erb @@ -0,0 +1,23 @@ +Listen <%= @ip %>:<%= @port %> +:<%= @port %>> + + Order deny,allow + Deny from all + Allow from <%= @allowed_network %> + + + KeepAliveTimeout <%= @keep_alive_timeout %> + MaxKeepAliveRequests <%= @max_keep_alive_requests %> + EnableMCPMReceive <%= scope.function_bool2httpd([@enable_mcpm_receive]) %> + + ManagerBalancerName <%= @balancer_name %> + ServerAdvertise <%= scope.function_bool2httpd([@server_advertise]) %> + + + SetHandler mod_cluster-manager + Order deny,allow + Deny from all + Allow from <%= @manager_allowed_network %> + + + diff --git a/environments/production/modules/apache/templates/mod/dav_fs.conf.erb b/environments/production/modules/apache/templates/mod/dav_fs.conf.erb new file mode 100644 index 0000000..3c53e9e --- /dev/null +++ b/environments/production/modules/apache/templates/mod/dav_fs.conf.erb @@ -0,0 +1 @@ +DAVLockDB "<%= @dav_lock %>" diff --git a/environments/production/modules/apache/templates/mod/deflate.conf.erb b/environments/production/modules/apache/templates/mod/deflate.conf.erb new file mode 100644 index 0000000..ede8b2e --- /dev/null +++ b/environments/production/modules/apache/templates/mod/deflate.conf.erb @@ -0,0 +1,7 @@ +<%- @types.sort.each do |type| -%> +AddOutputFilterByType DEFLATE <%= type %> +<%- end -%> + +<%- @notes.sort.each do |type,note| -%> +DeflateFilterNote <%= type %> <%=note %> +<%- end -%> diff --git a/environments/production/modules/apache/templates/mod/dir.conf.erb b/environments/production/modules/apache/templates/mod/dir.conf.erb new file mode 100644 index 0000000..741f6ae --- /dev/null +++ b/environments/production/modules/apache/templates/mod/dir.conf.erb @@ -0,0 +1 @@ +DirectoryIndex <%= @indexes.join(' ') %> diff --git a/environments/production/modules/apache/templates/mod/disk_cache.conf.erb b/environments/production/modules/apache/templates/mod/disk_cache.conf.erb new file mode 100644 index 0000000..b1b460e --- /dev/null +++ b/environments/production/modules/apache/templates/mod/disk_cache.conf.erb @@ -0,0 +1,4 @@ +CacheEnable disk / +CacheRoot "<%= @_cache_root %>" +CacheDirLevels 2 +CacheDirLength 1 diff --git a/environments/production/modules/apache/templates/mod/dumpio.conf.erb b/environments/production/modules/apache/templates/mod/dumpio.conf.erb new file mode 100644 index 0000000..29c34e2 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/dumpio.conf.erb @@ -0,0 +1,3 @@ +# https://httpd.apache.org/docs/2.4/mod/mod_dumpio.html +DumpIOInput "<%= @dump_io_input %>" +DumpIOOutput "<%= @dump_io_output %>" diff --git a/environments/production/modules/apache/templates/mod/event.conf.erb b/environments/production/modules/apache/templates/mod/event.conf.erb new file mode 100644 index 0000000..bca707c --- /dev/null +++ b/environments/production/modules/apache/templates/mod/event.conf.erb @@ -0,0 +1,33 @@ + + <%- if @serverlimit -%> + ServerLimit <%= @serverlimit %> + <%- end -%> + <%- if @startservers -%> + StartServers <%= @startservers %> + <%- end -%> + <%- if @maxrequestworkers -%> + MaxRequestWorkers <%= @maxrequestworkers %> + <%- elsif @maxclients -%> + MaxClients <%= @maxclients %> + <%- end -%> + <%- if @minsparethreads -%> + MinSpareThreads <%= @minsparethreads %> + <%- end -%> + <%- if @maxsparethreads -%> + MaxSpareThreads <%= @maxsparethreads %> + <%- end -%> + <%- if @threadsperchild -%> + ThreadsPerChild <%= @threadsperchild %> + <%- end -%> + <%- if @maxconnectionsperchild -%> + MaxConnectionsPerChild <%= @maxconnectionsperchild %> + <%- elsif @maxrequestsperchild -%> + MaxRequestsPerChild <%= @maxrequestsperchild %> + <%- end -%> + <%- if @threadlimit -%> + ThreadLimit <%= @threadlimit %> + <%- end -%> + <%- if @listenbacklog -%> + ListenBacklog <%= @listenbacklog %> + <%- end -%> + diff --git a/environments/production/modules/apache/templates/mod/expires.conf.erb b/environments/production/modules/apache/templates/mod/expires.conf.erb new file mode 100644 index 0000000..7660cfc --- /dev/null +++ b/environments/production/modules/apache/templates/mod/expires.conf.erb @@ -0,0 +1,11 @@ +ExpiresActive <%= scope.function_bool2httpd([@expires_active]) %> +<%- if ! @expires_default.nil? and ! @expires_default.empty? -%> +ExpiresDefault "<%= @expires_default %>" +<%- end -%> +<%- if ! @expires_by_type.nil? and ! @expires_by_type.empty? -%> +<%- [@expires_by_type].flatten.each do |line| -%> +<%- line.map do |type, seconds| -%> +ExpiresByType <%= type %> "<%= seconds -%>" +<%- end -%> +<%- end -%> +<%- end -%> diff --git a/environments/production/modules/apache/templates/mod/ext_filter.conf.erb b/environments/production/modules/apache/templates/mod/ext_filter.conf.erb new file mode 100644 index 0000000..67f98fd --- /dev/null +++ b/environments/production/modules/apache/templates/mod/ext_filter.conf.erb @@ -0,0 +1,6 @@ +# mod_ext_filter definitions +<%- if @ext_filter_define.length >= 1 -%> +<%- @ext_filter_define.keys.sort.each do |name| -%> +ExtFilterDefine <%= name %> <%= @ext_filter_define[name] %> +<%- end -%> +<%- end -%> diff --git a/environments/production/modules/apache/templates/mod/fastcgi.conf.erb b/environments/production/modules/apache/templates/mod/fastcgi.conf.erb new file mode 100644 index 0000000..93c8d86 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/fastcgi.conf.erb @@ -0,0 +1,8 @@ +# The Fastcgi Apache module configuration file is being +# managed by Puppet and changes will be overwritten. + + + SetHandler fastcgi-script + + FastCgiIpcDir "<%= @fastcgi_lib_path %>" + diff --git a/environments/production/modules/apache/templates/mod/fcgid.conf.erb b/environments/production/modules/apache/templates/mod/fcgid.conf.erb new file mode 100644 index 0000000..a82bc30 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/fcgid.conf.erb @@ -0,0 +1,5 @@ + +<% @options.sort_by {|key, value| key}.each do |key, value| -%> + <%= key %> <%= value %> +<% end -%> + diff --git a/environments/production/modules/apache/templates/mod/geoip.conf.erb b/environments/production/modules/apache/templates/mod/geoip.conf.erb new file mode 100644 index 0000000..00e61d9 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/geoip.conf.erb @@ -0,0 +1,25 @@ +GeoIPEnable <%= scope.function_bool2httpd([@enable]) %> + +<%- if @db_file and ! [ false, 'false', '' ].include?(@db_file) -%> + <%- if @db_file.kind_of?(Array) -%> + <%- Array(@db_file).each do |file| -%> +GeoIPDBFile <%= file %> <%= @flag %> + <%- end -%> + <%- else -%> +GeoIPDBFile <%= @db_file %> <%= @flag %> + <%- end -%> +<%- end -%> +GeoIPOutput <%= @output %> +<% if ! @enable_utf8.nil? -%> +GeoIPEnableUTF8 <%= scope.function_bool2httpd([@enable_utf8]) %> +<% end -%> +<% if ! @scan_proxy_headers.nil? -%> +GeoIPScanProxyHeaders <%= scope.function_bool2httpd([@scan_proxy_headers]) %> +<% end -%> +<% if ! @scan_proxy_header_field.nil? -%> +GeoIPScanProxyHeaderField <%= @scan_proxy_header_field %> +<% end -%> +<% if ! @use_last_xforwarededfor_ip.nil? -%> +GeoIPUseLastXForwardedForIP <%= scope.function_bool2httpd([@use_last_xforwarededfor_ip]) %> +<% end -%> + diff --git a/environments/production/modules/apache/templates/mod/info.conf.erb b/environments/production/modules/apache/templates/mod/info.conf.erb new file mode 100644 index 0000000..c661a23 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/info.conf.erb @@ -0,0 +1,19 @@ +> + SetHandler server-info +<%- if @restrict_access -%> + <%- if scope.function_versioncmp([@_apache_version, '2.4']) >= 0 -%> + Require ip <%= Array(@allow_from).join(" ") %> + <%- else -%> + Order deny,allow + Deny from all + <%- if @allow_from and ! @allow_from.empty? -%> + <%- @allow_from.each do |allowed| -%> + Allow from <%= allowed %> + <%- end -%> + <%- else -%> + Allow from 127.0.0.1 + Allow from ::1 + <%- end -%> + <%- end -%> +<%- end -%> + diff --git a/environments/production/modules/apache/templates/mod/itk.conf.erb b/environments/production/modules/apache/templates/mod/itk.conf.erb new file mode 100644 index 0000000..f45f2b3 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/itk.conf.erb @@ -0,0 +1,8 @@ + + StartServers <%= @startservers %> + MinSpareServers <%= @minspareservers %> + MaxSpareServers <%= @maxspareservers %> + ServerLimit <%= @serverlimit %> + MaxClients <%= @maxclients %> + MaxRequestsPerChild <%= @maxrequestsperchild %> + diff --git a/environments/production/modules/apache/templates/mod/ldap.conf.erb b/environments/production/modules/apache/templates/mod/ldap.conf.erb new file mode 100644 index 0000000..5ac0c1c --- /dev/null +++ b/environments/production/modules/apache/templates/mod/ldap.conf.erb @@ -0,0 +1,29 @@ + + SetHandler ldap-status + <%- if scope.function_versioncmp([@_apache_version, '2.4']) >= 0 -%> + Require ip 127.0.0.1 ::1 + <%- else -%> + Order deny,allow + Deny from all + Allow from 127.0.0.1 ::1 + Satisfy all + <%- end -%> + +<% if @ldap_trusted_global_cert_file -%> +LDAPTrustedGlobalCert <%= @ldap_trusted_global_cert_type %> <%= @ldap_trusted_global_cert_file %> +<% end -%> +<%- if @ldap_shared_cache_size -%> +LDAPSharedCacheSize <%= @ldap_shared_cache_size %> +<%- end -%> +<%- if @ldap_cache_entries -%> +LDAPCacheEntries <%= @ldap_cache_entries %> +<%- end -%> +<%- if @ldap_cache_ttl -%> +LDAPCacheTTL <%= @ldap_cache_ttl %> +<%- end -%> +<%- if @ldap_opcache_entries -%> +LDAPOpCacheEntries <%= @ldap_opcache_entries %> +<%- end -%> +<%- if @ldap_opcache_ttl -%> +LDAPOpCacheTTL <%= @ldap_opcache_ttl %> +<%- end -%> diff --git a/environments/production/modules/apache/templates/mod/load.erb b/environments/production/modules/apache/templates/mod/load.erb new file mode 100644 index 0000000..51f45ed --- /dev/null +++ b/environments/production/modules/apache/templates/mod/load.erb @@ -0,0 +1,7 @@ +<% if @loadfiles -%> +<% Array(@loadfiles).each do |loadfile| -%> +LoadFile <%= loadfile %> +<% end -%> + +<% end -%> +LoadModule <%= @_id %> <%= @_path %> diff --git a/environments/production/modules/apache/templates/mod/mime.conf.erb b/environments/production/modules/apache/templates/mod/mime.conf.erb new file mode 100644 index 0000000..46d021c --- /dev/null +++ b/environments/production/modules/apache/templates/mod/mime.conf.erb @@ -0,0 +1,38 @@ +TypesConfig <%= @mime_types_config %> + +AddType application/x-compress .Z +AddType application/x-gzip .gz .tgz +AddType application/x-bzip2 .bz2 + +AddLanguage ca .ca +AddLanguage cs .cz .cs +AddLanguage da .dk +AddLanguage de .de +AddLanguage el .el +AddLanguage en .en +AddLanguage eo .eo +AddLanguage es .es +AddLanguage et .et +AddLanguage fr .fr +AddLanguage he .he +AddLanguage hr .hr +AddLanguage it .it +AddLanguage ja .ja +AddLanguage ko .ko +AddLanguage ltz .ltz +AddLanguage nl .nl +AddLanguage nn .nn +AddLanguage no .no +AddLanguage pl .po +AddLanguage pt .pt +AddLanguage pt-BR .pt-br +AddLanguage ru .ru +AddLanguage sv .sv +AddLanguage zh-CN .zh-cn +AddLanguage zh-TW .zh-tw + +<%- @_mime_types_additional.sort.each do |add_mime, config| -%> + <%- config.each do |type, extension| %> +<%= add_mime %> <%= type %> <%= extension%> + <%- end -%> +<% end %> diff --git a/environments/production/modules/apache/templates/mod/mime_magic.conf.erb b/environments/production/modules/apache/templates/mod/mime_magic.conf.erb new file mode 100644 index 0000000..cbc173d --- /dev/null +++ b/environments/production/modules/apache/templates/mod/mime_magic.conf.erb @@ -0,0 +1 @@ +MIMEMagicFile "<%= @_magic_file %>" diff --git a/environments/production/modules/apache/templates/mod/mpm_event.conf.erb b/environments/production/modules/apache/templates/mod/mpm_event.conf.erb new file mode 100644 index 0000000..eb6f1ff --- /dev/null +++ b/environments/production/modules/apache/templates/mod/mpm_event.conf.erb @@ -0,0 +1,9 @@ + + StartServers 2 + MinSpareThreads 25 + MaxSpareThreads 75 + ThreadLimit 64 + ThreadsPerChild 25 + MaxClients 150 + MaxRequestsPerChild 0 + diff --git a/environments/production/modules/apache/templates/mod/negotiation.conf.erb b/environments/production/modules/apache/templates/mod/negotiation.conf.erb new file mode 100644 index 0000000..2fb4700 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/negotiation.conf.erb @@ -0,0 +1,2 @@ +LanguagePriority <%= Array(@language_priority).join(' ') %> +ForceLanguagePriority <%= Array(@force_language_priority).join(' ') %> diff --git a/environments/production/modules/apache/templates/mod/nss.conf.erb b/environments/production/modules/apache/templates/mod/nss.conf.erb new file mode 100644 index 0000000..36f83d8 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/nss.conf.erb @@ -0,0 +1,228 @@ +# +# This is the Apache server configuration file providing SSL support using. +# the mod_nss plugin. It contains the configuration directives to instruct +# the server how to serve pages over an https connection. +# +# Do NOT simply read the instructions in here without understanding +# what they do. They're here only as hints or reminders. If you are unsure +# consult the online docs. You have been warned. +# + +#LoadModule nss_module modules/libmodnss.so + +# +# When we also provide SSL we have to listen to the +# standard HTTP port (see above) and to the HTTPS port +# +# Note: Configurations that use IPv6 but not IPv4-mapped addresses need two +# Listen directives: "Listen [::]:8443" and "Listen 0.0.0.0:443" +# +Listen <%= @port %> + +## +## SSL Global Context +## +## All SSL configuration in this context applies both to +## the main server and all SSL-enabled virtual hosts. +## + +# +# Some MIME-types for downloading Certificates and CRLs +# +AddType application/x-x509-ca-cert .crt +AddType application/x-pkcs7-crl .crl + +# Pass Phrase Dialog: +# Configure the pass phrase gathering process. +# The filtering dialog program (`builtin' is a internal +# terminal dialog) has to provide the pass phrase on stdout. +<% if @passwd_file -%> +NSSPassPhraseDialog "file:<%= @passwd_file %>" +<% else -%> +NSSPassPhraseDialog builtin +<% end -%> + +# Pass Phrase Helper: +# This helper program stores the token password pins between +# restarts of Apache. +NSSPassPhraseHelper /usr/sbin/nss_pcache + +# Configure the SSL Session Cache. +# NSSSessionCacheSize is the number of entries in the cache. +# NSSSessionCacheTimeout is the SSL2 session timeout (in seconds). +# NSSSession3CacheTimeout is the SSL3/TLS session timeout (in seconds). +NSSSessionCacheSize 10000 +NSSSessionCacheTimeout 100 +NSSSession3CacheTimeout 86400 + +# +# Pseudo Random Number Generator (PRNG): +# Configure one or more sources to seed the PRNG of the SSL library. +# The seed data should be of good random quality. +# WARNING! On some platforms /dev/random blocks if not enough entropy +# is available. Those platforms usually also provide a non-blocking +# device, /dev/urandom, which may be used instead. +# +# This does not support seeding the RNG with each connection. + +NSSRandomSeed startup builtin +#NSSRandomSeed startup file:/dev/random 512 +#NSSRandomSeed startup file:/dev/urandom 512 + +# +# TLS Negotiation configuration under RFC 5746 +# +# Only renegotiate if the peer's hello bears the TLS renegotiation_info +# extension. Default off. +NSSRenegotiation off + +# Peer must send Signaling Cipher Suite Value (SCSV) or +# Renegotiation Info (RI) extension in ALL handshakes. Default: off +NSSRequireSafeNegotiation off + +## +## SSL Virtual Host Context +## + +> + +# General setup for the virtual host +#DocumentRoot "/etc/httpd/htdocs" +#ServerName www.example.com:8443 +#ServerAdmin you@example.com + +# mod_nss can log to separate log files, you can choose to do that if you'd like +# LogLevel is not inherited from httpd.conf. +ErrorLog "<%= @error_log %>" +TransferLog "<%= @transfer_log %>" +LogLevel warn + +# SSL Engine Switch: +# Enable/Disable SSL for this virtual host. +NSSEngine on + +# SSL Cipher Suite: +# List the ciphers that the client is permitted to negotiate. +# See the mod_nss documentation for a complete list. + +# SSL 3 ciphers. SSL 2 is disabled by default. +NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha + +# SSL 3 ciphers + ECC ciphers. SSL 2 is disabled by default. +# +# Comment out the NSSCipherSuite line above and use the one below if you have +# ECC enabled NSS and mod_nss and want to use Elliptical Curve Cryptography +#NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha,-ecdh_ecdsa_null_sha,+ecdh_ecdsa_rc4_128_sha,+ecdh_ecdsa_3des_sha,+ecdh_ecdsa_aes_128_sha,+ecdh_ecdsa_aes_256_sha,-ecdhe_ecdsa_null_sha,+ecdhe_ecdsa_rc4_128_sha,+ecdhe_ecdsa_3des_sha,+ecdhe_ecdsa_aes_128_sha,+ecdhe_ecdsa_aes_256_sha,-ecdh_rsa_null_sha,+ecdh_rsa_128_sha,+ecdh_rsa_3des_sha,+ecdh_rsa_aes_128_sha,+ecdh_rsa_aes_256_sha,-echde_rsa_null,+ecdhe_rsa_rc4_128_sha,+ecdhe_rsa_3des_sha,+ecdhe_rsa_aes_128_sha,+ecdhe_rsa_aes_256_sha + +# SSL Protocol: +# Cryptographic protocols that provide communication security. +# NSS handles the specified protocols as "ranges", and automatically +# negotiates the use of the strongest protocol for a connection starting +# with the maximum specified protocol and downgrading as necessary to the +# minimum specified protocol that can be used between two processes. +# Since all protocol ranges are completely inclusive, and no protocol in the +# middle of a range may be excluded, the entry "NSSProtocol TLSv1.0,TLSv1.2" +# is identical to the entry "NSSProtocol TLSv1.0,TLSv1.1,TLSv1.2". +NSSProtocol TLSv1.0,TLSv1.1 + +# SSL Certificate Nickname: +# The nickname of the RSA server certificate you are going to use. +NSSNickname Server-Cert + +# SSL Certificate Nickname: +# The nickname of the ECC server certificate you are going to use, if you +# have an ECC-enabled version of NSS and mod_nss +#NSSECCNickname Server-Cert-ecc + +# Server Certificate Database: +# The NSS security database directory that holds the certificates and +# keys. The database consists of 3 files: cert8.db, key3.db and secmod.db. +# Provide the directory that these files exist. +NSSCertificateDatabase "<%= @httpd_dir -%>/alias" + +# Database Prefix: +# In order to be able to store multiple NSS databases in one directory +# they need unique names. This option sets the database prefix used for +# cert8.db and key3.db. +#NSSDBPrefix my-prefix- + +# Client Authentication (Type): +# Client certificate verification type. Types are none, optional and +# require. +#NSSVerifyClient none + +# +# Online Certificate Status Protocol (OCSP). +# Verify that certificates have not been revoked before accepting them. +#NSSOCSP off + +# +# Use a default OCSP responder. If enabled this will be used regardless +# of whether one is included in a client certificate. Note that the +# server certificate is verified during startup. +# +# NSSOCSPDefaultURL defines the service URL of the OCSP responder +# NSSOCSPDefaultName is the nickname of the certificate to trust to +# sign the OCSP responses. +#NSSOCSPDefaultResponder on +#NSSOCSPDefaultURL http://example.com/ocsp/status +#NSSOCSPDefaultName ocsp-nickname + +# Access Control: +# With SSLRequire you can do per-directory access control based +# on arbitrary complex boolean expressions containing server +# variable checks and other lookup directives. The syntax is a +# mixture between C and Perl. See the mod_nss documentation +# for more details. +# +#NSSRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \ +# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ +# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \ +# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ +# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ +# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ +# + +# SSL Engine Options: +# Set various options for the SSL engine. +# o FakeBasicAuth: +# Translate the client X.509 into a Basic Authorisation. This means that +# the standard Auth/DBMAuth methods can be used for access control. The +# user name is the `one line' version of the client's X.509 certificate. +# Note that no password is obtained from the user. Every entry in the user +# file needs this password: `xxj31ZMTZzkVA'. +# o ExportCertData: +# This exports two additional environment variables: SSL_CLIENT_CERT and +# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the +# server (always existing) and the client (only existing when client +# authentication is used). This can be used to import the certificates +# into CGI scripts. +# o StdEnvVars: +# This exports the standard SSL/TLS related `SSL_*' environment variables. +# Per default this exportation is switched off for performance reasons, +# because the extraction step is an expensive operation and is usually +# useless for serving static content. So one usually enables the +# exportation for CGI and SSI requests only. +# o StrictRequire: +# This denies access when "NSSRequireSSL" or "NSSRequire" applied even +# under a "Satisfy any" situation, i.e. when it applies access is denied +# and no other module can change it. +# o OptRenegotiate: +# This enables optimized SSL connection renegotiation handling when SSL +# directives are used in per-directory context. +#NSSOptions +FakeBasicAuth +ExportCertData +CompatEnvVars +StrictRequire + + NSSOptions +StdEnvVars + + + NSSOptions +StdEnvVars + + +# Per-Server Logging: +# The home of a custom SSL log file. Use this when you want a +# compact non-error SSL logfile on a virtual host basis. +#CustomLog /home/rcrit/redhat/apache/logs/ssl_request_log \ +# "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" + + + diff --git a/environments/production/modules/apache/templates/mod/pagespeed.conf.erb b/environments/production/modules/apache/templates/mod/pagespeed.conf.erb new file mode 100644 index 0000000..56e72fe --- /dev/null +++ b/environments/production/modules/apache/templates/mod/pagespeed.conf.erb @@ -0,0 +1,102 @@ +ModPagespeed on + +ModPagespeedInheritVHostConfig <%= @inherit_vhost_config %> +AddOutputFilterByType MOD_PAGESPEED_OUTPUT_FILTER text/html +<% if @filter_xhtml -%> +AddOutputFilterByType MOD_PAGESPEED_OUTPUT_FILTER application/xhtml+xml +<% end -%> +ModPagespeedFileCachePath "<%= @cache_path %>" +ModPagespeedLogDir "<%= @log_dir %>" + +<% @memcache_servers.each do |server| -%> +ModPagespeedMemcachedServers <%= server %> +<% end -%> + +ModPagespeedRewriteLevel <%= @rewrite_level -%> + +<% @disable_filters.each do |filter| -%> +ModPagespeedDisableFilters <%= filter %> +<% end -%> + +<% @enable_filters.each do |filter| -%> +ModPagespeedEnableFilters <%= filter %> +<% end -%> + +<% @forbid_filters.each do |filter| -%> +ModPagespeedForbidFilters <%= filter %> +<% end -%> + +ModPagespeedRewriteDeadlinePerFlushMs <%= @rewrite_deadline_per_flush_ms %> + +<% if @additional_domains -%> +ModPagespeedDomain <%= @additional_domains -%> +<% end -%> + +ModPagespeedFileCacheSizeKb <%= @file_cache_size_kb %> +ModPagespeedFileCacheCleanIntervalMs <%= @file_cache_clean_interval_ms %> +ModPagespeedLRUCacheKbPerProcess <%= @lru_cache_per_process %> +ModPagespeedLRUCacheByteLimit <%= @lru_cache_byte_limit %> +ModPagespeedCssFlattenMaxBytes <%= @css_flatten_max_bytes %> +ModPagespeedCssInlineMaxBytes <%= @css_inline_max_bytes %> +ModPagespeedCssImageInlineMaxBytes <%= @css_image_inline_max_bytes %> +ModPagespeedImageInlineMaxBytes <%= @image_inline_max_bytes %> +ModPagespeedJsInlineMaxBytes <%= @js_inline_max_bytes %> +ModPagespeedCssOutlineMinBytes <%= @css_outline_min_bytes %> +ModPagespeedJsOutlineMinBytes <%= @js_outline_min_bytes %> + + +ModPagespeedFileCacheInodeLimit <%= @inode_limit %> +ModPagespeedImageMaxRewritesAtOnce <%= @image_max_rewrites_at_once %> + +ModPagespeedNumRewriteThreads <%= @num_rewrite_threads %> +ModPagespeedNumExpensiveRewriteThreads <%= @num_expensive_rewrite_threads %> + +ModPagespeedStatistics <%= @collect_statistics %> + + + # You may insert other "Allow from" lines to add hosts you want to + # allow to look at generated statistics. Another possibility is + # to comment out the "Order" and "Allow" options from the config + # file, to allow any client that can reach your server to examine + # statistics. This might be appropriate in an experimental setup or + # if the Apache server is protected by a reverse proxy that will + # filter URLs in some fashion. + <%- if scope.function_versioncmp([@_apache_version, '2.4']) >= 0 -%> + Require ip 127.0.0.1 ::1 <%= Array(@allow_view_stats).join(" ") %> + <%- else -%> + Order allow,deny + Allow from 127.0.0.1 ::1 <%= Array(@allow_view_stats).join(" ") %> + <%- end -%> + SetHandler mod_pagespeed_statistics + + +ModPagespeedStatisticsLogging <%= @statistics_logging %> + + <%- if scope.function_versioncmp([@_apache_version, '2.4']) >= 0 -%> + Require ip 127.0.0.1 ::1 <%= Array(@allow_pagespeed_console).join(" ") %> + <%- else -%> + Order allow,deny + Allow from 127.0.0.1 ::1 <%= Array(@allow_pagespeed_console).join(" ") %> + <%- end -%> + SetHandler pagespeed_console + + +ModPagespeedMessageBufferSize <%= @message_buffer_size %> + + + <%- if scope.function_versioncmp([@_apache_version, '2.4']) >= 0 -%> + Require ip 127.0.0.1 ::1 <%= Array(@allow_pagespeed_message).join(" ") %> + <%- else -%> + Order allow,deny + Allow from 127.0.0.1 ::1 <%= Array(@allow_pagespeed_message).join(" ") %> + <%- end -%> + SetHandler mod_pagespeed_message + + +<% if @additional_configuration.is_a? Array -%> +<%= @additional_configuration.join("\n") %> +<% else -%> +<% @additional_configuration.each_pair do |key, value| -%> +<%= key %> <%= value %> +<% end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/mod/passenger.conf.erb b/environments/production/modules/apache/templates/mod/passenger.conf.erb new file mode 100644 index 0000000..03ff534 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/passenger.conf.erb @@ -0,0 +1,61 @@ +# The Passenger Apache module configuration file is being +# managed by Puppet and changes will be overwritten. + + <%- if @passenger_root -%> + PassengerRoot "<%= @passenger_root %>" + <%- end -%> + <%- if @passenger_ruby -%> + PassengerRuby "<%= @passenger_ruby %>" + <%- end -%> + <%- if @passenger_default_ruby -%> + PassengerDefaultRuby "<%= @passenger_default_ruby %>" + <%- end -%> + <%- if @passenger_high_performance -%> + PassengerHighPerformance <%= @passenger_high_performance %> + <%- end -%> + <%- if @passenger_max_pool_size -%> + PassengerMaxPoolSize <%= @passenger_max_pool_size %> + <%- end -%> + <%- if @passenger_min_instances -%> + PassengerMinInstances <%= @passenger_min_instances %> + <%- end -%> + <%- if @passenger_max_instances_per_app -%> + PassengerMaxInstancesPerApp <%= @passenger_max_instances_per_app %> + <%- end -%> + <%- if @passenger_pool_idle_time -%> + PassengerPoolIdleTime <%= @passenger_pool_idle_time %> + <%- end -%> + <%- if @passenger_max_request_queue_size -%> + PassengerMaxRequestQueueSize <%= @passenger_max_request_queue_size %> + <%- end -%> + <%- if @passenger_max_requests -%> + PassengerMaxRequests <%= @passenger_max_requests %> + <%- end -%> + <%- if @passenger_spawn_method -%> + PassengerSpawnMethod <%= @passenger_spawn_method %> + <%- end -%> + <%- if @passenger_stat_throttle_rate -%> + PassengerStatThrottleRate <%= @passenger_stat_throttle_rate %> + <%- end -%> + <%- if @rack_autodetect -%> + RackAutoDetect <%= @rack_autodetect %> + <%- end -%> + <%- if @rails_autodetect -%> + RailsAutoDetect <%= @rails_autodetect %> + <%- end -%> + <%- if @passenger_use_global_queue -%> + PassengerUseGlobalQueue <%= @passenger_use_global_queue %> + <%- end -%> + <%- if @passenger_app_env -%> + PassengerAppEnv <%= @passenger_app_env %> + <%- end -%> + <%- if @passenger_log_file -%> + PassengerLogFile <%= @passenger_log_file %> + <%- end -%> + <%- if @passenger_log_level -%> + PassengerLogLevel <%= @passenger_log_level %> + <%- end -%> + <%- if @passenger_data_buffer_dir -%> + PassengerDataBufferDir <%= @passenger_data_buffer_dir %> + <%- end -%> + diff --git a/environments/production/modules/apache/templates/mod/peruser.conf.erb b/environments/production/modules/apache/templates/mod/peruser.conf.erb new file mode 100644 index 0000000..13c8d70 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/peruser.conf.erb @@ -0,0 +1,12 @@ + + MinSpareProcessors <%= @minspareprocessors %> + MinProcessors <%= @minprocessors %> + MaxProcessors <%= @maxprocessors %> + MaxClients <%= @maxclients %> + MaxRequestsPerChild <%= @maxrequestsperchild %> + IdleTimeout <%= @idletimeout %> + ExpireTimeout <%= @expiretimeout %> + KeepAlive <%= @keepalive %> + Include "<%= @mod_dir %>/peruser/multiplexers/*.conf" + Include "<%= @mod_dir %>/peruser/processors/*.conf" + diff --git a/environments/production/modules/apache/templates/mod/php.conf.erb b/environments/production/modules/apache/templates/mod/php.conf.erb new file mode 100644 index 0000000..9e684fe --- /dev/null +++ b/environments/production/modules/apache/templates/mod/php.conf.erb @@ -0,0 +1,23 @@ +# +# PHP is an HTML-embedded scripting language which attempts to make it +# easy for developers to write dynamically generated webpages. +# + +# +# Cause the PHP interpreter to handle files with a .php extension. +# +)$"> + SetHandler application/x-httpd-php + + +# +# Add index.php to the list of files that will be served as directory +# indexes. +# +DirectoryIndex index.php + +# +# Uncomment the following line to allow PHP to pretty-print .phps +# files as PHP source code: +# +#AddType application/x-httpd-php-source .phps diff --git a/environments/production/modules/apache/templates/mod/prefork.conf.erb b/environments/production/modules/apache/templates/mod/prefork.conf.erb new file mode 100644 index 0000000..aabfdf7 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/prefork.conf.erb @@ -0,0 +1,8 @@ + + StartServers <%= @startservers %> + MinSpareServers <%= @minspareservers %> + MaxSpareServers <%= @maxspareservers %> + ServerLimit <%= @serverlimit %> + MaxClients <%= @maxclients %> + MaxRequestsPerChild <%= @maxrequestsperchild %> + diff --git a/environments/production/modules/apache/templates/mod/proxy.conf.erb b/environments/production/modules/apache/templates/mod/proxy.conf.erb new file mode 100644 index 0000000..d023c14 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/proxy.conf.erb @@ -0,0 +1,27 @@ +# +# Proxy Server directives. Uncomment the following lines to +# enable the proxy server: +# + + # Do not enable proxying with ProxyRequests until you have secured your + # server. Open proxy servers are dangerous both to your network and to the + # Internet at large. + ProxyRequests <%= @proxy_requests %> + + <% if @proxy_requests != 'Off' or ( @allow_from and ! @allow_from.empty? ) -%> + + <%- if scope.function_versioncmp([@_apache_version, '2.4']) >= 0 -%> + Require ip <%= Array(@allow_from).join(" ") %> + <%- else -%> + Order deny,allow + Deny from all + Allow from <%= Array(@allow_from).join(" ") %> + <%- end -%> + + <% end -%> + + # Enable/disable the handling of HTTP/1.1 "Via:" headers. + # ("Full" adds the server version; "Block" removes all outgoing Via: headers) + # Set to one of: Off | On | Full | Block + ProxyVia <%= @proxy_via %> + diff --git a/environments/production/modules/apache/templates/mod/proxy_balancer.conf.erb b/environments/production/modules/apache/templates/mod/proxy_balancer.conf.erb new file mode 100644 index 0000000..c1f37be --- /dev/null +++ b/environments/production/modules/apache/templates/mod/proxy_balancer.conf.erb @@ -0,0 +1,10 @@ +> + SetHandler balancer-manager + <%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%> + Require ip <%= Array(@allow_from).join(" ") %> + <%- else -%> + Order deny,allow + Deny from all + Allow from <%= Array(@allow_from).join(" ") %> + <%- end -%> + diff --git a/environments/production/modules/apache/templates/mod/proxy_html.conf.erb b/environments/production/modules/apache/templates/mod/proxy_html.conf.erb new file mode 100644 index 0000000..fea15f3 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/proxy_html.conf.erb @@ -0,0 +1,18 @@ +ProxyHTMLLinks a href +ProxyHTMLLinks area href +ProxyHTMLLinks link href +ProxyHTMLLinks img src longdesc usemap +ProxyHTMLLinks object classid codebase data usemap +ProxyHTMLLinks q cite +ProxyHTMLLinks blockquote cite +ProxyHTMLLinks ins cite +ProxyHTMLLinks del cite +ProxyHTMLLinks form action +ProxyHTMLLinks input src usemap +ProxyHTMLLinks head profileProxyHTMLLinks base href +ProxyHTMLLinks script src for + +ProxyHTMLEvents onclick ondblclick onmousedown onmouseup \ + onmouseover onmousemove onmouseout onkeypress \ + onkeydown onkeyup onfocus onblur onload \ + onunload onsubmit onreset onselect onchange diff --git a/environments/production/modules/apache/templates/mod/remoteip.conf.erb b/environments/production/modules/apache/templates/mod/remoteip.conf.erb new file mode 100644 index 0000000..e10ebb5 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/remoteip.conf.erb @@ -0,0 +1,23 @@ +# Declare the header field which should be parsed for useragent IP addresses +RemoteIPHeader <%= @header %> + +<%- if @proxy_ips -%> +# Declare client intranet IP addresses trusted to present +# the RemoteIPHeader value +<%- [@proxy_ips].flatten.each do |proxy| -%> +RemoteIPInternalProxy <%= proxy %> +<%- end -%> +<%- end -%> + +<%- if @proxies_header -%> +# Declare the header field which will record all intermediate IP addresses +RemoteIPProxiesHeader <%= @proxies_header %> +<%- end -%> + +<%- if @trusted_proxy_ips -%> +# Declare client intranet IP addresses trusted to present +# the RemoteIPHeader value + <%- [@trusted_proxy_ips].flatten.each do |proxy| -%> +RemoteIPTrustedProxy <%= proxy %> + <%- end -%> +<%- end -%> diff --git a/environments/production/modules/apache/templates/mod/reqtimeout.conf.erb b/environments/production/modules/apache/templates/mod/reqtimeout.conf.erb new file mode 100644 index 0000000..6ffc5ff --- /dev/null +++ b/environments/production/modules/apache/templates/mod/reqtimeout.conf.erb @@ -0,0 +1,3 @@ +<% Array(@timeouts).each do |timeout| -%> +RequestReadTimeout <%= timeout %> +<%- end -%> diff --git a/environments/production/modules/apache/templates/mod/rpaf.conf.erb b/environments/production/modules/apache/templates/mod/rpaf.conf.erb new file mode 100644 index 0000000..56e2398 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/rpaf.conf.erb @@ -0,0 +1,15 @@ +# Enable reverse proxy add forward +RPAFenable On +# RPAFsethostname will, when enabled, take the incoming X-Host header and +# update the virtual host settings accordingly. This allows to have the same +# hostnames as in the "real" configuration for the forwarding proxy. +<% if @sethostname -%> +RPAFsethostname On +<% else -%> +RPAFsethostname Off +<% end -%> +# Which IPs are forwarding requests to us +RPAFproxy_ips <%= Array(@proxy_ips).join(" ") %> +# Setting RPAFheader allows you to change the header name to parse from the +# default X-Forwarded-For to something of your choice. +RPAFheader <%= @header %> diff --git a/environments/production/modules/apache/templates/mod/security.conf.erb b/environments/production/modules/apache/templates/mod/security.conf.erb new file mode 100644 index 0000000..638332e --- /dev/null +++ b/environments/production/modules/apache/templates/mod/security.conf.erb @@ -0,0 +1,80 @@ + + # Default recommended configuration + SecRuleEngine <%= @modsec_secruleengine %> + SecRequestBodyAccess On + SecRule REQUEST_HEADERS:Content-Type "text/xml" \ + "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML" + SecRequestBodyLimit <%= @secrequestbodylimit %> + SecRequestBodyNoFilesLimit <%= @secrequestbodynofileslimit %> + SecRequestBodyInMemoryLimit <%= @secrequestbodyinmemorylimit %> + SecRequestBodyLimitAction Reject + SecRule REQBODY_ERROR "!@eq 0" \ + "id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2" + SecRule MULTIPART_STRICT_ERROR "!@eq 0" \ + "id:'200002',phase:2,t:none,log,deny,status:44,msg:'Multipart request body failed strict validation: \ + PE %{REQBODY_PROCESSOR_ERROR}, \ + BQ %{MULTIPART_BOUNDARY_QUOTED}, \ + BW %{MULTIPART_BOUNDARY_WHITESPACE}, \ + DB %{MULTIPART_DATA_BEFORE}, \ + DA %{MULTIPART_DATA_AFTER}, \ + HF %{MULTIPART_HEADER_FOLDING}, \ + LF %{MULTIPART_LF_LINE}, \ + SM %{MULTIPART_MISSING_SEMICOLON}, \ + IQ %{MULTIPART_INVALID_QUOTING}, \ + IP %{MULTIPART_INVALID_PART}, \ + IH %{MULTIPART_INVALID_HEADER_FOLDING}, \ + FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'" + + SecRule &REQUEST_HEADERS:Proxy "@gt 0" "id:1000005,log,deny,msg:'httpoxy denied'" + + + SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \ + "id:'200003',phase:2,t:none,log,deny,status:44,msg:'Multipart parser detected a possible unmatched boundary.'" + + SecPcreMatchLimit <%= @secpcrematchlimit %> + SecPcreMatchLimitRecursion <%= @secpcrematchlimitrecursion %> + + SecRule TX:/^MSC_/ "!@streq 0" \ + "id:'200004',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'" + + SecResponseBodyAccess Off + SecResponseBodyMimeType text/plain text/html text/xml + SecResponseBodyLimit 524288 + SecResponseBodyLimitAction ProcessPartial + SecDebugLogLevel 0 + SecAuditEngine RelevantOnly + SecAuditLogRelevantStatus "<%= @audit_log_relevant_status %>" + SecAuditLogParts <%= @audit_log_parts %> + SecAuditLogType Serial + SecArgumentSeparator & + SecCookieFormat 0 +<%- if scope.lookupvar('::osfamily') == 'Debian' -%> + SecDebugLog <%= @logroot %>/modsec_debug.log + SecAuditLog <%= @logroot %>/modsec_audit.log + SecTmpDir /var/cache/modsecurity + SecDataDir /var/cache/modsecurity + SecUploadDir /var/cache/modsecurity +<%- elsif scope.lookupvar('::osfamily') == 'Suse' -%> + SecDebugLog /var/log/apache2/modsec_debug.log + SecAuditLog /var/log/apache2/modsec_audit.log + SecTmpDir /var/lib/mod_security + SecDataDir /var/lib/mod_security + SecUploadDir /var/lib/mod_security +<% else -%> + SecDebugLog <%= @logroot %>/modsec_debug.log + SecAuditLog <%= @logroot %>/modsec_audit.log + SecTmpDir /var/lib/mod_security + SecDataDir /var/lib/mod_security + SecUploadDir /var/lib/mod_security +<% end -%> + SecUploadKeepFiles Off + + # ModSecurity Core Rules Set configuration +<%- if scope.function_versioncmp([scope.lookupvar('::apache::apache_version'), '2.4']) >= 0 -%> + IncludeOptional <%= @modsec_dir %>/*.conf + IncludeOptional <%= @modsec_dir %>/activated_rules/*.conf +<%- else -%> + Include <%= @modsec_dir %>/*.conf + Include <%= @modsec_dir %>/activated_rules/*.conf +<%- end -%> + diff --git a/environments/production/modules/apache/templates/mod/security_crs.conf.erb b/environments/production/modules/apache/templates/mod/security_crs.conf.erb new file mode 100644 index 0000000..641daac --- /dev/null +++ b/environments/production/modules/apache/templates/mod/security_crs.conf.erb @@ -0,0 +1,436 @@ +# --------------------------------------------------------------- +# Core ModSecurity Rule Set ver.2.2.9 +# Copyright (C) 2006-2012 Trustwave All rights reserved. +# +# The OWASP ModSecurity Core Rule Set is distributed under +# Apache Software License (ASL) version 2 +# Please see the enclosed LICENCE file for full details. +# --------------------------------------------------------------- + + +# +# -- [[ Recommended Base Configuration ]] ------------------------------------------------- +# +# The configuration directives/settings in this file are used to control +# the OWASP ModSecurity CRS. These settings do **NOT** configure the main +# ModSecurity settings such as: +# +# - SecRuleEngine +# - SecRequestBodyAccess +# - SecAuditEngine +# - SecDebugLog +# +# You should use the modsecurity.conf-recommended file that comes with the +# ModSecurity source code archive. +# +# Ref: https://github.com/SpiderLabs/ModSecurity/blob/master/modsecurity.conf-recommended +# + + +# +# -- [[ Rule Version ]] ------------------------------------------------------------------- +# +# Rule version data is added to the "Producer" line of Section H of the Audit log: +# +# - Producer: ModSecurity for Apache/2.7.0-rc1 (http://www.modsecurity.org/); OWASP_CRS/2.2.4. +# +# Ref: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#wiki-SecComponentSignature +# +SecComponentSignature "OWASP_CRS/2.2.9" + + +# +# -- [[ Modes of Operation: Self-Contained vs. Collaborative Detection ]] ----------------- +# +# Each detection rule uses the "block" action which will inherit the SecDefaultAction +# specified below. Your settings here will determine which mode of operation you use. +# +# -- [[ Self-Contained Mode ]] -- +# Rules inherit the "deny" disruptive action. The first rule that matches will block. +# +# -- [[ Collaborative Detection Mode ]] -- +# This is a "delayed blocking" mode of operation where each matching rule will inherit +# the "pass" action and will only contribute to anomaly scores. Transactional blocking +# can be applied +# +# -- [[ Alert Logging Control ]] -- +# You have three options - +# +# - To log to both the Apache error_log and ModSecurity audit_log file use: "log" +# - To log *only* to the ModSecurity audit_log file use: "nolog,auditlog" +# - To log *only* to the Apache error_log file use: "log,noauditlog" +# +# Ref: http://blog.spiderlabs.com/2010/11/advanced-topic-of-the-week-traditional-vs-anomaly-scoring-detection-modes.html +# Ref: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#wiki-SecDefaultAction +# +SecDefaultAction "phase:1,<%= @_secdefaultaction -%>" +SecDefaultAction "phase:2,<%= @_secdefaultaction -%>" + +# +# -- [[ Collaborative Detection Severity Levels ]] ---------------------------------------- +# +# These are the default scoring points for each severity level. You may +# adjust these to you liking. These settings will be used in macro expansion +# in the rules to increment the anomaly scores when rules match. +# +# These are the default Severity ratings (with anomaly scores) of the individual rules - +# +# - 2: Critical - Anomaly Score of 5. +# Is the highest severity level possible without correlation. It is +# normally generated by the web attack rules (40 level files). +# - 3: Error - Anomaly Score of 4. +# Is generated mostly from outbound leakage rules (50 level files). +# - 4: Warning - Anomaly Score of 3. +# Is generated by malicious client rules (35 level files). +# - 5: Notice - Anomaly Score of 2. +# Is generated by the Protocol policy and anomaly files. +# +SecAction \ + "id:'900001', \ + phase:1, \ + t:none, \ + setvar:tx.critical_anomaly_score=<%= @critical_anomaly_score -%>, \ + setvar:tx.error_anomaly_score=<%= @error_anomaly_score -%>, \ + setvar:tx.warning_anomaly_score=<%= @warning_anomaly_score -%>, \ + setvar:tx.notice_anomaly_score=<%= @notice_anomaly_score -%>, \ + nolog, \ + pass" + + +# +# -- [[ Collaborative Detection Scoring Initialization and Threshold Levels ]] ------------------------------ +# +# These variables are used in macro expansion in the 49 inbound blocking and 59 +# outbound blocking files. +# +# **MUST HAVE** ModSecurity v2.5.12 or higher to use macro expansion in numeric +# operators. If you have an earlier version, edit the 49/59 files directly to +# set the appropriate anomaly score levels. +# +# You should set the score level (rule 900003) to the proper threshold you +# would prefer. If set to "5" it will work similarly to previous Mod CRS rules +# and will create an event in the error_log file if there are any rules that +# match. If you would like to lessen the number of events generated in the +# error_log file, you should increase the anomaly score threshold to something +# like "20". This would only generate an event in the error_log file if there +# are multiple lower severity rule matches or if any 1 higher severity item matches. +# +SecAction \ + "id:'900002', \ + phase:1, \ + t:none, \ + setvar:tx.anomaly_score=0, \ + setvar:tx.sql_injection_score=0, \ + setvar:tx.xss_score=0, \ + setvar:tx.inbound_anomaly_score=0, \ + setvar:tx.outbound_anomaly_score=0, \ + nolog, \ + pass" + + +SecAction \ + "id:'900003', \ + phase:1, \ + t:none, \ + setvar:tx.inbound_anomaly_score_level=<%= @inbound_anomaly_threshold -%>, \ + setvar:tx.outbound_anomaly_score_level=<%= @outbound_anomaly_threshold -%>, \ + nolog, \ + pass" + + +# +# -- [[ Collaborative Detection Blocking ]] ----------------------------------------------- +# +# This is a collaborative detection mode where each rule will increment an overall +# anomaly score for the transaction. The scores are then evaluated in the following files: +# +# Inbound anomaly score - checked in the modsecurity_crs_49_inbound_blocking.conf file +# Outbound anomaly score - checked in the modsecurity_crs_59_outbound_blocking.conf file +# +# If you want to use anomaly scoring mode, then uncomment this line. +# +SecAction \ + "id:'900004', \ + phase:1, \ + t:none, \ + setvar:tx.anomaly_score_blocking=<%= @anomaly_score_blocking -%>, \ + nolog, \ + pass" + + +# +# -- [[ GeoIP Database ]] ----------------------------------------------------------------- +# +# There are some rulesets that need to inspect the GEO data of the REMOTE_ADDR data. +# +# You must first download the MaxMind GeoIP Lite City DB - +# +# http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz +# +# You then need to define the proper path for the SecGeoLookupDb directive +# +# Ref: http://blog.spiderlabs.com/2010/10/detecting-malice-with-modsecurity-geolocation-data.html +# Ref: http://blog.spiderlabs.com/2010/11/detecting-malice-with-modsecurity-ip-forensics.html +# +#SecGeoLookupDb /opt/modsecurity/lib/GeoLiteCity.dat + +# +# -- [[ Regression Testing Mode ]] -------------------------------------------------------- +# +# If you are going to run the regression testing mode, you should uncomment the +# following rule. It will enable DetectionOnly mode for the SecRuleEngine and +# will enable Response Header tagging so that the client testing script can see +# which rule IDs have matched. +# +# You must specify the your source IP address where you will be running the tests +# from. +# +#SecRule REMOTE_ADDR "@ipMatch 192.168.1.100" \ + "id:'900005', \ + phase:1, \ + t:none, \ + ctl:ruleEngine=DetectionOnly, \ + setvar:tx.regression_testing=1, \ + nolog, \ + pass" + + +# +# -- [[ HTTP Policy Settings ]] ---------------------------------------------------------- +# +# Set the following policy settings here and they will be propagated to the 23 rules +# file (modsecurity_common_23_request_limits.conf) by using macro expansion. +# If you run into false positives, you can adjust the settings here. +# +# Only the max number of args is uncommented by default as there are a high rate +# of false positives. Uncomment the items you wish to set. +# +# +# -- Maximum number of arguments in request limited +SecAction \ + "id:'900006', \ + phase:1, \ + t:none, \ + setvar:tx.max_num_args=<%= @secrequestmaxnumargs %>, \ + nolog, \ + pass" + +# +# -- Limit argument name length +#SecAction \ + "id:'900007', \ + phase:1, \ + t:none, \ + setvar:tx.arg_name_length=100, \ + nolog, \ + pass" + +# +# -- Limit value name length +#SecAction \ + "id:'900008', \ + phase:1, \ + t:none, \ + setvar:tx.arg_length=400, \ + nolog, \ + pass" + +# +# -- Limit arguments total length +#SecAction \ + "id:'900009', \ + phase:1, \ + t:none, \ + setvar:tx.total_arg_length=64000, \ + nolog, \ + pass" + +# +# -- Individual file size is limited +#SecAction \ + "id:'900010', \ + phase:1, \ + t:none, \ + setvar:tx.max_file_size=1048576, \ + nolog, \ + pass" + +# +# -- Combined file size is limited +#SecAction \ + "id:'900011', \ + phase:1, \ + t:none, \ + setvar:tx.combined_file_sizes=1048576, \ + nolog, \ + pass" + + +# +# Set the following policy settings here and they will be propagated to the 30 rules +# file (modsecurity_crs_30_http_policy.conf) by using macro expansion. +# If you run into false positves, you can adjust the settings here. +# +SecAction \ + "id:'900012', \ + phase:1, \ + t:none, \ + setvar:'tx.allowed_methods=<%= @allowed_methods -%>', \ + setvar:'tx.allowed_request_content_type=<%= @content_types -%>', \ + setvar:'tx.allowed_http_versions=HTTP/0.9 HTTP/1.0 HTTP/1.1', \ + setvar:'tx.restricted_extensions=<%= @restricted_extensions -%>', \ + setvar:'tx.restricted_headers=<%= @restricted_headers -%>', \ + nolog, \ + pass" + + +# +# -- [[ Content Security Policy (CSP) Settings ]] ----------------------------------------- +# +# The purpose of these settings is to send CSP response headers to +# Mozilla FireFox users so that you can enforce how dynamic content +# is used. CSP usage helps to prevent XSS attacks against your users. +# +# Reference Link: +# +# https://developer.mozilla.org/en/Security/CSP +# +# Uncomment this SecAction line if you want use CSP enforcement. +# You need to set the appropriate directives and settings for your site/domain and +# and activate the CSP file in the experimental_rules directory. +# +# Ref: http://blog.spiderlabs.com/2011/04/modsecurity-advanced-topic-of-the-week-integrating-content-security-policy-csp.html +# +#SecAction \ + "id:'900013', \ + phase:1, \ + t:none, \ + setvar:tx.csp_report_only=1, \ + setvar:tx.csp_report_uri=/csp_violation_report, \ + setenv:'csp_policy=allow \'self\'; img-src *.yoursite.com; media-src *.yoursite.com; style-src *.yoursite.com; frame-ancestors *.yoursite.com; script-src *.yoursite.com; report-uri %{tx.csp_report_uri}', \ + nolog, \ + pass" + + +# +# -- [[ Brute Force Protection ]] --------------------------------------------------------- +# +# If you are using the Brute Force Protection rule set, then uncomment the following +# lines and set the following variables: +# - Protected URLs: resources to protect (e.g. login pages) - set to your login page +# - Burst Time Slice Interval: time interval window to monitor for bursts +# - Request Threshold: request # threshold to trigger a burst +# - Block Period: temporary block timeout +# +#SecAction \ + "id:'900014', \ + phase:1, \ + t:none, \ + setvar:'tx.brute_force_protected_urls=#/login.jsp# #/partner_login.php#', \ + setvar:'tx.brute_force_burst_time_slice=60', \ + setvar:'tx.brute_force_counter_threshold=10', \ + setvar:'tx.brute_force_block_timeout=300', \ + nolog, \ + pass" + + +# +# -- [[ DoS Protection ]] ---------------------------------------------------------------- +# +# If you are using the DoS Protection rule set, then uncomment the following +# lines and set the following variables: +# - Burst Time Slice Interval: time interval window to monitor for bursts +# - Request Threshold: request # threshold to trigger a burst +# - Block Period: temporary block timeout +# +SecAction \ + "id:'900015', \ + phase:1, \ + t:none, \ + setvar:'tx.dos_burst_time_slice=60', \ + setvar:'tx.dos_counter_threshold=100', \ + setvar:'tx.dos_block_timeout=600', \ + nolog, \ + pass" + + +# +# -- [[ Check UTF enconding ]] ----------------------------------------------------------- +# +# We only want to apply this check if UTF-8 encoding is actually used by the site, otherwise +# it will result in false positives. +# +# Uncomment this line if your site uses UTF8 encoding +#SecAction \ + "id:'900016', \ + phase:1, \ + t:none, \ + setvar:tx.crs_validate_utf8_encoding=1, \ + nolog, \ + pass" + + +# +# -- [[ Enable XML Body Parsing ]] ------------------------------------------------------- +# +# The rules in this file will trigger the XML parser upon an XML request +# +# Initiate XML Processor in case of xml content-type +# +SecRule REQUEST_HEADERS:Content-Type "text/xml" \ + "id:'900017', \ + phase:1, \ + t:none,t:lowercase, \ + nolog, \ + pass, \ + chain" + SecRule REQBODY_PROCESSOR "!@streq XML" \ + "ctl:requestBodyProcessor=XML" + + +# +# -- [[ Global and IP Collections ]] ----------------------------------------------------- +# +# Create both Global and IP collections for rules to use +# There are some CRS rules that assume that these two collections +# have already been initiated. +# +SecRule REQUEST_HEADERS:User-Agent "^(.*)$" \ + "id:'900018', \ + phase:1, \ + t:none,t:sha1,t:hexEncode, \ + setvar:tx.ua_hash=%{matched_var}, \ + nolog, \ + pass" + + +SecRule REQUEST_HEADERS:x-forwarded-for "^\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b" \ + "id:'900019', \ + phase:1, \ + t:none, \ + capture, \ + setvar:tx.real_ip=%{tx.1}, \ + nolog, \ + pass" + + +SecRule &TX:REAL_IP "!@eq 0" \ + "id:'900020', \ + phase:1, \ + t:none, \ + initcol:global=global, \ + initcol:ip=%{tx.real_ip}_%{tx.ua_hash}, \ + nolog, \ + pass" + + +SecRule &TX:REAL_IP "@eq 0" \ + "id:'900021', \ + phase:1, \ + t:none, \ + initcol:global=global, \ + initcol:ip=%{remote_addr}_%{tx.ua_hash}, \ + setvar:tx.real_ip=%{remote_addr}, \ + nolog, \ + pass" + diff --git a/environments/production/modules/apache/templates/mod/setenvif.conf.erb b/environments/production/modules/apache/templates/mod/setenvif.conf.erb new file mode 100644 index 0000000..d31c79f --- /dev/null +++ b/environments/production/modules/apache/templates/mod/setenvif.conf.erb @@ -0,0 +1,34 @@ +# +# The following directives modify normal HTTP response behavior to +# handle known problems with browser implementations. +# +BrowserMatch "Mozilla/2" nokeepalive +BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0 +BrowserMatch "RealPlayer 4\.0" force-response-1.0 +BrowserMatch "Java/1\.0" force-response-1.0 +BrowserMatch "JDK/1\.0" force-response-1.0 + +# +# The following directive disables redirects on non-GET requests for +# a directory that does not include the trailing slash. This fixes a +# problem with Microsoft WebFolders which does not appropriately handle +# redirects for folders with DAV methods. +# Same deal with Apple's DAV filesystem and Gnome VFS support for DAV. +# +BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully +BrowserMatch "MS FrontPage" redirect-carefully +BrowserMatch "^WebDrive" redirect-carefully +BrowserMatch "^WebDAVFS/1.[0123]" redirect-carefully +BrowserMatch "^gnome-vfs/1.0" redirect-carefully +BrowserMatch "^gvfs/1" redirect-carefully +BrowserMatch "^XML Spy" redirect-carefully +BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully +BrowserMatch " Konqueror/4" redirect-carefully + + + BrowserMatch "MSIE [2-6]" \ + nokeepalive ssl-unclean-shutdown \ + downgrade-1.0 force-response-1.0 + # MSIE 7 and newer should be able to use keepalive + BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown + diff --git a/environments/production/modules/apache/templates/mod/ssl.conf.erb b/environments/production/modules/apache/templates/mod/ssl.conf.erb new file mode 100644 index 0000000..c4475cb --- /dev/null +++ b/environments/production/modules/apache/templates/mod/ssl.conf.erb @@ -0,0 +1,38 @@ + + SSLRandomSeed startup builtin + SSLRandomSeed startup file:/dev/urandom <%= @ssl_random_seed_bytes %> + SSLRandomSeed connect builtin + SSLRandomSeed connect file:/dev/urandom <%= @ssl_random_seed_bytes %> + + AddType application/x-x509-ca-cert .crt + AddType application/x-pkcs7-crl .crl + + SSLPassPhraseDialog <%= @ssl_pass_phrase_dialog %> + SSLSessionCache "shmcb:<%= @session_cache %>" + SSLSessionCacheTimeout <%= @ssl_sessioncachetimeout %> + <%- if scope.function_versioncmp([@_apache_version, '2.4']) >= 0 -%> + Mutex <%= @_ssl_mutex %> + <%- if @ssl_compression -%> + SSLCompression <%= scope.function_bool2httpd([@ssl_compression]) %> + <%- end -%> + <%- else -%> + SSLMutex <%= @_ssl_mutex %> + <%- end -%> + SSLCryptoDevice <%= @ssl_cryptodevice %> + SSLHonorCipherOrder <%= scope.function_bool2httpd([@_ssl_honorcipherorder]) %> +<% if scope.function_versioncmp([@_apache_version, '2.4']) >= 0 -%> + SSLUseStapling <%= scope.function_bool2httpd([@ssl_stapling]) %> + <%- if not @ssl_stapling_return_errors.nil? -%> + SSLStaplingReturnResponderErrors <%= scope.function_bool2httpd([@ssl_stapling_return_errors]) %> + <%- end -%> + SSLStaplingCache "shmcb:<%= @stapling_cache %>" +<% end -%> + SSLCipherSuite <%= @ssl_cipher %> + SSLProtocol <%= @ssl_protocol.compact.join(' ') %> +<% if @ssl_options -%> + SSLOptions <%= @ssl_options.compact.join(' ') %> +<% end -%> +<%- if @ssl_openssl_conf_cmd -%> + SSLOpenSSLConfCmd <%= @ssl_openssl_conf_cmd %> +<%- end -%> + diff --git a/environments/production/modules/apache/templates/mod/status.conf.erb b/environments/production/modules/apache/templates/mod/status.conf.erb new file mode 100644 index 0000000..6a6b3da --- /dev/null +++ b/environments/production/modules/apache/templates/mod/status.conf.erb @@ -0,0 +1,16 @@ +> + SetHandler server-status + <%- if scope.function_versioncmp([@_apache_version, '2.4']) >= 0 -%> + Require ip <%= Array(@allow_from).join(" ") %> + <%- else -%> + Order deny,allow + Deny from all + Allow from <%= Array(@allow_from).join(" ") %> + <%- end -%> + +ExtendedStatus <%= @extended_status %> + + + # Show Proxy LoadBalancer status in mod_status + ProxyStatus On + diff --git a/environments/production/modules/apache/templates/mod/suphp.conf.erb b/environments/production/modules/apache/templates/mod/suphp.conf.erb new file mode 100644 index 0000000..95fbf97 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/suphp.conf.erb @@ -0,0 +1,19 @@ + + AddType application/x-httpd-suphp .php .php3 .php4 .php5 .phtml + suPHP_AddHandler application/x-httpd-suphp + + + suPHP_Engine on + + + # By default, disable suPHP for debian packaged web applications as files + # are owned by root and cannot be executed by suPHP because of min_uid. + + suPHP_Engine off + + +# # Use a specific php config file (a dir which contains a php.ini file) +# suPHP_ConfigPath /etc/php4/cgi/suphp/ +# # Tells mod_suphp NOT to handle requests with the type . +# suPHP_RemoveHandler + diff --git a/environments/production/modules/apache/templates/mod/userdir.conf.erb b/environments/production/modules/apache/templates/mod/userdir.conf.erb new file mode 100644 index 0000000..d52583b --- /dev/null +++ b/environments/production/modules/apache/templates/mod/userdir.conf.erb @@ -0,0 +1,27 @@ + +<% if @disable_root -%> + UserDir disabled root +<% end -%> + UserDir <%= @home %>/*/<%= @dir %> + + /*/<%= @dir %>"> + AllowOverride FileInfo AuthConfig Limit Indexes + Options <%= @options.join(' ') %> + + <%- if scope.function_versioncmp([@_apache_version, '2.4']) >= 0 -%> + Require all granted + <%- else -%> + Order allow,deny + Allow from all + <%- end -%> + + + <%- if scope.function_versioncmp([@_apache_version, '2.4']) >= 0 -%> + Require all granted + <%- else -%> + Order allow,deny + Allow from all + <%- end -%> + + + diff --git a/environments/production/modules/apache/templates/mod/worker.conf.erb b/environments/production/modules/apache/templates/mod/worker.conf.erb new file mode 100644 index 0000000..8ad6451 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/worker.conf.erb @@ -0,0 +1,11 @@ + + ServerLimit <%= @serverlimit %> + StartServers <%= @startservers %> + ThreadLimit <%= @threadlimit %> + MaxClients <%= @maxclients %> + MinSpareThreads <%= @minsparethreads %> + MaxSpareThreads <%= @maxsparethreads %> + ThreadsPerChild <%= @threadsperchild %> + MaxRequestsPerChild <%= @maxrequestsperchild %> + ListenBacklog <%= @listenbacklog %> + diff --git a/environments/production/modules/apache/templates/mod/wsgi.conf.erb b/environments/production/modules/apache/templates/mod/wsgi.conf.erb new file mode 100644 index 0000000..18752d2 --- /dev/null +++ b/environments/production/modules/apache/templates/mod/wsgi.conf.erb @@ -0,0 +1,13 @@ +# The WSGI Apache module configuration file is being +# managed by Puppet an changes will be overwritten. + + <%- if @wsgi_socket_prefix -%> + WSGISocketPrefix <%= @wsgi_socket_prefix %> + <%- end -%> + <%- if @wsgi_python_home -%> + WSGIPythonHome "<%= @wsgi_python_home %>" + <%- end -%> + <%- if @wsgi_python_path -%> + WSGIPythonPath "<%= @wsgi_python_path %>" + <%- end -%> + diff --git a/environments/production/modules/apache/templates/namevirtualhost.erb b/environments/production/modules/apache/templates/namevirtualhost.erb new file mode 100644 index 0000000..cf76768 --- /dev/null +++ b/environments/production/modules/apache/templates/namevirtualhost.erb @@ -0,0 +1,8 @@ +<%# NameVirtualHost should always be one of: + - * + - *: + - _default_: + - + - : +-%> +NameVirtualHost <%= @addr_port %> diff --git a/environments/production/modules/apache/templates/ports_header.erb b/environments/production/modules/apache/templates/ports_header.erb new file mode 100644 index 0000000..4908db4 --- /dev/null +++ b/environments/production/modules/apache/templates/ports_header.erb @@ -0,0 +1,5 @@ +# ************************************ +# Listen & NameVirtualHost resources in module puppetlabs-apache +# Managed by Puppet +# ************************************ + diff --git a/environments/production/modules/apache/templates/vhost/_access_log.erb b/environments/production/modules/apache/templates/vhost/_access_log.erb new file mode 100644 index 0000000..894daa7 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_access_log.erb @@ -0,0 +1,21 @@ +<% @_access_logs.each do |log| -%> +<% env ||= "env=#{log['env']}" if log['env'] -%> +<% env ||= '' -%> +<% format ||= "\"#{log['format']}\"" if log['format'] -%> +<% format ||= 'combined' -%> +<% if log['file'] -%> +<% if log['file'].chars.first == '/' -%> +<% destination = "#{log['file']}" -%> +<% else -%> +<% destination = "#{@logroot}/#{log['file']}" -%> +<% end -%> +<% elsif log['syslog'] -%> +<% destination = log['syslog'] -%> +<% elsif log['pipe'] -%> +<% destination = log['pipe'] -%> +<% else -%> +<% destination ||= "#{@logroot}/#{@name}_access_ssl.log" if @ssl -%> +<% destination ||= "#{@logroot}/#{@name}_access.log" -%> +<% end -%> + CustomLog "<%= destination %>" <%= format %> <%= env %> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_action.erb b/environments/production/modules/apache/templates/vhost/_action.erb new file mode 100644 index 0000000..8a02290 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_action.erb @@ -0,0 +1,4 @@ +<% if @action -%> + + Action <%= @action %> /cgi-bin virtual +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_additional_includes.erb b/environments/production/modules/apache/templates/vhost/_additional_includes.erb new file mode 100644 index 0000000..a07bb81 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_additional_includes.erb @@ -0,0 +1,9 @@ +<% Array(@additional_includes).each do |include| -%> + + ## Load additional static includes +<%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 && @use_optional_includes -%> + IncludeOptional "<%= include %>" +<%- else -%> + Include "<%= include %>" +<%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_aliases.erb b/environments/production/modules/apache/templates/vhost/_aliases.erb new file mode 100644 index 0000000..f9771bc --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_aliases.erb @@ -0,0 +1,16 @@ +<% if @aliases and ! @aliases.empty? -%> + ## Alias declarations for resources outside the DocumentRoot + <%- [@aliases].flatten.compact.each do |alias_statement| -%> + <%- if alias_statement["path"] != '' -%> + <%- if alias_statement["alias"] and alias_statement["alias"] != '' -%> + Alias <%= alias_statement["alias"] %> "<%= alias_statement["path"] %>" + <%- elsif alias_statement["aliasmatch"] and alias_statement["aliasmatch"] != '' -%> + AliasMatch <%= alias_statement["aliasmatch"] %> "<%= alias_statement["path"] %>" + <%- elsif alias_statement["scriptalias"] and alias_statement["scriptalias"] != '' -%> + ScriptAlias <%= alias_statement["scriptalias"] %> "<%= alias_statement["path"] %>" + <%- elsif alias_statement["scriptaliasmatch"] and alias_statement["scriptaliasmatch"] != '' -%> + ScriptAliasMatch <%= alias_statement["scriptaliasmatch"] %> "<%= alias_statement["path"] %>" + <%- end -%> + <%- end -%> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_allow_encoded_slashes.erb b/environments/production/modules/apache/templates/vhost/_allow_encoded_slashes.erb new file mode 100644 index 0000000..40c7343 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_allow_encoded_slashes.erb @@ -0,0 +1,4 @@ +<%- if @allow_encoded_slashes -%> + + AllowEncodedSlashes <%= @allow_encoded_slashes %> +<%- end -%> diff --git a/environments/production/modules/apache/templates/vhost/_auth_cas.erb b/environments/production/modules/apache/templates/vhost/_auth_cas.erb new file mode 100644 index 0000000..2f4787b --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_auth_cas.erb @@ -0,0 +1,65 @@ +<% if @cas_enabled -%> + <%- if @cas_cookie_path -%> + CASCookiePath <%= @cas_cookie_path %> + <%- end -%> + <%- if @cas_login_url -%> + CASLoginURL <%= @cas_login_url %> + <%- end -%> + <%- if @cas_validate_url -%> + CASValidateURL <%= @cas_validate_url %> + <%- end -%> + <%- if @cas_version -%> + CASVersion <%= @cas_version %> + <%- end -%> + <%- if @cas_debug -%> + CASDebug <%= @cas_debug %> + <%- end -%> + <%- if @cas_certificate_path -%> + CASCertificatePath <%= @cas_certificate_path %> + <%- end -%> + <%- if @cas_proxy_validate_url -%> + CASProxyValidateURL <%= @cas_proxy_validate_url %> + <%- end -%> + <%- if @cas_validate_depth -%> + CASValidateDepth <%= @cas_validate_depth %> + <%- end -%> + <%- if @cas_root_proxied_as -%> + CASRootProxiedAs <%= @cas_root_proxied_as %> + <%- end -%> + <%- if @cas_cookie_entropy -%> + CASCookieEntropy <%= @cas_cookie_entropy %> + <%- end -%> + <%- if @cas_timeout -%> + CASTimeout <%= @cas_timeout %> + <%- end -%> + <%- if @cas_idle_timeout -%> + CASIdleTimeout <%= @cas_idle_timeout %> + <%- end -%> + <%- if @cas_cache_clean_interval -%> + CASCacheCleanInterval <%= @cas_cache_clean_interval %> + <%- end -%> + <%- if @cas_cookie_domain -%> + CASCookieDomain <%= @cas_cookie_domain %> + <%- end -%> + <%- if @cas_cookie_http_only -%> + CASCookieHttpOnly <%= @cas_cookie_http_only %> + <%- end -%> + <%- if @cas_authoritative -%> + CASAuthoritative <%= @cas_authoritative %> + <%- end -%> + <%- if @cas_sso_enabled -%> + CASSSOEnabled On + <%- end -%> + <%- if @cas_validate_saml -%> + CASValidateSAML On + <%- end -%> + <%- if @cas_attribute_prefix -%> + CASAttributePrefix <%= @cas_attribute_prefix %> + <%- end -%> + <%- if @cas_attribute_delimiter -%> + CASAttributeDelimiter <%= @cas_attribute_delimiter %> + <%- end -%> + <%- if @cas_scrub_request_headers -%> + CASAttributeDelimiter On + <%- end -%> +<%- end -%> diff --git a/environments/production/modules/apache/templates/vhost/_auth_kerb.erb b/environments/production/modules/apache/templates/vhost/_auth_kerb.erb new file mode 100644 index 0000000..97f4c1f --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_auth_kerb.erb @@ -0,0 +1,32 @@ +<% if @auth_kerb -%> + + ## Kerberos directives + <%- if @krb_method_negotiate -%> + KrbMethodNegotiate <%= @krb_method_negotiate %> + <%- end -%> + <%- if @krb_method_k5passwd -%> + KrbMethodK5Passwd <%= @krb_method_k5passwd %> + <%- end -%> + <%- if @krb_authoritative -%> + KrbAuthoritative <%= @krb_authoritative %> + <%- end -%> + <%- if @krb_auth_realms and @krb_auth_realms.length >= 1 -%> + KrbAuthRealms <%= @krb_auth_realms.join(' ') %> + <%- end -%> + <%- if @krb_5keytab -%> + Krb5Keytab <%= @krb_5keytab %> + <%- end -%> + <%- if @krb_local_user_mapping -%> + KrbLocalUserMapping <%= @krb_local_user_mapping %> + <%- end -%> + <%- if @krb_verify_kdc -%> + KrbVerifyKDC <%= @krb_verify_kdc %> + <%- end -%> + <%- if @krb_servicename -%> + KrbServiceName <%= @krb_servicename %> + <%- end -%> + <%- if @krb_save_credentials -%> + KrbSaveCredentials <%= @krb_save_credentials -%> + <%- end -%> + +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_block.erb b/environments/production/modules/apache/templates/vhost/_block.erb new file mode 100644 index 0000000..b07f685 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_block.erb @@ -0,0 +1,14 @@ +<% if @block and ! @block.empty? -%> + + ## Block access statements +<% if @block.include? 'scm' -%> + # Block access to SCM directories. + + <%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%> + Require all denied + <%- else -%> + Deny From All + <%- end -%> + +<% end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_charsets.erb b/environments/production/modules/apache/templates/vhost/_charsets.erb new file mode 100644 index 0000000..ef83def --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_charsets.erb @@ -0,0 +1,4 @@ +<% if @add_default_charset -%> + + AddDefaultCharset <%= @add_default_charset %> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_custom_fragment.erb b/environments/production/modules/apache/templates/vhost/_custom_fragment.erb new file mode 100644 index 0000000..35c264a --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_custom_fragment.erb @@ -0,0 +1,5 @@ +<% if @custom_fragment -%> + + ## Custom fragment + <%= @custom_fragment %> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_directories.erb b/environments/production/modules/apache/templates/vhost/_directories.erb new file mode 100644 index 0000000..addd03b --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_directories.erb @@ -0,0 +1,326 @@ +<% if @_directories and ! @_directories.empty? -%> + + <%- scope.setvar('_template_scope', {}) -%> + ## Directories, there should at least be a declaration for <%= @docroot %> + <%- [@_directories].flatten.compact.each do |directory| -%> + <%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%> + <%- if directory['allow'] and ! [ false, 'false', '' ].include?(directory['allow']) -%> + <%- scope.function_warning(["Apache::Vhost: Using allow is deprecated in your Apache version"]) -%> + <%- end -%> + <%- if directory['deny'] and ! [ false, 'false', '' ].include?(directory['deny']) -%> + <%- scope.function_warning(["Apache::Vhost: Using deny is deprecated in your Apache version"]) -%> + <%- end -%> + <%- if directory['order'] and ! [ false, 'false', '' ].include?(directory['order']) -%> + <%- scope.function_warning(["Apache::Vhost: Using order is deprecated in your Apache version"]) -%> + <%- end -%> + <%- if directory['satisfy'] and ! [ false, 'false', '' ].include?(directory['satisfy']) -%> + <%- scope.function_warning(["Apache::Vhost: Using satisfy is deprecated in your Apache version"]) -%> + <%- end -%> + <%- end -%> + <%- if directory['path'] and directory['path'] != '' -%> + <%- if directory['provider'] and directory['provider'].match('(directory|location|files|proxy)') -%> + <%- if /^(.*)match$/ =~ directory['provider'] -%> + <%- provider = $1.capitalize + 'Match' -%> + <%- else -%> + <%- provider = directory['provider'].capitalize -%> + <%- end -%> + <%- else -%> + <%- provider = 'Directory' -%> + <%- end -%> + <%- path = directory['path'] -%> + + <<%= provider %> "<%= path %>"> + <%- if directory['headers'] -%> + <%- Array(directory['headers']).each do |header| -%> + Header <%= header %> + <%- end -%> + <%- end -%> + <%- if ! directory['geoip_enable'].nil? -%> + GeoIPEnable <%= scope.function_bool2httpd([directory['geoip_enable']]) %> + <%- end -%> + <%- if directory['options'] -%> + Options <%= Array(directory['options']).join(' ') %> + <%- end -%> + <%- if provider == 'Directory' -%> + <%- if directory['index_options'] -%> + IndexOptions <%= Array(directory['index_options']).join(' ') %> + <%- end -%> + <%- if directory['index_order_default'] -%> + IndexOrderDefault <%= Array(directory['index_order_default']).join(' ') %> + <%- end -%> + <%- if directory['index_style_sheet'] -%> + IndexStyleSheet '<%= directory['index_style_sheet'] %>' + <%- end -%> + <%- if directory['allow_override'] -%> + AllowOverride <%= Array(directory['allow_override']).join(' ') %> + <%- elsif provider == 'Directory' -%> + AllowOverride None + <%- end -%> + <%- end -%> + <%- scope.lookupvar('_template_scope')[:item] = directory -%> +<%= scope.function_template(["apache/vhost/_require.erb"]) -%> + <%- if directory['limit'] && directory['limit'] != '' -%> + <%- Array(directory['limit']).each do |lim| -%> + > + <%- scope.lookupvar('_template_scope')[:item] = lim -%> + <%= scope.function_template(["apache/vhost/_require.erb"]) -%> + + <%- end -%> + <%- end -%> + <%- if directory['addhandlers'] and ! directory['addhandlers'].empty? -%> + <%- [directory['addhandlers']].flatten.compact.each do |addhandler| -%> + )$"> + SetHandler <%= addhandler['handler'] %> + + <%- end -%> + <%- end -%> + <%- if directory['sethandler'] and directory['sethandler'] != '' -%> + SetHandler <%= directory['sethandler'] %> + <%- end -%> + <%- if directory['passenger_enabled'] and directory['passenger_enabled'] != '' -%> + PassengerEnabled <%= directory['passenger_enabled'] %> + <%- end -%> + <%- if directory['php_flags'] and ! directory['php_flags'].empty? -%> + <%- directory['php_flags'].sort.each do |flag,value| -%> + <%- value = if value =~ /true|yes|on|1/i then 'on' else 'off' end -%> + php_flag <%= "#{flag} #{value}" %> + <%- end -%> + <%- end -%> + <%- if directory['php_values'] and ! directory['php_values'].empty? -%> + <%- directory['php_values'].sort.each do |key,value| -%> + php_value <%= "#{key} #{value}" %> + <%- end -%> + <%- end -%> + <%- if directory['php_admin_flags'] and ! directory['php_admin_flags'].empty? -%> + <%- directory['php_admin_flags'].sort.each do |flag,value| -%> + <%- value = if value =~ /true|yes|on|1/i then 'on' else 'off' end -%> + php_admin_flag <%= "#{flag} #{value}" %> + <%- end -%> + <%- end -%> + <%- if directory['php_admin_values'] and ! directory['php_admin_values'].empty? -%> + <%- directory['php_admin_values'].sort.each do |key,value| -%> + php_admin_value <%= "#{key} #{value}" %> + <%- end -%> + <%- end -%> + <%- if directory['directoryindex'] and directory['directoryindex'] != '' -%> + DirectoryIndex <%= directory['directoryindex'] %> + <%- end -%> + <%- if directory['additional_includes'] and ! directory['additional_includes'].empty? -%> + <%- directory['additional_includes'].each do |include| -%> + Include '<%= "#{include}" %>' + <%- end -%> + <%- end -%> + <%- if directory['error_documents'] and ! directory['error_documents'].empty? -%> + <%- [directory['error_documents']].flatten.compact.each do |error_document| -%> + ErrorDocument <%= error_document['error_code'] %> <%= error_document['document'] %> + <%- end -%> + <%- end -%> + <%- if directory['dav'] -%> + Dav <%= directory['dav'] %> + <%- if directory['dav_depth_infinity'] -%> + DavDepthInfinity <%= scope.function_bool2httpd([directory['dav_depth_infinity']]) %> + <%- end -%> + <%- if directory['dav_min_timeout'] -%> + DavMinTimeout <%= directory['dav_min_timeout'] %> + <%- end -%> + <%- end -%> + <%- if directory['auth_type'] -%> + AuthType <%= directory['auth_type'] %> + <%- end -%> + <%- if directory['auth_name'] -%> + AuthName "<%= directory['auth_name'] %>" + <%- end -%> + <%- if directory['auth_digest_algorithm'] -%> + AuthDigestAlgorithm <%= directory['auth_digest_algorithm'] %> + <%- end -%> + <%- if directory['auth_digest_domain'] -%> + AuthDigestDomain <%= Array(directory['auth_digest_domain']).join(' ') %> + <%- end -%> + <%- if directory['auth_digest_nonce_lifetime'] -%> + AuthDigestNonceLifetime <%= directory['auth_digest_nonce_lifetime'] %> + <%- end -%> + <%- if directory['auth_digest_provider'] -%> + AuthDigestProvider <%= directory['auth_digest_provider'] %> + <%- end -%> + <%- if directory['auth_digest_qop'] -%> + AuthDigestQop <%= directory['auth_digest_qop'] %> + <%- end -%> + <%- if directory['auth_digest_shmem_size'] -%> + AuthDigestShmemSize <%= directory['auth_digest_shmem_size'] %> + <%- end -%> + <%- if directory['auth_basic_authoritative'] -%> + AuthBasicAuthoritative <%= directory['auth_basic_authoritative'] %> + <%- end -%> + <%- if directory['auth_basic_fake'] -%> + AuthBasicFake <%= directory['auth_basic_fake'] %> + <%- end -%> + <%- if directory['auth_basic_provider'] -%> + AuthBasicProvider <%= directory['auth_basic_provider'] %> + <%- end -%> + <%- if directory['auth_user_file'] -%> + AuthUserFile <%= directory['auth_user_file'] %> + <%- end -%> + <%- if directory['auth_group_file'] -%> + AuthGroupFile <%= directory['auth_group_file'] %> + <%- end -%> + <%- if directory['auth_merging'] -%> + AuthMerging <%= directory['auth_merging'] %> + <%- end -%> + <%- if directory['auth_ldap_url'] -%> + AuthLDAPURL <%= directory['auth_ldap_url'] %> + <%- end -%> + <%- if directory['auth_ldap_bind_dn'] -%> + AuthLDAPBindDN <%= directory['auth_ldap_bind_dn'] %> + <%- end -%> + <%- if directory['auth_ldap_bind_password'] -%> + AuthLDAPBindPassword <%= directory['auth_ldap_bind_password'] %> + <%- end -%> + <%- if directory['auth_ldap_group_attribute'] -%> + <%- Array(directory['auth_ldap_group_attribute']).each do |groupattr| -%> + AuthLDAPGroupAttribute <%= groupattr %> + <%- end -%> + <%- end -%> + <%- if directory['auth_ldap_group_attribute_is_dn'] == 'off' -%> + AuthLDAPGroupAttributeIsDN Off + <%- end -%> + <%- if directory['auth_ldap_group_attribute_is_dn'] == 'on' -%> + AuthLDAPGroupAttributeIsDN On + <%- end -%> + <%- if directory['fallbackresource'] -%> + FallbackResource <%= directory['fallbackresource'] %> + <%- end -%> + <%- if directory['expires_active'] -%> + ExpiresActive <%= directory['expires_active'] %> + <%- end -%> + <%- if directory['expires_default'] -%> + ExpiresDefault <%= directory['expires_default'] %> + <%- end -%> + <%- if directory['expires_by_type'] -%> + <%- Array(directory['expires_by_type']).each do |rule| -%> + ExpiresByType <%= rule %> + <%- end -%> + <%- end -%> + <%- if directory['ext_filter_options'] -%> + ExtFilterOptions <%= directory['ext_filter_options'] %> + <%- end -%> + <%- if directory['force_type'] -%> + ForceType <%= directory['force_type'] %> + <%- end -%> + <%- if directory['ssl_options'] -%> + SSLOptions <%= Array(directory['ssl_options']).join(' ') %> + <%- end -%> + <%- if directory['suphp'] and @suphp_engine == 'on' -%> + suPHP_UserGroup <%= directory['suphp']['user'] %> <%= directory['suphp']['group'] %> + <%- end -%> + <%- if directory['fcgiwrapper'] -%> + FcgidWrapper <%= directory['fcgiwrapper']['command'] %> <%= directory['fcgiwrapper']['suffix'] %> <%= directory['fcgiwrapper']['virtual'] %> + <%- end -%> + <%- if directory['rewrites'] -%> + # Rewrite rules + RewriteEngine On + <%- directory['rewrites'].flatten.compact.each do |rewrite_details| -%> + <%- if rewrite_details['comment'] -%> + #<%= rewrite_details['comment'] %> + <%- end -%> + <%- if rewrite_details['rewrite_base'] -%> + RewriteBase <%= rewrite_details['rewrite_base'] %> + <%- end -%> + <%- if rewrite_details['rewrite_cond'] -%> + <%- Array(rewrite_details['rewrite_cond']).each do |commands| -%> + <%- Array(commands).each do |command| -%> + RewriteCond <%= command %> + <%- end -%> + <%- end -%> + <%- end -%> + <%- Array(rewrite_details['rewrite_rule']).each do |commands| -%> + <%- Array(commands).each do |command| -%> + RewriteRule <%= command %> + <%- end -%> + <%- end -%> + <%- end -%> + <%- end -%> + <%- if directory['setenv'] -%> + <%- Array(directory['setenv']).each do |setenv| -%> + SetEnv <%= setenv %> + <%- end -%> + <%- end -%> + <%- if directory['set_output_filter'] -%> + SetOutputFilter <%= directory['set_output_filter'] %> + <%- end -%> + <%- if @shibboleth_enabled -%> + <%- if directory['shib_require_session'] and ! directory['shib_require_session'].empty? -%> + ShibRequireSession <%= directory['shib_require_session'] %> + <%- end -%> + <%- if directory['shib_request_settings'] and ! directory['shib_request_settings'].empty? -%> + <%- directory['shib_request_settings'].each do |key,value| -%> + ShibRequestSetting <%= key %> <%= value %> + <%- end -%> + <%- end -%> + <%- if directory['shib_use_headers'] and ! directory['shib_use_headers'].empty? -%> + ShibUseHeaders <%= directory['shib_use_headers'] %> + <%- end -%> + <%- end -%> + <%- if @cas_enabled -%> + <%- if directory['cas_scope'] -%> + CASScope <%= directory['cas_scope'] %> + <%- end -%> + <%- if directory['cas_renew'] -%> + CASRenew <%= directory['cas_renew'] %> + <%- end -%> + <%- if directory['cas_gateway'] -%> + CASGateway <%= directory['cas_gateway'] %> + <%- end -%> + <%- if directory['cas_cookie'] -%> + CASCookie <%= directory['cas_cookie'] %> + <%- end -%> + <%- if directory['cas_secure_cookie'] -%> + CASSecureCookie <%= directory['cas_secure_cookie'] %> + <%- end -%> + <%- if directory['cas_gateway_cookie'] -%> + CASGatewayCookie <%= directory['cas_gateway_cookie'] %> + <%- end -%> + <%- if directory['cas_authn_header'] -%> + CASAuthNHeader <%= directory['cas_authn_header'] %> + <%- end -%> + <%- end -%> + <%- if directory['mellon_enable'] -%> + MellonEnable "<%= directory['mellon_enable'] %>" + <%- if directory['mellon_endpoint_path'] -%> + MellonEndpointPath "<%= directory['mellon_endpoint_path'] %>" + <%- end -%> + <%- if directory['mellon_sp_private_key_file'] -%> + MellonSPPrivateKeyFile "<%= directory['mellon_sp_private_key_file'] %>" + <%- end -%> + <%- if directory['mellon_sp_cert_file'] -%> + MellonSPCertFile "<%= directory['mellon_sp_cert_file'] %>" + <%- end -%> + <%- if directory['mellon_sp_metadata_file'] -%> + MellonSPMetadataFile "<%= directory['mellon_sp_metadata_file'] %>" + <%- end -%> + <%- if directory['mellon_idp_metadata_file'] -%> + MellonIDPMetadataFile "<%= directory['mellon_idp_metadata_file'] %>" + <%- end -%> + <%- if directory['mellon_set_env_no_prefix'] -%> + <%- directory['mellon_set_env_no_prefix'].each do |key, value| -%> + MellonSetEnvNoPrefix "<%= key %>" "<%= value %>" + <%- end -%> + <%- end -%> + <%- if directory['mellon_user'] -%> + MellonUser "<%= directory['mellon_user'] %>" + <%- end -%> + <%- if directory['mellon_saml_response_dump'] -%> + MellonSamlResponseDump "<%= directory['mellon_saml_response_dump'] %>" + <%- end -%> + <%- if directory['mellon_cond'] -%> + <%- Array(directory['mellon_cond']).each do |cond| -%> + MellonCond <%= cond %> + <%- end -%> + <%- end -%> + <%- end -%> + <%- if directory['custom_fragment'] -%> + <%= directory['custom_fragment'] %> + <%- end -%> + > + <%- end -%> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_docroot.erb b/environments/production/modules/apache/templates/vhost/_docroot.erb new file mode 100644 index 0000000..b67998b --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_docroot.erb @@ -0,0 +1,7 @@ + + ## Vhost docroot +<% if @virtual_docroot -%> + VirtualDocumentRoot "<%= @virtual_docroot %>" +<% elsif @docroot -%> + DocumentRoot "<%= @docroot %>" +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_error_document.erb b/environments/production/modules/apache/templates/vhost/_error_document.erb new file mode 100644 index 0000000..654e72c --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_error_document.erb @@ -0,0 +1,7 @@ +<% if @error_documents and ! @error_documents.empty? -%> + <%- [@error_documents].flatten.compact.each do |error_document| -%> + <%- if error_document["error_code"] != '' and error_document["document"] != '' -%> + ErrorDocument <%= error_document["error_code"] %> <%= error_document["document"] %> + <%- end -%> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_fallbackresource.erb b/environments/production/modules/apache/templates/vhost/_fallbackresource.erb new file mode 100644 index 0000000..f1e4c35 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_fallbackresource.erb @@ -0,0 +1,4 @@ +<% if @fallbackresource -%> + + FallbackResource <%= @fallbackresource %> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_fastcgi.erb b/environments/production/modules/apache/templates/vhost/_fastcgi.erb new file mode 100644 index 0000000..b471839 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_fastcgi.erb @@ -0,0 +1,23 @@ +<% if @fastcgi_server -%> + + FastCgiExternalServer <%= @fastcgi_server %> -socket <%= @fastcgi_socket -%> +<% unless @fastcgi_idle_timeout.nil? %> -idle-timeout <%= @fastcgi_idle_timeout %><% end %> +<% end -%> +<% if @fastcgi_dir -%> + + "> + Options +ExecCGI + AllowOverride All + SetHandler fastcgi-script + <%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%> + Require all granted + <%- else -%> + Order allow,deny + Allow From All + <%- end -%> + AuthBasicAuthoritative Off + + + AllowEncodedSlashes On + ServerSignature Off +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_file_footer.erb b/environments/production/modules/apache/templates/vhost/_file_footer.erb new file mode 100644 index 0000000..84035ef --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_file_footer.erb @@ -0,0 +1 @@ + diff --git a/environments/production/modules/apache/templates/vhost/_file_header.erb b/environments/production/modules/apache/templates/vhost/_file_header.erb new file mode 100644 index 0000000..4cf7629 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_file_header.erb @@ -0,0 +1,12 @@ +# ************************************ +# Vhost template in module puppetlabs-apache +# Managed by Puppet +# ************************************ + +> +<% if @servername and not @servername.empty? -%> + ServerName <%= @servername %> +<% end -%> +<% if @serveradmin -%> + ServerAdmin <%= @serveradmin %> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_filters.erb b/environments/production/modules/apache/templates/vhost/_filters.erb new file mode 100644 index 0000000..b862597 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_filters.erb @@ -0,0 +1,10 @@ +<% if @filters and ! @filters.empty? -%> + + ## Filter module rules + ## as per http://httpd.apache.org/docs/2.2/mod/mod_filter.html + <%- Array(@filters).each do |filter| -%> + <%- if filter != '' -%> + <%= filter %> + <%- end -%> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_header.erb b/environments/production/modules/apache/templates/vhost/_header.erb new file mode 100644 index 0000000..c0f68c8 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_header.erb @@ -0,0 +1,10 @@ +<% if @headers and ! @headers.empty? -%> + + ## Header rules + ## as per http://httpd.apache.org/docs/2.2/mod/mod_headers.html#header + <%- Array(@headers).each do |header_statement| -%> + <%- if header_statement != '' -%> + Header <%= header_statement %> + <%- end -%> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_itk.erb b/environments/production/modules/apache/templates/vhost/_itk.erb new file mode 100644 index 0000000..803a73d --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_itk.erb @@ -0,0 +1,29 @@ +<% if @itk and ! @itk.empty? -%> + + ## ITK statement + + <%- if @itk["user"] and @itk["group"] -%> + AssignUserId <%= @itk["user"] %> <%= @itk["group"] %> + <%- end -%> + <%- if @itk["assignuseridexpr"] -%> + AssignUserIdExpr <%= @itk["assignuseridexpr"] %> + <%- end -%> + <%- if @itk["assigngroupidexpr"] -%> + AssignGroupIdExpr <%= @itk["assigngroupidexpr"] %> + <%- end -%> + <%- if @itk["maxclientvhost"] -%> + MaxClientsVHost <%= @itk["maxclientvhost"] %> + <%- end -%> + <%- if @itk["nice"] -%> + NiceValue <%= @itk["nice"] %> + <%- end -%> + <%- if @kernelversion >= '3.5.0' -%> + <%- if @itk["limituidrange"] -%> + LimitUIDRange <%= @itk["limituidrange"] %> + <%- end -%> + <%- if @itk["limitgidrange"] -%> + LimitGIDRange <%= @itk["limitgidrange"] %> + <%- end -%> + <%- end -%> + +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_jk_mounts.erb b/environments/production/modules/apache/templates/vhost/_jk_mounts.erb new file mode 100644 index 0000000..8cb1d11 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_jk_mounts.erb @@ -0,0 +1,12 @@ +<% if @jk_mounts and not @jk_mounts.empty? -%> + + <%- @jk_mounts.each do |jk| -%> + <%- if jk.is_a?(Hash) -%> + <%- if jk.has_key?('mount') and jk.has_key?('worker') -%> + JkMount <%= jk['mount'] %> <%= jk['worker'] %> + <%- elsif jk.has_key?('unmount') and jk.has_key?('worker') -%> + JkUnMount <%= jk['unmount'] %> <%= jk['worker'] %> + <%- end -%> + <%- end -%> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_keepalive_options.erb b/environments/production/modules/apache/templates/vhost/_keepalive_options.erb new file mode 100644 index 0000000..d14f5ed --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_keepalive_options.erb @@ -0,0 +1,9 @@ +<%- if @keepalive -%> + KeepAlive <%= @keepalive %> +<%- end -%> +<%- if @keepalive_timeout -%> + KeepAliveTimeout <%= @keepalive_timeout %> +<%- end -%> +<%- if @max_keepalive_requests -%> + MaxKeepAliveRequests <%= @max_keepalive_requests %> +<%- end -%> diff --git a/environments/production/modules/apache/templates/vhost/_logging.erb b/environments/production/modules/apache/templates/vhost/_logging.erb new file mode 100644 index 0000000..35a924d --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_logging.erb @@ -0,0 +1,10 @@ +<% if @error_log or @log_level -%> + + ## Logging +<% end -%> +<% if @error_log -%> + ErrorLog "<%= @error_log_destination %>" +<% end -%> +<% if @log_level -%> + LogLevel <%= @log_level %> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_passenger.erb b/environments/production/modules/apache/templates/vhost/_passenger.erb new file mode 100644 index 0000000..a380016 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_passenger.erb @@ -0,0 +1,33 @@ +<% if @passenger_app_root -%> + PassengerAppRoot <%= @passenger_app_root %> +<% end -%> +<% if @passenger_app_env -%> + PassengerAppEnv <%= @passenger_app_env %> +<% end -%> +<% if @passenger_ruby -%> + PassengerRuby <%= @passenger_ruby %> +<% end -%> +<% if @passenger_min_instances -%> + PassengerMinInstances <%= @passenger_min_instances %> +<% end -%> +<% if @passenger_start_timeout -%> + PassengerStartTimeout <%= @passenger_start_timeout %> +<% end -%> +<% if @passenger_pre_start -%> + PassengerPreStart <%= @passenger_pre_start %> +<% end -%> +<% if @passenger_user -%> + PassengerUser <%= @passenger_user %> +<% end -%> +<% if @passenger_high_performance -%> + PassengerHighPerformance <%= scope.function_bool2httpd([@passenger_high_performance]) %> +<% end -%> +<% if @passenger_nodejs -%> + PassengerNodejs <%= @passenger_nodejs -%> +<% end -%> +<% if @passenger_sticky_sessions -%> + PassengerStickySessions <%= scope.function_bool2httpd([@passenger_sticky_sessions]) %> +<% end -%> +<% if @passenger_startup_file -%> + PassengerStartupFile <%= @passenger_startup_file -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_passenger_base_uris.erb b/environments/production/modules/apache/templates/vhost/_passenger_base_uris.erb new file mode 100644 index 0000000..f3ef5aa --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_passenger_base_uris.erb @@ -0,0 +1,7 @@ +<% if @passenger_base_uris -%> + + ## Enable passenger base uris +<% Array(@passenger_base_uris).each do |uri| -%> + PassengerBaseURI <%= uri %> +<% end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_php.erb b/environments/production/modules/apache/templates/vhost/_php.erb new file mode 100644 index 0000000..8032a1a --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_php.erb @@ -0,0 +1,16 @@ +<% if @php_values and not @php_values.empty? -%> + <%- @php_values.sort.each do |key,value| -%> + <%- if value.is_a? String -%> + php_value <%= key %> "<%= value %>" + <%- else -%> + php_value <%= key %> <%= value %> + <%- end -%> + <%- end -%> +<% end -%> +<% if @php_flags and not @php_flags.empty? -%> + <%- @php_flags.sort.each do |key,flag| -%> + <%-# normalize flag -%> + <%- if flag =~ /true|yes|on|1/i then flag = 'on' else flag = 'off' end -%> + php_flag <%= key %> <%= flag %> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_php_admin.erb b/environments/production/modules/apache/templates/vhost/_php_admin.erb new file mode 100644 index 0000000..c0c8dd6 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_php_admin.erb @@ -0,0 +1,12 @@ +<% if @php_admin_values and not @php_admin_values.empty? -%> + <%- @php_admin_values.sort.each do |key,value| -%> + php_admin_value <%= key %> <%= value %> + <%- end -%> +<% end -%> +<% if @php_admin_flags and not @php_admin_flags.empty? -%> + <%- @php_admin_flags.sort.each do |key,flag| -%> + <%-# normalize flag -%> + <%- if flag =~ /true|yes|on|1/i then flag = 'on' else flag = 'off' end -%> + php_admin_flag <%= key %> <%= flag %> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_proxy.erb b/environments/production/modules/apache/templates/vhost/_proxy.erb new file mode 100644 index 0000000..79f36cf --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_proxy.erb @@ -0,0 +1,98 @@ +<% if @proxy_dest or @proxy_pass or @proxy_pass_match or @proxy_dest_match -%> + + ## Proxy rules + ProxyRequests Off +<%- end -%> +<% if @proxy_preserve_host -%> + ProxyPreserveHost On +<% else -%> + ProxyPreserveHost Off +<%- end -%> +<%- if defined?(@proxy_add_headers) -%> + <%- if @proxy_add_headers -%> + ProxyAddHeaders On + <%- else -%> + ProxyAddHeaders Off + <%- end -%> +<%- end -%> +<% if @proxy_error_override -%> + ProxyErrorOverride On +<%- end -%> +<%- [@proxy_pass].flatten.compact.each do |proxy| -%> + <%- Array(proxy['no_proxy_uris']).each do |uri| -%> + ProxyPass <%= uri %> ! + <%- end -%> + <%- Array(proxy['no_proxy_uris_match']).each do |uri| -%> + ProxyPassMatch <%= uri %> ! + <%- end -%> + ProxyPass <%= proxy['path'] %> <%= proxy['url'] -%> + <%- if proxy['params'] -%> + <%- proxy['params'].keys.sort.each do |key| -%> <%= key %>=<%= proxy['params'][key] -%> + <%- end -%> + <%- end -%> + <%- if proxy['keywords'] %> <%= proxy['keywords'].join(' ') -%> + <%- end %> + <%- if not proxy['reverse_cookies'].nil? -%> + <%- Array(proxy['reverse_cookies']).each do |reverse_cookies| -%> + <%- if reverse_cookies['path'] -%> + ProxyPassReverseCookiePath <%= reverse_cookies['path'] %> <%= reverse_cookies['url'] %> + <%- end -%> + <%- if reverse_cookies['domain'] -%> + ProxyPassReverseCookieDomain <%= reverse_cookies['domain'] %> <%= reverse_cookies['url'] %> + <%- end -%> + <%- end -%> + <%- end -%> + <%- if proxy['reverse_urls'].nil? -%> + ProxyPassReverse <%= proxy['path'] %> <%= proxy['url'] %> + <%- else -%> + <%- Array(proxy['reverse_urls']).each do |reverse_url| -%> + ProxyPassReverse <%= proxy['path'] %> <%= reverse_url %> + <%- end -%> + <%- end -%> + <%- if proxy['setenv'] -%> + <%- Array(proxy['setenv']).each do |setenv_var| -%> + SetEnv <%= setenv_var %> + <%- end -%> + <%- end -%> +<% end -%> +<% [@proxy_pass_match].flatten.compact.each do |proxy| %> + <%- Array(proxy['no_proxy_uris']).each do |uri| -%> + ProxyPass <%= uri %> ! + <%- end -%> + <%- Array(proxy['no_proxy_uris_match']).each do |uri| -%> + ProxyPassMatch <%= uri %> ! + <%- end -%> + ProxyPassMatch <%= proxy['path'] %> <%= proxy['url'] -%> + <%- if proxy['params'] -%> + <%- proxy['params'].keys.sort.each do |key| -%> <%= key %>=<%= proxy['params'][key] -%> + <%- end -%> + <%- end -%> + <%- if proxy['keywords'] %> <%= proxy['keywords'].join(' ') -%> + <%- end %> + <%- if proxy['reverse_urls'].nil? -%> + ProxyPassReverse <%= proxy['path'] %> <%= proxy['url'] %> + <%- else -%> + <%- Array(proxy['reverse_urls']).each do |reverse_url| -%> + ProxyPassReverse <%= proxy['path'] %> <%= reverse_url %> + <%- end -%> + <%- end -%> + <%- if proxy['setenv'] -%> + <%- Array(proxy['setenv']).each do |setenv_var| -%> + SetEnv <%= setenv_var %> + <%- end -%> + <%- end -%> +<% end -%> +<% if @proxy_dest -%> +<%- Array(@no_proxy_uris).each do |uri| -%> + ProxyPass <%= uri %> ! +<% end -%> + ProxyPass / <%= @proxy_dest %>/ + ProxyPassReverse / <%= @proxy_dest %>/ +<% end -%> +<% if @proxy_dest_match -%> +<%- Array(@no_proxy_uris_match).each do |uri| -%> + ProxyPassMatch <%= uri %> ! +<% end -%> + ProxyPassMatch / <%= @proxy_dest_match %>/ + ProxyPassReverse / <%= @proxy_dest_reverse_match %>/ +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_rack.erb b/environments/production/modules/apache/templates/vhost/_rack.erb new file mode 100644 index 0000000..4a5b5f1 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_rack.erb @@ -0,0 +1,7 @@ +<% if @rack_base_uris -%> + + ## Enable rack +<% Array(@rack_base_uris).each do |uri| -%> + RackBaseURI <%= uri %> +<% end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_redirect.erb b/environments/production/modules/apache/templates/vhost/_redirect.erb new file mode 100644 index 0000000..209da64 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_redirect.erb @@ -0,0 +1,35 @@ +<% if @redirect_source and @redirect_dest -%> +<% @redirect_dest_a = Array(@redirect_dest) -%> +<% @redirect_source_a = Array(@redirect_source) -%> +<% @redirect_status_a = Array(@redirect_status) -%> + + ## Redirect rules + <%- @redirect_source_a.each_with_index do |source, i| -%> +<% @redirect_dest_a[i] ||= @redirect_dest_a[0] -%> +<% @redirect_status_a[i] ||= @redirect_status_a[0] -%> + Redirect <%= "#{@redirect_status_a[i]} " %><%= source %> <%= @redirect_dest_a[i] %> + <%- end -%> +<% end -%> +<%- if @redirectmatch_status and @redirectmatch_regexp and @redirectmatch_dest -%> +<% @redirectmatch_status_a = Array(@redirectmatch_status) -%> +<% @redirectmatch_regexp_a = Array(@redirectmatch_regexp) -%> +<% @redirectmatch_dest_a = Array(@redirectmatch_dest) -%> + + ## RedirectMatch rules + <%- @redirectmatch_status_a.each_with_index do |status, i| -%> +<% @redirectmatch_status_a[i] ||= @redirectmatch_status_a[0] -%> +<% @redirectmatch_regexp_a[i] ||= @redirectmatch_regexp_a[0] -%> +<% @redirectmatch_dest_a[i] ||= @redirectmatch_dest_a[0] -%> + RedirectMatch <%= "#{@redirectmatch_status_a[i]} " %> <%= @redirectmatch_regexp_a[i] %> <%= @redirectmatch_dest_a[i] %> + <%- end -%> +<%- elsif @redirectmatch_regexp and @redirectmatch_dest -%> +<% @redirectmatch_regexp_a = Array(@redirectmatch_regexp) -%> +<% @redirectmatch_dest_a = Array(@redirectmatch_dest) -%> + + ## RedirectMatch rules + <%- @redirectmatch_regexp_a.each_with_index do |status, i| -%> +<% @redirectmatch_regexp_a[i] ||= @redirectmatch_regexp_a[0] -%> +<% @redirectmatch_dest_a[i] ||= @redirectmatch_dest_a[0] -%> + RedirectMatch <%= @redirectmatch_regexp_a[i] %> <%= @redirectmatch_dest_a[i] %> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_requestheader.erb b/environments/production/modules/apache/templates/vhost/_requestheader.erb new file mode 100644 index 0000000..9f17505 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_requestheader.erb @@ -0,0 +1,10 @@ +<% if @request_headers and ! @request_headers.empty? -%> + + ## Request header rules + ## as per http://httpd.apache.org/docs/2.2/mod/mod_headers.html#requestheader + <%- Array(@request_headers).each do |request_statement| -%> + <%- if request_statement != '' -%> + RequestHeader <%= request_statement %> + <%- end -%> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_require.erb b/environments/production/modules/apache/templates/vhost/_require.erb new file mode 100644 index 0000000..d6252de --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_require.erb @@ -0,0 +1,62 @@ +<%- _item = scope.lookupvar('_template_scope')[:item] -%> +<%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%> + <%- if _item['require'] && _item['require'] != '' && _item['require'] !~ /unmanaged/i -%> + <%- if _item['require'].is_a?(Hash) -%> + <%- case _item['require']['enforce'].downcase -%> + <%- when 'all','none','any' then -%> + > + <%- Array(_item['require']['requires']).each do |req| -%> + Require <%= req.strip %> + <%- end -%> + > + <%- else -%> + <%- scope.function_warning(["Apache::Vhost: Require can only overwritten with all, none or any."]) -%> + <%- end -%> + <%- else -%> + <%- Array(_item['require']).each do |req| -%> + Require <%= req %> + <%- end -%> + <%- end -%> + <%- end -%> + <%- if _item['auth_require'] -%> + Require <%= _item['auth_require'] %> + <%- end -%> + <%- if !(_item['require'] && _item['require'] != '') && _item['require'] !~ /unmanaged/i && !(_item['auth_require']) -%> + Require all granted + <%- end -%> +<%- else -%> + <%- if _item['auth_require'] -%> + Require <%= _item['auth_require'] %> + <%- end -%> + <%- if _item['order'] and _item['order'] != '' -%> + Order <%= Array(_item['order']).join(',') %> + <%- else -%> + Order allow,deny + <%- end -%> + <%- if _item['deny'] and ! [ false, 'false', '' ].include?(_item['deny']) -%> + <%- if _item['deny'].kind_of?(Array) -%> + <%- Array(_item['deny']).each do |restrict| -%> + Deny <%= restrict %> + <%- end -%> + <%- else -%> + Deny <%= _item['deny'] %> + <%- end -%> + <%- end -%> + <%- if _item['allow'] and ! [ false, 'false', '' ].include?(_item['allow']) -%> + <%- if _item['allow'].kind_of?(Array) -%> + <%- Array(_item['allow']).each do |access| -%> + Allow <%= access %> + <%- end -%> + <%- else -%> + Allow <%= _item['allow'] %> + <%- end -%> + <%- elsif [ 'from all', 'from All' ].include?(_item['deny']) -%> + <%- elsif ! _item['deny'] and [ false, 'false', '' ].include?(_item['allow']) -%> + Deny from all + <%- else -%> + Allow from all + <%- end -%> + <%- if _item['satisfy'] and _item['satisfy'] != '' -%> + Satisfy <%= _item['satisfy'] %> + <%- end -%> +<%- end -%> diff --git a/environments/production/modules/apache/templates/vhost/_rewrite.erb b/environments/production/modules/apache/templates/vhost/_rewrite.erb new file mode 100644 index 0000000..2827337 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_rewrite.erb @@ -0,0 +1,53 @@ +<%- if @rewrites -%> + ## Rewrite rules + RewriteEngine On + <%- if @rewrite_inherit -%> + RewriteOptions Inherit + <%- end -%> + <%- if @rewrite_base -%> + RewriteBase <%= @rewrite_base %> + <%- end -%> + + <%- [@rewrites].flatten.compact.each do |rewrite_details| -%> + <%- if rewrite_details['comment'] -%> + #<%= rewrite_details['comment'] %> + <%- end -%> + <%- if rewrite_details['rewrite_base'] -%> + RewriteBase <%= rewrite_details['rewrite_base'] %> + <%- end -%> + <%- if rewrite_details['rewrite_cond'] -%> + <%- Array(rewrite_details['rewrite_cond']).each do |commands| -%> + <%- Array(commands).each do |command| -%> + RewriteCond <%= command %> + <%- end -%> + <%- end -%> + <%- end -%> + <%- if rewrite_details['rewrite_map'] -%> + <%- Array(rewrite_details['rewrite_map']).each do |commands| -%> + <%- Array(commands).each do |command| -%> + RewriteMap <%= command %> + <%- end -%> + <%- end -%> + <%- end -%> + <%- Array(rewrite_details['rewrite_rule']).each do |commands| -%> + <%- Array(commands).each do |command| -%> + RewriteRule <%= command %> + <%- end -%> + + <%- end -%> + <%- end -%> +<%- end -%> +<%# reverse compatibility -%> +<% if @rewrite_rule and !@rewrites -%> + ## Rewrite rules + RewriteEngine On + <%- if @rewrite_base -%> + RewriteBase <%= @rewrite_base %> + <%- end -%> + <%- if @rewrite_cond -%> + <%- Array(@rewrite_cond).each do |cond| -%> + RewriteCond <%= cond %> + <%- end -%> + <%- end -%> + RewriteRule <%= @rewrite_rule %> +<%- end -%> diff --git a/environments/production/modules/apache/templates/vhost/_scriptalias.erb b/environments/production/modules/apache/templates/vhost/_scriptalias.erb new file mode 100644 index 0000000..bb4f6b3 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_scriptalias.erb @@ -0,0 +1,24 @@ +<%- if @scriptaliases.is_a?(Array) -%> +<%- aliases = @scriptaliases -%> +<%- elsif @scriptaliases.is_a?(Hash) -%> +<%- aliases = [@scriptaliases] -%> +<%- else -%> +<%- # Nothing to do with any other data type -%> +<%- aliases = [] -%> +<%- end -%> +<%- if @scriptalias or !aliases.empty? -%> + ## Script alias directives +<%# Combine scriptalais and scriptaliases into a single data structure -%> +<%# for backward compatibility and ease of implementation -%> +<%- aliases << { 'alias' => '/cgi-bin', 'path' => @scriptalias } if @scriptalias -%> +<%- aliases.flatten.compact! -%> +<%- aliases.each do |salias| -%> + <%- if salias["path"] != '' -%> + <%- if salias["alias"] and salias["alias"] != '' -%> + ScriptAlias <%= salias['alias'] %> "<%= salias['path'] %>" + <%- elsif salias["aliasmatch"] and salias["aliasmatch"] != '' -%> + ScriptAliasMatch <%= salias['aliasmatch'] %> "<%= salias['path'] %>" + <%- end -%> + <%- end -%> +<%- end -%> +<%- end -%> diff --git a/environments/production/modules/apache/templates/vhost/_security.erb b/environments/production/modules/apache/templates/vhost/_security.erb new file mode 100644 index 0000000..dc35c78 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_security.erb @@ -0,0 +1,43 @@ + +<% if @modsec_disable_vhost -%> + SecRuleEngine Off +<% end -%> +<% if @modsec_audit_log_destination -%> + SecAuditLog "<%= @modsec_audit_log_destination %>" +<% end -%> +<% if @_modsec_disable_ids.is_a?(Hash) -%> +<% @_modsec_disable_ids.each do |location,rules| -%> + > +<% Array(rules).each do |rule| -%> + SecRuleRemoveById <%= rule %> +<% end -%> + +<% end -%> +<% end -%> +<% ips = Array(@modsec_disable_ips).join(',') %> +<% if ips != '' %> + SecRule REMOTE_ADDR "<%= ips %>" "nolog,allow,id:1234123455" + SecAction "phase:2,pass,nolog,id:1234123456" +<% end -%> +<% if @_modsec_disable_msgs.is_a?(Hash) -%> +<% @_modsec_disable_msgs.each do |location,rules| -%> + > +<% Array(rules).each do |rule| -%> + SecRuleRemoveByMsg "<%= rule %>" +<% end -%> + +<% end -%> +<% end -%> +<% if @_modsec_disable_tags.is_a?(Hash) -%> +<% @_modsec_disable_tags.each do |location,rules| -%> + > +<% Array(rules).each do |rule| -%> + SecRuleRemoveByTag "<%= rule %>" +<% end -%> + +<% end -%> +<% end -%> +<% if @modsec_body_limit -%> + SecRequestBodyLimit <%= @modsec_body_limit %> +<% end -%> + diff --git a/environments/production/modules/apache/templates/vhost/_serveralias.erb b/environments/production/modules/apache/templates/vhost/_serveralias.erb new file mode 100644 index 0000000..e08a55e --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_serveralias.erb @@ -0,0 +1,7 @@ +<% if @serveraliases and ! @serveraliases.empty? -%> + + ## Server aliases + <%- Array(@serveraliases).each do |serveralias| -%> + ServerAlias <%= serveralias %> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_serversignature.erb b/environments/production/modules/apache/templates/vhost/_serversignature.erb new file mode 100644 index 0000000..ff13aaf --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_serversignature.erb @@ -0,0 +1 @@ + ServerSignature Off diff --git a/environments/production/modules/apache/templates/vhost/_setenv.erb b/environments/production/modules/apache/templates/vhost/_setenv.erb new file mode 100644 index 0000000..476a6b1 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_setenv.erb @@ -0,0 +1,17 @@ +<% if @setenv and ! @setenv.empty? -%> + + ## SetEnv/SetEnvIf for environment variables + <%- Array(@setenv).each do |envvar| -%> + SetEnv <%= envvar %> + <%- end -%> +<% end -%> +<% if @setenvif and ! @setenvif.empty? -%> + <%- Array(@setenvif).each do |envifvar| -%> + SetEnvIf <%= envifvar %> + <%- end -%> +<% end -%> +<% if @setenvifnocase and ! @setenvifnocase.empty? -%> + <%- Array(@setenvifnocase).each do |envifncvar| -%> + SetEnvIfNoCase <%= envifncvar %> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_ssl.erb b/environments/production/modules/apache/templates/vhost/_ssl.erb new file mode 100644 index 0000000..e70efeb --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_ssl.erb @@ -0,0 +1,55 @@ +<% if @ssl -%> + + ## SSL directives + SSLEngine on + SSLCertificateFile "<%= @ssl_cert %>" + SSLCertificateKeyFile "<%= @ssl_key %>" + <%- if @ssl_chain -%> + SSLCertificateChainFile "<%= @ssl_chain %>" + <%- end -%> + <%- if @ssl_certs_dir && @ssl_certs_dir != '' -%> + SSLCACertificatePath "<%= @ssl_certs_dir %>" + <%- end -%> + <%- if @ssl_ca -%> + SSLCACertificateFile "<%= @ssl_ca %>" + <%- end -%> + <%- if @ssl_crl_path -%> + SSLCARevocationPath "<%= @ssl_crl_path %>" + <%- end -%> + <%- if @ssl_crl -%> + SSLCARevocationFile "<%= @ssl_crl %>" + <%- end -%> + <%- if @ssl_crl_check && scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%> + SSLCARevocationCheck "<%= @ssl_crl_check %>" + <%- end -%> + <%- if @ssl_protocol -%> + SSLProtocol <%= [@ssl_protocol].flatten.compact.join(' ') %> + <%- end -%> + <%- if @ssl_cipher -%> + SSLCipherSuite <%= @ssl_cipher %> + <%- end -%> + <%- if @ssl_honorcipherorder -%> + SSLHonorCipherOrder <%= @ssl_honorcipherorder %> + <%- end -%> + <%- if @ssl_verify_client -%> + SSLVerifyClient <%= @ssl_verify_client %> + <%- end -%> + <%- if @ssl_verify_depth -%> + SSLVerifyDepth <%= @ssl_verify_depth %> + <%- end -%> + <%- if @ssl_options -%> + SSLOptions <%= Array(@ssl_options).join(' ') %> + <%- end -%> + <%- if @ssl_openssl_conf_cmd -%> + SSLOpenSSLConfCmd <%= @ssl_openssl_conf_cmd %> + <%- end -%> + <%- if (not @ssl_stapling.nil?) && (scope.function_versioncmp([@apache_version, '2.4']) >= 0) -%> + SSLUseStapling <%= scope.function_bool2httpd([@ssl_stapling]) %> + <%- end -%> + <%- if @ssl_stapling_timeout && scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%> + SSLStaplingResponderTimeout <%= @ssl_stapling_timeout %> + <%- end -%> + <%- if (not @ssl_stapling_return_errors.nil?) && (scope.function_versioncmp([@apache_version, '2.4']) >= 0) -%> + SSLStaplingReturnResponderErrors <%= scope.function_bool2httpd([@ssl_stapling_return_errors]) %> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_sslproxy.erb b/environments/production/modules/apache/templates/vhost/_sslproxy.erb new file mode 100644 index 0000000..a92bab5 --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_sslproxy.erb @@ -0,0 +1,23 @@ +<% if @ssl_proxyengine -%> + + # SSL Proxy directives + SSLProxyEngine On + <%- if @ssl_proxy_verify -%> + SSLProxyVerify <%= @ssl_proxy_verify %> + <%- end -%> + <%- if @ssl_proxy_check_peer_cn -%> + SSLProxyCheckPeerCN <%= @ssl_proxy_check_peer_cn %> + <%- end -%> + <%- if @ssl_proxy_check_peer_name -%> + SSLProxyCheckPeerName <%= @ssl_proxy_check_peer_name %> + <%- end -%> + <%- if @ssl_proxy_check_peer_expire -%> + SSLProxyCheckPeerExpire <%= @ssl_proxy_check_peer_expire %> + <%- end -%> + <%- if @ssl_proxy_machine_cert -%> + SSLProxyMachineCertificateFile "<%= @ssl_proxy_machine_cert %>" + <%- end -%> + <%- if @ssl_proxy_protocol -%> + SSLProxyProtocol <%= [@ssl_proxy_protocol].flatten.compact.join(' ') %> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_suexec.erb b/environments/production/modules/apache/templates/vhost/_suexec.erb new file mode 100644 index 0000000..8a7ae0f --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_suexec.erb @@ -0,0 +1,4 @@ +<% if @suexec_user_group -%> + + SuexecUserGroup <%= @suexec_user_group %> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_suphp.erb b/environments/production/modules/apache/templates/vhost/_suphp.erb new file mode 100644 index 0000000..e394b6f --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_suphp.erb @@ -0,0 +1,11 @@ +<% if @suphp_engine == 'on' -%> + <%- if @suphp_addhandler -%> + suPHP_AddHandler <%= @suphp_addhandler %> + <%- end -%> + <%- if @suphp_engine -%> + suPHP_Engine <%= @suphp_engine %> + <%- end -%> + <%- if @suphp_configpath -%> + suPHP_ConfigPath "<%= @suphp_configpath %>" + <%- end -%> +<% end -%> diff --git a/environments/production/modules/apache/templates/vhost/_wsgi.erb b/environments/production/modules/apache/templates/vhost/_wsgi.erb new file mode 100644 index 0000000..a49828f --- /dev/null +++ b/environments/production/modules/apache/templates/vhost/_wsgi.erb @@ -0,0 +1,34 @@ +<% if @wsgi_application_group -%> + WSGIApplicationGroup <%= @wsgi_application_group %> +<% end -%> +<% if @wsgi_daemon_process and @wsgi_daemon_process_options -%> + WSGIDaemonProcess <%= @wsgi_daemon_process %> <%= @wsgi_daemon_process_options.collect { |k,v| "#{k}=#{v}"}.sort.join(' ') %> +<% elsif @wsgi_daemon_process and !@wsgi_daemon_process_options -%> + WSGIDaemonProcess <%= @wsgi_daemon_process %> +<% end -%> +<% if @wsgi_import_script and @wsgi_import_script_options -%> + WSGIImportScript <%= @wsgi_import_script %> <%= @wsgi_import_script_options.collect { |k,v| "#{k}=#{v}"}.sort.join(' ') %> +<% end -%> +<% if @wsgi_process_group -%> + WSGIProcessGroup <%= @wsgi_process_group %> +<% end -%> +<% if @wsgi_script_aliases_match and ! @wsgi_script_aliases_match.empty? -%> + <%- @wsgi_script_aliases_match.keys.sort.each do |key| -%> + <%- if key != '' and @wsgi_script_aliases_match[key] != ''-%> + WSGIScriptAliasMatch <%= key %> "<%= @wsgi_script_aliases_match[key] %>" + <%- end -%> + <%- end -%> +<% end -%> +<% if @wsgi_script_aliases and ! @wsgi_script_aliases.empty? -%> + <%- @wsgi_script_aliases.keys.sort.each do |key| -%> + <%- if key != '' and @wsgi_script_aliases[key] != ''-%> + WSGIScriptAlias <%= key %> "<%= @wsgi_script_aliases[key] %>" + <%- end -%> + <%- end -%> +<% end -%> +<% if @wsgi_pass_authorization -%> + WSGIPassAuthorization <%= @wsgi_pass_authorization %> +<% end -%> +<% if @wsgi_chunked_request -%> + WSGIChunkedRequest <%= @wsgi_chunked_request %> +<% end -%> diff --git a/environments/production/modules/apt/CHANGELOG.md b/environments/production/modules/apt/CHANGELOG.md new file mode 100644 index 0000000..25fbd7b --- /dev/null +++ b/environments/production/modules/apt/CHANGELOG.md @@ -0,0 +1,541 @@ +## Supported Release 2.4.0 +### Summary +A release that includes only a couple of additional features, but includes several cleanups and bugfixes around existing issues. + +#### Features +- Tests updated to check for idempotency. +- (MODULES-4224) Implementation of beaker-module_install_helper. +- Deprecation warnings are now handled by the deprecation function in stdlib. + +#### Bugfixes +- Now http and https sources fixed for apt_key and can take a userinfo. +- GPG key update. +- Notify_update param now defaults to true to avoid validation errors. +- Implement retry on tests which pull key from a key server which sometimes times out (transient error). +- String comparison error now comphensated for in update.pp. +- (MODULES-4104) Removal of the port number from repository location in order to get the host name of the repository. +- Puppet lint warnings addressed. +- A few small readme issues addressed. + +## Supported Release 2.3.0 +### Summary +A release containing many bugfixes with additional features. + +#### Features +- Apt_updates facts now use /usr/bin/apt-get. +- Addition of notify update to apt::source. +- Update to newest modulesync_configs. +- Installs software-properties-common for Xenial. +- Modulesync updates. +- Add ability to specify a hash of apt::conf defines. + +#### Bugfixes +- A clean up of spec/defines/key_compat_specs, also now runs under STRICT_VARIABLES. +- Apt::setting expects priority to be an integer, set defaults accordingly. +- Fixed version check for Ubuntu on 16.04. +- Now uses hkps.pool.sks-keyservers.net instead of pgp.mit.edu. +- Updates and fixes to tests. General cleanup. +- Fixed regexp for $ensure params. +- Apt/params: Remove unused LSB facts. +- Replaced `-s` with `-f` in ppa rspec tests - After the repository is added, the "${::apt::sources_list_d}/${sources_list_d_filename}" file is created as an empty file. The unless condition of Exec["add-apt-repository-${name}"] calls test -s, which returns 1 if the file is empty. Because the file is empty, the unless condition is never true and the repository is added on every execution. This change replaces the -s test condition with -f, which is true if the file exists or false otherwise. +- Limit non-strict parsing to pre-3.5.0 only - Puppet 3.5.0 introduced strict variables and the module handles strict variables by using the defined() function. This does not work on prior versions of puppet so we now gate based on that version. Puppet 4 series has a new setting `strict` that may be set to enforce strict variables while `strict_variables` remains unset (see PUP-6358) which causes the conditional in manifests/params.pp to erroniously use non-strict 3.5-era parsing and fail. This new conditional corrects the cases such that strict variable behavior happens on versions 3.5.0 and later. + +##Supported Release 2.2.2 +###Summary + +Several bug fixes and the addition of support updates to Debian 8 and Ubuntu Wily. + +####Bugfixes +- Small fixes to descriptions within the readme and the addition of some examples. +- Updates to run on Ubuntu Wily. +- Fixed apt_key tempfile race condition. +- Run stages limitation added to the documentation. +- Remove unneeded whitespace in source.list template. +- Handle PPA names that contain a plus character. +- Update to current msync configs. +- Avoid duplicate package resources when package_manage => true. +- Avoid multiple package resource declarations. +- Ensure PPAs in tests have valid form. +- Look for correct sources.list.d file for apt::ppa. +- Debian 8 support addiiton to metadata. + +##Supported Release 2.2.1 +###Summary + +Small release for support of newer PE versions. This increments the version of PE in the metadata.json file. + +##2015-09-29 - Supported Release 2.2.0 +###Summary + +This release includes a few bugfixes. + +####Features +- Adds an `ensure` parameter for user control of proxy presence. +- Adds ability to set `notify_update` to `apt::conf` (MODULES-2269). +- Apt pins no longer trigger an `apt-get update` run. +- Adds support for creating pins from main class. + +####Bugfixes +- Updates to use the official Debian mirrors. +- Fixes path to `preferences` and `preferences.d` +- Fixes pinning for backports (MODULES-2446). +- Fixes the name/extension of the preferences files. + +##2015-07-28 - Supported Release 2.1.1 +###Summary + +This release includes a few bugfixes. + +####Bugfixes +- Fix incorrect use of anchoring (MODULES-2190) +- Use correct comment type for apt.conf files +- Test fixes +- Documentation fixes + +##2015-06-16 - Supported Release 2.1.0 +###Summary + +This release largely makes `apt::key` and `apt::source` API-compatible with the 1.8.x versions for ease in upgrading, and also addresses some compatibility issues with older versions of Puppet. + +####Features +- Add API compatibility to `apt::key` and `apt::source` +- Added `apt_reboot_required` fact + +####Bugfixes +- Fix compatibility with Puppet versions 3.0-3.4 +- Work around future parser bug PUP-4133 + +##2015-04-28 - Supported Release 2.0.1 +###Summary + +This bug fixes a few compatibility issues that came up with the 2.0.0 release, and includes test and documentation updates. + +####Bugfixes +- Fix incompatibility with keyrings containing multiple keys +- Fix bugs preventing the module from working with Puppet < 3.5.0 + +##2015-04-07 - Supported Release 2.0.0 +###Summary + +This is a major rewrite of the apt module. Many classes and defines were removed, but all existing functionality should still work. Please carefully review documentation before upgrading. + +####Backwards-incompatible changes + +As this is a major rewrite of the module there are a great number of backwards incompatible changes. Please review this and the updated README carefully before upgrading. + +#####`apt_key` +- `keyserver_options` parameter renamed to `options` + +#####`apt::backports` +- This no longer works out of the box on Linux Mint. If using this on mint, you must specify the `location`, `release`, `repos`, and `key` parameters. [Example](examples/backports.pp) + +#####`apt::builddep` +- This define was removed. Functionality can be matched passing 'build-dep' to `install_options` in the package resource. [Example](examples/builddep.pp) + +#####`apt::debian::testing` +- This class was removed. Manually add an `apt::source` instead. [Example](examples/debian_testing.pp) + +#####`apt::debian::unstable` +- This class was removed. Manually add an `apt::source` instead. [Example](examples/debian_unstable.pp) + +#####`apt::force` +- This define was removed. Functionallity can be matched by setting `install_options` in the package resource. See [here](examples/force.pp) for how to set the options. + +#####`apt::hold` +- This define was removed. Simply use an `apt::pin` with `priority => 1001` for the same functionality. + +#####`apt` +- `always_apt_update` - This parameter was removed. Use `update => { 'frequency' => 'always' }` instead. +- `apt_update_frequency` - This parameter was removed. Use `update => { 'frequency' => }` instead. +- `disable_keys` - This parameter was removed. See this [example](examples/disable_keys.pp) if you need this functionality. +- `proxy_host` - This parameter was removed. Use `proxy => { 'host' => }` instead. +- `proxy_port` - This parameter was removed. Use `proxy => { 'port' => }` instead. +- `purge_sources_list` - This parameter was removed. Use `purge => { 'sources.list' => }` instead. +- `purge_sources_list_d` - This parameter was removed. Use `purge => { 'sources.list.d' => }` instead. +- `purge_preferences` - This parameter was removed. Use `purge => { 'preferences' => }` instead. +- `purge_preferences_d` - This parameter was removed. Use `purge => { 'preferences.d' => }` instead. +- `update_timeout` - This parameter was removed. Use `update => { 'timeout' => }` instead. +- `update_tries` - This parameter was removed. Use `update => { 'tries' => }` instead. + +#####`apt::key` +- `key` - This parameter was renamed to `id`. +- `key_content` - This parameter was renamed to `content`. +- `key_source` - This parameter was renamed to `source`. +- `key_server` - This parameter was renamed to `server`. +- `key_options` - This parameter was renamed to `options`. + +#####`apt::release` +- This class was removed. See this [example](examples/release.pp) for how to achieve this functionality. + +#####`apt::source` +- `include_src` - This parameter was removed. Use `include => { 'src' => }` instead. ***NOTE*** This now defaults to false. +- `include_deb` - This parameter was removed. Use `include => { 'deb' => }` instead. +- `required_packages` - This parameter was removed. Use package resources for these packages if needed. +- `key` - This can either be a key id or a hash including key options. If using a hash, `key => { 'id' => }` must be specified. +- `key_server` - This parameter was removed. Use `key => { 'server' => }` instead. +- `key_content` - This parameter was removed. Use `key => { 'content' => }` instead. +- `key_source` - This parameter was removed. Use `key => { 'source' => }` instead. +- `trusted_source` - This parameter was renamed to `allow_unsigned`. + +#####`apt::unattended_upgrades` +- This class was removed and is being republished under the puppet-community namespace. The git repository is available [here](https://github.com/puppet-community/puppet-unattended_upgrades) and it will be published to the forge [here](https://forge.puppetlabs.com/puppet/unattended_upgrades). + +####Changes to default behavior +- By default purge unmanaged files in 'sources.list', 'sources.list.d', 'preferences', and 'preferences.d'. +- Changed default for `package_manage` in `apt::ppa` to `false`. Set to `true` in a single PPA if you need the package to be managed. +- `apt::source` will no longer include the `src` entries by default. +- `pin` in `apt::source` now defaults to `undef` instead of `false` + +####Features +- Added the ability to pass hashes of `apt::key`s, `apt::ppa`s, and `apt::setting`s to `apt`. +- Added 'https' key to `proxy` hash to allow disabling `https_proxy` for the `apt::ppa` environment. +- Added `apt::setting` define to abstract away configuration. +- Added the ability to pass hashes to `pin` and `key` in `apt::backports` and `apt::source`. + +####Bugfixes +- Fixes for strict variables. + +##2015-03-17 - Supported Release 1.8.0 +###Summary + +This is the last planned feature release of the 1.x series of this module. All new features will be evaluated for puppetlabs-apt 2.x. + +This release includes many important features, including support for full fingerprints, and fixes issues where `apt_key` was not supporting user/password and `apt_has_updates` was not properly parsing the `apt-check` output. + +####Changes to default behavior +- The apt module will now throw warnings if you don't use full fingerprints for `apt_key`s + +####Features +- Use gpg to check keys to work around https://bugs.launchpad.net/ubuntu/+source/gnupg2/+bug/1409117 (MODULES-1675) +- Add 'oldstable' to the default update origins for wheezy +- Add utopic, vivid, and cumulus compatibility +- Add support for full fingerprints +- New parameter for `apt::source` + - `trusted_source` +- New parameters for `apt::ppa` + - `package_name` + - `package_manage` +- New parameter for `apt::unattended_upgrades` + - `legacy_origin` +- Separate `apt::pin` from `apt::backports` to allow pin by release instead of origin + +####Bugfixes +- Cleanup lint and future parser issues +- Fix to support username and passwords again for `apt_key` (MODULES-1119) +- Fix issue where `apt::force` `$install_check` didn't work with non-English locales (MODULES-1231) +- Allow 5 digit ports in `apt_key` +- Fix for `ensure => absent` in `apt_key` (MODULES-1661) +- Fix `apt_has_updates` not parsing `apt-check` output correctly +- Fix inconsistent headers across files (MODULES-1200) +- Clean up formatting for 50unattended-upgrades.erb + +##2014-10-28 - Supported Release 1.7.0 +###Summary + +This release includes several new features, documentation and test improvements, and a few bug fixes. + +####Features +- Updated unit and acceptance tests +- Update module to work with Linux Mint +- Documentation updates +- Future parser / strict variables support +- Improved support for long GPG keys +- New parameters! + - Added `apt_update_frequency` to apt + - Added `cfg_files` and `cfg_missing` parameters to apt::force + - Added `randomsleep` to apt::unattended_upgrades +- Added `apt_update_last_success` fact +- Refactored facts for performance improvements + +####Bugfixes +- Update apt::builddep to require Exec['apt_update'] instead of notifying it +- Clean up lint errors + +##2014-08-20 - Supported Release 1.6.0 +###Summary + +####Features +- Allow URL or domain name for key_server parameter +- Allow custom comment for sources list +- Enable auto-update for Debian squeeze LTS +- Add facts showing available updates +- Test refactoring + +####Bugfixes +- Allow dashes in URL or domain for key_server parameter + +##2014-08-13 - Supported Release 1.5.3 +###Summary + +This is a bugfix releases. It addresses a bad regex, failures with unicode +characters, and issues with the $proxy_host handling in apt::ppa. + +####Features +- Synced files from Modulesync + +####Bugfixes +- Fix regex to follow APT requirements in apt::pin +- Fix for unicode characters +- Fix inconsistent $proxy_host handling in apt and apt::ppa +- Fix typo in README +- Fix broken acceptance tests + +##2014-07-15 - Supported Release 1.5.2 +###Summary + +This release merely updates metadata.json so the module can be uninstalled and +upgraded via the puppet module command. + +##2014-07-10 - Supported Release 1.5.1 +###Summary + +This release has added tests to ensure graceful failure on OSX. + +##2014-06-04 - Release 1.5.0 +###Summary + +This release adds support for Ubuntu 14.04. It also includes many new features +and important bugfixes. One huge change is that apt::key was replaced with +apt_key, which allows you to use puppet resource apt_key to inventory keys on +your system. + +Special thanks to daenney, our intrepid unofficial apt maintainer! + +####Features +- Add support for Ubuntu Trusty! +- Add apt::hold define +- Generate valid *.pref files in apt::pin +- Made pin_priority configurable for apt::backports +- Add apt_key type and provider +- Rename "${apt_conf_d}/proxy" to "${apt_conf_d}/01proxy" +- apt::key rewritten to use apt_key type +- Add support for update_tries to apt::update + +####Bugfixes +- Typo fixes +- Fix unattended upgrades +- Removed bogus line when using purge_preferences +- Fix apt::force to upgrade allow packages to be upgraded to the pacakge from the specified release + +##2014-03-04 - Supported Release 1.4.2 +###Summary + +This is a supported release. This release tidies up 1.4.1 and re-enables +support for Ubuntu 10.04 + +####Features + +####Bugfixes +- Fix apt:ppa to include the -y Ubuntu 10.04 requires. +- Documentation changes. +- Test fixups. + +####Known Bugs + +* No known issues. + + + +##2014-02-13 1.4.1 +###Summary +This is a bugfix release. + +####Bugfixes +- Fix apt::force unable to upgrade packages from releases other than its original +- Removed a few refeneces to aptitude instead of apt-get for portability +- Removed call to getparam() due to stdlib dependency +- Correct apt::source template when architecture is provided +- Retry package installs if apt is locked +- Use root to exec in apt::ppa +- Updated tests and converted acceptance tests to beaker + +##2013-10-08 - Release 1.4.0 + +###Summary + +Minor bugfix and allow the timeout to be adjusted. + +####Features +- Add an `updates_timeout` to apt::params + +####Bugfixes +- Ensure apt::ppa can read a ppa removed by hand. + + +##2013-10-08 - Release 1.3.0 +###Summary + +This major feature in this release is the new apt::unattended_upgrades class, +allowing you to handle Ubuntu's unattended feature. This allows you to select +specific packages to automatically upgrade without any further user +involvement. + +In addition we extend our Wheezy support, add proxy support to apt:ppa and do +various cleanups and tweaks. + +####Features +- Add apt::unattended_upgrades support for Ubuntu. +- Add wheezy backports support. +- Use the geoDNS http.debian.net instead of the main debian ftp server. +- Add `options` parameter to apt::ppa in order to pass options to apt-add-repository command. +- Add proxy support for apt::ppa (uses proxy_host and proxy_port from apt). + +####Bugfixes +- Fix regsubst() calls to quote single letters (for future parser). +- Fix lint warnings and other misc cleanup. + + +##2013-07-03 - Release 1.2.0 + +####Features +- Add geppetto `.project` natures +- Add GH auto-release +- Add `apt::key::key_options` parameter +- Add complex pin support using distribution properties for `apt::pin` via new properties: + - `apt::pin::codename` + - `apt::pin::release_version` + - `apt::pin::component` + - `apt::pin::originator` + - `apt::pin::label` +- Add source architecture support to `apt::source::architecture` + +####Bugfixes +- Use apt-get instead of aptitude in apt::force +- Update default backports location +- Add dependency for required packages before apt-get update + + +##2013-06-02 - Release 1.1.1 +###Summary + +This is a bug fix release that resolves a number of issues: + +* By changing template variable usage, we remove the deprecation warnings + for Puppet 3.2.x +* Fixed proxy file removal, when proxy absent + +Some documentation, style and whitespaces changes were also merged. This +release also introduced proper rspec-puppet unit testing on Travis-CI to help +reduce regression. + +Thanks to all the community contributors below that made this patch possible. + +#### Detail Changes + +* fix minor comment type (Chris Rutter) +* whitespace fixes (Michael Moll) +* Update travis config file (William Van Hevelingen) +* Build all branches on travis (William Van Hevelingen) +* Standardize travis.yml on pattern introduced in stdlib (William Van Hevelingen) +* Updated content to conform to README best practices template (Lauren Rother) +* Fix apt::release example in readme (Brian Galey) +* add @ to variables in template (Peter Hoeg) +* Remove deprecation warnings for pin.pref.erb as well (Ken Barber) +* Update travis.yml to latest versions of puppet (Ken Barber) +* Fix proxy file removal (Scott Barber) +* Add spec test for removing proxy configuration (Dean Reilly) +* Fix apt::key listing longer than 8 chars (Benjamin Knofe) + + + + +## Release 1.1.0 +###Summary + +This release includes Ubuntu 12.10 (Quantal) support for PPAs. + +--- + +##2012-05-25 - Puppet Labs - Release 0.0.4 +###Summary + + * Fix ppa list filename when there is a period in the PPA name + * Add .pref extension to apt preferences files + * Allow preferences to be purged + * Extend pin support + + +##2012-05-04 - Puppet Labs - Release 0.0.3 +###Summary + + * only invoke apt-get update once + * only install python-software-properties if a ppa is added + * support 'ensure => absent' for all defined types + * add apt::conf + * add apt::backports + * fixed Modulefile for module tool dependency resolution + * configure proxy before doing apt-get update + * use apt-get update instead of aptitude for apt::ppa + * add support to pin release + + +##2012-03-26 - Puppet Labs - Release 0.0.2 +###Summary + +* 41cedbb (#13261) Add real examples to smoke tests. +* d159a78 (#13261) Add key.pp smoke test +* 7116c7a (#13261) Replace foo source with puppetlabs source +* 1ead0bf Ignore pkg directory. +* 9c13872 (#13289) Fix some more style violations +* 0ea4ffa (#13289) Change test scaffolding to use a module & manifest dir fixture path +* a758247 (#13289) Clean up style violations and fix corresponding tests +* 99c3fd3 (#13289) Add puppet lint tests to Rakefile +* 5148cbf (#13125) Apt keys should be case insensitive +* b9607a4 Convert apt::key to use anchors + + +##2012-03-07 - Puppet Labs - Release 0.0.1 +###Summary + +* d4fec56 Modify apt::source release parameter test +* 1132a07 (#12917) Add contributors to README +* 8cdaf85 (#12823) Add apt::key defined type and modify apt::source to use it +* 7c0d10b (#12809) $release should use $lsbdistcodename and fall back to manual input +* be2cc3e (#12522) Adjust spec test for splitting purge +* 7dc60ae (#12522) Split purge option to spare sources.list +* 9059c4e Fix source specs to test all key permutations +* 8acb202 Add test for python-software-properties package +* a4af11f Check if python-software-properties is defined before attempting to define it. +* 1dcbf3d Add tests for required_packages change +* f3735d2 Allow duplicate $required_packages +* 74c8371 (#12430) Add tests for changes to apt module +* 97ebb2d Test two sources with the same key +* 1160bcd (#12526) Add ability to reverse apt { disable_keys => true } +* 2842d73 Add Modulefile to puppet-apt +* c657742 Allow the use of the same key in multiple sources +* 8c27963 (#12522) Adding purge option to apt class +* 997c9fd (#12529) Add unit test for apt proxy settings +* 50f3cca (#12529) Add parameter to support setting a proxy for apt +* d522877 (#12094) Replace chained .with_* with a hash +* 8cf1bd0 (#12094) Remove deprecated spec.opts file +* 2d688f4 (#12094) Add rspec-puppet tests for apt +* 0fb5f78 (#12094) Replace name with path in file resources +* f759bc0 (#11953) Apt::force passes $version to aptitude +* f71db53 (#11413) Add spec test for apt::force to verify changes to unless +* 2f5d317 (#11413) Update dpkg query used by apt::force +* cf6caa1 (#10451) Add test coverage to apt::ppa +* 0dd697d include_src parameter in example; Whitespace cleanup +* b662eb8 fix typos in "repositories" +* 1be7457 Fix (#10451) - apt::ppa fails to "apt-get update" when new PPA source is added +* 864302a Set the pin priority before adding the source (Fix #10449) +* 1de4e0a Refactored as per mlitteken +* 1af9a13 Added some crazy bash madness to check if the ppa is installed already. Otherwise the manifest tries to add it on every run! +* 52ca73e (#8720) Replace Apt::Ppa with Apt::Builddep +* 5c05fa0 added builddep command. +* a11af50 added the ability to specify the content of a key +* c42db0f Fixes ppa test. +* 77d2b0d reformatted whitespace to match recommended style of 2 space indentation. +* 27ebdfc ignore swap files. +* 377d58a added smoke tests for module. +* 18f614b reformatted apt::ppa according to recommended style. +* d8a1e4e Created a params class to hold global data. +* 636ae85 Added two params for apt class +* 148fc73 Update LICENSE. +* ed2d19e Support ability to add more than one PPA +* 420d537 Add call to apt-update after add-apt-repository in apt::ppa +* 945be77 Add package definition for python-software-properties +* 71fc425 Abs paths for all commands +* 9d51cd1 Adding LICENSE +* 71796e3 Heading fix in README +* 87777d8 Typo in README +* f848bac First commit diff --git a/environments/production/modules/apt/CONTRIBUTING.md b/environments/production/modules/apt/CONTRIBUTING.md new file mode 100644 index 0000000..990edba --- /dev/null +++ b/environments/production/modules/apt/CONTRIBUTING.md @@ -0,0 +1,217 @@ +Checklist (and a short version for the impatient) +================================================= + + * Commits: + + - Make commits of logical units. + + - Check for unnecessary whitespace with "git diff --check" before + committing. + + - Commit using Unix line endings (check the settings around "crlf" in + git-config(1)). + + - Do not check in commented out code or unneeded files. + + - The first line of the commit message should be a short + description (50 characters is the soft limit, excluding ticket + number(s)), and should skip the full stop. + + - Associate the issue in the message. The first line should include + the issue number in the form "(#XXXX) Rest of message". + + - The body should provide a meaningful commit message, which: + + - uses the imperative, present tense: "change", not "changed" or + "changes". + + - includes motivation for the change, and contrasts its + implementation with the previous behavior. + + - Make sure that you have tests for the bug you are fixing, or + feature you are adding. + + - Make sure the test suites passes after your commit: + `bundle exec rspec spec/acceptance` More information on [testing](#Testing) below + + - When introducing a new feature, make sure it is properly + documented in the README.md + + * Submission: + + * Pre-requisites: + + - Make sure you have a [GitHub account](https://github.com/join) + + - [Create a ticket](https://tickets.puppet.com/secure/CreateIssue!default.jspa), or [watch the ticket](https://tickets.puppet.com/browse/) you are patching for. + + * Preferred method: + + - Fork the repository on GitHub. + + - Push your changes to a topic branch in your fork of the + repository. (the format ticket/1234-short_description_of_change is + usually preferred for this project). + + - Submit a pull request to the repository in the puppetlabs + organization. + +The long version +================ + + 1. Make separate commits for logically separate changes. + + Please break your commits down into logically consistent units + which include new or changed tests relevant to the rest of the + change. The goal of doing this is to make the diff easier to + read for whoever is reviewing your code. In general, the easier + your diff is to read, the more likely someone will be happy to + review it and get it into the code base. + + If you are going to refactor a piece of code, please do so as a + separate commit from your feature or bug fix changes. + + We also really appreciate changes that include tests to make + sure the bug is not re-introduced, and that the feature is not + accidentally broken. + + Describe the technical detail of the change(s). If your + description starts to get too long, that is a good sign that you + probably need to split up your commit into more finely grained + pieces. + + Commits which plainly describe the things which help + reviewers check the patch and future developers understand the + code are much more likely to be merged in with a minimum of + bike-shedding or requested changes. Ideally, the commit message + would include information, and be in a form suitable for + inclusion in the release notes for the version of Puppet that + includes them. + + Please also check that you are not introducing any trailing + whitespace or other "whitespace errors". You can do this by + running "git diff --check" on your changes before you commit. + + 2. Sending your patches + + To submit your changes via a GitHub pull request, we _highly_ + recommend that you have them on a topic branch, instead of + directly on "master". + It makes things much easier to keep track of, especially if + you decide to work on another thing before your first change + is merged in. + + GitHub has some pretty good + [general documentation](http://help.github.com/) on using + their site. They also have documentation on + [creating pull requests](http://help.github.com/send-pull-requests/). + + In general, after pushing your topic branch up to your + repository on GitHub, you can switch to the branch in the + GitHub UI and click "Pull Request" towards the top of the page + in order to open a pull request. + + + 3. Update the related GitHub issue. + + If there is a GitHub issue associated with the change you + submitted, then you should update the ticket to include the + location of your branch, along with any other commentary you + may wish to make. + +Testing +======= + +Getting Started +--------------- + +Our puppet modules provide [`Gemfile`](./Gemfile)s which can tell a ruby +package manager such as [bundler](http://bundler.io/) what Ruby packages, +or Gems, are required to build, develop, and test this software. + +Please make sure you have [bundler installed](http://bundler.io/#getting-started) +on your system, then use it to install all dependencies needed for this project, +by running + +```shell +% bundle install +Fetching gem metadata from https://rubygems.org/........ +Fetching gem metadata from https://rubygems.org/.. +Using rake (10.1.0) +Using builder (3.2.2) +-- 8><-- many more --><8 -- +Using rspec-system-puppet (2.2.0) +Using serverspec (0.6.3) +Using rspec-system-serverspec (1.0.0) +Using bundler (1.3.5) +Your bundle is complete! +Use `bundle show [gemname]` to see where a bundled gem is installed. +``` + +NOTE some systems may require you to run this command with sudo. + +If you already have those gems installed, make sure they are up-to-date: + +```shell +% bundle update +``` + +With all dependencies in place and up-to-date we can now run the tests: + +```shell +% bundle exec rake spec +``` + +This will execute all the [rspec tests](http://rspec-puppet.com/) tests +under [spec/defines](./spec/defines), [spec/classes](./spec/classes), +and so on. rspec tests may have the same kind of dependencies as the +module they are testing. While the module defines in its [Modulefile](./Modulefile), +rspec tests define them in [.fixtures.yml](./fixtures.yml). + +Some puppet modules also come with [beaker](https://github.com/puppetlabs/beaker) +tests. These tests spin up a virtual machine under +[VirtualBox](https://www.virtualbox.org/)) with, controlling it with +[Vagrant](http://www.vagrantup.com/) to actually simulate scripted test +scenarios. In order to run these, you will need both of those tools +installed on your system. + +You can run them by issuing the following command + +```shell +% bundle exec rake spec_clean +% bundle exec rspec spec/acceptance +``` + +This will now download a pre-fabricated image configured in the [default node-set](./spec/acceptance/nodesets/default.yml), +install puppet, copy this module and install its dependencies per [spec/spec_helper_acceptance.rb](./spec/spec_helper_acceptance.rb) +and then run all the tests under [spec/acceptance](./spec/acceptance). + +Writing Tests +------------- + +XXX getting started writing tests. + +If you have commit access to the repository +=========================================== + +Even if you have commit access to the repository, you will still need to +go through the process above, and have someone else review and merge +in your changes. The rule is that all changes must be reviewed by a +developer on the project (that did not write the code) to ensure that +all changes go through a code review process. + +Having someone other than the author of the topic branch recorded as +performing the merge is the record that they performed the code +review. + + +Additional Resources +==================== + +* [Getting additional help](http://puppet.com/community/get-help) + +* [Writing tests](https://docs.puppet.com/guides/module_guides/bgtm.html#step-three-module-testing) + +* [General GitHub documentation](http://help.github.com/) + +* [GitHub pull request documentation](http://help.github.com/send-pull-requests/) diff --git a/environments/production/modules/apt/Gemfile b/environments/production/modules/apt/Gemfile new file mode 100644 index 0000000..46cb2ea --- /dev/null +++ b/environments/production/modules/apt/Gemfile @@ -0,0 +1,75 @@ +#This file is generated by ModuleSync, do not edit. + +source ENV['GEM_SOURCE'] || "https://rubygems.org" + +# Determines what type of gem is requested based on place_or_version. +def gem_type(place_or_version) + if place_or_version =~ /^git:/ + :git + elsif place_or_version =~ /^file:/ + :file + else + :gem + end +end + +# Find a location or specific version for a gem. place_or_version can be a +# version, which is most often used. It can also be git, which is specified as +# `git://somewhere.git#branch`. You can also use a file source location, which +# is specified as `file://some/location/on/disk`. +def location_for(place_or_version, fake_version = nil) + if place_or_version =~ /^(git[:@][^#]*)#(.*)/ + [fake_version, { :git => $1, :branch => $2, :require => false }].compact + elsif place_or_version =~ /^file:\/\/(.*)/ + ['>= 0', { :path => File.expand_path($1), :require => false }] + else + [place_or_version, { :require => false }] + end +end + +# Used for gem conditionals +supports_windows = false +ruby_version_segments = Gem::Version.new(RUBY_VERSION.dup).segments +minor_version = "#{ruby_version_segments[0]}.#{ruby_version_segments[1]}" + +group :development do + gem "puppet-module-posix-default-r#{minor_version}", :require => false, :platforms => "ruby" + gem "puppet-module-win-default-r#{minor_version}", :require => false, :platforms => ["mswin", "mingw", "x64_mingw"] + gem "puppet-module-posix-dev-r#{minor_version}", :require => false, :platforms => "ruby" + gem "puppet-module-win-dev-r#{minor_version}", :require => false, :platforms => ["mswin", "mingw", "x64_mingw"] + gem "json_pure", '<= 2.0.1', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem "fast_gettext", '1.1.0', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.1.0') + gem "fast_gettext", :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.1.0') +end + +group :system_tests do + gem "puppet-module-posix-system-r#{minor_version}", :require => false, :platforms => "ruby" + gem "puppet-module-win-system-r#{minor_version}", :require => false, :platforms => ["mswin", "mingw", "x64_mingw"] + gem "beaker", *location_for(ENV['BEAKER_VERSION'] || '>= 3') + gem "beaker-pe", :require => false + gem "beaker-rspec", *location_for(ENV['BEAKER_RSPEC_VERSION']) + gem "beaker-hostgenerator", *location_for(ENV['BEAKER_HOSTGENERATOR_VERSION']) + gem "beaker-abs", *location_for(ENV['BEAKER_ABS_VERSION'] || '~> 0.1') +end + +gem 'puppet', *location_for(ENV['PUPPET_GEM_VERSION']) + +# Only explicitly specify Facter/Hiera if a version has been specified. +# Otherwise it can lead to strange bundler behavior. If you are seeing weird +# gem resolution behavior, try setting `DEBUG_RESOLVER` environment variable +# to `1` and then run bundle install. +gem 'facter', *location_for(ENV['FACTER_GEM_VERSION']) if ENV['FACTER_GEM_VERSION'] +gem 'hiera', *location_for(ENV['HIERA_GEM_VERSION']) if ENV['HIERA_GEM_VERSION'] + + +# Evaluate Gemfile.local if it exists +if File.exists? "#{__FILE__}.local" + eval(File.read("#{__FILE__}.local"), binding) +end + +# Evaluate ~/.gemfile if it exists +if File.exists?(File.join(Dir.home, '.gemfile')) + eval(File.read(File.join(Dir.home, '.gemfile')), binding) +end + +# vim:ft=ruby diff --git a/environments/production/modules/apt/LICENSE b/environments/production/modules/apt/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/environments/production/modules/apt/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/environments/production/modules/apt/MAINTAINERS.md b/environments/production/modules/apt/MAINTAINERS.md new file mode 100644 index 0000000..0b11ea2 --- /dev/null +++ b/environments/production/modules/apt/MAINTAINERS.md @@ -0,0 +1,6 @@ +## Maintenance + +Maintainers: + - Puppet Forge Modules Team `forge-modules |at| puppet |dot| com` + +Tickets: https://tickets.puppet.com/browse/MODULES. Make sure to set component to `apt`. diff --git a/environments/production/modules/apt/NOTICE b/environments/production/modules/apt/NOTICE new file mode 100644 index 0000000..e615ab7 --- /dev/null +++ b/environments/production/modules/apt/NOTICE @@ -0,0 +1,15 @@ +Puppet Module - puppetlabs-apt + +Copyright 2017 Puppet, Inc. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. \ No newline at end of file diff --git a/environments/production/modules/apt/README.md b/environments/production/modules/apt/README.md new file mode 100644 index 0000000..3168f51 --- /dev/null +++ b/environments/production/modules/apt/README.md @@ -0,0 +1,527 @@ +# apt + +#### Table of Contents + + +2. [Module Description - What the module does and why it is useful](#module-description) +3. [Setup - The basics of getting started with apt](#setup) + * [What apt affects](#what-apt-affects) + * [Beginning with apt](#beginning-with-apt) +4. [Usage - Configuration options and additional functionality](#usage) + * [Add GPG keys](#add-gpg-keys) + * [Prioritize backports](#prioritize-backports) + * [Update the list of packages](#update-the-list-of-packages) + * [Pin a specific release](#pin-a-specific-release) + * [Add a Personal Package Archive repository](#add-a-personal-package-archive-repository) + * [Configure Apt from Hiera](#configure-apt-from-hiera) + * [Replace the default sources.list file](#replace-the-default-sourceslist-file) +5. [Reference - An under-the-hood peek at what the module is doing and how](#reference) + * [Classes](#classes) + * [Defined Types](#defined-types) + * [Types](#types) + * [Facts](#facts) +6. [Limitations - OS compatibility, etc.](#limitations) +7. [Development - Guide for contributing to the module](#development) + +## Module Description + +The apt module lets you use Puppet to manage Apt sources, keys, and other configuration options. + +Apt (Advanced Package Tool) is a package manager available on Debian, Ubuntu, and several other operating systems. The apt module provides a series of classes, defines, types, and facts to help you automate Apt package management. + +**Note**: For this module to correctly autodetect which version of Debian/Ubuntu (or derivative) you're running, you need to make sure the 'lsb-release' package is installed. We highly recommend you either make this part of your provisioning layer, if you run many Debian or derivative systems, or ensure that you have Facter 2.2.0 or later installed, which will pull this dependency in for you. + +## Setup + +### What apt affects + +* Your system's `preferences` file and `preferences.d` directory +* Your system's `sources.list` file and `sources.list.d` directory +* System repositories +* Authentication keys + +**Note:** This module offers `purge` parameters which, if set to 'true', **destroy** any configuration on the node's `sources.list(.d)` and `preferences(.d)` that you haven't declared through Puppet. The default for these parameters is 'false'. + +### Beginning with apt + +To use the apt module with default parameters, declare the `apt` class. + +```puppet +include apt +``` + +**Note:** The main `apt` class is required by all other classes, types, and defined types in this module. You must declare it whenever you use the module. + +## Usage + +### Add GPG keys + +**Warning:** Using short key IDs presents a serious security issue, potentially leaving you open to collision attacks. We recommend you always use full fingerprints to identify your GPG keys. This module allows short keys, but issues a security warning if you use them. + +Declare the `apt::key` defined type: + +```puppet +apt::key { 'puppetlabs': + id => '6F6B15509CF8E59E6E469F327F438280EF8D349F', + server => 'pgp.mit.edu', + options => 'http-proxy="http://proxyuser:proxypass@example.org:3128"', +} +``` + +### Prioritize backports + +```puppet +class { 'apt::backports': + pin => 500, +} +``` + +By default, the `apt::backports` class drops a pin file for backports, pinning it to a priority of 200. This is lower than the normal default of 500, so packages with `ensure => latest` don't get upgraded from backports without your explicit permission. + +If you raise the priority through the `pin` parameter to 500, normal policy goes into effect and Apt installs or upgrades to the newest version. This means that if a package is available from backports, it and its dependencies are pulled in from backports unless you explicitly set the `ensure` attribute of the `package` resource to `installed`/`present` or a specific version. + +### Update the list of packages + +By default, Puppet runs `apt-get update` on the first Puppet run after you include the `apt` class, and anytime `notify => Exec['apt_update']` occurs; i.e., whenever config files get updated or other relevant changes occur. If you set `update['frequency']` to 'always', the update runs on every Puppet run. You can also set `update['frequency']` to 'daily' or 'weekly': + +```puppet +class { 'apt': + update => { + frequency => 'daily', + }, +} +``` + +### Pin a specific release + +```puppet +apt::pin { 'karmic': priority => 700 } +apt::pin { 'karmic-updates': priority => 700 } +apt::pin { 'karmic-security': priority => 700 } +``` + +You can also specify more complex pins using distribution properties: + +```puppet +apt::pin { 'stable': + priority => -10, + originator => 'Debian', + release_version => '3.0', + component => 'main', + label => 'Debian' +} +``` + +To pin multiple packages, pass them to the `packages` parameter as an array or a space-delimited string. + +### Add a Personal Package Archive repository + +```puppet +apt::ppa { 'ppa:drizzle-developers/ppa': } +``` + +### Add an Apt source to `/etc/apt/sources.list.d/` + +```puppet +apt::source { 'debian_unstable': + comment => 'This is the iWeb Debian unstable mirror', + location => 'http://debian.mirror.iweb.ca/debian/', + release => 'unstable', + repos => 'main contrib non-free', + pin => '-10', + key => { + 'id' => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + 'server' => 'subkeys.pgp.net', + }, + include => { + 'src' => true, + 'deb' => true, + }, +} +``` + +To use the Puppet Labs Apt repository as a source: + +```puppet +apt::source { 'puppetlabs': + location => 'http://apt.puppetlabs.com', + repos => 'main', + key => { + 'id' => '6F6B15509CF8E59E6E469F327F438280EF8D349F', + 'server' => 'pgp.mit.edu', + }, +} +``` + +### Configure Apt from Hiera + +Instead of specifying your sources directly as resources, you can instead just +include the `apt` class, which will pick up the values automatically from +hiera. + +```yaml +apt::sources: + 'debian_unstable': + comment: 'This is the iWeb Debian unstable mirror' + location: 'http://debian.mirror.iweb.ca/debian/' + release: 'unstable' + repos: 'main contrib non-free' + pin: '-10' + key: + id: 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553' + server: 'subkeys.pgp.net' + include: + src: true + deb: true + + 'puppetlabs': + location: 'http://apt.puppetlabs.com' + repos: 'main' + key: + id: '6F6B15509CF8E59E6E469F327F438280EF8D349F' + server: 'pgp.mit.edu' +``` + +### Replace the default sources.list file + +The following example replaces the default `/etc/apt/sources.list`. Along with this code, be sure to use the `purge` parameter, or you might get duplicate source warnings when running Apt. + +```puppet +apt::source { "archive.ubuntu.com-${lsbdistcodename}": + location => 'http://archive.ubuntu.com/ubuntu', + key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + repos => 'main universe multiverse restricted', +} + +apt::source { "archive.ubuntu.com-${lsbdistcodename}-security": + location => 'http://archive.ubuntu.com/ubuntu', + key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + repos => 'main universe multiverse restricted', + release => "${lsbdistcodename}-security" +} + +apt::source { "archive.ubuntu.com-${lsbdistcodename}-updates": + location => 'http://archive.ubuntu.com/ubuntu', + key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + repos => 'main universe multiverse restricted', + release => "${lsbdistcodename}-updates" +} + +apt::source { "archive.ubuntu.com-${lsbdistcodename}-backports": + location => 'http://archive.ubuntu.com/ubuntu', + key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + repos => 'main universe multiverse restricted', + release => "${lsbdistcodename}-backports" +} +``` + +## Reference + +### Classes + +#### Public Classes + +* [`apt`](#class-apt) +* [`apt::backports`](#class-aptbackports) + +#### Private Classes + +* `apt::params`: Provides defaults for the apt module parameters. +* `apt::update`: Updates the list of available packages using `apt-get update`. + +### Defined Types + +* [`apt::conf`](#defined-type-aptconf) +* [`apt::key`](#defined-type-aptkey) +* [`apt::pin`](#defined-type-aptpin) +* [`apt::ppa`](#defined-type-aptppa) +* [`apt::setting`](#defined-type-aptsetting) +* [`apt::source`](#defined-type-aptsource) + +### Types + +* [`apt_key`](#type-apt_key) + +### Facts + +* `apt_updates`: The number of installed packages with available updates. + +* `apt_security_updates`: The number of installed packages with available security updates. + +* `apt_package_updates`: The names of all installed packages with available updates. In Facter 2.0 and later this data is formatted as an array; in earlier versions it is a comma-delimited string. + +* `apt_update_last_success`: The date, in epochtime, of the most recent successful `apt-get update` run (based on the mtime of /var/lib/apt/periodic/update-success-stamp). + +* `apt_reboot_required`: Determines if a reboot is necessary after updates have been installed. + +#### Class: `apt` + +Main class, includes all other classes. + +##### Parameters (all optional) + +* `confs`: Creates new `apt::conf` resources. Valid options: a hash to be passed to the [`create_resources` function](https://docs.puppetlabs.com/references/latest/function.html#createresources). Default: {}. + +* `keys`: Creates new `apt::key` resources. Valid options: a hash to be passed to the [`create_resources` function](https://docs.puppetlabs.com/references/latest/function.html#createresources). Default: {}. + +* `ppas`: Creates new `apt::ppa` resources. Valid options: a hash to be passed to the [`create_resources` function](https://docs.puppetlabs.com/references/latest/function.html#createresources). Default: {}. + +* `proxy`: Configures Apt to connect to a proxy server. Valid options: a hash made up from the following keys: + + * 'host': Specifies a proxy host to be stored in `/etc/apt/apt.conf.d/01proxy`. Valid options: a string containing a hostname. Default: undef. + + * 'port': Specifies a proxy port to be stored in `/etc/apt/apt.conf.d/01proxy`. Valid options: a string containing a port number. Default: '8080'. + + * 'https': Specifies whether to enable https proxies. Valid options: 'true' and 'false'. Default: 'false'. + + * 'ensure': Optional parameter. Valid options: 'file', 'present', and 'absent'. Default: 'undef'. Prefer 'file' over 'present'. + +* `purge`: Specifies whether to purge any existing settings that aren't managed by Puppet. Valid options: a hash made up from the following keys: + + * 'sources.list': Specifies whether to purge any unmanaged entries from `sources.list`. Valid options: 'true' and 'false'. Default: 'false'. + + * 'sources.list.d': Specifies whether to purge any unmanaged entries from `sources.list.d`. Valid options: 'true' and 'false'. Default: 'false'. + + * 'preferences': Specifies whether to purge any unmanaged entries from `preferences`. Valid options: 'true' and 'false'. Default: 'false'. + + * 'preferences.d': Specifies whether to purge any unmanaged entries from `preferences.d`. Valid options: 'true' and 'false'. Default: 'false'. + +* `settings`: Creates new `apt::setting` resources. Valid options: a hash to be passed to the [`create_resources` function](https://docs.puppetlabs.com/references/latest/function.html#createresources). Default: {}. + +* `sources`: Creates new `apt::source` resources. Valid options: a hash to be passed to the [`create_resources` function](https://docs.puppetlabs.com/references/latest/function.html#createresources). Default: {}. + +* `pins`: Creates new `apt::pin` resources. Valid options: a hash to be passed to the [`create_resources` function](https://docs.puppetlabs.com/references/latest/function.html#createresources). Default: {}. + +* `update`: Configures various update settings. Valid options: a hash made up from the following keys: + + * 'frequency': Specifies how often to run `apt-get update`. If the exec resource `apt_update` is notified, `apt-get update` runs regardless of this value. Valid options: 'always' (at every Puppet run); 'daily' (if the value of `apt_update_last_success` is less than current epoch time minus 86400); 'weekly' (if the value of `apt_update_last_success` is less than current epoch time minus 604800); and 'reluctantly' (only if the exec resource `apt_update` is notified). Default: 'reluctantly'. + + * 'timeout': Specifies how long to wait for the update to complete before canceling it. Valid options: an integer, in seconds. Default: 300. + + * 'tries': Specifies how many times to retry the update after receiving a DNS or HTTP error. Valid options: an integer. Default: 1. + +#### Class: `apt::backports` + +Manages backports. + +##### Parameters (all optional on Debian and Ubuntu; all required on other operating systems, except where specified) + +* `key`: Specifies a key to authenticate the backports. Valid options: a string to be passed to the `id` parameter of the `apt::key` defined type, or a hash of `parameter => value` pairs to be passed to `apt::key`'s `id`, `server`, `content`, `source`, and/or `options` parameters. Defaults: + + * Debian: 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553' + * Ubuntu: '630239CC130E1A7FD81A27B140976EAF437D05B5' + +* `location`: Specifies an Apt repository containing the backports to manage. Valid options: a string containing a URL. Defaults: + + * Debian (squeeze): 'http://httpredir.debian.org/debian-backports' + * Debian (other): 'http://httpredir.debian.org/debian' + * Ubuntu: 'http://archive.ubuntu.com/ubuntu' + +* `pin`: *Optional.* Specifies a pin priority for the backports. Valid options: a number or string to be passed to the `id` parameter of the `apt::pin` defined type, or a hash of `parameter => value` pairs to be passed to `apt::pin`'s corresponding parameters. Default: '200'. + +* `release`: Specifies a distribution of the Apt repository containing the backports to manage. Valid options: a string containing the release, used in populating the `source.list` configuration file. Default: on Debian and Ubuntu, '${lsbdistcodename}-backports'. We recommend keeping this default, except on other operating systems. + +* `repos`: Specifies a component of the Apt repository containing the backports to manage. Valid options: A string containing the repos to include, used in populating the `source.list` configuration file. Defaults: + + * Debian: 'main contrib non-free' + * Ubuntu: 'main universe multiverse restricted' + +#### Defined Type: `apt::conf` + +Specifies a custom Apt configuration file. + +##### Parameters + +* `content`: *Required, unless `ensure` is set to 'absent'.* Directly supplies content for the configuration file. Valid options: a string. Default: undef. + +* `ensure`: Specifies whether the configuration file should exist. Valid options: 'present' and 'absent'. Default: 'present'. + +* `priority`: *Optional.* Determines the order in which Apt processes the configuration file. Files with lower priority numbers are loaded first. Valid options: a string containing an integer. Default: '50'. + +* `notify_update`: *Optional.* Specifies whether to trigger an `apt-get update` run. Valid options: 'true' and 'false'. Default: 'true'. + +#### Defined Type: `apt::key` + +Manages the GPG keys that Apt uses to authenticate packages. + +The `apt::key` defined type makes use of the `apt_key` type, but includes extra functionality to help prevent duplicate keys. + +##### Parameters (all optional) + +* `content`: Supplies the entire GPG key. Useful in case the key can't be fetched from a remote location and using a file resource is inconvenient. Valid options: a string. Default: undef. + +* `ensure`: Specifies whether the key should exist. Valid options: 'present' and 'absent'. Default: 'present'. + +* `id`: Specifies a GPG key to authenticate Apt package signatures. Valid options: a string containing a key ID (8 or 16 hexadecimal characters, optionally prefixed with "0x") or a full key fingerprint (40 hexadecimal characters). Default: $title. + +* `options`: Passes additional options to `apt-key adv --keyserver-options`. Valid options: a string. Default: undef. + +* `source`: Specifies the location of an existing GPG key file to copy. Valid options: a string containing a URL (ftp://, http://, or https://) or an absolute path. Default: undef. + +* `server`: Specifies a keyserver to provide the GPG key. Valid options: a string containing a domain name or a full URL (http://, https://, or hkp://). Default: 'keyserver.ubuntu.com'. + +* `key`: Specifies a GPG key to authenticate Apt package signatures. Valid options: a string containing a key ID (8 or 16 hexadecimal characters, optionally prefixed with "0x") or a full key fingerprint (40 hexadecimal characters). Default: undef. **Note** This parameter is deprecated and will be removed in a future release. + +* `key_content`: Supplies the entire GPG key. Useful in case the key can't be fetched from a remote location and using a file resource is inconvenient. Valid options: a string. Default: undef. **Note** This parameter is deprecated and will be removed in a future release. + +* `key_source`: Specifies the location of an existing GPG key file to copy. Valid options: a string containing a URL (ftp://, http://, or https://) or an absolute path. Default: undef. **Note** This parameter is deprecated and will be removed in a future release. + +* `key_server`: Specifies a keyserver to provide the GPG key. Valid options: a string containing a domain name or a full URL (http://, https://, or hkp://). Default: 'keyserver.ubuntu.com'. **Note** This parameter is deprecated and will be removed in a future release. + +* `key_options`: Passes additional options to `apt-key adv --keyserver-options`. Valid options: a string. Default: undef. **Note** This parameter is deprecated and will be removed in a future release. + +#### Defined Type: `apt::pin` + +Manages Apt pins. Does not trigger an `apt-get update` run. + +**Note:** For context on these parameters, we recommend reading the man page ['apt_preferences(5)'](http://linux.die.net/man/5/apt_preferences) + +##### Parameters (all optional) + +* `codename`: Specifies the distribution (lsbdistcodename) of the Apt repository. Valid options: a string. Default: ''. + +* `component`: Names the licensing component associated with the packages in the directory tree of the Release file. Valid options: a string. Default: ''. + +* `ensure`: Specifies whether the pin should exist. Valid options: 'file', 'present', and 'absent'. Default: 'present'. + +* `explanation`: Supplies a comment to explain the pin. Valid options: a string. Default: "${caller_module_name}: ${name}". + +* `label`: Names the label of the packages in the directory tree of the Release file. Valid options: a string (most commonly, 'debian'). Default: ''. + +* `order`: Determines the order in which Apt processes the pin file. Files with lower order numbers are loaded first. Valid options: an integer. Default: 50. + +* `origin`: Tells Apt to prefer packages from the specified server. Valid options: a string containing a hostname. Default: ''. + +* `originator`: Names the originator of the packages in the directory tree of the Release file. Valid options: a string (most commonly, 'debian'). Default: ''. + +* `packages`: Specifies which package(s) to pin. Valid options: a string or an array. Default: '*'. + +* `priority`: Sets the priority of the package. If multiple versions of a given package are available, `apt-get` installs the one with the highest priority number (subject to dependency constraints). Valid options: an integer. Default: 0. + +* `release`: Tells Apt to prefer packages that support the specified release. Typical values include 'stable', 'testing', and 'unstable' Valid options: a string. Default: ''. + +* `release_version`: Tells Apt to prefer packages that support the specified operating system release version (e.g., Debian release version 7). Valid options: a string. Default: ''. + +* `version`: Tells Apt to prefer a specified package version or version range. Valid options: a string. Default: ''. + +#### Defined Type: `apt::ppa` + +Manages PPA repositories using `add-apt-repository`. Not supported on Debian. + +##### Parameters (all optional, except where specified) + +* `ensure`: Specifies whether the PPA should exist. Valid options: 'present' and 'absent'. Default: 'present'. + +* `options`: Supplies options to be passed to the `add-apt-repository` command. Valid options: a string. Defaults: + + * Lucid: undef + * All others: '-y' + +* `package_manage`: Specifies whether Puppet should manage the package that provides `apt-add-repository`. Valid options: 'true' and 'false'. Default: 'false'. + +* `package_name`: Names the package that provides the `apt-add-repository` command. Valid options: a string. Defaults: + + * Lucid and Precise: 'python-software-properties' + * Trusty and newer: 'software-properties-common' + * All others: 'python-software-properties' + +* `release`: *Optional if lsb-release is installed (unless you're using a different release than indicated by lsb-release, e.g., Linux Mint).* Specifies the operating system of your node. Valid options: a string containing a valid LSB distribution codename. Default: "$lsbdistcodename". + +#### Defined Type: `apt::setting` + +Manages Apt configuration files. + +##### Parameters + +* `content`: *Required, unless `source` is set.* Directly supplies content for the configuration file. Cannot be used in combination with `source`. Valid options: see the `content` attribute of [Puppet's native `file` type](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-content). Default: undef. + +* `ensure`: Specifies whether the file should exist. Valid options: 'present', 'absent', and 'file'. Default: 'file'. + +* `notify_update`: *Optional.* Specifies whether to trigger an `apt-get update` run. Valid options: 'true' and 'false'. Default: 'true'. + +* `priority`: *Optional.* Determines the order in which Apt processes the configuration file. Files with higher priority numbers are loaded first. Valid options: an integer or zero-padded integer. Default: 50. + +* `source`: *Required, unless `content` is set.* Specifies a source file to supply the content of the configuration file. Cannot be used in combination with `content`. Valid options: see the `source` attribute of [Puppet's native `file` type](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-source). Default: undef. + +#### Defined Type: `apt::source` + +Manages the Apt sources in `/etc/apt/sources.list.d/`. + +##### Parameters (all optional, except where specified) + +* `allow_unsigned`: Specifies whether to authenticate packages from this release, even if the Release file is not signed or the signature can't be checked. Valid options: 'true' and 'false'. Default: 'false'. + +* `architecture`: Tells Apt to only download information for specified architectures. Valid options: a string containing one or more architecture names, separated by commas (e.g., 'i386' or 'i386,alpha,powerpc'). Default: undef (if unspecified, Apt downloads information for all architectures defined in the Apt::Architectures option). + +* `comment`: Supplies a comment for adding to the Apt source file. Valid options: a string. Default: $name. + +* `ensure`: Specifies whether the Apt source file should exist. Valid options: 'present' and 'absent'. Default: 'present'. + +* `key`: Creates a declaration of the apt::key defined type. Valid options: a string to be passed to the `id` parameter of the `apt::key` defined type, or a hash of `parameter => value` pairs to be passed to `apt::key`'s `id`, `server`, `content`, `source`, and/or `options` parameters. Default: undef. + +* `include`: Configures include options. Valid options: a hash of available keys. Default: {}. Available keys are: + + * 'deb' - Specifies whether to request the distribution's compiled binaries. Valid options: 'true' and 'false'. Default: 'true'. + + * 'src' - Specifies whether to request the distribution's uncompiled source code. Valid options: 'true' and 'false'. Default: 'false'. + +* `location`: *Required, unless `ensure` is set to 'absent'.* Specifies an Apt repository. Valid options: a string containing a repository URL. Default: undef. + +* `pin`: Creates a declaration of the apt::pin defined type. Valid options: a number or string to be passed to the `id` parameter of the `apt::pin` defined type, or a hash of `parameter => value` pairs to be passed to `apt::pin`'s corresponding parameters. Default: undef. + +* `release`: Specifies a distribution of the Apt repository. Valid options: a string. Default: "$lsbdistcodename". + + * `repos`: Specifies a component of the Apt repository. Valid options: a string. Default: 'main'. + +* `include_deb`: Specify whether to request the distrubution's compiled binaries. Valid options: 'true' and 'false'. Default: undef. **Note**: This parameter is deprecated and will be removed in future versions of the module. + +* `include_src`: Specifies whether to request the distribution's uncompiled source code. Valid options: 'true' and 'false'. Default: undef. **Note**: This parameter is deprecated and will be removed in future versions of the module. + +* `required_packages`: Installs packages required for this Apt source via an exec. Default: 'false'. **Note**: This parameter is deprecated and will be removed in future versions of the module. + +* `key_content`: Specifies the content to be passed to `apt::key`. Default: undef. **Note**: This parameter is deprecated and will be removed in future versions of the module. + +* `key_server`: Specifies the server to be passed to `apt::key`. Default: undef. **Note**: This parameter is deprecated and will be removed in future versions of the module. + +* `key_source`: Specifies the source to be passed to `apt::key`. Default: undef. **Note**: This parameter is deprecated and will be removed in future versions of the module. + +* `trusted_source`: Specifies whether to authenticate packages from this release, even if the Release file is not signed or the signature can't be checked. Valid options: 'true' and 'false'. Default: undef. This parameter is **deprecated** and will be removed in a future version of the module. + +* `notify_update`: *Optional.* Specifies whether to trigger an `apt-get update` run. Valid options: 'true' and 'false'. Default: 'true'. + +#### Type: `apt_key` + +Manages the GPG keys that Apt uses to authenticate packages. + +**Note:** In most cases, we recommend using the `apt::key` defined type. It makes use of the `apt_key` type, but includes extra functionality to help prevent duplicate keys. + +##### Parameters (all optional) + +* `content`: Supplies the entire GPG key. Useful in case the key can't be fetched from a remote location and using a file resource is inconvenient. Cannot be used in combination with `source`. Valid options: a string. Default: undef. + +* `options`: Passes additional options to `apt-key adv --keyserver-options`. Valid options: a string. Default: undef. + +* `server`: Specifies a keyserver to provide Puppet's GPG key. Valid options: a string containing a domain name or a full URL. Default: 'keyserver.ubuntu.com'. + +* `source`: Specifies the location of an existing GPG key file to copy. Cannot be used in combination with `content`. Valid options: a string containing a URL (ftp://, http://, or https://) or an absolute path. Default: undef. + +## Limitations + +This module is tested and officially supported on Debian 6 and 7 and Ubuntu 10.04, 12.04, and 14.04. Testing on other platforms has been light and cannot be guaranteed. + +This module is not designed to be split across [run stages](https://docs.puppetlabs.com/puppet/latest/reference/lang_run_stages.html). + +### Adding new sources or PPAs + +If you are adding a new source or PPA and trying to install packages from the new source or PPA on the same Puppet run, your `package` resource should depend on `Class['apt::update']`, in addition to depending on the `Apt::Source` or the `Apt::Ppa`. You can also add [collectors](https://docs.puppetlabs.com/puppet/latest/reference/lang_collectors.html) to ensure that all packages happen after `apt::update`, but this can lead to dependency cycles and has implications for [virtual resources](https://docs.puppetlabs.com/puppet/latest/reference/lang_collectors.html#behavior). + +```puppet +Class['apt::update'] -> Package <| provider == 'apt' |> +``` + +## Development +Puppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can't access the huge number of platforms and myriad hardware, software, and deployment configurations that Puppet is intended to serve. We want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things. + +For more information, see our [module contribution guide.](https://docs.puppetlabs.com/forge/contributing.html) + +To see who's already involved, see the [list of contributors.](https://github.com/puppetlabs/puppetlabs-apt/graphs/contributors) diff --git a/environments/production/modules/apt/Rakefile b/environments/production/modules/apt/Rakefile new file mode 100644 index 0000000..d12d854 --- /dev/null +++ b/environments/production/modules/apt/Rakefile @@ -0,0 +1,37 @@ +require 'puppetlabs_spec_helper/rake_tasks' +require 'puppet-lint/tasks/puppet-lint' +require 'puppet_blacksmith/rake_tasks' if Bundler.rubygems.find_name('puppet-blacksmith').any? + +PuppetLint.configuration.fail_on_warnings = true +PuppetLint.configuration.send('relative') + +desc 'Generate pooler nodesets' +task :gen_nodeset do + require 'beaker-hostgenerator' + require 'securerandom' + require 'fileutils' + + agent_target = ENV['TEST_TARGET'] + if ! agent_target + STDERR.puts 'TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat-64default."' + agent_target = 'redhat-64default.' + end + + master_target = ENV['MASTER_TEST_TARGET'] + if ! master_target + STDERR.puts 'MASTER_TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat7-64mdcl"' + master_target = 'redhat7-64mdcl' + end + + targets = "#{master_target}-#{agent_target}" + cli = BeakerHostGenerator::CLI.new([targets]) + nodeset_dir = "tmp/nodesets" + nodeset = "#{nodeset_dir}/#{targets}-#{SecureRandom.uuid}.yaml" + FileUtils.mkdir_p(nodeset_dir) + File.open(nodeset, 'w') do |fh| + fh.print(cli.execute) + end + puts nodeset +end diff --git a/environments/production/modules/apt/checksums.json b/environments/production/modules/apt/checksums.json new file mode 100644 index 0000000..0dcfa04 --- /dev/null +++ b/environments/production/modules/apt/checksums.json @@ -0,0 +1,79 @@ +{ + "CHANGELOG.md": "d4d93607171f5046e2f0a50ce222cf64", + "CONTRIBUTING.md": "77d0440d7cd4206497f99065c60bed46", + "Gemfile": "bedf635025b279d7c7732adcc8ae9a29", + "LICENSE": "3b83ef96387f14655fc854ddc3c6bd57", + "MAINTAINERS.md": "35674b233c6d12c0f56ee8afbdae29e4", + "NOTICE": "6d00632a000f9a82dd465a8bdba01beb", + "README.md": "06945ba980070be5f9e9b755fcfa4d8b", + "Rakefile": "3851f083966b9bbd6d46e50dba5aa52a", + "examples/backports.pp": "af57ea62ed1b73f540858e00327e6517", + "examples/builddep.pp": "eddb8b7d7c0ef7383d85a74c1cd0de3f", + "examples/debian_testing.pp": "2e50a41180e2afeac2de15ade05ddaa1", + "examples/debian_unstable.pp": "82890803cc4423443db8f40353e16262", + "examples/disable_keys.pp": "3d4e7ac49946d961ff51a719ee713293", + "examples/fancy_progress.pp": "9a55d4ea52be4ebd670befff7ca3b87f", + "examples/force.pp": "f71857eba704a0eb3d8d6b146e80da6d", + "examples/hold.pp": "5e58e0a30d6407a05691d96c7647ae14", + "examples/key.pp": "d85507365bd2753e14e04c344c2f7703", + "examples/pin.pp": "4b4c3612d75a19dba8eb7227070fa4ab", + "examples/ppa.pp": "b902cce8159128b5e8b21bed540743ff", + "examples/release.pp": "2bc960babf8c4dd24b7ffa4220a601f8", + "examples/source.pp": "c79817e129305f86a495f7558de3d3ec", + "examples/unattended_upgrades.pp": "e7a797388ef03077f110f4f268f5ecd1", + "lib/facter/apt_reboot_required.rb": "7c3fc46f254fc4b4579d011578caaadb", + "lib/facter/apt_update_last_success.rb": "2926ff059cd2f63a2a7824ba898837f9", + "lib/facter/apt_updates.rb": "2662a82fe574e565d225f7838278d9eb", + "lib/puppet/provider/apt_key/apt_key.rb": "129604ff1ecc1d1fa8faabc3f981e7a5", + "lib/puppet/type/apt_key.rb": "9c6ca9618cdcb863275c23cf32c77f2d", + "lib/puppet_x/apt_key/patch_openuri.rb": "951bad007a3b5db035be069c1d1c9c09", + "locales/config.yaml": "46660fe63119d48b8fb7dc3b38ee0856", + "manifests/backports.pp": "7d4a6e58ae3dc364e6279358e4f4b957", + "manifests/conf.pp": "f2da7513dc9ac2d0e6f702ea01eb0501", + "manifests/init.pp": "7d18b442184fe82fdd5287555ee32135", + "manifests/key.pp": "91b1831c68335eb7e703e913f0867d63", + "manifests/params.pp": "0d4669cb467dd39294d0974de9718d3e", + "manifests/pin.pp": "dbba5555b65c0beb56bbfb71b24a7878", + "manifests/ppa.pp": "b0de5cc9759cc08481ceee558a29e031", + "manifests/setting.pp": "cde5492c31b2b94c49bf67c7c96a6058", + "manifests/source.pp": "3d444e1884e21b3854d17eb75d836ffb", + "manifests/update.pp": "46330dc5a8e69b62b2dfd9072cd4f26c", + "metadata.json": "0cd6880236cfd4b1e339ae70bebdda60", + "spec/acceptance/apt_key_provider_spec.rb": "68e448171b89dcf535ac3f985937f1a7", + "spec/acceptance/apt_spec.rb": "851b630f2b884d3ca638c00154c44dcc", + "spec/acceptance/class_spec.rb": "d3a2ff84333f0f9ee0143aeac414e46b", + "spec/acceptance/nodesets/centos-7-x64.yml": "a713f3abd3657f0ae2878829badd23cd", + "spec/acceptance/nodesets/debian-8-x64.yml": "d2d2977900989f30086ad251a14a1f39", + "spec/acceptance/nodesets/default.yml": "b42da5a1ea0c964567ba7495574b8808", + "spec/acceptance/nodesets/docker/centos-7.yml": "8a3892807bdd62306ae4774f41ba11ae", + "spec/acceptance/nodesets/docker/debian-8.yml": "ac8e871d1068c96de5e85a89daaec6df", + "spec/acceptance/nodesets/docker/ubuntu-14.04.yml": "dc42ee922a96908d85b8f0f08203ce58", + "spec/classes/apt_backports_spec.rb": "782f04ee20f75a4af29c3d91d0128ae0", + "spec/classes/apt_spec.rb": "3bd62fc217c1298da4bdc9abd8b7d631", + "spec/classes/apt_update_spec.rb": "e1bae3848f53c709a14c1e6def93865e", + "spec/classes/params_spec.rb": "7691f074096952a2996b3648d5ef43cd", + "spec/defines/conf_spec.rb": "4c07a034a6e55098962535d5dca611b0", + "spec/defines/key_compat_spec.rb": "794019a0acf3d5d3b0fe377135219413", + "spec/defines/key_spec.rb": "3f40b52c2dbf6b6926fc23450e2e94fe", + "spec/defines/pin_spec.rb": "5a3866f7a49f88e6e14e3335872e387b", + "spec/defines/ppa_spec.rb": "d68d807e9979b92d2526c6d1a76875eb", + "spec/defines/setting_spec.rb": "9683d930309008a9585d1bd61db3d3d5", + "spec/defines/source_compat_spec.rb": "45fb68d91e6cdb3ec318acd616750256", + "spec/defines/source_spec.rb": "a8f14e760b736d49c135970ce1ca6188", + "spec/spec_helper.rb": "b2db3bc02b4ac2fd5142a6621c641b07", + "spec/spec_helper_acceptance.rb": "ba9896539a0b9d550e4d27803ba5214c", + "spec/unit/facter/apt_has_updates_spec.rb": "8294711c589fb1efa9aa23be0faf8500", + "spec/unit/facter/apt_package_updates_spec.rb": "2a0549f8656f094d9d0006ce12f61b2c", + "spec/unit/facter/apt_reboot_required_spec.rb": "9d58cb2aeaed624f7c4ca118ec1b6410", + "spec/unit/facter/apt_security_updates_spec.rb": "ec8a6711feac739866743dfaf4baf3d0", + "spec/unit/facter/apt_update_last_success_spec.rb": "cbc907ca27e6f9bb803fa9654c4a1836", + "spec/unit/facter/apt_updates_spec.rb": "ffde1130fda5990d2786ff7878ade5e0", + "spec/unit/puppet/type/apt_key_spec.rb": "311c79d817ad03fbae8923fa2a075221", + "templates/15update-stamp.erb": "b9de0ac9e2c9854b1bb213e362dc4e41", + "templates/_conf_header.erb": "6f3077f2eabd3e929a44d55bc1c5446e", + "templates/_header.erb": "9300ac105fe777787ac9e793b8df8d25", + "templates/conf.erb": "b4bc626b0d998cd681ee6b8c507c0d1d", + "templates/pin.pref.erb": "c3885c6816db46cf66e3a9bf57973c61", + "templates/proxy.erb": "3d0f7b88020d8a29bafc690e05ca69d6", + "templates/source.list.erb": "72648dd11918d5c03db82065d3bef73b" +} \ No newline at end of file diff --git a/environments/production/modules/apt/examples/backports.pp b/environments/production/modules/apt/examples/backports.pp new file mode 100644 index 0000000..5f1f1ee --- /dev/null +++ b/environments/production/modules/apt/examples/backports.pp @@ -0,0 +1,11 @@ +# Set up a backport for linuxmint qiana +class { 'apt': } +apt::backports { 'qiana': + location => 'http://us.archive.ubuntu.com/ubuntu', + release => 'trusty-backports', + repos => 'main universe multiverse restricted', + key => { + id => '630239CC130E1A7FD81A27B140976EAF437D05B5', + server => 'hkps.pool.sks-keyservers.net', + }, +} diff --git a/environments/production/modules/apt/examples/builddep.pp b/environments/production/modules/apt/examples/builddep.pp new file mode 100644 index 0000000..deaaef8 --- /dev/null +++ b/environments/production/modules/apt/examples/builddep.pp @@ -0,0 +1,3 @@ +package{ 'glusterfs-server': + install_options => 'build-dep', +} diff --git a/environments/production/modules/apt/examples/debian_testing.pp b/environments/production/modules/apt/examples/debian_testing.pp new file mode 100644 index 0000000..3ed98f2 --- /dev/null +++ b/environments/production/modules/apt/examples/debian_testing.pp @@ -0,0 +1,18 @@ +package { 'debian-keyring': + ensure => present +} + +package { 'debian-archive-keyring': + ensure => present +} + +apt::source { 'debian_testing': + location => 'http://debian.mirror.iweb.ca/debian/', + release => 'testing', + repos => 'main contrib non-free', + pin => '-10', + key => { + id => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + server => 'subkeys.pgp.net', + }, +} diff --git a/environments/production/modules/apt/examples/debian_unstable.pp b/environments/production/modules/apt/examples/debian_unstable.pp new file mode 100644 index 0000000..b1492cd --- /dev/null +++ b/environments/production/modules/apt/examples/debian_unstable.pp @@ -0,0 +1,18 @@ +package { 'debian-keyring': + ensure => present +} + +package { 'debian-archive-keyring': + ensure => present +} + +apt::source { 'debian_unstable': + location => 'http://debian.mirror.iweb.ca/debian/', + release => 'unstable', + repos => 'main contrib non-free', + pin => '-10', + key => { + id => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + server => 'subkeys.pgp.net', + }, +} diff --git a/environments/production/modules/apt/examples/disable_keys.pp b/environments/production/modules/apt/examples/disable_keys.pp new file mode 100644 index 0000000..50d0ea8 --- /dev/null +++ b/environments/production/modules/apt/examples/disable_keys.pp @@ -0,0 +1,5 @@ +#Note: This is generally a bad idea. You should not disable verifying repository signatures. +apt::conf { 'unauth': + priority => 99, + content => 'APT::Get::AllowUnauthenticated 1;' +} diff --git a/environments/production/modules/apt/examples/fancy_progress.pp b/environments/production/modules/apt/examples/fancy_progress.pp new file mode 100644 index 0000000..db78441 --- /dev/null +++ b/environments/production/modules/apt/examples/fancy_progress.pp @@ -0,0 +1,4 @@ +apt::conf { 'progressbar': + priority => 99, + content => 'Dpkg::Progress-Fancy "1";', +} diff --git a/environments/production/modules/apt/examples/force.pp b/environments/production/modules/apt/examples/force.pp new file mode 100644 index 0000000..4cfaa96 --- /dev/null +++ b/environments/production/modules/apt/examples/force.pp @@ -0,0 +1,28 @@ +#if you need to specify a release +$rel_string = '-t ' +#else +$rel_string = '' + +#if you need to specify a version +$ensure = '' +#else +$ensure = installed + +#if overwrite existing cfg files +$config_files = '-o Dpkg::Options::="--force-confnew"' +#elsif force use of old files +$config_files = '-o Dpkg::Options::="--force-confold"' +#elsif update only unchanged files +$config_files = '-o Dpkg::Options::="--force-confdef"' +#else +$config_files = '' + +#if install missing configuration files for the package +$config_missing = '-o Dpkg::Options::="--force-confmiss"' +#else +$config_missing = '' + +package { '': + ensure => $ensure, + install_options => "${config_files} ${config_missing} ${rel_string}", +} diff --git a/environments/production/modules/apt/examples/hold.pp b/environments/production/modules/apt/examples/hold.pp new file mode 100644 index 0000000..00f760c --- /dev/null +++ b/environments/production/modules/apt/examples/hold.pp @@ -0,0 +1,5 @@ +apt::pin { 'hold-vim': + packages => 'vim', + version => '2:7.4.488-5', + priority => 1001, +} diff --git a/environments/production/modules/apt/examples/key.pp b/environments/production/modules/apt/examples/key.pp new file mode 100644 index 0000000..dc2401b --- /dev/null +++ b/environments/production/modules/apt/examples/key.pp @@ -0,0 +1,6 @@ +# Declare Apt key for apt.puppetlabs.com source +apt::key { 'puppetlabs': + id => '6F6B15509CF8E59E6E469F327F438280EF8D349F', + server => 'hkps.pool.sks-keyservers.net', + options => 'http-proxy="http://proxyuser:proxypass@example.org:3128"', +} diff --git a/environments/production/modules/apt/examples/pin.pp b/environments/production/modules/apt/examples/pin.pp new file mode 100644 index 0000000..6a9024c --- /dev/null +++ b/environments/production/modules/apt/examples/pin.pp @@ -0,0 +1,5 @@ +# pin a release in apt, useful for unstable repositories +apt::pin { 'foo': + packages => '*', + priority => 0, +} diff --git a/environments/production/modules/apt/examples/ppa.pp b/environments/production/modules/apt/examples/ppa.pp new file mode 100644 index 0000000..e728f6f --- /dev/null +++ b/environments/production/modules/apt/examples/ppa.pp @@ -0,0 +1,4 @@ +class { 'apt': } + +# Example declaration of an Apt PPA +apt::ppa{ 'ppa:openstack-ppa/bleeding-edge': } diff --git a/environments/production/modules/apt/examples/release.pp b/environments/production/modules/apt/examples/release.pp new file mode 100644 index 0000000..46d6893 --- /dev/null +++ b/environments/production/modules/apt/examples/release.pp @@ -0,0 +1,4 @@ +apt::conf { 'release': + content => 'APT::Default-Release "karmic";', + priority => '01', +} diff --git a/environments/production/modules/apt/examples/source.pp b/environments/production/modules/apt/examples/source.pp new file mode 100644 index 0000000..a3648c3 --- /dev/null +++ b/environments/production/modules/apt/examples/source.pp @@ -0,0 +1,35 @@ +# Declare the apt class to manage /etc/apt/sources.list and /etc/sources.list.d +class { 'apt': } + +# Install the puppetlabs apt source +# Release is automatically obtained from lsbdistcodename fact if available. +apt::source { 'puppetlabs': + location => 'http://apt.puppetlabs.com', + repos => 'main', + key => { + id => '6F6B15509CF8E59E6E469F327F438280EF8D349F', + server => 'hkps.pool.sks-keyservers.net', + }, +} + +# test two sources with the same key +apt::source { 'debian_testing': + location => 'http://debian.mirror.iweb.ca/debian/', + release => 'testing', + repos => 'main contrib non-free', + key => { + id => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + server => 'hkps.pool.sks-keyservers.net', + }, + pin => '-10', +} +apt::source { 'debian_unstable': + location => 'http://debian.mirror.iweb.ca/debian/', + release => 'unstable', + repos => 'main contrib non-free', + key => { + id => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + server => 'hkps.pool.sks-keyservers.net', + }, + pin => '-10', +} diff --git a/environments/production/modules/apt/examples/unattended_upgrades.pp b/environments/production/modules/apt/examples/unattended_upgrades.pp new file mode 100644 index 0000000..4640904 --- /dev/null +++ b/environments/production/modules/apt/examples/unattended_upgrades.pp @@ -0,0 +1 @@ +# TODO diff --git a/environments/production/modules/apt/lib/facter/apt_reboot_required.rb b/environments/production/modules/apt/lib/facter/apt_reboot_required.rb new file mode 100644 index 0000000..8de904a --- /dev/null +++ b/environments/production/modules/apt/lib/facter/apt_reboot_required.rb @@ -0,0 +1,7 @@ +# apt_reboot_required.rb +Facter.add(:apt_reboot_required) do + confine :osfamily => 'Debian' + setcode do + File.file?('/var/run/reboot-required') + end +end diff --git a/environments/production/modules/apt/lib/facter/apt_update_last_success.rb b/environments/production/modules/apt/lib/facter/apt_update_last_success.rb new file mode 100644 index 0000000..21c33d5 --- /dev/null +++ b/environments/production/modules/apt/lib/facter/apt_update_last_success.rb @@ -0,0 +1,18 @@ +require 'facter' + +#This is derived from the file /var/lib/apt/periodic/update-success-stamp +# This is generated upon a successful apt-get update run natively in ubuntu. +# the Puppetlabs-apt module deploys this same functionality for other debian-ish OSes +Facter.add('apt_update_last_success') do + confine :osfamily => 'Debian' + setcode do + if File.exists?('/var/lib/apt/periodic/update-success-stamp') + #get epoch time + lastsuccess = File.mtime('/var/lib/apt/periodic/update-success-stamp').to_i + lastsuccess + else + lastsuccess = -1 + lastsuccess + end + end +end diff --git a/environments/production/modules/apt/lib/facter/apt_updates.rb b/environments/production/modules/apt/lib/facter/apt_updates.rb new file mode 100644 index 0000000..e880fdf --- /dev/null +++ b/environments/production/modules/apt/lib/facter/apt_updates.rb @@ -0,0 +1,57 @@ +apt_package_updates = nil +Facter.add("apt_has_updates") do + confine :osfamily => 'Debian' + if File.executable?("/usr/bin/apt-get") + apt_get_result = Facter::Util::Resolution.exec('/usr/bin/apt-get -s upgrade 2>&1') + if not apt_get_result.nil? + apt_package_updates = [[], []] + apt_get_result.each_line do |line| + if line =~ /^Inst\s/ + package = line.gsub(/^Inst\s([^\s]+)\s.*/, '\1').strip + apt_package_updates[0].push(package) + security_matches = [ + / Debian[^\s]+-updates /, + / Debian-Security:/, + / Ubuntu[^\s]+-security /, + / gNewSense[^\s]+-security / + ] + re = Regexp.union(security_matches) + if line.match(re) + apt_package_updates[1].push(package) + end + end + end + end + end + + setcode do + if not apt_package_updates.nil? and apt_package_updates.length == 2 + apt_package_updates != [[], []] + end + end +end + +Facter.add("apt_package_updates") do + confine :apt_has_updates => true + setcode do + if Facter.version < '2.0.0' + apt_package_updates[0].join(',') + else + apt_package_updates[0] + end + end +end + +Facter.add("apt_updates") do + confine :apt_has_updates => true + setcode do + Integer(apt_package_updates[0].length) + end +end + +Facter.add("apt_security_updates") do + confine :apt_has_updates => true + setcode do + Integer(apt_package_updates[1].length) + end +end diff --git a/environments/production/modules/apt/lib/puppet/provider/apt_key/apt_key.rb b/environments/production/modules/apt/lib/puppet/provider/apt_key/apt_key.rb new file mode 100644 index 0000000..d7e85da --- /dev/null +++ b/environments/production/modules/apt/lib/puppet/provider/apt_key/apt_key.rb @@ -0,0 +1,227 @@ +require 'open-uri' +require 'net/ftp' +require 'tempfile' + +if RUBY_VERSION == '1.8.7' + # Mothers cry, puppies die and Ruby 1.8.7's open-uri needs to be + # monkeypatched to support passing in :ftp_passive_mode. + require File.expand_path(File.join(File.dirname(__FILE__), '..', '..', '..', + 'puppet_x', 'apt_key', 'patch_openuri.rb')) + OpenURI::Options.merge!({:ftp_active_mode => false,}) +end + +Puppet::Type.type(:apt_key).provide(:apt_key) do + + confine :osfamily => :debian + defaultfor :osfamily => :debian + commands :apt_key => 'apt-key' + commands :gpg => '/usr/bin/gpg' + + def self.instances + cli_args = ['adv','--list-keys', '--with-colons', '--fingerprint', '--fixed-list-mode'] + + if RUBY_VERSION > '1.8.7' + key_output = apt_key(cli_args).encode('UTF-8', 'binary', :invalid => :replace, :undef => :replace, :replace => '') + else + key_output = apt_key(cli_args) + end + + pub_line, fpr_line = nil + + key_array = key_output.split("\n").collect do |line| + if line.start_with?('pub') + pub_line = line + elsif line.start_with?('fpr') + fpr_line = line + end + + next unless (pub_line and fpr_line) + + line_hash = key_line_hash(pub_line, fpr_line) + + # reset everything + pub_line, fpr_line = nil + + expired = false + + if line_hash[:key_expiry] + expired = Time.now >= line_hash[:key_expiry] + end + + new( + :name => line_hash[:key_fingerprint], + :id => line_hash[:key_long], + :fingerprint => line_hash[:key_fingerprint], + :short => line_hash[:key_short], + :long => line_hash[:key_long], + :ensure => :present, + :expired => expired, + :expiry => line_hash[:key_expiry].nil? ? nil : line_hash[:key_expiry].strftime("%Y-%m-%d"), + :size => line_hash[:key_size], + :type => line_hash[:key_type], + :created => line_hash[:key_created].strftime("%Y-%m-%d") + ) + end + key_array.compact! + end + + def self.prefetch(resources) + apt_keys = instances + resources.keys.each do |name| + if name.length == 40 + if provider = apt_keys.find{ |key| key.fingerprint == name } + resources[name].provider = provider + end + elsif name.length == 16 + if provider = apt_keys.find{ |key| key.long == name } + resources[name].provider = provider + end + elsif name.length == 8 + if provider = apt_keys.find{ |key| key.short == name } + resources[name].provider = provider + end + end + end + end + + def self.key_line_hash(pub_line, fpr_line) + pub_split = pub_line.split(':') + fpr_split = fpr_line.split(':') + + fingerprint = fpr_split.last + return_hash = { + :key_fingerprint => fingerprint, + :key_long => fingerprint[-16..-1], # last 16 characters of fingerprint + :key_short => fingerprint[-8..-1], # last 8 characters of fingerprint + :key_size => pub_split[2], + :key_type => nil, + :key_created => Time.at(pub_split[5].to_i), + :key_expiry => pub_split[6].empty? ? nil : Time.at(pub_split[6].to_i), + } + + # set key type based on types defined in /usr/share/doc/gnupg/DETAILS.gz + case pub_split[3] + when "1" + return_hash[:key_type] = :rsa + when "17" + return_hash[:key_type] = :dsa + when "18" + return_hash[:key_type] = :ecc + when "19" + return_hash[:key_type] = :ecdsa + end + + return return_hash + end + + def source_to_file(value) + parsedValue = URI::parse(value) + if parsedValue.scheme.nil? + fail("The file #{value} does not exist") unless File.exists?(value) + # Because the tempfile method has to return a live object to prevent GC + # of the underlying file from occuring too early, we also have to return + # a file object here. The caller can still call the #path method on the + # closed file handle to get the path. + f = File.open(value, 'r') + f.close + f + else + begin + user_pass = parsedValue.userinfo.nil? ? nil : parsedValue.userinfo.split(':') + parsedValue.userinfo = '' + key = open(parsedValue, :http_basic_authentication => user_pass).read + rescue OpenURI::HTTPError, Net::FTPPermError => e + fail("#{e.message} for #{resource[:source]}") + rescue SocketError + fail("could not resolve #{resource[:source]}") + else + tempfile(key) + end + end + end + + # The tempfile method needs to return the tempfile object to the caller, so + # that it doesn't get deleted by the GC immediately after it returns. We + # want the caller to control when it goes out of scope. + def tempfile(content) + file = Tempfile.new('apt_key') + file.write content + file.close + #confirm that the fingerprint from the file, matches the long key that is in the manifest + if name.size == 40 + if File.executable? command(:gpg) + extracted_key = execute(["#{command(:gpg)} --with-fingerprint --with-colons #{file.path} | awk -F: '/^fpr:/ { print $10 }'"], :failonfail => false) + extracted_key = extracted_key.chomp + + found_match = false + extracted_key.each_line do |line| + if line.chomp == name + found_match = true + end + end + if not found_match + fail("The id in your manifest #{resource[:name]} and the fingerprint from content/source do not match. Please check there is not an error in the id or check the content/source is legitimate.") + end + else + warning('/usr/bin/gpg cannot be found for verification of the id.') + end + end + file + end + + def exists? + @property_hash[:ensure] == :present + end + + def create + command = [] + if resource[:source].nil? and resource[:content].nil? + # Breaking up the command like this is needed because it blows up + # if --recv-keys isn't the last argument. + command.push('adv', '--keyserver', resource[:server]) + unless resource[:options].nil? + command.push('--keyserver-options', resource[:options]) + end + command.push('--recv-keys', resource[:id]) + elsif resource[:content] + key_file = tempfile(resource[:content]) + command.push('add', key_file.path) + elsif resource[:source] + key_file = source_to_file(resource[:source]) + command.push('add', key_file.path) + # In case we really screwed up, better safe than sorry. + else + fail("an unexpected condition occurred while trying to add the key: #{resource[:id]}") + end + apt_key(command) + @property_hash[:ensure] = :present + end + + def destroy + begin + apt_key('del', resource.provider.short) + r = execute(["#{command(:apt_key)} list | grep '/#{resource.provider.short}\s'"], :failonfail => false) + end while r.exitstatus == 0 + @property_hash.clear + end + + def read_only(value) + fail('This is a read-only property.') + end + + mk_resource_methods + + # Needed until PUP-1470 is fixed and we can drop support for Puppet versions + # before that. + def expired + @property_hash[:expired] + end + + # Alias the setters of read-only properties + # to the read_only function. + alias :created= :read_only + alias :expired= :read_only + alias :expiry= :read_only + alias :size= :read_only + alias :type= :read_only +end diff --git a/environments/production/modules/apt/lib/puppet/type/apt_key.rb b/environments/production/modules/apt/lib/puppet/type/apt_key.rb new file mode 100644 index 0000000..72f3c87 --- /dev/null +++ b/environments/production/modules/apt/lib/puppet/type/apt_key.rb @@ -0,0 +1,135 @@ +require 'pathname' + +Puppet::Type.newtype(:apt_key) do + + @doc = <<-EOS + This type provides Puppet with the capabilities to manage GPG keys needed + by apt to perform package validation. Apt has it's own GPG keyring that can + be manipulated through the `apt-key` command. + + apt_key { '6F6B15509CF8E59E6E469F327F438280EF8D349F': + source => 'http://apt.puppetlabs.com/pubkey.gpg' + } + + **Autorequires**: + + If Puppet is given the location of a key file which looks like an absolute + path this type will autorequire that file. + EOS + + ensurable + + validate do + if self[:content] and self[:source] + fail('The properties content and source are mutually exclusive.') + end + if self[:id].length < 40 + warning('The id should be a full fingerprint (40 characters), see README.') + end + end + + newparam(:id, :namevar => true) do + desc 'The ID of the key you want to manage.' + # GPG key ID's should be either 32-bit (short) or 64-bit (long) key ID's + # and may start with the optional 0x, or they can be 40-digit key fingerprints + newvalues(/\A(0x)?[0-9a-fA-F]{8}\Z/, /\A(0x)?[0-9a-fA-F]{16}\Z/, /\A(0x)?[0-9a-fA-F]{40}\Z/) + munge do |value| + if value.start_with?('0x') + id = value.partition('0x').last.upcase + else + id = value.upcase + end + id + end + end + + newparam(:content) do + desc 'The content of, or string representing, a GPG key.' + end + + newparam(:source) do + desc 'Location of a GPG key file, /path/to/file, ftp://, http:// or https://' + newvalues(/\Ahttps?:\/\//, /\Aftp:\/\//, /\A\/\w+/) + end + + autorequire(:file) do + if self[:source] and Pathname.new(self[:source]).absolute? + self[:source] + end + end + + newparam(:server) do + desc 'The key server to fetch the key from based on the ID. It can either be a domain name or url.' + defaultto :'keyserver.ubuntu.com' + + newvalues(/\A((hkp|http|https):\/\/)?([a-z\d])([a-z\d-]{0,61}\.)+[a-z\d]+(:\d{2,5})?$/) + end + + newparam(:options) do + desc 'Additional options to pass to apt-key\'s --keyserver-options.' + end + + newproperty(:fingerprint) do + desc <<-EOS + The 40-digit hexadecimal fingerprint of the specified GPG key. + + This property is read-only. + EOS + end + + newproperty(:long) do + desc <<-EOS + The 16-digit hexadecimal id of the specified GPG key. + + This property is read-only. + EOS + end + + newproperty(:short) do + desc <<-EOS + The 8-digit hexadecimal id of the specified GPG key. + + This property is read-only. + EOS + end + + newproperty(:expired) do + desc <<-EOS + Indicates if the key has expired. + + This property is read-only. + EOS + end + + newproperty(:expiry) do + desc <<-EOS + The date the key will expire, or nil if it has no expiry date. + + This property is read-only. + EOS + end + + newproperty(:size) do + desc <<-EOS + The key size, usually a multiple of 1024. + + This property is read-only. + EOS + end + + newproperty(:type) do + desc <<-EOS + The key type, one of: rsa, dsa, ecc, ecdsa + + This property is read-only. + EOS + end + + newproperty(:created) do + desc <<-EOS + Date the key was created. + + This property is read-only. + EOS + end +end diff --git a/environments/production/modules/apt/lib/puppet_x/apt_key/patch_openuri.rb b/environments/production/modules/apt/lib/puppet_x/apt_key/patch_openuri.rb new file mode 100644 index 0000000..722c7bd --- /dev/null +++ b/environments/production/modules/apt/lib/puppet_x/apt_key/patch_openuri.rb @@ -0,0 +1,63 @@ +require 'uri' +require 'stringio' +require 'time' + +module URI + class FTP + def buffer_open(buf, proxy, options) # :nodoc: + if proxy + OpenURI.open_http(buf, self, proxy, options) + return + end + require 'net/ftp' + + directories = self.path.split(%r{/}, -1) + directories.shift if directories[0] == '' # strip a field before leading slash + directories.each {|d| + d.gsub!(/%([0-9A-Fa-f][0-9A-Fa-f])/) { [$1].pack("H2") } + } + unless filename = directories.pop + raise ArgumentError, "no filename: #{self.inspect}" + end + directories.each {|d| + if /[\r\n]/ =~ d + raise ArgumentError, "invalid directory: #{d.inspect}" + end + } + if /[\r\n]/ =~ filename + raise ArgumentError, "invalid filename: #{filename.inspect}" + end + typecode = self.typecode + if typecode && /\A[aid]\z/ !~ typecode + raise ArgumentError, "invalid typecode: #{typecode.inspect}" + end + + # The access sequence is defined by RFC 1738 + ftp = Net::FTP.open(self.host) + ftp.passive = true if !options[:ftp_active_mode] + # todo: extract user/passwd from .netrc. + user = 'anonymous' + passwd = nil + user, passwd = self.userinfo.split(/:/) if self.userinfo + ftp.login(user, passwd) + directories.each {|cwd| + ftp.voidcmd("CWD #{cwd}") + } + if typecode + # xxx: typecode D is not handled. + ftp.voidcmd("TYPE #{typecode.upcase}") + end + if options[:content_length_proc] + options[:content_length_proc].call(ftp.size(filename)) + end + ftp.retrbinary("RETR #{filename}", 4096) { |str| + buf << str + options[:progress_proc].call(buf.size) if options[:progress_proc] + } + ftp.close + buf.io.rewind + end + + include OpenURI::OpenRead + end +end diff --git a/environments/production/modules/apt/locales/config.yaml b/environments/production/modules/apt/locales/config.yaml new file mode 100644 index 0000000..07c0b9b --- /dev/null +++ b/environments/production/modules/apt/locales/config.yaml @@ -0,0 +1,25 @@ +--- +# This is the project-specific configuration file for setting up +# fast_gettext for your project. +gettext: + # This is used for the name of the .pot and .po files; they will be + # called .pot? + project_name: puppetlabs-apt + # This is used in comments in the .pot and .po files to indicate what + # project the files belong to and should bea little more desctiptive than + # + package_name: puppetlabs-apt + # The locale that the default messages in the .pot file are in + default_locale: en + # The email used for sending bug reports. + bugs_address: docs@puppet.com + # The holder of the copyright. + copyright_holder: Puppet, Inc. + # This determines which comments in code should be eligible for translation. + # Any comments that start with this string will be externalized. (Leave + # empty to include all.) + comments_tag: TRANSLATOR + # Patterns for +Dir.glob+ used to find all files that might contain + # translatable content, relative to the project root directory + source_files: + diff --git a/environments/production/modules/apt/manifests/backports.pp b/environments/production/modules/apt/manifests/backports.pp new file mode 100644 index 0000000..f7e85f5 --- /dev/null +++ b/environments/production/modules/apt/manifests/backports.pp @@ -0,0 +1,65 @@ +class apt::backports ( + $location = undef, + $release = undef, + $repos = undef, + $key = undef, + $pin = 200, +){ + if $location { + validate_string($location) + $_location = $location + } + if $release { + validate_string($release) + $_release = $release + } + if $repos { + validate_string($repos) + $_repos = $repos + } + if $key { + unless is_hash($key) { + validate_string($key) + } + $_key = $key + } + if ($::apt::xfacts['lsbdistid'] == 'debian' or $::apt::xfacts['lsbdistid'] == 'ubuntu') { + unless $location { + $_location = $::apt::backports['location'] + } + unless $release { + $_release = "${::apt::xfacts['lsbdistcodename']}-backports" + } + unless $repos { + $_repos = $::apt::backports['repos'] + } + unless $key { + $_key = $::apt::backports['key'] + } + } else { + unless $location and $release and $repos and $key { + fail('If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key') + } + } + + if is_hash($pin) { + $_pin = $pin + } elsif is_numeric($pin) or is_string($pin) { + # apt::source defaults to pinning to origin, but we should pin to release + # for backports + $_pin = { + 'priority' => $pin, + 'release' => $_release, + } + } else { + fail('pin must be either a string, number or hash') + } + + apt::source { 'backports': + location => $_location, + release => $_release, + repos => $_repos, + key => $_key, + pin => $_pin, + } +} diff --git a/environments/production/modules/apt/manifests/conf.pp b/environments/production/modules/apt/manifests/conf.pp new file mode 100644 index 0000000..8cd9c64 --- /dev/null +++ b/environments/production/modules/apt/manifests/conf.pp @@ -0,0 +1,20 @@ +define apt::conf ( + $content = undef, + $ensure = present, + $priority = 50, + $notify_update = undef, +) { + + unless $ensure == 'absent' { + unless $content { + fail('Need to pass in content parameter') + } + } + + apt::setting { "conf-${name}": + ensure => $ensure, + priority => $priority, + content => template('apt/_conf_header.erb', 'apt/conf.erb'), + notify_update => $notify_update, + } +} diff --git a/environments/production/modules/apt/manifests/init.pp b/environments/production/modules/apt/manifests/init.pp new file mode 100644 index 0000000..5664ede --- /dev/null +++ b/environments/production/modules/apt/manifests/init.pp @@ -0,0 +1,171 @@ +# == Class: apt +# +# Manage APT (Advanced Packaging Tool) +# +class apt ( + $confs = {}, + $update = {}, + $purge = {}, + $proxy = {}, + $sources = {}, + $keys = {}, + $ppas = {}, + $pins = {}, + $settings = {}, +) inherits ::apt::params { + + $frequency_options = ['always','daily','weekly','reluctantly'] + validate_hash($update) + if $update['frequency'] { + validate_re($update['frequency'], $frequency_options) + } + if $update['timeout'] { + unless is_integer($update['timeout']) { + fail('timeout value for update must be an integer') + } + } + if $update['tries'] { + unless is_integer($update['tries']) { + fail('tries value for update must be an integer') + } + } + + $_update = merge($::apt::update_defaults, $update) + include ::apt::update + + validate_hash($purge) + if $purge['sources.list'] { + validate_bool($purge['sources.list']) + } + if $purge['sources.list.d'] { + validate_bool($purge['sources.list.d']) + } + if $purge['preferences'] { + validate_bool($purge['preferences']) + } + if $purge['preferences.d'] { + validate_bool($purge['preferences.d']) + } + + $_purge = merge($::apt::purge_defaults, $purge) + + validate_hash($proxy) + if $proxy['ensure'] { + validate_re($proxy['ensure'], ['file', 'present', 'absent']) + } + if $proxy['host'] { + validate_string($proxy['host']) + } + if $proxy['port'] { + unless is_integer($proxy['port']) { + fail('$proxy port must be an integer') + } + } + if $proxy['https'] { + validate_bool($proxy['https']) + } + + $_proxy = merge($apt::proxy_defaults, $proxy) + + validate_hash($confs) + validate_hash($sources) + validate_hash($keys) + validate_hash($settings) + validate_hash($ppas) + validate_hash($pins) + + if $_proxy['ensure'] == 'absent' or $_proxy['host'] { + apt::setting { 'conf-proxy': + ensure => $_proxy['ensure'], + priority => '01', + content => template('apt/_conf_header.erb', 'apt/proxy.erb'), + } + } + + $sources_list_content = $_purge['sources.list'] ? { + true => "# Repos managed by puppet.\n", + default => undef, + } + + $preferences_ensure = $_purge['preferences'] ? { + true => absent, + default => file, + } + + if $_update['frequency'] == 'always' { + Exec <| title=='apt_update' |> { + refreshonly => false, + } + } + + apt::setting { 'conf-update-stamp': + priority => 15, + content => template('apt/_conf_header.erb', 'apt/15update-stamp.erb'), + } + + file { 'sources.list': + ensure => file, + path => $::apt::sources_list, + owner => root, + group => root, + mode => '0644', + content => $sources_list_content, + notify => Class['apt::update'], + } + + file { 'sources.list.d': + ensure => directory, + path => $::apt::sources_list_d, + owner => root, + group => root, + mode => '0644', + purge => $_purge['sources.list.d'], + recurse => $_purge['sources.list.d'], + notify => Class['apt::update'], + } + + file { 'preferences': + ensure => $preferences_ensure, + path => $::apt::preferences, + owner => root, + group => root, + mode => '0644', + notify => Class['apt::update'], + } + + file { 'preferences.d': + ensure => directory, + path => $::apt::preferences_d, + owner => root, + group => root, + mode => '0644', + purge => $_purge['preferences.d'], + recurse => $_purge['preferences.d'], + notify => Class['apt::update'], + } + + if $confs { + create_resources('apt::conf', $confs) + } + # manage sources if present + if $sources { + create_resources('apt::source', $sources) + } + # manage keys if present + if $keys { + create_resources('apt::key', $keys) + } + # manage ppas if present + if $ppas { + create_resources('apt::ppa', $ppas) + } + # manage settings if present + if $settings { + create_resources('apt::setting', $settings) + } + + # manage pins if present + if $pins { + create_resources('apt::pin', $pins) + } +} diff --git a/environments/production/modules/apt/manifests/key.pp b/environments/production/modules/apt/manifests/key.pp new file mode 100644 index 0000000..d4a1d80 --- /dev/null +++ b/environments/production/modules/apt/manifests/key.pp @@ -0,0 +1,111 @@ +# == Define: apt::key +define apt::key ( + $id = $title, + $ensure = present, + $content = undef, + $source = undef, + $server = $::apt::keyserver, + $options = undef, + $key = undef, + $key_content = undef, + $key_source = undef, + $key_server = undef, + $key_options = undef, +) { + + if $key != undef { + deprecation('apt $key', '$key is deprecated and will be removed in the next major release. Please use $id instead.') + $_id = $key + } else { + $_id = $id + } + + if $key_content != undef { + deprecation('apt $key_content', '$key_content is deprecated and will be removed in the next major release. Please use $content instead.') + $_content = $key_content + } else { + $_content = $content + } + + if $key_source != undef { + deprecation('apt $key_source', '$key_source is deprecated and will be removed in the next major release. Please use $source instead.') + $_source = $key_source + } else { + $_source = $source + } + + if $key_server != undef { + deprecation('apt $key_server', '$key_server is deprecated and will be removed in the next major release. Please use $server instead.') + $_server = $key_server + } else { + $_server = $server + } + + if $key_options != undef { + deprecation('apt $key_options', '$key_options is deprecated and will be removed in the next major release. Please use $options instead.') + $_options = $key_options + } else { + $_options = $options + } + + validate_re($_id, ['\A(0x)?[0-9a-fA-F]{8}\Z', '\A(0x)?[0-9a-fA-F]{16}\Z', '\A(0x)?[0-9a-fA-F]{40}\Z']) + validate_re($ensure, ['\A(absent|present)\Z',]) + + if $_content { + validate_string($_content) + } + + if $_source { + validate_re($_source, ['\Ahttps?:\/\/', '\Aftp:\/\/', '\A\/\w+']) + } + + if $_server { + validate_re($_server,['\A((hkp|http|https):\/\/)?([a-z\d])([a-z\d-]{0,61}\.)+[a-z\d]+(:\d{2,5})?$']) + } + + if $_options { + validate_string($_options) + } + + case $ensure { + present: { + if defined(Anchor["apt_key ${_id} absent"]){ + fail("key with id ${_id} already ensured as absent") + } + + if !defined(Anchor["apt_key ${_id} present"]) { + apt_key { $title: + ensure => $ensure, + id => $_id, + source => $_source, + content => $_content, + server => $_server, + options => $_options, + } + -> anchor { "apt_key ${_id} present": } + } + } + + absent: { + if defined(Anchor["apt_key ${_id} present"]){ + fail("key with id ${_id} already ensured as present") + } + + if !defined(Anchor["apt_key ${_id} absent"]){ + apt_key { $title: + ensure => $ensure, + id => $_id, + source => $_source, + content => $_content, + server => $_server, + options => $_options, + } + -> anchor { "apt_key ${_id} absent": } + } + } + + default: { + fail "Invalid 'ensure' value '${ensure}' for apt::key" + } + } +} diff --git a/environments/production/modules/apt/manifests/params.pp b/environments/production/modules/apt/manifests/params.pp new file mode 100644 index 0000000..ea1087e --- /dev/null +++ b/environments/production/modules/apt/manifests/params.pp @@ -0,0 +1,142 @@ +class apt::params { + + if $::osfamily != 'Debian' { + fail('This module only works on Debian or derivatives like Ubuntu') + } + + # prior to puppet 3.5.0, defined() couldn't test if a variable was defined. + # strict_variables wasn't added until 3.5.0, so this should be fine. + if $::puppetversion and versioncmp($::puppetversion, '3.5.0') < 0 { + $xfacts = { + 'lsbdistcodename' => $::lsbdistcodename, + 'lsbdistrelease' => $::lsbdistrelease, + 'lsbdistid' => $::lsbdistid, + } + } else { + # Strict variables facts lookup compatibility + $xfacts = { + 'lsbdistcodename' => defined('$lsbdistcodename') ? { + true => $::lsbdistcodename, + default => undef, + }, + 'lsbdistrelease' => defined('$lsbdistrelease') ? { + true => $::lsbdistrelease, + default => undef, + }, + 'lsbdistid' => defined('$lsbdistid') ? { + true => $::lsbdistid, + default => undef, + }, + } + } + + $root = '/etc/apt' + $provider = '/usr/bin/apt-get' + $sources_list = "${root}/sources.list" + $sources_list_d = "${root}/sources.list.d" + $conf_d = "${root}/apt.conf.d" + $preferences = "${root}/preferences" + $preferences_d = "${root}/preferences.d" + $keyserver = 'keyserver.ubuntu.com' + + $config_files = { + 'conf' => { + 'path' => $conf_d, + 'ext' => '', + }, + 'pref' => { + 'path' => $preferences_d, + 'ext' => '.pref', + }, + 'list' => { + 'path' => $sources_list_d, + 'ext' => '.list', + } + } + + $update_defaults = { + 'frequency' => 'reluctantly', + 'timeout' => undef, + 'tries' => undef, + } + + $proxy_defaults = { + 'ensure' => undef, + 'host' => undef, + 'port' => 8080, + 'https' => false, + } + + $purge_defaults = { + 'sources.list' => false, + 'sources.list.d' => false, + 'preferences' => false, + 'preferences.d' => false, + } + + $source_key_defaults = { + 'server' => $keyserver, + 'options' => undef, + 'content' => undef, + 'source' => undef, + } + + $include_defaults = { + 'deb' => true, + 'src' => false, + } + + case $xfacts['lsbdistid'] { + 'debian': { + case $xfacts['lsbdistcodename'] { + 'squeeze': { + $backports = { + 'location' => 'http://httpredir.debian.org/debian-backports', + 'key' => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + 'repos' => 'main contrib non-free', + } + } + default: { + $backports = { + 'location' => 'http://httpredir.debian.org/debian', + 'key' => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + 'repos' => 'main contrib non-free', + } + } + } + + $ppa_options = undef + $ppa_package = undef + + } + 'ubuntu': { + $backports = { + 'location' => 'http://archive.ubuntu.com/ubuntu', + 'key' => '630239CC130E1A7FD81A27B140976EAF437D05B5', + 'repos' => 'main universe multiverse restricted', + } + + if $xfacts['lsbdistcodename'] == 'lucid' { + $ppa_options = undef + $ppa_package = 'python-software-properties' + } elsif $xfacts['lsbdistcodename'] == 'precise' { + $ppa_options = '-y' + $ppa_package = 'python-software-properties' + } elsif versioncmp($xfacts['lsbdistrelease'], '14.04') >= 0 { + $ppa_options = '-y' + $ppa_package = 'software-properties-common' + } else { + $ppa_options = '-y' + $ppa_package = 'python-software-properties' + } + } + undef: { + fail('Unable to determine lsbdistid, please install lsb-release first') + } + default: { + $ppa_options = undef + $ppa_package = undef + $backports = undef + } + } +} diff --git a/environments/production/modules/apt/manifests/pin.pp b/environments/production/modules/apt/manifests/pin.pp new file mode 100644 index 0000000..dff2c29 --- /dev/null +++ b/environments/production/modules/apt/manifests/pin.pp @@ -0,0 +1,80 @@ +# pin.pp +# pin a release in apt, useful for unstable repositories + +define apt::pin( + $ensure = present, + $explanation = undef, + $order = 50, + $packages = '*', + $priority = 0, + $release = '', # a= + $origin = '', + $version = '', + $codename = '', # n= + $release_version = '', # v= + $component = '', # c= + $originator = '', # o= + $label = '' # l= +) { + if $order and !is_integer($order) { + fail('Only integers are allowed in the apt::pin order param') + } + + if $explanation { + $_explanation = $explanation + } else { + if defined('$caller_module_name') { # strict vars check + $_explanation = "${caller_module_name}: ${name}" + } else { + $_explanation = ": ${name}" + } + } + + $pin_release_array = [ + $release, + $codename, + $release_version, + $component, + $originator, + $label] + $pin_release = join($pin_release_array, '') + + # Read the manpage 'apt_preferences(5)', especially the chapter + # 'The Effect of APT Preferences' to understand the following logic + # and the difference between specific and general form + if is_array($packages) { + $packages_string = join($packages, ' ') + } else { + $packages_string = $packages + } + + if $packages_string != '*' { # specific form + if ( $pin_release != '' and ( $origin != '' or $version != '' )) or + ( $version != '' and ( $pin_release != '' or $origin != '' )) { + fail('parameters release, origin, and version are mutually exclusive') + } + } else { # general form + if $version != '' { + fail('parameter version cannot be used in general form') + } + if ( $pin_release != '' and $origin != '' ) { + fail('parameters release and origin are mutually exclusive') + } + } + + # According to man 5 apt_preferences: + # The files have either no or "pref" as filename extension + # and only contain alphanumeric, hyphen (-), underscore (_) and period + # (.) characters. Otherwise APT will print a notice that it has ignored a + # file, unless that file matches a pattern in the + # Dir::Ignore-Files-Silently configuration list - in which case it will + # be silently ignored. + $file_name = regsubst($title, '[^0-9a-z\-_\.]', '_', 'IG') + + apt::setting { "pref-${file_name}": + ensure => $ensure, + priority => $order, + content => template('apt/_header.erb', 'apt/pin.pref.erb'), + notify_update => false, + } +} diff --git a/environments/production/modules/apt/manifests/ppa.pp b/environments/production/modules/apt/manifests/ppa.pp new file mode 100644 index 0000000..6b025d7 --- /dev/null +++ b/environments/production/modules/apt/manifests/ppa.pp @@ -0,0 +1,69 @@ +# ppa.pp +define apt::ppa( + $ensure = 'present', + $options = $::apt::ppa_options, + $release = $::apt::xfacts['lsbdistcodename'], + $package_name = $::apt::ppa_package, + $package_manage = false, +) { + unless $release { + fail('lsbdistcodename fact not available: release parameter required') + } + + if $::apt::xfacts['lsbdistid'] == 'Debian' { + fail('apt::ppa is not currently supported on Debian.') + } + + if versioncmp($::apt::xfacts['lsbdistrelease'], '15.10') >= 0 { + $distid = downcase($::apt::xfacts['lsbdistid']) + $filename = regsubst($name, '^ppa:([^/]+)/(.+)$', "\\1-${distid}-\\2-${release}") + } else { + $filename = regsubst($name, '^ppa:([^/]+)/(.+)$', "\\1-\\2-${release}") + } + + $filename_no_slashes = regsubst($filename, '/', '-', 'G') + $filename_no_specialchars = regsubst($filename_no_slashes, '[\.\+]', '_', 'G') + $sources_list_d_filename = "${filename_no_specialchars}.list" + + if $ensure == 'present' { + if $package_manage { + ensure_packages($package_name) + + $_require = [File['sources.list.d'], Package[$package_name]] + } else { + $_require = File['sources.list.d'] + } + + $_proxy = $::apt::_proxy + if $_proxy['host'] { + if $_proxy['https'] { + $_proxy_env = ["http_proxy=http://${$_proxy['host']}:${$_proxy['port']}", "https_proxy=https://${$_proxy['host']}:${$_proxy['port']}"] + } else { + $_proxy_env = ["http_proxy=http://${$_proxy['host']}:${$_proxy['port']}"] + } + } else { + $_proxy_env = [] + } + + exec { "add-apt-repository-${name}": + environment => $_proxy_env, + command => "/usr/bin/add-apt-repository ${options} ${name}", + unless => "/usr/bin/test -f ${::apt::sources_list_d}/${sources_list_d_filename}", + user => 'root', + logoutput => 'on_failure', + notify => Class['apt::update'], + require => $_require, + } + + file { "${::apt::sources_list_d}/${sources_list_d_filename}": + ensure => file, + require => Exec["add-apt-repository-${name}"], + } + } + else { + file { "${::apt::sources_list_d}/${sources_list_d_filename}": + ensure => 'absent', + notify => Class['apt::update'], + } + } +} diff --git a/environments/production/modules/apt/manifests/setting.pp b/environments/production/modules/apt/manifests/setting.pp new file mode 100644 index 0000000..b0fb62b --- /dev/null +++ b/environments/production/modules/apt/manifests/setting.pp @@ -0,0 +1,64 @@ +define apt::setting ( + $priority = 50, + $ensure = file, + $source = undef, + $content = undef, + $notify_update = true, +) { + + include 'apt::params' + if $content and $source { + fail('apt::setting cannot have both content and source') + } + + if !$content and !$source { + fail('apt::setting needs either of content or source') + } + + validate_re($ensure, ['file', 'present', 'absent']) + validate_bool($notify_update) + + $title_array = split($title, '-') + $setting_type = $title_array[0] + $base_name = join(delete_at($title_array, 0), '-') + + validate_re($setting_type, ['\Aconf\z', '\Apref\z', '\Alist\z'], "apt::setting resource name/title must start with either 'conf-', 'pref-' or 'list-'") + + unless is_integer($priority) { + # need this to allow zero-padded priority. + validate_re($priority, '^\d+$', 'apt::setting priority must be an integer or a zero-padded integer') + } + + if $source { + validate_string($source) + } + + if $content { + validate_string($content) + } + + if ($setting_type == 'list') or ($setting_type == 'pref') { + $_priority = '' + } else { + $_priority = $priority + } + + $_path = $::apt::params::config_files[$setting_type]['path'] + $_ext = $::apt::params::config_files[$setting_type]['ext'] + + if $notify_update { + $_notify = Class['apt::update'] + } else { + $_notify = undef + } + + file { "${_path}/${_priority}${base_name}${_ext}": + ensure => $ensure, + owner => 'root', + group => 'root', + mode => '0644', + content => $content, + source => $source, + notify => $_notify, + } +} diff --git a/environments/production/modules/apt/manifests/source.pp b/environments/production/modules/apt/manifests/source.pp new file mode 100644 index 0000000..5b8e4b1 --- /dev/null +++ b/environments/production/modules/apt/manifests/source.pp @@ -0,0 +1,158 @@ +# source.pp +# add an apt source +define apt::source( + $location = undef, + $comment = $name, + $ensure = present, + $release = undef, + $repos = 'main', + $include = {}, + $key = undef, + $pin = undef, + $architecture = undef, + $allow_unsigned = false, + $include_src = undef, + $include_deb = undef, + $required_packages = undef, + $key_server = undef, + $key_content = undef, + $key_source = undef, + $trusted_source = undef, + $notify_update = true, +) { + validate_string($architecture, $comment, $location, $repos) + validate_bool($allow_unsigned) + validate_hash($include) + + # This is needed for compat with 1.8.x + include ::apt + + $_before = Apt::Setting["list-${title}"] + + if $include_src != undef { + deprecation('apt $include_src', "\$include_src is deprecated and will be removed in the next major release, please use \$include => { 'src' => ${include_src} } instead") + } + + if $include_deb != undef { + deprecation('apt $include_deb', "\$include_deb is deprecated and will be removed in the next major release, please use \$include => { 'deb' => ${include_deb} } instead") + } + + if $required_packages != undef { + deprecation('apt $required_packages', '$required_packages is deprecated and will be removed in the next major release, please use package resources instead.') + exec { "Required packages: '${required_packages}' for ${name}": + command => "${::apt::params::provider} -y install ${required_packages}", + logoutput => 'on_failure', + refreshonly => true, + tries => 3, + try_sleep => 1, + before => $_before, + } + } + + if $key_server != undef { + deprecation('apt $key_server', "\$key_server is deprecated and will be removed in the next major release, please use \$key => { 'server' => ${key_server} } instead.") + } + + if $key_content != undef { + deprecation('apt $key_content', "\$key_content is deprecated and will be removed in the next major release, please use \$key => { 'content' => ${key_content} } instead.") + } + + if $key_source != undef { + deprecation('apt $key_source', "\$key_source is deprecated and will be removed in the next major release, please use \$key => { 'source' => ${key_source} } instead.") + } + + if $trusted_source != undef { + deprecation('apt $trusted_source', '$trusted_source is deprecated and will be removed in the next major release, please use $allow_unsigned instead.') + $_allow_unsigned = $trusted_source + } else { + $_allow_unsigned = $allow_unsigned + } + + if ! $release { + $_release = $::apt::params::xfacts['lsbdistcodename'] + unless $_release { + fail('lsbdistcodename fact not available: release parameter required') + } + } else { + $_release = $release + } + + if $ensure == 'present' and ! $location { + fail('cannot create a source entry without specifying a location') + } + + if $include_src != undef and $include_deb != undef { + $_deprecated_include = { + 'src' => $include_src, + 'deb' => $include_deb, + } + } elsif $include_src != undef { + $_deprecated_include = { 'src' => $include_src } + } elsif $include_deb != undef { + $_deprecated_include = { 'deb' => $include_deb } + } else { + $_deprecated_include = {} + } + + $_include = merge($::apt::params::include_defaults, $_deprecated_include, $include) + + $_deprecated_key = { + 'key_server' => $key_server, + 'key_content' => $key_content, + 'key_source' => $key_source, + } + + if $key { + if is_hash($key) { + unless $key['id'] { + fail('key hash must contain at least an id entry') + } + $_key = merge($::apt::params::source_key_defaults, $_deprecated_key, $key) + } else { + validate_string($key) + $_key = merge( { 'id' => $key }, $_deprecated_key) + } + } + + apt::setting { "list-${name}": + ensure => $ensure, + content => template('apt/_header.erb', 'apt/source.list.erb'), + notify_update => $notify_update, + } + + if $pin { + if is_hash($pin) { + $_pin = merge($pin, { 'ensure' => $ensure, 'before' => $_before }) + } elsif (is_numeric($pin) or is_string($pin)) { + $url_split = split($location, '[:\/]+') + $host = $url_split[1] + $_pin = { + 'ensure' => $ensure, + 'priority' => $pin, + 'before' => $_before, + 'origin' => $host, + } + } else { + fail('Received invalid value for pin parameter') + } + create_resources('apt::pin', { "${name}" => $_pin }) + } + + # We do not want to remove keys when the source is absent. + if $key and ($ensure == 'present') { + if is_hash($_key) { + apt::key { "Add key: ${$_key['id']} from Apt::Source ${title}": + ensure => present, + id => $_key['id'], + server => $_key['server'], + content => $_key['content'], + source => $_key['source'], + options => $_key['options'], + key_server => $_key['key_server'], + key_content => $_key['key_content'], + key_source => $_key['key_source'], + before => $_before, + } + } + } +} diff --git a/environments/production/modules/apt/manifests/update.pp b/environments/production/modules/apt/manifests/update.pp new file mode 100644 index 0000000..4a8a7c8 --- /dev/null +++ b/environments/production/modules/apt/manifests/update.pp @@ -0,0 +1,61 @@ +class apt::update { + #TODO: to catch if $::apt_update_last_success has the value of -1 here. If we + #opt to do this, a info/warn would likely be all you'd need likely to happen + #on the first run, but if it's not run in awhile something is likely borked + #with apt and we'd want to know about it. + + case $::apt::_update['frequency'] { + 'always': { + $_kick_apt = true + } + 'daily': { + #compare current date with the apt_update_last_success fact to determine + #if we should kick apt_update. + $daily_threshold = (strftime('%s') - 86400) + if $::apt_update_last_success { + if $::apt_update_last_success + 0 < $daily_threshold { + $_kick_apt = true + } else { + $_kick_apt = false + } + } else { + #if apt-get update has not successfully run, we should kick apt_update + $_kick_apt = true + } + } + 'weekly':{ + #compare current date with the apt_update_last_success fact to determine + #if we should kick apt_update. + $weekly_threshold = (strftime('%s') - 604800) + if $::apt_update_last_success { + if ( $::apt_update_last_success + 0 < $weekly_threshold ) { + $_kick_apt = true + } else { + $_kick_apt = false + } + } else { + #if apt-get update has not successfully run, we should kick apt_update + $_kick_apt = true + } + } + default: { + #catches 'reluctantly', and any other value (which should not occur). + #do nothing. + $_kick_apt = false + } + } + + if $_kick_apt { + $_refresh = false + } else { + $_refresh = true + } + exec { 'apt_update': + command => "${::apt::provider} update", + logoutput => 'on_failure', + refreshonly => $_refresh, + timeout => $::apt::_update['timeout'], + tries => $::apt::_update['tries'], + try_sleep => 1 + } +} diff --git a/environments/production/modules/apt/metadata.json b/environments/production/modules/apt/metadata.json new file mode 100644 index 0000000..5ca43e2 --- /dev/null +++ b/environments/production/modules/apt/metadata.json @@ -0,0 +1,39 @@ +{ + "name": "puppetlabs-apt", + "version": "2.4.0", + "author": "Puppet Labs", + "summary": "Provides an interface for managing Apt source, key, and definitions with Puppet", + "license": "Apache-2.0", + "source": "https://github.com/puppetlabs/puppetlabs-apt", + "project_page": "https://github.com/puppetlabs/puppetlabs-apt", + "issues_url": "https://tickets.puppetlabs.com/browse/MODULES", + "dependencies": [ + {"name":"puppetlabs/stdlib","version_requirement":">= 4.13.0 < 5.0.0"} + ], + "data_provider": null, + "operatingsystem_support": [ + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "6", + "7", + "8" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "10.04", + "12.04", + "14.04", + "16.04" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">= 3.0.0 < 5.0.0" + } + ] +} diff --git a/environments/production/modules/apt/spec/acceptance/apt_key_provider_spec.rb b/environments/production/modules/apt/spec/acceptance/apt_key_provider_spec.rb new file mode 100644 index 0000000..b4347e1 --- /dev/null +++ b/environments/production/modules/apt/spec/acceptance/apt_key_provider_spec.rb @@ -0,0 +1,847 @@ +require 'spec_helper_acceptance' + +PUPPETLABS_GPG_KEY_SHORT_ID = 'EF8D349F' +PUPPETLABS_GPG_KEY_LONG_ID = '7F438280EF8D349F' +PUPPETLABS_GPG_KEY_FINGERPRINT = '6F6B15509CF8E59E6E469F327F438280EF8D349F' +PUPPETLABS_APT_URL = 'apt.puppetlabs.com' +PUPPETLABS_GPG_KEY_FILE = 'DEB-GPG-KEY-puppet' +CENTOS_GPG_KEY_SHORT_ID = 'C105B9DE' +CENTOS_GPG_KEY_LONG_ID = '0946FCA2C105B9DE' +CENTOS_GPG_KEY_FINGERPRINT = 'C1DAC52D1664E8A4386DBA430946FCA2C105B9DE' +CENTOS_REPO_URL = 'ftp.cvut.cz/centos' +CENTOS_GPG_KEY_FILE = 'RPM-GPG-KEY-CentOS-6' + +SHOULD_NEVER_EXIST_ID = 'EF8D349F' + +KEY_CHECK_COMMAND = "apt-key adv --list-keys --with-colons --fingerprint | grep " +PUPPETLABS_KEY_CHECK_COMMAND = "#{KEY_CHECK_COMMAND} #{PUPPETLABS_GPG_KEY_FINGERPRINT}" +CENTOS_KEY_CHECK_COMMAND = "#{KEY_CHECK_COMMAND} #{CENTOS_GPG_KEY_FINGERPRINT}" + +MAX_TIMEOUT_RETRY = 3 +TIMEOUT_RETRY_WAIT = 5 +TIMEOUT_ERROR_MATCHER = /no valid OpenPGP data found/ + +describe 'apt_key' do + before(:each) do + # Delete twice to make sure everything is cleaned + # up after the short key collision + shell("apt-key del #{PUPPETLABS_GPG_KEY_SHORT_ID}", + :acceptable_exit_codes => [0,1,2]) + shell("apt-key del #{PUPPETLABS_GPG_KEY_SHORT_ID}", + :acceptable_exit_codes => [0,1,2]) + end + + describe 'default options' do + key_versions = { + '32bit key id' => "#{PUPPETLABS_GPG_KEY_SHORT_ID}", + '64bit key id' => "#{PUPPETLABS_GPG_KEY_LONG_ID}", + '160bit key fingerprint' => "#{PUPPETLABS_GPG_KEY_FINGERPRINT}", + '32bit lowercase key id' => "#{PUPPETLABS_GPG_KEY_SHORT_ID.downcase}", + '64bit lowercase key id' => "#{PUPPETLABS_GPG_KEY_LONG_ID.downcase}", + '160bit lowercase key fingerprint' => "#{PUPPETLABS_GPG_KEY_FINGERPRINT.downcase}", + '0x formatted 32bit key id' => "0x#{PUPPETLABS_GPG_KEY_SHORT_ID}", + '0x formatted 64bit key id' => "0x#{PUPPETLABS_GPG_KEY_LONG_ID}", + '0x formatted 160bit key fingerprint' => "0x#{PUPPETLABS_GPG_KEY_FINGERPRINT}", + '0x formatted 32bit lowercase key id' => "0x#{PUPPETLABS_GPG_KEY_SHORT_ID.downcase}", + '0x formatted 64bit lowercase key id' => "0x#{PUPPETLABS_GPG_KEY_LONG_ID.downcase}", + '0x formatted 160bit lowercase key fingerprint' => "0x#{PUPPETLABS_GPG_KEY_FINGERPRINT.downcase}", + } + + key_versions.each do |key, value| + context "#{key}" do + it 'works' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{value}', + ensure => 'present', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + end + + context 'invalid length key id' do + it 'fails' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '8280EF8D349F', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Valid values match/) + end + end + end + end + + describe 'ensure =>' do + context 'absent' do + it 'is removed' do + pp = <<-EOS + apt_key { 'centos': + id => '#{CENTOS_GPG_KEY_LONG_ID}', + ensure => 'absent', + } + EOS + + # Install the key first (retry because key pool may timeout) + retry_on_error_matching(MAX_TIMEOUT_RETRY, TIMEOUT_RETRY_WAIT, TIMEOUT_ERROR_MATCHER) do + shell("apt-key adv --keyserver hkps.pool.sks-keyservers.net \ + --recv-keys #{CENTOS_GPG_KEY_FINGERPRINT}") + end + shell(CENTOS_KEY_CHECK_COMMAND) + + # Time to remove it using Puppet + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + + shell(CENTOS_KEY_CHECK_COMMAND, + :acceptable_exit_codes => [1]) + + # Re-Install the key (retry because key pool may timeout) + retry_on_error_matching(MAX_TIMEOUT_RETRY, TIMEOUT_RETRY_WAIT, TIMEOUT_ERROR_MATCHER) do + shell("apt-key adv --keyserver hkps.pool.sks-keyservers.net \ + --recv-keys #{CENTOS_GPG_KEY_FINGERPRINT}") + end + end + end + + context 'absent, added with long key', :unless => (fact('operatingsystem') == 'Debian' and fact('operatingsystemmajrelease') == '6') do + it 'is removed' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'absent', + } + EOS + + # Install the key first (retry because key pool may timeout) + retry_on_error_matching(MAX_TIMEOUT_RETRY, TIMEOUT_RETRY_WAIT, TIMEOUT_ERROR_MATCHER) do + shell("apt-key adv --keyserver hkps.pool.sks-keyservers.net \ + --recv-keys #{PUPPETLABS_GPG_KEY_LONG_ID}") + end + + shell(PUPPETLABS_KEY_CHECK_COMMAND) + + # Time to remove it using Puppet + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + + shell(PUPPETLABS_KEY_CHECK_COMMAND, + :acceptable_exit_codes => [1]) + end + end + end + + describe 'content =>' do + context 'puppetlabs gpg key' do + it 'works' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_FINGERPRINT}', + ensure => 'present', + content => "-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBFe2Iz4BEADqbv/nWmR26bsivTDOLqrfBEvRu9kSfDMzYh9Bmik1A8Z036Eg +h5+TZD8Rrd5TErLQ6eZFmQXk9yKFoa9/C4aBjmsL/u0yeMmVb7/66i+x3eAYGLzV +FyunArjtefZyxq0B2mdRHE8kwl5XGl8015T5RGHCTEhpX14O9yigI7gtliRoZcl3 +hfXtedcvweOf9VrV+t5LF4PrZejom8VcB5CE2pdQ+23KZD48+Cx/sHSLHDtahOTQ +5HgwOLK7rBll8djFgIqP/UvhOqnZGIsg4MzTvWd/vwanocfY8BPwwodpX6rPUrD2 +aXPsaPeM3Q0juDnJT03c4i0jwCoYPg865sqBBrpOQyefxWD6UzGKYkZbaKeobrTB +xUKUlaz5agSK12j4N+cqVuZUBAWcokXLRrcftt55B8jz/Mwhx8kl6Qtrnzco9tBG +T5JN5vXMkETDjN/TqfB0D0OsLTYOp3jj4hpMpG377Q+6D71YuwfAsikfnpUtEBxe +NixXuKAIqrgG8trfODV+yYYWzfdM2vuuYiZW9pGAdm8ao+JalDZss3HL7oVYXSJp +MIjjhi78beuNflkdL76ACy81t2TvpxoPoUIG098kW3xd720oqQkyWJTgM+wV96bD +ycmRgNQpvqHYKWtZIyZCTzKzTTIdqg/sbE/D8cHGmoy0eHUDshcE0EtxsQARAQAB +tEhQdXBwZXQsIEluYy4gUmVsZWFzZSBLZXkgKFB1cHBldCwgSW5jLiBSZWxlYXNl +IEtleSkgPHJlbGVhc2VAcHVwcGV0LmNvbT6JAj4EEwECACgFAle2Iz4CGwMFCQlm +AYAGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEH9DgoDvjTSfIN0P/jcCRzK8 +WIdhcNz5dkj7xRZb8Oft2yDfenQmzb1SwGGa96IwJFcjF4Nq7ymcDUqunS2DEDb2 +gCucsqmW1ubkaggsYbc9voz/SQwhsQpBjfWbuyOX9DWmW6av/aB1F85wP79gyfqT +uidTGxQE6EhDbLe7tuvxOHfM1bKsUtI+0n9TALLLHfXUEdtaXCwMlJuO1IIn1PWa +H7HzyEjw6OW/cy73oM9nuErBIio1O60slPLOW2XNhdWZJCRWkcXyuumRjoepz7WN +1JgsLOTcB7rcQaBP3pDN0O/Om5dlDQ6oYitoJs/F0gfEgwK68Uy8k8sUR+FLLJqM +o0CwOg6CeWU4ShAEd1xZxVYW6VOOKlz9x9dvjIVDn2SlTBDmLS99ySlQS57rjGPf +GwlRUnuZP4OeSuoFNNJNb9PO6XFSP66eNHFbEpIoBU7phBzwWpTXNsW+kAcY8Rno +8GzKR/2FRsxe5Nhfh8xy88U7BA0tqxWdqpk/ym+wDcgHBfSRt0dPFnbaHAiMRlgX +J/NPHBQtkoEdQTKA+ICxcNTUMvsPDQgZcU1/ViLMN+6kZaGNDVcPeMgDvqxu0e/T +b3uYiId38HYbHmD6rDrOQL/2VPPXbdGbxDGQUgX1DfdOuFXw1hSTilwI1KdXxUXD +sCsZbchgliqGcI1l2En62+6pI2x5XQqqiJ7+uQINBFe2Iz4BEADzbs8WhdBxBa0t +JBl4Vz0brDgU3YDqNkqnra/T17kVPI7s27VEhoHERmZJ17pKqb2pElpr9mN/FzuN +0N9wvUaumd9gxzsOCam7DPTmuSIvwysk391mjCJkboo01bhuVXe2FBkgOPFzAJEH +YFPxmu7tWOmCxNYiuuYtxLywU7lC/Zp6CZuq57xJqUWK47I5wDK9/iigkwSb3nDs +6A2LpkDmCr+rcOwLh5bxDSei7vYW+3TNOkPlC/h6fO9dPeC9AfyW6qPdVFQq1mpZ +Zcj1ALz7zFiciIB4NrD3PTjDlRnaJCWKPafVSsMbyIWmQaJ01ifuE0Owianrau8c +I264VXmI5pA9C8k9f2aVBuJiLsXaLEb03CzFWz9JpBLttA9ccaam3feU2EmnC3sb +9xD+Ibkxq5mKFN3lEzUAAIqbI1QYGZXPgLxMY7JSvoUxAqeHwpf/dO2LIUqYUpx0 +bF/GWRV9Uql8omNQbhwP0p2X/0Gfxj9Abg2IJM8LeOu3Xk0HACwwyVXgxcgk5FO+ ++KZpTN3iynjmbIzB9qcd9TeSzjVh/RDPSdn5K6Ao5ynubGYmaPwCk+DdVBRDlgWo +7yNIF4N9rFuSMAEJxA1nS5TYFgIN9oDF3/GHngVGfFCv4EG3yS08Hk1tDV0biKdK +ypcx402TAwVRWP5Pzmxc6/ZXU4ZhZQARAQABiQIlBBgBAgAPBQJXtiM+AhsMBQkJ +ZgGAAAoJEH9DgoDvjTSfbWYQALwafIQK9avVNIuhMsyYPa/yHf6rUOLqrYO1GCmj +vyG4cYmryzdxyfcXEmuE5QAIbEKSISrcO6Nvjt9PwLCjR/dUvco0f0YFTPv+kamn ++Bwp2Zt6d3MenXC6mLXPHR4OqFjzCpUT8kFwycvGPsuqZQ/CO0qzLDmAGTY+4ly3 +9aQEsQyFhV3P+6SWnaC2TldWpfG/2pCSaSa8dbYbRe3SUNKXwT8kw3WoQYNofF6n +or8oFVA+UIVlvHc5h7L3tfFylRy5CwtR5rBQtoBicRVxEQc7ARNmB1XWuPntMQl/ +N1Fcfc+KSILFblAR6eVv+6BhMvRqzxqe81AEAP+oKVVwJ7H+wTQun2UKAgZATDWP +/LQsYinmLADpraDPqxT2WJe8kjszMDQZCK+jhsVrhZdkiw9EHAM0z7BKz6JERmLu +TIEcickkTfzbJWXZgv40Bvl99yPMswnR1lQHD7TKxyHYrI7dzJQri4mbORg4lOnZ +3Tyodv21Ocf4as2No1p6esZW+M46zjZeO8zzExmmENI2+P7/VUt+LWyQFiqRM0iW +zGioYMWgVePywFGaTV51/0uF9ymHHC7BDIcLgUWHdg/1B67jR5YQfzPJUqLhnylt +1sjDRQIlf+3U+ddvre2YxX/rYUI2gBT32QzQrv016KsiZO+N+Iya3B4D68s6xxQS +3xJn +=mMjt +-----END PGP PUBLIC KEY BLOCK-----", + } + EOS + + #Apply the manifest (Retry if timeout error is received from key pool) + retry_on_error_matching(MAX_TIMEOUT_RETRY, TIMEOUT_RETRY_WAIT, TIMEOUT_ERROR_MATCHER) do + apply_manifest(pp, :catch_failures => true) + end + + apply_manifest(pp, :catch_changes => true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + + + context 'multiple keys' do + it 'runs without errors' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_FINGERPRINT}', + ensure => 'present', + content => "-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1 + +mQINBEw3u0ABEAC1+aJQpU59fwZ4mxFjqNCgfZgDhONDSYQFMRnYC1dzBpJHzI6b +fUBQeaZ8rh6N4kZ+wq1eL86YDXkCt4sCvNTP0eF2XaOLbmxtV9bdpTIBep9bQiKg +5iZaz+brUZlFk/MyJ0Yz//VQ68N1uvXccmD6uxQsVO+gx7rnarg/BGuCNaVtGwy+ +S98g8Begwxs9JmGa8pMCcSxtC7fAfAEZ02cYyrw5KfBvFI3cHDdBqrEJQKwKeLKY +GHK3+H1TM4ZMxPsLuR/XKCbvTyl+OCPxU2OxPjufAxLlr8BWUzgJv6ztPe9imqpH +Ppp3KuLFNorjPqWY5jSgKl94W/CO2x591e++a1PhwUn7iVUwVVe+mOEWnK5+Fd0v +VMQebYCXS+3dNf6gxSvhz8etpw20T9Ytg4EdhLvCJRV/pYlqhcq+E9le1jFOHOc0 +Nc5FQweUtHGaNVyn8S1hvnvWJBMxpXq+Bezfk3X8PhPT/l9O2lLFOOO08jo0OYiI +wrjhMQQOOSZOb3vBRvBZNnnxPrcdjUUm/9cVB8VcgI5KFhG7hmMCwH70tpUWcZCN +NlI1wj/PJ7Tlxjy44f1o4CQ5FxuozkiITJvh9CTg+k3wEmiaGz65w9jRl9ny2gEl +f4CR5+ba+w2dpuDeMwiHJIs5JsGyJjmA5/0xytB7QvgMs2q25vWhygsmUQARAQAB +tEdQdXBwZXQgTGFicyBSZWxlYXNlIEtleSAoUHVwcGV0IExhYnMgUmVsZWFzZSBL +ZXkpIDxpbmZvQHB1cHBldGxhYnMuY29tPokBHAQQAQIABgUCTDfARgAKCRAhWv5Q +5BRwMq8TCACgG44+c+KgHBinygdU9Oj/r1wmfXbbmR+tpRgZ5sJytHC6gp3wjKFH +XrmddgmYPzKsAUGTxJxRUqxD+lKeo2sEKuXNAPo1C+4hZUV6Ah2N1qytZfpLOP43 +U6WVvMgluQTl6jRaMIwQolUj8ZNjYCdNZQCbfo8tALkedIBPKSrDF5kOwn+zxFyR +3v5A3mwFXK0bepvjlDuMsmktwk7opgfivP1mA3svPLIZu70PKk+u6UAMb06svt6V +SewYMbgTUzw+SCT1e/0xEpqjUqNgsPnPE6hW116goRB2cz6VYwmKfVe+ioljsVMM +mTqj5xWqoeR0ov6yCyxwVVCWOAIR3QSAiQEcBBABAgAGBQJUCeGFAAoJEBM5V+oR +Ao3zE3AH/1GQTS4JX3kS3WXE2Pi8L+gGylfYsf1dDbaDBX8mPfxKO6usZZmX9fIu +qQwQDIEksGrdcb6nrGecHufJDbLmFZiE77LjjoREFlG9tEyaIAVSCw/vyng9wVo8 +InDF7j1VHuUueh6eu+yvLjUrFuh3CVNHcx2rEIFzx+X5660TbbRfMgxLpTMkkb4w +7DQjCUmFQD4yLzZzXAzjELc/TgsFGZc3lxo7UuzwX0ZEm15WjrdYwvtMU1TGjjI2 +6dgk24K3Kb2OeUnCybQ1mLx6qVx0aFd21beKRG9u3Stp8HHXpfLh/aznbCY5JavO +ShOXgNgq3f0/UImLjyuFv27x0HQFxfeJARwEEAEKAAYFAlQHuw4ACgkQpHBvotfb +FDW/pwf+J6JBPpUHi/EsuLLbqDTQjGbnMTsH35pZRApKheaISPRZH8oqgdmWE599 +6e5GwnXMoBJoUvU0VbcO7aEarWlKmO6dpTKsfvjP+PtiSBeXUa8ewNcTq5N0Z7O5 +IwF2CiHrSTEcySjjboMKJHS/vQCmsLg1j+MA7wq3quzX0vQsGBX3X1x+n2KOH4s8 +BGoXFJs6sM1SInnqkPwryCesj61zc9I72kTM6IsG17X586INWMHoMDzpF/hTWKKw +2c0kFMDIJDpU+KBKr/e4mbKrp8ToP64GjB0MOx6MqjZI6I3k1PQu8zgWmOQ+yQhI +e/UfB8u+eGbhDwUMqKBEHUzV3b5lj4kCHAQQAQIABgUCUeTczgAKCRBKMwua1kj6 +4/mED/9RNl8PfjS6SKnqM+UzPHBIP9BqnC07sPiCwZOxd7MOQ73sPbV3Wk1o1PRG +tcAxqDCTUSUPGaf9gdQN8yi9lrZspqCNaZXfzGRaz4+uHU/ji9QMbfQIBTopn6ZM +YtRuiV868N98JOb0yfWLaTEVonFtWFZHrNHbwplHbyzUgGyup5MKSxh90p2S7DX+ +PznSFbwwzeE8En/jxUvHlAQV+eVfC3V+n4vKAC+sjInDu8m2xr1CMIiRCTa1y/vu +uGSJnoAO2GBUjHmPfINZKbicuoWnBtBMqs1GsJvldsv+ggx4cm4UgJvYdyQNLUq4 +pceaq8O4uhGvT/AURkymzldB6+iZRrsmQx5LmP0C5sIbiDXMoS089oYOx8MoGWMI +cErBTKxCPmgZTnDxW+U4+dLrYMF+yBTbLmKmaYhNiSNI4votfA7rEbn+zEDxzKgl +KZs3bzqKZxjoAeWhOKK7r83tSz4I2uHD9XscC6fnp61YGfdtlYJEYYA8XeomvjLa +xQxjQTcdrs48Qcgp8FvgyImelee1ZPbydB8Xd2VMVO2EDPBydlyHHZ6zjKt8Neff +djh6KyrFYJtOW4StdSiBQQofUqiFJq1gy3F6dy/ttSXMivbbNJQJjJV/1zKDnSQH +L7Qnux4SmobkrlHzP2z/rcFPk6CGaLpsHazmIrl8G3dO7UhinIkCHAQQAQIABgUC +VAesWAAKCRBGnps2mw8PHet2EACTyXdYh4kXGgSwQpY8hUJwd9FPrXPyYMTfeJFq +kIBpG/q60Q72Kqvn0AqUSmnROoKzPnwYW/jE+89tx1JBAT+8EtRAJvJaNH9Hovw4 +S3GV5wqImdsmIqJUxl8lh9moB9zfpsqWz2Laa1Xn/TGwmLl/zFL0PWQ4rv8r6pZ/ +OhEE/pnqZDLh/+6PxYmQRsIvDfmeVd57XSYLnT6JNXkAYBnmMouw+L7b2B9LWMIs +10lfjdOCplNE1FCTFS7K/j13x8Cyul6yF6eeq+rd5ftcw84XW+1qh3Jsw4bSNc0Z +LvGh7zgRznEWhxZrcGzWwtxnEG1aW7wXiDJ/kqAvBNP1LOhIQQH2NVp3oRW+hB1o +Cb/pbIht3xin7g5EJ0cpplTKNvfVdcitIflpgV9CT51oNkV7dVCtkXbFxwGdxP1L +CnYmfJ8IBumX6a3ue741E1tHHp2dZOHXWiMUI6TjYISQjx4KiiFTXJRpMsm5AQDi +ps+TSnF5TsNJ4776aAhP0hTN6Wy864NRoWEPs9OHltmZFCHzzTixQZrNxaUvLALP +vCmQ++U8f4mxD1+/eLXSzcfWolUoqyneTH/DEWpYXaoE5NalLfmoH7WxCR32LXWR +tJ748SZXI5SFjOzIzLsFr/qq36hGqDb7fqsc4LSz8uvJYo7vAdvkSUL2mkHeX4lD +QzwR/4kCHAQQAQgABgUCTPlA6QAKCRBcE9bbkwUuAxdYD/40FxAeNCYByxkr/XRT +0gFT+NCjPuqPWCM5tf2NIhSapXtb2+32WbAfDzVfqWjC0G0RnQBve+vcjpY4/rJu +4VKIDGIT8CtnKOIyEcXTNFOehi65xO4ypaeiBPSb3ip3P0of1iZZDQrNHMW5VcyL +1c+PWT/6exXSGsePtO/89tc6mupqZtC05f5ZXG4jswMF0U6Q5s3S0tG7Y+oQhKNF +JS4sH4rHe1o5CxKwNRSzqccA0hptKy3MHUZ2+zeHzuRdRWGjb2rUiVxnIvPPBGxF +2JHhB4ERhGgbTxRZ6wZbdW06BOE8r7pGrUpUfCw/WRT3gGXJHpGPOzFAvr3Xl7Vc +DUKTVmIajnpd3SoyD1t2XsvJlSQBOWbViucHdvE4SIKQ77vBLRlZIoXXVb6Wu7Vq ++eQs1ybjwGOhnnKjz8llXcMnLzzN86STpjN4qGTXQy/E9+dyUP1sXn3RRwb+ZkdI +77m1YY95QRNgG/hqh77IuWWg1MtTSgQnP+F27mfo0/522hObhdAe73VO3ttEPiri +Wy7tw3bS9daP2TAVbYyFqkvptkBb1OXRUSzqUuWjBmZ35UlXjKQsGeUHlOiEh84a +ondF90A7gx0X/ktNIPRrfCGkHJcDu+HVnR7xKk+F0qb9+/pGLiT3rqeQTr8fYsb4 +xLHT7uEg1gVFB1g0kd+RQHzV74kCPgQTAQIAKAIbAwYLCQgHAwIGFQgCCQoLBBYC +AwECHgECF4AFAk/x5PoFCQtIMjoACgkQEFS3okvW7DAIKQ/9HvZyf+LHVSkCk92K +b6gckniin3+5ooz67hSr8miGBfK4eocqQ0H7bdtWjAILzR/IBY0xj6OHKhYP2k8T +Lc7QhQjt0dRpNkX+Iton2AZryV7vUADreYz44B0bPmhiE+LL46ET5IThLKu/Kfih +zkEEBa9/t178+dO9zCM2xsXaiDhMOxVE32gXvSZKP3hmvnK/FdylUY3nWtPedr+l +HpBLoHGaPH7cjI+MEEugU3oAJ0jpq3V8n4w0jIq2V77wfmbD9byIV7dXcxApzciK ++ekwpQNQMSaceuxLlTZKcdSqo0/qmS2A863YZQ0ZBe+Xyf5OI33+y+Mry+vl6Lre +2VfPm3udgR10E4tWXJ9Q2CmG+zNPWt73U1FD7xBI7PPvOlyzCX4QJhy2Fn/fvzaN +jHp4/FSiCw0HvX01epcersyun3xxPkRIjwwRM9m5MJ0o4hhPfa97zibXSh8XXBno +sBQxeg6nEnb26eorVQbqGx0ruu/W2m5/JpUfREsFmNOBUbi8xlKNS5CZypH3Zh88 +EZiTFolOMEh+hT6s0l6znBAGGZ4m/Unacm5yDHmg7unCk4JyVopQ2KHMoqG886el +u+rm0ASkhyqBAk9sWKptMl3NHiYTRE/m9VAkugVIB2pi+8u84f+an4Hml4xlyijg +Yu05pqNvnLRyJDLd61hviLC8GYWJAj4EEwECACgFAkw3u0ACGwMFCQPCZwAGCwkI +BwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEBBUt6JL1uwwGWsP/2i5hP3qG6V6SFFc +glFkMRLz7TP4f0gCbBtyqBzfbttensLPlB7C/+xfdXHlV0EHQ9nvArWFhXizTNEU +jPYvyjOtIOAryEJZjanaoYtR7IBqiJ2e9v1ywF7p9IGm3wt+qy8MNpHpfmjKUX+f +Eq0rrJGN9tTZzBCZeDrB1doXzbQCIMNnv85vUYaDKRisaB2QrxYZz+7tjNsDKu4j +Qw1m+nVbC6c3ZVX9uNswm7mzwscUFzqQOeq85FD7ifOZnVcOItfaDyBSGVS+aMIr +dUsQjsQYOG/KGjEt+oRJd6rWRvN+K7S33KgJqo4cemibiSzgGDfOEIwxFNzSOSHz +UTL5biHk3A+A7eRQmGoTdOObVtUXOrORgEfEVuORmMEA8xvpJJHnhscBIaglu5zh +7sGSKFSbnzYXdvFBZ/NyhiRwkLeDQQa9yuU3GOmw0BCK6UqZVkgwW3d6dSGqGWNV +kg3T/Tk1Tkm7M9CYoJVplFhlgnXfwjElvw+/91VDiTmEQ8Kbb7UmHIyXPNVFftcw +fq7eS2vzlnuFDjkQ/o1NQE4o0BGhWMQW6gQZBW6ABF6vW7UUMnoKpPnlaR4c2nD+ +TWBUzE4bx7k2qTcrXArKOWrv3DMsKgoGNQ33DCco6HLuGwrawHesOJBijTFHcDQ2 +ELpR2QyPlIySJ4a2psp4Hc2S43XhiQI+BBMBAgAoAhsDBgsJCAcDAgYVCAIJCgsE +FgIDAQIeAQIXgAUCVwb4BQUJDDXSzQAKCRAQVLeiS9bsMLwBEACtdY+PvfNw8SFu +RpIM2rvdjGsEfJPKpUK5Dx90m1NSVyhMwQeYLdBb0GGgeGjjX8E5kCqhsD53VPWH +AD13nPc3zCeiDJiwpjYXeuGIH7AOG+gZZDLdy14myEN0JQIXQslOK8SiaTn/yI4s +2Lrje0Ubf6wbJ3uX9MwsqIkugkJrYn9e1BC1uPgESbE1SjiIbB4iL8lrxE6fdyxc +QnUEzneOFQ9kScfPc/M5U9COMuQOuoefiAEh+FRrjxf9ag3NzecTlwk/EdpgmfSj +a+ClS+BJv83zYForrHRfUU1SDiueuWXAH1OTaUpAsZIiXpigTB4X3hLJXB1iKoA1 +TEM/9bZGPdJsS1mwUUy3ukDW1rhOodxojhN1XhT3f7X9Cl8lKxKw1tloRijfL3n4 +njwk6hEyKaURTo4iOs12HDlBZV3zhWONNZTvqrFMkz4OB+q8RGpfO8G4Mbba+fNQ +2At+cAWmGCoZeX3KfyRtqYe6vtKJf5ptQZgjl3EFPl6OxKjopzomB7o9lXbxARgO +6Pf9NSyYwlv0sNfy88N5iSsa7Sw7yi9t9tO5KFGoGYLmXXgyjvNZrE8KMh6/hJOW +HsW19noVdogd73q+gjRAl+eZ4J1nKpbSPkbufNoD8uB/j3rr5/sRJrtvVnMTJXwC +iTItalyg7XRJSQ9kAqzvRlxdGobo95kCDQRXtiM+ARAA6m7/51pkdum7Ir0wzi6q +3wRL0bvZEnwzM2IfQZopNQPGdN+hIIefk2Q/Ea3eUxKy0OnmRZkF5PcihaGvfwuG +gY5rC/7tMnjJlW+/+uovsd3gGBi81RcrpwK47Xn2csatAdpnURxPJMJeVxpfNNeU ++URhwkxIaV9eDvcooCO4LZYkaGXJd4X17XnXL8Hjn/Va1freSxeD62Xo6JvFXAeQ +hNqXUPttymQ+PPgsf7B0ixw7WoTk0OR4MDiyu6wZZfHYxYCKj/1L4Tqp2RiLIODM +071nf78Gp6HH2PAT8MKHaV+qz1Kw9mlz7Gj3jN0NI7g5yU9N3OItI8AqGD4POubK +gQa6TkMnn8Vg+lMximJGW2inqG60wcVClJWs+WoEitdo+DfnKlbmVAQFnKJFy0a3 +H7beeQfI8/zMIcfJJekLa583KPbQRk+STeb1zJBEw4zf06nwdA9DrC02Dqd44+Ia +TKRt++0Pug+9WLsHwLIpH56VLRAcXjYsV7igCKq4BvLa3zg1fsmGFs33TNr7rmIm +VvaRgHZvGqPiWpQ2bLNxy+6FWF0iaTCI44Yu/G3rjX5ZHS++gAsvNbdk76caD6FC +BtPfJFt8Xe9tKKkJMliU4DPsFfemw8nJkYDUKb6h2ClrWSMmQk8ys00yHaoP7GxP +w/HBxpqMtHh1A7IXBNBLcbEAEQEAAbRIUHVwcGV0LCBJbmMuIFJlbGVhc2UgS2V5 +IChQdXBwZXQsIEluYy4gUmVsZWFzZSBLZXkpIDxyZWxlYXNlQHB1cHBldC5jb20+ +iQI+BBMBAgAoBQJXtiM+AhsDBQkJZgGABgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIX +gAAKCRB/Q4KA7400nyDdD/43AkcyvFiHYXDc+XZI+8UWW/Dn7dsg33p0Js29UsBh +mveiMCRXIxeDau8pnA1Krp0tgxA29oArnLKpltbm5GoILGG3Pb6M/0kMIbEKQY31 +m7sjl/Q1plumr/2gdRfOcD+/YMn6k7onUxsUBOhIQ2y3u7br8Th3zNWyrFLSPtJ/ +UwCyyx311BHbWlwsDJSbjtSCJ9T1mh+x88hI8Ojlv3Mu96DPZ7hKwSIqNTutLJTy +zltlzYXVmSQkVpHF8rrpkY6Hqc+1jdSYLCzk3Ae63EGgT96QzdDvzpuXZQ0OqGIr +aCbPxdIHxIMCuvFMvJPLFEfhSyyajKNAsDoOgnllOEoQBHdcWcVWFulTjipc/cfX +b4yFQ59kpUwQ5i0vfckpUEue64xj3xsJUVJ7mT+DnkrqBTTSTW/TzulxUj+unjRx +WxKSKAVO6YQc8FqU1zbFvpAHGPEZ6PBsykf9hUbMXuTYX4fMcvPFOwQNLasVnaqZ +P8pvsA3IBwX0kbdHTxZ22hwIjEZYFyfzTxwULZKBHUEygPiAsXDU1DL7Dw0IGXFN +f1YizDfupGWhjQ1XD3jIA76sbtHv0297mIiHd/B2Gx5g+qw6zkC/9lTz123Rm8Qx +kFIF9Q33TrhV8NYUk4pcCNSnV8VFw7ArGW3IYJYqhnCNZdhJ+tvuqSNseV0Kqoie +/okBHAQQAQoABgUCV7d12AAKCRATOVfqEQKN8xl+B/0cdW8EhjyBXFWi4B0RzVXR +TIi5vUEe2mL+/cwt/qD70VJbe6Vy2X1VwGX5QrpMtjSnouGAa7aMU+oYXlzz+RPW +MtJTWMMVgOidRnAWw61wFAabZLFyJfVUg/QxI/sUQYkA3VC1XxSHLK+bjfglULRC +Q+JKpuK2D1jz0SrJhQtX6IGkVmT0t1tlwMUWhW3EIuHpc8TwvgxP0wjg8KLd01vK +KJTRLNb6Z3pFlT8rEF0Cw5LFReJM8i4+w1DqIy18xMkuDh09WBJhhCUH8LIHgGlz +D5p3fRmbtkW6T/wpjP2XR+eiGABJ0nr4WTDAwWn9SxnjXapp/QvKd+lOPRYUqRB5 +iQEcBBABAgAGBQJXt3igAAoJEF5FJ36WgCWsN2wH/RBYyRHcIXW3F3oYS884JNj+ +KA4Fl04kmuF9oQ3OnF8JYaYyZ1uuRErGH1UB8BVxTudKcowGCYi8AV4iQHSLx5dr +qY0w2MVlcxC2+8vUYEHYXU2i9EoGa6vwIJU+oSB/evnCJGe5DmzR6EbgQPADlkX3 +IW8GzrnPionDJhP7POwOY4HNOOBRm6AfAE3JMjH++TUuEgAuB0urjCNPmZ2/t9ic +uSS5hDp5HepoaQ2rfEI1Df+/wd8vXAD5Zdi1wZhmDWX8pq/spdAgV4/kMlcKzdRS +FINyA4wajLVLfsYPavBCW18aHV6pEBc9mdhQ3xsqardcnyX+rd9kMgXKsG69WAGJ +ARwEEAEKAAYFAle3ca8ACgkQpHBvotfbFDWkRQf8CZtvvGM1sHJk7l07KDmG2zSM +rWb/GPsySK+DZRZDBJz3m7FWazWnfb2cuqRSMnoDDvnjg5EVSFqdZ3GaTsjKFBNe +NnLp/dC+sjSfKoi+a1iCP5wuhiXOwwWz4O45ekYUKrIwCXh3C32mtnqc6460YQwp +a1pdGqEeGq4aqcZPHUYAb294GuelA1TUkxibCIIDo5f223UNwGV3m9LPTyf0uOwO +1cht4ZdvccWBFXuDvzMQ9AGh6jHq8SX1uopQkEOY8AY53Lul6ubHzoHIvrld/GaQ +9osF1dm2/llGtHbQDqnVYVXg+lLNqW0u6JhNSE/EHDi9S2zWmK8J60m4akJRRokB +HAQQAQgABgUCV7eBzwAKCRDfnAdsUd5/xDeuB/0aVR8KKFpEjV+mYspTMJMUi0ku +0iqXYqVmvMCfrwP2fzKu2MbLqWjgutG9RiwtrMmqaRPx+AYGJMU6k/TVd9bxWP8+ +vxvZzsEz9lPIoH6xCEAgA6AQ6TIYswwU0G6duR/iRUtn57oTixfoFazUFXriY3yk +gAeSphPmG2ZBVU/VEvht6qjkKrxIT46sjNEl5+5R3R9EekrW19D9S0TjtjPOGjfo ++6ZMxKWlGW5gCREliuSTQY1/56MTQdrA6bFdiim0TPftC+aK+6l2kzTyVbygBPPo +8/p30iOYHOX179HZNwGyGnP9fNxaURLsx7Zymaf2esA4mGVApDDE6QrZbeGHiQEc +BBABCAAGBQJXu01KAAoJEOe7Y9N+knoevtAH/2VjCnLU1xc25iuIDnDKtPdgdclY +tV5w4kLpDxo1WTieCPOjSK5Xbsfe9eSSSqjgsHm1EkejunzuDcmm57LXfcdf3MA3 +1u6qIkS/fdctj9hkEMonEeWN2NnyYLAkcjWf6+I4u/qhM8BdoT/UmB80rgdq07yr +14zxMhetoZaqcLMCtZuaVpQMmoa/SbaADQSISiYRN3xWeZUmeWBjU10avK7YeRMN +tyYTCAsRCvrwcKTN9XKdzHgm5kMZfo9UDuqnD2TsUxDwRcwYfe1+ZiHWV6sWZtGv +zPqJ4t7fUO8tlo3LnCCdZRXp3U5i9G8f4xZCkH0fY2kEMHMxOn4T5NS1WxmJARwE +EAEKAAYFAle3euIACgkQutXwo5LphXJtOAf/QvpHm4MsGYMFe0GamNcfCqgPQBfr ++/7SIreIG9BJDpsB+JkNZX3+tcZR5m7tfXl7Zt8+t+ENJVs62FPPzOA8EuXQAMGW +NkyQlV9Y4lFerccUX3gK3rP4BMxTQ372quGXfOIeYwUmTEPaA0me6M0ODla3jT+g +dl9HSwCCLTfv4/2djK/Oi/+m1r3grfeFLbOjoznR4xZoPbWFBWCn7iweWE3B6r1X +n+99DEaLmuEG4Mk8ohlKzIgReZ1wTkHcIt27GG60to8TUhbgqtGcOtE3Qc9hxZXh +wRbYaNFM8gkIAmo4eJuuWd+VWjnMeFH9JKtcrSEgMhI/qyt97c8g5497sYkBHAQQ +AQoABgUCV7d67gAKCRCCRVGYVPwajc8QB/93fnBi8sKAaaWIjFA5ZrZkjZEsVE2a +y8G4hCKUPFk8qwacVSC78I/yFqZPhy1DE2zsXEQEdu9VBNxVvEHuRBrs79XU7L92 +8xtdzEZF06my+xqYhhgBTqK1VguU4ayD9jKNgE1jGjPnHPFcjLaadyEtDDk9MMwC +fzvtFPGepRi1LYRMYxR4CNxAvAlgb0uVnZ+9dEfo9nfBfRL7ACLtnQbkazJZXyfP +zKeRmxlA9RTRlGm+ufHN5TgzsKFiTBbkQOF51ItAVJcKZVEARuyuMqWXIlZyURXq +kG9x1jAx0oZDW2iVRb6Ft21pAJd5P1ovGacX6EhTubAeAmlkqvmuPh3viQEcBBAB +CgAGBQJXt3sHAAoJEDy4a/JFI238WrgIAJS1gtpqw/tzyeAgopnKUyl+/ocCWoye +0wkS4/9QLzttQ718oDeb1EIcGnQEkazES1NAPoHAnc6TbvPfu71sfPqiTVMRE4VI +6AwXdjNT8ZWi0ip8fog1YVzFBxxMpYThDAPqkKPQG3kj3TAUMpmTlM/h63ndOOOU +5clUmuqT2agX7Xo/lP4qApcvcXe/EhwtWttYkFW9pPtjXUoHA7R4iEw/HZZRGvgi +RRuVkVnta63SBMasyypO8Km35dg/UAE4RRsPV1QLwl+uqgvD6zGt3A8+GNEXoAki +agKt8GJ43DlsD8aDkFzsp0E2iQ+idkqkqy7FXJMe4eG/LL4WG72fNL6JAhwEEAEC +AAYFAle3e60ACgkQyXOBc2z4R/lCtQ//SCePwH2R35N2h9EMYsCH9iypJmFWMcwN +HlEXOKmJrQ3viD0X3iXEa2SNRKKK7Evn3ggN9zbKwLLBIvZimut8LBLiF6TFnK/u ++8kZxGHLW0dhR/IokUY5zadx/E1F0C0IAkY7hNh791K6e7rwjw49pxSUnAQ00YMc +hNFeuq+IRtty+Jnw8uYz9m5CRAzBqPeAQ3mtXeYgkNPWEMQSTW5FDHnINlZItup9 +BSwIQxYJymKFkG3YxcJsx18dQNuVdzhg81b4XS35C2mOjlOhUsD+5Pp+8L0SQ3GC +u3qj/xXazdB9U0yJIs0u3JYb1Rl73v/fQji6UYyU/4TbEAhjl4n8JRgje1bJ4W1g +ugjalCM9YVaLrgjf5CIf0t8rn3G4Hl26ddNm/VroTCMLKXvg4kdFKF1oc6xImqoo +WJblVa4B4la9LxuRsgN9PamGlBUg1cDUftjpSstW1PYQPiGhc0jJh8vXNmIg5fzq +5dcLLWXOlrQOkg4ce30YzDculzn6ntBl30sCzVi/hxQrX3c0cpAqgRT3azAkO7JT +4J8fXO8CyAwuXjpDv6g4N9xfIdgTrbtqgnZb3MzOzpd11s7Q6ypCcEZVxt+FKVS1 +LgzJoWMQNVJ31sBwI1KenfB2/YfF6uILtpdFM+soKt86IvQub726rw56JWrIiP8w ++ojBTcDZGM6JAhwEEAEIAAYFAle3gC8ACgkQEFS3okvW7DCFfQ//SduNnxVJqud1 ++c1B+N1G/M3jfkMvSb6Sujb5/4qu5yL2Yo/PoTHesvqkFh5zILGuepCLI4ravZd7 +zyxy31o+egTC+adR4s6118k9swe9XDuZ+SNxBhK9A18pnaPcwa6b0j2q5KZI4klF +DKCg3u+D6qJQ3jqMPKbfPymVn1LE4qzkj/SXll0Nxkw7jIapn30UNONdY+q2nXpZ +Ej4xI01X66v9Zh/IRj8H0jwtJsTKfAoCkRmE9aJW4ywDUMJ0iHAqxYuGX2y617F6 +b1IY1JoWvBlNDTlCwj0v8xF6CK02JQecKhHl9hvAoAuJDhGIqSGkKH3ENAOFN6I0 +7orX6UrHDafphfqLYmEYCHJhz/QXC6Y4hxWS4cpcGbNqzfoerFkQimi0FT2lLPtn +DH1OOvBvibKAVKkifkAUjYCGN4EJYI39x9VX1I++sqoXWZoAgRTGd7Ppm7PQFdvM +pHQYDMLIzdFex5xvcQGrga1r7kOjUgpSP3rqBTgNfZtDNRucQE1iLOCu6Iias8HW +B66ya5eN7tpAN3vXvtMs1qpOU7748HbUKTOPvccj6abxJ5OKFluK286eLMXW1hHP +rB8I1WuIyYuqgtyuvdiRqhq0d+LyWuM2ZVos0usa03OtAuvnlaaTLE4qsW0cc73l +TAUI89WEAZ4yrD+IIVbR8WNv+F0O0GaJAhwEEAEIAAYFAle3ge4ACgkQhyhST+Id +P8Y9VBAAij8tXwW0Kl/cpJo0AEh1zPObs2ChFucwdj3DIbMOziV4d3cD/agGTL2H +rjNQnfGqr+oxvBOPGTXFJGllhmXYFISWdWQFGNM0G8XF0/zlnMP6c7XEpmUmr0O1 +OQuTVi31lY3kBmFLuZiTmN4YENIo3vCG1z7P8hHb3jpDUR4112KZdqWnvTGznDsA +lFTiNdlX9bU7eoQtFC0bueYv+rvHQ3PdzT4O8NBPuRhrfqVaaCUOERlUGuqjJzlK +TfxRq949Ts7piTqlnwIgw+mWfuvyVtKcRnrIkTSMmDcojKnYmi8FjRQoEyZp5DOZ +NLoJ5OMLCb3gyjQDLtGaPeDuLBiAPfb+dB+FtTplwbeevpOks/Cnbr8eCY2DflMd +3cgOA7xT5NyoZrUY9nhlRGStqIjJ/QrB1orFt8hqisshGJLgGp+64wvbFORgXvcY +3M2qoSeCRz03IFjeIf58TxcmaTC+aYffWTFKuGmvUKNCbGod20MyRtl5/xzQ3K5S +bt9u6MXeLw50psnu/GzQEgN52dU36fsh3XNWQrlV3YdTihJHTSeFAs1LA/eg/qJL +4WPGXmg/sBHFXuv4NC7aqI+0sUjlZfDk3aJCZHmnBTQ8izuvlUhhYy3+8N5D9i5E +KjaIAsEoHGIljwcenI5lLZNSNqlREW3ZED7vJZrbblOWq7ezlhKJAhwEEAEKAAYF +Ale3e7cACgkQAl2/Z5bsLy5UhA/+JZ/I5Zscici5SnbVKTIefcJWwlylWCale/IV +0m+YXl1GTLOxNFMgeSHlISVDWeo1g22jtT/ln4mfYfKJFN+Hy2lHuknxqZOCwti/ +T6DDSCqk8SZBIJliESPp1yOC6a1I1LhZWGzq1fUc3JtPng/CuiFKgxVQvrKooFTT +eFFzC3+S5Bjfcgz/vw/Hfuf8C2kMW6FFg3SQJIo1Iz8Z4C/f++J9kMKgkU7lfauK +9B3teN5F7gavOMv1C3SeM7xv0smaayM+coSA29/8LOKbfc5oSucNldXMI9CZTWQa +Kq7gfN5Lq7MPYDScS9UbEXAGQQIWsMIkeLadkdVpOqTjMfvnUX3d+rFdOCI4xFEA +5mm9o2qsmKTdZtGBeoY1M1Quq4qITtZifqthe6cZ83YulyKCEZniqiQzfCjWYZoS +tcW8rc+DIC/pakwRN7K7nZRNpoYb50+C+vlHfk7tuQuR3B95QFiOdfob9lSrnNtM +pli+diK5g1xmBbhSCUvbSK22ELCEtek6CZxKvkQclscteEhvVDIiq6rl5fMZsQCz +85L4fMX1HhVQ4fSPIIAfMi1sup36DEtTM9ensT8jKSB0gp9ZHsUAX+NA8PeUsjB1 +p6i7ywHuA0kS4NC8a7uACXgWyQq6rVZPn9w9ogu1k2KdtcHLcQSAgq8jB0Xw3056 +K7S6EVK5Ag0EV7YjPgEQAPNuzxaF0HEFrS0kGXhXPRusOBTdgOo2Sqetr9PXuRU8 +juzbtUSGgcRGZknXukqpvakSWmv2Y38XO43Q33C9Rq6Z32DHOw4JqbsM9Oa5Ii/D +KyTf3WaMImRuijTVuG5Vd7YUGSA48XMAkQdgU/Ga7u1Y6YLE1iK65i3EvLBTuUL9 +mnoJm6rnvEmpRYrjsjnAMr3+KKCTBJvecOzoDYumQOYKv6tw7AuHlvENJ6Lu9hb7 +dM06Q+UL+Hp871094L0B/Jbqo91UVCrWalllyPUAvPvMWJyIgHg2sPc9OMOVGdok +JYo9p9VKwxvIhaZBonTWJ+4TQ7CJqetq7xwjbrhVeYjmkD0LyT1/ZpUG4mIuxdos +RvTcLMVbP0mkEu20D1xxpqbd95TYSacLexv3EP4huTGrmYoU3eUTNQAAipsjVBgZ +lc+AvExjslK+hTECp4fCl/907YshSphSnHRsX8ZZFX1SqXyiY1BuHA/SnZf/QZ/G +P0BuDYgkzwt467deTQcALDDJVeDFyCTkU774pmlM3eLKeOZsjMH2px31N5LONWH9 +EM9J2fkroCjnKe5sZiZo/AKT4N1UFEOWBajvI0gXg32sW5IwAQnEDWdLlNgWAg32 +gMXf8YeeBUZ8UK/gQbfJLTweTW0NXRuIp0rKlzHjTZMDBVFY/k/ObFzr9ldThmFl +ABEBAAGJAiUEGAECAA8FAle2Iz4CGwwFCQlmAYAACgkQf0OCgO+NNJ9tZhAAvBp8 +hAr1q9U0i6EyzJg9r/Id/qtQ4uqtg7UYKaO/IbhxiavLN3HJ9xcSa4TlAAhsQpIh +Ktw7o2+O30/AsKNH91S9yjR/RgVM+/6Rqaf4HCnZm3p3cx6dcLqYtc8dHg6oWPMK +lRPyQXDJy8Y+y6plD8I7SrMsOYAZNj7iXLf1pASxDIWFXc/7pJadoLZOV1al8b/a +kJJpJrx1thtF7dJQ0pfBPyTDdahBg2h8XqeivygVUD5QhWW8dzmHsve18XKVHLkL +C1HmsFC2gGJxFXERBzsBE2YHVda4+e0xCX83UVx9z4pIgsVuUBHp5W/7oGEy9GrP +Gp7zUAQA/6gpVXAnsf7BNC6fZQoCBkBMNY/8tCxiKeYsAOmtoM+rFPZYl7ySOzMw +NBkIr6OGxWuFl2SLD0QcAzTPsErPokRGYu5MgRyJySRN/NslZdmC/jQG+X33I8yz +CdHWVAcPtMrHIdisjt3MlCuLiZs5GDiU6dndPKh2/bU5x/hqzY2jWnp6xlb4zjrO +Nl47zPMTGaYQ0jb4/v9VS34tbJAWKpEzSJbMaKhgxaBV4/LAUZpNXnX/S4X3KYcc +LsEMhwuBRYd2D/UHruNHlhB/M8lSouGfKW3WyMNFAiV/7dT512+t7ZjFf+thQjaA +FPfZDNCu/TXoqyJk7434jJrcHgPryzrHFBLfEmc= +=TREp +-----END PGP PUBLIC KEY BLOCK----- ", + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + + context 'bogus key' do + it 'fails' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + content => 'For posterity: such content, much bogus, wow', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/no valid OpenPGP data found/) + end + end + end + end + + describe 'server =>' do + context 'hkps.pool.sks-keyservers.net' do + it 'works' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + server => 'hkps.pool.sks-keyservers.net', + } + EOS + + #Apply the manifest (Retry if timeout error is received from key pool) + retry_on_error_matching(MAX_TIMEOUT_RETRY, TIMEOUT_RETRY_WAIT, TIMEOUT_ERROR_MATCHER) do + apply_manifest(pp, :catch_failures => true) + end + + apply_manifest(pp, :catch_changes => true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + + context 'hkp://hkps.pool.sks-keyservers.net:80' do + it 'works' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_FINGERPRINT}', + ensure => 'present', + server => 'hkp://hkps.pool.sks-keyservers.net:80', + } + EOS + + retry_on_error_matching(MAX_TIMEOUT_RETRY, TIMEOUT_RETRY_WAIT, TIMEOUT_ERROR_MATCHER) do + apply_manifest(pp, :catch_failures => true) + end + + apply_manifest(pp, :catch_changes => true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + + context 'nonexistant.key.server' do + it 'fails' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + server => 'nonexistant.key.server', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/(Host not found|Couldn't resolve host)/) + end + end + end + + context 'key server start with dot' do + it 'fails' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + server => '.pgp.key.server', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Invalid value \".pgp.key.server\"/) + end + end + end + end + + describe 'source =>' do + context 'http://' do + it 'works' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'http://#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + + it 'works with userinfo' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'http://dummyuser:dummypassword@#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + + it 'fails with a 404' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'http://#{PUPPETLABS_APT_URL}/herpderp.gpg', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/404 Not Found/) + end + end + + it 'fails with a socket error' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'http://apt.puppetlabss.com/herpderp.gpg', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/could not resolve/) + end + end + end + + context 'ftp://' do + before(:each) do + shell("apt-key del #{CENTOS_GPG_KEY_LONG_ID}", + :acceptable_exit_codes => [0,1,2]) + end + + it 'works' do + pp = <<-EOS + apt_key { 'CentOS 6': + id => '#{CENTOS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'ftp://#{CENTOS_REPO_URL}/#{CENTOS_GPG_KEY_FILE}', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + shell(CENTOS_KEY_CHECK_COMMAND) + end + + it 'fails with a 550' do + pp = <<-EOS + apt_key { 'CentOS 6': + id => '#{SHOULD_NEVER_EXIST_ID}', + ensure => 'present', + source => 'ftp://#{CENTOS_REPO_URL}/herpderp.gpg', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/550 Failed to open/) + end + end + + it 'fails with a socket error' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'ftp://apt.puppetlabss.com/herpderp.gpg', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/could not resolve/) + end + end + end + + context 'https://' do + it 'works' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'https://#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + + it 'works with userinfo' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'https://dummyuser:dummypassword@#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + + it 'fails with a 404' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{SHOULD_NEVER_EXIST_ID}', + ensure => 'present', + source => 'https://#{PUPPETLABS_APT_URL}/herpderp.gpg', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/404 Not Found/) + end + end + + it 'fails with a socket error' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{SHOULD_NEVER_EXIST_ID}', + ensure => 'present', + source => 'https://apt.puppetlabss.com/herpderp.gpg', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/could not resolve/) + end + end + end + + context '/path/that/exists' do + before(:each) do + shell("curl -o /tmp/puppetlabs-pubkey.gpg \ + http://#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}") + end + + after(:each) do + shell('rm /tmp/puppetlabs-pubkey.gpg') + end + + it 'works' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => 'EF8D349F', + ensure => 'present', + source => '/tmp/puppetlabs-pubkey.gpg', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + + context '/path/that/does/not/exist' do + it 'fails' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => '/tmp/totally_bogus.file', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/does not exist/) + end + end + end + + context '/path/that/exists/with/bogus/content' do + before(:each) do + shell('echo "here be dragons" > /tmp/fake-key.gpg') + end + + after(:each) do + shell('rm /tmp/fake-key.gpg') + end + it 'fails' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => '/tmp/fake-key.gpg', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/no valid OpenPGP data found/) + end + end + end + end + + describe 'options =>' do + context 'debug' do + it 'works' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + options => 'debug', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + end + + describe 'fingerprint validation against source/content' do + context 'fingerprint in id matches fingerprint from remote key' do + it 'works' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_FINGERPRINT}', + ensure => 'present', + source => 'https://#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + end + + context 'fingerprint in id does NOT match fingerprint from remote key' do + it 'works' do + pp = <<-EOS + apt_key { 'puppetlabs': + id => '6F6B15509CF8E59E6E469F327F438280EF8D9999', + ensure => 'present', + source => 'https://#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/do not match/) + end + end + end + end + +end diff --git a/environments/production/modules/apt/spec/acceptance/apt_spec.rb b/environments/production/modules/apt/spec/acceptance/apt_spec.rb new file mode 100644 index 0000000..52415f5 --- /dev/null +++ b/environments/production/modules/apt/spec/acceptance/apt_spec.rb @@ -0,0 +1,68 @@ +require 'spec_helper_acceptance' + +MAX_TIMEOUT_RETRY = 3 +TIMEOUT_RETRY_WAIT = 5 +TIMEOUT_ERROR_MATCHER = /no valid OpenPGP data found/ + +describe 'apt class' do + + context 'reset' do + it 'fixes the sources.list' do + shell('cp /etc/apt/sources.list /tmp') + end + end + + context 'all the things' do + it 'should work with no errors' do + pp = <<-EOS + if $::lsbdistcodename == 'lucid' { + $sources = undef + } else { + $sources = { + 'puppetlabs' => { + 'ensure' => present, + 'location' => 'http://apt.puppetlabs.com', + 'repos' => 'main', + 'key' => { + 'id' => '6F6B15509CF8E59E6E469F327F438280EF8D349F', + 'server' => 'hkps.pool.sks-keyservers.net', + }, + }, + } + } + class { 'apt': + update => { + 'frequency' => 'always', + 'timeout' => '400', + 'tries' => '3', + }, + purge => { + 'sources.list' => true, + 'sources.list.d' => true, + 'preferences' => true, + 'preferences.d' => true, + }, + sources => $sources, + } + EOS + + #Apply the manifest (Retry if timeout error is received from key pool) + retry_on_error_matching(MAX_TIMEOUT_RETRY, TIMEOUT_RETRY_WAIT, TIMEOUT_ERROR_MATCHER) do + apply_manifest(pp, :catch_failures => true) + end + + apply_manifest(pp, :catch_failures => true) + end + it 'should still work' do + shell('apt-get update') + shell('apt-get -y --force-yes upgrade') + end + end + + context 'reset' do + it 'fixes the sources.list' do + shell('cp /tmp/sources.list /etc/apt') + end + end + +end diff --git a/environments/production/modules/apt/spec/acceptance/class_spec.rb b/environments/production/modules/apt/spec/acceptance/class_spec.rb new file mode 100644 index 0000000..1539a0d --- /dev/null +++ b/environments/production/modules/apt/spec/acceptance/class_spec.rb @@ -0,0 +1,17 @@ +require 'spec_helper_acceptance' + +describe 'apt class' do + + context 'default parameters' do + # Using puppet_apply as a helper + it 'should work with no errors' do + pp = <<-EOS + class { 'apt': } + EOS + + # Run it twice and test for idempotency + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + end +end diff --git a/environments/production/modules/apt/spec/acceptance/nodesets/centos-7-x64.yml b/environments/production/modules/apt/spec/acceptance/nodesets/centos-7-x64.yml new file mode 100644 index 0000000..5eebdef --- /dev/null +++ b/environments/production/modules/apt/spec/acceptance/nodesets/centos-7-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + centos-7-x64: + roles: + - agent + - default + platform: el-7-x86_64 + hypervisor: vagrant + box: puppetlabs/centos-7.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/apt/spec/acceptance/nodesets/debian-8-x64.yml b/environments/production/modules/apt/spec/acceptance/nodesets/debian-8-x64.yml new file mode 100644 index 0000000..fef6e63 --- /dev/null +++ b/environments/production/modules/apt/spec/acceptance/nodesets/debian-8-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + debian-8-x64: + roles: + - agent + - default + platform: debian-8-amd64 + hypervisor: vagrant + box: puppetlabs/debian-8.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/apt/spec/acceptance/nodesets/default.yml b/environments/production/modules/apt/spec/acceptance/nodesets/default.yml new file mode 100644 index 0000000..dba339c --- /dev/null +++ b/environments/production/modules/apt/spec/acceptance/nodesets/default.yml @@ -0,0 +1,10 @@ +HOSTS: + ubuntu-1404-x64: + roles: + - agent + - default + platform: ubuntu-14.04-amd64 + hypervisor: vagrant + box: puppetlabs/ubuntu-14.04-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/apt/spec/acceptance/nodesets/docker/centos-7.yml b/environments/production/modules/apt/spec/acceptance/nodesets/docker/centos-7.yml new file mode 100644 index 0000000..a3333aa --- /dev/null +++ b/environments/production/modules/apt/spec/acceptance/nodesets/docker/centos-7.yml @@ -0,0 +1,12 @@ +HOSTS: + centos-7-x64: + platform: el-7-x86_64 + hypervisor: docker + image: centos:7 + docker_preserve_image: true + docker_cmd: '["/usr/sbin/init"]' + # install various tools required to get the image up to usable levels + docker_image_commands: + - 'yum install -y crontabs tar wget openssl sysvinit-tools iproute which initscripts' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/apt/spec/acceptance/nodesets/docker/debian-8.yml b/environments/production/modules/apt/spec/acceptance/nodesets/docker/debian-8.yml new file mode 100644 index 0000000..df5c319 --- /dev/null +++ b/environments/production/modules/apt/spec/acceptance/nodesets/docker/debian-8.yml @@ -0,0 +1,11 @@ +HOSTS: + debian-8-x64: + platform: debian-8-amd64 + hypervisor: docker + image: debian:8 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get update && apt-get install -y net-tools wget locales strace lsof && echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/apt/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/environments/production/modules/apt/spec/acceptance/nodesets/docker/ubuntu-14.04.yml new file mode 100644 index 0000000..b1efa58 --- /dev/null +++ b/environments/production/modules/apt/spec/acceptance/nodesets/docker/ubuntu-14.04.yml @@ -0,0 +1,12 @@ +HOSTS: + ubuntu-1404-x64: + platform: ubuntu-14.04-amd64 + hypervisor: docker + image: ubuntu:14.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + # ensure that upstart is booting correctly in the container + - 'rm /usr/sbin/policy-rc.d && rm /sbin/initctl && dpkg-divert --rename --remove /sbin/initctl && apt-get update && apt-get install -y net-tools wget && locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/apt/spec/classes/apt_backports_spec.rb b/environments/production/modules/apt/spec/classes/apt_backports_spec.rb new file mode 100644 index 0000000..5762025 --- /dev/null +++ b/environments/production/modules/apt/spec/classes/apt_backports_spec.rb @@ -0,0 +1,272 @@ +#!/usr/bin/env rspec +require 'spec_helper' + +describe 'apt::backports', :type => :class do + let (:pre_condition) { "class{ '::apt': }" } + describe 'debian/ubuntu tests' do + context 'defaults on deb' do + let(:facts) do + { + :lsbdistid => 'Debian', + :osfamily => 'Debian', + :lsbdistcodename => 'wheezy', + :puppetversion => Puppet.version, + } + end + it { is_expected.to contain_apt__source('backports').with({ + :location => 'http://httpredir.debian.org/debian', + :key => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + :repos => 'main contrib non-free', + :release => 'wheezy-backports', + :pin => { 'priority' => 200, 'release' => 'wheezy-backports' }, + }) + } + end + context 'defaults on squeeze' do + let(:facts) do + { + :lsbdistid => 'Debian', + :osfamily => 'Debian', + :lsbdistcodename => 'squeeze', + :puppetversion => Puppet.version, + } + end + it { is_expected.to contain_apt__source('backports').with({ + :location => 'http://httpredir.debian.org/debian-backports', + :key => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + :repos => 'main contrib non-free', + :release => 'squeeze-backports', + :pin => { 'priority' => 200, 'release' => 'squeeze-backports' }, + }) + } + end + context 'defaults on ubuntu' do + let(:facts) do + { + :lsbdistid => 'Ubuntu', + :osfamily => 'Debian', + :lsbdistcodename => 'trusty', + :lsbdistrelease => '14.04', + :puppetversion => Puppet.version, + } + end + it { is_expected.to contain_apt__source('backports').with({ + :location => 'http://archive.ubuntu.com/ubuntu', + :key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + :repos => 'main universe multiverse restricted', + :release => 'trusty-backports', + :pin => { 'priority' => 200, 'release' => 'trusty-backports' }, + }) + } + end + context 'set everything' do + let(:facts) do + { + :lsbdistid => 'Ubuntu', + :osfamily => 'Debian', + :lsbdistcodename => 'trusty', + :lsbdistrelease => '14.04', + :puppetversion => Puppet.version, + } + end + let(:params) do + { + :location => 'http://archive.ubuntu.com/ubuntu-test', + :release => 'vivid', + :repos => 'main', + :key => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + :pin => '90', + } + end + it { is_expected.to contain_apt__source('backports').with({ + :location => 'http://archive.ubuntu.com/ubuntu-test', + :key => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + :repos => 'main', + :release => 'vivid', + :pin => { 'priority' => 90, 'release' => 'vivid' }, + }) + } + end + context 'set things with hashes' do + let(:facts) do + { + :lsbdistid => 'Ubuntu', + :osfamily => 'Debian', + :lsbdistcodename => 'trusty', + :lsbdistrelease => '14.04', + :puppetversion => Puppet.version, + } + end + let(:params) do + { + :key => { + 'id' => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + }, + :pin => { + 'priority' => '90', + }, + } + end + it { is_expected.to contain_apt__source('backports').with({ + :key => { 'id' => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553' }, + :pin => { 'priority' => '90' }, + }) + } + end + end + describe 'mint tests' do + let(:facts) do + { + :lsbdistid => 'linuxmint', + :osfamily => 'Debian', + :lsbdistcodename => 'qiana', + :puppetversion => Puppet.version, + } + end + context 'sets all the needed things' do + let(:params) do + { + :location => 'http://archive.ubuntu.com/ubuntu', + :release => 'trusty-backports', + :repos => 'main universe multiverse restricted', + :key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + } + end + it { is_expected.to contain_apt__source('backports').with({ + :location => 'http://archive.ubuntu.com/ubuntu', + :key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + :repos => 'main universe multiverse restricted', + :release => 'trusty-backports', + :pin => { 'priority' => 200, 'release' => 'trusty-backports' }, + }) + } + end + context 'missing location' do + let(:params) do + { + :release => 'trusty-backports', + :repos => 'main universe multiverse restricted', + :key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key/) + end + end + context 'missing release' do + let(:params) do + { + :location => 'http://archive.ubuntu.com/ubuntu', + :repos => 'main universe multiverse restricted', + :key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key/) + end + end + context 'missing repos' do + let(:params) do + { + :location => 'http://archive.ubuntu.com/ubuntu', + :release => 'trusty-backports', + :key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key/) + end + end + context 'missing key' do + let(:params) do + { + :location => 'http://archive.ubuntu.com/ubuntu', + :release => 'trusty-backports', + :repos => 'main universe multiverse restricted', + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key/) + end + end + end + describe 'validation' do + let(:facts) do + { + :lsbdistid => 'Ubuntu', + :osfamily => 'Debian', + :lsbdistcodename => 'trusty', + :lsbdistrelease => '14.04', + :puppetversion => Puppet.version, + } + end + context 'invalid location' do + let(:params) do + { + :location => true + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /is not a string/) + end + end + context 'invalid release' do + let(:params) do + { + :release => true + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /is not a string/) + end + end + context 'invalid repos' do + let(:params) do + { + :repos => true + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /is not a string/) + end + end + context 'invalid key' do + let(:params) do + { + :key => true + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /is not a string/) + end + end + context 'invalid pin' do + let(:params) do + { + :pin => true + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /pin must be either a string, number or hash/) + end + end + end +end diff --git a/environments/production/modules/apt/spec/classes/apt_spec.rb b/environments/production/modules/apt/spec/classes/apt_spec.rb new file mode 100644 index 0000000..53ef7be --- /dev/null +++ b/environments/production/modules/apt/spec/classes/apt_spec.rb @@ -0,0 +1,333 @@ +require 'spec_helper' +describe 'apt' do + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :lsbdistcodename => 'wheezy', :puppetversion => Puppet.version} } + + context 'defaults' do + it { is_expected.to contain_file('sources.list').that_notifies('Class[Apt::Update]').only_with({ + :ensure => 'file', + :path => '/etc/apt/sources.list', + :owner => 'root', + :group => 'root', + :mode => '0644', + :notify => 'Class[Apt::Update]', + })} + + it { is_expected.to contain_file('sources.list.d').that_notifies('Class[Apt::Update]').only_with({ + :ensure => 'directory', + :path => '/etc/apt/sources.list.d', + :owner => 'root', + :group => 'root', + :mode => '0644', + :purge => false, + :recurse => false, + :notify => 'Class[Apt::Update]', + })} + + it { is_expected.to contain_file('preferences').that_notifies('Class[Apt::Update]').only_with({ + :ensure => 'file', + :path => '/etc/apt/preferences', + :owner => 'root', + :group => 'root', + :mode => '0644', + :notify => 'Class[Apt::Update]', + })} + + it { is_expected.to contain_file('preferences.d').that_notifies('Class[Apt::Update]').only_with({ + :ensure => 'directory', + :path => '/etc/apt/preferences.d', + :owner => 'root', + :group => 'root', + :mode => '0644', + :purge => false, + :recurse => false, + :notify => 'Class[Apt::Update]', + })} + + it 'should lay down /etc/apt/apt.conf.d/15update-stamp' do + is_expected.to contain_file('/etc/apt/apt.conf.d/15update-stamp').with({ + :group => 'root', + :mode => '0644', + :owner => 'root', + }).with_content(/APT::Update::Post-Invoke-Success \{"touch \/var\/lib\/apt\/periodic\/update-success-stamp 2>\/dev\/null \|\| true";\};/) + end + + it { is_expected.to contain_exec('apt_update').with({ + :refreshonly => 'true', + })} + + it { is_expected.not_to contain_apt__setting('conf-proxy') } + end + + describe 'proxy=' do + context 'host=localhost' do + let(:params) { { :proxy => { 'host' => 'localhost'} } } + it { is_expected.to contain_apt__setting('conf-proxy').with({ + :priority => '01', + }).with_content( + /Acquire::http::proxy "http:\/\/localhost:8080\/";/ + ).without_content( + /Acquire::https::proxy/ + )} + end + + context 'host=localhost and port=8180' do + let(:params) { { :proxy => { 'host' => 'localhost', 'port' => 8180} } } + it { is_expected.to contain_apt__setting('conf-proxy').with({ + :priority => '01', + }).with_content( + /Acquire::http::proxy "http:\/\/localhost:8180\/";/ + ).without_content( + /Acquire::https::proxy/ + )} + end + + context 'host=localhost and https=true' do + let(:params) { { :proxy => { 'host' => 'localhost', 'https' => true} } } + it { is_expected.to contain_apt__setting('conf-proxy').with({ + :priority => '01', + }).with_content( + /Acquire::http::proxy "http:\/\/localhost:8080\/";/ + ).with_content( + /Acquire::https::proxy "https:\/\/localhost:8080\/";/ + )} + end + + context 'ensure=absent' do + let(:params) { { :proxy => { 'ensure' => 'absent'} } } + it { is_expected.to contain_apt__setting('conf-proxy').with({ + :ensure => 'absent', + :priority => '01', + })} + end + end + context 'lots of non-defaults' do + let :params do + { + :update => { 'frequency' => 'always', 'timeout' => 1, 'tries' => 3 }, + :purge => { 'sources.list' => false, 'sources.list.d' => false, + 'preferences' => false, 'preferences.d' => false, }, + } + end + + it { is_expected.to contain_file('sources.list').with({ + :content => nil, + })} + + it { is_expected.to contain_file('sources.list.d').with({ + :purge => false, + :recurse => false, + })} + + it { is_expected.to contain_file('preferences').with({ + :ensure => 'file', + })} + + it { is_expected.to contain_file('preferences.d').with({ + :purge => false, + :recurse => false, + })} + + it { is_expected.to contain_exec('apt_update').with({ + :refreshonly => false, + :timeout => 1, + :tries => 3, + })} + + end + + context 'with sources defined on valid osfamily' do + let :facts do + { :osfamily => 'Debian', + :lsbdistcodename => 'precise', + :lsbdistid => 'Debian', + :puppetversion => Puppet.version, + } + end + let(:params) { { :sources => { + 'debian_unstable' => { + 'location' => 'http://debian.mirror.iweb.ca/debian/', + 'release' => 'unstable', + 'repos' => 'main contrib non-free', + 'key' => { 'id' => '150C8614919D8446E01E83AF9AA38DCD55BE302B', 'server' => 'subkeys.pgp.net' }, + 'pin' => '-10', + 'include' => {'src' => true,}, + }, + 'puppetlabs' => { + 'location' => 'http://apt.puppetlabs.com', + 'repos' => 'main', + 'key' => { 'id' => '6F6B15509CF8E59E6E469F327F438280EF8D349F', 'server' => 'pgp.mit.edu' }, + } + } } } + + it { + is_expected.to contain_apt__setting('list-debian_unstable').with({ + :ensure => 'present', + }) + } + + it { is_expected.to contain_file('/etc/apt/sources.list.d/debian_unstable.list').with_content(/^deb http:\/\/debian.mirror.iweb.ca\/debian\/ unstable main contrib non-free$/) } + it { is_expected.to contain_file('/etc/apt/sources.list.d/debian_unstable.list').with_content(/^deb-src http:\/\/debian.mirror.iweb.ca\/debian\/ unstable main contrib non-free$/) } + + it { + is_expected.to contain_apt__setting('list-puppetlabs').with({ + :ensure => 'present', + }) + } + + it { is_expected.to contain_file('/etc/apt/sources.list.d/puppetlabs.list').with_content(/^deb http:\/\/apt.puppetlabs.com precise main$/) } + end + + context 'with confs defined on valid osfamily' do + let :facts do + { :osfamily => 'Debian', + :lsbdistcodename => 'precise', + :lsbdistid => 'Debian', + :puppetversion => Puppet.version, + } + end + let(:params) { { :confs => { + 'foo' => { + 'content' => 'foo', + }, + 'bar' => { + 'content' => 'bar', + } + } } } + + it { is_expected.to contain_apt__conf('foo').with({ + :content => 'foo', + })} + + it { is_expected.to contain_apt__conf('bar').with({ + :content => 'bar', + })} + end + + context 'with keys defined on valid osfamily' do + let :facts do + { :osfamily => 'Debian', + :lsbdistcodename => 'precise', + :lsbdistid => 'Debian', + :puppetversion => Puppet.version, + } + end + let(:params) { { :keys => { + '55BE302B' => { + 'server' => 'subkeys.pgp.net', + }, + 'EF8D349F' => { + 'server' => 'pgp.mit.edu', + } + } } } + + it { is_expected.to contain_apt__key('55BE302B').with({ + :server => 'subkeys.pgp.net', + })} + + it { is_expected.to contain_apt__key('EF8D349F').with({ + :server => 'pgp.mit.edu', + })} + end + + context 'with ppas defined on valid osfamily' do + let :facts do + { :osfamily => 'Debian', + :lsbdistcodename => 'precise', + :lsbdistid => 'ubuntu', + :lsbdistrelease => '12.04', + :puppetversion => Puppet.version, + } + end + let(:params) { { :ppas => { + 'ppa:drizzle-developers/ppa' => {}, + 'ppa:nginx/stable' => {}, + } } } + + it { is_expected.to contain_apt__ppa('ppa:drizzle-developers/ppa')} + it { is_expected.to contain_apt__ppa('ppa:nginx/stable')} + end + + context 'with settings defined on valid osfamily' do + let :facts do + { :osfamily => 'Debian', + :lsbdistcodename => 'precise', + :lsbdistid => 'Debian', + :puppetversion => Puppet.version, + } + end + let(:params) { { :settings => { + 'conf-banana' => { 'content' => 'banana' }, + 'pref-banana' => { 'content' => 'banana' }, + } } } + + it { is_expected.to contain_apt__setting('conf-banana')} + it { is_expected.to contain_apt__setting('pref-banana')} + end + + context 'with pins defined on valid osfamily' do + let :facts do + { :osfamily => 'Debian', + :lsbdistcodename => 'precise', + :lsbdistid => 'Debian', + :puppetversion => Puppet.version, + } + end + let(:params) { { :pins => { + 'stable' => { 'priority' => 600, 'order' => 50 }, + 'testing' => { 'priority' => 700, 'order' => 100 }, + } } } + + it { is_expected.to contain_apt__pin('stable') } + it { is_expected.to contain_apt__pin('testing') } + end + + describe 'failing tests' do + context "purge['sources.list']=>'banana'" do + let(:params) { { :purge => { 'sources.list' => 'banana' }, } } + it do + expect { + subject.call + }.to raise_error(Puppet::Error) + end + end + + context "purge['sources.list.d']=>'banana'" do + let(:params) { { :purge => { 'sources.list.d' => 'banana' }, } } + it do + expect { + subject.call + }.to raise_error(Puppet::Error) + end + end + + context "purge['preferences']=>'banana'" do + let(:params) { { :purge => { 'preferences' => 'banana' }, } } + it do + expect { + subject.call + }.to raise_error(Puppet::Error) + end + end + + context "purge['preferences.d']=>'banana'" do + let(:params) { { :purge => { 'preferences.d' => 'banana' }, } } + it do + expect { + subject.call + }.to raise_error(Puppet::Error) + end + end + + context 'with unsupported osfamily' do + let :facts do + { :osfamily => 'Darwin', :puppetversion => Puppet.version,} + end + + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /This module only works on Debian or derivatives like Ubuntu/) + end + end + end +end diff --git a/environments/production/modules/apt/spec/classes/apt_update_spec.rb b/environments/production/modules/apt/spec/classes/apt_update_spec.rb new file mode 100644 index 0000000..d031104 --- /dev/null +++ b/environments/production/modules/apt/spec/classes/apt_update_spec.rb @@ -0,0 +1,75 @@ +#!/usr/bin/env rspec +require 'spec_helper' + +describe 'apt::update', :type => :class do + context "and apt::update['frequency']='always'" do + { 'a recent run' => Time.now.to_i, 'we are due for a run' => 1406660561,'the update-success-stamp file does not exist' => -1 }.each_pair do |desc, factval| + context "and $::apt_update_last_success indicates #{desc}" do + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :apt_update_last_success => factval, :lsbdistcodename => 'wheezy', :puppetversion => Puppet.version, } } + let (:pre_condition) { "class{'::apt': update => {'frequency' => 'always' },}" } + it 'should trigger an apt-get update run' do + #set the apt_update exec's refreshonly attribute to false + is_expected.to contain_exec('apt_update').with({'refreshonly' => false}) + end + end + end + context 'when $::apt_update_last_success is nil' do + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :lsbdistcodename => 'wheezy', :puppetversion => Puppet.version, } } + let (:pre_condition) { "class{ '::apt': update => {'frequency' => 'always' },}" } + it 'should trigger an apt-get update run' do + #set the apt_update exec\'s refreshonly attribute to false + is_expected.to contain_exec('apt_update').with({'refreshonly' => false}) + end + end + end + context "and apt::update['frequency']='reluctantly'" do + {'a recent run' => Time.now.to_i, 'we are due for a run' => 1406660561,'the update-success-stamp file does not exist' => -1 }.each_pair do |desc, factval| + context "and $::apt_update_last_success indicates #{desc}" do + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :apt_update_last_success => factval, :lsbdistcodename => 'wheezy', :puppetversion => Puppet.version,} } + let (:pre_condition) { "class{ '::apt': update => {'frequency' => 'reluctantly' },}" } + it 'should not trigger an apt-get update run' do + #don't change the apt_update exec's refreshonly attribute. (it should be true) + is_expected.to contain_exec('apt_update').with({'refreshonly' => true}) + end + end + end + context 'when $::apt_update_last_success is nil' do + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :lsbdistcodename => 'wheezy', :puppetversion => Puppet.version, } } + let (:pre_condition) { "class{ '::apt': update => {'frequency' => 'reluctantly' },}" } + it 'should not trigger an apt-get update run' do + #don't change the apt_update exec's refreshonly attribute. (it should be true) + is_expected.to contain_exec('apt_update').with({'refreshonly' => true}) + end + end + end + ['daily','weekly'].each do |update_frequency| + context "and apt::update['frequency'] has the value of #{update_frequency}" do + { 'we are due for a run' => 1406660561,'the update-success-stamp file does not exist' => -1 }.each_pair do |desc, factval| + context "and $::apt_update_last_success indicates #{desc}" do + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :apt_update_last_success => factval, :lsbdistcodename => 'wheezy', :puppetversion => Puppet.version, } } + let (:pre_condition) { "class{ '::apt': update => {'frequency' => '#{update_frequency}',} }" } + it 'should trigger an apt-get update run' do + #set the apt_update exec\'s refreshonly attribute to false + is_expected.to contain_exec('apt_update').with({'refreshonly' => false}) + end + end + end + context 'when the $::apt_update_last_success fact has a recent value' do + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :lsbdistcodename => 'wheezy', :apt_update_last_success => Time.now.to_i, :puppetversion => Puppet.version, } } + let (:pre_condition) { "class{ '::apt': update => {'frequency' => '#{update_frequency}',} }" } + it 'should not trigger an apt-get update run' do + #don't change the apt_update exec\'s refreshonly attribute. (it should be true) + is_expected.to contain_exec('apt_update').with({'refreshonly' => true}) + end + end + context 'when $::apt_update_last_success is nil' do + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :lsbdistcodename => 'wheezy', :apt_update_last_success => nil, :puppetversion => Puppet.version, } } + let (:pre_condition) { "class{ '::apt': update => {'frequency' => '#{update_frequency}',} }" } + it 'should trigger an apt-get update run' do + #set the apt_update exec\'s refreshonly attribute to false + is_expected.to contain_exec('apt_update').with({'refreshonly' => false}) + end + end + end + end +end diff --git a/environments/production/modules/apt/spec/classes/params_spec.rb b/environments/production/modules/apt/spec/classes/params_spec.rb new file mode 100644 index 0000000..3161cf0 --- /dev/null +++ b/environments/production/modules/apt/spec/classes/params_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' +describe 'apt::params', :type => :class do + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :lsbdistcodename => 'wheezy', :puppetversion => Puppet.version, } } + + # There are 4 resources in this class currently + # there should not be any more resources because it is a params class + # The resources are class[apt::params], class[main], class[settings], stage[main] + it "Should not contain any resources" do + expect(subject.call.resources.size).to eq(4) + end + + describe "With lsb-release not installed" do + let(:facts) { { :osfamily => 'Debian', :puppetversion => Puppet.version, } } + let (:title) { 'my_package' } + + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /Unable to determine lsbdistid, please install lsb-release first/) + end + end +end diff --git a/environments/production/modules/apt/spec/defines/conf_spec.rb b/environments/production/modules/apt/spec/defines/conf_spec.rb new file mode 100644 index 0000000..c74bf1a --- /dev/null +++ b/environments/production/modules/apt/spec/defines/conf_spec.rb @@ -0,0 +1,84 @@ +require 'spec_helper' +describe 'apt::conf', :type => :define do + let :pre_condition do + 'class { "apt": }' + end + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :lsbdistcodename => 'wheezy', :puppetversion => Puppet.version, } } + let :title do + 'norecommends' + end + + describe "when creating an apt preference" do + let :default_params do + { + :priority => '00', + :content => "Apt::Install-Recommends 0;\nApt::AutoRemove::InstallRecommends 1;\n" + } + end + let :params do + default_params + end + + let :filename do + "/etc/apt/apt.conf.d/00norecommends" + end + + it { is_expected.to contain_file(filename).with({ + 'ensure' => 'present', + 'content' => /Apt::Install-Recommends 0;\nApt::AutoRemove::InstallRecommends 1;/, + 'owner' => 'root', + 'group' => 'root', + 'mode' => '0644', + }) + } + + context "with notify_update = true (default)" do + let :params do + default_params + end + it { is_expected.to contain_apt__setting("conf-#{title}").with_notify_update(true) } + end + + context "with notify_update = false" do + let :params do + default_params.merge({ + :notify_update => false + }) + end + it { is_expected.to contain_apt__setting("conf-#{title}").with_notify_update(false) } + end + end + + describe "when creating a preference without content" do + let :params do + { + :priority => '00', + } + end + + it 'fails' do + expect { subject.call } .to raise_error(/pass in content/) + end + end + + describe "when removing an apt preference" do + let :params do + { + :ensure => 'absent', + :priority => '00', + } + end + + let :filename do + "/etc/apt/apt.conf.d/00norecommends" + end + + it { is_expected.to contain_file(filename).with({ + 'ensure' => 'absent', + 'owner' => 'root', + 'group' => 'root', + 'mode' => '0644', + }) + } + end +end diff --git a/environments/production/modules/apt/spec/defines/key_compat_spec.rb b/environments/production/modules/apt/spec/defines/key_compat_spec.rb new file mode 100644 index 0000000..eaf53fc --- /dev/null +++ b/environments/production/modules/apt/spec/defines/key_compat_spec.rb @@ -0,0 +1,330 @@ +require 'spec_helper' + +describe 'apt::key', :type => :define do + let(:facts) { { + :lsbdistid => 'Debian', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } } + GPG_KEY_ID = '6F6B15509CF8E59E6E469F327F438280EF8D349F' + + let :title do + GPG_KEY_ID + end + + let :pre_condition do + 'include apt' + end + + describe 'normal operation' do + describe 'default options' do + it { + is_expected.to contain_apt_key(title).with({ + :id => title, + :ensure => 'present', + :source => nil, + :server => 'keyserver.ubuntu.com', + :content => nil, + :keyserver_options => nil, + }) + } + it 'contains the apt_key present anchor' do + is_expected.to contain_anchor("apt_key #{title} present") + end + end + + describe 'title and key =>' do + let :title do + 'puppetlabs' + end + + let :params do { + :key => GPG_KEY_ID, + } end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with({ + :id => GPG_KEY_ID, + :ensure => 'present', + :source => nil, + :server => 'keyserver.ubuntu.com', + :content => nil, + :keyserver_options => nil, + }) + end + it 'contains the apt_key present anchor' do + is_expected.to contain_anchor("apt_key #{GPG_KEY_ID} present") + end + end + + describe 'ensure => absent' do + let :params do { + :ensure => 'absent', + } end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with({ + :id => title, + :ensure => 'absent', + :source => nil, + :server => 'keyserver.ubuntu.com', + :content => nil, + :keyserver_options => nil, + }) + end + it 'contains the apt_key absent anchor' do + is_expected.to contain_anchor("apt_key #{title} absent") + end + end + + describe 'set a bunch of things!' do + let :params do { + :key_content => 'GPG key content', + :key_source => 'http://apt.puppetlabs.com/pubkey.gpg', + :key_server => 'pgp.mit.edu', + :key_options => 'debug', + } end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with({ + :id => title, + :ensure => 'present', + :source => 'http://apt.puppetlabs.com/pubkey.gpg', + :server => 'pgp.mit.edu', + :content => params[:key_content], + :options => 'debug', + }) + end + it 'contains the apt_key present anchor' do + is_expected.to contain_anchor("apt_key #{title} present") + end + end + + context "domain with dash" do + let(:params) do{ + :key_server => 'p-gp.m-it.edu', + } end + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with({ + :id => title, + :server => 'p-gp.m-it.edu', + }) + end + end + + context "url" do + let :params do + { + :key_server => 'hkp://pgp.mit.edu', + } + end + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with({ + :id => title, + :server => 'hkp://pgp.mit.edu', + }) + end + end + context "url with port number" do + let :params do + { + :key_server => 'hkp://pgp.mit.edu:80', + } + end + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with({ + :id => title, + :server => 'hkp://pgp.mit.edu:80', + }) + end + end + end + + describe 'validation' do + context "domain begin with dash" do + let(:params) do{ + :key_server => '-pgp.mit.edu', + } end + it 'fails' do + expect { subject.call } .to raise_error(/does not match/) + end + end + + context "domain begin with dot" do + let(:params) do{ + :key_server => '.pgp.mit.edu', + } end + it 'fails' do + expect { subject.call } .to raise_error(/does not match/) + end + end + + context "domain end with dot" do + let(:params) do{ + :key_server => "pgp.mit.edu.", + } end + it 'fails' do + expect { subject.call } .to raise_error(/does not match/) + end + end + context "exceed character url" do + let :params do + { + :key_server => 'hkp://pgpiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.mit.edu' + } + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + context "incorrect port number url" do + let :params do + { + :key_server => 'hkp://pgp.mit.edu:8008080' + } + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + context "incorrect protocol for url" do + let :params do + { + :key_server => 'abc://pgp.mit.edu:80' + } + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + context "missing port number url" do + let :params do + { + :key_server => 'hkp://pgp.mit.edu:' + } + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + context "url ending with a dot" do + let :params do + { + :key_server => 'hkp://pgp.mit.edu.' + } + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + context "url begin with a dash" do + let(:params) do{ + :key_server => "hkp://-pgp.mit.edu", + } end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + context 'invalid key' do + let :title do + 'Out of rum. Why? Why are we out of rum?' + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + + context 'invalid source' do + let :params do { + :key_source => 'afp://puppetlabs.com/key.gpg', + } end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + + context 'invalid content' do + let :params do { + :key_content => [], + } end + it 'fails' do + expect { subject.call }.to raise_error(/is not a string/) + end + end + + context 'invalid server' do + let :params do { + :key_server => 'two bottles of rum', + } end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + + context 'invalid keyserver_options' do + let :params do { + :key_options => {}, + } end + it 'fails' do + expect { subject.call }.to raise_error(/is not a string/) + end + end + + context 'invalid ensure' do + let :params do + { + :ensure => 'foo', + } + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + + describe 'duplication' do + context 'two apt::key resources for same key, different titles' do + let :pre_condition do + "#{super()}\napt::key { 'duplicate': key => '#{title}', }" + end + + it 'contains the duplicate apt::key resource' do + is_expected.to contain_apt__key('duplicate').with({ + :key => title, + :ensure => 'present', + }) + end + + it 'contains the original apt::key resource' do + is_expected.to contain_apt__key(title).with({ + :id => title, + :ensure => 'present', + }) + end + + it 'contains the native apt_key' do + is_expected.to contain_apt_key('duplicate').with({ + :id => title, + :ensure => 'present', + :source => nil, + :server => 'keyserver.ubuntu.com', + :content => nil, + :keyserver_options => nil, + }) + end + + it 'does not contain the original apt_key' do + is_expected.not_to contain_apt_key(title) + end + end + + context 'two apt::key resources, different ensure' do + let :pre_condition do + "#{super()}\napt::key { 'duplicate': key => '#{title}', ensure => 'absent', }" + end + it 'informs the user of the impossibility' do + expect { subject.call }.to raise_error(/already ensured as absent/) + end + end + end + end +end diff --git a/environments/production/modules/apt/spec/defines/key_spec.rb b/environments/production/modules/apt/spec/defines/key_spec.rb new file mode 100644 index 0000000..1ebcfc7 --- /dev/null +++ b/environments/production/modules/apt/spec/defines/key_spec.rb @@ -0,0 +1,325 @@ +require 'spec_helper' + +describe 'apt::key' do + let :pre_condition do + 'class { "apt": }' + end + + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :lsbdistcodename => 'wheezy', :puppetversion => Puppet.version, } } + + GPG_KEY_ID = '6F6B15509CF8E59E6E469F327F438280EF8D349F' + + let :title do + GPG_KEY_ID + end + + describe 'normal operation' do + describe 'default options' do + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with({ + :id => title, + :ensure => 'present', + :source => nil, + :server => 'keyserver.ubuntu.com', + :content => nil, + :options => nil, + }) + end + it 'contains the apt_key present anchor' do + is_expected.to contain_anchor("apt_key #{title} present") + end + end + + describe 'title and key =>' do + let :title do + 'puppetlabs' + end + + let :params do { + :id => GPG_KEY_ID, + } end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with({ + :id => GPG_KEY_ID, + :ensure => 'present', + :source => nil, + :server => 'keyserver.ubuntu.com', + :content => nil, + :options => nil, + }) + end + it 'contains the apt_key present anchor' do + is_expected.to contain_anchor("apt_key #{GPG_KEY_ID} present") + end + end + + describe 'ensure => absent' do + let :params do { + :ensure => 'absent', + } end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with({ + :id => title, + :ensure => 'absent', + :source => nil, + :server => 'keyserver.ubuntu.com', + :content => nil, + :keyserver => nil, + }) + end + it 'contains the apt_key absent anchor' do + is_expected.to contain_anchor("apt_key #{title} absent") + end + end + + describe 'set a bunch of things!' do + let :params do { + :content => 'GPG key content', + :source => 'http://apt.puppetlabs.com/pubkey.gpg', + :server => 'pgp.mit.edu', + :options => 'debug', + } end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with({ + :id => title, + :ensure => 'present', + :source => 'http://apt.puppetlabs.com/pubkey.gpg', + :server => 'pgp.mit.edu', + :content => params[:content], + :options => 'debug', + }) + end + it 'contains the apt_key present anchor' do + is_expected.to contain_anchor("apt_key #{title} present") + end + end + + context "domain with dash" do + let(:params) do{ + :server => 'p-gp.m-it.edu', + } end + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with({ + :id => title, + :server => 'p-gp.m-it.edu', + }) + end + end + + context "url" do + let :params do + { + :server => 'hkp://pgp.mit.edu', + } + end + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with({ + :id => title, + :server => 'hkp://pgp.mit.edu', + }) + end + end + context "url with port number" do + let :params do + { + :server => 'hkp://pgp.mit.edu:80', + } + end + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with({ + :id => title, + :server => 'hkp://pgp.mit.edu:80', + }) + end + end + end + + describe 'validation' do + context "domain begin with dash" do + let(:params) do{ + :server => '-pgp.mit.edu', + } end + it 'fails' do + expect { subject.call } .to raise_error(/does not match/) + end + end + + context "domain begin with dot" do + let(:params) do{ + :server => '.pgp.mit.edu', + } end + it 'fails' do + expect { subject.call } .to raise_error(/does not match/) + end + end + + context "domain end with dot" do + let(:params) do{ + :server => "pgp.mit.edu.", + } end + it 'fails' do + expect { subject.call } .to raise_error(/does not match/) + end + end + context "exceed character url" do + let :params do + { + :server => 'hkp://pgpiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.mit.edu' + } + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + context "incorrect port number url" do + let :params do + { + :server => 'hkp://pgp.mit.edu:8008080' + } + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + context "incorrect protocol for url" do + let :params do + { + :server => 'abc://pgp.mit.edu:80' + } + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + context "missing port number url" do + let :params do + { + :server => 'hkp://pgp.mit.edu:' + } + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + context "url ending with a dot" do + let :params do + { + :server => 'hkp://pgp.mit.edu.' + } + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + context "url begin with a dash" do + let(:params) do{ + :server => "hkp://-pgp.mit.edu", + } end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + context 'invalid key' do + let :title do + 'Out of rum. Why? Why are we out of rum?' + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + + context 'invalid source' do + let :params do { + :source => 'afp://puppetlabs.com/key.gpg', + } end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + + context 'invalid content' do + let :params do { + :content => [], + } end + it 'fails' do + expect { subject.call }.to raise_error(/is not a string/) + end + end + + context 'invalid server' do + let :params do { + :server => 'two bottles of rum', + } end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + + context 'invalid options' do + let :params do { + :options => {}, + } end + it 'fails' do + expect { subject.call }.to raise_error(/is not a string/) + end + end + + context 'invalid ensure' do + %w(foo aabsent absenta apresent presenta).each do |param| + let :params do + { + :ensure => param, + } + end + it 'fails' do + expect { subject.call }.to raise_error(/does not match/) + end + end + end + + describe 'duplication' do + context 'two apt::key resources for same key, different titles' do + let :pre_condition do + "class { 'apt': } + apt::key { 'duplicate': id => '#{title}', }" + end + + it 'contains two apt::key resources' do + is_expected.to contain_apt__key('duplicate').with({ + :id => title, + :ensure => 'present', + }) + is_expected.to contain_apt__key(title).with({ + :id => title, + :ensure => 'present', + }) + end + + it 'contains only a single apt_key' do + is_expected.to contain_apt_key('duplicate').with({ + :id => title, + :ensure => 'present', + :source => nil, + :server => 'keyserver.ubuntu.com', + :content => nil, + :options => nil, + }) + is_expected.not_to contain_apt_key(title) + end + end + + context 'two apt::key resources, different ensure' do + let :pre_condition do + "class { 'apt': } + apt::key { 'duplicate': id => '#{title}', ensure => 'absent', }" + end + it 'informs the user of the impossibility' do + expect { subject.call }.to raise_error(/already ensured as absent/) + end + end + end + end +end diff --git a/environments/production/modules/apt/spec/defines/pin_spec.rb b/environments/production/modules/apt/spec/defines/pin_spec.rb new file mode 100644 index 0000000..9fb28c6 --- /dev/null +++ b/environments/production/modules/apt/spec/defines/pin_spec.rb @@ -0,0 +1,145 @@ +require 'spec_helper' +describe 'apt::pin', :type => :define do + let :pre_condition do + 'class { "apt": }' + end + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :lsbdistcodename => 'wheezy', :puppetversion => Puppet.version, } } + let(:title) { 'my_pin' } + + context 'defaults' do + it { is_expected.to contain_apt__setting("pref-my_pin").with_content(/Explanation: : my_pin\nPackage: \*\nPin: release a=my_pin\nPin-Priority: 0\n/)} + it { is_expected.to contain_apt__setting("pref-my_pin") } + end + + context 'set version' do + let :params do + { + 'packages' => 'vim', + 'version' => '1', + } + end + it { is_expected.to contain_apt__setting("pref-my_pin").with_content(/Explanation: : my_pin\nPackage: vim\nPin: version 1\nPin-Priority: 0\n/)} + it { is_expected.to contain_apt__setting("pref-my_pin") } + end + + context 'set origin' do + let :params do + { + 'packages' => 'vim', + 'origin' => 'test', + } + end + it { is_expected.to contain_apt__setting("pref-my_pin").with_content(/Explanation: : my_pin\nPackage: vim\nPin: origin test\nPin-Priority: 0\n/)} + it { is_expected.to contain_apt__setting("pref-my_pin") } + end + + context 'not defaults' do + let :params do + { + 'explanation' => 'foo', + 'order' => 99, + 'release' => '1', + 'codename' => 'bar', + 'release_version' => '2', + 'component' => 'baz', + 'originator' => 'foobar', + 'label' => 'foobaz', + 'priority' => 10, + } + end + it { is_expected.to contain_apt__setting("pref-my_pin").with_content(/Explanation: foo\nPackage: \*\nPin: release a=1, n=bar, v=2, c=baz, o=foobar, l=foobaz\nPin-Priority: 10\n/) } + it { is_expected.to contain_apt__setting("pref-my_pin").with({ + 'priority' => 99, + }) + } + end + + context 'ensure absent' do + let :params do + { + 'ensure' => 'absent' + } + end + it { is_expected.to contain_apt__setting("pref-my_pin").with({ + 'ensure' => 'absent', + }) + } + end + + context 'bad characters' do + let(:title) { 'such bad && wow!' } + it { is_expected.to contain_apt__setting("pref-such__bad____wow_") } + end + + describe 'validation' do + context 'invalid order' do + let :params do + { + 'order' => 'foo', + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /Only integers are allowed/) + end + end + + context 'packages == * and version' do + let :params do + { + 'version' => '1', + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /parameter version cannot be used in general form/) + end + end + + context 'packages == * and release and origin' do + let :params do + { + 'origin' => 'test', + 'release' => 'foo', + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /parameters release and origin are mutually exclusive/) + end + end + + context 'specific form with release and origin' do + let :params do + { + 'release' => 'foo', + 'origin' => 'test', + 'packages' => 'vim', + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /parameters release, origin, and version are mutually exclusive/) + end + end + + context 'specific form with version and origin' do + let :params do + { + 'version' => '1', + 'origin' => 'test', + 'packages' => 'vim', + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /parameters release, origin, and version are mutually exclusive/) + end + end + end +end diff --git a/environments/production/modules/apt/spec/defines/ppa_spec.rb b/environments/production/modules/apt/spec/defines/ppa_spec.rb new file mode 100644 index 0000000..a4c3014 --- /dev/null +++ b/environments/production/modules/apt/spec/defines/ppa_spec.rb @@ -0,0 +1,378 @@ +require 'spec_helper' +describe 'apt::ppa' do + let :pre_condition do + 'class { "apt": }' + end + + describe 'defaults' do + let :facts do + { + :lsbdistrelease => '11.04', + :lsbdistcodename => 'natty', + :operatingsystem => 'Ubuntu', + :osfamily => 'Debian', + :lsbdistid => 'Ubuntu', + :puppetversion => Puppet.version, + } + end + + let(:title) { 'ppa:needs/such.substitution/wow+type' } + it { is_expected.to_not contain_package('python-software-properties') } + it { is_expected.to contain_exec('add-apt-repository-ppa:needs/such.substitution/wow+type').that_notifies('Class[Apt::Update]').with({ + :environment => [], + :command => '/usr/bin/add-apt-repository -y ppa:needs/such.substitution/wow+type', + :unless => '/usr/bin/test -f /etc/apt/sources.list.d/needs-such_substitution-wow_type-natty.list', + :user => 'root', + :logoutput => 'on_failure', + }) + } + end + + describe 'Ubuntu 15.10 sources.list filename' do + let :facts do + { + :lsbdistrelease => '15.10', + :lsbdistcodename => 'wily', + :operatingsystem => 'Ubuntu', + :osfamily => 'Debian', + :lsbdistid => 'Ubuntu', + :puppetversion => Puppet.version, + } + end + + let(:title) { 'ppa:user/foo' } + it { is_expected.to contain_exec('add-apt-repository-ppa:user/foo').that_notifies('Class[Apt::Update]').with({ + :environment => [], + :command => '/usr/bin/add-apt-repository -y ppa:user/foo', + :unless => '/usr/bin/test -f /etc/apt/sources.list.d/user-ubuntu-foo-wily.list', + :user => 'root', + :logoutput => 'on_failure', + }) + } + end + + describe 'ppa depending on ppa, MODULES-1156' do + let :pre_condition do + 'class { "apt": }' + end + end + + describe 'package_name => software-properties-common' do + let :pre_condition do + 'class { "apt": }' + end + let :params do + { + :package_name => 'software-properties-common', + :package_manage => true, + } + end + let :facts do + { + :lsbdistrelease => '11.04', + :lsbdistcodename => 'natty', + :operatingsystem => 'Ubuntu', + :osfamily => 'Debian', + :lsbdistid => 'Ubuntu', + :puppetversion => Puppet.version, + } + end + + let(:title) { 'ppa:needs/such.substitution/wow' } + it { is_expected.to contain_package('software-properties-common') } + it { is_expected.to contain_exec('add-apt-repository-ppa:needs/such.substitution/wow').that_notifies('Class[Apt::Update]').with({ + 'environment' => [], + 'command' => '/usr/bin/add-apt-repository -y ppa:needs/such.substitution/wow', + 'unless' => '/usr/bin/test -f /etc/apt/sources.list.d/needs-such_substitution-wow-natty.list', + 'user' => 'root', + 'logoutput' => 'on_failure', + }) + } + + it { is_expected.to contain_file('/etc/apt/sources.list.d/needs-such_substitution-wow-natty.list').that_requires('Exec[add-apt-repository-ppa:needs/such.substitution/wow]').with({ + 'ensure' => 'file', + }) + } + end + + describe 'package_manage => true, multiple ppas, MODULES-2873' do + let :pre_condition do + 'class { "apt": } + apt::ppa {"ppa:user/foo": + package_manage => true + }' + end + let :facts do + { + :lsbdistrelease => '11.04', + :lsbdistcodename => 'natty', + :operatingsystem => 'Ubuntu', + :osfamily => 'Debian', + :lsbdistid => 'Ubuntu', + :puppetversion => Puppet.version, + } + end + let :params do + { + :package_manage => true, + } + end + + let(:title) { 'ppa:user/bar' } + it { is_expected.to contain_package('python-software-properties') } + it { is_expected.to contain_exec('add-apt-repository-ppa:user/bar').that_notifies('Class[Apt::Update]').with({ + 'environment' => [], + 'command' => '/usr/bin/add-apt-repository -y ppa:user/bar', + 'unless' => '/usr/bin/test -f /etc/apt/sources.list.d/user-bar-natty.list', + 'user' => 'root', + 'logoutput' => 'on_failure', + }) + } + + it { is_expected.to contain_file('/etc/apt/sources.list.d/user-bar-natty.list').that_requires('Exec[add-apt-repository-ppa:user/bar]').with({ + 'ensure' => 'file', + }) + } + end + + describe 'package_manage => false' do + let :pre_condition do + 'class { "apt": }' + end + let :facts do + { + :lsbdistrelease => '11.04', + :lsbdistcodename => 'natty', + :operatingsystem => 'Ubuntu', + :osfamily => 'Debian', + :lsbdistid => 'Ubuntu', + :puppetversion => Puppet.version, + } + end + let :params do + { + :package_manage => false, + } + end + + let(:title) { 'ppa:needs/such.substitution/wow' } + it { is_expected.to_not contain_package('python-software-properties') } + it { is_expected.to contain_exec('add-apt-repository-ppa:needs/such.substitution/wow').that_notifies('Class[Apt::Update]').with({ + 'environment' => [], + 'command' => '/usr/bin/add-apt-repository -y ppa:needs/such.substitution/wow', + 'unless' => '/usr/bin/test -f /etc/apt/sources.list.d/needs-such_substitution-wow-natty.list', + 'user' => 'root', + 'logoutput' => 'on_failure', + }) + } + + it { is_expected.to contain_file('/etc/apt/sources.list.d/needs-such_substitution-wow-natty.list').that_requires('Exec[add-apt-repository-ppa:needs/such.substitution/wow]').with({ + 'ensure' => 'file', + }) + } + end + + describe 'apt included, no proxy' do + let :pre_condition do + 'class { "apt": } + apt::ppa { "ppa:user/foo2": } + ' + end + let :facts do + { + :lsbdistrelease => '14.04', + :lsbdistcodename => 'trusty', + :operatingsystem => 'Ubuntu', + :lsbdistid => 'Ubuntu', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :options => '', + :package_manage => true, + :require => 'Apt::Ppa[ppa:user/foo2]', + } + end + let(:title) { 'ppa:user/foo' } + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_package('software-properties-common') } + it { is_expected.to contain_exec('add-apt-repository-ppa:user/foo').that_notifies('Class[Apt::Update]').with({ + :environment => [], + :command => '/usr/bin/add-apt-repository ppa:user/foo', + :unless => '/usr/bin/test -f /etc/apt/sources.list.d/user-foo-trusty.list', + :user => 'root', + :logoutput => 'on_failure', + }) + } + end + + describe 'apt included, proxy host' do + let :pre_condition do + 'class { "apt": + proxy => { "host" => "localhost" }, + }' + end + let :facts do + { + :lsbdistrelease => '14.04', + :lsbdistcodename => 'trusty', + :operatingsystem => 'Ubuntu', + :lsbdistid => 'Ubuntu', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + 'options' => '', + 'package_manage' => true, + } + end + let(:title) { 'ppa:user/foo' } + it { is_expected.to contain_package('software-properties-common') } + it { is_expected.to contain_exec('add-apt-repository-ppa:user/foo').that_notifies('Class[Apt::Update]').with({ + :environment => ['http_proxy=http://localhost:8080'], + :command => '/usr/bin/add-apt-repository ppa:user/foo', + :unless => '/usr/bin/test -f /etc/apt/sources.list.d/user-foo-trusty.list', + :user => 'root', + :logoutput => 'on_failure', + }) + } + end + + describe 'apt included, proxy host and port' do + let :pre_condition do + 'class { "apt": + proxy => { "host" => "localhost", "port" => 8180 }, + }' + end + let :facts do + { + :lsbdistrelease => '14.04', + :lsbdistcodename => 'trusty', + :operatingsystem => 'Ubuntu', + :lsbdistid => 'Ubuntu', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :options => '', + :package_manage => true, + } + end + let(:title) { 'ppa:user/foo' } + it { is_expected.to contain_package('software-properties-common') } + it { is_expected.to contain_exec('add-apt-repository-ppa:user/foo').that_notifies('Class[Apt::Update]').with({ + :environment => ['http_proxy=http://localhost:8180'], + :command => '/usr/bin/add-apt-repository ppa:user/foo', + :unless => '/usr/bin/test -f /etc/apt/sources.list.d/user-foo-trusty.list', + :user => 'root', + :logoutput => 'on_failure', + }) + } + end + + describe 'apt included, proxy host and port and https' do + let :pre_condition do + 'class { "apt": + proxy => { "host" => "localhost", "port" => 8180, "https" => true }, + }' + end + let :facts do + { + :lsbdistrelease => '14.04', + :lsbdistcodename => 'trusty', + :operatingsystem => 'Ubuntu', + :lsbdistid => 'Ubuntu', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :options => '', + :package_manage => true, + } + end + let(:title) { 'ppa:user/foo' } + it { is_expected.to contain_package('software-properties-common') } + it { is_expected.to contain_exec('add-apt-repository-ppa:user/foo').that_notifies('Class[Apt::Update]').with({ + :environment => ['http_proxy=http://localhost:8180', 'https_proxy=https://localhost:8180'], + :command => '/usr/bin/add-apt-repository ppa:user/foo', + :unless => '/usr/bin/test -f /etc/apt/sources.list.d/user-foo-trusty.list', + :user => 'root', + :logoutput => 'on_failure', + }) + } + end + + describe 'ensure absent' do + let :pre_condition do + 'class { "apt": }' + end + let :facts do + { + :lsbdistrelease => '14.04', + :lsbdistcodename => 'trusty', + :operatingsystem => 'Ubuntu', + :lsbdistid => 'Ubuntu', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let(:title) { 'ppa:user/foo' } + let :params do + { + :ensure => 'absent' + } + end + it { is_expected.to contain_file('/etc/apt/sources.list.d/user-foo-trusty.list').that_notifies('Class[Apt::Update]').with({ + :ensure => 'absent', + }) + } + end + + context 'validation' do + describe 'no release' do + let :facts do + { + :lsbdistrelease => '14.04', + :operatingsystem => 'Ubuntu', + :lsbdistid => 'Ubuntu', + :osfamily => 'Debian', + :lsbdistcodeanme => nil, + :puppetversion => Puppet.version, + } + end + let(:title) { 'ppa:user/foo' } + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /lsbdistcodename fact not available: release parameter required/) + end + end + + describe 'not ubuntu' do + let :facts do + { + :lsbdistrelease => '6.0.7', + :lsbdistcodename => 'wheezy', + :operatingsystem => 'Debian', + :lsbdistid => 'debian', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let(:title) { 'ppa:user/foo' } + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /not currently supported on Debian/) + end + end + end +end diff --git a/environments/production/modules/apt/spec/defines/setting_spec.rb b/environments/production/modules/apt/spec/defines/setting_spec.rb new file mode 100644 index 0000000..c0aad8e --- /dev/null +++ b/environments/production/modules/apt/spec/defines/setting_spec.rb @@ -0,0 +1,117 @@ +require 'spec_helper' + +describe 'apt::setting' do + let(:pre_condition) { 'class { "apt": }' } + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :lsbdistcodename => 'wheezy', :puppetversion => Puppet.version, } } + let(:title) { 'conf-teddybear' } + + let(:default_params) { { :content => 'di' } } + + describe 'when using the defaults' do + context 'without source or content' do + it do + expect { subject.call }.to raise_error(Puppet::Error, /needs either of /) + end + end + + context 'with title=conf-teddybear ' do + let(:params) { default_params } + it { is_expected.to contain_file('/etc/apt/apt.conf.d/50teddybear').that_notifies('Class[Apt::Update]') } + end + + context 'with title=pref-teddybear' do + let(:title) { 'pref-teddybear' } + let(:params) { default_params } + it { is_expected.to contain_file('/etc/apt/preferences.d/teddybear.pref').that_notifies('Class[Apt::Update]') } + end + + context 'with title=list-teddybear' do + let(:title) { 'list-teddybear' } + let(:params) { default_params } + it { is_expected.to contain_file('/etc/apt/sources.list.d/teddybear.list').that_notifies('Class[Apt::Update]') } + end + + context 'with source' do + let(:params) { { :source => 'puppet:///la/die/dah' } } + it { + is_expected.to contain_file('/etc/apt/apt.conf.d/50teddybear').that_notifies('Class[Apt::Update]').with({ + :ensure => 'file', + :owner => 'root', + :group => 'root', + :mode => '0644', + :source => "#{params[:source]}", + })} + end + + context 'with content' do + let(:params) { default_params } + it { is_expected.to contain_file('/etc/apt/apt.conf.d/50teddybear').that_notifies('Class[Apt::Update]').with({ + :ensure => 'file', + :owner => 'root', + :group => 'root', + :mode => '0644', + :content => "#{params[:content]}", + })} + end + end + + describe 'settings requiring settings, MODULES-769' do + let(:pre_condition) do + 'class { "apt": } + apt::setting { "list-teddybear": content => "foo" } + ' + end + let(:facts) { { :lsbdistid => 'Debian', :osfamily => 'Debian', :lsbdistcodename => 'wheezy', :puppetversion => Puppet.version, } } + let(:title) { 'conf-teddybear' } + let(:default_params) { { :content => 'di' } } + + let(:params) { default_params.merge({ :require => 'Apt::Setting[list-teddybear]' }) } + + it { is_expected.to compile.with_all_deps } + end + + describe 'when trying to pull one over' do + context 'with source and content' do + let(:params) { default_params.merge({ :source => 'la' }) } + it do + expect { subject.call }.to raise_error(Puppet::Error, /cannot have both /) + end + end + + context 'with title=ext-teddybear' do + let(:title) { 'ext-teddybear' } + let(:params) { default_params } + it do + expect { subject.call }.to raise_error(Puppet::Error, /must start with /) + end + end + + context 'with ensure=banana' do + let(:params) { default_params.merge({ :ensure => 'banana' }) } + it do + expect { subject.call }.to raise_error(Puppet::Error, /"banana" does not /) + end + end + + context 'with priority=1.2' do + let(:params) { default_params.merge({ :priority => 1.2 }) } + if Puppet::Util::Package.versioncmp(Puppet.version, '4.0') >= 0 || ENV["FUTURE_PARSER"] == 'yes' + it { is_expected.to compile.and_raise_error(/input needs to be a String/) } + else + it { is_expected.to compile.and_raise_error(/priority must be an integer or a zero-padded integer/) } + end + end + end + + describe 'with priority=100' do + let(:params) { default_params.merge({ :priority => 100 }) } + it { is_expected.to contain_file('/etc/apt/apt.conf.d/100teddybear').that_notifies('Class[Apt::Update]') } + end + + describe 'with ensure=absent' do + let(:params) { default_params.merge({ :ensure => 'absent' }) } + it { is_expected.to contain_file('/etc/apt/apt.conf.d/50teddybear').that_notifies('Class[Apt::Update]').with({ + :ensure => 'absent', + })} + end +end diff --git a/environments/production/modules/apt/spec/defines/source_compat_spec.rb b/environments/production/modules/apt/spec/defines/source_compat_spec.rb new file mode 100644 index 0000000..5da846f --- /dev/null +++ b/environments/production/modules/apt/spec/defines/source_compat_spec.rb @@ -0,0 +1,164 @@ +require 'spec_helper' + +describe 'apt::source', :type => :define do + GPG_KEY_ID = '6F6B15509CF8E59E6E469F327F438280EF8D349F' + + let :title do + 'my_source' + end + + context 'mostly defaults' do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + + let :params do + { + 'include_deb' => false, + 'include_src' => true, + 'location' => 'http://debian.mirror.iweb.ca/debian/', + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with_content(/# my_source\ndeb-src http:\/\/debian\.mirror\.iweb\.ca\/debian\/ wheezy main\n/) + } + end + + context 'no defaults' do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + 'comment' => 'foo', + 'location' => 'http://debian.mirror.iweb.ca/debian/', + 'release' => 'sid', + 'repos' => 'testing', + 'include_src' => false, + 'required_packages' => 'vim', + 'key' => GPG_KEY_ID, + 'key_server' => 'pgp.mit.edu', + 'key_content' => 'GPG key content', + 'key_source' => 'http://apt.puppetlabs.com/pubkey.gpg', + 'pin' => '10', + 'architecture' => 'x86_64', + 'trusted_source' => true, + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with_content(/# foo\ndeb \[arch=x86_64 trusted=yes\] http:\/\/debian\.mirror\.iweb\.ca\/debian\/ sid testing\n/).without_content(/deb-src/) + } + + it { is_expected.to contain_apt__pin('my_source').that_comes_before('Apt::Setting[list-my_source]').with({ + 'ensure' => 'present', + 'priority' => '10', + 'origin' => 'debian.mirror.iweb.ca', + }) + } + + it { is_expected.to contain_exec("Required packages: 'vim' for my_source").that_comes_before('Apt::Setting[list-my_source]').with({ + 'command' => '/usr/bin/apt-get -y install vim', + 'logoutput' => 'on_failure', + 'refreshonly' => true, + 'tries' => '3', + 'try_sleep' => '1', + }) + } + + it { is_expected.to contain_apt__key("Add key: #{GPG_KEY_ID} from Apt::Source my_source").that_comes_before('Apt::Setting[list-my_source]').with({ + 'ensure' => 'present', + 'id' => GPG_KEY_ID, + 'key_server' => 'pgp.mit.edu', + 'key_content' => 'GPG key content', + 'key_source' => 'http://apt.puppetlabs.com/pubkey.gpg', + }) + } + end + + context 'trusted_source true' do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + 'include_src' => false, + 'location' => 'http://debian.mirror.iweb.ca/debian/', + 'trusted_source' => true, + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with_content(/# my_source\ndeb \[trusted=yes\] http:\/\/debian\.mirror\.iweb\.ca\/debian\/ wheezy main\n/) } + end + + context 'architecture equals x86_64' do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + 'location' => 'http://debian.mirror.iweb.ca/debian/', + 'architecture' => 'x86_64', + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with_content(/# my_source\ndeb \[arch=x86_64\] http:\/\/debian\.mirror\.iweb\.ca\/debian\/ wheezy main\n/) + } + end + + context 'ensure => absent' do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + 'ensure' => 'absent', + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with({ + 'ensure' => 'absent' + }) + } + end + + describe 'validation' do + context 'no release' do + let :facts do + { + :lsbdistid => 'Debian', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + + it do + expect { subject.call }.to raise_error(Puppet::Error, /lsbdistcodename fact not available: release parameter required/) + end + end + end +end diff --git a/environments/production/modules/apt/spec/defines/source_spec.rb b/environments/production/modules/apt/spec/defines/source_spec.rb new file mode 100644 index 0000000..bf6977a --- /dev/null +++ b/environments/production/modules/apt/spec/defines/source_spec.rb @@ -0,0 +1,444 @@ +require 'spec_helper' + +describe 'apt::source' do + GPG_KEY_ID = '6F6B15509CF8E59E6E469F327F438280EF8D349F' + + let :pre_condition do + 'class { "apt": }' + end + + let :title do + 'my_source' + end + + context 'defaults' do + context 'without location' do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /source entry without specifying a location/) + end + end + context 'with location' do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let(:params) { { :location => 'hello.there', } } + + it { is_expected.to contain_apt__setting('list-my_source').with({ + :ensure => 'present', + }).without_content(/# my_source\ndeb-src hello.there wheezy main\n/) + } + end + end + + describe 'no defaults' do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + + context 'with complex pin' do + let :params do + { + :location => 'hello.there', + :pin => { 'release' => 'wishwash', + 'explanation' => 'wishwash', + 'priority' => 1001, }, + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with({ + :ensure => 'present', + }).with_content(/hello.there wheezy main\n/) + } + + it { is_expected.to contain_file('/etc/apt/sources.list.d/my_source.list').that_notifies('Class[Apt::Update]')} + + it { is_expected.to contain_apt__pin('my_source').that_comes_before('Apt::Setting[list-my_source]').with({ + :ensure => 'present', + :priority => 1001, + :explanation => 'wishwash', + :release => 'wishwash', + }) + } + end + + context 'with simple key' do + let :params do + { + :comment => 'foo', + :location => 'http://debian.mirror.iweb.ca/debian/', + :release => 'sid', + :repos => 'testing', + :key => GPG_KEY_ID, + :pin => '10', + :architecture => 'x86_64', + :allow_unsigned => true, + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with({ + :ensure => 'present', + }).with_content(/# foo\ndeb \[arch=x86_64 trusted=yes\] http:\/\/debian\.mirror\.iweb\.ca\/debian\/ sid testing\n/).without_content(/deb-src/) + } + + it { is_expected.to contain_apt__pin('my_source').that_comes_before('Apt::Setting[list-my_source]').with({ + :ensure => 'present', + :priority => '10', + :origin => 'debian.mirror.iweb.ca', + }) + } + + it { is_expected.to contain_apt__key("Add key: #{GPG_KEY_ID} from Apt::Source my_source").that_comes_before('Apt::Setting[list-my_source]').with({ + :ensure => 'present', + :id => GPG_KEY_ID, + }) + } + end + + context 'with complex key' do + let :params do + { + :comment => 'foo', + :location => 'http://debian.mirror.iweb.ca/debian/', + :release => 'sid', + :repos => 'testing', + :key => { 'id' => GPG_KEY_ID, 'server' => 'pgp.mit.edu', + 'content' => 'GPG key content', + 'source' => 'http://apt.puppetlabs.com/pubkey.gpg',}, + :pin => '10', + :architecture => 'x86_64', + :allow_unsigned => true, + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with({ + :ensure => 'present', + }).with_content(/# foo\ndeb \[arch=x86_64 trusted=yes\] http:\/\/debian\.mirror\.iweb\.ca\/debian\/ sid testing\n/).without_content(/deb-src/) + } + + it { is_expected.to contain_apt__pin('my_source').that_comes_before('Apt::Setting[list-my_source]').with({ + :ensure => 'present', + :priority => '10', + :origin => 'debian.mirror.iweb.ca', + }) + } + + it { is_expected.to contain_apt__key("Add key: #{GPG_KEY_ID} from Apt::Source my_source").that_comes_before('Apt::Setting[list-my_source]').with({ + :ensure => 'present', + :id => GPG_KEY_ID, + :server => 'pgp.mit.edu', + :content => 'GPG key content', + :source => 'http://apt.puppetlabs.com/pubkey.gpg', + }) + } + end + + context 'with simple key' do + let :params do + { + :comment => 'foo', + :location => 'http://debian.mirror.iweb.ca/debian/', + :release => 'sid', + :repos => 'testing', + :key => GPG_KEY_ID, + :pin => '10', + :architecture => 'x86_64', + :allow_unsigned => true, + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with({ + :ensure => 'present', + }).with_content(/# foo\ndeb \[arch=x86_64 trusted=yes\] http:\/\/debian\.mirror\.iweb\.ca\/debian\/ sid testing\n/).without_content(/deb-src/) + } + + it { is_expected.to contain_apt__pin('my_source').that_comes_before('Apt::Setting[list-my_source]').with({ + :ensure => 'present', + :priority => '10', + :origin => 'debian.mirror.iweb.ca', + }) + } + + it { is_expected.to contain_apt__key("Add key: #{GPG_KEY_ID} from Apt::Source my_source").that_comes_before('Apt::Setting[list-my_source]').with({ + :ensure => 'present', + :id => GPG_KEY_ID, + }) + } + end + end + + context 'allow_unsigned true' do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :location => 'hello.there', + :allow_unsigned => true, + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with({ + :ensure => 'present', + }).with_content(/# my_source\ndeb \[trusted=yes\] hello.there wheezy main\n/) + } + end + + context 'architecture equals x86_64' do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :location => 'hello.there', + :include => {'deb' => false, 'src' => true,}, + :architecture => 'x86_64', + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with({ + :ensure => 'present', + }).with_content(/# my_source\ndeb-src \[arch=x86_64\] hello.there wheezy main\n/) + } + end + + context 'include_src => true' do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :location => 'hello.there', + :include_src => true, + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with({ + :ensure => 'present', + }).with_content(/# my_source\ndeb hello.there wheezy main\ndeb-src hello.there wheezy main\n/) + } + end + + context 'include_deb => false' do + let :facts do + { + :lsbdistid => 'debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :location => 'hello.there', + :include_deb => false, + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with({ + :ensure => 'present', + }).without_content(/deb-src hello.there wheezy main\n/) + } + it { is_expected.to contain_apt__setting('list-my_source').without_content(/deb hello.there wheezy main\n/) } + end + + context 'include_src => true and include_deb => false' do + let :facts do + { + :lsbdistid => 'debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :location => 'hello.there', + :include_deb => false, + :include_src => true, + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with({ + :ensure => 'present', + }).with_content(/deb-src hello.there wheezy main\n/) + } + it { is_expected.to contain_apt__setting('list-my_source').without_content(/deb hello.there wheezy main\n/) } + end + + context 'include precedence' do + let :facts do + { + :lsbdistid => 'debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :location => 'hello.there', + :include_deb => true, + :include_src => false, + :include => { 'deb' => false, 'src' => true }, + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with({ + :ensure => 'present', + }).with_content(/deb-src hello.there wheezy main\n/) + } + it { is_expected.to contain_apt__setting('list-my_source').without_content(/deb hello.there wheezy main\n/) } + end + + context 'ensure => absent' do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :ensure => 'absent', + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with({ + :ensure => 'absent' + }) + } + end + + describe 'validation' do + context 'no release' do + let :facts do + { + :lsbdistid => 'Debian', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let(:params) { { :location => 'hello.there', } } + + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /lsbdistcodename fact not available: release parameter required/) + end + end + + context 'invalid pin' do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :location => 'hello.there', + :pin => true, + } + end + + it do + expect { + subject.call + }.to raise_error(Puppet::Error, /invalid value for pin/) + end + end + + context "with notify_update = undef (default)" do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :location => 'hello.there', + } + end + it { is_expected.to contain_apt__setting("list-#{title}").with_notify_update(true) } + end + + context "with notify_update = true" do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :location => 'hello.there', + :notify_update => true, + } + end + it { is_expected.to contain_apt__setting("list-#{title}").with_notify_update(true) } + end + + context "with notify_update = false" do + let :facts do + { + :lsbdistid => 'Debian', + :lsbdistcodename => 'wheezy', + :osfamily => 'Debian', + :puppetversion => Puppet.version, + } + end + let :params do + { + :location => 'hello.there', + :notify_update => false, + } + end + it { is_expected.to contain_apt__setting("list-#{title}").with_notify_update(false) } + end + + end +end diff --git a/environments/production/modules/apt/spec/spec_helper.rb b/environments/production/modules/apt/spec/spec_helper.rb new file mode 100644 index 0000000..22d5d68 --- /dev/null +++ b/environments/production/modules/apt/spec/spec_helper.rb @@ -0,0 +1,8 @@ +#This file is generated by ModuleSync, do not edit. +require 'puppetlabs_spec_helper/module_spec_helper' + +# put local configuration and setup into spec_helper_local +begin + require 'spec_helper_local' +rescue LoadError +end diff --git a/environments/production/modules/apt/spec/spec_helper_acceptance.rb b/environments/production/modules/apt/spec/spec_helper_acceptance.rb new file mode 100644 index 0000000..30eccbf --- /dev/null +++ b/environments/production/modules/apt/spec/spec_helper_acceptance.rb @@ -0,0 +1,43 @@ +require 'beaker-rspec' +require 'beaker/puppet_install_helper' +require 'beaker/module_install_helper' + +run_puppet_install_helper +install_module_on(hosts) +install_module_dependencies_on(hosts) + +UNSUPPORTED_PLATFORMS = ['RedHat','Suse','windows','AIX','Solaris'] + +# This method allows a block to be passed in and if an exception is raised +# that matches the 'error_matcher' matcher, the block will wait a set number +# of seconds before retrying. +# Params: +# - max_retry_count - Max number of retries +# - retry_wait_interval_secs - Number of seconds to wait before retry +# - error_matcher - Matcher which the exception raised must match to allow retry +# Example Usage: +# retry_on_error_matching(3, 5, /OpenGPG Error/) do +# apply_manifest(pp, :catch_failures => true) +# end +def retry_on_error_matching(max_retry_count = 3, retry_wait_interval_secs = 5, error_matcher = nil) + try = 0 + begin + try += 1 + yield + rescue Exception => e + if try < max_retry_count && (error_matcher == nil || e.message =~ error_matcher) + sleep retry_wait_interval_secs + retry + else + raise + end + end +end + +RSpec.configure do |c| + # Project root + proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..')) + + # Readable test descriptions + c.formatter = :documentation +end diff --git a/environments/production/modules/apt/spec/unit/facter/apt_has_updates_spec.rb b/environments/production/modules/apt/spec/unit/facter/apt_has_updates_spec.rb new file mode 100644 index 0000000..bcd6bb5 --- /dev/null +++ b/environments/production/modules/apt/spec/unit/facter/apt_has_updates_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'apt_has_updates fact' do + subject { Facter.fact(:apt_has_updates).value } + after(:each) { Facter.clear } + + describe 'on non-Debian distro' do + before { + Facter.fact(:osfamily).expects(:value).at_least(1).returns 'RedHat' + } + it { is_expected.to be_nil } + end + + describe 'on Debian based distro missing apt-get' do + before { + Facter.fact(:osfamily).expects(:value).at_least(1).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns false + } + it { is_expected.to be_nil } + end + + describe 'on Debian based distro' do + before { + Facter.fact(:osfamily).expects(:value).at_least(1).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s upgrade 2>&1').returns ""+ + "Inst tzdata [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n"+ + "Conf tzdata (2015g-0+deb8u1 Debian:stable-updates [all])\n"+ + "Inst unhide.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n"+ + "Conf unhide.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" + } + it { is_expected.to be true } + end +end + diff --git a/environments/production/modules/apt/spec/unit/facter/apt_package_updates_spec.rb b/environments/production/modules/apt/spec/unit/facter/apt_package_updates_spec.rb new file mode 100644 index 0000000..d7587ca --- /dev/null +++ b/environments/production/modules/apt/spec/unit/facter/apt_package_updates_spec.rb @@ -0,0 +1,34 @@ +require 'spec_helper' + +describe 'apt_package_updates fact' do + subject { Facter.fact(:apt_package_updates).value } + after(:each) { Facter.clear } + + describe 'when apt has no updates' do + before { + Facter.fact(:apt_has_updates).stubs(:value).returns false + } + it { is_expected.to be nil } + end + + describe 'when apt has updates' do + before { + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s upgrade 2>&1').returns ""+ + "Inst tzdata [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n"+ + "Conf tzdata (2015g-0+deb8u1 Debian:stable-updates [all])\n"+ + "Inst unhide.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n"+ + "Conf unhide.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" + } + it { + if Facter.version < '2.0.0' + is_expected.to eq('tzdata,unhide.rb') + else + is_expected.to eq(['tzdata','unhide.rb']) + end + } + end +end diff --git a/environments/production/modules/apt/spec/unit/facter/apt_reboot_required_spec.rb b/environments/production/modules/apt/spec/unit/facter/apt_reboot_required_spec.rb new file mode 100644 index 0000000..ed6efd0 --- /dev/null +++ b/environments/production/modules/apt/spec/unit/facter/apt_reboot_required_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' + +describe 'apt_reboot_required fact' do + subject { Facter.fact(:apt_reboot_required).value } + after(:each) { Facter.clear } + + describe 'if a reboot is required' do + before { + Facter.fact(:osfamily).expects(:value).at_least(1).returns 'Debian' + File.stubs(:file?).returns true + File.expects(:file?).at_least(1).with('/var/run/reboot-required').returns true + } + it { is_expected.to eq true } + end + + describe 'if a reboot is not required' do + before { + Facter.fact(:osfamily).expects(:value).at_least(1).returns 'Debian' + File.stubs(:file?).returns true + File.expects(:file?).at_least(1).with('/var/run/reboot-required').returns false + } + it { is_expected.to eq false } + end + +end diff --git a/environments/production/modules/apt/spec/unit/facter/apt_security_updates_spec.rb b/environments/production/modules/apt/spec/unit/facter/apt_security_updates_spec.rb new file mode 100644 index 0000000..174b60d --- /dev/null +++ b/environments/production/modules/apt/spec/unit/facter/apt_security_updates_spec.rb @@ -0,0 +1,29 @@ +require 'spec_helper' + +describe 'apt_security_updates fact' do + subject { Facter.fact(:apt_security_updates).value } + after(:each) { Facter.clear } + + describe 'when apt has no updates' do + before { + Facter.fact(:apt_has_updates).stubs(:value).returns false + } + it { is_expected.to be nil } + end + + describe 'when apt has security updates' do + before { + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s upgrade 2>&1').returns ""+ + "Inst tzdata [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n"+ + "Conf tzdata (2015g-0+deb8u1 Debian:stable-updates [all])\n"+ + "Inst unhide.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n"+ + "Conf unhide.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" + } + it { is_expected.to eq(1) } + end + +end diff --git a/environments/production/modules/apt/spec/unit/facter/apt_update_last_success_spec.rb b/environments/production/modules/apt/spec/unit/facter/apt_update_last_success_spec.rb new file mode 100644 index 0000000..cb32a5e --- /dev/null +++ b/environments/production/modules/apt/spec/unit/facter/apt_update_last_success_spec.rb @@ -0,0 +1,28 @@ +require 'spec_helper' + +describe 'apt_update_last_success fact' do + subject { Facter.fact(:apt_update_last_success).value } + after(:each) { Facter.clear } + + describe 'on Debian based distro which has not yet created the update-success-stamp file' do + before { + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:exists?).returns false + } + it 'should have a value of -1' do + is_expected.to eq(-1) + end + end + + describe 'on Debian based distro which has created the update-success-stamp' do + before { + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:exists?).returns true + File.stubs(:mtime).returns 1407660561 + } + it 'should have the value of the mtime of the file' do + is_expected.to eq(1407660561) + end + end + +end diff --git a/environments/production/modules/apt/spec/unit/facter/apt_updates_spec.rb b/environments/production/modules/apt/spec/unit/facter/apt_updates_spec.rb new file mode 100644 index 0000000..8c726fc --- /dev/null +++ b/environments/production/modules/apt/spec/unit/facter/apt_updates_spec.rb @@ -0,0 +1,29 @@ +require 'spec_helper' + +describe 'apt_updates fact' do + subject { Facter.fact(:apt_updates).value } + after(:each) { Facter.clear } + + describe 'when apt has no updates' do + before { + Facter.fact(:apt_has_updates).stubs(:value).returns false + } + it { is_expected.to be nil } + end + + describe 'when apt has updates' do + before { + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s upgrade 2>&1').returns ""+ + "Inst tzdata [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n"+ + "Conf tzdata (2015g-0+deb8u1 Debian:stable-updates [all])\n"+ + "Inst unhide.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n"+ + "Conf unhide.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" + } + it { is_expected.to eq(2) } + end + +end diff --git a/environments/production/modules/apt/spec/unit/puppet/type/apt_key_spec.rb b/environments/production/modules/apt/spec/unit/puppet/type/apt_key_spec.rb new file mode 100644 index 0000000..9c2dd91 --- /dev/null +++ b/environments/production/modules/apt/spec/unit/puppet/type/apt_key_spec.rb @@ -0,0 +1,188 @@ +require 'spec_helper' +require 'puppet' + +describe Puppet::Type::type(:apt_key) do + context 'only namevar 32bit key id' do + let(:resource) { Puppet::Type.type(:apt_key).new( + :id => 'EF8D349F' + )} + it 'id is set' do + expect(resource[:id]).to eq 'EF8D349F' + end + + it 'name is set to id' do + expect(resource[:name]).to eq 'EF8D349F' + end + + it 'keyserver is default' do + expect(resource[:server]).to eq :'keyserver.ubuntu.com' + end + + it 'source is not set' do + expect(resource[:source]).to eq nil + end + + it 'content is not set' do + expect(resource[:content]).to eq nil + end + end + + context 'with a lowercase 32bit key id' do + let(:resource) { Puppet::Type.type(:apt_key).new( + :id => 'ef8d349f' + )} + it 'id is set' do + expect(resource[:id]).to eq 'EF8D349F' + end + end + + context 'with a 64bit key id' do + let(:resource) { Puppet::Type.type(:apt_key).new( + :id => 'FFFFFFFFEF8D349F' + )} + it 'id is set' do + expect(resource[:id]).to eq 'FFFFFFFFEF8D349F' + end + end + + context 'with a 0x formatted key id' do + let(:resource) { Puppet::Type.type(:apt_key).new( + :id => '0xEF8D349F' + )} + it 'id is set' do + expect(resource[:id]).to eq 'EF8D349F' + end + end + + context 'with a 0x formatted lowercase key id' do + let(:resource) { Puppet::Type.type(:apt_key).new( + :id => '0xef8d349f' + )} + it 'id is set' do + expect(resource[:id]).to eq 'EF8D349F' + end + end + + context 'with a 0x formatted 64bit key id' do + let(:resource) { Puppet::Type.type(:apt_key).new( + :id => '0xFFFFFFFFEF8D349F' + )} + it 'id is set' do + expect(resource[:id]).to eq 'FFFFFFFFEF8D349F' + end + end + + context 'with source' do + let(:resource) { Puppet::Type.type(:apt_key).new( + :id => 'EF8D349F', + :source => 'http://apt.puppetlabs.com/pubkey.gpg' + )} + + it 'source is set to the URL' do + expect(resource[:source]).to eq 'http://apt.puppetlabs.com/pubkey.gpg' + end + end + + context 'with content' do + let(:resource) { Puppet::Type.type(:apt_key).new( + :id => 'EF8D349F', + :content => 'http://apt.puppetlabs.com/pubkey.gpg' + )} + + it 'content is set to the string' do + expect(resource[:content]).to eq 'http://apt.puppetlabs.com/pubkey.gpg' + end + end + + context 'with keyserver' do + let(:resource) { Puppet::Type.type(:apt_key).new( + :id => 'EF8D349F', + :server => 'http://keyring.debian.org' + )} + + it 'keyserver is set to Debian' do + expect(resource[:server]).to eq 'http://keyring.debian.org' + end + end + + context 'validation' do + it 'raises an error if content and source are set' do + expect { Puppet::Type.type(:apt_key).new( + :id => 'EF8D349F', + :source => 'http://apt.puppetlabs.com/pubkey.gpg', + :content => 'Completely invalid as a GPG key' + )}.to raise_error(/content and source are mutually exclusive/) + end + + it 'raises an error if a weird length key is used' do + expect { Puppet::Type.type(:apt_key).new( + :id => 'FEF8D349F', + :source => 'http://apt.puppetlabs.com/pubkey.gpg', + :content => 'Completely invalid as a GPG key' + )}.to raise_error(/Valid values match/) + end + + it 'raises an error when an invalid URI scheme is used in source' do + expect { Puppet::Type.type(:apt_key).new( + :id => 'EF8D349F', + :source => 'hkp://pgp.mit.edu' + )}.to raise_error(/Valid values match/) + end + + it 'allows the http URI scheme in source' do + expect { Puppet::Type.type(:apt_key).new( + :id => 'EF8D349F', + :source => 'http://pgp.mit.edu' + )}.to_not raise_error + end + + it 'allows the http URI with username and password' do + expect { Puppet::Type.type(:apt_key).new( + :id => '4BD6EC30', + :source => 'http://testme:Password2@pgp.mit.edu' + )}.to_not raise_error + end + + it 'allows the https URI scheme in source' do + expect { Puppet::Type.type(:apt_key).new( + :id => 'EF8D349F', + :source => 'https://pgp.mit.edu' + )}.to_not raise_error + end + + it 'allows the https URI with username and password' do + expect { Puppet::Type.type(:apt_key).new( + :id => 'EF8D349F', + :source => 'https://testme:Password2@pgp.mit.edu' + )}.to_not raise_error + end + + it 'allows the ftp URI scheme in source' do + expect { Puppet::Type.type(:apt_key).new( + :id => 'EF8D349F', + :source => 'ftp://pgp.mit.edu' + )}.to_not raise_error + end + + it 'allows an absolute path in source' do + expect { Puppet::Type.type(:apt_key).new( + :id => 'EF8D349F', + :source => '/path/to/a/file' + )}.to_not raise_error + end + + it 'allows 5-digit ports' do + expect { Puppet::Type.type(:apt_key).new( + :id => 'EF8D349F', + :source => 'http://pgp.mit.edu:12345/key' + )}.to_not raise_error + end + + it 'allows 5-digit ports when using key servers' do + expect { Puppet::Type.type(:apt_key).new( + :id => 'EF8D349F', + :server => 'http://pgp.mit.edu:12345' + )}.to_not raise_error + end + end +end diff --git a/environments/production/modules/apt/templates/15update-stamp.erb b/environments/production/modules/apt/templates/15update-stamp.erb new file mode 100644 index 0000000..14ead83 --- /dev/null +++ b/environments/production/modules/apt/templates/15update-stamp.erb @@ -0,0 +1 @@ +APT::Update::Post-Invoke-Success {"touch /var/lib/apt/periodic/update-success-stamp 2>/dev/null || true";}; diff --git a/environments/production/modules/apt/templates/_conf_header.erb b/environments/production/modules/apt/templates/_conf_header.erb new file mode 100644 index 0000000..bfa365e --- /dev/null +++ b/environments/production/modules/apt/templates/_conf_header.erb @@ -0,0 +1 @@ +// This file is managed by Puppet. DO NOT EDIT. diff --git a/environments/production/modules/apt/templates/_header.erb b/environments/production/modules/apt/templates/_header.erb new file mode 100644 index 0000000..487e581 --- /dev/null +++ b/environments/production/modules/apt/templates/_header.erb @@ -0,0 +1 @@ +# This file is managed by Puppet. DO NOT EDIT. diff --git a/environments/production/modules/apt/templates/conf.erb b/environments/production/modules/apt/templates/conf.erb new file mode 100644 index 0000000..a35d1d4 --- /dev/null +++ b/environments/production/modules/apt/templates/conf.erb @@ -0,0 +1 @@ +<%= @content -%> diff --git a/environments/production/modules/apt/templates/pin.pref.erb b/environments/production/modules/apt/templates/pin.pref.erb new file mode 100644 index 0000000..76936d7 --- /dev/null +++ b/environments/production/modules/apt/templates/pin.pref.erb @@ -0,0 +1,21 @@ +<%- +@pin = "release a=#{@name}" # default value +if @pin_release.length > 0 + options = [] + options.push("a=#{@release}") if @release.length > 0 + options.push("n=#{@codename}") if @codename.length > 0 + options.push("v=#{@release_version}") if @release_version.length > 0 + options.push("c=#{@component}") if @component.length > 0 + options.push("o=#{@originator}") if @originator.length > 0 + options.push("l=#{@label}") if @label.length > 0 + @pin = "release #{options.join(', ')}" +elsif @version.length > 0 + @pin = "version #{@version}" +elsif @origin.length > 0 + @pin = "origin #{@origin}" +end +-%> +Explanation: <%= @_explanation %> +Package: <%= @packages_string %> +Pin: <%= @pin %> +Pin-Priority: <%= @priority %> diff --git a/environments/production/modules/apt/templates/proxy.erb b/environments/production/modules/apt/templates/proxy.erb new file mode 100644 index 0000000..670e3a7 --- /dev/null +++ b/environments/production/modules/apt/templates/proxy.erb @@ -0,0 +1,4 @@ +Acquire::http::proxy "http://<%= @_proxy['host'] %>:<%= @_proxy['port'] %>/"; +<%- if @_proxy['https'] %> +Acquire::https::proxy "https://<%= @_proxy['host'] %>:<%= @_proxy['port'] %>/"; +<%- end -%> diff --git a/environments/production/modules/apt/templates/source.list.erb b/environments/production/modules/apt/templates/source.list.erb new file mode 100644 index 0000000..84cd2cf --- /dev/null +++ b/environments/production/modules/apt/templates/source.list.erb @@ -0,0 +1,9 @@ +# <%= @comment %> +<%- if @_include['deb'] then -%> +deb <%- if @architecture or @_allow_unsigned -%> +[<%- if @architecture %>arch=<%= @architecture %><% end %><%if @architecture and @_allow_unsigned %> <% end%><% if @_allow_unsigned %>trusted=yes<% end %>] <%- end %><%= @location %> <%= @_release %> <%= @repos %> +<%- end -%> +<%- if @_include['src'] then -%> +deb-src <%- if @architecture or @_allow_unsigned -%> +[<%- if @architecture %>arch=<%= @architecture %><% end %><%if @architecture and @_allow_unsigned %> <% end%><% if @_allow_unsigned %>trusted=yes<% end %>] <%- end %><%= @location %> <%= @_release %> <%= @repos %> +<%- end -%> diff --git a/environments/production/modules/concat/CHANGELOG.md b/environments/production/modules/concat/CHANGELOG.md new file mode 100644 index 0000000..68f0f6e --- /dev/null +++ b/environments/production/modules/concat/CHANGELOG.md @@ -0,0 +1,339 @@ +## Supported Release 2.2.1 +### Summary + +This is a backwards compatible bugfix release. + +#### Bugfixes + +- (MODULES-4350) Makes :path the namevar for concat_file +- (MODULES-4351) Prevents the :order parameter from accepting arbitrary values in concat_file +- (MODULES-4352) Restricts the :replace parameter to values accepted by file +- (MODULES-4474) Drops auto requirement of fragments +- (MODULES-3900) Improves error messages in concat::fragment +- Uses the whole fragment title when sorting + +## Supported Release 2.2.0 +### Summary + +This release includes support for Debian 8 and Ubuntu 16.04 in addition to numerous bugfixes. + +#### Features +- Adds Debian 8 support +- Adds Ubuntu 16.04 support + +#### Bugfixes +- Fixes the stdlib lower dependency. +- (MODULES-3027) Fixes escaping the '*' character in tag creation. +- (MODULES-3097) Fixes fragment sorting by alpha +- Correctly propagates 'validate_cmd' parameter to generated file resource +- Correctly escapes disallowed characters in fragment tag creation +- (MODULES-3332) Correct the target path validation +- (MODULES-3463) Properly passes metaparams to generated resource + +## Supported Release 2.1.0 +### Summary + +This is a re-release of concat as a resource type. This release also includes new features and bugfixes on top of the previously YANKED 2.0.1 release. + +#### Features +- Adds the show_diff property. +- Adds the selinux related file params. +- Allows integer UID/GID values to be passed into `$owner` and `$group` + +#### Bugfixes +- Adds a workaround to PUP-1963: generated resources never receiving dependency edges. +- Fixes occassional failure to find directory environment. + +## Supported Release 1.2.5 +### Summary + +Small release for support of newer PE versions. This increments the version of PE in the metadata.json file. + +## 2015-07-21 - Supported Release 1.2.4 +### Summary + +This release includes some ruby path and lint fixes. + +#### Bugfixes +- Use correct ruby path with PE and AIO +- Lint fixes +- Use correct ruby path on FreeBSD +- Test fixes + +## 2015-06-02 - Supported Release 2.0.1 [YANKED] +### Summary + +This is a bugfix release. + +#### Bugfixes +- Fixes dependency graphing with concurrent modification of the same file. +- Fixes handling fragment target. +- Fixes the defaulted force behavior to handle empty concats correctly. + +## 2015-06-02 - Supported Release 1.2.3 +### Summary + +This release includes a README fix to document correct behavior of fragment target parameter. + +#### Bugfixes +- README Fix to correctly document how a fragment $target param should work. + +## 2015-05-12 - Supported Release 2.0.0 [YANKED] +### Summary + +This is a major release. Includes re-implementation of concat to use native Type and Providers, resulting in significantly improved performance and testability. Also includes a bugfix to alpha ordering of fragments. + +#### Features +- Re-implementation of concat to use native Type and Providers. + +#### Bugfixes +- Fixes a bug in alpha ordering of fragments. + +## 2015-05-12 - Supported Release 1.2.2 +### Summary + +This release includes a bugfix. + +#### Bugfixes +- Fixes a bug introduced by MODULES-1700, in handling default retrieval of fragment backup parameter. + +## 2015-04-14 - Supported Release 1.2.1 +### Summary + +This release includes bugfixes, test improvements, and a rewritten README. + +#### Bugfixes + +- Verifies existence of $is_pe before using it. +- Adds validation for $order param to not allow restricted characters. +- Sets the group id on Fragments for versions of Facter that contain the $gid fact. +- Sets the script group to 0 if the script is owned by root. +- Explicitly sets script and concat directories to the same owner and group. +- Re-adds support for fragment backup, so that static compiler can work with filebucket (MODULES-1700). + +## 2015-02-17 - Supported Release 1.2.0 +### Summary + +This release includes a number of bugfixes and adds support for running a validation command when using puppet >= 3.5.0. + +#### Features +- Support running a validation command for Puppet >= 3.5.0 + +#### Bugfixes +- Reset poisoned defaults from Exec +- Use concatfragments.rb on AIX since it doesn't support print0 +- Make sure ruby is in the path for PE (MODULES-1456) +- Fix missing method for check_is_owned_by for windows (MODULES-1764) +- Fix sort by numeric + +## 2014-10-28 - Supported Release 1.1.2 +### Summary + +This release includes bugfixes and test improvements. The module was tested against SLES10 and SLES12 and found to work against those platforms with no module improvements. Metadata was updated to include those as supported platforms. + +#### Bugfixes +- newline didn't work for Windows and Solaris. This has been fixed. +- Install certs on Windows for acceptance tests +- Update tests to work with strict variables (no module updates were required) +- Update tests to work on Windows +- Fix typo in CHANGELOG.md + +## 2014-09-10 - Supported Release 1.1.1 +### Summary + +This is a bugfix release, and the first supported release of the 1.1.x series. + +#### Bugfixes +- Make the `$order` parameter default to a string and be validated as an integer + or a string +- Use the ruby script on Solaris to not break Sol10 support +- Add quotes to the ruby script location for Windows +- Fix typos in README.md +- Make regex in concat::setup case-insensitive to make it work on Windows +- Make sure concat fragments are always replaced +- Fix validation to allow `$backup` to be a boolean +- Remove dependency on stdlib 4.x +- Fix for lack of idempotency with `ensure => 'absent'` +- Fix tests and spec_helper +- Synchronized files for more consistency across modules via modulesync + +## 2014-05-14 - Release 1.1.0 +### Summary + +This release is primarily a bugfix release since 1.1.0-rc1. + +#### Features +- Improved testing, with tests moved to beaker + +#### Bugfixes +- No longer attempts to set fragment owner and mode on Windows +- Fix numeric sorting +- Fix incorrect quoting +- Fix newlines + +## 2014-01-03 - Release 1.1.0-rc1 +### Summary + +This release of concat was 90% written by Joshua Hoblitt, and the module team +would like to thank him for the huge amount of work he put into this release. + +This module deprecates a bunch of old parameters and usage patterns, modernizes +much of the manifest code, simplifies a whole bunch of logic and makes +improvements to almost all parts of the module. + +The other major feature is windows support, courtesy of luisfdez, with an +alternative version of the concat bash script in ruby. We've attempted to +ensure that there are no backwards incompatible changes, all users of 1.0.0 +should be able to use 1.1.0 without any failures, but you may find deprecation +warnings and we'll be aggressively moving for a 2.0 to remove those too. + +For further information on deprecations, please read: +https://github.com/puppetlabs/puppetlabs-concat/blob/master/README.md#api-deprecations + +#### Removed +- Puppet 0.24 support. +- Filebucket backup of all file resources except the target concatenated file. +- Default owner/user/group values. +- Purging of long unused /usr/local/bin/concatfragments.sh + +### Features +- Windows support via a ruby version of the concat bash script. +- Huge amount of acceptance testing work added. +- Documentation (README) completely rewritten. +- New parameters in concat: + - `ensure`: Controls if the file should be present/absent at all. + - Remove requirement to include concat::setup in manifests. + - Made `gnu` parameter deprecated. + - Added parameter validation. + +### Bugfixes + - Ensure concat::setup runs before concat::fragment in all cases. + - Pluginsync references updated for modern Puppet. + - Fix incorrect group parameter. + - Use $owner instead of $id to avoid confusion with $::id + - Compatibility fixes for Puppet 2.7/ruby 1.8.7 + - Use LC_ALL=C instead of LANG=C + - Always exec the concatfragments script as root when running as root. + - Syntax and other cleanup changes. + +## 2014-06-25 - Supported Release 1.0.4 +### Summary + +This release has test fixes. + +#### Features +- Added test support for OSX. + +#### Bugfixes + +#### Known bugs + +* Not supported on Windows. + +## 2014-06-04 - Release 1.0.3 +### Summary + +This release adds compatibility for PE3.3 and fixes tests. + +#### Features +- Added test support for Ubuntu Trusty. + +#### Bugfixes + +#### Known bugs + +*Not supported on Windows. + +## 2014-03-04 - Supported Release 1.0.2 +### Summary + +This is a supported release. No functional changes were made from 1.0.1. + +#### Features +- Huge amount of tests backported from 1.1. +- Documentation rewrite. + +#### Bugfixes + +#### Known Bugs + +* Not supported on Windows. + + +## 2014-02-12 - 1.0.1 +### Summary + +Minor bugfixes for sorting of fragments and ordering of resources. + +#### Bugfixes +- LANG => C replaced with LC_ALL => C to reduce spurious recreation of +fragments. +- Corrected pluginsync documentation. +- Ensure concat::setup always runs before fragments. + + +## 2013-08-09 - 1.0.0 +### Summary + +Many new features and bugfixes in this release, and if you're a heavy concat +user you should test carefully before upgrading. The features should all be +backwards compatible but only light testing has been done from our side before +this release. + +#### Features +- New parameters in concat: + - `replace`: specify if concat should replace existing files. + - `ensure_newline`: controls if fragments should contain a newline at the end. +- Improved README documentation. +- Add rspec:system tests (rake spec:system to test concat) + +#### Bugfixes +- Gracefully handle \n in a fragment resource name. +- Adding more helpful message for 'pluginsync = true' +- Allow passing `source` and `content` directly to file resource, rather than +defining resource defaults. +- Added -r flag to read so that filenames with \ will be read correctly. +- sort always uses LANG=C. +- Allow WARNMSG to contain/start with '#'. +- Replace while-read pattern with for-do in order to support Solaris. + +#### CHANGELOG: +- 2010/02/19 - initial release +- 2010/03/12 - add support for 0.24.8 and newer + - make the location of sort configurable + - add the ability to add shell comment based warnings to + top of files + - add the ablity to create empty files +- 2010/04/05 - fix parsing of WARN and change code style to match rest + of the code + - Better and safer boolean handling for warn and force + - Don't use hard coded paths in the shell script, set PATH + top of the script + - Use file{} to copy the result and make all fragments owned + by root. This means we can chnage the ownership/group of the + resulting file at any time. + - You can specify ensure => "/some/other/file" in concat::fragment + to include the contents of a symlink into the final file. +- 2010/04/16 - Add more cleaning of the fragment name - removing / from the $name +- 2010/05/22 - Improve documentation and show the use of ensure => +- 2010/07/14 - Add support for setting the filebucket behavior of files +- 2010/10/04 - Make the warning message configurable +- 2010/12/03 - Add flags to make concat work better on Solaris - thanks Jonathan Boyett +- 2011/02/03 - Make the shell script more portable and add a config option for root group +- 2011/06/21 - Make base dir root readable only for security +- 2011/06/23 - Set base directory using a fact instead of hardcoding it +- 2011/06/23 - Support operating as non privileged user +- 2011/06/23 - Support dash instead of bash or sh +- 2011/07/11 - Better solaris support +- 2011/12/05 - Use fully qualified variables +- 2011/12/13 - Improve Nexenta support +- 2012/04/11 - Do not use any GNU specific extensions in the shell script +- 2012/03/24 - Comply to community style guides +- 2012/05/23 - Better errors when basedir isnt set +- 2012/05/31 - Add spec tests +- 2012/07/11 - Include concat::setup in concat improving UX +- 2012/08/14 - Puppet Lint improvements +- 2012/08/30 - The target path can be different from the $name +- 2012/08/30 - More Puppet Lint cleanup +- 2012/09/04 - RELEASE 0.2.0 +- 2012/12/12 - Added (file) $replace parameter to concat diff --git a/environments/production/modules/concat/CONTRIBUTING.md b/environments/production/modules/concat/CONTRIBUTING.md new file mode 100644 index 0000000..990edba --- /dev/null +++ b/environments/production/modules/concat/CONTRIBUTING.md @@ -0,0 +1,217 @@ +Checklist (and a short version for the impatient) +================================================= + + * Commits: + + - Make commits of logical units. + + - Check for unnecessary whitespace with "git diff --check" before + committing. + + - Commit using Unix line endings (check the settings around "crlf" in + git-config(1)). + + - Do not check in commented out code or unneeded files. + + - The first line of the commit message should be a short + description (50 characters is the soft limit, excluding ticket + number(s)), and should skip the full stop. + + - Associate the issue in the message. The first line should include + the issue number in the form "(#XXXX) Rest of message". + + - The body should provide a meaningful commit message, which: + + - uses the imperative, present tense: "change", not "changed" or + "changes". + + - includes motivation for the change, and contrasts its + implementation with the previous behavior. + + - Make sure that you have tests for the bug you are fixing, or + feature you are adding. + + - Make sure the test suites passes after your commit: + `bundle exec rspec spec/acceptance` More information on [testing](#Testing) below + + - When introducing a new feature, make sure it is properly + documented in the README.md + + * Submission: + + * Pre-requisites: + + - Make sure you have a [GitHub account](https://github.com/join) + + - [Create a ticket](https://tickets.puppet.com/secure/CreateIssue!default.jspa), or [watch the ticket](https://tickets.puppet.com/browse/) you are patching for. + + * Preferred method: + + - Fork the repository on GitHub. + + - Push your changes to a topic branch in your fork of the + repository. (the format ticket/1234-short_description_of_change is + usually preferred for this project). + + - Submit a pull request to the repository in the puppetlabs + organization. + +The long version +================ + + 1. Make separate commits for logically separate changes. + + Please break your commits down into logically consistent units + which include new or changed tests relevant to the rest of the + change. The goal of doing this is to make the diff easier to + read for whoever is reviewing your code. In general, the easier + your diff is to read, the more likely someone will be happy to + review it and get it into the code base. + + If you are going to refactor a piece of code, please do so as a + separate commit from your feature or bug fix changes. + + We also really appreciate changes that include tests to make + sure the bug is not re-introduced, and that the feature is not + accidentally broken. + + Describe the technical detail of the change(s). If your + description starts to get too long, that is a good sign that you + probably need to split up your commit into more finely grained + pieces. + + Commits which plainly describe the things which help + reviewers check the patch and future developers understand the + code are much more likely to be merged in with a minimum of + bike-shedding or requested changes. Ideally, the commit message + would include information, and be in a form suitable for + inclusion in the release notes for the version of Puppet that + includes them. + + Please also check that you are not introducing any trailing + whitespace or other "whitespace errors". You can do this by + running "git diff --check" on your changes before you commit. + + 2. Sending your patches + + To submit your changes via a GitHub pull request, we _highly_ + recommend that you have them on a topic branch, instead of + directly on "master". + It makes things much easier to keep track of, especially if + you decide to work on another thing before your first change + is merged in. + + GitHub has some pretty good + [general documentation](http://help.github.com/) on using + their site. They also have documentation on + [creating pull requests](http://help.github.com/send-pull-requests/). + + In general, after pushing your topic branch up to your + repository on GitHub, you can switch to the branch in the + GitHub UI and click "Pull Request" towards the top of the page + in order to open a pull request. + + + 3. Update the related GitHub issue. + + If there is a GitHub issue associated with the change you + submitted, then you should update the ticket to include the + location of your branch, along with any other commentary you + may wish to make. + +Testing +======= + +Getting Started +--------------- + +Our puppet modules provide [`Gemfile`](./Gemfile)s which can tell a ruby +package manager such as [bundler](http://bundler.io/) what Ruby packages, +or Gems, are required to build, develop, and test this software. + +Please make sure you have [bundler installed](http://bundler.io/#getting-started) +on your system, then use it to install all dependencies needed for this project, +by running + +```shell +% bundle install +Fetching gem metadata from https://rubygems.org/........ +Fetching gem metadata from https://rubygems.org/.. +Using rake (10.1.0) +Using builder (3.2.2) +-- 8><-- many more --><8 -- +Using rspec-system-puppet (2.2.0) +Using serverspec (0.6.3) +Using rspec-system-serverspec (1.0.0) +Using bundler (1.3.5) +Your bundle is complete! +Use `bundle show [gemname]` to see where a bundled gem is installed. +``` + +NOTE some systems may require you to run this command with sudo. + +If you already have those gems installed, make sure they are up-to-date: + +```shell +% bundle update +``` + +With all dependencies in place and up-to-date we can now run the tests: + +```shell +% bundle exec rake spec +``` + +This will execute all the [rspec tests](http://rspec-puppet.com/) tests +under [spec/defines](./spec/defines), [spec/classes](./spec/classes), +and so on. rspec tests may have the same kind of dependencies as the +module they are testing. While the module defines in its [Modulefile](./Modulefile), +rspec tests define them in [.fixtures.yml](./fixtures.yml). + +Some puppet modules also come with [beaker](https://github.com/puppetlabs/beaker) +tests. These tests spin up a virtual machine under +[VirtualBox](https://www.virtualbox.org/)) with, controlling it with +[Vagrant](http://www.vagrantup.com/) to actually simulate scripted test +scenarios. In order to run these, you will need both of those tools +installed on your system. + +You can run them by issuing the following command + +```shell +% bundle exec rake spec_clean +% bundle exec rspec spec/acceptance +``` + +This will now download a pre-fabricated image configured in the [default node-set](./spec/acceptance/nodesets/default.yml), +install puppet, copy this module and install its dependencies per [spec/spec_helper_acceptance.rb](./spec/spec_helper_acceptance.rb) +and then run all the tests under [spec/acceptance](./spec/acceptance). + +Writing Tests +------------- + +XXX getting started writing tests. + +If you have commit access to the repository +=========================================== + +Even if you have commit access to the repository, you will still need to +go through the process above, and have someone else review and merge +in your changes. The rule is that all changes must be reviewed by a +developer on the project (that did not write the code) to ensure that +all changes go through a code review process. + +Having someone other than the author of the topic branch recorded as +performing the merge is the record that they performed the code +review. + + +Additional Resources +==================== + +* [Getting additional help](http://puppet.com/community/get-help) + +* [Writing tests](https://docs.puppet.com/guides/module_guides/bgtm.html#step-three-module-testing) + +* [General GitHub documentation](http://help.github.com/) + +* [GitHub pull request documentation](http://help.github.com/send-pull-requests/) diff --git a/environments/production/modules/concat/Gemfile b/environments/production/modules/concat/Gemfile new file mode 100644 index 0000000..5dfff2d --- /dev/null +++ b/environments/production/modules/concat/Gemfile @@ -0,0 +1,156 @@ +#This file is generated by ModuleSync, do not edit. + +source ENV['GEM_SOURCE'] || "https://rubygems.org" + +# Determines what type of gem is requested based on place_or_version. +def gem_type(place_or_version) + if place_or_version =~ /^git:/ + :git + elsif place_or_version =~ /^file:/ + :file + else + :gem + end +end + +# Find a location or specific version for a gem. place_or_version can be a +# version, which is most often used. It can also be git, which is specified as +# `git://somewhere.git#branch`. You can also use a file source location, which +# is specified as `file://some/location/on/disk`. +def location_for(place_or_version, fake_version = nil) + if place_or_version =~ /^(git[:@][^#]*)#(.*)/ + [fake_version, { :git => $1, :branch => $2, :require => false }].compact + elsif place_or_version =~ /^file:\/\/(.*)/ + ['>= 0', { :path => File.expand_path($1), :require => false }] + else + [place_or_version, { :require => false }] + end +end + +# Used for gem conditionals +supports_windows = true +ruby_version_segments = Gem::Version.new(RUBY_VERSION.dup).segments +minor_version = "#{ruby_version_segments[0]}.#{ruby_version_segments[1]}" + +# The following gems are not included by default as they require DevKit on Windows. +# You should probably include them in a Gemfile.local or a ~/.gemfile +#gem 'pry' #this may already be included in the gemfile +#gem 'pry-stack_explorer', :require => false +#if RUBY_VERSION =~ /^2/ +# gem 'pry-byebug' +#else +# gem 'pry-debugger' +#end + +group :development do + gem "puppet-module-posix-default-r#{minor_version}", :require => false, :platforms => "ruby" + gem "puppet-module-win-default-r#{minor_version}", :require => false, :platforms => ["mswin", "mingw", "x64_mingw"] + gem "puppet-module-posix-dev-r#{minor_version}", :require => false, :platforms => "ruby" + gem "puppet-module-win-dev-r#{minor_version}", :require => false, :platforms => ["mswin", "mingw", "x64_mingw"] + gem "json_pure", '<= 2.0.1', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem "fast_gettext", '1.1.0', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.1.0') + gem "fast_gettext", :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.1.0') +end + +group :system_tests do + gem "puppet-module-posix-system-r#{minor_version}", :require => false, :platforms => "ruby" + gem "puppet-module-win-system-r#{minor_version}", :require => false, :platforms => ["mswin", "mingw", "x64_mingw"] + gem "beaker", *location_for(ENV['BEAKER_VERSION'] || '>= 3') + gem "beaker-pe", :require => false + gem "beaker-rspec", *location_for(ENV['BEAKER_RSPEC_VERSION']) + gem "beaker-hostgenerator", *location_for(ENV['BEAKER_HOSTGENERATOR_VERSION']) + gem "beaker-abs", *location_for(ENV['BEAKER_ABS_VERSION'] || '~> 0.1') +end + +gem 'puppet', *location_for(ENV['PUPPET_GEM_VERSION']) + +# Only explicitly specify Facter/Hiera if a version has been specified. +# Otherwise it can lead to strange bundler behavior. If you are seeing weird +# gem resolution behavior, try setting `DEBUG_RESOLVER` environment variable +# to `1` and then run bundle install. +gem 'facter', *location_for(ENV['FACTER_GEM_VERSION']) if ENV['FACTER_GEM_VERSION'] +gem 'hiera', *location_for(ENV['HIERA_GEM_VERSION']) if ENV['HIERA_GEM_VERSION'] + +# For Windows dependencies, these could be required based on the version of +# Puppet you are requiring. Anything greater than v3.5.0 is going to have +# Windows-specific dependencies dictated by the gem itself. The other scenario +# is when you are faking out Puppet to use a local file path / git path. +explicitly_require_windows_gems = false +puppet_gem_location = gem_type(ENV['PUPPET_GEM_VERSION']) +# This is not a perfect answer to the version check +if puppet_gem_location != :gem || (ENV['PUPPET_GEM_VERSION'] && Gem::Version.correct?(ENV['PUPPET_GEM_VERSION']) && Gem::Requirement.new('< 3.5.0').satisfied_by?(Gem::Version.new(ENV['PUPPET_GEM_VERSION'].dup))) + if Gem::Platform.local.os == 'mingw32' + explicitly_require_windows_gems = true + end + if puppet_gem_location == :gem + # If facterversion hasn't been specified and we are + # looking for a Puppet Gem version less than 3.5.0, we + # need to ensure we get a good Facter for specs. + gem "facter",">= 1.6.11","<= 1.7.5",:require => false unless ENV['FACTER_GEM_VERSION'] + # If hieraversion hasn't been specified and we are + # looking for a Puppet Gem version less than 3.5.0, we + # need to ensure we get a good Hiera for specs. + gem "hiera",">= 1.0.0","<= 1.3.0",:require => false unless ENV['HIERA_GEM_VERSION'] + end +end + +if explicitly_require_windows_gems + # This also means Puppet Gem less than 3.5.0 - this has been tested back + # to 3.0.0. Any further back is likely not supported. + if puppet_gem_location == :gem + gem "ffi", "1.9.0", :require => false + gem "win32-eventlog", "0.5.3","<= 0.6.5", :require => false + gem "win32-process", "0.6.5","<= 0.7.5", :require => false + gem "win32-security", "~> 0.1.2","<= 0.2.5", :require => false + gem "win32-service", "0.7.2","<= 0.8.8", :require => false + gem "minitar", "0.5.4", :require => false + else + gem "ffi", "~> 1.9.0", :require => false + gem "win32-eventlog", "~> 0.5","<= 0.6.5", :require => false + gem "win32-process", "~> 0.6","<= 0.7.5", :require => false + gem "win32-security", "~> 0.1","<= 0.2.5", :require => false + gem "win32-service", "~> 0.7","<= 0.8.8", :require => false + gem "minitar", "~> 0.5.4", :require => false + end + + gem "win32-dir", "~> 0.3","<= 0.4.9", :require => false + gem "win32console", "1.3.2", :require => false if RUBY_VERSION =~ /^1\./ + + # sys-admin was removed in Puppet 3.7.0+, and doesn't compile + # under Ruby 2.3 - so restrict it to Ruby 1.x + gem "sys-admin", "1.5.6", :require => false if RUBY_VERSION =~ /^1\./ + + # Puppet less than 3.7.0 requires these. + # Puppet 3.5.0+ will control the actual requirements. + # These are listed in formats that work with all versions of + # Puppet from 3.0.0 to 3.6.x. After that, these were no longer used. + # We do not want to allow newer versions than what came out after + # 3.6.x to be used as they constitute some risk in breaking older + # functionality. So we set these to exact versions. + gem "win32-api", "1.4.8", :require => false + gem "win32-taskscheduler", "0.2.2", :require => false + gem "windows-api", "0.4.3", :require => false + gem "windows-pr", "1.2.3", :require => false +else + if Gem::Platform.local.os == 'mingw32' + # If we're using a Puppet gem on windows, which handles its own win32-xxx gem dependencies (Pup 3.5.0 and above), set maximum versions + # Required due to PUP-6445 + gem "win32-dir", "<= 0.4.9", :require => false + gem "win32-eventlog", "<= 0.6.5", :require => false + gem "win32-process", "<= 0.7.5", :require => false + gem "win32-security", "<= 0.2.5", :require => false + gem "win32-service", "<= 0.8.8", :require => false + end +end + +# Evaluate Gemfile.local if it exists +if File.exists? "#{__FILE__}.local" + eval(File.read("#{__FILE__}.local"), binding) +end + +# Evaluate ~/.gemfile if it exists +if File.exists?(File.join(Dir.home, '.gemfile')) + eval(File.read(File.join(Dir.home, '.gemfile')), binding) +end + +# vim:ft=ruby diff --git a/environments/production/modules/concat/LICENSE b/environments/production/modules/concat/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/environments/production/modules/concat/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/environments/production/modules/concat/MAINTAINERS.md b/environments/production/modules/concat/MAINTAINERS.md new file mode 100644 index 0000000..4cc8eec --- /dev/null +++ b/environments/production/modules/concat/MAINTAINERS.md @@ -0,0 +1,6 @@ +## Maintenance + +Maintainers: + - Puppet Forge Modules Team `forge-modules |at| puppet |dot| com` + +Tickets: https://tickets.puppet.com/browse/MODULES. Make sure to set component to `concat`. diff --git a/environments/production/modules/concat/NOTICE b/environments/production/modules/concat/NOTICE new file mode 100644 index 0000000..89dd0b5 --- /dev/null +++ b/environments/production/modules/concat/NOTICE @@ -0,0 +1,15 @@ +Puppet Module - puppetlabs-concat + +Copyright 2017 Puppet, Inc. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. \ No newline at end of file diff --git a/environments/production/modules/concat/README.md b/environments/production/modules/concat/README.md new file mode 100644 index 0000000..56caa31 --- /dev/null +++ b/environments/production/modules/concat/README.md @@ -0,0 +1,360 @@ +# concat + +#### Table of Contents + +1. [Overview](#overview) +2. [Module Description - What the module does and why it is useful](#module-description) +3. [Setup - The basics of getting started with concat](#setup) + * [What concat affects](#what-concat-affects) + * [Beginning with concat](#beginning-with-concat) +4. [Usage - Configuration options and additional functionality](#usage) +5. [Reference - An under-the-hood peek at what the module is doing and how](#reference) + * [Defines](#defines) + * [Parameters](#parameters) + * [Removed functionality](#removed-functionality) +6. [Limitations - OS compatibility, etc.](#limitations) +7. [Development - Guide for contributing to the module](#development) + +## Overview + +The concat module lets you construct files from multiple ordered fragments of text. + +## Module Description + +The concat module lets you gather `concat::fragment` resources from your other modules and order them into a coherent file through a single `concat` resource. + +### Beginning with concat + +To start using concat you need to create: + +* A concat{} resource for the final file. +* One or more concat::fragment{}s. + +A minimal example might be: + +~~~ +concat { '/tmp/file': + ensure => present, +} + +concat::fragment { 'tmpfile': + target => '/tmp/file', + content => 'test contents', + order => '01' +} +~~~ + +## Usage + +### Maintain a list of the major modules on a node + +To maintain an motd file that lists the modules on one of your nodes, first create a class to frame up the file: + +~~~ +class motd { + $motd = '/etc/motd' + + concat { $motd: + owner => 'root', + group => 'root', + mode => '0644' + } + + concat::fragment{ 'motd_header': + target => $motd, + content => "\nPuppet modules on this server:\n\n", + order => '01' + } + + # let local users add to the motd by creating a file called + # /etc/motd.local + concat::fragment{ 'motd_local': + target => $motd, + source => '/etc/motd.local', + order => '15' + } +} + +# let other modules register themselves in the motd +define motd::register($content="", $order='10') { + if $content == "" { + $body = $name + } else { + $body = $content + } + + concat::fragment{ "motd_fragment_$name": + target => '/etc/motd', + order => $order, + content => " -- $body\n" + } +} +~~~ + +Then, in the declarations for each module on the node, add `motd::register{ 'Apache': }` to register the module in the motd. + +~~~ +class apache { + include apache::install, apache::config, apache::service + + motd::register{ 'Apache': } +} +~~~ + +These two steps populate the /etc/motd file with a list of the installed and registered modules, which stays updated even if you just remove the registered modules' `include` lines. System administrators can append text to the list by writing to /etc/motd.local. + +When you're finished, the motd file will look something like this: + +~~~ + Puppet modules on this server: + + -- Apache + -- MySQL + + +~~~ + +## Reference + +### Defines +* `concat`: Manages a file, compiled from one or more text fragments. +* `concat::fragment`: Manages a fragment of text to be compiled into a file. + +### Types +* `concat_file`: Generates a file with content from fragments sharing a common unique tag. +* `concat_fragment`: Manages the fragment. + +### Parameters + +#### Define: `concat` + +All the parameters listed below are optional. + +##### `backup` + +Specifies whether (and how) to back up the destination file before overwriting it. Your value gets passed on to Puppet's [native `file` resource](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-backup) for execution. Valid options: 'true', 'false', or a string representing either a target filebucket or a filename extension beginning with ".". Default value: 'puppet'. + +##### `backup_fragments` + +Specifies whether to backup concat fragments using the backup setting of the target concat file. Valid options: 'true' and 'false'. Default value: 'false'. + +##### `ensure` + +Specifies whether the destination file should exist. Setting to 'absent' tells Puppet to delete the destination file if it exists, and negates the effect of any other parameters. Valid options: 'present' and 'absent'. Default value: 'present'. + +##### `ensure_newline` + +Specifies whether to add a line break at the end of each fragment that doesn't already end in one. Valid options: 'true' and 'false'. Default value: 'false'. + +##### `force` + +Deprecated as of concat v2.0.0. Has no effect. + +##### `group` + +Specifies a permissions group for the destination file. Valid options: a string containing a group name. Default value: undefined. + +##### `mode` + +Specifies the permissions mode of the destination file. Valid options: a string containing a permission mode value in octal notation. Default value: '0644'. + +##### `order` + +Specifies a method for sorting your fragments by name within the destination file. Valid options: 'alpha' (e.g., '1, 10, 2') or 'numeric' (e.g., '1, 2, 10'). Default value: 'alpha'. + +You can override this setting for individual fragments by adjusting the `order` parameter in their `concat::fragment` declarations. + +##### `owner` + +Specifies the owner of the destination file. Valid options: a string containing a username. Default value: undefined. + +##### `path` + +Specifies a destination file for the combined fragments. Valid options: a string containing an absolute path. Default value: the title of your declared resource. + +##### `replace` + +Specifies whether to overwrite the destination file if it already exists. Valid options: 'true' and 'false'. Default value: 'true'. + +##### `show_diff` + +Specifies whether to set the show_diff parameter for the file resource. Useful for hiding secrets stored in hiera from insecure reporting methods. Valid options: 'true'. + +##### `validate_cmd` + +Specifies a validation command to apply to the destination file. Requires Puppet version 3.5 or newer. Valid options: a string to be passed to a file resource. Default value: undefined. + +##### `warn` + +Specifies whether to add a header message at the top of the destination file. Valid options: the booleans 'true' and 'false', or a string to serve as the header. Default value: 'false'. + +If you set 'warn' to 'true', `concat` adds the following line with an `order` of `0`: + +~~~ +# This file is managed by Puppet. DO NOT EDIT. +~~~ + +Before 2.0.0, this parameter would add a newline at the end of the warn +message. To improve flexibilty, this was removed. Please add it explicitly if +you need it. + +##### `selinux_ignore_defaults` + +See the `file` type's +[`selinux_ignore_defaults`](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-selinux_ignore_defaults) +documentention. + +##### `selrange` + +See the `file` type's +[`selrange`](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-selrange) +documentention. + +##### `selrole` + +See the `file` type's +[`selrole`](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-selrole) +documentention. + +##### `seltype` + +See the `file` type's +[`seltype`](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-seltype) +documentention. + +##### `seluser` + +See the `file` type's +[`seluser`](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-seluser) +documentention. + + +#### Define: `concat::fragment` + +Except where noted, all the below parameters are optional. + +##### `content` + +Supplies the content of the fragment. **Note**: You must supply either a `content` parameter or a `source` parameter. Valid options: a string. Default value: undef. + +##### `ensure` + +Deprecated as of concat v2.0.0. Has no effect. + +##### `order` + +Reorders your fragments within the destination file. Fragments that share the same order number are ordered by name. Valid options: a string (recommended) or an integer. Default value: '10'. + +##### `source` + +Specifies a file to read into the content of the fragment. **Note**: You must supply either a `content` parameter or a `source` parameter. Valid options: a string or an array, containing one or more Puppet URLs. Default value: undefined. + +##### `target` + +*Required.* Specifies the destination file of the fragment. Valid options: a string containing the path or title of the parent `concat` resource. + + +#### Type: `concat_file` + +##### `backup` + +Specifies whether (and how) to back up the destination file before overwriting it. Your value gets passed on to Puppet's [native `file` resource](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-backup) for execution. Valid options: 'true', 'false', or a string representing either a target filebucket or a filename extension beginning with ".". Default value: 'puppet'. + +##### `ensure` + +Specifies whether the destination file should exist. Setting to 'absent' tells Puppet to delete the destination file if it exists, and negates the effect of any other parameters. Valid options: 'present' and 'absent'. Default value: 'present'. + +##### `ensure_newline` + +Specifies whether to add a line break at the end of each fragment that doesn't already end in one. Valid options: 'true' and 'false'. Default value: 'false'. + +##### `group` + +Specifies a permissions group for the destination file. Valid options: a string containing a group name. Default value: undefined. + +##### `mode` + +Specifies the permissions mode of the destination file. Valid options: a string containing a permission mode value in octal notation. Default value: '0644'. + +##### `order` + +Specifies a method for sorting your fragments by name within the destination file. Valid options: 'alpha' (e.g., '1, 10, 2') or 'numeric' (e.g., '1, 2, 10'). Default value: 'numeric'. + +You can override this setting for individual fragments by adjusting the `order` parameter in their `concat::fragment` declarations. + +##### `owner` + +Specifies the owner of the destination file. Valid options: a string containing a username. Default value: undefined. + +##### `path` + +Specifies a destination file for the combined fragments. Valid options: a string containing an absolute path. Default value: the title of your declared resource. + +##### `replace` + +Specifies whether to overwrite the destination file if it already exists. Valid options: 'true' and 'false'. Default value: 'true'. + +#### `tag` + +*Required.* Specifies a unique tag reference to collect all concat_fragments with the same tag. + +#####` validate_cmd` + +Specifies a validation command to apply to the destination file. Requires Puppet version 3.5 or newer. Valid options: a string to be passed to a file resource. Default value: undefined. + +#### Type: `concat_fragment` + +##### `content` + +Supplies the content of the fragment. **Note**: You must supply either a `content` parameter or a `source` parameter. Valid options: a string. Default value: undef. + +##### `order` + +Reorders your fragments within the destination file. Fragments that share the same order number are ordered by name. Valid options: a string (recommended) or an integer. Default value: '10'. + +##### `source` + +Specifies a file to read into the content of the fragment. **Note**: You must supply either a `content` parameter or a `source` parameter. Valid options: a string or an array, containing one or more Puppet URLs. Default value: undefined. + +##### `tag` + +*Required.* Specifies a unique tag to be used by concat_file to reference and collect content. + +##### `target` + +*Required.* Specifies the destination file of the fragment. Valid options: a string containing the path or title of the parent `concat_file` resource. + +### Removed functionality + +The following functionality existed in previous versions of the concat module, but was removed in version 2.0.0: + +Parameters removed from `concat::fragment`: +* `gnu` +* `backup` +* `group` +* `mode` +* `owner` + +The `concat::setup` class has also been removed. + +Prior to concat version 2.0.0, if you set the `warn` parameter to a string value of 'true', 'false', 'yes', 'no', 'on', or 'off', the module translated the string to the corresponding boolean value. In concat version 2.0.0 and newer, the `warn_header` parameter treats those values the same as other strings and uses them as the content of your header message. To avoid that, pass the 'true' and 'false' values as booleans instead of strings. + +## Limitations + +This module has been tested on [all PE-supported platforms](https://forge.puppetlabs.com/supported#compat-matrix), and no issues have been identified. + +## Development + +Puppet modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can't access the huge number of platforms and myriad of hardware, software, and deployment configurations that Puppet is intended to serve. + +We want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things. + +For more information, see our [module contribution guide.](https://docs.puppetlabs.com/forge/contributing.html) + +### Contributors + +Richard Pijnenburg ([@Richardp82](http://twitter.com/richardp82)) + +Joshua Hoblitt ([@jhoblitt](http://twitter.com/jhoblitt)) + +[More contributors.](https://github.com/puppetlabs/puppetlabs-concat/graphs/contributors) diff --git a/environments/production/modules/concat/Rakefile b/environments/production/modules/concat/Rakefile new file mode 100644 index 0000000..d12d854 --- /dev/null +++ b/environments/production/modules/concat/Rakefile @@ -0,0 +1,37 @@ +require 'puppetlabs_spec_helper/rake_tasks' +require 'puppet-lint/tasks/puppet-lint' +require 'puppet_blacksmith/rake_tasks' if Bundler.rubygems.find_name('puppet-blacksmith').any? + +PuppetLint.configuration.fail_on_warnings = true +PuppetLint.configuration.send('relative') + +desc 'Generate pooler nodesets' +task :gen_nodeset do + require 'beaker-hostgenerator' + require 'securerandom' + require 'fileutils' + + agent_target = ENV['TEST_TARGET'] + if ! agent_target + STDERR.puts 'TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat-64default."' + agent_target = 'redhat-64default.' + end + + master_target = ENV['MASTER_TEST_TARGET'] + if ! master_target + STDERR.puts 'MASTER_TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat7-64mdcl"' + master_target = 'redhat7-64mdcl' + end + + targets = "#{master_target}-#{agent_target}" + cli = BeakerHostGenerator::CLI.new([targets]) + nodeset_dir = "tmp/nodesets" + nodeset = "#{nodeset_dir}/#{targets}-#{SecureRandom.uuid}.yaml" + FileUtils.mkdir_p(nodeset_dir) + File.open(nodeset, 'w') do |fh| + fh.print(cli.execute) + end + puts nodeset +end diff --git a/environments/production/modules/concat/appveyor.yml b/environments/production/modules/concat/appveyor.yml new file mode 100644 index 0000000..39ca16e --- /dev/null +++ b/environments/production/modules/concat/appveyor.yml @@ -0,0 +1,38 @@ +version: 1.1.x.{build} +skip_commits: + message: /^\(?doc\)?.*/ +clone_depth: 10 +init: +- SET +- 'mkdir C:\ProgramData\PuppetLabs\code && exit 0' +- 'mkdir C:\ProgramData\PuppetLabs\facter && exit 0' +- 'mkdir C:\ProgramData\PuppetLabs\hiera && exit 0' +- 'mkdir C:\ProgramData\PuppetLabs\puppet\var && exit 0' +environment: + matrix: + - PUPPET_GEM_VERSION: ~> 4.0 + RUBY_VER: 21 + - PUPPET_GEM_VERSION: ~> 4.0 + RUBY_VER: 21-x64 + - PUPPET_GEM_VERSION: ~> 4.0 + RUBY_VER: 23 + - PUPPET_GEM_VERSION: ~> 4.0 + RUBY_VER: 23-x64 +matrix: + fast_finish: true +install: +- SET PATH=C:\Ruby%RUBY_VER%\bin;%PATH% +- bundle install --jobs 4 --retry 2 --without system_tests +- type Gemfile.lock +build: off +test_script: +- bundle exec puppet -V +- ruby -v +- bundle exec rake spec SPEC_OPTS='--format documentation' +notifications: +- provider: Email + to: + - nobody@nowhere.com + on_build_success: false + on_build_failure: false + on_build_status_changed: false diff --git a/environments/production/modules/concat/checksums.json b/environments/production/modules/concat/checksums.json new file mode 100644 index 0000000..b93ef17 --- /dev/null +++ b/environments/production/modules/concat/checksums.json @@ -0,0 +1,45 @@ +{ + "CHANGELOG.md": "1b2b91c4e885b62b4eef130607f0e546", + "CONTRIBUTING.md": "77d0440d7cd4206497f99065c60bed46", + "Gemfile": "424b47eb0cccebbdb5f9de35eebee23f", + "LICENSE": "3b83ef96387f14655fc854ddc3c6bd57", + "MAINTAINERS.md": "c7098fb93e4b0bbeda9e9e2baf2b6476", + "NOTICE": "4a364fe76a22fc737554e108567f5602", + "README.md": "ab1eb8a6e051bb24502be869a8cc2884", + "Rakefile": "3851f083966b9bbd6d46e50dba5aa52a", + "appveyor.yml": "9b63832ea6e33639c858898d6fd22006", + "examples/fragment.pp": "01096a870ef7d1a1425999745f64cc2d", + "examples/init.pp": "356477e6c25394550886bf1c1edb72a4", + "lib/puppet/type/concat_file.rb": "e7b02f157ef1d05bff5c9eb7e05a7772", + "lib/puppet/type/concat_fragment.rb": "3203ea0608a63551676dea9ed53de110", + "locales/config.yaml": "29ee1ea8ad1de5805229f70b552c8d95", + "manifests/fragment.pp": "e8aea5a8c56ee0a3b6e0d2975a3ed20c", + "manifests/init.pp": "692f51d75240196ad06d1642ba59003b", + "metadata.json": "6cb693fc2063117cae21f1958b11a1c3", + "spec/acceptance/backup_spec.rb": "242ce4dce1efba5efb21850b9bb2a342", + "spec/acceptance/concat_spec.rb": "80fdb7d63a419b6bb9f9f42bc217171e", + "spec/acceptance/concurrency_spec.rb": "53984b19ec3a34d7084d7796f98f6857", + "spec/acceptance/fragment_source_spec.rb": "85deac6d359ffffd363c0e96bab173b3", + "spec/acceptance/fragments_are_always_replaced_spec.rb": "be39ed9ed30e7bb48aaccda2d7f730ac", + "spec/acceptance/newline_spec.rb": "5aaf65972c4f8ed4fd1592cd863583f5", + "spec/acceptance/nodesets/centos-7-x64.yml": "a713f3abd3657f0ae2878829badd23cd", + "spec/acceptance/nodesets/debian-8-x64.yml": "d2d2977900989f30086ad251a14a1f39", + "spec/acceptance/nodesets/default.yml": "a77662a1375bdf0dde4ed6bd798f2f45", + "spec/acceptance/nodesets/docker/centos-7.yml": "8a3892807bdd62306ae4774f41ba11ae", + "spec/acceptance/nodesets/docker/debian-8.yml": "ac8e871d1068c96de5e85a89daaec6df", + "spec/acceptance/nodesets/docker/ubuntu-14.04.yml": "dc42ee922a96908d85b8f0f08203ce58", + "spec/acceptance/order_spec.rb": "14e739dc02b4a4b48c5ed4d2c9bf1d17", + "spec/acceptance/pup-1963_spec.rb": "71e8a59d674f7a1dafeeba87438a0ca9", + "spec/acceptance/quoted_paths_spec.rb": "9cce52e33e894f10847b986f1d6e56d2", + "spec/acceptance/replace_spec.rb": "f0c42c610e53fc9739581d99a3cd94b0", + "spec/acceptance/specinfra_stubs.rb": "27839261403d8bbccf506552f9d8ef38", + "spec/acceptance/symbolic_name_spec.rb": "b40452adbfebb0ea9d56547d9daee700", + "spec/acceptance/validation_spec.rb": "e54226b10f46cfa9e89e57398eddbbd2", + "spec/acceptance/warn_header_spec.rb": "269e9329646674ec6975c34e0c58e8c1", + "spec/acceptance/warnings_spec.rb": "99fd93c1df5bdf952b37bd8926ad4868", + "spec/spec_helper.rb": "b2db3bc02b4ac2fd5142a6621c641b07", + "spec/spec_helper_acceptance.rb": "c1b41c181bd36836658643af1d2a9b2e", + "spec/unit/defines/concat_fragment_spec.rb": "1d5b4c3aa0928dc3033762090f9af87c", + "spec/unit/defines/concat_spec.rb": "32e6ef5e3b03d4cd12a0dfff1f3ebc80", + "spec/unit/type/concat_file_spec.rb": "b9671fa2de84ca8b4137cd6aaba8e796" +} \ No newline at end of file diff --git a/environments/production/modules/concat/examples/fragment.pp b/environments/production/modules/concat/examples/fragment.pp new file mode 100644 index 0000000..16bf3b6 --- /dev/null +++ b/environments/production/modules/concat/examples/fragment.pp @@ -0,0 +1,20 @@ +concat { 'testconcat': + ensure => present, + path => '/tmp/concat', + owner => 'root', + group => 'root', + mode => '0664', + show_diff => true, +} + +concat::fragment { '1': + target => 'testconcat', + content => '1', + order => '01', +} + +concat::fragment { '2': + target => 'testconcat', + content => '2', + order => '02', +} diff --git a/environments/production/modules/concat/examples/init.pp b/environments/production/modules/concat/examples/init.pp new file mode 100644 index 0000000..c7f1934 --- /dev/null +++ b/environments/production/modules/concat/examples/init.pp @@ -0,0 +1,6 @@ +concat { '/tmp/concat': + ensure => present, + owner => 'root', + group => 'root', + mode => '0644', +} diff --git a/environments/production/modules/concat/lib/puppet/type/concat_file.rb b/environments/production/modules/concat/lib/puppet/type/concat_file.rb new file mode 100644 index 0000000..359c963 --- /dev/null +++ b/environments/production/modules/concat/lib/puppet/type/concat_file.rb @@ -0,0 +1,212 @@ +require 'puppet/type/file/owner' +require 'puppet/type/file/group' +require 'puppet/type/file/mode' +require 'puppet/util/checksums' + +Puppet::Type.newtype(:concat_file) do + @doc = "Gets all the file fragments and puts these into the target file. + This will mostly be used with exported resources. + + example: + Concat_fragment <<| tag == 'unique_tag' |>> + + concat_file { '/tmp/file': + tag => 'unique_tag', # Mandatory + path => '/tmp/file', # Optional. If given it overrides the resource name + owner => 'root', # Optional. Default to undef + group => 'root', # Optional. Default to undef + mode => '0644' # Optional. Default to undef + order => 'numeric' # Optional, Default to 'numeric' + ensure_newline => false # Optional, Defaults to false + } + " + + ensurable do + defaultvalues + + defaultto { :present } + end + + def exists? + self[:ensure] == :present + end + + newparam(:tag) do + desc "Tag reference to collect all concat_fragment's with the same tag" + end + + newparam(:path, :namevar => true) do + desc "The output file" + + validate do |value| + unless (Puppet::Util.absolute_path?(value, :posix) or Puppet::Util.absolute_path?(value, :windows)) + raise ArgumentError, "File paths must be fully qualified, not '#{value}'" + end + end + end + + newparam(:owner, :parent => Puppet::Type::File::Owner) do + desc "Desired file owner." + end + + newparam(:group, :parent => Puppet::Type::File::Group) do + desc "Desired file group." + end + + newparam(:mode, :parent => Puppet::Type::File::Mode) do + desc "Desired file mode." + end + + newparam(:order) do + desc "Controls the ordering of fragments. Can be set to alpha or numeric." + + newvalues(:alpha, :numeric) + + defaultto :numeric + end + + newparam(:backup) do + desc "Controls the filebucketing behavior of the final file and see File type reference for its use." + defaultto 'puppet' + end + + newparam(:replace, :boolean => true, :parent => Puppet::Parameter::Boolean) do + desc "Whether to replace a file that already exists on the local system." + defaultto :true + end + + newparam(:validate_cmd) do + desc "Validates file." + end + + newparam(:ensure_newline, :boolean => true, :parent => Puppet::Parameter::Boolean) do + desc "Whether to ensure there is a newline after each fragment." + defaultto :false + end + + # Inherit File parameters + newparam(:selinux_ignore_defaults) do + end + + newparam(:selrange) do + end + + newparam(:selrole) do + end + + newparam(:seltype) do + end + + newparam(:seluser) do + end + + newparam(:show_diff) do + end + # End file parameters + + # Autorequire the file we are generating below + autorequire(:file) do + [self[:path]] + end + + def should_content + return @generated_content if @generated_content + @generated_content = "" + content_fragments = [] + + resources = catalog.resources.select do |r| + r.is_a?(Puppet::Type.type(:concat_fragment)) && r[:tag] == self[:tag] + end + + resources.each do |r| + content_fragments << ["#{r[:order]}___#{r[:name]}", fragment_content(r)] + end + + if self[:order] == :numeric + sorted = content_fragments.sort do |a, b| + def decompound(d) + d.split('___', 2).map { |v| v =~ /^\d+$/ ? v.to_i : v } + end + + decompound(a[0]) <=> decompound(b[0]) + end + else + sorted = content_fragments.sort_by do |a| + a_order, a_name = a[0].split('__', 2) + [a_order, a_name] + end + end + + @generated_content = sorted.map { |cf| cf[1] }.join + + @generated_content + end + + def fragment_content(r) + if r[:content].nil? == false + fragment_content = r[:content] + elsif r[:source].nil? == false + @source = nil + Array(r[:source]).each do |source| + if Puppet::FileServing::Metadata.indirection.find(source) + @source = source + break + end + end + self.fail "Could not retrieve source(s) #{r[:source].join(", ")}" unless @source + tmp = Puppet::FileServing::Content.indirection.find(@source) + fragment_content = tmp.content unless tmp.nil? + end + + if self[:ensure_newline] + fragment_content<<"\n" unless fragment_content =~ /\n$/ + end + + fragment_content + end + + def generate + file_opts = { + :ensure => self[:ensure] == :absent ? :absent : :file, + } + + [:path, + :owner, + :group, + :mode, + :replace, + :backup, + :selinux_ignore_defaults, + :selrange, + :selrole, + :seltype, + :seluser, + :validate_cmd, + :show_diff].each do |param| + unless self[param].nil? + file_opts[param] = self[param] + end + end + + metaparams = Puppet::Type.metaparams + excluded_metaparams = [ :before, :notify, :require, :subscribe, :tag ] + + metaparams.reject! { |param| excluded_metaparams.include? param } + + metaparams.each do |metaparam| + file_opts[metaparam] = self[metaparam] if self[metaparam] + end + + [Puppet::Type.type(:file).new(file_opts)] + end + + def eval_generate + content = should_content + + if !content.nil? and !content.empty? + catalog.resource("File[#{self[:path]}]")[:content] = content + end + + [ catalog.resource("File[#{self[:path]}]") ] + end +end diff --git a/environments/production/modules/concat/lib/puppet/type/concat_fragment.rb b/environments/production/modules/concat/lib/puppet/type/concat_fragment.rb new file mode 100644 index 0000000..45f0801 --- /dev/null +++ b/environments/production/modules/concat/lib/puppet/type/concat_fragment.rb @@ -0,0 +1,64 @@ +Puppet::Type.newtype(:concat_fragment) do + @doc = "Create a concat fragment to be used by concat. + the `concat_fragment` type creates a file fragment to be collected by concat based on the tag. + The example is based on exported resources. + + Example: + @@concat_fragment { \"uniqe_name_${::fqdn}\": + tag => 'unique_name', + order => 10, # Optional. Default to 10 + content => 'some content' # OR + content => template('template.erb') # OR + source => 'puppet:///path/to/file' + } + " + + newparam(:name, :namevar => true) do + desc "Unique name" + end + + newparam(:target) do + desc "Target" + end + + newparam(:content) do + desc "Content" + end + + newparam(:source) do + desc "Source" + end + + newparam(:order) do + desc "Order" + defaultto '10' + validate do |val| + fail Puppet::ParseError, '$order is not a string or integer.' if !(val.is_a? String or val.is_a? Integer) + fail Puppet::ParseError, "Order cannot contain '/', ':', or '\n'." if val.to_s =~ /[:\n\/]/ + end + end + + newparam(:tag) do + desc "Tag name to be used by concat to collect all concat_fragments by tag name" + end + + autorequire(:file) do + if catalog.resources.select {|x| x.class == Puppet::Type.type(:concat_file) and (x[:path] == self[:target] || x.title == self[:target]) }.empty? + warning "Target Concat_file with path of #{self[:target]} not found in the catalog" + end + end + + validate do + # Check if target is set + fail Puppet::ParseError, "Target not set" if self[:target].nil? + + # Check if tag is set + fail Puppet::ParseError, "Tag not set" if self[:tag].nil? + + # Check if either source or content is set. raise error if none is set + fail Puppet::ParseError, "Set either 'source' or 'content'" if self[:source].nil? && self[:content].nil? + + # Check if both are set, if so rais error + fail Puppet::ParseError, "Can't use 'source' and 'content' at the same time" if !self[:source].nil? && !self[:content].nil? + end +end diff --git a/environments/production/modules/concat/locales/config.yaml b/environments/production/modules/concat/locales/config.yaml new file mode 100644 index 0000000..e7f36d7 --- /dev/null +++ b/environments/production/modules/concat/locales/config.yaml @@ -0,0 +1,25 @@ +--- +# This is the project-specific configuration file for setting up +# fast_gettext for your project. +gettext: + # This is used for the name of the .pot and .po files; they will be + # called .pot? + project_name: puppetlabs-concat + # This is used in comments in the .pot and .po files to indicate what + # project the files belong to and should bea little more desctiptive than + # + package_name: puppetlabs-concat + # The locale that the default messages in the .pot file are in + default_locale: en + # The email used for sending bug reports. + bugs_address: docs@puppet.com + # The holder of the copyright. + copyright_holder: Puppet, Inc. + # This determines which comments in code should be eligible for translation. + # Any comments that start with this string will be externalized. (Leave + # empty to include all.) + comments_tag: TRANSLATOR + # Patterns for +Dir.glob+ used to find all files that might contain + # translatable content, relative to the project root directory + source_files: + diff --git a/environments/production/modules/concat/manifests/fragment.pp b/environments/production/modules/concat/manifests/fragment.pp new file mode 100644 index 0000000..582af58 --- /dev/null +++ b/environments/production/modules/concat/manifests/fragment.pp @@ -0,0 +1,57 @@ +# == Define: concat::fragment +# +# Creates a concat_fragment in the catalogue +# +# === Options: +# +# [*target*] +# The file that these fragments belong to +# [*content*] +# If present puts the content into the file +# [*source*] +# If content was not specified, use the source +# [*order*] +# By default all files gets a 10_ prefix in the directory you can set it to +# anything else using this to influence the order of the content in the file +# +define concat::fragment( + $target, + $ensure = undef, + $content = undef, + $source = undef, + $order = '10', +) { + validate_string($target) + $resource = 'Concat::Fragment' + + if $ensure != undef { + warning('The $ensure parameter to concat::fragment is deprecated and has no effect.') + } + + validate_string($content) + if !(is_string($source) or is_array($source)) { + fail("${resource}['${title}']: 'source' is not a String or an Array.") + } + + if !(is_string($order) or is_integer($order)) { + fail("${resource}['${title}']: 'order' is not a String or an Integer.") + } elsif (is_string($order) and $order =~ /[:\n\/]/) { + fail("${resource}['${title}']: 'order' cannot contain '/', ':', or '\n'.") + } + + if ! ($content or $source) { + crit('No content, source or symlink specified') + } elsif ($content and $source) { + fail("${resource}['${title}']: Can't use 'source' and 'content' at the same time.") + } + + $safe_target_name = regsubst($target, '[/:~\n\s\+\*\(\)@]', '_', 'GM') + + concat_fragment { $name: + target => $target, + tag => $safe_target_name, + order => $order, + content => $content, + source => $source, + } +} diff --git a/environments/production/modules/concat/manifests/init.pp b/environments/production/modules/concat/manifests/init.pp new file mode 100644 index 0000000..e14721f --- /dev/null +++ b/environments/production/modules/concat/manifests/init.pp @@ -0,0 +1,158 @@ +# == Define: concat +# +# Sets up so that you can use fragments to build a final config file, +# +# === Options: +# +# [*ensure*] +# Present/Absent +# [*path*] +# The path to the final file. Use this in case you want to differentiate +# between the name of a resource and the file path. Note: Use the name you +# provided in the target of your fragments. +# [*owner*] +# Who will own the file +# [*group*] +# Who will own the file +# [*mode*] +# The mode of the final file +# [*show_diff*] +# Use metaparam for files to show/hide diffs for reporting when using eyaml +# secrets. Defaults to true +# [*warn*] +# Adds a normal shell style comment top of the file indicating that it is +# built by puppet. +# Before 2.0.0, this parameter would add a newline at the end of the warn +# message. To improve flexibilty, this was removed. Please add it explicitely +# if you need it. +# [*backup*] +# Controls the filebucketing behavior of the final file and see File type +# reference for its use. Defaults to 'puppet' +# [*replace*] +# Whether to replace a file that already exists on the local system +# [*order*] +# Select whether to order associated fragments by 'alpha' or 'numeric'. +# Defaults to 'alpha'. +# [*ensure_newline*] +# Specifies whether to ensure there's a new line at the end of each fragment. +# Valid options: 'true' and 'false'. Default value: 'false'. +# [*selinux_ignore_defaults*] +# [*selrange*] +# [*selrole*] +# [*seltype*] +# [*validate_cmd*] +# Specifies a validation command to apply to the destination file. +# Requires Puppet version 3.5 or newer. Valid options: a string to be passed +# to a file resource. Default value: undefined. +# + +define concat( + $ensure = 'present', + $path = $name, + $owner = undef, + $group = undef, + $mode = '0644', + $warn = false, + $force = undef, + $show_diff = true, + $backup = 'puppet', + $replace = true, + $order = 'alpha', + $ensure_newline = false, + $validate_cmd = undef, + $selinux_ignore_defaults = undef, + $selrange = undef, + $selrole = undef, + $seltype = undef, + $seluser = undef +) { + validate_re($ensure, '^present$|^absent$') + validate_absolute_path($path) + validate_string($mode) + if ! (is_string($owner) or is_integer($owner)) { + fail("\$owner must be a string or integer, got ${owner}") + } + if ! (is_string($group) or is_integer($group)) { + fail("\$group must be a string or integer, got ${group}") + } + if ! (is_string($warn) or $warn == true or $warn == false) { + fail('$warn is not a string or boolean') + } + validate_bool($show_diff) + if ! is_bool($backup) and ! is_string($backup) { + fail('$backup must be string or bool!') + } + validate_bool($replace) + validate_re($order, '^alpha$|^numeric$') + validate_bool($ensure_newline) + + if $validate_cmd and ! is_string($validate_cmd) { + fail('$validate_cmd must be a string') + } + + if $force != undef { + warning('The $force parameter to concat is deprecated and has no effect.') + } + if $selinux_ignore_defaults { + validate_bool($selinux_ignore_defaults) + } + validate_string($selrange) + validate_string($selrole) + validate_string($seltype) + validate_string($seluser) + + $safe_name = regsubst($name, '[/:~\n\s\+\*\(\)@]', '_', 'G') + $default_warn_message = "# This file is managed by Puppet. DO NOT EDIT.\n" + + case $warn { + true: { + $warn_message = $default_warn_message + $_append_header = true + } + false: { + $warn_message = '' + $_append_header = false + } + default: { + $warn_message = $warn + $_append_header = true + } + } + + if $ensure == 'present' { + concat_file { $name: + tag => $safe_name, + path => $path, + owner => $owner, + group => $group, + mode => $mode, + selinux_ignore_defaults => $selinux_ignore_defaults, + selrange => $selrange, + selrole => $selrole, + seltype => $seltype, + seluser => $seluser, + replace => $replace, + backup => $backup, + show_diff => $show_diff, + order => $order, + ensure_newline => $ensure_newline, + validate_cmd => $validate_cmd, + } + + if $_append_header { + concat_fragment { "${name}_header": + target => $name, + tag => $safe_name, + content => $warn_message, + order => '0', + } + } + } else { + concat_file { $name: + ensure => $ensure, + tag => $safe_name, + path => $path, + backup => $backup, + } + } +} diff --git a/environments/production/modules/concat/metadata.json b/environments/production/modules/concat/metadata.json new file mode 100644 index 0000000..28d2e06 --- /dev/null +++ b/environments/production/modules/concat/metadata.json @@ -0,0 +1,109 @@ +{ + "name": "puppetlabs-concat", + "version": "2.2.1", + "author": "Puppet Labs", + "summary": "Construct files from multiple fragments.", + "license": "Apache-2.0", + "source": "https://github.com/puppetlabs/puppetlabs-concat", + "project_page": "https://github.com/puppetlabs/puppetlabs-concat", + "issues_url": "https://tickets.puppetlabs.com/browse/MODULES", + "dependencies": [ + {"name":"puppetlabs/stdlib","version_requirement":">= 4.2.0 < 5.0.0"} + ], + "data_provider": null, + "operatingsystem_support": [ + { + "operatingsystem": "RedHat", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "CentOS", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "OracleLinux", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "Scientific", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "SLES", + "operatingsystemrelease": [ + "10 SP4", + "11 SP1", + "12" + ] + }, + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "6", + "7", + "8" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "10.04", + "12.04", + "14.04", + "16.04" + ] + }, + { + "operatingsystem": "Solaris", + "operatingsystemrelease": [ + "10", + "11" + ] + }, + { + "operatingsystem": "Windows", + "operatingsystemrelease": [ + "Server 2003 R2", + "Server 2008 R2", + "Server 2012", + "Server 2012 R2" + ] + }, + { + "operatingsystem": "AIX", + "operatingsystemrelease": [ + "5.3", + "6.1", + "7.1" + ] + }, + { + "operatingsystem": "OSX", + "operatingsystemrelease": [ + "10.9" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">= 3.0.0 < 5.0.0" + } + ] +} diff --git a/environments/production/modules/concat/spec/acceptance/backup_spec.rb b/environments/production/modules/concat/spec/acceptance/backup_spec.rb new file mode 100644 index 0000000..0a737a5 --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/backup_spec.rb @@ -0,0 +1,115 @@ +require 'spec_helper_acceptance' + +describe 'concat backup parameter' do + basedir = default.tmpdir('concat') + context '=> puppet' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + file { '#{basedir}/file': + content => "old contents\n", + } + EOS + apply_manifest(pp) + end + pp = <<-EOS + concat { '#{basedir}/file': + backup => 'puppet', + } + concat::fragment { 'new file': + target => '#{basedir}/file', + content => 'new contents', + } + EOS + + it 'applies the manifest twice with "Filebucketed" stdout and no stderr' do + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Filebucketed #{basedir}\/file to puppet with sum 0140c31db86293a1a1e080ce9b91305f/) + end + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + its(:content) { should match /new contents/ } + end + end + + context '=> .backup' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + file { '#{basedir}/file': + content => "old contents\n", + } + EOS + apply_manifest(pp) + end + pp = <<-EOS + concat { '#{basedir}/file': + backup => '.backup', + } + concat::fragment { 'new file': + target => '#{basedir}/file', + content => 'new contents', + } + EOS + + # XXX Puppet doesn't mention anything about filebucketing with a given + # extension like .backup + it 'applies the manifest twice no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + its(:content) { should match /new contents/ } + end + describe file("#{basedir}/file.backup") do + it { should be_file } + its(:content) { should match /old contents/ } + end + end + + # XXX The backup parameter uses validate_string() and thus can't be the + # boolean false value, but the string 'false' has the same effect in Puppet 3 + context "=> 'false'" do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + file { '#{basedir}/file': + content => "old contents\n", + } + EOS + apply_manifest(pp) + end + pp = <<-EOS + concat { '#{basedir}/file': + backup => '.backup', + } + concat::fragment { 'new file': + target => '#{basedir}/file', + content => 'new contents', + } + EOS + + it 'applies the manifest twice with no "Filebucketed" stdout and no stderr' do + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to_not match(/Filebucketed/) + end + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + its(:content) { should match /new contents/ } + end + end +end diff --git a/environments/production/modules/concat/spec/acceptance/concat_spec.rb b/environments/production/modules/concat/spec/acceptance/concat_spec.rb new file mode 100644 index 0000000..3e24a58 --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/concat_spec.rb @@ -0,0 +1,228 @@ +require 'spec_helper_acceptance' + +case fact('osfamily') + when 'AIX' + username = 'root' + groupname = 'system' + scriptname = 'concatfragments.rb' + vardir = default.puppet['vardir'] + if vardir.nil? or vardir == '' + vardir = '/opt/puppetlabs/puppet/cache' + end + when 'Darwin' + username = 'root' + groupname = 'wheel' + scriptname = 'concatfragments.rb' + vardir = default.puppet['vardir'] + if vardir.nil? or vardir == '' + vardir = '/opt/puppetlabs/puppet/cache' + end + when 'windows' + username = 'Administrator' + groupname = 'Administrators' + scriptname = 'concatfragments.rb' + result = on default, "echo #{default.puppet['vardir']}" + vardir = result.raw_output.chomp + when 'Solaris' + username = 'root' + groupname = 'root' + scriptname = 'concatfragments.rb' + vardir = default.puppet['vardir'] + if vardir.nil? or vardir == '' + vardir = '/opt/puppetlabs/puppet/cache' + end + else + username = 'root' + groupname = 'root' + scriptname = 'concatfragments.rb' + vardir = default.puppet['vardir'] + if vardir.nil? or vardir == '' + vardir = '/opt/puppetlabs/puppet/cache' + end +end + +describe 'basic concat test' do + basedir = default.tmpdir('concat') + safe_basedir = basedir.gsub(/[\/:]/, '_') + + shared_examples 'successfully_applied' do |pp| + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + end + + context 'owner/group root' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + EOS + apply_manifest(pp) + end + pp = <<-EOS + concat { '#{basedir}/file': + owner => '#{username}', + group => '#{groupname}', + mode => '0644', + } + + concat::fragment { '1': + target => '#{basedir}/file', + content => '1', + order => '01', + } + + concat::fragment { '2': + target => '#{basedir}/file', + content => '2', + order => '02', + } + EOS + + it_behaves_like 'successfully_applied', pp + + describe file("#{basedir}/file") do + it { should be_file } + it { should be_owned_by username } + it("should be group", :unless => (fact('osfamily') == 'windows')) { should be_grouped_into groupname } + it("should be mode", :unless => (fact('osfamily') == 'AIX' or fact('osfamily') == 'windows')) { + should be_mode 644 + } + its(:content) { + should match '1' + should match '2' + } + end + end + + context 'ensure' do + context 'works when set to present with path set' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + EOS + apply_manifest(pp) + end + pp=" + concat { 'file': + ensure => present, + path => '#{basedir}/file', + mode => '0644', + } + concat::fragment { '1': + target => 'file', + content => '1', + order => '01', + } + " + + it_behaves_like 'successfully_applied', pp + + describe file("#{basedir}/file") do + it { should be_file } + it("should be mode", :unless => (fact('osfamily') == 'AIX' or fact('osfamily') == 'windows')) { + should be_mode 644 + } + its(:content) { should match '1' } + end + end + context 'works when set to absent with path set' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + EOS + apply_manifest(pp) + end + pp=" + concat { 'file': + ensure => absent, + path => '#{basedir}/file', + mode => '0644', + } + concat::fragment { '1': + target => 'file', + content => '1', + order => '01', + } + " + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should_not be_file } + end + end + context 'works when set to present with path that has special characters' do + filename = fact('osfamily') == 'windows' ? 'file(1)' : 'file(1:2)' + + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + EOS + apply_manifest(pp) + end + pp=" + concat { '#{filename}': + ensure => present, + path => '#{basedir}/#{filename}', + mode => '0644', + } + concat::fragment { '1': + target => '#{filename}', + content => '1', + order => '01', + } + " + + it_behaves_like 'successfully_applied', pp + + describe file("#{basedir}/#{filename}") do + it { should be_file } + it("should be mode", :unless => (fact('osfamily') == 'AIX' or fact('osfamily') == 'windows')) { + should be_mode 644 + } + its(:content) { should match '1' } + end + end + context 'noop properly' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + EOS + apply_manifest(pp) + end + pp=" + concat { 'file': + ensure => present, + path => '#{basedir}/file', + mode => '0644', + noop => true, + } + concat::fragment { '1': + target => 'file', + content => '1', + order => '01', + } + " + + it_behaves_like 'successfully_applied', pp + + describe file("#{basedir}/file") do + it { should_not be_file } + end + end + end +end diff --git a/environments/production/modules/concat/spec/acceptance/concurrency_spec.rb b/environments/production/modules/concat/spec/acceptance/concurrency_spec.rb new file mode 100644 index 0000000..fcffdbd --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/concurrency_spec.rb @@ -0,0 +1,37 @@ +require 'spec_helper_acceptance' + +describe 'with file recursive purge' do + basedir = default.tmpdir('concat') + context 'should still create concat file' do + pp = <<-EOS + file { '#{basedir}/bar': + ensure => directory, + purge => true, + recurse => true, + } + + concat { "foobar": + ensure => 'present', + path => '#{basedir}/bar/foobar', + } + + concat::fragment { 'foo': + target => 'foobar', + content => 'foo', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/bar/foobar") do + it { should be_file } + its(:content) { + should match 'foo' + } + end + end +end + diff --git a/environments/production/modules/concat/spec/acceptance/fragment_source_spec.rb b/environments/production/modules/concat/spec/acceptance/fragment_source_spec.rb new file mode 100644 index 0000000..b208979 --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/fragment_source_spec.rb @@ -0,0 +1,156 @@ +require 'spec_helper_acceptance' + +case fact('osfamily') + when 'AIX' + username = 'root' + groupname = 'system' + when 'Darwin' + username = 'root' + groupname = 'wheel' + when 'windows' + username = 'Administrator' + groupname = 'Administrators' + else + username = 'root' + groupname = 'root' +end + +describe 'concat::fragment source' do + basedir = default.tmpdir('concat') + context 'should read file fragments from local system' do + pp = <<-EOS + file { '#{basedir}/file1': + content => "file1 contents\n" + } + file { '#{basedir}/file2': + content => "file2 contents\n" + } + concat { '#{basedir}/foo': } + + concat::fragment { '1': + target => '#{basedir}/foo', + source => '#{basedir}/file1', + require => File['#{basedir}/file1'], + } + concat::fragment { '2': + target => '#{basedir}/foo', + content => 'string1 contents', + } + concat::fragment { '3': + target => '#{basedir}/foo', + source => '#{basedir}/file2', + require => File['#{basedir}/file2'], + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/foo") do + it { should be_file } + its(:content) { + should match 'file1 contents' + should match 'string1 contents' + should match 'file2 contents' + } + end + end # should read file fragments from local system + + context 'should create files containing first match only.' do + pp = <<-EOS + file { '#{basedir}/file1': + content => "file1 contents\n" + } + file { '#{basedir}/file2': + content => "file2 contents\n" + } + concat { '#{basedir}/result_file1': + owner => '#{username}', + group => '#{groupname}', + mode => '0644', + } + concat { '#{basedir}/result_file2': + owner => '#{username}', + group => '#{groupname}', + mode => '0644', + } + concat { '#{basedir}/result_file3': + owner => '#{username}', + group => '#{groupname}', + mode => '0644', + } + + concat::fragment { '1': + target => '#{basedir}/result_file1', + source => [ '#{basedir}/file1', '#{basedir}/file2' ], + require => [ File['#{basedir}/file1'], File['#{basedir}/file2'] ], + order => '01', + } + concat::fragment { '2': + target => '#{basedir}/result_file2', + source => [ '#{basedir}/file2', '#{basedir}/file1' ], + require => [ File['#{basedir}/file1'], File['#{basedir}/file2'] ], + order => '01', + } + concat::fragment { '3': + target => '#{basedir}/result_file3', + source => [ '#{basedir}/file1', '#{basedir}/file2' ], + require => [ File['#{basedir}/file1'], File['#{basedir}/file2'] ], + order => '01', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + describe file("#{basedir}/result_file1") do + it { should be_file } + its(:content) { + should match 'file1 contents' + should_not match 'file2 contents' + } + end + describe file("#{basedir}/result_file2") do + it { should be_file } + its(:content) { + should match 'file2 contents' + should_not match 'file1 contents' + } + end + describe file("#{basedir}/result_file3") do + it { should be_file } + its(:content) { + should match 'file1 contents' + should_not match 'file2 contents' + } + end + end + + context 'should fail if no match on source.' do + pp = <<-EOS + concat { '#{basedir}/fail_no_source': + owner => '#{username}', + group => '#{groupname}', + mode => '0644', + } + + concat::fragment { '1': + target => '#{basedir}/fail_no_source', + source => [ '#{basedir}/nofilehere', '#{basedir}/nothereeither' ], + order => '01', + } + EOS + + it 'applies the manifest with resource failures' do + expect(apply_manifest(pp, :catch_failures => true).stderr).to match(/Failed to generate additional resources using 'eval_generate'/) + end + describe file("#{basedir}/fail_no_source") do + #FIXME: Serverspec::Type::File doesn't support exists? for some reason. so... hack. + it { should_not be_directory } + end + end +end + diff --git a/environments/production/modules/concat/spec/acceptance/fragments_are_always_replaced_spec.rb b/environments/production/modules/concat/spec/acceptance/fragments_are_always_replaced_spec.rb new file mode 100644 index 0000000..70d7382 --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/fragments_are_always_replaced_spec.rb @@ -0,0 +1,139 @@ +require 'spec_helper_acceptance' + +describe 'concat::fragment replace' do + basedir = default.tmpdir('concat') + + context 'should create fragment files' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + EOS + apply_manifest(pp) + end + + pp1 = <<-EOS + concat { '#{basedir}/foo': } + + concat::fragment { '1': + target => '#{basedir}/foo', + content => 'caller has replace unset run 1', + } + EOS + pp2 = <<-EOS + concat { '#{basedir}/foo': } + + concat::fragment { '1': + target => '#{basedir}/foo', + content => 'caller has replace unset run 2', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp1, :catch_failures => true) + apply_manifest(pp1, :catch_changes => true) + apply_manifest(pp2, :catch_failures => true) + apply_manifest(pp2, :catch_changes => true) + end + + describe file("#{basedir}/foo") do + it { should be_file } + its(:content) { + should_not match 'caller has replace unset run 1' + should match 'caller has replace unset run 2' + } + end + end # should create fragment files + + context 'should replace its own fragment files when caller has File { replace=>true } set' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + EOS + apply_manifest(pp) + end + + pp1 = <<-EOS + File { replace=>true } + concat { '#{basedir}/foo': } + + concat::fragment { '1': + target => '#{basedir}/foo', + content => 'caller has replace true set run 1', + } + EOS + pp2 = <<-EOS + File { replace=>true } + concat { '#{basedir}/foo': } + + concat::fragment { '1': + target => '#{basedir}/foo', + content => 'caller has replace true set run 2', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp1, :catch_failures => true) + apply_manifest(pp1, :catch_changes => true) + apply_manifest(pp2, :catch_failures => true) + apply_manifest(pp2, :catch_changes => true) + end + + describe file("#{basedir}/foo") do + it { should be_file } + its(:content) { + should_not match 'caller has replace true set run 1' + should match 'caller has replace true set run 2' + } + end + end # should replace its own fragment files when caller has File(replace=>true) set + + context 'should replace its own fragment files even when caller has File { replace=>false } set' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + EOS + apply_manifest(pp) + end + + pp1 = <<-EOS + File { replace=>false } + concat { '#{basedir}/foo': } + + concat::fragment { '1': + target => '#{basedir}/foo', + content => 'caller has replace false set run 1', + } + EOS + pp2 = <<-EOS + File { replace=>false } + concat { '#{basedir}/foo': } + + concat::fragment { '1': + target => '#{basedir}/foo', + content => 'caller has replace false set run 2', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp1, :catch_failures => true) + apply_manifest(pp1, :catch_changes => true) + apply_manifest(pp2, :catch_failures => true) + apply_manifest(pp2, :catch_changes => true) + end + + describe file("#{basedir}/foo") do + it { should be_file } + its(:content) { + should_not match 'caller has replace false set run 1' + should match 'caller has replace false set run 2' + } + end + end # should replace its own fragment files even when caller has File(replace=>false) set + +end diff --git a/environments/production/modules/concat/spec/acceptance/newline_spec.rb b/environments/production/modules/concat/spec/acceptance/newline_spec.rb new file mode 100644 index 0000000..c1fa16a --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/newline_spec.rb @@ -0,0 +1,67 @@ +require 'spec_helper_acceptance' + +describe 'concat ensure_newline parameter' do + basedir = default.tmpdir('concat') + context '=> false' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory + } + EOS + + apply_manifest(pp) + end + pp = <<-EOS + concat { '#{basedir}/file': + ensure_newline => false, + } + concat::fragment { '1': + target => '#{basedir}/file', + content => '1', + } + concat::fragment { '2': + target => '#{basedir}/file', + content => '2', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + its(:content) { should match '12' } + end + end + + context '=> true' do + pp = <<-EOS + concat { '#{basedir}/file': + ensure_newline => true, + } + concat::fragment { '1': + target => '#{basedir}/file', + content => '1', + } + concat::fragment { '2': + target => '#{basedir}/file', + content => '2', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + its(:content) { + should match /1\n2\n/ + } + end + end +end diff --git a/environments/production/modules/concat/spec/acceptance/nodesets/centos-7-x64.yml b/environments/production/modules/concat/spec/acceptance/nodesets/centos-7-x64.yml new file mode 100644 index 0000000..5eebdef --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/nodesets/centos-7-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + centos-7-x64: + roles: + - agent + - default + platform: el-7-x86_64 + hypervisor: vagrant + box: puppetlabs/centos-7.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/concat/spec/acceptance/nodesets/debian-8-x64.yml b/environments/production/modules/concat/spec/acceptance/nodesets/debian-8-x64.yml new file mode 100644 index 0000000..fef6e63 --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/nodesets/debian-8-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + debian-8-x64: + roles: + - agent + - default + platform: debian-8-amd64 + hypervisor: vagrant + box: puppetlabs/debian-8.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/concat/spec/acceptance/nodesets/default.yml b/environments/production/modules/concat/spec/acceptance/nodesets/default.yml new file mode 100644 index 0000000..6f60231 --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/nodesets/default.yml @@ -0,0 +1,18 @@ +--- +HOSTS: + windows2012-64-1: + pe_dir: + pe_ver: + pe_upgrade_dir: + pe_upgrade_ver: + hypervisor: vmpooler + platform: windows-2012-64 + ruby_arch: x64 + template: win-2012-x86_64 + roles: + - agent + - default +CONFIG: + nfs_server: none + consoleport: 443 + pooling_api: http://vmpooler.delivery.puppetlabs.net/ diff --git a/environments/production/modules/concat/spec/acceptance/nodesets/docker/centos-7.yml b/environments/production/modules/concat/spec/acceptance/nodesets/docker/centos-7.yml new file mode 100644 index 0000000..a3333aa --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/nodesets/docker/centos-7.yml @@ -0,0 +1,12 @@ +HOSTS: + centos-7-x64: + platform: el-7-x86_64 + hypervisor: docker + image: centos:7 + docker_preserve_image: true + docker_cmd: '["/usr/sbin/init"]' + # install various tools required to get the image up to usable levels + docker_image_commands: + - 'yum install -y crontabs tar wget openssl sysvinit-tools iproute which initscripts' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/concat/spec/acceptance/nodesets/docker/debian-8.yml b/environments/production/modules/concat/spec/acceptance/nodesets/docker/debian-8.yml new file mode 100644 index 0000000..df5c319 --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/nodesets/docker/debian-8.yml @@ -0,0 +1,11 @@ +HOSTS: + debian-8-x64: + platform: debian-8-amd64 + hypervisor: docker + image: debian:8 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get update && apt-get install -y net-tools wget locales strace lsof && echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/concat/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/environments/production/modules/concat/spec/acceptance/nodesets/docker/ubuntu-14.04.yml new file mode 100644 index 0000000..b1efa58 --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/nodesets/docker/ubuntu-14.04.yml @@ -0,0 +1,12 @@ +HOSTS: + ubuntu-1404-x64: + platform: ubuntu-14.04-amd64 + hypervisor: docker + image: ubuntu:14.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + # ensure that upstart is booting correctly in the container + - 'rm /usr/sbin/policy-rc.d && rm /sbin/initctl && dpkg-divert --rename --remove /sbin/initctl && apt-get update && apt-get install -y net-tools wget && locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/concat/spec/acceptance/order_spec.rb b/environments/production/modules/concat/spec/acceptance/order_spec.rb new file mode 100644 index 0000000..b746b1c --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/order_spec.rb @@ -0,0 +1,123 @@ +require 'spec_helper_acceptance' + +describe 'concat order' do + basedir = default.tmpdir('concat') + + context '=> ' do + shared_examples 'sortby' do |order_by, match_output| + pp = <<-EOS + concat { '#{basedir}/foo': + order => '#{order_by}' + } + concat::fragment { '1': + target => '#{basedir}/foo', + content => 'string1', + order => '1', + } + concat::fragment { '2': + target => '#{basedir}/foo', + content => 'string2', + order => '2', + } + concat::fragment { '10': + target => '#{basedir}/foo', + content => 'string10', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/foo") do + it { should be_file } + its(:content) { should match match_output } + end + end + + describe 'alpha' do + it_behaves_like 'sortby', 'alpha', /string1string10string2/ + end + + describe 'numeric' do + it_behaves_like 'sortby', 'numeric', /string1string2string10/ + end + end +end # concat order + +describe 'concat::fragment order' do + basedir = default.tmpdir('concat') + + context '=> reverse order' do + shared_examples 'order_by' do |order_by, match_output| + pp = <<-EOS + concat { '#{basedir}/foo': + order => '#{order_by}' + } + concat::fragment { '1': + target => '#{basedir}/foo', + content => 'string1', + order => '15', + } + concat::fragment { '2': + target => '#{basedir}/foo', + content => 'string2', + # default order 10 + } + concat::fragment { '3': + target => '#{basedir}/foo', + content => 'string3', + order => '1', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/foo") do + it { should be_file } + its(:content) { should match match_output } + end + end + describe 'alpha' do + it_should_behave_like 'order_by', 'alpha', /string3string2string1/ + end + describe 'numeric' do + it_should_behave_like 'order_by', 'numeric', /string3string2string1/ + end + end + + context '=> normal order' do + pp = <<-EOS + concat { '#{basedir}/foo': } + concat::fragment { '1': + target => '#{basedir}/foo', + content => 'string1', + order => '01', + } + concat::fragment { '2': + target => '#{basedir}/foo', + content => 'string2', + order => '02' + } + concat::fragment { '3': + target => '#{basedir}/foo', + content => 'string3', + order => '03', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/foo") do + it { should be_file } + its(:content) { should match /string1string2string3/ } + end + end +end # concat::fragment order diff --git a/environments/production/modules/concat/spec/acceptance/pup-1963_spec.rb b/environments/production/modules/concat/spec/acceptance/pup-1963_spec.rb new file mode 100644 index 0000000..c36fe41 --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/pup-1963_spec.rb @@ -0,0 +1,69 @@ +require 'spec_helper_acceptance' + +case fact('osfamily') + when 'Windows' + command = 'cmd.exe /c echo triggered' + else + command = 'echo triggered' +end + +describe 'with metaparameters' do + describe 'with subscribed resources' do + basedir = default.tmpdir('concat') + + context 'should trigger refresh' do + pp = <<-EOS + concat { "foobar": + ensure => 'present', + path => '#{basedir}/foobar', + } + + concat::fragment { 'foo': + target => 'foobar', + content => 'foo', + } + + exec { 'trigger': + path => $::path, + command => "#{command}", + subscribe => Concat['foobar'], + refreshonly => true, + } + EOS + + it 'applies the manifest twice with stdout regex' do + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/Triggered 'refresh'/) + expect(apply_manifest(pp, :catch_changes => true).stdout).to_not match(/Triggered 'refresh'/) + end + end + end + + describe 'with resources to notify' do + basedir = default.tmpdir('concat') + context 'should notify' do + pp = <<-EOS + exec { 'trigger': + path => $::path, + command => "#{command}", + refreshonly => true, + } + + concat { "foobar": + ensure => 'present', + path => '#{basedir}/foobar', + notify => Exec['trigger'], + } + + concat::fragment { 'foo': + target => 'foobar', + content => 'foo', + } + EOS + + it 'applies the manifest twice with stdout regex' do + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/Triggered 'refresh'/) + expect(apply_manifest(pp, :catch_changes => true).stdout).to_not match(/Triggered 'refresh'/) + end + end + end +end diff --git a/environments/production/modules/concat/spec/acceptance/quoted_paths_spec.rb b/environments/production/modules/concat/spec/acceptance/quoted_paths_spec.rb new file mode 100644 index 0000000..6f9f9fd --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/quoted_paths_spec.rb @@ -0,0 +1,42 @@ +require 'spec_helper_acceptance' + +describe 'quoted paths' do + basedir = default.tmpdir('concat') + + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + file { '#{basedir}/concat test': + ensure => directory, + } + EOS + apply_manifest(pp) + end + + context 'path with blanks' do + pp = <<-EOS + concat { '#{basedir}/concat test/foo': + } + concat::fragment { '1': + target => '#{basedir}/concat test/foo', + content => 'string1', + } + concat::fragment { '2': + target => '#{basedir}/concat test/foo', + content => 'string2', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/concat test/foo") do + it { should be_file } + its(:content) { should match /string1string2/ } + end + end +end diff --git a/environments/production/modules/concat/spec/acceptance/replace_spec.rb b/environments/production/modules/concat/spec/acceptance/replace_spec.rb new file mode 100644 index 0000000..68d7383 --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/replace_spec.rb @@ -0,0 +1,261 @@ +require 'spec_helper_acceptance' + +describe 'replacement of' do + basedir = default.tmpdir('concat') + context 'file' do + context 'should not succeed' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + file { '#{basedir}/file': + content => "file exists\n" + } + EOS + apply_manifest(pp) + end + pp = <<-EOS + concat { '#{basedir}/file': + replace => false, + } + + concat::fragment { '1': + target => '#{basedir}/file', + content => '1', + } + + concat::fragment { '2': + target => '#{basedir}/file', + content => '2', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + its(:content) { + should match 'file exists' + should_not match '1' + should_not match '2' + } + end + end + + context 'should succeed' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + file { '#{basedir}/file': + content => "file exists\n" + } + EOS + apply_manifest(pp) + end + pp = <<-EOS + concat { '#{basedir}/file': + replace => true, + } + + concat::fragment { '1': + target => '#{basedir}/file', + content => '1', + } + + concat::fragment { '2': + target => '#{basedir}/file', + content => '2', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + its(:content) { + should_not match 'file exists' + should match '1' + should match '2' + } + end + end + end # file + + context 'symlink', :unless => (fact("osfamily") == "windows") do + context 'should not succeed' do + # XXX the core puppet file type will replace a symlink with a plain file + # when using ensure => present and source => ... but it will not when using + # ensure => present and content => ...; this is somewhat confusing behavior + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + file { '#{basedir}/file': + ensure => link, + target => '#{basedir}/dangling', + } + EOS + apply_manifest(pp) + end + + pp = <<-EOS + concat { '#{basedir}/file': + replace => false, + } + + concat::fragment { '1': + target => '#{basedir}/file', + content => '1', + } + + concat::fragment { '2': + target => '#{basedir}/file', + content => '2', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + # XXX specinfra doesn't support be_linked_to on AIX + describe file("#{basedir}/file"), :unless => (fact("osfamily") == "AIX" or fact("osfamily") == "windows") do + it { should be_linked_to "#{basedir}/dangling" } + end + + describe file("#{basedir}/dangling") do + # XXX serverspec does not have a matcher for 'exists' + it { should_not be_file } + it { should_not be_directory } + end + end + + context 'should succeed' do + # XXX the core puppet file type will replace a symlink with a plain file + # when using ensure => present and source => ... but it will not when using + # ensure => present and content => ...; this is somewhat confusing behavior + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + file { '#{basedir}/file': + ensure => link, + target => '#{basedir}/dangling', + } + EOS + apply_manifest(pp) + end + + pp = <<-EOS + concat { '#{basedir}/file': + replace => true, + } + + concat::fragment { '1': + target => '#{basedir}/file', + content => '1', + } + + concat::fragment { '2': + target => '#{basedir}/file', + content => '2', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + its(:content) { + should match '1' + should match '2' + } + end + end + end # symlink + + context 'directory' do + context 'should not succeed' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory, + } + file { '#{basedir}/file': + ensure => directory, + } + EOS + apply_manifest(pp) + end + pp = <<-EOS + concat { '#{basedir}/file': } + + concat::fragment { '1': + target => '#{basedir}/file', + content => '1', + } + + concat::fragment { '2': + target => '#{basedir}/file', + content => '2', + } + EOS + + it 'applies the manifest twice with stderr for changing to file' do + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/change from directory to file failed/) + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/change from directory to file failed/) + end + + describe file("#{basedir}/file") do + it { should be_directory } + end + end + + # XXX + # when there are no fragments, and the replace param will only replace + # files and symlinks, not directories. The semantics either need to be + # changed, extended, or a new param introduced to control directory + # replacement. + context 'should succeed', :pending => 'not yet implemented' do + pp = <<-EOS + concat { '#{basedir}/file': + } + + concat::fragment { '1': + target => '#{basedir}/file', + content => '1', + } + + concat::fragment { '2': + target => '#{basedir}/file', + content => '2', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + its(:content) { should match '1' } + end + end + end # directory +end diff --git a/environments/production/modules/concat/spec/acceptance/specinfra_stubs.rb b/environments/production/modules/concat/spec/acceptance/specinfra_stubs.rb new file mode 100644 index 0000000..bae85ef --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/specinfra_stubs.rb @@ -0,0 +1,19 @@ +class Specinfra::Command::Windows::Base::File < Specinfra::Command::Windows::Base + class << self + def check_is_owned_by(file, owner) + Backend::PowerShell::Command.new do + exec "if((Get-Item '#{file}').GetAccessControl().Owner -match '#{owner}' + -or ((Get-Item '#{file}').GetAccessControl().Owner -match '#{owner}').Length -gt 0){ exit 0 } else { exit 1 }" + end + end + end +end + + +class Specinfra::Command::Base::File < Specinfra::Command::Base + class << self + def get_content(file) + "cat '#{file}' 2> /dev/null || echo -n" + end + end +end diff --git a/environments/production/modules/concat/spec/acceptance/symbolic_name_spec.rb b/environments/production/modules/concat/spec/acceptance/symbolic_name_spec.rb new file mode 100644 index 0000000..df8d54f --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/symbolic_name_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper_acceptance' + +describe 'symbolic name' do + basedir = default.tmpdir('concat') + pp = <<-EOS + concat { 'not_abs_path': + path => '#{basedir}/file', + } + + concat::fragment { '1': + target => 'not_abs_path', + content => '1', + order => '01', + } + + concat::fragment { '2': + target => 'not_abs_path', + content => '2', + order => '02', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + its(:content) { + should match '1' + should match '2' + } + end +end diff --git a/environments/production/modules/concat/spec/acceptance/validation_spec.rb b/environments/production/modules/concat/spec/acceptance/validation_spec.rb new file mode 100644 index 0000000..c35871b --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/validation_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper_acceptance' + +describe 'concat validate_cmd parameter', :unless => (fact('kernel') != 'Linux') do + basedir = default.tmpdir('concat') + context '=> "/usr/bin/test -e %"' do + before(:all) do + pp = <<-EOS + file { '#{basedir}': + ensure => directory + } + EOS + + apply_manifest(pp) + end + pp = <<-EOS + concat { '#{basedir}/file': + validate_cmd => '/usr/bin/test -e %', + } + concat::fragment { 'content': + target => '#{basedir}/file', + content => 'content', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + it { should contain 'content' } + end + end +end diff --git a/environments/production/modules/concat/spec/acceptance/warn_header_spec.rb b/environments/production/modules/concat/spec/acceptance/warn_header_spec.rb new file mode 100644 index 0000000..b73414e --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/warn_header_spec.rb @@ -0,0 +1,104 @@ +require 'spec_helper_acceptance' + +describe 'concat warn =>' do + basedir = default.tmpdir('concat') + context 'true should enable default warning message' do + pp = <<-EOS + concat { '#{basedir}/file': + warn => true, + } + + concat::fragment { '1': + target => '#{basedir}/file', + content => '1', + order => '01', + } + + concat::fragment { '2': + target => '#{basedir}/file', + content => '2', + order => '02', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + its(:content) { + should match /# This file is managed by Puppet\. DO NOT EDIT\./ + should match /1/ + should match /2/ + } + end + end + context 'false should not enable default warning message' do + pp = <<-EOS + concat { '#{basedir}/file': + warn => false, + } + + concat::fragment { '1': + target => '#{basedir}/file', + content => '1', + order => '01', + } + + concat::fragment { '2': + target => '#{basedir}/file', + content => '2', + order => '02', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + its(:content) { + should_not match /# This file is managed by Puppet\. DO NOT EDIT\./ + should match /1/ + should match /2/ + } + end + end + context '# foo should overide default warning message' do + pp = <<-EOS + concat { '#{basedir}/file': + warn => "# foo\n", + } + + concat::fragment { '1': + target => '#{basedir}/file', + content => '1', + order => '01', + } + + concat::fragment { '2': + target => '#{basedir}/file', + content => '2', + order => '02', + } + EOS + + it 'applies the manifest twice with no stderr' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{basedir}/file") do + it { should be_file } + its(:content) { + should match /# foo/ + should match /1/ + should match /2/ + } + end + end +end diff --git a/environments/production/modules/concat/spec/acceptance/warnings_spec.rb b/environments/production/modules/concat/spec/acceptance/warnings_spec.rb new file mode 100644 index 0000000..4ad7a97 --- /dev/null +++ b/environments/production/modules/concat/spec/acceptance/warnings_spec.rb @@ -0,0 +1,61 @@ +require 'spec_helper_acceptance' + +describe 'warnings' do + basedir = default.tmpdir('concat') + + shared_examples 'has_warning' do |pp, w| + it 'applies the manifest twice with a stderr regex' do + expect(apply_manifest(pp, :catch_failures => true).stderr).to match(/#{Regexp.escape(w)}/m) + expect(apply_manifest(pp, :catch_changes => true).stderr).to match(/#{Regexp.escape(w)}/m) + end + end + + context 'concat force parameter deprecation' do + pp = <<-EOS + concat { '#{basedir}/file': + force => false, + } + concat::fragment { 'foo': + target => '#{basedir}/file', + content => 'bar', + } + EOS + w = 'The $force parameter to concat is deprecated and has no effect.' + + it_behaves_like 'has_warning', pp, w + end + + context 'concat::fragment ensure parameter deprecation' do + context 'target file exists' do + pp = <<-EOS + concat { '#{basedir}/file': + } + concat::fragment { 'foo': + target => '#{basedir}/file', + ensure => false, + content => 'bar', + } + EOS + w = 'The $ensure parameter to concat::fragment is deprecated and has no effect.' + + it_behaves_like 'has_warning', pp, w + end + end + + context 'concat::fragment target not found' do + context 'target not found' do + pp = <<-EOS + concat { 'file': + path => '#{basedir}/file', + } + concat::fragment { 'foo': + target => '#{basedir}/bar', + content => 'bar', + } + EOS + w = 'not found in the catalog' + + it_behaves_like 'has_warning', pp, w + end + end +end diff --git a/environments/production/modules/concat/spec/spec_helper.rb b/environments/production/modules/concat/spec/spec_helper.rb new file mode 100644 index 0000000..22d5d68 --- /dev/null +++ b/environments/production/modules/concat/spec/spec_helper.rb @@ -0,0 +1,8 @@ +#This file is generated by ModuleSync, do not edit. +require 'puppetlabs_spec_helper/module_spec_helper' + +# put local configuration and setup into spec_helper_local +begin + require 'spec_helper_local' +rescue LoadError +end diff --git a/environments/production/modules/concat/spec/spec_helper_acceptance.rb b/environments/production/modules/concat/spec/spec_helper_acceptance.rb new file mode 100644 index 0000000..d0b05ea --- /dev/null +++ b/environments/production/modules/concat/spec/spec_helper_acceptance.rb @@ -0,0 +1,53 @@ +require 'beaker-rspec/spec_helper' +require 'beaker-rspec/helpers/serverspec' +require 'acceptance/specinfra_stubs' +require 'beaker/puppet_install_helper' + +run_puppet_install_helper + +unless ENV['RS_PROVISION'] == 'no' or ENV['BEAKER_provision'] == 'no' + hosts.each do |host| + if host['platform'] =~ /sles-1/i || host['platform'] =~ /solaris-1/i + get_deps = <<-EOS + package{'wget':} + exec{'download-stdlib': + command => "wget -P /root/ https://forgeapi.puppetlabs.com/v3/files/puppetlabs-stdlib-4.5.1.tar.gz --no-check-certificate", + path => ['/opt/csw/bin/','/usr/bin/'] + } + EOS + apply_manifest_on(host, get_deps) + # have to use force otherwise it checks ssl cert even though it is a local file + on host, puppet('module install /root/puppetlabs-stdlib-4.5.1.tar.gz --force --ignore-dependencies'), {:acceptable_exit_codes => [0, 1]} + elsif host['platform'] =~ /windows/i + on host, 'curl -k -o c:/puppetlabs-stdlib-4.5.1.tar.gz https://forgeapi.puppetlabs.com/v3/files/puppetlabs-stdlib-4.5.1.tar.gz' + on host, puppet('module install c:/puppetlabs-stdlib-4.5.1.tar.gz --force --ignore-dependencies'), {:acceptable_exit_codes => [0, 1]} + else + on host, puppet('module install puppetlabs-stdlib'), {:acceptable_exit_codes => [0, 1]} + end + end +end + +RSpec.configure do |c| + # Project root + proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..')) + + # Readable test descriptions + c.formatter = :documentation + + # Configure all nodes in nodeset + c.before :suite do + hosts.each do |host| + copy_module_to(host, :source => proj_root, :module_name => 'concat') + end + end + + c.before(:all) do + shell('mkdir -p /tmp/concat') + end + c.after(:all) do + shell('rm -rf /tmp/concat /var/lib/puppet/concat') + end + + c.treat_symbols_as_metadata_keys_with_true_values = true +end + diff --git a/environments/production/modules/concat/spec/unit/defines/concat_fragment_spec.rb b/environments/production/modules/concat/spec/unit/defines/concat_fragment_spec.rb new file mode 100644 index 0000000..80b5401 --- /dev/null +++ b/environments/production/modules/concat/spec/unit/defines/concat_fragment_spec.rb @@ -0,0 +1,160 @@ +require 'spec_helper' + +describe 'concat::fragment', :type => :define do + + shared_examples 'fragment' do |title, params| + params = {} if params.nil? + + p = { + :content => nil, + :source => nil, + :order => 10, + }.merge(params) + + id = 'root' + gid = 'root' + + let(:title) { title } + let(:params) { params } + let(:pre_condition) do + "concat{ '#{p[:target]}': }" + end + + it do + should contain_concat(p[:target]) + should contain_concat_file(p[:target]) + should contain_concat_fragment(title) + end + end + + context 'title' do + ['0', '1', 'a', 'z'].each do |title| + it_behaves_like 'fragment', title, { + :target => '/etc/motd', + :content => "content for #{title}" + } + end + end # title + + context 'target =>' do + ['./etc/motd', 'etc/motd', 'motd_header'].each do |target| + context target do + it_behaves_like 'fragment', target, { + :target => '/etc/motd', + :content => "content for #{target}" + } + end + end + + context 'false' do + let(:title) { 'motd_header' } + let(:params) {{ :target => false }} + + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not a string/) + end + end + end # target => + + context 'content =>' do + ['', 'ashp is our hero'].each do |content| + context content do + it_behaves_like 'fragment', 'motd_header', { + :content => content, + :target => '/etc/motd', + } + end + end + + context 'false' do + let(:title) { 'motd_header' } + let(:params) {{ :content => false, :target => '/etc/motd' }} + + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not a string/) + end + end + end # content => + + context 'source =>' do + ['', '/foo/bar', ['/foo/bar', '/foo/baz']].each do |source| + context source do + it_behaves_like 'fragment', 'motd_header', { + :source => source, + :target => '/etc/motd', + } + end + end + + context 'false' do + let(:title) { 'motd_header' } + let(:params) {{ :source => false, :target => '/etc/motd' }} + + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not a String or an Array/) + end + end + end # source => + + context 'order =>' do + ['', '42', 'a', 'z'].each do |order| + context '\'\'' do + it_behaves_like 'fragment', 'motd_header', { + :order => order, + :target => '/etc/motd', + } + end + end + + context 'false' do + let(:title) { 'motd_header' } + let(:params) {{ :order => false, :target => '/etc/motd' }} + + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not a String or an Integer/) + end + end + + context '123:456' do + let(:title) { 'motd_header' } + let(:params) {{ :order => '123:456', :target => '/etc/motd' }} + + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /cannot contain/) + end + end + context '123/456' do + let(:title) { 'motd_header' } + let(:params) {{ :order => '123/456', :target => '/etc/motd' }} + + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /cannot contain/) + end + end + context '123\n456' do + let(:title) { 'motd_header' } + let(:params) {{ :order => "123\n456", :target => '/etc/motd' }} + + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /cannot contain/) + end + end + end # order => + + context 'more than one content source' do + context 'source and content' do + let(:title) { 'motd_header' } + let(:params) do + { + :target => '/etc/motd', + :source => '/foo', + :content => 'bar', + } + end + + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /Can\'t use \'source\' and \'content\' at the same time/m) + end + end + end # more than one content source +end diff --git a/environments/production/modules/concat/spec/unit/defines/concat_spec.rb b/environments/production/modules/concat/spec/unit/defines/concat_spec.rb new file mode 100644 index 0000000..ea0598a --- /dev/null +++ b/environments/production/modules/concat/spec/unit/defines/concat_spec.rb @@ -0,0 +1,362 @@ +require 'spec_helper' + +describe 'concat', :type => :define do + + shared_examples 'concat' do |title, params, id| + params = {} if params.nil? + id = 'root' if id.nil? + + # default param values + p = { + :ensure => 'present', + :path => title, + :owner => nil, + :group => nil, + :mode => '0644', + :warn => false, + :backup => 'puppet', + :replace => true, + }.merge(params) + + concat_name = 'fragments.concat.out' + default_warn_message = "# This file is managed by Puppet. DO NOT EDIT.\n" + + file_defaults = { + :backup => p[:backup], + } + + let(:title) { title } + let(:params) { params } + let(:facts) do + { + :id => id, + :osfamily => 'Debian', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :kernel => 'Linux', + :is_pe => false, + } + end + + if p[:ensure] == 'present' + it do + should contain_concat(title).with(file_defaults.merge({ + :ensure => 'present', + :owner => p[:owner], + :group => p[:group], + :mode => p[:mode], + :path => p[:path], + :backup => p[:backup], + :replace => p[:replace], + :selinux_ignore_defaults => p[:selinux_ignore_defaults], + :selrange => p[:selrange], + :selrole => p[:selrole], + :seltype => p[:seltype], + :seluser => p[:seluser], + })) + end + else + it do + should contain_concat(title).with(file_defaults.merge({ + :ensure => 'absent', + :backup => p[:backup], + })) + end + end + end + + context 'title' do + context 'without path param' do + # title/name is the default value for the path param. therefore, the + # title must be an absolute path unless path is specified + ['/foo', '/foo/bar', '/foo/bar/baz'].each do |title| + context title do + it_behaves_like 'concat', '/etc/foo.bar' + end + end + + ['./foo', 'foo', 'foo/bar'].each do |title| + context title do + let(:title) { title } + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not an absolute path/) + end + end + end + end + + context 'with path param' do + ['/foo', 'foo', 'foo/bar'].each do |title| + context title do + it_behaves_like 'concat', title, { :path => '/etc/foo.bar' } + end + end + end + + context 'with special characters in title' do + ['foo:bar', 'foo*bar', 'foo(bar)', 'foo@bar'].each do |title| + context title do + it_behaves_like 'concat', title, { :path => '/etc/foo.bar' } + end + end + end + end # title => + + context 'as non-root user' do + it_behaves_like 'concat', '/etc/foo.bar', {}, 'bob' + end + + context 'ensure =>' do + ['present', 'absent'].each do |ens| + context ens do + it_behaves_like 'concat', '/etc/foo.bar', { :ensure => ens } + end + end + + context 'invalid' do + let(:title) { '/etc/foo.bar' } + let(:params) {{ :ensure => 'invalid' }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /#{Regexp.escape('does not match "^present$|^absent$"')}/) + end + end + end # ensure => + + context 'path =>' do + context '/foo' do + it_behaves_like 'concat', '/etc/foo.bar', { :path => '/foo' } + end + + ['./foo', 'foo', 'foo/bar', false].each do |path| + context path do + let(:title) { '/etc/foo.bar' } + let(:params) {{ :path => path }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not an absolute path/) + end + end + end + end # path => + + context 'owner =>' do + context 'apenney' do + it_behaves_like 'concat', '/etc/foo.bar', { :owner => 'apenny' } + end + + context '1000' do + it_behaves_like 'concat', '/etc/foo.bar', { :owner => 1000 } + end + + context 'false' do + let(:title) { '/etc/foo.bar' } + let(:params) {{ :owner => false }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /\$owner must be a string or integer/) + end + end + end # owner => + + context 'group =>' do + context 'apenney' do + it_behaves_like 'concat', '/etc/foo.bar', { :group => 'apenny' } + end + + context '1000' do + it_behaves_like 'concat', '/etc/foo.bar', { :group => 1000 } + end + + context 'false' do + let(:title) { '/etc/foo.bar' } + let(:params) {{ :group => false }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /\$group must be a string or integer/) + end + end + end # group => + + context 'mode =>' do + context '1755' do + it_behaves_like 'concat', '/etc/foo.bar', { :mode => '1755' } + end + + context 'false' do + let(:title) { '/etc/foo.bar' } + let(:params) {{ :mode => false }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not a string/) + end + end + end # mode => + + context 'warn =>' do + [true, false, '# foo'].each do |warn| + context warn do + it_behaves_like 'concat', '/etc/foo.bar', { :warn => warn } + end + end + + context '(stringified boolean)' do + ['true', 'yes', 'on', 'false', 'no', 'off'].each do |warn| + context warn do + it_behaves_like 'concat', '/etc/foo.bar', { :warn => warn } + + it 'should create a warning' do + skip('rspec-puppet support for testing warning()') + end + end + end + end + + context '123' do + let(:title) { '/etc/foo.bar' } + let(:params) {{ :warn => 123 }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not a string or boolean/) + end + end + end # warn => + + context 'show_diff =>' do + [true, false].each do |show_diff| + context show_diff do + it_behaves_like 'concat', '/etc/foo.bar', { :show_diff => show_diff } + end + end + + context '123' do + let(:title) { '/etc/foo.bar' } + let(:params) {{ :show_diff => 123 }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not a boolean/) + end + end + end # show_diff => + + context 'backup =>' do + context 'reverse' do + it_behaves_like 'concat', '/etc/foo.bar', { :backup => 'reverse' } + end + + context 'false' do + it_behaves_like 'concat', '/etc/foo.bar', { :backup => false } + end + + context 'true' do + it_behaves_like 'concat', '/etc/foo.bar', { :backup => true } + end + + context 'true' do + let(:title) { '/etc/foo.bar' } + let(:params) {{ :backup => [] }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /backup must be string or bool/) + end + end + end # backup => + + context 'replace =>' do + [true, false].each do |replace| + context replace do + it_behaves_like 'concat', '/etc/foo.bar', { :replace => replace } + end + end + + context '123' do + let(:title) { '/etc/foo.bar' } + let(:params) {{ :replace => 123 }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not a boolean/) + end + end + end # replace => + + context 'order =>' do + ['alpha', 'numeric'].each do |order| + context order do + it_behaves_like 'concat', '/etc/foo.bar', { :order => order } + end + end + + context 'invalid' do + let(:title) { '/etc/foo.bar' } + let(:params) {{ :order => 'invalid' }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /#{Regexp.escape('does not match "^alpha$|^numeric$"')}/) + end + end + end # order => + + context 'ensure_newline =>' do + [true, false].each do |ensure_newline| + context 'true' do + it_behaves_like 'concat', '/etc/foo.bar', { :ensure_newline => ensure_newline} + end + end + + context '123' do + let(:title) { '/etc/foo.bar' } + let(:params) {{ :ensure_newline => 123 }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not a boolean/) + end + end + end # ensure_newline => + + context 'validate_cmd =>' do + if Puppet::Util::Package::versioncmp(Puppet::version, '3.5.0') > 0 + context '/usr/bin/test -e %' do + it_behaves_like 'concat', '/etc/foo.bar', { :validate_cmd => '/usr/bin/test -e %' } + end + + [ 1234, true ].each do |cmd| + context cmd do + let(:title) { '/etc/foo.bar' } + let(:params) {{ :validate_cmd => cmd }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /\$validate_cmd must be a string/) + end + end + end + end + end # validate_cmd => + + context 'selinux_ignore_defaults =>' do + let(:title) { '/etc/foo.bar' } + + [true, false].each do |v| + context v do + it_behaves_like 'concat', '/etc/foo.bar', { :selinux_ignore_defaults => v } + end + end + + context '123' do + let(:title) { '/etc/foo.bar' } + let(:params) {{ :selinux_ignore_defaults => 123 }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not a boolean/) + end + end + end # selinux_ignore_defaults => + + [ + :selrange, + :selrole, + :seltype, + :seluser, + ].each do |p| + context " #{p} =>" do + let(:title) { '/etc/foo.bar' } + + context 'foo' do + it_behaves_like 'concat', '/etc/foo.bar', { p => 'foo' } + end + + context 'false' do + let(:title) { '/etc/foo.bar' } + let(:params) {{ p => false }} + it 'should fail' do + expect { catalogue }.to raise_error(Puppet::Error, /is not a string/) + end + end + end # #{p} => + end +end diff --git a/environments/production/modules/concat/spec/unit/type/concat_file_spec.rb b/environments/production/modules/concat/spec/unit/type/concat_file_spec.rb new file mode 100644 index 0000000..ee6992b --- /dev/null +++ b/environments/production/modules/concat/spec/unit/type/concat_file_spec.rb @@ -0,0 +1,65 @@ +require 'spec_helper' + +shared_examples 'Puppet::Parameter::Boolean' do |parameter| + [true, :true, 'true', :yes, 'yes'].each do |value| + it "accepts #{value} (#{value.class}) as a value" do + resource[parameter] = value + expect(resource[parameter]).to eq(true) + end + end + + [false, :false, 'false', :no, 'no'].each do |value| + it "accepts #{value} (#{value.class}) as a value" do + resource[parameter] = value + expect(resource[parameter]).to eq(false) + end + end + + it 'does not accept "foo" as a value' do + expect { resource[parameter] = 'foo' }.to raise_error(%r{Invalid value "foo"}) + end +end + +describe Puppet::Type.type(:concat_file) do + let(:resource) { described_class.new(name: '/foo/bar') } + + describe 'key attributes' do + let(:subject) { described_class.key_attributes } + + it 'contain only :path' do + is_expected.to eq([:path]) + end + end + + describe 'parameter :path' do + it 'does not accept unqualified paths' do + expect { resource[:path] = 'foo' }.to raise_error( + %r{File paths must be fully qualified} + ) + end + end + + describe 'parameter :order' do + it 'accepts "alpha" as a value' do + resource[:order] = 'alpha' + expect(resource[:order]).to eq(:alpha) + end + + it 'accepts "numeric" as a value' do + resource[:order] = 'numeric' + expect(resource[:order]).to eq(:numeric) + end + + it 'does not accept "bar" as a value' do + expect { resource[:order] = 'bar' }.to raise_error(%r{Invalid value "bar"}) + end + end + + describe 'parameter :replace' do + it_behaves_like 'Puppet::Parameter::Boolean', :replace + end + + describe 'parameter :ensure_newline' do + it_behaves_like 'Puppet::Parameter::Boolean', :ensure_newline + end +end diff --git a/environments/production/modules/firewall/CHANGELOG.md b/environments/production/modules/firewall/CHANGELOG.md new file mode 100644 index 0000000..17057bc --- /dev/null +++ b/environments/production/modules/firewall/CHANGELOG.md @@ -0,0 +1,618 @@ +## Supported Release 1.8.2 +### Summary +This release includes numerous features and bugfixes, See below. + +#### Bugfixes +- Fixing issue with double quotes being removed when part of the rule comment +- Add the --wait flag to the insert/update/delete iptables actions to prevent failures from occuring when iptables is running outside of puppet for iptables >= 1.4.20 +- Fix iptables_version and ip6tables_version facts not returning the version + +#### Features +- Support for multiple IP sets in a single rule +- Implement queue_bypass and queue_num parameters for NFQUEUE jump target +- Tighten SELinux permissions on persistent files +- RHEL7 SELinux support for puppet 3 +- Manage ip6tables service for Redhat Family + +## Supported Release 1.8.1 +### Summary +This release documents an important issue with mcollective that may impact users of the firewall module. Workarounds are suggested as part of this advisory until mcollective can be patched. + +#### Bugfixes +- Add mcollective rule-reversal known limitation + +## Supported Release 1.8.0 +### Summary + +This release includes numerous features, bugfixes and other improvements including better handling when trying to delete already absent rules. + +#### Features +- Added new 'pkg_ensure' parameter to allow the updating of the iptables package. +- Added new 'log_uid' property. +- Added 'sctp' to the 'proto' property. +- Added support for IPv6 NAT in Linux kernels >= 3.7. +- Added support for the security table. + +#### Bugfixes +- (MODULES-2783) Replaced hardcoded iptables service references with $service_name variable. +- (MODULES-1341) Recover when deleting absent rules. +- (MODULES-3032) Facter flush is called to clear Facter cache get up to date value for ':iptables_persistent_version'. +- (MODULES-2159) Fixed idempotency issue when using connlimit. +- Fixed the handling of chain names that contain '-f'. + +#### Improvements +- Numerous unit and acceptance test improvements. +- Improved handling/use of the '$::iptables_persistent_version' custom fact. +- Better handling of operating systems that use SELinux. + +## Supported Release 1.7.2 +### Summary + +Small release for support of newer PE versions. This increments the version of PE in the metadata.json file. + +## 2015-08-25 - Supported Release 1.7.1 +### Summary + +This is a bugfix release to deprecate the port parameter. Using the unspecific 'port' parameter can lead to firewall rules that are unexpectedly too lax. It is recommended to always use the specific dport and sport parameters to avoid this ambiguity. + +#### Bugfixes +- Deprecate the port parameter + +## 2015-07-28 - Supported Release 1.7.0 +### Summary + +This release includes numerous features, bugfixes and other improvements including Puppet 4 & PE 2015.2 support as well as ClusterIP and DSCP jump target support. + +#### Features +- Puppet 4 and PE 2015.2 official support +- ClusterIP jump target (including options) now supported +- DSCP jump target (including options) now supported +- SLES 10 now compatible (but not supported) + +#### Bugfixes +- (MODULES-1967) Parse escape sequences from iptables +- (MODULES-1592) Allow src_type and dst_type prefixed with '!' to pass validation +- (MODULES-2186) - iptables rules with -A in comment now supported +- (MODULES-1976) Revise rule name validation for ruby 1.9 +- Fix installation hang on Debian Jessie +- Fix for physdev idempotency on EL5 + +#### Improvements +- Documentation improvements +- Enforce the seluser on selinux systems +- All the relevent services are now autorequired by the firewall and firewallchain types +- Replace Facter.fact().value() calls with Facter.value() to support Facter 3 + +## 2015-05-19 - Supported Release 1.6.0 +### Summary + +This release includes support for TEE, MSS, the time ipt module, Debian 8 support, and a number of test fixes and other improvements. + +#### Features +- Add TEE support +- Add MSS support (including clamp-mss-to-pmtu support) +- Add support for the time ipt module (-m time) +- Add support for Debian 8 +- Add support for ICMPv6 types 'neighbour-{solicitation,advertisement}' +- Add support for ICMPv6 type 'too-big' +- Add support for new 'match_mark' property +- Added 'ipv4' and 'ipv6' options to 'proto' property + +#### Bugfixes +- Fix for Systemd-based OSes where systemd needs restarted before being able to pick up new services (MODULES-1984) +- Arch Linux package management fix + +## 2015-03-31 - Supported Release 1.5.0 +### Summary + +This release includes physdev_is_bridged support, checksum_fill support, basic Gentoo compatibility, and a number of test fixes and improvements. + +#### Features +- Add `physdev_is_bridged` support +- Add `checksum_fill` support +- Add basic Gentoo compatibility (unsupported) + +#### Bugfixes +- Implementation for resource map munging to allow a single ipt module to be used multiple times in a single rule on older versions of iptables (MODULES-1808) +- Test fixes + +## 2015-01-27 - Supported Release 1.4.0 +### Summary + +This release includes physdev support, the ability to look up usernames from uuid, and a number of bugfixes + +#### Features +- Add `netmap` feature +- Add `physdev` support +- Add ability to look up username from uuid (MODULES-753, MODULES-1688) + +#### Bugfixes +- Sync iptables/ip6tables providers (MODULES-1612) +- Fix package names for Amazon and Ubuntu 14.10 (MODULES-1029) +- Fix overly aggressive gsub when `ensure => absent` (MODULES-1453) +- Unable to parse `-m (tcp|udp)` rules (MODULES-1552) +- Fix ip6tables provider when `iptables-ipv6` package isn't installed for EL6 (MODULES-633) +- Test fixes + +## 2014-12-16 - Supported Release 1.3.0 +### Summary + +This release includes a number of bugfixes and features, including fixing `tcp_flags` support, and added support for interface aliases, negation for iniface and outiface, and extra configurability for packages and service names. + +#### Features +- Add support for interface aliases (eth0:0) (MODULES-1469) +- Add negation for iniface, outiface (MODULES-1470) +- Make package and service names configurable (MODULES-1309) + +#### Bugfixes +- Fix test regexes for EL5 (MODULES-1565) +- Fix `tcp_flags` support for ip6tables (MODULES-556) +- Don't arbitrarily limit `set_mark` for certain chains + +## 2014-11-04 - Supported Release 1.2.0 +### Summary + +This release has a number of new features and bugfixes, including rule inversion, future parser support, improved EL7 support, and the ability to purge ip6tables rules. + +#### Features +- Documentation updates! +- Test updates! +- Add ipset support +- Enable rule inversion +- Future parser support +- Improved support for EL7 +- Support netfilter-persistent +- Add support for statistics module +- Add support for mac address source rules +- Add cbt protocol + +#### Bugfixes +- Incorrect use of `source => :iptables` in the ip6tables provider was making it impossible to purge ip6tables rules (MODULES-41) +- Don't require `toports` when `jump => 'REDIRECT'` (MODULES-1086) +- Don't limit which chains iniface and outiface parameters can be used in +- Don't fail on rules added with ipsec/strongswan (MODULES-796) + +## 2014-07-08 - Supported Release 1.1.3 +### Summary +This is a supported release with test coverage enhancements. + +#### Bugfixes +- Confine to supported kernels + +## 2014-06-04 - Release 1.1.2 +### Summary + +This is a release of the code previously released as 1.1.1, with updated metadata. + +## 2014-05-16 Release 1.1.1 +### Summary + +This release reverts the alphabetical ordering of 1.1.0. We found this caused +a regression in the Openstack modules so in the interest of safety we have +removed this for now. + +## 2014-05-13 Release 1.1.0 +### Summary + +This release has a significant change from previous releases; we now apply the +firewall resources alphabetically by default, removing the need to create pre +and post classes just to enforce ordering. It only effects default ordering +and further information can be found in the README about this. Please test +this in development before rolling into production out of an abundance of +caution. + +We've also added `mask` which is required for --recent in recent (no pun +intended) versions of iptables, as well as connlimit and connmark. This +release has been validated against Ubuntu 14.04 and RHEL7 and should be fully +working on those platforms. + +#### Features + +- Apply firewall resources alphabetically. +- Add support for connlimit and connmark. +- Add `mask` as a parameter. (Used exclusively with the recent parameter). + +#### Bugfixes + +- Add systemd support for RHEL7. +- Replace &&'s with the correct and in manifests. +- Fix tests on Trusty and RHEL7 +- Fix for Fedora Rawhide. +- Fix boolean flag tests. +- Fix DNAT->SNAT typo in an error message. + +#### Known Bugs + +* For Oracle, the `owner` and `socket` parameters require a workaround to function. Please see the Limitations section of the README. + + +## 2014-03-04 Supported Release 1.0.2 +### Summary + +This is a supported release. This release removes a testing symlink that can +cause trouble on systems where /var is on a seperate filesystem from the +modulepath. + +#### Features +#### Bugfixes +#### Known Bugs + +* For Oracle, the `owner` and `socket` parameters require a workaround to function. Please see the Limitations section of the README. + +### Supported release - 2014-03-04 1.0.1 + +#### Summary + +An important bugfix was made to the offset calculation for unmanaged rules +to handle rules with 9000+ in the name. + +#### Features + +#### Bugfixes +- Offset calculations assumed unmanaged rules were numbered 9000+. +- Gracefully fail to manage ip6tables on iptables 1.3.x + +#### Known Bugs + +* For Oracle, the `owner` and `socket` parameters require a workaround to function. Please see the Limitations section of the README. + +--- +### 1.0.0 - 2014-02-11 + +No changes, just renumbering to 1.0.0. + +--- +### 0.5.0 - 2014-02-10 + +##### Summary: +This is a bigger release that brings in "recent" connection limiting (think +"port knocking"), firewall chain purging on a per-chain/per-table basis, and +support for a few other use cases. This release also fixes a major bug which +could cause modifications to the wrong rules when unmanaged rules are present. + +##### New Features: +* Add "recent" limiting via parameters `rdest`, `reap`, `recent`, `rhitcount`, + `rname`, `rseconds`, `rsource`, and `rttl` +* Add negation support for source and destination +* Add per-chain/table purging support to `firewallchain` +* IPv4 specific + * Add random port forwarding support + * Add ipsec policy matching via `ipsec_dir` and `ipsec_policy` +* IPv6 specific + * Add support for hop limiting via `hop_limit` parameter + * Add fragmentation matchers via `ishasmorefrags`, `islastfrag`, and `isfirstfrag` + * Add support for conntrack stateful firewall matching via `ctstate` + +##### Bugfixes: +- Boolean fixups allowing false values +- Better detection of unmanaged rules +- Fix multiport rule detection +- Fix sport/dport rule detection +- Make INPUT, OUTPUT, and FORWARD not autorequired for firewall chain filter +- Allow INPUT with the nat table +- Fix `src_range` & `dst_range` order detection +- Documentation clarifications +- Fixes to spec tests + +--------------------------------------- + +### 0.4.2 - 2013-09-10 + +Another attempt to fix the packaging issue. We think we understand exactly +what is failing and this should work properly for the first time. + +--------------------------------------- + +### 0.4.1 - 2013-08-09 + +Bugfix release to fix a packaging issue that may have caused puppet module +install commands to fail. + +--------------------------------------- + +### 0.4.0 - 2013-07-11 + +This release adds support for address type, src/dest ip ranges, and adds +additional testing and bugfixes. + +#### Features +* Add `src_type` and `dst_type` attributes (Nick Stenning) +* Add `src_range` and `dst_range` attributes (Lei Zhang) +* Add SL and SLC operatingsystems as supported (Steve Traylen) + +#### Bugfixes +* Fix parser for bursts other than 5 (Chris Rutter) +* Fix parser for -f in --comment (Georg Koester) +* Add doc headers to class files (Dan Carley) +* Fix lint warnings/errors (Wolf Noble) + +--------------------------------------- + +### 0.3.1 - 2013/6/10 + +This minor release provides some bugfixes and additional tests. + +#### Changes + +* Update tests for rspec-system-puppet 2 (Ken Barber) +* Update rspec-system tests for rspec-system-puppet 1.5 (Ken Barber) +* Ensure all services have 'hasstatus => true' for Puppet 2.6 (Ken Barber) +* Accept pre-existing rule with invalid name (Joe Julian) +* Swap log_prefix and log_level order to match the way it's saved (Ken Barber) +* Fix log test to replicate bug #182 (Ken Barber) +* Split argments while maintaining quoted strings (Joe Julian) +* Add more log param tests (Ken Barber) +* Add extra tests for logging parameters (Ken Barber) +* Clarify OS support (Ken Barber) + +--------------------------------------- + +### 0.3.0 - 2013/4/25 + +This release introduces support for Arch Linux and extends support for Fedora 15 and up. There are also lots of bugs fixed and improved testing to prevent regressions. + +##### Changes + +* Fix error reporting for insane hostnames (Tomas Doran) +* Support systemd on Fedora 15 and up (Eduardo Gutierrez) +* Move examples to docs (Ken Barber) +* Add support for Arch Linux platform (Ingmar Steen) +* Add match rule for fragments (Georg Koester) +* Fix boolean rules being recognized as changed (Georg Koester) +* Same rules now get deleted (Anastasis Andronidis) +* Socket params test (Ken Barber) +* Ensure parameter can disable firewall (Marc Tardif) + +--------------------------------------- + +### 0.2.1 - 2012/3/13 + +This maintenance release introduces the new README layout, and fixes a bug with iptables_persistent_version. + +##### Changes + +* (GH-139) Throw away STDERR from dpkg-query in Fact +* Update README to be consistent with module documentation template +* Fix failing spec tests due to dpkg change in iptables_persistent_version + +--------------------------------------- + +### 0.2.0 - 2012/3/3 + +This release introduces automatic persistence, removing the need for the previous manual dependency requirement for persistent the running rules to the OS persistence file. + +Previously you would have required the following in your site.pp (or some other global location): + + # Always persist firewall rules + exec { 'persist-firewall': + command => $operatingsystem ? { + 'debian' => '/sbin/iptables-save > /etc/iptables/rules.v4', + /(RedHat|CentOS)/ => '/sbin/iptables-save > /etc/sysconfig/iptables', + }, + refreshonly => true, + } + Firewall { + notify => Exec['persist-firewall'], + before => Class['my_fw::post'], + require => Class['my_fw::pre'], + } + Firewallchain { + notify => Exec['persist-firewall'], + } + resources { "firewall": + purge => true + } + +You only need: + + class { 'firewall': } + Firewall { + before => Class['my_fw::post'], + require => Class['my_fw::pre'], + } + +To install pre-requisites and to create dependencies on your pre & post rules. Consult the README for more information. + +##### Changes + +* Firewall class manifests (Dan Carley) +* Firewall and firewallchain persistence (Dan Carley) +* (GH-134) Autorequire iptables related packages (Dan Carley) +* Typo in #persist_iptables OS normalisation (Dan Carley) +* Tests for #persist_iptables (Dan Carley) +* (GH-129) Replace errant return in autoreq block (Dan Carley) + +--------------------------------------- + +### 0.1.1 - 2012/2/28 + +This release primarily fixes changing parameters in 3.x + +##### Changes + +* (GH-128) Change method_missing usage to define_method for 3.x compatibility +* Update travis.yml gem specifications to actually test 2.6 +* Change source in Gemfile to use a specific URL for Ruby 2.0.0 compatibility + +--------------------------------------- + +### 0.1.0 - 2012/2/24 + +This release is somewhat belated, so no summary as there are far too many changes this time around. Hopefully we won't fall this far behind again :-). + +##### Changes + +* Add support for MARK target and set-mark property (Johan Huysmans) +* Fix broken call to super for ruby-1.9.2 in munge (Ken Barber) +* simple fix of the error message for allowed values of the jump property (Daniel Black) +* Adding OSPF(v3) protocol to puppetlabs-firewall (Arnoud Vermeer) +* Display multi-value: port, sport, dport and state command seperated (Daniel Black) +* Require jump=>LOG for log params (Daniel Black) +* Reject and document icmp => "any" (Dan Carley) +* add firewallchain type and iptables_chain provider (Daniel Black) +* Various fixes for firewallchain resource (Ken Barber) +* Modify firewallchain name to be chain:table:protocol (Ken Barber) +* Fix allvalidchain iteration (Ken Barber) +* Firewall autorequire Firewallchains (Dan Carley) +* Tests and docstring for chain autorequire (Dan Carley) +* Fix README so setup instructions actually work (Ken Barber) +* Support vlan interfaces (interface containing ".") (Johan Huysmans) +* Add tests for VLAN support for iniface/outiface (Ken Barber) +* Add the table when deleting rules (Johan Huysmans) +* Fix tests since we are now prefixing -t) +* Changed 'jump' to 'action', commands to lower case (Jason Short) +* Support interface names containing "+" (Simon Deziel) +* Fix for when iptables-save spews out "FATAL" errors (Sharif Nassar) +* Fix for incorrect limit command arguments for ip6tables provider (Michael Hsu) +* Document Util::Firewall.host_to_ip (Dan Carley) +* Nullify addresses with zero prefixlen (Dan Carley) +* Add support for --tcp-flags (Thomas Vander Stichele) +* Make tcp_flags support a feature (Ken Barber) +* OUTPUT is a valid chain for the mangle table (Adam Gibbins) +* Enable travis-ci support (Ken Barber) +* Convert an existing test to CIDR (Dan Carley) +* Normalise iptables-save to CIDR (Dan Carley) +* be clearer about what distributions we support (Ken Barber) +* add gre protocol to list of acceptable protocols (Jason Hancock) +* Added pkttype property (Ashley Penney) +* Fix mark to not repeat rules with iptables 1.4.1+ (Sharif Nassar) +* Stub iptables_version for now so tests run on non-Linux hosts (Ken Barber) +* Stub iptables facts for set_mark tests (Dan Carley) +* Update formatting of README to meet Puppet Labs best practices (Will Hopper) +* Support for ICMP6 type code resolutions (Dan Carley) +* Insert order hash included chains from different tables (Ken Barber) +* rspec 2.11 compatibility (Jonathan Boyett) +* Add missing class declaration in README (sfozz) +* array_matching is contraindicated (Sharif Nassar) +* Convert port Fixnum into strings (Sharif Nassar) +* Update test framework to the modern age (Ken Barber) +* working with ip6tables support (wuwx) +* Remove gemfile.lock and add to gitignore (William Van Hevelingen) +* Update travis and gemfile to be like stdlib travis files (William Van Hevelingen) +* Add support for -m socket option (Ken Barber) +* Add support for single --sport and --dport parsing (Ken Barber) +* Fix tests for Ruby 1.9.3 from 3e13bf3 (Dan Carley) +* Mock Resolv.getaddress in #host_to_ip (Dan Carley) +* Update docs for source and dest - they are not arrays (Ken Barber) + +--------------------------------------- + +### 0.0.4 - 2011/12/05 + +This release adds two new parameters, 'uid' and 'gid'. As a part of the owner module, these params allow you to specify a uid, username, gid, or group got a match: + + firewall { '497 match uid': + port => '123', + proto => 'mangle', + chain => 'OUTPUT', + action => 'drop' + uid => '123' + } + +This release also adds value munging for the 'log_level', 'source', and 'destination' parameters. The 'source' and 'destination' now support hostnames: + + firewall { '498 accept from puppetlabs.com': + port => '123', + proto => 'tcp', + source => 'puppetlabs.com', + action => 'accept' + } + + +The 'log_level' parameter now supports using log level names, such as 'warn', 'debug', and 'panic': + + firewall { '499 logging': + port => '123', + proto => 'udp', + log_level => 'debug', + action => 'drop' + } + +Additional changes include iptables and ip6tables version facts, general whitespace cleanup, and adding additional unit tests. + +##### Changes + +* (#10957) add iptables_version and ip6tables_version facts +* (#11093) Improve log_level property so it converts names to numbers +* (#10723) Munge hostnames and IPs to IPs with CIDR +* (#10718) Add owner-match support +* (#10997) Add fixtures for ipencap +* (#11034) Whitespace cleanup +* (#10690) add port property support to ip6tables + +--------------------------------------- + +### 0.0.3 - 2011/11/12 + +This release introduces a new parameter 'port' which allows you to set both +source and destination ports for a match: + + firewall { "500 allow NTP requests": + port => "123", + proto => "udp", + action => "accept", + } + +We also have the limit parameter finally working: + + firewall { "500 limit HTTP requests": + dport => 80, + proto => tcp, + limit => "60/sec", + burst => 30, + action => accept, + } + +State ordering has been fixed now, and more characters are allowed in the +namevar: + +* Alphabetical +* Numbers +* Punctuation +* Whitespace + +##### Changes + +* (#10693) Ensure -m limit is added for iptables when using 'limit' param +* (#10690) Create new port property +* (#10700) allow additional characters in comment string +* (#9082) Sort iptables --state option values internally to keep it consistent across runs +* (#10324) Remove extraneous whitespace from iptables rule line in spec tests + +--------------------------------------- + +### 0.0.2 - 2011/10/26 + +This is largely a maintanence and cleanup release, but includes the ability to +specify ranges of ports in the sport/dport parameter: + + firewall { "500 allow port range": + dport => ["3000-3030","5000-5050"], + sport => ["1024-65535"], + action => "accept", + } + +##### Changes + +* (#10295) Work around bug #4248 whereby the puppet/util paths are not being loaded correctly on the puppetmaster +* (#10002) Change to dport and sport to handle ranges, and fix handling of name to name to port +* (#10263) Fix tests on Puppet 2.6.x +* (#10163) Cleanup some of the inline documentation and README file to align with general forge usage + +--------------------------------------- + +### 0.0.1 - 2011/10/18 + +Initial release. + +##### Changes + +* (#9362) Create action property and perform transformation for accept, drop, reject value for iptables jump parameter +* (#10088) Provide a customised version of CONTRIBUTING.md +* (#10026) Re-arrange provider and type spec files to align with Puppet +* (#10026) Add aliases for test,specs,tests to Rakefile and provide -T as default +* (#9439) fix parsing and deleting existing rules +* (#9583) Fix provider detection for gentoo and unsupported linuxes for the iptables provider +* (#9576) Stub provider so it works properly outside of Linux +* (#9576) Align spec framework with Puppet core +* and lots of other earlier development tasks ... diff --git a/environments/production/modules/firewall/CONTRIBUTING.md b/environments/production/modules/firewall/CONTRIBUTING.md new file mode 100644 index 0000000..3c3f1e7 --- /dev/null +++ b/environments/production/modules/firewall/CONTRIBUTING.md @@ -0,0 +1,218 @@ +Checklist (and a short version for the impatient) +================================================= + + * Commits: + + - Make commits of logical units. + + - Check for unnecessary whitespace with "git diff --check" before + committing. + + - Commit using Unix line endings (check the settings around "crlf" in + git-config(1)). + + - Do not check in commented out code or unneeded files. + + - The first line of the commit message should be a short + description (50 characters is the soft limit, excluding ticket + number(s)), and should skip the full stop. + + - Associate the issue in the message. The first line should include + the issue number in the form "(#XXXX) Rest of message". + + - The body should provide a meaningful commit message, which: + + - uses the imperative, present tense: "change", not "changed" or + "changes". + + - includes motivation for the change, and contrasts its + implementation with the previous behavior. + + - Make sure that you have tests for the bug you are fixing, or + feature you are adding. + + - Make sure the test suites passes after your commit: + `bundle exec rspec spec/acceptance` More information on [testing](#Testing) below + + - When introducing a new feature, make sure it is properly + documented in the README.md + + * Submission: + + * Pre-requisites: + + - Make sure you have a [GitHub account](https://github.com/join) + + - [Create a ticket](https://tickets.puppetlabs.com/secure/CreateIssue!default.jspa), or [watch the ticket](https://tickets.puppetlabs.com/browse/) you are patching for. + + * Preferred method: + + - Fork the repository on GitHub. + + - Push your changes to a topic branch in your fork of the + repository. (the format ticket/1234-short_description_of_change is + usually preferred for this project). + + - Submit a pull request to the repository in the puppetlabs + organization. + +The long version +================ + + 1. Make separate commits for logically separate changes. + + Please break your commits down into logically consistent units + which include new or changed tests relevant to the rest of the + change. The goal of doing this is to make the diff easier to + read for whoever is reviewing your code. In general, the easier + your diff is to read, the more likely someone will be happy to + review it and get it into the code base. + + If you are going to refactor a piece of code, please do so as a + separate commit from your feature or bug fix changes. + + We also really appreciate changes that include tests to make + sure the bug is not re-introduced, and that the feature is not + accidentally broken. + + Describe the technical detail of the change(s). If your + description starts to get too long, that is a good sign that you + probably need to split up your commit into more finely grained + pieces. + + Commits which plainly describe the things which help + reviewers check the patch and future developers understand the + code are much more likely to be merged in with a minimum of + bike-shedding or requested changes. Ideally, the commit message + would include information, and be in a form suitable for + inclusion in the release notes for the version of Puppet that + includes them. + + Please also check that you are not introducing any trailing + whitespace or other "whitespace errors". You can do this by + running "git diff --check" on your changes before you commit. + + 2. Sending your patches + + To submit your changes via a GitHub pull request, we _highly_ + recommend that you have them on a topic branch, instead of + directly on "master". + It makes things much easier to keep track of, especially if + you decide to work on another thing before your first change + is merged in. + + GitHub has some pretty good + [general documentation](http://help.github.com/) on using + their site. They also have documentation on + [creating pull requests](http://help.github.com/send-pull-requests/). + + In general, after pushing your topic branch up to your + repository on GitHub, you can switch to the branch in the + GitHub UI and click "Pull Request" towards the top of the page + in order to open a pull request. + + + 3. Update the related GitHub issue. + + If there is a GitHub issue associated with the change you + submitted, then you should update the ticket to include the + location of your branch, along with any other commentary you + may wish to make. + +Testing +======= + +Getting Started +--------------- + +Our puppet modules provide [`Gemfile`](./Gemfile)s which can tell a ruby +package manager such as [bundler](http://bundler.io/) what Ruby packages, +or Gems, are required to build, develop, and test this software. + +Please make sure you have [bundler installed](http://bundler.io/#getting-started) +on your system, then use it to install all dependencies needed for this project, +by running + +```shell +% bundle install +Fetching gem metadata from https://rubygems.org/........ +Fetching gem metadata from https://rubygems.org/.. +Using rake (10.1.0) +Using builder (3.2.2) +-- 8><-- many more --><8 -- +Using rspec-system-puppet (2.2.0) +Using serverspec (0.6.3) +Using rspec-system-serverspec (1.0.0) +Using bundler (1.3.5) +Your bundle is complete! +Use `bundle show [gemname]` to see where a bundled gem is installed. +``` + +NOTE some systems may require you to run this command with sudo. + +If you already have those gems installed, make sure they are up-to-date: + +```shell +% bundle update +``` + +With all dependencies in place and up-to-date we can now run the tests: + +```shell +% bundle exec rake spec +``` + +This will execute all the [rspec tests](http://rspec-puppet.com/) tests +under [spec/defines](./spec/defines), [spec/classes](./spec/classes), +and so on. rspec tests may have the same kind of dependencies as the +module they are testing. While the module defines in its [Modulefile](./Modulefile), +rspec tests define them in [.fixtures.yml](./fixtures.yml). + +Some puppet modules also come with [beaker](https://github.com/puppetlabs/beaker) +tests. These tests spin up a virtual machine under +[VirtualBox](https://www.virtualbox.org/)) with, controlling it with +[Vagrant](http://www.vagrantup.com/) to actually simulate scripted test +scenarios. In order to run these, you will need both of those tools +installed on your system. + +You can run them by issuing the following command + +```shell +% bundle exec rake spec_clean +% bundle exec rspec spec/acceptance +``` + +This will now download a pre-fabricated image configured in the [default node-set](./spec/acceptance/nodesets/default.yml), +install puppet, copy this module and install its dependencies per [spec/spec_helper_acceptance.rb](./spec/spec_helper_acceptance.rb) +and then run all the tests under [spec/acceptance](./spec/acceptance). + +Writing Tests +------------- + +XXX getting started writing tests. + +If you have commit access to the repository +=========================================== + +Even if you have commit access to the repository, you will still need to +go through the process above, and have someone else review and merge +in your changes. The rule is that all changes must be reviewed by a +developer on the project (that did not write the code) to ensure that +all changes go through a code review process. + +Having someone other than the author of the topic branch recorded as +performing the merge is the record that they performed the code +review. + + +Additional Resources +==================== + +* [Getting additional help](http://puppet.com/community/get-help) + +* [Writing tests](https://docs.puppet.com/guides/module_guides/bgtm.html#step-three-module-testing) + +* [General GitHub documentation](http://help.github.com/) + +* [GitHub pull request documentation](http://help.github.com/send-pull-requests/) + diff --git a/environments/production/modules/firewall/Gemfile b/environments/production/modules/firewall/Gemfile new file mode 100644 index 0000000..3d46720 --- /dev/null +++ b/environments/production/modules/firewall/Gemfile @@ -0,0 +1,87 @@ +#This file is generated by ModuleSync, do not edit. + +source ENV['GEM_SOURCE'] || "https://rubygems.org" + +# Determines what type of gem is requested based on place_or_version. +def gem_type(place_or_version) + if place_or_version =~ /^git:/ + :git + elsif place_or_version =~ /^file:/ + :file + else + :gem + end +end + +# Find a location or specific version for a gem. place_or_version can be a +# version, which is most often used. It can also be git, which is specified as +# `git://somewhere.git#branch`. You can also use a file source location, which +# is specified as `file://some/location/on/disk`. +def location_for(place_or_version, fake_version = nil) + if place_or_version =~ /^(git[:@][^#]*)#(.*)/ + [fake_version, { :git => $1, :branch => $2, :require => false }].compact + elsif place_or_version =~ /^file:\/\/(.*)/ + ['>= 0', { :path => File.expand_path($1), :require => false }] + else + [place_or_version, { :require => false }] + end +end + +# Used for gem conditionals +supports_windows = false + +group :development do + gem 'puppet-lint', :require => false + gem 'metadata-json-lint', :require => false, :platforms => 'ruby' + gem 'puppet_facts', :require => false + gem 'puppet-blacksmith', '>= 3.4.0', :require => false, :platforms => 'ruby' + gem 'puppetlabs_spec_helper', '>= 1.2.1', :require => false + gem 'rspec-puppet', '>= 2.3.2', :require => false + gem 'rspec-puppet-facts', :require => false, :platforms => 'ruby' + gem 'mocha', '< 1.2.0', :require => false + gem 'simplecov', :require => false, :platforms => 'ruby' + gem 'parallel_tests', '< 2.10.0', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'parallel_tests', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.0.0') + gem 'rubocop', '0.41.2', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'rubocop', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.0.0') + gem 'rubocop-rspec', '~> 1.6', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.3.0') + gem 'pry', :require => false + gem 'json_pure', '<= 2.0.1', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'fast_gettext', '1.1.0', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.1.0') + gem 'fast_gettext', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.1.0') +end + +group :system_tests do + gem 'beaker', *location_for(ENV['BEAKER_VERSION'] || '~> 2.20') if supports_windows + gem 'beaker', *location_for(ENV['BEAKER_VERSION']) if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.3.0') and ! supports_windows + gem 'beaker', *location_for(ENV['BEAKER_VERSION'] || '< 3') if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.3.0') and ! supports_windows + gem 'beaker-pe', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.3.0') + gem 'beaker-rspec', *location_for(ENV['BEAKER_RSPEC_VERSION'] || '>= 3.4') if ! supports_windows + gem 'beaker-rspec', *location_for(ENV['BEAKER_RSPEC_VERSION'] || '~> 5.1') if supports_windows + gem 'beaker-puppet_install_helper', :require => false + gem 'master_manipulator', :require => false + gem 'beaker-hostgenerator', *location_for(ENV['BEAKER_HOSTGENERATOR_VERSION']) + gem 'beaker-abs', *location_for(ENV['BEAKER_ABS_VERSION'] || '~> 0.1') +end + +gem 'puppet', *location_for(ENV['PUPPET_GEM_VERSION']) + +# Only explicitly specify Facter/Hiera if a version has been specified. +# Otherwise it can lead to strange bundler behavior. If you are seeing weird +# gem resolution behavior, try setting `DEBUG_RESOLVER` environment variable +# to `1` and then run bundle install. +gem 'facter', *location_for(ENV['FACTER_GEM_VERSION']) if ENV['FACTER_GEM_VERSION'] +gem 'hiera', *location_for(ENV['HIERA_GEM_VERSION']) if ENV['HIERA_GEM_VERSION'] + + +# Evaluate Gemfile.local if it exists +if File.exists? "#{__FILE__}.local" + eval(File.read("#{__FILE__}.local"), binding) +end + +# Evaluate ~/.gemfile if it exists +if File.exists?(File.join(Dir.home, '.gemfile')) + eval(File.read(File.join(Dir.home, '.gemfile')), binding) +end + +# vim:ft=ruby diff --git a/environments/production/modules/firewall/LICENSE b/environments/production/modules/firewall/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/environments/production/modules/firewall/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/environments/production/modules/firewall/NOTICE b/environments/production/modules/firewall/NOTICE new file mode 100644 index 0000000..b221448 --- /dev/null +++ b/environments/production/modules/firewall/NOTICE @@ -0,0 +1,26 @@ +firewall puppet module + +Copyright (C) 2011-2016 Puppet Labs, Inc. +Copyright (C) 2011 Jonathan Boyett +Copyright (C) 2011 Media Temple, Inc. + +Some of the iptables code was taken from puppet-iptables which was: + +Copyright (C) 2011 Bob.sh Limited +Copyright (C) 2008 Camptocamp Association +Copyright (C) 2007 Dmitri Priimak + +Puppet Labs can be contacted at: info@puppetlabs.com + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/environments/production/modules/firewall/README.markdown b/environments/production/modules/firewall/README.markdown new file mode 100644 index 0000000..a06d423 --- /dev/null +++ b/environments/production/modules/firewall/README.markdown @@ -0,0 +1,943 @@ +#firewall + +[![Build Status](https://travis-ci.org/puppetlabs/puppetlabs-firewall.png?branch=master)](https://travis-ci.org/puppetlabs/puppetlabs-firewall) + +####Table of Contents + +1. [Overview - What is the firewall module?](#overview) +2. [Module Description - What does the module do?](#module-description) +3. [Setup - The basics of getting started with firewall](#setup) + * [What firewall Affects](#what-firewall-affects) + * [Setup Requirements](#setup-requirements) + * [Beginning with firewall](#beginning-with-firewall) + * [Upgrading](#upgrading) +4. [Usage - Configuration and customization options](#usage) + * [Default rules - Setting up general configurations for all firewalls](#default-rules) + * [Application-Specific Rules - Options for configuring and managing firewalls across applications](#application-specific-rules) + * [Additional Uses for the Firewall Module](#other-rules) +5. [Reference - An under-the-hood peek at what the module is doing](#reference) +6. [Limitations - OS compatibility, etc.](#limitations) +7. [Development - Guide for contributing to the module](#development) + * [Tests - Testing your configuration](#tests) + +## Overview + +The firewall module lets you manage firewall rules with Puppet. + +## Module Description + +PuppetLabs' firewall module introduces the `firewall` resource, which is used to manage and configure firewall rules from within the Puppet DSL. This module offers support for iptables and ip6tables. The module also introduces the `firewallchain` resource, which allows you to manage chains or firewall lists and ebtables for bridging support. At the moment, only iptables and ip6tables chains are supported. + +The firewall module acts on your running firewall, making immediate changes as the catalog executes. Defining default pre and post rules allows you to provide global defaults for your hosts before and after any custom rules. Defining `pre` and `post` rules is also necessary to help you avoid locking yourself out of your own boxes when Puppet runs. + +## Setup + +### What firewall Affects + +* Every node running a firewall +* Firewall settings in your system +* Connection settings for managed nodes +* Unmanaged resources (get purged) + + +### Setup Requirements + +Firewall uses Ruby-based providers, so you must enable [pluginsync](http://docs.puppetlabs.com/guides/plugins_in_modules.html#enabling-pluginsync). + +### Beginning with firewall + +In the following two sections, you create new classes and then create firewall rules related to those classes. These steps are optional but provide a framework for firewall rules, which is helpful if you’re just starting to create them. + +If you already have rules in place, then you don’t need to do these two sections. However, be aware of the ordering of your firewall rules. The module will dynamically apply rules in the order they appear in the catalog, meaning a deny rule could be applied before the allow rules. This might mean the module hasn’t established some of the important connections, such as the connection to the Puppet master. + +The following steps are designed to ensure that you keep your SSH and other connections, primarily your connection to your Puppet master. If you create the `pre` and `post` classes described in the first section, then you also need to create the rules described in the second section. + +#### Create the `my_fw::pre` and `my_fw::post` Classes + +This approach employs a whitelist setup, so you can define what rules you want and everything else is ignored rather than removed. + +The code in this section does the following: + +* The 'require' parameter in `firewall {}` ensures `my_fw::pre` is run before any other rules. +* In the `my_fw::post` class declaration, the 'before' parameter ensures `my_fw::post` is run after any other rules. + +Therefore, the run order is: + +* The rules in `my_fw::pre` +* Your rules (defined in code) +* The rules in `my_fw::post` + +The rules in the `pre` and `post` classes are fairly general. These two classes ensure that you retain connectivity and that you drop unmatched packets appropriately. The rules you define in your manifests are likely specific to the applications you run. + +1.) Add the `pre` class to my_fw/manifests/pre.pp. Your pre.pp file should contain any default rules to be applied first. The rules in this class should be added in the order you want them to run.2. + ~~~puppet + class my_fw::pre { + Firewall { + require => undef, + } + + # Default firewall rules + firewall { '000 accept all icmp': + proto => 'icmp', + action => 'accept', + }-> + firewall { '001 accept all to lo interface': + proto => 'all', + iniface => 'lo', + action => 'accept', + }-> + firewall { '002 reject local traffic not on loopback interface': + iniface => '! lo', + proto => 'all', + destination => '127.0.0.1/8', + action => 'reject', + }-> + firewall { '003 accept related established rules': + proto => 'all', + state => ['RELATED', 'ESTABLISHED'], + action => 'accept', + } + } + ~~~ + + The rules in `pre` should allow basic networking (such as ICMP and TCP) and ensure that existing connections are not closed. + +2.) Add the `post` class to my_fw/manifests/post.pp and include any default rules to be applied last. + + ~~~puppet + class my_fw::post { + firewall { '999 drop all': + proto => 'all', + action => 'drop', + before => undef, + } + } + ~~~ + +Alternatively, the [firewallchain](#type-firewallchain) type can be used to set the default policy: + + ~~~puppet + firewallchain { 'INPUT:filter:IPv4': + ensure => present, + policy => drop, + before => undef, + } + ~~~ + +#### Create Firewall Rules + +The rules you create here are helpful if you don’t have any existing rules; they help you order your firewall configurations so you don’t lock yourself out of your box. + +Rules are persisted automatically between reboots, although there are known issues with ip6tables on older Debian/Ubuntu distributions. There are also known issues with ebtables. + +1.) In site.pp or another top-scope file, add the following code to set up a metatype to purge unmanaged firewall resources. This will clear any existing rules and make sure that only rules defined in Puppet exist on the machine. + + ~~~puppet + resources { 'firewall': + purge => true, + } + ~~~ + + To purge unmanaged firewall chains, also add: + + ~~~puppet + resources { 'firewallchain': + purge => true, + } + ~~~ + + **Note** - If there are unmanaged rules in unmanaged chains, it will take two Puppet runs before the firewall chain is purged. This is different than the `purge` parameter available in `firewallchain`. + +2.) Use the following code to set up the default parameters for all of the firewall rules you will establish later. These defaults will ensure that the `pre` and `post` classes are run in the correct order to avoid locking you out of your box during the first Puppet run. + + ~~~puppet + Firewall { + before => Class['my_fw::post'], + require => Class['my_fw::pre'], + } + ~~~ + +3.) Then, declare the `my_fw::pre` and `my_fw::post` classes to satisfy dependencies. You can declare these classes using an External Node Classifier or the following code: + + ~~~puppet + class { ['my_fw::pre', 'my_fw::post']: } + ~~~ + +4.) Include the `firewall` class to ensure the correct packages are installed. + + ~~~puppet + class { 'firewall': } + ~~~ + +### Upgrading + +Use these steps if you already have a version of the firewall module installed. + +#### From version 0.2.0 and more recent + +Upgrade the module with the puppet module tool as normal: + + puppet module upgrade puppetlabs/firewall + +## Usage + +There are two kinds of firewall rules you can use with firewall: default rules and application-specific rules. Default rules apply to general firewall settings, whereas application-specific rules manage firewall settings for a specific application, node, etc. + +All rules employ a numbering system in the resource's title that is used for ordering. When titling your rules, make sure you prefix the rule with a number, for example, '000 accept all icmp requests'. _000_ runs first, _999_ runs last. + +### Default Rules + +You can place default rules in either `my_fw::pre` or `my_fw::post`, depending on when you would like them to run. Rules placed in the `pre` class will run first, and rules in the `post` class, last. + +In iptables, the title of the rule is stored using the comment feature of the underlying firewall subsystem. Values must match '/^\d+[[:graph:][:space:]]+$/'. + +#### Examples of Default Rules + +Basic accept ICMP request example: + +~~~puppet +firewall { '000 accept all icmp requests': + proto => 'icmp', + action => 'accept', +} +~~~ + +Drop all: + +~~~puppet +firewall { '999 drop all other requests': + action => 'drop', +} +~~~ + +#### Example of an IPv6 rule + +IPv6 rules can be specified using the _ip6tables_ provider: + +~~~puppet +firewall { '006 Allow inbound SSH (v6)': + dport => 22, + proto => tcp, + action => accept, + provider => 'ip6tables', +} +~~~ + +### Application-Specific Rules + +Puppet doesn't care where you define rules, and this means that you can place +your firewall resources as close to the applications and services that you +manage as you wish. If you use the [roles and profiles +pattern](https://puppetlabs.com/learn/roles-profiles-introduction) then it +makes sense to create your firewall rules in the profiles, so they +remain close to the services managed by the profile. + +This is an example of firewall rules in a profile: + +~~~puppet +class profile::apache { + include apache + apache::vhost { 'mysite': ensure => present } + + firewall { '100 allow http and https access': + dport => [80, 443], + proto => tcp, + action => accept, + } +} +~~~ + +### Rule inversion +Firewall rules may be inverted by prefixing the value of a parameter by "! ". If the value is an array, then every item in the array must be prefixed as iptables does not understand inverting a single value. + +Parameters that understand inversion are: connmark, ctstate, destination, dport, dst\_range, dst\_type, iniface, outiface, port, proto, source, sport, src\_range, src\_type, and state. + +Examples: + +~~~puppet +firewall { '001 disallow esp protocol': + action => 'accept', + proto => '! esp', +} +firewall { '002 drop NEW external website packets with FIN/RST/ACK set and SYN unset': + chain => 'INPUT', + state => 'NEW', + action => 'drop', + proto => 'tcp', + sport => ['! http', '! 443'], + source => '! 10.0.0.0/8', + tcp_flags => '! FIN,SYN,RST,ACK SYN', +} +~~~ + +### Additional Uses for the Firewall Module + +You can apply firewall rules to specific nodes. Usually, you will want to put the firewall rule in another class and apply that class to a node. Apply a rule to a node as follows: + +~~~puppet +node 'some.node.com' { + firewall { '111 open port 111': + dport => 111, + } +} +~~~ + +You can also do more complex things with the `firewall` resource. This example sets up static NAT for the source network 10.1.2.0/24: + +~~~puppet +firewall { '100 snat for network foo2': + chain => 'POSTROUTING', + jump => 'MASQUERADE', + proto => 'all', + outiface => 'eth0', + source => '10.1.2.0/24', + table => 'nat', +} +~~~ + + +You can also change the TCP MSS value for VPN client traffic: + +~~~puppet +firewall { '110 TCPMSS for VPN clients': + chain => 'FORWARD', + table => 'mangle', + source => '10.0.2.0/24', + proto => tcp, + tcp_flags => 'SYN,RST SYN', + mss => '1361:1541', + set_mss => '1360', + jump => 'TCPMSS', +} +~~~ + +The following will mirror all traffic sent to the server to a secondary host on the LAN with the TEE target: + +~~~puppet +firewall { '503 Mirror traffic to IDS': + proto => all, + jump => 'TEE', + gateway => '10.0.0.2', + chain => 'PREROUTING', + table => 'mangle', +} +~~~ + +The following example creates a new chain and forwards any port 5000 access to it. +~~~puppet +firewall { '100 forward to MY_CHAIN': + chain => 'INPUT', + jump => 'MY_CHAIN', +} +# The namevar here is in the format chain_name:table:protocol +firewallchain { 'MY_CHAIN:filter:IPv4': + ensure => present, +} +firewall { '100 my rule': + chain => 'MY_CHAIN', + action => 'accept', + proto => 'tcp', + dport => 5000, +} +~~~ + +### Additional Information + +Access the inline documentation: + + puppet describe firewall + +Or + + puppet doc -r type + (and search for firewall) + +## Reference + +Classes: + +* [firewall](#class-firewall) + +Types: + +* [firewall](#type-firewall) +* [firewallchain](#type-firewallchain) + +Facts: + +* [ip6tables_version](#fact-ip6tablesversion) +* [iptables_version](#fact-iptablesversion) +* [iptables_persistent_version](#fact-iptablespersistentversion) + +### Class: firewall + +Performs the basic setup tasks required for using the firewall resources. + +At the moment this takes care of: + +* iptables-persistent package installation + +Include the `firewall` class for nodes that need to use the resources in this module: + + class { 'firewall': } + +#### ensure + +Parameter that controls the state of the iptables service on your system, allowing you to disable iptables if you want. + +`ensure` can either be 'running' or 'stopped'. Defaults to 'running'. + +#### pkg_ensure + +Parameter that controls the state of the iptables package on your system, allowing you to update it if you wish. + +`ensure` can either be 'present' or 'latest'. Defaults to 'present'. + +#### service_name + +Specify the name of the IPv4 iptables service. Defaults defined in `firewall::params`. + +#### service_name_v6 + +Specify the name of the IPv6 ip6tables service. Defaults defined in `firewall::params`. + +#### package_name + +Specify the platform-specific package(s) to install. Defaults defined in `firewall::params`. + +###Type: firewall + +This type enables you to manage firewall rules within Puppet. + +#### Providers +**Note:** Not all features are available with all providers. + + * `ip6tables`: Ip6tables type provider + * Required binaries: `ip6tables-save`, `ip6tables`. + * Supported features: `address_type`, `connection_limiting`, `dnat`, `hop_limiting`, `icmp_match`, `interface_match`, `iprange`, `ipsec_dir`, `ipsec_policy`, `ipset`, `iptables`, `isfirstfrag`, `ishasmorefrags`, `islastfrag`, `length`, `log_level`, `log_prefix`, `log_uid`, `mark`, `mask`, `mss`, `owner`, `pkttype`, `queue_bypass`, `queue_num`, `rate_limiting`, `recent_limiting`, `reject_type`, `snat`, `socket`, `state_match`, `string_matching`, `tcp_flags`. + +* `iptables`: Iptables type provider + * Required binaries: `iptables-save`, `iptables`. + * Default for `kernel` == `linux`. + * Supported features: `address_type`, `clusterip`, `connection_limiting`, `dnat`, `icmp_match`, `interface_match`, `iprange`, `ipsec_dir`, `ipsec_policy`, `ipset`, `iptables`, `isfragment`, `length`, `log_level`, `log_prefix`, `log_uid`, `mark`, `mask`, `mss`, `netmap`, `owner`, `pkttype`, `queue_bypass`, `queue_num`, `rate_limiting`, `recent_limiting`, `reject_type`, `snat`, `socket`, `state_match`, `string_matching`, `tcp_flags`. + +**Autorequires:** + +If Puppet is managing the iptables or ip6tables chains specified in the `chain` or `jump` parameters, the firewall resource will autorequire those firewallchain resources. + +If Puppet is managing the iptables or iptables-persistent packages, and the provider is iptables or ip6tables, the firewall resource will autorequire those packages to ensure that any required binaries are installed. + +#### Features + +* `address_type`: The ability to match on source or destination address type. + +* `clusterip`: Configure a simple cluster of nodes that share a certain IP and MAC address without an explicit load balancer in front of them. + +* `connection_limiting`: Connection limiting features. + +* `dnat`: Destination NATing. + +* `hop_limiting`: Hop limiting features. + +* `icmp_match`: The ability to match ICMP types. + +* `interface_match`: Interface matching. + +* `iprange`: The ability to match on source or destination IP range. + +* `ipsec_dir`: The ability to match IPsec policy direction. + +* `ipsec_policy`: The ability to match IPsec policy. + +* `iptables`: The provider provides iptables features. + +* `isfirstfrag`: The ability to match the first fragment of a fragmented ipv6 packet. + +* `isfragment`: The ability to match fragments. + +* `ishasmorefrags`: The ability to match a non-last fragment of a fragmented ipv6 packet. + +* `islastfrag`: The ability to match the last fragment of an ipv6 packet. + +* `length`: The ability to match the length of the layer-3 payload. + +* `log_level`: The ability to control the log level. + +* `log_prefix`: The ability to add prefixes to log messages. + +* `log_uid`: The ability to log the userid of the process which generated the packet. + +* `mark`: The ability to match or set the netfilter mark value associated with the packet. + +* `mask`: The ability to match recent rules based on the ipv4 mask. + +* `owner`: The ability to match owners. + +* `pkttype`: The ability to match a packet type. + +* `rate_limiting`: Rate limiting features. + +* `recent_limiting`: The netfilter recent module. + +* `reject_type`: The ability to control reject messages. + +* `set_mss`: Set the TCP MSS of a packet. + +* `snat`: Source NATing. + +* `socket`: The ability to match open sockets. + +* `state_match`: The ability to match stateful firewall states. + +* `string_matching`: The ability to match a given string by using some pattern matching strategy. + +* `tcp_flags`: The ability to match on particular TCP flag settings. + +* `netmap`: The ability to map entire subnets via source or destination nat rules. + +#### Parameters + +* `action`: This is the action to perform on a match. Valid values for this action are: + * 'accept': The packet is accepted. + * 'reject': The packet is rejected with a suitable ICMP response. + * 'drop': The packet is dropped. + + If you specify no value it will simply match the rule but perform no action unless you provide a provider-specific parameter (such as `jump`). + +* `burst`: Rate limiting burst value (per second) before limit checks apply. Values must match '/^\d+$/'. Requires the `rate_limiting` feature. + +* `clusterip_new`: Create a new ClusterIP. You always have to set this on the first rule for a given ClusterIP. Requires the `clusterip` feature. + +* `clusterip_hashmode`: Specify the hashing mode. Valid values are sourceip, sourceip-sourceport, sourceip-sourceport-destport. Requires the `clusterip` feature. + +* `clusterip_clustermac`: Specify the ClusterIP MAC address. Has to be a link-layer multicast address. Requires the `clusterip` feature. + +* `clusterip_total_nodes`: Number of total nodes within this cluster. Requires the `clusterip` feature. + +* `clusterip_local_node`: Local node number within this cluster. Requires the `clusterip` feature. + +* `clusterip_hash_init`: Specify the random seed used for hash initialization. Requires the `clusterip` feature. + +* `chain`: Name of the chain to use. You can provide a user-based chain or use one of the following built-in chains:'INPUT','FORWARD','OUTPUT','PREROUTING', or 'POSTROUTING'. The default value is 'INPUT'. Values must match '/^[a-zA-Z0-9\-_]+$/'. Requires the `iptables` feature. + +* `checksum_fill`: When using a `jump` value of 'CHECKSUM', this boolean makes sure that a checksum is calculated and filled in a packet that lacks a checksum. Valid values are 'true' or 'false'. Requires the `iptables` feature. + +* `clamp_mss_to_pmtu`: Enables PMTU Clamping support when using a jump target of 'TCPMSS'. Valid values are 'true' or 'false'. + +* `connlimit_above`: Connection limiting value for matched connections above n. Values must match '/^\d+$/'. Requires the `connection_limiting` feature. + +* `connlimit_mask`: Connection limiting by subnet mask for matched connections. Apply a subnet mask of /0 to /32 for IPv4, and a subnet mask of /0 to /128 for IPv6. Values must match '/^\d+$/'. Requires the `connection_limiting` feature. + +* `connmark`: Match the Netfilter mark value associated with the packet. Accepts values `mark/mask` or `mark`. These will be converted to hex if they are not hex already. Requires the `mark` feature. + +* `ctstate`: Matches a packet based on its state in the firewall stateful inspection table, using the conntrack module. Valid values are: 'INVALID', 'ESTABLISHED', 'NEW', 'RELATED'. Requires the `state_match` feature. + +* `date_start`: Start Date/Time for the rule to match, which must be in ISO 8601 "T" notation. The possible time range is '1970-01-01T00:00:00' to '2038-01-19T04:17:07' + +* `date_stop`: End Date/Time for the rule to match, which must be in ISO 8601 "T" notation. The possible time range is '1970-01-01T00:00:00' to '2038-01-19T04:17:07' + +* `destination`: The destination address to match. For example: `destination => '192.168.1.0/24'`. You can also negate a mask by putting ! in front. For example: `destination => '! 192.168.2.0/24'`. The destination can also be an IPv6 address if your provider supports it. + + For some firewall providers you can pass a range of ports in the format: 'start number-end number'. For example, '1-1024' would cover ports 1 to 1024. + +* `dport`: The destination port to match for this filter (if the protocol supports ports). Will accept a single element or an array. For some firewall providers you can pass a range of ports in the format: 'start number-end number'. For example, '1-1024' would cover ports 1 to 1024. + +* `dst_range`: The destination IP range. For example: `dst_range => '192.168.1.1-192.168.1.10'`. + + The destination IP range is must in 'IP1-IP2' format. Values in the range must be valid IPv4 or IPv6 addresses. Requires the `iprange` feature. + +* `dst_type`: The destination address type. For example: `dst_type => 'LOCAL'`. + + Valid values are: + + * 'UNSPEC': an unspecified address + * 'UNICAST': a unicast address + * 'LOCAL': a local address + * 'BROADCAST': a broadcast address + * 'ANYCAST': an anycast packet + * 'MULTICAST': a multicast address + * 'BLACKHOLE': a blackhole address + * 'UNREACHABLE': an unreachable address + * 'PROHIBIT': a prohibited address + * 'THROW': an unroutable address + * 'XRESOLVE: an unresolvable address + + Requires the `address_type` feature. + +* `ensure`: Ensures that the resource is present. Valid values are 'present', 'absent'. The default is 'present'. + +* `gateway`: Used with TEE target to mirror traffic of a machine to a secondary host on the LAN. + +* `gid`: GID or Group owner matching rule. Accepts a string argument only, as iptables does not accept multiple gid in a single statement. Requires the `owner` feature. + +* `hop_limit`: Hop limiting value for matched packets. Values must match '/^\d+$/'. Requires the `hop_limiting` feature. + +* `icmp`: When matching ICMP packets, this indicates the type of ICMP packet to match. A value of 'any' is not supported. To match any type of ICMP packet, the parameter should be omitted or undefined. Requires the `icmp_match` feature. + +* `iniface`: Input interface to filter on. Values must match '/^!?\s?[a-zA-Z0-9\-\._\+\:]+$/'. Requires the `interface_match` feature. Supports interface alias (eth0:0) and negation. + +* `ipsec_dir`: Sets the ipsec policy direction. Valid values are 'in', 'out'. Requires the `ipsec_dir` feature. + +* `ipsec_policy`: Sets the ipsec policy type. Valid values are 'none', 'ipsec'. Requires the `ipsec_policy` feature. + +* `ipset`: Matches IP sets. Value must be 'ipset_name (src|dst|src,dst)' and can be negated by putting ! in front. Requires ipset kernel module. Will accept a single element or an array. + +* `isfirstfrag`: If true, matches when the packet is the first fragment of a fragmented ipv6 packet. Cannot be negated. Supported by ipv6 only. Valid values are 'true', 'false'. Requires the `isfirstfrag` feature. + +* `isfragment`: If 'true', matches when the packet is a tcp fragment of a fragmented packet. Supported by iptables only. Valid values are 'true', 'false'. Requires features `isfragment`. + +* `ishasmorefrags`: If 'true', matches when the packet has the 'more fragments' bit set. Supported by ipv6 only. Valid values are 'true', 'false'. Requires the `ishasmorefrags` feature. + +* `islastfrag`: If true, matches when the packet is the last fragment of a fragmented ipv6 packet. Supported by ipv6 only. Valid values are 'true', 'false'. Requires the `islastfrag`. + +* `jump`: The value for the iptables `--jump` parameter. Any valid chain name is allowed, but normal values are: 'QUEUE', 'RETURN', 'DNAT', 'SNAT', 'LOG', 'MASQUERADE', 'REDIRECT', 'MARK', 'TCPMSS', 'DSCP'. + + For the values 'ACCEPT', 'DROP', and 'REJECT', you must use the generic `action` parameter. This is to enforce the use of generic parameters where possible for maximum cross-platform modeling. + + If you set both `accept` and `jump` parameters, you will get an error, because only one of the options should be set. Requires the `iptables` feature. + +* `kernel_timezone`: Use the kernel timezone instead of UTC to determine whether a packet meets the time regulations. + +* `length`: Set the value for matching the length of the layer-3 payload. Can be a single number or a range using '-' as a separator. Requires the `length` feature. + +* `limit`: Rate limiting value for matched packets. The format is: 'rate/[/second/|/minute|/hour|/day]'. Example values are: '50/sec', '40/min', '30/hour', '10/day'. Requires the `rate_limiting` feature. + +* `line`: Read-only property for caching the rule line. + +* `log_level`: When combined with `jump => 'LOG'` specifies the system log level to log to. Requires the `log_level` feature. + +* `log_prefix`: When combined with `jump => 'LOG'` specifies the log prefix to use when logging. Requires the `log_prefix` feature. + +* `log_uid`: The ability to log the userid of the process which generated the packet. + +* `mask`: Sets the mask to use when `recent` is enabled. Requires the `mask` feature. + +* `month_days`: Only match on the given days of the month. Possible values are '1' to '31'. Note that specifying '31' will not match on months that do not have a 31st day; the same goes for 28- or 29-day February. + +* `match_mark`: Match the Netfilter mark value associated with the packet. Accepts either of mark/mask or mark. These will be converted to hex if they are not already. Requires the `mark` feature. + +* `mss`: Sets a given TCP MSS value or range to match. + +* `name`: The canonical name of the rule. This name is also used for ordering, so make sure you prefix the rule with a number. For example: + + ~~~puppet +firewall { '000 this runs first': + # this rule will run first +} +firewall { '999 this runs last': + # this rule will run last +} + ~~~ + + Depending on the provider, the name of the rule can be stored using the comment feature of the underlying firewall subsystem. Values must match '/^\d+[[:graph:][:space:]]+$/'. + +* `outiface`: Output interface to filter on. Values must match '/^!?\s?[a-zA-Z0-9\-\._\+\:]+$/'. Requires the `interface_match` feature. Supports interface alias (eth0:0) and negation. + +* `physdev_in`: Match if the packet is entering a bridge from the given interface. Values must match '/^[a-zA-Z0-9\-\._\+]+$/'. + +* `physdev_out`: Match if the packet is leaving a bridge via the given interface. Values must match '/^[a-zA-Z0-9\-\._\+]+$/'. + +* `physdev_is_bridged`: Match if the packet is transversing a bridge. Valid values are true or false. + +* `pkttype`: Sets the packet type to match. Valid values are: 'unicast', 'broadcast', and'multicast'. Requires the `pkttype` feature. + +* `port`: *DEPRECATED* Using the unspecific 'port' parameter can lead to firewall rules that are unexpectedly too lax. It is recommended to always use the specific dport and sport parameters to avoid this ambiguity. The destination or source port to match for this filter (if the protocol supports ports). Will accept a single element or an array. For some firewall providers you can pass a range of ports in the format: 'start number-end number'. For example, '1-1024' would cover ports 1 to 1024. + +* `proto`: The specific protocol to match for this rule. This is 'tcp' by default. Valid values are: + * 'ip' + * 'tcp' + * 'udp' + * 'icmp' + * 'ipv4' + * 'ipv6' + * 'ipv6-icmp' + * 'esp' + * 'ah' + * 'vrrp' + * 'igmp' + * 'ipencap' + * 'ospf' + * 'gre' + * 'pim' + * 'all' + +* `provider`: The specific backend to use for this firewall resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform. Available providers are ip6tables and iptables. See the [Providers](#providers) section above for details about these providers. + +* `queue_bypass`: When using a `jump` value of 'NFQUEUE' this boolean will allow packets to bypass `queue_num`. This is useful when the process in userspace may not be listening on `queue_num` all the time. + +* `queue_num`: When using a `jump` value of 'NFQUEUE' this parameter specifies the queue number to send packets to. + +* `random`: When using a `jump` value of 'MASQUERADE', 'DNAT', 'REDIRECT', or 'SNAT', this boolean will enable randomized port mapping. Valid values are true or false. Requires the `dnat` feature. + +* `rdest`: If boolean 'true', adds the destination IP address to the list. Valid values are true or false. Requires the `recent_limiting` feature and the `recent` parameter. + +* `reap`: Can only be used in conjunction with the `rseconds` parameter. If boolean 'true', this will purge entries older than 'seconds' as specified in `rseconds`. Valid values are true or false. Requires the `recent_limiting` feature and the `recent` parameter. + +* `recent`: Enable the recent module. Valid values are: 'set', 'update', 'rcheck', or 'remove'. For example: + +~~~puppet +# If anyone's appeared on the 'badguy' blacklist within +# the last 60 seconds, drop their traffic, and update the timestamp. +firewall { '100 Drop badguy traffic': + recent => 'update', + rseconds => 60, + rsource => true, + rname => 'badguy', + action => 'DROP', + chain => 'FORWARD', +} +# No-one should be sending us traffic on eth0 from localhost +# Blacklist them +firewall { '101 blacklist strange traffic': + recent => 'set', + rsource => true, + rname => 'badguy', + destination => '127.0.0.0/8', + iniface => 'eth0', + action => 'DROP', + chain => 'FORWARD', +} +~~~ + + Requires the `recent_limiting` feature. + +* `reject`: When combined with `jump => 'REJECT'`, you can specify a different ICMP response to be sent back to the packet sender. Requires the `reject_type` feature. + +* `rhitcount`: Used in conjunction with `recent => 'update'` or `recent => 'rcheck'`. When used, this will narrow the match to happen only when the address is in the list and packets greater than or equal to the given value have been received. Requires the `recent_limiting` feature and the `recent` parameter. + +* `rname`: Specify the name of the list. Takes a string argument. Requires the `recent_limiting` feature and the `recent` parameter. + +* `rseconds`: Used in conjunction with `recent => 'rcheck'` or `recent => 'update'`. When used, this will narrow the match to only happen when the address is in the list and was seen within the last given number of seconds. Requires the `recent_limiting` feature and the `recent` parameter. + +* `rsource`: If boolean 'true', adds the source IP address to the list. Valid values are 'true', 'false'. Requires the `recent_limiting` feature and the `recent` parameter. + +* `rttl`: May only be used in conjunction with `recent => 'rcheck'` or `recent => 'update'`. If boolean 'true', this will narrow the match to happen only when the address is in the list and the TTL of the current packet matches that of the packet that hit the `recent => 'set'` rule. If you have problems with DoS attacks via bogus packets from fake source addresses, this parameter may help. Valid values are 'true', 'false'. Requires the `recent_limiting` feature and the `recent` parameter. + +* `set_dscp`: When combined with `jump => 'DSCP'` specifies the dscp marking associated with the packet. + +* `set_dscp_class`: When combined with `jump => 'DSCP'` specifies the class associated with the packet (valid values found here: http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-packet-marking/10103-dscpvalues.html#packetclassification). + +* `set_mark`: Set the Netfilter mark value associated with the packet. Accepts either 'mark/mask' or 'mark'. These will be converted to hex if they are not already. Requires the `mark` feature. + +* `set_mss`: When combined with `jump => 'TCPMSS'` specifies the value of the MSS field. + +* `socket`: If 'true', matches if an open socket can be found by doing a socket lookup on the packet. Valid values are 'true', 'false'. Requires the `socket` feature. + +* `source`: The source address. For example: `source => '192.168.2.0/24'`. You can also negate a mask by putting ! in front. For example: `source => '! 192.168.2.0/24'`. The source can also be an IPv6 address if your provider supports it. + +* `sport`: The source port to match for this filter (if the protocol supports ports). Will accept a single element or an array. For some firewall providers you can pass a range of ports in the format:'start number-end number'. For example, '1-1024' would cover ports 1 to 1024. + +* `src_range`: The source IP range. For example: `src_range => '192.168.1.1-192.168.1.10'`. The source IP range must be in 'IP1-IP2' format. Values in the range must be valid IPv4 or IPv6 addresses. Requires the `iprange` feature. + +* `src_type`: Specify the source address type. For example: `src_type => 'LOCAL'`. + + Valid values are: + + * 'UNSPEC': an unspecified address. + * 'UNICAST': a unicast address. + * 'LOCAL': a local address. + * 'BROADCAST': a broadcast address. + * 'ANYCAST': an anycast packet. + * 'MULTICAST': a multicast address. + * 'BLACKHOLE': a blackhole address. + * 'UNREACHABLE': an unreachable address. + * 'PROHIBIT': a prohibited address. + * 'THROW': an unroutable address. + * 'XRESOLVE': an unresolvable address. + + Requires the `address_type` feature. + +* `stat_every`: Match one packet every nth packet. Requires `stat_mode => 'nth'` + +* `stat_mode`: Set the matching mode for statistic matching. Supported modes are `random` and `nth`. + +* `stat_packet`: Set the initial counter value for the nth mode. Must be between 0 and the value of `stat_every`. Defaults to 0. Requires `stat_mode => 'nth'` + +* `stat_probability`: Set the probability from 0 to 1 for a packet to be randomly matched. It works only with `stat_mode => 'random'`. + +* `state`: Matches a packet based on its state in the firewall stateful inspection table. Valid values are: 'INVALID', 'ESTABLISHED', 'NEW', 'RELATED'. Requires the `state_match` feature. + +* `string`: Set the pattern for string matching. Requires the `string_matching` feature. + +* `string_algo`: Used in conjunction with `string`, select the pattern matching strategy. Valid values are: 'bm', 'kmp' (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris). Requires the `string_matching` feature. + +* `string_from`: Used in conjunction with `string`, set the offset from which it starts looking for any matching. Requires the `string_matching` feature. + +* `string_to`: Used in conjunction with `string`, set the offset up to which should be scanned. Requires the `string_matching` feature. + +* `table`: Table to use. Valid values are: 'nat', 'mangle', 'filter', 'raw', 'rawpost'. By default the setting is 'filter'. Requires the `iptables` feature. + +* `tcp_flags`: Match when the TCP flags are as specified. Set as a string with a list of comma-separated flag names for the mask, then a space, then a comma-separated list of flags that should be set. The flags are: 'SYN', 'ACK', 'FIN', 'RST', 'URG', 'PSH', 'ALL', 'NONE'. + + Note that you specify flags in the order that iptables `--list` rules would list them to avoid having Puppet think you changed the flags. For example, 'FIN,SYN,RST,ACK SYN' matches packets with the SYN bit set and the ACK, RST and FIN bits cleared. Such packets are used to request TCP connection initiation. Requires the `tcp_flags` feature. + +* `time_contiguous`: When the `time_stop` value is smaller than the `time_start` value, match this as a single time period instead of distinct intervals. + +* `time_start`: Start time for the rule to match. The possible time range is '00:00:00' to '23:59:59'. Leading zeroes are allowed (e.g. '06:03') and correctly interpreted as base-10. + +* `time_stop`: End time for the rule to match. The possible time range is '00:00:00' to '23:59:59'. Leading zeroes are allowed (e.g. '06:03') and correctly interpreted as base-10. + +* `todest`: When using `jump => 'DNAT'`, you can specify the new destination address using this parameter. Requires the `dnat` feature. + +* `toports`: For DNAT this is the port that will replace the destination port. Requires the `dnat` feature. + +* `tosource`: When using `jump => 'SNAT'`, you can specify the new source address using this parameter. Requires the `snat` feature. + +* `to`: When using `jump => 'NETMAP'`, you can specify a source or destination subnet to nat to. Requires the `netmap` feature`. + +* `uid`: UID or Username owner matching rule. Accepts a string argument only, as iptables does not accept multiple uid in a single statement. Requires the `owner` feature. + +* `week_days`: Only match on the given weekdays. Possible values are 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun'. + +### Type: firewallchain + +Enables you to manage rule chains for firewalls. + +Currently this type supports only iptables, ip6tables, and ebtables on Linux. It also provides support for setting the default policy on chains and tables that allow it. + +**Autorequires**: If Puppet is managing the iptables or iptables-persistent packages, and the provider is iptables_chain, the firewall resource will autorequire those packages to ensure that any required binaries are installed. + +#### Providers + +`iptables_chain` is the only provider that supports firewallchain. + +#### Features + +* `iptables_chain`: The provider provides iptables chain features. +* `policy`: Default policy (inbuilt chains only). + +#### Parameters + +* `ensure`: Ensures that the resource is present. Valid values are 'present', 'absent'. + +* `ignore`: Regex to perform on firewall rules to exempt unmanaged rules from purging (when enabled). This is matched against the output of iptables-save. This can be a single regex or an array of them. To support flags, use the ruby inline flag mechanism: a regex such as '/foo/i' can be written as '(?i)foo' or '(?i:foo)'. Only when purge is 'true'. + + Full example: +~~~puppet +firewallchain { 'INPUT:filter:IPv4': + purge => true, + ignore => [ + # ignore the fail2ban jump rule + '-j fail2ban-ssh', + # ignore any rules with "ignore" (case insensitive) in the comment in the rule + '--comment "[^"](?i:ignore)[^"]"', + ], +} +~~~ + +* `name`: Specify the canonical name of the chain. For iptables the format must be {chain}:{table}:{protocol}. + +* `policy`: Set the action the packet will perform when the end of the chain is reached. It can only be set on inbuilt chains ('INPUT', 'FORWARD', 'OUTPUT', 'PREROUTING', 'POSTROUTING'). Valid values are: + + * 'accept': The packet is accepted. + * 'drop': The packet is dropped. + * 'queue': The packet is passed userspace. + * 'return': The packet is returned to calling (jump) queue or to the default of inbuilt chains. + +* `provider`: The specific backend to use for this firewallchain resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform. The only available provider is: + + `iptables_chain`: iptables chain provider + + * Required binaries: `ebtables-save`, `ebtables`, `ip6tables-save`, `ip6tables`, `iptables-save`, `iptables`. + * Default for `kernel` == `linux`. + * Supported features: `iptables_chain`, `policy`. + +* `purge`: Purge unmanaged firewall rules in this chain. Valid values are 'false', 'true'. + +**Note** This `purge` is purging unmanaged rules in a firewall chain, not unmanaged firewall chains. To purge unmanaged firewall chains, use the following instead. + +~~~puppet +resources { 'firewallchain': + purge => true, +} +~~~ + +### Fact: ip6tables_version + +A Facter fact that can be used to determine what the default version of ip6tables is for your operating system/distribution. + +### Fact: iptables_version + +A Facter fact that can be used to determine what the default version of iptables is for your operating system/distribution. + +### Fact: iptables_persistent_version + +Retrieves the version of iptables-persistent from your OS. This is a Debian/Ubuntu specific fact. + +## Limitations + +### SLES + +The `socket` parameter is not supported on SLES. In this release it will cause +the catalog to fail with iptables failures, rather than correctly warn you that +the features are unusable. + +### Oracle Enterprise Linux + +The `socket` and `owner` parameters are unsupported on Oracle Enterprise Linux +when the "Unbreakable" kernel is used. These may function correctly when using +the stock RedHat kernel instead. Declaring either of these parameters on an +unsupported system will result in iptable rules failing to apply. + +### Debian 8 Support + +As Puppet Enterprise itself does not yet support Debian 8, use of this module with Puppet Enterprise under a Debian 8 +system should be regarded as experimental. + +### Known Issues + +#### MCollective causes PE to reverse firewall rule order + +Firewall rules appear in reverse order if you use MCollective to run Puppet in Puppet Enterprise 2016.1, 2015.3, 2015.2, or 3.8.x. + +If you use MCollective to kick off Puppet runs (`mco puppet runonce -I agent.example.com`) while also using the [`puppetlabs/firewall`](https://forge.puppet.com/puppetlabs/firewall) module, your firewall rules might be listed in reverse order. + +In many firewall configurations, the last rule drops all packets. If the rule order is reversed, this rule is listed first and network connectivity fails. + +To prevent this issue, do not use MCollective to kick off Puppet runs. Use any of the following instead: + +* Run `puppet agent -t` on the command line. +* Use a cron job. +* Click [Run Puppet](https://docs.puppet.com/pe/2016.1/console_classes_groups_running_puppet.html#run-puppet-on-an-individual-node) in the console. + +#### Reporting Issues + +Report found bugs in JIRA: + + + +## Development + +Puppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can’t access the huge number of platforms and myriad of hardware, software, and deployment configurations that Puppet is intended to serve. + +We want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things. + +You can read the complete module contribution guide [on the Puppet Labs wiki.](http://projects.puppetlabs.com/projects/module-site/wiki/Module_contributing) + +For this particular module, please also read CONTRIBUTING.md before contributing. + +Currently we support: + +* iptables +* ip6tables +* ebtables (chains only) + +### Testing + +Make sure you have: + +* rake +* bundler + +Install the necessary gems: + + bundle install + +And run the tests from the root of the source code: + + rake test + +If you have a copy of Vagrant 1.1.0 you can also run the system tests: + + RS_SET=ubuntu-1404-x64 rspec spec/acceptance + RS_SET=centos-64-x64 rspec spec/acceptance diff --git a/environments/production/modules/firewall/Rakefile b/environments/production/modules/firewall/Rakefile new file mode 100644 index 0000000..3e8d4cb --- /dev/null +++ b/environments/production/modules/firewall/Rakefile @@ -0,0 +1,38 @@ +require 'puppet_blacksmith/rake_tasks' +require 'puppet-lint/tasks/puppet-lint' +require 'puppetlabs_spec_helper/rake_tasks' + +PuppetLint.configuration.send('relative') +PuppetLint.configuration.send('disable_documentation') +PuppetLint.configuration.send('disable_single_quote_string_with_variables') + +desc 'Generate pooler nodesets' +task :gen_nodeset do + require 'beaker-hostgenerator' + require 'securerandom' + require 'fileutils' + + agent_target = ENV['TEST_TARGET'] + if ! agent_target + STDERR.puts 'TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat-64default."' + agent_target = 'redhat-64default.' + end + + master_target = ENV['MASTER_TEST_TARGET'] + if ! master_target + STDERR.puts 'MASTER_TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat7-64mdcl"' + master_target = 'redhat7-64mdcl' + end + + targets = "#{master_target}-#{agent_target}" + cli = BeakerHostGenerator::CLI.new([targets]) + nodeset_dir = "tmp/nodesets" + nodeset = "#{nodeset_dir}/#{targets}-#{SecureRandom.uuid}.yaml" + FileUtils.mkdir_p(nodeset_dir) + File.open(nodeset, 'w') do |fh| + fh.print(cli.execute) + end + puts nodeset +end diff --git a/environments/production/modules/firewall/checksums.json b/environments/production/modules/firewall/checksums.json new file mode 100644 index 0000000..ead0f2e --- /dev/null +++ b/environments/production/modules/firewall/checksums.json @@ -0,0 +1,105 @@ +{ + "CHANGELOG.md": "2626048ca09a859640d3eea99ed0049a", + "CONTRIBUTING.md": "b78f71c1104f00538d50ad2775f58e95", + "Gemfile": "8229b2c0196b32a14403f99450c801af", + "LICENSE": "3b83ef96387f14655fc854ddc3c6bd57", + "NOTICE": "a0239e08139b72b4d710967890eaba67", + "README.markdown": "6d8edf39502835508fb1151790e1a816", + "Rakefile": "6db744f1deed7ae0746abe59e3d50863", + "lib/facter/ip6tables_version.rb": "e1dbe35390cd819240e202709c52b1bb", + "lib/facter/iptables_persistent_version.rb": "8ea76fecb8032174823ef6fb846c83c9", + "lib/facter/iptables_version.rb": "116b96951342bf726f28fa952f2f5f4b", + "lib/puppet/provider/firewall/ip6tables.rb": "51c56374556b07eeab1e716e7c0d3b02", + "lib/puppet/provider/firewall/iptables.rb": "52dee7c94c701da42a22521529755c00", + "lib/puppet/provider/firewall.rb": "32d2f5e5dcc082986b82ef26a119038b", + "lib/puppet/provider/firewallchain/iptables_chain.rb": "4d0432b240e8ecd46094a64462641e15", + "lib/puppet/type/firewall.rb": "8cf30048510095949274db26eacf54a5", + "lib/puppet/type/firewallchain.rb": "9262061ade5c73329db773b769ee70a2", + "lib/puppet/util/firewall.rb": "036b832027cf4301356661f9c3c3a1d9", + "lib/puppet/util/ipcidr.rb": "e1160dfd6e73fc5ef2bb8abc291f6fd5", + "manifests/init.pp": "0b050d757969b4a12115dc6c4edfe229", + "manifests/linux/archlinux.pp": "692a236965597cfba264a2e361aa3522", + "manifests/linux/debian.pp": "8103642b9061d18fe5c70cd3af695bf7", + "manifests/linux/gentoo.pp": "225a291a80afacc8d5f01a21825c0c5a", + "manifests/linux/redhat.pp": "509f15a549947914ee26073513bd224b", + "manifests/linux.pp": "9e9fd52137680f10487261f45a7f1021", + "manifests/params.pp": "f55d4b0850a067c6b450fc5c93873d55", + "metadata.json": "58a11831d35e0b38f7de2d81f74c5bfb", + "spec/acceptance/change_source_spec.rb": "68974434c7434340ed659ece23dd1668", + "spec/acceptance/class_spec.rb": "1c45fb508e35355f18125c458da03c3b", + "spec/acceptance/connlimit_spec.rb": "3cd6e1ce8a1bbf60a6301d874c39db8f", + "spec/acceptance/connmark_spec.rb": "1617263f5d1e036b63060f65b03a1d3d", + "spec/acceptance/firewall_bridging_spec.rb": "4a660611d2c9e3e4439cb37838b11783", + "spec/acceptance/firewall_clusterip_spec.rb": "2ff89c8bd5985d9133537b0c80ffbffa", + "spec/acceptance/firewall_dscp_spec.rb": "8b99f2095f53b04e276c4bfb309de47d", + "spec/acceptance/firewall_iptmodules_spec.rb": "4f2293976483fd3d17a686e975e0813a", + "spec/acceptance/firewall_mss_spec.rb": "b76ace05ee2ef9442d673f2a31da976d", + "spec/acceptance/firewall_spec.rb": "45b1b0aaf1096affcf492a6769c1ddb6", + "spec/acceptance/firewall_tee_spec.rb": "56e38741eb3aacb3f68565e2e386b220", + "spec/acceptance/firewall_time_spec.rb": "206cf26d6c5e0d013b0529b2edcc9f43", + "spec/acceptance/firewall_uid_spec.rb": "5a44538e247ab2234bbeca539558b10e", + "spec/acceptance/firewallchain_spec.rb": "978288d450b6cd5374182b894361791c", + "spec/acceptance/invert_spec.rb": "7931641b8594d219afdb3abe1e50b920", + "spec/acceptance/ip6_fragment_spec.rb": "22cf51568533fc918407a034cf9f1bc4", + "spec/acceptance/isfragment_spec.rb": "2ec3f2201d87371516939e40b4f60445", + "spec/acceptance/match_mark_spec.rb": "48b6fa5fe9373b5376101e5e074c21d6", + "spec/acceptance/nodesets/centos-7-x64.yml": "a713f3abd3657f0ae2878829badd23cd", + "spec/acceptance/nodesets/debian-8-x64.yml": "d2d2977900989f30086ad251a14a1f39", + "spec/acceptance/nodesets/default.yml": "b42da5a1ea0c964567ba7495574b8808", + "spec/acceptance/nodesets/docker/centos-7.yml": "8a3892807bdd62306ae4774f41ba11ae", + "spec/acceptance/nodesets/docker/debian-8.yml": "ac8e871d1068c96de5e85a89daaec6df", + "spec/acceptance/nodesets/docker/ubuntu-14.04.yml": "dc42ee922a96908d85b8f0f08203ce58", + "spec/acceptance/nodesets/new/aio/debian-8-64mda.yml": "3cb5b076f8ff1ce0123f7002d1132aa1", + "spec/acceptance/nodesets/new/aio/redhat-6-64mda.yml": "2da8ffed4efeb44fb78b686a06195116", + "spec/acceptance/nodesets/new/aio/redhat-7-64mda.yml": "200ba1439bddf26dd611b5f315e3b955", + "spec/acceptance/nodesets/new/aio/ubuntu-1404-64mda.yml": "41256594850e488f033ec30327139162", + "spec/acceptance/nodesets/new/aio/ubuntu-1604-64mda.yml": "9c79b040697c25f1170feaf3ea3d9700", + "spec/acceptance/nodesets/new/pe/centos-5-64mda.yml": "192e4434be158fb238b8088f5d9adce0", + "spec/acceptance/nodesets/new/pe/centos-6-64mda.yml": "13947041961996723a56bfa35289919a", + "spec/acceptance/nodesets/new/pe/centos-7-64mda.yml": "5ff3e38e023c75ce2ace69a5ccadbf33", + "spec/acceptance/nodesets/new/pe/debian-6-64mda.yml": "ff79b672c5a532409c492ad0d45dc0ad", + "spec/acceptance/nodesets/new/pe/debian-7-64mda.yml": "63fefd7c9395781748a8b63d08dfd86c", + "spec/acceptance/nodesets/new/pe/debian-8-64mda.yml": "ed8e721a3d96556d92a9a1806171987b", + "spec/acceptance/nodesets/new/pe/oracle-5-64mda.yml": "64adf2da3fff9a6cf4b28c638f568a43", + "spec/acceptance/nodesets/new/pe/oracle-6-64mda.yml": "3e0fbe6f9516023816c85884f0fdc839", + "spec/acceptance/nodesets/new/pe/oracle-7-64mda.yml": "b5f568cf11baafdf98f0127220527219", + "spec/acceptance/nodesets/new/pe/redhat-5-64mda.yml": "3c07dc9d83607f0f04a6903a77f5825d", + "spec/acceptance/nodesets/new/pe/redhat-6-64mda.yml": "886858b5f4ddcd484da013eca85d996e", + "spec/acceptance/nodesets/new/pe/redhat-7-64mda.yml": "199c73bd7860987d5af932164b5603e7", + "spec/acceptance/nodesets/new/pe/scientific-5-64mda.yml": "4d23f6b5aa75033ddd9077588ee605a9", + "spec/acceptance/nodesets/new/pe/scientific-6-64mda.yml": "342a75a0f2a8e45b7f317d34a35fdb77", + "spec/acceptance/nodesets/new/pe/scientific-7-64mda.yml": "5952c337b5dfd11ddbc28cd7936630db", + "spec/acceptance/nodesets/new/pe/sles-10-64mda.yml": "6b71985abd427432bdb2f9e8b76087fe", + "spec/acceptance/nodesets/new/pe/sles-11-64mda.yml": "5ed55d2324395308cab72ec6e0545967", + "spec/acceptance/nodesets/new/pe/sles-12-64mda.yml": "bc2fc9c59161c30b69fe907d65a138dc", + "spec/acceptance/nodesets/new/pe/ubuntu-1004-64mda.yml": "07bef5f739c27a6a62945adbd2e8813e", + "spec/acceptance/nodesets/new/pe/ubuntu-1204-64mda.yml": "c689063fd68a3c3ba3c47ced3016fa0e", + "spec/acceptance/nodesets/new/pe/ubuntu-1404-64mda.yml": "d0f11e054810e240ba4efdf3d08de815", + "spec/acceptance/nodesets/new/pe/ubuntu-1604-64mda.yml": "c66b70cd33f4e338ddfb54ff46f35c8e", + "spec/acceptance/params_spec.rb": "68260bd4d660ac7d0d48dbd0ad67db9e", + "spec/acceptance/purge_spec.rb": "300c5bfea39594d7ef770b7a68a231a7", + "spec/acceptance/resource_cmd_spec.rb": "57aac32238563f516f70eb0ca8ce344c", + "spec/acceptance/rules_spec.rb": "6a331e90b860fc8ce7a77b4930bfe81e", + "spec/acceptance/socket_spec.rb": "20cb65db2dd2d78e244d04e2a8080f6e", + "spec/acceptance/standard_usage_spec.rb": "c8b32c414f664525e4db6379c933d56c", + "spec/fixtures/ip6tables/conversion_hash.rb": "37c2c9b8994f7f444f1707930e5c2fbd", + "spec/fixtures/iptables/conversion_hash.rb": "ea1c8a7b7885808c1d089c8efa4bf92d", + "spec/spec_helper.rb": "680042bbf76628be53cc1354710facce", + "spec/spec_helper_acceptance.rb": "8a5b3695371ec0fe091a6dce233c03fe", + "spec/spec_helper_local.rb": "2282ca978a87d98971655e94b5e88860", + "spec/unit/classes/firewall_linux_archlinux_spec.rb": "3f9ce56d2069fb971423b3df24de1e3a", + "spec/unit/classes/firewall_linux_debian_spec.rb": "03f6a6eb35f8cc30b4932dddae9a8855", + "spec/unit/classes/firewall_linux_gentoo_spec.rb": "c23c922f2e07ff25ba9de032cb182983", + "spec/unit/classes/firewall_linux_redhat_spec.rb": "9d7a717431db0825be0f4d9d295ed951", + "spec/unit/classes/firewall_linux_spec.rb": "ee386c853b4da33120c43b62c8e9de4f", + "spec/unit/classes/firewall_spec.rb": "493e711ba35eb305491f7723ee6e1c73", + "spec/unit/facter/iptables_persistent_version_spec.rb": "8cbcfb4ff9fa26fb0abe34f5819043cd", + "spec/unit/facter/iptables_spec.rb": "db01057c5fef9679c51786b7492f1732", + "spec/unit/puppet/provider/ip6tables_spec.rb": "67b945e26f9e31c16fd410818649b072", + "spec/unit/puppet/provider/iptables_chain_spec.rb": "f45cc8b7ef1ea3264f1331d045b815a5", + "spec/unit/puppet/provider/iptables_spec.rb": "6bb78676957637934495ae59698ea1e9", + "spec/unit/puppet/type/firewall_spec.rb": "358cb01b17f55d7c3fcf7bdccf66c321", + "spec/unit/puppet/type/firewallchain_spec.rb": "9e6e8b5875f1a394bec2e8f7ddb8f37c", + "spec/unit/puppet/util/firewall_spec.rb": "f1e09fca280e5a02b5b390d13c428262", + "spec/unit/puppet/util/ipcidr_spec.rb": "59882f384ccfd55ae23a0ec2bde81cb4" +} \ No newline at end of file diff --git a/environments/production/modules/firewall/lib/facter/ip6tables_version.rb b/environments/production/modules/firewall/lib/facter/ip6tables_version.rb new file mode 100644 index 0000000..f2540c6 --- /dev/null +++ b/environments/production/modules/firewall/lib/facter/ip6tables_version.rb @@ -0,0 +1,11 @@ +Facter.add(:ip6tables_version) do + confine :kernel => :Linux + setcode do + version = Facter::Util::Resolution.exec('ip6tables --version') + if version + version.match(/\d+\.\d+\.\d+/).to_s + else + nil + end + end +end diff --git a/environments/production/modules/firewall/lib/facter/iptables_persistent_version.rb b/environments/production/modules/firewall/lib/facter/iptables_persistent_version.rb new file mode 100644 index 0000000..4dbf6bc --- /dev/null +++ b/environments/production/modules/firewall/lib/facter/iptables_persistent_version.rb @@ -0,0 +1,22 @@ +Facter.add(:iptables_persistent_version) do + confine :operatingsystem => %w{Debian Ubuntu} + setcode do + # Throw away STDERR because dpkg >= 1.16.7 will make some noise if the + # package isn't currently installed. + os = Facter.value(:operatingsystem) + os_release = Facter.value(:operatingsystemrelease) + if (os == 'Debian' and (Puppet::Util::Package.versioncmp(os_release, '8.0') >= 0)) or + (os == 'Ubuntu' and (Puppet::Util::Package.versioncmp(os_release, '14.10') >= 0)) + cmd = "dpkg-query -Wf '${Version}' netfilter-persistent 2>/dev/null" + else + cmd = "dpkg-query -Wf '${Version}' iptables-persistent 2>/dev/null" + end + version = Facter::Util::Resolution.exec(cmd) + + if version.nil? or !version.match(/\d+\.\d+/) + nil + else + version + end + end +end diff --git a/environments/production/modules/firewall/lib/facter/iptables_version.rb b/environments/production/modules/firewall/lib/facter/iptables_version.rb new file mode 100644 index 0000000..7da5937 --- /dev/null +++ b/environments/production/modules/firewall/lib/facter/iptables_version.rb @@ -0,0 +1,11 @@ +Facter.add(:iptables_version) do + confine :kernel => :Linux + setcode do + version = Facter::Util::Resolution.exec('iptables --version') + if version + version.match(/\d+\.\d+\.\d+/).to_s + else + nil + end + end +end diff --git a/environments/production/modules/firewall/lib/puppet/provider/firewall.rb b/environments/production/modules/firewall/lib/puppet/provider/firewall.rb new file mode 100644 index 0000000..c6b0b10 --- /dev/null +++ b/environments/production/modules/firewall/lib/puppet/provider/firewall.rb @@ -0,0 +1,34 @@ +class Puppet::Provider::Firewall < Puppet::Provider + + # Prefetch our rule list. This is ran once every time before any other + # action (besides initialization of each object). + def self.prefetch(resources) + debug("[prefetch(resources)]") + instances.each do |prov| + if resource = resources[prov.name] || resources[prov.name.downcase] + resource.provider = prov + end + end + end + + # Look up the current status. This allows us to conventiently look up + # existing status with properties[:foo]. + def properties + if @property_hash.empty? + @property_hash = query || {:ensure => :absent} + @property_hash[:ensure] = :absent if @property_hash.empty? + end + @property_hash.dup + end + + # Pull the current state of the list from the full list. We're + # getting some double entendre here.... + def query + self.class.instances.each do |instance| + if instance.name == self.name or instance.name.downcase == self.name + return instance.properties + end + end + nil + end +end diff --git a/environments/production/modules/firewall/lib/puppet/provider/firewall/ip6tables.rb b/environments/production/modules/firewall/lib/puppet/provider/firewall/ip6tables.rb new file mode 100644 index 0000000..72d30be --- /dev/null +++ b/environments/production/modules/firewall/lib/puppet/provider/firewall/ip6tables.rb @@ -0,0 +1,242 @@ +Puppet::Type.type(:firewall).provide :ip6tables, :parent => :iptables, :source => :ip6tables do + @doc = "Ip6tables type provider" + + has_feature :iptables + has_feature :connection_limiting + has_feature :hop_limiting + has_feature :rate_limiting + has_feature :recent_limiting + has_feature :snat + has_feature :dnat + has_feature :interface_match + has_feature :icmp_match + has_feature :owner + has_feature :state_match + has_feature :reject_type + has_feature :log_level + has_feature :log_prefix + has_feature :log_uid + has_feature :mark + has_feature :mss + has_feature :tcp_flags + has_feature :pkttype + has_feature :ishasmorefrags + has_feature :islastfrag + has_feature :isfirstfrag + has_feature :socket + has_feature :address_type + has_feature :iprange + has_feature :ipsec_dir + has_feature :ipsec_policy + has_feature :mask + has_feature :ipset + has_feature :length + has_feature :string_matching + has_feature :queue_num + has_feature :queue_bypass + + optional_commands({ + :ip6tables => 'ip6tables', + :ip6tables_save => 'ip6tables-save', + }) + + confine :kernel => :linux + + ip6tables_version = Facter.value('ip6tables_version') + if (ip6tables_version and Puppet::Util::Package.versioncmp(ip6tables_version, '1.4.1') < 0) + mark_flag = '--set-mark' + else + mark_flag = '--set-xmark' + end + + + def initialize(*args) + ip6tables_version = Facter.value('ip6tables_version') + if ip6tables_version and ip6tables_version.match /1\.3\.\d/ + raise ArgumentError, 'The ip6tables provider is not supported on version 1.3 of iptables' + else + super + end + end + + def self.iptables(*args) + ip6tables(*args) + end + + def self.iptables_save(*args) + ip6tables_save(*args) + end + + @protocol = "IPv6" + + @resource_map = { + :burst => "--limit-burst", + :checksum_fill => "--checksum-fill", + :clamp_mss_to_pmtu => "--clamp-mss-to-pmtu", + :connlimit_above => "-m connlimit --connlimit-above", + :connlimit_mask => "--connlimit-mask", + :connmark => "-m connmark --mark", + :ctstate => "-m conntrack --ctstate", + :destination => "-d", + :dport => ["-m multiport --dports", "--dport"], + :dst_range => '--dst-range', + :dst_type => "--dst-type", + :gateway => "--gateway", + :gid => "--gid-owner", + :hop_limit => "-m hl --hl-eq", + :icmp => "-m icmp6 --icmpv6-type", + :iniface => "-i", + :ipsec_dir => "-m policy --dir", + :ipsec_policy => "--pol", + :ipset => "-m set --match-set", + :isfirstfrag => "-m frag --fragid 0 --fragfirst", + :ishasmorefrags => "-m frag --fragid 0 --fragmore", + :islastfrag => "-m frag --fragid 0 --fraglast", + :jump => "-j", + :length => "-m length --length", + :limit => "-m limit --limit", + :log_level => "--log-level", + :log_prefix => "--log-prefix", + :log_uid => "--log-uid", + :mask => "--mask", + :match_mark => "-m mark --mark", + :name => "-m comment --comment", + :mac_source => ["-m mac --mac-source", "--mac-source"], + :mss => "-m tcpmss --mss", + :outiface => "-o", + :pkttype => "-m pkttype --pkt-type", + :port => '-m multiport --ports', + :proto => "-p", + :queue_num => "--queue-num", + :queue_bypass => "--queue-bypass", + :rdest => "--rdest", + :reap => "--reap", + :recent => "-m recent", + :reject => "--reject-with", + :rhitcount => "--hitcount", + :rname => "--name", + :rseconds => "--seconds", + :rsource => "--rsource", + :rttl => "--rttl", + :set_dscp => '--set-dscp', + :set_dscp_class => '--set-dscp-class', + :set_mark => mark_flag, + :set_mss => '--set-mss', + :socket => "-m socket", + :source => "-s", + :sport => ["-m multiport --sports", "--sport"], + :src_range => '--src-range', + :src_type => "--src-type", + :stat_every => '--every', + :stat_mode => "-m statistic --mode", + :stat_packet => '--packet', + :stat_probability => '--probability', + :state => "-m state --state", + :string => "-m string --string", + :string_algo => "--algo", + :string_from => "--from", + :string_to => "--to", + :table => "-t", + :tcp_flags => "-m tcp --tcp-flags", + :todest => "--to-destination", + :toports => "--to-ports", + :tosource => "--to-source", + :uid => "--uid-owner", + :physdev_in => "--physdev-in", + :physdev_out => "--physdev-out", + :physdev_is_bridged => "--physdev-is-bridged", + :date_start => "--datestart", + :date_stop => "--datestop", + :time_start => "--timestart", + :time_stop => "--timestop", + :month_days => "--monthdays", + :week_days => "--weekdays", + :time_contiguous => "--contiguous", + :kernel_timezone => "--kerneltz", + } + + # These are known booleans that do not take a value, but we want to munge + # to true if they exist. + @known_booleans = [ + :checksum_fill, + :clamp_mss_to_pmtu, + :ishasmorefrags, + :islastfrag, + :isfirstfrag, + :log_uid, + :rsource, + :rdest, + :reap, + :rttl, + :socket, + :physdev_is_bridged, + :time_contiguous, + :kernel_timezone, + :queue_bypass, + ] + + # Properties that use "-m " (with the potential to have multiple + # arguments against the same IPT module) must be in this hash. The keys in this + # hash are the IPT module names, with the values being an array of the respective + # supported arguments for this IPT module. + # + # ** IPT Module arguments must be in order as they would appear in iptables-save ** + # + # Exceptions: + # => multiport: (For some reason, the multiport arguments can't be) + # specified within the same "-m multiport", but works in seperate + # ones. + # + @module_to_argument_mapping = { + :physdev => [:physdev_in, :physdev_out, :physdev_is_bridged], + :addrtype => [:src_type, :dst_type], + :iprange => [:src_range, :dst_range], + :owner => [:uid, :gid], + :time => [:time_start, :time_stop, :month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone] + } + + # Create property methods dynamically + (@resource_map.keys << :chain << :table << :action).each do |property| + if @known_booleans.include?(property) then + # The boolean properties default to '' which should be read as false + define_method "#{property}" do + @property_hash[property] = :false if @property_hash[property] == nil + @property_hash[property.to_sym] + end + else + define_method "#{property}" do + @property_hash[property.to_sym] + end + end + + if property == :chain + define_method "#{property}=" do |value| + if @property_hash[:chain] != value + raise ArgumentError, "Modifying the chain for existing rules is not supported." + end + end + else + define_method "#{property}=" do |value| + @property_hash[:needs_change] = true + end + end + end + + # This is the order of resources as they appear in iptables-save output, + # we need it to properly parse and apply rules, if the order of resource + # changes between puppet runs, the changed rules will be re-applied again. + # This order can be determined by going through iptables source code or just tweaking and trying manually + # (Note: on my CentOS 6.4 ip6tables-save returns -m frag on the place + # I put it when calling the command. So compability with manual changes + # not provided with current parser [georg.koester]) + @resource_list = [:table, :source, :destination, :iniface, :outiface, :physdev_in, + :physdev_out, :physdev_is_bridged, :proto, :ishasmorefrags, :islastfrag, :isfirstfrag, :src_range, :dst_range, + :tcp_flags, :uid, :gid, :mac_source, :sport, :dport, :port, :src_type, + :dst_type, :socket, :pkttype, :name, :ipsec_dir, :ipsec_policy, :state, + :ctstate, :icmp, :hop_limit, :limit, :burst, :length, :recent, :rseconds, :reap, + :rhitcount, :rttl, :rname, :mask, :rsource, :rdest, :ipset, :string, :string_algo, + :string_from, :string_to, :jump, :clamp_mss_to_pmtu, :gateway, :todest, + :tosource, :toports, :checksum_fill, :log_level, :log_prefix, :log_uid, :reject, :set_mss, :set_dscp, :set_dscp_class, :mss, :queue_num, :queue_bypass, + :set_mark, :match_mark, :connlimit_above, :connlimit_mask, :connmark, :time_start, :time_stop, :month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone] + +end diff --git a/environments/production/modules/firewall/lib/puppet/provider/firewall/iptables.rb b/environments/production/modules/firewall/lib/puppet/provider/firewall/iptables.rb new file mode 100644 index 0000000..39bc228 --- /dev/null +++ b/environments/production/modules/firewall/lib/puppet/provider/firewall/iptables.rb @@ -0,0 +1,785 @@ +require 'puppet/provider/firewall' +require 'digest/md5' + +Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Firewall do + include Puppet::Util::Firewall + + @doc = "Iptables type provider" + + has_feature :iptables + has_feature :connection_limiting + has_feature :rate_limiting + has_feature :recent_limiting + has_feature :snat + has_feature :dnat + has_feature :netmap + has_feature :interface_match + has_feature :icmp_match + has_feature :owner + has_feature :state_match + has_feature :reject_type + has_feature :log_level + has_feature :log_prefix + has_feature :log_uid + has_feature :mark + has_feature :mss + has_feature :tcp_flags + has_feature :pkttype + has_feature :isfragment + has_feature :socket + has_feature :address_type + has_feature :iprange + has_feature :ipsec_dir + has_feature :ipsec_policy + has_feature :mask + has_feature :ipset + has_feature :clusterip + has_feature :length + has_feature :string_matching + has_feature :queue_num + has_feature :queue_bypass + + optional_commands({ + :iptables => 'iptables', + :iptables_save => 'iptables-save', + }) + + defaultfor :kernel => :linux + confine :kernel => :linux + + iptables_version = Facter.value('iptables_version') + if (iptables_version and Puppet::Util::Package.versioncmp(iptables_version, '1.4.1') < 0) + mark_flag = '--set-mark' + else + mark_flag = '--set-xmark' + end + + @protocol = "IPv4" + + @resource_map = { + :burst => "--limit-burst", + :checksum_fill => "--checksum-fill", + :clamp_mss_to_pmtu => "--clamp-mss-to-pmtu", + :connlimit_above => "-m connlimit --connlimit-above", + :connlimit_mask => "--connlimit-mask", + :connmark => "-m connmark --mark", + :ctstate => "-m conntrack --ctstate", + :destination => "-d", + :dport => ["-m multiport --dports", "--dport"], + :dst_range => "--dst-range", + :dst_type => "--dst-type", + :gateway => "--gateway", + :gid => "--gid-owner", + :icmp => "-m icmp --icmp-type", + :iniface => "-i", + :ipsec_dir => "-m policy --dir", + :ipsec_policy => "--pol", + :ipset => "-m set --match-set", + :isfragment => "-f", + :jump => "-j", + :goto => "-g", + :length => "-m length --length", + :limit => "-m limit --limit", + :log_level => "--log-level", + :log_prefix => "--log-prefix", + :log_uid => "--log-uid", + :mac_source => ["-m mac --mac-source", "--mac-source"], + :mask => '--mask', + :match_mark => "-m mark --mark", + :mss => '-m tcpmss --mss', + :name => "-m comment --comment", + :outiface => "-o", + :pkttype => "-m pkttype --pkt-type", + :port => '-m multiport --ports', + :proto => "-p", + :queue_num => "--queue-num", + :queue_bypass => "--queue-bypass", + :random => "--random", + :rdest => "--rdest", + :reap => "--reap", + :recent => "-m recent", + :reject => "--reject-with", + :rhitcount => "--hitcount", + :rname => "--name", + :rseconds => "--seconds", + :rsource => "--rsource", + :rttl => "--rttl", + :set_dscp => '--set-dscp', + :set_dscp_class => '--set-dscp-class', + :set_mark => mark_flag, + :set_mss => '--set-mss', + :socket => "-m socket", + :source => "-s", + :sport => ["-m multiport --sports", "--sport"], + :src_range => "--src-range", + :src_type => "--src-type", + :stat_every => '--every', + :stat_mode => "-m statistic --mode", + :stat_packet => '--packet', + :stat_probability => '--probability', + :state => "-m state --state", + :string => "-m string --string", + :string_algo => "--algo", + :string_from => "--from", + :string_to => "--to", + :table => "-t", + :tcp_flags => "-m tcp --tcp-flags", + :todest => "--to-destination", + :toports => "--to-ports", + :tosource => "--to-source", + :to => "--to", + :uid => "--uid-owner", + :physdev_in => "--physdev-in", + :physdev_out => "--physdev-out", + :physdev_is_bridged => "--physdev-is-bridged", + :date_start => "--datestart", + :date_stop => "--datestop", + :time_start => "--timestart", + :time_stop => "--timestop", + :month_days => "--monthdays", + :week_days => "--weekdays", + :time_contiguous => "--contiguous", + :kernel_timezone => "--kerneltz", + :clusterip_new => "--new", + :clusterip_hashmode => "--hashmode", + :clusterip_clustermac => "--clustermac", + :clusterip_total_nodes => "--total-nodes", + :clusterip_local_node => "--local-node", + :clusterip_hash_init => "--hash-init", + } + + # These are known booleans that do not take a value, but we want to munge + # to true if they exist. + @known_booleans = [ + :checksum_fill, + :clamp_mss_to_pmtu, + :isfragment, + :log_uid, + :random, + :rdest, + :reap, + :rsource, + :rttl, + :socket, + :physdev_is_bridged, + :time_contiguous, + :kernel_timezone, + :clusterip_new, + :queue_bypass, + ] + + # Properties that use "-m " (with the potential to have multiple + # arguments against the same IPT module) must be in this hash. The keys in this + # hash are the IPT module names, with the values being an array of the respective + # supported arguments for this IPT module. + # + # ** IPT Module arguments must be in order as they would appear in iptables-save ** + # + # Exceptions: + # => multiport: (For some reason, the multiport arguments can't be) + # specified within the same "-m multiport", but works in seperate + # ones. + # + @module_to_argument_mapping = { + :physdev => [:physdev_in, :physdev_out, :physdev_is_bridged], + :addrtype => [:src_type, :dst_type], + :iprange => [:src_range, :dst_range], + :owner => [:uid, :gid], + :time => [:time_start, :time_stop, :month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone] + } + + def self.munge_resource_map_from_existing_values(resource_map_original, compare) + resource_map_new = resource_map_original.clone + + @module_to_argument_mapping.each do |ipt_module, arg_array| + arg_array.each do |argument| + if resource_map_original[argument].is_a?(Array) + if compare.include?(resource_map_original[argument].first) + resource_map_new[argument] = resource_map_original[argument].clone + resource_map_new[argument][0] = "-m #{ipt_module.to_s} #{resource_map_original[argument].first}" + break + end + else + if compare.include?(resource_map_original[argument]) + resource_map_new[argument] = "-m #{ipt_module.to_s} #{resource_map_original[argument]}" + break + end + end + end + end + resource_map_new + end + + def munge_resource_map_from_resource(resource_map_original, compare) + resource_map_new = resource_map_original.clone + module_to_argument_mapping = self.class.instance_variable_get('@module_to_argument_mapping') + + module_to_argument_mapping.each do |ipt_module, arg_array| + arg_array.each do |argument| + if compare[argument] + if resource_map_original[argument].is_a?(Array) + resource_map_new[argument] = resource_map_original[argument].clone + resource_map_new[argument][0] = "-m #{ipt_module.to_s} #{resource_map_original[argument].first}" + else + resource_map_new[argument] = "-m #{ipt_module.to_s} #{resource_map_original[argument]}" + end + break + end + end + end + resource_map_new + end + + + # Create property methods dynamically + (@resource_map.keys << :chain << :table << :action).each do |property| + if @known_booleans.include?(property) then + # The boolean properties default to '' which should be read as false + define_method "#{property}" do + @property_hash[property] = :false if @property_hash[property] == nil + @property_hash[property.to_sym] + end + else + define_method "#{property}" do + @property_hash[property.to_sym] + end + end + + if property == :chain + define_method "#{property}=" do |value| + if @property_hash[:chain] != value + raise ArgumentError, "Modifying the chain for existing rules is not supported." + end + end + else + define_method "#{property}=" do |value| + @property_hash[:needs_change] = true + end + end + end + + # This is the order of resources as they appear in iptables-save output, + # we need it to properly parse and apply rules, if the order of resource + # changes between puppet runs, the changed rules will be re-applied again. + # This order can be determined by going through iptables source code or just tweaking and trying manually + @resource_list = [ + :table, :source, :destination, :iniface, :outiface, :physdev_in, :physdev_out, :physdev_is_bridged, :proto, :isfragment, + :stat_mode, :stat_every, :stat_packet, :stat_probability, + :src_range, :dst_range, :tcp_flags, :uid, :gid, :mac_source, :sport, :dport, :port, + :src_type, :dst_type, :socket, :pkttype, :name, :ipsec_dir, :ipsec_policy, + :state, :ctstate, :icmp, :limit, :burst, :length, :recent, :rseconds, :reap, + :rhitcount, :rttl, :rname, :mask, :rsource, :rdest, :ipset, :string, :string_algo, + :string_from, :string_to, :jump, :goto, :clusterip_new, :clusterip_hashmode, + :clusterip_clustermac, :clusterip_total_nodes, :clusterip_local_node, :clusterip_hash_init, :queue_num, :queue_bypass, + :clamp_mss_to_pmtu, :gateway, :set_mss, :set_dscp, :set_dscp_class, :todest, :tosource, :toports, :to, :checksum_fill, :random, :log_prefix, + :log_level, :log_uid, :reject, :set_mark, :match_mark, :mss, :connlimit_above, :connlimit_mask, :connmark, :time_start, :time_stop, + :month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone + ] + + def insert + debug 'Inserting rule %s' % resource[:name] + iptables insert_args + end + + def update + debug 'Updating rule %s' % resource[:name] + iptables update_args + end + + def delete + debug 'Deleting rule %s' % resource[:name] + begin + iptables delete_args + rescue Puppet::ExecutionFailure => e + # Check to see if the iptables rule is already gone. This can sometimes + # happen as a side effect of other resource changes. If it's not gone, + # raise the error as per usual. + raise e unless self.resource.property(:ensure).insync?(:absent) + + # If it's already gone, there is no error. Still record a change, but + # adjust the change message to indicate ambiguity over what work Puppet + # actually did to remove the resource, vs. what could have been a side + # effect of something else puppet did. + resource.property(:ensure).singleton_class.send(:define_method, :change_to_s) do |a,b| + "ensured absent" + end + end + end + + def exists? + properties[:ensure] != :absent + end + + # Flush the property hash once done. + def flush + debug("[flush]") + if @property_hash.delete(:needs_change) + notice("Properties changed - updating rule") + update + end + persist_iptables(self.class.instance_variable_get(:@protocol)) + @property_hash.clear + end + + def self.instances + debug "[instances]" + table = nil + rules = [] + counter = 1 + + # String#lines would be nice, but we need to support Ruby 1.8.5 + iptables_save.split("\n").each do |line| + unless line =~ /^\#\s+|^\:\S+|^COMMIT|^FATAL/ + if line =~ /^\*/ + table = line.sub(/\*/, "") + else + if hash = rule_to_hash(line, table, counter) + rules << new(hash) + counter += 1 + end + end + end + end + rules + end + + def self.rule_to_hash(line, table, counter) + hash = {} + keys = [] + values = line.dup + + #################### + # PRE-PARSE CLUDGING + #################### + + # The match for ttl + values = values.gsub(/(!\s+)?-m ttl (!\s+)?--ttl-(eq|lt|gt) [0-9]+/, '') + # --tcp-flags takes two values; we cheat by adding " around it + # so it behaves like --comment + values = values.gsub(/(!\s+)?--tcp-flags (\S*) (\S*)/, '--tcp-flags "\1\2 \3"') + # --match-set can have multiple values with weird iptables format + if values =~ /-m set --match-set/ + values = values.gsub(/(!\s+)?--match-set (\S*) (\S*)/, '--match-set \1\2 \3') + ind = values.index('-m set --match-set') + sets = values.scan(/-m set --match-set ((?:!\s+)?\S* \S*)/) + values = values.gsub(/-m set --match-set (!\s+)?\S* \S* /, '') + values.insert(ind, "-m set --match-set \"#{sets.join(';')}\" ") + end + # we do a similar thing for negated address masks (source and destination). + values = values.gsub(/(-\S+) (!)\s?(\S*)/,'\1 "\2 \3"') + # the actual rule will have the ! mark before the option. + values = values.gsub(/(!)\s*(-\S+)\s*(\S*)/, '\2 "\1 \3"') + # The match extension for tcp & udp are optional and throws off the @resource_map. + values = values.gsub(/(?!-m tcp --tcp-flags)-m (tcp|udp) /, '') + # There is a bug in EL5 which puts 2 spaces before physdev, so we fix it + values = values.gsub(/\s{2}--physdev/, ' --physdev') + # '--pol ipsec' takes many optional arguments; we cheat again by adding " around them + values = values.sub(/ + --pol\sipsec + (\s--strict)? + (\s--reqid\s\S+)? + (\s--spi\s\S+)? + (\s--proto\s\S+)? + (\s--mode\s\S+)? + (\s--tunnel-dst\s\S+)? + (\s--tunnel-src\s\S+)? + (\s--next)?/x, + '--pol "ipsec\1\2\3\4\5\6\7\8" ' + ) + # on some iptables versions, --connlimit-saddr switch is added after the rule is applied + values = values.gsub(/--connlimit-saddr/, '') + + resource_map = munge_resource_map_from_existing_values(@resource_map, values) + + # Trick the system for booleans + @known_booleans.each do |bool| + # append "true" because all params are expected to have values + if bool == :isfragment then + # -f requires special matching: + # only replace those -f that are not followed by an l to + # distinguish between -f and the '-f' inside of --tcp-flags. + values = values.sub(/\s-f(?!l)(?=.*--comment)/, ' -f true') + else + values = values.sub(/#{resource_map[bool]}/, "#{resource_map[bool]} true") + end + end + + ############ + # Populate parser_list with used value, in the correct order + ############ + map_index={} + resource_map.each_pair do |map_k,map_v| + [map_v].flatten.each do |v| + ind=values.index(/\s#{v}\s/) + next unless ind + map_index[map_k]=ind + end + end + # Generate parser_list based on the index of the found option + parser_list=[] + map_index.sort_by{|k,v| v}.each{|mapi| parser_list << mapi.first } + + ############ + # MAIN PARSE + ############ + + # Here we iterate across our values to generate an array of keys + parser_list.reverse.each do |k| + resource_map_key = resource_map[k] + [resource_map_key].flatten.each do |opt| + if values.slice!(/\s#{opt}/) + keys << k + break + end + end + end + + # Manually remove chain + values.slice!('-A') + keys << :chain + + # Here we generate the main hash by scanning arguments off the values + # string, handling any quoted characters present in the value, and then + # zipping the values with the array of keys. + keys.zip(values.scan(/("([^"\\]|\\.)*"|\S+)/).transpose[0].reverse) do |f, v| + if v =~ /^".*"$/ then + hash[f] = v.sub(/^"(.*)"$/, '\1').gsub(/\\(\\|'|")/, '\1') + else + hash[f] = v.dup + end + end + + ##################### + # POST PARSE CLUDGING + ##################### + + [:dport, :sport, :port, :state, :ctstate].each do |prop| + hash[prop] = hash[prop].split(',') if ! hash[prop].nil? + end + + hash[:ipset] = hash[:ipset].split(';') if ! hash[:ipset].nil? + + ## clean up DSCP class to HEX mappings + valid_dscp_classes = { + '0x0a' => 'af11', + '0x0c' => 'af12', + '0x0e' => 'af13', + '0x12' => 'af21', + '0x14' => 'af22', + '0x16' => 'af23', + '0x1a' => 'af31', + '0x1c' => 'af32', + '0x1e' => 'af33', + '0x22' => 'af41', + '0x24' => 'af42', + '0x26' => 'af43', + '0x08' => 'cs1', + '0x10' => 'cs2', + '0x18' => 'cs3', + '0x20' => 'cs4', + '0x28' => 'cs5', + '0x30' => 'cs6', + '0x38' => 'cs7', + '0x2e' => 'ef' + } + [:set_dscp_class].each do |prop| + [:set_dscp].each do |dmark| + next unless hash[dmark] + hash[prop] = valid_dscp_classes[hash[dmark]] + end + end + + + # Convert booleans removing the previous cludge we did + @known_booleans.each do |bool| + if hash[bool] != nil then + if hash[bool] != "true" then + raise "Parser error: #{bool} was meant to be a boolean but received value: #{hash[bool]}." + end + end + end + + # Our type prefers hyphens over colons for ranges so ... + # Iterate across all ports replacing colons with hyphens so that ranges match + # the types expectations. + [:dport, :sport, :port].each do |prop| + next unless hash[prop] + hash[prop] = hash[prop].collect do |elem| + elem.gsub(/:/,'-') + end + end + if hash[:length] + hash[:length].gsub!(/:/,'-') + end + + # Invert any rules that are prefixed with a '!' + [ + :connmark, + :ctstate, + :destination, + :dport, + :dst_range, + :dst_type, + :port, + :proto, + :source, + :sport, + :src_range, + :src_type, + :state, + ].each do |prop| + if hash[prop] and hash[prop].is_a?(Array) + # find if any are negated, then negate all if so + should_negate = hash[prop].index do |value| + value.match(/^(!)\s+/) + end + hash[prop] = hash[prop].collect { |v| + "! #{v.sub(/^!\s+/,'')}" + } if should_negate + elsif hash[prop] + m = hash[prop].match(/^(!?)\s?(.*)/) + neg = "! " if m[1] == "!" + if [:source,:destination].include?(prop) + # Normalise all rules to CIDR notation. + hash[prop] = "#{neg}#{Puppet::Util::IPCidr.new(m[2]).cidr}" + else + hash[prop] = "#{neg}#{m[2]}" + end + end + end + + # States should always be sorted. This ensures that the output from + # iptables-save and user supplied resources is consistent. + hash[:state] = hash[:state].sort unless hash[:state].nil? + hash[:ctstate] = hash[:ctstate].sort unless hash[:ctstate].nil? + + # This forces all existing, commentless rules or rules with invalid comments to be moved + # to the bottom of the stack. + # Puppet-firewall requires that all rules have comments (resource names) and match this + # regex and will fail if a rule in iptables does not have a comment. We get around this + # by appending a high level + if ! hash[:name] + num = 9000 + counter + hash[:name] = "#{num} #{Digest::MD5.hexdigest(line)}" + elsif not /^\d+[[:graph:][:space:]]+$/ =~ hash[:name] + num = 9000 + counter + hash[:name] = "#{num} #{/([[:graph:][:space:]]+)/.match(hash[:name])[1]}" + end + + # Iptables defaults to log_level '4', so it is omitted from the output of iptables-save. + # If the :jump value is LOG and you don't have a log-level set, we assume it to be '4'. + if hash[:jump] == 'LOG' && ! hash[:log_level] + hash[:log_level] = '4' + end + + # Iptables defaults to burst '5', so it is ommitted from the output of iptables-save. + # If the :limit value is set and you don't have a burst set, we assume it to be '5'. + if hash[:limit] && ! hash[:burst] + hash[:burst] = '5' + end + + hash[:line] = line + hash[:provider] = self.name.to_s + hash[:table] = table + hash[:ensure] = :present + + # Munge some vars here ... + + # Proto should equal 'all' if undefined + hash[:proto] = "all" if !hash.include?(:proto) + + # If the jump parameter is set to one of: ACCEPT, REJECT or DROP then + # we should set the action parameter instead. + if ['ACCEPT','REJECT','DROP'].include?(hash[:jump]) then + hash[:action] = hash[:jump].downcase + hash.delete(:jump) + end + hash + end + + def insert_args + args = [] + args << ["-I", resource[:chain], insert_order] + args << general_args + args + end + + def update_args + args = [] + args << ["-R", resource[:chain], insert_order] + args << general_args + args + end + + def delete_args + # Split into arguments + line = properties[:line].gsub(/^\-A /, '-D ').split(/\s(?=(?:[^"]|"[^"]*")*$)/).map{|v| v.gsub(/^"/, '').gsub(/"$/, '')} + line.unshift("-t", properties[:table]) + end + + # This method takes the resource, and attempts to generate the command line + # arguments for iptables. + def general_args + debug "Current resource: %s" % resource.class + + args = [] + resource_list = self.class.instance_variable_get('@resource_list') + known_booleans = self.class.instance_variable_get('@known_booleans') + resource_map = self.class.instance_variable_get('@resource_map') + resource_map = munge_resource_map_from_resource(resource_map, resource) + + # Always attempt to wait for a lock for iptables to prevent failures when + # puppet is running at the same time something else is managing the rules + # note: --wait wasn't added untip iptables version 1.4.20 + iptables_version = Facter.value('iptables_version') + if (iptables_version && Puppet::Util::Package.versioncmp(iptables_version, '1.4.20') >= 0) + args << ['--wait'] + end + + resource_list.each do |res| + resource_value = nil + if (resource[res]) then + resource_value = resource[res] + # If socket is true then do not add the value as -m socket is standalone + if known_booleans.include?(res) then + if resource[res] == :true then + resource_value = nil + else + # If the property is not :true then we don't want to add the value + # to the args list + next + end + end + elsif res == :jump and resource[:action] then + # In this case, we are substituting jump for action + resource_value = resource[:action].to_s.upcase + else + next + end + + args << [resource_map[res]].flatten.first.split(' ') + args = args.flatten + + # On negations, the '!' has to be before the option (eg: "! -d 1.2.3.4") + if resource_value.is_a?(String) and resource_value.sub!(/^!\s*/, '') then + # we do this after adding the 'dash' argument because of ones like "-m multiport --dports", where we want it before the "--dports" but after "-m multiport". + # so we insert before whatever the last argument is + args.insert(-2, '!') + elsif resource_value.is_a?(Symbol) and resource_value.to_s.match(/^!/) then + #ruby 1.8.7 can't .match Symbols ------------------ ^ + resource_value = resource_value.to_s.sub!(/^!\s*/, '').to_sym + args.insert(-2, '!') + elsif resource_value.is_a?(Array) and res != :ipset + should_negate = resource_value.index do |value| + #ruby 1.8.7 can't .match symbols + value.to_s.match(/^(!)\s+/) + end + if should_negate + resource_value, wrong_values = resource_value.collect do |value| + if value.is_a?(String) + wrong = value if ! value.match(/^!\s+/) + [value.sub(/^!\s*/, ''),wrong] + else + [value,nil] + end + end.transpose + wrong_values = wrong_values.compact + if ! wrong_values.empty? + fail "All values of the '#{res}' property must be prefixed with a '!' when inverting, but '#{wrong_values.join("', '")}' #{wrong_values.length>1?"are":"is"} not prefixed; aborting" + end + args.insert(-2, '!') + end + end + + + # For sport and dport, convert hyphens to colons since the type + # expects hyphens for ranges of ports. + if [:sport, :dport, :port].include?(res) then + resource_value = resource_value.collect do |elem| + elem.gsub(/-/, ':') + end + end + + # ipset can accept multiple values with weird iptables arguments + if res == :ipset + resource_value.join(" #{[resource_map[res]].flatten.first} ").split(' ').each do |a| + if a.sub!(/^!\s*/, '') + # Negate ipset options + args.insert(-2, '!') + end + + args << a if a.length > 0 + end + # our tcp_flags takes a single string with comma lists separated + # by space + # --tcp-flags expects two arguments + elsif res == :tcp_flags + one, two = resource_value.split(' ') + args << one + args << two + elsif resource_value.is_a?(Array) + args << resource_value.join(',') + elsif !resource_value.nil? + args << resource_value + end + end + + args + end + + def insert_order + debug("[insert_order]") + rules = [] + + # Find list of current rules based on chain and table + self.class.instances.each do |rule| + if rule.chain == resource[:chain].to_s and rule.table == resource[:table].to_s + rules << rule.name + end + end + + # No rules at all? Just bail now. + return 1 if rules.empty? + + # Add our rule to the end of the array of known rules + my_rule = resource[:name].to_s + rules << my_rule + + unmanaged_rule_regex = /^9[0-9]{3}\s[a-f0-9]{32}$/ + # Find if this is a new rule or an existing rule, then find how many + # unmanaged rules preceed it. + if rules.length == rules.uniq.length + # This is a new rule so find its ordered location. + new_rule_location = rules.sort.uniq.index(my_rule) + if new_rule_location == 0 + # The rule will be the first rule in the chain because nothing came + # before it. + offset_rule = rules[0] + else + # This rule will come after other managed rules, so find the rule + # immediately preceeding it. + offset_rule = rules.sort.uniq[new_rule_location - 1] + end + else + # This is a pre-existing rule, so find the offset from the original + # ordering. + offset_rule = my_rule + end + # Count how many unmanaged rules are ahead of the target rule so we know + # how much to add to the insert order + unnamed_offset = rules[0..rules.index(offset_rule)].inject(0) do |sum,rule| + # This regex matches the names given to unmanaged rules (a number + # 9000-9999 followed by an MD5 hash). + sum + (rule.match(unmanaged_rule_regex) ? 1 : 0) + end + + # We want our rule to come before unmanaged rules if it's not a 9-rule + if offset_rule.match(unmanaged_rule_regex) and ! my_rule.match(/^9/) + unnamed_offset -= 1 + end + + # Insert our new or updated rule in the correct order of named rules, but + # offset for unnamed rules. + rules.reject{|r|r.match(unmanaged_rule_regex)}.sort.index(my_rule) + 1 + unnamed_offset + end +end diff --git a/environments/production/modules/firewall/lib/puppet/provider/firewallchain/iptables_chain.rb b/environments/production/modules/firewall/lib/puppet/provider/firewallchain/iptables_chain.rb new file mode 100644 index 0000000..ec10ecc --- /dev/null +++ b/environments/production/modules/firewall/lib/puppet/provider/firewallchain/iptables_chain.rb @@ -0,0 +1,179 @@ +Puppet::Type.type(:firewallchain).provide :iptables_chain do + include Puppet::Util::Firewall + + @doc = "Iptables chain provider" + + has_feature :iptables_chain + has_feature :policy + + optional_commands({ + :iptables => 'iptables', + :iptables_save => 'iptables-save', + :ip6tables => 'ip6tables', + :ip6tables_save => 'ip6tables-save', + :ebtables => 'ebtables', + :ebtables_save => 'ebtables-save', + }) + + defaultfor :kernel => :linux + confine :kernel => :linux + + # chain name is greedy so we anchor from the end. + # [\d+:\d+] doesn't exist on ebtables + Mapping = { + :IPv4 => { + :tables => method(:iptables), + :save => method(:iptables_save), + :re => /^:(.+)\s(\S+)\s\[\d+:\d+\]$/, + }, + :IPv6 => { + :tables => method(:ip6tables), + :save => method(:ip6tables_save), + :re => /^:(.+)\s(\S+)\s\[\d+:\d+\]$/, + }, + :ethernet => { + :tables => method(:ebtables), + :save => method(:ebtables_save), + :re => /^:(.+)\s(\S+)$/, + } + } + InternalChains = /^(PREROUTING|POSTROUTING|BROUTING|INPUT|FORWARD|OUTPUT)$/ + Tables = 'nat|mangle|filter|raw|rawpost|broute|security' + Nameformat = /^(.+):(#{Tables}):(IP(v[46])?|ethernet)$/ + + def create + allvalidchains do |t, chain, table, protocol| + if chain =~ InternalChains + # can't create internal chains + warning "Attempting to create internal chain #{@resource[:name]}" + end + if properties[:ensure] == protocol + debug "Skipping Inserting chain #{chain} on table #{table} (#{protocol}) already exists" + else + debug "Inserting chain #{chain} on table #{table} (#{protocol}) using #{t}" + t.call ['-t',table,'-N',chain] + unless @resource[:policy].nil? + t.call ['-t',table,'-P',chain,@resource[:policy].to_s.upcase] + end + end + end + end + + def destroy + allvalidchains do |t, chain, table| + if chain =~ InternalChains + # can't delete internal chains + warning "Attempting to destroy internal chain #{@resource[:name]}" + end + debug "Deleting chain #{chain} on table #{table}" + t.call ['-t',table,'-X',chain] + end + end + + def exists? + allvalidchains do |t, chain| + if chain =~ InternalChains + # If the chain isn't present, it's likely because the module isn't loaded. + # If this is true, then we fall into 2 cases + # 1) It'll be loaded on demand + # 2) It won't be loaded on demand, and we throw an error + # This is the intended behavior as it's not the provider's job to load kernel modules + # So we pretend it exists... + return true + end + end + properties[:ensure] == :present + end + + def policy=(value) + return if value == :empty + allvalidchains do |t, chain, table| + p = ['-t',table,'-P',chain,value.to_s.upcase] + debug "[set policy] #{t} #{p}" + t.call p + end + end + + def policy + debug "[get policy] #{@resource[:name]} =#{@property_hash[:policy].to_s.downcase}" + return @property_hash[:policy].to_s.downcase + end + + def self.prefetch(resources) + debug("[prefetch(resources)]") + instances.each do |prov| + if resource = resources[prov.name] + resource.provider = prov + end + end + end + + def flush + debug("[flush]") + persist_iptables(@resource[:name].match(Nameformat)[3]) + # Clear the property hash so we re-initialize with updated values + @property_hash.clear + end + + # Look up the current status. This allows us to conventiently look up + # existing status with properties[:foo]. + def properties + if @property_hash.empty? + @property_hash = query || {:ensure => :absent} + end + @property_hash.dup + end + + # Pull the current state of the list from the full list. + def query + self.class.instances.each do |instance| + if instance.name == self.name + debug "query found #{self.name}" % instance.properties.inspect + return instance.properties + end + end + nil + end + + def self.instances + debug "[instances]" + table = nil + chains = [] + + Mapping.each { |p, c| + begin + c[:save].call.each_line do |line| + if line =~ c[:re] then + name = $1 + ':' + (table == 'filter' ? 'filter' : table) + ':' + p.to_s + policy = $2 == '-' ? nil : $2.downcase.to_sym + + chains << new({ + :name => name, + :policy => policy, + :ensure => :present, + }) + + debug "[instance] '#{name}' #{policy}" + elsif line =~ /^\*(\S+)/ + table = $1 + else + next + end + end + rescue Puppet::Error + # ignore command not found for ebtables or anything that doesn't exist + end + } + + chains + end + + def allvalidchains + @resource[:name].match(Nameformat) + chain = $1 + table = $2 + protocol = $3 + yield Mapping[protocol.to_sym][:tables],chain,table,protocol.to_sym + end + +end diff --git a/environments/production/modules/firewall/lib/puppet/type/firewall.rb b/environments/production/modules/firewall/lib/puppet/type/firewall.rb new file mode 100644 index 0000000..e0575f4 --- /dev/null +++ b/environments/production/modules/firewall/lib/puppet/type/firewall.rb @@ -0,0 +1,1695 @@ +# See: #10295 for more details. +# +# This is a workaround for bug: #4248 whereby ruby files outside of the normal +# provider/type path do not load until pluginsync has occured on the puppetmaster +# +# In this case I'm trying the relative path first, then falling back to normal +# mechanisms. This should be fixed in future versions of puppet but it looks +# like we'll need to maintain this for some time perhaps. +$LOAD_PATH.unshift(File.join(File.dirname(__FILE__),"..","..")) +require 'puppet/util/firewall' + +Puppet::Type.newtype(:firewall) do + include Puppet::Util::Firewall + + @doc = <<-EOS + This type provides the capability to manage firewall rules within + puppet. + + **Autorequires:** + + If Puppet is managing the iptables or ip6tables chains specified in the + `chain` or `jump` parameters, the firewall resource will autorequire + those firewallchain resources. + + If Puppet is managing the iptables, iptables-persistent, or iptables-services packages, + and the provider is iptables or ip6tables, the firewall resource will + autorequire those packages to ensure that any required binaries are + installed. + EOS + + feature :connection_limiting, "Connection limiting features." + feature :hop_limiting, "Hop limiting features." + feature :rate_limiting, "Rate limiting features." + feature :recent_limiting, "The netfilter recent module" + feature :snat, "Source NATing" + feature :dnat, "Destination NATing" + feature :netmap, "NET MAPping" + feature :interface_match, "Interface matching" + feature :icmp_match, "Matching ICMP types" + feature :owner, "Matching owners" + feature :state_match, "Matching stateful firewall states" + feature :reject_type, "The ability to control reject messages" + feature :log_level, "The ability to control the log level" + feature :log_prefix, "The ability to add prefixes to log messages" + feature :log_uid, "Add UIDs to log messages" + feature :mark, "Match or Set the netfilter mark value associated with the packet" + feature :mss, "Match a given TCP MSS value or range." + feature :tcp_flags, "The ability to match on particular TCP flag settings" + feature :pkttype, "Match a packet type" + feature :socket, "Match open sockets" + feature :isfragment, "Match fragments" + feature :address_type, "The ability match on source or destination address type" + feature :iprange, "The ability match on source or destination IP range " + feature :ishasmorefrags, "Match a non-last fragment of a fragmented ipv6 packet - might be first" + feature :islastfrag, "Match the last fragment of an ipv6 packet" + feature :isfirstfrag, "Match the first fragment of a fragmented ipv6 packet" + feature :ipsec_policy, "Match IPsec policy" + feature :ipsec_dir, "Match IPsec policy direction" + feature :mask, "Ability to match recent rules based on the ipv4 mask" + feature :ipset, "Match against specified ipset list" + feature :clusterip, "Configure a simple cluster of nodes that share a certain IP and MAC address without an explicit load balancer in front of them." + feature :length, "Match the length of layer-3 payload" + feature :string_matching, "String matching features" + feature :queue_num, "Which NFQUEUE to send packets to" + feature :queue_bypass, "If nothing is listening on queue_num, allow packets to bypass the queue" + + # provider specific features + feature :iptables, "The provider provides iptables features." + + ensurable do + desc <<-EOS + Manage the state of this rule. The default action is *present*. + EOS + + newvalue(:present) do + provider.insert + end + + newvalue(:absent) do + provider.delete + end + + defaultto :present + end + + newparam(:name) do + desc <<-EOS + The canonical name of the rule. This name is also used for ordering + so make sure you prefix the rule with a number: + + 000 this runs first + 999 this runs last + + Depending on the provider, the name of the rule can be stored using + the comment feature of the underlying firewall subsystem. + EOS + isnamevar + + # Keep rule names simple - they must start with a number + newvalues(/^\d+[[:graph:][:space:]]+$/) + end + + newproperty(:action) do + desc <<-EOS + This is the action to perform on a match. Can be one of: + + * accept - the packet is accepted + * reject - the packet is rejected with a suitable ICMP response + * drop - the packet is dropped + + If you specify no value it will simply match the rule but perform no + action unless you provide a provider specific parameter (such as *jump*). + EOS + newvalues(:accept, :reject, :drop) + end + + # Generic matching properties + newproperty(:source) do + desc <<-EOS + The source address. For example: + + source => '192.168.2.0/24' + + You can also negate a mask by putting ! in front. For example: + + source => '! 192.168.2.0/24' + + The source can also be an IPv6 address if your provider supports it. + EOS + + munge do |value| + begin + @resource.host_to_mask(value) + rescue Exception => e + self.fail("host_to_ip failed for #{value}, exception #{e}") + end + end + end + + # Source IP range + newproperty(:src_range, :required_features => :iprange) do + desc <<-EOS + The source IP range. For example: + + src_range => '192.168.1.1-192.168.1.10' + + The source IP range must be in 'IP1-IP2' format. + EOS + + validate do |value| + if matches = /^([^\-\/]+)-([^\-\/]+)$/.match(value) + start_addr = matches[1] + end_addr = matches[2] + + [start_addr, end_addr].each do |addr| + begin + @resource.host_to_ip(addr) + rescue Exception + self.fail("Invalid IP address \"#{addr}\" in range \"#{value}\"") + end + end + else + raise(ArgumentError, "The source IP range must be in 'IP1-IP2' format.") + end + end + end + + newproperty(:destination) do + desc <<-EOS + The destination address to match. For example: + + destination => '192.168.1.0/24' + + You can also negate a mask by putting ! in front. For example: + + destination => '! 192.168.2.0/24' + + The destination can also be an IPv6 address if your provider supports it. + EOS + + munge do |value| + begin + @resource.host_to_mask(value) + rescue Exception => e + self.fail("host_to_ip failed for #{value}, exception #{e}") + end + end + end + + # Destination IP range + newproperty(:dst_range, :required_features => :iprange) do + desc <<-EOS + The destination IP range. For example: + + dst_range => '192.168.1.1-192.168.1.10' + + The destination IP range must be in 'IP1-IP2' format. + EOS + + validate do |value| + if matches = /^([^\-\/]+)-([^\-\/]+)$/.match(value) + start_addr = matches[1] + end_addr = matches[2] + + [start_addr, end_addr].each do |addr| + begin + @resource.host_to_ip(addr) + rescue Exception + self.fail("Invalid IP address \"#{addr}\" in range \"#{value}\"") + end + end + else + raise(ArgumentError, "The destination IP range must be in 'IP1-IP2' format.") + end + end + end + + newproperty(:sport, :array_matching => :all) do + desc <<-EOS + The source port to match for this filter (if the protocol supports + ports). Will accept a single element or an array. + + For some firewall providers you can pass a range of ports in the format: + + - + + For example: + + 1-1024 + + This would cover ports 1 to 1024. + EOS + + munge do |value| + @resource.string_to_port(value, :proto) + end + + def is_to_s(value) + should_to_s(value) + end + + def should_to_s(value) + value = [value] unless value.is_a?(Array) + value.join(',') + end + end + + newproperty(:dport, :array_matching => :all) do + desc <<-EOS + The destination port to match for this filter (if the protocol supports + ports). Will accept a single element or an array. + + For some firewall providers you can pass a range of ports in the format: + + - + + For example: + + 1-1024 + + This would cover ports 1 to 1024. + EOS + + munge do |value| + @resource.string_to_port(value, :proto) + end + + def is_to_s(value) + should_to_s(value) + end + + def should_to_s(value) + value = [value] unless value.is_a?(Array) + value.join(',') + end + end + + newproperty(:port, :array_matching => :all) do + desc <<-EOS + DEPRECATED + + The destination or source port to match for this filter (if the protocol + supports ports). Will accept a single element or an array. + + For some firewall providers you can pass a range of ports in the format: + + - + + For example: + + 1-1024 + + This would cover ports 1 to 1024. + EOS + + validate do |value| + Puppet.warning('Passing port to firewall is deprecated and will be removed. Use dport and/or sport instead.') + end + + munge do |value| + @resource.string_to_port(value, :proto) + end + + def is_to_s(value) + should_to_s(value) + end + + def should_to_s(value) + value = [value] unless value.is_a?(Array) + value.join(',') + end + end + + newproperty(:dst_type, :required_features => :address_type) do + desc <<-EOS + The destination address type. For example: + + dst_type => 'LOCAL' + + Can be one of: + + * UNSPEC - an unspecified address + * UNICAST - a unicast address + * LOCAL - a local address + * BROADCAST - a broadcast address + * ANYCAST - an anycast packet + * MULTICAST - a multicast address + * BLACKHOLE - a blackhole address + * UNREACHABLE - an unreachable address + * PROHIBIT - a prohibited address + * THROW - undocumented + * NAT - undocumented + * XRESOLVE - undocumented + EOS + + newvalues(*[:UNSPEC, :UNICAST, :LOCAL, :BROADCAST, :ANYCAST, :MULTICAST, + :BLACKHOLE, :UNREACHABLE, :PROHIBIT, :THROW, :NAT, :XRESOLVE].collect do |address_type| + [address_type, "! #{address_type}".to_sym] + end.flatten) + end + + newproperty(:src_type, :required_features => :address_type) do + desc <<-EOS + The source address type. For example: + + src_type => 'LOCAL' + + Can be one of: + + * UNSPEC - an unspecified address + * UNICAST - a unicast address + * LOCAL - a local address + * BROADCAST - a broadcast address + * ANYCAST - an anycast packet + * MULTICAST - a multicast address + * BLACKHOLE - a blackhole address + * UNREACHABLE - an unreachable address + * PROHIBIT - a prohibited address + * THROW - undocumented + * NAT - undocumented + * XRESOLVE - undocumented + EOS + + newvalues(*[:UNSPEC, :UNICAST, :LOCAL, :BROADCAST, :ANYCAST, :MULTICAST, + :BLACKHOLE, :UNREACHABLE, :PROHIBIT, :THROW, :NAT, :XRESOLVE].collect do |address_type| + [address_type, "! #{address_type}".to_sym] + end.flatten) + end + + newproperty(:proto) do + desc <<-EOS + The specific protocol to match for this rule. By default this is + *tcp*. + EOS + + newvalues(*[:ip, :tcp, :udp, :icmp, :"ipv6-icmp", :esp, :ah, :vrrp, :igmp, :ipencap, :ipv4, :ipv6, :ospf, :gre, :cbt, :sctp, :pim, :all].collect do |proto| + [proto, "! #{proto}".to_sym] + end.flatten) + defaultto "tcp" + end + + # tcp-specific + newproperty(:mss) do + desc <<-EOS + Match a given TCP MSS value or range. + EOS + end + + # tcp-specific + newproperty(:tcp_flags, :required_features => :tcp_flags) do + desc <<-EOS + Match when the TCP flags are as specified. + Is a string with a list of comma-separated flag names for the mask, + then a space, then a comma-separated list of flags that should be set. + The flags are: SYN ACK FIN RST URG PSH ALL NONE + Note that you specify them in the order that iptables --list-rules + would list them to avoid having puppet think you changed the flags. + Example: FIN,SYN,RST,ACK SYN matches packets with the SYN bit set and the + ACK,RST and FIN bits cleared. Such packets are used to request + TCP connection initiation. + EOS + end + + + # Iptables specific + newproperty(:chain, :required_features => :iptables) do + desc <<-EOS + Name of the chain to use. Can be one of the built-ins: + + * INPUT + * FORWARD + * OUTPUT + * PREROUTING + * POSTROUTING + + Or you can provide a user-based chain. + + The default value is 'INPUT'. + EOS + + defaultto "INPUT" + newvalue(/^[a-zA-Z0-9\-_]+$/) + end + + newproperty(:table, :required_features => :iptables) do + desc <<-EOS + Table to use. Can be one of: + + * nat + * mangle + * filter + * raw + * rawpost + + By default the setting is 'filter'. + EOS + + newvalues(:nat, :mangle, :filter, :raw, :rawpost) + defaultto "filter" + end + + newproperty(:jump, :required_features => :iptables) do + desc <<-EOS + The value for the iptables --jump parameter. Normal values are: + + * QUEUE + * RETURN + * DNAT + * SNAT + * LOG + * MASQUERADE + * REDIRECT + * MARK + + But any valid chain name is allowed. + + For the values ACCEPT, DROP and REJECT you must use the generic + 'action' parameter. This is to enfore the use of generic parameters where + possible for maximum cross-platform modelling. + + If you set both 'accept' and 'jump' parameters, you will get an error as + only one of the options should be set. + EOS + + validate do |value| + unless value =~ /^[a-zA-Z0-9\-_]+$/ + raise ArgumentError, <<-EOS + Jump destination must consist of alphanumeric characters, an + underscore or a yphen. + EOS + end + + if ["accept","reject","drop"].include?(value.downcase) + raise ArgumentError, <<-EOS + Jump destination should not be one of ACCEPT, REJECT or DROP. Use + the action property instead. + EOS + end + + end + end + + newproperty(:goto, :required_features => :iptables) do + desc <<-EOS + The value for the iptables --goto parameter. Normal values are: + + * QUEUE + * RETURN + * DNAT + * SNAT + * LOG + * MASQUERADE + * REDIRECT + * MARK + + But any valid chain name is allowed. + EOS + + validate do |value| + unless value =~ /^[a-zA-Z0-9\-_]+$/ + raise ArgumentError, <<-EOS + Goto destination must consist of alphanumeric characters, an + underscore or a yphen. + EOS + end + + if ["accept","reject","drop"].include?(value.downcase) + raise ArgumentError, <<-EOS + Goto destination should not be one of ACCEPT, REJECT or DROP. Use + the action property instead. + EOS + end + + end + end + + # Interface specific matching properties + newproperty(:iniface, :required_features => :interface_match) do + desc <<-EOS + Input interface to filter on. Supports interface alias like eth0:0. + To negate the match try this: + + iniface => '! lo', + + EOS + newvalues(/^!?\s?[a-zA-Z0-9\-\._\+\:]+$/) + end + + newproperty(:outiface, :required_features => :interface_match) do + desc <<-EOS + Output interface to filter on. Supports interface alias like eth0:0. + To negate the match try this: + + outiface => '! lo', + + EOS + newvalues(/^!?\s?[a-zA-Z0-9\-\._\+\:]+$/) + end + + # NAT specific properties + newproperty(:tosource, :required_features => :snat) do + desc <<-EOS + When using jump => "SNAT" you can specify the new source address using + this parameter. + EOS + end + + newproperty(:todest, :required_features => :dnat) do + desc <<-EOS + When using jump => "DNAT" you can specify the new destination address + using this paramter. + EOS + end + + newproperty(:toports, :required_features => :dnat) do + desc <<-EOS + For DNAT this is the port that will replace the destination port. + EOS + end + + newproperty(:to, :required_features => :netmap) do + desc <<-EOS + For NETMAP this will replace the destination IP + EOS + end + + newproperty(:random, :required_features => :dnat) do + desc <<-EOS + When using a jump value of "MASQUERADE", "DNAT", "REDIRECT", or "SNAT" + this boolean will enable randomized port mapping. + EOS + + newvalues(:true, :false) + end + + # Reject ICMP type + newproperty(:reject, :required_features => :reject_type) do + desc <<-EOS + When combined with jump => "REJECT" you can specify a different icmp + response to be sent back to the packet sender. + EOS + end + + # Logging properties + newproperty(:log_level, :required_features => :log_level) do + desc <<-EOS + When combined with jump => "LOG" specifies the system log level to log + to. + EOS + + munge do |value| + if value.kind_of?(String) + value = @resource.log_level_name_to_number(value) + else + value + end + + if value == nil && value != "" + self.fail("Unable to determine log level") + end + value + end + end + + newproperty(:log_prefix, :required_features => :log_prefix) do + desc <<-EOS + When combined with jump => "LOG" specifies the log prefix to use when + logging. + EOS + end + + newproperty(:log_uid, :required_features => :log_uid) do + desc <<-EOS + When combined with jump => "LOG" specifies the uid of the process making + the connection. + EOS + + newvalues(:true, :false) + end + + # ICMP matching property + newproperty(:icmp, :required_features => :icmp_match) do + desc <<-EOS + When matching ICMP packets, this is the type of ICMP packet to match. + + A value of "any" is not supported. To achieve this behaviour the + parameter should simply be omitted or undefined. + EOS + + validate do |value| + if value == "any" + raise ArgumentError, + "Value 'any' is not valid. This behaviour should be achieved " \ + "by omitting or undefining the ICMP parameter." + end + end + + munge do |value| + if value.kind_of?(String) + # ICMP codes differ between IPv4 and IPv6. + case @resource[:provider] + when :iptables + protocol = 'inet' + when :ip6tables + protocol = 'inet6' + else + self.fail("cannot work out protocol family") + end + + value = @resource.icmp_name_to_number(value, protocol) + else + value + end + + if value == nil && value != "" + self.fail("cannot work out icmp type") + end + value + end + end + + newproperty(:state, :array_matching => :all, :required_features => + :state_match) do + + desc <<-EOS + Matches a packet based on its state in the firewall stateful inspection + table. Values can be: + + * INVALID + * ESTABLISHED + * NEW + * RELATED + EOS + + newvalues(:INVALID,:ESTABLISHED,:NEW,:RELATED) + + # States should always be sorted. This normalizes the resource states to + # keep it consistent with the sorted result from iptables-save. + def should=(values) + @should = super(values).sort_by {|sym| sym.to_s} + end + + def is_to_s(value) + should_to_s(value) + end + + def should_to_s(value) + value = [value] unless value.is_a?(Array) + value.join(',') + end + end + + newproperty(:ctstate, :array_matching => :all, :required_features => + :state_match) do + + desc <<-EOS + Matches a packet based on its state in the firewall stateful inspection + table, using the conntrack module. Values can be: + + * INVALID + * ESTABLISHED + * NEW + * RELATED + EOS + + newvalues(:INVALID,:ESTABLISHED,:NEW,:RELATED) + + # States should always be sorted. This normalizes the resource states to + # keep it consistent with the sorted result from iptables-save. + def should=(values) + @should = super(values).sort_by {|sym| sym.to_s} + end + + def is_to_s(value) + should_to_s(value) + end + + def should_to_s(value) + value = [value] unless value.is_a?(Array) + value.join(',') + end + end + + + # Connection mark + newproperty(:connmark, :required_features => :mark) do + desc <<-EOS + Match the Netfilter mark value associated with the packet. Accepts either of: + mark/mask or mark. These will be converted to hex if they are not already. + EOS + munge do |value| + int_or_hex = '[a-fA-F0-9x]' + match = value.to_s.match("(#{int_or_hex}+)(/)?(#{int_or_hex}+)?") + mark = @resource.to_hex32(match[1]) + + # Values that can't be converted to hex. + # Or contain a trailing slash with no mask. + if mark.nil? or (mark and match[2] and match[3].nil?) + raise ArgumentError, "MARK value must be integer or hex between 0 and 0xffffffff" + end + + # There should not be a mask on connmark + unless match[3].nil? + raise ArgumentError, "iptables does not support masks on MARK match rules" + end + value = mark + + value + end + end + + # Connection limiting properties + newproperty(:connlimit_above, :required_features => :connection_limiting) do + desc <<-EOS + Connection limiting value for matched connections above n. + EOS + newvalue(/^\d+$/) + end + + newproperty(:connlimit_mask, :required_features => :connection_limiting) do + desc <<-EOS + Connection limiting by subnet mask for matched connections. + IPv4: 0-32 + IPv6: 0-128 + EOS + newvalue(/^\d+$/) + end + + # Hop limiting properties + newproperty(:hop_limit, :required_features => :hop_limiting) do + desc <<-EOS + Hop limiting value for matched packets. + EOS + newvalue(/^\d+$/) + end + + # Rate limiting properties + newproperty(:limit, :required_features => :rate_limiting) do + desc <<-EOS + Rate limiting value for matched packets. The format is: + rate/[/second/|/minute|/hour|/day]. + + Example values are: '50/sec', '40/min', '30/hour', '10/day'." + EOS + end + + newproperty(:burst, :required_features => :rate_limiting) do + desc <<-EOS + Rate limiting burst value (per second) before limit checks apply. + EOS + newvalue(/^\d+$/) + end + + newproperty(:uid, :required_features => :owner) do + desc <<-EOS + UID or Username owner matching rule. Accepts a string argument + only, as iptables does not accept multiple uid in a single + statement. + EOS + def insync?(is) + require 'etc' + + # The following code allow us to take into consideration unix mappings + # between string usernames and UIDs (integers). We also need to ignore + # spaces as they are irrelevant with respect to rule sync. + + # Remove whitespace + is = is.gsub(/\s+/,'') + should = @should.first.to_s.gsub(/\s+/,'') + + # Keep track of negation, but remove the '!' + is_negate = '' + should_negate = '' + if is.start_with?('!') + is = is.gsub(/^!/,'') + is_negate = '!' + end + if should.start_with?('!') + should = should.gsub(/^!/,'') + should_negate = '!' + end + + # If 'should' contains anything other than digits, + # we assume that we have to do a lookup to convert + # to UID + unless should[/[0-9]+/] == should + should = Etc.getpwnam(should).uid + end + + # If 'is' contains anything other than digits, + # we assume that we have to do a lookup to convert + # to UID + unless is[/[0-9]+/] == is + is = Etc.getpwnam(is).uid + end + + return "#{is_negate}#{is}" == "#{should_negate}#{should}" + end + + end + + newproperty(:gid, :required_features => :owner) do + desc <<-EOS + GID or Group owner matching rule. Accepts a string argument + only, as iptables does not accept multiple gid in a single + statement. + EOS + end + + # match mark + newproperty(:match_mark, :required_features => :mark) do + desc <<-EOS + Match the Netfilter mark value associated with the packet. Accepts either of: + mark/mask or mark. These will be converted to hex if they are not already. + EOS + munge do |value| + mark_regex = %r{\A((?:0x)?[0-9A-F]+)(/)?((?:0x)?[0-9A-F]+)?\z}i + match = value.to_s.match(mark_regex) + if match.nil? + raise ArgumentError, "Match MARK value must be integer or hex between 0 and 0xffffffff" + end + mark = @resource.to_hex32(match[1]) + + # Values that can't be converted to hex. + # Or contain a trailing slash with no mask. + if mark.nil? or (mark and match[2] and match[3].nil?) + raise ArgumentError, "Match MARK value must be integer or hex between 0 and 0xffffffff" + end + + # There should not be a mask on match_mark + unless match[3].nil? + raise ArgumentError, "iptables does not support masks on MARK match rules" + end + value = mark + + value + end + end + + newproperty(:set_mark, :required_features => :mark) do + desc <<-EOS + Set the Netfilter mark value associated with the packet. Accepts either of: + mark/mask or mark. These will be converted to hex if they are not already. + EOS + + munge do |value| + int_or_hex = '[a-fA-F0-9x]' + match = value.to_s.match("(#{int_or_hex}+)(/)?(#{int_or_hex}+)?") + mark = @resource.to_hex32(match[1]) + + # Values that can't be converted to hex. + # Or contain a trailing slash with no mask. + if mark.nil? or (mark and match[2] and match[3].nil?) + raise ArgumentError, "MARK value must be integer or hex between 0 and 0xffffffff" + end + + # Old iptables does not support a mask. New iptables will expect one. + iptables_version = Facter.value('iptables_version') + mask_required = (iptables_version and Puppet::Util::Package.versioncmp(iptables_version, '1.4.1') >= 0) + + if mask_required + if match[3].nil? + value = "#{mark}/0xffffffff" + else + mask = @resource.to_hex32(match[3]) + if mask.nil? + raise ArgumentError, "MARK mask must be integer or hex between 0 and 0xffffffff" + end + value = "#{mark}/#{mask}" + end + else + unless match[3].nil? + raise ArgumentError, "iptables version #{iptables_version} does not support masks on MARK rules" + end + value = mark + end + + value + end + end + + newproperty(:clamp_mss_to_pmtu, :required_features => :iptables) do + desc <<-EOS + Sets the clamp mss to pmtu flag. + EOS + + newvalues(:true, :false) + end + + newproperty(:set_dscp, :required_features => :iptables) do + desc <<-EOS + Set DSCP Markings. + EOS + end + + newproperty(:set_dscp_class, :required_features => :iptables) do + desc <<-EOS + This sets the DSCP field according to a predefined DiffServ class. + EOS + # iptables uses the cisco DSCP classes as the basis for this flag. Values may be found here: + # 'http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-packet-marking/10103-dscpvalues.html' + valid_codes = [ + 'af11','af12','af13','af21','af22','af23','af31','af32','af33','af41', + 'af42','af43','cs1','cs2','cs3','cs4','cs5','cs6','cs7','ef' + ] + munge do |value| + unless valid_codes.include? value.downcase + raise ArgumentError, "#{value} is not a valid DSCP Class" + end + value.downcase + end + end + + newproperty(:set_mss, :required_features => :iptables) do + desc <<-EOS + Sets the TCP MSS value for packets. + EOS + end + + newproperty(:pkttype, :required_features => :pkttype) do + desc <<-EOS + Sets the packet type to match. + EOS + + newvalues(:unicast, :broadcast, :multicast) + end + + newproperty(:isfragment, :required_features => :isfragment) do + desc <<-EOS + Set to true to match tcp fragments (requires type to be set to tcp) + EOS + + newvalues(:true, :false) + end + + newproperty(:recent, :required_features => :recent_limiting) do + desc <<-EOS + Enable the recent module. Takes as an argument one of set, update, + rcheck or remove. For example: + + # If anyone's appeared on the 'badguy' blacklist within + # the last 60 seconds, drop their traffic, and update the timestamp. + firewall { '100 Drop badguy traffic': + recent => 'update', + rseconds => 60, + rsource => true, + rname => 'badguy', + action => 'DROP', + chain => 'FORWARD', + } + # No-one should be sending us traffic on eth0 from localhost + # Blacklist them + firewall { '101 blacklist strange traffic': + recent => 'set', + rsource => true, + rname => 'badguy', + destination => '127.0.0.0/8', + iniface => 'eth0', + action => 'DROP', + chain => 'FORWARD', + } + EOS + + newvalues(:set, :update, :rcheck, :remove) + munge do |value| + value = "--" + value + end + end + + newproperty(:rdest, :required_features => :recent_limiting) do + desc <<-EOS + Recent module; add the destination IP address to the list. + Must be boolean true. + EOS + + newvalues(:true, :false) + end + + newproperty(:rsource, :required_features => :recent_limiting) do + desc <<-EOS + Recent module; add the source IP address to the list. + Must be boolean true. + EOS + + newvalues(:true, :false) + end + + newproperty(:rname, :required_features => :recent_limiting) do + desc <<-EOS + Recent module; The name of the list. Takes a string argument. + EOS + end + + newproperty(:rseconds, :required_features => :recent_limiting) do + desc <<-EOS + Recent module; used in conjunction with one of `recent => 'rcheck'` or + `recent => 'update'`. When used, this will narrow the match to only + happen when the address is in the list and was seen within the last given + number of seconds. + EOS + end + + newproperty(:reap, :required_features => :recent_limiting) do + desc <<-EOS + Recent module; can only be used in conjunction with the `rseconds` + attribute. When used, this will cause entries older than 'seconds' to be + purged. Must be boolean true. + EOS + + newvalues(:true, :false) + end + + newproperty(:rhitcount, :required_features => :recent_limiting) do + desc <<-EOS + Recent module; used in conjunction with `recent => 'update'` or `recent + => 'rcheck'. When used, this will narrow the match to only happen when + the address is in the list and packets had been received greater than or + equal to the given value. + EOS + end + + newproperty(:rttl, :required_features => :recent_limiting) do + desc <<-EOS + Recent module; may only be used in conjunction with one of `recent => + 'rcheck'` or `recent => 'update'`. When used, this will narrow the match + to only happen when the address is in the list and the TTL of the current + packet matches that of the packet which hit the `recent => 'set'` rule. + This may be useful if you have problems with people faking their source + address in order to DoS you via this module by disallowing others access + to your site by sending bogus packets to you. Must be boolean true. + EOS + + newvalues(:true, :false) + end + + newproperty(:socket, :required_features => :socket) do + desc <<-EOS + If true, matches if an open socket can be found by doing a coket lookup + on the packet. + EOS + + newvalues(:true, :false) + end + + newproperty(:ishasmorefrags, :required_features => :ishasmorefrags) do + desc <<-EOS + If true, matches if the packet has it's 'more fragments' bit set. ipv6. + EOS + + newvalues(:true, :false) + end + + newproperty(:islastfrag, :required_features => :islastfrag) do + desc <<-EOS + If true, matches if the packet is the last fragment. ipv6. + EOS + + newvalues(:true, :false) + end + + newproperty(:isfirstfrag, :required_features => :isfirstfrag) do + desc <<-EOS + If true, matches if the packet is the first fragment. + Sadly cannot be negated. ipv6. + EOS + + newvalues(:true, :false) + end + + newproperty(:ipsec_policy, :required_features => :ipsec_policy) do + desc <<-EOS + Sets the ipsec policy type. May take a combination of arguments for any flags that can be passed to `--pol ipsec` such as: `--strict`, `--reqid 100`, `--next`, `--proto esp`, etc. + EOS + + newvalues(:none, :ipsec) + end + + newproperty(:ipsec_dir, :required_features => :ipsec_dir) do + desc <<-EOS + Sets the ipsec policy direction + EOS + + newvalues(:in, :out) + end + + newproperty(:stat_mode) do + desc <<-EOS + Set the matching mode for statistic matching. Supported modes are `random` and `nth`. + EOS + + newvalues(:nth, :random) + end + + newproperty(:stat_every) do + desc <<-EOS + Match one packet every nth packet. Requires `stat_mode => 'nth'` + EOS + + validate do |value| + unless value =~ /^\d+$/ + raise ArgumentError, <<-EOS + stat_every value must be a digit + EOS + end + + unless value.to_i > 0 + raise ArgumentError, <<-EOS + stat_every value must be larger than 0 + EOS + end + end + end + + newproperty(:stat_packet) do + desc <<-EOS + Set the initial counter value for the nth mode. Must be between 0 and the value of `stat_every`. Defaults to 0. Requires `stat_mode => 'nth'` + EOS + + newvalues(/^\d+$/) + end + + newproperty(:stat_probability) do + desc <<-EOS + Set the probability from 0 to 1 for a packet to be randomly matched. It works only with `stat_mode => 'random'`. + EOS + + validate do |value| + unless value =~ /^([01])\.(\d+)$/ + raise ArgumentError, <<-EOS + stat_probability must be between 0.0 and 1.0 + EOS + end + + if $1.to_i == 1 && $2.to_i != 0 + raise ArgumentError, <<-EOS + start_probability must be between 0.0 and 1.0 + EOS + end + end + end + + newproperty(:mask, :required_features => :mask) do + desc <<-EOS + Sets the mask to use when `recent` is enabled. + EOS + end + + newproperty(:gateway, :required_features => :iptables) do + desc <<-EOS + The TEE target will clone a packet and redirect this clone to another + machine on the local network segment. gateway is the target host's IP. + EOS + end + + newproperty(:ipset, :required_features => :ipset, :array_matching => :all) do + desc <<-EOS + Matches against the specified ipset list. + Requires ipset kernel module. Will accept a single element or an array. + The value is the name of the blacklist, followed by a space, and then + 'src' and/or 'dst' separated by a comma. + For example: 'blacklist src,dst' + EOS + + def is_to_s(value) + should_to_s(value) + end + + def should_to_s(value) + value = [value] unless value.is_a?(Array) + value.join(', ') + end + end + + newproperty(:checksum_fill, :required_features => :iptables) do + desc <<-EOS + Compute and fill missing packet checksums. + EOS + + newvalues(:true, :false) + end + + newparam(:line) do + desc <<-EOS + Read-only property for caching the rule line. + EOS + end + + newproperty(:mac_source) do + desc <<-EOS + MAC Source + EOS + newvalues(/^([0-9a-f]{2}[:]){5}([0-9a-f]{2})$/i) + end + + newproperty(:physdev_in, :required_features => :iptables) do + desc <<-EOS + Match if the packet is entering a bridge from the given interface. + EOS + newvalues(/^[a-zA-Z0-9\-\._\+]+$/) + end + + newproperty(:physdev_out, :required_features => :iptables) do + desc <<-EOS + Match if the packet is leaving a bridge via the given interface. + EOS + newvalues(/^[a-zA-Z0-9\-\._\+]+$/) + end + + newproperty(:physdev_is_bridged, :required_features => :iptables) do + desc <<-EOS + Match if the packet is transversing a bridge. + EOS + newvalues(:true, :false) + end + + newproperty(:date_start, :required_features => :iptables) do + desc <<-EOS + Only match during the given time, which must be in ISO 8601 "T" notation. + The possible time range is 1970-01-01T00:00:00 to 2038-01-19T04:17:07 + EOS + end + + newproperty(:date_stop, :required_features => :iptables) do + desc <<-EOS + Only match during the given time, which must be in ISO 8601 "T" notation. + The possible time range is 1970-01-01T00:00:00 to 2038-01-19T04:17:07 + EOS + end + + newproperty(:time_start, :required_features => :iptables) do + desc <<-EOS + Only match during the given daytime. The possible time range is 00:00:00 to 23:59:59. + Leading zeroes are allowed (e.g. "06:03") and correctly interpreted as base-10. + EOS + + munge do |value| + if value =~ /^([0-9]):/ + value = "0#{value}" + end + + if value =~ /^([0-9]|0[0-9]|1[0-9]|2[0-3]):[0-5][0-9]$/ + value = "#{value}:00" + end + + value + end + end + + newproperty(:time_stop, :required_features => :iptables) do + desc <<-EOS + Only match during the given daytime. The possible time range is 00:00:00 to 23:59:59. + Leading zeroes are allowed (e.g. "06:03") and correctly interpreted as base-10. + EOS + + munge do |value| + if value =~ /^([0-9]):/ + value = "0#{value}" + end + + if value =~ /^([0-9]|0[0-9]|1[0-9]|2[0-3]):[0-5][0-9]$/ + value = "#{value}:00" + end + + value + end + end + + newproperty(:month_days, :required_features => :iptables) do + desc <<-EOS + Only match on the given days of the month. Possible values are 1 to 31. + Note that specifying 31 will of course not match on months which do not have a 31st day; + the same goes for 28- or 29-day February. + EOS + + validate do |value| + month = value.to_i + if month >= 1 and month <=31 + value + else + raise ArgumentError, + "month_days must be in the range of 1-31" + end + end + end + + newproperty(:week_days, :required_features => :iptables) do + desc <<-EOS + Only match on the given weekdays. Possible values are Mon, Tue, Wed, Thu, Fri, Sat, Sun. + EOS + + newvalues(:Mon, :Tue, :Wed, :Thu, :Fri, :Sat, :Sun) + end + + newproperty(:time_contiguous, :required_features => :iptables) do + desc <<-EOS + When time_stop is smaller than time_start value, match this as a single time period instead distinct intervals. + EOS + + newvalues(:true, :false) + end + + newproperty(:kernel_timezone, :required_features => :iptables) do + desc <<-EOS + Use the kernel timezone instead of UTC to determine whether a packet meets the time regulations. + EOS + + newvalues(:true, :false) + end + + newproperty(:clusterip_new, :required_features => :clusterip) do + desc <<-EOS + Used with the CLUSTERIP jump target. + Create a new ClusterIP. You always have to set this on the first rule for a given ClusterIP. + EOS + + newvalues(:true, :false) + end + + newproperty(:clusterip_hashmode, :required_features => :clusterip) do + desc <<-EOS + Used with the CLUSTERIP jump target. + Specify the hashing mode. Valid values: sourceip, sourceip-sourceport, sourceip-sourceport-destport. + EOS + + newvalues(:sourceip, :'sourceip-sourceport', :'sourceip-sourceport-destport') + end + + newproperty(:clusterip_clustermac, :required_features => :clusterip) do + desc <<-EOS + Used with the CLUSTERIP jump target. + Specify the ClusterIP MAC address. Has to be a link-layer multicast address. + EOS + + newvalues(/^([0-9a-f]{2}[:]){5}([0-9a-f]{2})$/i) + end + + newproperty(:clusterip_total_nodes, :required_features => :clusterip) do + desc <<-EOS + Used with the CLUSTERIP jump target. + Number of total nodes within this cluster. + EOS + + newvalues(/\d+/) + end + + newproperty(:clusterip_local_node, :required_features => :clusterip) do + desc <<-EOS + Used with the CLUSTERIP jump target. + Specify the random seed used for hash initialization. + EOS + + newvalues(/\d+/) + end + + newproperty(:clusterip_hash_init, :required_features => :clusterip) do + desc <<-EOS + Used with the CLUSTERIP jump target. + Specify the random seed used for hash initialization. + EOS + end + + newproperty(:length, :required_features => :length) do + desc <<-EOS + Sets the length of layer-3 payload to match. + EOS + + munge do |value| + match = value.to_s.match("^([0-9]+)(-)?([0-9]+)?$") + if match.nil? + raise ArgumentError, "Length value must either be an integer or a range" + end + + low = match[1].to_i + if !match[3].nil? + high = match[3].to_i + end + + if (low < 0 or low > 65535) or \ + (!high.nil? and (high < 0 or high > 65535 or high < low)) + raise ArgumentError, "Length values must be between 0 and 65535" + end + + value = low.to_s + if !high.nil? + value << ":" << high.to_s + end + value + end + end + + newproperty(:string, :required_features => :string_matching) do + desc <<-EOS + String matching feature. Matches the packet against the pattern + given as an argument. + EOS + + munge do |value| + value = "'" + value + "'" + end + end + + newproperty(:string_algo, :required_features => :string_matching) do + desc <<-EOS + String matching feature, pattern matching strategy. + EOS + + newvalues(:bm, :kmp) + end + + newproperty(:string_from, :required_features => :string_matching) do + desc <<-EOS + String matching feature, offset from which we start looking for any matching. + EOS + end + + newproperty(:string_to, :required_features => :string_matching) do + desc <<-EOS + String matching feature, offset up to which we should scan. + EOS + end + + newproperty(:queue_num, :required_features => :queue_num) do + desc <<-EOS + Used with NFQUEUE jump target. + What queue number to send packets to + EOS + munge do |value| + match = value.to_s.match("^([0-9])*$") + if match.nil? + raise ArgumentError, "queue_num must be an integer" + end + + if match[1].to_i > 65535 || match[1].to_i < 0 + raise ArgumentError, "queue_num must be between 0 and 65535" + end + value + end + end + + newproperty(:queue_bypass, :required_features => :queue_bypass) do + desc <<-EOS + Used with NFQUEUE jump target + Allow packets to bypass :queue_num if userspace process is not listening + EOS + newvalues(:true, :false) + end + + + autorequire(:firewallchain) do + reqs = [] + protocol = nil + + case value(:provider) + when :iptables + protocol = "IPv4" + when :ip6tables + protocol = "IPv6" + end + + unless protocol.nil? + table = value(:table) + [value(:chain), value(:jump)].each do |chain| + reqs << "#{chain}:#{table}:#{protocol}" unless ( chain.nil? || (['INPUT', 'OUTPUT', 'FORWARD'].include?(chain) && table == :filter) ) + end + end + + reqs + end + + # Classes would be a better abstraction, pending: + # http://projects.puppetlabs.com/issues/19001 + autorequire(:package) do + case value(:provider) + when :iptables, :ip6tables + %w{iptables iptables-persistent iptables-services} + else + [] + end + end + + autorequire(:service) do + case value(:provider) + when :iptables, :ip6tables + %w{firewalld iptables ip6tables iptables-persistent netfilter-persistent} + else + [] + end + end + + # autobefore is only provided since puppet 4.0 + if Puppet.version.to_f >= 4.0 + # On RHEL 7 this needs to be threaded correctly to manage SE Linux permissions after persisting the rules + autobefore(:file) do + [ '/etc/sysconfig/iptables', '/etc/sysconfig/ip6tables' ] + end + end + + validate do + debug("[validate]") + + # TODO: this is put here to skip validation if ensure is not set. This + # is because there is a revalidation stage called later where the values + # are not set correctly. I tried tracing it - but have put in this + # workaround instead to skip. Must get to the bottom of this. + if ! value(:ensure) + return + end + + # First we make sure the chains and tables are valid combinations + if value(:table).to_s == "filter" && + value(:chain) =~ /PREROUTING|POSTROUTING/ + + self.fail "PREROUTING and POSTROUTING cannot be used in table 'filter'" + end + + if value(:table).to_s == "nat" && value(:chain) =~ /INPUT|FORWARD/ + self.fail "INPUT and FORWARD cannot be used in table 'nat'" + end + + if value(:table).to_s == "raw" && + value(:chain) =~ /INPUT|FORWARD|POSTROUTING/ + + self.fail "INPUT, FORWARD and POSTROUTING cannot be used in table raw" + end + + # Now we analyse the individual properties to make sure they apply to + # the correct combinations. + if value(:uid) + unless value(:chain).to_s =~ /OUTPUT|POSTROUTING/ + self.fail "Parameter uid only applies to chains " \ + "OUTPUT,POSTROUTING" + end + end + + if value(:gid) + unless value(:chain).to_s =~ /OUTPUT|POSTROUTING/ + self.fail "Parameter gid only applies to chains " \ + "OUTPUT,POSTROUTING" + end + end + + if value(:set_mark) + unless value(:jump).to_s =~ /MARK/ && + value(:table).to_s =~ /mangle/ + self.fail "Parameter set_mark only applies to " \ + "the mangle table and when jump => MARK" + end + end + + if value(:dport) + unless value(:proto).to_s =~ /tcp|udp|sctp/ + self.fail "[%s] Parameter dport only applies to sctp, tcp and udp " \ + "protocols. Current protocol is [%s] and dport is [%s]" % + [value(:name), should(:proto), should(:dport)] + end + end + + if value(:jump).to_s == "DSCP" + unless value(:set_dscp) || value(:set_dscp_class) + self.fail "When using jump => DSCP, the set_dscp or set_dscp_class property is required" + end + end + + if value(:jump).to_s == "TCPMSS" + unless value(:set_mss) || value(:clamp_mss_to_pmtu) + self.fail "When using jump => TCPMSS, the set_mss or clamp_mss_to_pmtu property is required" + end + end + + if value(:jump).to_s == "TEE" + unless value(:gateway) + self.fail "When using jump => TEE, the gateway property is required" + end + end + + if value(:jump).to_s == "DNAT" + unless value(:table).to_s =~ /nat/ + self.fail "Parameter jump => DNAT only applies to table => nat" + end + + unless value(:todest) + self.fail "Parameter jump => DNAT must have todest parameter" + end + end + + if value(:jump).to_s == "SNAT" + unless value(:table).to_s =~ /nat/ + self.fail "Parameter jump => SNAT only applies to table => nat" + end + + unless value(:tosource) + self.fail "Parameter jump => SNAT must have tosource parameter" + end + end + + if value(:jump).to_s == "MASQUERADE" + unless value(:table).to_s =~ /nat/ + self.fail "Parameter jump => MASQUERADE only applies to table => nat" + end + end + + if value(:log_prefix) || value(:log_level) || value(:log_uid) + unless value(:jump).to_s == "LOG" + self.fail "Parameter log_prefix, log_level and log_uid require jump => LOG" + end + end + + if value(:burst) && ! value(:limit) + self.fail "burst makes no sense without limit" + end + + if value(:action) && value(:jump) + self.fail "Only one of the parameters 'action' and 'jump' can be set" + end + + if value(:connlimit_mask) && ! value(:connlimit_above) + self.fail "Parameter 'connlimit_mask' requires 'connlimit_above'" + end + + if value(:mask) && ! value(:recent) + self.fail "Mask can only be set if recent is enabled." + end + + [:stat_packet, :stat_every, :stat_probability].each do |param| + if value(param) && ! value(:stat_mode) + self.fail "Parameter '#{param.to_s}' requires 'stat_mode' to be set" + end + end + + if value(:stat_packet) && value(:stat_mode) != :nth + self.fail "Parameter 'stat_packet' requires 'stat_mode' to be set to 'nth'" + end + + if value(:stat_every) && value(:stat_mode) != :nth + self.fail "Parameter 'stat_every' requires 'stat_mode' to be set to 'nth'" + end + + if value(:stat_probability) && value(:stat_mode) != :random + self.fail "Parameter 'stat_probability' requires 'stat_mode' to be set to 'random'" + end + + if value(:checksum_fill) + unless value(:jump).to_s == "CHECKSUM" && value(:table).to_s == "mangle" + self.fail "Parameter checksum_fill requires jump => CHECKSUM and table => mangle" + end + end + + if value(:queue_num) || value(:queue_bypass) + unless value(:jump).to_s == "NFQUEUE" + self.fail "Paramter queue_number and queue_bypass require jump => NFQUEUE" + end + end + + end +end diff --git a/environments/production/modules/firewall/lib/puppet/type/firewallchain.rb b/environments/production/modules/firewall/lib/puppet/type/firewallchain.rb new file mode 100644 index 0000000..46cf586 --- /dev/null +++ b/environments/production/modules/firewall/lib/puppet/type/firewallchain.rb @@ -0,0 +1,235 @@ +# This is a workaround for bug: #4248 whereby ruby files outside of the normal +# provider/type path do not load until pluginsync has occured on the puppetmaster +# +# In this case I'm trying the relative path first, then falling back to normal +# mechanisms. This should be fixed in future versions of puppet but it looks +# like we'll need to maintain this for some time perhaps. +$LOAD_PATH.unshift(File.join(File.dirname(__FILE__),"..","..")) +require 'puppet/util/firewall' + +Puppet::Type.newtype(:firewallchain) do + include Puppet::Util::Firewall + + @doc = <<-EOS + This type provides the capability to manage rule chains for firewalls. + + Currently this supports only iptables, ip6tables and ebtables on Linux. And + provides support for setting the default policy on chains and tables that + allow it. + + **Autorequires:** + If Puppet is managing the iptables, iptables-persistent, or iptables-services packages, + and the provider is iptables_chain, the firewall resource will autorequire + those packages to ensure that any required binaries are installed. + EOS + + feature :iptables_chain, "The provider provides iptables chain features." + feature :policy, "Default policy (inbuilt chains only)" + + ensurable do + defaultvalues + defaultto :present + end + + newparam(:name) do + desc <<-EOS + The canonical name of the chain. + + For iptables the format must be {chain}:{table}:{protocol}. + EOS + isnamevar + + validate do |value| + if value !~ Nameformat then + raise ArgumentError, "Inbuilt chains must be in the form {chain}:{table}:{protocol} where {table} is one of FILTER, NAT, MANGLE, RAW, RAWPOST, BROUTE, SECURITY or empty (alias for filter), chain can be anything without colons or one of PREROUTING, POSTROUTING, BROUTING, INPUT, FORWARD, OUTPUT for the inbuilt chains, and {protocol} being IPv4, IPv6, ethernet (ethernet bridging) got '#{value}' table:'#{$1}' chain:'#{$2}' protocol:'#{$3}'" + else + chain = $1 + table = $2 + protocol = $3 + case table + when 'filter' + if chain =~ /^(PREROUTING|POSTROUTING|BROUTING)$/ + raise ArgumentError, "INPUT, OUTPUT and FORWARD are the only inbuilt chains that can be used in table 'filter'" + end + when 'mangle' + if chain =~ InternalChains && chain == 'BROUTING' + raise ArgumentError, "PREROUTING, POSTROUTING, INPUT, FORWARD and OUTPUT are the only inbuilt chains that can be used in table 'mangle'" + end + when 'nat' + if chain =~ /^(BROUTING|FORWARD)$/ + raise ArgumentError, "PREROUTING, POSTROUTING, INPUT, and OUTPUT are the only inbuilt chains that can be used in table 'nat'" + end + if Gem::Version.new(Facter['kernelmajversion'].value.dup) < Gem::Version.new('3.7') and protocol =~/^(IP(v6)?)?$/ + raise ArgumentError, "table nat isn't valid in IPv6. You must specify ':IPv4' as the name suffix" + end + when 'raw' + if chain =~ /^(POSTROUTING|BROUTING|INPUT|FORWARD)$/ + raise ArgumentError,'PREROUTING and OUTPUT are the only inbuilt chains in the table \'raw\'' + end + when 'broute' + if protocol != 'ethernet' + raise ArgumentError,'BROUTE is only valid with protocol \'ethernet\'' + end + if chain =~ /^PREROUTING|POSTROUTING|INPUT|FORWARD|OUTPUT$/ + raise ArgumentError,'BROUTING is the only inbuilt chain allowed on on table \'broute\'' + end + when 'security' + if chain =~ /^(PREROUTING|POSTROUTING|BROUTING)$/ + raise ArgumentError, "INPUT, OUTPUT and FORWARD are the only inbuilt chains that can be used in table 'security'" + end + end + if chain == 'BROUTING' && ( protocol != 'ethernet' || table!='broute') + raise ArgumentError,'BROUTING is the only inbuilt chain allowed on on table \'BROUTE\' with protocol \'ethernet\' i.e. \'broute:BROUTING:enternet\'' + end + end + end + end + + newproperty(:policy) do + desc <<-EOS + This is the action to when the end of the chain is reached. + It can only be set on inbuilt chains (INPUT, FORWARD, OUTPUT, + PREROUTING, POSTROUTING) and can be one of: + + * accept - the packet is accepted + * drop - the packet is dropped + * queue - the packet is passed userspace + * return - the packet is returned to calling (jump) queue + or the default of inbuilt chains + EOS + newvalues(:accept, :drop, :queue, :return) + defaultto do + # ethernet chain have an ACCEPT default while other haven't got an + # allowed value + if @resource[:name] =~ /:ethernet$/ + :accept + else + nil + end + end + end + + newparam(:purge, :boolean => true) do + desc <<-EOS + Purge unmanaged firewall rules in this chain + EOS + newvalues(:false, :true) + defaultto :false + end + + newparam(:ignore) do + desc <<-EOS + Regex to perform on firewall rules to exempt unmanaged rules from purging (when enabled). + This is matched against the output of `iptables-save`. + + This can be a single regex, or an array of them. + To support flags, use the ruby inline flag mechanism. + Meaning a regex such as + /foo/i + can be written as + '(?i)foo' or '(?i:foo)' + + Full example: + firewallchain { 'INPUT:filter:IPv4': + purge => true, + ignore => [ + '-j fail2ban-ssh', # ignore the fail2ban jump rule + '--comment "[^"]*(?i:ignore)[^"]*"', # ignore any rules with "ignore" (case insensitive) in the comment in the rule + ], + } + EOS + + validate do |value| + unless value.is_a?(Array) or value.is_a?(String) or value == false + self.devfail "Ignore must be a string or an Array" + end + end + munge do |patterns| # convert into an array of {Regex}es + patterns = [patterns] if patterns.is_a?(String) + patterns.map{|p| Regexp.new(p)} + end + end + + # Classes would be a better abstraction, pending: + # http://projects.puppetlabs.com/issues/19001 + autorequire(:package) do + case value(:provider) + when :iptables_chain + %w{iptables iptables-persistent iptables-services} + else + [] + end + end + + autorequire(:service) do + case value(:provider) + when :iptables, :ip6tables + %w{firewalld iptables ip6tables iptables-persistent netfilter-persistent} + else + [] + end + end + + validate do + debug("[validate]") + + value(:name).match(Nameformat) + chain = $1 + table = $2 + protocol = $3 + + # Check that we're not removing an internal chain + if chain =~ InternalChains && value(:ensure) == :absent + self.fail "Cannot remove in-built chains" + end + + if value(:policy).nil? && protocol == 'ethernet' + self.fail "you must set a non-empty policy on all ethernet table chains" + end + + # Check that we're not setting a policy on a user chain + if chain !~ InternalChains && + !value(:policy).nil? && + protocol != 'ethernet' + + self.fail "policy can only be set on in-built chains (with the exception of ethernet chains) (table:#{table} chain:#{chain} protocol:#{protocol})" + end + + # no DROP policy on nat table + if table == 'nat' && + value(:policy) == :drop + + self.fail 'The "nat" table is not intended for filtering, the use of DROP is therefore inhibited' + end + end + + def generate + return [] unless self.purge? + + value(:name).match(Nameformat) + chain = $1 + table = $2 + protocol = $3 + + provider = case protocol + when 'IPv4' + :iptables + when 'IPv6' + :ip6tables + end + + # gather a list of all rules present on the system + rules_resources = Puppet::Type.type(:firewall).instances + + # Keep only rules in this chain + rules_resources.delete_if { |res| (res[:provider] != provider or res.provider.properties[:table].to_s != table or res.provider.properties[:chain] != chain) } + + # Remove rules which match our ignore filter + rules_resources.delete_if {|res| value(:ignore).find_index{|f| res.provider.properties[:line].match(f)}} if value(:ignore) + + # We mark all remaining rules for deletion, and then let the catalog override us on rules which should be present + rules_resources.each {|res| res[:ensure] = :absent} + + rules_resources + end +end diff --git a/environments/production/modules/firewall/lib/puppet/util/firewall.rb b/environments/production/modules/firewall/lib/puppet/util/firewall.rb new file mode 100644 index 0000000..cdffaaf --- /dev/null +++ b/environments/production/modules/firewall/lib/puppet/util/firewall.rb @@ -0,0 +1,232 @@ +require 'socket' +require 'resolv' +require 'puppet/util/ipcidr' + +# Util module for puppetlabs-firewall +module Puppet::Util::Firewall + # Translate the symbolic names for icmp packet types to integers + def icmp_name_to_number(value_icmp, protocol) + if value_icmp =~ /\d{1,2}$/ + value_icmp + elsif protocol == 'inet' + case value_icmp + when "echo-reply" then "0" + when "destination-unreachable" then "3" + when "source-quench" then "4" + when "redirect" then "6" + when "echo-request" then "8" + when "router-advertisement" then "9" + when "router-solicitation" then "10" + when "time-exceeded" then "11" + when "parameter-problem" then "12" + when "timestamp-request" then "13" + when "timestamp-reply" then "14" + when "address-mask-request" then "17" + when "address-mask-reply" then "18" + else nil + end + elsif protocol == 'inet6' + case value_icmp + when "destination-unreachable" then "1" + when "too-big" then "2" + when "time-exceeded" then "3" + when "parameter-problem" then "4" + when "echo-request" then "128" + when "echo-reply" then "129" + when "router-solicitation" then "133" + when "router-advertisement" then "134" + when "neighbour-solicitation" then "135" + when "neighbour-advertisement" then "136" + when "redirect" then "137" + else nil + end + else + raise ArgumentError, "unsupported protocol family '#{protocol}'" + end + end + + # Convert log_level names to their respective numbers + def log_level_name_to_number(value) + #TODO make this 0-7 only + if value =~ /\d/ + value + else + case value + when "panic" then "0" + when "alert" then "1" + when "crit" then "2" + when "err" then "3" + when "error" then "3" + when "warn" then "4" + when "warning" then "4" + when "not" then "5" + when "notice" then "5" + when "info" then "6" + when "debug" then "7" + else nil + end + end + end + + # This method takes a string and a protocol and attempts to convert + # it to a port number if valid. + # + # If the string already contains a port number or perhaps a range of ports + # in the format 22:1000 for example, it simply returns the string and does + # nothing. + def string_to_port(value, proto) + proto = proto.to_s + unless proto =~ /^(tcp|udp)$/ + proto = 'tcp' + end + + m = value.to_s.match(/^(!\s+)?(\S+)/) + if m[2].match(/^\d+(-\d+)?$/) + return "#{m[1]}#{m[2]}" + else + return "#{m[1]}#{Socket.getservbyname(m[2], proto).to_s}" + end + end + + # Takes an address and returns it in CIDR notation. + # + # If the address is: + # + # - A hostname: + # It will be resolved + # - An IPv4 address: + # It will be qualified with a /32 CIDR notation + # - An IPv6 address: + # It will be qualified with a /128 CIDR notation + # - An IP address with a CIDR notation: + # It will be normalised + # - An IP address with a dotted-quad netmask: + # It will be converted to CIDR notation + # - Any address with a resulting prefix length of zero: + # It will return nil which is equivilent to not specifying an address + # + def host_to_ip(value) + begin + value = Puppet::Util::IPCidr.new(value) + rescue + value = Puppet::Util::IPCidr.new(Resolv.getaddress(value)) + end + + return nil if value.prefixlen == 0 + value.cidr + end + + # Takes an address mask and converts the host portion to CIDR notation. + # + # This takes into account you can negate a mask but follows all rules + # defined in host_to_ip for the host/address part. + # + def host_to_mask(value) + match = value.match /(!)\s?(.*)$/ + return host_to_ip(value) unless match + + cidr = host_to_ip(match[2]) + return nil if cidr == nil + "#{match[1]} #{cidr}" + end + + # Validates the argument is int or hex, and returns valid hex + # conversion of the value or nil otherwise. + def to_hex32(value) + begin + value = Integer(value) + if value.between?(0, 0xffffffff) + return '0x' + value.to_s(16) + end + rescue ArgumentError + # pass + end + return nil + end + + def persist_iptables(proto) + debug("[persist_iptables]") + + # Basic normalisation for older Facter + os_key = Facter.value(:osfamily) + os_key ||= case Facter.value(:operatingsystem) + when 'RedHat', 'CentOS', 'Fedora', 'Scientific', 'SL', 'SLC', 'Ascendos', 'CloudLinux', 'PSBM', 'OracleLinux', 'OVS', 'OEL', 'Amazon', 'XenServer', 'VirtuozzoLinux' + 'RedHat' + when 'Debian', 'Ubuntu' + 'Debian' + else + Facter.value(:operatingsystem) + end + + # Older iptables-persistent doesn't provide save action. + if os_key == 'Debian' + # We need to call flush to clear Facter cache as it's possible the cached value will be nil due to the fact + # that the iptables-persistent package was potentially installed after the initial Fact gathering. + Facter.fact(:iptables_persistent_version).flush + persist_ver = Facter.value(:iptables_persistent_version) + if (persist_ver and Puppet::Util::Package.versioncmp(persist_ver, '0.5.0') < 0) + os_key = 'Debian_manual' + end + end + + # Fedora 15 and newer use systemd to persist iptable rules + if os_key == 'RedHat' && Facter.value(:operatingsystem) == 'Fedora' && Facter.value(:operatingsystemrelease).to_i >= 15 + os_key = 'Fedora' + end + + # RHEL 7 and newer also use systemd to persist iptable rules + if os_key == 'RedHat' && ['RedHat','CentOS','Scientific','SL','SLC','Ascendos','CloudLinux','PSBM','OracleLinux','OVS','OEL','XenServer','VirtuozzoLinux'].include?(Facter.value(:operatingsystem)) && Facter.value(:operatingsystemrelease).to_i >= 7 + os_key = 'Fedora' + end + + cmd = case os_key.to_sym + when :RedHat + case proto.to_sym + when :IPv4 + %w{/sbin/service iptables save} + when :IPv6 + %w{/sbin/service ip6tables save} + end + when :Fedora + case proto.to_sym + when :IPv4 + %w{/usr/libexec/iptables/iptables.init save} + when :IPv6 + %w{/usr/libexec/iptables/ip6tables.init save} + end + when :Debian + case proto.to_sym + when :IPv4, :IPv6 + if (persist_ver and Puppet::Util::Package.versioncmp(persist_ver, '1.0') > 0) + %w{/usr/sbin/service netfilter-persistent save} + else + %w{/usr/sbin/service iptables-persistent save} + end + end + when :Debian_manual + case proto.to_sym + when :IPv4 + ["/bin/sh", "-c", "/sbin/iptables-save > /etc/iptables/rules"] + end + when :Archlinux + case proto.to_sym + when :IPv4 + ["/bin/sh", "-c", "/usr/sbin/iptables-save > /etc/iptables/iptables.rules"] + when :IPv6 + ["/bin/sh", "-c", "/usr/sbin/ip6tables-save > /etc/iptables/ip6tables.rules"] + end + end + + # Catch unsupported OSs from the case statement above. + if cmd.nil? + debug('firewall: Rule persistence is not supported for this type/OS') + return + end + + begin + execute(cmd) + rescue Puppet::ExecutionFailure => detail + warning("Unable to persist firewall rules: #{detail}") + end + end +end diff --git a/environments/production/modules/firewall/lib/puppet/util/ipcidr.rb b/environments/production/modules/firewall/lib/puppet/util/ipcidr.rb new file mode 100644 index 0000000..87e8d5e --- /dev/null +++ b/environments/production/modules/firewall/lib/puppet/util/ipcidr.rb @@ -0,0 +1,42 @@ +require 'ipaddr' + +# IPCidr object wrapper for IPAddr +module Puppet + module Util + class IPCidr < IPAddr + def initialize(ipaddr) + begin + super(ipaddr) + rescue ArgumentError => e + if e.message =~ /invalid address/ + raise ArgumentError, "Invalid address from IPAddr.new: #{ipaddr}" + else + raise e + end + end + end + + def netmask + _to_string(@mask_addr) + end + + def prefixlen + m = case @family + when Socket::AF_INET + IN4MASK + when Socket::AF_INET6 + IN6MASK + else + raise "unsupported address family" + end + return $1.length if /\A(1*)(0*)\z/ =~ (@mask_addr & m).to_s(2) + raise "bad addr_mask format" + end + + def cidr + cidr = sprintf("%s/%s", self.to_s, self.prefixlen) + cidr + end + end + end +end diff --git a/environments/production/modules/firewall/manifests/init.pp b/environments/production/modules/firewall/manifests/init.pp new file mode 100644 index 0000000..53697b5 --- /dev/null +++ b/environments/production/modules/firewall/manifests/init.pp @@ -0,0 +1,47 @@ +# = Class: firewall +# +# Manages packages and services required by the firewall type/provider. +# +# This class includes the appropriate sub-class for your operating system, +# where supported. +# +# == Parameters: +# +# [*ensure*] +# Ensure parameter passed onto Service[] resources. +# Default: running +# +class firewall ( + $ensure = running, + $pkg_ensure = present, + $service_name = $::firewall::params::service_name, + $service_name_v6 = $::firewall::params::service_name_v6, + $package_name = $::firewall::params::package_name, +) inherits ::firewall::params { + case $ensure { + /^(running|stopped)$/: { + # Do nothing. + } + default: { + fail("${title}: Ensure value '${ensure}' is not supported") + } + } + + case $::kernel { + 'Linux': { + class { "${title}::linux": + ensure => $ensure, + pkg_ensure => $pkg_ensure, + service_name => $service_name, + service_name_v6 => $service_name_v6, + package_name => $package_name, + } + contain "${title}::linux" + } + 'FreeBSD': { + } + default: { + fail("${title}: Kernel '${::kernel}' is not currently supported") + } + } +} diff --git a/environments/production/modules/firewall/manifests/linux.pp b/environments/production/modules/firewall/manifests/linux.pp new file mode 100644 index 0000000..0fd758a --- /dev/null +++ b/environments/production/modules/firewall/manifests/linux.pp @@ -0,0 +1,72 @@ +# = Class: firewall::linux +# +# Installs the `iptables` package for Linux operating systems and includes +# the appropriate sub-class for any distribution specific services and +# additional packages. +# +# == Parameters: +# +# [*ensure*] +# Ensure parameter passed onto Service[] resources. When `running` the +# service will be started on boot, and when `stopped` it will not. +# Default: running +# +class firewall::linux ( + $ensure = running, + $pkg_ensure = present, + $service_name = $::firewall::params::service_name, + $service_name_v6 = $::firewall::params::service_name_v6, + $package_name = $::firewall::params::package_name, +) inherits ::firewall::params { + $enable = $ensure ? { + running => true, + stopped => false, + } + + package { 'iptables': + ensure => $pkg_ensure, + } + + case $::operatingsystem { + 'RedHat', 'CentOS', 'Fedora', 'Scientific', 'SL', 'SLC', 'Ascendos', + 'CloudLinux', 'PSBM', 'OracleLinux', 'OVS', 'OEL', 'Amazon', 'XenServer', + 'VirtuozzoLinux': { + class { "${title}::redhat": + ensure => $ensure, + enable => $enable, + package_name => $package_name, + service_name => $service_name, + service_name_v6 => $service_name_v6, + require => Package['iptables'], + } + } + 'Debian', 'Ubuntu': { + class { "${title}::debian": + ensure => $ensure, + enable => $enable, + package_name => $package_name, + service_name => $service_name, + require => Package['iptables'], + } + } + 'Archlinux': { + class { "${title}::archlinux": + ensure => $ensure, + enable => $enable, + package_name => $package_name, + service_name => $service_name, + require => Package['iptables'], + } + } + 'Gentoo': { + class { "${title}::gentoo": + ensure => $ensure, + enable => $enable, + package_name => $package_name, + service_name => $service_name, + require => Package['iptables'], + } + } + default: {} + } +} diff --git a/environments/production/modules/firewall/manifests/linux/archlinux.pp b/environments/production/modules/firewall/manifests/linux/archlinux.pp new file mode 100644 index 0000000..bdd803b --- /dev/null +++ b/environments/production/modules/firewall/manifests/linux/archlinux.pp @@ -0,0 +1,44 @@ +# = Class: firewall::linux::archlinux +# +# Manages `iptables` and `ip6tables` services, and creates files used for +# persistence, on Arch Linux systems. +# +# == Parameters: +# +# [*ensure*] +# Ensure parameter passed onto Service[] resources. +# Default: running +# +# [*enable*] +# Enable parameter passed onto Service[] resources. +# Default: true +# +class firewall::linux::archlinux ( + $ensure = 'running', + $enable = true, + $service_name = $::firewall::params::service_name, + $package_name = $::firewall::params::package_name, + $package_ensure = $::firewall::params::package_ensure, +) inherits ::firewall::params { + if $package_name { + package { $package_name: + ensure => $package_ensure, + } + } + + service { $service_name: + ensure => $ensure, + enable => $enable, + hasstatus => true, + } + + file { '/etc/iptables/iptables.rules': + ensure => present, + before => Service[$service_name], + } + + file { '/etc/iptables/ip6tables.rules': + ensure => present, + before => Service[$service_name], + } +} diff --git a/environments/production/modules/firewall/manifests/linux/debian.pp b/environments/production/modules/firewall/manifests/linux/debian.pp new file mode 100644 index 0000000..a857177 --- /dev/null +++ b/environments/production/modules/firewall/manifests/linux/debian.pp @@ -0,0 +1,56 @@ +# = Class: firewall::linux::debian +# +# Installs the `iptables-persistent` package for Debian-alike systems. This +# allows rules to be stored to file and restored on boot. +# +# == Parameters: +# +# [*ensure*] +# Ensure parameter passed onto Service[] resources. +# Default: running +# +# [*enable*] +# Enable parameter passed onto Service[] resources. +# Default: true +# +class firewall::linux::debian ( + $ensure = running, + $enable = true, + $service_name = $::firewall::params::service_name, + $package_name = $::firewall::params::package_name, + $package_ensure = $::firewall::params::package_ensure, +) inherits ::firewall::params { + + if $package_name { + #Fixes hang while installing iptables-persistent on debian 8 + exec {'iptables-persistent-debconf': + command => "/bin/echo \"${package_name} ${package_name}/autosave_v4 boolean false\" | /usr/bin/debconf-set-selections && /bin/echo \"${package_name} ${package_name}/autosave_v6 boolean false\" | /usr/bin/debconf-set-selections", + refreshonly => true + } + package { $package_name: + ensure => $package_ensure, + require => Exec['iptables-persistent-debconf'] + } + } + + if($::operatingsystemrelease =~ /^6\./ and $enable == true and $::iptables_persistent_version + and versioncmp($::iptables_persistent_version, '0.5.0') < 0) { + # This fixes a bug in the iptables-persistent LSB headers in 6.x, without it + # we lose idempotency + exec { 'iptables-persistent-enable': + logoutput => on_failure, + command => '/usr/sbin/update-rc.d iptables-persistent enable', + unless => '/usr/bin/test -f /etc/rcS.d/S*iptables-persistent', + require => Package[$package_name], + } + } else { + # This isn't a real service/daemon. The start action loads rules, so just + # needs to be called on system boot. + service { $service_name: + ensure => undef, + enable => $enable, + hasstatus => true, + require => Package[$package_name], + } + } +} diff --git a/environments/production/modules/firewall/manifests/linux/gentoo.pp b/environments/production/modules/firewall/manifests/linux/gentoo.pp new file mode 100644 index 0000000..920e60c --- /dev/null +++ b/environments/production/modules/firewall/manifests/linux/gentoo.pp @@ -0,0 +1,44 @@ +# = Class: firewall::linux::gentoo +# +# Manages `iptables` and `ip6tables` services, and creates files used for +# persistence, on Gentoo Linux systems. +# +# == Parameters: +# +# [*ensure*] +# Ensure parameter passed onto Service[] resources. +# Default: running +# +# [*enable*] +# Enable parameter passed onto Service[] resources. +# Default: true +# +class firewall::linux::gentoo ( + $ensure = 'running', + $enable = true, + $service_name = $::firewall::params::service_name, + $package_name = $::firewall::params::package_name, + $package_ensure = $::firewall::params::package_ensure, +) inherits ::firewall::params { + if $package_name { + package { $package_name: + ensure => $package_ensure, + } + } + + service { $service_name: + ensure => $ensure, + enable => $enable, + hasstatus => true, + } + + file { '/var/lib/iptables/rules-save': + ensure => present, + before => Service[$service_name], + } + + file { '/var/lib/iptables/rules-save6': + ensure => present, + before => Service[$service_name], + } +} diff --git a/environments/production/modules/firewall/manifests/linux/redhat.pp b/environments/production/modules/firewall/manifests/linux/redhat.pp new file mode 100644 index 0000000..7f733a8 --- /dev/null +++ b/environments/production/modules/firewall/manifests/linux/redhat.pp @@ -0,0 +1,118 @@ +# = Class: firewall::linux::redhat +# +# Manages the `iptables` service on RedHat-alike systems. +# +# == Parameters: +# +# [*ensure*] +# Ensure parameter passed onto Service[] resources. +# Default: running +# +# [*enable*] +# Enable parameter passed onto Service[] resources. +# Default: true +# +class firewall::linux::redhat ( + $ensure = running, + $enable = true, + $service_name = $::firewall::params::service_name, + $service_name_v6 = $::firewall::params::service_name_v6, + $package_name = $::firewall::params::package_name, + $package_ensure = $::firewall::params::package_ensure, +) inherits ::firewall::params { + + # RHEL 7 / CentOS 7 and later and Fedora 15 and later require the iptables-services + # package, which provides the /usr/libexec/iptables/iptables.init used by + # lib/puppet/util/firewall.rb. + if ($::operatingsystem != 'Amazon') + and (($::operatingsystem != 'Fedora' and versioncmp($::operatingsystemrelease, '7.0') >= 0) + or ($::operatingsystem == 'Fedora' and versioncmp($::operatingsystemrelease, '15') >= 0)) { + service { 'firewalld': + ensure => stopped, + enable => false, + before => Package[$package_name], + } + } + + if $package_name { + package { $package_name: + ensure => $package_ensure, + before => Service[$service_name], + } + } + + if ($::operatingsystem != 'Amazon') + and (($::operatingsystem != 'Fedora' and versioncmp($::operatingsystemrelease, '7.0') >= 0) + or ($::operatingsystem == 'Fedora' and versioncmp($::operatingsystemrelease, '15') >= 0)) { + if $ensure == 'running' { + exec { '/usr/bin/systemctl daemon-reload': + require => Package[$package_name], + before => Service[$service_name, $service_name_v6], + unless => "/usr/bin/systemctl is-active ${service_name} ${service_name_v6}", + } + } + } + + service { $service_name: + ensure => $ensure, + enable => $enable, + hasstatus => true, + } + service { $service_name_v6: + ensure => $ensure, + enable => $enable, + hasstatus => true, + } + + file { "/etc/sysconfig/${service_name}": + ensure => present, + owner => 'root', + group => 'root', + mode => '0600', + } + file { "/etc/sysconfig/${service_name_v6}": + ensure => present, + owner => 'root', + group => 'root', + mode => '0600', + } + + # Before puppet 4, the autobefore on the firewall type does not work - therefore + # we need to keep this workaround here + if versioncmp($::puppetversion, '4.0') <= 0 { + File["/etc/sysconfig/${service_name}"] -> Service[$service_name] + File["/etc/sysconfig/${service_name_v6}"] -> Service[$service_name_v6] + } + + # Redhat 7 selinux user context for /etc/sysconfig/iptables is set to unconfined_u + # Redhat 7 selinux type context for /etc/sysconfig/iptables is set to etc_t + case $::selinux { + #lint:ignore:quoted_booleans + 'true',true: { + case $::operatingsystemrelease { + /^7\..*/: { + case $::operatingsystem { + 'CentOS': { + File["/etc/sysconfig/${service_name}"] { seluser => 'unconfined_u', seltype => 'system_conf_t' } + File["/etc/sysconfig/${service_name_v6}"] { seluser => 'unconfined_u', seltype => 'system_conf_t' } + } + default : { + File["/etc/sysconfig/${service_name}"] { seluser => 'unconfined_u', seltype => 'etc_t' } + File["/etc/sysconfig/${service_name_v6}"] { seluser => 'unconfined_u', seltype => 'etc_t' } + } + } + } + /^6\..*/: { + File["/etc/sysconfig/${service_name}"] { seluser => 'unconfined_u', seltype => 'system_conf_t' } + File["/etc/sysconfig/${service_name_v6}"] { seluser => 'unconfined_u', seltype => 'system_conf_t' } + } + default: { + File["/etc/sysconfig/${service_name}"] { seluser => 'system_u', seltype => 'system_conf_t' } + File["/etc/sysconfig/${service_name_v6}"] { seluser => 'unconfined_u', seltype => 'system_conf_t' } + } + } + } + default: {} + #lint:endignore + } +} diff --git a/environments/production/modules/firewall/manifests/params.pp b/environments/production/modules/firewall/manifests/params.pp new file mode 100644 index 0000000..fe9955d --- /dev/null +++ b/environments/production/modules/firewall/manifests/params.pp @@ -0,0 +1,75 @@ +class firewall::params { + $package_ensure = 'present' + case $::osfamily { + 'RedHat': { + $service_name = 'iptables' + $service_name_v6 = 'ip6tables' + case $::operatingsystem { + 'Amazon': { + $package_name = undef + } + 'Fedora': { + if versioncmp($::operatingsystemrelease, '15') >= 0 { + $package_name = 'iptables-services' + } else { + $package_name = undef + } + } + default: { + if versioncmp($::operatingsystemrelease, '7.0') >= 0 { + $package_name = 'iptables-services' + } else { + $package_name = 'iptables-ipv6' + } + } + } + } + 'Debian': { + $service_name_v6 = undef + case $::operatingsystem { + 'Debian': { + if versioncmp($::operatingsystemrelease, '8.0') >= 0 { + $service_name = 'netfilter-persistent' + $package_name = 'iptables-persistent' + } else { + $service_name = 'iptables-persistent' + $package_name = 'iptables-persistent' + } + + } + 'Ubuntu': { + if versioncmp($::operatingsystemrelease, '14.10') >= 0 { + $service_name = 'netfilter-persistent' + $package_name = 'iptables-persistent' + } else { + $service_name = 'iptables-persistent' + $package_name = 'iptables-persistent' + } + + } + default: { + $service_name = 'iptables-persistent' + $package_name = 'iptables-persistent' + } + } + } + 'Gentoo': { + $service_name = ['iptables','ip6tables'] + $service_name_v6 = undef + $package_name = 'net-firewall/iptables' + } + default: { + $service_name_v6 = undef + case $::operatingsystem { + 'Archlinux': { + $service_name = ['iptables','ip6tables'] + $package_name = undef + } + default: { + $service_name = 'iptables' + $package_name = undef + } + } + } + } +} diff --git a/environments/production/modules/firewall/metadata.json b/environments/production/modules/firewall/metadata.json new file mode 100644 index 0000000..010a972 --- /dev/null +++ b/environments/production/modules/firewall/metadata.json @@ -0,0 +1,83 @@ +{ + "name": "puppetlabs-firewall", + "version": "1.8.2", + "author": "Puppet Labs", + "summary": "Manages Firewalls such as iptables", + "license": "Apache-2.0", + "source": "https://github.com/puppetlabs/puppetlabs-firewall", + "project_page": "http://github.com/puppetlabs/puppetlabs-firewall", + "issues_url": "https://tickets.puppetlabs.com/browse/MODULES", + "dependencies": [ + + ], + "data_provider": null, + "operatingsystem_support": [ + { + "operatingsystem": "RedHat", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "CentOS", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "OracleLinux", + "operatingsystemrelease": [ + "6", + "7" + ] + }, + { + "operatingsystem": "Scientific", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "SLES", + "operatingsystemrelease": [ + "11 SP1", + "12" + ] + }, + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "6", + "7", + "8" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "10.04", + "12.04", + "14.04", + "16.04" + ] + }, + { + "operatingsystem": "Gentoo", + "operatingsystemrelease": [ + "1.0" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">= 3.5.0 < 5.0.0" + } + ] +} diff --git a/environments/production/modules/firewall/spec/acceptance/change_source_spec.rb b/environments/production/modules/firewall/spec/acceptance/change_source_spec.rb new file mode 100644 index 0000000..3a5dbeb --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/change_source_spec.rb @@ -0,0 +1,76 @@ +require 'spec_helper_acceptance' + +describe 'changing the source' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + describe 'when unmanaged rules exist' do + it 'applies with 8.0.0.1 first' do + pp = <<-EOS + class { '::firewall': } + firewall { '101 test source changes': + proto => tcp, + port => '101', + action => accept, + source => '8.0.0.1', + } + firewall { '100 test source static': + proto => tcp, + port => '100', + action => accept, + source => '8.0.0.2', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'adds a unmanaged rule without a comment' do + shell('iptables -A INPUT -t filter -s 8.0.0.3/32 -p tcp -m multiport --ports 102 -j ACCEPT') + expect(shell('iptables-save').stdout).to match(/-A INPUT -s 8\.0\.0\.3(\/32)? -p tcp -m multiport --ports 102 -j ACCEPT/) + end + + it 'contains the changable 8.0.0.1 rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -s 8\.0\.0\.1(\/32)? -p tcp -m multiport --ports 101 -m comment --comment "101 test source changes" -j ACCEPT/) + end + end + it 'contains the static 8.0.0.2 rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -s 8\.0\.0\.2(\/32)? -p tcp -m multiport --ports 100 -m comment --comment "100 test source static" -j ACCEPT/) + end + end + + it 'changes to 8.0.0.4 second' do + pp = <<-EOS + class { '::firewall': } + firewall { '101 test source changes': + proto => tcp, + port => '101', + action => accept, + source => '8.0.0.4', + } + EOS + + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/Notice: \/Stage\[main\]\/Main\/Firewall\[101 test source changes\]\/source: source changed '8\.0\.0\.1\/32' to '8\.0\.0\.4\/32'/) + end + + it 'does not contain the old changing 8.0.0.1 rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/8\.0\.0\.1/) + end + end + it 'contains the staic 8.0.0.2 rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -s 8\.0\.0\.2(\/32)? -p tcp -m multiport --ports 100 -m comment --comment "100 test source static" -j ACCEPT/) + end + end + it 'contains the changing new 8.0.0.4 rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -s 8\.0\.0\.4(\/32)? -p tcp -m multiport --ports 101 -m comment --comment "101 test source changes" -j ACCEPT/) + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/class_spec.rb b/environments/production/modules/firewall/spec/acceptance/class_spec.rb new file mode 100644 index 0000000..1a516ab --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/class_spec.rb @@ -0,0 +1,33 @@ +require 'spec_helper_acceptance' + +describe "firewall class" do + it 'should run successfully' do + pp = "class { 'firewall': }" + + # Run it twice and test for idempotency + apply_manifest(pp, :catch_failures => true) + if do_catch_changes + expect(apply_manifest(pp, :catch_failures => true).exit_code).to be_zero + end + end + + it 'ensure => stopped:' do + pp = "class { 'firewall': ensure => stopped }" + + # Run it twice and test for idempotency + apply_manifest(pp, :catch_failures => true) + if do_catch_changes + expect(apply_manifest(pp, :catch_failures => true).exit_code).to be_zero + end + end + + it 'ensure => running:' do + pp = "class { 'firewall': ensure => running }" + + # Run it twice and test for idempotency + apply_manifest(pp, :catch_failures => true) + if do_catch_changes + expect(apply_manifest(pp, :catch_failures => true).exit_code).to be_zero + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/connlimit_spec.rb b/environments/production/modules/firewall/spec/acceptance/connlimit_spec.rb new file mode 100644 index 0000000..9ec4615 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/connlimit_spec.rb @@ -0,0 +1,63 @@ +require 'spec_helper_acceptance' + +describe 'connlimit property' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + if default['platform'] !~ /sles-10/ + describe 'connlimit_above' do + context '10' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '500 - test': + proto => tcp, + dport => '2222', + connlimit_above => '10', + action => reject, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + #connlimit-saddr is added in Ubuntu 14.04. + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --dports 2222 -m comment --comment "500 - test" -m connlimit --connlimit-above 10 --connlimit-mask 32 (--connlimit-saddr )?-j REJECT --reject-with icmp-port-unreachable/) + end + end + end + end + + describe 'connlimit_mask' do + context '24' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '501 - test': + proto => tcp, + dport => '2222', + connlimit_above => '10', + connlimit_mask => '24', + action => reject, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + #connlimit-saddr is added in Ubuntu 14.04. + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --dports 2222 -m comment --comment "501 - test" -m connlimit --connlimit-above 10 --connlimit-mask 24 (--connlimit-saddr )?-j REJECT --reject-with icmp-port-unreachable/) + end + end + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/connmark_spec.rb b/environments/production/modules/firewall/spec/acceptance/connmark_spec.rb new file mode 100644 index 0000000..ab3b764 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/connmark_spec.rb @@ -0,0 +1,27 @@ +require 'spec_helper_acceptance' + +describe 'connmark property' do + + describe 'connmark' do + context '50' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '502 - test': + proto => 'all', + connmark => '0x1', + action => reject, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -m comment --comment "502 - test" -m connmark --mark 0x1 -j REJECT --reject-with icmp-port-unreachable/) + end + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/firewall_bridging_spec.rb b/environments/production/modules/firewall/spec/acceptance/firewall_bridging_spec.rb new file mode 100644 index 0000000..568d64c --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/firewall_bridging_spec.rb @@ -0,0 +1,369 @@ + require 'spec_helper_acceptance' + +describe 'firewall bridging' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + describe 'iptables physdev tests' do + context 'physdev_in eth0' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '701 - test': + chain => 'FORWARD', + proto => tcp, + port => '701', + action => accept, + physdev_in => 'eth0', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-in eth0 -m multiport --ports 701 -m comment --comment "701 - test" -j ACCEPT/) + end + end + end + + context 'physdev_out eth1' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '702 - test': + chain => 'FORWARD', + proto => tcp, + port => '702', + action => accept, + physdev_out => 'eth1', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-out eth1 -m multiport --ports 702 -m comment --comment "702 - test" -j ACCEPT/) + end + end + end + + context 'physdev_in eth0 and physdev_out eth1' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '703 - test': + chain => 'FORWARD', + proto => tcp, + port => '703', + action => accept, + physdev_in => 'eth0', + physdev_out => 'eth1', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-in eth0 --physdev-out eth1 -m multiport --ports 703 -m comment --comment "703 - test" -j ACCEPT/) + end + end + end + + context 'physdev_is_bridged' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '704 - test': + chain => 'FORWARD', + proto => tcp, + port => '704', + action => accept, + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-is-bridged -m multiport --ports 704 -m comment --comment "704 - test" -j ACCEPT/) + end + end + end + + context 'physdev_in eth0 and physdev_is_bridged' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '705 - test': + chain => 'FORWARD', + proto => tcp, + port => '705', + action => accept, + physdev_in => 'eth0', + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-in eth0 --physdev-is-bridged -m multiport --ports 705 -m comment --comment "705 - test" -j ACCEPT/) + end + end + end + + context 'physdev_out eth1 and physdev_is_bridged' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '706 - test': + chain => 'FORWARD', + proto => tcp, + port => '706', + action => accept, + physdev_out => 'eth1', + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-out eth1 --physdev-is-bridged -m multiport --ports 706 -m comment --comment "706 - test" -j ACCEPT/) + end + end + end + + context 'physdev_in eth0 and physdev_out eth1 and physdev_is_bridged' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '707 - test': + chain => 'FORWARD', + proto => tcp, + port => '707', + action => accept, + physdev_in => 'eth0', + physdev_out => 'eth1', + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-in eth0 --physdev-out eth1 --physdev-is-bridged -m multiport --ports 707 -m comment --comment "707 - test" -j ACCEPT/) + end + end + end + + end + + #iptables version 1.3.5 is not suppored by the ip6tables provider + if default['platform'] !~ /el-5/ and default['platform'] !~ /sles-10/ + describe 'ip6tables physdev tests' do + context 'physdev_in eth0' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '701 - test': + provider => 'ip6tables', + chain => 'FORWARD', + proto => tcp, + port => '701', + action => accept, + physdev_in => 'eth0', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-in eth0 -m multiport --ports 701 -m comment --comment "701 - test" -j ACCEPT/) + end + end + end + + context 'physdev_out eth1' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '702 - test': + provider => 'ip6tables', + chain => 'FORWARD', + proto => tcp, + port => '702', + action => accept, + physdev_out => 'eth1', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-out eth1 -m multiport --ports 702 -m comment --comment "702 - test" -j ACCEPT/) + end + end + end + + context 'physdev_in eth0 and physdev_out eth1' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '703 - test': + provider => 'ip6tables', + chain => 'FORWARD', + proto => tcp, + port => '703', + action => accept, + physdev_in => 'eth0', + physdev_out => 'eth1', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-in eth0 --physdev-out eth1 -m multiport --ports 703 -m comment --comment "703 - test" -j ACCEPT/) + end + end + end + + context 'physdev_is_bridged' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '704 - test': + provider => 'ip6tables', + chain => 'FORWARD', + proto => tcp, + port => '704', + action => accept, + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-is-bridged -m multiport --ports 704 -m comment --comment "704 - test" -j ACCEPT/) + end + end + end + + context 'physdev_in eth0 and physdev_is_bridged' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '705 - test': + provider => 'ip6tables', + chain => 'FORWARD', + proto => tcp, + port => '705', + action => accept, + physdev_in => 'eth0', + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-in eth0 --physdev-is-bridged -m multiport --ports 705 -m comment --comment "705 - test" -j ACCEPT/) + end + end + end + + context 'physdev_out eth1 and physdev_is_bridged' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '706 - test': + provider => 'ip6tables', + chain => 'FORWARD', + proto => tcp, + port => '706', + action => accept, + physdev_out => 'eth1', + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-out eth1 --physdev-is-bridged -m multiport --ports 706 -m comment --comment "706 - test" -j ACCEPT/) + end + end + end + + context 'physdev_in eth0 and physdev_out eth1 and physdev_is_bridged' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '707 - test': + provider => 'ip6tables', + chain => 'FORWARD', + proto => tcp, + port => '707', + action => accept, + physdev_in => 'eth0', + physdev_out => 'eth1', + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m physdev\s+--physdev-in eth0 --physdev-out eth1 --physdev-is-bridged -m multiport --ports 707 -m comment --comment "707 - test" -j ACCEPT/) + end + end + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/firewall_clusterip_spec.rb b/environments/production/modules/firewall/spec/acceptance/firewall_clusterip_spec.rb new file mode 100644 index 0000000..03fbd90 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/firewall_clusterip_spec.rb @@ -0,0 +1,49 @@ + +# These tests have been commented out, as there are suspicions that the clusterIP ipt module is causing system reboots. + + +# require 'spec_helper_acceptance' + +# describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do + +# before(:all) do +# shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush') +# shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush') +# end + +# # SLES doesn't have the CLUSTERIP module +# if default['platform'] !~ /sles/ +# describe 'clusterip' do +# context 'cluster ipv4 test' do +# it 'applies' do +# pending("MODULES-2124 should be resolved for clusterip RHEL7 support") if default['platform'] =~ /el-7/ +# pp = <<-EOS +# class { '::firewall': } +# firewall { +# '830 - clusterip test': +# chain => 'FORWARD', +# jump => 'CLUSTERIP', +# destination => '1.1.1.1', +# iniface => 'eth0', +# clusterip_new => true, +# clusterip_hashmode => "sourceip", +# clusterip_clustermac => "01:00:5E:00:00:00", +# clusterip_total_nodes => "2", +# clusterip_local_node => "1", +# clusterip_hash_init => "1337", +# } +# EOS + +# apply_manifest(pp, :catch_failures => true) +# end + +# it 'should contain the rule' do +# pending("MODULES-2124 should be resolved for clusterip RHEL7 support") if default['platform'] =~ /el-7/ +# shell('iptables-save') do |r| +# expect(r.stdout).to match(/-A FORWARD -d (1.1.1.1\/32|1.1.1.1) -i eth0 -p tcp -m comment --comment "830 - clusterip test" -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:5E:00:00:00 --total-nodes 2 --local-node 1 --hash-init 1337/) +# end +# end +# end +# end +# end +# end diff --git a/environments/production/modules/firewall/spec/acceptance/firewall_dscp_spec.rb b/environments/production/modules/firewall/spec/acceptance/firewall_dscp_spec.rb new file mode 100644 index 0000000..581f117 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/firewall_dscp_spec.rb @@ -0,0 +1,117 @@ +require 'spec_helper_acceptance' + +describe 'firewall DSCP' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + describe 'dscp ipv4 tests' do + context 'set_dscp 0x01' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { + '1000 - set_dscp': + proto => 'tcp', + jump => 'DSCP', + set_dscp => '0x01', + port => '997', + chain => 'OUTPUT', + table => 'mangle', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save -t mangle') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m multiport --ports 997 -m comment --comment "1000 - set_dscp" -j DSCP --set-dscp 0x01/) + end + end + end + + context 'set_dscp_class EF' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { + '1001 EF - set_dscp_class': + proto => 'tcp', + jump => 'DSCP', + port => '997', + set_dscp_class => 'EF', + chain => 'OUTPUT', + table => 'mangle', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m multiport --ports 997 -m comment --comment "1001 EF - set_dscp_class" -j DSCP --set-dscp 0x2e/) + end + end + end + end + + if default['platform'] !~ /el-5/ and default['platform'] !~ /sles-10/ + describe 'dscp ipv6 tests' do + context 'set_dscp 0x01' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { + '1002 - set_dscp': + proto => 'tcp', + jump => 'DSCP', + set_dscp => '0x01', + port => '997', + chain => 'OUTPUT', + table => 'mangle', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save -t mangle') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m multiport --ports 997 -m comment --comment "1002 - set_dscp" -j DSCP --set-dscp 0x01/) + end + end + end + + context 'set_dscp_class EF' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { + '1003 EF - set_dscp_class': + proto => 'tcp', + jump => 'DSCP', + port => '997', + set_dscp_class => 'EF', + chain => 'OUTPUT', + table => 'mangle', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m multiport --ports 997 -m comment --comment "1003 EF - set_dscp_class" -j DSCP --set-dscp 0x2e/) + end + end + end + end + end + +end diff --git a/environments/production/modules/firewall/spec/acceptance/firewall_iptmodules_spec.rb b/environments/production/modules/firewall/spec/acceptance/firewall_iptmodules_spec.rb new file mode 100644 index 0000000..24234c0 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/firewall_iptmodules_spec.rb @@ -0,0 +1,201 @@ + require 'spec_helper_acceptance' + +describe 'firewall iptmodules' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + describe 'iptables ipt_modules tests' do + context 'all the modules with multiple args' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '801 - ipt_modules tests': + proto => tcp, + dport => '8080', + action => reject, + chain => 'OUTPUT', + uid => 0, + gid => 404, + src_range => "90.0.0.1-90.0.0.2", + dst_range => "100.0.0.1-100.0.0.2", + src_type => 'LOCAL', + dst_type => 'UNICAST', + physdev_in => "eth0", + physdev_out => "eth1", + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m physdev\s+--physdev-in eth0 --physdev-out eth1 --physdev-is-bridged -m iprange --src-range 90.0.0.1-90.0.0.2\s+--dst-range 100.0.0.1-100.0.0.2 -m owner --uid-owner (0|root) --gid-owner 404 -m multiport --dports 8080 -m addrtype --src-type LOCAL --dst-type UNICAST -m comment --comment "801 - ipt_modules tests" -j REJECT --reject-with icmp-port-unreachable/) + end + end + end + + context 'all the modules with single args' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '802 - ipt_modules tests': + proto => tcp, + dport => '8080', + action => reject, + chain => 'OUTPUT', + gid => 404, + dst_range => "100.0.0.1-100.0.0.2", + dst_type => 'UNICAST', + physdev_out => "eth1", + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m physdev\s+--physdev-out eth1 --physdev-is-bridged -m iprange --dst-range 100.0.0.1-100.0.0.2 -m owner --gid-owner 404 -m multiport --dports 8080 -m addrtype --dst-type UNICAST -m comment --comment "802 - ipt_modules tests" -j REJECT --reject-with icmp-port-unreachable/) + end + end + end + end + + #iptables version 1.3.5 is not suppored by the ip6tables provider + if default['platform'] =~ /debian-7/ or default['platform'] =~ /ubuntu-14\.04/ + describe 'ip6tables ipt_modules tests' do + context 'all the modules with multiple args' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '801 - ipt_modules tests': + proto => tcp, + dport => '8080', + action => reject, + chain => 'OUTPUT', + provider => 'ip6tables', + uid => 0, + gid => 404, + src_range => "2001::-2002::", + dst_range => "2003::-2004::", + src_type => 'LOCAL', + dst_type => 'UNICAST', + physdev_in => "eth0", + physdev_out => "eth1", + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m physdev\s+--physdev-in eth0 --physdev-out eth1 --physdev-is-bridged -m iprange --src-range 2001::-2002::\s+--dst-range 2003::-2004:: -m owner --uid-owner (0|root) --gid-owner 404 -m multiport --dports 8080 -m addrtype --src-type LOCAL --dst-type UNICAST -m comment --comment "801 - ipt_modules tests" -j REJECT --reject-with icmp6-port-unreachable/) + end + end + end + + context 'all the modules with single args' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '802 - ipt_modules tests': + proto => tcp, + dport => '8080', + action => reject, + chain => 'OUTPUT', + provider => 'ip6tables', + gid => 404, + dst_range => "2003::-2004::", + dst_type => 'UNICAST', + physdev_out => "eth1", + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m physdev\s+--physdev-out eth1 --physdev-is-bridged -m iprange --dst-range 2003::-2004:: -m owner --gid-owner 404 -m multiport --dports 8080 -m addrtype --dst-type UNICAST -m comment --comment "802 - ipt_modules tests" -j REJECT --reject-with icmp6-port-unreachable/) + end + end + end + end + # Older OSes don't have addrtype so we leave those properties out. + # el-5 doesn't support ipv6 by default + elsif default['platform'] !~ /el-5/ and default['platform'] !~ /sles-10/ + describe 'ip6tables ipt_modules tests' do + context 'all the modules with multiple args' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '801 - ipt_modules tests': + proto => tcp, + dport => '8080', + action => reject, + chain => 'OUTPUT', + provider => 'ip6tables', + uid => 0, + gid => 404, + src_range => "2001::-2002::", + dst_range => "2003::-2004::", + physdev_in => "eth0", + physdev_out => "eth1", + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m physdev\s+--physdev-in eth0 --physdev-out eth1 --physdev-is-bridged -m iprange --src-range 2001::-2002::\s+--dst-range 2003::-2004:: -m owner --uid-owner (0|root) --gid-owner 404 -m multiport --dports 8080 -m comment --comment "801 - ipt_modules tests" -j REJECT --reject-with icmp6-port-unreachable/) + end + end + end + + context 'all the modules with single args' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '802 - ipt_modules tests': + proto => tcp, + dport => '8080', + action => reject, + chain => 'OUTPUT', + provider => 'ip6tables', + gid => 404, + dst_range => "2003::-2004::", + physdev_out => "eth1", + physdev_is_bridged => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m physdev\s+--physdev-out eth1 --physdev-is-bridged -m iprange --dst-range 2003::-2004:: -m owner --gid-owner 404 -m multiport --dports 8080 -m comment --comment "802 - ipt_modules tests" -j REJECT --reject-with icmp6-port-unreachable/) + end + end + end + end + end + +end diff --git a/environments/production/modules/firewall/spec/acceptance/firewall_mss_spec.rb b/environments/production/modules/firewall/spec/acceptance/firewall_mss_spec.rb new file mode 100644 index 0000000..06390fb --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/firewall_mss_spec.rb @@ -0,0 +1,117 @@ +require 'spec_helper_acceptance' + +describe 'firewall MSS' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + describe 'mss ipv4 tests' do + context '1360' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { + '502 - set_mss': + proto => 'tcp', + tcp_flags => 'SYN,RST SYN', + jump => 'TCPMSS', + set_mss => '1360', + mss => '1361:1541', + chain => 'FORWARD', + table => 'mangle', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save -t mangle') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "502 - set_mss" -m tcpmss --mss 1361:1541 -j TCPMSS --set-mss 1360/) + end + end + end + + context 'clamp_mss_to_pmtu' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { + '503 - clamp_mss_to_pmtu': + proto => 'tcp', + chain => 'FORWARD', + tcp_flags => 'SYN,RST SYN', + jump => 'TCPMSS', + clamp_mss_to_pmtu => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "503 - clamp_mss_to_pmtu" -j TCPMSS --clamp-mss-to-pmtu/) + end + end + end + end + + if default['platform'] !~ /el-5/ and default['platform'] !~ /sles-10/ + describe 'mss ipv6 tests' do + context '1360' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { + '502 - set_mss': + proto => 'tcp', + tcp_flags => 'SYN,RST SYN', + jump => 'TCPMSS', + set_mss => '1360', + mss => '1361:1541', + chain => 'FORWARD', + table => 'mangle', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save -t mangle') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "502 - set_mss" -m tcpmss --mss 1361:1541 -j TCPMSS --set-mss 1360/) + end + end + end + + context 'clamp_mss_to_pmtu' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { + '503 - clamp_mss_to_pmtu': + proto => 'tcp', + chain => 'FORWARD', + tcp_flags => 'SYN,RST SYN', + jump => 'TCPMSS', + clamp_mss_to_pmtu => true, + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "503 - clamp_mss_to_pmtu" -j TCPMSS --clamp-mss-to-pmtu/) + end + end + end + end + end + +end diff --git a/environments/production/modules/firewall/spec/acceptance/firewall_spec.rb b/environments/production/modules/firewall/spec/acceptance/firewall_spec.rb new file mode 100644 index 0000000..ef54ee8 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/firewall_spec.rb @@ -0,0 +1,2419 @@ +require 'spec_helper_acceptance' + +describe 'firewall basics', docker: true do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + describe 'name' do + context 'valid' do + it 'applies cleanly' do + pp = <<-EOS + class { '::firewall': } + firewall { '001 - test': ensure => present } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + end + + context 'invalid' do + it 'fails' do + pp = <<-EOS + class { '::firewall': } + firewall { 'test': ensure => present } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Invalid value "test"./) + end + end + end + end + + describe 'ensure' do + context 'default' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '555 - test': + proto => tcp, + port => '555', + action => accept, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 555 -m comment --comment "555 - test" -j ACCEPT/) + end + end + end + + context 'present' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '555 - test': + ensure => present, + proto => tcp, + port => '555', + action => accept, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 555 -m comment --comment "555 - test" -j ACCEPT/) + end + end + end + + context 'absent' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '555 - test': + ensure => absent, + proto => tcp, + port => '555', + action => accept, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should not contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m multiport --ports 555 -m comment --comment "555 - test" -j ACCEPT/) + end + end + end + end + + describe 'source' do + context '192.168.2.0/24' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '556 - test': + proto => tcp, + port => '556', + action => accept, + source => '192.168.2.0/24', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -s 192.168.2.0\/(24|255\.255\.255\.0) -p tcp -m multiport --ports 556 -m comment --comment "556 - test" -j ACCEPT/) + end + end + end + + context '! 192.168.2.0/24' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '556 - test': + proto => tcp, + port => '556', + action => accept, + source => '! 192.168.2.0/24', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT (! -s|-s !) 192.168.2.0\/(24|255\.255\.255\.0) -p tcp -m multiport --ports 556 -m comment --comment "556 - test" -j ACCEPT/) + end + end + end + + # Invalid address + context '256.168.2.0/24' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '556 - test': + proto => tcp, + port => '556', + action => accept, + source => '256.168.2.0/24', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/host_to_ip failed for 256.168.2.0\/(24|255\.255\.255\.0)/) + end + end + + it 'should not contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -s 256.168.2.0\/(24|255\.255\.255\.0) -p tcp -m multiport --ports 556 -m comment --comment "556 - test" -j ACCEPT/) + end + end + end + end + + describe 'src_range' do + context '192.168.1.1-192.168.1.10' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '557 - test': + proto => tcp, + port => '557', + action => accept, + src_range => '192.168.1.1-192.168.1.10', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m iprange --src-range 192.168.1.1-192.168.1.10 -m multiport --ports 557 -m comment --comment "557 - test" -j ACCEPT/) + end + end + end + + # Invalid IP + context '392.168.1.1-192.168.1.10' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '557 - test': + proto => tcp, + port => '557', + action => accept, + src_range => '392.168.1.1-192.168.1.10', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Invalid IP address "392.168.1.1" in range "392.168.1.1-192.168.1.10"/) + end + end + + it 'should not contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m iprange --src-range 392.168.1.1-192.168.1.10 -m multiport --ports 557 -m comment --comment "557 - test" -j ACCEPT/) + end + end + end + end + + describe 'destination' do + context '192.168.2.0/24' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '558 - test': + proto => tcp, + port => '558', + action => accept, + destination => '192.168.2.0/24', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -d 192.168.2.0\/(24|255\.255\.255\.0) -p tcp -m multiport --ports 558 -m comment --comment "558 - test" -j ACCEPT/) + end + end + end + + context '! 192.168.2.0/24' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '558 - test': + proto => tcp, + port => '558', + action => accept, + destination => '! 192.168.2.0/24', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT (! -d|-d !) 192.168.2.0\/(24|255\.255\.255\.0) -p tcp -m multiport --ports 558 -m comment --comment "558 - test" -j ACCEPT/) + end + end + end + + # Invalid address + context '256.168.2.0/24' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '558 - test': + proto => tcp, + port => '558', + action => accept, + destination => '256.168.2.0/24', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/host_to_ip failed for 256.168.2.0\/(24|255\.255\.255\.0)/) + end + end + + it 'should not contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -d 256.168.2.0\/(24|255\.255\.255\.0) -p tcp -m multiport --ports 558 -m comment --comment "558 - test" -j ACCEPT/) + end + end + end + end + + describe 'dst_range' do + context '192.168.1.1-192.168.1.10' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '559 - test': + proto => tcp, + port => '559', + action => accept, + dst_range => '192.168.1.1-192.168.1.10', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m iprange --dst-range 192.168.1.1-192.168.1.10 -m multiport --ports 559 -m comment --comment "559 - test" -j ACCEPT/) + end + end + end + + # Invalid IP + context '392.168.1.1-192.168.1.10' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '559 - test': + proto => tcp, + port => '559', + action => accept, + dst_range => '392.168.1.1-192.168.1.10', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Invalid IP address "392.168.1.1" in range "392.168.1.1-192.168.1.10"/) + end + end + + it 'should not contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m iprange --dst-range 392.168.1.1-192.168.1.10 -m multiport --ports 559 -m comment --comment "559 - test" -j ACCEPT/) + end + end + end + end + + describe 'sport' do + context 'single port' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '560 - test': + proto => tcp, + sport => '560', + action => accept, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --sports 560 -m comment --comment "560 - test" -j ACCEPT/) + end + end + end + + context 'multiple ports' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '560 - test': + proto => tcp, + sport => '560-561', + action => accept, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --sports 560:561 -m comment --comment "560 - test" -j ACCEPT/) + end + end + end + + context 'invalid ports' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '560 - test': + proto => tcp, + sport => '9999560-561', + action => accept, + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/invalid port\/service `9999560' specified/) + end + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m multiport --sports 9999560-561 -m comment --comment "560 - test" -j ACCEPT/) + end + end + end + end + + describe 'dport' do + context 'single port' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '561 - test': + proto => tcp, + dport => '561', + action => accept, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --dports 561 -m comment --comment "561 - test" -j ACCEPT/) + end + end + end + + context 'multiple ports' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '561 - test': + proto => tcp, + dport => '561-562', + action => accept, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --dports 561:562 -m comment --comment "561 - test" -j ACCEPT/) + end + end + end + + context 'invalid ports' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '561 - test': + proto => tcp, + dport => '9999561-562', + action => accept, + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/invalid port\/service `9999561' specified/) + end + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m multiport --dports 9999561-562 -m comment --comment "560 - test" -j ACCEPT/) + end + end + end + end + + describe 'port' do + context 'single port' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '562 - test': + proto => tcp, + port => '562', + action => accept, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 562 -m comment --comment "562 - test" -j ACCEPT/) + end + end + end + + context 'multiple ports' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '562 - test': + proto => tcp, + port => '562-563', + action => accept, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 562:563 -m comment --comment "562 - test" -j ACCEPT/) + end + end + end + + context 'invalid ports' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '562 - test': + proto => tcp, + port => '9999562-563', + action => accept, + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/invalid port\/service `9999562' specified/) + end + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m multiport --ports 9999562-563 -m comment --comment "562 - test" -j ACCEPT/) + end + end + end + end + + ['dst_type', 'src_type'].each do |type| + describe "#{type}" do + context 'MULTICAST' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '563 - test': + proto => tcp, + action => accept, + #{type} => 'MULTICAST', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m addrtype\s.*\sMULTICAST -m comment --comment "563 - test" -j ACCEPT/) + end + end + end + + context '! MULTICAST' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '563 - test inversion': + proto => tcp, + action => accept, + #{type} => '! MULTICAST', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m addrtype( !\s.*\sMULTICAST|\s.*\s! MULTICAST) -m comment --comment "563 - test inversion" -j ACCEPT/) + end + end + end + + context 'BROKEN' do + it 'fails' do + pp = <<-EOS + class { '::firewall': } + firewall { '563 - test': + proto => tcp, + action => accept, + #{type} => 'BROKEN', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Invalid value "BROKEN"./) + end + end + + it 'should not contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m addrtype\s.*\sBROKEN -m comment --comment "563 - test" -j ACCEPT/) + end + end + end + end + end + + describe 'tcp_flags' do + context 'FIN,SYN ACK' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '564 - test': + proto => tcp, + action => accept, + tcp_flags => 'FIN,SYN ACK', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN ACK -m comment --comment "564 - test" -j ACCEPT/) + end + end + end + end + + describe 'chain' do + context 'INPUT' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '565 - test': + proto => tcp, + action => accept, + chain => 'FORWARD', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m comment --comment "565 - test" -j ACCEPT/) + end + end + end + end + + describe 'table' do + context 'mangle' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '566 - test': + proto => tcp, + action => accept, + table => 'mangle', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save -t mangle') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m comment --comment "566 - test" -j ACCEPT/) + end + end + end + context 'nat' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '566 - test2': + proto => tcp, + action => accept, + table => 'nat', + chain => 'OUTPUT', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should not contain the rule' do + shell('iptables-save -t nat') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m comment --comment "566 - test2" -j ACCEPT/) + end + end + end + end + + describe 'jump' do + after :all do + iptables_flush_all_tables + expect(shell('iptables -t filter -X TEST').stderr).to eq("") + end + + context 'MARK' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewallchain { 'TEST:filter:IPv4': + ensure => present, + } + firewall { '567 - test': + proto => tcp, + chain => 'INPUT', + jump => 'TEST', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m comment --comment "567 - test" -j TEST/) + end + end + end + + context 'jump and apply' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewallchain { 'TEST:filter:IPv4': + ensure => present, + } + firewall { '568 - test': + proto => tcp, + chain => 'INPUT', + action => 'accept', + jump => 'TEST', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Only one of the parameters 'action' and 'jump' can be set/) + end + end + + it 'should not contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m comment --comment "568 - test" -j TEST/) + end + end + end + end + + describe 'tosource' do + context '192.168.1.1' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '568 - test': + proto => tcp, + table => 'nat', + chain => 'POSTROUTING', + jump => 'SNAT', + tosource => '192.168.1.1', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save -t nat') do |r| + expect(r.stdout).to match(/A POSTROUTING -p tcp -m comment --comment "568 - test" -j SNAT --to-source 192.168.1.1/) + end + end + end + end + + describe 'todest' do + context '192.168.1.1' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '569 - test': + proto => tcp, + table => 'nat', + chain => 'PREROUTING', + jump => 'DNAT', + source => '200.200.200.200', + todest => '192.168.1.1', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save -t nat') do |r| + expect(r.stdout).to match(/-A PREROUTING -s 200.200.200.200(\/32)? -p tcp -m comment --comment "569 - test" -j DNAT --to-destination 192.168.1.1/) + end + end + end + end + + describe 'toports' do + context '192.168.1.1' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '570 - test': + proto => icmp, + table => 'nat', + chain => 'PREROUTING', + jump => 'REDIRECT', + toports => '2222', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save -t nat') do |r| + expect(r.stdout).to match(/-A PREROUTING -p icmp -m comment --comment "570 - test" -j REDIRECT --to-ports 2222/) + end + end + end + end + + + if default['platform'] !~ /el-5/ and default['platform'] !~ /ubuntu-10\.04/ and default['platform'] !~ /debian-6/ and default['platform'] !~ /sles/ + describe 'checksum_fill' do + context 'virbr' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '576 - test': + proto => udp, + table => 'mangle', + outiface => 'virbr0', + chain => 'POSTROUTING', + dport => '68', + jump => 'CHECKSUM', + checksum_fill => true, + provider => iptables, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save -t mangle') do |r| + expect(r.stdout).to match(/-A POSTROUTING -o virbr0 -p udp -m multiport --dports 68 -m comment --comment "576 - test" -j CHECKSUM --checksum-fill/) + end + end + end + end + + describe 'checksum_fill6' do + context 'virbr' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '576 - test': + proto => udp, + table => 'mangle', + outiface => 'virbr0', + chain => 'POSTROUTING', + dport => '68', + jump => 'CHECKSUM', + checksum_fill => true, + provider => ip6tables, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save -t mangle') do |r| + expect(r.stdout).to match(/-A POSTROUTING -o virbr0 -p udp -m multiport --dports 68 -m comment --comment "576 - test" -j CHECKSUM --checksum-fill/) + end + end + end + end + end + + # RHEL5 does not support --random + if default['platform'] !~ /el-5/ and default['platform'] !~ /sles-10/ + describe 'random' do + context '192.168.1.1' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '570 - test 2': + proto => all, + table => 'nat', + chain => 'POSTROUTING', + jump => 'MASQUERADE', + source => '172.30.0.0/16', + random => true + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save -t nat') do |r| + expect(r.stdout).to match(/-A POSTROUTING -s 172\.30\.0\.0\/16 -m comment --comment "570 - test 2" -j MASQUERADE --random/) + end + end + end + end + end + + describe 'icmp' do + context 'any' do + it 'fails' do + pp = <<-EOS + class { '::firewall': } + firewall { '571 - test': + proto => icmp, + icmp => 'any', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/This behaviour should be achieved by omitting or undefining the ICMP parameter/) + end + end + + it 'should not contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p icmp -m comment --comment "570 - test" -m icmp --icmp-type 11/) + end + end + end + end + + #iptables version 1.3.5 is not suppored by the ip6tables provider + if default['platform'] !~ /el-5/ and default['platform'] !~ /sles-10/ + describe 'hop_limit' do + context '5' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '571 - test': + ensure => present, + proto => tcp, + port => '571', + action => accept, + hop_limit => '5', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 571 -m comment --comment "571 - test" -m hl --hl-eq 5 -j ACCEPT/) + end + end + end + + context 'invalid' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '571 - test': + ensure => present, + proto => tcp, + port => '571', + action => accept, + hop_limit => 'invalid', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Invalid value "invalid"./) + end + end + + it 'should not contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m multiport --ports 571 -m comment --comment "571 - test" -m hl --hl-eq invalid -j ACCEPT/) + end + end + end + end + + describe 'ishasmorefrags' do + context 'true' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '587 - test': + ensure => present, + proto => tcp, + port => '587', + action => accept, + ishasmorefrags => true, + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/A INPUT -p tcp -m frag --fragid 0 --fragmore -m multiport --ports 587 -m comment --comment "587 - test" -j ACCEPT/) + end + end + end + + context 'false' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '588 - test': + ensure => present, + proto => tcp, + port => '588', + action => accept, + ishasmorefrags => false, + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 588 -m comment --comment "588 - test" -j ACCEPT/) + end + end + end + end + + describe 'islastfrag' do + context 'true' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '589 - test': + ensure => present, + proto => tcp, + port => '589', + action => accept, + islastfrag => true, + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m frag --fragid 0 --fraglast -m multiport --ports 589 -m comment --comment "589 - test" -j ACCEPT/) + end + end + end + + context 'false' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '590 - test': + ensure => present, + proto => tcp, + port => '590', + action => accept, + islastfrag => false, + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 590 -m comment --comment "590 - test" -j ACCEPT/) + end + end + end + end + + describe 'isfirstfrag' do + context 'true' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '591 - test': + ensure => present, + proto => tcp, + port => '591', + action => accept, + isfirstfrag => true, + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m frag --fragid 0 --fragfirst -m multiport --ports 591 -m comment --comment "591 - test" -j ACCEPT/) + end + end + end + + context 'false' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '592 - test': + ensure => present, + proto => tcp, + port => '592', + action => accept, + isfirstfrag => false, + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 592 -m comment --comment "592 - test" -j ACCEPT/) + end + end + end + end + + describe 'tcp_flags' do + context 'FIN,SYN ACK' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '593 - test': + proto => tcp, + action => accept, + tcp_flags => 'FIN,SYN ACK', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN ACK -m comment --comment "593 - test" -j ACCEPT/) + end + end + end + end + + describe 'src_range' do + context '2001:db8::1-2001:db8::ff' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '601 - test': + proto => tcp, + port => '601', + action => accept, + src_range => '2001:db8::1-2001:db8::ff', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m iprange --src-range 2001:db8::1-2001:db8::ff -m multiport --ports 601 -m comment --comment "601 - test" -j ACCEPT/) + end + end + end + + # Invalid IP + context '2001::db8::1-2001:db8::ff' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '601 - test': + proto => tcp, + port => '601', + action => accept, + provider => 'ip6tables', + src_range => '2001::db8::1-2001:db8::ff', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Invalid IP address "2001::db8::1" in range "2001::db8::1-2001:db8::ff"/) + end + end + + it 'should not contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m iprange --src-range 2001::db8::1-2001:db8::ff -m multiport --ports 601 -m comment --comment "601 - test" -j ACCEPT/) + end + end + end + end + + describe 'dst_range' do + context '2001:db8::1-2001:db8::ff' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '602 - test': + proto => tcp, + port => '602', + action => accept, + dst_range => '2001:db8::1-2001:db8::ff', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m iprange --dst-range 2001:db8::1-2001:db8::ff -m multiport --ports 602 -m comment --comment "602 - test" -j ACCEPT/) + end + end + end + + # Invalid IP + context '2001::db8::1-2001:db8::ff' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '602 - test': + proto => tcp, + port => '602', + action => accept, + provider => 'ip6tables', + dst_range => '2001::db8::1-2001:db8::ff', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Invalid IP address "2001::db8::1" in range "2001::db8::1-2001:db8::ff"/) + end + end + + it 'should not contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m iprange --dst-range 2001::db8::1-2001:db8::ff -m multiport --ports 602 -m comment --comment "602 - test" -j ACCEPT/) + end + end + end + end + + describe 'mac_source' do + context '0A:1B:3C:4D:5E:6F' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '604 - test': + ensure => present, + source => '2001:db8::1/128', + mac_source => '0A:1B:3C:4D:5E:6F', + chain => 'INPUT', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -s 2001:db8::1\/(128|ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff) -p tcp -m mac --mac-source 0A:1B:3C:4D:5E:6F -m comment --comment "604 - test"/) + end + end + end + end + + # ip6tables has limited `-m socket` support + if default['platform'] !~ /el-5/ and default['platform'] !~ /ubuntu-10\.04/ and default['platform'] !~ /debian-6/ and default['platform'] !~ /sles/ + describe 'socket' do + context 'true' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '605 - test': + ensure => present, + proto => tcp, + port => '605', + action => accept, + chain => 'INPUT', + socket => true, + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 605 -m socket -m comment --comment "605 - test" -j ACCEPT/) + end + end + end + + context 'false' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '606 - test': + ensure => present, + proto => tcp, + port => '606', + action => accept, + chain => 'INPUT', + socket => false, + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 606 -m comment --comment "606 - test" -j ACCEPT/) + end + end + end + end + end + + describe 'ipsec_policy' do + context 'ipsec' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '607 - test': + ensure => 'present', + action => 'reject', + chain => 'OUTPUT', + destination => '2001:db8::1/128', + ipsec_dir => 'out', + ipsec_policy => 'ipsec', + proto => 'all', + reject => 'icmp6-adm-prohibited', + table => 'filter', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -d 2001:db8::1\/(128|ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff) -m comment --comment "607 - test" -m policy --dir out --pol ipsec -j REJECT --reject-with icmp6-adm-prohibited/) + end + end + end + + context 'none' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '608 - test': + ensure => 'present', + action => 'reject', + chain => 'OUTPUT', + destination => '2001:db8::1/128', + ipsec_dir => 'out', + ipsec_policy => 'none', + proto => 'all', + reject => 'icmp6-adm-prohibited', + table => 'filter', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -d 2001:db8::1\/(128|ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff) -m comment --comment "608 - test" -m policy --dir out --pol none -j REJECT --reject-with icmp6-adm-prohibited/) + end + end + end + end + + describe 'ipsec_dir' do + context 'out' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '609 - test': + ensure => 'present', + action => 'reject', + chain => 'OUTPUT', + destination => '2001:db8::1/128', + ipsec_dir => 'out', + ipsec_policy => 'ipsec', + proto => 'all', + reject => 'icmp6-adm-prohibited', + table => 'filter', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -d 2001:db8::1\/(128|ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff) -m comment --comment "609 - test" -m policy --dir out --pol ipsec -j REJECT --reject-with icmp6-adm-prohibited/) + end + end + end + + context 'in' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '610 - test': + ensure => 'present', + action => 'reject', + chain => 'INPUT', + destination => '2001:db8::1/128', + ipsec_dir => 'in', + ipsec_policy => 'none', + proto => 'all', + reject => 'icmp6-adm-prohibited', + table => 'filter', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -d 2001:db8::1\/(128|ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff) -m comment --comment "610 - test" -m policy --dir in --pol none -j REJECT --reject-with icmp6-adm-prohibited/) + end + end + end + end + + describe 'set_mark' do + context '0x3e8/0xffffffff' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '611 - test': + ensure => present, + chain => 'OUTPUT', + proto => tcp, + port => '611', + jump => 'MARK', + table => 'mangle', + set_mark => '0x3e8/0xffffffff', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save -t mangle') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m multiport --ports 611 -m comment --comment "611 - test" -j MARK --set-xmark 0x3e8\/0xffffffff/) + end + end + end + end + + #ip6tables only supports ipset, addrtype, and mask on a limited set of platforms + if default['platform'] =~ /el-7/ or default['platform'] =~ /debian-7/ or default['platform'] =~ /ubuntu-14\.04/ + #ipset is really difficult to test, just testing on one platform + if default['platform'] =~ /ubuntu-14\.04/ + describe 'ipset' do + it 'applies' do + pp = <<-EOS + exec { 'hackery pt 1': + command => 'service iptables-persistent flush', + path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + package { 'ipset': + ensure => present, + require => Exec['hackery pt 1'], + } + exec { 'hackery pt 2': + command => 'service iptables-persistent start', + path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + require => Package['ipset'], + } + class { '::firewall': } + exec { 'create ipset blacklist': + command => 'ipset create blacklist hash:ip,port family inet6 maxelem 1024 hashsize 65535 timeout 120', + path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + require => Package['ipset'], + } + -> exec { 'create ipset honeypot': + command => 'ipset create honeypot hash:ip family inet6 maxelem 1024 hashsize 65535 timeout 120', + path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + -> exec { 'add blacklist': + command => 'ipset add blacklist 2001:db8::1,80', + path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + -> exec { 'add honeypot': + command => 'ipset add honeypot 2001:db8::5', + path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + firewall { '612 - test': + ensure => present, + chain => 'INPUT', + proto => tcp, + action => drop, + ipset => ['blacklist src,dst', '! honeypot dst'], + provider => 'ip6tables', + require => Exec['add honeypot'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m comment --comment "612 - test" -m set --match-set blacklist src,dst -m set ! --match-set honeypot dst -j DROP/) + end + end + end + end + + # mask isn't supported on deb7 + if default['platform'] !~ /debian-7/ + describe 'mask' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '613 - test': + recent => 'update', + rseconds => 60, + rsource => true, + rname => 'test', + action => 'drop', + chain => 'FORWARD', + mask => 'ffff::', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A FORWARD -p tcp -m comment --comment "613 - test" -m recent --update --seconds 60 --name test --mask ffff:: --rsource -j DROP/) + end + end + end + end + + ['dst_type', 'src_type'].each do |type| + describe "#{type}" do + context 'MULTICAST' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '603 - test': + proto => tcp, + action => accept, + #{type} => 'MULTICAST', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m addrtype\s.*\sMULTICAST -m comment --comment "603 - test" -j ACCEPT/) + end + end + end + + context '! MULTICAST' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '603 - test inversion': + proto => tcp, + action => accept, + #{type} => '! MULTICAST', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m addrtype( !\s.*\sMULTICAST|\s.*\s! MULTICAST) -m comment --comment "603 - test inversion" -j ACCEPT/) + end + end + end + + context 'BROKEN' do + it 'fails' do + pp = <<-EOS + class { '::firewall': } + firewall { '603 - test': + proto => tcp, + action => accept, + #{type} => 'BROKEN', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Invalid value "BROKEN"./) + end + end + + it 'should not contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m addrtype\s.*\sBROKEN -m comment --comment "603 - test" -j ACCEPT/) + end + end + end + end + end + end + + end + + describe 'limit' do + context '500/sec' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '572 - test': + ensure => present, + proto => tcp, + port => '572', + action => accept, + limit => '500/sec', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 572 -m comment --comment "572 - test" -m limit --limit 500\/sec -j ACCEPT/) + end + end + end + end + + describe 'burst' do + context '500' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '573 - test': + ensure => present, + proto => tcp, + port => '573', + action => accept, + limit => '500/sec', + burst => '1500', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 573 -m comment --comment "573 - test" -m limit --limit 500\/sec --limit-burst 1500 -j ACCEPT/) + end + end + end + + context 'invalid' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '571 - test': + ensure => present, + proto => tcp, + port => '571', + action => accept, + limit => '500/sec', + burst => '1500/sec', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Invalid value "1500\/sec"./) + end + end + + it 'should not contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m multiport --ports 573 -m comment --comment "573 - test" -m limit --limit 500\/sec --limit-burst 1500\/sec -j ACCEPT/) + end + end + end + end + + describe 'uid' do + context 'nobody' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '574 - test': + ensure => present, + proto => tcp, + chain => 'OUTPUT', + port => '574', + action => accept, + uid => 'nobody', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m owner --uid-owner (nobody|\d+) -m multiport --ports 574 -m comment --comment "574 - test" -j ACCEPT/) + end + end + end + end + + describe 'gid' do + context 'root' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '575 - test': + ensure => present, + proto => tcp, + chain => 'OUTPUT', + port => '575', + action => accept, + gid => 'root', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m owner --gid-owner (root|\d+) -m multiport --ports 575 -m comment --comment "575 - test" -j ACCEPT/) + end + end + end + end + + #iptables version 1.3.5 does not support masks on MARK rules + if default['platform'] !~ /el-5/ and default['platform'] !~ /sles-10/ + describe 'set_mark' do + context '0x3e8/0xffffffff' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '580 - test': + ensure => present, + chain => 'OUTPUT', + proto => tcp, + port => '580', + jump => 'MARK', + table => 'mangle', + set_mark => '0x3e8/0xffffffff', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save -t mangle') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m multiport --ports 580 -m comment --comment "580 - test" -j MARK --set-xmark 0x3e8\/0xffffffff/) + end + end + end + end + end + + describe 'pkttype' do + context 'multicast' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '581 - test': + ensure => present, + proto => tcp, + port => '581', + action => accept, + pkttype => 'multicast', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 581 -m pkttype --pkt-type multicast -m comment --comment "581 - test" -j ACCEPT/) + end + end + end + + context 'test' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '582 - test': + ensure => present, + proto => tcp, + port => '582', + action => accept, + pkttype => 'test', + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Invalid value "test"./) + end + end + + it 'should not contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m multiport --ports 582 -m pkttype --pkt-type multicast -m comment --comment "582 - test" -j ACCEPT/) + end + end + end + end + + describe 'isfragment' do + context 'true' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '583 - test': + ensure => present, + proto => tcp, + port => '583', + action => accept, + isfragment => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -f -m multiport --ports 583 -m comment --comment "583 - test" -j ACCEPT/) + end + end + end + + context 'false' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '584 - test': + ensure => present, + proto => tcp, + port => '584', + action => accept, + isfragment => false, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m multiport --ports 584 -m comment --comment "584 - test" -j ACCEPT/) + end + end + end + end + + # RHEL5/SLES does not support -m socket + describe 'socket', :unless => (default['platform'] =~ /el-5/ or fact('operatingsystem') == 'SLES') do + context 'true' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '585 - test': + ensure => present, + proto => tcp, + port => '585', + action => accept, + chain => 'PREROUTING', + table => 'nat', + socket => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save -t nat') do |r| + expect(r.stdout).to match(/-A PREROUTING -p tcp -m multiport --ports 585 -m socket -m comment --comment "585 - test" -j ACCEPT/) + end + end + end + + context 'false' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '586 - test': + ensure => present, + proto => tcp, + port => '586', + action => accept, + chain => 'PREROUTING', + table => 'nat', + socket => false, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save -t nat') do |r| + expect(r.stdout).to match(/-A PREROUTING -p tcp -m multiport --ports 586 -m comment --comment "586 - test" -j ACCEPT/) + end + end + end + end + + describe 'ipsec_policy' do + context 'ipsec' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '593 - test': + ensure => 'present', + action => 'reject', + chain => 'OUTPUT', + destination => '20.0.0.0/8', + ipsec_dir => 'out', + ipsec_policy => 'ipsec', + proto => 'all', + reject => 'icmp-net-unreachable', + table => 'filter', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -d 20.0.0.0\/(8|255\.0\.0\.0) -m comment --comment "593 - test" -m policy --dir out --pol ipsec -j REJECT --reject-with icmp-net-unreachable/) + end + end + end + + context 'none' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '594 - test': + ensure => 'present', + action => 'reject', + chain => 'OUTPUT', + destination => '20.0.0.0/8', + ipsec_dir => 'out', + ipsec_policy => 'none', + proto => 'all', + reject => 'icmp-net-unreachable', + table => 'filter', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -d 20.0.0.0\/(8|255\.0\.0\.0) -m comment --comment "594 - test" -m policy --dir out --pol none -j REJECT --reject-with icmp-net-unreachable/) + end + end + end + end + + describe 'ipsec_dir' do + context 'out' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '595 - test': + ensure => 'present', + action => 'reject', + chain => 'OUTPUT', + destination => '20.0.0.0/8', + ipsec_dir => 'out', + ipsec_policy => 'ipsec', + proto => 'all', + reject => 'icmp-net-unreachable', + table => 'filter', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -d 20.0.0.0\/(8|255\.0\.0\.0) -m comment --comment "595 - test" -m policy --dir out --pol ipsec -j REJECT --reject-with icmp-net-unreachable/) + end + end + end + + context 'in' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '596 - test': + ensure => 'present', + action => 'reject', + chain => 'INPUT', + destination => '20.0.0.0/8', + ipsec_dir => 'in', + ipsec_policy => 'none', + proto => 'all', + reject => 'icmp-net-unreachable', + table => 'filter', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -d 20.0.0.0\/(8|255\.0\.0\.0) -m comment --comment "596 - test" -m policy --dir in --pol none -j REJECT --reject-with icmp-net-unreachable/) + end + end + end + end + + describe 'recent' do + context 'set' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '597 - test': + ensure => 'present', + chain => 'INPUT', + destination => '30.0.0.0/8', + proto => 'all', + table => 'filter', + recent => 'set', + rdest => true, + rname => 'list1', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + # Mask added as of Ubuntu 14.04. + expect(r.stdout).to match(/-A INPUT -d 30.0.0.0\/(8|255\.0\.0\.0) -m comment --comment "597 - test" -m recent --set --name list1 (--mask 255.255.255.255 )?--rdest/) + end + end + end + + context 'rcheck' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '598 - test': + ensure => 'present', + chain => 'INPUT', + destination => '30.0.0.0/8', + proto => 'all', + table => 'filter', + recent => 'rcheck', + rsource => true, + rname => 'list1', + rseconds => 60, + rhitcount => 5, + rttl => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -d 30.0.0.0\/(8|255\.0\.0\.0) -m comment --comment "598 - test" -m recent --rcheck --seconds 60 --hitcount 5 --rttl --name list1 (--mask 255.255.255.255 )?--rsource/) + end + end + end + + context 'update' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '599 - test': + ensure => 'present', + chain => 'INPUT', + destination => '30.0.0.0/8', + proto => 'all', + table => 'filter', + recent => 'update', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -d 30.0.0.0\/(8|255\.0\.0\.0) -m comment --comment "599 - test" -m recent --update/) + end + end + end + + context 'remove' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '600 - test': + ensure => 'present', + chain => 'INPUT', + destination => '30.0.0.0/8', + proto => 'all', + table => 'filter', + recent => 'remove', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -d 30.0.0.0\/(8|255\.0\.0\.0) -m comment --comment "600 - test" -m recent --remove/) + end + end + end + end + + describe 'mac_source' do + context '0A:1B:3C:4D:5E:6F' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '610 - test': + ensure => present, + source => '10.1.5.28/32', + mac_source => '0A:1B:3C:4D:5E:6F', + chain => 'INPUT', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + if (fact('osfamily') == 'RedHat' and fact('operatingsystemmajrelease') == '5') or (default['platform'] =~ /sles-10/) + expect(r.stdout).to match(/-A INPUT -s 10.1.5.28 -p tcp -m mac --mac-source 0A:1B:3C:4D:5E:6F -m comment --comment "610 - test"/) + else + expect(r.stdout).to match(/-A INPUT -s 10.1.5.28\/(32|255\.255\.255\.255) -p tcp -m mac --mac-source 0A:1B:3C:4D:5E:6F -m comment --comment "610 - test"/) + end + end + end + end + end + + describe 'reset' do + it 'deletes all rules' do + shell('ip6tables --flush') + shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush') + end + end + + describe 'to' do + context 'Destination netmap 192.168.1.1' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '569 - test': + proto => tcp, + table => 'nat', + chain => 'PREROUTING', + jump => 'NETMAP', + source => '200.200.200.200', + to => '192.168.1.1', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save -t nat') do |r| + expect(r.stdout).to match(/-A PREROUTING -s 200.200.200.200(\/32)? -p tcp -m comment --comment "569 - test" -j NETMAP --to 192.168.1.1/) + end + end + end + + describe 'reset' do + it 'deletes all rules' do + shell('ip6tables --flush') + shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush') + end + end + + context 'Source netmap 192.168.1.1' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '569 - test': + proto => tcp, + table => 'nat', + chain => 'POSTROUTING', + jump => 'NETMAP', + destination => '200.200.200.200', + to => '192.168.1.1', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save -t nat') do |r| + expect(r.stdout).to match(/-A POSTROUTING -d 200.200.200.200(\/32)? -p tcp -m comment --comment "569 - test" -j NETMAP --to 192.168.1.1/) + end + end + end + end + + context 'log_prefix containing -A' do + it 'adds the rule' do + pp = <<-EOS + class { '::firewall': } + firewall { '700 - test': + jump => 'LOG', + log_prefix => 'FW-A-INPUT: ', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m comment --comment "700 - test" -j LOG --log-prefix "FW-A-INPUT: "/) + end + end + + it 'removes the rule' do + pp = <<-EOS + class { '::firewall': } + firewall { '700 - test': + ensure => absent, + jump => 'LOG', + log_prefix => 'FW-A-INPUT: ', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should not contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m comment --comment "700 - test" -j LOG --log-prefix "FW-A-INPUT: "/) + end + end + end + + context 'log_uid is true' do + it 'adds the rule' do + pp = <<-EOS + class { '::firewall': } + firewall { '700 - test log_uid': + chain => 'OUTPUT', + jump => 'LOG', + log_uid => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m comment --comment "700 - test log_uid" -j LOG --log-uid/) + end + end + + it 'removes the rule' do + pp = <<-EOS + class { '::firewall': } + firewall { '700 - test log_uid': + chain => 'OUTPUT', + jump => 'LOG', + log_uid => false, + ensure => absent, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should not contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A OUTPUT -p tcp -m comment --comment "700 - test log_uid" -j --log-uid/) + end + end + end + + context 'comment containing "-A "' do + it 'adds the rule' do + pp = <<-EOS + class { '::firewall': } + firewall { '700 - blah-A Test Rule': + jump => 'LOG', + log_prefix => 'FW-A-INPUT: ', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -p tcp -m comment --comment "700 - blah-A Test Rule" -j LOG --log-prefix "FW-A-INPUT: "/) + end + end + + it 'removes the rule' do + pp = <<-EOS + class { '::firewall': } + firewall { '700 - blah-A Test Rule': + ensure => absent, + jump => 'LOG', + log_prefix => 'FW-A-INPUT: ', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should not contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/-A INPUT -p tcp -m comment --comment "700 - blah-A Test Rule" -j LOG --log-prefix "FW-A-INPUT: "/) + end + end + end + + +end diff --git a/environments/production/modules/firewall/spec/acceptance/firewall_tee_spec.rb b/environments/production/modules/firewall/spec/acceptance/firewall_tee_spec.rb new file mode 100644 index 0000000..da07a28 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/firewall_tee_spec.rb @@ -0,0 +1,64 @@ +require 'spec_helper_acceptance' + +describe 'firewall tee' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + if default['platform'] =~ /ubuntu-1404/ or default['platform'] =~ /ubuntu-1204/ or default['platform'] =~ /debian-7/ or default['platform'] =~ /debian-8/ or default['platform'] =~ /el-7/ + describe 'tee_gateway' do + context '10.0.0.2' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { + '810 - tee_gateway': + chain => 'PREROUTING', + table => 'mangle', + jump => 'TEE', + gateway => '10.0.0.2', + proto => all, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save -t mangle') do |r| + expect(r.stdout).to match(/-A PREROUTING -m comment --comment "810 - tee_gateway" -j TEE --gateway 10.0.0.2/) + end + end + end + end + + describe 'tee_gateway6' do + context '2001:db8::1' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { + '811 - tee_gateway6': + chain => 'PREROUTING', + table => 'mangle', + jump => 'TEE', + gateway => '2001:db8::1', + proto => all, + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save -t mangle') do |r| + expect(r.stdout).to match(/-A PREROUTING -m comment --comment "811 - tee_gateway6" -j TEE --gateway 2001:db8::1/) + end + end + end + end + end + +end diff --git a/environments/production/modules/firewall/spec/acceptance/firewall_time_spec.rb b/environments/production/modules/firewall/spec/acceptance/firewall_time_spec.rb new file mode 100644 index 0000000..2569770 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/firewall_time_spec.rb @@ -0,0 +1,75 @@ +require 'spec_helper_acceptance' + +describe 'firewall time' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + if default['platform'] =~ /ubuntu-1404/ or default['platform'] =~ /debian-7/ or default['platform'] =~ /debian-8/ or default['platform'] =~ /el-7/ + describe "time tests ipv4" do + context 'set all time parameters' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '805 - test': + proto => tcp, + dport => '8080', + action => accept, + chain => 'OUTPUT', + date_start => '2016-01-19T04:17:07', + date_stop => '2038-01-19T04:17:07', + time_start => '6:00', + time_stop => '17:00:00', + month_days => '7', + week_days => 'Tue', + kernel_timezone => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m multiport --dports 8080 -m comment --comment "805 - test" -m time --timestart 06:00:00 --timestop 17:00:00 --monthdays 7 --weekdays Tue --datestart 2016-01-19T04:17:07 --datestop 2038-01-19T04:17:07 --kerneltz -j ACCEPT/) + end + end + end + end + + describe "time tests ipv6" do + context 'set all time parameters' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '805 - test': + proto => tcp, + dport => '8080', + action => accept, + chain => 'OUTPUT', + date_start => '2016-01-19T04:17:07', + date_stop => '2038-01-19T04:17:07', + time_start => '6:00', + time_stop => '17:00:00', + month_days => '7', + week_days => 'Tue', + kernel_timezone => true, + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -p tcp -m multiport --dports 8080 -m comment --comment "805 - test" -m time --timestart 06:00:00 --timestop 17:00:00 --monthdays 7 --weekdays Tue --datestart 2016-01-19T04:17:07 --datestop 2038-01-19T04:17:07 --kerneltz -j ACCEPT/) + end + end + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/firewall_uid_spec.rb b/environments/production/modules/firewall/spec/acceptance/firewall_uid_spec.rb new file mode 100644 index 0000000..e4df7f8 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/firewall_uid_spec.rb @@ -0,0 +1,104 @@ +require 'spec_helper_acceptance' + +describe 'firewall uid' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + describe "uid tests" do + context 'uid set to root' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '801 - test': + chain => 'OUTPUT', + action => accept, + uid => 'root', + proto => 'all', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -m owner --uid-owner (0|root) -m comment --comment "801 - test" -j ACCEPT/) + end + end + end + + context 'uid set to !root' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '802 - test': + chain => 'OUTPUT', + action => accept, + uid => '!root', + proto => 'all', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -m owner ! --uid-owner (0|root) -m comment --comment "802 - test" -j ACCEPT/) + end + end + end + + context 'uid set to 0' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '803 - test': + chain => 'OUTPUT', + action => accept, + uid => '0', + proto => 'all', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -m owner --uid-owner (0|root) -m comment --comment "803 - test" -j ACCEPT/) + end + end + end + + context 'uid set to !0' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '804 - test': + chain => 'OUTPUT', + action => accept, + uid => '!0', + proto => 'all', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A OUTPUT -m owner ! --uid-owner (0|root) -m comment --comment "804 - test" -j ACCEPT/) + end + end + end + + end + +end diff --git a/environments/production/modules/firewall/spec/acceptance/firewallchain_spec.rb b/environments/production/modules/firewall/spec/acceptance/firewallchain_spec.rb new file mode 100644 index 0000000..ffc4e22 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/firewallchain_spec.rb @@ -0,0 +1,127 @@ +require 'spec_helper_acceptance' + +describe 'puppet resource firewallchain command' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + describe 'ensure' do + context 'present' do + it 'applies cleanly' do + pp = <<-EOS + firewallchain { 'MY_CHAIN:filter:IPv4': + ensure => present, + } + EOS + # Run it twice and test for idempotency + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'finds the chain' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/MY_CHAIN/) + end + end + end + + context 'absent' do + it 'applies cleanly' do + pp = <<-EOS + firewallchain { 'MY_CHAIN:filter:IPv4': + ensure => absent, + } + EOS + # Run it twice and test for idempotency + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'fails to find the chain' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/MY_CHAIN/) + end + end + end + end + + # XXX purge => false is not yet implemented + #context 'adding a firewall rule to a chain:' do + # it 'applies cleanly' do + # pp = <<-EOS + # firewallchain { 'MY_CHAIN:filter:IPv4': + # ensure => present, + # } + # firewall { '100 my rule': + # chain => 'MY_CHAIN', + # action => 'accept', + # proto => 'tcp', + # dport => 5000, + # } + # EOS + # # Run it twice and test for idempotency + # apply_manifest(pp, :catch_failures => true) + # apply_manifest(pp, :catch_changes => do_catch_changes) + # end + #end + + #context 'not purge firewallchain chains:' do + # it 'does not purge the rule' do + # pp = <<-EOS + # firewallchain { 'MY_CHAIN:filter:IPv4': + # ensure => present, + # purge => false, + # before => Resources['firewall'], + # } + # resources { 'firewall': + # purge => true, + # } + # EOS + # # Run it twice and test for idempotency + # apply_manifest(pp, :catch_failures => true) do |r| + # expect(r.stdout).to_not match(/removed/) + # expect(r.stderr).to eq('') + # end + # apply_manifest(pp, :catch_changes => do_catch_changes) + # end + + # it 'still has the rule' do + # pp = <<-EOS + # firewall { '100 my rule': + # chain => 'MY_CHAIN', + # action => 'accept', + # proto => 'tcp', + # dport => 5000, + # } + # EOS + # # Run it twice and test for idempotency + # apply_manifest(pp, :catch_changes => do_catch_changes) + # end + #end + + describe 'policy' do + after :all do + shell('iptables -t filter -P FORWARD ACCEPT') + end + + context 'DROP' do + it 'applies cleanly' do + pp = <<-EOS + firewallchain { 'FORWARD:filter:IPv4': + policy => 'drop', + } + EOS + # Run it twice and test for idempotency + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'finds the chain' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/FORWARD DROP/) + end + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/invert_spec.rb b/environments/production/modules/firewall/spec/acceptance/invert_spec.rb new file mode 100644 index 0000000..5eba941 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/invert_spec.rb @@ -0,0 +1,61 @@ +require 'spec_helper_acceptance' + +describe 'firewall inverting' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + context "inverting rules" do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '601 disallow esp protocol': + action => 'accept', + proto => '! esp', + } + firewall { '602 drop NEW external website packets with FIN/RST/ACK set and SYN unset': + chain => 'INPUT', + state => 'NEW', + action => 'drop', + proto => 'tcp', + sport => ['! http', '! 443'], + source => '! 10.0.0.0/8', + tcp_flags => '! FIN,SYN,RST,ACK SYN', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'should contain the rules' do + shell('iptables-save') do |r| + if (fact('osfamily') == 'RedHat' and fact('operatingsystemmajrelease') == '5') or (default['platform'] =~ /sles-10/) + expect(r.stdout).to match(/-A INPUT -p ! esp -m comment --comment "601 disallow esp protocol" -j ACCEPT/) + expect(r.stdout).to match(/-A INPUT -s ! 10\.0\.0\.0\/255\.0\.0\.0 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m multiport --sports ! 80,443 -m comment --comment "602 drop NEW external website packets with FIN\/RST\/ACK set and SYN unset" -m state --state NEW -j DROP/) + else + expect(r.stdout).to match(/-A INPUT ! -p esp -m comment --comment "601 disallow esp protocol" -j ACCEPT/) + expect(r.stdout).to match(/-A INPUT ! -s 10\.0\.0\.0\/8 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m multiport ! --sports 80,443 -m comment --comment "602 drop NEW external website packets with FIN\/RST\/ACK set and SYN unset" -m state --state NEW -j DROP/) + end + end + end + end + context "inverting partial array rules" do + it 'raises a failure' do + pp = <<-EOS + class { '::firewall': } + firewall { '603 drop 80,443 traffic': + chain => 'INPUT', + action => 'drop', + proto => 'tcp', + sport => ['! http', '443'], + } + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/is not prefixed/) + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/ip6_fragment_spec.rb b/environments/production/modules/firewall/spec/acceptance/ip6_fragment_spec.rb new file mode 100644 index 0000000..ed2256f --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/ip6_fragment_spec.rb @@ -0,0 +1,116 @@ +require 'spec_helper_acceptance' + +if default['platform'] =~ /el-5/ or default['platform'] =~ /sles-10/ + describe "firewall ip6tables doesn't work on 1.3.5 because --comment is missing" do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + it "can't use ip6tables" do + pp = <<-EOS + class { '::firewall': } + firewall { '599 - test': + ensure => present, + proto => 'tcp', + provider => 'ip6tables', + } + EOS + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/ip6tables provider is not supported/) + end + end +else + describe 'firewall ishasmorefrags/islastfrag/isfirstfrag properties' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + shared_examples "is idempotent" do |values, line_match| + it "changes the values to #{values}" do + pp = <<-EOS + class { '::firewall': } + firewall { '599 - test': + ensure => present, + proto => 'tcp', + provider => 'ip6tables', + #{values} + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/#{line_match}/) + end + end + end + shared_examples "doesn't change" do |values, line_match| + it "doesn't change the values to #{values}" do + pp = <<-EOS + class { '::firewall': } + firewall { '599 - test': + ensure => present, + proto => 'tcp', + provider => 'ip6tables', + #{values} + } + EOS + + apply_manifest(pp, :catch_changes => do_catch_changes) + + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/#{line_match}/) + end + end + end + + describe 'adding a rule' do + context 'when unset' do + before :all do + ip6tables_flush_all_tables + end + it_behaves_like 'is idempotent', '', /-A INPUT -p tcp -m comment --comment "599 - test"/ + end + context 'when set to true' do + before :all do + ip6tables_flush_all_tables + end + it_behaves_like "is idempotent", 'ishasmorefrags => true, islastfrag => true, isfirstfrag => true', /-A INPUT -p tcp -m frag --fragid 0 --fragmore -m frag --fragid 0 --fraglast -m frag --fragid 0 --fragfirst -m comment --comment "599 - test"/ + end + context 'when set to false' do + before :all do + ip6tables_flush_all_tables + end + it_behaves_like "is idempotent", 'ishasmorefrags => false, islastfrag => false, isfirstfrag => false', /-A INPUT -p tcp -m comment --comment "599 - test"/ + end + end + describe 'editing a rule' do + context 'when unset or false' do + before :each do + ip6tables_flush_all_tables + shell('ip6tables -A INPUT -p tcp -m comment --comment "599 - test"') + end + context 'and current value is false' do + it_behaves_like "doesn't change", 'ishasmorefrags => false, islastfrag => false, isfirstfrag => false', /-A INPUT -p tcp -m comment --comment "599 - test"/ + end + context 'and current value is true' do + it_behaves_like "is idempotent", 'ishasmorefrags => true, islastfrag => true, isfirstfrag => true', /-A INPUT -p tcp -m frag --fragid 0 --fragmore -m frag --fragid 0 --fraglast -m frag --fragid 0 --fragfirst -m comment --comment "599 - test"/ + end + end + context 'when set to true' do + before :each do + ip6tables_flush_all_tables + shell('ip6tables -A INPUT -p tcp -m frag --fragid 0 --fragmore -m frag --fragid 0 --fraglast -m frag --fragid 0 --fragfirst -m comment --comment "599 - test"') + end + context 'and current value is false' do + it_behaves_like "is idempotent", 'ishasmorefrags => false, islastfrag => false, isfirstfrag => false', /-A INPUT -p tcp -m comment --comment "599 - test"/ + end + context 'and current value is true' do + it_behaves_like "doesn't change", 'ishasmorefrags => true, islastfrag => true, isfirstfrag => true', /-A INPUT -p tcp -m frag --fragid 0 --fragmore -m frag --fragid 0 --fraglast -m frag --fragid 0 --fragfirst -m comment --comment "599 - test"/ + end + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/isfragment_spec.rb b/environments/production/modules/firewall/spec/acceptance/isfragment_spec.rb new file mode 100644 index 0000000..8e879b2 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/isfragment_spec.rb @@ -0,0 +1,93 @@ +require 'spec_helper_acceptance' + +describe 'firewall isfragment property' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + shared_examples "is idempotent" do |value, line_match| + it "changes the value to #{value}" do + pp = <<-EOS + class { '::firewall': } + firewall { '597 - test': + ensure => present, + proto => 'tcp', + #{value} + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + + shell('iptables-save') do |r| + expect(r.stdout).to match(/#{line_match}/) + end + end + end + shared_examples "doesn't change" do |value, line_match| + it "doesn't change the value to #{value}" do + pp = <<-EOS + class { '::firewall': } + firewall { '597 - test': + ensure => present, + proto => 'tcp', + #{value} + } + EOS + + apply_manifest(pp, :catch_changes => do_catch_changes) + + shell('iptables-save') do |r| + expect(r.stdout).to match(/#{line_match}/) + end + end + end + + describe 'adding a rule' do + context 'when unset' do + before :all do + iptables_flush_all_tables + end + it_behaves_like 'is idempotent', '', /-A INPUT -p tcp -m comment --comment "597 - test"/ + end + context 'when set to true' do + before :all do + iptables_flush_all_tables + end + it_behaves_like 'is idempotent', 'isfragment => true,', /-A INPUT -p tcp -f -m comment --comment "597 - test"/ + end + context 'when set to false' do + before :all do + iptables_flush_all_tables + end + it_behaves_like "is idempotent", 'isfragment => false,', /-A INPUT -p tcp -m comment --comment "597 - test"/ + end + end + describe 'editing a rule' do + context 'when unset or false' do + before :each do + iptables_flush_all_tables + shell('iptables -A INPUT -p tcp -m comment --comment "597 - test"') + end + context 'and current value is false' do + it_behaves_like "doesn't change", 'isfragment => false,', /-A INPUT -p tcp -m comment --comment "597 - test"/ + end + context 'and current value is true' do + it_behaves_like "is idempotent", 'isfragment => true,', /-A INPUT -p tcp -f -m comment --comment "597 - test"/ + end + end + context 'when set to true' do + before :each do + iptables_flush_all_tables + shell('iptables -A INPUT -p tcp -f -m comment --comment "597 - test"') + end + context 'and current value is false' do + it_behaves_like "is idempotent", 'isfragment => false,', /-A INPUT -p tcp -m comment --comment "597 - test"/ + end + context 'and current value is true' do + it_behaves_like "doesn't change", 'isfragment => true,', /-A INPUT -p tcp -f -m comment --comment "597 - test"/ + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/match_mark_spec.rb b/environments/production/modules/firewall/spec/acceptance/match_mark_spec.rb new file mode 100644 index 0000000..17b80b4 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/match_mark_spec.rb @@ -0,0 +1,57 @@ +require 'spec_helper_acceptance' + +describe 'firewall match marks' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + if default['platform'] !~ /el-5/ and default['platform'] !~ /sles-10/ + describe 'match_mark' do + context '0x1' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '503 match_mark - test': + proto => 'all', + match_mark => '0x1', + action => reject, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('iptables-save') do |r| + expect(r.stdout).to match(/-A INPUT -m comment --comment "503 match_mark - test" -m mark --mark 0x1 -j REJECT --reject-with icmp-port-unreachable/) + end + end + end + end + + describe 'match_mark_ip6' do + context '0x1' do + it 'applies' do + pp = <<-EOS + class { '::firewall': } + firewall { '503 match_mark ip6tables - test': + proto => 'all', + match_mark => '0x1', + action => reject, + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should contain the rule' do + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/-A INPUT -m comment --comment "503 match_mark ip6tables - test" -m mark --mark 0x1 -j REJECT --reject-with icmp6-port-unreachable/) + end + end + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/centos-7-x64.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/centos-7-x64.yml new file mode 100644 index 0000000..5eebdef --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/centos-7-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + centos-7-x64: + roles: + - agent + - default + platform: el-7-x86_64 + hypervisor: vagrant + box: puppetlabs/centos-7.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/debian-8-x64.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/debian-8-x64.yml new file mode 100644 index 0000000..fef6e63 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/debian-8-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + debian-8-x64: + roles: + - agent + - default + platform: debian-8-amd64 + hypervisor: vagrant + box: puppetlabs/debian-8.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/default.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/default.yml new file mode 100644 index 0000000..dba339c --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/default.yml @@ -0,0 +1,10 @@ +HOSTS: + ubuntu-1404-x64: + roles: + - agent + - default + platform: ubuntu-14.04-amd64 + hypervisor: vagrant + box: puppetlabs/ubuntu-14.04-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/docker/centos-7.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/docker/centos-7.yml new file mode 100644 index 0000000..a3333aa --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/docker/centos-7.yml @@ -0,0 +1,12 @@ +HOSTS: + centos-7-x64: + platform: el-7-x86_64 + hypervisor: docker + image: centos:7 + docker_preserve_image: true + docker_cmd: '["/usr/sbin/init"]' + # install various tools required to get the image up to usable levels + docker_image_commands: + - 'yum install -y crontabs tar wget openssl sysvinit-tools iproute which initscripts' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/docker/debian-8.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/docker/debian-8.yml new file mode 100644 index 0000000..df5c319 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/docker/debian-8.yml @@ -0,0 +1,11 @@ +HOSTS: + debian-8-x64: + platform: debian-8-amd64 + hypervisor: docker + image: debian:8 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get update && apt-get install -y net-tools wget locales strace lsof && echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/docker/ubuntu-14.04.yml new file mode 100644 index 0000000..b1efa58 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/docker/ubuntu-14.04.yml @@ -0,0 +1,12 @@ +HOSTS: + ubuntu-1404-x64: + platform: ubuntu-14.04-amd64 + hypervisor: docker + image: ubuntu:14.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + # ensure that upstart is booting correctly in the container + - 'rm /usr/sbin/policy-rc.d && rm /sbin/initctl && dpkg-divert --rename --remove /sbin/initctl && apt-get update && apt-get install -y net-tools wget && locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/debian-8-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/debian-8-64mda.yml new file mode 100644 index 0000000..90a8e83 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/debian-8-64mda.yml @@ -0,0 +1,29 @@ +--- +HOSTS: + debian-8-amd64-agent: + roles: + - agent + - default + platform: debian-8-amd64 + template: debian-8-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + type: aio + ssh: + timeout: 600 + diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/redhat-6-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/redhat-6-64mda.yml new file mode 100644 index 0000000..9e63eeb --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/redhat-6-64mda.yml @@ -0,0 +1,28 @@ +--- +HOSTS: + redhat-6-x86_64-agent: + roles: + - agent + - default + platform: el-6-x86_64 + template: redhat-6-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + type: aio + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/redhat-7-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/redhat-7-64mda.yml new file mode 100644 index 0000000..b9c352b --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/redhat-7-64mda.yml @@ -0,0 +1,28 @@ +--- +HOSTS: + redhat-7-x86_64-agent: + roles: + - agent + - default + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + type: aio + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/ubuntu-1404-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/ubuntu-1404-64mda.yml new file mode 100644 index 0000000..9029d26 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/ubuntu-1404-64mda.yml @@ -0,0 +1,28 @@ +--- +HOSTS: + ubuntu-1404-agent: + roles: + - agent + - default + platform: ubuntu-14.04-amd64 + template: Delivery/Quality Assurance/Templates/vCloud/ubuntu-1404-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + type: aio + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/ubuntu-1604-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/ubuntu-1604-64mda.yml new file mode 100644 index 0000000..80848a9 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/aio/ubuntu-1604-64mda.yml @@ -0,0 +1,28 @@ +--- +HOSTS: + ubuntu-1604-agent: + roles: + - agent + - default + platform: ubuntu-16.04-amd64 + template: Delivery/Quality Assurance/Templates/vCloud/ubuntu-1604-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + type: aio + ssh: + timeout: 600 diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/centos-5-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/centos-5-64mda.yml new file mode 100644 index 0000000..ba6c23c --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/centos-5-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + centos-5-x86_64-agent: + roles: + - agent + - default + platform: el-5-x86_64 + template: Delivery/Quality Assurance/Templates/vCloud/centos-5-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/centos-6-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/centos-6-64mda.yml new file mode 100644 index 0000000..e97e73f --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/centos-6-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + centos-6-x86_64-agent: + roles: + - agent + - default + platform: el-6-x86_64 + template: Delivery/Quality Assurance/Templates/vCloud/centos-6-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/centos-7-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/centos-7-64mda.yml new file mode 100644 index 0000000..056b52d --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/centos-7-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + centos-7-x86_64-agent: + roles: + - agent + - default + platform: el-7-x86_64 + template: centos-7-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/debian-6-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/debian-6-64mda.yml new file mode 100644 index 0000000..3101a5a --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/debian-6-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + debian-6-amd64-agent: + roles: + - agent + - default + platform: debian-6-amd64 + template: debian-6-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/debian-7-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/debian-7-64mda.yml new file mode 100644 index 0000000..4ebf914 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/debian-7-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + debian-7-amd64-agent: + roles: + - agent + - default + platform: debian-7-amd64 + template: debian-7-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/debian-8-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/debian-8-64mda.yml new file mode 100644 index 0000000..dc46f03 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/debian-8-64mda.yml @@ -0,0 +1,28 @@ +--- +HOSTS: + debian-8-amd64-agent: + roles: + - agent + - default + platform: debian-8-amd64 + template: debian-8-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 + diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/oracle-5-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/oracle-5-64mda.yml new file mode 100644 index 0000000..eb65fd4 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/oracle-5-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + oracle-5-x86_64-agent: + roles: + - agent + - default + platform: el-5-x86_64 + template: oracle-5-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/oracle-6-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/oracle-6-64mda.yml new file mode 100644 index 0000000..58e0fc0 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/oracle-6-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + oracle-6-x86_64-agent: + roles: + - agent + - default + platform: el-6-x86_64 + template: oracle-6-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/oracle-7-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/oracle-7-64mda.yml new file mode 100644 index 0000000..157d814 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/oracle-7-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + oracle-7-x86_64-agent: + roles: + - agent + - default + platform: el-7-x86_64 + template: oracle-7-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/redhat-5-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/redhat-5-64mda.yml new file mode 100644 index 0000000..56e45f5 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/redhat-5-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + redhat-5-x86_64-agent: + roles: + - agent + - default + platform: el-5-x86_64 + template: redhat-5-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/redhat-6-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/redhat-6-64mda.yml new file mode 100644 index 0000000..a41c585 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/redhat-6-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + redhat-6-x86_64-agent: + roles: + - agent + - default + platform: el-6-x86_64 + template: redhat-6-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/redhat-7-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/redhat-7-64mda.yml new file mode 100644 index 0000000..6ed476b --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/redhat-7-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + redhat-7-x86_64-agent: + roles: + - agent + - default + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/scientific-5-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/scientific-5-64mda.yml new file mode 100644 index 0000000..4ae3e43 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/scientific-5-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + scientific-5-x86_64-agent: + roles: + - agent + - default + platform: el-5-x86_64 + template: scientific-5-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/scientific-6-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/scientific-6-64mda.yml new file mode 100644 index 0000000..0c9457f --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/scientific-6-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + scientific-6-x86_64-agent: + roles: + - agent + - default + platform: el-6-x86_64 + template: scientific-6-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/scientific-7-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/scientific-7-64mda.yml new file mode 100644 index 0000000..80692bf --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/scientific-7-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + scientific-7-x86_64-agent: + roles: + - agent + - default + platform: el-7-x86_64 + template: scientific-7-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/sles-10-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/sles-10-64mda.yml new file mode 100644 index 0000000..5761d8d --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/sles-10-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + sles-10-x86_64-agent: + roles: + - agent + - default + platform: sles-10-x86_64 + template: sles-10-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/sles-11-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/sles-11-64mda.yml new file mode 100644 index 0000000..660c72f --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/sles-11-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + sles-11-x86_64-agent: + roles: + - agent + - default + platform: sles-11-x86_64 + template: sles-11-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/sles-12-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/sles-12-64mda.yml new file mode 100644 index 0000000..0e7884c --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/sles-12-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + sles-12-x86_64-agent: + roles: + - agent + - default + platform: sles-12-x86_64 + template: sles-12-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1004-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1004-64mda.yml new file mode 100644 index 0000000..0baeba8 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1004-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + ubuntu-1004-agent: + roles: + - agent + - default + platform: ubuntu-10.04-amd64 + template: ubuntu-1004-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1204-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1204-64mda.yml new file mode 100644 index 0000000..d8c2931 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1204-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + ubuntu-1204-agent: + roles: + - agent + - default + platform: ubuntu-12.04-amd64 + template: Delivery/Quality Assurance/Templates/vCloud/ubuntu-1204-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1404-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1404-64mda.yml new file mode 100644 index 0000000..c53683d --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1404-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + ubuntu-1404-agent: + roles: + - agent + - default + platform: ubuntu-14.04-amd64 + template: Delivery/Quality Assurance/Templates/vCloud/ubuntu-1404-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1604-64mda.yml b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1604-64mda.yml new file mode 100644 index 0000000..2a5fdf3 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/nodesets/new/pe/ubuntu-1604-64mda.yml @@ -0,0 +1,27 @@ +--- +HOSTS: + ubuntu-1604-agent: + roles: + - agent + - default + platform: ubuntu-16.04-amd64 + template: Delivery/Quality Assurance/Templates/vCloud/ubuntu-1604-x86_64 + hypervisor: vcloud + redhat-7-x86_64-master: + roles: + - master + - dashboard + - database + - agent + platform: el-7-x86_64 + template: redhat-7-x86_64 + hypervisor: vcloud +CONFIG: + nfs_server: none + consoleport: 443 + datastore: instance0 + folder: Delivery/Quality Assurance/Enterprise/Dynamic + resourcepool: delivery/Quality Assurance/Enterprise/Dynamic + pooling_api: http://vcloud.delivery.puppetlabs.net/ + ssh: + timeout: 600 diff --git a/environments/production/modules/firewall/spec/acceptance/params_spec.rb b/environments/production/modules/firewall/spec/acceptance/params_spec.rb new file mode 100644 index 0000000..cac685a --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/params_spec.rb @@ -0,0 +1,152 @@ +require 'spec_helper_acceptance' + +describe 'param based tests' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + it 'test various params', :unless => (default['platform'].match(/el-5/) || fact('operatingsystem') == 'SLES') do + iptables_flush_all_tables + + ppm = <<-EOS + firewall { '100 test': + table => 'raw', + socket => 'true', + chain => 'PREROUTING', + jump => 'LOG', + log_level => 'debug', + } + EOS + + expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2) + expect(apply_manifest(ppm, :catch_failures => true).exit_code).to be_zero + end + + it 'test log rule' do + iptables_flush_all_tables + + ppm = <<-EOS + firewall { '998 log all': + proto => 'all', + jump => 'LOG', + log_level => 'debug', + } + EOS + expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2) + expect(apply_manifest(ppm, :catch_failures => true).exit_code).to be_zero + end + + it 'test log rule - changing names' do + iptables_flush_all_tables + + ppm1 = <<-EOS + firewall { '004 log all INVALID packets': + chain => 'INPUT', + proto => 'all', + ctstate => 'INVALID', + jump => 'LOG', + log_level => '3', + log_prefix => 'IPTABLES dropped invalid: ', + } + EOS + + ppm2 = <<-EOS + firewall { '003 log all INVALID packets': + chain => 'INPUT', + proto => 'all', + ctstate => 'INVALID', + jump => 'LOG', + log_level => '3', + log_prefix => 'IPTABLES dropped invalid: ', + } + EOS + + expect(apply_manifest(ppm1, :catch_failures => true).exit_code).to eq(2) + + ppm = <<-EOS + "\n" + ppm2 + resources { 'firewall': + purge => true, + } + EOS + expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2) + end + + it 'test chain - changing names' do + iptables_flush_all_tables + + ppm1 = <<-EOS + firewall { '004 with a chain': + chain => 'INPUT', + proto => 'all', + } + EOS + + ppm2 = <<-EOS + firewall { '004 with a chain': + chain => 'OUTPUT', + proto => 'all', + } + EOS + + apply_manifest(ppm1, :expect_changes => true) + + ppm = <<-EOS + "\n" + ppm2 + resources { 'firewall': + purge => true, + } + EOS + expect(apply_manifest(ppm2, :expect_failures => true).stderr).to match(/is not supported/) + end + + it 'test log rule - idempotent' do + iptables_flush_all_tables + + ppm1 = <<-EOS + firewall { '004 log all INVALID packets': + chain => 'INPUT', + proto => 'all', + ctstate => 'INVALID', + jump => 'LOG', + log_level => '3', + log_prefix => 'IPTABLES dropped invalid: ', + } + EOS + + expect(apply_manifest(ppm1, :catch_failures => true).exit_code).to eq(2) + expect(apply_manifest(ppm1, :catch_failures => true).exit_code).to be_zero + end + + it 'test src_range rule' do + iptables_flush_all_tables + + ppm = <<-EOS + firewall { '997 block src ip range': + chain => 'INPUT', + proto => 'all', + action => 'drop', + src_range => '10.0.0.1-10.0.0.10', + } + EOS + + expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2) + expect(apply_manifest(ppm, :catch_failures => true).exit_code).to be_zero + end + + it 'test dst_range rule' do + iptables_flush_all_tables + + ppm = <<-EOS + firewall { '998 block dst ip range': + chain => 'INPUT', + proto => 'all', + action => 'drop', + dst_range => '10.0.0.2-10.0.0.20', + } + EOS + + expect(apply_manifest(ppm, :catch_failures => true).exit_code).to eq(2) + expect(apply_manifest(ppm, :catch_failures => true).exit_code).to be_zero + end + +end diff --git a/environments/production/modules/firewall/spec/acceptance/purge_spec.rb b/environments/production/modules/firewall/spec/acceptance/purge_spec.rb new file mode 100644 index 0000000..4e052ba --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/purge_spec.rb @@ -0,0 +1,235 @@ +require 'spec_helper_acceptance' + +describe 'purge tests' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + context('resources purge') do + before(:all) do + iptables_flush_all_tables + + shell('iptables -A INPUT -s 1.2.1.2') + shell('iptables -A INPUT -s 1.2.1.2') + end + + it 'make sure duplicate existing rules get purged' do + + pp = <<-EOS + class { 'firewall': } + resources { 'firewall': + purge => true, + } + EOS + + apply_manifest(pp, :expect_changes => true) + end + + it 'saves' do + shell('iptables-save') do |r| + expect(r.stdout).to_not match(/1\.2\.1\.2/) + expect(r.stderr).to eq("") + end + end + end + + context('ipv4 chain purge') do + after(:all) do + iptables_flush_all_tables + end + before(:each) do + iptables_flush_all_tables + + shell('iptables -A INPUT -p tcp -s 1.2.1.1') + shell('iptables -A INPUT -p udp -s 1.2.1.1') + shell('iptables -A OUTPUT -s 1.2.1.2 -m comment --comment "010 output-1.2.1.2"') + end + + it 'purges only the specified chain' do + pp = <<-EOS + class { 'firewall': } + firewallchain { 'INPUT:filter:IPv4': + purge => true, + } + EOS + + apply_manifest(pp, :expect_changes => true) + + shell('iptables-save') do |r| + expect(r.stdout).to match(/010 output-1\.2\.1\.2/) + expect(r.stdout).to_not match(/1\.2\.1\.1/) + expect(r.stderr).to eq("") + end + end + + it 'ignores managed rules' do + pp = <<-EOS + class { 'firewall': } + firewallchain { 'OUTPUT:filter:IPv4': + purge => true, + } + firewall { '010 output-1.2.1.2': + chain => 'OUTPUT', + proto => 'all', + source => '1.2.1.2', + } + EOS + + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'ignores specified rules' do + pp = <<-EOS + class { 'firewall': } + firewallchain { 'INPUT:filter:IPv4': + purge => true, + ignore => [ + '-s 1\.2\.1\.1', + ], + } + EOS + + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'adds managed rules with ignored rules' do + pp = <<-EOS + class { 'firewall': } + firewallchain { 'INPUT:filter:IPv4': + purge => true, + ignore => [ + '-s 1\.2\.1\.1', + ], + } + firewall { '014 input-1.2.1.6': + chain => 'INPUT', + proto => 'all', + source => '1.2.1.6', + } + -> firewall { '013 input-1.2.1.5': + chain => 'INPUT', + proto => 'all', + source => '1.2.1.5', + } + -> firewall { '012 input-1.2.1.4': + chain => 'INPUT', + proto => 'all', + source => '1.2.1.4', + } + -> firewall { '011 input-1.2.1.3': + chain => 'INPUT', + proto => 'all', + source => '1.2.1.3', + } + EOS + + apply_manifest(pp, :catch_failures => true) + + expect(shell('iptables-save').stdout).to match(/-A INPUT -s 1\.2\.1\.1(\/32)? -p tcp\s?\n-A INPUT -s 1\.2\.1\.1(\/32)? -p udp/) + end + end + + if default['platform'] !~ /el-5/ and default['platform'] !~ /sles-10/ + context 'ipv6 chain purge' do + after(:all) do + ip6tables_flush_all_tables + end + before(:each) do + ip6tables_flush_all_tables + + shell('ip6tables -A INPUT -p tcp -s 1::42') + shell('ip6tables -A INPUT -p udp -s 1::42') + shell('ip6tables -A OUTPUT -s 1::50 -m comment --comment "010 output-1::50"') + end + + it 'purges only the specified chain' do + pp = <<-EOS + class { 'firewall': } + firewallchain { 'INPUT:filter:IPv6': + purge => true, + } + EOS + + apply_manifest(pp, :expect_changes => true) + + shell('ip6tables-save') do |r| + expect(r.stdout).to match(/010 output-1::50/) + expect(r.stdout).to_not match(/1::42/) + expect(r.stderr).to eq("") + end + end + + it 'ignores managed rules' do + pp = <<-EOS + class { 'firewall': } + firewallchain { 'OUTPUT:filter:IPv6': + purge => true, + } + firewall { '010 output-1::50': + chain => 'OUTPUT', + proto => 'all', + source => '1::50', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'ignores specified rules' do + pp = <<-EOS + class { 'firewall': } + firewallchain { 'INPUT:filter:IPv6': + purge => true, + ignore => [ + '-s 1::42', + ], + } + EOS + + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'adds managed rules with ignored rules' do + pp = <<-EOS + class { 'firewall': } + firewallchain { 'INPUT:filter:IPv6': + purge => true, + ignore => [ + '-s 1::42', + ], + } + firewall { '014 input-1::46': + chain => 'INPUT', + proto => 'all', + source => '1::46', + provider => 'ip6tables', + } + -> firewall { '013 input-1::45': + chain => 'INPUT', + proto => 'all', + source => '1::45', + provider => 'ip6tables', + } + -> firewall { '012 input-1::44': + chain => 'INPUT', + proto => 'all', + source => '1::44', + provider => 'ip6tables', + } + -> firewall { '011 input-1::43': + chain => 'INPUT', + proto => 'all', + source => '1::43', + provider => 'ip6tables', + } + EOS + + apply_manifest(pp, :catch_failures => true) + + expect(shell('ip6tables-save').stdout).to match(/-A INPUT -s 1::42(\/128)? -p tcp\s?\n-A INPUT -s 1::42(\/128)? -p udp/) + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/resource_cmd_spec.rb b/environments/production/modules/firewall/spec/acceptance/resource_cmd_spec.rb new file mode 100644 index 0000000..39845fb --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/resource_cmd_spec.rb @@ -0,0 +1,190 @@ +require 'spec_helper_acceptance' + +# Here we want to test the the resource commands ability to work with different +# existing ruleset scenarios. This will give the parsing capabilities of the +# code a good work out. +describe 'puppet resource firewall command' do + before(:all) do + # In order to properly check stderr for anomalies we need to fix the deprecation warnings from puppet.conf. + config = shell('puppet config print config').stdout + shell("sed -i -e \'s/^templatedir.*$//\' #{config}") + end + + context 'make sure it returns no errors when executed on a clean machine' do + it do + shell('puppet resource firewall') do |r| + r.exit_code.should be_zero + # don't check stdout, some boxes come with rules, that is normal + r.stderr.should be_empty + end + end + end + + context 'flush iptables and make sure it returns nothing afterwards' do + before(:all) do + iptables_flush_all_tables + end + + # No rules, means no output thanks. And no errors as well. + it do + shell('puppet resource firewall') do |r| + r.exit_code.should be_zero + r.stdout.should == "\n" + end + end + end + + context 'accepts rules without comments' do + before(:all) do + iptables_flush_all_tables + shell('iptables -A INPUT -j ACCEPT -p tcp --dport 80') + end + + it do + shell('puppet resource firewall') do |r| + r.exit_code.should be_zero + # don't check stdout, testing preexisting rules, output is normal + r.stderr.should be_empty + end + end + end + + context 'accepts rules with invalid comments' do + before(:all) do + iptables_flush_all_tables + shell('iptables -A INPUT -j ACCEPT -p tcp --dport 80 -m comment --comment "http"') + end + + it do + shell('puppet resource firewall') do |r| + r.exit_code.should be_zero + # don't check stdout, testing preexisting rules, output is normal + r.stderr.should be_empty + end + end + end + + context 'accepts rules with negation' do + before :all do + iptables_flush_all_tables + shell('iptables -t nat -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535') + shell('iptables -t nat -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535') + shell('iptables -t nat -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE') + end + + it do + shell('puppet resource firewall') do |r| + r.exit_code.should be_zero + # don't check stdout, testing preexisting rules, output is normal + r.stderr.should be_empty + end + end + end + + context 'accepts rules with match extension tcp flag' do + before :all do + iptables_flush_all_tables + shell('iptables -t mangle -A PREROUTING -d 1.2.3.4 -p tcp -m tcp -m multiport --dports 80,443,8140 -j MARK --set-mark 42') + end + + it do + shell('puppet resource firewall') do |r| + r.exit_code.should be_zero + # don't check stdout, testing preexisting rules, output is normal + r.stderr.should be_empty + end + end + end + + if default['platform'] !~ /sles-10/ + context 'accepts rules utilizing the statistic module' do + before :all do + iptables_flush_all_tables + # This command doesn't work with all versions/oses, so let it fail + shell('iptables -t nat -A POSTROUTING -d 1.2.3.4/32 -o eth0 -m statistic --mode nth --every 2 -j SNAT --to-source 2.3.4.5', :acceptable_exit_codes => [0,1,2] ) + shell('iptables -t nat -A POSTROUTING -d 1.2.3.4/32 -o eth0 -m statistic --mode nth --every 1 --packet 0 -j SNAT --to-source 2.3.4.6') + shell('iptables -t nat -A POSTROUTING -d 1.2.3.4/32 -o eth0 -m statistic --mode random --probability 0.99 -j SNAT --to-source 2.3.4.7') + end + + it do + shell('puppet resource firewall') do |r| + r.exit_code.should be_zero + # don't check stdout, testing preexisting rules, output is normal + r.stderr.should be_empty + end + end + end + end + + context 'accepts rules with negation' do + before :all do + iptables_flush_all_tables + shell('iptables -t nat -A POSTROUTING -s 192.168.122.0/24 -m policy --dir out --pol ipsec -j ACCEPT') + shell('iptables -t filter -A FORWARD -s 192.168.1.0/24 -d 192.168.122.0/24 -i eth0 -m policy --dir in --pol ipsec --reqid 108 --proto esp -j ACCEPT') + shell('iptables -t filter -A FORWARD -s 192.168.122.0/24 -d 192.168.1.0/24 -o eth0 -m policy --dir out --pol ipsec --reqid 108 --proto esp -j ACCEPT') + shell('iptables -t filter -A FORWARD -s 192.168.201.1/32 -d 192.168.122.0/24 -i eth0 -m policy --dir in --pol ipsec --reqid 107 --proto esp -j ACCEPT') + shell('iptables -t filter -A FORWARD -s 192.168.122.0/24 -d 192.168.201.1/32 -o eth0 -m policy --dir out --pol ipsec --reqid 107 --proto esp -j ACCEPT') + end + + it do + shell('puppet resource firewall') do |r| + r.exit_code.should be_zero + # don't check stdout, testing preexisting rules, output is normal + r.stderr.should be_empty + end + end + end + + context 'accepts rules with -m (tcp|udp) without dport/sport' do + before :all do + iptables_flush_all_tables + shell('iptables -A INPUT -s 10.0.0.0/8 -p udp -m udp -j ACCEPT') + end + + it do + shell('puppet resource firewall') do |r| + r.exit_code.should be_zero + # don't check stdout, testing preexisting rules, output is normal + r.stderr.should be_empty + end + end + end + + context 'accepts rules with -m ttl' do + before :all do + iptables_flush_all_tables + shell('iptables -t nat -A OUTPUT -s 10.0.0.0/8 -p tcp -m ttl ! --ttl-eq 42 -j REDIRECT --to-ports 12299') + end + + it do + shell('puppet resource firewall') do |r| + r.exit_code.should be_zero + # don't check stdout, testing preexisting rules, output is normal + r.stderr.should be_empty + end + end + end + + # version of iptables that ships with el5 doesn't work with the + # ip6tables provider + if default['platform'] !~ /el-5/ and default['platform'] !~ /sles-10/ + context 'dport/sport with ip6tables' do + before :all do + if fact('osfamily') == 'Debian' + shell('echo "iptables-persistent iptables-persistent/autosave_v4 boolean false" | debconf-set-selections') + shell('echo "iptables-persistent iptables-persistent/autosave_v6 boolean false" | debconf-set-selections') + shell('apt-get install iptables-persistent -y') + end + ip6tables_flush_all_tables + shell('ip6tables -A INPUT -d fe80::/64 -p tcp -m tcp --dport 546 --sport 547 -j ACCEPT -m comment --comment 000-foobar') + end + it do + shell('puppet resource firewall \'000-foobar\' provider=ip6tables') do |r| + r.exit_code.should be_zero + # don't check stdout, testing preexisting rules, output is normal + r.stderr.should be_empty + end + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/rules_spec.rb b/environments/production/modules/firewall/spec/acceptance/rules_spec.rb new file mode 100644 index 0000000..3b27bd5 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/rules_spec.rb @@ -0,0 +1,280 @@ +require 'spec_helper_acceptance' + +describe 'complex ruleset 1' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + after :all do + shell('iptables -t filter -P INPUT ACCEPT') + shell('iptables -t filter -P FORWARD ACCEPT') + shell('iptables -t filter -P OUTPUT ACCEPT') + shell('iptables -t filter --flush') + end + + it 'applies cleanly' do + pp = <<-EOS + firewall { '090 forward allow local': + chain => 'FORWARD', + proto => 'all', + source => '10.0.0.0/8', + destination => '10.0.0.0/8', + action => 'accept', + } + firewall { '100 forward standard allow tcp': + chain => 'FORWARD', + source => '10.0.0.0/8', + destination => '!10.0.0.0/8', + proto => 'tcp', + state => 'NEW', + port => [80,443,21,20,22,53,123,43,873,25,465], + action => 'accept', + } + firewall { '100 forward standard allow udp': + chain => 'FORWARD', + source => '10.0.0.0/8', + destination => '!10.0.0.0/8', + proto => 'udp', + port => [53,123], + action => 'accept', + } + firewall { '100 forward standard allow icmp': + chain => 'FORWARD', + source => '10.0.0.0/8', + destination => '!10.0.0.0/8', + proto => 'icmp', + action => 'accept', + } + + firewall { '090 ignore ipsec': + table => 'nat', + chain => 'POSTROUTING', + outiface => 'eth0', + ipsec_policy => 'ipsec', + ipsec_dir => 'out', + action => 'accept', + } + firewall { '093 ignore 10.0.0.0/8': + table => 'nat', + chain => 'POSTROUTING', + outiface => 'eth0', + destination => '10.0.0.0/8', + action => 'accept', + } + firewall { '093 ignore 172.16.0.0/12': + table => 'nat', + chain => 'POSTROUTING', + outiface => 'eth0', + destination => '172.16.0.0/12', + action => 'accept', + } + firewall { '093 ignore 192.168.0.0/16': + table => 'nat', + chain => 'POSTROUTING', + outiface => 'eth0', + destination => '192.168.0.0/16', + action => 'accept', + } + firewall { '100 masq outbound': + table => 'nat', + chain => 'POSTROUTING', + outiface => 'eth0', + jump => 'MASQUERADE', + } + firewall { '101 redirect port 1': + table => 'nat', + chain => 'PREROUTING', + iniface => 'eth0', + proto => 'tcp', + dport => '1', + toports => '22', + jump => 'REDIRECT', + } + EOS + + # Run it twice and test for idempotency + apply_manifest(pp, :catch_failures => true) + expect(apply_manifest(pp, :catch_failures => true).exit_code).to be_zero + end + + it 'contains appropriate rules' do + shell('iptables-save') do |r| + [ + /INPUT ACCEPT/, + /FORWARD ACCEPT/, + /OUTPUT ACCEPT/, + /-A FORWARD -s 10.0.0.0\/(8|255\.0\.0\.0) -d 10.0.0.0\/(8|255\.0\.0\.0) -m comment --comment \"090 forward allow local\" -j ACCEPT/, + /-A FORWARD -s 10.0.0.0\/(8|255\.0\.0\.0) (! -d|-d !) 10.0.0.0\/(8|255\.0\.0\.0) -p icmp -m comment --comment \"100 forward standard allow icmp\" -j ACCEPT/, + /-A FORWARD -s 10.0.0.0\/(8|255\.0\.0\.0) (! -d|-d !) 10.0.0.0\/(8|255\.0\.0\.0) -p tcp -m multiport --ports 80,443,21,20,22,53,123,43,873,25,465 -m comment --comment \"100 forward standard allow tcp\" -m state --state NEW -j ACCEPT/, + /-A FORWARD -s 10.0.0.0\/(8|255\.0\.0\.0) (! -d|-d !) 10.0.0.0\/(8|255\.0\.0\.0) -p udp -m multiport --ports 53,123 -m comment --comment \"100 forward standard allow udp\" -j ACCEPT/ + ].each do |line| + expect(r.stdout).to match(line) + end + end + end +end + +describe 'complex ruleset 2' do + after :all do + shell('iptables -t filter -P INPUT ACCEPT') + shell('iptables -t filter -P FORWARD ACCEPT') + shell('iptables -t filter -P OUTPUT ACCEPT') + shell('iptables -t filter --flush') + expect(shell('iptables -t filter -X LOCAL_INPUT').stderr).to eq("") + expect(shell('iptables -t filter -X LOCAL_INPUT_PRE').stderr).to eq("") + end + + it 'applies cleanly' do + pp = <<-EOS + class { '::firewall': } + + Firewall { + proto => 'all', + stage => 'pre', + } + Firewallchain { + stage => 'pre', + purge => 'true', + ignore => [ + '--comment "[^"]*(?i:ignore)[^"]*"', + ], + } + + firewall { '001 ssh needed for beaker testing': + proto => 'tcp', + dport => '22', + action => 'accept', + before => Firewallchain['INPUT:filter:IPv4'], + } + + firewall { '010 INPUT allow established and related': + proto => 'all', + state => ['ESTABLISHED', 'RELATED'], + action => 'accept', + before => Firewallchain['INPUT:filter:IPv4'], + } + + firewall { "011 reject local traffic not on loopback interface": + iniface => '! lo', + proto => 'all', + destination => '127.0.0.1/8', + action => 'reject', + } + firewall { '012 accept loopback': + iniface => 'lo', + action => 'accept', + before => Firewallchain['INPUT:filter:IPv4'], + } + firewall { '020 ssh': + proto => 'tcp', + dport => '22', + state => 'NEW', + action => 'accept', + before => Firewallchain['INPUT:filter:IPv4'], + } + + firewall { '025 smtp': + outiface => '! eth0:2', + chain => 'OUTPUT', + proto => 'tcp', + dport => '25', + state => 'NEW', + action => 'accept', + } + firewall { '013 icmp echo-request': + proto => 'icmp', + icmp => 'echo-request', + action => 'accept', + source => '10.0.0.0/8', + } + firewall { '013 icmp destination-unreachable': + proto => 'icmp', + icmp => 'destination-unreachable', + action => 'accept', + } + firewall { '013 icmp time-exceeded': + proto => 'icmp', + icmp => 'time-exceeded', + action => 'accept', + } + firewall { '443 ssl on aliased interface': + proto => 'tcp', + dport => '443', + state => 'NEW', + action => 'accept', + iniface => 'eth0:3', + } + + firewallchain { 'LOCAL_INPUT_PRE:filter:IPv4': } + firewall { '001 LOCAL_INPUT_PRE': + jump => 'LOCAL_INPUT_PRE', + require => Firewallchain['LOCAL_INPUT_PRE:filter:IPv4'], + } + firewallchain { 'LOCAL_INPUT:filter:IPv4': } + firewall { '900 LOCAL_INPUT': + jump => 'LOCAL_INPUT', + require => Firewallchain['LOCAL_INPUT:filter:IPv4'], + } + firewallchain { 'INPUT:filter:IPv4': + policy => 'drop', + ignore => [ + '-j fail2ban-ssh', + '--comment "[^"]*(?i:ignore)[^"]*"', + ], + } + + + firewall { '010 allow established and related': + chain => 'FORWARD', + proto => 'all', + state => ['ESTABLISHED','RELATED'], + action => 'accept', + before => Firewallchain['FORWARD:filter:IPv4'], + } + firewallchain { 'FORWARD:filter:IPv4': + policy => 'drop', + } + + firewallchain { 'OUTPUT:filter:IPv4': } + + + # purge unknown rules from mangle table + firewallchain { ['PREROUTING:mangle:IPv4', 'INPUT:mangle:IPv4', 'FORWARD:mangle:IPv4', 'OUTPUT:mangle:IPv4', 'POSTROUTING:mangle:IPv4']: } + + # and the nat table + firewallchain { ['PREROUTING:nat:IPv4', 'INPUT:nat:IPv4', 'OUTPUT:nat:IPv4', 'POSTROUTING:nat:IPv4']: } + EOS + + # Run it twice and test for idempotency + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end + + it 'contains appropriate rules' do + shell('iptables-save') do |r| + [ + /INPUT DROP/, + /FORWARD DROP/, + /OUTPUT ACCEPT/, + /LOCAL_INPUT/, + /LOCAL_INPUT_PRE/, + /-A INPUT -m comment --comment \"001 LOCAL_INPUT_PRE\" -j LOCAL_INPUT_PRE/, + /-A INPUT -m comment --comment \"010 INPUT allow established and related\" -m state --state RELATED,ESTABLISHED -j ACCEPT/, + /-A INPUT -d 127.0.0.0\/(8|255\.0\.0\.0) (! -i|-i !) lo -m comment --comment \"011 reject local traffic not on loopback interface\" -j REJECT --reject-with icmp-port-unreachable/, + /-A INPUT -i lo -m comment --comment \"012 accept loopback\" -j ACCEPT/, + /-A INPUT -p icmp -m comment --comment \"013 icmp destination-unreachable\" -m icmp --icmp-type 3 -j ACCEPT/, + /-A INPUT -s 10.0.0.0\/(8|255\.0\.0\.0) -p icmp -m comment --comment \"013 icmp echo-request\" -m icmp --icmp-type 8 -j ACCEPT/, + /-A INPUT -p icmp -m comment --comment \"013 icmp time-exceeded\" -m icmp --icmp-type 11 -j ACCEPT/, + /-A INPUT -p tcp -m multiport --dports 22 -m comment --comment \"020 ssh\" -m state --state NEW -j ACCEPT/, + /-A INPUT -p tcp -m multiport --dports 22 -m comment --comment \"001 ssh needed for beaker testing\" -j ACCEPT/, + /-A OUTPUT (! -o|-o !) eth0:2 -p tcp -m multiport --dports 25 -m comment --comment \"025 smtp\" -m state --state NEW -j ACCEPT/, + /-A INPUT -i eth0:3 -p tcp -m multiport --dports 443 -m comment --comment \"443 ssl on aliased interface\" -m state --state NEW -j ACCEPT/, + /-A INPUT -m comment --comment \"900 LOCAL_INPUT\" -j LOCAL_INPUT/, + /-A FORWARD -m comment --comment \"010 allow established and related\" -m state --state RELATED,ESTABLISHED -j ACCEPT/ + ].each do |line| + expect(r.stdout).to match(line) + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/socket_spec.rb b/environments/production/modules/firewall/spec/acceptance/socket_spec.rb new file mode 100644 index 0000000..84a5361 --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/socket_spec.rb @@ -0,0 +1,98 @@ +require 'spec_helper_acceptance' + +# RHEL5 does not support -m socket +describe 'firewall socket property', :unless => default['platform'] =~ /el-5/ || fact('operatingsystem') == 'SLES' do + before :all do + iptables_flush_all_tables + ip6tables_flush_all_tables + end + + shared_examples "is idempotent" do |value, line_match| + it "changes the value to #{value}" do + pp = <<-EOS + class { '::firewall': } + firewall { '598 - test': + ensure => present, + proto => 'tcp', + chain => 'PREROUTING', + table => 'raw', + #{value} + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + + shell('iptables-save -t raw') do |r| + expect(r.stdout).to match(/#{line_match}/) + end + end + end + shared_examples "doesn't change" do |value, line_match| + it "doesn't change the value to #{value}" do + pp = <<-EOS + class { '::firewall': } + firewall { '598 - test': + ensure => present, + proto => 'tcp', + chain => 'PREROUTING', + table => 'raw', + #{value} + } + EOS + + apply_manifest(pp, :catch_changes => true) + + shell('iptables-save -t raw') do |r| + expect(r.stdout).to match(/#{line_match}/) + end + end + end + + describe 'adding a rule' do + context 'when unset' do + before :all do + iptables_flush_all_tables + end + it_behaves_like 'is idempotent', '', /-A PREROUTING -p tcp -m comment --comment "598 - test"/ + end + context 'when set to true' do + before :all do + iptables_flush_all_tables + end + it_behaves_like 'is idempotent', 'socket => true,', /-A PREROUTING -p tcp -m socket -m comment --comment "598 - test"/ + end + context 'when set to false' do + before :all do + iptables_flush_all_tables + end + it_behaves_like "is idempotent", 'socket => false,', /-A PREROUTING -p tcp -m comment --comment "598 - test"/ + end + end + describe 'editing a rule' do + context 'when unset or false' do + before :each do + iptables_flush_all_tables + shell('iptables -t raw -A PREROUTING -p tcp -m comment --comment "598 - test"') + end + context 'and current value is false' do + it_behaves_like "doesn't change", 'socket => false,', /-A PREROUTING -p tcp -m comment --comment "598 - test"/ + end + context 'and current value is true' do + it_behaves_like "is idempotent", 'socket => true,', /-A PREROUTING -p tcp -m socket -m comment --comment "598 - test"/ + end + end + context 'when set to true' do + before :each do + iptables_flush_all_tables + shell('iptables -t raw -A PREROUTING -p tcp -m socket -m comment --comment "598 - test"') + end + context 'and current value is false' do + it_behaves_like "is idempotent", 'socket => false,', /-A PREROUTING -p tcp -m comment --comment "598 - test"/ + end + context 'and current value is true' do + it_behaves_like "doesn't change", 'socket => true,', /-A PREROUTING -p tcp -m socket -m comment --comment "598 - test"/ + end + end + end +end diff --git a/environments/production/modules/firewall/spec/acceptance/standard_usage_spec.rb b/environments/production/modules/firewall/spec/acceptance/standard_usage_spec.rb new file mode 100644 index 0000000..6c54f8c --- /dev/null +++ b/environments/production/modules/firewall/spec/acceptance/standard_usage_spec.rb @@ -0,0 +1,60 @@ +require 'spec_helper_acceptance' + +# Some tests for the standard recommended usage +describe 'standard usage tests' do + it 'applies twice' do + pp = <<-EOS + class my_fw::pre { + Firewall { + require => undef, + } + + # Default firewall rules + firewall { '000 accept all icmp': + proto => 'icmp', + action => 'accept', + }-> + firewall { '001 accept all to lo interface': + proto => 'all', + iniface => 'lo', + action => 'accept', + }-> + firewall { "0002 reject local traffic not on loopback interface": + iniface => '! lo', + destination => '127.0.0.1/8', + action => 'reject', + }-> + firewall { '003 accept related established rules': + proto => 'all', + ctstate => ['RELATED', 'ESTABLISHED'], + action => 'accept', + } + } + class my_fw::post { + firewall { '999 drop all': + proto => 'all', + action => 'drop', + before => undef, + } + } + resources { "firewall": + purge => true + } + Firewall { + before => Class['my_fw::post'], + require => Class['my_fw::pre'], + } + class { ['my_fw::pre', 'my_fw::post']: } + class { 'firewall': } + firewall { '500 open up port 22': + action => 'accept', + proto => 'tcp', + dport => 22, + } + EOS + + # Run it twice and test for idempotency + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => do_catch_changes) + end +end diff --git a/environments/production/modules/firewall/spec/fixtures/ip6tables/conversion_hash.rb b/environments/production/modules/firewall/spec/fixtures/ip6tables/conversion_hash.rb new file mode 100644 index 0000000..d752378 --- /dev/null +++ b/environments/production/modules/firewall/spec/fixtures/ip6tables/conversion_hash.rb @@ -0,0 +1,117 @@ +# These hashes allow us to iterate across a series of test data +# creating rspec examples for each parameter to ensure the input :line +# extrapolates to the desired value for the parameter in question. And +# vice-versa + +# This hash is for testing a line conversion to a hash of parameters +# which will be used to create a resource. +ARGS_TO_HASH6 = { + 'source_destination_ipv6_no_cidr' => { + :line => '-A INPUT -s 2001:db8:85a3::8a2e:370:7334 -d 2001:db8:85a3::8a2e:370:7334 -m comment --comment "000 source destination ipv6 no cidr"', + :table => 'filter', + :provider => 'ip6tables', + :params => { + :source => '2001:db8:85a3::8a2e:370:7334/128', + :destination => '2001:db8:85a3::8a2e:370:7334/128', + }, + }, + 'source_destination_ipv6_netmask' => { + :line => '-A INPUT -s 2001:db8:1234::/ffff:ffff:ffff:0000:0000:0000:0000:0000 -d 2001:db8:4321::/ffff:ffff:ffff:0000:0000:0000:0000:0000 -m comment --comment "000 source destination ipv6 netmask"', + :table => 'filter', + :provider => 'ip6tables', + :params => { + :source => '2001:db8:1234::/48', + :destination => '2001:db8:4321::/48', + }, + }, + 'udp_source_port_and_destination_port' => { + :line => '-A ufw6-before-input -s fe80::/10 -d fe80::/10 -p udp -m udp --sport 547 --dport 546 -j ACCEPT', + :table => 'filter', + :provider => 'ip6tables', + :params => { + :proto => 'udp', + :sport => ['547'], + :dport => ['546'], + }, + } +} + +# This hash is for testing converting a hash to an argument line. +HASH_TO_ARGS6 = { + 'zero_prefixlen_ipv6' => { + :params => { + :name => '100 zero prefix length ipv6', + :table => 'filter', + :provider => 'ip6tables', + :source => '::/0', + :destination => '::/0', + }, + :args => ['-t', :filter, '-p', :tcp, '-m', 'comment', '--comment', '100 zero prefix length ipv6'], + }, + 'source_destination_ipv4_no_cidr' => { + :params => { + :name => '000 source destination ipv4 no cidr', + :table => 'filter', + :provider => 'ip6tables', + :source => '1.1.1.1', + :destination => '2.2.2.2', + }, + :args => ['-t', :filter, '-s', '1.1.1.1/32', '-d', '2.2.2.2/32', '-p', :tcp, '-m', 'comment', '--comment', '000 source destination ipv4 no cidr'], + }, + 'source_destination_ipv6_no_cidr' => { + :params => { + :name => '000 source destination ipv6 no cidr', + :table => 'filter', + :provider => 'ip6tables', + :source => '2001:db8:1234::', + :destination => '2001:db8:4321::', + }, + :args => ['-t', :filter, '-s', '2001:db8:1234::/128', '-d', '2001:db8:4321::/128', '-p', :tcp, '-m', 'comment', '--comment', '000 source destination ipv6 no cidr'], + }, + 'source_destination_ipv6_netmask' => { + :params => { + :name => '000 source destination ipv6 netmask', + :table => 'filter', + :provider => 'ip6tables', + :source => '2001:db8:1234::/ffff:ffff:ffff:0000:0000:0000:0000:0000', + :destination => '2001:db8:4321::/ffff:ffff:ffff:0000:0000:0000:0000:0000', + }, + :args => ['-t', :filter, '-s', '2001:db8:1234::/48', '-d', '2001:db8:4321::/48', '-p', :tcp, '-m', 'comment', '--comment', '000 source destination ipv6 netmask'], + }, + 'frag_ishasmorefrags' => { + :params => { + :name => "100 has more fragments", + :ishasmorefrags => true, + :provider => 'ip6tables', + :table => "filter", + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "frag", "--fragid", "0", "--fragmore", "-m", "comment", "--comment", "100 has more fragments"], + }, + 'frag_islastfrag' => { + :params => { + :name => "100 last fragment", + :islastfrag => true, + :provider => 'ip6tables', + :table => "filter", + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "frag", "--fragid", "0", "--fraglast", "-m", "comment", "--comment", "100 last fragment"], + }, + 'frag_isfirstfrags' => { + :params => { + :name => "100 first fragment", + :isfirstfrag => true, + :provider => 'ip6tables', + :table => "filter", + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "frag", "--fragid", "0", "--fragfirst", "-m", "comment", "--comment", "100 first fragment"], + }, + 'hop_limit' => { + :params => { + :name => "100 hop limit", + :hop_limit => 255, + :provider => 'ip6tables', + :table => "filter", + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "comment", "--comment", "100 hop limit", "-m", "hl", "--hl-eq", 255], + }, +} diff --git a/environments/production/modules/firewall/spec/fixtures/iptables/conversion_hash.rb b/environments/production/modules/firewall/spec/fixtures/iptables/conversion_hash.rb new file mode 100644 index 0000000..164f67d --- /dev/null +++ b/environments/production/modules/firewall/spec/fixtures/iptables/conversion_hash.rb @@ -0,0 +1,1278 @@ +# These hashes allow us to iterate across a series of test data +# creating rspec examples for each parameter to ensure the input :line +# extrapolates to the desired value for the parameter in question. And +# vice-versa + +# This hash is for testing a line conversion to a hash of parameters +# which will be used to create a resource. +ARGS_TO_HASH = { + 'mac_source_1' => { + :line => '-A neutron-openvswi-FORWARD -s 1.2.3.4/32 -m mac --mac-source FA:16:00:00:00:00 -j ACCEPT', + :table => 'filter', + :params => { + :chain => 'neutron-openvswi-FORWARD', + :source => '1.2.3.4/32', + :mac_source => 'FA:16:00:00:00:00', + }, + }, + 'dport_and_sport' => { + :line => '-A nova-compute-FORWARD -s 0.0.0.0/32 -d 255.255.255.255/32 -p udp -m udp --sport 68 --dport 67 -j ACCEPT', + :table => 'filter', + :params => { + :action => 'accept', + :chain => 'nova-compute-FORWARD', + :source => '0.0.0.0/32', + :destination => '255.255.255.255/32', + :sport => ['68'], + :dport => ['67'], + :proto => 'udp', + }, + }, + 'long_rule_1' => { + :line => '-A INPUT -s 1.1.1.1/32 -d 1.1.1.1/32 -p tcp -m multiport --dports 7061,7062 -m multiport --sports 7061,7062 -m comment --comment "000 allow foo" -j ACCEPT', + :table => 'filter', + :compare_all => true, + :params => { + :action => "accept", + :chain => "INPUT", + :destination => "1.1.1.1/32", + :dport => ["7061","7062"], + :ensure => :present, + :line => '-A INPUT -s 1.1.1.1/32 -d 1.1.1.1/32 -p tcp -m multiport --dports 7061,7062 -m multiport --sports 7061,7062 -m comment --comment "000 allow foo" -j ACCEPT', + :name => "000 allow foo", + :proto => "tcp", + :provider => "iptables", + :source => "1.1.1.1/32", + :sport => ["7061","7062"], + :table => "filter", + }, + }, + 'action_drop_1' => { + :line => '-A INPUT -m comment --comment "000 allow foo" -j DROP', + :table => 'filter', + :params => { + :jump => nil, + :action => "drop", + }, + }, + 'action_reject_1' => { + :line => '-A INPUT -m comment --comment "000 allow foo" -j REJECT', + :table => 'filter', + :params => { + :jump => nil, + :action => "reject", + }, + }, + 'action_nil_1' => { + :line => '-A INPUT -m comment --comment "000 allow foo"', + :table => 'filter', + :params => { + :jump => nil, + :action => nil, + }, + }, + 'jump_custom_chain_1' => { + :line => '-A INPUT -m comment --comment "000 allow foo" -j custom_chain', + :table => 'filter', + :params => { + :jump => "custom_chain", + :action => nil, + }, + }, + 'jump_goto' => { + :line => '-A w--instance-cfmhvrgpmq6 -g w--default', + :table => 'filter', + :params => { + :goto => "w--default", + :action => nil, + }, + + }, + 'source_destination_ipv4_no_cidr' => { + :line => '-A INPUT -s 1.1.1.1 -d 2.2.2.2 -m comment --comment "000 source destination ipv4 no cidr"', + :table => 'filter', + :params => { + :source => '1.1.1.1/32', + :destination => '2.2.2.2/32', + }, + }, + 'source_destination_ipv6_no_cidr' => { + :line => '-A INPUT -s 2001:db8:85a3::8a2e:370:7334 -d 2001:db8:85a3::8a2e:370:7334 -m comment --comment "000 source destination ipv6 no cidr"', + :table => 'filter', + :params => { + :source => '2001:db8:85a3::8a2e:370:7334/128', + :destination => '2001:db8:85a3::8a2e:370:7334/128', + }, + }, + 'source_destination_ipv4_netmask' => { + :line => '-A INPUT -s 1.1.1.0/255.255.255.0 -d 2.2.0.0/255.255.0.0 -m comment --comment "000 source destination ipv4 netmask"', + :table => 'filter', + :params => { + :source => '1.1.1.0/24', + :destination => '2.2.0.0/16', + }, + }, + 'source_destination_ipv6_netmask' => { + :line => '-A INPUT -s 2001:db8:1234::/ffff:ffff:ffff:0000:0000:0000:0000:0000 -d 2001:db8:4321::/ffff:ffff:ffff:0000:0000:0000:0000:0000 -m comment --comment "000 source destination ipv6 netmask"', + :table => 'filter', + :params => { + :source => '2001:db8:1234::/48', + :destination => '2001:db8:4321::/48', + }, + }, + 'source_destination_negate_source' => { + :line => '-A INPUT ! -s 1.1.1.1 -d 2.2.2.2 -m comment --comment "000 negated source address"', + :table => 'filter', + :params => { + :source => '! 1.1.1.1/32', + :destination => '2.2.2.2/32', + }, + }, + 'source_destination_negate_destination' => { + :line => '-A INPUT -s 1.1.1.1 ! -d 2.2.2.2 -m comment --comment "000 negated destination address"', + :table => 'filter', + :params => { + :source => '1.1.1.1/32', + :destination => '! 2.2.2.2/32', + }, + }, + 'source_destination_negate_destination_alternative' => { + :line => '-A INPUT -s 1.1.1.1 -d ! 2.2.2.2 -m comment --comment "000 negated destination address alternative"', + :table => 'filter', + :params => { + :source => '1.1.1.1/32', + :destination => '! 2.2.2.2/32', + }, + }, + 'dport_range_1' => { + :line => '-A INPUT -m multiport --dports 1:1024 -m comment --comment "000 allow foo"', + :table => 'filter', + :params => { + :dport => ["1-1024"], + }, + }, + 'dport_range_2' => { + :line => '-A INPUT -m multiport --dports 15,512:1024 -m comment --comment "000 allow foo"', + :table => 'filter', + :params => { + :dport => ["15","512-1024"], + }, + }, + 'sport_range_1' => { + :line => '-A INPUT -m multiport --sports 1:1024 -m comment --comment "000 allow foo"', + :table => 'filter', + :params => { + :sport => ["1-1024"], + }, + }, + 'sport_range_2' => { + :line => '-A INPUT -m multiport --sports 15,512:1024 -m comment --comment "000 allow foo"', + :table => 'filter', + :params => { + :sport => ["15","512-1024"], + }, + }, + 'dst_type_1' => { + :line => '-A INPUT -m addrtype --dst-type LOCAL', + :table => 'filter', + :params => { + :dst_type => 'LOCAL', + }, + }, + 'src_type_1' => { + :line => '-A INPUT -m addrtype --src-type LOCAL', + :table => 'filter', + :params => { + :src_type => 'LOCAL', + }, + }, + 'dst_range_1' => { + :line => '-A INPUT -m iprange --dst-range 10.0.0.2-10.0.0.20', + :table => 'filter', + :params => { + :dst_range => '10.0.0.2-10.0.0.20', + }, + }, + 'src_range_1' => { + :line => '-A INPUT -m iprange --src-range 10.0.0.2-10.0.0.20', + :table => 'filter', + :params => { + :src_range => '10.0.0.2-10.0.0.20', + }, + }, + 'tcp_flags_1' => { + :line => '-A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK,FIN SYN -m comment --comment "000 initiation"', + :table => 'filter', + :compare_all => true, + :chain => 'INPUT', + :proto => 'tcp', + :params => { + :chain => "INPUT", + :ensure => :present, + :line => '-A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK,FIN SYN -m comment --comment "000 initiation"', + :name => "000 initiation", + :proto => "tcp", + :provider => "iptables", + :table => "filter", + :tcp_flags => "SYN,RST,ACK,FIN SYN", + }, + }, + 'state_returns_sorted_values' => { + :line => '-A INPUT -m state --state INVALID,RELATED,ESTABLISHED', + :table => 'filter', + :params => { + :state => ['ESTABLISHED', 'INVALID', 'RELATED'], + :action => nil, + }, + }, + 'ctstate_returns_sorted_values' => { + :line => '-A INPUT -m conntrack --ctstate INVALID,RELATED,ESTABLISHED', + :table => 'filter', + :params => { + :ctstate => ['ESTABLISHED', 'INVALID', 'RELATED'], + :action => nil, + }, + }, + 'comment_string_character_validation' => { + :line => '-A INPUT -s 192.168.0.1/32 -m comment --comment "000 allow from 192.168.0.1, please"', + :table => 'filter', + :params => { + :source => '192.168.0.1/32', + }, + }, + 'string_escape_sequences' => { + :line => '-A INPUT -m comment --comment "000 parse escaped \\"s, \\\'s, and \\\\s"', + :table => 'filter', + :params => { + :name => '000 parse escaped "s, \'s, and \\s', + }, + }, + 'log_level_debug' => { + :line => '-A INPUT -m comment --comment "956 INPUT log-level" -m state --state NEW -j LOG --log-level 7', + :table => 'filter', + :params => { + :state => ['NEW'], + :log_level => '7', + :jump => 'LOG' + }, + }, + 'log_level_warn' => { + :line => '-A INPUT -m comment --comment "956 INPUT log-level" -m state --state NEW -j LOG', + :table => 'filter', + :params => { + :state => ['NEW'], + :log_level => '4', + :jump => 'LOG' + }, + }, + 'load_limit_module_and_implicit_burst' => { + :line => '-A INPUT -m multiport --dports 123 -m comment --comment "057 INPUT limit NTP" -m limit --limit 15/hour', + :table => 'filter', + :params => { + :dport => ['123'], + :limit => '15/hour', + :burst => '5' + }, + }, + 'limit_with_explicit_burst' => { + :line => '-A INPUT -m multiport --dports 123 -m comment --comment "057 INPUT limit NTP" -m limit --limit 30/hour --limit-burst 10', + :table => 'filter', + :params => { + :dport => ['123'], + :limit => '30/hour', + :burst => '10' + }, + }, + 'proto_ipencap' => { + :line => '-A INPUT -p ipencap -m comment --comment "0100 INPUT accept ipencap"', + :table => 'filter', + :params => { + :proto => 'ipencap', + } + }, + 'load_uid_owner_filter_module' => { + :line => '-A OUTPUT -m owner --uid-owner root -m comment --comment "057 OUTPUT uid root only" -j ACCEPT', + :table => 'filter', + :params => { + :action => 'accept', + :uid => 'root', + :chain => 'OUTPUT', + }, + }, + 'load_uid_owner_postrouting_module' => { + :line => '-t mangle -A POSTROUTING -m owner --uid-owner root -m comment --comment "057 POSTROUTING uid root only" -j ACCEPT', + :table => 'mangle', + :params => { + :action => 'accept', + :chain => 'POSTROUTING', + :uid => 'root', + }, + }, + 'load_gid_owner_filter_module' => { + :line => '-A OUTPUT -m owner --gid-owner root -m comment --comment "057 OUTPUT gid root only" -j ACCEPT', + :table => 'filter', + :params => { + :action => 'accept', + :chain => 'OUTPUT', + :gid => 'root', + }, + }, + 'load_gid_owner_postrouting_module' => { + :line => '-t mangle -A POSTROUTING -m owner --gid-owner root -m comment --comment "057 POSTROUTING gid root only" -j ACCEPT', + :table => 'mangle', + :params => { + :action => 'accept', + :chain => 'POSTROUTING', + :gid => 'root', + }, + }, + 'mark_set-mark' => { + :line => '-t mangle -A PREROUTING -j MARK --set-xmark 0x3e8/0xffffffff', + :table => 'mangle', + :params => { + :jump => 'MARK', + :chain => 'PREROUTING', + :set_mark => '0x3e8/0xffffffff', + } + }, + 'iniface_1' => { + :line => '-A INPUT -i eth0 -m comment --comment "060 iniface" -j DROP', + :table => 'filter', + :params => { + :action => 'drop', + :chain => 'INPUT', + :iniface => 'eth0', + }, + }, + 'iniface_1_negated' => { + :line => '-A INPUT ! -i eth0 -m comment --comment "060 iniface" -j DROP', + :table => 'filter', + :params => { + :action => 'drop', + :chain => 'INPUT', + :iniface => '! eth0', + }, + }, + 'iniface_1_aliased' => { + :line => '-A INPUT -i eth0:1 -m comment --comment "060 iniface" -j DROP', + :table => 'filter', + :params => { + :action => 'drop', + :chain => 'INPUT', + :iniface => 'eth0:1', + }, + }, + 'iniface_with_vlans_1' => { + :line => '-A INPUT -i eth0.234 -m comment --comment "060 iniface" -j DROP', + :table => 'filter', + :params => { + :action => 'drop', + :chain => 'INPUT', + :iniface => 'eth0.234', + }, + }, + 'iniface_with_plus_1' => { + :line => '-A INPUT -i eth+ -m comment --comment "060 iniface" -j DROP', + :table => 'filter', + :params => { + :action => 'drop', + :chain => 'INPUT', + :iniface => 'eth+', + }, + }, + 'outiface_1' => { + :line => '-A OUTPUT -o eth0 -m comment --comment "060 outiface" -j DROP', + :table => 'filter', + :params => { + :action => 'drop', + :chain => 'OUTPUT', + :outiface => 'eth0', + }, + }, + 'outiface_1_negated' => { + :line => '-A OUTPUT ! -o eth0 -m comment --comment "060 outiface" -j DROP', + :table => 'filter', + :params => { + :action => 'drop', + :chain => 'OUTPUT', + :outiface => '! eth0', + }, + }, + 'outiface_1_aliased' => { + :line => '-A OUTPUT -o eth0:2 -m comment --comment "060 outiface" -j DROP', + :table => 'filter', + :params => { + :action => 'drop', + :chain => 'OUTPUT', + :outiface => 'eth0:2', + }, + }, + 'outiface_with_vlans_1' => { + :line => '-A OUTPUT -o eth0.234 -m comment --comment "060 outiface" -j DROP', + :table => 'filter', + :params => { + :action => 'drop', + :chain => 'OUTPUT', + :outiface => 'eth0.234', + }, + }, + 'outiface_with_plus_1' => { + :line => '-A OUTPUT -o eth+ -m comment --comment "060 outiface" -j DROP', + :table => 'filter', + :params => { + :action => 'drop', + :chain => 'OUTPUT', + :outiface => 'eth+', + }, + }, + 'pkttype multicast' => { + :line => '-A INPUT -m pkttype --pkt-type multicast -j ACCEPT', + :table => 'filter', + :params => { + :action => 'accept', + :pkttype => 'multicast', + }, + }, + 'socket_option' => { + :line => '-A PREROUTING -m socket -j ACCEPT', + :table => 'mangle', + :params => { + :action => 'accept', + :chain => 'PREROUTING', + :socket => true, + }, + }, + 'isfragment_option' => { + :line => '-A INPUT -f -m comment --comment "010 a-f comment with dashf" -j ACCEPT', + :table => 'filter', + :params => { + :name => '010 a-f comment with dashf', + :action => 'accept', + :isfragment => true, + }, + }, + 'single_tcp_sport' => { + :line => '-A OUTPUT -s 10.94.100.46/32 -p tcp -m tcp --sport 20443 -j ACCEPT', + :table => 'mangle', + :params => { + :action => 'accept', + :chain => 'OUTPUT', + :source => "10.94.100.46/32", + :proto => "tcp", + :sport => ["20443"], + }, + }, + 'single_udp_sport' => { + :line => '-A OUTPUT -s 10.94.100.46/32 -p udp -m udp --sport 20443 -j ACCEPT', + :table => 'mangle', + :params => { + :action => 'accept', + :chain => 'OUTPUT', + :source => "10.94.100.46/32", + :proto => "udp", + :sport => ["20443"], + }, + }, + 'single_tcp_dport' => { + :line => '-A OUTPUT -s 10.94.100.46/32 -p tcp -m tcp --dport 20443 -j ACCEPT', + :table => 'mangle', + :params => { + :action => 'accept', + :chain => 'OUTPUT', + :source => "10.94.100.46/32", + :proto => "tcp", + :dport => ["20443"], + }, + }, + 'single_udp_dport' => { + :line => '-A OUTPUT -s 10.94.100.46/32 -p udp -m udp --dport 20443 -j ACCEPT', + :table => 'mangle', + :params => { + :action => 'accept', + :chain => 'OUTPUT', + :source => "10.94.100.46/32", + :proto => "udp", + :dport => ["20443"], + }, + }, + 'connlimit_above' => { + :line => '-A INPUT -p tcp -m multiport --dports 22 -m comment --comment "061 REJECT connlimit_above 10" -m connlimit --connlimit-above 10 --connlimit-mask 32 -j REJECT --reject-with icmp-port-unreachable', + :table => 'filter', + :params => { + :proto => 'tcp', + :dport => ["22"], + :connlimit_above => '10', + :action => 'reject', + }, + }, + 'connlimit_above_with_connlimit_mask' => { + :line => '-A INPUT -p tcp -m multiport --dports 22 -m comment --comment "061 REJECT connlimit_above 10 with mask 24" -m connlimit --connlimit-above 10 --connlimit-mask 24 -j REJECT --reject-with icmp-port-unreachable', + :table => 'filter', + :params => { + :proto => 'tcp', + :dport => ["22"], + :connlimit_above => '10', + :connlimit_mask => '24', + :action => 'reject', + }, + }, + 'connmark' => { + :line => '-A INPUT -m comment --comment "062 REJECT connmark" -m connmark --mark 0x1 -j REJECT --reject-with icmp-port-unreachable', + :table => 'filter', + :params => { + :proto => 'all', + :connmark => '0x1', + :action => 'reject', + }, + }, + 'disallow_esp_protocol' => { + :line => '-t filter ! -p esp -m comment --comment "063 disallow esp protocol" -j ACCEPT', + :table => 'filter', + :params => { + :name => '063 disallow esp protocol', + :action => 'accept', + :proto => '! esp', + }, + }, + 'drop_new_packets_without_syn' => { + :line => '-t filter ! -s 10.0.0.0/8 ! -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "064 drop NEW non-tcp external packets with FIN/RST/ACK set and SYN unset" -m state --state NEW -j DROP', + :table => 'filter', + :params => { + :name => '064 drop NEW non-tcp external packets with FIN/RST/ACK set and SYN unset', + :state => ['NEW'], + :action => 'drop', + :proto => '! tcp', + :source => '! 10.0.0.0/8', + :tcp_flags => '! FIN,SYN,RST,ACK SYN', + }, + }, + 'negate_dport_and_sport' => { + :line => '-A nova-compute-FORWARD -s 0.0.0.0/32 -d 255.255.255.255/32 -p udp -m udp ! --sport 68,69 ! --dport 67,66 -j ACCEPT', + :table => 'filter', + :params => { + :action => 'accept', + :chain => 'nova-compute-FORWARD', + :source => '0.0.0.0/32', + :destination => '255.255.255.255/32', + :sport => ['! 68','! 69'], + :dport => ['! 67','! 66'], + :proto => 'udp', + }, + }, + 'match_mark' => { + :line => '-A INPUT -p tcp -m comment --comment "066 REJECT connlimit_above 10 with mask 32 and mark matches" -m mark --mark 0x1 -m connlimit --connlimit-above 10 --connlimit-mask 32 -j REJECT --reject-with icmp-port-unreachable', + :table => 'filter', + :params => { + :proto => 'tcp', + :connlimit_above => '10', + :connlimit_mask => '32', + :match_mark => '0x1', + :action => 'reject', + }, + }, + 'clamp_mss_to_pmtu' => { + :line => '-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "067 change max segment size" -j TCPMSS --clamp-mss-to-pmtu', + :table => 'filter', + :params => { + :name => '067 change max segment size', + :table => 'filter', + :proto => 'tcp', + :tcp_flags => 'SYN,RST SYN', + :jump => 'TCPMSS', + :clamp_mss_to_pmtu => true, + }, + }, + 'mangled_chain_name_with_-f' => { + :line => '-A foo-filter -p tcp -m comment --comment "068 chain name containing -f" -j ACCEPT', + :params => { + :name => '068 chain name containing -f', + :action => 'accept', + :chain => 'foo-filter', + }, + }, + 'length_1' => { + :line => '-A INPUT -m length --length 42000', + :table => 'filter', + :params => { + :length => '42000', + }, + }, + 'length_2' => { + :line => '-A INPUT -m length --length 1492:65535', + :table => 'filter', + :params => { + :length => '1492-65535', + }, + }, + 'string_matching_1' => { + :line => '-A INPUT -m string --string "GET /index.html"', + :table => 'filter', + :params => { + :string => 'GET /index.html', + }, + }, + 'string_matching_2' => { + :line => '-A INPUT -m string --string "GET /index.html" --algo bm', + :table => 'filter', + :params => { + :string => 'GET /index.html', + :string_algo => 'bm', + }, + }, + 'string_matching_3' => { + :line => '-A INPUT -m string --string "GET /index.html" --from 1', + :table => 'filter', + :params => { + :string => 'GET /index.html', + :string_from => '1', + }, + }, + 'nfqueue_jump1' => { + :line => '-A INPUT -m tcp -p tcp -s 1.2.3.4/32 -d 4.3.2.1/32 -m comment --comment "000 nfqueue specify queue_num" -j NFQUEUE --queue-num 50', + :table => 'filter', + :params => { + :name => "000 nfqueue specify queue_num", + :source => "1.2.3.4/32", + :destination => "4.3.2.1/32", + :jump => "NFQUEUE", + :queue_num => "50", + :proto => "tcp", + }, + }, + 'nfqueue_jump2' => { + :line => '-A INPUT -m tcp -p tcp -s 1.2.3.4/32 -d 4.3.2.1/32 -m comment --comment "002 nfqueue specify queue_num and queue_bypass" -j NFQUEUE --queue-num 50 --queue-bypass', + :table => "filter", + :params => { + :name => "002 nfqueue specify queue_num and queue_bypass", + :source => "1.2.3.4/32", + :destination => "4.3.2.1/32", + :jump => "NFQUEUE", + :queue_num => "50", + :queue_bypass => true, + :proto => "tcp", + }, + }, + 'nfqueue_jump3' => { + :line => '-A INPUT -m tcp -p tcp -s 1.2.3.4/32 -d 4.3.2.1/32 -m comment --comment "003 nfqueue dont specify queue_num or queue_bypass" -j NFQUEUE', + :table => "filter", + :params => { + :name => "003 nfqueue dont specify queue_num or queue_bypass", + :source => "1.2.3.4/32", + :destination => "4.3.2.1/32", + :jump => "NFQUEUE", + :proto => "tcp", + }, + }, +} + +# This hash is for testing converting a hash to an argument line. +HASH_TO_ARGS = { + 'long_rule_1' => { + :params => { + :action => "accept", + :chain => "INPUT", + :destination => "1.1.1.1", + :dport => ["7061","7062"], + :ensure => :present, + :name => "000 allow foo", + :proto => "tcp", + :source => "1.1.1.1", + :sport => ["7061","7062"], + :table => "filter", + }, + :args => ["-t", :filter, "-s", "1.1.1.1/32", "-d", "1.1.1.1/32", "-p", :tcp, "-m", "multiport", "--sports", "7061,7062", "-m", "multiport", "--dports", "7061,7062", "-m", "comment", "--comment", "000 allow foo", "-j", "ACCEPT"], + }, + 'long_rule_2' => { + :params => { + :chain => "INPUT", + :destination => "2.10.13.3/24", + :dport => ["7061"], + :ensure => :present, + :jump => "my_custom_chain", + :name => "700 allow bar", + :proto => "udp", + :source => "1.1.1.1", + :sport => ["7061","7062"], + :table => "filter", + }, + :args => ["-t", :filter, "-s", "1.1.1.1/32", "-d", "2.10.13.0/24", "-p", :udp, "-m", "multiport", "--sports", "7061,7062", "-m", "multiport", "--dports", "7061", "-m", "comment", "--comment", "700 allow bar", "-j", "my_custom_chain"], + }, + 'no_action' => { + :params => { + :name => "100 no action", + :table => "filter", + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "comment", "--comment", + "100 no action"], + }, + 'zero_prefixlen_ipv4' => { + :params => { + :name => '100 zero prefix length ipv4', + :table => 'filter', + :source => '0.0.0.0/0', + :destination => '0.0.0.0/0', + }, + :args => ['-t', :filter, '-p', :tcp, '-m', 'comment', '--comment', '100 zero prefix length ipv4'], + }, + 'zero_prefixlen_ipv6' => { + :params => { + :name => '100 zero prefix length ipv6', + :table => 'filter', + :source => '::/0', + :destination => '::/0', + }, + :args => ['-t', :filter, '-p', :tcp, '-m', 'comment', '--comment', '100 zero prefix length ipv6'], + }, + 'source_destination_ipv4_no_cidr' => { + :params => { + :name => '000 source destination ipv4 no cidr', + :table => 'filter', + :source => '1.1.1.1', + :destination => '2.2.2.2', + }, + :args => ['-t', :filter, '-s', '1.1.1.1/32', '-d', '2.2.2.2/32', '-p', :tcp, '-m', 'comment', '--comment', '000 source destination ipv4 no cidr'], + }, + 'source_destination_ipv6_no_cidr' => { + :params => { + :name => '000 source destination ipv6 no cidr', + :table => 'filter', + :source => '2001:db8:1234::', + :destination => '2001:db8:4321::', + }, + :args => ['-t', :filter, '-s', '2001:db8:1234::/128', '-d', '2001:db8:4321::/128', '-p', :tcp, '-m', 'comment', '--comment', '000 source destination ipv6 no cidr'], + }, + 'source_destination_ipv4_netmask' => { + :params => { + :name => '000 source destination ipv4 netmask', + :table => 'filter', + :source => '1.1.1.0/255.255.255.0', + :destination => '2.2.0.0/255.255.0.0', + }, + :args => ['-t', :filter, '-s', '1.1.1.0/24', '-d', '2.2.0.0/16', '-p', :tcp, '-m', 'comment', '--comment', '000 source destination ipv4 netmask'], + }, + 'source_destination_ipv6_netmask' => { + :params => { + :name => '000 source destination ipv6 netmask', + :table => 'filter', + :source => '2001:db8:1234::/ffff:ffff:ffff:0000:0000:0000:0000:0000', + :destination => '2001:db8:4321::/ffff:ffff:ffff:0000:0000:0000:0000:0000', + }, + :args => ['-t', :filter, '-s', '2001:db8:1234::/48', '-d', '2001:db8:4321::/48', '-p', :tcp, '-m', 'comment', '--comment', '000 source destination ipv6 netmask'], + }, + 'sport_range_1' => { + :params => { + :name => "100 sport range", + :sport => ["1-1024"], + :table => "filter", + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "multiport", "--sports", "1:1024", "-m", "comment", "--comment", "100 sport range"], + }, + 'sport_range_2' => { + :params => { + :name => "100 sport range", + :sport => ["15","512-1024"], + :table => "filter", + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "multiport", "--sports", "15,512:1024", "-m", "comment", "--comment", "100 sport range"], + }, + 'dport_range_1' => { + :params => { + :name => "100 sport range", + :dport => ["1-1024"], + :table => "filter", + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "multiport", "--dports", "1:1024", "-m", "comment", "--comment", "100 sport range"], + }, + 'dport_range_2' => { + :params => { + :name => "100 sport range", + :dport => ["15","512-1024"], + :table => "filter", + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "multiport", "--dports", "15,512:1024", "-m", "comment", "--comment", "100 sport range"], + }, + 'dst_type_1' => { + :params => { + :name => '000 dst_type', + :table => 'filter', + :dst_type => 'LOCAL', + }, + :args => ['-t', :filter, '-p', :tcp, '-m', 'addrtype', '--dst-type', :LOCAL, '-m', 'comment', '--comment', '000 dst_type'], + }, + 'src_type_1' => { + :params => { + :name => '000 src_type', + :table => 'filter', + :src_type => 'LOCAL', + }, + :args => ['-t', :filter, '-p', :tcp, '-m', 'addrtype', '--src-type', :LOCAL, '-m', 'comment', '--comment', '000 src_type'], + }, + 'dst_range_1' => { + :params => { + :name => '000 dst_range', + :table => 'filter', + :dst_range => '10.0.0.1-10.0.0.10', + }, + :args => ['-t', :filter, '-p', :tcp, '-m', 'iprange', '--dst-range', '10.0.0.1-10.0.0.10', '-m', 'comment', '--comment', '000 dst_range'], + }, + 'src_range_1' => { + :params => { + :name => '000 src_range', + :table => 'filter', + :dst_range => '10.0.0.1-10.0.0.10', + }, + :args => ['-t', :filter, '-p', :tcp, '-m', 'iprange', '--dst-range', '10.0.0.1-10.0.0.10', '-m', 'comment', '--comment', '000 src_range'], + }, + 'tcp_flags_1' => { + :params => { + :name => "000 initiation", + :tcp_flags => "SYN,RST,ACK,FIN SYN", + :table => "filter", + }, + + :args => ["-t", :filter, "-p", :tcp, "-m", "tcp", "--tcp-flags", "SYN,RST,ACK,FIN", "SYN", "-m", "comment", "--comment", "000 initiation",] + }, + 'states_set_from_array' => { + :params => { + :name => "100 states_set_from_array", + :table => "filter", + :state => ['ESTABLISHED', 'INVALID'] + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "comment", "--comment", "100 states_set_from_array", + "-m", "state", "--state", "ESTABLISHED,INVALID"], + }, + 'ctstates_set_from_array' => { + :params => { + :name => "100 ctstates_set_from_array", + :table => "filter", + :ctstate => ['ESTABLISHED', 'INVALID'] + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "comment", "--comment", "100 ctstates_set_from_array", + "-m", "conntrack", "--ctstate", "ESTABLISHED,INVALID"], + }, + 'comment_string_character_validation' => { + :params => { + :name => "000 allow from 192.168.0.1, please", + :table => 'filter', + :source => '192.168.0.1' + }, + :args => ['-t', :filter, '-s', '192.168.0.1/32', '-p', :tcp, '-m', 'comment', '--comment', '000 allow from 192.168.0.1, please'], + }, + 'comment_string_character_validation_2' => { + :params => { + :name => "000 allow symbols ( $+<=>^`|~ ) in ruby >= 1.9", + :table => 'filter', + }, + :args => ['-t', :filter, '-p', :tcp, '-m', 'comment', '--comment', '000 allow symbols ( $+<=>^`|~ ) in ruby >= 1.9'], + }, + 'log_level_debug' => { + :params => { + :name => '956 INPUT log-level', + :table => 'filter', + :state => 'NEW', + :jump => 'LOG', + :log_level => 'debug' + }, + :args => ['-t', :filter, '-p', :tcp, '-m', 'comment', '--comment', '956 INPUT log-level', '-m', 'state', '--state', 'NEW', '-j', 'LOG', '--log-level', '7'], + }, + 'log_level_warn' => { + :params => { + :name => '956 INPUT log-level', + :table => 'filter', + :state => 'NEW', + :jump => 'LOG', + :log_level => 'warn' + }, + :args => ['-t', :filter, '-p', :tcp, '-m', 'comment', '--comment', '956 INPUT log-level', '-m', 'state', '--state', 'NEW', '-j', 'LOG', '--log-level', '4'], + }, + 'load_limit_module_and_implicit_burst' => { + :params => { + :name => '057 INPUT limit NTP', + :table => 'filter', + :dport => '123', + :limit => '15/hour' + }, + :args => ['-t', :filter, '-p', :tcp, '-m', 'multiport', '--dports', '123', '-m', 'comment', '--comment', '057 INPUT limit NTP', '-m', 'limit', '--limit', '15/hour'], + }, + 'limit_with_explicit_burst' => { + :params => { + :name => '057 INPUT limit NTP', + :table => 'filter', + :dport => '123', + :limit => '30/hour', + :burst => '10' + }, + :args => ['-t', :filter, '-p', :tcp, '-m', 'multiport', '--dports', '123', '-m', 'comment', '--comment', '057 INPUT limit NTP', '-m', 'limit', '--limit', '30/hour', '--limit-burst', '10'], + }, + 'proto_ipencap' => { + :params => { + :name => '0100 INPUT accept ipencap', + :table => 'filter', + :proto => 'ipencap', + }, + :args => ['-t', :filter, '-p', :ipencap, '-m', 'comment', '--comment', '0100 INPUT accept ipencap'], + }, + 'load_uid_owner_filter_module' => { + :params => { + :name => '057 OUTPUT uid root only', + :table => 'filter', + :uid => 'root', + :action => 'accept', + :chain => 'OUTPUT', + :proto => 'all', + }, + :args => ['-t', :filter, '-p', :all, '-m', 'owner', '--uid-owner', 'root', '-m', 'comment', '--comment', '057 OUTPUT uid root only', '-j', 'ACCEPT'], + }, + 'load_uid_owner_postrouting_module' => { + :params => { + :name => '057 POSTROUTING uid root only', + :table => 'mangle', + :uid => 'root', + :action => 'accept', + :chain => 'POSTROUTING', + :proto => 'all', + }, + :args => ['-t', :mangle, '-p', :all, '-m', 'owner', '--uid-owner', 'root', '-m', 'comment', '--comment', '057 POSTROUTING uid root only', '-j', 'ACCEPT'], + }, + 'load_gid_owner_filter_module' => { + :params => { + :name => '057 OUTPUT gid root only', + :table => 'filter', + :chain => 'OUTPUT', + :gid => 'root', + :action => 'accept', + :proto => 'all', + }, + :args => ['-t', :filter, '-p', :all, '-m', 'owner', '--gid-owner', 'root', '-m', 'comment', '--comment', '057 OUTPUT gid root only', '-j', 'ACCEPT'], + }, + 'load_gid_owner_postrouting_module' => { + :params => { + :name => '057 POSTROUTING gid root only', + :table => 'mangle', + :gid => 'root', + :action => 'accept', + :chain => 'POSTROUTING', + :proto => 'all', + }, + :args => ['-t', :mangle, '-p', :all, '-m', 'owner', '--gid-owner', 'root', '-m', 'comment', '--comment', '057 POSTROUTING gid root only', '-j', 'ACCEPT'], + }, + 'mark_set-mark_int' => { + :params => { + :name => '058 set-mark 1000', + :table => 'mangle', + :jump => 'MARK', + :chain => 'PREROUTING', + :set_mark => '1000', + }, + :args => ['-t', :mangle, '-p', :tcp, '-m', 'comment', '--comment', '058 set-mark 1000', '-j', 'MARK', '--set-xmark', '0x3e8/0xffffffff'], + }, + 'mark_set-mark_hex' => { + :params => { + :name => '058 set-mark 0x32', + :table => 'mangle', + :jump => 'MARK', + :chain => 'PREROUTING', + :set_mark => '0x32', + }, + :args => ['-t', :mangle, '-p', :tcp, '-m', 'comment', '--comment', '058 set-mark 0x32', '-j', 'MARK', '--set-xmark', '0x32/0xffffffff'], + }, + 'mark_set-mark_hex_with_hex_mask' => { + :params => { + :name => '058 set-mark 0x32/0xffffffff', + :table => 'mangle', + :jump => 'MARK', + :chain => 'PREROUTING', + :set_mark => '0x32/0xffffffff', + }, + :args => ['-t', :mangle, '-p', :tcp, '-m', 'comment', '--comment', '058 set-mark 0x32/0xffffffff', '-j', 'MARK', '--set-xmark', '0x32/0xffffffff'], + }, + 'mark_set-mark_hex_with_mask' => { + :params => { + :name => '058 set-mark 0x32/4', + :table => 'mangle', + :jump => 'MARK', + :chain => 'PREROUTING', + :set_mark => '0x32/4', + }, + :args => ['-t', :mangle, '-p', :tcp, '-m', 'comment', '--comment', '058 set-mark 0x32/4', '-j', 'MARK', '--set-xmark', '0x32/0x4'], + }, + 'iniface_1' => { + :params => { + :name => '060 iniface', + :table => 'filter', + :action => 'drop', + :chain => 'INPUT', + :iniface => 'eth0', + }, + :args => ["-t", :filter, "-i", "eth0", "-p", :tcp, "-m", "comment", "--comment", "060 iniface", "-j", "DROP"], + }, + 'iniface_with_vlans_1' => { + :params => { + :name => '060 iniface', + :table => 'filter', + :action => 'drop', + :chain => 'INPUT', + :iniface => 'eth0.234', + }, + :args => ["-t", :filter, "-i", "eth0.234", "-p", :tcp, "-m", "comment", "--comment", "060 iniface", "-j", "DROP"], + }, + 'iniface_with_plus_1' => { + :params => { + :name => '060 iniface', + :table => 'filter', + :action => 'drop', + :chain => 'INPUT', + :iniface => 'eth+', + }, + :args => ["-t", :filter, "-i", "eth+", "-p", :tcp, "-m", "comment", "--comment", "060 iniface", "-j", "DROP"], + }, + 'outiface_1' => { + :params => { + :name => '060 outiface', + :table => 'filter', + :action => 'drop', + :chain => 'OUTPUT', + :outiface => 'eth0', + }, + :args => ["-t", :filter, "-o", "eth0", "-p", :tcp, "-m", "comment", "--comment", "060 outiface", "-j", "DROP"], + }, + 'outiface_with_vlans_1' => { + :params => { + :name => '060 outiface', + :table => 'filter', + :action => 'drop', + :chain => 'OUTPUT', + :outiface => 'eth0.234', + }, + :args => ["-t", :filter, "-o", "eth0.234", "-p", :tcp, "-m", "comment", "--comment", "060 outiface", "-j", "DROP"], + }, + 'outiface_with_plus_1' => { + :params => { + :name => '060 outiface', + :table => 'filter', + :action => 'drop', + :chain => 'OUTPUT', + :outiface => 'eth+', + }, + :args => ["-t", :filter, "-o", "eth+", "-p", :tcp, "-m", "comment", "--comment", "060 outiface", "-j", "DROP"], + }, + 'pkttype multicast' => { + :params => { + :name => '062 pkttype multicast', + :table => "filter", + :action => 'accept', + :chain => 'INPUT', + :iniface => 'eth0', + :pkttype => 'multicast', + }, + :args => ["-t", :filter, "-i", "eth0", "-p", :tcp, "-m", "pkttype", "--pkt-type", :multicast, "-m", "comment", "--comment", "062 pkttype multicast", "-j", "ACCEPT"], + }, + 'socket_option' => { + :params => { + :name => '050 socket option', + :table => 'mangle', + :action => 'accept', + :chain => 'PREROUTING', + :socket => true, + }, + :args => ['-t', :mangle, '-p', :tcp, '-m', 'socket', '-m', 'comment', '--comment', '050 socket option', '-j', 'ACCEPT'], + }, + 'isfragment_option' => { + :params => { + :name => '050 isfragment option', + :table => 'filter', + :proto => :all, + :action => 'accept', + :isfragment => true, + }, + :args => ['-t', :filter, '-p', :all, '-f', '-m', 'comment', '--comment', '050 isfragment option', '-j', 'ACCEPT'], + }, + 'isfragment_option not changing -f in comment' => { + :params => { + :name => '050 testcomment-with-fdashf', + :table => 'filter', + :proto => :all, + :action => 'accept', + }, + :args => ['-t', :filter, '-p', :all, '-m', 'comment', '--comment', '050 testcomment-with-fdashf', '-j', 'ACCEPT'], + }, + 'connlimit_above' => { + :params => { + :name => '061 REJECT connlimit_above 10', + :table => 'filter', + :proto => 'tcp', + :dport => ["22"], + :connlimit_above => '10', + :action => 'reject', + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "multiport", "--dports", "22", "-m", "comment", "--comment", "061 REJECT connlimit_above 10", "-j", "REJECT", "-m", "connlimit", "--connlimit-above", "10"], + }, + 'connlimit_above_with_connlimit_mask' => { + :params => { + :name => '061 REJECT connlimit_above 10 with mask 24', + :table => 'filter', + :proto => 'tcp', + :dport => ["22"], + :connlimit_above => '10', + :connlimit_mask => '24', + :action => 'reject', + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "multiport", "--dports", "22", "-m", "comment", "--comment", "061 REJECT connlimit_above 10 with mask 24", "-j", "REJECT", "-m", "connlimit", "--connlimit-above", "10", "--connlimit-mask", "24"], + }, + 'connmark' => { + :params => { + :name => '062 REJECT connmark', + :table => 'filter', + :proto => 'all', + :connmark => '0x1', + :action => 'reject', + }, + :args => ["-t", :filter, "-p", :all, "-m", "comment", "--comment", "062 REJECT connmark", "-j", "REJECT", "-m", "connmark", "--mark", "0x1"], + }, + 'disallow_esp_protocol' => { + :params => { + :name => '063 disallow esp protocol', + :table => 'filter', + :action => 'accept', + :proto => '! esp', + }, + :args => ["-t", :filter, "!", "-p", :esp, "-m", "comment", "--comment", "063 disallow esp protocol", "-j", "ACCEPT"], + }, + 'drop_new_packets_without_syn' => { + :params => { + :name => '064 drop NEW non-tcp external packets with FIN/RST/ACK set and SYN unset', + :table => 'filter', + :chain => 'INPUT', + :state => ['NEW'], + :action => 'drop', + :proto => '! tcp', + :source => '! 10.0.0.0/8', + :tcp_flags => '! FIN,SYN,RST,ACK SYN', + }, + :args => ["-t", :filter, "!", "-s", "10.0.0.0/8", "!", "-p", :tcp, "-m", "tcp", "!", "--tcp-flags", "FIN,SYN,RST,ACK", "SYN", "-m", "comment", "--comment", "064 drop NEW non-tcp external packets with FIN/RST/ACK set and SYN unset", "-m", "state", "--state", "NEW", "-j", "DROP"] + }, + 'negate_dport_and_sport' => { + :params => { + :name => '065 negate dport and sport', + :table => 'filter', + :action => 'accept', + :chain => 'nova-compute-FORWARD', + :source => '0.0.0.0/32', + :destination => '255.255.255.255/32', + :sport => ['! 68','! 69'], + :dport => ['! 67','! 66'], + :proto => 'udp', + }, + :args => ["-t", :filter, "-s", "0.0.0.0/32", "-d", "255.255.255.255/32", "-p", :udp, "-m", "multiport", "!", "--sports", "68,69", "-m", "multiport", "!", "--dports", "67,66", "-m", "comment", "--comment", "065 negate dport and sport", "-j", "ACCEPT"], + }, + 'match_mark' => { + :params => { + :name => '066 REJECT connlimit_above 10 with mask 32 and mark matches', + :table => 'filter', + :proto => 'tcp', + :connlimit_above => '10', + :connlimit_mask => '32', + :match_mark => '0x1', + :action => 'reject', + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "comment", "--comment", "066 REJECT connlimit_above 10 with mask 32 and mark matches", "-j", "REJECT", "-m", "mark", "--mark", "0x1", "-m", "connlimit", "--connlimit-above", "10", "--connlimit-mask", "32"], + }, + 'clamp_mss_to_pmtu' => { + :params => { + :name => '067 change max segment size', + :table => 'filter', + :proto => 'tcp', + :tcp_flags => 'SYN,RST SYN', + :jump => 'TCPMSS', + :clamp_mss_to_pmtu => true, + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "tcp", "--tcp-flags", "SYN,RST", "SYN", "-m", "comment", "--comment", "067 change max segment size", "-j", "TCPMSS", "--clamp-mss-to-pmtu"], + }, + 'set_dscp_class' => { + :params => { + :name => '068 set dscp class to EF', + :table => 'mangle', + :proto => 'tcp', + :port => '997', + :jump => 'DSCP', + :set_dscp_class => 'ef', + }, + :args => ["-t", :mangle, "-p", :tcp, "-m", "multiport", '--ports', '997', "-m", "comment", "--comment", "068 set dscp class to EF", "-j", "DSCP", "--set-dscp-class", "ef"], + }, + 'length_1' => { + :params => { + :name => '000 length', + :table => 'filter', + :length => '42000', + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "comment", "--comment", "000 length", "-m", "length", "--length", "42000"], + }, + 'length_2' => { + :params => { + :name => '000 length', + :table => 'filter', + :length => '1492-65535', + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "comment", "--comment", "000 length", "-m", "length", "--length", "1492:65535"], + }, + 'string_matching_1' => { + :params => { + :name => '000 string_matching', + :table => 'filter', + :string => 'GET /index.html', + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "comment", "--comment", "000 string_matching", "-m", "string", "--string", "'GET /index.html'"], + }, + 'string_matching_2' => { + :params => { + :name => '000 string_matching', + :table => 'filter', + :string => 'GET /index.html', + :string_algo => 'bm', + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "comment", "--comment", "000 string_matching", "-m", "string", "--string", "'GET /index.html'", "--algo", :bm], + }, + 'string_matching_3' => { + :params => { + :name => '000 string_matching', + :table => 'filter', + :string => 'GET /index.html', + :string_from => '1', + :string_to => '65535', + }, + :args => ["-t", :filter, "-p", :tcp, "-m", "comment", "--comment", "000 string_matching", "-m", "string", "--string", "'GET /index.html'", "--from", "1", "--to", "65535"], + }, + 'nfqueue_jump1' => { + :params => { + :name => '000 nfqueue specify queue_num', + :table => 'filter', + :jump => 'NFQUEUE', + :source => "1.2.3.4/32", + :destination => "4.3.2.1/32", + :queue_num => "50", + }, + :args => ["-t", :filter, "-s", "1.2.3.4/32", "-d", "4.3.2.1/32", "-p", :tcp, "-m", "comment", "--comment", "000 nfqueue specify queue_num", "-j", "NFQUEUE", "--queue-num", "50"] + }, + 'nfqueue_jump2' => { + :params => { + :name => '002 nfqueue specify queue_num and queue_bypass', + :table => 'filter', + :jump => "NFQUEUE", + :source => '1.2.3.4/32', + :destination => '4.3.2.1/32', + :queue_num => "50", + :queue_bypass => true, + }, + :args => ["-t", :filter, "-s", "1.2.3.4/32", "-d", "4.3.2.1/32", "-p", :tcp, "-m", "comment", "--comment", "002 nfqueue specify queue_num and queue_bypass", "-j", "NFQUEUE", "--queue-num", "50", "--queue-bypass"] + }, + 'nfqueue_jump3' => { + :params => { + :name => '003 nfqueue dont specify queue_num or queue_bypass', + :table => 'filter', + :jump => "NFQUEUE", + :source => '1.2.3.4/32', + :destination => '4.3.2.1/32', + }, + :args => ["-t", :filter, "-s", "1.2.3.4/32", "-d", "4.3.2.1/32", "-p", :tcp, "-m", "comment", "--comment", "003 nfqueue dont specify queue_num or queue_bypass", "-j", "NFQUEUE"] + } +} \ No newline at end of file diff --git a/environments/production/modules/firewall/spec/spec_helper.rb b/environments/production/modules/firewall/spec/spec_helper.rb new file mode 100644 index 0000000..9ae37b1 --- /dev/null +++ b/environments/production/modules/firewall/spec/spec_helper.rb @@ -0,0 +1,16 @@ +#This file is generated by ModuleSync, do not edit. +require 'puppetlabs_spec_helper/module_spec_helper' + +if Puppet.version.to_f >= 4.5 + RSpec.configure do |c| + c.before :each do + Puppet.settings[:strict] = :error + end + end +end + +# put local configuration and setup into spec_helper_local +begin + require 'spec_helper_local' +rescue LoadError +end diff --git a/environments/production/modules/firewall/spec/spec_helper_acceptance.rb b/environments/production/modules/firewall/spec/spec_helper_acceptance.rb new file mode 100644 index 0000000..bc0506f --- /dev/null +++ b/environments/production/modules/firewall/spec/spec_helper_acceptance.rb @@ -0,0 +1,41 @@ +require 'beaker-rspec' +require 'beaker/puppet_install_helper' + +def iptables_flush_all_tables + ['filter', 'nat', 'mangle', 'raw'].each do |t| + expect(shell("iptables -t #{t} -F").stderr).to eq("") + end +end + +def ip6tables_flush_all_tables + ['filter', 'mangle'].each do |t| + expect(shell("ip6tables -t #{t} -F").stderr).to eq("") + end +end + +def do_catch_changes + if default['platform'] =~ /el-5/ + return false + else + return true + end +end + +run_puppet_install_helper + +RSpec.configure do |c| + # Project root + proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..')) + + # Configure all nodes in nodeset + c.before :suite do + # Install module and dependencies + hosts.each do |host| + copy_module_to(host, :source => proj_root, :module_name => 'firewall') + on host, puppet('module install puppetlabs-stdlib --version 3.2.0') + + # the ubuntu-14.04 docker image doesn't carry the iptables command + apply_manifest_on host, 'package { "iptables": ensure => installed }' if fact('osfamily') == 'Debian' + end + end +end diff --git a/environments/production/modules/firewall/spec/spec_helper_local.rb b/environments/production/modules/firewall/spec/spec_helper_local.rb new file mode 100644 index 0000000..6af3d0b --- /dev/null +++ b/environments/production/modules/firewall/spec/spec_helper_local.rb @@ -0,0 +1,14 @@ +RSpec.configure do |config| + config.mock_with :rspec +end + +def with_debian_facts + let :facts do + { + :kernel => 'Linux', + :operatingsystem => 'Debian', + :operatingsystemrelease => '8.0', + :osfamily => 'Debian', + } + end +end diff --git a/environments/production/modules/firewall/spec/unit/classes/firewall_linux_archlinux_spec.rb b/environments/production/modules/firewall/spec/unit/classes/firewall_linux_archlinux_spec.rb new file mode 100644 index 0000000..36dc925 --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/classes/firewall_linux_archlinux_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'firewall::linux::archlinux', :type => :class do + let(:facts) do + { + :osfamily => 'Archlinux', + :operatingsystem => 'Archlinux' + } + end + it { should contain_service('iptables').with( + :ensure => 'running', + :enable => 'true' + )} + it { should contain_service('ip6tables').with( + :ensure => 'running', + :enable => 'true' + )} + + context 'ensure => stopped' do + let(:params) {{ :ensure => 'stopped' }} + it { should contain_service('iptables').with( + :ensure => 'stopped' + )} + it { should contain_service('ip6tables').with( + :ensure => 'stopped' + )} + end + + context 'enable => false' do + let(:params) {{ :enable => 'false' }} + it { should contain_service('iptables').with( + :enable => 'false' + )} + it { should contain_service('ip6tables').with( + :enable => 'false' + )} + end +end diff --git a/environments/production/modules/firewall/spec/unit/classes/firewall_linux_debian_spec.rb b/environments/production/modules/firewall/spec/unit/classes/firewall_linux_debian_spec.rb new file mode 100644 index 0000000..e8af543 --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/classes/firewall_linux_debian_spec.rb @@ -0,0 +1,87 @@ +require 'spec_helper' + +describe 'firewall::linux::debian', :type => :class do + context "Debian 7" do + let(:facts) {{ + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '7.0' + }} + it { should contain_package('iptables-persistent').with( + :ensure => 'present' + )} + it { should contain_service('iptables-persistent').with( + :ensure => nil, + :enable => 'true', + :require => 'Package[iptables-persistent]' + )} + end + + context 'deb7 enable => false' do + let(:facts) {{ + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '7.0' + }} + let(:params) {{ :enable => 'false' }} + it { should contain_service('iptables-persistent').with( + :enable => 'false' + )} + end + + context "Debian 8" do + let(:facts) {{ + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => 'jessie/sid' + }} + it { should contain_package('iptables-persistent').with( + :ensure => 'present' + )} + it { should contain_service('netfilter-persistent').with( + :ensure => nil, + :enable => 'true', + :require => 'Package[iptables-persistent]' + )} + end + + context 'deb8 enable => false' do + let(:facts) {{ + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => 'jessie/sid' + }} + let(:params) {{ :enable => 'false' }} + it { should contain_service('netfilter-persistent').with( + :enable => 'false' + )} + end + + context "Debian 8, alt operatingsystem" do + let(:facts) {{ + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '8.0' + }} + it { should contain_package('iptables-persistent').with( + :ensure => 'present' + )} + it { should contain_service('netfilter-persistent').with( + :ensure => nil, + :enable => 'true', + :require => 'Package[iptables-persistent]' + )} + end + + context 'deb8, alt operatingsystem, enable => false' do + let(:facts) {{ + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '8.0' + }} + let(:params) {{ :enable => 'false' }} + it { should contain_service('netfilter-persistent').with( + :enable => 'false' + )} + end +end diff --git a/environments/production/modules/firewall/spec/unit/classes/firewall_linux_gentoo_spec.rb b/environments/production/modules/firewall/spec/unit/classes/firewall_linux_gentoo_spec.rb new file mode 100644 index 0000000..942d8e4 --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/classes/firewall_linux_gentoo_spec.rb @@ -0,0 +1,41 @@ +require 'spec_helper' + +describe 'firewall::linux::gentoo', :type => :class do + let(:facts) do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo' + } + end + it { should contain_service('iptables').with( + :ensure => 'running', + :enable => 'true' + )} + it { should contain_service('ip6tables').with( + :ensure => 'running', + :enable => 'true' + )} + it { should contain_package('net-firewall/iptables').with( + :ensure => 'present' + )} + + context 'ensure => stopped' do + let(:params) {{ :ensure => 'stopped' }} + it { should contain_service('iptables').with( + :ensure => 'stopped' + )} + it { should contain_service('ip6tables').with( + :ensure => 'stopped' + )} + end + + context 'enable => false' do + let(:params) {{ :enable => 'false' }} + it { should contain_service('iptables').with( + :enable => 'false' + )} + it { should contain_service('ip6tables').with( + :enable => 'false' + )} + end +end diff --git a/environments/production/modules/firewall/spec/unit/classes/firewall_linux_redhat_spec.rb b/environments/production/modules/firewall/spec/unit/classes/firewall_linux_redhat_spec.rb new file mode 100644 index 0000000..90dbcd5 --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/classes/firewall_linux_redhat_spec.rb @@ -0,0 +1,102 @@ +require 'spec_helper' + +RSpec.shared_examples "ensures iptables service" do + context 'default' do + it { should contain_service('iptables').with( + :ensure => 'running', + :enable => 'true' + )} + end + + context 'ensure => stopped' do + let(:params) {{ :ensure => 'stopped' }} + it { should contain_service('iptables').with( + :ensure => 'stopped' + )} + end + + context 'enable => false' do + let(:params) {{ :enable => 'false' }} + it { should contain_service('iptables').with( + :enable => 'false' + )} + end +end + +describe 'firewall::linux::redhat', :type => :class do + %w{RedHat CentOS Fedora}.each do |os| + oldreleases = (os == 'Fedora' ? ['14'] : ['6.5']) + newreleases = (os == 'Fedora' ? ['15','Rawhide'] : ['7.0.1406']) + + oldreleases.each do |osrel| + context "os #{os} and osrel #{osrel}" do + let(:facts) {{ + :operatingsystem => os, + :operatingsystemrelease => osrel, + :osfamily => 'RedHat', + :selinux => false, + :puppetversion => Puppet.version, + }} + + it { should_not contain_service('firewalld') } + it { should_not contain_package('iptables-services') } + + it_behaves_like "ensures iptables service" + end + end + + newreleases.each do |osrel| + context "os #{os} and osrel #{osrel}" do + let(:facts) {{ + :operatingsystem => os, + :operatingsystemrelease => osrel, + :osfamily => 'RedHat', + :selinux => false, + :puppetversion => Puppet.version, + }} + + it { should contain_service('iptables').with( + :ensure => 'running', + :enable => 'true' + )} + it { should contain_service('ip6tables').with( + :ensure => 'running', + :enable => 'true' + )} + + context 'ensure => stopped' do + let(:params) {{ :ensure => 'stopped' }} + it { should contain_service('iptables').with( + :ensure => 'stopped' + )} + it { should contain_service('ip6tables').with( + :ensure => 'stopped' + )} + end + + context 'enable => false' do + let(:params) {{ :enable => 'false' }} + it { should contain_service('iptables').with( + :enable => 'false' + )} + it { should contain_service('ip6tables').with( + :enable => 'false' + )} + end + + it { should contain_service('firewalld').with( + :ensure => 'stopped', + :enable => false, + :before => 'Package[iptables-services]' + )} + + it { should contain_package('iptables-services').with( + :ensure => 'present', + :before => 'Service[iptables]' + )} + + it_behaves_like "ensures iptables service" + end + end + end +end diff --git a/environments/production/modules/firewall/spec/unit/classes/firewall_linux_spec.rb b/environments/production/modules/firewall/spec/unit/classes/firewall_linux_spec.rb new file mode 100644 index 0000000..b045801 --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/classes/firewall_linux_spec.rb @@ -0,0 +1,46 @@ +require 'spec_helper' + +describe 'firewall::linux', :type => :class do + context 'RedHat like' do + %w{RedHat CentOS Fedora}.each do |os| + context "operatingsystem => #{os}" do + releases = (os == 'Fedora' ? ['14','15','Rawhide'] : ['6','7']) + releases.each do |osrel| + context "operatingsystemrelease => #{osrel}" do + let(:facts) {{ + :kernel => 'Linux', + :operatingsystem => os, + :operatingsystemrelease => osrel, + :osfamily => 'RedHat', + :selinux => false, + :puppetversion => Puppet.version, + }} + it { should contain_class('firewall::linux::redhat').with_require('Package[iptables]') } + it { should contain_package('iptables').with_ensure('present') } + end + end + end + end + end + + context 'Debian like' do + %w{Debian Ubuntu}.each do |os| + context "operatingsystem => #{os}" do + releases = (os == 'Debian' ? ['6','7','8'] : ['10.04','12.04','14.04']) + releases.each do |osrel| + let(:facts) {{ + :kernel => 'Linux', + :operatingsystem => os, + :operatingsystemrelease => osrel, + :osfamily => 'Debian', + :selinux => false, + :puppetversion => Puppet.version, + }} + + it { should contain_class('firewall::linux::debian').with_require('Package[iptables]') } + it { should contain_package('iptables').with_ensure('present') } + end + end + end + end +end diff --git a/environments/production/modules/firewall/spec/unit/classes/firewall_spec.rb b/environments/production/modules/firewall/spec/unit/classes/firewall_spec.rb new file mode 100644 index 0000000..7c9f714 --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/classes/firewall_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'firewall', :type => :class do + context 'kernel => Linux' do + with_debian_facts + it { should contain_class('firewall::linux').with_ensure('running') } + end + + context 'kernel => Windows' do + let(:facts) {{ :kernel => 'Windows' }} + it { expect { should contain_class('firewall::linux') }.to raise_error(Puppet::Error) } + end + + context 'kernel => SunOS' do + let(:facts) {{ :kernel => 'SunOS' }} + it { expect { should contain_class('firewall::linux') }.to raise_error(Puppet::Error) } + end + + context 'kernel => Darwin' do + let(:facts) {{ :kernel => 'Darwin' }} + it { expect { should contain_class('firewall::linux') }.to raise_error(Puppet::Error) } + end + + context 'ensure => stopped' do + with_debian_facts + let(:params) {{ :ensure => 'stopped' }} + it { should contain_class('firewall::linux').with_ensure('stopped') } + end + + context 'ensure => test' do + let(:facts) {{ :kernel => 'Linux' }} + let(:params) {{ :ensure => 'test' }} + it { expect { should contain_class('firewall::linux') }.to raise_error(Puppet::Error) } + end +end diff --git a/environments/production/modules/firewall/spec/unit/facter/iptables_persistent_version_spec.rb b/environments/production/modules/firewall/spec/unit/facter/iptables_persistent_version_spec.rb new file mode 100644 index 0000000..656e904 --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/facter/iptables_persistent_version_spec.rb @@ -0,0 +1,97 @@ +require 'spec_helper' + +describe "Facter::Util::Fact iptables_persistent_version" do + + + context "iptables-persistent applicable" do + before { Facter.clear } + + let(:dpkg_cmd) { "dpkg-query -Wf '${Version}' iptables-persistent 2>/dev/null" } + + { + "Debian" => "0.0.20090701", + "Ubuntu" => "0.5.3ubuntu2", + }.each do |os, ver| + + if os == "Debian" + os_release = "7.0" + elsif os == "Ubuntu" + os_release = "14.04" + end + + describe "#{os} package installed" do + before { + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return(os) + allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return(os_release) + allow(Facter::Util::Resolution).to receive(:exec).with(dpkg_cmd). + and_return(ver) + } + it { expect(Facter.fact(:iptables_persistent_version).value).to eql ver } + end + end + + describe 'Ubuntu package not installed' do + before { + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Ubuntu') + allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return('14.04') + allow(Facter::Util::Resolution).to receive(:exec).with(dpkg_cmd). + and_return(nil) + } + it { expect(Facter.fact(:iptables_persistent_version).value).to be_nil } + end + + describe 'CentOS not supported' do + before { allow(Facter.fact(:operatingsystem)).to receive(:value). + and_return("CentOS") } + it { expect(Facter.fact(:iptables_persistent_version).value).to be_nil } + end + + end + + context "netfilter-persistent applicable" do + before { Facter.clear } + + let(:dpkg_cmd) { "dpkg-query -Wf '${Version}' netfilter-persistent 2>/dev/null" } + + { + "Debian" => "0.0.20090701", + "Ubuntu" => "0.5.3ubuntu2", + }.each do |os, ver| + + if os == "Debian" + os_release = "8.0" + elsif os == "Ubuntu" + os_release = "14.10" + end + + describe "#{os} package installed" do + before { + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return(os) + allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return(os_release) + allow(Facter::Util::Resolution).to receive(:exec).with(dpkg_cmd). + and_return(ver) + } + it { expect(Facter.fact(:iptables_persistent_version).value).to eql ver } + end + end + + describe 'Ubuntu package not installed' do + os_release = "14.10" + before { + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Ubuntu') + allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return(os_release) + allow(Facter::Util::Resolution).to receive(:exec).with(dpkg_cmd). + and_return(nil) + } + it { expect(Facter.fact(:iptables_persistent_version).value).to be_nil } + end + + describe 'CentOS not supported' do + before { allow(Facter.fact(:operatingsystem)).to receive(:value). + and_return("CentOS") } + it { expect(Facter.fact(:iptables_persistent_version).value).to be_nil } + end + + end + +end diff --git a/environments/production/modules/firewall/spec/unit/facter/iptables_spec.rb b/environments/production/modules/firewall/spec/unit/facter/iptables_spec.rb new file mode 100644 index 0000000..c17816c --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/facter/iptables_spec.rb @@ -0,0 +1,23 @@ +require 'spec_helper' + +describe "Facter::Util::Fact" do + before { + Facter.clear + allow(Facter.fact(:kernel)).to receive(:value).and_return('Linux') + allow(Facter.fact(:kernelrelease)).to receive(:value).and_return('2.6') + } + + describe 'iptables_version' do + it { + allow(Facter::Util::Resolution).to receive(:exec).with('iptables --version'). + and_return('iptables v1.4.7') + expect(Facter.fact(:iptables_version).value).to eql '1.4.7' + } + end + + describe 'ip6tables_version' do + before { allow(Facter::Util::Resolution).to receive(:exec). + with('ip6tables --version').and_return('ip6tables v1.4.7') } + it { expect(Facter.fact(:ip6tables_version).value).to eql '1.4.7' } + end +end diff --git a/environments/production/modules/firewall/spec/unit/puppet/provider/ip6tables_spec.rb b/environments/production/modules/firewall/spec/unit/puppet/provider/ip6tables_spec.rb new file mode 100644 index 0000000..058c90b --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/puppet/provider/ip6tables_spec.rb @@ -0,0 +1,61 @@ +#!/usr/bin/env rspec + +require 'spec_helper' +if Puppet.version < '3.4.0' + require 'puppet/provider/confine/exists' +else + require 'puppet/confine/exists' +end +provider_class = Puppet::Type.type(:firewall).provider(:ip6tables) +describe 'ip6tables' do + let(:params) { {:name => '000 test foo', :action => 'accept'} } + let(:provider) { provider_class } + let(:resource) { Puppet::Type.type(:firewall) } + let(:ip6tables_version) { '1.4.0' } + + before :each do + + end + + def stub_iptables + allow(Puppet::Type::Firewall).to receive(:defaultprovider).and_return provider + # Stub confine facts + allow(provider).to receive(:command).with(:iptables_save).and_return "/sbin/iptables-save" + + allow(Facter.fact(:kernel)).to receive(:value).and_return('Linux') + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Debian') + allow(Facter.fact('ip6tables_version')).to receive(:value).and_return(ip6tables_version) + allow(Puppet::Util::Execution).to receive(:execute).and_return "" + allow(Puppet::Util).to receive(:which).with("iptables-save"). + and_return "/sbin/iptables-save" + end + + shared_examples 'raise error' do + it { + stub_iptables + expect { + provider.new(resource.new(params)) + }.to raise_error(Puppet::DevError, error_message) + } + end + shared_examples 'run' do + it { + stub_iptables + provider.new(resource.new(params)) + } + end + context 'iptables 1.3' do + let(:params) { {:name => '000 test foo', :action => 'accept'} } + let(:error_message) { /The ip6tables provider is not supported on version 1\.3 of iptables/ } + let(:ip6tables_version) { '1.3.10' } + it_should_behave_like 'raise error' + end + context 'ip6tables nil' do + let(:params) { {:name => '000 test foo', :action => 'accept'} } + let(:error_message) { /The ip6tables provider is not supported on version 1\.3 of iptables/ } + let(:ip6tables_version) { nil } + it_should_behave_like 'run' + end + + +end diff --git a/environments/production/modules/firewall/spec/unit/puppet/provider/iptables_chain_spec.rb b/environments/production/modules/firewall/spec/unit/puppet/provider/iptables_chain_spec.rb new file mode 100755 index 0000000..d8eade2 --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/puppet/provider/iptables_chain_spec.rb @@ -0,0 +1,237 @@ +#!/usr/bin/env rspec + +require 'spec_helper' +if Puppet.version < '3.4.0' + require 'puppet/provider/confine/exists' +else + require 'puppet/confine/exists' +end + +describe 'iptables chain provider detection' do + if Puppet.version < '3.4.0' + let(:exists) { + Puppet::Provider::Confine::Exists + } + else + let(:exists) { + Puppet::Confine::Exists + } + end + + before :each do + # Reset the default provider + Puppet::Type.type(:firewallchain).defaultprovider = nil + + # Stub confine facts + allow(Facter.fact(:kernel)).to receive(:value).and_return('Linux') + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Debian') + end + + it "should default to iptables provider if /sbin/(eb|ip|ip6)tables[-save] exists" do + # Stub lookup for /sbin/iptables & /sbin/iptables-save + allow(exists).to receive(:which).with("ebtables"). + and_return "/sbin/ebtables" + allow(exists).to receive(:which).with("ebtables-save"). + and_return "/sbin/ebtables-save" + + allow(exists).to receive(:which).with("iptables"). + and_return "/sbin/iptables" + allow(exists).to receive(:which).with("iptables-save"). + and_return "/sbin/iptables-save" + + allow(exists).to receive(:which).with("ip6tables"). + and_return "/sbin/ip6tables" + allow(exists).to receive(:which).with("ip6tables-save"). + and_return "/sbin/ip6tables-save" + + # Every other command should return false so we don't pick up any + # other providers + allow(exists).to receive(:which) { |value| + value !~ /(eb|ip|ip6)tables(-save)?$/ + }.and_return false + + # Create a resource instance and make sure the provider is iptables + resource = Puppet::Type.type(:firewallchain).new({ + :name => 'test:filter:IPv4', + }) + expect(resource.provider.class.to_s).to eq("Puppet::Type::Firewallchain::ProviderIptables_chain") + end +end + +describe 'iptables chain provider' do + let(:provider) { Puppet::Type.type(:firewallchain).provider(:iptables_chain) } + let(:resource) { + Puppet::Type.type(:firewallchain).new({ + :name => ':test:', + }) + } + + before :each do + allow(Puppet::Type::Firewallchain).to receive(:defaultprovider).and_return provider + allow(provider).to receive(:command).with(:ebtables_save).and_return "/sbin/ebtables-save" + allow(provider).to receive(:command).with(:iptables_save).and_return "/sbin/iptables-save" + allow(provider).to receive(:command).with(:ip6tables_save).and_return "/sbin/ip6tables-save" + end + + it 'should be able to get a list of existing rules' do + # Pretend to return nil from iptables + allow(provider).to receive(:execute).with(['/sbin/ip6tables-save']).and_return("") + allow(provider).to receive(:execute).with(['/sbin/ebtables-save']).and_return("") + allow(provider).to receive(:execute).with(['/sbin/iptables-save']).and_return("") + + provider.instances.each do |chain| + expect(chain).to be_instance_of(provider) + expect(chain.properties[:provider].to_s).to eq(provider.name.to_s) + end + end + +end + +describe 'iptables chain resource parsing' do + let(:provider) { Puppet::Type.type(:firewallchain).provider(:iptables_chain) } + + before :each do + ebtables = ['BROUTE:BROUTING:ethernet', + 'BROUTE:broute:ethernet', + ':INPUT:ethernet', + ':FORWARD:ethernet', + ':OUTPUT:ethernet', + ':filter:ethernet', + ':filterdrop:ethernet', + ':filterreturn:ethernet', + 'NAT:PREROUTING:ethernet', + 'NAT:OUTPUT:ethernet', + 'NAT:POSTROUTING:ethernet', + ] + allow(provider).to receive(:execute).with(['/sbin/ebtables-save']).and_return(' +*broute +:BROUTING ACCEPT +:broute ACCEPT + +*filter +:INPUT ACCEPT +:FORWARD ACCEPT +:OUTPUT ACCEPT +:filter ACCEPT +:filterdrop DROP +:filterreturn RETURN + +*nat +:PREROUTING ACCEPT +:OUTPUT ACCEPT +:POSTROUTING ACCEPT +') + + iptables = [ + 'raw:PREROUTING:IPv4', + 'raw:OUTPUT:IPv4', + 'raw:raw:IPv4', + 'mangle:PREROUTING:IPv4', + 'mangle:INPUT:IPv4', + 'mangle:FORWARD:IPv4', + 'mangle:OUTPUT:IPv4', + 'mangle:POSTROUTING:IPv4', + 'mangle:mangle:IPv4', + 'NAT:PREROUTING:IPv4', + 'NAT:OUTPUT:IPv4', + 'NAT:POSTROUTING:IPv4', + 'NAT:mangle:IPv4', + 'NAT:mangle:IPv4', + 'NAT:mangle:IPv4', + 'security:INPUT:IPv4', + 'security:FORWARD:IPv4', + 'security:OUTPUT:IPv4', + ':$5()*&%\'"^$): :IPv4', + ] + allow(provider).to receive(:execute).with(['/sbin/iptables-save']).and_return(' +# Generated by iptables-save v1.4.9 on Mon Jan 2 01:20:06 2012 +*raw +:PREROUTING ACCEPT [12:1780] +:OUTPUT ACCEPT [19:1159] +:raw - [0:0] +COMMIT +# Completed on Mon Jan 2 01:20:06 2012 +# Generated by iptables-save v1.4.9 on Mon Jan 2 01:20:06 2012 +*mangle +:PREROUTING ACCEPT [12:1780] +:INPUT ACCEPT [12:1780] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [19:1159] +:POSTROUTING ACCEPT [19:1159] +:mangle - [0:0] +COMMIT +# Completed on Mon Jan 2 01:20:06 2012 +# Generated by iptables-save v1.4.9 on Mon Jan 2 01:20:06 2012 +*nat +:PREROUTING ACCEPT [2242:639750] +:OUTPUT ACCEPT [5176:326206] +:POSTROUTING ACCEPT [5162:325382] +COMMIT +# Completed on Mon Jan 2 01:20:06 2012 +# Generated by iptables-save v1.4.9 on Mon Jan 2 01:20:06 2012 +*filter +:INPUT ACCEPT [0:0] +:FORWARD DROP [0:0] +:OUTPUT ACCEPT [5673:420879] +:$5()*&%\'"^$): - [0:0] +COMMIT +# Completed on Mon Jan 2 01:20:06 2012 +') + ip6tables = [ + 'raw:PREROUTING:IPv6', + 'raw:OUTPUT:IPv6', + 'raw:ff:IPv6', + 'mangle:PREROUTING:IPv6', + 'mangle:INPUT:IPv6', + 'mangle:FORWARD:IPv6', + 'mangle:OUTPUT:IPv6', + 'mangle:POSTROUTING:IPv6', + 'mangle:ff:IPv6', + 'security:INPUT:IPv6', + 'security:FORWARD:IPv6', + 'security:OUTPUT:IPv6', + ':INPUT:IPv6', + ':FORWARD:IPv6', + ':OUTPUT:IPv6', + ':test:IPv6', + ] + allow(provider).to receive(:execute).with(['/sbin/ip6tables-save']).and_return(' +# Generated by ip6tables-save v1.4.9 on Mon Jan 2 01:31:39 2012 +*raw +:PREROUTING ACCEPT [2173:489241] +:OUTPUT ACCEPT [0:0] +:ff - [0:0] +COMMIT +# Completed on Mon Jan 2 01:31:39 2012 +# Generated by ip6tables-save v1.4.9 on Mon Jan 2 01:31:39 2012 +*mangle +:PREROUTING ACCEPT [2301:518373] +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:ff - [0:0] +COMMIT +# Completed on Mon Jan 2 01:31:39 2012 +# Generated by ip6tables-save v1.4.9 on Mon Jan 2 01:31:39 2012 +*filter +:INPUT ACCEPT [0:0] +:FORWARD DROP [0:0] +:OUTPUT ACCEPT [20:1292] +:test - [0:0] +COMMIT +# Completed on Mon Jan 2 01:31:39 2012 +') + @all = ebtables + iptables + ip6tables + # IPv4 and IPv6 names also exist as resources {table}:{chain}:IP and {table}:{chain}: + iptables.each { |name| @all += [ name[0..-3], name[0..-5] ] } + ip6tables.each { |name| @all += [ name[0..-3], name[0..-5] ] } + end + + it 'should have all in parsed resources' do + provider.instances.each do |resource| + @all.include?(resource.name) + end + end + +end diff --git a/environments/production/modules/firewall/spec/unit/puppet/provider/iptables_spec.rb b/environments/production/modules/firewall/spec/unit/puppet/provider/iptables_spec.rb new file mode 100644 index 0000000..f9316d9 --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/puppet/provider/iptables_spec.rb @@ -0,0 +1,433 @@ +#!/usr/bin/env rspec + +require 'spec_helper' +if Puppet.version < '3.4.0' + require 'puppet/provider/confine/exists' +else + require 'puppet/confine/exists' +end + +describe 'iptables provider detection' do + if Puppet.version < '3.4.0' + let(:exists) { + Puppet::Provider::Confine::Exists + } + else + let(:exists) { + Puppet::Confine::Exists + } + end + + before :each do + # Reset the default provider + Puppet::Type.type(:firewall).defaultprovider = nil + + # Stub confine facts + allow(Facter.fact(:kernel)).to receive(:value).and_return('Linux') + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Debian') + end + + it "is expected to default to iptables provider if /sbin/iptables[-save] exists" do + # Stub lookup for /sbin/iptables & /sbin/iptables-save + allow(exists).to receive(:which).with("iptables"). + and_return "/sbin/iptables" + allow(exists).to receive(:which).with("iptables-save"). + and_return "/sbin/iptables-save" + + # Every other command is expected to return false so we don't pick up any + # other providers + allow(exists).to receive(:which) { |value| + ! ["iptables","iptables-save"].include?(value) + }.and_return false + + # Create a resource instance and make sure the provider is iptables + resource = Puppet::Type.type(:firewall).new({ + :name => '000 test foo', + }) + expect(resource.provider.class.to_s).to eq("Puppet::Type::Firewall::ProviderIptables") + end +end + +describe 'iptables provider' do + let(:provider) { Puppet::Type.type(:firewall).provider(:iptables) } + let(:resource) { + Puppet::Type.type(:firewall).new({ + :name => '000 test foo', + :action => 'accept', + }) + } + + before :each do + allow(Puppet::Type::Firewall).to receive(:defaultprovider).and_return provider + allow(provider).to receive(:command).with(:iptables_save).and_return "/sbin/iptables-save" + + # Stub iptables version + allow(Facter.fact(:iptables_version)).to receive(:value).and_return("1.4.2") + + allow(Puppet::Util::Execution).to receive(:execute).and_return "" + allow(Puppet::Util).to receive(:which).with("iptables-save"). + and_return "/sbin/iptables-save" + end + + it 'is expected to be able to get a list of existing rules' do + provider.instances.each do |rule| + expect(rule).to be_instance_of(provider) + expect(rule.properties[:provider].to_s).to eq(provider.name.to_s) + end + end + + it 'is expected to ignore lines with fatal errors' do + allow(Puppet::Util::Execution).to receive(:execute).with(['/sbin/iptables-save']). + and_return("FATAL: Could not load /lib/modules/2.6.18-028stab095.1/modules.dep: No such file or directory") + + expect(provider.instances.length).to be_zero + end + + describe '#insert_order' do + let(:iptables_save_output) { [ + '-A INPUT -s 8.0.0.2/32 -p tcp -m multiport --ports 100 -m comment --comment "100 test" -j ACCEPT', + '-A INPUT -s 8.0.0.3/32 -p tcp -m multiport --ports 200 -m comment --comment "200 test" -j ACCEPT', + '-A INPUT -s 8.0.0.4/32 -p tcp -m multiport --ports 300 -m comment --comment "300 test" -j ACCEPT' + ] } + let(:resources) do + iptables_save_output.each_with_index.collect { |l,index| provider.rule_to_hash(l, 'filter', index) } + end + let(:providers) do + resources.collect { |r| provider.new(r) } + end + it 'understands offsets for adding rules to the beginning' do + resource = Puppet::Type.type(:firewall).new({ :name => '001 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(1) # 1-indexed + end + it 'understands offsets for editing rules at the beginning' do + resource = Puppet::Type.type(:firewall).new({ :name => '100 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(1) + end + it 'understands offsets for adding rules to the middle' do + resource = Puppet::Type.type(:firewall).new({ :name => '101 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(2) + end + it 'understands offsets for editing rules at the middle' do + resource = Puppet::Type.type(:firewall).new({ :name => '200 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(2) + end + it 'understands offsets for adding rules to the end' do + resource = Puppet::Type.type(:firewall).new({ :name => '301 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(4) + end + it 'understands offsets for editing rules at the end' do + resource = Puppet::Type.type(:firewall).new({ :name => '300 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(3) + end + + context 'with unname rules between' do + let(:iptables_save_output) { [ + '-A INPUT -s 8.0.0.2/32 -p tcp -m multiport --ports 100 -m comment --comment "100 test" -j ACCEPT', + '-A INPUT -s 8.0.0.2/32 -p tcp -m multiport --ports 150 -m comment --comment "150 test" -j ACCEPT', + '-A INPUT -s 8.0.0.3/32 -p tcp -m multiport --ports 200 -j ACCEPT', + '-A INPUT -s 8.0.0.3/32 -p tcp -m multiport --ports 250 -j ACCEPT', + '-A INPUT -s 8.0.0.4/32 -p tcp -m multiport --ports 300 -m comment --comment "300 test" -j ACCEPT', + '-A INPUT -s 8.0.0.4/32 -p tcp -m multiport --ports 350 -m comment --comment "350 test" -j ACCEPT', + ] } + it 'understands offsets for adding rules before unnamed rules' do + resource = Puppet::Type.type(:firewall).new({ :name => '001 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(1) + end + it 'understands offsets for editing rules before unnamed rules' do + resource = Puppet::Type.type(:firewall).new({ :name => '100 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(1) + end + it 'understands offsets for adding rules between managed rules' do + resource = Puppet::Type.type(:firewall).new({ :name => '120 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(2) + end + it 'understands offsets for adding rules between unnamed rules' do + resource = Puppet::Type.type(:firewall).new({ :name => '151 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(3) + end + it 'understands offsets for adding rules after unnamed rules' do + resource = Puppet::Type.type(:firewall).new({ :name => '351 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(7) + end + end + + context 'with unname rules before and after' do + let(:iptables_save_output) { [ + '-A INPUT -s 8.0.0.3/32 -p tcp -m multiport --ports 050 -j ACCEPT', + '-A INPUT -s 8.0.0.3/32 -p tcp -m multiport --ports 090 -j ACCEPT', + '-A INPUT -s 8.0.0.2/32 -p tcp -m multiport --ports 100 -m comment --comment "100 test" -j ACCEPT', + '-A INPUT -s 8.0.0.2/32 -p tcp -m multiport --ports 150 -m comment --comment "150 test" -j ACCEPT', + '-A INPUT -s 8.0.0.3/32 -p tcp -m multiport --ports 200 -j ACCEPT', + '-A INPUT -s 8.0.0.3/32 -p tcp -m multiport --ports 250 -j ACCEPT', + '-A INPUT -s 8.0.0.4/32 -p tcp -m multiport --ports 300 -m comment --comment "300 test" -j ACCEPT', + '-A INPUT -s 8.0.0.4/32 -p tcp -m multiport --ports 350 -m comment --comment "350 test" -j ACCEPT', + '-A INPUT -s 8.0.0.5/32 -p tcp -m multiport --ports 400 -j ACCEPT', + '-A INPUT -s 8.0.0.5/32 -p tcp -m multiport --ports 450 -j ACCEPT', + ] } + it 'understands offsets for adding rules before unnamed rules' do + resource = Puppet::Type.type(:firewall).new({ :name => '001 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(1) + end + it 'understands offsets for editing rules before unnamed rules' do + resource = Puppet::Type.type(:firewall).new({ :name => '100 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(3) + end + it 'understands offsets for adding rules between managed rules' do + resource = Puppet::Type.type(:firewall).new({ :name => '120 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(4) + end + it 'understands offsets for adding rules between unnamed rules' do + resource = Puppet::Type.type(:firewall).new({ :name => '151 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(5) + end + it 'understands offsets for adding rules after unnamed rules' do + resource = Puppet::Type.type(:firewall).new({ :name => '351 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(9) + end + it 'understands offsets for adding rules at the end' do + resource = Puppet::Type.type(:firewall).new({ :name => '950 test', }) + allow(resource.provider.class).to receive(:instances).and_return(providers) + expect(resource.provider.insert_order).to eq(11) + end + end + end + + # Load in ruby hash for test fixtures. + load 'spec/fixtures/iptables/conversion_hash.rb' + + describe 'when converting rules to resources' do + ARGS_TO_HASH.each do |test_name,data| + describe "for test data '#{test_name}'" do + let(:resource) { provider.rule_to_hash(data[:line], data[:table], 0) } + # If this option is enabled, make sure the parameters exactly match + if data[:compare_all] then + it "the parameter hash keys should be the same as returned by rules_to_hash" do + expect(resource.keys).to match_array(data[:params].keys) + end + end + + # Iterate across each parameter, creating an example for comparison + data[:params].each do |param_name, param_value| + it "the parameter '#{param_name.to_s}' should match #{param_value.inspect}" do + # booleans get cludged to string "true" + if param_value == true then + expect(resource[param_name]).to be_truthy + else + expect(resource[param_name]).to eq(data[:params][param_name]) + end + end + end + end + end + end + + describe 'when working out general_args' do + HASH_TO_ARGS.each do |test_name,data| + describe "for test data '#{test_name}'" do + let(:resource) { Puppet::Type.type(:firewall).new(data[:params]) } + let(:provider) { Puppet::Type.type(:firewall).provider(:iptables) } + let(:instance) { provider.new(resource) } + + it 'general_args should be valid' do + expect(instance.general_args.flatten).to eq(data[:args]) + end + end + end + end + + describe 'when converting rules without comments to resources' do + let(:sample_rule) { + '-A INPUT -s 1.1.1.1 -d 1.1.1.1 -p tcp -m multiport --dports 7061,7062 -m multiport --sports 7061,7062 -j ACCEPT' + } + let(:resource) { provider.rule_to_hash(sample_rule, 'filter', 0) } + let(:instance) { provider.new(resource) } + + it 'rule name contains a MD5 sum of the line' do + expect(resource[:name]).to eq("9000 #{Digest::MD5.hexdigest(resource[:line])}") + end + + it 'parsed the rule arguments correctly' do + expect(resource[:chain]).to eq('INPUT') + expect(resource[:source]).to eq('1.1.1.1/32') + expect(resource[:destination]).to eq('1.1.1.1/32') + expect(resource[:proto]).to eq('tcp') + expect(resource[:dport]).to eq(['7061', '7062']) + expect(resource[:sport]).to eq(['7061', '7062']) + expect(resource[:action]).to eq('accept') + end + end + + describe 'when converting existing rules generates by system-config-firewall-tui to resources' do + let(:sample_rule) { + # as generated by iptables-save from rules created with system-config-firewall-tui + '-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT' + } + let(:resource) { provider.rule_to_hash(sample_rule, 'filter', 0) } + let(:instance) { provider.new(resource) } + + it 'rule name contains a MD5 sum of the line' do + expect(resource[:name]).to eq("9000 #{Digest::MD5.hexdigest(resource[:line])}") + end + + it 'parse arguments' do + expect(resource[:chain]).to eq('INPUT') + expect(resource[:proto]).to eq('tcp') + expect(resource[:dport]).to eq(['22']) + expect(resource[:state]).to eq(['NEW']) + expect(resource[:action]).to eq('accept') + end + end + + describe 'when creating resources' do + let(:instance) { provider.new(resource) } + + it 'insert_args should be an array' do + expect(instance.insert_args.class).to eq(Array) + end + end + + describe 'when modifying resources' do + let(:instance) { provider.new(resource) } + + it 'update_args should be an array' do + expect(instance.update_args.class).to eq(Array) + end + + it 'fails when modifying the chain' do + expect { instance.chain = "OUTPUT" }.to raise_error(/is not supported/) + end + end + + describe 'when inverting rules' do + let(:resource) { + Puppet::Type.type(:firewall).new({ + :name => '040 partial invert', + :table => 'filter', + :action => 'accept', + :chain => 'nova-compute-FORWARD', + :source => '0.0.0.0/32', + :destination => '255.255.255.255/32', + :sport => ['! 78','79','http'], + :dport => ['77','! 76'], + :proto => 'udp', + }) + } + let(:instance) { provider.new(resource) } + + it 'fails when not all array items are inverted' do + expect { instance.insert }.to raise_error Puppet::Error, /but '79', '80' are not prefixed/ + end + end + + describe 'when deleting resources' do + let(:sample_rule) { + '-A INPUT -s 1.1.1.1 -d 1.1.1.1 -p tcp -m multiport --dports 7061,7062 -m multiport --sports 7061,7062 -j ACCEPT' + } + let(:resource) { provider.rule_to_hash(sample_rule, 'filter', 0) } + let(:instance) { provider.new(resource) } + + it 'resource[:line] looks like the original rule' do + resource[:line] == sample_rule + end + + it 'delete_args is an array' do + expect(instance.delete_args.class).to eq(Array) + end + + it 'delete_args is the same as the rule string when joined' do + expect(instance.delete_args.join(' ')).to eq(sample_rule.gsub(/\-A/, + '-t filter -D')) + end + end +end + +describe 'ip6tables provider' do + let(:provider6) { Puppet::Type.type(:firewall).provider(:ip6tables) } + let(:resource) { + Puppet::Type.type(:firewall).new({ + :name => '000 test foo', + :action => 'accept', + :provider => "ip6tables", + }) + } + + before :each do + allow(Puppet::Type::Firewall).to receive(:ip6tables).and_return provider6 + allow(provider6).to receive(:command).with(:ip6tables_save).and_return "/sbin/ip6tables-save" + + # Stub iptables version + allow(Facter.fact(:ip6tables_version)).to receive(:value).and_return '1.4.7' + + allow(Puppet::Util::Execution).to receive(:execute).and_return '' + allow(Puppet::Util).to receive(:which).with("ip6tables-save"). + and_return "/sbin/ip6tables-save" + end + + it 'is expected to be able to get a list of existing rules' do + provider6.instances.each do |rule| + expect(rule).to be_instance_of(provider6) + expect(rule.properties[:provider6].to_s).to eql provider6.name.to_s + end + end + + it 'is expected to ignore lines with fatal errors' do + allow(Puppet::Util::Execution).to receive(:execute).with(['/sbin/ip6tables-save']). + and_return("FATAL: Could not load /lib/modules/2.6.18-028stab095.1/modules.dep: No such file or directory") + expect(provider6.instances.length).to eq 0 + end + + # Load in ruby hash for test fixtures. + load 'spec/fixtures/ip6tables/conversion_hash.rb' + + describe 'when converting rules to resources' do + ARGS_TO_HASH6.each do |test_name,data| + describe "for test data '#{test_name}'" do + let(:resource) { provider6.rule_to_hash(data[:line], data[:table], 0) } + + # If this option is enabled, make sure the parameters exactly match + if data[:compare_all] then + it "the parameter hash keys should be the same as returned by rules_to_hash" do + expect(resource.keys).to match data[:params].keys + end + end + + # Iterate across each parameter, creating an example for comparison + data[:params].each do |param_name, param_value| + it "the parameter '#{param_name.to_s}' should match #{param_value.inspect}" do + expect(resource[param_name]).to eql data[:params][param_name] + end + end + end + end + end + + describe 'when working out general_args' do + HASH_TO_ARGS6.each do |test_name,data| + describe "for test data '#{test_name}'" do + let(:resource) { Puppet::Type.type(:firewall).new(data[:params]) } + let(:provider6) { Puppet::Type.type(:firewall).provider(:ip6tables) } + let(:instance) { provider6.new(resource) } + + it 'general_args should be valid' do + expect(instance.general_args.flatten).to eql data[:args] + end + end + end + end +end diff --git a/environments/production/modules/firewall/spec/unit/puppet/type/firewall_spec.rb b/environments/production/modules/firewall/spec/unit/puppet/type/firewall_spec.rb new file mode 100755 index 0000000..a34963c --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/puppet/type/firewall_spec.rb @@ -0,0 +1,688 @@ +#!/usr/bin/env rspec + +require 'spec_helper' + +firewall = Puppet::Type.type(:firewall) + +describe firewall do + before :each do + @class = firewall + @provider = double 'provider' + allow(@provider).to receive(:name).and_return(:iptables) + allow(Puppet::Type::Firewall).to receive(:defaultprovider).and_return @provider + + @resource = @class.new({:name => '000 test foo'}) + + # Stub iptables version + allow(Facter.fact(:iptables_version)).to receive(:value).and_return('1.4.2') + allow(Facter.fact(:ip6tables_version)).to receive(:value).and_return('1.4.2') + + # Stub confine facts + allow(Facter.fact(:kernel)).to receive(:value).and_return('Linux') + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Debian') + end + + it 'should have :name be its namevar' do + expect(@class.key_attributes).to eql [:name] + end + + describe ':name' do + it 'should accept a name' do + @resource[:name] = '000-test-foo' + expect(@resource[:name]).to eql '000-test-foo' + end + + it 'should not accept a name with non-ASCII chars' do + expect(lambda { @resource[:name] = '%*#^(#$' }).to raise_error(Puppet::Error) + end + end + + describe ':action' do + it "should have no default" do + res = @class.new(:name => "000 test") + expect(res.parameters[:action]).to eql nil + end + + [:accept, :drop, :reject].each do |action| + it "should accept value #{action}" do + @resource[:action] = action + expect(@resource[:action]).to eql action + end + end + + it 'should fail when value is not recognized' do + expect(lambda { @resource[:action] = 'not valid' }).to raise_error(Puppet::Error) + end + end + + describe ':chain' do + [:INPUT, :FORWARD, :OUTPUT, :PREROUTING, :POSTROUTING].each do |chain| + it "should accept chain value #{chain}" do + @resource[:chain] = chain + expect(@resource[:chain]).to eql chain + end + end + + it 'should fail when the chain value is not recognized' do + expect(lambda { @resource[:chain] = 'not valid' }).to raise_error(Puppet::Error) + end + end + + describe ':table' do + [:nat, :mangle, :filter, :raw].each do |table| + it "should accept table value #{table}" do + @resource[:table] = table + expect(@resource[:table]).to eql table + end + end + + it "should fail when table value is not recognized" do + expect(lambda { @resource[:table] = 'not valid' }).to raise_error(Puppet::Error) + end + end + + describe ':proto' do + [:ip, :tcp, :udp, :icmp, :esp, :ah, :vrrp, :igmp, :ipencap, :ipv4, :ipv6, :ospf, :gre, :pim, :all].each do |proto| + it "should accept proto value #{proto}" do + @resource[:proto] = proto + expect(@resource[:proto]).to eql proto + end + end + + it "should fail when proto value is not recognized" do + expect(lambda { @resource[:proto] = 'foo' }).to raise_error(Puppet::Error) + end + end + + describe ':jump' do + it "should have no default" do + res = @class.new(:name => "000 test") + expect(res.parameters[:jump]).to eql nil + end + + ['QUEUE', 'RETURN', 'DNAT', 'SNAT', 'LOG', 'MASQUERADE', 'REDIRECT', 'MARK'].each do |jump| + it "should accept jump value #{jump}" do + @resource[:jump] = jump + expect(@resource[:jump]).to eql jump + end + end + + ['ACCEPT', 'DROP', 'REJECT'].each do |jump| + it "should now fail when value #{jump}" do + expect(lambda { @resource[:jump] = jump }).to raise_error(Puppet::Error) + end + end + + it "should fail when jump value is not recognized" do + expect(lambda { @resource[:jump] = '%^&*' }).to raise_error(Puppet::Error) + end + end + + [:source, :destination].each do |addr| + describe addr do + it "should accept a #{addr} as a string" do + @resource[addr] = '127.0.0.1' + expect(@resource[addr]).to eql '127.0.0.1/32' + end + ['0.0.0.0/0', '::/0'].each do |prefix| + it "should be nil for zero prefix length address #{prefix}" do + @resource[addr] = prefix + expect(@resource[addr]).to eql nil + end + end + it "should accept a negated #{addr} as a string" do + @resource[addr] = '! 127.0.0.1' + expect(@resource[addr]).to eql '! 127.0.0.1/32' + end + end + end + + [:dport, :sport].each do |port| + describe port do + it "should accept a #{port} as string" do + @resource[port] = '22' + expect(@resource[port]).to eql ['22'] + end + + it "should accept a #{port} as an array" do + @resource[port] = ['22','23'] + expect(@resource[port]).to eql ['22','23'] + end + + it "should accept a #{port} as a number" do + @resource[port] = 22 + expect(@resource[port]).to eql ['22'] + end + + it "should accept a #{port} as a hyphen separated range" do + @resource[port] = ['22-1000'] + expect(@resource[port]).to eql ['22-1000'] + end + + it "should accept a #{port} as a combination of arrays of single and " \ + "hyphen separated ranges" do + + @resource[port] = ['22-1000','33','3000-4000'] + expect(@resource[port]).to eql ['22-1000','33','3000-4000'] + end + + it "should convert a port name for #{port} to its number" do + @resource[port] = 'ssh' + expect(@resource[port]).to eql ['22'] + end + + it "should not accept something invalid for #{port}" do + expect { @resource[port] = 'something odd' }.to raise_error(Puppet::Error, /^Parameter .+ failed.+Munging failed for value ".+" in class .+: no such service/) + end + + it "should not accept something invalid in an array for #{port}" do + expect { @resource[port] = ['something odd','something even odder'] }.to raise_error(Puppet::Error, /^Parameter .+ failed.+Munging failed for value ".+" in class .+: no such service/) + end + end + end + + describe 'port deprecated' do + it "raises a warning" do + expect(Puppet).to receive(:warning).with /port to firewall is deprecated/ + @resource[:port] = "22" + end + end + + [:dst_type, :src_type].each do |addrtype| + describe addrtype do + it "should have no default" do + res = @class.new(:name => "000 test") + expect(res.parameters[addrtype]).to eql nil + end + end + + [:UNSPEC, :UNICAST, :LOCAL, :BROADCAST, :ANYCAST, :MULTICAST, :BLACKHOLE, + :UNREACHABLE, :PROHIBIT, :THROW, :NAT, :XRESOLVE].each do |type| + it "should accept #{addrtype} value #{type}" do + @resource[addrtype] = type + expect(@resource[addrtype]).to eql type + end + end + + it "should fail when #{addrtype} value is not recognized" do + expect(lambda { @resource[addrtype] = 'foo' }).to raise_error(Puppet::Error) + end + end + + [:iniface, :outiface].each do |iface| + describe iface do + it "should accept #{iface} value as a string" do + @resource[iface] = 'eth1' + expect(@resource[iface]).to eql 'eth1' + end + it "should accept a negated #{iface} value as a string" do + @resource[iface] = '! eth1' + expect(@resource[iface]).to eql '! eth1' + end + it "should accept an interface alias for the #{iface} value as a string" do + @resource[iface] = 'eth1:2' + expect(@resource[iface]).to eql 'eth1:2' + end + end + end + + [:tosource, :todest, :to].each do |addr| + describe addr do + it "should accept #{addr} value as a string" do + @resource[addr] = '127.0.0.1' + end + end + end + + describe ':log_level' do + values = { + 'panic' => '0', + 'alert' => '1', + 'crit' => '2', + 'err' => '3', + 'warn' => '4', + 'warning' => '4', + 'not' => '5', + 'notice' => '5', + 'info' => '6', + 'debug' => '7' + } + + values.each do |k,v| + it { + @resource[:log_level] = k + expect(@resource[:log_level]).to eql v + } + + it { + @resource[:log_level] = 3 + expect(@resource[:log_level]).to eql 3 + } + + it { expect(lambda { @resource[:log_level] = 'foo' }).to raise_error(Puppet::Error) } + end + end + + describe ':icmp' do + icmp_codes = { + :iptables => { + '0' => 'echo-reply', + '3' => 'destination-unreachable', + '4' => 'source-quench', + '6' => 'redirect', + '8' => 'echo-request', + '9' => 'router-advertisement', + '10' => 'router-solicitation', + '11' => 'time-exceeded', + '12' => 'parameter-problem', + '13' => 'timestamp-request', + '14' => 'timestamp-reply', + '17' => 'address-mask-request', + '18' => 'address-mask-reply' + }, + :ip6tables => { + '1' => 'destination-unreachable', + '2' => 'too-big', + '3' => 'time-exceeded', + '4' => 'parameter-problem', + '128' => 'echo-request', + '129' => 'echo-reply', + '133' => 'router-solicitation', + '134' => 'router-advertisement', + '137' => 'redirect' + } + } + icmp_codes.each do |provider, values| + describe provider do + values.each do |k,v| + it 'should convert icmp string to number' do + @resource[:provider] = provider + expect(@resource[:provider]).to eql provider + @resource[:icmp] = v + expect(@resource[:icmp]).to eql k + end + end + end + end + + it 'should accept values as integers' do + @resource[:icmp] = 9 + expect(@resource[:icmp]).to eql 9 + end + + it 'should fail if icmp type is "any"' do + expect(lambda { @resource[:icmp] = 'any' }).to raise_error(Puppet::Error) + end + + it 'should fail if icmp type cannot be mapped to a numeric' do + expect(lambda { @resource[:icmp] = 'foo' }).to raise_error(Puppet::Error) + end + end + + describe ':state' do + it 'should accept value as a string' do + @resource[:state] = :INVALID + expect(@resource[:state]).to eql [:INVALID] + end + + it 'should accept value as an array' do + @resource[:state] = [:INVALID, :NEW] + expect(@resource[:state]).to eql [:INVALID, :NEW] + end + + it 'should sort values alphabetically' do + @resource[:state] = [:NEW, :ESTABLISHED] + expect(@resource[:state]).to eql [:ESTABLISHED, :NEW] + end + end + + describe ':ctstate' do + it 'should accept value as a string' do + @resource[:ctstate] = :INVALID + expect(@resource[:ctstate]).to eql [:INVALID] + end + + it 'should accept value as an array' do + @resource[:ctstate] = [:INVALID, :NEW] + expect(@resource[:ctstate]).to eql [:INVALID, :NEW] + end + + it 'should sort values alphabetically' do + @resource[:ctstate] = [:NEW, :ESTABLISHED] + expect(@resource[:ctstate]).to eql [:ESTABLISHED, :NEW] + end + end + + describe ':burst' do + it 'should accept numeric values' do + @resource[:burst] = 12 + expect(@resource[:burst]).to eql 12 + end + + it 'should fail if value is not numeric' do + expect(lambda { @resource[:burst] = 'foo' }).to raise_error(Puppet::Error) + end + end + + describe ':recent' do + ['set', 'update', 'rcheck', 'remove'].each do |recent| + it "should accept recent value #{recent}" do + @resource[:recent] = recent + expect(@resource[:recent]).to eql "--#{recent}" + end + end + end + + describe ':action and :jump' do + it 'should allow only 1 to be set at a time' do + expect { + @class.new( + :name => "001-test", + :action => "accept", + :jump => "custom_chain" + ) + }.to raise_error(Puppet::Error, /Only one of the parameters 'action' and 'jump' can be set$/) + end + end + describe ':gid and :uid' do + it 'should allow me to set uid' do + @resource[:uid] = 'root' + expect(@resource[:uid]).to eql 'root' + end + it 'should allow me to set uid as an array, and silently hide my error' do + @resource[:uid] = ['root', 'bobby'] + expect(@resource[:uid]).to eql 'root' + end + it 'should allow me to set gid' do + @resource[:gid] = 'root' + expect(@resource[:gid]).to eql 'root' + end + it 'should allow me to set gid as an array, and silently hide my error' do + @resource[:gid] = ['root', 'bobby'] + expect(@resource[:gid]).to eql 'root' + end + end + + describe ':set_mark' do + ['1.3.2', '1.4.2'].each do |iptables_version| + describe "with iptables #{iptables_version}" do + before { + Facter.clear + allow(Facter.fact(:iptables_version)).to receive(:value).and_return iptables_version + allow(Facter.fact(:ip6tables_version)).to receive(:value).and_return iptables_version + } + + if iptables_version == '1.3.2' + it 'should allow me to set set-mark without mask' do + @resource[:set_mark] = '0x3e8' + expect(@resource[:set_mark]).to eql '0x3e8' + end + it 'should convert int to hex without mask' do + @resource[:set_mark] = '1000' + expect(@resource[:set_mark]).to eql '0x3e8' + end + it 'should fail if mask is present' do + expect(lambda { @resource[:set_mark] = '0x3e8/0xffffffff'}).to raise_error( + Puppet::Error, /iptables version #{iptables_version} does not support masks on MARK rules$/ + ) + end + end + + if iptables_version == '1.4.2' + it 'should allow me to set set-mark with mask' do + @resource[:set_mark] = '0x3e8/0xffffffff' + expect(@resource[:set_mark]).to eql '0x3e8/0xffffffff' + end + it 'should convert int to hex and add a 32 bit mask' do + @resource[:set_mark] = '1000' + expect(@resource[:set_mark]).to eql '0x3e8/0xffffffff' + end + it 'should add a 32 bit mask' do + @resource[:set_mark] = '0x32' + expect(@resource[:set_mark]).to eql '0x32/0xffffffff' + end + it 'should use the mask provided' do + @resource[:set_mark] = '0x32/0x4' + expect(@resource[:set_mark]).to eql '0x32/0x4' + end + it 'should use the mask provided and convert int to hex' do + @resource[:set_mark] = '1000/0x4' + expect(@resource[:set_mark]).to eql '0x3e8/0x4' + end + it 'should fail if mask value is more than 32 bits' do + expect(lambda { @resource[:set_mark] = '1/4294967296'}).to raise_error( + Puppet::Error, /MARK mask must be integer or hex between 0 and 0xffffffff$/ + ) + end + it 'should fail if mask is malformed' do + expect(lambda { @resource[:set_mark] = '1000/0xq4'}).to raise_error( + Puppet::Error, /MARK mask must be integer or hex between 0 and 0xffffffff$/ + ) + end + end + + ['/', '1000/', 'pwnie'].each do |bad_mark| + it "should fail with malformed mark '#{bad_mark}'" do + expect(lambda { @resource[:set_mark] = bad_mark}).to raise_error(Puppet::Error) + end + end + it 'should fail if mark value is more than 32 bits' do + expect(lambda { @resource[:set_mark] = '4294967296'}).to raise_error( + Puppet::Error, /MARK value must be integer or hex between 0 and 0xffffffff$/ + ) + end + end + end + end + + [:chain, :jump].each do |param| + describe param do + it 'should autorequire fwchain when table and provider are undefined' do + @resource[param] = 'FOO' + expect(@resource[:table]).to eql :filter + expect(@resource[:provider]).to eql :iptables + + chain = Puppet::Type.type(:firewallchain).new(:name => 'FOO:filter:IPv4') + catalog = Puppet::Resource::Catalog.new + catalog.add_resource @resource + catalog.add_resource chain + rel = @resource.autorequire[0] + expect(rel.source.ref).to eql chain.ref + expect(rel.target.ref).to eql @resource.ref + end + + it 'should autorequire fwchain when table is undefined and provider is ip6tables' do + @resource[param] = 'FOO' + expect(@resource[:table]).to eql :filter + @resource[:provider] = :ip6tables + + chain = Puppet::Type.type(:firewallchain).new(:name => 'FOO:filter:IPv6') + catalog = Puppet::Resource::Catalog.new + catalog.add_resource @resource + catalog.add_resource chain + rel = @resource.autorequire[0] + expect(rel.source.ref).to eql chain.ref + expect(rel.target.ref).to eql @resource.ref + end + + it 'should autorequire fwchain when table is raw and provider is undefined' do + @resource[param] = 'FOO' + @resource[:table] = :raw + expect(@resource[:provider]).to eql :iptables + + chain = Puppet::Type.type(:firewallchain).new(:name => 'FOO:raw:IPv4') + catalog = Puppet::Resource::Catalog.new + catalog.add_resource @resource + catalog.add_resource chain + rel = @resource.autorequire[0] + expect(rel.source.ref).to eql chain.ref + expect(rel.target.ref).to eql @resource.ref + end + + it 'should autorequire fwchain when table is raw and provider is ip6tables' do + @resource[param] = 'FOO' + @resource[:table] = :raw + @resource[:provider] = :ip6tables + + chain = Puppet::Type.type(:firewallchain).new(:name => 'FOO:raw:IPv6') + catalog = Puppet::Resource::Catalog.new + catalog.add_resource @resource + catalog.add_resource chain + rel = @resource.autorequire[0] + expect(rel.source.ref).to eql chain.ref + expect(rel.target.ref).to eql @resource.ref + end + + # test where autorequire is still needed (table != filter) + ['INPUT', 'OUTPUT', 'FORWARD'].each do |test_chain| + it "should autorequire fwchain #{test_chain} when table is mangle and provider is undefined" do + @resource[param] = test_chain + @resource[:table] = :mangle + expect(@resource[:provider]).to eql :iptables + + chain = Puppet::Type.type(:firewallchain).new(:name => "#{test_chain}:mangle:IPv4") + catalog = Puppet::Resource::Catalog.new + catalog.add_resource @resource + catalog.add_resource chain + rel = @resource.autorequire[0] + expect(rel.source.ref).to eql chain.ref + expect(rel.target.ref).to eql @resource.ref + end + + it "should autorequire fwchain #{test_chain} when table is mangle and provider is ip6tables" do + @resource[param] = test_chain + @resource[:table] = :mangle + @resource[:provider] = :ip6tables + + chain = Puppet::Type.type(:firewallchain).new(:name => "#{test_chain}:mangle:IPv6") + catalog = Puppet::Resource::Catalog.new + catalog.add_resource @resource + catalog.add_resource chain + rel = @resource.autorequire[0] + expect(rel.source.ref).to eql chain.ref + expect(rel.target.ref).to eql @resource.ref + end + end + + # test of case where autorequire should not happen + ['INPUT', 'OUTPUT', 'FORWARD'].each do |test_chain| + + it "should not autorequire fwchain #{test_chain} when table and provider are undefined" do + @resource[param] = test_chain + expect(@resource[:table]).to eql :filter + expect(@resource[:provider]).to eql :iptables + + chain = Puppet::Type.type(:firewallchain).new(:name => "#{test_chain}:filter:IPv4") + catalog = Puppet::Resource::Catalog.new + catalog.add_resource @resource + catalog.add_resource chain + rel = @resource.autorequire[0] + expect(rel).to eql nil + end + + it "should not autorequire fwchain #{test_chain} when table is undefined and provider is ip6tables" do + @resource[param] = test_chain + expect(@resource[:table]).to eql :filter + @resource[:provider] = :ip6tables + + chain = Puppet::Type.type(:firewallchain).new(:name => "#{test_chain}:filter:IPv6") + catalog = Puppet::Resource::Catalog.new + catalog.add_resource @resource + catalog.add_resource chain + rel = @resource.autorequire[0] + expect(rel).to eql nil + end + end + end + end + + describe ":chain and :jump" do + it 'should autorequire independent fwchains' do + @resource[:chain] = 'FOO' + @resource[:jump] = 'BAR' + expect(@resource[:table]).to eql :filter + expect(@resource[:provider]).to eql :iptables + + chain_foo = Puppet::Type.type(:firewallchain).new(:name => 'FOO:filter:IPv4') + chain_bar = Puppet::Type.type(:firewallchain).new(:name => 'BAR:filter:IPv4') + catalog = Puppet::Resource::Catalog.new + catalog.add_resource @resource + catalog.add_resource chain_foo + catalog.add_resource chain_bar + rel = @resource.autorequire + expect(rel[0].source.ref).to eql chain_foo.ref + expect(rel[0].target.ref).to eql @resource.ref + expect(rel[1].source.ref).to eql chain_bar.ref + expect(rel[1].target.ref).to eql @resource.ref + end + end + + describe ':pkttype' do + [:multicast, :broadcast, :unicast].each do |pkttype| + it "should accept pkttype value #{pkttype}" do + @resource[:pkttype] = pkttype + expect(@resource[:pkttype]).to eql pkttype + end + end + + it 'should fail when the pkttype value is not recognized' do + expect(lambda { @resource[:pkttype] = 'not valid' }).to raise_error(Puppet::Error) + end + end + + describe 'autorequire packages' do + [:iptables, :ip6tables].each do |provider| + it "provider #{provider} should autorequire package iptables" do + @resource[:provider] = provider + expect(@resource[:provider]).to eql provider + package = Puppet::Type.type(:package).new(:name => 'iptables') + catalog = Puppet::Resource::Catalog.new + catalog.add_resource @resource + catalog.add_resource package + rel = @resource.autorequire[0] + expect(rel.source.ref).to eql package.ref + expect(rel.target.ref).to eql @resource.ref + end + + it "provider #{provider} should autorequire packages iptables, iptables-persistent, and iptables-services" do + @resource[:provider] = provider + expect(@resource[:provider]).to eql provider + packages = [ + Puppet::Type.type(:package).new(:name => 'iptables'), + Puppet::Type.type(:package).new(:name => 'iptables-persistent'), + Puppet::Type.type(:package).new(:name => 'iptables-services') + ] + catalog = Puppet::Resource::Catalog.new + catalog.add_resource @resource + packages.each do |package| + catalog.add_resource package + end + packages.zip(@resource.autorequire) do |package, rel| + expect(rel.source.ref).to eql package.ref + expect(rel.target.ref).to eql @resource.ref + end + end + end + end + it 'is suitable' do + expect(@resource.suitable?).to be_truthy + end +end + +describe 'firewall on unsupported platforms' do + it 'is not suitable' do + # Stub iptables version + allow(Facter.fact(:iptables_version)).to receive(:value).and_return(nil) + allow(Facter.fact(:ip6tables_version)).to receive(:value).and_return(nil) + + # Stub confine facts + allow(Facter.fact(:kernel)).to receive(:value).and_return('Darwin') + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Darwin') + resource = firewall.new(:name => "000 test foo", :ensure => :present) + + # If our provider list is nil, then the Puppet::Transaction#evaluate will + # say 'Error: Could not find a suitable provider for firewall' but there + # isn't a unit testable way to get this. + expect(resource.suitable?).to be_falsey + end +end diff --git a/environments/production/modules/firewall/spec/unit/puppet/type/firewallchain_spec.rb b/environments/production/modules/firewall/spec/unit/puppet/type/firewallchain_spec.rb new file mode 100755 index 0000000..440534e --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/puppet/type/firewallchain_spec.rb @@ -0,0 +1,217 @@ +#!/usr/bin/env rspec + +require 'spec_helper' + +firewallchain = Puppet::Type.type(:firewallchain) + +describe firewallchain do + before(:each) do + # Stub confine facts + allow(Facter.fact(:kernel)).to receive(:value).and_return('Linux') + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Debian') + end + let(:klass) { firewallchain } + let(:provider) { + prov = double 'provider' + allow(prov).to receive(:name).and_return(:iptables_chain) + prov + } + let(:resource) { + allow(Puppet::Type::Firewallchain).to receive(:defaultprovider).and_return provider + klass.new({:name => 'INPUT:filter:IPv4', :policy => :accept }) + } + + it 'should have :name be its namevar' do + expect(klass.key_attributes).to eql [:name] + end + + describe ':name' do + {'nat' => ['PREROUTING', 'POSTROUTING', 'INPUT', 'OUTPUT'], + 'mangle' => [ 'PREROUTING', 'POSTROUTING', 'INPUT', 'FORWARD', 'OUTPUT' ], + 'filter' => ['INPUT','OUTPUT','FORWARD'], + 'raw' => [ 'PREROUTING', 'OUTPUT'], + 'broute' => ['BROUTING'], + 'security' => ['INPUT','OUTPUT','FORWARD'] + }.each_pair do |table, allowedinternalchains| + ['IPv4', 'IPv6', 'ethernet'].each do |protocol| + [ 'test', '$5()*&%\'"^$09):' ].each do |chainname| + name = "#{chainname}:#{table}:#{protocol}" + if table == 'nat' && protocol == 'IPv6' + it "should accept #{name} for Linux 3.7+" do + allow(Facter.fact(:kernelmajversion)).to receive(:value).and_return('3.7') + resource[:name] = name + expect(resource[:name]).to eql name + end + it "should fail #{name} for Linux 2.6" do + allow(Facter.fact(:kernelmajversion)).to receive(:value).and_return('2.6') + expect { resource[:name] = name }.to raise_error(Puppet::Error) + end + elsif protocol != 'ethernet' && table == 'broute' + it "should fail #{name}" do + expect { resource[:name] = name }.to raise_error(Puppet::Error) + end + else + it "should accept name #{name}" do + resource[:name] = name + expect(resource[:name]).to eql name + end + end + end # chainname + end # protocol + + [ 'PREROUTING', 'POSTROUTING', 'BROUTING', 'INPUT', 'FORWARD', 'OUTPUT' ].each do |internalchain| + name = internalchain + ':' + table + ':' + if internalchain == 'BROUTING' + name += 'ethernet' + elsif table == 'nat' + name += 'IPv4' + else + name += 'IPv4' + end + if allowedinternalchains.include? internalchain + it "should allow #{name}" do + resource[:name] = name + expect(resource[:name]).to eql name + end + else + it "should fail #{name}" do + expect { resource[:name] = name }.to raise_error(Puppet::Error) + end + end + end # internalchain + + end # table, allowedinternalchainnames + + it 'should fail with invalid table names' do + expect { resource[:name] = 'wrongtablename:test:IPv4' }.to raise_error(Puppet::Error) + end + + it 'should fail with invalid protocols names' do + expect { resource[:name] = 'test:filter:IPv5' }.to raise_error(Puppet::Error) + end + + end + + describe ':policy' do + + [:accept, :drop, :queue, :return].each do |policy| + it "should accept policy #{policy}" do + resource[:policy] = policy + expect(resource[:policy]).to eql policy + end + end + + it 'should fail when value is not recognized' do + expect { resource[:policy] = 'not valid' }.to raise_error(Puppet::Error) + end + + [:accept, :drop, :queue, :return].each do |policy| + it "non-inbuilt chains should not accept policy #{policy}" do + expect { klass.new({:name => 'testchain:filter:IPv4', :policy => policy }) }.to raise_error(Puppet::Error) + end + it "non-inbuilt chains can accept policies on protocol = ethernet (policy #{policy})" do + klass.new({:name => 'testchain:filter:ethernet', :policy => policy }) + end + end + + end + + describe 'autorequire packages' do + it "provider iptables_chain should autorequire package iptables" do + expect(resource[:provider]).to eql :iptables_chain + package = Puppet::Type.type(:package).new(:name => 'iptables') + catalog = Puppet::Resource::Catalog.new + catalog.add_resource resource + catalog.add_resource package + rel = resource.autorequire[0] + expect(rel.source.ref).to eql package.ref + expect(rel.target.ref).to eql resource.ref + end + + it "provider iptables_chain should autorequire packages iptables, iptables-persistent, and iptables-services" do + expect(resource[:provider]).to eql :iptables_chain + packages = [ + Puppet::Type.type(:package).new(:name => 'iptables'), + Puppet::Type.type(:package).new(:name => 'iptables-persistent'), + Puppet::Type.type(:package).new(:name => 'iptables-services') + ] + catalog = Puppet::Resource::Catalog.new + catalog.add_resource resource + packages.each do |package| + catalog.add_resource package + end + packages.zip(resource.autorequire) do |package, rel| + expect(rel.source.ref).to eql package.ref + expect(rel.target.ref).to eql resource.ref + end + end + end + + describe 'purge iptables rules' do + before(:each) do + stub_return = < 'INPUT:filter:IPv4', :purge => true) + + expect(resource.generate.size).to eq(3) + end + + it 'should not generate ignored iptables rules' do + allow(Facter.fact(:ip6tables_version)).to receive(:value).and_return("1.4.21") + resource = Puppet::Type::Firewallchain.new(:name => 'INPUT:filter:IPv4', :purge => true, :ignore => ['-j fail2ban-ssh']) + + expect(resource.generate.size).to eq(2) + end + + it 'should not generate iptables resources when not enabled' do + resource = Puppet::Type::Firewallchain.new(:name => 'INPUT:filter:IPv4') + + expect(resource.generate.size).to eq(0) + end + end + it 'is suitable' do + expect(resource.suitable?).to be_truthy + end +end + +describe 'firewall on unsupported platforms' do + it 'is not suitable' do + # Stub iptables version + allow(Facter.fact(:iptables_version)).to receive(:value).and_return(nil) + allow(Facter.fact(:ip6tables_version)).to receive(:value).and_return(nil) + + # Stub confine facts + allow(Facter.fact(:kernel)).to receive(:value).and_return('Darwin') + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Darwin') + resource = firewallchain.new(:name => "INPUT:filter:IPv4", :ensure => :present) + + # If our provider list is nil, then the Puppet::Transaction#evaluate will + # say 'Error: Could not find a suitable provider for firewall' but there + # isn't a unit testable way to get this. + expect(resource.suitable?).to be_falsey + end +end diff --git a/environments/production/modules/firewall/spec/unit/puppet/util/firewall_spec.rb b/environments/production/modules/firewall/spec/unit/puppet/util/firewall_spec.rb new file mode 100644 index 0000000..a55ed87 --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/puppet/util/firewall_spec.rb @@ -0,0 +1,208 @@ +require 'spec_helper' + +describe 'Puppet::Util::Firewall' do + let(:resource) { + type = Puppet::Type.type(:firewall) + provider = double 'provider' + allow(provider).to receive(:name).and_return(:iptables) + allow(Puppet::Type::Firewall).to receive(:defaultprovider).and_return(provider) + type.new({:name => '000 test foo'}) + } + + before(:each) { resource } + + describe '#host_to_ip' do + subject { resource } + it { + expect(Resolv).to receive(:getaddress).with('puppetlabs.com').and_return('96.126.112.51') + expect(subject.host_to_ip('puppetlabs.com')).to eql '96.126.112.51/32' + } + it { expect(subject.host_to_ip('96.126.112.51')).to eql '96.126.112.51/32' } + it { expect(subject.host_to_ip('96.126.112.51/32')).to eql '96.126.112.51/32' } + it { expect(subject.host_to_ip('2001:db8:85a3:0:0:8a2e:370:7334')).to eql '2001:db8:85a3::8a2e:370:7334/128' } + it { expect(subject.host_to_ip('2001:db8:1234::/48')).to eql '2001:db8:1234::/48' } + it { expect(subject.host_to_ip('0.0.0.0/0')).to eql nil } + it { expect(subject.host_to_ip('::/0')).to eql nil } + end + + describe '#host_to_mask' do + subject { resource } + it { + expect(Resolv).to receive(:getaddress).at_least(:once).with('puppetlabs.com').and_return('96.126.112.51') + expect(subject.host_to_mask('puppetlabs.com')).to eql '96.126.112.51/32' + expect(subject.host_to_mask('!puppetlabs.com')).to eql '! 96.126.112.51/32' + } + it { expect(subject.host_to_mask('96.126.112.51')).to eql '96.126.112.51/32' } + it { expect(subject.host_to_mask('!96.126.112.51')).to eql '! 96.126.112.51/32' } + it { expect(subject.host_to_mask('96.126.112.51/32')).to eql '96.126.112.51/32' } + it { expect(subject.host_to_mask('! 96.126.112.51/32')).to eql '! 96.126.112.51/32' } + it { expect(subject.host_to_mask('2001:db8:85a3:0:0:8a2e:370:7334')).to eql '2001:db8:85a3::8a2e:370:7334/128' } + it { expect(subject.host_to_mask('!2001:db8:85a3:0:0:8a2e:370:7334')).to eql '! 2001:db8:85a3::8a2e:370:7334/128' } + it { expect(subject.host_to_mask('2001:db8:1234::/48')).to eql '2001:db8:1234::/48' } + it { expect(subject.host_to_mask('! 2001:db8:1234::/48')).to eql '! 2001:db8:1234::/48' } + it { expect(subject.host_to_mask('0.0.0.0/0')).to eql nil } + it { expect(subject.host_to_mask('!0.0.0.0/0')).to eql nil } + it { expect(subject.host_to_mask('::/0')).to eql nil } + it { expect(subject.host_to_mask('! ::/0')).to eql nil } + end + + describe '#icmp_name_to_number' do + describe 'proto unsupported' do + subject { resource } + + %w{inet5 inet8 foo}.each do |proto| + it "should reject invalid proto #{proto}" do + expect { subject.icmp_name_to_number('echo-reply', proto) }. + to raise_error(ArgumentError, "unsupported protocol family '#{proto}'") + end + end + end + + describe 'proto IPv4' do + proto = 'inet' + subject { resource } + it { expect(subject.icmp_name_to_number('echo-reply', proto)).to eql '0' } + it { expect(subject.icmp_name_to_number('destination-unreachable', proto)).to eql '3' } + it { expect(subject.icmp_name_to_number('source-quench', proto)).to eql '4' } + it { expect(subject.icmp_name_to_number('redirect', proto)).to eql '6' } + it { expect(subject.icmp_name_to_number('echo-request', proto)).to eql '8' } + it { expect(subject.icmp_name_to_number('router-advertisement', proto)).to eql '9' } + it { expect(subject.icmp_name_to_number('router-solicitation', proto)).to eql '10' } + it { expect(subject.icmp_name_to_number('time-exceeded', proto)).to eql '11' } + it { expect(subject.icmp_name_to_number('parameter-problem', proto)).to eql '12' } + it { expect(subject.icmp_name_to_number('timestamp-request', proto)).to eql '13' } + it { expect(subject.icmp_name_to_number('timestamp-reply', proto)).to eql '14' } + it { expect(subject.icmp_name_to_number('address-mask-request', proto)).to eql '17' } + it { expect(subject.icmp_name_to_number('address-mask-reply', proto)).to eql '18' } + end + + describe 'proto IPv6' do + proto = 'inet6' + subject { resource } + it { expect(subject.icmp_name_to_number('destination-unreachable', proto)).to eql '1' } + it { expect(subject.icmp_name_to_number('time-exceeded', proto)).to eql '3' } + it { expect(subject.icmp_name_to_number('parameter-problem', proto)).to eql '4' } + it { expect(subject.icmp_name_to_number('echo-request', proto)).to eql '128' } + it { expect(subject.icmp_name_to_number('echo-reply', proto)).to eql '129' } + it { expect(subject.icmp_name_to_number('router-solicitation', proto)).to eql '133' } + it { expect(subject.icmp_name_to_number('router-advertisement', proto)).to eql '134' } + it { expect(subject.icmp_name_to_number('neighbour-solicitation', proto)).to eql '135' } + it { expect(subject.icmp_name_to_number('neighbour-advertisement', proto)).to eql '136' } + it { expect(subject.icmp_name_to_number('redirect', proto)).to eql '137' } + end + end + + describe '#string_to_port' do + subject { resource } + it { expect(subject.string_to_port('80','tcp')).to eql '80' } + it { expect(subject.string_to_port(80,'tcp')).to eql '80' } + it { expect(subject.string_to_port('http','tcp')).to eql '80' } + it { expect(subject.string_to_port('domain','udp')).to eql '53' } + end + + describe '#to_hex32' do + subject { resource } + it { expect(subject.to_hex32('0')).to eql '0x0' } + it { expect(subject.to_hex32('0x32')).to eql '0x32' } + it { expect(subject.to_hex32('42')).to eql '0x2a' } + it { expect(subject.to_hex32('4294967295')).to eql '0xffffffff' } + it { expect(subject.to_hex32('4294967296')).to eql nil } + it { expect(subject.to_hex32('-1')).to eql nil } + it { expect(subject.to_hex32('bananas')).to eql nil } + end + + describe '#persist_iptables' do + before { Facter.clear } + subject { resource } + + describe 'when proto is IPv4' do + let(:proto) { 'IPv4' } + + it 'is expected to exec /sbin/service if running RHEL 6 or earlier' do + allow(Facter.fact(:osfamily)).to receive(:value).and_return('RedHat') + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('RedHat') + allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return('6') + + expect(subject).to receive(:execute).with(%w{/sbin/service iptables save}) + subject.persist_iptables(proto) + end + + it 'is expected to exec for systemd if running RHEL 7 or greater' do + allow(Facter.fact(:osfamily)).to receive(:value).and_return('RedHat') + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('RedHat') + allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return('7') + + expect(subject).to receive(:execute).with(%w{/usr/libexec/iptables/iptables.init save}) + subject.persist_iptables(proto) + end + + it 'is expected to exec for systemd if running Fedora 15 or greater' do + allow(Facter.fact(:osfamily)).to receive(:value).and_return('RedHat') + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Fedora') + allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return('15') + + expect(subject).to receive(:execute).with(%w{/usr/libexec/iptables/iptables.init save}) + subject.persist_iptables(proto) + end + + it 'is expected to exec for CentOS 6 identified from operatingsystem and operatingsystemrelease' do + allow(Facter.fact(:osfamily)).to receive(:value).and_return(nil) + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('CentOS') + allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return('6.5') + expect(subject).to receive(:execute).with(%w{/sbin/service iptables save}) + subject.persist_iptables(proto) + end + + it 'is expected to exec for CentOS 7 identified from operatingsystem and operatingsystemrelease' do + allow(Facter.fact(:osfamily)).to receive(:value).and_return(nil) + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('CentOS') + allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return('7.0.1406') + expect(subject).to receive(:execute).with(%w{/usr/libexec/iptables/iptables.init save}) + subject.persist_iptables(proto) + end + + it 'is expected to exec for Archlinux identified from osfamily' do + allow(Facter.fact(:osfamily)).to receive(:value).and_return('Archlinux') + expect(subject).to receive(:execute).with(['/bin/sh', '-c', '/usr/sbin/iptables-save > /etc/iptables/iptables.rules']) + subject.persist_iptables(proto) + end + + it 'is expected to raise a warning when exec fails' do + allow(Facter.fact(:osfamily)).to receive(:value).and_return('RedHat') + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('RedHat') + allow(Facter.fact(:operatingsystemrelease)).to receive(:value).and_return('6') + + expect(subject).to receive(:execute).with(%w{/sbin/service iptables save}). + and_raise(Puppet::ExecutionFailure, 'some error') + expect(subject).to receive(:warning).with('Unable to persist firewall rules: some error') + subject.persist_iptables(proto) + end + end + + describe 'when proto is IPv6' do + let(:proto) { 'IPv6' } + + it 'is expected to exec for newer Ubuntu' do + allow(Facter.fact(:osfamily)).to receive(:value).and_return(nil) + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Ubuntu') + allow(Facter.fact(:iptables_persistent_version)).to receive(:value).and_return('0.5.3ubuntu2') + expect(subject).to receive(:execute).with(%w{/usr/sbin/service iptables-persistent save}) + subject.persist_iptables(proto) + end + + it 'is expected to not exec for older Ubuntu which does not support IPv6' do + allow(Facter.fact(:osfamily)).to receive(:value).and_return(nil) + allow(Facter.fact(:operatingsystem)).to receive(:value).and_return('Ubuntu') + allow(Facter.fact(:iptables_persistent_version)).to receive(:value).and_return('0.0.20090701') + expect(subject).to receive(:execute).never + subject.persist_iptables(proto) + end + + it 'is expected to not exec for Suse which is not supported' do + allow(Facter.fact(:osfamily)).to receive(:value).and_return('Suse') + expect(subject).to receive(:execute).never + subject.persist_iptables(proto) + end + end + end +end diff --git a/environments/production/modules/firewall/spec/unit/puppet/util/ipcidr_spec.rb b/environments/production/modules/firewall/spec/unit/puppet/util/ipcidr_spec.rb new file mode 100644 index 0000000..8f718d2 --- /dev/null +++ b/environments/production/modules/firewall/spec/unit/puppet/util/ipcidr_spec.rb @@ -0,0 +1,77 @@ +require 'spec_helper' + +describe 'Puppet::Util::IPCidr' do + describe 'ipv4 address' do + before { @ipaddr = Puppet::Util::IPCidr.new('96.126.112.51') } + subject { @ipaddr } + it { expect(subject.cidr).to eql '96.126.112.51/32' } + it { expect(subject.prefixlen).to eql 32 } + it { expect(subject.netmask).to eql '255.255.255.255' } + end + + describe 'single ipv4 address with cidr' do + before { @ipcidr = Puppet::Util::IPCidr.new('96.126.112.51/32') } + subject { @ipcidr } + it { expect(subject.cidr).to eql '96.126.112.51/32' } + it { expect(subject.prefixlen).to eql 32 } + it { expect(subject.netmask).to eql '255.255.255.255' } + end + + describe 'ipv4 address range with cidr' do + before { @ipcidr = Puppet::Util::IPCidr.new('96.126.112.0/24') } + subject { @ipcidr } + it { expect(subject.cidr).to eql '96.126.112.0/24' } + it { expect(subject.prefixlen).to eql 24 } + it { expect(subject.netmask).to eql '255.255.255.0' } + end + + # https://tickets.puppetlabs.com/browse/MODULES-3215 + describe 'ipv4 address range with invalid cidr' do + before { @ipcidr = Puppet::Util::IPCidr.new('96.126.112.20/24') } + subject { @ipcidr } + specify { subject.cidr.should == '96.126.112.0/24' } # .20 is expected to + # be silently dropped. + specify { subject.prefixlen.should == 24 } + specify { subject.netmask.should == '255.255.255.0' } + end + + describe 'ipv4 open range with cidr' do + before { @ipcidr = Puppet::Util::IPCidr.new('0.0.0.0/0') } + subject { @ipcidr } + it { expect(subject.cidr).to eql '0.0.0.0/0' } + it { expect(subject.prefixlen).to eql 0 } + it { expect(subject.netmask).to eql '0.0.0.0' } + end + + describe 'ipv6 address' do + before { @ipaddr = Puppet::Util::IPCidr.new('2001:db8:85a3:0:0:8a2e:370:7334') } + subject { @ipaddr } + it { expect(subject.cidr).to eql '2001:db8:85a3::8a2e:370:7334/128' } + it { expect(subject.prefixlen).to eql 128 } + it { expect(subject.netmask).to eql 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff' } + end + + describe 'single ipv6 addr with cidr' do + before { @ipaddr = Puppet::Util::IPCidr.new('2001:db8:85a3:0:0:8a2e:370:7334/128') } + subject { @ipaddr } + it { expect(subject.cidr).to eql '2001:db8:85a3::8a2e:370:7334/128' } + it { expect(subject.prefixlen).to eql 128 } + it { expect(subject.netmask).to eql 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff' } + end + + describe 'ipv6 addr range with cidr' do + before { @ipaddr = Puppet::Util::IPCidr.new('2001:db8:1234::/48') } + subject { @ipaddr } + it { expect(subject.cidr).to eql '2001:db8:1234::/48' } + it { expect(subject.prefixlen).to eql 48 } + it { expect(subject.netmask).to eql 'ffff:ffff:ffff:0000:0000:0000:0000:0000' } + end + + describe 'ipv6 open range with cidr' do + before { @ipaddr = Puppet::Util::IPCidr.new('::/0') } + subject { @ipaddr } + it { expect(subject.cidr).to eql '::/0' } + it { expect(subject.prefixlen).to eql 0 } + it { expect(subject.netmask).to eql '0000:0000:0000:0000:0000:0000:0000:0000' } + end +end diff --git a/environments/production/modules/inifile/CHANGELOG.md b/environments/production/modules/inifile/CHANGELOG.md new file mode 100644 index 0000000..9cacaec --- /dev/null +++ b/environments/production/modules/inifile/CHANGELOG.md @@ -0,0 +1,265 @@ +## Supported Release 1.6.0 +### Summary +This release expands functionality around sub-settings and adds the `refreshonly` parameter so the user can specify whether a resource should or should not respond to a refresh event. + +### Features +- `refreshonly` decide whether or not a value should be updated as part of a refresh +- `insert_type` choose where the sub-setting is placed in the final string +- `subsetting_key_val_separator` specify a key/value separator for sub-settings + +### Bugfixes +- MODULES-3145 Cast values to strings before passing to provider + + +## Supported Release 1.5.0 +### Summary +This release adds the long-awaited `show_diff` parameter for diffing the complete file on changes (or can also just show the md5 sums). + +### Features +- Added `show_diff` parameter to show diffs on changes. +- Remove empty ini sections when the last line in the section is removed. + +### Bugfixes +- Workaround `create_ini_settings()` duplicate resources puppet bug PUP-4709 + +## Supported Release 1.4.3 +###Summary + +Small release for support of newer PE versions. This increments the version of PE in the metadata.json file. + +## 2015-09-01 - Supported Release 1.4.2 +### Summary +This release adds some bugfixes. + +####Bugfixes +- MODULES-2212 Add use_exact_match parameter for subsettings +- MODULES-1908 Munge the setting to ensure we always strip the whitespace +- MODULES-2369 Support a space as a key_val_separator + +## 2015-07-15 - Supported Release 1.4.1 +### Summary +This release bumps the metadata for PE up. + +##2015-07-07 - Supported Releases 1.4.0 +###Summary + +This is primarily a release which includes acceptance tests updates, but also includes some minor bug fixes and improvements + +####Features +- Solaris 12 Support +- Acceptance testing improvements + +####Bugfixes +- MODULES-1599 Match only on space and tab whitespace after k/v separator + +##2015-06-09 - Supported Releases 1.3.0 +###Summary + +This is primarily a feature release, but also includes test fixes, documentation updates and synchronization of files with modulesync. + +####Features +- Synchronized files using modulesync +- Improved documentation +- Allow changing key value separator beyond indentation +- Adding the ability to change regex match for $section in inifile + +####Bugfixes +- pin beaker-rspec for windows testing +- pin rspec gems for testing +- Adds default values for section +- Fixed names containing spaces + +##2014-11-11 - Supported Releases 1.2.0 +###Summary + +This is primarily a bugfix release, but also includes documentation updates and synchronization of files with modulesync. + +####Features +- Synchronized files using modulesync +- Improved documentation with a warning about old, manually installed inifile with PE3.3+ + +####Bugfixes +- Fix issue where single character settings were not being saved + +##2014-09-30 - Supported Releases 1.1.4 +###Summary + +This release includes documentation and test updates. + +##2014-07-15 - Supported Release 1.1.3 +###Summary + +This release merely updates metadata.json so the module can be uninstalled and +upgraded via the puppet module command. + +##2014-07-10 - Supported Release 1.1.2 +###Summary + +This is a re-packaging release. + +##2014-07-07 - Release 1.1.1 +###Summary + +This supported bugfix release corrects the inifile section header detection +regex (so you can use more characters in your section titles). + +####Bugfixes +- Correct section regex to allow anything other than ] +- Correct `exists?` to return a boolean +- Lots of test updates +- Add missing CONTRIBUTING.md + +##2014-06-04 - Release 1.1.0 +###Summary + +This is a compatibility and feature release. This release adds one new +feature, the ability to control the quote character used. This allows you to +do things like: + +``` +ini_subsetting { '-Xms': + ensure => present, + path => '/some/config/file', + section => '', + setting => 'JAVA_ARGS', + quote_char => '"', + subsetting => '-Xms' + value => '256m', + } +``` + +Which builds: + +``` +JAVA_ARGS="-Xmx256m -Xms256m" +``` + +####Features +- Add quote_char parameter to the ini_subsetting resource type + +####Bugfixes + +####Known Bugs +* No known bugs + +##2014-03-04 - Supported Release 1.0.3 +###Summary + +This is a supported release. It has only test changes. + +####Features + +####Bugfixes + +####Known Bugs +* No known bugs + + +##2014-02-26 - Version 1.0.2 +###Summary +This release adds supported platforms to metadata.json and contains spec fixes + + +##2014-02-12 - Version 1.0.1 +###Summary +This release is a bugfix for handling whitespace/[]'s better, and adding a +bunch of tests. + +####Bugfixes +- Handle whitespace in sections +- Handle square brances in values +- Add metadata.json +- Update some travis testing +- Tons of beaker-rspec tests + + +##2013-07-16 - Version 1.0.0 +####Features +- Handle empty values. +- Handle whitespace in settings names (aka: server role = something) +- Add mechanism for allowing ini_setting subclasses to override the +formation of the namevar during .instances, to allow for ini_setting +derived types that manage flat ini-file-like files and still purge +them. + +--- +##2013-05-28 - Chris Price - 0.10.3 + * Fix bug in subsetting handling for new settings (cbea5dc) + +##2013-05-22 - Chris Price - 0.10.2 + * Better handling of quotes for subsettings (1aa7e60) + +##2013-05-21 - Chris Price - 0.10.1 + * Change constants to class variables to avoid ruby warnings (6b19864) + +##2013-04-10 - Erik Dalén - 0.10.1 + * Style fixes (c4af8c3) + +##2013-04-02 - Dan Bode - 0.10.1 + * Add travisfile and Gemfile (c2052b3) + +##2013-04-02 - Chris Price - 0.10.1 + * Update README.markdown (ad38a08) + +##2013-02-15 - Karel Brezina - 0.10.0 + * Added 'ini_subsetting' custom resource type (4351d8b) + +##2013-03-11 - Dan Bode - 0.10.0 + * guard against nil indentation values (5f71d7f) + +##2013-01-07 - Dan Bode - 0.10.0 + * Add purging support to ini file (2f22483) + +##2013-02-05 - James Sweeny - 0.10.0 + * Fix test to use correct key_val_parameter (b1aff63) + +##2012-11-06 - Chris Price - 0.10.0 + * Added license file w/Apache 2.0 license (5e1d203) + +##2012-11-02 - Chris Price - 0.9.0 + * Version 0.9.0 released + +##2012-10-26 - Chris Price - 0.9.0 + * Add detection for commented versions of settings (a45ab65) + +##2012-10-20 - Chris Price - 0.9.0 + * Refactor to clarify implementation of `save` (f0d443f) + +##2012-10-20 - Chris Price - 0.9.0 + * Add example for `ensure=absent` (e517148) + +##2012-10-20 - Chris Price - 0.9.0 + * Better handling of whitespace lines at ends of sections (845fa70) + +##2012-10-20 - Chris Price - 0.9.0 + * Respect indentation / spacing for existing sections and settings (c2c26de) + +##2012-10-17 - Chris Price - 0.9.0 + * Minor tweaks to handling of removing settings (cda30a6) + +##2012-10-10 - Dan Bode - 0.9.0 + * Add support for removing lines (1106d70) + +##2012-10-02 - Dan Bode - 0.9.0 + * Make value a property (cbc90d3) + +##2012-10-02 - Dan Bode - 0.9.0 + * Make ruby provider a better parent. (1564c47) + +##2012-09-29 - Reid Vandewiele - 0.9.0 + * Allow values with spaces to be parsed and set (3829e20) + +##2012-09-24 - Chris Price - 0.0.3 + * Version 0.0.3 released + +##2012-09-20 - Chris Price - 0.0.3 + * Add validation for key_val_separator (e527908) + +##2012-09-19 - Chris Price - 0.0.3 + * Allow overriding separator string between key/val pairs (8d1fdc5) + +##2012-08-20 - Chris Price - 0.0.2 + * Version 0.0.2 released + +##2012-08-17 - Chris Price - 0.0.2 + * Add support for "global" section at beginning of file (c57dab4) diff --git a/environments/production/modules/inifile/CONTRIBUTING.md b/environments/production/modules/inifile/CONTRIBUTING.md new file mode 100644 index 0000000..3c3f1e7 --- /dev/null +++ b/environments/production/modules/inifile/CONTRIBUTING.md @@ -0,0 +1,218 @@ +Checklist (and a short version for the impatient) +================================================= + + * Commits: + + - Make commits of logical units. + + - Check for unnecessary whitespace with "git diff --check" before + committing. + + - Commit using Unix line endings (check the settings around "crlf" in + git-config(1)). + + - Do not check in commented out code or unneeded files. + + - The first line of the commit message should be a short + description (50 characters is the soft limit, excluding ticket + number(s)), and should skip the full stop. + + - Associate the issue in the message. The first line should include + the issue number in the form "(#XXXX) Rest of message". + + - The body should provide a meaningful commit message, which: + + - uses the imperative, present tense: "change", not "changed" or + "changes". + + - includes motivation for the change, and contrasts its + implementation with the previous behavior. + + - Make sure that you have tests for the bug you are fixing, or + feature you are adding. + + - Make sure the test suites passes after your commit: + `bundle exec rspec spec/acceptance` More information on [testing](#Testing) below + + - When introducing a new feature, make sure it is properly + documented in the README.md + + * Submission: + + * Pre-requisites: + + - Make sure you have a [GitHub account](https://github.com/join) + + - [Create a ticket](https://tickets.puppetlabs.com/secure/CreateIssue!default.jspa), or [watch the ticket](https://tickets.puppetlabs.com/browse/) you are patching for. + + * Preferred method: + + - Fork the repository on GitHub. + + - Push your changes to a topic branch in your fork of the + repository. (the format ticket/1234-short_description_of_change is + usually preferred for this project). + + - Submit a pull request to the repository in the puppetlabs + organization. + +The long version +================ + + 1. Make separate commits for logically separate changes. + + Please break your commits down into logically consistent units + which include new or changed tests relevant to the rest of the + change. The goal of doing this is to make the diff easier to + read for whoever is reviewing your code. In general, the easier + your diff is to read, the more likely someone will be happy to + review it and get it into the code base. + + If you are going to refactor a piece of code, please do so as a + separate commit from your feature or bug fix changes. + + We also really appreciate changes that include tests to make + sure the bug is not re-introduced, and that the feature is not + accidentally broken. + + Describe the technical detail of the change(s). If your + description starts to get too long, that is a good sign that you + probably need to split up your commit into more finely grained + pieces. + + Commits which plainly describe the things which help + reviewers check the patch and future developers understand the + code are much more likely to be merged in with a minimum of + bike-shedding or requested changes. Ideally, the commit message + would include information, and be in a form suitable for + inclusion in the release notes for the version of Puppet that + includes them. + + Please also check that you are not introducing any trailing + whitespace or other "whitespace errors". You can do this by + running "git diff --check" on your changes before you commit. + + 2. Sending your patches + + To submit your changes via a GitHub pull request, we _highly_ + recommend that you have them on a topic branch, instead of + directly on "master". + It makes things much easier to keep track of, especially if + you decide to work on another thing before your first change + is merged in. + + GitHub has some pretty good + [general documentation](http://help.github.com/) on using + their site. They also have documentation on + [creating pull requests](http://help.github.com/send-pull-requests/). + + In general, after pushing your topic branch up to your + repository on GitHub, you can switch to the branch in the + GitHub UI and click "Pull Request" towards the top of the page + in order to open a pull request. + + + 3. Update the related GitHub issue. + + If there is a GitHub issue associated with the change you + submitted, then you should update the ticket to include the + location of your branch, along with any other commentary you + may wish to make. + +Testing +======= + +Getting Started +--------------- + +Our puppet modules provide [`Gemfile`](./Gemfile)s which can tell a ruby +package manager such as [bundler](http://bundler.io/) what Ruby packages, +or Gems, are required to build, develop, and test this software. + +Please make sure you have [bundler installed](http://bundler.io/#getting-started) +on your system, then use it to install all dependencies needed for this project, +by running + +```shell +% bundle install +Fetching gem metadata from https://rubygems.org/........ +Fetching gem metadata from https://rubygems.org/.. +Using rake (10.1.0) +Using builder (3.2.2) +-- 8><-- many more --><8 -- +Using rspec-system-puppet (2.2.0) +Using serverspec (0.6.3) +Using rspec-system-serverspec (1.0.0) +Using bundler (1.3.5) +Your bundle is complete! +Use `bundle show [gemname]` to see where a bundled gem is installed. +``` + +NOTE some systems may require you to run this command with sudo. + +If you already have those gems installed, make sure they are up-to-date: + +```shell +% bundle update +``` + +With all dependencies in place and up-to-date we can now run the tests: + +```shell +% bundle exec rake spec +``` + +This will execute all the [rspec tests](http://rspec-puppet.com/) tests +under [spec/defines](./spec/defines), [spec/classes](./spec/classes), +and so on. rspec tests may have the same kind of dependencies as the +module they are testing. While the module defines in its [Modulefile](./Modulefile), +rspec tests define them in [.fixtures.yml](./fixtures.yml). + +Some puppet modules also come with [beaker](https://github.com/puppetlabs/beaker) +tests. These tests spin up a virtual machine under +[VirtualBox](https://www.virtualbox.org/)) with, controlling it with +[Vagrant](http://www.vagrantup.com/) to actually simulate scripted test +scenarios. In order to run these, you will need both of those tools +installed on your system. + +You can run them by issuing the following command + +```shell +% bundle exec rake spec_clean +% bundle exec rspec spec/acceptance +``` + +This will now download a pre-fabricated image configured in the [default node-set](./spec/acceptance/nodesets/default.yml), +install puppet, copy this module and install its dependencies per [spec/spec_helper_acceptance.rb](./spec/spec_helper_acceptance.rb) +and then run all the tests under [spec/acceptance](./spec/acceptance). + +Writing Tests +------------- + +XXX getting started writing tests. + +If you have commit access to the repository +=========================================== + +Even if you have commit access to the repository, you will still need to +go through the process above, and have someone else review and merge +in your changes. The rule is that all changes must be reviewed by a +developer on the project (that did not write the code) to ensure that +all changes go through a code review process. + +Having someone other than the author of the topic branch recorded as +performing the merge is the record that they performed the code +review. + + +Additional Resources +==================== + +* [Getting additional help](http://puppet.com/community/get-help) + +* [Writing tests](https://docs.puppet.com/guides/module_guides/bgtm.html#step-three-module-testing) + +* [General GitHub documentation](http://help.github.com/) + +* [GitHub pull request documentation](http://help.github.com/send-pull-requests/) + diff --git a/environments/production/modules/inifile/Gemfile b/environments/production/modules/inifile/Gemfile new file mode 100644 index 0000000..c7da908 --- /dev/null +++ b/environments/production/modules/inifile/Gemfile @@ -0,0 +1,41 @@ +#This file is generated by ModuleSync, do not edit. + +source ENV['GEM_SOURCE'] || "https://rubygems.org" + +def location_for(place, version = nil) + if place =~ /^(git[:@][^#]*)#(.*)/ + [version, { :git => $1, :branch => $2, :require => false}].compact + elsif place =~ /^file:\/\/(.*)/ + ['>= 0', { :path => File.expand_path($1), :require => false}] + else + [place, version, { :require => false}].compact + end +end + +group :development, :unit_tests do + gem 'metadata-json-lint', :require => false + gem 'puppet_facts', :require => false + gem 'puppet-blacksmith', '>= 3.4.0', :require => false + gem 'puppetlabs_spec_helper', :require => false + gem 'rspec-puppet', '>= 2.3.2', :require => false + gem 'simplecov', :require => false +end +group :system_tests do + gem 'beaker-rspec', *location_for(ENV['BEAKER_RSPEC_VERSION'] || '>= 3.4') + gem 'beaker', *location_for(ENV['BEAKER_VERSION']) + gem 'serverspec', :require => false + gem 'beaker-puppet_install_helper', :require => false + gem 'master_manipulator', :require => false + gem 'beaker-hostgenerator', *location_for(ENV['BEAKER_HOSTGENERATOR_VERSION']) +end + +# json_pure 2.0.2 added a requirement on ruby >= 2. We pin to json_pure 2.0.1 +# if using ruby 1.x +gem 'json_pure', '<=2.0.1', :require => false if RUBY_VERSION =~ /^1\./ + +gem 'facter', *location_for(ENV['FACTER_GEM_VERSION']) +gem 'puppet', *location_for(ENV['PUPPET_GEM_VERSION']) + +if File.exists? "#{__FILE__}.local" + eval(File.read("#{__FILE__}.local"), binding) +end diff --git a/environments/production/modules/inifile/LICENSE b/environments/production/modules/inifile/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/environments/production/modules/inifile/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/environments/production/modules/inifile/NOTICE b/environments/production/modules/inifile/NOTICE new file mode 100644 index 0000000..bb6ff91 --- /dev/null +++ b/environments/production/modules/inifile/NOTICE @@ -0,0 +1,19 @@ +inifile puppet module + +Copyright (C) 2012-2016 Puppet Labs, Inc. +Copyright (C) 2012 Chris Price + +Puppet Labs can be contacted at: info@puppetlabs.com + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/environments/production/modules/inifile/README.markdown b/environments/production/modules/inifile/README.markdown new file mode 100644 index 0000000..e5407c5 --- /dev/null +++ b/environments/production/modules/inifile/README.markdown @@ -0,0 +1,482 @@ +#inifile + +[![Build Status](https://travis-ci.org/puppetlabs/puppetlabs-inifile.png?branch=master)](https://travis-ci.org/puppetlabs/puppetlabs-inifile) + +####Table of Contents + +1. [Overview](#overview) +2. [Module Description - What the module does and why it is useful](#module-description) +3. [Setup - The basics of getting started with inifile module](#setup) + * [Beginning with inifile](#beginning-with-inifile) +4. [Usage - Configuration options and additional functionality](#usage) +5. [Reference - An under-the-hood peek at what the module is doing and how](#reference) +5. [Limitations - OS compatibility, etc.](#limitations) +6. [Development - Guide for contributing to the module](#development) + +##Overview + +The inifile module lets Puppet manage settings stored in INI-style configuration files. + +##Module Description + +Many applications use INI-style configuration files to store their settings. This module supplies two custom resource types to let you manage those settings through Puppet. + +##Setup + +###Beginning with inifile + +To manage a single setting in an INI file, add the `ini_setting` type to a class: + +~~~puppet +ini_setting { "sample setting": + ensure => present, + path => '/tmp/foo.ini', + section => 'bar', + setting => 'baz', + value => 'quux', +} +~~~ + +##Usage + + +The inifile module tries hard not to manipulate your file any more than it needs to. In most cases, it doesn't affect the original whitespace, comments, ordering, etc. + + * Supports comments starting with either '#' or ';'. + * Supports either whitespace or no whitespace around '='. + * Adds any missing sections to the INI file. + +###Manage multiple values in a setting + +Use the `ini_subsetting` type: + +~~~puppet +ini_subsetting {'sample subsetting': + ensure => present, + section => '', + key_val_separator => '=', + path => '/etc/default/pe-puppetdb', + setting => 'JAVA_ARGS', + subsetting => '-Xmx', + value => '512m', +} +~~~ + +Results in managing this `-Xmx` subsetting: + +~~~puppet +JAVA_ARGS="-Xmx512m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof" +~~~ + + +###Use a non-standard section header + +~~~puppet +ini_setting { 'default minage': + ensure => present, + path => '/etc/security/users', + section => 'default', + setting => 'minage', + value => '1', + section_prefix => '', + section_suffix => ':', +} +~~~ + +Results in: + +~~~puppet +default: + minage = 1 +~~~ + +###Implement child providers + +You might want to create child providers that inherit the `ini_setting` provider, for one or both of these purposes: + + * Make a custom resource to manage an application that stores its settings in INI files, without recreating the code to manage the files themselves. + + * [Purge all unmanaged settings](https://docs.puppetlabs.com/references/latest/type.html#resources-attribute-purge) from a managed INI file. + +To implement child providers, first specify a custom type. Have it implement a namevar called `name` and a property called `value`: + +~~~ruby +#my_module/lib/puppet/type/glance_api_config.rb +Puppet::Type.newtype(:glance_api_config) do + ensurable + newparam(:name, :namevar => true) do + desc 'Section/setting name to manage from glance-api.conf' + # namevar should be of the form section/setting + newvalues(/\S+\/\S+/) + end + newproperty(:value) do + desc 'The value of the setting to define' + munge do |v| + v.to_s.strip + end + end +end +~~~ + +Your type also needs a provider that uses the `ini_setting` provider as its parent: + +~~~ruby +# my_module/lib/puppet/provider/glance_api_config/ini_setting.rb +Puppet::Type.type(:glance_api_config).provide( + :ini_setting, + # set ini_setting as the parent provider + :parent => Puppet::Type.type(:ini_setting).provider(:ruby) +) do + # implement section as the first part of the namevar + def section + resource[:name].split('/', 2).first + end + def setting + # implement setting as the second part of the namevar + resource[:name].split('/', 2).last + end + # hard code the file path (this allows purging) + def self.file_path + '/etc/glance/glance-api.conf' + end +end +~~~ + +Now the settings in /etc/glance/glance-api.conf file can be managed as individual resources: + +~~~puppet +glance_api_config { 'HEADER/important_config': + value => 'secret_value', +} +~~~ + +If you've implemented self.file_path, you can have Puppet purge the file of all lines that aren't implemented as Puppet resources: + +~~~puppet +resources { 'glance_api_config' + purge => true, +} +~~~ + +### Manage multiple ini_settings + +To manage multiple ini_settings, use the [`create_ini_settings`](#function-create_ini_settings) function. + +~~~puppet +$defaults = { 'path' => '/tmp/foo.ini' } +$example = { 'section1' => { 'setting1' => 'value1' } } +create_ini_settings($example, $defaults) +~~~ + +results in: + +~~~puppet +ini_setting { '[section1] setting1': + ensure => present, + section => 'section1', + setting => 'setting1', + value => 'value1', + path => '/tmp/foo.ini', +} +~~~ + +To include special parameters, the following code: + +~~~puppet +$defaults = { 'path' => '/tmp/foo.ini' } +$example = { + 'section1' => { + 'setting1' => 'value1', + 'settings2' => { + 'ensure' => 'absent' + } + } +} +create_ini_settings($example, $defaults) +~~~ + +results in: + +~~~puppet +ini_setting { '[section1] setting1': + ensure => present, + section => 'section1', + setting => 'setting1', + value => 'value1', + path => '/tmp/foo.ini', +} +ini_setting { '[section1] setting2': + ensure => absent, + section => 'section1', + setting => 'setting2', + path => '/tmp/foo.ini', +} +~~~ + +#### Manage multiple ini_settings with Hiera + +This example requires Puppet 3.x/4.x, as it uses automatic retrieval of Hiera data for class parameters and `puppetlabs/stdlib`. + +For the profile `example`: + +~~~puppet +class profile::example ( + $settings, +) { + validate_hash($settings) + $defaults = { 'path' => '/tmp/foo.ini' } + create_ini_settings($settings, $defaults) +} +~~~ + +Provide this in your Hiera data: + +~~~puppet +profile::example::settings: + section1: + setting1: value1 + setting2: value2 + setting3: + ensure: absent +~~~ + +Results in: + +~~~puppet +ini_setting { '[section1] setting1': + ensure => present, + section => 'section1', + setting => 'setting1', + value => 'value1', + path => '/tmp/foo.ini', +} +ini_setting { '[section1] setting2': + ensure => present, + section => 'section1', + setting => 'setting2', + value => 'value2', + path => '/tmp/foo.ini', +} +ini_setting { '[section1] setting3': + ensure => absent, + section => 'section1', + setting => 'setting3', + path => '/tmp/foo.ini', +} +~~~ + + +##Reference + +###Public Types + + * [`ini_setting`](#type-ini_setting) + + * [`ini_subsetting`](#type-ini_subsetting) + +###Public Functions + + * [`create_ini_settings`](#function-create_ini_settings) + +### Type: ini_setting + +Manages a setting within an INI file. + +#### Parameters + +##### `ensure` + +Determines whether the specified setting should exist. Valid options: 'present' and 'absent'. Default value: 'present'. + +##### `key_val_separator` + +*Optional.* Specifies a string to use between each setting name and value (e.g., to determine whether the separator includes whitespace). Valid options: a string. Default value: ' = '. + +##### `name` + +*Optional.* Specifies an arbitrary name to identify the resource. Valid options: a string. Default value: the title of your declared resource. + +##### `path` + +*Required.* Specifies an INI file containing the setting to manage. Valid options: a string containing an absolute path. + +##### `section` + +*Optional.* Designates a section of the specified INI file containing the setting to manage. To manage a global setting (at the beginning of the file, before any named sections) enter "". Defaults to "". Valid options: a string. + +##### `setting` + +*Required.* Designates a setting to manage within the specified INI file and section. Valid options: a string. + +##### `show_diff` + +*Optional.* Prevents outputting actual values to the logfile. Useful for handling of passwords and other sensitive information. Possible values are: + * `true`: This allows all values to be passed to logfiles. (default) + * `false`: The values in the logfiles will be replaced with `[redacted sensitive information]`. + * `md5`: The values in the logfiles will be replaced with their md5 hash. + +Global show_diff configuraton takes priority over this one - +[https://docs.puppetlabs.com/references/latest/configuration.html#showdiff]([https://docs.puppetlabs.com/references/latest/configuration.html#showdiff]. +). Default value: 'true'. + +##### `value` + +*Optional.* Supplies a value for the specified setting. Valid options: a string. Default value: undefined. + +##### `section_prefix` + +*Optional.* Designates the string that will appear before the section's name. Default value: "[" + +##### `section_suffix` + +*Optional.* Designates the string that will appear after the section's name. Default value: "]". + +##### `refreshonly` + +*Optional.* A boolean to indicate whether or not the value associated with the setting should be updated if this resource is only part of a refresh event. Default value: **false**. + +For example, if we want a timestamp associated with the last time a setting's value was updated, we could do something like this: + +~~~ +ini_setting { 'foosetting': + ensure => present, + path => '/tmp/file.ini', + section => 'foo', + setting => 'foosetting', + value => 'bar', + notify => Ini_Setting['foosetting_timestamp'], +} + +$now = strftime('%Y-%m-%d %H:%M:%S') +ini_setting {'foosetting_timestamp': + ensure => present, + path => '/tmp/file.ini', + section => 'foo', + setting => 'foosetting_timestamp', + value => $now, + refreshonly => true, +} +~~~ + +**NOTE:** This type finds all sections in the file by looking for lines like `${section_prefix}${title}${section_suffix}`. + +### Type: ini_subsetting + +Manages multiple values within the same INI setting. + +#### Parameters + +##### `ensure` + +Specifies whether the subsetting should be present. Valid options: 'present' and 'absent'. Default value: 'present'. + +##### `key_val_separator` + +*Optional.* Specifies a string to use between setting name and value (e.g., to determine whether the separator includes whitespace). Valid options: a string. Default value: ' = '. + +##### `path` + +*Required.* Specifies an INI file containing the subsetting to manage. Valid options: a string containing an absolute path. + +##### `quote_char` + +*Optional.* The character used to quote the entire value of the setting. Valid values are '', '"', and "'". Defaults to ''. Valid options: '', '"' and "'". Default value: ''. + +##### `section` + +*Optional.* Designates a section of the specified INI file containing the setting to manage. To manage a global setting (at the beginning of the file, before any named sections) enter "". Defaults to "". Valid options: a string. + +##### `setting` + +*Required.* Designates a setting within the specified section containing the subsetting to manage. Valid options: a string. + +##### `show_diff` + +*Optional.* Prevents outputting actual values to the logfile. Useful for handling of passwords and other sensitive information. Possible values are: + * `true`: This allows all values to be passed to logfiles. (default) + * `false`: The values in the logfiles will be replaced with `[redacted sensitive information]`. + * `md5`: The values in the logfiles will be replaced with their md5 hash. + +Global show_diff configuraton takes priority over this one - +[https://docs.puppetlabs.com/references/latest/configuration.html#showdiff]([https://docs.puppetlabs.com/references/latest/configuration.html#showdiff]. +). Default value: 'true'. + +##### `subsetting` + +*Required.* Designates a subsetting to manage within the specified setting. Valid options: a string. + +##### `subsetting_separator` + +*Optional.* Specifies a string to use between subsettings. Valid options: a string. Default value: " ". + +##### `subsetting_key_val_separator` + +*Optional.* Specifies a string to use between subsetting name and value (if there is a separator between the subsetting name and its value). Valid options: a string. Default value: empty string. + +##### `use_exact_match` + +*Optional.* Whether to use partial or exact matching for subsetting. Should be set to true if the subsettings do not have values. Valid options: true, false. Default value: false. + +##### `value` + +*Optional.* Supplies a value for the specified subsetting. Valid options: a string. Default value: undefined. + +##### `insert_type` + +*Optional.* Selects where a new subsetting item should be inserted. + +* *start* - insert at the beginning of the line. +* *end* - insert at the end of the line (default). +* *before* - insert before the specified element if possible. +* *after* - insert after the specified element if possible. +* *index* - insert at the specified index number. + +##### `insert_value` + +*Optional.* The value for the insert type if the value if required. + +### Function: create_ini_settings + +Manages multiple `ini_setting` resources from a hash. Note that this cannot be used with ini_subsettings. + +`create_ini_settings($settings, $defaults)` + +#### Arguments + +##### First argument: `settings` + +*Required.* Specify a hash representing the `ini_setting` resources you want to create. + +##### Second argument: `defaults` + +*Optional.* Accepts a hash to be used as the values for any attributes not defined in the first argument. + +~~~puppet +$example = { + 'section1' => { + 'setting1' => { + 'value' => 'value1', 'path' => '/tmp/foo.ini' + } + } +} +~~~ + +Default value: '{}'. + +##Limitations + +This module has been tested on [all PE-supported platforms](https://forge.puppetlabs.com/supported#compat-matrix), and no issues have been identified. Additionally, it is tested (but not supported) on Windows 7, Mac OS X 10.9, and Solaris 12. + +Due to (PUP-4709) the create_ini_settings function will cause errors when attempting to create multiple ini_settings in one go when using Puppet 4.0.x or 4.1.x. If needed, the temporary fix for this can be found here: https://github.com/puppetlabs/puppetlabs-inifile/pull/196. + +##Development + +Puppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can't access the huge number of platforms and myriad of hardware, software, and deployment configurations that Puppet is intended to serve. + +We want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things. + +For more information, see our [module contribution guide.](https://docs.puppetlabs.com/forge/contributing.html) + +###Contributors + +To see who's already involved, see the [list of contributors.](https://github.com/puppetlabs/puppetlabs-inifile/graphs/contributors) diff --git a/environments/production/modules/inifile/Rakefile b/environments/production/modules/inifile/Rakefile new file mode 100644 index 0000000..8906d23 --- /dev/null +++ b/environments/production/modules/inifile/Rakefile @@ -0,0 +1,42 @@ +require 'puppet_blacksmith/rake_tasks' +require 'puppet-lint/tasks/puppet-lint' +require 'puppetlabs_spec_helper/rake_tasks' + +PuppetLint.configuration.fail_on_warnings = true +PuppetLint.configuration.send('relative') +PuppetLint.configuration.send('disable_140chars') +PuppetLint.configuration.send('disable_class_inherits_from_params_class') +PuppetLint.configuration.send('disable_documentation') +PuppetLint.configuration.send('disable_single_quote_string_with_variables') +PuppetLint.configuration.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp", "bundle/**/*", "vendor/**/*"] + +desc 'Generate pooler nodesets' +task :gen_nodeset do + require 'beaker-hostgenerator' + require 'securerandom' + require 'fileutils' + + agent_target = ENV['TEST_TARGET'] + if ! agent_target + STDERR.puts 'TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat-64default."' + agent_target = 'redhat-64default.' + end + + master_target = ENV['MASTER_TEST_TARGET'] + if ! master_target + STDERR.puts 'MASTER_TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat7-64mdcl"' + master_target = 'redhat7-64mdcl' + end + + targets = "#{master_target}-#{agent_target}" + cli = BeakerHostGenerator::CLI.new([targets]) + nodeset_dir = "tmp/nodesets" + nodeset = "#{nodeset_dir}/#{targets}-#{SecureRandom.uuid}.yaml" + FileUtils.mkdir_p(nodeset_dir) + File.open(nodeset, 'w') do |fh| + fh.print(cli.execute) + end + puts nodeset +end diff --git a/environments/production/modules/inifile/checksums.json b/environments/production/modules/inifile/checksums.json new file mode 100644 index 0000000..fe30dbf --- /dev/null +++ b/environments/production/modules/inifile/checksums.json @@ -0,0 +1,46 @@ +{ + "CHANGELOG.md": "b79d1d9ad75203d493ce29d57688ee52", + "CONTRIBUTING.md": "b78f71c1104f00538d50ad2775f58e95", + "Gemfile": "33b5ea08ef953546af87ba9a7b8ce9e7", + "LICENSE": "3b83ef96387f14655fc854ddc3c6bd57", + "NOTICE": "d8696846ced56eb64cd473c23a68bf64", + "README.markdown": "a332fb6634f4e113d1afd725864e6296", + "Rakefile": "3a79b0672ca13fe46284c635227be459", + "examples/ini_setting.pp": "9c8a9d2c453901cedb106cada253f1f6", + "examples/ini_subsetting.pp": "16ef08c1534754b47120e58fa9e2f068", + "lib/puppet/parser/functions/create_ini_settings.rb": "244ad74b739944457c54bf1d114e8233", + "lib/puppet/provider/ini_setting/ruby.rb": "194c03eab6111e5eb6668ee847cdabcf", + "lib/puppet/provider/ini_subsetting/ruby.rb": "b4f21f2322e23af99f16b73dc7c55a32", + "lib/puppet/type/ini_setting.rb": "e5ff282f6b8baeffb543282d2b804d8b", + "lib/puppet/type/ini_subsetting.rb": "8e45c38f0a3c9e86b4b9de47178743dd", + "lib/puppet/util/external_iterator.rb": "69ad1eb930ca6d8d6b6faea343b4a22e", + "lib/puppet/util/ini_file/section.rb": "f11af8cae180df80bae852861833ea85", + "lib/puppet/util/ini_file.rb": "802af19cfadfbe28e3f348079dc9be77", + "lib/puppet/util/setting_value.rb": "ee28122422640b5d87fac0de43c77a26", + "metadata.json": "08e2d384acc9f2293932c785d67d8830", + "spec/acceptance/ini_setting_spec.rb": "b57f06571b7801300fbe5f9cf7be9da4", + "spec/acceptance/ini_subsetting_spec.rb": "e13b127e174a546a8b66cc68d0b06228", + "spec/acceptance/nodesets/centos-7-x64.yml": "349128a7cfa9a953fb9af67cad52442a", + "spec/acceptance/nodesets/debian-8-x64.yml": "d2d2977900989f30086ad251a14a1f39", + "spec/acceptance/nodesets/default.yml": "b42da5a1ea0c964567ba7495574b8808", + "spec/acceptance/nodesets/docker/centos-7.yml": "8a3892807bdd62306ae4774f41ba11ae", + "spec/acceptance/nodesets/docker/debian-8.yml": "ac8e871d1068c96de5e85a89daaec6df", + "spec/acceptance/nodesets/docker/ubuntu-14.04.yml": "dc42ee922a96908d85b8f0f08203ce58", + "spec/classes/create_ini_settings_test_spec.rb": "606404184ab6f1d34c574ef8f1e73d99", + "spec/classes/create_multiple_ini_settings_spec.rb": "a73fa20198257547dc363b76fb771332", + "spec/classes/inherit_test1_spec.rb": "da7052326a2b51411ac3a69518c8d95e", + "spec/fixtures/create_multiple_ini_settings/manifests/init.pp": "4ef51aaebb61423d3b580690cfa9e284", + "spec/functions/create_ini_settings_spec.rb": "3ccc3ff4925f7c0b764eb0ca9bf8ad2c", + "spec/spec.opts": "a600ded995d948e393fbe2320ba8e51c", + "spec/spec_helper.rb": "b2db3bc02b4ac2fd5142a6621c641b07", + "spec/spec_helper_acceptance.rb": "74f51e1ce2766dcd7c338d6e8e70626d", + "spec/spec_helper_local.rb": "76b869c1f6c144f1defea8239c53d1aa", + "spec/unit/puppet/provider/ini_setting/inheritance_spec.rb": "6d0ce91ba7564c6d66c524ac19f220fb", + "spec/unit/puppet/provider/ini_setting/ruby_spec.rb": "719afd4485bd061c3fb2742b76f01c45", + "spec/unit/puppet/provider/ini_subsetting/ruby_spec.rb": "b9d7e60954a246a1f31d7e18c3550a5c", + "spec/unit/puppet/type/ini_setting_spec.rb": "576fbca30450a0f73a0764865e801b2a", + "spec/unit/puppet/type/ini_subetting_spec.rb": "3b0c58c3b1b9db144dc27fbb91a888da", + "spec/unit/puppet/util/external_iterator_spec.rb": "35cc6e56e0064e496e9151dd778f751f", + "spec/unit/puppet/util/ini_file_spec.rb": "7c9845cfb384ee68ef03f296158343f1", + "spec/unit/puppet/util/setting_value_spec.rb": "535abf7d56dc2d5492df637382cef3c5" +} \ No newline at end of file diff --git a/environments/production/modules/inifile/examples/ini_setting.pp b/environments/production/modules/inifile/examples/ini_setting.pp new file mode 100644 index 0000000..279cb00 --- /dev/null +++ b/environments/production/modules/inifile/examples/ini_setting.pp @@ -0,0 +1,25 @@ +ini_setting { 'sample setting': + ensure => present, + path => '/tmp/foo.ini', + section => 'foo', + setting => 'foosetting', + value => 'FOO!', +} + +ini_setting { 'sample setting2': + ensure => present, + path => '/tmp/foo.ini', + section => 'bar', + setting => 'barsetting', + value => 'BAR!', + key_val_separator => '=', + require => Ini_setting['sample setting'], +} + +ini_setting { 'sample setting3': + ensure => absent, + path => '/tmp/foo.ini', + section => 'bar', + setting => 'bazsetting', + require => Ini_setting['sample setting2'], +} diff --git a/environments/production/modules/inifile/examples/ini_subsetting.pp b/environments/production/modules/inifile/examples/ini_subsetting.pp new file mode 100644 index 0000000..1ae4c65 --- /dev/null +++ b/environments/production/modules/inifile/examples/ini_subsetting.pp @@ -0,0 +1,31 @@ +ini_subsetting { 'sample subsetting': + ensure => 'present', + section => '', + key_val_separator => '=', + path => '/etc/default/pe-puppetdb', + setting => 'JAVA_ARGS', + subsetting => '-Xmx', + value => '512m', +} + +ini_subsetting { 'sample subsetting2': + ensure => 'absent', + section => '', + key_val_separator => '=', + path => '/etc/default/pe-puppetdb', + setting => 'JAVA_ARGS', + subsetting => '-Xms', +} + +ini_subsetting { 'sample subsetting3': + ensure => 'present', + section => '', + key_val_separator => '=', + subsetting_key_val_separator => ':', + path => '/etc/default/pe-puppetdb', + setting => 'JAVA_ARGS', + subsetting => '-XX', + value => '+HeapDumpOnOutOfMemoryError', + insert_type => 'after', + insert_value => '-Xmx', +} diff --git a/environments/production/modules/inifile/lib/puppet/parser/functions/create_ini_settings.rb b/environments/production/modules/inifile/lib/puppet/parser/functions/create_ini_settings.rb new file mode 100644 index 0000000..f0eff6d --- /dev/null +++ b/environments/production/modules/inifile/lib/puppet/parser/functions/create_ini_settings.rb @@ -0,0 +1,90 @@ +# +# create_ini_settings.rb +# + +module Puppet::Parser::Functions + newfunction(:create_ini_settings, :type => :statement, :doc => <<-EOS +Uses create_resources to create a set of ini_setting resources from a hash: + + $settings = { section1 => { + setting1 => val1 + }, + section2 => { + setting2 => val2, + setting3 => { + ensure => absent + } + } + } + $defaults = { + path => '/tmp/foo.ini' + } + create_ini_settings($settings,$defaults) + + +Will create the following resources + + ini_setting{'/tmp/foo.ini [section1] setting1': + ensure => present, + section => 'section1', + setting => 'setting1', + value => 'val1', + path => '/tmp/foo.ini', + } + ini_setting{'/tmp/foo.ini [section2] setting2': + ensure => present, + section => 'section2', + setting => 'setting2', + value => 'val2', + path => '/tmp/foo.ini', + } + ini_setting{'/tmp/foo.ini [section2] setting3': + ensure => absent, + section => 'section2', + setting => 'setting3', + path => '/tmp/foo.ini', + } + +EOS + ) do |arguments| + + raise(Puppet::ParseError, "create_ini_settings(): Wrong number of arguments " + + "given (#{arguments.size} for 1 or 2)") unless arguments.size.between?(1,2) + + settings = arguments[0] + defaults = arguments[1] || {} + + if [settings,defaults].any?{|i| !i.is_a?(Hash) } + raise(Puppet::ParseError, + 'create_ini_settings(): Requires all arguments to be a Hash') + end + + resources = settings.keys.inject({}) do |res, section| + raise(Puppet::ParseError, + "create_ini_settings(): Section #{section} must contain a Hash") \ + unless settings[section].is_a?(Hash) + + unless path = defaults.merge(settings)['path'] + raise Puppet::ParseError, 'create_ini_settings(): must pass the path parameter to the Ini_setting resource!' + end + + settings[section].each do |setting, value| + res["#{path} [#{section}] #{setting}"] = { + 'ensure' => 'present', + 'section' => section, + 'setting' => setting, + }.merge(if value.is_a?(Hash) + value + else + { 'value' => value, } + end) + end + res + end + + Puppet::Parser::Functions.function('create_resources') + function_create_resources(['ini_setting',resources,defaults]) + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/inifile/lib/puppet/provider/ini_setting/ruby.rb b/environments/production/modules/inifile/lib/puppet/provider/ini_setting/ruby.rb new file mode 100644 index 0000000..2455541 --- /dev/null +++ b/environments/production/modules/inifile/lib/puppet/provider/ini_setting/ruby.rb @@ -0,0 +1,118 @@ +require File.expand_path('../../../util/ini_file', __FILE__) + +Puppet::Type.type(:ini_setting).provide(:ruby) do + + def self.instances + # this code is here to support purging and the query-all functionality of the + # 'puppet resource' command, on a per-file basis. Users + # can create a type for a specific config file with a provider that uses + # this as its parent and implements the method + # 'self.file_path', and that will provide the value for the path to the + # ini file (rather than needing to specify it on each ini setting + # declaration). This allows 'purging' to be used to clear out + # all settings from a particular ini file except those included in + # the catalog. + if self.respond_to?(:file_path) + # figure out what to do about the seperator + ini_file = Puppet::Util::IniFile.new(file_path, '=') + resources = [] + ini_file.section_names.each do |section_name| + ini_file.get_settings(section_name).each do |setting, value| + resources.push( + new( + :name => namevar(section_name, setting), + :value => value, + :ensure => :present + ) + ) + end + end + resources + else + raise(Puppet::Error, 'Ini_settings only support collecting instances when a file path is hard coded') + end + end + + def self.namevar(section_name, setting) + "#{section_name}/#{setting}" + end + + def exists? + !ini_file.get_value(section, setting).nil? + end + + def create + ini_file.set_value(section, setting, resource[:value]) + ini_file.save + @ini_file = nil + end + + def destroy + ini_file.remove_setting(section, setting) + ini_file.save + @ini_file = nil + end + + def value + ini_file.get_value(section, setting) + end + + def value=(value) + ini_file.set_value(section, setting, resource[:value]) + ini_file.save + end + + def section + # this method is here so that it can be overridden by a child provider + resource[:section] + end + + def setting + # this method is here so that it can be overridden by a child provider + resource[:setting] + end + + def file_path + # this method is here to support purging and sub-classing. + # if a user creates a type and subclasses our provider and provides a + # 'file_path' method, then they don't have to specify the + # path as a parameter for every ini_setting declaration. + # This implementation allows us to support that while still + # falling back to the parameter value when necessary. + if self.class.respond_to?(:file_path) + self.class.file_path + else + resource[:path] + end + end + + def separator + if resource.class.validattr?(:key_val_separator) + resource[:key_val_separator] || '=' + else + '=' + end + end + + def section_prefix + if resource.class.validattr?(:section_prefix) + resource[:section_prefix] || '[' + else + '[' + end + end + + def section_suffix + if resource.class.validattr?(:section_suffix) + resource[:section_suffix] || ']' + else + ']' + end + end + + private + def ini_file + @ini_file ||= Puppet::Util::IniFile.new(file_path, separator, section_prefix, section_suffix) + end + +end diff --git a/environments/production/modules/inifile/lib/puppet/provider/ini_subsetting/ruby.rb b/environments/production/modules/inifile/lib/puppet/provider/ini_subsetting/ruby.rb new file mode 100644 index 0000000..b1e5d84 --- /dev/null +++ b/environments/production/modules/inifile/lib/puppet/provider/ini_subsetting/ruby.rb @@ -0,0 +1,86 @@ +require File.expand_path('../../../util/ini_file', __FILE__) +require File.expand_path('../../../util/setting_value', __FILE__) + +Puppet::Type.type(:ini_subsetting).provide(:ruby) do + + def exists? + setting_value.get_subsetting_value(subsetting, resource[:use_exact_match]) + end + + def create + setting_value.add_subsetting( + subsetting, resource[:value], resource[:use_exact_match], + resource[:insert_type], resource[:insert_value] + ) + ini_file.set_value(section, setting, setting_value.get_value) + ini_file.save + @ini_file = nil + @setting_value = nil + end + + def destroy + setting_value.remove_subsetting(subsetting, resource[:use_exact_match]) + ini_file.set_value(section, setting, setting_value.get_value) + ini_file.save + @ini_file = nil + @setting_value = nil + end + + def value + setting_value.get_subsetting_value(subsetting) + end + + def value=(value) + setting_value.add_subsetting( + subsetting, value, resource[:use_exact_match], + resource[:insert_type], resource[:insert_value] + ) + ini_file.set_value(section, setting, setting_value.get_value) + ini_file.save + end + + def section + resource[:section] + end + + def setting + resource[:setting] + end + + def subsetting + resource[:subsetting] + end + + def subsetting_separator + resource[:subsetting_separator] + end + + def file_path + resource[:path] + end + + def key_val_separator + resource[:key_val_separator] || '=' + end + + def subsetting_key_val_separator + resource[:subsetting_key_val_separator] || '' + end + + def quote_char + resource[:quote_char] + end + + private + def ini_file + @ini_file ||= Puppet::Util::IniFile.new(file_path, key_val_separator) + end + + def setting_value + @setting_value ||= Puppet::Util::SettingValue.new( + ini_file.get_value(section, setting), + subsetting_separator, quote_char, subsetting_key_val_separator + ) + end + +end diff --git a/environments/production/modules/inifile/lib/puppet/type/ini_setting.rb b/environments/production/modules/inifile/lib/puppet/type/ini_setting.rb new file mode 100644 index 0000000..850fddf --- /dev/null +++ b/environments/production/modules/inifile/lib/puppet/type/ini_setting.rb @@ -0,0 +1,128 @@ +require 'digest/md5' + +Puppet::Type.newtype(:ini_setting) do + + ensurable do + defaultvalues + defaultto :present + end + + def munge_boolean_md5(value) + case value + when true, :true, 'true', :yes, 'yes' + :true + when false, :false, 'false', :no, 'no' + :false + when :md5, 'md5' + :md5 + else + fail('expected a boolean value or :md5') + end + end + + newparam(:name, :namevar => true) do + desc 'An arbitrary name used as the identity of the resource.' + end + + newparam(:section) do + desc 'The name of the section in the ini file in which the setting should be defined.' + + 'If not provided, defaults to global, top of file, sections.' + defaultto("") + end + + newparam(:setting) do + desc 'The name of the setting to be defined.' + munge do |value| + if value =~ /(^\s|\s$)/ + Puppet.warn("Settings should not have spaces in the value, we are going to strip the whitespace") + end + value.lstrip.rstrip + end + end + + newparam(:path) do + desc 'The ini file Puppet will ensure contains the specified setting.' + validate do |value| + unless (Puppet.features.posix? and value =~ /^\//) or (Puppet.features.microsoft_windows? and (value =~ /^.:\// or value =~ /^\/\/[^\/]+\/[^\/]+/)) + raise(Puppet::Error, "File paths must be fully qualified, not '#{value}'") + end + end + end + + newparam(:show_diff) do + desc 'Whether to display differences when the setting changes.' + + defaultto :true + + newvalues(:true, :md5, :false) + + munge do |value| + @resource.munge_boolean_md5(value) + end + end + + newparam(:key_val_separator) do + desc 'The separator string to use between each setting name and value. ' + + 'Defaults to " = ", but you could use this to override e.g. ": ", or' + + 'whether or not the separator should include whitespace.' + defaultto(" = ") + end + + newproperty(:value) do + desc 'The value of the setting to be defined.' + + munge do |value| + value.to_s + end + + def should_to_s(newvalue) + if (@resource[:show_diff] == :true && Puppet[:show_diff]) then + return newvalue + elsif (@resource[:show_diff] == :md5 && Puppet[:show_diff]) then + return '{md5}' + Digest::MD5.hexdigest(newvalue.to_s) + else + return '[redacted sensitive information]' + end + end + + def is_to_s(value) + should_to_s(value) + end + + def insync?(current) + if (@resource[:refreshonly]) then + true + else + current == should + end + end + + end + + newparam(:section_prefix) do + desc 'The prefix to the section name\'s header.' + + 'Defaults to \'[\'.' + defaultto('[') + end + + newparam(:section_suffix) do + desc 'The suffix to the section name\'s header.' + + 'Defaults to \']\'.' + defaultto(']') + end + + newparam(:refreshonly) do + desc 'A flag indicating whether or not the ini_setting should be updated '+ + 'only when called as part of a refresh event' + defaultto false + newvalues(true,false) + end + + def refresh + if self[:refreshonly] then + # update the value in the provider, which will save the value to the ini file + provider.value = self[:value] + end + end + +end diff --git a/environments/production/modules/inifile/lib/puppet/type/ini_subsetting.rb b/environments/production/modules/inifile/lib/puppet/type/ini_subsetting.rb new file mode 100644 index 0000000..63cf8ac --- /dev/null +++ b/environments/production/modules/inifile/lib/puppet/type/ini_subsetting.rb @@ -0,0 +1,136 @@ +require 'digest/md5' + +Puppet::Type.newtype(:ini_subsetting) do + + ensurable do + defaultvalues + defaultto :present + end + + def munge_boolean_md5(value) + case value + when true, :true, 'true', :yes, 'yes' + :true + when false, :false, 'false', :no, 'no' + :false + when :md5, 'md5' + :md5 + else + fail('expected a boolean value or :md5') + end + end + + newparam(:name, :namevar => true) do + desc 'An arbitrary name used as the identity of the resource.' + end + + newparam(:section) do + desc 'The name of the section in the ini file in which the setting should be defined.' + + 'If not provided, defaults to global, top of file, sections.' + defaultto("") + end + + newparam(:setting) do + desc 'The name of the setting to be defined.' + end + + newparam(:subsetting) do + desc 'The name of the subsetting to be defined.' + end + + newparam(:subsetting_separator) do + desc 'The separator string between subsettings. Defaults to " "' + defaultto(" ") + end + + newparam(:subsetting_key_val_separator) do + desc 'The separator string between the subsetting name and its value. Defaults to the empty string.' + defaultto('') + end + + newparam(:path) do + desc 'The ini file Puppet will ensure contains the specified setting.' + validate do |value| + unless (Puppet.features.posix? and value =~ /^\//) or (Puppet.features.microsoft_windows? and (value =~ /^.:\// or value =~ /^\/\/[^\/]+\/[^\/]+/)) + raise(Puppet::Error, "File paths must be fully qualified, not '#{value}'") + end + end + end + + newparam(:show_diff) do + desc 'Whether to display differences when the setting changes.' + defaultto :true + newvalues(:true, :md5, :false) + + munge do |value| + @resource.munge_boolean_md5(value) + end + end + + newparam(:key_val_separator) do + desc 'The separator string to use between each setting name and value. ' + + 'Defaults to " = ", but you could use this to override e.g. ": ", or' + + 'whether or not the separator should include whitespace.' + defaultto(" = ") + end + + newparam(:quote_char) do + desc 'The character used to quote the entire value of the setting. ' + + %q{Valid values are '', '"' and "'". Defaults to ''.} + defaultto('') + + validate do |value| + unless value =~ /^["']?$/ + raise Puppet::Error, %q{:quote_char valid values are '', '"' and "'"} + end + end + end + + newparam(:use_exact_match) do + desc 'Set to true if your subsettings don\'t have values and you want to use exact matches to determine if the subsetting exists. See MODULES-2212' + newvalues(:true, :false) + defaultto(:false) + end + + newproperty(:value) do + desc 'The value of the subsetting to be defined.' + + def should_to_s(newvalue) + if (@resource[:show_diff] == :true && Puppet[:show_diff]) then + return newvalue + elsif (@resource[:show_diff] == :md5 && Puppet[:show_diff]) then + return '{md5}' + Digest::MD5.hexdigest(newvalue.to_s) + else + return '[redacted sensitive information]' + end + end + + def is_to_s(value) + should_to_s(value) + end + + def is_to_s(value) + should_to_s(value) + end + end + + newparam(:insert_type) do + desc <<-eof +Where the new subsetting item should be inserted? + +* :start - insert at the beginning of the line. +* :end - insert at the end of the line (default). +* :before - insert before the specified element if possible. +* :after - insert after the specified element if possible. +* :index - insert at the specified index number. + eof + + newvalues(:start, :end, :before, :after, :index) + defaultto(:end) + end + + newparam(:insert_value) do + desc 'The value for the insert types which require one.' + end + +end diff --git a/environments/production/modules/inifile/lib/puppet/util/external_iterator.rb b/environments/production/modules/inifile/lib/puppet/util/external_iterator.rb new file mode 100644 index 0000000..45c0fa4 --- /dev/null +++ b/environments/production/modules/inifile/lib/puppet/util/external_iterator.rb @@ -0,0 +1,28 @@ +module Puppet +module Util + class ExternalIterator + def initialize(coll) + @coll = coll + @cur_index = -1 + end + + def next + @cur_index = @cur_index + 1 + item_at(@cur_index) + end + + def peek + item_at(@cur_index + 1) + end + + private + def item_at(index) + if @coll.length > index + [@coll[index], index] + else + [nil, nil] + end + end + end +end +end diff --git a/environments/production/modules/inifile/lib/puppet/util/ini_file.rb b/environments/production/modules/inifile/lib/puppet/util/ini_file.rb new file mode 100644 index 0000000..818328d --- /dev/null +++ b/environments/production/modules/inifile/lib/puppet/util/ini_file.rb @@ -0,0 +1,331 @@ +require File.expand_path('../external_iterator', __FILE__) +require File.expand_path('../ini_file/section', __FILE__) + +module Puppet +module Util + class IniFile + + def initialize(path, key_val_separator = ' = ', section_prefix = '[', section_suffix = ']') + + k_v_s = key_val_separator =~ /^\s+$/ ? ' ' : key_val_separator.strip + + @section_prefix = section_prefix + @section_suffix = section_suffix + + @@SECTION_REGEX = section_regex + @@SETTING_REGEX = /^(\s*)([^#;\s]|[^#;\s].*?[^\s#{k_v_s}])(\s*#{k_v_s}[ \t]*)(.*)\s*$/ + @@COMMENTED_SETTING_REGEX = /^(\s*)[#;]+(\s*)(.*?[^\s#{k_v_s}])(\s*#{k_v_s}[ \t]*)(.*)\s*$/ + + @path = path + @key_val_separator = key_val_separator + @section_names = [] + @sections_hash = {} + if File.file?(@path) + parse_file + end + end + + def section_regex + # Only put in prefix/suffix if they exist + # Also, if the prefix is '', the negated + # set match should be a match all instead. + r_string = '^\s*' + r_string += Regexp.escape(@section_prefix) + r_string += '(' + if @section_prefix != '' + r_string += '[^' + r_string += Regexp.escape(@section_prefix) + r_string += ']' + else + r_string += '.' + end + r_string += '*)' + r_string += Regexp.escape(@section_suffix) + r_string += '\s*$' + /#{r_string}/ + end + + def section_names + @section_names + end + + def get_settings(section_name) + section = @sections_hash[section_name] + section.setting_names.inject({}) do |result, setting| + result[setting] = section.get_value(setting) + result + end + end + + def get_value(section_name, setting) + if (@sections_hash.has_key?(section_name)) + @sections_hash[section_name].get_value(setting) + end + end + + def set_value(section_name, setting, value) + unless (@sections_hash.has_key?(section_name)) + add_section(Section.new(section_name, nil, nil, nil, nil)) + end + + section = @sections_hash[section_name] + + if (section.has_existing_setting?(setting)) + update_line(section, setting, value) + section.update_existing_setting(setting, value) + elsif result = find_commented_setting(section, setting) + # So, this stanza is a bit of a hack. What we're trying + # to do here is this: for settings that don't already + # exist, we want to take a quick peek to see if there + # is a commented-out version of them in the section. + # If so, we'd prefer to add the setting directly after + # the commented line, rather than at the end of the section. + + # If we get here then we found a commented line, so we + # call "insert_inline_setting_line" to update the lines array + insert_inline_setting_line(result, section, setting, value) + + # Then, we need to tell the setting object that we hacked + # in an inline setting + section.insert_inline_setting(setting, value) + + # Finally, we need to update all of the start/end line + # numbers for all of the sections *after* the one that + # was modified. + section_index = @section_names.index(section_name) + increment_section_line_numbers(section_index + 1) + else + section.set_additional_setting(setting, value) + end + end + + def remove_setting(section_name, setting) + section = @sections_hash[section_name] + if (section.has_existing_setting?(setting)) + # If the setting is found, we have some work to do. + # First, we remove the line from our array of lines: + remove_line(section, setting) + + # Then, we need to tell the setting object to remove + # the setting from its state: + section.remove_existing_setting(setting) + + # Finally, we need to update all of the start/end line + # numbers for all of the sections *after* the one that + # was modified. + section_index = @section_names.index(section_name) + decrement_section_line_numbers(section_index + 1) + end + end + + def save + File.open(@path, 'w') do |fh| + + @section_names.each_index do |index| + name = @section_names[index] + + section = @sections_hash[name] + + # We need a buffer to cache lines that are only whitespace + whitespace_buffer = [] + + if (section.is_new_section?) && (! section.is_global?) + fh.puts("\n#{@section_prefix}#{section.name}#{@section_suffix}") + end + + if ! section.is_new_section? + # don't add empty sections + if section.empty? and ! section.is_global? + next + end + + # write all of the pre-existing settings + (section.start_line..section.end_line).each do |line_num| + line = lines[line_num] + + # We buffer any lines that are only whitespace so that + # if they are at the end of a section, we can insert + # any new settings *before* the final chunk of whitespace + # lines. + if (line =~ /^\s*$/) + whitespace_buffer << line + else + # If we get here, we've found a non-whitespace line. + # We'll flush any cached whitespace lines before we + # write it. + flush_buffer_to_file(whitespace_buffer, fh) + fh.puts(line) + end + end + end + + # write new settings, if there are any + section.additional_settings.each_pair do |key, value| + fh.puts("#{' ' * (section.indentation || 0)}#{key}#{@key_val_separator}#{value}") + end + + if (whitespace_buffer.length > 0) + flush_buffer_to_file(whitespace_buffer, fh) + else + # We get here if there were no blank lines at the end of the + # section. + # + # If we are adding a new section with a new setting, + # and if there are more sections that come after this one, + # we'll write one blank line just so that there is a little + # whitespace between the sections. + #if (section.end_line.nil? && + if (section.is_new_section? && + (section.additional_settings.length > 0) && + (index < @section_names.length - 1)) + fh.puts("") + end + end + + end + end + end + + + private + def add_section(section) + @sections_hash[section.name] = section + @section_names << section.name + end + + def parse_file + line_iter = create_line_iter + + # We always create a "global" section at the beginning of the file, for + # anything that appears before the first named section. + section = read_section('', 0, line_iter) + add_section(section) + line, line_num = line_iter.next + + while line + if (match = @@SECTION_REGEX.match(line)) + section = read_section(match[1], line_num, line_iter) + add_section(section) + end + line, line_num = line_iter.next + end + end + + def read_section(name, start_line, line_iter) + settings = {} + end_line_num = nil + min_indentation = nil + while true + line, line_num = line_iter.peek + if (line_num.nil? or match = @@SECTION_REGEX.match(line)) + return Section.new(name, start_line, end_line_num, settings, min_indentation) + elsif (match = @@SETTING_REGEX.match(line)) + settings[match[2]] = match[4] + indentation = match[1].length + min_indentation = [indentation, min_indentation || indentation].min + end + end_line_num = line_num + line_iter.next + end + end + + def update_line(section, setting, value) + (section.start_line..section.end_line).each do |line_num| + if (match = @@SETTING_REGEX.match(lines[line_num])) + if (match[2] == setting) + lines[line_num] = "#{match[1]}#{match[2]}#{match[3]}#{value}" + end + end + end + end + + def remove_line(section, setting) + (section.start_line..section.end_line).each do |line_num| + if (match = @@SETTING_REGEX.match(lines[line_num])) + if (match[2] == setting) + lines.delete_at(line_num) + end + end + end + end + + def create_line_iter + ExternalIterator.new(lines) + end + + def lines + @lines ||= IniFile.readlines(@path) + end + + # This is mostly here because it makes testing easier--we don't have + # to try to stub any methods on File. + def self.readlines(path) + # If this type is ever used with very large files, we should + # write this in a different way, using a temp + # file; for now assuming that this type is only used on + # small-ish config files that can fit into memory without + # too much trouble. + File.readlines(path) + end + + # This utility method scans through the lines for a section looking for + # commented-out versions of a setting. It returns `nil` if it doesn't + # find one. If it does find one, then it returns a hash containing + # two keys: + # + # :line_num - the line number that contains the commented version + # of the setting + # :match - the ruby regular expression match object, which can + # be used to mimic the whitespace from the comment line + def find_commented_setting(section, setting) + return nil if section.is_new_section? + (section.start_line..section.end_line).each do |line_num| + if (match = @@COMMENTED_SETTING_REGEX.match(lines[line_num])) + if (match[3] == setting) + return { :match => match, :line_num => line_num } + end + end + end + nil + end + + # This utility method is for inserting a line into the existing + # lines array. The `result` argument is expected to be in the + # format of the return value of `find_commented_setting`. + def insert_inline_setting_line(result, section, setting, value) + line_num = result[:line_num] + match = result[:match] + lines.insert(line_num + 1, "#{' ' * (section.indentation || 0 )}#{setting}#{match[4]}#{value}") + end + + # Utility method; given a section index (index into the @section_names + # array), decrement the start/end line numbers for that section and all + # all of the other sections that appear *after* the specified section. + def decrement_section_line_numbers(section_index) + @section_names[section_index..(@section_names.length - 1)].each do |name| + section = @sections_hash[name] + section.decrement_line_nums + end + end + + # Utility method; given a section index (index into the @section_names + # array), increment the start/end line numbers for that section and all + # all of the other sections that appear *after* the specified section. + def increment_section_line_numbers(section_index) + @section_names[section_index..(@section_names.length - 1)].each do |name| + section = @sections_hash[name] + section.increment_line_nums + end + end + + + def flush_buffer_to_file(buffer, fh) + if buffer.length > 0 + buffer.each { |l| fh.puts(l) } + buffer.clear + end + end + + end +end +end diff --git a/environments/production/modules/inifile/lib/puppet/util/ini_file/section.rb b/environments/production/modules/inifile/lib/puppet/util/ini_file/section.rb new file mode 100644 index 0000000..c5df144 --- /dev/null +++ b/environments/production/modules/inifile/lib/puppet/util/ini_file/section.rb @@ -0,0 +1,103 @@ +class Puppet::Util::IniFile + class Section + # Some implementation details: + # + # * `name` will be set to the empty string for the 'global' section. + # * there will always be a 'global' section, with a `start_line` of 0, + # but if the file actually begins with a real section header on + # the first line, then the 'global' section will have an + # `end_line` of `nil`. + # * `start_line` and `end_line` will be set to `nil` for a new non-global + # section. + def initialize(name, start_line, end_line, settings, indentation) + @name = name + @start_line = start_line + @end_line = end_line + @existing_settings = settings.nil? ? {} : settings + @additional_settings = {} + @indentation = indentation + end + + attr_reader :name, :start_line, :end_line, :additional_settings, :indentation + + def is_global?() + @name == '' + end + + def is_new_section?() + # a new section (global or named) will always have `end_line` + # set to `nil` + @end_line.nil? + end + + def setting_names + @existing_settings.keys | @additional_settings.keys + end + + def get_value(setting_name) + @existing_settings[setting_name] || @additional_settings[setting_name] + end + + def has_existing_setting?(setting_name) + @existing_settings.has_key?(setting_name) + end + + def empty? + start_line == end_line + end + + def update_existing_setting(setting_name, value) + @existing_settings[setting_name] = value + end + + def remove_existing_setting(setting_name) + if (@existing_settings.delete(setting_name)) + if @end_line + @end_line = @end_line - 1 + end + end + end + + # This is a hacky method; it's basically called when we need to insert + # a new setting but we don't want it to appear at the very end of the + # section. Instead we hack it into the existing settings list and + # increment our end_line number--this assumes that the caller (`ini_file`) + # is doing some babysitting w/rt the other sections and the actual data + # of the lines. + def insert_inline_setting(setting_name, value) + @existing_settings[setting_name] = value + if @end_line + @end_line = @end_line + 1 + end + end + + def set_additional_setting(setting_name, value) + @additional_settings[setting_name] = value + end + + # Decrement the start and end line numbers for the section (if they are + # defined); this is intended to be called when a setting is removed + # from a section that comes before this section in the ini file. + def decrement_line_nums() + if @start_line + @start_line = @start_line - 1 + end + if @end_line + @end_line = @end_line - 1 + end + end + + # Increment the start and end line numbers for the section (if they are + # defined); this is intended to be called when an inline setting is added + # to a section that comes before this section in the ini file. + def increment_line_nums() + if @start_line + @start_line = @start_line + 1 + end + if @end_line + @end_line = @end_line + 1 + end + end + + end +end diff --git a/environments/production/modules/inifile/lib/puppet/util/setting_value.rb b/environments/production/modules/inifile/lib/puppet/util/setting_value.rb new file mode 100644 index 0000000..090c9c8 --- /dev/null +++ b/environments/production/modules/inifile/lib/puppet/util/setting_value.rb @@ -0,0 +1,187 @@ +module Puppet + module Util + # This class can work with a list of subsettings inside + # an ini file setting string to add, remove, extract and set their values. + class SettingValue + + # The constructor method + # @param setting_value [String] The initial setting value + # @param subsetting_separator [String] The character is used to separate + # subsettings in the setting_value string. + # @param default_quote_char [String] Quote the setting string with this character. + def initialize(setting_value, subsetting_separator = ' ', default_quote_char = '', key_val_separator = '') + @setting_value = setting_value + @subsetting_separator = subsetting_separator + @quote_char = default_quote_char + @key_val_separator = key_val_separator + @subsetting_items = [] + + if @setting_value + unquoted, quote_char = unquote_setting_value(setting_value) + @quote_char = quote_char unless quote_char.empty? + # an item can contain escaped separator + @subsetting_items = unquoted.scan(Regexp.new("(?:(?:[^\\#{@subsetting_separator}]|\\.)+)")) + @subsetting_items.map! { |item| item.strip } + end + end + + # If the setting value is quoted, the quotes are + # removed and the unquoted string and the quoting + # character are returned. + # @param setting_value [String] The input value + # @return [Array] The unquoted string and the quoting character + def unquote_setting_value(setting_value) + quote_char = '' + if setting_value.start_with?('"') and setting_value.end_with?('"') + quote_char = '"' + elsif setting_value.start_with?("'") and setting_value.end_with?("'") + quote_char = "'" + end + + if quote_char != '' + unquoted = setting_value[1, setting_value.length - 2] + else + unquoted = setting_value + end + + [unquoted, quote_char] + end + + # Get the resulting setting value by joining all the + # subsettings, separator and quote characters. + # @return [String] + def get_value + value = @subsetting_items.join @subsetting_separator + @quote_char + value + @quote_char + end + + # Get the value of the given subsetting item. + # If the exact match is used the value will be true + # if the item is found. + # @param subsetting [String] The name of the subsetting to add. + # @param use_exact_match [:true,:false] Should the full name match be used? + # @return [nil,true,String] + def get_subsetting_value(subsetting, use_exact_match=:false) + index = find_subsetting(subsetting, use_exact_match) + # the item is not found in the list + return nil unless index + # the exact match is set and the item is found, the value should be true + return true if use_exact_match == :true + item = @subsetting_items[index] + item[(subsetting.length + @key_val_separator.length)..-1] + end + + # Add a new subsetting item to the list of existing items + # if such item is not already there. + # @param subsetting [String] The name of the subsetting to add. + # @param subsetting_value [String] The value of the subsetting. + # It will be appended to the name. + # @param use_exact_match [:true,:false] Should the full name match be used? + # @param [Symbol] insert_type + # @param [String,Integer] insert_value + # @return [Array] The resulting subsettings list. + def add_subsetting(subsetting, subsetting_value, use_exact_match=:false, insert_type=:end, insert_value=nil) + index = find_subsetting(subsetting, use_exact_match) + + # update the existing values if the subsetting is found in the list + return update_subsetting(subsetting, subsetting_value, use_exact_match) if index + + new_item = item_value(subsetting, subsetting_value) + + case insert_type + when :start + @subsetting_items.unshift(new_item) + when :end + @subsetting_items.push(new_item) + when :before + before_index = find_subsetting(insert_value, use_exact_match) + if before_index + @subsetting_items.insert(before_index, new_item) + else + @subsetting_items.push(new_item) + end + when :after + after_index = find_subsetting(insert_value, use_exact_match) + if after_index + @subsetting_items.insert(after_index + 1, new_item) + else + @subsetting_items.push(new_item) + end + when :index + before_index = insert_value.to_i + before_index = @subsetting_items.length if before_index > @subsetting_items.length + @subsetting_items.insert(before_index, new_item) + else + @subsetting_items.push(new_item) + end + + @subsetting_items + end + + # Update all matching items in the settings list to the new values. + # @param subsetting [String] The name of the subsetting to add. + # @param subsetting_value [String] The value of the subsetting. + # @param use_exact_match [:true,:false] Should the full name match be used? + # @return [Array] The resulting subsettings list. + def update_subsetting(subsetting, subsetting_value, use_exact_match=:false) + new_item = item_value(subsetting, subsetting_value) + @subsetting_items.map! do |item| + if match_subsetting?(item, subsetting, use_exact_match) + new_item + else + item + end + end + end + + # Find the first subsetting item matching the given name, + # or, if the exact match is set, equal to the given name + # and return its array index value. Returns nil if not found. + # @param subsetting [String] The name of the subsetting to search. + # @param use_exact_match [:true,:false] Look for the full string match? + # @return [Integer, nil] + def find_subsetting(subsetting, use_exact_match=:false) + @subsetting_items.index do |item| + match_subsetting?(item, subsetting, use_exact_match) + end + end + + # Check if the subsetting item matches the given name. + # If the exact match is set the entire item is matched, + # and only the item name and separator string if not. + # @param item [String] The item value to check against the subsetting name. + # @param subsetting [String] The subsetting name. + # @param use_exact_match [:true,:false] Look for the full string match? + # @return [true,false] + def match_subsetting?(item, subsetting, use_exact_match=:false) + if use_exact_match == :true + item.eql?(subsetting) + else + item.start_with?(subsetting + @key_val_separator) + end + end + + # Remove all the subsetting items that match + # the given subsetting name. + # @param subsetting [String] The subsetting name to remove. + # @param use_exact_match [:true,:false] Look for the full string match? + # @return [Array] The resulting subsettings list. + def remove_subsetting(subsetting, use_exact_match=:false) + @subsetting_items.delete_if do |item| + match_subsetting?(item, subsetting, use_exact_match) + end + end + + # The actual value of the subsetting item. + # It's built from the subsetting name, its value and the separator + # string if present. + # @param subsetting [String] The subsetting name + # @param subsetting_value [String] The value of the subsetting + # @return [String] + def item_value(subsetting, subsetting_value) + (subsetting || '') + (@key_val_separator || '') + (subsetting_value || '') + end + + end + end +end diff --git a/environments/production/modules/inifile/metadata.json b/environments/production/modules/inifile/metadata.json new file mode 100644 index 0000000..a540c60 --- /dev/null +++ b/environments/production/modules/inifile/metadata.json @@ -0,0 +1,104 @@ +{ + "name": "puppetlabs-inifile", + "version": "1.6.0", + "author": "Puppet Labs", + "summary": "Resource types for managing settings in INI files", + "license": "Apache-2.0", + "source": "https://github.com/puppetlabs/puppetlabs-inifile", + "project_page": "https://github.com/puppetlabs/puppetlabs-inifile", + "issues_url": "https://tickets.puppetlabs.com/browse/MODULES", + "dependencies": [ + + ], + "data_provider": null, + "operatingsystem_support": [ + { + "operatingsystem": "RedHat", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "CentOS", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "OracleLinux", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "Scientific", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "SLES", + "operatingsystemrelease": [ + "10 SP4", + "11 SP1", + "12" + ] + }, + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "6", + "7", + "8" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "10.04", + "12.04", + "14.04", + "16.04" + ] + }, + { + "operatingsystem": "Solaris", + "operatingsystemrelease": [ + "10", + "11", + "12" + ] + }, + { + "operatingsystem": "Windows", + "operatingsystemrelease": [ + "Server 2003 R2", + "Server 2008 R2", + "Server 2012", + "Server 2012 R2" + ] + }, + { + "operatingsystem": "AIX", + "operatingsystemrelease": [ + "5.3", + "6.1", + "7.1" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">= 3.0.0 < 5.0.0" + } + ] +} diff --git a/environments/production/modules/inifile/spec/acceptance/ini_setting_spec.rb b/environments/production/modules/inifile/spec/acceptance/ini_setting_spec.rb new file mode 100644 index 0000000..6b14109 --- /dev/null +++ b/environments/production/modules/inifile/spec/acceptance/ini_setting_spec.rb @@ -0,0 +1,320 @@ +require 'spec_helper_acceptance' + +tmpdir = default.tmpdir('tmp') + +describe 'ini_setting resource' do + after :all do + shell("rm #{tmpdir}/*.ini", :acceptable_exit_codes => [0, 1, 2]) + end + + shared_examples 'has_content' do |path, pp, content| + before :all do + shell("rm #{path}", :acceptable_exit_codes => [0, 1, 2]) + end + after :all do + shell("cat #{path}", :acceptable_exit_codes => [0, 1, 2]) + shell("rm #{path}", :acceptable_exit_codes => [0, 1, 2]) + end + + it 'applies the manifest twice' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file(path) do + it { should be_file } + its(:content) { should match content } + end + end + + shared_examples 'has_error' do |path, pp, error| + before :all do + shell("rm #{path}", :acceptable_exit_codes => [0, 1, 2]) + end + after :all do + shell("cat #{path}", :acceptable_exit_codes => [0, 1, 2]) + shell("rm #{path}", :acceptable_exit_codes => [0, 1, 2]) + end + + it 'applies the manifest and gets a failure message' do + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(error) + end + + describe file(path) do + it { should_not be_file } + end + end + + describe 'ensure parameter' do + context '=> present for global and section' do + pp = <<-EOS + ini_setting { 'ensure => present for section': + ensure => present, + path => "#{tmpdir}/ini_setting.ini", + section => 'one', + setting => 'two', + value => 'three', + } + ini_setting { 'ensure => present for global': + ensure => present, + path => "#{tmpdir}/ini_setting.ini", + section => '', + setting => 'four', + value => 'five', + } + EOS + + it 'applies the manifest twice' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + it_behaves_like 'has_content', "#{tmpdir}/ini_setting.ini", pp, /four = five\n\n\[one\]\ntwo = three/ + end + + context '=> present for global and section (from previous blank value)' do + before :all do + if fact('osfamily') == 'Darwin' + shell("echo \"four =[one]\ntwo =\" > #{tmpdir}/ini_setting.ini") + else + shell("echo -e \"four =\n[one]\ntwo =\" > #{tmpdir}/ini_setting.ini") + end + end + + pp = <<-EOS + ini_setting { 'ensure => present for section': + ensure => present, + path => "#{tmpdir}/ini_setting.ini", + section => 'one', + setting => 'two', + value => 'three', + } + ini_setting { 'ensure => present for global': + ensure => present, + path => "#{tmpdir}/ini_setting.ini", + section => '', + setting => 'four', + value => 'five', + } + EOS + + it 'applies the manifest twice' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + it_behaves_like 'has_content', "#{tmpdir}/ini_setting.ini", pp, /four = five\n\n\[one\]\ntwo = three/ + end + + context '=> absent for key/value' do + before :all do + if fact('osfamily') == 'Darwin' + shell("echo \"four = five[one]\ntwo = three\" > #{tmpdir}/ini_setting.ini") + else + shell("echo -e \"four = five\n[one]\ntwo = three\" > #{tmpdir}/ini_setting.ini") + end + end + + pp = <<-EOS + ini_setting { 'ensure => absent for key/value': + ensure => absent, + path => "#{tmpdir}/ini_setting.ini", + section => 'one', + setting => 'two', + value => 'three', + } + EOS + + it 'applies the manifest twice' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{tmpdir}/ini_setting.ini") do + it { should be_file } + its(:content) { + should match /four = five/ + should_not match /\[one\]/ + should_not match /two = three/ + } + end + end + + context '=> absent for global' do + before :all do + if fact('osfamily') == 'Darwin' + shell("echo \"four = five\n[one]\ntwo = three\" > #{tmpdir}/ini_setting.ini") + else + shell("echo -e \"four = five\n[one]\ntwo = three\" > #{tmpdir}/ini_setting.ini") + end + end + after :all do + shell("cat #{tmpdir}/ini_setting.ini", :acceptable_exit_codes => [0, 1, 2]) + shell("rm #{tmpdir}/ini_setting.ini", :acceptable_exit_codes => [0, 1, 2]) + end + + pp = <<-EOS + ini_setting { 'ensure => absent for global': + ensure => absent, + path => "#{tmpdir}/ini_setting.ini", + section => '', + setting => 'four', + value => 'five', + } + EOS + + it 'applies the manifest twice' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{tmpdir}/ini_setting.ini") do + it { should be_file } + its(:content) { + should_not match /four = five/ + should match /\[one\]/ + should match /two = three/ + } + end + end + end + + describe 'section, setting, value parameters' do + { + "section => 'test', setting => 'foo', value => 'bar'," => /\[test\]\nfoo = bar/, + "section => 'more', setting => 'baz', value => 'quux'," => /\[more\]\nbaz = quux/, + "section => '', setting => 'top', value => 'level'," => /top = level/, + "section => 'z', setting => 'sp aces', value => 'foo bar'," => /\[z\]\nsp aces = foo bar/, + }.each do |parameter_list, content| + context parameter_list do + pp = <<-EOS + ini_setting { "#{parameter_list}": + ensure => present, + path => "#{tmpdir}/ini_setting.ini", + #{parameter_list} + } + EOS + + it_behaves_like 'has_content', "#{tmpdir}/ini_setting.ini", pp, content + end + end + + { + "section => 'test'," => /setting is a required.+value is a required/, + "setting => 'foo', value => 'bar'," => /section is a required/, + "section => 'test', setting => 'foo'," => /value is a required/, + "section => 'test', value => 'bar'," => /setting is a required/, + "value => 'bar'," => /section is a required.+setting is a required/, + "setting => 'foo'," => /section is a required.+value is a required/, + }.each do |parameter_list, error| + context parameter_list, :pending => 'no error checking yet' do + pp = <<-EOS + ini_setting { "#{parameter_list}": + ensure => present, + path => "#{tmpdir}/ini_setting.ini", + #{parameter_list} + } + EOS + + it_behaves_like 'has_error', "#{tmpdir}/ini_setting.ini", pp, error + end + end + end + + describe 'path parameter' do + [ + "#{tmpdir}/one.ini", + "#{tmpdir}/two.ini", + "#{tmpdir}/three.ini", + ].each do |path| + context "path => #{path}" do + pp = <<-EOS + ini_setting { 'path => #{path}': + ensure => present, + section => 'one', + setting => 'two', + value => 'three', + path => '#{path}', + } + EOS + + it_behaves_like 'has_content', path, pp, /\[one\]\ntwo = three/ + end + end + + context "path => foo" do + pp = <<-EOS + ini_setting { 'path => foo': + ensure => present, + section => 'one', + setting => 'two', + value => 'three', + path => 'foo', + } + EOS + + it_behaves_like 'has_error', 'foo', pp, /must be fully qualified/ + end + end + + describe 'key_val_separator parameter' do + { + "" => /two = three/, + "key_val_separator => '='," => /two=three/, + "key_val_separator => ' = '," => /two = three/, + "key_val_separator => ' '," => /two three/, + "key_val_separator => ' '," => /two three/, + }.each do |parameter, content| + context "with \"#{parameter}\" makes \"#{content}\"" do + pp = <<-EOS + ini_setting { "with #{parameter} makes #{content}": + ensure => present, + section => 'one', + setting => 'two', + value => 'three', + path => "#{tmpdir}/key_val_separator.ini", + #{parameter} + } + EOS + + it_behaves_like 'has_content', "#{tmpdir}/key_val_separator.ini", pp, content + end + end + end + + describe 'show_diff parameter and logging:' do + [ {:value => "initial_value", :matcher => "created", :show_diff => true}, + {:value => "public_value", :matcher => /initial_value.*public_value/, :show_diff => true}, + {:value => "secret_value", :matcher => /redacted sensitive information.*redacted sensitive information/, :show_diff => false}, + {:value => "md5_value", :matcher => /{md5}881671aa2bbc680bc530c4353125052b.*{md5}ed0903a7fa5de7886ca1a7a9ad06cf51/, :show_diff => :md5} + ].each do |i| + context "show_diff => #{i[:show_diff]}" do + pp = <<-EOS + ini_setting { 'test_show_diff': + ensure => present, + section => 'test', + setting => 'something', + value => '#{i[:value]}', + path => "#{tmpdir}/test_show_diff.ini", + show_diff => #{i[:show_diff]} + } + EOS + + it "applies manifest and expects changed value to be logged in proper form" do + config = { + 'main' => { + 'show_diff' => true + } + } + configure_puppet_on(default, config) + + res = apply_manifest(pp, :expect_changes => true) + expect(res.stdout).to match(i[:matcher]) + expect(res.stdout).not_to match(i[:value]) unless (i[:show_diff] == true) + + end + end + end + end + +end diff --git a/environments/production/modules/inifile/spec/acceptance/ini_subsetting_spec.rb b/environments/production/modules/inifile/spec/acceptance/ini_subsetting_spec.rb new file mode 100644 index 0000000..89cf46f --- /dev/null +++ b/environments/production/modules/inifile/spec/acceptance/ini_subsetting_spec.rb @@ -0,0 +1,336 @@ +require 'spec_helper_acceptance' + +tmpdir = default.tmpdir('tmp') + +describe 'ini_subsetting resource' do + after :all do + shell("rm #{tmpdir}/*.ini", :acceptable_exit_codes => [0, 1, 2]) + end + + shared_examples 'has_content' do |path, pp, content| + before :all do + shell("rm #{path}", :acceptable_exit_codes => [0, 1, 2]) + end + after :all do + shell("cat #{path}", :acceptable_exit_codes => [0, 1, 2]) + shell("rm #{path}", :acceptable_exit_codes => [0, 1, 2]) + end + + it 'applies the manifest twice' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file(path) do + it { should be_file } + its(:content) { + should match content + } + end + end + + shared_examples 'has_error' do |path, pp, error| + before :all do + shell("rm #{path}", :acceptable_exit_codes => [0, 1, 2]) + end + after :all do + shell("cat #{path}", :acceptable_exit_codes => [0, 1, 2]) + shell("rm #{path}", :acceptable_exit_codes => [0, 1, 2]) + end + + it 'applies the manifest and gets a failure message' do + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(error) + end + + describe file(path) do + it { should_not be_file } + end + end + + describe 'ensure, section, setting, subsetting, & value parameters' do + context '=> present with subsections' do + pp = <<-EOS + ini_subsetting { 'ensure => present for alpha': + ensure => present, + path => "#{tmpdir}/ini_subsetting.ini", + section => 'one', + setting => 'key', + subsetting => 'alpha', + value => 'bet', + } + ini_subsetting { 'ensure => present for beta': + ensure => present, + path => "#{tmpdir}/ini_subsetting.ini", + section => 'one', + setting => 'key', + subsetting => 'beta', + value => 'trons', + require => Ini_subsetting['ensure => present for alpha'], + } + EOS + + it 'applies the manifest twice' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{tmpdir}/ini_subsetting.ini") do + it { should be_file } + its(:content) { + should match /\[one\]\nkey = alphabet betatrons/ + } + end + end + + context 'ensure => absent' do + before :all do + if fact('osfamily') == 'Darwin' + shell("echo \"[one]\nkey = alphabet betatrons\" > #{tmpdir}/ini_subsetting.ini") + else + shell("echo -e \"[one]\nkey = alphabet betatrons\" > #{tmpdir}/ini_subsetting.ini") + end + end + + pp = <<-EOS + ini_subsetting { 'ensure => absent for subsetting': + ensure => absent, + path => "#{tmpdir}/ini_subsetting.ini", + section => 'one', + setting => 'key', + subsetting => 'alpha', + } + EOS + + it 'applies the manifest twice' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{tmpdir}/ini_subsetting.ini") do + it { should be_file } + its(:content) { + should match /\[one\]/ + should match /key = betatrons/ + should_not match /alphabet/ + } + end + end + end + + describe 'subsetting_separator' do + { + "" => /two = twinethree foobar/, + "subsetting_separator => ','," => /two = twinethree,foobar/, + "subsetting_separator => ' '," => /two = twinethree foobar/, + "subsetting_separator => ' == '," => /two = twinethree == foobar/, + "subsetting_separator => '='," => /two = twinethree=foobar/, + }.each do |parameter, content| + context "with \"#{parameter}\" makes \"#{content}\"" do + pp = <<-EOS + ini_subsetting { "with #{parameter} makes #{content}": + ensure => present, + section => 'one', + setting => 'two', + subsetting => 'twine', + value => 'three', + path => "#{tmpdir}/subsetting_separator.ini", + before => Ini_subsetting['foobar'], + #{parameter} + } + ini_subsetting { "foobar": + ensure => present, + section => 'one', + setting => 'two', + subsetting => 'foo', + value => 'bar', + path => "#{tmpdir}/subsetting_separator.ini", + #{parameter} + } + EOS + + it_behaves_like 'has_content', "#{tmpdir}/subsetting_separator.ini", pp, content + end + end + end + + describe 'subsetting_key_val_separator' do + { + '' => /two = twinethree foobar/, + "subsetting_key_val_separator => ':'," => /two = twine:three foo:bar/, + "subsetting_key_val_separator => '-'," => /two = twine-three foo-bar/, + }.each do |parameter, content| + context "with '#{parameter}' makes '#{content}'" do + pp = <<-EOS + ini_subsetting { "with #{parameter} makes #{content}": + ensure => 'present', + section => 'one', + setting => 'two', + subsetting => 'twine', + value => 'three', + path => "#{tmpdir}/subsetting_key_val_separator.ini", + before => Ini_subsetting['foobar'], + #{parameter} + } + ini_subsetting { "foobar": + ensure => 'present', + section => 'one', + setting => 'two', + subsetting => 'foo', + value => 'bar', + path => "#{tmpdir}/subsetting_key_val_separator.ini", + #{parameter} + } + EOS + + it_behaves_like 'has_content', "#{tmpdir}/subsetting_key_val_separator.ini", pp, content + end + end + end + + describe 'quote_char' do + { + ['-Xmx'] => /args=""/, + ['-Xmx', '256m'] => /args=-Xmx256m/, + ['-Xmx', '512m'] => /args="-Xmx512m"/, + ['-Xms', '256m'] => /args="-Xmx256m -Xms256m"/, + }.each do |parameter, content| + context %Q{with '#{parameter.first}' #{parameter.length > 1 ? '=> \'' << parameter[1] << '\'' : 'absent'} makes '#{content}'} do + path = File.join(tmpdir, 'ini_subsetting.ini') + + before :all do + shell(%Q{echo '[java]\nargs=-Xmx256m' > #{path}}) + end + after :all do + shell("cat #{path}", :acceptable_exit_codes => [0, 1, 2]) + shell("rm #{path}", :acceptable_exit_codes => [0, 1, 2]) + end + + pp = <<-EOS + ini_subsetting { '#{parameter.first}': + ensure => #{parameter.length > 1 ? 'present' : 'absent'}, + path => '#{path}', + section => 'java', + setting => 'args', + quote_char => '"', + subsetting => '#{parameter.first}', + value => '#{parameter.length > 1 ? parameter[1] : ''}' + } + EOS + + it 'applies the manifest twice' do + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file("#{tmpdir}/ini_subsetting.ini") do + it { should be_file } + its(:content) { + should match content + } + end + end + end + end + + describe 'show_diff parameter and logging:' do + [ {:value => "initial_value", :matcher => "created", :show_diff => true}, + {:value => "public_value", :matcher => /initial_value.*public_value/, :show_diff => true}, + {:value => "secret_value", :matcher => /redacted sensitive information.*redacted sensitive information/, :show_diff => false}, + {:value => "md5_value", :matcher => /{md5}881671aa2bbc680bc530c4353125052b.*{md5}ed0903a7fa5de7886ca1a7a9ad06cf51/, :show_diff => :md5} + ].each do |i| + context "show_diff => #{i[:show_diff]}" do + pp = <<-EOS + ini_subsetting { 'test_show_diff': + ensure => present, + section => 'test', + setting => 'something', + subsetting => 'xxx', + value => '#{i[:value]}', + path => "#{tmpdir}/test_show_diff.ini", + show_diff => #{i[:show_diff]} + } + EOS + + it "applies manifest and expects changed value to be logged in proper form" do + config = { + 'main' => { + 'show_diff' => true + } + } + configure_puppet_on(default, config) + + res = apply_manifest(pp, :expect_changes => true) + expect(res.stdout).to match(i[:matcher]) + expect(res.stdout).not_to match(i[:value]) unless (i[:show_diff] == true) + + end + end + end + end + + describe 'insert types:' do + [ + { + :insert_type => :start, + :content => /d a b c/, + }, + { + :insert_type => :end, + :content => /a b c d/, + }, + { + :insert_type => :before, + :insert_value => 'c', + :content => /a b d c/, + }, + { + :insert_type => :after, + :insert_value => 'a', + :content => /a d b c/, + }, + { + :insert_type => :index, + :insert_value => 2, + :content => /a b d c/, + } + ].each do |params| + context "with '#{params[:insert_type]}' makes '#{params[:content]}'" do + pp = <<-EOS + ini_subsetting { "a": + ensure => present, + section => 'one', + setting => 'two', + subsetting => 'a', + path => "#{tmpdir}/insert_types.ini", + } -> + ini_subsetting { "b": + ensure => present, + section => 'one', + setting => 'two', + subsetting => 'b', + path => "#{tmpdir}/insert_types.ini", + } -> + ini_subsetting { "c": + ensure => present, + section => 'one', + setting => 'two', + subsetting => 'c', + path => "#{tmpdir}/insert_types.ini", + } -> + ini_subsetting { "insert makes #{params[:content]}": + ensure => present, + section => 'one', + setting => 'two', + subsetting => 'd', + path => "#{tmpdir}/insert_types.ini", + insert_type => '#{params[:insert_type]}', + insert_value => '#{params[:insert_value]}', + } + EOS + + it_behaves_like 'has_content', "#{tmpdir}/insert_types.ini", pp, params[:content] + end + end + end + +end diff --git a/environments/production/modules/inifile/spec/acceptance/nodesets/centos-7-x64.yml b/environments/production/modules/inifile/spec/acceptance/nodesets/centos-7-x64.yml new file mode 100644 index 0000000..1a40c89 --- /dev/null +++ b/environments/production/modules/inifile/spec/acceptance/nodesets/centos-7-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + centos-7-x64: + roles: + - agent + - default + platform: redhat-7-x86_64 + hypervisor: vagrant + box: puppetlabs/centos-7.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/inifile/spec/acceptance/nodesets/debian-8-x64.yml b/environments/production/modules/inifile/spec/acceptance/nodesets/debian-8-x64.yml new file mode 100644 index 0000000..fef6e63 --- /dev/null +++ b/environments/production/modules/inifile/spec/acceptance/nodesets/debian-8-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + debian-8-x64: + roles: + - agent + - default + platform: debian-8-amd64 + hypervisor: vagrant + box: puppetlabs/debian-8.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/inifile/spec/acceptance/nodesets/default.yml b/environments/production/modules/inifile/spec/acceptance/nodesets/default.yml new file mode 100644 index 0000000..dba339c --- /dev/null +++ b/environments/production/modules/inifile/spec/acceptance/nodesets/default.yml @@ -0,0 +1,10 @@ +HOSTS: + ubuntu-1404-x64: + roles: + - agent + - default + platform: ubuntu-14.04-amd64 + hypervisor: vagrant + box: puppetlabs/ubuntu-14.04-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/inifile/spec/acceptance/nodesets/docker/centos-7.yml b/environments/production/modules/inifile/spec/acceptance/nodesets/docker/centos-7.yml new file mode 100644 index 0000000..a3333aa --- /dev/null +++ b/environments/production/modules/inifile/spec/acceptance/nodesets/docker/centos-7.yml @@ -0,0 +1,12 @@ +HOSTS: + centos-7-x64: + platform: el-7-x86_64 + hypervisor: docker + image: centos:7 + docker_preserve_image: true + docker_cmd: '["/usr/sbin/init"]' + # install various tools required to get the image up to usable levels + docker_image_commands: + - 'yum install -y crontabs tar wget openssl sysvinit-tools iproute which initscripts' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/inifile/spec/acceptance/nodesets/docker/debian-8.yml b/environments/production/modules/inifile/spec/acceptance/nodesets/docker/debian-8.yml new file mode 100644 index 0000000..df5c319 --- /dev/null +++ b/environments/production/modules/inifile/spec/acceptance/nodesets/docker/debian-8.yml @@ -0,0 +1,11 @@ +HOSTS: + debian-8-x64: + platform: debian-8-amd64 + hypervisor: docker + image: debian:8 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get update && apt-get install -y net-tools wget locales strace lsof && echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/inifile/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/environments/production/modules/inifile/spec/acceptance/nodesets/docker/ubuntu-14.04.yml new file mode 100644 index 0000000..b1efa58 --- /dev/null +++ b/environments/production/modules/inifile/spec/acceptance/nodesets/docker/ubuntu-14.04.yml @@ -0,0 +1,12 @@ +HOSTS: + ubuntu-1404-x64: + platform: ubuntu-14.04-amd64 + hypervisor: docker + image: ubuntu:14.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + # ensure that upstart is booting correctly in the container + - 'rm /usr/sbin/policy-rc.d && rm /sbin/initctl && dpkg-divert --rename --remove /sbin/initctl && apt-get update && apt-get install -y net-tools wget && locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/inifile/spec/classes/create_ini_settings_test_spec.rb b/environments/production/modules/inifile/spec/classes/create_ini_settings_test_spec.rb new file mode 100644 index 0000000..c81f93f --- /dev/null +++ b/environments/production/modules/inifile/spec/classes/create_ini_settings_test_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' +# end-to-end test of the create_init_settings function +describe 'create_ini_settings_test' do + it { should have_ini_setting_resource_count(3) } + it { should contain_ini_setting('/tmp/foo.ini [section1] setting1').with( + :ensure => 'present', + :section => 'section1', + :setting => 'setting1', + :value => 'val1', + :path => '/tmp/foo.ini' + )} + it { should contain_ini_setting('/tmp/foo.ini [section2] setting2').with( + :ensure => 'present', + :section => 'section2', + :setting => 'setting2', + :value => 'val2', + :path => '/tmp/foo.ini' + )} + it { should contain_ini_setting('/tmp/foo.ini [section2] setting3').with( + :ensure => 'absent', + :section => 'section2', + :setting => 'setting3', + :path => '/tmp/foo.ini' + )} +end diff --git a/environments/production/modules/inifile/spec/classes/create_multiple_ini_settings_spec.rb b/environments/production/modules/inifile/spec/classes/create_multiple_ini_settings_spec.rb new file mode 100644 index 0000000..374557e --- /dev/null +++ b/environments/production/modules/inifile/spec/classes/create_multiple_ini_settings_spec.rb @@ -0,0 +1,5 @@ +require 'spec_helper' + +describe 'create_multiple_ini_settings' do + it { is_expected.to compile } +end diff --git a/environments/production/modules/inifile/spec/classes/inherit_test1_spec.rb b/environments/production/modules/inifile/spec/classes/inherit_test1_spec.rb new file mode 100644 index 0000000..152584f --- /dev/null +++ b/environments/production/modules/inifile/spec/classes/inherit_test1_spec.rb @@ -0,0 +1,10 @@ +require 'spec_helper' +# We can't really test much here, apart from the type roundtrips though the +# parser OK. +describe 'inherit_test1' do + it { + should contain_inherit_ini_setting('valid_type').with({ + 'value' => 'true', + }) + } +end diff --git a/environments/production/modules/inifile/spec/fixtures/create_multiple_ini_settings/manifests/init.pp b/environments/production/modules/inifile/spec/fixtures/create_multiple_ini_settings/manifests/init.pp new file mode 100644 index 0000000..b4595a9 --- /dev/null +++ b/environments/production/modules/inifile/spec/fixtures/create_multiple_ini_settings/manifests/init.pp @@ -0,0 +1,15 @@ +class create_multiple_ini_settings { + +$defaults = { 'path' => '/tmp/foo.ini' } +$example = { + 'section1' => { + 'setting1' => 'value1', + 'settings2' => { + 'ensure' => 'absent' + } + } +} +create_ini_settings($example, $defaults) + +} + diff --git a/environments/production/modules/inifile/spec/fixtures/tmp/.empty b/environments/production/modules/inifile/spec/fixtures/tmp/.empty new file mode 100644 index 0000000..e69de29 diff --git a/environments/production/modules/inifile/spec/functions/create_ini_settings_spec.rb b/environments/production/modules/inifile/spec/functions/create_ini_settings_spec.rb new file mode 100644 index 0000000..4fe817f --- /dev/null +++ b/environments/production/modules/inifile/spec/functions/create_ini_settings_spec.rb @@ -0,0 +1,24 @@ +#! /usr/bin/env ruby + +require 'spec_helper' +require 'rspec-puppet' + +describe 'create_ini_settings' do + before :each do + Puppet::Parser::Functions.autoloader.loadall + Puppet::Parser::Functions.function(:create_resources) + end + + describe 'argument handling' do + it { is_expected.to run.with_params.and_raise_error(Puppet::ParseError, /0 for 1 or 2/) } + it { is_expected.to run.with_params(1,2,3).and_raise_error(Puppet::ParseError, /3 for 1 or 2/) } + it { is_expected.to run.with_params('foo').and_raise_error(Puppet::ParseError, /Requires all arguments/) } + it { is_expected.to run.with_params({},'foo').and_raise_error(Puppet::ParseError, /Requires all arguments/) } + + it { is_expected.to run.with_params({}) } + it { is_expected.to run.with_params({},{}) } + + it { is_expected.to run.with_params({ 'section' => { 'setting' => 'value' }}).and_raise_error(Puppet::ParseError, /must pass the path parameter/) } + it { is_expected.to run.with_params({ 1 => 2 }).and_raise_error(Puppet::ParseError, /Section 1 must contain a Hash/) } + end +end diff --git a/environments/production/modules/inifile/spec/spec.opts b/environments/production/modules/inifile/spec/spec.opts new file mode 100644 index 0000000..91cd642 --- /dev/null +++ b/environments/production/modules/inifile/spec/spec.opts @@ -0,0 +1,6 @@ +--format +s +--colour +--loadby +mtime +--backtrace diff --git a/environments/production/modules/inifile/spec/spec_helper.rb b/environments/production/modules/inifile/spec/spec_helper.rb new file mode 100644 index 0000000..22d5d68 --- /dev/null +++ b/environments/production/modules/inifile/spec/spec_helper.rb @@ -0,0 +1,8 @@ +#This file is generated by ModuleSync, do not edit. +require 'puppetlabs_spec_helper/module_spec_helper' + +# put local configuration and setup into spec_helper_local +begin + require 'spec_helper_local' +rescue LoadError +end diff --git a/environments/production/modules/inifile/spec/spec_helper_acceptance.rb b/environments/production/modules/inifile/spec/spec_helper_acceptance.rb new file mode 100644 index 0000000..dd1f1f0 --- /dev/null +++ b/environments/production/modules/inifile/spec/spec_helper_acceptance.rb @@ -0,0 +1,23 @@ +require 'beaker-rspec/spec_helper' +require 'beaker-rspec/helpers/serverspec' +require 'beaker/puppet_install_helper' + +run_puppet_install_helper + +RSpec.configure do |c| + # Project root + proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..')) + + # Readable test descriptions + c.formatter = :documentation + + # Configure all nodes in nodeset + c.before :suite do + # Install module and dependencies + hosts.each do |host| + copy_root_module_to(host, :source => proj_root, :module_name => 'inifile') + end + end + + c.treat_symbols_as_metadata_keys_with_true_values = true +end diff --git a/environments/production/modules/inifile/spec/spec_helper_local.rb b/environments/production/modules/inifile/spec/spec_helper_local.rb new file mode 100644 index 0000000..e35501c --- /dev/null +++ b/environments/production/modules/inifile/spec/spec_helper_local.rb @@ -0,0 +1,3 @@ +RSpec.configure do |config| + config.mock_with :rspec +end diff --git a/environments/production/modules/inifile/spec/unit/puppet/provider/ini_setting/inheritance_spec.rb b/environments/production/modules/inifile/spec/unit/puppet/provider/ini_setting/inheritance_spec.rb new file mode 100644 index 0000000..a5e1240 --- /dev/null +++ b/environments/production/modules/inifile/spec/unit/puppet/provider/ini_setting/inheritance_spec.rb @@ -0,0 +1,67 @@ +require 'spec_helper' + +# This is a reduced version of ruby_spec.rb just to ensure we can subclass as +# documented +$: << './spec/fixtures/modules/inherit_ini_setting/lib' +provider_class = Puppet::Type.type(:inherit_ini_setting).provider(:ini_setting) +describe provider_class do + include PuppetlabsSpec::Files + + let(:tmpfile) { tmpfilename('inherit_ini_setting_test') } + + def validate_file(expected_content, tmpfile) + File.read(tmpfile).should == expected_content + end + + + before :each do + File.open(tmpfile, 'w') do |fh| + fh.write(orig_content) + end + end + + context 'when calling instances' do + let(:orig_content) { '' } + + it 'should parse nothing when the file is empty' do + provider_class.stubs(:file_path).returns(tmpfile) + provider_class.instances.should == [] + end + + context 'when the file has contents' do + let(:orig_content) { + <<-EOS +# A comment +red = blue +green = purple + EOS + } + + it 'should parse the results' do + provider_class.stubs(:file_path).returns(tmpfile) + instances = provider_class.instances + instances.size.should == 2 + # inherited version of namevar flattens the names + names = instances.map do |instance| + instance.instance_variable_get(:@property_hash)[:name] + end + names.sort.should == [ 'green', 'red' ] + end + end + end + + context 'when ensuring that a setting is present' do + let(:orig_content) { '' } + + it 'should add a value to the file' do + provider_class.stubs(:file_path).returns(tmpfile) + resource = Puppet::Type::Inherit_ini_setting.new({ + :setting => 'set_this', + :value => 'to_that', + }) + provider = described_class.new(resource) + provider.create + validate_file("set_this=to_that\n", tmpfile) + end + end +end diff --git a/environments/production/modules/inifile/spec/unit/puppet/provider/ini_setting/ruby_spec.rb b/environments/production/modules/inifile/spec/unit/puppet/provider/ini_setting/ruby_spec.rb new file mode 100644 index 0000000..527d135 --- /dev/null +++ b/environments/production/modules/inifile/spec/unit/puppet/provider/ini_setting/ruby_spec.rb @@ -0,0 +1,1529 @@ +require 'spec_helper' +require 'puppet' + +provider_class = Puppet::Type.type(:ini_setting).provider(:ruby) +describe provider_class do + include PuppetlabsSpec::Files + + let(:tmpfile) { tmpfilename("ini_setting_test") } + let(:emptyfile) { tmpfilename("ini_setting_test_empty") } + + let(:common_params) { { + :title => 'ini_setting_ensure_present_test', + :path => tmpfile, + :section => 'section2', + } } + + def validate_file(expected_content,tmpfile = tmpfile) + expect(File.read(tmpfile)).to eq(expected_content) + end + + + before :each do + File.open(tmpfile, 'w') do |fh| + fh.write(orig_content) + end + File.open(emptyfile, 'w') do |fh| + fh.write("") + end + end + + context 'when calling instances' do + + let :orig_content do + '' + end + + it 'should fail when file path is not set' do + expect { + provider_class.instances + }.to raise_error(Puppet::Error, 'Ini_settings only support collecting instances when a file path is hard coded') + end + + context 'when file path is set by a child class' do + it 'should return [] when file is empty' do + child_one = Class.new(provider_class) do + def self.file_path + emptyfile + end + end + child_one.stubs(:file_path).returns(emptyfile) + expect(child_one.instances).to eq([]) + end + it 'should override the provider instances file_path' do + child_two = Class.new(provider_class) do + def self.file_path + '/some/file/path' + end + end + resource = Puppet::Type::Ini_setting.new(common_params) + provider = child_two.new(resource) + expect(provider.file_path).to eq('/some/file/path') + end + context 'when file has contecnts' do + let(:orig_content) { + <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + EOS + } + + it 'should be able to parse the results' do + child_three = Class.new(provider_class) do + def self.file_path + '/some/file/path' + end + end + child_three.stubs(:file_path).returns(tmpfile) + expect(child_three.instances.size).to eq(7) + expected_array = [ + {:name => 'section1/foo', :value => 'foovalue' }, + {:name => 'section1/bar', :value => 'barvalue' }, + {:name => 'section1/master', :value => 'true' }, + {:name => 'section2/foo', :value => 'foovalue2' }, + {:name => 'section2/baz', :value => 'bazvalue' }, + {:name => 'section2/url', :value => 'http://192.168.1.1:8080' }, + {:name => 'section:sub/subby', :value => 'bar' } + ] + real_array = [] + ensure_array = [] + child_three.instances.each do |x| + prop_hash = x.instance_variable_get(:@property_hash) + ensure_value = prop_hash.delete(:ensure) + ensure_array.push(ensure_value) + real_array.push(prop_hash) + end + expect(ensure_array.uniq).to eq([:present]) + expect(((real_array - expected_array) && (expected_array - real_array))).to eq([]) + + end + + end + + end + + end + + context "when ensuring that a setting is present" do + let(:orig_content) { + <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + +-nonstandard- + shoes = purple + EOS + } + + it "should add a missing setting to the correct section" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :setting => 'yahoo', :value => 'yippee')) + provider = described_class.new(resource) + expect(provider.exists?).to be false + provider.create + expected_content = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +yahoo = yippee +[section:sub] +subby=bar + #another comment + ; yet another comment + +-nonstandard- + shoes = purple + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a missing setting to the correct section with pre/suffix" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'nonstandard', + :setting => 'yahoo', :value => 'yippee', + :section_prefix => '-', :section_suffix => '-')) + provider = described_class.new(resource) + expect(provider.exists?).to be false + provider.create + expected_content = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + +-nonstandard- + shoes = purple + yahoo = yippee + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a missing setting to the correct section with colon" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section:sub', :setting => 'yahoo', :value => 'yippee')) + provider = described_class.new(resource) + expect(provider.exists?).to be false + provider.create + expected_content = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + +-nonstandard- + shoes = purple +yahoo = yippee + EOS + validate_file(expected_content, tmpfile) + end + + it "should modify an existing setting with a different value" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :setting => 'baz', :value => 'bazvalue2')) + provider = described_class.new(resource) + provider.exists?.should be true + provider.value=('bazvalue2') + expected_content = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue2 +url = http://192.168.1.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + +-nonstandard- + shoes = purple + EOS + validate_file(expected_content, tmpfile) + end + + it "should modify an existing setting with a different boolean value" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section1', :setting => 'master', :value => false)) + provider = described_class.new(resource) + provider.exists?.should be true + transaction = double('transaction', :persistence => true) + expect(Puppet::Transaction::ResourceHarness.new(transaction).evaluate(provider.resource).out_of_sync).to eq(true) + expected_content = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = false +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + +-nonstandard- + shoes = purple + EOS + validate_file(expected_content, tmpfile) + end + + it "should modify an existing setting with pre/suffix with a different value" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'nonstandard', + :setting => 'shoes', :value => 'orange', + :section_prefix => '-', :section_suffix => '-' )) + provider = described_class.new(resource) + provider.exists?.should be true + provider.value=('orange') + expected_content = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + +-nonstandard- + shoes = orange + EOS + validate_file(expected_content, tmpfile) + end + + it "should modify an existing setting with a different value - with colon in section" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section:sub', :setting => 'subby', :value => 'foo')) + provider = described_class.new(resource) + provider.exists?.should be true + provider.value.should eq('bar') + provider.value=('foo') + expected_content = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section:sub] +subby=foo + #another comment + ; yet another comment + +-nonstandard- + shoes = purple + EOS + validate_file(expected_content, tmpfile) + end + + it "should be able to handle settings with non alphanumbering settings " do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :setting => 'url', :value => 'http://192.168.0.1:8080')) + provider = described_class.new(resource) + provider.exists?.should be true + provider.value.should eq('http://192.168.1.1:8080') + provider.value=('http://192.168.0.1:8080') + expected_content = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.0.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + +-nonstandard- + shoes = purple + EOS + validate_file(expected_content, tmpfile) + end + + it "should be able to handle settings with pre/suffix with non alphanumbering settings " do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'nonstandard', + :setting => 'shoes', :value => 'http://192.168.0.1:8080', + :section_prefix => '-', :section_suffix => '-' )) + provider = described_class.new(resource) + provider.exists?.should be true + provider.value.should eq('purple') + provider.value=('http://192.168.0.1:8080') + expected_content = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + +-nonstandard- + shoes = http://192.168.0.1:8080 + EOS + validate_file(expected_content, tmpfile) + end + + it "should recognize an existing setting with the specified value" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :setting => 'baz', :value => 'bazvalue')) + provider = described_class.new(resource) + provider.exists?.should be true + end + + it "should recognize an existing setting with pre/suffix with the specified value" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'nonstandard', + :setting => 'shoes', :value => 'purple', + :section_prefix => '-', :section_suffix => '-' )) + provider = described_class.new(resource) + provider.exists?.should be true + end + + it "should add a new section if the section does not exist" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => "section3", :setting => 'huzzah', :value => 'shazaam')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + +-nonstandard- + shoes = purple + +[section3] +huzzah = shazaam + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a new section with pre/suffix if the section does not exist" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => "section3", :setting => 'huzzah', :value => 'shazaam', + :section_prefix => '-', :section_suffix => '-' )) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + +-nonstandard- + shoes = purple + +-section3- +huzzah = shazaam + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a new section if the section does not exist - with colon" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => "section:subsection", :setting => 'huzzah', :value => 'shazaam')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + +-nonstandard- + shoes = purple + +[section:subsection] +huzzah = shazaam + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a new section with pre/suffix if the section does not exist - with colon" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => "section:subsection", :setting => 'huzzah', :value => 'shazaam', + :section_prefix => '-', :section_suffix => '-' )) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + +-nonstandard- + shoes = purple + +-section:subsection- +huzzah = shazaam + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a new section if no sections exists" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => "section1", :setting => 'setting1', :value => 'hellowworld', :path => emptyfile)) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + validate_file(" +[section1] +setting1 = hellowworld +", emptyfile) + end + + it "should add a new section with pre/suffix if no sections exists" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => "section1", :setting => 'setting1', :value => 'hellowworld', :path => emptyfile, + :section_prefix => '-', :section_suffix => '-' )) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + validate_file(" +-section1- +setting1 = hellowworld +", emptyfile) + end + + it "should add a new section with colon if no sections exists" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => "section:subsection", :setting => 'setting1', :value => 'hellowworld', :path => emptyfile)) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + validate_file(" +[section:subsection] +setting1 = hellowworld +", emptyfile) + end + + it "should add a new section with pre/suffix with colon if no sections exists" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => "section:subsection", :setting => 'setting1', :value => 'hellowworld', :path => emptyfile, + :section_prefix => '-', :section_suffix => '-' )) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + validate_file(" +-section:subsection- +setting1 = hellowworld +", emptyfile) + end + it "should be able to handle variables of any type" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => "section1", :setting => 'master', :value => true)) + provider = described_class.new(resource) + provider.exists?.should be true + provider.value.should == 'true' + end + + end + + context "when dealing with a global section" do + let(:orig_content) { + <<-EOS +# This is a comment +foo=blah +[section2] +foo = http://192.168.1.1:8080 + ; yet another comment + EOS + } + + + it "should add a missing setting if it doesn't exist" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => '', :setting => 'bar', :value => 'yippee')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +# This is a comment +foo=blah +bar = yippee +[section2] +foo = http://192.168.1.1:8080 + ; yet another comment + EOS + validate_file(expected_content, tmpfile) + end + + it "should modify an existing setting with a different value" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => '', :setting => 'foo', :value => 'yippee')) + provider = described_class.new(resource) + provider.exists?.should be true + provider.value.should eq('blah') + provider.value=('yippee') + expected_content = <<-EOS +# This is a comment +foo=yippee +[section2] +foo = http://192.168.1.1:8080 + ; yet another comment + EOS + validate_file(expected_content, tmpfile) + end + + it "should recognize an existing setting with the specified value" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => '', :setting => 'foo', :value => 'blah')) + provider = described_class.new(resource) + provider.exists?.should be true + end + end + + context "when the first line of the file is a section" do + let(:orig_content) { + <<-EOS +[section2] +foo = http://192.168.1.1:8080 + EOS + } + + it "should be able to add a global setting" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => '', :setting => 'foo', :value => 'yippee')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +foo = yippee + +[section2] +foo = http://192.168.1.1:8080 + EOS + validate_file(expected_content, tmpfile) + end + + it "should modify an existing setting" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section2', :setting => 'foo', :value => 'yippee')) + provider = described_class.new(resource) + provider.exists?.should be true + provider.value.should eq('http://192.168.1.1:8080') + provider.value=('yippee') + expected_content = <<-EOS +[section2] +foo = yippee + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a new setting" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section2', :setting => 'bar', :value => 'baz')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +[section2] +foo = http://192.168.1.1:8080 +bar = baz + EOS + validate_file(expected_content, tmpfile) + end + end + + context "when overriding the separator" do + let(:orig_content) { + <<-EOS +[section2] +foo=bar + EOS + } + + it "should modify an existing setting" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section2', + :setting => 'foo', + :value => 'yippee', + :key_val_separator => '=')) + provider = described_class.new(resource) + provider.exists?.should be true + provider.value.should eq('bar') + provider.value=('yippee') + expected_content = <<-EOS +[section2] +foo=yippee + EOS + validate_file(expected_content, tmpfile) + end + + end + + context "when overriding the separator to something other than =" do + let(:orig_content) { + <<-EOS +[section2] +foo: bar + EOS + } + + it "should modify an existing setting" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section2', + :setting => 'foo', + :value => 'yippee', + :key_val_separator => ': ')) + provider = described_class.new(resource) + provider.exists?.should be true + provider.value.should eq('bar') + provider.value=('yippee') + expected_content = <<-EOS +[section2] +foo: yippee + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a new setting" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section2', + :setting => 'bar', + :value => 'baz', + :key_val_separator => ': ')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +[section2] +foo: bar +bar: baz + EOS + validate_file(expected_content, tmpfile) + end + + end + + context "when overriding the separator to a space" do + let(:orig_content) { + <<-EOS +[section2] +foo bar + EOS + } + + it "should modify an existing setting" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section2', + :setting => 'foo', + :value => 'yippee', + :key_val_separator => ' ')) + provider = described_class.new(resource) + provider.exists?.should be true + provider.value.should eq('bar') + provider.value=('yippee') + expected_content = <<-EOS +[section2] +foo yippee + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a new setting" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section2', + :setting => 'bar', + :value => 'baz', + :key_val_separator => ' ')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +[section2] +foo bar +bar baz + EOS + validate_file(expected_content, tmpfile) + end + end + + context "when ensuring that a setting is absent" do + let(:orig_content) { + <<-EOS +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section3] +# com = ment +uncom = ment +[section4] +uncom = ment +[section:sub] +subby=bar + #another comment + ; yet another comment + + -nonstandard- + shoes = purple +EOS + } + + it "should remove a setting that exists" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section1', :setting => 'foo', :ensure => 'absent')) + provider = described_class.new(resource) + provider.exists?.should be true + provider.destroy + expected_content = <<-EOS +[section1] +; This is also a comment + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section3] +# com = ment +uncom = ment +[section4] +uncom = ment +[section:sub] +subby=bar + #another comment + ; yet another comment + + -nonstandard- + shoes = purple + EOS + validate_file(expected_content, tmpfile) + end + + it "should remove a setting with pre/suffix that exists" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'nonstandard', :setting => 'shoes', :ensure => 'absent', + :section_prefix => '-', :section_suffix => '-' )) + provider = described_class.new(resource) + provider.exists?.should be true + provider.destroy + expected_content = <<-EOS +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section3] +# com = ment +uncom = ment +[section4] +uncom = ment +[section:sub] +subby=bar + #another comment + ; yet another comment + + EOS + validate_file(expected_content, tmpfile) + end + + it "should do nothing for a setting that does not exist" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section:sub', :setting => 'foo', :ensure => 'absent')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.destroy + expected_content = <<-EOS +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section3] +# com = ment +uncom = ment +[section4] +uncom = ment +[section:sub] +subby=bar + #another comment + ; yet another comment + + -nonstandard- + shoes = purple + EOS + validate_file(expected_content, tmpfile) + end + + it "should do nothing for a setting with pre/suffix that does not exist" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'nonstandard', :setting => 'foo', :ensure => 'absent', + :section_prefix => '-', :section_suffix => '-' )) + provider = described_class.new(resource) + provider.exists?.should be false + provider.destroy + expected_content = <<-EOS +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section3] +# com = ment +uncom = ment +[section4] +uncom = ment +[section:sub] +subby=bar + #another comment + ; yet another comment + + -nonstandard- + shoes = purple + EOS + validate_file(expected_content, tmpfile) + end + + it "does not remove a section when the last uncommented setting is removed if there are comments" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section3', + :setting => 'uncom', + :ensure => 'absent', + )) + provider = described_class.new(resource) + provider.exists?.should be true + provider.destroy + expected_content = <<-EOS +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section3] +# com = ment +[section4] +uncom = ment +[section:sub] +subby=bar + #another comment + ; yet another comment + + -nonstandard- + shoes = purple + EOS + validate_file(expected_content, tmpfile) + end + + it "removes the section when removing the last line in the section" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section4', + :setting => 'uncom', + :ensure => 'absent', + )) + provider = described_class.new(resource) + provider.exists?.should be true + provider.destroy + expected_content = <<-EOS +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section2] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section3] +# com = ment +uncom = ment +[section:sub] +subby=bar + #another comment + ; yet another comment + + -nonstandard- + shoes = purple + EOS + validate_file(expected_content, tmpfile) + end + end + + context "when dealing with indentation in sections" do + let(:orig_content) { + <<-EOS +# This is a comment + [section1] + ; This is also a comment + foo=foovalue + + bar = barvalue + master = true + +[section2] + foo= foovalue2 + baz=bazvalue + url = http://192.168.1.1:8080 +[section:sub] + subby=bar + #another comment + fleezy = flam + ; yet another comment + EOS + } + + it "should add a missing setting at the correct indentation when the header is aligned" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section1', :setting => 'yahoo', :value => 'yippee')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +# This is a comment + [section1] + ; This is also a comment + foo=foovalue + + bar = barvalue + master = true + yahoo = yippee + +[section2] + foo= foovalue2 + baz=bazvalue + url = http://192.168.1.1:8080 +[section:sub] + subby=bar + #another comment + fleezy = flam + ; yet another comment + EOS + validate_file(expected_content, tmpfile) + end + + it "should update an existing setting at the correct indentation when the header is aligned" do + resource = Puppet::Type::Ini_setting.new( + common_params.merge(:section => 'section1', :setting => 'bar', :value => 'barvalue2')) + provider = described_class.new(resource) + provider.exists?.should be true + provider.create + expected_content = <<-EOS +# This is a comment + [section1] + ; This is also a comment + foo=foovalue + + bar = barvalue2 + master = true + +[section2] + foo= foovalue2 + baz=bazvalue + url = http://192.168.1.1:8080 +[section:sub] + subby=bar + #another comment + fleezy = flam + ; yet another comment + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a missing setting at the correct indentation when the header is not aligned" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section2', :setting => 'yahoo', :value => 'yippee')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +# This is a comment + [section1] + ; This is also a comment + foo=foovalue + + bar = barvalue + master = true + +[section2] + foo= foovalue2 + baz=bazvalue + url = http://192.168.1.1:8080 + yahoo = yippee +[section:sub] + subby=bar + #another comment + fleezy = flam + ; yet another comment + EOS + validate_file(expected_content, tmpfile) + end + + it "should update an existing setting at the correct indentation when the header is not aligned" do + resource = Puppet::Type::Ini_setting.new( + common_params.merge(:section => 'section2', :setting => 'baz', :value => 'bazvalue2')) + provider = described_class.new(resource) + provider.exists?.should be true + provider.create + expected_content = <<-EOS +# This is a comment + [section1] + ; This is also a comment + foo=foovalue + + bar = barvalue + master = true + +[section2] + foo= foovalue2 + baz=bazvalue2 + url = http://192.168.1.1:8080 +[section:sub] + subby=bar + #another comment + fleezy = flam + ; yet another comment + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a missing setting at the min indentation when the section is not aligned" do + resource = Puppet::Type::Ini_setting.new( + common_params.merge(:section => 'section:sub', :setting => 'yahoo', :value => 'yippee')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +# This is a comment + [section1] + ; This is also a comment + foo=foovalue + + bar = barvalue + master = true + +[section2] + foo= foovalue2 + baz=bazvalue + url = http://192.168.1.1:8080 +[section:sub] + subby=bar + #another comment + fleezy = flam + ; yet another comment + yahoo = yippee + EOS + validate_file(expected_content, tmpfile) + end + + it "should update an existing setting at the previous indentation when the section is not aligned" do + resource = Puppet::Type::Ini_setting.new( + common_params.merge(:section => 'section:sub', :setting => 'fleezy', :value => 'flam2')) + provider = described_class.new(resource) + provider.exists?.should be true + provider.create + expected_content = <<-EOS +# This is a comment + [section1] + ; This is also a comment + foo=foovalue + + bar = barvalue + master = true + +[section2] + foo= foovalue2 + baz=bazvalue + url = http://192.168.1.1:8080 +[section:sub] + subby=bar + #another comment + fleezy = flam2 + ; yet another comment + EOS + validate_file(expected_content, tmpfile) + end + + end + + + context "when dealing settings that have a commented version present" do + let(:orig_content) { + <<-EOS + [section1] + # foo=foovalue + bar=barvalue + foo = foovalue2 + +[section2] +# foo = foovalue +;bar=barvalue +blah = blah +#baz= + EOS + } + + it "should add a new setting below a commented version of that setting" do + resource = Puppet::Type::Ini_setting.new( + common_params.merge(:section => 'section2', :setting => 'foo', :value => 'foo3')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS + [section1] + # foo=foovalue + bar=barvalue + foo = foovalue2 + +[section2] +# foo = foovalue +foo = foo3 +;bar=barvalue +blah = blah +#baz= + EOS + validate_file(expected_content, tmpfile) + end + + it "should update an existing setting in place, even if there is a commented version of that setting" do + resource = Puppet::Type::Ini_setting.new( + common_params.merge(:section => 'section1', :setting => 'foo', :value => 'foo3')) + provider = described_class.new(resource) + provider.exists?.should be true + provider.create + expected_content = <<-EOS + [section1] + # foo=foovalue + bar=barvalue + foo = foo3 + +[section2] +# foo = foovalue +;bar=barvalue +blah = blah +#baz= + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a new setting below a commented version of that setting, respecting semicolons as comments" do + resource = Puppet::Type::Ini_setting.new( + common_params.merge(:section => 'section2', :setting => 'bar', :value => 'bar3')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS + [section1] + # foo=foovalue + bar=barvalue + foo = foovalue2 + +[section2] +# foo = foovalue +;bar=barvalue +bar=bar3 +blah = blah +#baz= + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a new setting below an empty commented version of that setting" do + resource = Puppet::Type::Ini_setting.new( + common_params.merge(:section => 'section2', :setting => 'baz', :value => 'bazvalue')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS + [section1] + # foo=foovalue + bar=barvalue + foo = foovalue2 + +[section2] +# foo = foovalue +;bar=barvalue +blah = blah +#baz= +baz=bazvalue + EOS + validate_file(expected_content, tmpfile) + end + + context 'when a section only contains comments' do + let(:orig_content) { + <<-EOS +[section1] +# foo=foovalue +# bar=bar2 +EOS + } + + it 'should be able to add a new setting when a section contains only comments' do + resource = Puppet::Type::Ini_setting.new( + common_params.merge(:section => 'section1', :setting => 'foo', :value => 'foovalue2') + ) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +[section1] +# foo=foovalue +foo=foovalue2 +# bar=bar2 + EOS + validate_file(expected_content, tmpfile) + end + + it 'should be able to add a new setting when it matches a commented out line other than the first one' do + resource = Puppet::Type::Ini_setting.new( + common_params.merge(:section => 'section1', :setting => 'bar', :value => 'barvalue2') + ) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +[section1] +# foo=foovalue +# bar=bar2 +bar=barvalue2 + EOS + validate_file(expected_content, tmpfile) + end + end + + context "when sections have spaces and dashes" do + let(:orig_content) { + <<-EOS +# This is a comment +[section - one] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section - two] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +[section:sub] +subby=bar + #another comment + ; yet another comment + EOS + } + + it "should add a missing setting to the correct section" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'section - two', :setting => 'yahoo', :value => 'yippee')) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +# This is a comment +[section - one] +; This is also a comment +foo=foovalue + +bar = barvalue +master = true +[section - two] + +foo= foovalue2 +baz=bazvalue +url = http://192.168.1.1:8080 +yahoo = yippee +[section:sub] +subby=bar + #another comment + ; yet another comment + EOS + validate_file(expected_content, tmpfile) + end + + end + + end + + context "when sections have spaces and quotations" do + let(:orig_content) do + <<-EOS +[branch "master"] + remote = origin + merge = refs/heads/master + +[alias] +to-deploy = log --merges --grep='pull request' --format='%s (%cN)' origin/production..origin/master +[branch "production"] + remote = origin + merge = refs/heads/production + EOS + end + + it "should add a missing setting to the correct section" do + resource = Puppet::Type::Ini_setting.new(common_params.merge( + :section => 'alias', + :setting => 'foo', + :value => 'bar' + )) + provider = described_class.new(resource) + provider.exists?.should be false + provider.create + expected_content = <<-EOS +[branch "master"] + remote = origin + merge = refs/heads/master + +[alias] +to-deploy = log --merges --grep='pull request' --format='%s (%cN)' origin/production..origin/master +foo = bar +[branch "production"] + remote = origin + merge = refs/heads/production + EOS + validate_file(expected_content, tmpfile) + end + end +end diff --git a/environments/production/modules/inifile/spec/unit/puppet/provider/ini_subsetting/ruby_spec.rb b/environments/production/modules/inifile/spec/unit/puppet/provider/ini_subsetting/ruby_spec.rb new file mode 100644 index 0000000..4a9a549 --- /dev/null +++ b/environments/production/modules/inifile/spec/unit/puppet/provider/ini_subsetting/ruby_spec.rb @@ -0,0 +1,348 @@ +require 'spec_helper' +require 'puppet' + +provider_class = Puppet::Type.type(:ini_subsetting).provider(:ruby) +describe provider_class do + include PuppetlabsSpec::Files + + let(:tmpfile) { tmpfilename("ini_setting_test") } + + def validate_file(expected_content, tmpfile) + expect(File.read(tmpfile)).to eq expected_content + end + + before :each do + File.open(tmpfile, 'w') do |fh| + fh.write(orig_content) + end + end + + context "when ensuring that a subsetting is present" do + let(:common_params) { { + :title => 'ini_setting_ensure_present_test', + :path => tmpfile, + :section => '', + :key_val_separator => '=', + :setting => 'JAVA_ARGS', + } } + + let(:orig_content) { + <<-EOS +JAVA_ARGS="-Xmx192m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof" + EOS + } + + it "should add a missing subsetting" do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => '-Xms', :value => '128m')) + provider = described_class.new(resource) + expect(provider.exists?).to be_nil + provider.create + expected_content = <<-EOS +JAVA_ARGS="-Xmx192m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof -Xms128m" + EOS + validate_file(expected_content, tmpfile) + end + + it 'should add a missing subsetting element at the beginning of the line' do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => '-Xms', :value => '128m', :insert_type => :start)) + provider = described_class.new(resource) + expect(provider.exists?).to be_nil + provider.create + expected_content = <<-EOS +JAVA_ARGS="-Xms128m -Xmx192m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof" + EOS + validate_file(expected_content, tmpfile) + end + + it 'should add a missing subsetting element at the end of the line' do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => '-Xms', :value => '128m', :insert_type => :end)) + provider = described_class.new(resource) + expect(provider.exists?).to be_nil + provider.create + expected_content = <<-EOS +JAVA_ARGS="-Xmx192m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof -Xms128m" + EOS + validate_file(expected_content, tmpfile) + end + + it 'should add a missing subsetting element after the given item' do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => '-Xms', :value => '128m', :insert_type => :after, :insert_value => '-Xmx')) + provider = described_class.new(resource) + expect(provider.exists?).to be_nil + provider.create + expected_content = <<-EOS +JAVA_ARGS="-Xmx192m -Xms128m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof" + EOS + validate_file(expected_content, tmpfile) + end + + it 'should add a missing subsetting element before the given item' do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => '-Xms', :value => '128m', :insert_type => :before, :insert_value => '-Xmx')) + provider = described_class.new(resource) + expect(provider.exists?).to be_nil + provider.create + expected_content = <<-EOS +JAVA_ARGS="-Xms128m -Xmx192m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof" + EOS + validate_file(expected_content, tmpfile) + end + + it 'should add a missing subsetting element at the given index' do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => '-Xms', :value => '128m', :insert_type => :index, :insert_value => '1')) + provider = described_class.new(resource) + expect(provider.exists?).to be_nil + provider.create + expected_content = <<-EOS +JAVA_ARGS="-Xmx192m -Xms128m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof" + EOS + validate_file(expected_content, tmpfile) + end + + it "should remove an existing subsetting" do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => '-Xmx')) + provider = described_class.new(resource) + expect(provider.exists?).to eq '192m' + provider.destroy + expected_content = <<-EOS +JAVA_ARGS="-XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof" + EOS + validate_file(expected_content, tmpfile) + end + + it 'should be able to remove several subsettings with the same name' do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => '-XX')) + provider = described_class.new(resource) + expect(provider.exists?).to eq ':+HeapDumpOnOutOfMemoryError' + provider.destroy + expected_content = <<-EOS +JAVA_ARGS="-Xmx192m" + EOS + validate_file(expected_content, tmpfile) + end + + it "should modify an existing subsetting" do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => '-Xmx', :value => '256m')) + provider = described_class.new(resource) + expect(provider.exists?).to eq '192m' + provider.value=('256m') + expected_content = <<-EOS +JAVA_ARGS="-Xmx256m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof" + EOS + validate_file(expected_content, tmpfile) + end + + it 'should be able to modify several subsettings with the same name' do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => '-XX', :value => 'test')) + provider = described_class.new(resource) + expect(provider.exists?).to eq ':+HeapDumpOnOutOfMemoryError' + provider.value=('test') + expected_content = <<-EOS +JAVA_ARGS="-Xmx192m -XXtest -XXtest" + EOS + validate_file(expected_content, tmpfile) + end + end + + context "when working with subsettings in files with unquoted settings values" do + let(:common_params) { { + :title => 'ini_setting_ensure_present_test', + :path => tmpfile, + :section => 'master', + :setting => 'reports', + } } + + let(:orig_content) { + <<-EOS +[master] + +reports = http,foo + EOS + } + + it "should remove an existing subsetting" do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => 'http', :subsetting_separator => ',')) + provider = described_class.new(resource) + expect(provider.exists?).to eq '' + provider.destroy + expected_content = <<-EOS +[master] + +reports = foo + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a new subsetting when the 'parent' setting already exists" do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => 'puppetdb', :subsetting_separator => ',')) + provider = described_class.new(resource) + expect(provider.exists?).to be_nil + provider.value=('') + expected_content = <<-EOS +[master] + +reports = http,foo,puppetdb + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a new subsetting when the 'parent' setting does not already exist" do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :setting => 'somenewsetting', + :subsetting => 'puppetdb', + :subsetting_separator => ',')) + provider = described_class.new(resource) + expect(provider.exists?).to be_nil + provider.value=('') + expected_content = <<-EOS +[master] + +reports = http,foo +somenewsetting = puppetdb + EOS + validate_file(expected_content, tmpfile) + end + + end + + context "when working with subsettings in files with use_exact_match" do + let(:common_params) { { + :title => 'ini_setting_ensure_present_test', + :path => tmpfile, + :section => 'master', + :setting => 'reports', + :use_exact_match => true, + } } + + let(:orig_content) { + <<-EOS +[master] + +reports = http,foo + EOS + } + + it "should add a new subsetting when the 'parent' setting already exists" do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => 'fo', :subsetting_separator => ',')) + provider = described_class.new(resource) + provider.value=('') + expected_content = <<-EOS +[master] + +reports = http,foo,fo + EOS + validate_file(expected_content, tmpfile) + end + + it "should not remove substring subsettings" do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => 'fo', :subsetting_separator => ',')) + provider = described_class.new(resource) + provider.value=('') + provider.destroy + expected_content = <<-EOS +[master] + +reports = http,foo + EOS + validate_file(expected_content, tmpfile) + end + end + + context 'when working with subsettings in files with subsetting_key_val_separator' do + let(:common_params) { { + :title => 'ini_setting_ensure_present_test', + :path => tmpfile, + :section => 'master', + :setting => 'reports', + :subsetting_separator => ',', + :subsetting_key_val_separator => ':', + } } + + let(:orig_content) { + <<-EOS +[master] + +reports = a:1,b:2 + EOS + } + + it "should add a new subsetting when the 'parent' setting already exists" do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => 'c', + :value => '3', + )) + provider = described_class.new(resource) + provider.value=('3') + expected_content = <<-EOS +[master] + +reports = a:1,b:2,c:3 + EOS + validate_file(expected_content, tmpfile) + end + + it "should add a new subsetting when the 'parent' setting does not already exist" do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => 'c', + :value => '3', + :setting => 'somenewsetting', + )) + provider = described_class.new(resource) + expect(provider.exists?).to be_nil + provider.value=('3') + expected_content = <<-EOS +[master] + +reports = a:1,b:2 +somenewsetting = c:3 + EOS + validate_file(expected_content, tmpfile) + end + + it 'should be able to remove the existing subsetting' do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => 'b', + )) + provider = described_class.new(resource) + expect(provider.exists?).to eq '2' + provider.destroy + expected_content = <<-EOS +[master] + +reports = a:1 + EOS + validate_file(expected_content, tmpfile) + end + + it 'should be able to modify the existing subsetting' do + resource = Puppet::Type::Ini_subsetting.new(common_params.merge( + :subsetting => 'b', + :value => '5', + )) + provider = described_class.new(resource) + expect(provider.exists?).to eq '2' + provider.value=('5') + expected_content = <<-EOS +[master] + +reports = a:1,b:5 + EOS + validate_file(expected_content, tmpfile) + end + + end + +end diff --git a/environments/production/modules/inifile/spec/unit/puppet/type/ini_setting_spec.rb b/environments/production/modules/inifile/spec/unit/puppet/type/ini_setting_spec.rb new file mode 100644 index 0000000..3869c42 --- /dev/null +++ b/environments/production/modules/inifile/spec/unit/puppet/type/ini_setting_spec.rb @@ -0,0 +1,63 @@ +#! /usr/bin/env ruby +require 'spec_helper' + +ini_setting = Puppet::Type.type(:ini_setting) + +describe ini_setting do + + [true, false].product([true, false, "true", "false", "md5", :md5]).each do |cfg, param| + describe "when Puppet[:show_diff] is #{cfg} and show_diff => #{param}" do + + before do + Puppet[:show_diff] = cfg + @value = described_class.new(:name => 'foo', :value => 'whatever', :show_diff => param).property(:value) + end + + if (cfg and [true, "true"].include? param) + it "should display diff" do + expect(@value.change_to_s('not_secret','at_all')).to include('not_secret','at_all') + end + + it "should tell current value" do + expect(@value.is_to_s('not_secret_at_all')).to eq('not_secret_at_all') + end + + it "should tell new value" do + expect(@value.should_to_s('not_secret_at_all')).to eq('not_secret_at_all') + end + elsif (cfg and ["md5", :md5].include? param) + it "should tell correct md5 hash for value" do + expect(@value.change_to_s('not_secret','at_all')).to include('e9e8db547f8960ef32dbc34029735564','46cd73a9509ba78c39f05faf078a8cbe') + expect(@value.change_to_s('not_secret','at_all')).not_to include('not_secret') + expect(@value.change_to_s('not_secret','at_all')).not_to include('at_all') + end + + it "should tell md5 of current value, but not value itself" do + expect(@value.is_to_s('not_secret_at_all')).to eq('{md5}218fde79f501b8ab8d212f1059bb857f') + expect(@value.is_to_s('not_secret_at_all')).not_to include('not_secret_at_all') + end + + it "should tell md5 of new value, but not value itself" do + expect(@value.should_to_s('not_secret_at_all')).to eq('{md5}218fde79f501b8ab8d212f1059bb857f') + expect(@value.should_to_s('not_secret_at_all')).not_to include('not_secret_at_all') + end + else + it "should not tell any actual values" do + expect(@value.change_to_s('not_secret','at_all')).to include('[redacted sensitive information]') + expect(@value.change_to_s('not_secret','at_all')).not_to include('not_secret') + expect(@value.change_to_s('not_secret','at_all')).not_to include('at_all') + end + + it "should not tell current value" do + expect(@value.is_to_s('not_secret_at_all')).to eq('[redacted sensitive information]') + expect(@value.is_to_s('not_secret_at_all')).not_to include('not_secret_at_all') + end + + it "should not tell new value" do + expect(@value.should_to_s('not_secret_at_all')).to eq('[redacted sensitive information]') + expect(@value.should_to_s('not_secret_at_all')).not_to include('not_secret_at_all') + end + end + end + end +end diff --git a/environments/production/modules/inifile/spec/unit/puppet/type/ini_subetting_spec.rb b/environments/production/modules/inifile/spec/unit/puppet/type/ini_subetting_spec.rb new file mode 100644 index 0000000..4bc6f30 --- /dev/null +++ b/environments/production/modules/inifile/spec/unit/puppet/type/ini_subetting_spec.rb @@ -0,0 +1,62 @@ +#! /usr/bin/env ruby +require 'spec_helper' + +ini_subsetting = Puppet::Type.type(:ini_subsetting) + +describe ini_subsetting do + [true, false].product([true, false, :md5]).each do |cfg, param| + describe "when Puppet[:show_diff] is #{cfg} and show_diff => #{param}" do + + before do + Puppet[:show_diff] = cfg + @value = described_class.new(:name => 'foo', :value => 'whatever', :show_diff => param).property(:value) + end + + if (cfg and param == true) + it "should display diff" do + expect(@value.change_to_s('not_secret','at_all')).to include('not_secret','at_all') + end + + it "should tell current value" do + expect(@value.is_to_s('not_secret_at_all')).to eq('not_secret_at_all') + end + + it "should tell new value" do + expect(@value.should_to_s('not_secret_at_all')).to eq('not_secret_at_all') + end + elsif (cfg and param == :md5) + it "should tell correct md5 hash for value" do + expect(@value.change_to_s('not_secret','at_all')).to include('e9e8db547f8960ef32dbc34029735564','46cd73a9509ba78c39f05faf078a8cbe') + expect(@value.change_to_s('not_secret','at_all')).not_to include('not_secret') + expect(@value.change_to_s('not_secret','at_all')).not_to include('at_all') + end + + it "should tell md5 of current value, but not value itself" do + expect(@value.is_to_s('not_secret_at_all')).to eq('{md5}218fde79f501b8ab8d212f1059bb857f') + expect(@value.is_to_s('not_secret_at_all')).not_to include('not_secret_at_all') + end + + it "should tell md5 of new value, but not value itself" do + expect(@value.should_to_s('not_secret_at_all')).to eq('{md5}218fde79f501b8ab8d212f1059bb857f') + expect(@value.should_to_s('not_secret_at_all')).not_to include('not_secret_at_all') + end + else + it "should not tell any actual values" do + expect(@value.change_to_s('not_secret','at_all')).to include('[redacted sensitive information]') + expect(@value.change_to_s('not_secret','at_all')).not_to include('not_secret') + expect(@value.change_to_s('not_secret','at_all')).not_to include('at_all') + end + + it "should not tell current value" do + expect(@value.is_to_s('not_secret_at_all')).to eq('[redacted sensitive information]') + expect(@value.is_to_s('not_secret_at_all')).not_to include('not_secret_at_all') + end + + it "should not tell new value" do + expect(@value.should_to_s('not_secret_at_all')).to eq('[redacted sensitive information]') + expect(@value.should_to_s('not_secret_at_all')).not_to include('not_secret_at_all') + end + end + end + end +end diff --git a/environments/production/modules/inifile/spec/unit/puppet/util/external_iterator_spec.rb b/environments/production/modules/inifile/spec/unit/puppet/util/external_iterator_spec.rb new file mode 100644 index 0000000..92b17af --- /dev/null +++ b/environments/production/modules/inifile/spec/unit/puppet/util/external_iterator_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' +require 'puppet/util/external_iterator' + +describe Puppet::Util::ExternalIterator do + let(:subject) { Puppet::Util::ExternalIterator.new(["a", "b", "c"]) } + + context "#next" do + it "should iterate over the items" do + subject.next.should == ["a", 0] + subject.next.should == ["b", 1] + subject.next.should == ["c", 2] + end + end + + context "#peek" do + it "should return the 0th item repeatedly" do + subject.peek.should == ["a", 0] + subject.peek.should == ["a", 0] + end + + it "should not advance the iterator, but should reflect calls to #next" do + subject.peek.should == ["a", 0] + subject.peek.should == ["a", 0] + subject.next.should == ["a", 0] + subject.peek.should == ["b", 1] + subject.next.should == ["b", 1] + subject.peek.should == ["c", 2] + subject.next.should == ["c", 2] + subject.peek.should == [nil, nil] + subject.next.should == [nil, nil] + end + end + + +end diff --git a/environments/production/modules/inifile/spec/unit/puppet/util/ini_file_spec.rb b/environments/production/modules/inifile/spec/unit/puppet/util/ini_file_spec.rb new file mode 100644 index 0000000..7a92090 --- /dev/null +++ b/environments/production/modules/inifile/spec/unit/puppet/util/ini_file_spec.rb @@ -0,0 +1,287 @@ +require 'spec_helper' +require 'stringio' +require 'puppet/util/ini_file' + +describe Puppet::Util::IniFile do + let(:subject) { Puppet::Util::IniFile.new("/my/ini/file/path") } + + before :each do + File.should_receive(:file?).with("/my/ini/file/path") { true } + described_class.should_receive(:readlines).once.with("/my/ini/file/path") do + sample_content + end + end + + context "when parsing a file" do + let(:sample_content) { + template = <<-EOS +# This is a comment +[section1] +; This is also a comment +foo=foovalue + +bar = barvalue +baz = +[section2] + +foo= foovalue2 +baz=bazvalue + ; commented = out setting + #another comment + ; yet another comment + zot = multi word value + xyzzy['thing1']['thing2']=xyzzyvalue + l=git log + EOS + template.split("\n") + } + + it "should parse the correct number of sections" do + # there is always a "global" section, so our count should be 3. + subject.section_names.length.should == 3 + end + + it "should parse the correct section_names" do + # there should always be a "global" section named "" at the beginning of the list + subject.section_names.should == ["", "section1", "section2"] + end + + it "should expose settings for sections" do + subject.get_settings("section1").should == { + "bar" => "barvalue", + "baz" => "", + "foo" => "foovalue" + } + + subject.get_settings("section2").should == { + "baz" => "bazvalue", + "foo" => "foovalue2", + "l" => "git log", + "xyzzy['thing1']['thing2']" => "xyzzyvalue", + "zot" => "multi word value" + } + end + + end + + context "when parsing a file whose first line is a section" do + let(:sample_content) { + template = <<-EOS +[section1] +; This is a comment +foo=foovalue + EOS + template.split("\n") + } + + it "should parse the correct number of sections" do + # there is always a "global" section, so our count should be 2. + subject.section_names.length.should == 2 + end + + it "should parse the correct section_names" do + # there should always be a "global" section named "" at the beginning of the list + subject.section_names.should == ["", "section1"] + end + + it "should expose settings for sections" do + subject.get_value("section1", "foo").should == "foovalue" + end + + end + + context "when parsing a file with a 'global' section" do + let(:sample_content) { + template = <<-EOS +foo = bar +[section1] +; This is a comment +foo=foovalue + EOS + template.split("\n") + } + + it "should parse the correct number of sections" do + # there is always a "global" section, so our count should be 2. + subject.section_names.length.should == 2 + end + + it "should parse the correct section_names" do + # there should always be a "global" section named "" at the beginning of the list + subject.section_names.should == ["", "section1"] + end + + it "should expose settings for sections" do + subject.get_value("", "foo").should == "bar" + subject.get_value("section1", "foo").should == "foovalue" + end + end + + context "when updating a file with existing empty values" do + let(:sample_content) { + template = <<-EOS +[section1] +foo= +#bar= +#xyzzy['thing1']['thing2']='xyzzyvalue' + EOS + template.split("\n") + } + + it "should properly update uncommented values" do + subject.get_value("section1", "far").should == nil + subject.set_value("section1", "foo", "foovalue") + subject.get_value("section1", "foo").should == "foovalue" + end + + it "should properly update commented values" do + subject.get_value("section1", "bar").should == nil + subject.set_value("section1", "bar", "barvalue") + subject.get_value("section1", "bar").should == "barvalue" + subject.get_value("section1", "xyzzy['thing1']['thing2']").should == nil + subject.set_value("section1", "xyzzy['thing1']['thing2']", "xyzzyvalue") + subject.get_value("section1", "xyzzy['thing1']['thing2']").should == "xyzzyvalue" + end + + it "should properly add new empty values" do + subject.get_value("section1", "baz").should == nil + subject.set_value("section1", "baz", "bazvalue") + subject.get_value("section1", "baz").should == "bazvalue" + end + end + + context 'the file has quotation marks in its section names' do + let(:sample_content) do + template = <<-EOS +[branch "master"] + remote = origin + merge = refs/heads/master + +[alias] +to-deploy = log --merges --grep='pull request' --format='%s (%cN)' origin/production..origin/master +[branch "production"] + remote = origin + merge = refs/heads/production + EOS + template.split("\n") + end + + it 'should parse the sections' do + subject.section_names.should match_array ['', + 'branch "master"', + 'alias', + 'branch "production"' + ] + end + end + + context 'Samba INI file with dollars in section names' do + let(:sample_content) do + template = <<-EOS + [global] + workgroup = FELLOWSHIP + ; ... + idmap config * : backend = tdb + + [printers] + comment = All Printers + ; ... + browseable = No + + [print$] + comment = Printer Drivers + path = /var/lib/samba/printers + + [Shares] + path = /home/shares + read only = No + guest ok = Yes + EOS + template.split("\n") + end + + it "should parse the correct section_names" do + subject.section_names.should match_array [ + '', + 'global', + 'printers', + 'print$', + 'Shares' + ] + end + end + + context 'section names with forward slashes in them' do + let(:sample_content) do + template = <<-EOS +[monitor:///var/log/*.log] +disabled = test_value + EOS + template.split("\n") + end + + it "should parse the correct section_names" do + subject.section_names.should match_array [ + '', + 'monitor:///var/log/*.log' + ] + end + end + + context 'KDE Configuration with braces in setting names' do + let(:sample_content) do + template = <<-EOS + [khotkeys] +_k_friendly_name=khotkeys +{5465e8c7-d608-4493-a48f-b99d99fdb508}=Print,none,PrintScreen +{d03619b6-9b3c-48cc-9d9c-a2aadb485550}=Search,none,Search +EOS + template.split("\n") + end + + it "should expose settings for sections" do + subject.get_value("khotkeys", "{5465e8c7-d608-4493-a48f-b99d99fdb508}").should == "Print,none,PrintScreen" + subject.get_value("khotkeys", "{d03619b6-9b3c-48cc-9d9c-a2aadb485550}").should == "Search,none,Search" + end + end + + context 'Configuration with colons in setting names' do + let(:sample_content) do + template = <<-EOS + [Drive names] +A:=5.25" Floppy +B:=3.5" Floppy +C:=Winchester +EOS + template.split("\n") + end + + it "should expose settings for sections" do + subject.get_value("Drive names", "A:").should eq '5.25" Floppy' + subject.get_value("Drive names", "B:").should eq '3.5" Floppy' + subject.get_value("Drive names", "C:").should eq 'Winchester' + end + end + + context 'Configuration with spaces in setting names' do + let(:sample_content) do + template = <<-EOS + [global] + # log files split per-machine: + log file = /var/log/samba/log.%m + + kerberos method = system keytab + passdb backend = tdbsam + security = ads +EOS + template.split("\n") + end + + it "should expose settings for sections" do + subject.get_value("global", "log file").should eq '/var/log/samba/log.%m' + subject.get_value("global", "kerberos method").should eq 'system keytab' + subject.get_value("global", "passdb backend").should eq 'tdbsam' + subject.get_value("global", "security").should eq 'ads' + end + end +end diff --git a/environments/production/modules/inifile/spec/unit/puppet/util/setting_value_spec.rb b/environments/production/modules/inifile/spec/unit/puppet/util/setting_value_spec.rb new file mode 100644 index 0000000..8514724 --- /dev/null +++ b/environments/production/modules/inifile/spec/unit/puppet/util/setting_value_spec.rb @@ -0,0 +1,103 @@ +require 'spec_helper' +require 'puppet/util/setting_value' + +describe Puppet::Util::SettingValue do + + describe "space subsetting separator" do + INIT_VALUE_SPACE = "\"-Xmx192m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof\"" + + before :each do + @setting_value = Puppet::Util::SettingValue.new(INIT_VALUE_SPACE, " ") + end + + it "should get the original value" do + @setting_value.get_value.should == INIT_VALUE_SPACE + end + + it "should get the correct value" do + @setting_value.get_subsetting_value("-Xmx").should == "192m" + end + + it "should add a new value" do + @setting_value.add_subsetting("-Xms", "256m") + @setting_value.get_subsetting_value("-Xms").should == "256m" + @setting_value.get_value.should == INIT_VALUE_SPACE[0, INIT_VALUE_SPACE.length - 1] + " -Xms256m\"" + end + + it "should change existing value" do + @setting_value.add_subsetting("-Xmx", "512m") + @setting_value.get_subsetting_value("-Xmx").should == "512m" + end + + it "should remove existing value" do + @setting_value.remove_subsetting("-Xmx") + @setting_value.get_subsetting_value("-Xmx").should == nil + end + end + + describe "comma subsetting separator" do + INIT_VALUE_COMMA = "\"-Xmx192m,-XX:+HeapDumpOnOutOfMemoryError,-XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof\"" + + before :each do + @setting_value = Puppet::Util::SettingValue.new(INIT_VALUE_COMMA, ",") + end + + it "should get the original value" do + @setting_value.get_value.should == INIT_VALUE_COMMA + end + + it "should get the correct value" do + @setting_value.get_subsetting_value("-Xmx").should == "192m" + end + + it "should add a new value" do + @setting_value.add_subsetting("-Xms", "256m") + @setting_value.get_subsetting_value("-Xms").should == "256m" + @setting_value.get_value.should == INIT_VALUE_COMMA[0, INIT_VALUE_COMMA.length - 1] + ",-Xms256m\"" + end + + it "should change existing value" do + @setting_value.add_subsetting("-Xmx", "512m") + @setting_value.get_subsetting_value("-Xmx").should == "512m" + end + + it "should remove existing value" do + @setting_value.remove_subsetting("-Xmx") + @setting_value.get_subsetting_value("-Xmx").should == nil + end + end + + describe "quote_char parameter" do + QUOTE_CHAR = '"' + INIT_VALUE_UNQUOTED = '-Xmx192m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof' + + it "should get quoted empty string if original value was empty" do + setting_value = Puppet::Util::SettingValue.new(nil, ' ', QUOTE_CHAR) + setting_value.get_value.should == QUOTE_CHAR * 2 + end + + it "should quote the setting when adding a value" do + setting_value = Puppet::Util::SettingValue.new(INIT_VALUE_UNQUOTED, ' ', QUOTE_CHAR) + setting_value.add_subsetting("-Xms", "256m") + + setting_value.get_subsetting_value("-Xms").should == "256m" + setting_value.get_value.should == QUOTE_CHAR + INIT_VALUE_UNQUOTED + ' -Xms256m' + QUOTE_CHAR + end + + it "should quote the setting when changing an existing value" do + setting_value = Puppet::Util::SettingValue.new(INIT_VALUE_UNQUOTED, ' ', QUOTE_CHAR) + setting_value.add_subsetting("-Xmx", "512m") + + setting_value.get_subsetting_value("-Xmx").should == "512m" + setting_value.get_value.should =~ /^#{Regexp.quote(QUOTE_CHAR)}.*#{Regexp.quote(QUOTE_CHAR)}$/ + end + + it "should quote the setting when removing an existing value" do + setting_value = Puppet::Util::SettingValue.new(INIT_VALUE_UNQUOTED, ' ', QUOTE_CHAR) + setting_value.remove_subsetting("-Xmx") + + setting_value.get_subsetting_value("-Xmx").should == nil + setting_value.get_value.should =~ /^#{Regexp.quote(QUOTE_CHAR)}.*#{Regexp.quote(QUOTE_CHAR)}$/ + end + end +end diff --git a/environments/production/modules/mysql/CHANGELOG.md b/environments/production/modules/mysql/CHANGELOG.md new file mode 100644 index 0000000..5f07f6e --- /dev/null +++ b/environments/production/modules/mysql/CHANGELOG.md @@ -0,0 +1,770 @@ +## Supported Release 3.10.0 +### Summary +This release includes new features for setting TLS options on a mysql user, a new parameter to allow specifying tool to import sql files, as well as various bugfixes. + +#### Features +- (MODULES-3879) Adds `import_cat_cmd` parameter to specify the command to read sql files +- Adds support for setting `tls_options` in `mysql_user` + +#### Bugfixes +- (MODULES-3557) Adds Ubuntu 16.04 package names for language bindings +- (MODULES-3907) Adds MySQL/Percona 5.7 initialize on fresh deploy + +## Supported Release 3.9.0 +### Summary +This release adds Percona 5.7 support and compatibility with Ubuntu 16.04, in addition to various bugfixes. + +#### Features +- (MODULES-3441) Adds the `mysqld_version` fact +- (MODULES-3513) Adds a new backup dump parameter `maxallowedpacket` +- Adds new parameter `xtrabackup_package_name` to `mysql::backup::xtrabackup` class +- Adds ability to revoke GRANT privilege + +#### Bugfixes +- Fixes a bug where `mysql_user` fails if facter cannot retrieve fqdn. +- Fix global parameter usage in backup script +- Adds support for `puppet-staging` version `2.0.0` +- (MODULES-3601) Moves binary logging configuration to take place after package install +- (MODULES-3711) Add limit to mysql server ID generated value +- (MODULES-3698) Fixes defaults for SLES12 +- Updates user name length restrictions for MySQL version 5.7.8 and above. +- Fixes a bug where error log is not writable by owner + +## Supported Release 3.8.0 +###Summary +This release adds Percona 5.7 support and compatibility with Ubuntu 16.04, in addition to various bugfixes. + +#### Features +- Adds support for Percona 5.7 +- Adds support for Ubuntu 16.04 (Xenial) + +#### Known Limitations +- The mysqlbackup.sh script will not work on MySQL 5.7.0 and up. + +#### Bugfixes +- Use mysql_install_db only with uniq defaults-extra-file +- Updates mysqlbackup.sh to ensure backup directory exist +- Loosen MariaDB recognition to fix it on Debian 8 +- Allow mysql::backup::mysqldump to access root_group in tests +- Fixed problem with ignoring parameters from global configs +- Fixes ordering issue that initialized mysqld before config is set +- (MODULES-1256) Fix parameters on OpenSUSE 12 +- Fixes install errors on Debian-based OS by configuring the base of includedir +- Configure the configfile location for mariadb +- Default mysqld_type return value should be 'mysql' if another type is not detected +- Make sure that bzip2 is installed before setting up the cron tab job using mysqlbackup.sh +- Fixes path issue on FreeBSD +- Check that /var/lib/mysql actually contains files +- Removes mysql regex when checking type +- (MODULES-2111) Add the system database to user related actions +- Updates default group for logfiles on Debian-based OS to 'adm' +- Fixes an issue with Amazon linux major release 4 installation +- Fixes 'mysql_install_db' script support on Gentoo +- Removes erroneous anchors to mysql::client from mysql::db +- Adds path to be able to find MySQL 5.5 installation on CentOS + +## Supported Release 3.7.0 +###Summary + +A large release with several new features. Also includes a considerable amount of bugfixes, many around compatibility and improvements to current functionality. + +#### Features + +- Now uses mariadb in OpenSuSE >= 13.1. +- Switch to rspec-puppet-facts. +- Additional function to check if table exists before grant. +- Add ability to input password hash directly. +- Now checking major release instead of specific release. +- Debian 8 support. + +#### Bugfixes + +- Minor doc update. +- Fixes improper use of function `warn` in backup manifest of server. +- Fixes to Compatibility with PE 3.3. +- Fixes `when not managing config file` in `mysql_server_spec`. +- Improved user validation and munging. +- Fixes fetching the mysql_user password for MySQL >=5.7.6. +- Fixes unique server_id within my.cnf, the issue were the entire mac address was not being read in to generate the id. +- Corrects the daemon_dev_package_name for mariadb on redhat. +- Fix version compare to properly suppress show_diff for root password. +- Fixes to ensure compatibility with future parser. +- Solaris removed from PE in metadata as its not supported. +- Use MYSQL_PWD to avoid mysqldump warnings. +- Use temp cnf file instead of env variable which creates acceptance test failures. +- No longer hash passwords that are already hashed. +- Fix Gemfile to work with ruby 1.8.7. +- Fixed MySQL 5.7.6++ compatibility. +- Fixing error when disabling service management and the service does not exist. +- Ubuntu vivid should use systemd not upstart. +- Fixed new mysql_datadir provider on CentOS for MySQl 5.7.6 compatibility. +- Ensure if service restart to wait till mysql is up. +- Move all dependencies to not have them in case of service unmanaged. +- Re-Added the ability to set a empty string as option parameter. +- Fixes edge-case with dropping pre-existing users with grants. +- Fix logic for choosing rspec version. +- Refactored main acceptance suite. +- Skip idempotency tests on test cells that do have PUP-5016 unfixed. +- Fix tmpdir to be shared across examples. +- Update to current msync configs [006831f]. +- Fix mysql_grant with MySQL ANSI_QUOTES mode. +- Generate .my.cnf for all sections. + +## Supported Release 3.6.2 +###Summary + +Small release for support of newer PE versions. This increments the version of PE in the metadata.json file. + +## 2015-09-22 - Supported Release 3.6.1 +### Summary +This is a security and bugfix release that fixes incorrect username truncation in the munge for the mysql_user type, incorrect function used in `mysql::server::backup` and fixes compatibility issues with PE 3.3.x. + +#### Bugfixes +- Loosen the regex in mysql_user munging so the username is not unintentionally truncated. +- Use `warning()` not `warn()` +- Metadata had inadvertantly dropped 3.3.x support +- Some 3.3.x compatibility issues in `mysqltuner` were corrected + +## 2015-08-10 - Supported Release 3.6.0 +### Summary +This release adds the ability to use mysql::db and `mysql_*` types against unmanaged or external mysql instances. + +#### Features +- Add ability to use mysql::db WITHOUT mysql::server (ie, externally) +- Add prescript attribute to mysql::server::backup for xtrabackup +- Add postscript ability to xtrabackup provider. + +#### Bugfixes +- Fix default root passwords blocking puppet on mysql 5.8 +- Fix service dependency when package_manage is false +- Fix selinux permissions on my.cnf + +##2015-07-23 - Supported Release 3.5.0 +###Summary +A small release to add explicit support to newer Puppet versions and accumulated patches. + +####Features/Improvements +- Start running tests against puppet 4 +- Support longer usernames on newer MariaDB versions +- Add parameters for Solaris 11 and 12 + +####Bugfixes +- Fix references to the mysql-server package +- mysql_server_id doesn't throw and error on machines without macaddress + +##2015-05-19 - Supported Release 3.4.0 +###Summary +This release includes the addition of extra facts, OpenBSD compatibility, and a number of other features, improvements and bug fixes. + +####Features/Improvements +- Added server_id fact which includes mac address for better uniqueness +- Added OpenBSD compatibility, only for 'OpenBSD -current' (due to the recent switch to mariadb) +- Added a $mysql_group parameter, and use that instead of the $root_group parameter to define the group membership of the mysql error log file. +- Updated tests for rspec-puppet 2 and future parser +- Further acceptance testing improvements +- MODULES-1928 - allow log-error to be undef +- Split package installation and database install +- README wording improvements +- Added options for including/excluding triggers and routines +- Made the 'TRIGGER' privilege of mysqldump backups depend on whether or not we are actually backing up triggers +- Cleaned up the privilege assignment in the mysqldump backup script +- Add a fact for capturing the mysql version installed + +####Bugfixes +- mysql backup: fix regression in mysql_user call +- Set service_ensure to undef, in the case of an unmanaged service +- README Typos fixed +- Bugfix on Xtrabackup crons +- Fixed a permission problem that was preventing triggers from being backed up +- MODULES-1981: Revoke and grant difference of old and new privileges +- Fix an issue were we assume triggers work +- Change default for mysql::server::backup to ignore_triggers = false + +####Deprecations +mysql::server::old_root_password property + +##2015-03-03 - Supported Release 3.3.0 +###Summary +This release includes major README updates, the addition of backup providers, and a fix for managing the log-bin directory. + +####Features +- Add package_manage parameters to `mysql::server` and `mysql::client` (MODULES-1143) +- README improvements +- Add `mysqldump`, `mysqlbackup`, and `xtrabackup` backup providers. + +####Bugfixes +- log-error overrides were not being properly used (MODULES-1804) +- check for full path for log-bin to stop puppet from managing file '.' + +##2015-02-09 - Supported Release 3.2.0 +###Summary +This release includes several new features and bugfixes, including support for various plugins, making the output from mysql_password more consistent when input is empty and improved username validation. + +####Features +- Add type and provider to manage plugins +- Add support for authentication plugins +- Add support for mysql_install_db on freebsd +- Add `create_root_user` and `create_root_my_cnf` parameters to `mysql::server` + +####Bugfixes +- Remove dependency on stdlib >= 4.1.0 (MODULES-1759) +- Make grant autorequire user +- Remove invalid parameter 'provider' from mysql_user instance (MODULES-1731) +- Return empty string for empty input in mysql_password +- Fix `mysql::account_security` when fqdn==localhost +- Update username validation (MODULES-1520) +- Future parser fix in params.pp +- Fix package name for debian 8 +- Don't start the service until the server package is installed and the config file is in place +- Test fixes +- Lint fixes + +##2014-12-16 - Supported Release 3.1.0 +###Summary + +This release includes several new features, including SLES12 support, and a number of bug fixes. + +####Notes + +`mysql::server::mysqltuner` has been refactored to fetch the mysqltuner script from github by default. If you are running on a non-network-connected system, you will need to download that file and have it available to your node at a path specified by the `source` parameter to the `mysqltuner` class. + +####Features +- Add support for install_options for all package resources (MODULES-1484) +- Add log-bin directory creation +- Allow mysql::db to import multiple files (MODULES-1338) +- SLES12 support +- Improved identifier quoting detections +- Reworked `mysql::server::mysqltuner` so that we are no longer packaging the script as it is licensed under the GPL. + +####Bugfixes +- Fix regression in username validation +- Proper containment for mysql::client in mysql::db +- Support quoted usernames of length 15 and 16 chars + +##2014-11-11 - Supported Release 3.0.0 +###Summary + +Added several new features including MariaDB support and future parser + +####Backwards-incompatible Changes +* Remove the deprecated `database`, `database_user`, and `database_grant` resources. The correct resources to use are `mysql`, `mysql_user`, and `mysql_grant` respectively. + +####Features +* Add MariaDB Support +* The mysqltuner perl script has been updated to 1.3.0 based on work at http://github.com/major/MySQLTuner-perl +* Add future parse support, fixed issues with undef to empty string +* Pass the backup credentials to 'SHOW DATABASES' +* Ability to specify the Includedir for `mysql::server` +* `mysql::db` now has an import\_timeout feature that defaults to 300 +* The `mysql` class has been removed +* `mysql::server` now takes an `override_options` hash that will affect the installation +* Ability to install both dev and client dev + +####BugFix +* `mysql::server::backup` now passes `ensure` param to the nested `mysql_grant` +* `mysql::server::service` now properly requires the presence of the `log_error` file +* `mysql::config` now occurs before `mysql::server::install_db` correctly + +##2014-07-15 - Supported Release 2.3.1 +###Summary + +This release merely updates metadata.json so the module can be uninstalled and +upgraded via the puppet module command. + +##2014-05-14 - Supported Release 2.3.0 + +This release primarily adds support for RHEL7 and Ubuntu 14.04 but it +also adds a couple of new parameters to allow for further customization, +as well as ensuring backups can backup stored procedures properly. + +####Features +Added `execpath` to allow a custom executable path for non-standard mysql installations. +Added `dbname` to mysql::db and use ensure_resource to create the resource. +Added support for RHEL7 and Fedora Rawhide. +Added support for Ubuntu 14.04. +Create a warning for if you disable SSL. +Ensure the error logfile is owned by MySQL. +Disable ssl on FreeBSD. +Add PROCESS privilege for backups. + +####Bugfixes + +####Known Bugs +* No known bugs + +##2014-03-04 - Supported Release 2.2.3 +###Summary + +This is a supported release. This release removes a testing symlink that can +cause trouble on systems where /var is on a seperate filesystem from the +modulepath. + +####Features +####Bugfixes +####Known Bugs +* No known bugs + +##2014-03-04 - Supported Release 2.2.2 +###Summary +This is a supported release. Mostly comprised of enhanced testing, plus a +bugfix for Suse. + +####Bugfixes +- PHP bindings on Suse +- Test fixes + +####Known Bugs +* No known bugs + +##2014-02-19 - Version 2.2.1 + +###Summary + +Minor release that repairs mysql_database{} so that it sees the correct +collation settings (it was only checking the global mysql ones, not the +actual database and constantly setting it over and over since January 22nd). + +Also fixes a bunch of tests on various platforms. + + +##2014-02-13 - Version 2.2.0 + +###Summary + +####Features +- Add `backupdirmode`, `backupdirowner`, `backupdirgroup` to + mysql::server::backup to allow customizing the mysqlbackupdir. +- Support multiple options of the same name, allowing you to + do 'replicate-do-db' => ['base1', 'base2', 'base3'] in order to get three + lines of replicate-do-db = base1, replicate-do-db = base2 etc. + +####Bugfixes +- Fix `restart` so it actually stops mysql restarting if set to false. +- DRY out the defaults_file functionality in the providers. +- mysql_grant fixed to work with root@localhost/@. +- mysql_grant fixed for WITH MAX_QUERIES_PER_HOUR +- mysql_grant fixed so revoking all privileges accounts for GRANT OPTION +- mysql_grant fixed to remove duplicate privileges. +- mysql_grant fixed to handle PROCEDURES when removing privileges. +- mysql_database won't try to create existing databases, breaking replication. +- bind_address renamed bind-address in 'mysqld' options. +- key_buffer renamed to key_buffer_size. +- log_error renamed to log-error. +- pid_file renamed to pid-file. +- Ensure mysql::server:root_password runs before mysql::server::backup +- Fix options_override -> override_options in the README. +- Extensively rewrite the README to be accurate and awesome. +- Move to requiring stdlib 3.2.0, shipped in PE3.0 +- Add many new tests. + + +##2013-11-13 - Version 2.1.0 + +###Summary + +The most important changes in 2.1.0 are improvements to the my.cnf creation, +as well as providers. Setting options to = true strips them to be just the +key name itself, which is required for some options. + +The provider updates fix a number of bugs, from lowercase privileges to +deprecation warnings. + +Last, the new hiera integration functionality should make it easier to +externalize all your grants, users, and, databases. Another great set of +community submissions helped to make this release. + +####Features +- Some options can not take a argument. Gets rid of the '= true' when an +option is set to true. +- Easier hiera integration: Add hash parameters to mysql::server to allow +specifying grants, users, and databases. + +####Bugfixes +- Fix an issue with lowercase privileges in mysql_grant{} causing them to be reapplied needlessly. +- Changed defaults-file to defaults-extra-file in providers. +- Ensure /root/.my.cnf is 0600 and root owned. +- database_user deprecation warning was incorrect. +- Add anchor pattern for client.pp +- Documentation improvements. +- Various test fixes. + + +##2013-10-21 - Version 2.0.1 + +###Summary + +This is a bugfix release to handle an issue where unsorted mysql_grant{} +privileges could cause Puppet to incorrectly reapply the permissions on +each run. + +####Bugfixes +- Mysql_grant now sorts privileges in the type and provider for comparison. +- Comment and test tweak for PE3.1. + + +##2013-10-14 - Version 2.0.0 + +###Summary + +(Previously detailed in the changelog for 2.0.0-rc1) + +This module has been completely refactored and works significantly different. +The changes are broad and touch almost every piece of the module. + +See the README.md for full details of all changes and syntax. +Please remain on 1.0.0 if you don't have time to fully test this in dev. + +* mysql::server, mysql::client, and mysql::bindings are the primary interface +classes. +* mysql::server takes an `override_options` parameter to set my.cnf options, +with the hash format: { 'section' => { 'thing' => 'value' }} +* mysql attempts backwards compatibility by forwarding all parameters to +mysql::server. + + +##2013-10-09 - Version 2.0.0-rc5 + +###Summary + +Hopefully the final rc! Further fixes to mysql_grant (stripping out the +cleverness so we match a much wider range of input.) + +####Bugfixes +- Make mysql_grant accept '.*'@'.*' in terms of input for user@host. + + +##2013-10-09 - Version 2.0.0-rc4 + +###Summary + +Bugfixes to mysql_grant and mysql_user form the bulk of this rc, as well as +ensuring that values in the override_options hash that contain a value of '' +are created as just "key" in the conf rather than "key =" or "key = false". + +####Bugfixes +- Improve mysql_grant to work with IPv6 addresses (both long and short). +- Ensure @host users work as well as user@host users. +- Updated my.cnf template to support items with no values. + + +##2013-10-07 - Version 2.0.0-rc3 + +###Summary +Fix mysql::server::monitor's use of mysql_user{}. + +####Bugfixes +- Fix myql::server::monitor's use of mysql_user{} to grant the proper +permissions. Add specs as well. (Thanks to treydock!) + + +##2013-10-03 - Version 2.0.0-rc2 + +###Summary +Bugfixes + +####Bugfixes +- Fix a duplicate parameter in mysql::server + + +##2013-10-03 - Version 2.0.0-rc1 + +###Summary + +This module has been completely refactored and works significantly different. +The changes are broad and touch almost every piece of the module. + +See the README.md for full details of all changes and syntax. +Please remain on 1.0.0 if you don't have time to fully test this in dev. + +* mysql::server, mysql::client, and mysql::bindings are the primary interface +classes. +* mysql::server takes an `override_options` parameter to set my.cnf options, +with the hash format: { 'section' => { 'thing' => 'value' }} +* mysql attempts backwards compatibility by forwarding all parameters to +mysql::server. + +--- +##2013-09-23 - Version 1.0.0 + +###Summary + +This release introduces a number of new type/providers, to eventually +replace the database_ ones. The module has been converted to call the +new providers rather than the previous ones as they have a number of +fixes, additional options, and work with puppet resource. + +This 1.0.0 release precedes a large refactoring that will be released +almost immediately after as 2.0.0. + +####Features +- Added mysql_grant, mysql_database, and mysql_user. +- Add `mysql::bindings` class and refactor all other bindings to be contained underneath mysql::bindings:: namespace. +- Added support to back up specified databases only with 'mysqlbackup' parameter. +- Add option to mysql::backup to set the backup script to perform a mysqldump on each database to its own file + +####Bugfixes +- Update my.cnf.pass.erb to allow custom socket support +- Add environment variable for .my.cnf in mysql::db. +- Add HOME environment variable for .my.cnf to mysqladmin command when +(re)setting root password + +--- +##2013-07-15 - Version 0.9.0 +####Features +- Add `mysql::backup::backuprotate` parameter +- Add `mysql::backup::delete_before_dump` parameter +- Add `max_user_connections` attribute to `database_user` type + +####Bugfixes +- Add client package dependency for `mysql::db` +- Remove duplicate `expire_logs_days` and `max_binlog_size` settings +- Make root's `.my.cnf` file path dynamic +- Update pidfile path for Suse variants +- Fixes for lint + +##2013-07-05 - Version 0.8.1 +####Bugfixes + - Fix a typo in the Fedora 19 support. + +##2013-07-01 - Version 0.8.0 +####Features + - mysql::perl class to install perl-DBD-mysql. + - minor improvements to the providers to improve reliability + - Install the MariaDB packages on Fedora 19 instead of MySQL. + - Add new `mysql` class parameters: + - `max_connections`: The maximum number of allowed connections. + - `manage_config_file`: Opt out of puppetized control of my.cnf. + - `ft_min_word_len`: Fine tune the full text search. + - `ft_max_word_len`: Fine tune the full text search. + - Add new `mysql` class performance tuning parameters: + - `key_buffer` + - `thread_stack` + - `thread_cache_size` + - `myisam-recover` + - `query_cache_limit` + - `query_cache_size` + - `max_connections` + - `tmp_table_size` + - `table_open_cache` + - `long_query_time` + - Add new `mysql` class replication parameters: + - `server_id` + - `sql_log_bin` + - `log_bin` + - `max_binlog_size` + - `binlog_do_db` + - `expire_logs_days` + - `log_bin_trust_function_creators` + - `replicate_ignore_table` + - `replicate_wild_do_table` + - `replicate_wild_ignore_table` + - `expire_logs_days` + - `max_binlog_size` + +####Bugfixes + - No longer restart MySQL when /root/.my.cnf changes. + - Ensure mysql::config runs before any mysql::db defines. + +##2013-06-26 - Version 0.7.1 +####Bugfixes +- Single-quote password for special characters +- Update travis testing for puppet 3.2.x and missing Bundler gems + +##2013-06-25 - Version 0.7.0 +This is a maintenance release for community bugfixes and exposing +configuration variables. + +* Add new `mysql` class parameters: + - `basedir`: The base directory mysql uses + - `bind_address`: The IP mysql binds to + - `client_package_name`: The name of the mysql client package + - `config_file`: The location of the server config file + - `config_template`: The template to use to generate my.cnf + - `datadir`: The directory MySQL's datafiles are stored + - `default_engine`: The default engine to use for tables + - `etc_root_password`: Whether or not to add the mysql root password to + /etc/my.cnf + - `java_package_name`: The name of the java package containing the java + connector + - `log_error`: Where to log errors + - `manage_service`: Boolean dictating if mysql::server should manage the + service + - `max_allowed_packet`: Maximum network packet size mysqld will accept + - `old_root_password`: Previous root user password + - `php_package_name`: The name of the phpmysql package to install + - `pidfile`: The location mysql will expect the pidfile to be + - `port`: The port mysql listens on + - `purge_conf_dir`: Value fed to recurse and purge parameters of the + /etc/mysql/conf.d resource + - `python_package_name`: The name of the python mysql package to install + - `restart`: Whether to restart mysqld + - `root_group`: Use specified group for root-owned files + - `root_password`: The root MySQL password to use + - `ruby_package_name`: The name of the ruby mysql package to install + - `ruby_package_provider`: The installation suite to use when installing the + ruby package + - `server_package_name`: The name of the server package to install + - `service_name`: The name of the service to start + - `service_provider`: The name of the service provider + - `socket`: The location of the MySQL server socket file + - `ssl_ca`: The location of the SSL CA Cert + - `ssl_cert`: The location of the SSL Certificate to use + - `ssl_key`: The SSL key to use + - `ssl`: Whether or not to enable ssl + - `tmpdir`: The directory MySQL's tmpfiles are stored +* Deprecate `mysql::package_name` parameter in favor of +`mysql::client_package_name` +* Fix local variable template deprecation +* Fix dependency ordering in `mysql::db` +* Fix ANSI quoting in queries +* Fix travis support (but still messy) +* Fix typos + +##2013-01-11 - Version 0.6.1 +* Fix providers when /root/.my.cnf is absent + +##2013-01-09 - Version 0.6.0 +* Add `mysql::server::config` define for specific config directives +* Add `mysql::php` class for php support +* Add `backupcompress` parameter to `mysql::backup` +* Add `restart` parameter to `mysql::config` +* Add `purge_conf_dir` parameter to `mysql::config` +* Add `manage_service` parameter to `mysql::server` +* Add syslog logging support via the `log_error` parameter +* Add initial SuSE support +* Fix remove non-localhost root user when fqdn != hostname +* Fix dependency in `mysql::server::monitor` +* Fix .my.cnf path for root user and root password +* Fix ipv6 support for users +* Fix / update various spec tests +* Fix typos +* Fix lint warnings + +##2012-08-23 - Version 0.5.0 +* Add puppetlabs/stdlib as requirement +* Add validation for mysql privs in provider +* Add `pidfile` parameter to mysql::config +* Add `ensure` parameter to mysql::db +* Add Amazon linux support +* Change `bind_address` parameter to be optional in my.cnf template +* Fix quoting root passwords + +##2012-07-24 - Version 0.4.0 +* Fix various bugs regarding database names +* FreeBSD support +* Allow specifying the storage engine +* Add a backup class +* Add a security class to purge default accounts + +##2012-05-03 - Version 0.3.0 +* 14218 Query the database for available privileges +* Add mysql::java class for java connector installation +* Use correct error log location on different distros +* Fix set_mysql_rootpw to properly depend on my.cnf + +##2012-04-11 - Version 0.2.0 + +##2012-03-19 - William Van Hevelingen +* (#13203) Add ssl support (f7e0ea5) + +##2012-03-18 - Nan Liu +* Travis ci before script needs success exit code. (0ea463b) + +##2012-03-18 - Nan Liu +* Fix Puppet 2.6 compilation issues. (9ebbbc4) + +##2012-03-16 - Nan Liu +* Add travis.ci for testing multiple puppet versions. (33c72ef) + +##2012-03-15 - William Van Hevelingen +* (#13163) Datadir should be configurable (f353fc6) + +##2012-03-16 - Nan Liu +* Document create_resources dependency. (558a59c) + +##2012-03-16 - Nan Liu +* Fix spec test issues related to error message. (eff79b5) + +##2012-03-16 - Nan Liu +* Fix mysql service on Ubuntu. (72da2c5) + +##2012-03-16 - Dan Bode +* Add more spec test coverage (55e399d) + +##2012-03-16 - Nan Liu +* (#11963) Fix spec test due to path changes. (1700349) + +##2012-03-07 - François Charlier +* Add a test to check path for 'mysqld-restart' (b14c7d1) + +##2012-03-07 - François Charlier +* Fix path for 'mysqld-restart' (1a9ae6b) + +##2012-03-15 - Dan Bode +* Add rspec-puppet tests for mysql::config (907331a) + +##2012-03-15 - Dan Bode +* Moved class dependency between sever and config to server (da62ad6) + +##2012-03-14 - Dan Bode +* Notify mysql restart from set_mysql_rootpw exec (0832a2c) + +##2012-03-15 - Nan Liu +* Add documentation related to osfamily fact. (8265d28) + +##2012-03-14 - Dan Bode +* Mention osfamily value in failure message (e472d3b) + +##2012-03-14 - Dan Bode +* Fix bug when querying for all database users (015490c) + +##2012-02-09 - Nan Liu +* Major refactor of mysql module. (b1f90fd) + +##2012-01-11 - Justin Ellison +* Ruby and Python's MySQL libraries are named differently on different distros. (1e926b4) + +##2012-01-11 - Justin Ellison +* Per @ghoneycutt, we should fail explicitly and explain why. (09af083) + +##2012-01-11 - Justin Ellison +* Removing duplicate declaration (7513d03) + +##2012-01-10 - Justin Ellison +* Use socket value from params class instead of hardcoding. (663e97c) + +##2012-01-10 - Justin Ellison +* Instead of hardcoding the config file target, pull it from mysql::params (031a47d) + +##2012-01-10 - Justin Ellison +* Moved $socket to within the case to toggle between distros. Added a $config_file variable to allow per-distro config file destinations. (360eacd) + +##2012-01-10 - Justin Ellison +* Pretty sure this is a bug, 99% of Linux distros out there won't ever hit the default. (3462e6b) + +##2012-02-09 - William Van Hevelingen +* Changed the README to use markdown (3b7dfeb) + +##2012-02-04 - Daniel Black +* (#12412) mysqltuner.pl update (b809e6f) + +##2011-11-17 - Matthias Pigulla +* (#11363) Add two missing privileges to grant: event_priv, trigger_priv (d15c9d1) + +##2011-12-20 - Jeff McCune +* (minor) Fixup typos in Modulefile metadata (a0ed6a1) + +##2011-12-19 - Carl Caum +* Only notify Exec to import sql if sql is given (0783c74) + +##2011-12-19 - Carl Caum +* (#11508) Only load sql_scripts on DB creation (e3b9fd9) + +##2011-12-13 - Justin Ellison +* Require not needed due to implicit dependencies (3058feb) + +##2011-12-13 - Justin Ellison +* Bug #11375: puppetlabs-mysql fails on CentOS/RHEL (a557b8d) + +##2011-06-03 - Dan Bode - 0.0.1 +* initial commit diff --git a/environments/production/modules/mysql/CONTRIBUTING.md b/environments/production/modules/mysql/CONTRIBUTING.md new file mode 100644 index 0000000..3c3f1e7 --- /dev/null +++ b/environments/production/modules/mysql/CONTRIBUTING.md @@ -0,0 +1,218 @@ +Checklist (and a short version for the impatient) +================================================= + + * Commits: + + - Make commits of logical units. + + - Check for unnecessary whitespace with "git diff --check" before + committing. + + - Commit using Unix line endings (check the settings around "crlf" in + git-config(1)). + + - Do not check in commented out code or unneeded files. + + - The first line of the commit message should be a short + description (50 characters is the soft limit, excluding ticket + number(s)), and should skip the full stop. + + - Associate the issue in the message. The first line should include + the issue number in the form "(#XXXX) Rest of message". + + - The body should provide a meaningful commit message, which: + + - uses the imperative, present tense: "change", not "changed" or + "changes". + + - includes motivation for the change, and contrasts its + implementation with the previous behavior. + + - Make sure that you have tests for the bug you are fixing, or + feature you are adding. + + - Make sure the test suites passes after your commit: + `bundle exec rspec spec/acceptance` More information on [testing](#Testing) below + + - When introducing a new feature, make sure it is properly + documented in the README.md + + * Submission: + + * Pre-requisites: + + - Make sure you have a [GitHub account](https://github.com/join) + + - [Create a ticket](https://tickets.puppetlabs.com/secure/CreateIssue!default.jspa), or [watch the ticket](https://tickets.puppetlabs.com/browse/) you are patching for. + + * Preferred method: + + - Fork the repository on GitHub. + + - Push your changes to a topic branch in your fork of the + repository. (the format ticket/1234-short_description_of_change is + usually preferred for this project). + + - Submit a pull request to the repository in the puppetlabs + organization. + +The long version +================ + + 1. Make separate commits for logically separate changes. + + Please break your commits down into logically consistent units + which include new or changed tests relevant to the rest of the + change. The goal of doing this is to make the diff easier to + read for whoever is reviewing your code. In general, the easier + your diff is to read, the more likely someone will be happy to + review it and get it into the code base. + + If you are going to refactor a piece of code, please do so as a + separate commit from your feature or bug fix changes. + + We also really appreciate changes that include tests to make + sure the bug is not re-introduced, and that the feature is not + accidentally broken. + + Describe the technical detail of the change(s). If your + description starts to get too long, that is a good sign that you + probably need to split up your commit into more finely grained + pieces. + + Commits which plainly describe the things which help + reviewers check the patch and future developers understand the + code are much more likely to be merged in with a minimum of + bike-shedding or requested changes. Ideally, the commit message + would include information, and be in a form suitable for + inclusion in the release notes for the version of Puppet that + includes them. + + Please also check that you are not introducing any trailing + whitespace or other "whitespace errors". You can do this by + running "git diff --check" on your changes before you commit. + + 2. Sending your patches + + To submit your changes via a GitHub pull request, we _highly_ + recommend that you have them on a topic branch, instead of + directly on "master". + It makes things much easier to keep track of, especially if + you decide to work on another thing before your first change + is merged in. + + GitHub has some pretty good + [general documentation](http://help.github.com/) on using + their site. They also have documentation on + [creating pull requests](http://help.github.com/send-pull-requests/). + + In general, after pushing your topic branch up to your + repository on GitHub, you can switch to the branch in the + GitHub UI and click "Pull Request" towards the top of the page + in order to open a pull request. + + + 3. Update the related GitHub issue. + + If there is a GitHub issue associated with the change you + submitted, then you should update the ticket to include the + location of your branch, along with any other commentary you + may wish to make. + +Testing +======= + +Getting Started +--------------- + +Our puppet modules provide [`Gemfile`](./Gemfile)s which can tell a ruby +package manager such as [bundler](http://bundler.io/) what Ruby packages, +or Gems, are required to build, develop, and test this software. + +Please make sure you have [bundler installed](http://bundler.io/#getting-started) +on your system, then use it to install all dependencies needed for this project, +by running + +```shell +% bundle install +Fetching gem metadata from https://rubygems.org/........ +Fetching gem metadata from https://rubygems.org/.. +Using rake (10.1.0) +Using builder (3.2.2) +-- 8><-- many more --><8 -- +Using rspec-system-puppet (2.2.0) +Using serverspec (0.6.3) +Using rspec-system-serverspec (1.0.0) +Using bundler (1.3.5) +Your bundle is complete! +Use `bundle show [gemname]` to see where a bundled gem is installed. +``` + +NOTE some systems may require you to run this command with sudo. + +If you already have those gems installed, make sure they are up-to-date: + +```shell +% bundle update +``` + +With all dependencies in place and up-to-date we can now run the tests: + +```shell +% bundle exec rake spec +``` + +This will execute all the [rspec tests](http://rspec-puppet.com/) tests +under [spec/defines](./spec/defines), [spec/classes](./spec/classes), +and so on. rspec tests may have the same kind of dependencies as the +module they are testing. While the module defines in its [Modulefile](./Modulefile), +rspec tests define them in [.fixtures.yml](./fixtures.yml). + +Some puppet modules also come with [beaker](https://github.com/puppetlabs/beaker) +tests. These tests spin up a virtual machine under +[VirtualBox](https://www.virtualbox.org/)) with, controlling it with +[Vagrant](http://www.vagrantup.com/) to actually simulate scripted test +scenarios. In order to run these, you will need both of those tools +installed on your system. + +You can run them by issuing the following command + +```shell +% bundle exec rake spec_clean +% bundle exec rspec spec/acceptance +``` + +This will now download a pre-fabricated image configured in the [default node-set](./spec/acceptance/nodesets/default.yml), +install puppet, copy this module and install its dependencies per [spec/spec_helper_acceptance.rb](./spec/spec_helper_acceptance.rb) +and then run all the tests under [spec/acceptance](./spec/acceptance). + +Writing Tests +------------- + +XXX getting started writing tests. + +If you have commit access to the repository +=========================================== + +Even if you have commit access to the repository, you will still need to +go through the process above, and have someone else review and merge +in your changes. The rule is that all changes must be reviewed by a +developer on the project (that did not write the code) to ensure that +all changes go through a code review process. + +Having someone other than the author of the topic branch recorded as +performing the merge is the record that they performed the code +review. + + +Additional Resources +==================== + +* [Getting additional help](http://puppet.com/community/get-help) + +* [Writing tests](https://docs.puppet.com/guides/module_guides/bgtm.html#step-three-module-testing) + +* [General GitHub documentation](http://help.github.com/) + +* [GitHub pull request documentation](http://help.github.com/send-pull-requests/) + diff --git a/environments/production/modules/mysql/Gemfile b/environments/production/modules/mysql/Gemfile new file mode 100644 index 0000000..e8b3fa6 --- /dev/null +++ b/environments/production/modules/mysql/Gemfile @@ -0,0 +1,52 @@ +#This file is generated by ModuleSync, do not edit. + +source ENV['GEM_SOURCE'] || "https://rubygems.org" + +def location_from_env(env, default_location = []) + if location = ENV[env] + if location =~ /^((?:git|https?)[:@][^#]*)#(.*)/ + [{ :git => $1, :branch => $2, :require => false }] + elsif location =~ /^file:\/\/(.*)/ + ['>= 0', { :path => File.expand_path($1), :require => false }] + else + [location, { :require => false }] + end + else + default_location + end +end + +group :development, :unit_tests do + gem 'metadata-json-lint' + gem 'puppet_facts' + gem 'puppet-blacksmith', '>= 3.4.0' + gem 'puppetlabs_spec_helper', '>= 1.2.1' + gem 'rspec-puppet', '>= 2.3.2' + gem 'rspec-puppet-facts' + gem 'mocha', '< 1.2.0' + gem 'simplecov' + gem 'parallel_tests', '< 2.10.0' if RUBY_VERSION < '2.0.0' + gem 'parallel_tests' if RUBY_VERSION >= '2.0.0' + gem 'rubocop', '0.41.2' if RUBY_VERSION < '2.0.0' + gem 'rubocop' if RUBY_VERSION >= '2.0.0' + gem 'rubocop-rspec', '~> 1.6' if RUBY_VERSION >= '2.3.0' + gem 'json_pure', '<= 2.0.1' if RUBY_VERSION < '2.0.0' + gem 'rspec-puppet-facts' +end +group :system_tests do + gem 'beaker', *location_from_env('BEAKER_VERSION', []) if RUBY_VERSION >= '2.3.0' + gem 'beaker', *location_from_env('BEAKER_VERSION', ['< 3']) if RUBY_VERSION < '2.3.0' + gem 'beaker-pe' if RUBY_VERSION >= '2.3.0' + gem 'beaker-rspec', *location_from_env('BEAKER_RSPEC_VERSION', ['>= 3.4']) + gem 'serverspec' + gem 'beaker-puppet_install_helper' + gem 'master_manipulator' + gem 'beaker-hostgenerator', *location_from_env('BEAKER_HOSTGENERATOR_VERSION', []) +end + +gem 'facter', *location_from_env('FACTER_GEM_VERSION') +gem 'puppet', *location_from_env('PUPPET_GEM_VERSION') + +if File.exists? "#{__FILE__}.local" + eval(File.read("#{__FILE__}.local"), binding) +end diff --git a/environments/production/modules/mysql/LICENSE b/environments/production/modules/mysql/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/environments/production/modules/mysql/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/environments/production/modules/mysql/NOTICE b/environments/production/modules/mysql/NOTICE new file mode 100644 index 0000000..caaa8f4 --- /dev/null +++ b/environments/production/modules/mysql/NOTICE @@ -0,0 +1,18 @@ +mysql puppet module + +Copyright (C) 2013-2016 Puppet Labs, Inc. + +Puppet Labs can be contacted at: info@puppetlabs.com + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/environments/production/modules/mysql/README.md b/environments/production/modules/mysql/README.md new file mode 100644 index 0000000..290d240 --- /dev/null +++ b/environments/production/modules/mysql/README.md @@ -0,0 +1,1050 @@ +# mysql + +#### Table of Contents + +1. [Module Description - What the module does and why it is useful](#module-description) +2. [Setup - The basics of getting started with mysql](#setup) + * [Beginning with mysql](#beginning-with-mysql) +3. [Usage - Configuration options and additional functionality](#usage) + * [Customize server options](#customize-server-options) + * [Create a database](#create-a-database) + * [Customize configuration](#create-custom-configuration) + * [Work with an existing server](#work-with-an-existing-server) + * [Specify passwords](#specify-passwords) + * [Install Percona server on CentOS](#install-percona-server-on-centos) + * [Install MariaDB on Ubuntu](#install-mariadb-on-ubuntu) +4. [Reference - An under-the-hood peek at what the module is doing and how](#reference) +5. [Limitations - OS compatibility, etc.](#limitations) +6. [Development - Guide for contributing to the module](#development) + +## Module Description + +The mysql module installs, configures, and manages the MySQL service. + +This module manages both the installation and configuration of MySQL, as well as extending Puppet to allow management of MySQL resources, such as databases, users, and grants. + +## Setup + +### Beginning with mysql + +To install a server with the default options: + +`include '::mysql::server'`. + +To customize options, such as the root +password or `/etc/my.cnf` settings, you must also pass in an override hash: + +```puppet +class { '::mysql::server': + root_password => 'strongpassword', + remove_default_accounts => true, + override_options => $override_options +} +``` + +See [**Customize Server Options**](#customize-server-options) below for examples of the hash structure for $override_options`. + +## Usage + +All interaction for the server is done via `mysql::server`. To install the client, use `mysql::client`. To install bindings, use `mysql::bindings`. + +### Customize server options + +To define server options, structure a hash structure of overrides in `mysql::server`. This hash resembles a hash in the my.cnf file: + +```puppet +$override_options = { + 'section' => { + 'item' => 'thing', + } +} +``` + +For options that you would traditionally represent in this format: + +``` +[section] +thing = X +``` + +...you can make an entry like `thing => true`, `thing => value`, or `thing => "` in the hash. Alternatively, you can pass an array, as `thing => ['value', 'value2']`, or list each `thing => value` separately on separate lines. + +You can pass a variable in the hash without setting a value for it; the variable would then use MySQL's default settings. To exclude an option from the my.cnf file --- for example, when using `override_options` to revert to a default value --- pass `thing => undef`. + +If an option needs multiple instances, pass an array. For example, + +```puppet +$override_options = { + 'mysqld' => { + 'replicate-do-db' => ['base1', 'base2'], + } +} +``` + +produces + +``` +[mysqld] +replicate-do-db = base1 +replicate-do-db = base2 +``` + +To implement version specific parameters, specify the version, such as [mysqld-5.5]. This allows one config for different versions of MySQL. + +### Create a database + +To create a database with a user and some assigned privileges: + +```puppet +mysql::db { 'mydb': + user => 'myuser', + password => 'mypass', + host => 'localhost', + grant => ['SELECT', 'UPDATE'], +} +``` + +To use a different resource name with exported resources: + +```puppet + @@mysql::db { "mydb_${fqdn}": + user => 'myuser', + password => 'mypass', + dbname => 'mydb', + host => ${fqdn}, + grant => ['SELECT', 'UPDATE'], + tag => $domain, +} +``` + +Then you can collect it on the remote DB server: + +```puppet +Mysql::Db <<| tag == $domain |>> +``` + +If you set the sql parameter to a file when creating a database, the file is imported into the new database. + +For large sql files, increase the `import_timeout` parameter, which defaults to 300 seconds. + +```puppet +mysql::db { 'mydb': + user => 'myuser', + password => 'mypass', + host => 'localhost', + grant => ['SELECT', 'UPDATE'], + sql => '/path/to/sqlfile.gz', + import_cat_cmd => 'zcat', + import_timeout => 900, +} +``` + +### Customize configuration + +To add custom MySQL configuration, place additional files into `includedir`. This allows you to override settings or add additional ones, which is helpful if you don't use `override_options` in `mysql::server`. The `includedir` location is by default set to `/etc/mysql/conf.d`. + +### Work with an existing server + +To instantiate databases and users on an existing MySQL server, you need a `.my.cnf` file in `root`'s home directory. This file must specify the remote server address and credentials. For example: + +``` +[client] +user=root +host=localhost +password=secret +``` + +This module uses the `mysqld_version` fact to discover the server version being used. By default, this is set to the output of `mysqld -V`. If you're working with a remote MySQL server, you may need to set a custom fact for `mysqld_version` to ensure correct behaviour. + +When working with a remote server, do *not* use the `mysql::server` class in your Puppet manifests. + +### Specify passwords + +In addition to passing passwords as plain text, you can input them as hashes. For example: + +```puppet +mysql::db { 'mydb': + user => 'myuser', + password => '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4', + host => 'localhost', + grant => ['SELECT', 'UPDATE'], +} +``` + +### Install Percona server on CentOS + +This example shows how to do a minimal installation of a Percona server on a +CentOS system. This sets up the Percona server, client, and bindings (including Perl and Python bindings). You can customize this usage and update the version as needed. + +This usage has been tested on Puppet 4.4 / CentOS 7 / Percona Server 5.7. + +**Note:** The installation of the yum repository is not part of this package +and is here only to show a full example of how you can install. + +```puppet +yumrepo { 'percona': + descr => 'CentOS $releasever - Percona', + baseurl => 'http://repo.percona.com/centos/$releasever/os/$basearch/', + gpgkey => 'http://www.percona.com/downloads/percona-release/RPM-GPG-KEY-percona', + enabled => 1, + gpgcheck => 1, +} + +class {'mysql::server': + package_name => 'Percona-Server-server-57', + package_ensure => '5.7.11-4.1.el7', + service_name => 'mysql', + config_file => '/etc/my.cnf', + includedir => '/etc/my.cnf.d', + root_password => 'PutYourOwnPwdHere', + override_options => { + mysqld => { + log-error => '/var/log/mysqld.log', + pid-file => '/var/run/mysqld/mysqld.pid', + }, + mysqld_safe => { + log-error => '/var/log/mysqld.log', + }, + } +} + +# Note: Installing Percona-Server-server-57 also installs Percona-Server-client-57. +# This shows how to install the Percona MySQL client on its own +class {'mysql::client': + package_name => 'Percona-Server-client-57', + package_ensure => '5.7.11-4.1.el7', +} + +# These packages are normally installed along with Percona-Server-server-57 +# If you needed to install the bindings, however, you could do so with this code +class { 'mysql::bindings': + client_dev_package_name => 'Percona-Server-shared-57', + client_dev_package_ensure => '5.7.11-4.1.el7', + client_dev => true, + daemon_dev_package_name => 'Percona-Server-devel-57', + daemon_dev_package_ensure => '5.7.11-4.1.el7', + daemon_dev => true, + perl_enable => true, + perl_package_name => 'perl-DBD-MySQL', + python_enable => true, + python_package_name => 'MySQL-python', +} + +# Dependencies definition +Yumrepo['percona']-> +Class['mysql::server'] + +Yumrepo['percona']-> +Class['mysql::client'] + +Yumrepo['percona']-> +Class['mysql::bindings'] +``` + +### Install MariaDB on Ubuntu + +#### Optional: Install the MariaDB official repo + +In this example, we'll use the latest stable (currently 10.1) from the official MariaDB repository, not the one from the distro repository. You could instead use the package from the Ubuntu repository. Make sure you use the repository corresponding to the version you want. + +**Note:** `sfo1.mirrors.digitalocean.com` is one of many mirrors available. You can use any official mirror. + +``` +include apt + +apt::source { 'mariadb': + location => 'http://sfo1.mirrors.digitalocean.com/mariadb/repo/10.1/ubuntu', + release => $::lsbdistcodename, + repos => 'main', + key => { + id => '199369E5404BD5FC7D2FE43BCBCB082A1BB943DB', + server => 'hkp://keyserver.ubuntu.com:80', + }, + include => { + src => false, + deb => true, + }, +} +``` + +#### Install the MariaDB server + +This example shows MariaDB server installation on Ubuntu Trusty. Adjust the version and the parameters of `my.cnf` as needed. All parameters of the `my.cnf` can be defined using the `override_options` parameter. + +The folders `/var/log/mysql` and `/var/run/mysqld` are created automatically, but if you are using other custom folders, they should exist as prerequisites for this code. + +All the values set here are an example of a working minimal configuration. + +Specify the version of the package you want with the `package_ensure` parameter. + +``` +class {'::mysql::server': + package_name => 'mariadb-server', + package_ensure => '10.1.14+maria-1~trusty', + service_name => 'mysql', + root_password => 'AVeryStrongPasswordUShouldEncrypt!', + override_options => { + mysqld => { + 'log-error' => '/var/log/mysql/mariadb.log', + 'pid-file' => '/var/run/mysqld/mysqld.pid', + }, + mysqld_safe => { + 'log-error' => '/var/log/mysql/mariadb.log', + }, + } +} + +# Dependency management. Only use that part if you are installing the repository +# as shown in the Preliminary step of this example. +Apt::Source['mariadb'] ~> +Class['apt::update'] -> +Class['::mysql::server'] + +``` + +#### Install the MariaDB client + +This example shows how to install the MariaDB client and all of the bindings at once. You can do this installation separately from the server installation. + +Specify the version of the package you want with the `package_ensure` parameter. + +``` +class {'::mysql::client': + package_name => 'mariadb-client', + package_ensure => '10.1.14+maria-1~trusty', + bindings_enable => true, +} + +# Dependency management. Only use that part if you are installing the repository +# as shown in the Preliminary step of this example. +Apt::Source['mariadb'] ~> +Class['apt::update'] -> +Class['::mysql::client'] +``` + +## Reference + +### Classes + +#### Public classes + +* [`mysql::server`](#mysqlserver): Installs and configures MySQL. +* [`mysql::server::monitor`](#mysqlservermonitor): Sets up a monitoring user. +* [`mysql::server::mysqltuner`](#mysqlservermysqltuner): Installs MySQL tuner script. +* [`mysql::server::backup`](#mysqlserverbackup): Sets up MySQL backups via cron. +* [`mysql::bindings`](#mysqlbindings): Installs various MySQL language bindings. +* [`mysql::client`](#mysqlclient): Installs MySQL client (for non-servers). + +#### Private classes + +* `mysql::server::install`: Installs packages. +* `mysql::server::installdb`: Implements setup of mysqld data directory (e.g. /var/lib/mysql) +* `mysql::server::config`: Configures MYSQL. +* `mysql::server::service`: Manages service. +* `mysql::server::account_security`: Deletes default MySQL accounts. +* `mysql::server::root_password`: Sets MySQL root password. +* `mysql::server::providers`: Creates users, grants, and databases. +* `mysql::bindings::client_dev`: Installs MySQL client development package. +* `mysql::bindings::daemon_dev`: Installs MySQL daemon development package. +* `mysql::bindings::java`: Installs Java bindings. +* `mysql::bindings::perl`: Installs Perl bindings. +* `mysql::bindings::php`: Installs PHP bindings. +* `mysql::bindings::python`: Installs Python bindings. +* `mysql::bindings::ruby`: Installs Ruby bindings. +* `mysql::client::install`: Installs MySQL client. +* `mysql::backup::mysqldump`: Implements mysqldump backups. +* `mysql::backup::mysqlbackup`: Implements backups with Oracle MySQL Enterprise Backup. +* `mysql::backup::xtrabackup`: Implements backups with XtraBackup from Percona. + +### Parameters + +#### mysql::server + +##### `create_root_user` + +Whether root user should be created. Valid values are true, false. Defaults to true. + +This is useful for a cluster setup with Galera. The root user has to be created only once. You can set this parameter true on one node and set it to false on the remaining nodes. + +##### `create_root_my_cnf` + +Whether to create `/root/.my.cnf`. Valid values are true, false. Defaults to true. + +`create_root_my_cnf` allows creation of `/root/.my.cnf` independently of `create_root_user`. You can use this for a cluster setup with Galera where you want `/root/.my.cnf` to exist on all nodes. + +##### `root_password` + +The MySQL root password. Puppet attempts to set the root password and update `/root/.my.cnf` with it. + +This is required if `create_root_user` or `create_root_my_cnf` are true. If `root_password` is 'UNSET', then `create_root_user` and `create_root_my_cnf` are assumed to be false --- that is, the MySQL root user and `/root/.my.cnf` are not created. + +Password changes are supported; however, the old password must be set in `/root/.my.cnf`. Effectively, Puppet uses the old password, configured in `/root/my.cnf`, to set the new password in MySQL, and then updates `/root/.my.cnf` with the new password. + +##### `old_root_password` + +This parameter no longer does anything. It exists only for backwards compatibility. See the `root_password` parameter above for details on changing the root password. + +##### `override_options` + +Specifies override options to pass into MySQL. Structured like a hash in the my.cnf file: + +```puppet +$override_options = { + 'section' => { + 'item' => 'thing', + } +} +``` + +See [**Customize Server Options**](#customize-server-options) above for usage details. + +##### `config_file` + +The location, as a path, of the MySQL configuration file. + +##### `manage_config_file` + +Whether the MySQL configuration file should be managed. Valid values are true, false. Defaults to true. + +##### `includedir` +The location, as a path, of !includedir for custom configuration overrides. + +##### `install_options` +Passes [install_options](https://docs.puppetlabs.com/references/latest/type.html#package-attribute-install_options) array to managed package resources. You must pass the appropriate options for the specified package manager. + +##### `purge_conf_dir` + +Whether the `includedir` directory should be purged. Valid values are true, false. Defaults to false. + +##### `restart` + +Whether the service should be restarted when things change. Valid values are true, false. Defaults to false. + +##### `root_group` + +The name of the group used for root. Can be a group name or a group ID. See more about the [`group` file attribute](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-group). + +##### `mysql_group` + +The name of the group of the MySQL daemon user. Can be a group name or a group ID. See more about the [`group` file attribute](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-group). + +##### `package_ensure` + +Whether the package exists or should be a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Defaults to 'present'. + +##### `package_manage` + +Whether to manage the MySQL server package. Defaults to true. + +##### `package_name` + +The name of the MySQL server package to install. + +##### `remove_default_accounts` + +Specifies whether to automatically include `mysql::server::account_security`. Valid values are true, false. Defaults to false. + +##### `service_enabled` + +Specifies whether the service should be enabled. Valid values are true, false. Defaults to true. + +##### `service_manage` + +Specifies whether the service should be managed. Valid values are true, false. Defaults to true. + +##### `service_name` + +The name of the MySQL server service. Defaults are OS dependent, defined in params.pp. + +##### `service_provider` + +The provider to use to manage the service. For Ubuntu, defaults to 'upstart'; otherwise, default is undefined. + +##### `users` + +Optional hash of users to create, which are passed to [mysql_user](#mysql_user). + +``` +users => { + 'someuser@localhost' => { + ensure => 'present', + max_connections_per_hour => '0', + max_queries_per_hour => '0', + max_updates_per_hour => '0', + max_user_connections => '0', + password_hash => '*F3A2A51A9B0F2BE2468926B4132313728C250DBF', + tls_options => ['NONE'], + }, +} +``` + +##### `grants` + +Optional hash of grants, which are passed to [mysql_grant](#mysql_grant). + +``` +grants => { + 'someuser@localhost/somedb.*' => { + ensure => 'present', + options => ['GRANT'], + privileges => ['SELECT', 'INSERT', 'UPDATE', 'DELETE'], + table => 'somedb.*', + user => 'someuser@localhost', + }, +} +``` + +##### `databases` + +Optional hash of databases to create, which are passed to [mysql_database](#mysql_database). + +``` +databases => { + 'somedb' => { + ensure => 'present', + charset => 'utf8', + }, +} +``` + +#### mysql::server::backup + +##### `backupuser` + +MySQL user to create for backups. + +##### `backuppassword` + +MySQL user password for backups. + +##### `backupdir` + +Directory in which to store backups. + +##### `backupdirmode` + +Permissions applied to the backup directory. This parameter is passed directly +to the `file` resource. + +##### `backupdirowner` + +Owner for the backup directory. This parameter is passed directly to the `file` +resource. + +##### `backupdirgroup` + +Group owner for the backup directory. This parameter is passed directly to the +`file` resource. + +##### `backupcompress` + +Whether backups should be compressed. Valid values are true, false. Defaults to true. + +##### `backuprotate` + +How many days to keep backups. Valid value is an integer. Defaults to '30'. + +##### `delete_before_dump` + +Whether to delete old .sql files before backing up. Setting to true deletes old files before backing up, while setting to false deletes them after backup. Valid values are true, false. Defaults to false. + +##### `backupdatabases` + +Specifies an array of databases to back up. + +##### `file_per_database` + +Whether a separate file be used per database. Valid values are true, false. Defaults to false. + +##### `include_routines` + +Whether or not to include routines for each database when doing a `file_per_database` backup. Defaults to false. + +##### `include_triggers` + +Whether or not to include triggers for each database when doing a `file_per_database` backup. Defaults to false. + +##### `ensure` + +Allows you to remove the backup scripts. Valid values are 'present', 'absent'. Defaults to 'present'. + +##### `execpath` + +Allows you to set a custom PATH should your MySQL installation be non-standard places. Defaults to `/usr/bin:/usr/sbin:/bin:/sbin`. + +##### `time` + +An array of two elements to set the backup time. Allows ['23', '5'] (i.e., 23:05) or ['3', '45'] (i.e., 03:45) for HH:MM times. + +##### `postscript` + +A script that is executed when the backup is finished. This could be used to (r)sync the backup to a central store. This script can be either a single line that is directly executed or a number of lines supplied as an array. It could also be one or more externally managed (executable) files. + +##### `prescript` + +A script that is executed before the backup begins. + +##### `provider` + +Sets the server backup implementation. Valid values are: + +* `mysqldump`: Implements backups with mysqldump. Backup type: Logical. This is the default value. +* `mysqlbackup`: Implements backups with MySQL Enterprise Backup from Oracle. Backup type: Physical. To use this type of backup, you'll need the `meb` package, which is available in RPM and TAR formats from Oracle. For Ubuntu, you can use [meb-deb](https://github.com/dveeden/meb-deb) to create a package from an official tarball. +* `xtrabackup`: Implements backups with XtraBackup from Percona. Backup type: Physical. + +##### `maxallowedpacket` + +Defines the maximum SQL statement size for the backup dump script. The default value is 1MB, as this is the default MySQL Server value. + +#### mysql::server::monitor + +##### `mysql_monitor_username` + +The username to create for MySQL monitoring. + +##### `mysql_monitor_password` + +The password to create for MySQL monitoring. + +##### `mysql_monitor_hostname` + +The hostname from which the monitoring user requests are allowed access. + +#### mysql::server::mysqltuner + +**Note**: If you're using this class on a non-network-connected system, you must download the mysqltuner.pl script and have it hosted somewhere accessible via `http(s)://`, `puppet://`, `ftp://`, or a fully qualified file path. + +##### `ensure` + +Ensures that the resource exists. Valid values are `present`, `absent`. Defaults to `present`. + +##### `version` + +The version to install from the major/MySQLTuner-perl github repository. Must be a valid tag. Defaults to 'v1.3.0'. + +##### `source` + +Specifies the source. If not specified, defaults to `https://github.com/major/MySQLTuner-perl/raw/${version}/mysqltuner.pl` + +#### mysql::bindings + +##### `client_dev` + +Specifies whether `::mysql::bindings::client_dev` should be included. Valid values are true', false. Defaults to false. + +##### `daemon_dev` + +Specifies whether `::mysql::bindings::daemon_dev` should be included. Valid values are true, false. Defaults to false. + +##### `java_enable` + +Specifies whether `::mysql::bindings::java` should be included. Valid values are true, false. Defaults to false. + +##### `perl_enable` + +Specifies whether `mysql::bindings::perl` should be included. Valid values are true, false. Defaults to false. + +##### `php_enable` + +Specifies whether `mysql::bindings::php` should be included. Valid values are true, false. Defaults to false. + +##### `python_enable` + +Specifies whether `mysql::bindings::python` should be included. Valid values are true, false. Defaults to false. + +##### `ruby_enable` + +Specifies whether `mysql::bindings::ruby` should be included. Valid values are true, false. Defaults to false. + +##### `install_options` + +Passes `install_options` array to managed package resources. You must pass the [appropriate options](https://docs.puppetlabs.com/references/latest/type.html#package-attribute-install_options) for the package manager(s). + +##### `client_dev_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `client_dev => true`. + +##### `client_dev_package_name` + +The name of the client_dev package to install. Only applies if `client_dev => true`. + +##### `client_dev_package_provider` + +The provider to use to install the client_dev package. Only applies if `client_dev => true`. + +##### `daemon_dev_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `daemon_dev => true`. + +##### `daemon_dev_package_name` + +The name of the daemon_dev package to install. Only applies if `daemon_dev => true`. + +##### `daemon_dev_package_provider` + +The provider to use to install the daemon_dev package. Only applies if `daemon_dev => true`. + +##### `java_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `java_enable => true`. + +##### `java_package_name` + +The name of the Java package to install. Only applies if `java_enable => true`. + +##### `java_package_provider` + +The provider to use to install the Java package. Only applies if `java_enable => true`. + +##### `perl_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `perl_enable => true`. + +##### `perl_package_name` + +The name of the Perl package to install. Only applies if `perl_enable => true`. + +##### `perl_package_provider` + +The provider to use to install the Perl package. Only applies if `perl_enable => true`. + +##### `php_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `php_enable => true`. + +##### `php_package_name` + +The name of the PHP package to install. Only applies if `php_enable => true`. + +##### `python_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `python_enable => true`. + +##### `python_package_name` + +The name of the Python package to install. Only applies if `python_enable => true`. + +##### `python_package_provider` + +The provider to use to install the PHP package. Only applies if `python_enable => true`. + +##### `ruby_package_ensure` + +Whether the package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. Only applies if `ruby_enable => true`. + +##### `ruby_package_name` + +The name of the Ruby package to install. Only applies if `ruby_enable => true`. + +##### `ruby_package_provider` + +What provider should be used to install the package. + +#### mysql::client + +##### `bindings_enable` + +Whether to automatically install all bindings. Valid values are true, false. Default to false. + +##### `install_options` +Array of install options for managed package resources. You must pass the appropriate options for the package manager. + +##### `package_ensure` + +Whether the MySQL package should be present, absent, or a specific version. Valid values are 'present', 'absent', or 'x.y.z'. + +##### `package_manage` + +Whether to manage the MySQL client package. Defaults to true. + +##### `package_name` + +The name of the MySQL client package to install. + +### Defines + +#### mysql::db + +``` +mysql_database { 'information_schema': + ensure => 'present', + charset => 'utf8', + collate => 'utf8_swedish_ci', +} +mysql_database { 'mysql': + ensure => 'present', + charset => 'latin1', + collate => 'latin1_swedish_ci', +} +``` + +##### `user` + +The user for the database you're creating. + +##### `password` + +The password for $user for the database you're creating. + +##### `dbname` + +The name of the database to create. Defaults to $name. + +##### `charset` + +The character set for the database. Defaults to 'utf8'. + +##### `collate` + +The collation for the database. Defaults to 'utf8_general_ci'. + +##### `host` + +The host to use as part of user@host for grants. Defaults to 'localhost'. + +##### `grant` + +The privileges to be granted for user@host on the database. Defaults to 'ALL'. + +##### `sql` + +The path to the sqlfile you want to execute. This can be single file specified as string, or it can be an array of strings. Defaults to undef. + +##### `enforce_sql` + +Specifies whether executing the sqlfiles should happen on every run. If set to false, sqlfiles only run once. Valid values are true, false. Defaults to false. + +##### `ensure` + +Specifies whether to create the database. Valid values are 'present', 'absent'. Defaults to 'present'. + +##### `import_timeout` + +Timeout, in seconds, for loading the sqlfiles. Defaults to '300'. + +##### `import_cat_cmd` + +Command to read the sqlfile for importing the database. Useful for compressed sqlfiles. For example, you can use 'zcat' for .gz files. Defaults to 'cat'. + +### Types + +#### mysql_database + +`mysql_database` creates and manages databases within MySQL. + +##### `ensure` + +Whether the resource is present. Valid values are 'present', 'absent'. Defaults to 'present'. + +##### `name` + +The name of the MySQL database to manage. + +##### `charset` + +The CHARACTER SET setting for the database. Defaults to ':utf8'. + +##### `collate` + +The COLLATE setting for the database. Defaults to ':utf8_general_ci'. + +#### mysql_user + +Creates and manages user grants within MySQL. + +``` +mysql_user { 'root@127.0.0.1': + ensure => 'present', + max_connections_per_hour => '0', + max_queries_per_hour => '0', + max_updates_per_hour => '0', + max_user_connections => '0', +} +``` + +You can also specify an authentication plugin. + +``` +mysql_user{ 'myuser'@'localhost': + ensure => 'present', + plugin => 'unix_socket', +} +``` + +TLS options can be specified for a user. +``` +mysql_user{ 'myuser'@'localhost': + ensure => 'present', + tls_options => ['SSL'], +} +``` + +##### `name` + +The name of the user, as 'username@hostname' or username@hostname. + +##### `password_hash` + +The user's password hash of the user. Use mysql_password() for creating such a hash. + +##### `max_user_connections` + +Maximum concurrent connections for the user. Must be an integer value. A value of '0' specifies no (or global) limit. + +##### `max_connections_per_hour` + +Maximum connections per hour for the user. Must be an integer value. A value of '0' specifies no (or global) limit. + +##### `max_queries_per_hour` + +Maximum queries per hour for the user. Must be an integer value. A value of '0' specifies no (or global) limit. + +##### `max_updates_per_hour` + +Maximum updates per hour for the user. Must be an integer value. A value of '0' specifies no (or global) limit. + +##### `tls_options` + +SSL-related options for a MySQL account, using one or more tls_option values. 'NONE' specifies that the account has no TLS options enforced, and the available options are 'SSL', 'X509', 'CIPHER *cipher*', 'ISSUER *issuer*', 'SUBJECT *subject*'; as stated in the MySQL documentation. + + +#### mysql_grant + +`mysql_grant` creates grant permissions to access databases within MySQL. To create grant permissions to access databases with MySQL, use it you must create the title of the resource as shown below, following the pattern of `username@hostname/database.table`: + +``` +mysql_grant { 'root@localhost/*.*': + ensure => 'present', + options => ['GRANT'], + privileges => ['ALL'], + table => '*.*', + user => 'root@localhost', +} +``` + +It is possible to specify privileges down to the column level: + +``` +mysql_grant { 'root@localhost/mysql.user': + ensure => 'present', + privileges => ['SELECT (Host, User)'], + table => 'mysql.user', + user => 'root@localhost', +} +``` + +To revoke GRANT privilege specify ['NONE']. + +##### `ensure` + +Whether the resource is present. Valid values are 'present', 'absent'. Defaults to 'present'. + +##### `name` + +Name to describe the grant. Must in a 'user/table' format. + +##### `privileges` + +Privileges to grant the user. + +##### `table` + +The table to which privileges are applied. + +##### `user` + +User to whom privileges are granted. + +##### `options` + +MySQL options to grant. Optional. + +#### mysql_plugin + +`mysql_plugin` can be used to load plugins into the MySQL Server. + +``` +mysql_plugin { 'auth_socket': + ensure => 'present', + soname => 'auth_socket.so', +} +``` + +##### `ensure` + +Whether the resource is present. Valid values are 'present', 'absent'. Defaults to 'present'. + +##### `name` + +The name of the MySQL plugin to manage. + +##### `soname` + +The library file name. + +#### `mysql_datadir` + +Initializes the MySQL data directory with version specific code. Pre MySQL 5.7.6 +it uses mysql_install_db. After MySQL 5.7.6 it uses mysqld --initialize-insecure. + +Insecure initialization is needed, as mysqld version 5.7 introduced "secure by default" mode. +This means MySQL generates a random password and writes it to STDOUT. This means puppet +can never accesss the database server afterwards, as no credencials are available. + +This type is an internal type and should not be called directly. + +### Facts + +#### `mysql_version` + +Determines the MySQL version by parsing the output from `mysql --version` + +#### `mysql_server_id` + +Generates a unique id, based on the node's MAC address, which can be used as +`server_id`. This fact will *always* return `0` on nodes that have only +loopback interfaces. Because those nodes aren't connected to the outside world, this shouldn't cause any conflicts. + +## Limitations + +This module has been tested on: + +* RedHat Enterprise Linux 5, 6, 7 +* Debian 6, 7, 8 +* CentOS 5, 6, 7 +* Ubuntu 10.04, 12.04, 14.04, 16.04 +* Scientific Linux 5, 6 +* SLES 11 + +Testing on other platforms has been minimal and cannot be guaranteed. + +**Note:** The mysqlbackup.sh does not work and is not supported on MySQL 5.7 and greater. + +## Development + +Puppet Labs modules on the Puppet Forge are open projects, and community +contributions are essential for keeping them great. We can't access the +huge number of platforms and myriad of hardware, software, and deployment +configurations that Puppet is intended to serve. + +We want to keep it as easy as possible to contribute changes so that our +modules work in your environment. There are a few guidelines that we need +contributors to follow so that we can have a chance of keeping on top of things. + +Check out our the complete [module contribution guide](https://docs.puppetlabs.com/forge/contributing.html). + +### Authors + +This module is based on work by David Schmitt. The following contributors have contributed to this module (beyond Puppet Labs): + +* Larry Ludwig +* Christian G. Warden +* Daniel Black +* Justin Ellison +* Lowe Schmidt +* Matthias Pigulla +* William Van Hevelingen +* Michael Arnold +* Chris Weyl +* Daniël van Eeden +* Jan-Otto Kröpke diff --git a/environments/production/modules/mysql/Rakefile b/environments/production/modules/mysql/Rakefile new file mode 100644 index 0000000..3e8d4cb --- /dev/null +++ b/environments/production/modules/mysql/Rakefile @@ -0,0 +1,38 @@ +require 'puppet_blacksmith/rake_tasks' +require 'puppet-lint/tasks/puppet-lint' +require 'puppetlabs_spec_helper/rake_tasks' + +PuppetLint.configuration.send('relative') +PuppetLint.configuration.send('disable_documentation') +PuppetLint.configuration.send('disable_single_quote_string_with_variables') + +desc 'Generate pooler nodesets' +task :gen_nodeset do + require 'beaker-hostgenerator' + require 'securerandom' + require 'fileutils' + + agent_target = ENV['TEST_TARGET'] + if ! agent_target + STDERR.puts 'TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat-64default."' + agent_target = 'redhat-64default.' + end + + master_target = ENV['MASTER_TEST_TARGET'] + if ! master_target + STDERR.puts 'MASTER_TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat7-64mdcl"' + master_target = 'redhat7-64mdcl' + end + + targets = "#{master_target}-#{agent_target}" + cli = BeakerHostGenerator::CLI.new([targets]) + nodeset_dir = "tmp/nodesets" + nodeset = "#{nodeset_dir}/#{targets}-#{SecureRandom.uuid}.yaml" + FileUtils.mkdir_p(nodeset_dir) + File.open(nodeset, 'w') do |fh| + fh.print(cli.execute) + end + puts nodeset +end diff --git a/environments/production/modules/mysql/TODO b/environments/production/modules/mysql/TODO new file mode 100644 index 0000000..3913293 --- /dev/null +++ b/environments/production/modules/mysql/TODO @@ -0,0 +1,8 @@ +The best that I can tell is that this code traces back to David Schmitt. It has been forked many times since then :) + +1. you cannot add databases to an instance that has a root password +2. you have to specify username as USER@BLAH or it cannot be found +3. mysql_grant does not complain if user does not exist +4. Needs support for pre-seeding on debian +5. the types may need to take user/password +6. rather or not to configure /etc/.my.cnf should be configurable diff --git a/environments/production/modules/mysql/checksums.json b/environments/production/modules/mysql/checksums.json new file mode 100644 index 0000000..a07fb79 --- /dev/null +++ b/environments/production/modules/mysql/checksums.json @@ -0,0 +1,115 @@ +{ + "CHANGELOG.md": "b68d316974b7228a92b8a8c3b65bb9a4", + "CONTRIBUTING.md": "b78f71c1104f00538d50ad2775f58e95", + "Gemfile": "fda543906c8c75b06ea37c4d31b95292", + "LICENSE": "3b83ef96387f14655fc854ddc3c6bd57", + "NOTICE": "d43aacde256c8e55a50e2425e25b3a8a", + "README.md": "b4969d0b8649dd0f9c105ff22b66a871", + "Rakefile": "6db744f1deed7ae0746abe59e3d50863", + "TODO": "88ca4024a37992b46c34cb46e4ac39e6", + "examples/backup.pp": "a61c6f34f153a323209faf25948737f5", + "examples/bindings.pp": "35a8387f5c55fa2e479c513a67918674", + "examples/java.pp": "0ad9de4f9f2c049642bcf08124757085", + "examples/mysql_database.pp": "107ee8793f7b4a12cfca32eddccc6bbd", + "examples/mysql_db.pp": "55d2d603f9fb8ab3c8a781d08119aa69", + "examples/mysql_grant.pp": "cd42336a6c7b2d27f5d5d6d0e310ee1a", + "examples/mysql_plugin.pp": "4f86c988a99b131e736501a309604e94", + "examples/mysql_user.pp": "0b76964aebb01714745548e0f2f32fd3", + "examples/perl.pp": "454f14dc4492fcf04afbe81b2776917e", + "examples/python.pp": "355a7e1ea3978a8fd290b5bc28b63808", + "examples/ruby.pp": "a6ae0381aacc5a8d2c403e606c6df0f0", + "examples/server/account_security.pp": "375442b7886c01b42fbf75a1fcb31822", + "examples/server/config.pp": "659b7c40e9b55634721b3c33a8c6da98", + "examples/server.pp": "72e22552a95b9a5e4a349dbfc13639dc", + "lib/facter/mysql_server_id.rb": "10de205ca9dc83b68cf63b52d97346ec", + "lib/facter/mysql_version.rb": "e30648f3d394a1cbdd4e54eb5c28d28c", + "lib/facter/mysqld_version.rb": "720f447c97dd4ce099006cd5391ade57", + "lib/puppet/parser/functions/mysql_deepmerge.rb": "2b5040ee8cd75a81cf881851e922833a", + "lib/puppet/parser/functions/mysql_dirname.rb": "820ba09a6a0df639da560b41cb31242f", + "lib/puppet/parser/functions/mysql_password.rb": "365a0ba55f0d04d0f5d56abcd577ec7d", + "lib/puppet/parser/functions/mysql_strip_hash.rb": "3efe69f1eb189b2913e178b8472aaede", + "lib/puppet/provider/mysql.rb": "2696893220da9d341d5826c9e9d4ca19", + "lib/puppet/provider/mysql_database/mysql.rb": "5cf9b8044df4ec72a726b5f781c84f8f", + "lib/puppet/provider/mysql_datadir/mysql.rb": "7c256b40cf96bdafde9c762ab867de80", + "lib/puppet/provider/mysql_grant/mysql.rb": "3630023349a4c8f06932938a26aaa2e6", + "lib/puppet/provider/mysql_plugin/mysql.rb": "49128d2a9a547c4945735bfd75fd6d6c", + "lib/puppet/provider/mysql_user/mysql.rb": "dc09eef4e1d879ffe4ee8eb9a7b3026c", + "lib/puppet/type/mysql_database.rb": "438eafbfecc30605462a220d92cf9603", + "lib/puppet/type/mysql_datadir.rb": "f19e548062e81f424646c193b086aaf6", + "lib/puppet/type/mysql_grant.rb": "afcc65b0394a23e95b8bf932bc6110b4", + "lib/puppet/type/mysql_plugin.rb": "0a52cead6c9283c9aa14ea71bdfa80bd", + "lib/puppet/type/mysql_user.rb": "8cc3c0851c06d01b310a7f551945e696", + "manifests/backup/mysqlbackup.pp": "66441b167e682689df21a4b37af175e8", + "manifests/backup/mysqldump.pp": "d858a7dda445c45952f6a7f029d41189", + "manifests/backup/xtrabackup.pp": "ebf4f4765fbbedbdc49acad9dd539a6b", + "manifests/bindings/client_dev.pp": "80753f1bf48de71d2ca1a6cfda4830be", + "manifests/bindings/daemon_dev.pp": "94d2d74afc2b247593877cebd548ed76", + "manifests/bindings/java.pp": "556b743dc162d2f3264708b0b7ba0328", + "manifests/bindings/perl.pp": "4ecbd448ceac580a07df34b5d3e24837", + "manifests/bindings/php.pp": "641139f1f27085b8e72ac73fb8bc39d8", + "manifests/bindings/python.pp": "ef9e674237eddd7e98ab307131b11069", + "manifests/bindings/ruby.pp": "32b0a32161f7a5b50562cb8e154207d9", + "manifests/bindings.pp": "8becf04105d44910f12986a58cd566f7", + "manifests/client/install.pp": "7b5810404cc9411ec38de404749f1266", + "manifests/client.pp": "c350bd6d108acb03a87b860b14d225ef", + "manifests/db.pp": "fada45e451ec7563dab714d12b9e330b", + "manifests/params.pp": "816c5cf78525ab2917da4ce1a888dfe6", + "manifests/server/account_security.pp": "36a293eec189ec1bdfe92b370d087085", + "manifests/server/backup.pp": "6ed4f8c9aac5d7f17bf5c10fceddde41", + "manifests/server/binarylog.pp": "d61af28d0f9c07cfa23c63a7cdd364bf", + "manifests/server/config.pp": "650f0ba40b9148e66f910465e63b1170", + "manifests/server/install.pp": "3cbbf313b940b582e73c229f4a8c0720", + "manifests/server/installdb.pp": "ccc13d3cbeb78b0c144006a256e40079", + "manifests/server/monitor.pp": "3810b5d756a3661e92d709115982cd59", + "manifests/server/mysqltuner.pp": "24d04e0b24cf3b31b6798bc76eed32b6", + "manifests/server/providers.pp": "87a019dce5bbb6b18c9aa61b5f99134c", + "manifests/server/root_password.pp": "5790e04defe2a64d145975abdfcfd3ac", + "manifests/server/service.pp": "e9d4256c2830a8b300822616c408ce95", + "manifests/server.pp": "3f3915a73ff075eca009f5656b225e6d", + "metadata.json": "2cc79c0e6902c12c1b33eca2e192ea29", + "spec/acceptance/mysql_backup_spec.rb": "ef6f0d033e87a8a9f8457f89ad8ea118", + "spec/acceptance/mysql_db_spec.rb": "c093f0d25c7000713b444706b6cfd1c7", + "spec/acceptance/mysql_helper.rb": "b95d8fd15325f1ece1cd652dc60c7608", + "spec/acceptance/mysql_server_spec.rb": "b3362859a6cdc38cfabf1c5a63a4fc57", + "spec/acceptance/nodesets/centos-7-x64.yml": "a713f3abd3657f0ae2878829badd23cd", + "spec/acceptance/nodesets/debian-8-x64.yml": "d2d2977900989f30086ad251a14a1f39", + "spec/acceptance/nodesets/default.yml": "b42da5a1ea0c964567ba7495574b8808", + "spec/acceptance/nodesets/docker/centos-7.yml": "8a3892807bdd62306ae4774f41ba11ae", + "spec/acceptance/nodesets/docker/debian-8.yml": "ac8e871d1068c96de5e85a89daaec6df", + "spec/acceptance/nodesets/docker/ubuntu-14.04.yml": "dc42ee922a96908d85b8f0f08203ce58", + "spec/acceptance/types/mysql_database_spec.rb": "047db055103fa9782bc6714297eb2a09", + "spec/acceptance/types/mysql_grant_spec.rb": "216d93f0937dbdb5fc58a61bd2150d62", + "spec/acceptance/types/mysql_plugin_spec.rb": "107f32d267daa847996ff992ccec8c06", + "spec/acceptance/types/mysql_user_spec.rb": "5d04dc3b3ffd0778f83038833ef72bf2", + "spec/classes/graceful_failures_spec.rb": "91481f693c3f71dff22524189438bcc6", + "spec/classes/mycnf_template_spec.rb": "07fc36d51b592eba1f94d39208c2701f", + "spec/classes/mysql_bindings_spec.rb": "14c5abbe4ae20278d1a4a02254bf312b", + "spec/classes/mysql_client_spec.rb": "b1fa7a5a06585697f7100d1891d359ed", + "spec/classes/mysql_server_account_security_spec.rb": "97b6caf04a7a75a88e58728edcfc11cb", + "spec/classes/mysql_server_backup_spec.rb": "964357b46daa237c92cc61b88a20093b", + "spec/classes/mysql_server_monitor_spec.rb": "aef3aa73265b42b66b963a09e5f32f1f", + "spec/classes/mysql_server_mysqltuner_spec.rb": "55ff6dad45a8dfef97d52dff0b111a36", + "spec/classes/mysql_server_spec.rb": "99806ad51b124bf8ca9dad201962b743", + "spec/defines/mysql_db_spec.rb": "afb2d6cfa051dd4d8301d7aede1aa1c4", + "spec/spec.opts": "a600ded995d948e393fbe2320ba8e51c", + "spec/spec_helper.rb": "b2db3bc02b4ac2fd5142a6621c641b07", + "spec/spec_helper_acceptance.rb": "2d7d8e8a6d1225ba6bf57a4f05dfff0c", + "spec/spec_helper_local.rb": "05db024c91eb5d5141b67d97b01a58b4", + "spec/unit/facter/mysql_server_id_spec.rb": "4a01f2323a400c82d89f37847c3c9611", + "spec/unit/facter/mysql_version_spec.rb": "f593c725b83a7bbf1f0fdc13bf1531df", + "spec/unit/facter/mysqld_version_spec.rb": "f5495c63a64d21be175d329cc5a3a8cd", + "spec/unit/puppet/functions/mysql_deepmerge_spec.rb": "f6102e1f82fb9f4aa38cbf3955ee5973", + "spec/unit/puppet/functions/mysql_password_spec.rb": "8fe68dc4ec13fc6ade18defe54cac8d4", + "spec/unit/puppet/provider/mysql_database/mysql_spec.rb": "98a799433ac10b237ac3ad27441610d4", + "spec/unit/puppet/provider/mysql_plugin/mysql_spec.rb": "914bac73bb9841ec7d7041488a55d442", + "spec/unit/puppet/provider/mysql_user/mysql_spec.rb": "174e7e3a97529fdcc2e6ba24e65cf8d2", + "spec/unit/puppet/type/mysql_database_spec.rb": "9fa0d390c2e15c8a52fc2b981e2a63fc", + "spec/unit/puppet/type/mysql_grant_spec.rb": "1a003358dc88a74ef21fb33fc71debef", + "spec/unit/puppet/type/mysql_plugin_spec.rb": "7ebacf228dfd0c60811bdf8a28a329ff", + "spec/unit/puppet/type/mysql_user_spec.rb": "e902ad1b9578dce35e13750c7967ef1d", + "templates/meb.cnf.erb": "b6422b19ee97b8a2883bfac44fdc0292", + "templates/my.cnf.erb": "535d2ff37fea6b11ad928224965143d3", + "templates/my.cnf.pass.erb": "11f80afb0993a436f074a43f70733999", + "templates/mysqlbackup.sh.erb": "0cc74138c7a5dd5d3864f94227717bd4", + "templates/xtrabackup.sh.erb": "219b487c4faad80a897cda6973b81741" +} \ No newline at end of file diff --git a/environments/production/modules/mysql/examples/backup.pp b/environments/production/modules/mysql/examples/backup.pp new file mode 100644 index 0000000..4bdf804 --- /dev/null +++ b/environments/production/modules/mysql/examples/backup.pp @@ -0,0 +1,9 @@ +class { 'mysql::server': + root_password => 'password' +} + +class { 'mysql::server::backup': + backupuser => 'myuser', + backuppassword => 'mypassword', + backupdir => '/tmp/backups', +} diff --git a/environments/production/modules/mysql/examples/bindings.pp b/environments/production/modules/mysql/examples/bindings.pp new file mode 100644 index 0000000..e4e325c --- /dev/null +++ b/environments/production/modules/mysql/examples/bindings.pp @@ -0,0 +1,3 @@ +class { 'mysql::bindings': + php_enable => true, +} diff --git a/environments/production/modules/mysql/examples/java.pp b/environments/production/modules/mysql/examples/java.pp new file mode 100644 index 0000000..0fc009a --- /dev/null +++ b/environments/production/modules/mysql/examples/java.pp @@ -0,0 +1 @@ +class { 'mysql::java':} diff --git a/environments/production/modules/mysql/examples/mysql_database.pp b/environments/production/modules/mysql/examples/mysql_database.pp new file mode 100644 index 0000000..47a328c --- /dev/null +++ b/environments/production/modules/mysql/examples/mysql_database.pp @@ -0,0 +1,17 @@ +class { 'mysql::server': + root_password => 'password' +} +mysql::db{ ['test1', 'test2', 'test3']: + ensure => present, + charset => 'utf8', + require => Class['mysql::server'], +} +mysql::db{ 'test4': + ensure => present, + charset => 'latin1', +} +mysql::db{ 'test5': + ensure => present, + charset => 'binary', + collate => 'binary', +} diff --git a/environments/production/modules/mysql/examples/mysql_db.pp b/environments/production/modules/mysql/examples/mysql_db.pp new file mode 100644 index 0000000..43c619f --- /dev/null +++ b/environments/production/modules/mysql/examples/mysql_db.pp @@ -0,0 +1,17 @@ +class { 'mysql::server': + root_password => 'password' +} +mysql::db { 'mydb': + user => 'myuser', + password => 'mypass', + host => 'localhost', + grant => ['SELECT', 'UPDATE'], +} +mysql::db { "mydb_${fqdn}": + user => 'myuser', + password => 'mypass', + dbname => 'mydb', + host => $::fqdn, + grant => ['SELECT', 'UPDATE'], + tag => $domain, +} diff --git a/environments/production/modules/mysql/examples/mysql_grant.pp b/environments/production/modules/mysql/examples/mysql_grant.pp new file mode 100644 index 0000000..20fe78d --- /dev/null +++ b/environments/production/modules/mysql/examples/mysql_grant.pp @@ -0,0 +1,5 @@ +mysql_grant{'test1@localhost/redmine.*': + user => 'test1@localhost', + table => 'redmine.*', + privileges => ['UPDATE'], +} diff --git a/environments/production/modules/mysql/examples/mysql_plugin.pp b/environments/production/modules/mysql/examples/mysql_plugin.pp new file mode 100644 index 0000000..d802759 --- /dev/null +++ b/environments/production/modules/mysql/examples/mysql_plugin.pp @@ -0,0 +1,23 @@ +class { 'mysql::server': + root_password => 'password' +} + +$validate_password_soname = $::osfamily ? { + windows => 'validate_password.dll', + default => 'validate_password.so' +} + +mysql::plugin { 'validate_password': + ensure => present, + soname => $validate_password_soname, +} + +$auth_socket_soname = $::osfamily ? { + windows => 'auth_socket.dll', + default => 'auth_socket.so' +} + +mysql::plugin { 'auth_socket': + ensure => present, + soname => $auth_socket_soname, +} diff --git a/environments/production/modules/mysql/examples/mysql_user.pp b/environments/production/modules/mysql/examples/mysql_user.pp new file mode 100644 index 0000000..c471868 --- /dev/null +++ b/environments/production/modules/mysql/examples/mysql_user.pp @@ -0,0 +1,32 @@ +$mysql_root_pw = 'password' + +class { 'mysql::server': + root_password => 'password', +} + +mysql_user{ 'redmine@localhost': + ensure => present, + password_hash => mysql_password('redmine'), + require => Class['mysql::server'], +} + +mysql_user{ 'dan@localhost': + ensure => present, + password_hash => mysql_password('blah') +} + +mysql_user{ 'dan@%': + ensure => present, + password_hash => mysql_password('blah'), +} + +mysql_user{ 'socketplugin@%': + ensure => present, + plugin => 'unix_socket', +} + +mysql_user{ 'socketplugin@%': + ensure => present, + password_hash => mysql_password('blah'), + plugin => 'mysql_native_password', +} diff --git a/environments/production/modules/mysql/examples/perl.pp b/environments/production/modules/mysql/examples/perl.pp new file mode 100644 index 0000000..1bbd3ab --- /dev/null +++ b/environments/production/modules/mysql/examples/perl.pp @@ -0,0 +1 @@ +include mysql::bindings::perl diff --git a/environments/production/modules/mysql/examples/python.pp b/environments/production/modules/mysql/examples/python.pp new file mode 100644 index 0000000..49ddddb --- /dev/null +++ b/environments/production/modules/mysql/examples/python.pp @@ -0,0 +1 @@ +class { 'mysql::bindings::python':} diff --git a/environments/production/modules/mysql/examples/ruby.pp b/environments/production/modules/mysql/examples/ruby.pp new file mode 100644 index 0000000..6717256 --- /dev/null +++ b/environments/production/modules/mysql/examples/ruby.pp @@ -0,0 +1 @@ +include mysql::bindings::ruby diff --git a/environments/production/modules/mysql/examples/server.pp b/environments/production/modules/mysql/examples/server.pp new file mode 100644 index 0000000..8afdd00 --- /dev/null +++ b/environments/production/modules/mysql/examples/server.pp @@ -0,0 +1,3 @@ +class { 'mysql::server': + root_password => 'password', +} diff --git a/environments/production/modules/mysql/examples/server/account_security.pp b/environments/production/modules/mysql/examples/server/account_security.pp new file mode 100644 index 0000000..cb59f4f --- /dev/null +++ b/environments/production/modules/mysql/examples/server/account_security.pp @@ -0,0 +1,4 @@ +class { 'mysql::server': + root_password => 'password', +} +class { 'mysql::server::account_security': } diff --git a/environments/production/modules/mysql/examples/server/config.pp b/environments/production/modules/mysql/examples/server/config.pp new file mode 100644 index 0000000..2cde11b --- /dev/null +++ b/environments/production/modules/mysql/examples/server/config.pp @@ -0,0 +1,3 @@ +mysql::server::config { 'testfile': + +} diff --git a/environments/production/modules/mysql/lib/facter/mysql_server_id.rb b/environments/production/modules/mysql/lib/facter/mysql_server_id.rb new file mode 100644 index 0000000..3cb39e5 --- /dev/null +++ b/environments/production/modules/mysql/lib/facter/mysql_server_id.rb @@ -0,0 +1,9 @@ +def get_mysql_id + Facter.value(:macaddress).split(':')[2..-1].inject(0) { |total,value| (total << 6) + value.hex } +end + +Facter.add("mysql_server_id") do + setcode do + get_mysql_id rescue nil + end +end diff --git a/environments/production/modules/mysql/lib/facter/mysql_version.rb b/environments/production/modules/mysql/lib/facter/mysql_version.rb new file mode 100644 index 0000000..62fba61 --- /dev/null +++ b/environments/production/modules/mysql/lib/facter/mysql_version.rb @@ -0,0 +1,8 @@ +Facter.add("mysql_version") do + setcode do + mysql_ver = Facter::Util::Resolution.exec('mysql --version') + if mysql_ver + mysql_ver.match(/\d+\.\d+\.\d+/)[0] + end + end +end diff --git a/environments/production/modules/mysql/lib/facter/mysqld_version.rb b/environments/production/modules/mysql/lib/facter/mysqld_version.rb new file mode 100644 index 0000000..c3711cc --- /dev/null +++ b/environments/production/modules/mysql/lib/facter/mysqld_version.rb @@ -0,0 +1,5 @@ +Facter.add("mysqld_version") do + setcode do + Facter::Util::Resolution.exec('mysqld -V 2>/dev/null') + end +end diff --git a/environments/production/modules/mysql/lib/puppet/parser/functions/mysql_deepmerge.rb b/environments/production/modules/mysql/lib/puppet/parser/functions/mysql_deepmerge.rb new file mode 100644 index 0000000..aca9c7a --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/parser/functions/mysql_deepmerge.rb @@ -0,0 +1,58 @@ +module Puppet::Parser::Functions + newfunction(:mysql_deepmerge, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args| + Recursively merges two or more hashes together and returns the resulting hash. + + For example: + + $hash1 = {'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } } + $hash2 = {'two' => 'dos', 'three' => { 'five' => 5 } } + $merged_hash = mysql_deepmerge($hash1, $hash2) + # The resulting hash is equivalent to: + # $merged_hash = { 'one' => 1, 'two' => 'dos', 'three' => { 'four' => 4, 'five' => 5 } } + + When there is a duplicate key that is a hash, they are recursively merged. + When there is a duplicate key that is not a hash, the key in the rightmost hash will "win." + When there are conficting uses of dashes and underscores in two keys (which mysql would otherwise equate), + the rightmost style will win. + + ENDHEREDOC + + if args.length < 2 + raise Puppet::ParseError, ("mysql_deepmerge(): wrong number of arguments (#{args.length}; must be at least 2)") + end + + result = Hash.new + args.each do |arg| + next if arg.is_a? String and arg.empty? # empty string is synonym for puppet's undef + # If the argument was not a hash, skip it. + unless arg.is_a?(Hash) + raise Puppet::ParseError, "mysql_deepmerge: unexpected argument type #{arg.class}, only expects hash arguments" + end + + # Now we have to traverse our hash assigning our non-hash values + # to the matching keys in our result while following our hash values + # and repeating the process. + overlay( result, arg ) + end + return( result ) + end +end + +def has_normalized!(hash, key) + return true if hash.has_key?( key ) + return false unless key.match(/-|_/) + other_key = key.include?('-') ? key.gsub( '-', '_' ) : key.gsub( '_', '-' ) + return false unless hash.has_key?( other_key ) + hash[key] = hash.delete( other_key ) + return true; +end + +def overlay( hash1, hash2 ) + hash2.each do |key, value| + if(has_normalized!( hash1, key ) and value.is_a?(Hash) and hash1[key].is_a?(Hash)) + overlay( hash1[key], value ) + else + hash1[key] = value + end + end +end diff --git a/environments/production/modules/mysql/lib/puppet/parser/functions/mysql_dirname.rb b/environments/production/modules/mysql/lib/puppet/parser/functions/mysql_dirname.rb new file mode 100644 index 0000000..5d0ef55 --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/parser/functions/mysql_dirname.rb @@ -0,0 +1,15 @@ +module Puppet::Parser::Functions + newfunction(:mysql_dirname, :type => :rvalue, :doc => <<-EOS + Returns the dirname of a path. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "mysql_dirname(): Wrong number of arguments " + + "given (#{arguments.size} for 1)") if arguments.size < 1 + + path = arguments[0] + return File.dirname(path) + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/mysql/lib/puppet/parser/functions/mysql_password.rb b/environments/production/modules/mysql/lib/puppet/parser/functions/mysql_password.rb new file mode 100644 index 0000000..74d7fa8 --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/parser/functions/mysql_password.rb @@ -0,0 +1,17 @@ +# hash a string as mysql's "PASSWORD()" function would do it +require 'digest/sha1' + +module Puppet::Parser::Functions + newfunction(:mysql_password, :type => :rvalue, :doc => <<-EOS + Returns the mysql password hash from the clear text password. + EOS + ) do |args| + + raise(Puppet::ParseError, 'mysql_password(): Wrong number of arguments ' + + "given (#{args.size} for 1)") if args.size != 1 + + return '' if args[0].empty? + return args[0] if args[0] =~ /\*[A-F0-9]{40}$/ + '*' + Digest::SHA1.hexdigest(Digest::SHA1.digest(args[0])).upcase + end +end diff --git a/environments/production/modules/mysql/lib/puppet/parser/functions/mysql_strip_hash.rb b/environments/production/modules/mysql/lib/puppet/parser/functions/mysql_strip_hash.rb new file mode 100644 index 0000000..8e850d0 --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/parser/functions/mysql_strip_hash.rb @@ -0,0 +1,21 @@ +module Puppet::Parser::Functions + newfunction(:mysql_strip_hash, :type => :rvalue, :arity => 1, :doc => <<-EOS +TEMPORARY FUNCTION: EXPIRES 2014-03-10 +When given a hash this function strips out all blank entries. +EOS + ) do |args| + + hash = args[0] + unless hash.is_a?(Hash) + raise(Puppet::ParseError, 'mysql_strip_hash(): Requires hash to work with') + end + + # Filter out all the top level blanks. + hash.reject{|k,v| v == ''}.each do |k,v| + if v.is_a?(Hash) + v.reject!{|ki,vi| vi == '' } + end + end + + end +end diff --git a/environments/production/modules/mysql/lib/puppet/provider/mysql.rb b/environments/production/modules/mysql/lib/puppet/provider/mysql.rb new file mode 100644 index 0000000..181d788 --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/provider/mysql.rb @@ -0,0 +1,115 @@ +class Puppet::Provider::Mysql < Puppet::Provider + + # Without initvars commands won't work. + initvars + + # Make sure we find mysql commands on CentOS and FreeBSD + ENV['PATH']=ENV['PATH'] + ':/usr/libexec:/usr/local/libexec:/usr/local/bin' + + commands :mysql => 'mysql' + commands :mysqld => 'mysqld' + commands :mysqladmin => 'mysqladmin' + + # Optional defaults file + def self.defaults_file + if File.file?("#{Facter.value(:root_home)}/.my.cnf") + "--defaults-extra-file=#{Facter.value(:root_home)}/.my.cnf" + else + nil + end + end + + def self.mysqld_type + # find the mysql "dialect" like mariadb / mysql etc. + mysqld_version_string.scan(/mariadb/i) { return "mariadb" } + mysqld_version_string.scan(/\s\(percona/i) { return "percona" } + return "mysql" + end + + def mysqld_type + self.class.mysqld_type + end + + def self.mysqld_version_string + # As the possibility of the mysqld being remote we need to allow the version string to be overridden, this can be done by facter.value as seen below. In the case that it has not been set and the facter value is nil we use the mysql -v command to ensure we report the correct version of mysql for later use cases. + @mysqld_version_string ||= Facter.value(:mysqld_version) || mysqld('-V') + end + + def mysqld_version_string + self.class.mysqld_version_string + end + + def self.mysqld_version + # note: be prepared for '5.7.6-rc-log' etc results + # versioncmp detects 5.7.6-log to be newer then 5.7.6 + # this is why we need the trimming. + mysqld_version_string.scan(/\d+\.\d+\.\d+/).first unless mysqld_version_string.nil? + end + + def mysqld_version + self.class.mysqld_version + end + + def defaults_file + self.class.defaults_file + end + + def self.users + mysql([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"].compact).split("\n") + end + + # Optional parameter to run a statement on the MySQL system database. + def self.system_database + '--database=mysql' + end + + def system_database + self.class.system_database + end + + # Take root@localhost and munge it to 'root'@'localhost' + def self.cmd_user(user) + "'#{user.sub('@', "'@'")}'" + end + + # Take root.* and return ON `root`.* + def self.cmd_table(table) + table_string = '' + + # We can't escape *.* so special case this. + if table == '*.*' + table_string << '*.*' + # Special case also for PROCEDURES + elsif table.start_with?('PROCEDURE ') + table_string << table.sub(/^PROCEDURE (.*)(\..*)/, 'PROCEDURE `\1`\2') + else + table_string << table.sub(/^(.*)(\..*)/, '`\1`\2') + end + table_string + end + + def self.cmd_privs(privileges) + if privileges.include?('ALL') + return 'ALL PRIVILEGES' + else + priv_string = '' + privileges.each do |priv| + priv_string << "#{priv}, " + end + end + # Remove trailing , from the last element. + priv_string.sub(/, $/, '') + end + + # Take in potential options and build up a query string with them. + def self.cmd_options(options) + option_string = '' + options.each do |opt| + if opt == 'GRANT' + option_string << ' WITH GRANT OPTION' + end + end + option_string + end + +end diff --git a/environments/production/modules/mysql/lib/puppet/provider/mysql_database/mysql.rb b/environments/production/modules/mysql/lib/puppet/provider/mysql_database/mysql.rb new file mode 100644 index 0000000..4587c18 --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/provider/mysql_database/mysql.rb @@ -0,0 +1,68 @@ +require File.expand_path(File.join(File.dirname(__FILE__), '..', 'mysql')) +Puppet::Type.type(:mysql_database).provide(:mysql, :parent => Puppet::Provider::Mysql) do + desc 'Manages MySQL databases.' + + commands :mysql => 'mysql' + + def self.instances + mysql([defaults_file, '-NBe', 'show databases'].compact).split("\n").collect do |name| + attributes = {} + mysql([defaults_file, '-NBe', "show variables like '%_database'", name].compact).split("\n").each do |line| + k,v = line.split(/\s/) + attributes[k] = v + end + new(:name => name, + :ensure => :present, + :charset => attributes['character_set_database'], + :collate => attributes['collation_database'] + ) + end + end + + # We iterate over each mysql_database entry in the catalog and compare it against + # the contents of the property_hash generated by self.instances + def self.prefetch(resources) + databases = instances + resources.keys.each do |database| + if provider = databases.find { |db| db.name == database } + resources[database].provider = provider + end + end + end + + def create + mysql([defaults_file, '-NBe', "create database if not exists `#{@resource[:name]}` character set `#{@resource[:charset]}` collate `#{@resource[:collate]}`"].compact) + + @property_hash[:ensure] = :present + @property_hash[:charset] = @resource[:charset] + @property_hash[:collate] = @resource[:collate] + + exists? ? (return true) : (return false) + end + + def destroy + mysql([defaults_file, '-NBe', "drop database if exists `#{@resource[:name]}`"].compact) + + @property_hash.clear + exists? ? (return false) : (return true) + end + + def exists? + @property_hash[:ensure] == :present || false + end + + mk_resource_methods + + def charset=(value) + mysql([defaults_file, '-NBe', "alter database `#{resource[:name]}` CHARACTER SET #{value}"].compact) + @property_hash[:charset] = value + charset == value ? (return true) : (return false) + end + + def collate=(value) + mysql([defaults_file, '-NBe', "alter database `#{resource[:name]}` COLLATE #{value}"].compact) + @property_hash[:collate] = value + collate == value ? (return true) : (return false) + end + +end diff --git a/environments/production/modules/mysql/lib/puppet/provider/mysql_datadir/mysql.rb b/environments/production/modules/mysql/lib/puppet/provider/mysql_datadir/mysql.rb new file mode 100644 index 0000000..620231e --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/provider/mysql_datadir/mysql.rb @@ -0,0 +1,78 @@ +require File.expand_path(File.join(File.dirname(__FILE__), '..', 'mysql')) +Puppet::Type.type(:mysql_datadir).provide(:mysql, :parent => Puppet::Provider::Mysql) do + + desc 'manage data directories for mysql instances' + + initvars + + # Make sure we find mysqld on CentOS and mysql_install_db on Gentoo + ENV['PATH']=ENV['PATH'] + ':/usr/libexec:/usr/share/mysql/scripts:/opt/rh/mysql55/root/usr/bin:/opt/rh/mysql55/root/usr/libexec' + + commands :mysqld => 'mysqld' + commands :mysql_install_db => 'mysql_install_db' + + def create + name = @resource[:name] + insecure = @resource.value(:insecure) || true + defaults_extra_file = @resource.value(:defaults_extra_file) + user = @resource.value(:user) || "mysql" + basedir = @resource.value(:basedir) + datadir = @resource.value(:datadir) || @resource[:name] + log_error = @resource.value(:log_error) || "/var/tmp/mysqld_initialize.log" + + unless defaults_extra_file.nil? + if File.exist?(defaults_extra_file) + defaults_extra_file="--defaults-extra-file=#{defaults_extra_file}" + else + raise ArgumentError, "Defaults-extra-file #{defaults_extra_file} is missing" + end + end + + if insecure == true + initialize="--initialize-insecure" + else + initialize="--initialize" + end + + opts = [ defaults_extra_file ] + %w(basedir datadir user).each do |opt| + val = eval(opt) + opts<<"--#{opt}=#{val}" unless val.nil? + end + + if mysqld_version.nil? + debug("Installing MySQL data directory with mysql_install_db #{opts.compact.join(" ")}") + mysql_install_db(opts.compact) + else + if (mysqld_type == "mysql" or mysqld_type == "percona") and Puppet::Util::Package.versioncmp(mysqld_version, '5.7.6') >= 0 + opts<<"--log-error=#{log_error}" + opts<<"#{initialize}" + debug("Initializing MySQL data directory >= 5.7.6 with mysqld: #{opts.compact.join(" ")}") + mysqld(opts.compact) + else + debug("Installing MySQL data directory with mysql_install_db #{opts.compact.join(" ")}") + mysql_install_db(opts.compact) + end + end + + exists? + end + + def destroy + name = @resource[:name] + raise ArgumentError, "ERROR: Resource can not be removed" + end + + def exists? + datadir = @resource[:datadir] + (File.directory?("#{datadir}/mysql")) && (Dir.entries("#{datadir}/mysql") - %w{ . .. }).any? + end + + ## + ## MySQL datadir properties + ## + + # Generates method for all properties of the property_hash + mk_resource_methods + +end diff --git a/environments/production/modules/mysql/lib/puppet/provider/mysql_grant/mysql.rb b/environments/production/modules/mysql/lib/puppet/provider/mysql_grant/mysql.rb new file mode 100644 index 0000000..40623af --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/provider/mysql_grant/mysql.rb @@ -0,0 +1,176 @@ +require File.expand_path(File.join(File.dirname(__FILE__), '..', 'mysql')) +Puppet::Type.type(:mysql_grant).provide(:mysql, :parent => Puppet::Provider::Mysql) do + + desc 'Set grants for users in MySQL.' + + def self.instances + instances = [] + users.select{ |user| user =~ /.+@/ }.collect do |user| + user_string = self.cmd_user(user) + query = "SHOW GRANTS FOR #{user_string};" + begin + grants = mysql([defaults_file, "-NBe", query].compact) + rescue Puppet::ExecutionFailure => e + # Silently ignore users with no grants. Can happen e.g. if user is + # defined with fqdn and server is run with skip-name-resolve. Example: + # Default root user created by mysql_install_db on a host with fqdn + # of myhost.mydomain.my: root@myhost.mydomain.my, when MySQL is started + # with --skip-name-resolve. + if e.inspect =~ /There is no such grant defined for user/ + next + else + raise Puppet::Error, "#mysql had an error -> #{e.inspect}" + end + end + # Once we have the list of grants generate entries for each. + grants.each_line do |grant| + # Match the munges we do in the type. + munged_grant = grant.delete("'").delete("`").delete('"') + # Matching: GRANT (SELECT, UPDATE) PRIVILEGES ON (*.*) TO ('root')@('127.0.0.1') (WITH GRANT OPTION) + if match = munged_grant.match(/^GRANT\s(.+)\sON\s(.+)\sTO\s(.*)@(.*?)(\s.*)?$/) + privileges, table, user, host, rest = match.captures + table.gsub!('\\\\', '\\') + + # split on ',' if it is not a non-'('-containing string followed by a + # closing parenthesis ')'-char - e.g. only split comma separated elements not in + # parentheses + stripped_privileges = privileges.strip.split(/\s*,\s*(?![^(]*\))/).map do |priv| + # split and sort the column_privileges in the parentheses and rejoin + if priv.include?('(') + type, col=priv.strip.split(/\s+|\b/,2) + type.upcase + " (" + col.slice(1...-1).strip.split(/\s*,\s*/).sort.join(', ') + ")" + else + # Once we split privileges up on the , we need to make sure we + # shortern ALL PRIVILEGES to just all. + priv == 'ALL PRIVILEGES' ? 'ALL' : priv.strip + end + end + # Same here, but to remove OPTION leaving just GRANT. + if rest.match(/WITH\sGRANT\sOPTION/) + options = ['GRANT'] + else + options = ['NONE'] + end + # fix double backslash that MySQL prints, so resources match + table.gsub!("\\\\", "\\") + # We need to return an array of instances so capture these + instances << new( + :name => "#{user}@#{host}/#{table}", + :ensure => :present, + :privileges => stripped_privileges.sort, + :table => table, + :user => "#{user}@#{host}", + :options => options + ) + end + end + end + return instances + end + + def self.prefetch(resources) + users = instances + resources.keys.each do |name| + if provider = users.find { |user| user.name == name } + resources[name].provider = provider + end + end + end + + def grant(user, table, privileges, options) + user_string = self.class.cmd_user(user) + priv_string = self.class.cmd_privs(privileges) + table_string = self.class.cmd_table(table) + query = "GRANT #{priv_string}" + query << " ON #{table_string}" + query << " TO #{user_string}" + query << self.class.cmd_options(options) unless options.nil? + mysql([defaults_file, system_database, '-e', query].compact) + end + + def create + grant(@resource[:user], @resource[:table], @resource[:privileges], @resource[:options]) + + @property_hash[:ensure] = :present + @property_hash[:table] = @resource[:table] + @property_hash[:user] = @resource[:user] + @property_hash[:options] = @resource[:options] if @resource[:options] + @property_hash[:privileges] = @resource[:privileges] + + exists? ? (return true) : (return false) + end + + def revoke(user, table, revoke_privileges = ['ALL']) + user_string = self.class.cmd_user(user) + table_string = self.class.cmd_table(table) + priv_string = self.class.cmd_privs(revoke_privileges) + # revoke grant option needs to be a extra query, because + # "REVOKE ALL PRIVILEGES, GRANT OPTION [..]" is only valid mysql syntax + # if no ON clause is used. + # It hast to be executed before "REVOKE ALL [..]" since a GRANT has to + # exist to be executed successfully + if revoke_privileges.include? 'ALL' + query = "REVOKE GRANT OPTION ON #{table_string} FROM #{user_string}" + mysql([defaults_file, system_database, '-e', query].compact) + end + query = "REVOKE #{priv_string} ON #{table_string} FROM #{user_string}" + mysql([defaults_file, system_database, '-e', query].compact) + end + + def destroy + # if the user was dropped, it'll have been removed from the user hash + # as the grants are alraedy removed by the DROP statement + if self.class.users.include? @property_hash[:user] + revoke(@property_hash[:user], @property_hash[:table]) + end + @property_hash.clear + + exists? ? (return false) : (return true) + end + + def exists? + @property_hash[:ensure] == :present || false + end + + def flush + @property_hash.clear + mysql([defaults_file, '-NBe', 'FLUSH PRIVILEGES'].compact) + end + + mk_resource_methods + + def diff_privileges(privileges_old, privileges_new) + diff = {:revoke => Array.new, :grant => Array.new} + if privileges_old.include? 'ALL' + diff[:revoke] = privileges_old + diff[:grant] = privileges_new + elsif privileges_new.include? 'ALL' + diff[:grant] = privileges_new + else + diff[:revoke] = privileges_old - privileges_new + diff[:grant] = privileges_new - privileges_old + end + return diff + end + + def privileges=(privileges) + diff = diff_privileges(@property_hash[:privileges], privileges) + if not diff[:revoke].empty? + revoke(@property_hash[:user], @property_hash[:table], diff[:revoke]) + end + if not diff[:grant].empty? + grant(@property_hash[:user], @property_hash[:table], diff[:grant], @property_hash[:options]) + end + @property_hash[:privileges] = privileges + self.privileges + end + + def options=(options) + revoke(@property_hash[:user], @property_hash[:table]) + grant(@property_hash[:user], @property_hash[:table], @property_hash[:privileges], options) + @property_hash[:options] = options + + self.options + end + +end diff --git a/environments/production/modules/mysql/lib/puppet/provider/mysql_plugin/mysql.rb b/environments/production/modules/mysql/lib/puppet/provider/mysql_plugin/mysql.rb new file mode 100644 index 0000000..2cb640b --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/provider/mysql_plugin/mysql.rb @@ -0,0 +1,53 @@ +require File.expand_path(File.join(File.dirname(__FILE__), '..', 'mysql')) +Puppet::Type.type(:mysql_plugin).provide(:mysql, :parent => Puppet::Provider::Mysql) do + desc 'Manages MySQL plugins.' + + commands :mysql => 'mysql' + + def self.instances + mysql([defaults_file, '-NBe', 'show plugins'].compact).split("\n").collect do |line| + name, status, type, library, license = line.split(/\t/) + new(:name => name, + :ensure => :present, + :soname => library + ) + end + end + + # We iterate over each mysql_plugin entry in the catalog and compare it against + # the contents of the property_hash generated by self.instances + def self.prefetch(resources) + plugins = instances + resources.keys.each do |plugin| + if provider = plugins.find { |pl| pl.name == plugin } + resources[plugin].provider = provider + end + end + end + + def create + # Use plugin_name.so as soname if it's not specified. This won't work on windows as + # there it should be plugin_name.dll + @resource[:soname].nil? ? (soname=@resource[:name] + '.so') : (soname=@resource[:soname]) + mysql([defaults_file, '-NBe', "install plugin #{@resource[:name]} soname '#{soname}'"].compact) + + @property_hash[:ensure] = :present + @property_hash[:soname] = @resource[:soname] + + exists? ? (return true) : (return false) + end + + def destroy + mysql([defaults_file, '-NBe', "uninstall plugin #{@resource[:name]}"].compact) + + @property_hash.clear + exists? ? (return false) : (return true) + end + + def exists? + @property_hash[:ensure] == :present || false + end + + mk_resource_methods + +end diff --git a/environments/production/modules/mysql/lib/puppet/provider/mysql_user/mysql.rb b/environments/production/modules/mysql/lib/puppet/provider/mysql_user/mysql.rb new file mode 100644 index 0000000..e5200a1 --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/provider/mysql_user/mysql.rb @@ -0,0 +1,197 @@ +require File.expand_path(File.join(File.dirname(__FILE__), '..', 'mysql')) +Puppet::Type.type(:mysql_user).provide(:mysql, :parent => Puppet::Provider::Mysql) do + + desc 'manage users for a mysql database.' + commands :mysql => 'mysql' + + # Build a property_hash containing all the discovered information about MySQL + # users. + def self.instances + users = mysql([defaults_file, '-NBe', + "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"].compact).split("\n") + # To reduce the number of calls to MySQL we collect all the properties in + # one big swoop. + users.collect do |name| + if mysqld_version.nil? + ## Default ... + query = "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{name}'" + else + if (mysqld_type == "mysql" or mysqld_type == "percona") and Puppet::Util::Package.versioncmp(mysqld_version, '5.7.6') >= 0 + query = "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, AUTHENTICATION_STRING, PLUGIN FROM mysql.user WHERE CONCAT(user, '@', host) = '#{name}'" + else + query = "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{name}'" + end + end + @max_user_connections, @max_connections_per_hour, @max_queries_per_hour, + @max_updates_per_hour, ssl_type, ssl_cipher, x509_issuer, x509_subject, + @password, @plugin = mysql([defaults_file, "-NBe", query].compact).split(/\s/) + @tls_options = parse_tls_options(ssl_type, ssl_cipher, x509_issuer, x509_subject) + + new(:name => name, + :ensure => :present, + :password_hash => @password, + :plugin => @plugin, + :max_user_connections => @max_user_connections, + :max_connections_per_hour => @max_connections_per_hour, + :max_queries_per_hour => @max_queries_per_hour, + :max_updates_per_hour => @max_updates_per_hour, + :tls_options => @tls_options, + ) + end + end + + # We iterate over each mysql_user entry in the catalog and compare it against + # the contents of the property_hash generated by self.instances + def self.prefetch(resources) + users = instances + resources.keys.each do |name| + if provider = users.find { |user| user.name == name } + resources[name].provider = provider + end + end + end + + def create + merged_name = @resource[:name].sub('@', "'@'") + password_hash = @resource.value(:password_hash) + plugin = @resource.value(:plugin) + max_user_connections = @resource.value(:max_user_connections) || 0 + max_connections_per_hour = @resource.value(:max_connections_per_hour) || 0 + max_queries_per_hour = @resource.value(:max_queries_per_hour) || 0 + max_updates_per_hour = @resource.value(:max_updates_per_hour) || 0 + tls_options = @resource.value(:tls_options) || ['NONE'] + + # Use CREATE USER to be compatible with NO_AUTO_CREATE_USER sql_mode + # This is also required if you want to specify a authentication plugin + if !plugin.nil? + if plugin == 'sha256_password' and !password_hash.nil? + mysql([defaults_file, system_database, '-e', "CREATE USER '#{merged_name}' IDENTIFIED WITH '#{plugin}' AS '#{password_hash}'"].compact) + else + mysql([defaults_file, system_database, '-e', "CREATE USER '#{merged_name}' IDENTIFIED WITH '#{plugin}'"].compact) + end + @property_hash[:ensure] = :present + @property_hash[:plugin] = plugin + else + mysql([defaults_file, system_database, '-e', "CREATE USER '#{merged_name}' IDENTIFIED BY PASSWORD '#{password_hash}'"].compact) + @property_hash[:ensure] = :present + @property_hash[:password_hash] = password_hash + end + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO '#{merged_name}' WITH MAX_USER_CONNECTIONS #{max_user_connections} MAX_CONNECTIONS_PER_HOUR #{max_connections_per_hour} MAX_QUERIES_PER_HOUR #{max_queries_per_hour} MAX_UPDATES_PER_HOUR #{max_updates_per_hour}"].compact) + @property_hash[:max_user_connections] = max_user_connections + @property_hash[:max_connections_per_hour] = max_connections_per_hour + @property_hash[:max_queries_per_hour] = max_queries_per_hour + @property_hash[:max_updates_per_hour] = max_updates_per_hour + + merged_tls_options = tls_options.join(' AND ') + if (((mysqld_type == "mysql" or mysqld_type == "percona") and Puppet::Util::Package.versioncmp(mysqld_version, '5.7.6') >= 0) or + (mysqld_type == 'mariadb' and Puppet::Util::Package.versioncmp(mysqld_version, '10.2.0') >= 0)) + mysql([defaults_file, system_database, '-e', "ALTER USER '#{merged_name}' REQUIRE #{merged_tls_options}"].compact) + else + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO '#{merged_name}' REQUIRE #{merged_tls_options}"].compact) + end + @property_hash[:tls_options] = tls_options + + exists? ? (return true) : (return false) + end + + def destroy + merged_name = @resource[:name].sub('@', "'@'") + mysql([defaults_file, system_database, '-e', "DROP USER '#{merged_name}'"].compact) + + @property_hash.clear + exists? ? (return false) : (return true) + end + + def exists? + @property_hash[:ensure] == :present || false + end + + ## + ## MySQL user properties + ## + + # Generates method for all properties of the property_hash + mk_resource_methods + + def password_hash=(string) + merged_name = self.class.cmd_user(@resource[:name]) + + # We have a fact for the mysql version ... + if mysqld_version.nil? + # default ... if mysqld_version does not work + mysql([defaults_file, system_database, '-e', "SET PASSWORD FOR #{merged_name} = '#{string}'"].compact) + else + # Version >= 5.7.6 (many password related changes) + if (mysqld_type == "mysql" or mysqld_type == "percona") and Puppet::Util::Package.versioncmp(mysqld_version, '5.7.6') >= 0 + if string.match(/^\*/) + mysql([defaults_file, system_database, '-e', "ALTER USER #{merged_name} IDENTIFIED WITH mysql_native_password AS '#{string}'"].compact) + else + raise ArgumentError, "Only mysql_native_password (*ABCD...XXX) hashes are supported" + end + else + # older versions + mysql([defaults_file, system_database, '-e', "SET PASSWORD FOR #{merged_name} = '#{string}'"].compact) + end + end + + password_hash == string ? (return true) : (return false) + end + + def max_user_connections=(int) + merged_name = self.class.cmd_user(@resource[:name]) + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO #{merged_name} WITH MAX_USER_CONNECTIONS #{int}"].compact).chomp + + max_user_connections == int ? (return true) : (return false) + end + + def max_connections_per_hour=(int) + merged_name = self.class.cmd_user(@resource[:name]) + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO #{merged_name} WITH MAX_CONNECTIONS_PER_HOUR #{int}"].compact).chomp + + max_connections_per_hour == int ? (return true) : (return false) + end + + def max_queries_per_hour=(int) + merged_name = self.class.cmd_user(@resource[:name]) + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO #{merged_name} WITH MAX_QUERIES_PER_HOUR #{int}"].compact).chomp + + max_queries_per_hour == int ? (return true) : (return false) + end + + def max_updates_per_hour=(int) + merged_name = self.class.cmd_user(@resource[:name]) + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO #{merged_name} WITH MAX_UPDATES_PER_HOUR #{int}"].compact).chomp + + max_updates_per_hour == int ? (return true) : (return false) + end + + def tls_options=(array) + merged_name = self.class.cmd_user(@resource[:name]) + merged_tls_options = array.join(' AND ') + if (((mysqld_type == "mysql" or mysqld_type == "percona") and Puppet::Util::Package.versioncmp(mysqld_version, '5.7.6') >= 0) or + (mysqld_type == 'mariadb' and Puppet::Util::Package.versioncmp(mysqld_version, '10.2.0') >= 0)) + mysql([defaults_file, system_database, '-e', "ALTER USER #{merged_name} REQUIRE #{merged_tls_options}"].compact) + else + mysql([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO #{merged_name} REQUIRE #{merged_tls_options}"].compact) + end + + tls_options == array ? (return true) : (return false) + end + + def self.parse_tls_options(ssl_type, ssl_cipher, x509_issuer, x509_subject) + if ssl_type == 'ANY' + return ['SSL'] + elsif ssl_type == 'X509' + return ['X509'] + elsif ssl_type == 'SPECIFIED' + options = [] + options << "CIPHER #{ssl_cipher}" if not ssl_cipher.nil? and not ssl_cipher.empty? + options << "ISSUER #{x509_issuer}" if not x509_issuer.nil? and not x509_issuer.empty? + options << "SUBJECT #{x509_subject}" if not x509_subject.nil? and not x509_subject.empty? + return options + else + return ['NONE'] + end + end + +end diff --git a/environments/production/modules/mysql/lib/puppet/type/mysql_database.rb b/environments/production/modules/mysql/lib/puppet/type/mysql_database.rb new file mode 100644 index 0000000..1f94d5f --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/type/mysql_database.rb @@ -0,0 +1,25 @@ +Puppet::Type.newtype(:mysql_database) do + @doc = 'Manage MySQL databases.' + + ensurable + + autorequire(:file) { '/root/.my.cnf' } + autorequire(:class) { 'mysql::server' } + + newparam(:name, :namevar => true) do + desc 'The name of the MySQL database to manage.' + end + + newproperty(:charset) do + desc 'The CHARACTER SET setting for the database' + defaultto :utf8 + newvalue(/^\S+$/) + end + + newproperty(:collate) do + desc 'The COLLATE setting for the database' + defaultto :utf8_general_ci + newvalue(/^\S+$/) + end + +end diff --git a/environments/production/modules/mysql/lib/puppet/type/mysql_datadir.rb b/environments/production/modules/mysql/lib/puppet/type/mysql_datadir.rb new file mode 100644 index 0000000..367767d --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/type/mysql_datadir.rb @@ -0,0 +1,35 @@ +Puppet::Type.newtype(:mysql_datadir) do + @doc = 'Manage MySQL datadirs with mysql_install_db OR mysqld (5.7.6 and above).' + + ensurable + + autorequire(:package) { 'mysql-server' } + + newparam(:datadir, :namevar => true) do + desc "The datadir name" + end + + newparam(:basedir) do + desc 'The basedir name, default /usr.' + newvalues(/^\//) + end + + newparam(:user) do + desc 'The user for the directory default mysql (name, not uid).' + end + + newparam(:defaults_extra_file) do + desc "MySQL defaults-extra-file with absolute path (*.cnf)." + newvalues(/^\/.*\.cnf$/) + end + + newparam(:insecure, :boolean => true) do + desc "Insecure initialization (needed for 5.7.6++)." + end + + newparam(:log_error) do + desc "The path to the mysqld error log file (used with the --log-error option)" + newvalues(/^\//) + end + +end diff --git a/environments/production/modules/mysql/lib/puppet/type/mysql_grant.rb b/environments/production/modules/mysql/lib/puppet/type/mysql_grant.rb new file mode 100644 index 0000000..7385f93 --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/type/mysql_grant.rb @@ -0,0 +1,103 @@ +# This has to be a separate type to enable collecting +Puppet::Type.newtype(:mysql_grant) do + @doc = "Manage a MySQL user's rights." + ensurable + + autorequire(:file) { '/root/.my.cnf' } + autorequire(:mysql_user) { self[:user] } + + def initialize(*args) + super + # Forcibly munge any privilege with 'ALL' in the array to exist of just + # 'ALL'. This can't be done in the munge in the property as that iterates + # over the array and there's no way to replace the entire array before it's + # returned to the provider. + if self[:ensure] == :present and Array(self[:privileges]).count > 1 and self[:privileges].to_s.include?('ALL') + self[:privileges] = 'ALL' + end + # Sort the privileges array in order to ensure the comparision in the provider + # self.instances method match. Otherwise this causes it to keep resetting the + # privileges. + self[:privileges] = Array(self[:privileges]).map{ |priv| + # split and sort the column_privileges in the parentheses and rejoin + if priv.include?('(') + type, col=priv.strip.split(/\s+|\b/,2) + type.upcase + " (" + col.slice(1...-1).strip.split(/\s*,\s*/).sort.join(', ') + ")" + else + priv.strip.upcase + end + }.uniq.reject{|k| k == 'GRANT' or k == 'GRANT OPTION'}.sort! + end + + validate do + fail('privileges parameter is required.') if self[:ensure] == :present and self[:privileges].nil? + fail('table parameter is required.') if self[:ensure] == :present and self[:table].nil? + fail('user parameter is required.') if self[:ensure] == :present and self[:user].nil? + fail('name must match user and table parameters') if self[:name] != "#{self[:user]}/#{self[:table]}" + end + + newparam(:name, :namevar => true) do + desc 'Name to describe the grant.' + + munge do |value| + value.delete("'") + end + end + + newproperty(:privileges, :array_matching => :all) do + desc 'Privileges for user' + end + + newproperty(:table) do + desc 'Table to apply privileges to.' + + munge do |value| + value.delete("`") + end + + newvalues(/.*\..*/,/@/) + end + + newproperty(:user) do + desc 'User to operate on.' + validate do |value| + # http://dev.mysql.com/doc/refman/5.5/en/identifiers.html + # If at least one special char is used, string must be quoted + + # http://stackoverflow.com/questions/8055727/negating-a-backreference-in-regular-expressions/8057827#8057827 + if matches = /^(['`"])((?!\1).)*\1@([\w%\.:\-\/]+)$/.match(value) + user_part = matches[2] + host_part = matches[3] + elsif matches = /^([0-9a-zA-Z$_]*)@([\w%\.:\-\/]+)$/.match(value) + user_part = matches[1] + host_part = matches[2] + elsif matches = /^((?!['`"]).*[^0-9a-zA-Z$_].*)@(.+)$/.match(value) + user_part = matches[1] + host_part = matches[2] + else + raise(ArgumentError, "Invalid database user #{value}") + end + + mysql_version = Facter.value(:mysql_version) + unless mysql_version.nil? + if Puppet::Util::Package.versioncmp(mysql_version, '5.7.8') < 0 and user_part.size > 16 + raise(ArgumentError, 'MySQL usernames are limited to a maximum of 16 characters') + elsif Puppet::Util::Package.versioncmp(mysql_version, '10.0.0') < 0 and user_part.size > 32 + raise(ArgumentError, 'MySQL usernames are limited to a maximum of 32 characters') + elsif Puppet::Util::Package.versioncmp(mysql_version, '10.0.0') > 0 and user_part.size > 80 + raise(ArgumentError, 'MySQL usernames are limited to a maximum of 80 characters') + end + end + end + + munge do |value| + matches = /^((['`"]?).*\2)@(.+)$/.match(value) + "#{matches[1]}@#{matches[3].downcase}" + end + end + + newproperty(:options, :array_matching => :all) do + desc 'Options to grant.' + end + +end diff --git a/environments/production/modules/mysql/lib/puppet/type/mysql_plugin.rb b/environments/production/modules/mysql/lib/puppet/type/mysql_plugin.rb new file mode 100644 index 0000000..e827920 --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/type/mysql_plugin.rb @@ -0,0 +1,17 @@ +Puppet::Type.newtype(:mysql_plugin) do + @doc = 'Manage MySQL plugins.' + + ensurable + + autorequire(:file) { '/root/.my.cnf' } + + newparam(:name, :namevar => true) do + desc 'The name of the MySQL plugin to manage.' + end + + newproperty(:soname) do + desc 'The name of the library' + newvalue(/^\w+\.\w+$/) + end + +end diff --git a/environments/production/modules/mysql/lib/puppet/type/mysql_user.rb b/environments/production/modules/mysql/lib/puppet/type/mysql_user.rb new file mode 100644 index 0000000..831a531 --- /dev/null +++ b/environments/production/modules/mysql/lib/puppet/type/mysql_user.rb @@ -0,0 +1,105 @@ +# This has to be a separate type to enable collecting +Puppet::Type.newtype(:mysql_user) do + @doc = 'Manage a MySQL user. This includes management of users password as well as privileges.' + + ensurable + + autorequire(:file) { '/root/.my.cnf' } + autorequire(:class) { 'mysql::server' } + + newparam(:name, :namevar => true) do + desc "The name of the user. This uses the 'username@hostname' or username@hostname." + validate do |value| + # http://dev.mysql.com/doc/refman/5.5/en/identifiers.html + # If at least one special char is used, string must be quoted + + # http://stackoverflow.com/questions/8055727/negating-a-backreference-in-regular-expressions/8057827#8057827 + if matches = /^(['`"])((?:(?!\1).)*)\1@([\w%\.:\-\/]+)$/.match(value) + user_part = matches[2] + host_part = matches[3] + elsif matches = /^([0-9a-zA-Z$_]*)@([\w%\.:\-\/]+)$/.match(value) + user_part = matches[1] + host_part = matches[2] + elsif matches = /^((?!['`"]).*[^0-9a-zA-Z$_].*)@(.+)$/.match(value) + user_part = matches[1] + host_part = matches[2] + else + raise(ArgumentError, "Invalid database user #{value}") + end + + mysql_version = Facter.value(:mysql_version) + unless mysql_version.nil? + if Puppet::Util::Package.versioncmp(mysql_version, '5.7.8') < 0 and user_part.size > 16 + raise(ArgumentError, 'MySQL usernames are limited to a maximum of 16 characters') + elsif Puppet::Util::Package.versioncmp(mysql_version, '10.0.0') < 0 and user_part.size > 32 + raise(ArgumentError, 'MySQL usernames are limited to a maximum of 32 characters') + elsif Puppet::Util::Package.versioncmp(mysql_version, '10.0.0') > 0 and user_part.size > 80 + raise(ArgumentError, 'MySQL usernames are limited to a maximum of 80 characters') + end + end + end + + munge do |value| + matches = /^((['`"]?).*\2)@(.+)$/.match(value) + "#{matches[1]}@#{matches[3].downcase}" + end + end + + newproperty(:password_hash) do + desc 'The password hash of the user. Use mysql_password() for creating such a hash.' + newvalue(/\w*/) + end + + newproperty(:plugin) do + desc 'The authentication plugin of the user.' + newvalue(/\w+/) + end + + newproperty(:max_user_connections) do + desc "Max concurrent connections for the user. 0 means no (or global) limit." + newvalue(/\d+/) + end + + newproperty(:max_connections_per_hour) do + desc "Max connections per hour for the user. 0 means no (or global) limit." + newvalue(/\d+/) + end + + newproperty(:max_queries_per_hour) do + desc "Max queries per hour for the user. 0 means no (or global) limit." + newvalue(/\d+/) + end + + newproperty(:max_updates_per_hour) do + desc "Max updates per hour for the user. 0 means no (or global) limit." + newvalue(/\d+/) + end + + newproperty(:tls_options, :array_matching => :all) do + desc "Options to that set the TLS-related REQUIRE attributes for the user." + validate do |value| + value = [value] if not value.is_a?(Array) + if value.include? 'NONE' or value.include? 'SSL' or value.include? 'X509' + if value.length > 1 + raise(ArgumentError, "REQUIRE tls options NONE, SSL and X509 cannot be used with other options, you may only use one of them.") + end + else + value.each do |opt| + if not o = opt.match(/^(CIPHER|ISSUER|SUBJECT)/i) + raise(ArgumentError, "Invalid tls option #{o}") + end + end + end + end + def insync?(is) + # The current value may be nil and we don't + # want to call sort on it so make sure we have arrays + if is.is_a?(Array) and @should.is_a?(Array) + is.sort == @should.sort + else + is == @should + end + end + end + +end diff --git a/environments/production/modules/mysql/manifests/backup/mysqlbackup.pp b/environments/production/modules/mysql/manifests/backup/mysqlbackup.pp new file mode 100644 index 0000000..ae70c1b --- /dev/null +++ b/environments/production/modules/mysql/manifests/backup/mysqlbackup.pp @@ -0,0 +1,106 @@ +# See README.me for usage. +class mysql::backup::mysqlbackup ( + $backupuser = '', + $backuppassword = '', + $maxallowedpacket = '1M', + $backupdir = '', + $backupdirmode = '0700', + $backupdirowner = 'root', + $backupdirgroup = $mysql::params::root_group, + $backupcompress = true, + $backuprotate = 30, + $ignore_events = true, + $delete_before_dump = false, + $backupdatabases = [], + $file_per_database = false, + $include_triggers = true, + $include_routines = false, + $ensure = 'present', + $time = ['23', '5'], + $prescript = false, + $postscript = false, + $execpath = '/usr/bin:/usr/sbin:/bin:/sbin', +) inherits mysql::params { + + mysql_user { "${backupuser}@localhost": + ensure => $ensure, + password_hash => mysql_password($backuppassword), + require => Class['mysql::server::root_password'], + } + + package { 'meb': + ensure => $ensure, + } + + # http://dev.mysql.com/doc/mysql-enterprise-backup/3.11/en/mysqlbackup.privileges.html + mysql_grant { "${backupuser}@localhost/*.*": + ensure => $ensure, + user => "${backupuser}@localhost", + table => '*.*', + privileges => [ 'RELOAD', 'SUPER', 'REPLICATION CLIENT' ], + require => Mysql_user["${backupuser}@localhost"], + } + + mysql_grant { "${backupuser}@localhost/mysql.backup_progress": + ensure => $ensure, + user => "${backupuser}@localhost", + table => 'mysql.backup_progress', + privileges => [ 'CREATE', 'INSERT', 'DROP', 'UPDATE' ], + require => Mysql_user["${backupuser}@localhost"], + } + + mysql_grant { "${backupuser}@localhost/mysql.backup_history": + ensure => $ensure, + user => "${backupuser}@localhost", + table => 'mysql.backup_history', + privileges => [ 'CREATE', 'INSERT', 'SELECT', 'DROP', 'UPDATE' ], + require => Mysql_user["${backupuser}@localhost"], + } + + cron { 'mysqlbackup-weekly': + ensure => $ensure, + command => 'mysqlbackup backup', + user => 'root', + hour => $time[0], + minute => $time[1], + weekday => '0', + require => Package['meb'], + } + + cron { 'mysqlbackup-daily': + ensure => $ensure, + command => 'mysqlbackup --incremental backup', + user => 'root', + hour => $time[0], + minute => $time[1], + weekday => '1-6', + require => Package['meb'], + } + + $default_options = { + 'mysqlbackup' => { + 'backup-dir' => $backupdir, + 'with-timestamp' => true, + 'incremental_base' => 'history:last_backup', + 'incremental_backup_dir' => $backupdir, + 'user' => $backupuser, + 'password' => $backuppassword, + } + } + $options = mysql_deepmerge($default_options, $mysql::server::override_options) + + file { 'mysqlbackup-config-file': + path => '/etc/mysql/conf.d/meb.cnf', + content => template('mysql/meb.cnf.erb'), + mode => '0600', + } + + file { 'mysqlbackupdir': + ensure => 'directory', + path => $backupdir, + mode => $backupdirmode, + owner => $backupdirowner, + group => $backupdirgroup, + } + +} diff --git a/environments/production/modules/mysql/manifests/backup/mysqldump.pp b/environments/production/modules/mysql/manifests/backup/mysqldump.pp new file mode 100644 index 0000000..3ff3c9b --- /dev/null +++ b/environments/production/modules/mysql/manifests/backup/mysqldump.pp @@ -0,0 +1,73 @@ +# See README.me for usage. +class mysql::backup::mysqldump ( + $backupuser = '', + $backuppassword = '', + $backupdir = '', + $maxallowedpacket = '1M', + $backupdirmode = '0700', + $backupdirowner = 'root', + $backupdirgroup = $mysql::params::root_group, + $backupcompress = true, + $backuprotate = 30, + $ignore_events = true, + $delete_before_dump = false, + $backupdatabases = [], + $file_per_database = false, + $include_triggers = false, + $include_routines = false, + $ensure = 'present', + $time = ['23', '5'], + $prescript = false, + $postscript = false, + $execpath = '/usr/bin:/usr/sbin:/bin:/sbin', +) inherits mysql::params { + + ensure_packages(['bzip2']) + + mysql_user { "${backupuser}@localhost": + ensure => $ensure, + password_hash => mysql_password($backuppassword), + require => Class['mysql::server::root_password'], + } + + if $include_triggers { + $privs = [ 'SELECT', 'RELOAD', 'LOCK TABLES', 'SHOW VIEW', 'PROCESS', 'TRIGGER' ] + } else { + $privs = [ 'SELECT', 'RELOAD', 'LOCK TABLES', 'SHOW VIEW', 'PROCESS' ] + } + + mysql_grant { "${backupuser}@localhost/*.*": + ensure => $ensure, + user => "${backupuser}@localhost", + table => '*.*', + privileges => $privs, + require => Mysql_user["${backupuser}@localhost"], + } + + cron { 'mysql-backup': + ensure => $ensure, + command => '/usr/local/sbin/mysqlbackup.sh', + user => 'root', + hour => $time[0], + minute => $time[1], + require => [File['mysqlbackup.sh'], Package['bzip2']], + } + + file { 'mysqlbackup.sh': + ensure => $ensure, + path => '/usr/local/sbin/mysqlbackup.sh', + mode => '0700', + owner => 'root', + group => $mysql::params::root_group, + content => template('mysql/mysqlbackup.sh.erb'), + } + + file { 'mysqlbackupdir': + ensure => 'directory', + path => $backupdir, + mode => $backupdirmode, + owner => $backupdirowner, + group => $backupdirgroup, + } + +} diff --git a/environments/production/modules/mysql/manifests/backup/xtrabackup.pp b/environments/production/modules/mysql/manifests/backup/xtrabackup.pp new file mode 100644 index 0000000..185b29f --- /dev/null +++ b/environments/production/modules/mysql/manifests/backup/xtrabackup.pp @@ -0,0 +1,67 @@ +# See README.me for usage. +class mysql::backup::xtrabackup ( + $xtrabackup_package_name = $mysql::params::xtrabackup_package_name, + $backupuser = '', + $backuppassword = '', + $backupdir = '', + $maxallowedpacket = '1M', + $backupmethod = 'mysqldump', + $backupdirmode = '0700', + $backupdirowner = 'root', + $backupdirgroup = $mysql::params::root_group, + $backupcompress = true, + $backuprotate = 30, + $ignore_events = true, + $delete_before_dump = false, + $backupdatabases = [], + $file_per_database = false, + $include_triggers = true, + $include_routines = false, + $ensure = 'present', + $time = ['23', '5'], + $prescript = false, + $postscript = false, + $execpath = '/usr/bin:/usr/sbin:/bin:/sbin', +) inherits mysql::params { + + package{ $xtrabackup_package_name: + ensure => $ensure, + } + + cron { 'xtrabackup-weekly': + ensure => $ensure, + command => "/usr/local/sbin/xtrabackup.sh ${backupdir}", + user => 'root', + hour => $time[0], + minute => $time[1], + weekday => '0', + require => Package[$xtrabackup_package_name], + } + + cron { 'xtrabackup-daily': + ensure => $ensure, + command => "/usr/local/sbin/xtrabackup.sh --incremental ${backupdir}", + user => 'root', + hour => $time[0], + minute => $time[1], + weekday => '1-6', + require => Package[$xtrabackup_package_name], + } + + file { 'mysqlbackupdir': + ensure => 'directory', + path => $backupdir, + mode => $backupdirmode, + owner => $backupdirowner, + group => $backupdirgroup, + } + + file { 'xtrabackup.sh': + ensure => $ensure, + path => '/usr/local/sbin/xtrabackup.sh', + mode => '0700', + owner => 'root', + group => $mysql::params::root_group, + content => template('mysql/xtrabackup.sh.erb'), + } +} diff --git a/environments/production/modules/mysql/manifests/bindings.pp b/environments/production/modules/mysql/manifests/bindings.pp new file mode 100644 index 0000000..fa7b870 --- /dev/null +++ b/environments/production/modules/mysql/manifests/bindings.pp @@ -0,0 +1,57 @@ +# See README.md. +class mysql::bindings ( + $install_options = undef, + # Boolean to determine if we should include the classes. + $java_enable = false, + $perl_enable = false, + $php_enable = false, + $python_enable = false, + $ruby_enable = false, + $client_dev = false, + $daemon_dev = false, + # Settings for the various classes. + $java_package_ensure = $mysql::params::java_package_ensure, + $java_package_name = $mysql::params::java_package_name, + $java_package_provider = $mysql::params::java_package_provider, + $perl_package_ensure = $mysql::params::perl_package_ensure, + $perl_package_name = $mysql::params::perl_package_name, + $perl_package_provider = $mysql::params::perl_package_provider, + $php_package_ensure = $mysql::params::php_package_ensure, + $php_package_name = $mysql::params::php_package_name, + $php_package_provider = $mysql::params::php_package_provider, + $python_package_ensure = $mysql::params::python_package_ensure, + $python_package_name = $mysql::params::python_package_name, + $python_package_provider = $mysql::params::python_package_provider, + $ruby_package_ensure = $mysql::params::ruby_package_ensure, + $ruby_package_name = $mysql::params::ruby_package_name, + $ruby_package_provider = $mysql::params::ruby_package_provider, + $client_dev_package_ensure = $mysql::params::client_dev_package_ensure, + $client_dev_package_name = $mysql::params::client_dev_package_name, + $client_dev_package_provider = $mysql::params::client_dev_package_provider, + $daemon_dev_package_ensure = $mysql::params::daemon_dev_package_ensure, + $daemon_dev_package_name = $mysql::params::daemon_dev_package_name, + $daemon_dev_package_provider = $mysql::params::daemon_dev_package_provider +) inherits mysql::params { + + case $::osfamily { + 'Archlinux': { + if $java_enable { fail("::mysql::bindings::java cannot be managed by puppet on ${::osfamily} as it is not in official repositories. Please disable java mysql binding.") } + if $perl_enable { include '::mysql::bindings::perl' } + if $php_enable { warning("::mysql::bindings::php does not need to be managed by puppet on ${::osfamily} as it is included in mysql package by default.") } + if $python_enable { include '::mysql::bindings::python' } + if $ruby_enable { fail("::mysql::bindings::ruby cannot be managed by puppet on ${::osfamily} as it is not in official repositories. Please disable ruby mysql binding.") } + } + + default: { + if $java_enable { include '::mysql::bindings::java' } + if $perl_enable { include '::mysql::bindings::perl' } + if $php_enable { include '::mysql::bindings::php' } + if $python_enable { include '::mysql::bindings::python' } + if $ruby_enable { include '::mysql::bindings::ruby' } + } + } + + if $client_dev { include '::mysql::bindings::client_dev' } + if $daemon_dev { include '::mysql::bindings::daemon_dev' } + +} diff --git a/environments/production/modules/mysql/manifests/bindings/client_dev.pp b/environments/production/modules/mysql/manifests/bindings/client_dev.pp new file mode 100644 index 0000000..ee3c2fe --- /dev/null +++ b/environments/production/modules/mysql/manifests/bindings/client_dev.pp @@ -0,0 +1,15 @@ +# Private class +class mysql::bindings::client_dev { + + if $mysql::bindings::client_dev_package_name { + package { 'mysql-client_dev': + ensure => $mysql::bindings::client_dev_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::client_dev_package_name, + provider => $mysql::bindings::client_dev_package_provider, + } + } else { + warning("No MySQL client development package configured for ${::operatingsystem}.") + } + +} diff --git a/environments/production/modules/mysql/manifests/bindings/daemon_dev.pp b/environments/production/modules/mysql/manifests/bindings/daemon_dev.pp new file mode 100644 index 0000000..0515358 --- /dev/null +++ b/environments/production/modules/mysql/manifests/bindings/daemon_dev.pp @@ -0,0 +1,15 @@ +# Private class +class mysql::bindings::daemon_dev { + + if $mysql::bindings::daemon_dev_package_name { + package { 'mysql-daemon_dev': + ensure => $mysql::bindings::daemon_dev_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::daemon_dev_package_name, + provider => $mysql::bindings::daemon_dev_package_provider, + } + } else { + warning("No MySQL daemon development package configured for ${::operatingsystem}.") + } + +} diff --git a/environments/production/modules/mysql/manifests/bindings/java.pp b/environments/production/modules/mysql/manifests/bindings/java.pp new file mode 100644 index 0000000..db93ac2 --- /dev/null +++ b/environments/production/modules/mysql/manifests/bindings/java.pp @@ -0,0 +1,11 @@ +# Private class +class mysql::bindings::java { + + package { 'mysql-connector-java': + ensure => $mysql::bindings::java_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::java_package_name, + provider => $mysql::bindings::java_package_provider, + } + +} diff --git a/environments/production/modules/mysql/manifests/bindings/perl.pp b/environments/production/modules/mysql/manifests/bindings/perl.pp new file mode 100644 index 0000000..99d429c --- /dev/null +++ b/environments/production/modules/mysql/manifests/bindings/perl.pp @@ -0,0 +1,11 @@ +# Private class +class mysql::bindings::perl { + + package{ 'perl_mysql': + ensure => $mysql::bindings::perl_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::perl_package_name, + provider => $mysql::bindings::perl_package_provider, + } + +} diff --git a/environments/production/modules/mysql/manifests/bindings/php.pp b/environments/production/modules/mysql/manifests/bindings/php.pp new file mode 100644 index 0000000..9af7069 --- /dev/null +++ b/environments/production/modules/mysql/manifests/bindings/php.pp @@ -0,0 +1,11 @@ +# Private class: See README.md +class mysql::bindings::php { + + package { 'php-mysql': + ensure => $mysql::bindings::php_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::php_package_name, + provider => $mysql::bindings::php_package_provider, + } + +} diff --git a/environments/production/modules/mysql/manifests/bindings/python.pp b/environments/production/modules/mysql/manifests/bindings/python.pp new file mode 100644 index 0000000..a44c8fa --- /dev/null +++ b/environments/production/modules/mysql/manifests/bindings/python.pp @@ -0,0 +1,11 @@ +# Private class +class mysql::bindings::python { + + package { 'python-mysqldb': + ensure => $mysql::bindings::python_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::python_package_name, + provider => $mysql::bindings::python_package_provider, + } + +} diff --git a/environments/production/modules/mysql/manifests/bindings/ruby.pp b/environments/production/modules/mysql/manifests/bindings/ruby.pp new file mode 100644 index 0000000..d431efe --- /dev/null +++ b/environments/production/modules/mysql/manifests/bindings/ruby.pp @@ -0,0 +1,11 @@ +# Private class +class mysql::bindings::ruby { + + package{ 'ruby_mysql': + ensure => $mysql::bindings::ruby_package_ensure, + install_options => $mysql::bindings::install_options, + name => $mysql::bindings::ruby_package_name, + provider => $mysql::bindings::ruby_package_provider, + } + +} diff --git a/environments/production/modules/mysql/manifests/client.pp b/environments/production/modules/mysql/manifests/client.pp new file mode 100644 index 0000000..3d5d706 --- /dev/null +++ b/environments/production/modules/mysql/manifests/client.pp @@ -0,0 +1,29 @@ +# +class mysql::client ( + $bindings_enable = $mysql::params::bindings_enable, + $install_options = undef, + $package_ensure = $mysql::params::client_package_ensure, + $package_manage = $mysql::params::client_package_manage, + $package_name = $mysql::params::client_package_name, +) inherits mysql::params { + + include '::mysql::client::install' + + if $bindings_enable { + class { 'mysql::bindings': + java_enable => true, + perl_enable => true, + php_enable => true, + python_enable => true, + ruby_enable => true, + } + } + + + # Anchor pattern workaround to avoid resources of mysql::client::install to + # "float off" outside mysql::client + anchor { 'mysql::client::start': } -> + Class['mysql::client::install'] -> + anchor { 'mysql::client::end': } + +} diff --git a/environments/production/modules/mysql/manifests/client/install.pp b/environments/production/modules/mysql/manifests/client/install.pp new file mode 100644 index 0000000..26e5ec2 --- /dev/null +++ b/environments/production/modules/mysql/manifests/client/install.pp @@ -0,0 +1,14 @@ +# See README.md. +class mysql::client::install { + + if $mysql::client::package_manage { + + package { 'mysql_client': + ensure => $mysql::client::package_ensure, + install_options => $mysql::client::install_options, + name => $mysql::client::package_name, + } + + } + +} diff --git a/environments/production/modules/mysql/manifests/db.pp b/environments/production/modules/mysql/manifests/db.pp new file mode 100644 index 0000000..f5b2221 --- /dev/null +++ b/environments/production/modules/mysql/manifests/db.pp @@ -0,0 +1,72 @@ +# See README.md for details. +define mysql::db ( + $user, + $password, + $dbname = $name, + $charset = 'utf8', + $collate = 'utf8_general_ci', + $host = 'localhost', + $grant = 'ALL', + $sql = undef, + $enforce_sql = false, + $ensure = 'present', + $import_timeout = 300, + $import_cat_cmd = 'cat', +) { + #input validation + validate_re($ensure, '^(present|absent)$', + "${ensure} is not supported for ensure. Allowed values are 'present' and 'absent'.") + $table = "${dbname}.*" + + if !(is_array($sql) or is_string($sql)) { + fail('$sql must be either a string or an array.') + } + + $sql_inputs = join([$sql], ' ') + + include '::mysql::client' + + $db_resource = { + ensure => $ensure, + charset => $charset, + collate => $collate, + provider => 'mysql', + require => [ Class['mysql::client'] ], + } + ensure_resource('mysql_database', $dbname, $db_resource) + + $user_resource = { + ensure => $ensure, + password_hash => mysql_password($password), + provider => 'mysql', + } + ensure_resource('mysql_user', "${user}@${host}", $user_resource) + + if $ensure == 'present' { + mysql_grant { "${user}@${host}/${table}": + privileges => $grant, + provider => 'mysql', + user => "${user}@${host}", + table => $table, + require => [ + Mysql_database[$dbname], + Mysql_user["${user}@${host}"], + ], + } + + $refresh = ! $enforce_sql + + if $sql { + exec{ "${dbname}-import": + command => "${import_cat_cmd} ${sql_inputs} | mysql ${dbname}", + logoutput => true, + environment => "HOME=${::root_home}", + refreshonly => $refresh, + path => '/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin', + require => Mysql_grant["${user}@${host}/${table}"], + subscribe => Mysql_database[$dbname], + timeout => $import_timeout, + } + } + } +} diff --git a/environments/production/modules/mysql/manifests/params.pp b/environments/production/modules/mysql/manifests/params.pp new file mode 100644 index 0000000..8f65b8f --- /dev/null +++ b/environments/production/modules/mysql/manifests/params.pp @@ -0,0 +1,450 @@ +# Private class: See README.md. +class mysql::params { + + $manage_config_file = true + $purge_conf_dir = false + $restart = false + $root_password = 'UNSET' + $install_secret_file = '/.mysql_secret' + $server_package_ensure = 'present' + $server_package_manage = true + $server_service_manage = true + $server_service_enabled = true + $client_package_ensure = 'present' + $client_package_manage = true + $create_root_user = true + $create_root_my_cnf = true + # mysql::bindings + $bindings_enable = false + $java_package_ensure = 'present' + $java_package_provider = undef + $perl_package_ensure = 'present' + $perl_package_provider = undef + $php_package_ensure = 'present' + $php_package_provider = undef + $python_package_ensure = 'present' + $python_package_provider = undef + $ruby_package_ensure = 'present' + $ruby_package_provider = undef + $client_dev_package_ensure = 'present' + $client_dev_package_provider = undef + $daemon_dev_package_ensure = 'present' + $daemon_dev_package_provider = undef + $xtrabackup_package_name = 'percona-xtrabackup' + + + case $::osfamily { + 'RedHat': { + case $::operatingsystem { + 'Fedora': { + if versioncmp($::operatingsystemrelease, '19') >= 0 or $::operatingsystemrelease == 'Rawhide' { + $provider = 'mariadb' + } else { + $provider = 'mysql' + } + } + /^(RedHat|CentOS|Scientific|OracleLinux)$/: { + if versioncmp($::operatingsystemmajrelease, '7') >= 0 { + $provider = 'mariadb' + } else { + $provider = 'mysql' + } + } + default: { + $provider = 'mysql' + } + } + + if $provider == 'mariadb' { + $client_package_name = 'mariadb' + $server_package_name = 'mariadb-server' + $server_service_name = 'mariadb' + $log_error = '/var/log/mariadb/mariadb.log' + $config_file = '/etc/my.cnf.d/server.cnf' + # mariadb package by default has !includedir set in my.cnf to /etc/my.cnf.d + $includedir = undef + $pidfile = '/var/run/mariadb/mariadb.pid' + $daemon_dev_package_name = 'mariadb-devel' + } else { + $client_package_name = 'mysql' + $server_package_name = 'mysql-server' + $server_service_name = 'mysqld' + $log_error = '/var/log/mysqld.log' + $config_file = '/etc/my.cnf' + $includedir = '/etc/my.cnf.d' + $pidfile = '/var/run/mysqld/mysqld.pid' + $daemon_dev_package_name = 'mysql-devel' + } + + $basedir = '/usr' + $datadir = '/var/lib/mysql' + $root_group = 'root' + $mysql_group = 'mysql' + $socket = '/var/lib/mysql/mysql.sock' + $ssl_ca = '/etc/mysql/cacert.pem' + $ssl_cert = '/etc/mysql/server-cert.pem' + $ssl_key = '/etc/mysql/server-key.pem' + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'mysql-connector-java' + $perl_package_name = 'perl-DBD-MySQL' + $php_package_name = 'php-mysql' + $python_package_name = 'MySQL-python' + $ruby_package_name = 'ruby-mysql' + $client_dev_package_name = undef + } + + 'Suse': { + case $::operatingsystem { + 'OpenSuSE': { + if versioncmp( $::operatingsystemmajrelease, '12' ) >= 0 { + $client_package_name = 'mariadb-client' + $server_package_name = 'mariadb' + # First service start fails if this is set. Runs fine without + # it being set, in any case. Leaving it as-is for the mysql. + $basedir = undef + } else { + $client_package_name = 'mysql-community-server-client' + $server_package_name = 'mysql-community-server' + $basedir = '/usr' + } + } + 'SLES','SLED': { + if versioncmp($::operatingsystemrelease, '12') >= 0 { + $client_package_name = 'mariadb-client' + $server_package_name = 'mariadb' + $basedir = undef + } else { + $client_package_name = 'mysql-client' + $server_package_name = 'mysql' + $basedir = '/usr' + } + } + default: { + fail("Unsupported platform: puppetlabs-${module_name} currently doesn't support ${::operatingsystem}") + } + } + $config_file = '/etc/my.cnf' + $includedir = '/etc/my.cnf.d' + $datadir = '/var/lib/mysql' + $log_error = $::operatingsystem ? { + /OpenSuSE/ => '/var/log/mysql/mysqld.log', + /(SLES|SLED)/ => '/var/log/mysqld.log', + } + $pidfile = $::operatingsystem ? { + /OpenSuSE/ => '/var/run/mysql/mysqld.pid', + /(SLES|SLED)/ => '/var/lib/mysql/mysqld.pid', + } + $root_group = 'root' + $mysql_group = 'mysql' + $server_service_name = 'mysql' + + if $::operatingsystem =~ /(SLES|SLED)/ { + if versioncmp( $::operatingsystemmajrelease, '12' ) >= 0 { + $socket = '/run/mysql/mysql.sock' + } else { + $socket = '/var/lib/mysql/mysql.sock' + } + } else { + $socket = '/var/run/mysql/mysql.sock' + } + + $ssl_ca = '/etc/mysql/cacert.pem' + $ssl_cert = '/etc/mysql/server-cert.pem' + $ssl_key = '/etc/mysql/server-key.pem' + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'mysql-connector-java' + $perl_package_name = 'perl-DBD-mysql' + $php_package_name = 'apache2-mod_php53' + $python_package_name = 'python-mysql' + $ruby_package_name = $::operatingsystem ? { + /OpenSuSE/ => 'rubygem-mysql', + /(SLES|SLED)/ => 'ruby-mysql', + } + $client_dev_package_name = 'libmysqlclient-devel' + $daemon_dev_package_name = 'mysql-devel' + } + + 'Debian': { + $client_package_name = 'mysql-client' + $server_package_name = 'mysql-server' + + $basedir = '/usr' + $config_file = '/etc/mysql/my.cnf' + $includedir = '/etc/mysql/conf.d' + $datadir = '/var/lib/mysql' + $log_error = '/var/log/mysql/error.log' + $pidfile = '/var/run/mysqld/mysqld.pid' + $root_group = 'root' + $mysql_group = 'adm' + $server_service_name = 'mysql' + $socket = '/var/run/mysqld/mysqld.sock' + $ssl_ca = '/etc/mysql/cacert.pem' + $ssl_cert = '/etc/mysql/server-cert.pem' + $ssl_key = '/etc/mysql/server-key.pem' + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'libmysql-java' + $perl_package_name = 'libdbd-mysql-perl' + $php_package_name = $::lsbdistcodename ? { + 'xenial' => 'php-mysql', + default => 'php5-mysql', + } + $python_package_name = 'python-mysqldb' + $ruby_package_name = $::lsbdistcodename ? { + 'trusty' => 'ruby-mysql', + 'jessie' => 'ruby-mysql', + 'xenial' => 'ruby-mysql', + default => 'libmysql-ruby', + } + $client_dev_package_name = 'libmysqlclient-dev' + $daemon_dev_package_name = 'libmysqld-dev' + } + + 'Archlinux': { + $client_package_name = 'mariadb-clients' + $server_package_name = 'mariadb' + $basedir = '/usr' + $config_file = '/etc/mysql/my.cnf' + $datadir = '/var/lib/mysql' + $log_error = '/var/log/mysqld.log' + $pidfile = '/var/run/mysqld/mysqld.pid' + $root_group = 'root' + $mysql_group = 'mysql' + $server_service_name = 'mysqld' + $socket = '/var/lib/mysql/mysql.sock' + $ssl_ca = '/etc/mysql/cacert.pem' + $ssl_cert = '/etc/mysql/server-cert.pem' + $ssl_key = '/etc/mysql/server-key.pem' + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'mysql-connector-java' + $perl_package_name = 'perl-dbd-mysql' + $php_package_name = undef + $python_package_name = 'mysql-python' + $ruby_package_name = 'mysql-ruby' + } + + 'Gentoo': { + $client_package_name = 'virtual/mysql' + $server_package_name = 'virtual/mysql' + $basedir = '/usr' + $config_file = '/etc/mysql/my.cnf' + $datadir = '/var/lib/mysql' + $log_error = '/var/log/mysql/mysqld.err' + $pidfile = '/run/mysqld/mysqld.pid' + $root_group = 'root' + $mysql_group = 'mysql' + $server_service_name = 'mysql' + $socket = '/run/mysqld/mysqld.sock' + $ssl_ca = '/etc/mysql/cacert.pem' + $ssl_cert = '/etc/mysql/server-cert.pem' + $ssl_key = '/etc/mysql/server-key.pem' + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'dev-java/jdbc-mysql' + $perl_package_name = 'dev-perl/DBD-mysql' + $php_package_name = undef + $python_package_name = 'dev-python/mysql-python' + $ruby_package_name = 'dev-ruby/mysql-ruby' + } + + 'FreeBSD': { + $client_package_name = 'databases/mysql56-client' + $server_package_name = 'databases/mysql56-server' + $basedir = '/usr/local' + $config_file = '/usr/local/etc/my.cnf' + $includedir = '/usr/local/etc/my.cnf.d' + $datadir = '/var/db/mysql' + $log_error = '/var/log/mysqld.log' + $pidfile = '/var/run/mysql.pid' + $root_group = 'wheel' + $mysql_group = 'mysql' + $server_service_name = 'mysql-server' + $socket = '/var/db/mysql/mysql.sock' + $ssl_ca = undef + $ssl_cert = undef + $ssl_key = undef + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'databases/mysql-connector-java' + $perl_package_name = 'p5-DBD-mysql' + $php_package_name = 'php5-mysql' + $python_package_name = 'databases/py-MySQLdb' + $ruby_package_name = 'databases/ruby-mysql' + # The libraries installed by these packages are included in client and server packages, no installation required. + $client_dev_package_name = undef + $daemon_dev_package_name = undef + } + + 'OpenBSD': { + $client_package_name = 'mariadb-client' + $server_package_name = 'mariadb-server' + $basedir = '/usr/local' + $config_file = '/etc/my.cnf' + $includedir = undef + $datadir = '/var/mysql' + $log_error = "/var/mysql/${::hostname}.err" + $pidfile = '/var/mysql/mysql.pid' + $root_group = 'wheel' + $mysql_group = '_mysql' + $server_service_name = 'mysqld' + $socket = '/var/run/mysql/mysql.sock' + $ssl_ca = undef + $ssl_cert = undef + $ssl_key = undef + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = undef + $perl_package_name = 'p5-DBD-mysql' + $php_package_name = 'php-mysql' + $python_package_name = 'py-mysql' + $ruby_package_name = 'ruby-mysql' + # The libraries installed by these packages are included in client and server packages, no installation required. + $client_dev_package_name = undef + $daemon_dev_package_name = undef + } + + 'Solaris': { + $client_package_name = 'database/mysql-55/client' + $server_package_name = 'database/mysql-55' + $basedir = undef + $config_file = '/etc/mysql/5.5/my.cnf' + $datadir = '/var/mysql/5.5/data' + $log_error = "/var/mysql/5.5/data/${::hostname}.err" + $pidfile = "/var/mysql/5.5/data/${::hostname}.pid" + $root_group = 'bin' + $server_service_name = 'application/database/mysql:version_55' + $socket = '/tmp/mysql.sock' + $ssl_ca = undef + $ssl_cert = undef + $ssl_key = undef + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = undef + $perl_package_name = undef + $php_package_name = 'web/php-53/extension/php-mysql' + $python_package_name = 'library/python/python-mysql' + $ruby_package_name = undef + # The libraries installed by these packages are included in client and server packages, no installation required. + $client_dev_package_name = undef + $daemon_dev_package_name = undef + } + + default: { + case $::operatingsystem { + 'Amazon': { + $client_package_name = 'mysql' + $server_package_name = 'mysql-server' + $basedir = '/usr' + $config_file = '/etc/my.cnf' + $includedir = '/etc/my.cnf.d' + $datadir = '/var/lib/mysql' + $log_error = '/var/log/mysqld.log' + $pidfile = '/var/run/mysqld/mysqld.pid' + $root_group = 'root' + $mysql_group = 'mysql' + $server_service_name = 'mysqld' + $socket = '/var/lib/mysql/mysql.sock' + $ssl_ca = '/etc/mysql/cacert.pem' + $ssl_cert = '/etc/mysql/server-cert.pem' + $ssl_key = '/etc/mysql/server-key.pem' + $tmpdir = '/tmp' + # mysql::bindings + $java_package_name = 'mysql-connector-java' + $perl_package_name = 'perl-DBD-MySQL' + $php_package_name = 'php-mysql' + $python_package_name = 'MySQL-python' + $ruby_package_name = 'ruby-mysql' + # The libraries installed by these packages are included in client and server packages, no installation required. + $client_dev_package_name = undef + $daemon_dev_package_name = undef + } + + default: { + fail("Unsupported platform: puppetlabs-${module_name} currently doesn't support ${::osfamily} or ${::operatingsystem}") + } + } + } + } + + case $::operatingsystem { + 'Ubuntu': { + if versioncmp($::operatingsystemmajrelease, '14.10') > 0 { + $server_service_provider = 'systemd' + } else { + $server_service_provider = 'upstart' + } + } + default: { + $server_service_provider = undef + } + } + + $default_options = { + 'client' => { + 'port' => '3306', + 'socket' => $mysql::params::socket, + }, + 'mysqld_safe' => { + 'nice' => '0', + 'log-error' => $mysql::params::log_error, + 'socket' => $mysql::params::socket, + }, + 'mysqld-5.0' => { + 'myisam-recover' => 'BACKUP', + }, + 'mysqld-5.1' => { + 'myisam-recover' => 'BACKUP', + }, + 'mysqld-5.5' => { + 'myisam-recover' => 'BACKUP', + }, + 'mysqld-5.6' => { + 'myisam-recover-options' => 'BACKUP', + }, + 'mysqld-5.7' => { + 'myisam-recover-options' => 'BACKUP', + }, + 'mysqld' => { + 'basedir' => $mysql::params::basedir, + 'bind-address' => '127.0.0.1', + 'datadir' => $mysql::params::datadir, + 'expire_logs_days' => '10', + 'key_buffer_size' => '16M', + 'log-error' => $mysql::params::log_error, + 'max_allowed_packet' => '16M', + 'max_binlog_size' => '100M', + 'max_connections' => '151', + 'pid-file' => $mysql::params::pidfile, + 'port' => '3306', + 'query_cache_limit' => '1M', + 'query_cache_size' => '16M', + 'skip-external-locking' => true, + 'socket' => $mysql::params::socket, + 'ssl' => false, + 'ssl-ca' => $mysql::params::ssl_ca, + 'ssl-cert' => $mysql::params::ssl_cert, + 'ssl-key' => $mysql::params::ssl_key, + 'ssl-disable' => false, + 'thread_cache_size' => '8', + 'thread_stack' => '256K', + 'tmpdir' => $mysql::params::tmpdir, + 'user' => 'mysql', + }, + 'mysqldump' => { + 'max_allowed_packet' => '16M', + 'quick' => true, + 'quote-names' => true, + }, + 'isamchk' => { + 'key_buffer_size' => '16M', + }, + } + + ## Additional graceful failures + if $::osfamily == 'RedHat' and $::operatingsystemmajrelease == '4' and $::operatingsystem != 'Amazon' { + fail("Unsupported platform: puppetlabs-${module_name} only supports RedHat 5.0 and beyond") + } +} diff --git a/environments/production/modules/mysql/manifests/server.pp b/environments/production/modules/mysql/manifests/server.pp new file mode 100644 index 0000000..e910c21 --- /dev/null +++ b/environments/production/modules/mysql/manifests/server.pp @@ -0,0 +1,89 @@ +# Class: mysql::server: See README.md for documentation. +class mysql::server ( + $config_file = $mysql::params::config_file, + $includedir = $mysql::params::includedir, + $install_options = undef, + $install_secret_file = $mysql::params::install_secret_file, + $manage_config_file = $mysql::params::manage_config_file, + $override_options = {}, + $package_ensure = $mysql::params::server_package_ensure, + $package_manage = $mysql::params::server_package_manage, + $package_name = $mysql::params::server_package_name, + $purge_conf_dir = $mysql::params::purge_conf_dir, + $remove_default_accounts = false, + $restart = $mysql::params::restart, + $root_group = $mysql::params::root_group, + $mysql_group = $mysql::params::mysql_group, + $root_password = $mysql::params::root_password, + $service_enabled = $mysql::params::server_service_enabled, + $service_manage = $mysql::params::server_service_manage, + $service_name = $mysql::params::server_service_name, + $service_provider = $mysql::params::server_service_provider, + $create_root_user = $mysql::params::create_root_user, + $create_root_my_cnf = $mysql::params::create_root_my_cnf, + $users = {}, + $grants = {}, + $databases = {}, + + # Deprecated parameters + $enabled = undef, + $manage_service = undef, + $old_root_password = undef +) inherits mysql::params { + + # Deprecated parameters. + if $enabled { + crit('This parameter has been renamed to service_enabled.') + $real_service_enabled = $enabled + } else { + $real_service_enabled = $service_enabled + } + if $manage_service { + crit('This parameter has been renamed to service_manage.') + $real_service_manage = $manage_service + } else { + $real_service_manage = $service_manage + } + if $old_root_password { + warning('old_root_password is no longer used and will be removed in a future release') + } + + # Create a merged together set of options. Rightmost hashes win over left. + $options = mysql_deepmerge($mysql::params::default_options, $override_options) + + Class['mysql::server::root_password'] -> Mysql::Db <| |> + + include '::mysql::server::config' + include '::mysql::server::install' + include '::mysql::server::binarylog' + include '::mysql::server::installdb' + include '::mysql::server::service' + include '::mysql::server::root_password' + include '::mysql::server::providers' + + if $remove_default_accounts { + class { '::mysql::server::account_security': + require => Anchor['mysql::server::end'], + } + } + + anchor { 'mysql::server::start': } + anchor { 'mysql::server::end': } + + if $restart { + Class['mysql::server::config'] ~> + Class['mysql::server::service'] + } + + Anchor['mysql::server::start'] -> + Class['mysql::server::config'] -> + Class['mysql::server::install'] -> + Class['mysql::server::binarylog'] -> + Class['mysql::server::installdb'] -> + Class['mysql::server::service'] -> + Class['mysql::server::root_password'] -> + Class['mysql::server::providers'] -> + Anchor['mysql::server::end'] + + +} diff --git a/environments/production/modules/mysql/manifests/server/account_security.pp b/environments/production/modules/mysql/manifests/server/account_security.pp new file mode 100644 index 0000000..3fcdd61 --- /dev/null +++ b/environments/production/modules/mysql/manifests/server/account_security.pp @@ -0,0 +1,39 @@ +# See README.md. +class mysql::server::account_security { + mysql_user { + [ 'root@127.0.0.1', + 'root@::1', + '@localhost', + '@%']: + ensure => 'absent', + require => Anchor['mysql::server::end'], + } + if ($::fqdn != 'localhost.localdomain') { + mysql_user { + [ 'root@localhost.localdomain', + '@localhost.localdomain']: + ensure => 'absent', + require => Anchor['mysql::server::end'], + } + } + if ($::fqdn and $::fqdn != 'localhost') { + mysql_user { + [ "root@${::fqdn}", + "@${::fqdn}"]: + ensure => 'absent', + require => Anchor['mysql::server::end'], + } + } + if ($::fqdn != $::hostname) { + if ($::hostname != 'localhost') { + mysql_user { ["root@${::hostname}", "@${::hostname}"]: + ensure => 'absent', + require => Anchor['mysql::server::end'], + } + } + } + mysql_database { 'test': + ensure => 'absent', + require => Anchor['mysql::server::end'], + } +} diff --git a/environments/production/modules/mysql/manifests/server/backup.pp b/environments/production/modules/mysql/manifests/server/backup.pp new file mode 100644 index 0000000..d31a880 --- /dev/null +++ b/environments/production/modules/mysql/manifests/server/backup.pp @@ -0,0 +1,55 @@ +# See README.me for usage. +class mysql::server::backup ( + $backupuser = undef, + $backuppassword = undef, + $backupdir = undef, + $backupdirmode = '0700', + $backupdirowner = 'root', + $backupdirgroup = 'root', + $backupcompress = true, + $backuprotate = 30, + $ignore_events = true, + $delete_before_dump = false, + $backupdatabases = [], + $file_per_database = false, + $include_routines = false, + $include_triggers = false, + $ensure = 'present', + $time = ['23', '5'], + $prescript = false, + $postscript = false, + $execpath = '/usr/bin:/usr/sbin:/bin:/sbin', + $provider = 'mysqldump', + $maxallowedpacket = '1M', +) { + + if $prescript and $provider =~ /(mysqldump|mysqlbackup)/ { + warning("The \$prescript option is not currently implemented for the ${provider} backup provider.") + } + + create_resources('class', { + "mysql::backup::${provider}" => { + 'backupuser' => $backupuser, + 'backuppassword' => $backuppassword, + 'backupdir' => $backupdir, + 'backupdirmode' => $backupdirmode, + 'backupdirowner' => $backupdirowner, + 'backupdirgroup' => $backupdirgroup, + 'backupcompress' => $backupcompress, + 'backuprotate' => $backuprotate, + 'ignore_events' => $ignore_events, + 'delete_before_dump' => $delete_before_dump, + 'backupdatabases' => $backupdatabases, + 'file_per_database' => $file_per_database, + 'include_routines' => $include_routines, + 'include_triggers' => $include_triggers, + 'ensure' => $ensure, + 'time' => $time, + 'prescript' => $prescript, + 'postscript' => $postscript, + 'execpath' => $execpath, + 'maxallowedpacket' => $maxallowedpacket, + } + }) + +} diff --git a/environments/production/modules/mysql/manifests/server/binarylog.pp b/environments/production/modules/mysql/manifests/server/binarylog.pp new file mode 100644 index 0000000..459915d --- /dev/null +++ b/environments/production/modules/mysql/manifests/server/binarylog.pp @@ -0,0 +1,22 @@ +# Binary log configuration requires the mysql user to be present. This must be done after package install +class mysql::server::binarylog { + + $options = $mysql::server::options + $includedir = $mysql::server::includedir + + $logbin = pick($options['mysqld']['log-bin'], $options['mysqld']['log_bin'], false) + + if $logbin { + $logbindir = mysql_dirname($logbin) + + #Stop puppet from managing directory if just a filename/prefix is specified + if $logbindir != '.' { + file { $logbindir: + ensure => directory, + mode => '0755', + owner => $options['mysqld']['user'], + group => $options['mysqld']['user'], + } + } + } +} diff --git a/environments/production/modules/mysql/manifests/server/config.pp b/environments/production/modules/mysql/manifests/server/config.pp new file mode 100644 index 0000000..efb4940 --- /dev/null +++ b/environments/production/modules/mysql/manifests/server/config.pp @@ -0,0 +1,56 @@ +# See README.me for options. +class mysql::server::config { + + $options = $mysql::server::options + $includedir = $mysql::server::includedir + + File { + owner => 'root', + group => $mysql::server::root_group, + mode => '0400', + } + + if $includedir and $includedir != '' { + file { $includedir: + ensure => directory, + mode => '0755', + recurse => $mysql::server::purge_conf_dir, + purge => $mysql::server::purge_conf_dir, + } + + # on some systems this is /etc/my.cnf.d, while Debian has /etc/mysql/conf.d and FreeBSD something in /usr/local. For the latter systems, + # managing this basedir is also required, to have it available before the package is installed. + $includeparentdir = mysql_dirname($includedir) + if $includeparentdir != '/' and $includeparentdir != '/etc' { + file { $includeparentdir: + ensure => directory, + mode => '0755', + } + } + } + + if $mysql::server::manage_config_file { + file { 'mysql-config-file': + path => $mysql::server::config_file, + content => template('mysql/my.cnf.erb'), + mode => '0644', + selinux_ignore_defaults => true, + } + + # on mariadb systems, $includedir is not defined, but /etc/my.cnf.d has + # to be managed to place the server.cnf there + $configparentdir = mysql_dirname($mysql::server::config_file) + if $configparentdir != '/' and $configparentdir != '/etc' and $configparentdir != $includedir and $configparentdir != mysql_dirname($includedir) { + file { $configparentdir: + ensure => directory, + mode => '0755', + } + } + } + + if $options['mysqld']['ssl-disable'] { + notify {'ssl-disable': + message =>'Disabling SSL is evil! You should never ever do this except if you are forced to use a mysql version compiled without SSL support' + } + } +} diff --git a/environments/production/modules/mysql/manifests/server/install.pp b/environments/production/modules/mysql/manifests/server/install.pp new file mode 100644 index 0000000..3b9601d --- /dev/null +++ b/environments/production/modules/mysql/manifests/server/install.pp @@ -0,0 +1,13 @@ +# +class mysql::server::install { + + if $mysql::server::package_manage { + + package { 'mysql-server': + ensure => $mysql::server::package_ensure, + install_options => $mysql::server::install_options, + name => $mysql::server::package_name, + } + } + +} diff --git a/environments/production/modules/mysql/manifests/server/installdb.pp b/environments/production/modules/mysql/manifests/server/installdb.pp new file mode 100644 index 0000000..5b419f2 --- /dev/null +++ b/environments/production/modules/mysql/manifests/server/installdb.pp @@ -0,0 +1,46 @@ +# +class mysql::server::installdb { + $options = $mysql::server::options + + if $mysql::server::package_manage { + + # Build the initial databases. + $mysqluser = $mysql::server::options['mysqld']['user'] + $datadir = $mysql::server::options['mysqld']['datadir'] + $basedir = $mysql::server::options['mysqld']['basedir'] + $config_file = $mysql::server::config_file + $log_error = $mysql::server::options['mysqld']['log-error'] + + if $mysql::server::manage_config_file and $config_file != $mysql::params::config_file { + $_config_file=$config_file + } else { + $_config_file=undef + } + + if $options['mysqld']['log-error'] { + file { $options['mysqld']['log-error']: + ensure => present, + owner => $mysqluser, + group => $::mysql::server::mysql_group, + mode => 'u+rw', + before => Mysql_datadir[ $datadir ], + } + } + + mysql_datadir { $datadir: + ensure => 'present', + datadir => $datadir, + basedir => $basedir, + user => $mysqluser, + log_error => $log_error, + defaults_extra_file => $_config_file, + } + + if $mysql::server::restart { + Mysql_datadir[$datadir] { + notify => Class['mysql::server::service'], + } + } + } + +} diff --git a/environments/production/modules/mysql/manifests/server/monitor.pp b/environments/production/modules/mysql/manifests/server/monitor.pp new file mode 100644 index 0000000..6b18609 --- /dev/null +++ b/environments/production/modules/mysql/manifests/server/monitor.pp @@ -0,0 +1,24 @@ +#This is a helper class to add a monitoring user to the database +class mysql::server::monitor ( + $mysql_monitor_username = '', + $mysql_monitor_password = '', + $mysql_monitor_hostname = '' +) { + + Anchor['mysql::server::end'] -> Class['mysql::server::monitor'] + + mysql_user { "${mysql_monitor_username}@${mysql_monitor_hostname}": + ensure => present, + password_hash => mysql_password($mysql_monitor_password), + require => Class['mysql::server::service'], + } + + mysql_grant { "${mysql_monitor_username}@${mysql_monitor_hostname}/*.*": + ensure => present, + user => "${mysql_monitor_username}@${mysql_monitor_hostname}", + table => '*.*', + privileges => [ 'PROCESS', 'SUPER' ], + require => Mysql_user["${mysql_monitor_username}@${mysql_monitor_hostname}"], + } + +} diff --git a/environments/production/modules/mysql/manifests/server/mysqltuner.pp b/environments/production/modules/mysql/manifests/server/mysqltuner.pp new file mode 100644 index 0000000..ff1d563 --- /dev/null +++ b/environments/production/modules/mysql/manifests/server/mysqltuner.pp @@ -0,0 +1,52 @@ +# +class mysql::server::mysqltuner( + $ensure = 'present', + $version = 'v1.3.0', + $source = undef, +) { + + if $source { + $_version = $source + $_source = $source + } else { + $_version = $version + $_source = "https://github.com/major/MySQLTuner-perl/raw/${version}/mysqltuner.pl" + } + + if $ensure == 'present' { + # $::puppetversion doesn't exist in puppet 4.x so would break strict + # variables + if ! $::settings::strict_variables { + $_puppetversion = $::puppetversion + } else { + # defined only works with puppet >= 3.5.0, so don't use it unless we're + # actually using strict variables + $_puppetversion = defined('$puppetversion') ? { + true => $::puppetversion, + default => undef, + } + } + # see https://tickets.puppetlabs.com/browse/ENTERPRISE-258 + if $_puppetversion and $_puppetversion =~ /Puppet Enterprise/ and versioncmp($_puppetversion, '3.8.0') < 0 { + class { '::staging': + path => '/opt/mysql_staging', + } + } else { + class { '::staging': } + } + + staging::file { "mysqltuner-${_version}": + source => $_source, + } + file { '/usr/local/bin/mysqltuner': + ensure => $ensure, + mode => '0550', + source => "${::staging::path}/mysql/mysqltuner-${_version}", + require => Staging::File["mysqltuner-${_version}"], + } + } else { + file { '/usr/local/bin/mysqltuner': + ensure => $ensure, + } + } +} diff --git a/environments/production/modules/mysql/manifests/server/providers.pp b/environments/production/modules/mysql/manifests/server/providers.pp new file mode 100644 index 0000000..b651172 --- /dev/null +++ b/environments/production/modules/mysql/manifests/server/providers.pp @@ -0,0 +1,8 @@ +# Convenience class to call each of the three providers with the corresponding +# hashes provided in mysql::server. +# See README.md for details. +class mysql::server::providers { + create_resources('mysql_user', $mysql::server::users) + create_resources('mysql_grant', $mysql::server::grants) + create_resources('mysql_database', $mysql::server::databases) +} diff --git a/environments/production/modules/mysql/manifests/server/root_password.pp b/environments/production/modules/mysql/manifests/server/root_password.pp new file mode 100644 index 0000000..9ebc103 --- /dev/null +++ b/environments/production/modules/mysql/manifests/server/root_password.pp @@ -0,0 +1,46 @@ +# +class mysql::server::root_password { + + $options = $mysql::server::options + $secret_file = $mysql::server::install_secret_file + + # New installations of MySQL will configure a default random password for the root user + # with an expiration. No actions can be performed until this password is changed. The + # below exec will remove this default password. If the user has supplied a root + # password it will be set further down with the mysql_user resource. + $rm_pass_cmd = join([ + "mysqladmin -u root --password=\$(grep -o '[^ ]\\+\$' ${secret_file}) password ''", + "rm -f ${secret_file}" + ], ' && ') + exec { 'remove install pass': + command => $rm_pass_cmd, + onlyif => "test -f ${secret_file}", + path => '/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin' + } + + # manage root password if it is set + if $mysql::server::create_root_user == true and $mysql::server::root_password != 'UNSET' { + mysql_user { 'root@localhost': + ensure => present, + password_hash => mysql_password($mysql::server::root_password), + require => Exec['remove install pass'] + } + } + + if $mysql::server::create_root_my_cnf == true and $mysql::server::root_password != 'UNSET' { + file { "${::root_home}/.my.cnf": + content => template('mysql/my.cnf.pass.erb'), + owner => 'root', + mode => '0600', + } + + # show_diff was added with puppet 3.0 + if versioncmp($::puppetversion, '3.0') >= 0 { + File["${::root_home}/.my.cnf"] { show_diff => false } + } + if $mysql::server::create_root_user == true { + Mysql_user['root@localhost'] -> File["${::root_home}/.my.cnf"] + } + } + +} diff --git a/environments/production/modules/mysql/manifests/server/service.pp b/environments/production/modules/mysql/manifests/server/service.pp new file mode 100644 index 0000000..3617b4b --- /dev/null +++ b/environments/production/modules/mysql/manifests/server/service.pp @@ -0,0 +1,58 @@ +# +class mysql::server::service { + $options = $mysql::server::options + + if $mysql::server::real_service_manage { + if $mysql::server::real_service_enabled { + $service_ensure = 'running' + } else { + $service_ensure = 'stopped' + } + } else { + $service_ensure = undef + } + + if $mysql::server::override_options and $mysql::server::override_options['mysqld'] and $mysql::server::override_options['mysqld']['user'] { + $mysqluser = $mysql::server::override_options['mysqld']['user'] + } else { + $mysqluser = $options['mysqld']['user'] + } + + if $mysql::server::real_service_manage { + service { 'mysqld': + ensure => $service_ensure, + name => $mysql::server::service_name, + enable => $mysql::server::real_service_enabled, + provider => $mysql::server::service_provider, + } + + # only establish ordering between service and package if + # we're managing the package. + if $mysql::server::package_manage { + Service['mysqld'] { + require => Package['mysql-server'], + } + } + + # only establish ordering between config file and service if + # we're managing the config file. + if $mysql::server::manage_config_file { + File['mysql-config-file'] -> Service['mysqld'] + } + + if $mysql::server::override_options and $mysql::server::override_options['mysqld'] and $mysql::server::override_options['mysqld']['socket'] { + $mysqlsocket = $mysql::server::override_options['mysqld']['socket'] + } else { + $mysqlsocket = $options['mysqld']['socket'] + } + + exec { 'wait_for_mysql_socket_to_open': + command => "test -S ${mysqlsocket}", + unless => "test -S ${mysqlsocket}", + tries => '3', + try_sleep => '10', + require => Service['mysqld'], + path => '/bin:/usr/bin', + } + } +} diff --git a/environments/production/modules/mysql/metadata.json b/environments/production/modules/mysql/metadata.json new file mode 100644 index 0000000..41c8da1 --- /dev/null +++ b/environments/production/modules/mysql/metadata.json @@ -0,0 +1,80 @@ +{ + "name": "puppetlabs-mysql", + "version": "3.10.0", + "author": "Puppet Labs", + "summary": "Installs, configures, and manages the MySQL service.", + "license": "Apache-2.0", + "source": "git://github.com/puppetlabs/puppetlabs-mysql.git", + "project_page": "http://github.com/puppetlabs/puppetlabs-mysql", + "issues_url": "https://tickets.puppetlabs.com/browse/MODULES", + "dependencies": [ + {"name":"puppetlabs/stdlib","version_requirement":">= 3.2.0 < 5.0.0"}, + {"name":"puppet/staging","version_requirement":">= 1.0.1 < 3.0.0"} + ], + "data_provider": null, + "operatingsystem_support": [ + { + "operatingsystem": "RedHat", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "CentOS", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "OracleLinux", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "Scientific", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "SLES", + "operatingsystemrelease": [ + "11 SP1", + "12" + ] + }, + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "6", + "7", + "8" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "10.04", + "12.04", + "14.04", + "16.04" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">= 3.0.0 < 5.0.0" + } + ], + "description": "MySQL module" +} diff --git a/environments/production/modules/mysql/spec/acceptance/mysql_backup_spec.rb b/environments/production/modules/mysql/spec/acceptance/mysql_backup_spec.rb new file mode 100644 index 0000000..88a90cc --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/mysql_backup_spec.rb @@ -0,0 +1,205 @@ +require 'spec_helper_acceptance' +require 'puppet' +require 'puppet/util/package' +require_relative './mysql_helper.rb' + +describe 'mysql::server::backup class' do + context 'should work with no errors' do + it 'when configuring mysql backups' do + pp = <<-EOS + class { 'mysql::server': root_password => 'password' } + mysql::db { [ + 'backup1', + 'backup2' + ]: + user => 'backup', + password => 'secret', + } + + class { 'mysql::server::backup': + backupuser => 'myuser', + backuppassword => 'mypassword', + backupdir => '/tmp/backups', + backupcompress => true, + postscript => [ + 'rm -rf /var/tmp/mysqlbackups', + 'rm -f /var/tmp/mysqlbackups.done', + 'cp -r /tmp/backups /var/tmp/mysqlbackups', + 'touch /var/tmp/mysqlbackups.done', + ], + execpath => '/usr/bin:/usr/sbin:/bin:/sbin:/opt/zimbra/bin', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_failures => true) + end + end + + describe 'mysqlbackup.sh' do + it 'should run mysqlbackup.sh with no errors' do + pre_run + if ! version_is_greater_than('5.7.0') + shell("/usr/local/sbin/mysqlbackup.sh") do |r| + expect(r.stderr).to eq("") + end + end + end + + it 'should dump all databases to single file' do + pre_run + if ! version_is_greater_than('5.7.0') + shell('ls -l /tmp/backups/mysql_backup_*-*.sql.bz2 | wc -l') do |r| + expect(r.stdout).to match(/1/) + expect(r.exit_code).to be_zero + end + end + end + + context 'should create one file per database per run' do + it 'executes mysqlbackup.sh a second time' do + pre_run + if ! version_is_greater_than('5.7.0') + shell('sleep 1') + shell('/usr/local/sbin/mysqlbackup.sh') + end + end + + it 'creates at least one backup tarball' do + pre_run + if ! version_is_greater_than('5.7.0') + shell('ls -l /tmp/backups/mysql_backup_*-*.sql.bz2 | wc -l') do |r| + expect(r.stdout).to match(/2/) + expect(r.exit_code).to be_zero + end + end + end + end + end + + context 'with one file per database' do + context 'should work with no errors' do + it 'when configuring mysql backups' do + pp = <<-EOS + class { 'mysql::server': root_password => 'password' } + mysql::db { [ + 'backup1', + 'backup2' + ]: + user => 'backup', + password => 'secret', + } + + class { 'mysql::server::backup': + backupuser => 'myuser', + backuppassword => 'mypassword', + backupdir => '/tmp/backups', + backupcompress => true, + file_per_database => true, + postscript => [ + 'rm -rf /var/tmp/mysqlbackups', + 'rm -f /var/tmp/mysqlbackups.done', + 'cp -r /tmp/backups /var/tmp/mysqlbackups', + 'touch /var/tmp/mysqlbackups.done', + ], + execpath => '/usr/bin:/usr/sbin:/bin:/sbin:/opt/zimbra/bin', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_failures => true) + end + end + + describe 'mysqlbackup.sh' do + it 'should run mysqlbackup.sh with no errors without root credentials' do + pre_run + if ! version_is_greater_than('5.7.0') + shell("HOME=/tmp/dontreadrootcredentials /usr/local/sbin/mysqlbackup.sh") do |r| + expect(r.stderr).to eq("") + end + end + end + + it 'should create one file per database' do + pre_run + if ! version_is_greater_than('5.7.0') + ['backup1', 'backup2'].each do |database| + shell("ls -l /tmp/backups/mysql_backup_#{database}_*-*.sql.bz2 | wc -l") do |r| + expect(r.stdout).to match(/1/) + expect(r.exit_code).to be_zero + end + end + end + end + + context 'should create one file per database per run' do + it 'executes mysqlbackup.sh a second time' do + pre_run + if ! version_is_greater_than('5.7.0') + shell('sleep 1') + shell('HOME=/tmp/dontreadrootcredentials /usr/local/sbin/mysqlbackup.sh') + end + end + + it 'has one file per database per run' do + pre_run + if ! version_is_greater_than('5.7.0') + ['backup1', 'backup2'].each do |database| + shell("ls -l /tmp/backups/mysql_backup_#{database}_*-*.sql.bz2 | wc -l") do |r| + expect(r.stdout).to match(/2/) + expect(r.exit_code).to be_zero + end + end + end + end + end + end + end + + context 'with triggers and routines' do + it 'when configuring mysql backups with triggers and routines' do + pre_run + pp = <<-EOS + class { 'mysql::server': root_password => 'password' } + mysql::db { [ + 'backup1', + 'backup2' + ]: + user => 'backup', + password => 'secret', + } + package { 'bzip2': + ensure => present, + } + class { 'mysql::server::backup': + backupuser => 'myuser', + backuppassword => 'mypassword', + backupdir => '/tmp/backups', + backupcompress => true, + file_per_database => true, + include_triggers => #{version_is_greater_than('5.1.5')}, + include_routines => true, + postscript => [ + 'rm -rf /var/tmp/mysqlbackups', + 'rm -f /var/tmp/mysqlbackups.done', + 'cp -r /tmp/backups /var/tmp/mysqlbackups', + 'touch /var/tmp/mysqlbackups.done', + ], + execpath => '/usr/bin:/usr/sbin:/bin:/sbin:/opt/zimbra/bin', + require => Package['bzip2'], + } + EOS + apply_manifest(pp, :catch_failures => true) + end + + it 'should run mysqlbackup.sh with no errors' do + pre_run + if ! version_is_greater_than('5.7.0') + shell("/usr/local/sbin/mysqlbackup.sh") do |r| + expect(r.stderr).to eq("") + end + end + end + end +end diff --git a/environments/production/modules/mysql/spec/acceptance/mysql_db_spec.rb b/environments/production/modules/mysql/spec/acceptance/mysql_db_spec.rb new file mode 100644 index 0000000..8c57160 --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/mysql_db_spec.rb @@ -0,0 +1,65 @@ +require 'spec_helper_acceptance' + +describe 'mysql::db define' do + describe 'creating a database' do + let(:pp) do + <<-EOS + class { 'mysql::server': root_password => 'password' } + mysql::db { 'spec1': + user => 'root1', + password => 'password', + } + EOS + end + it_behaves_like "a idempotent resource" + + describe command("mysql -e 'show databases;'") do + its(:exit_status) { is_expected.to eq 0 } + its(:stdout) { is_expected.to match /^spec1$/ } + end + end + + describe 'creating a database with post-sql' do + let(:pp) do + <<-EOS + class { 'mysql::server': override_options => { 'root_password' => 'password' } } + file { '/tmp/spec.sql': + ensure => file, + content => 'CREATE TABLE table1 (id int);', + before => Mysql::Db['spec2'], + } + mysql::db { 'spec2': + user => 'root1', + password => 'password', + sql => '/tmp/spec.sql', + } + EOS + end + it_behaves_like "a idempotent resource" + + describe command("mysql -e 'show tables;' spec2") do + its(:exit_status) { is_expected.to eq 0 } + its(:stdout) { is_expected.to match /^table1$/ } + end + end + + describe 'creating a database with dbname parameter' do + let(:check_command) { " | grep realdb" } + let(:pp) do + <<-EOS + class { 'mysql::server': override_options => { 'root_password' => 'password' } } + mysql::db { 'spec1': + user => 'root1', + password => 'password', + dbname => 'realdb', + } + EOS + end + it_behaves_like "a idempotent resource" + + describe command("mysql -e 'show databases;'") do + its(:exit_status) { is_expected.to eq 0 } + its(:stdout) { is_expected.to match /^realdb$/ } + end + end +end diff --git a/environments/production/modules/mysql/spec/acceptance/mysql_helper.rb b/environments/production/modules/mysql/spec/acceptance/mysql_helper.rb new file mode 100644 index 0000000..7a5dd57 --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/mysql_helper.rb @@ -0,0 +1,8 @@ + def pre_run + apply_manifest("class { 'mysql::server': root_password => 'password' }", :catch_failures => true) + @mysql_version = (on default, 'mysql --version').output.chomp.match(/\d+\.\d+\.\d+/)[0] + end + + def version_is_greater_than(version) + return Puppet::Util::Package.versioncmp(@mysql_version, version) > 0 + end diff --git a/environments/production/modules/mysql/spec/acceptance/mysql_server_spec.rb b/environments/production/modules/mysql/spec/acceptance/mysql_server_spec.rb new file mode 100644 index 0000000..d8e2f3e --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/mysql_server_spec.rb @@ -0,0 +1,107 @@ +require 'spec_helper_acceptance' + +describe 'mysql class' do + describe 'advanced config' do + before(:all) do + @tmpdir = default.tmpdir('mysql') + end + let(:pp) do + <<-EOS + class { 'mysql::server': + config_file => '#{@tmpdir}/my.cnf', + includedir => '#{@tmpdir}/include', + manage_config_file => 'true', + override_options => { 'mysqld' => { 'key_buffer_size' => '32M' }}, + package_ensure => 'present', + purge_conf_dir => 'true', + remove_default_accounts => 'true', + restart => 'true', + root_group => 'root', + root_password => 'test', + service_enabled => 'true', + service_manage => 'true', + users => { + 'someuser@localhost' => { + ensure => 'present', + max_connections_per_hour => '0', + max_queries_per_hour => '0', + max_updates_per_hour => '0', + max_user_connections => '0', + password_hash => '*F3A2A51A9B0F2BE2468926B4132313728C250DBF', + }}, + grants => { + 'someuser@localhost/somedb.*' => { + ensure => 'present', + options => ['GRANT'], + privileges => ['SELECT', 'INSERT', 'UPDATE', 'DELETE'], + table => 'somedb.*', + user => 'someuser@localhost', + }, + }, + databases => { + 'somedb' => { + ensure => 'present', + charset => 'utf8', + }, + } + } + EOS + end + + it_behaves_like "a idempotent resource" + end + + describe 'minimal config' do + before(:all) do + @tmpdir = default.tmpdir('mysql') + end + let(:pp) do + <<-EOS + class { 'mysql::server': + config_file => '#{@tmpdir}/my.cnf', + includedir => '#{@tmpdir}/include', + manage_config_file => 'false', + override_options => { 'mysqld' => { 'key_buffer_size' => '32M' }}, + package_ensure => 'present', + purge_conf_dir => 'false', + remove_default_accounts => 'false', + restart => 'false', + root_group => 'root', + root_password => 'test', + service_enabled => 'false', + service_manage => 'false', + users => {}, + grants => {}, + databases => {}, + } + EOS + end + + it_behaves_like "a idempotent resource" + end + + describe 'syslog configuration' do + let(:pp) do + <<-EOS + class { 'mysql::server': + override_options => { 'mysqld' => { 'log-error' => undef }, 'mysqld_safe' => { 'log-error' => false, 'syslog' => true }}, + } + EOS + end + + it_behaves_like "a idempotent resource" + end + + context 'when changing the password' do + let(:password) { 'THE NEW SECRET' } + let(:pp) { "class { 'mysql::server': root_password => '#{password}' }" } + + it 'should not display the password' do + result = apply_manifest(pp, :catch_failures => true) + # this does not actually prove anything, as show_diff in the puppet config defaults to false. + expect(result.stdout).not_to match /#{password}/ + end + + it_behaves_like "a idempotent resource" + end +end diff --git a/environments/production/modules/mysql/spec/acceptance/nodesets/centos-7-x64.yml b/environments/production/modules/mysql/spec/acceptance/nodesets/centos-7-x64.yml new file mode 100644 index 0000000..5eebdef --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/nodesets/centos-7-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + centos-7-x64: + roles: + - agent + - default + platform: el-7-x86_64 + hypervisor: vagrant + box: puppetlabs/centos-7.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/mysql/spec/acceptance/nodesets/debian-8-x64.yml b/environments/production/modules/mysql/spec/acceptance/nodesets/debian-8-x64.yml new file mode 100644 index 0000000..fef6e63 --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/nodesets/debian-8-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + debian-8-x64: + roles: + - agent + - default + platform: debian-8-amd64 + hypervisor: vagrant + box: puppetlabs/debian-8.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/mysql/spec/acceptance/nodesets/default.yml b/environments/production/modules/mysql/spec/acceptance/nodesets/default.yml new file mode 100644 index 0000000..dba339c --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/nodesets/default.yml @@ -0,0 +1,10 @@ +HOSTS: + ubuntu-1404-x64: + roles: + - agent + - default + platform: ubuntu-14.04-amd64 + hypervisor: vagrant + box: puppetlabs/ubuntu-14.04-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/mysql/spec/acceptance/nodesets/docker/centos-7.yml b/environments/production/modules/mysql/spec/acceptance/nodesets/docker/centos-7.yml new file mode 100644 index 0000000..a3333aa --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/nodesets/docker/centos-7.yml @@ -0,0 +1,12 @@ +HOSTS: + centos-7-x64: + platform: el-7-x86_64 + hypervisor: docker + image: centos:7 + docker_preserve_image: true + docker_cmd: '["/usr/sbin/init"]' + # install various tools required to get the image up to usable levels + docker_image_commands: + - 'yum install -y crontabs tar wget openssl sysvinit-tools iproute which initscripts' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/mysql/spec/acceptance/nodesets/docker/debian-8.yml b/environments/production/modules/mysql/spec/acceptance/nodesets/docker/debian-8.yml new file mode 100644 index 0000000..df5c319 --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/nodesets/docker/debian-8.yml @@ -0,0 +1,11 @@ +HOSTS: + debian-8-x64: + platform: debian-8-amd64 + hypervisor: docker + image: debian:8 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get update && apt-get install -y net-tools wget locales strace lsof && echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/mysql/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/environments/production/modules/mysql/spec/acceptance/nodesets/docker/ubuntu-14.04.yml new file mode 100644 index 0000000..b1efa58 --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/nodesets/docker/ubuntu-14.04.yml @@ -0,0 +1,12 @@ +HOSTS: + ubuntu-1404-x64: + platform: ubuntu-14.04-amd64 + hypervisor: docker + image: ubuntu:14.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + # ensure that upstart is booting correctly in the container + - 'rm /usr/sbin/policy-rc.d && rm /sbin/initctl && dpkg-divert --rename --remove /sbin/initctl && apt-get update && apt-get install -y net-tools wget && locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/mysql/spec/acceptance/types/mysql_database_spec.rb b/environments/production/modules/mysql/spec/acceptance/types/mysql_database_spec.rb new file mode 100644 index 0000000..b19026d --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/types/mysql_database_spec.rb @@ -0,0 +1,64 @@ +require 'spec_helper_acceptance' + +describe 'mysql_database' do + describe 'setup' do + it 'should work with no errors' do + pp = <<-EOS + class { 'mysql::server': } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + + describe 'creating database' do + it 'should work without errors' do + pp = <<-EOS + mysql_database { 'spec_db': + ensure => present, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the database' do + shell("mysql -NBe \"SHOW DATABASES LIKE 'spec_db'\"") do |r| + expect(r.stdout).to match(/^spec_db$/) + expect(r.stderr).to be_empty + end + end + end + + describe 'charset and collate' do + it 'should create two db of different types idempotently' do + pp = <<-EOS + mysql_database { 'spec_latin1': + charset => 'latin1', + collate => 'latin1_swedish_ci', + } + mysql_database { 'spec_utf8': + charset => 'utf8', + collate => 'utf8_general_ci', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + it 'should find latin1 db' do + shell("mysql -NBe \"SHOW VARIABLES LIKE '%_database'\" spec_latin1") do |r| + expect(r.stdout).to match(/^character_set_database\tlatin1\ncollation_database\tlatin1_swedish_ci$/) + expect(r.stderr).to be_empty + end + end + + it 'should find utf8 db' do + shell("mysql -NBe \"SHOW VARIABLES LIKE '%_database'\" spec_utf8") do |r| + expect(r.stdout).to match(/^character_set_database\tutf8\ncollation_database\tutf8_general_ci$/) + expect(r.stderr).to be_empty + end + end + end +end diff --git a/environments/production/modules/mysql/spec/acceptance/types/mysql_grant_spec.rb b/environments/production/modules/mysql/spec/acceptance/types/mysql_grant_spec.rb new file mode 100644 index 0000000..ccf2b27 --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/types/mysql_grant_spec.rb @@ -0,0 +1,578 @@ +require 'spec_helper_acceptance' +require 'puppet' +require 'puppet/util/package' +require_relative '../mysql_helper.rb' + +describe 'mysql_grant' do + before(:all) do + pp = <<-EOS + class { 'mysql::server': + root_password => 'password', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + describe 'missing privileges for user' do + it 'should fail' do + pp = <<-EOS + mysql_user { 'test1@tester': + ensure => present, + } + mysql_grant { 'test1@tester/test.*': + ensure => 'present', + table => 'test.*', + user => 'test1@tester', + require => Mysql_user['test1@tester'], + } + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/privileges parameter is required/) + end + + it 'should not find the user' do + expect(shell("mysql -NBe \"SHOW GRANTS FOR test1@tester\"", { :acceptable_exit_codes => 1}).stderr).to match(/There is no such grant defined for user 'test1' on host 'tester'/) + end + end + + describe 'missing table for user' do + it 'should fail' do + pp = <<-EOS + mysql_user { 'atest@tester': + ensure => present, + } + mysql_grant { 'atest@tester/test.*': + ensure => 'present', + user => 'atest@tester', + privileges => ['ALL'], + require => Mysql_user['atest@tester'], + } + EOS + + apply_manifest(pp, :expect_failures => true) + end + + it 'should not find the user' do + expect(shell("mysql -NBe \"SHOW GRANTS FOR atest@tester\"", {:acceptable_exit_codes => 1}).stderr).to match(/There is no such grant defined for user 'atest' on host 'tester'/) + end + end + + describe 'adding privileges' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'test2@tester': + ensure => present, + } + mysql_grant { 'test2@tester/test.*': + ensure => 'present', + table => 'test.*', + user => 'test2@tester', + privileges => ['SELECT', 'UPDATE'], + require => Mysql_user['test2@tester'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"SHOW GRANTS FOR test2@tester\"") do |r| + expect(r.stdout).to match(/GRANT SELECT, UPDATE.*TO 'test2'@'tester'/) + expect(r.stderr).to be_empty + end + end + end + + describe 'adding privileges with special character in name' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'test-2@tester': + ensure => present, + } + mysql_grant { 'test-2@tester/test.*': + ensure => 'present', + table => 'test.*', + user => 'test-2@tester', + privileges => ['SELECT', 'UPDATE'], + require => Mysql_user['test-2@tester'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"SHOW GRANTS FOR 'test-2'@tester\"") do |r| + expect(r.stdout).to match(/GRANT SELECT, UPDATE.*TO 'test-2'@'tester'/) + expect(r.stderr).to be_empty + end + end + end + + describe 'adding privileges with invalid name' do + it 'should fail' do + pp = <<-EOS + mysql_user { 'test2@tester': + ensure => present, + } + mysql_grant { 'test': + ensure => 'present', + table => 'test.*', + user => 'test2@tester', + privileges => ['SELECT', 'UPDATE'], + require => Mysql_user['test2@tester'], + } + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/name must match user and table parameters/) + end + end + + describe 'adding option' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'test3@tester': + ensure => present, + } + mysql_grant { 'test3@tester/test.*': + ensure => 'present', + table => 'test.*', + user => 'test3@tester', + options => ['GRANT'], + privileges => ['SELECT', 'UPDATE'], + require => Mysql_user['test3@tester'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"SHOW GRANTS FOR test3@tester\"") do |r| + expect(r.stdout).to match(/GRANT SELECT, UPDATE ON `test`.* TO 'test3'@'tester' WITH GRANT OPTION$/) + expect(r.stderr).to be_empty + end + end + end + + describe 'adding all privileges without table' do + it 'should fail' do + pp = <<-EOS + mysql_user { 'test4@tester': + ensure => present, + } + mysql_grant { 'test4@tester/test.*': + ensure => 'present', + user => 'test4@tester', + options => ['GRANT'], + privileges => ['SELECT', 'UPDATE', 'ALL'], + require => Mysql_user['test4@tester'], + } + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/table parameter is required./) + end + end + + describe 'adding all privileges' do + it 'should only try to apply ALL' do + pp = <<-EOS + mysql_user { 'test4@tester': + ensure => present, + } + mysql_grant { 'test4@tester/test.*': + ensure => 'present', + table => 'test.*', + user => 'test4@tester', + options => ['GRANT'], + privileges => ['SELECT', 'UPDATE', 'ALL'], + require => Mysql_user['test4@tester'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"SHOW GRANTS FOR test4@tester\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test4'@'tester' WITH GRANT OPTION/) + expect(r.stderr).to be_empty + end + end + end + + # Test combinations of user@host to ensure all cases work. + describe 'short hostname' do + it 'should apply' do + pp = <<-EOS + mysql_user { 'test@short': + ensure => present, + } + mysql_grant { 'test@short/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@short', + privileges => 'ALL', + require => Mysql_user['test@short'], + } + mysql_user { 'test@long.hostname.com': + ensure => present, + } + mysql_grant { 'test@long.hostname.com/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@long.hostname.com', + privileges => 'ALL', + require => Mysql_user['test@long.hostname.com'], + } + mysql_user { 'test@192.168.5.6': + ensure => present, + } + mysql_grant { 'test@192.168.5.6/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@192.168.5.6', + privileges => 'ALL', + require => Mysql_user['test@192.168.5.6'], + } + mysql_user { 'test@2607:f0d0:1002:0051:0000:0000:0000:0004': + ensure => present, + } + mysql_grant { 'test@2607:f0d0:1002:0051:0000:0000:0000:0004/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@2607:f0d0:1002:0051:0000:0000:0000:0004', + privileges => 'ALL', + require => Mysql_user['test@2607:f0d0:1002:0051:0000:0000:0000:0004'], + } + mysql_user { 'test@::1/128': + ensure => present, + } + mysql_grant { 'test@::1/128/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@::1/128', + privileges => 'ALL', + require => Mysql_user['test@::1/128'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'finds short hostname' do + shell("mysql -NBe \"SHOW GRANTS FOR test@short\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test'@'short'/) + expect(r.stderr).to be_empty + end + end + it 'finds long hostname' do + shell("mysql -NBe \"SHOW GRANTS FOR 'test'@'long.hostname.com'\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test'@'long.hostname.com'/) + expect(r.stderr).to be_empty + end + end + it 'finds ipv4' do + shell("mysql -NBe \"SHOW GRANTS FOR 'test'@'192.168.5.6'\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test'@'192.168.5.6'/) + expect(r.stderr).to be_empty + end + end + it 'finds ipv6' do + shell("mysql -NBe \"SHOW GRANTS FOR 'test'@'2607:f0d0:1002:0051:0000:0000:0000:0004'\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test'@'2607:f0d0:1002:0051:0000:0000:0000:0004'/) + expect(r.stderr).to be_empty + end + end + it 'finds short ipv6' do + shell("mysql -NBe \"SHOW GRANTS FOR 'test'@'::1/128'\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test'@'::1\/128'/) + expect(r.stderr).to be_empty + end + end + end + + describe 'complex test' do + it 'setup mysql::server' do + pp = <<-EOS + $dbSubnet = '10.10.10.%' + + mysql_database { 'foo': + ensure => present, + } + + exec { 'mysql-create-table': + command => '/usr/bin/mysql -NBe "CREATE TABLE foo.bar (name VARCHAR(20))"', + environment => "HOME=${::root_home}", + unless => '/usr/bin/mysql -NBe "SELECT 1 FROM foo.bar LIMIT 1;"', + require => Mysql_database['foo'], + } + + Mysql_grant { + ensure => present, + options => ['GRANT'], + privileges => ['ALL'], + table => '*.*', + require => [ Mysql_database['foo'], Exec['mysql-create-table'] ], + } + + mysql_user { "user1@${dbSubnet}": + ensure => present, + } + mysql_grant { "user1@${dbSubnet}/*.*": + user => "user1@${dbSubnet}", + require => Mysql_user["user1@${dbSubnet}"], + } + mysql_user { "user2@${dbSubnet}": + ensure => present, + } + mysql_grant { "user2@${dbSubnet}/foo.bar": + privileges => ['SELECT', 'INSERT', 'UPDATE'], + user => "user2@${dbSubnet}", + table => 'foo.bar', + require => Mysql_user["user2@${dbSubnet}"], + } + mysql_user { "user3@${dbSubnet}": + ensure => present, + } + mysql_grant { "user3@${dbSubnet}/foo.*": + privileges => ['SELECT', 'INSERT', 'UPDATE'], + user => "user3@${dbSubnet}", + table => 'foo.*', + require => Mysql_user["user3@${dbSubnet}"], + } + mysql_user { 'web@%': + ensure => present, + } + mysql_grant { 'web@%/*.*': + user => 'web@%', + require => Mysql_user['web@%'], + } + mysql_user { "web@${dbSubnet}": + ensure => present, + } + mysql_grant { "web@${dbSubnet}/*.*": + user => "web@${dbSubnet}", + require => Mysql_user["web@${dbSubnet}"], + } + mysql_user { "web@${fqdn}": + ensure => present, + } + mysql_grant { "web@${fqdn}/*.*": + user => "web@${fqdn}", + require => Mysql_user["web@${fqdn}"], + } + mysql_user { 'web@localhost': + ensure => present, + } + mysql_grant { 'web@localhost/*.*': + user => 'web@localhost', + require => Mysql_user['web@localhost'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + end + + describe 'lower case privileges' do + it 'create ALL privs' do + pp = <<-EOS + mysql_user { 'lowercase@localhost': + ensure => present, + } + mysql_grant { 'lowercase@localhost/*.*': + user => 'lowercase@localhost', + privileges => 'ALL', + table => '*.*', + require => Mysql_user['lowercase@localhost'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'create lowercase all privs' do + pp = <<-EOS + mysql_user { 'lowercase@localhost': + ensure => present, + } + mysql_grant { 'lowercase@localhost/*.*': + user => 'lowercase@localhost', + privileges => 'all', + table => '*.*', + require => Mysql_user['lowercase@localhost'], + } + EOS + + expect(apply_manifest(pp, :catch_failures => true).exit_code).to eq(0) + end + end + + describe 'adding procedure privileges' do + it 'should work without errors' do + pp = <<-EOS + if $::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemmajrelease, '16.00') > 0 { + exec { 'simpleproc-create': + command => 'mysql --user="root" --password="password" --database=mysql --delimiter="//" -NBe "CREATE PROCEDURE simpleproc (OUT param1 INT) BEGIN SELECT COUNT(*) INTO param1 FROM t; end//"', + path => '/usr/bin/', + before => Mysql_user['test2@tester'], + } + } + mysql_user { 'test2@tester': + ensure => present, + } + mysql_grant { 'test2@tester/PROCEDURE mysql.simpleproc': + ensure => 'present', + table => 'PROCEDURE mysql.simpleproc', + user => 'test2@tester', + privileges => ['EXECUTE'], + require => Mysql_user['test2@tester'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"SHOW GRANTS FOR test2@tester\"") do |r| + expect(r.stdout).to match(/GRANT EXECUTE ON PROCEDURE `mysql`.`simpleproc` TO 'test2'@'tester'/) + expect(r.stderr).to be_empty + end + end + end + + describe 'grants with skip-name-resolve specified' do + it 'setup mysql::server' do + pp = <<-EOS + class { 'mysql::server': + override_options => { + 'mysqld' => {'skip-name-resolve' => true} + }, + restart => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should apply' do + pp = <<-EOS + mysql_user { 'test@fqdn.com': + ensure => present, + } + mysql_grant { 'test@fqdn.com/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@fqdn.com', + privileges => 'ALL', + require => Mysql_user['test@fqdn.com'], + } + mysql_user { 'test@192.168.5.7': + ensure => present, + } + mysql_grant { 'test@192.168.5.7/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@192.168.5.7', + privileges => 'ALL', + require => Mysql_user['test@192.168.5.7'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should fail with fqdn' do + pre_run + if ! version_is_greater_than('5.7.0') + expect(shell("mysql -NBe \"SHOW GRANTS FOR test@fqdn.com\"", { :acceptable_exit_codes => 1}).stderr).to match(/There is no such grant defined for user 'test' on host 'fqdn.com'/) + end + end + it 'finds ipv4' do + shell("mysql -NBe \"SHOW GRANTS FOR 'test'@'192.168.5.7'\"") do |r| + expect(r.stdout).to match(/GRANT ALL PRIVILEGES ON `test`.* TO 'test'@'192.168.5.7'/) + expect(r.stderr).to be_empty + end + end + + it 'should fail to execute while applying' do + pp = <<-EOS + mysql_user { 'test@fqdn.com': + ensure => present, + } + mysql_grant { 'test@fqdn.com/test.*': + ensure => 'present', + table => 'test.*', + user => 'test@fqdn.com', + privileges => 'ALL', + require => Mysql_user['test@fqdn.com'], + } + EOS + + mysql_cmd = shell('which mysql').stdout.chomp + shell("mv #{mysql_cmd} #{mysql_cmd}.bak") + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Command mysql is missing/) + shell("mv #{mysql_cmd}.bak #{mysql_cmd}") + end + + it 'reset mysql::server config' do + pp = <<-EOS + class { 'mysql::server': + restart => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + + describe 'adding privileges to specific table' do + # Using puppet_apply as a helper + it 'setup mysql server' do + pp = <<-EOS + class { 'mysql::server': override_options => { 'root_password' => 'password' } } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'creates grant on missing table will fail' do + pp = <<-EOS + mysql_user { 'test@localhost': + ensure => present, + } + mysql_grant { 'test@localhost/grant_spec_db.grant_spec_table': + user => 'test@localhost', + privileges => ['SELECT'], + table => 'grant_spec_db.grant_spec_table', + require => Mysql_user['test@localhost'], + } + EOS + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Table 'grant_spec_db\.grant_spec_table' doesn't exist/) + end + + it 'creates table' do + pp = <<-EOS + file { '/tmp/grant_spec_table.sql': + ensure => file, + content => 'CREATE TABLE grant_spec_table (id int);', + before => Mysql::Db['grant_spec_db'], + } + mysql::db { 'grant_spec_db': + user => 'root1', + password => 'password', + sql => '/tmp/grant_spec_table.sql', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should have the table' do + expect(shell("mysql -e 'show tables;' grant_spec_db|grep grant_spec_table").exit_code).to be_zero + end + end +end diff --git a/environments/production/modules/mysql/spec/acceptance/types/mysql_plugin_spec.rb b/environments/production/modules/mysql/spec/acceptance/types/mysql_plugin_spec.rb new file mode 100644 index 0000000..538b67c --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/types/mysql_plugin_spec.rb @@ -0,0 +1,76 @@ +require 'spec_helper_acceptance' + +# Different operating systems (and therefore different versions/forks +# of mysql) have varying levels of support for plugins and have +# different plugins available. Choose a plugin that works or don't try +# to test plugins if not available. +if fact('osfamily') =~ /RedHat/ + if fact('operatingsystemrelease') =~ /^5\./ + plugin = nil # Plugins not supported on mysql on RHEL 5 + elsif fact('operatingsystemrelease') =~ /^6\./ + plugin = 'example' + plugin_lib = 'ha_example.so' + elsif fact('operatingsystemrelease') =~ /^7\./ + plugin = 'pam' + plugin_lib = 'auth_pam.so' + end +elsif fact('osfamily') =~ /Debian/ + if fact('operatingsystem') =~ /Debian/ + if fact('operatingsystemrelease') =~ /^6\./ + # Only available plugin is innodb which is already loaded and not unload- or reload-able + plugin = nil + elsif fact('operatingsystemrelease') =~ /^7\./ + plugin = 'example' + plugin_lib = 'ha_example.so' + end + elsif fact('operatingsystem') =~ /Ubuntu/ + if fact('operatingsystemrelease') =~ /^10\.04/ + # Only available plugin is innodb which is already loaded and not unload- or reload-able + plugin = nil + elsif fact('operatingsystemrelease') =~ /^16\.04/ + # On Xenial running 5.7.12, the example plugin does not appear to be available. + plugin = 'validate_password' + plugin_lib = 'validate_password.so' + else + plugin = 'example' + plugin_lib = 'ha_example.so' + end + end +elsif fact('osfamily') =~ /Suse/ + plugin = nil # Plugin library path is broken on Suse http://lists.opensuse.org/opensuse-bugs/2013-08/msg01123.html +end + +describe 'mysql_plugin' do + if plugin # if plugins are supported + describe 'setup' do + it 'should work with no errors' do + pp = <<-EOS + class { 'mysql::server': } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + + describe 'load plugin' do + it 'should work without errors' do + pp = <<-EOS + mysql_plugin { #{plugin}: + ensure => present, + soname => '#{plugin_lib}', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the plugin' do + shell("mysql -NBe \"select plugin_name from information_schema.plugins where plugin_name='#{plugin}'\"") do |r| + expect(r.stdout).to match(/^#{plugin}$/i) + expect(r.stderr).to be_empty + end + end + end + end + +end diff --git a/environments/production/modules/mysql/spec/acceptance/types/mysql_user_spec.rb b/environments/production/modules/mysql/spec/acceptance/types/mysql_user_spec.rb new file mode 100644 index 0000000..c91f65a --- /dev/null +++ b/environments/production/modules/mysql/spec/acceptance/types/mysql_user_spec.rb @@ -0,0 +1,146 @@ +require 'spec_helper_acceptance' + +describe 'mysql_user' do + describe 'setup' do + it 'should work with no errors' do + pp = <<-EOS + class { 'mysql::server': } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + + context 'using ashp@localhost' do + describe 'adding user' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'ashp@localhost': + password_hash => '*F9A8E96790775D196D12F53BCC88B8048FF62ED5', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"select '1' from mysql.user where CONCAT(user, '@', host) = 'ashp@localhost'\"") do |r| + expect(r.stdout).to match(/^1$/) + expect(r.stderr).to be_empty + end + end + it 'has no SSL options' do + shell("mysql -NBe \"select SSL_TYPE from mysql.user where CONCAT(user, '@', host) = 'ashp@localhost'\"") do |r| + expect(r.stdout).to match(/^\s*$/) + expect(r.stderr).to be_empty + end + end + end + end + + context 'using ashp-dash@localhost' do + describe 'adding user' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'ashp-dash@localhost': + password_hash => '*F9A8E96790775D196D12F53BCC88B8048FF62ED5', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"select '1' from mysql.user where CONCAT(user, '@', host) = 'ashp-dash@localhost'\"") do |r| + expect(r.stdout).to match(/^1$/) + expect(r.stderr).to be_empty + end + end + end + end + + context 'using ashp@LocalHost' do + describe 'adding user' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'ashp@LocalHost': + password_hash => '*F9A8E96790775D196D12F53BCC88B8048FF62ED5', + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"select '1' from mysql.user where CONCAT(user, '@', host) = 'ashp@localhost'\"") do |r| + expect(r.stdout).to match(/^1$/) + expect(r.stderr).to be_empty + end + end + end + end + context 'using resource should throw no errors' do + describe 'find users' do + it { + on default, puppet('resource mysql_user'), {:catch_failures => true} do |r| + expect(r.stdout).to_not match(/Error:/) + expect(r.stdout).to_not match(/must be properly quoted, invalid character:/) + end + } + end + end + context 'using user-w-ssl@localhost with SSL' do + describe 'adding user' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'user-w-ssl@localhost': + password_hash => '*F9A8E96790775D196D12F53BCC88B8048FF62ED5', + tls_options => ['SSL'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"select '1' from mysql.user where CONCAT(user, '@', host) = 'user-w-ssl@localhost'\"") do |r| + expect(r.stdout).to match(/^1$/) + expect(r.stderr).to be_empty + end + end + it 'should show correct ssl_type' do + shell("mysql -NBe \"select SSL_TYPE from mysql.user where CONCAT(user, '@', host) = 'user-w-ssl@localhost'\"") do |r| + expect(r.stdout).to match(/^ANY$/) + expect(r.stderr).to be_empty + end + end + end + end + context 'using user-w-x509@localhost with X509' do + describe 'adding user' do + it 'should work without errors' do + pp = <<-EOS + mysql_user { 'user-w-x509@localhost': + password_hash => '*F9A8E96790775D196D12F53BCC88B8048FF62ED5', + tls_options => ['X509'], + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should find the user' do + shell("mysql -NBe \"select '1' from mysql.user where CONCAT(user, '@', host) = 'user-w-x509@localhost'\"") do |r| + expect(r.stdout).to match(/^1$/) + expect(r.stderr).to be_empty + end + end + it 'should show correct ssl_type' do + shell("mysql -NBe \"select SSL_TYPE from mysql.user where CONCAT(user, '@', host) = 'user-w-x509@localhost'\"") do |r| + expect(r.stdout).to match(/^X509$/) + expect(r.stderr).to be_empty + end + end + end + end +end diff --git a/environments/production/modules/mysql/spec/classes/graceful_failures_spec.rb b/environments/production/modules/mysql/spec/classes/graceful_failures_spec.rb new file mode 100644 index 0000000..9fb8117 --- /dev/null +++ b/environments/production/modules/mysql/spec/classes/graceful_failures_spec.rb @@ -0,0 +1,19 @@ +require 'spec_helper' + +describe 'mysql::server' do + context "on an unsupported OS" do + # fetch any sets of facts to modify them + os, facts = on_supported_os.first + + let(:facts) { + facts.merge({ + :osfamily => 'UNSUPPORTED', + :operatingsystem => 'UNSUPPORTED', + }) + } + + it 'should gracefully fail' do + is_expected.to compile.and_raise_error(/Unsupported platform:/) + end + end +end diff --git a/environments/production/modules/mysql/spec/classes/mycnf_template_spec.rb b/environments/production/modules/mysql/spec/classes/mycnf_template_spec.rb new file mode 100644 index 0000000..9c0c433 --- /dev/null +++ b/environments/production/modules/mysql/spec/classes/mycnf_template_spec.rb @@ -0,0 +1,86 @@ +require 'spec_helper' + +describe 'mysql::server' do + context 'my.cnf template' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + context 'normal entry' do + let(:params) {{ :override_options => { 'mysqld' => { 'socket' => '/var/lib/mysql/mysql.sock' } } }} + it do + is_expected.to contain_file('mysql-config-file').with({ + :mode => '0644', + :selinux_ignore_defaults => true, + }).with_content(/socket = \/var\/lib\/mysql\/mysql.sock/) + end + end + + describe 'array entry' do + let(:params) {{ :override_options => { 'mysqld' => { 'replicate-do-db' => ['base1', 'base2'], } }}} + it do + is_expected.to contain_file('mysql-config-file').with_content( + /.*replicate-do-db = base1\nreplicate-do-db = base2.*/ + ) + end + end + + describe 'skip-name-resolve set to an empty string' do + let(:params) {{ :override_options => { 'mysqld' => { 'skip-name-resolve' => '' }}}} + it { is_expected.to contain_file('mysql-config-file').with_content(/^skip-name-resolve$/) } + end + + describe 'ssl set to true' do + let(:params) {{ :override_options => { 'mysqld' => { 'ssl' => true }}}} + it { is_expected.to contain_file('mysql-config-file').with_content(/ssl/) } + it { is_expected.to contain_file('mysql-config-file').without_content(/ssl = true/) } + end + + describe 'ssl set to false' do + let(:params) {{ :override_options => { 'mysqld' => { 'ssl' => false }}}} + it { is_expected.to contain_file('mysql-config-file').with_content(/ssl = false/) } + end + + # ssl-disable (and ssl) are special cased within mysql. + describe 'possibility of disabling ssl completely' do + let(:params) {{ :override_options => { 'mysqld' => { 'ssl' => true, 'ssl-disable' => true }}}} + it { is_expected.to contain_file('mysql-config-file').without_content(/ssl = true/) } + end + + describe 'a non ssl option set to true' do + let(:params) {{ :override_options => { 'mysqld' => { 'test' => true }}}} + it { is_expected.to contain_file('mysql-config-file').with_content(/^test$/) } + it { is_expected.to contain_file('mysql-config-file').without_content(/test = true/) } + end + + context 'with includedir' do + let(:params) {{ :includedir => '/etc/my.cnf.d' }} + it 'makes the directory' do + is_expected.to contain_file('/etc/my.cnf.d').with({ + :ensure => :directory, + :mode => '0755', + }) + end + + it { is_expected.to contain_file('mysql-config-file').with_content(/!includedir/) } + end + + context 'without includedir' do + let(:params) {{ :includedir => '' }} + it 'shouldnt contain the directory' do + is_expected.not_to contain_file('mysql-config-file').with({ + :ensure => :directory, + :mode => '0755', + }) + end + + it { is_expected.to contain_file('mysql-config-file').without_content(/!includedir/) } + end + end + end + end +end diff --git a/environments/production/modules/mysql/spec/classes/mysql_bindings_spec.rb b/environments/production/modules/mysql/spec/classes/mysql_bindings_spec.rb new file mode 100644 index 0000000..066e876 --- /dev/null +++ b/environments/production/modules/mysql/spec/classes/mysql_bindings_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +describe 'mysql::bindings' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + let(:params) {{ + 'java_enable' => true, + 'perl_enable' => true, + 'php_enable' => true, + 'python_enable' => true, + 'ruby_enable' => true, + 'client_dev' => true, + 'daemon_dev' => true, + 'client_dev_package_name' => 'libmysqlclient-devel', + 'daemon_dev_package_name' => 'mysql-devel', + }} + + it { is_expected.to contain_package('mysql-connector-java') } + it { is_expected.to contain_package('perl_mysql') } + it { is_expected.to contain_package('python-mysqldb') } + it { is_expected.to contain_package('ruby_mysql') } + it { is_expected.to contain_package('mysql-client_dev') } + it { is_expected.to contain_package('mysql-daemon_dev') } + end + end +end diff --git a/environments/production/modules/mysql/spec/classes/mysql_client_spec.rb b/environments/production/modules/mysql/spec/classes/mysql_client_spec.rb new file mode 100644 index 0000000..fdbcc19 --- /dev/null +++ b/environments/production/modules/mysql/spec/classes/mysql_client_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'mysql::client' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + context 'with defaults' do + it { is_expected.not_to contain_class('mysql::bindings') } + it { is_expected.to contain_package('mysql_client') } + end + + context 'with bindings enabled' do + let(:params) {{ :bindings_enable => true }} + + it { is_expected.to contain_class('mysql::bindings') } + it { is_expected.to contain_package('mysql_client') } + end + + context 'with package_manage set to true' do + let(:params) {{ :package_manage => true }} + + it { is_expected.to contain_package('mysql_client') } + end + + context 'with package_manage set to false' do + let(:params) {{ :package_manage => false }} + + it { is_expected.not_to contain_package('mysql_client') } + end + + end + end +end diff --git a/environments/production/modules/mysql/spec/classes/mysql_server_account_security_spec.rb b/environments/production/modules/mysql/spec/classes/mysql_server_account_security_spec.rb new file mode 100644 index 0000000..d45c46e --- /dev/null +++ b/environments/production/modules/mysql/spec/classes/mysql_server_account_security_spec.rb @@ -0,0 +1,86 @@ +require 'spec_helper' + +describe 'mysql::server::account_security' do + on_supported_os.each do |os, facts| + context "on #{os}" do + context "with fqdn==myhost.mydomain" do + let(:facts) { + facts.merge({ + :root_home => '/root', + :fqdn => 'myhost.mydomain', + :hostname => 'myhost', + }) + } + + [ 'root@myhost.mydomain', + 'root@127.0.0.1', + 'root@::1', + '@myhost.mydomain', + '@localhost', + '@%', + ].each do |user| + it "removes Mysql_User[#{user}]" do + is_expected.to contain_mysql_user(user).with_ensure('absent') + end + end + + # When the hostname doesn't match the fqdn we also remove these. + # We don't need to test the inverse as when they match they are + # covered by the above list. + [ 'root@myhost', '@myhost' ].each do |user| + it "removes Mysql_User[#{user}]" do + is_expected.to contain_mysql_user(user).with_ensure('absent') + end + end + + it 'should remove Mysql_database[test]' do + is_expected.to contain_mysql_database('test').with_ensure('absent') + end + end + + context "with fqdn==localhost" do + let(:facts) { + facts.merge({ + :root_home => '/root', + :fqdn => 'localhost', + :hostname => 'localhost', + }) + } + + [ 'root@127.0.0.1', + 'root@::1', + '@localhost', + 'root@localhost.localdomain', + '@localhost.localdomain', + '@%', + ].each do |user| + it "removes Mysql_User[#{user}]" do + is_expected.to contain_mysql_user(user).with_ensure('absent') + end + end + end + + context "with fqdn==localhost.localdomain" do + let(:facts) { + facts.merge({ + :root_home => '/root', + :fqdn => 'localhost.localdomain', + :hostname => 'localhost', + }) + } + + [ 'root@127.0.0.1', + 'root@::1', + '@localhost', + 'root@localhost.localdomain', + '@localhost.localdomain', + '@%', + ].each do |user| + it "removes Mysql_User[#{user}]" do + is_expected.to contain_mysql_user(user).with_ensure('absent') + end + end + end + end + end +end diff --git a/environments/production/modules/mysql/spec/classes/mysql_server_backup_spec.rb b/environments/production/modules/mysql/spec/classes/mysql_server_backup_spec.rb new file mode 100644 index 0000000..96cfdf4 --- /dev/null +++ b/environments/production/modules/mysql/spec/classes/mysql_server_backup_spec.rb @@ -0,0 +1,407 @@ +require 'spec_helper' + +describe 'mysql::server::backup' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + let(:default_params) { + { 'backupuser' => 'testuser', + 'backuppassword' => 'testpass', + 'maxallowedpacket' => '1M', + 'backupdir' => '/tmp', + 'backuprotate' => '25', + 'delete_before_dump' => true, + 'execpath' => '/usr/bin:/usr/sbin:/bin:/sbin:/opt/zimbra/bin', + 'maxallowedpacket' => '1M', + } + } + + context 'standard conditions' do + let(:params) { default_params } + + # Cannot use that_requires here, doesn't work on classes. + it { is_expected.to contain_mysql_user('testuser@localhost').with( + :require => 'Class[Mysql::Server::Root_password]') } + + it { is_expected.to contain_mysql_grant('testuser@localhost/*.*').with( + :privileges => ['SELECT', 'RELOAD', 'LOCK TABLES', 'SHOW VIEW', 'PROCESS'] + ).that_requires('Mysql_user[testuser@localhost]') } + + context 'with triggers included' do + let(:params) do + { :include_triggers => true }.merge(default_params) + end + it { is_expected.to contain_mysql_grant('testuser@localhost/*.*').with( + :privileges => ['SELECT', 'RELOAD', 'LOCK TABLES', 'SHOW VIEW', 'PROCESS', 'TRIGGER'] + ).that_requires('Mysql_user[testuser@localhost]') } + end + + it { is_expected.to contain_cron('mysql-backup').with( + :command => '/usr/local/sbin/mysqlbackup.sh', + :ensure => 'present' + )} + + it { is_expected.to contain_file('mysqlbackup.sh').with( + :path => '/usr/local/sbin/mysqlbackup.sh', + :ensure => 'present' + ) } + + it { is_expected.to contain_file('mysqlbackupdir').with( + :path => '/tmp', + :ensure => 'directory' + )} + + it 'should have compression by default' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /bzcat -zc/ + ) + end + + it 'should skip backing up events table by default' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="--ignore-table=mysql.event"/ + ) + end + + it 'should not mention triggers by default because file_per_database is false' do + is_expected.to contain_file('mysqlbackup.sh').without_content( + /.*triggers.*/ + ) + end + + it 'should not mention routines by default because file_per_database is false' do + is_expected.to contain_file('mysqlbackup.sh').without_content( + /.*routines.*/ + ) + end + + it 'should have 25 days of rotation' do + # MySQL counts from 0 + is_expected.to contain_file('mysqlbackup.sh').with_content(/.*ROTATE=24.*/) + end + + it 'should have a standard PATH' do + is_expected.to contain_file('mysqlbackup.sh').with_content(%r{PATH=/usr/bin:/usr/sbin:/bin:/sbin:/opt/zimbra/bin}) + end + end + + context 'custom ownership and mode for backupdir' do + let(:params) do + { :backupdirmode => '0750', + :backupdirowner => 'testuser', + :backupdirgroup => 'testgrp', + }.merge(default_params) + end + + it { is_expected.to contain_file('mysqlbackupdir').with( + :path => '/tmp', + :ensure => 'directory', + :mode => '0750', + :owner => 'testuser', + :group => 'testgrp' + ) } + end + + context 'with compression disabled' do + let(:params) do + { :backupcompress => false }.merge(default_params) + end + + it { is_expected.to contain_file('mysqlbackup.sh').with( + :path => '/usr/local/sbin/mysqlbackup.sh', + :ensure => 'present' + ) } + + it 'should be able to disable compression' do + is_expected.to contain_file('mysqlbackup.sh').without_content( + /.*bzcat -zc.*/ + ) + end + end + + context 'with mysql.events backedup' do + let(:params) do + { :ignore_events => false }.merge(default_params) + end + + it { is_expected.to contain_file('mysqlbackup.sh').with( + :path => '/usr/local/sbin/mysqlbackup.sh', + :ensure => 'present' + ) } + + it 'should be able to backup events table' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="--events"/ + ) + end + end + + context 'with database list specified' do + let(:params) do + { :backupdatabases => ['mysql'] }.merge(default_params) + end + + it { is_expected.to contain_file('mysqlbackup.sh').with( + :path => '/usr/local/sbin/mysqlbackup.sh', + :ensure => 'present' + ) + } + + it 'should have a backup file for each database' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /mysql | bzcat -zc \${DIR}\\\${PREFIX}mysql_`date'/ + ) + end + + it 'should skip backup triggers by default' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-triggers"/ + ) + end + + it 'should skip backing up routines by default' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-routines"/ + ) + end + + context 'with include_triggers set to true' do + let(:params) do + default_params.merge({ + :backupdatabases => ['mysql'], + :include_triggers => true + }) + end + + it 'should backup triggers when asked' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --triggers"/ + ) + end + end + + context 'with include_triggers set to false' do + let(:params) do + default_params.merge({ + :backupdatabases => ['mysql'], + :include_triggers => false + }) + end + + it 'should skip backing up triggers when asked to skip' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-triggers"/ + ) + end + end + + context 'with include_routines set to true' do + let(:params) do + default_params.merge({ + :backupdatabases => ['mysql'], + :include_routines => true + }) + end + + it 'should backup routines when asked' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --routines"/ + ) + end + end + + context 'with include_routines set to false' do + let(:params) do + default_params.merge({ + :backupdatabases => ['mysql'], + :include_triggers => true + }) + end + + it 'should skip backing up routines when asked to skip' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-routines"/ + ) + end + end + end + + context 'with file per database' do + let(:params) do + default_params.merge({ :file_per_database => true }) + end + + it 'should loop through backup all databases' do + is_expected.to contain_file('mysqlbackup.sh').with_content(/.*SHOW DATABASES.*/) + end + + context 'with compression disabled' do + let(:params) do + default_params.merge({ :file_per_database => true, :backupcompress => false }) + end + + it 'should loop through backup all databases without compression' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /.*SHOW DATABASES.*/ + ) + is_expected.to contain_file('mysqlbackup.sh').without_content( + /.*bzcat -zc.*/ + ) + end + end + + it 'should skip backup triggers by default' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-triggers"/ + ) + end + + it 'should skip backing up routines by default' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-routines"/ + ) + end + + context 'with include_triggers set to true' do + let(:params) do + default_params.merge({ + :file_per_database => true, + :include_triggers => true + }) + end + + it 'should backup triggers when asked' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --triggers"/ + ) + end + end + + context 'with include_triggers set to false' do + let(:params) do + default_params.merge({ + :file_per_database => true, + :include_triggers => false + }) + end + + it 'should skip backing up triggers when asked to skip' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-triggers"/ + ) + end + end + + context 'with include_routines set to true' do + let(:params) do + default_params.merge({ + :file_per_database => true, + :include_routines => true + }) + end + + it 'should backup routines when asked' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --routines"/ + ) + end + end + + context 'with include_routines set to false' do + let(:params) do + default_params.merge({ + :file_per_database => true, + :include_triggers => true + }) + end + + it 'should skip backing up routines when asked to skip' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /ADDITIONAL_OPTIONS="\$ADDITIONAL_OPTIONS --skip-routines"/ + ) + end + end + end + + context 'with postscript' do + let(:params) do + default_params.merge({ :postscript => 'rsync -a /tmp backup01.local-lan:' }) + end + + it 'should be add postscript' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /rsync -a \/tmp backup01.local-lan:/ + ) + end + end + + context 'with postscripts' do + let(:params) do + default_params.merge({ :postscript => [ + 'rsync -a /tmp backup01.local-lan:', + 'rsync -a /tmp backup02.local-lan:', + ]}) + end + + it 'should be add postscript' do + is_expected.to contain_file('mysqlbackup.sh').with_content( + /.*rsync -a \/tmp backup01.local-lan:\n\nrsync -a \/tmp backup02.local-lan:.*/ + ) + end + end + + context 'with the xtrabackup provider' do + let(:params) do + default_params.merge({:provider => 'xtrabackup'}) + end + + it 'should contain the wrapper script' do + is_expected.to contain_file('xtrabackup.sh').with_content( + /^innobackupex\s+"\$@"/ + ) + end + + context 'with prescript defined' do + let(:params) do + default_params.merge({ + :provider => 'xtrabackup', + :prescript => [ + 'rsync -a /tmp backup01.local-lan:', + 'rsync -a /tmp backup02.local-lan:', + ] + }) + end + + it 'should contain the prescript' do + is_expected.to contain_file('xtrabackup.sh').with_content( + /.*rsync -a \/tmp backup01.local-lan:\n\nrsync -a \/tmp backup02.local-lan:.*/ + ) + end + end + + context 'with postscript defined' do + let(:params) do + default_params.merge({ + :provider => 'xtrabackup', + :postscript => [ + 'rsync -a /tmp backup01.local-lan:', + 'rsync -a /tmp backup02.local-lan:', + ] + }) + end + + it 'should contain the prostscript' do + is_expected.to contain_file('xtrabackup.sh').with_content( + /.*rsync -a \/tmp backup01.local-lan:\n\nrsync -a \/tmp backup02.local-lan:.*/ + ) + end + end + end + end + end +end diff --git a/environments/production/modules/mysql/spec/classes/mysql_server_monitor_spec.rb b/environments/production/modules/mysql/spec/classes/mysql_server_monitor_spec.rb new file mode 100644 index 0000000..27fab17 --- /dev/null +++ b/environments/production/modules/mysql/spec/classes/mysql_server_monitor_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' +describe 'mysql::server::monitor' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + let :pre_condition do + "include 'mysql::server'" + end + + let :default_params do + { + :mysql_monitor_username => 'monitoruser', + :mysql_monitor_password => 'monitorpass', + :mysql_monitor_hostname => 'monitorhost', + } + end + + let :params do + default_params + end + + it { is_expected.to contain_mysql_user('monitoruser@monitorhost')} + + it { is_expected.to contain_mysql_grant('monitoruser@monitorhost/*.*').with( + :ensure => 'present', + :user => 'monitoruser@monitorhost', + :table => '*.*', + :privileges => ["PROCESS", "SUPER"], + :require => 'Mysql_user[monitoruser@monitorhost]' + )} + end + end +end diff --git a/environments/production/modules/mysql/spec/classes/mysql_server_mysqltuner_spec.rb b/environments/production/modules/mysql/spec/classes/mysql_server_mysqltuner_spec.rb new file mode 100644 index 0000000..4fef3d5 --- /dev/null +++ b/environments/production/modules/mysql/spec/classes/mysql_server_mysqltuner_spec.rb @@ -0,0 +1,46 @@ +require 'spec_helper' + +describe 'mysql::server::mysqltuner' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :staging_http_get => 'curl', + :root_home => '/root', + }) + } + + context 'ensure => present' do + it { is_expected.to compile } + it { is_expected.to contain_staging__file('mysqltuner-v1.3.0').with({ + :source => 'https://github.com/major/MySQLTuner-perl/raw/v1.3.0/mysqltuner.pl', + }) + } + end + + context 'ensure => absent' do + let(:params) {{ :ensure => 'absent' }} + it { is_expected.to compile } + it { is_expected.to contain_file('/usr/local/bin/mysqltuner').with(:ensure => 'absent') } + end + + context 'custom version' do + let(:params) {{ :version => 'v1.2.0' }} + it { is_expected.to compile } + it { is_expected.to contain_staging__file('mysqltuner-v1.2.0').with({ + :source => 'https://github.com/major/MySQLTuner-perl/raw/v1.2.0/mysqltuner.pl', + }) + } + end + + context 'custom source' do + let(:params) {{ :source => '/tmp/foo' }} + it { is_expected.to compile } + it { is_expected.to contain_staging__file('mysqltuner-/tmp/foo').with({ + :source => '/tmp/foo', + }) + } + end + end + end +end diff --git a/environments/production/modules/mysql/spec/classes/mysql_server_spec.rb b/environments/production/modules/mysql/spec/classes/mysql_server_spec.rb new file mode 100644 index 0000000..2a1ca62 --- /dev/null +++ b/environments/production/modules/mysql/spec/classes/mysql_server_spec.rb @@ -0,0 +1,220 @@ +require 'spec_helper' + +describe 'mysql::server' do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + context 'with defaults' do + it { is_expected.to contain_class('mysql::server::install') } + it { is_expected.to contain_class('mysql::server::config') } + it { is_expected.to contain_class('mysql::server::service') } + it { is_expected.to contain_class('mysql::server::root_password') } + it { is_expected.to contain_class('mysql::server::providers') } + end + + context 'with remove_default_accounts set' do + let(:params) {{ :remove_default_accounts => true }} + it { is_expected.to contain_class('mysql::server::account_security') } + end + + context 'when not managing config file' do + let(:params) {{ :manage_config_file => false }} + it { is_expected.to compile.with_all_deps } + end + + context 'when not managing the service' do + let(:params) {{ :service_manage => false }} + it { is_expected.to compile.with_all_deps } + it { is_expected.not_to contain_service('mysqld') } + end + + context 'mysql::server::install' do + it 'contains the package by default' do + is_expected.to contain_package('mysql-server').with({ + :ensure => :present, + }) + end + context 'with package_manage set to true' do + let(:params) {{ :package_manage => true }} + it { is_expected.to contain_package('mysql-server') } + end + context 'with package_manage set to false' do + let(:params) {{ :package_manage => false }} + it { is_expected.not_to contain_package('mysql-server') } + end + context 'with datadir overridden' do + let(:params) {{ :override_options => { 'mysqld' => { 'datadir' => '/tmp' }} }} + it { is_expected.to contain_mysql_datadir('/tmp') } + end + end + + context 'mysql::server::service' do + context 'with defaults' do + it { is_expected.to contain_service('mysqld') } + end + context 'with package_manage set to true' do + let(:params) {{ :package_manage => true }} + it { is_expected.to contain_service('mysqld').that_requires('Package[mysql-server]') } + end + context 'with package_manage set to false' do + let(:params) {{ :package_manage => false }} + it { is_expected.to contain_service('mysqld') } + it { is_expected.not_to contain_service('mysqld').that_requires('Package[mysql-server]') } + end + context 'service_enabled set to false' do + let(:params) {{ :service_enabled => false }} + + it do + is_expected.to contain_service('mysqld').with({ + :ensure => :stopped + }) + end + context 'with package_manage set to true' do + let(:params) {{ :package_manage => true }} + it { is_expected.to contain_package('mysql-server') } + end + context 'with package_manage set to false' do + let(:params) {{ :package_manage => false }} + it { is_expected.not_to contain_package('mysql-server') } + end + context 'with datadir overridden' do + let(:params) {{ :override_options => { 'mysqld' => { 'datadir' => '/tmp' }} }} + it { is_expected.to contain_mysql_datadir('/tmp') } + end + end + context 'with log-error overridden' do + let(:params) {{ :override_options => { 'mysqld' => { 'log-error' => '/tmp/error.log' }} }} + it { is_expected.to contain_file('/tmp/error.log') } + end + end + + context 'mysql::server::root_password' do + describe 'when defaults' do + it { + is_expected.to contain_exec('remove install pass').with( + :command => 'mysqladmin -u root --password=$(grep -o \'[^ ]\\+$\' /.mysql_secret) password \'\' && rm -f /.mysql_secret', + :onlyif => 'test -f /.mysql_secret', + :path => '/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin' + ) + } + it { is_expected.not_to contain_mysql_user('root@localhost') } + it { is_expected.not_to contain_file('/root/.my.cnf') } + end + describe 'when root_password set' do + let(:params) {{:root_password => 'SET' }} + it { is_expected.to contain_mysql_user('root@localhost') } + if Puppet.version.to_f >= 3.0 + it { is_expected.to contain_file('/root/.my.cnf').with(:show_diff => false).that_requires('Mysql_user[root@localhost]') } + else + it { is_expected.to contain_file('/root/.my.cnf').that_requires('Mysql_user[root@localhost]') } + end + end + describe 'when root_password set, create_root_user set to false' do + let(:params) {{ :root_password => 'SET', :create_root_user => false }} + it { is_expected.not_to contain_mysql_user('root@localhost') } + if Puppet.version.to_f >= 3.0 + it { is_expected.to contain_file('/root/.my.cnf').with(:show_diff => false) } + else + it { is_expected.to contain_file('/root/.my.cnf') } + end + end + describe 'when root_password set, create_root_my_cnf set to false' do + let(:params) {{ :root_password => 'SET', :create_root_my_cnf => false }} + it { is_expected.to contain_mysql_user('root@localhost') } + it { is_expected.not_to contain_file('/root/.my.cnf') } + end + describe 'when root_password set, create_root_user and create_root_my_cnf set to false' do + let(:params) {{ :root_password => 'SET', :create_root_user => false, :create_root_my_cnf => false }} + it { is_expected.not_to contain_mysql_user('root@localhost') } + it { is_expected.not_to contain_file('/root/.my.cnf') } + end + describe 'when install_secret_file set to /root/.mysql_secret' do + let(:params) {{ :install_secret_file => '/root/.mysql_secret' }} + it { + is_expected.to contain_exec('remove install pass').with( + :command => 'mysqladmin -u root --password=$(grep -o \'[^ ]\\+$\' /root/.mysql_secret) password \'\' && rm -f /root/.mysql_secret', + :onlyif => 'test -f /root/.mysql_secret' + ) + } + end + end + + context 'mysql::server::providers' do + describe 'with users' do + let(:params) {{:users => { + 'foo@localhost' => { + 'max_connections_per_hour' => '1', + 'max_queries_per_hour' => '2', + 'max_updates_per_hour' => '3', + 'max_user_connections' => '4', + 'password_hash' => '*F3A2A51A9B0F2BE2468926B4132313728C250DBF' + }, + 'foo2@localhost' => {} + }}} + it { is_expected.to contain_mysql_user('foo@localhost').with( + :max_connections_per_hour => '1', + :max_queries_per_hour => '2', + :max_updates_per_hour => '3', + :max_user_connections => '4', + :password_hash => '*F3A2A51A9B0F2BE2468926B4132313728C250DBF' + )} + it { is_expected.to contain_mysql_user('foo2@localhost').with( + :max_connections_per_hour => nil, + :max_queries_per_hour => nil, + :max_updates_per_hour => nil, + :max_user_connections => nil, + :password_hash => nil + )} + end + + describe 'with grants' do + let(:params) {{:grants => { + 'foo@localhost/somedb.*' => { + 'user' => 'foo@localhost', + 'table' => 'somedb.*', + 'privileges' => ["SELECT", "UPDATE"], + 'options' => ["GRANT"], + }, + 'foo2@localhost/*.*' => { + 'user' => 'foo2@localhost', + 'table' => '*.*', + 'privileges' => ["SELECT"], + }, + }}} + it { is_expected.to contain_mysql_grant('foo@localhost/somedb.*').with( + :user => 'foo@localhost', + :table => 'somedb.*', + :privileges => ["SELECT", "UPDATE"], + :options => ["GRANT"] + )} + it { is_expected.to contain_mysql_grant('foo2@localhost/*.*').with( + :user => 'foo2@localhost', + :table => '*.*', + :privileges => ["SELECT"], + :options => nil + )} + end + + describe 'with databases' do + let(:params) {{:databases => { + 'somedb' => { + 'charset' => 'latin1', + 'collate' => 'latin1', + }, + 'somedb2' => {} + }}} + it { is_expected.to contain_mysql_database('somedb').with( + :charset => 'latin1', + :collate => 'latin1' + )} + it { is_expected.to contain_mysql_database('somedb2')} + end + end + end + end +end diff --git a/environments/production/modules/mysql/spec/defines/mysql_db_spec.rb b/environments/production/modules/mysql/spec/defines/mysql_db_spec.rb new file mode 100644 index 0000000..0cd9cb2 --- /dev/null +++ b/environments/production/modules/mysql/spec/defines/mysql_db_spec.rb @@ -0,0 +1,83 @@ +require 'spec_helper' + +describe 'mysql::db', :type => :define do + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts.merge({ + :root_home => '/root', + }) + } + + let(:title) { 'test_db' } + + let(:params) { + { 'user' => 'testuser', + 'password' => 'testpass', + } + } + + it 'should report an error when ensure is not present or absent' do + params.merge!({'ensure' => 'invalid_val'}) + expect { catalogue }.to raise_error(Puppet::Error, + /invalid_val is not supported for ensure\. Allowed values are 'present' and 'absent'\./) + end + + it 'should not notify the import sql exec if no sql script was provided' do + is_expected.to contain_mysql_database('test_db').without_notify + end + + it 'should subscribe to database if sql script is given' do + params.merge!({'sql' => 'test_sql'}) + is_expected.to contain_exec('test_db-import').with_subscribe('Mysql_database[test_db]') + end + + it 'should only import sql script on creation if not enforcing' do + params.merge!({'sql' => 'test_sql', 'enforce_sql' => false}) + is_expected.to contain_exec('test_db-import').with_refreshonly(true) + end + + it 'should import sql script on creation if enforcing' do + params.merge!({'sql' => 'test_sql', 'enforce_sql' => true}) + is_expected.to contain_exec('test_db-import').with_refreshonly(false) + is_expected.to contain_exec('test_db-import').with_command('cat test_sql | mysql test_db') + end + + it 'should import sql script with custom command on creation if enforcing' do + params.merge!({'sql' => 'test_sql', 'enforce_sql' => true, 'import_cat_cmd' => 'zcat'}) + is_expected.to contain_exec('test_db-import').with_refreshonly(false) + is_expected.to contain_exec('test_db-import').with_command('zcat test_sql | mysql test_db') + end + + it 'should import sql scripts when more than one is specified' do + params.merge!({'sql' => ['test_sql', 'test_2_sql']}) + is_expected.to contain_exec('test_db-import').with_command('cat test_sql test_2_sql | mysql test_db') + end + + it 'should report an error if sql isn\'t a string or an array' do + params.merge!({'sql' => {'foo' => 'test_sql', 'bar' => 'test_2_sql'}}) + expect { catalogue }.to raise_error(Puppet::Error, + /\$sql must be either a string or an array\./) + end + + it 'should not create database and database user' do + params.merge!({'ensure' => 'absent', 'host' => 'localhost'}) + is_expected.to contain_mysql_database('test_db').with_ensure('absent') + is_expected.to contain_mysql_user('testuser@localhost').with_ensure('absent') + end + + it 'should create with an appropriate collate and charset' do + params.merge!({'charset' => 'utf8', 'collate' => 'utf8_danish_ci'}) + is_expected.to contain_mysql_database('test_db').with({ + 'charset' => 'utf8', + 'collate' => 'utf8_danish_ci', + }) + end + + it 'should use dbname parameter as database name instead of name' do + params.merge!({'dbname' => 'real_db'}) + is_expected.to contain_mysql_database('real_db') + end + end + end +end diff --git a/environments/production/modules/mysql/spec/spec.opts b/environments/production/modules/mysql/spec/spec.opts new file mode 100644 index 0000000..91cd642 --- /dev/null +++ b/environments/production/modules/mysql/spec/spec.opts @@ -0,0 +1,6 @@ +--format +s +--colour +--loadby +mtime +--backtrace diff --git a/environments/production/modules/mysql/spec/spec_helper.rb b/environments/production/modules/mysql/spec/spec_helper.rb new file mode 100644 index 0000000..22d5d68 --- /dev/null +++ b/environments/production/modules/mysql/spec/spec_helper.rb @@ -0,0 +1,8 @@ +#This file is generated by ModuleSync, do not edit. +require 'puppetlabs_spec_helper/module_spec_helper' + +# put local configuration and setup into spec_helper_local +begin + require 'spec_helper_local' +rescue LoadError +end diff --git a/environments/production/modules/mysql/spec/spec_helper_acceptance.rb b/environments/production/modules/mysql/spec/spec_helper_acceptance.rb new file mode 100644 index 0000000..07e19bd --- /dev/null +++ b/environments/production/modules/mysql/spec/spec_helper_acceptance.rb @@ -0,0 +1,66 @@ +require 'beaker-rspec' +require 'beaker/puppet_install_helper' + +run_puppet_install_helper + +UNSUPPORTED_PLATFORMS = [ 'Windows', 'Solaris', 'AIX' ] + +RSpec.configure do |c| + # Project root + proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..')) + + # Readable test descriptions + c.formatter = :documentation + + # detect the situation where PUP-5016 is triggered and skip the idempotency tests in that case + # also note how fact('puppetversion') is not available because of PUP-4359 + if fact('osfamily') == 'Debian' && fact('operatingsystemmajrelease') == '8' && shell('puppet --version').stdout =~ /^4\.2/ + c.filter_run_excluding :skip_pup_5016 => true + end + + # Configure all nodes in nodeset + c.before :suite do + # Install module and dependencies + puppet_module_install(:source => proj_root, :module_name => 'mysql') + hosts.each do |host| + # Required for binding tests. + if fact('osfamily') == 'RedHat' + version = fact("operatingsystemmajrelease") + if fact('operatingsystemmajrelease') =~ /7/ || fact('operatingsystem') =~ /Fedora/ + shell("yum install -y bzip2") + end + end + + # Solaris 11 doesn't ship the SSL CA root for the forgeapi server + # therefore we need to use a different way to deploy the module to + # the host + if host['platform'] =~ /solaris-11/i + apply_manifest_on(host, 'package { "git": }') + # PE 3.x and 2015.2 require different locations to install modules + modulepath = host.puppet['modulepath'] + modulepath = modulepath.split(':').first if modulepath + + environmentpath = host.puppet['environmentpath'] + environmentpath = environmentpath.split(':').first if environmentpath + + destdir = modulepath || "#{environmentpath}/production/modules" + on host, "git clone https://github.com/puppetlabs/puppetlabs-stdlib #{destdir}/stdlib && cd #{destdir}/stdlib && git checkout 3.2.0" + on host, "git clone https://github.com/stahnma/puppet-module-epel.git #{destdir}/epel && cd #{destdir}/epel && git checkout 1.0.2" + else + on host, puppet('module','install','puppetlabs-stdlib','--version','3.2.0') + on host, puppet('module','install','stahnma/epel') + on host, puppet('module','install','puppet/staging') + end + end + end +end + +shared_examples "a idempotent resource" do + it 'should apply with no errors' do + apply_manifest(pp, :catch_failures => true) + end + + it 'should apply a second time without changes', :skip_pup_5016 do + apply_manifest(pp, :catch_changes => true) + end +end diff --git a/environments/production/modules/mysql/spec/spec_helper_local.rb b/environments/production/modules/mysql/spec/spec_helper_local.rb new file mode 100644 index 0000000..9a86ccd --- /dev/null +++ b/environments/production/modules/mysql/spec/spec_helper_local.rb @@ -0,0 +1,3 @@ +require 'rspec-puppet-facts' +include RspecPuppetFacts + diff --git a/environments/production/modules/mysql/spec/unit/facter/mysql_server_id_spec.rb b/environments/production/modules/mysql/spec/unit/facter/mysql_server_id_spec.rb new file mode 100644 index 0000000..a2e9fdf --- /dev/null +++ b/environments/production/modules/mysql/spec/unit/facter/mysql_server_id_spec.rb @@ -0,0 +1,27 @@ +require "spec_helper" + +describe Facter::Util::Fact do + before { + Facter.clear + } + + describe "mysql_server_id" do + context "igalic's laptop" do + before :each do + Facter.fact(:macaddress).stubs(:value).returns('3c:97:0e:69:fb:e1') + end + it do + Facter.fact(:mysql_server_id).value.to_s.should == '4116385' + end + end + + context "node with lo only" do + before :each do + Facter.fact(:macaddress).stubs(:value).returns('00:00:00:00:00:00') + end + it do + Facter.fact(:mysql_server_id).value.to_s.should == '0' + end + end + end +end diff --git a/environments/production/modules/mysql/spec/unit/facter/mysql_version_spec.rb b/environments/production/modules/mysql/spec/unit/facter/mysql_version_spec.rb new file mode 100644 index 0000000..60379f6 --- /dev/null +++ b/environments/production/modules/mysql/spec/unit/facter/mysql_version_spec.rb @@ -0,0 +1,20 @@ +require "spec_helper" + +describe Facter::Util::Fact do + before { + Facter.clear + } + + describe "mysql_version" do + context 'with value' do + before :each do + Facter::Util::Resolution.stubs(:exec).with('mysql --version').returns('mysql Ver 14.12 Distrib 5.0.95, for redhat-linux-gnu (x86_64) using readline 5.1') + end + it { + expect(Facter.fact(:mysql_version).value).to eq('5.0.95') + } + end + + end + +end diff --git a/environments/production/modules/mysql/spec/unit/facter/mysqld_version_spec.rb b/environments/production/modules/mysql/spec/unit/facter/mysqld_version_spec.rb new file mode 100644 index 0000000..f0b606f --- /dev/null +++ b/environments/production/modules/mysql/spec/unit/facter/mysqld_version_spec.rb @@ -0,0 +1,20 @@ +require "spec_helper" + +describe Facter::Util::Fact do + before { + Facter.clear + } + + describe "mysqld_version" do + context 'with value' do + before :each do + Facter::Util::Resolution.stubs(:exec).with('mysqld -V 2>/dev/null').returns('mysqld Ver 5.5.49-37.9 for Linux on x86_64 (Percona Server (GPL), Release 37.9, Revision efa0073)') + end + it { + expect(Facter.fact(:mysqld_version).value).to eq('mysqld Ver 5.5.49-37.9 for Linux on x86_64 (Percona Server (GPL), Release 37.9, Revision efa0073)') + } + end + + end + +end diff --git a/environments/production/modules/mysql/spec/unit/puppet/functions/mysql_deepmerge_spec.rb b/environments/production/modules/mysql/spec/unit/puppet/functions/mysql_deepmerge_spec.rb new file mode 100644 index 0000000..18cb26b --- /dev/null +++ b/environments/production/modules/mysql/spec/unit/puppet/functions/mysql_deepmerge_spec.rb @@ -0,0 +1,91 @@ +#! /usr/bin/env ruby -S rspec + +require 'spec_helper' + +describe Puppet::Parser::Functions.function(:mysql_deepmerge) do + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + describe 'when calling mysql_deepmerge from puppet' do + it "should not compile when no arguments are passed" do + skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./ + Puppet[:code] = '$x = mysql_deepmerge()' + expect { + scope.compiler.compile + }.to raise_error(Puppet::ParseError, /wrong number of arguments/) + end + + it "should not compile when 1 argument is passed" do + skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./ + Puppet[:code] = "$my_hash={'one' => 1}\n$x = mysql_deepmerge($my_hash)" + expect { + scope.compiler.compile + }.to raise_error(Puppet::ParseError, /wrong number of arguments/) + end + end + + describe 'when calling mysql_deepmerge on the scope instance' do + it 'should require all parameters are hashes' do + expect { new_hash = scope.function_mysql_deepmerge([{}, '2'])}.to raise_error(Puppet::ParseError, /unexpected argument type String/) + expect { new_hash = scope.function_mysql_deepmerge([{}, 2])}.to raise_error(Puppet::ParseError, /unexpected argument type Fixnum/) + end + + it 'should accept empty strings as puppet undef' do + expect { new_hash = scope.function_mysql_deepmerge([{}, ''])}.not_to raise_error + end + + it 'should be able to mysql_deepmerge two hashes' do + new_hash = scope.function_mysql_deepmerge([{'one' => '1', 'two' => '1'}, {'two' => '2', 'three' => '2'}]) + expect(new_hash['one']).to eq('1') + expect(new_hash['two']).to eq('2') + expect(new_hash['three']).to eq('2') + end + + it 'should mysql_deepmerge multiple hashes' do + hash = scope.function_mysql_deepmerge([{'one' => 1}, {'one' => '2'}, {'one' => '3'}]) + expect(hash['one']).to eq('3') + end + + it 'should accept empty hashes' do + expect(scope.function_mysql_deepmerge([{},{},{}])).to eq({}) + end + + it 'should mysql_deepmerge subhashes' do + hash = scope.function_mysql_deepmerge([{'one' => 1}, {'two' => 2, 'three' => { 'four' => 4 } }]) + expect(hash['one']).to eq(1) + expect(hash['two']).to eq(2) + expect(hash['three']).to eq({ 'four' => 4 }) + end + + it 'should append to subhashes' do + hash = scope.function_mysql_deepmerge([{'one' => { 'two' => 2 } }, { 'one' => { 'three' => 3 } }]) + expect(hash['one']).to eq({ 'two' => 2, 'three' => 3 }) + end + + it 'should append to subhashes 2' do + hash = scope.function_mysql_deepmerge([{'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } }, {'two' => 'dos', 'three' => { 'five' => 5 } }]) + expect(hash['one']).to eq(1) + expect(hash['two']).to eq('dos') + expect(hash['three']).to eq({ 'four' => 4, 'five' => 5 }) + end + + it 'should append to subhashes 3' do + hash = scope.function_mysql_deepmerge([{ 'key1' => { 'a' => 1, 'b' => 2 }, 'key2' => { 'c' => 3 } }, { 'key1' => { 'b' => 99 } }]) + expect(hash['key1']).to eq({ 'a' => 1, 'b' => 99 }) + expect(hash['key2']).to eq({ 'c' => 3 }) + end + + it 'should equate keys mod dash and underscore' do + hash = scope.function_mysql_deepmerge([{ 'a-b-c' => 1 } , { 'a_b_c' => 10 }]) + expect(hash['a_b_c']).to eq(10) + expect(hash).not_to have_key('a-b-c') + end + + it 'should keep style of the last when keys are euqal mod dash and underscore' do + hash = scope.function_mysql_deepmerge([{ 'a-b-c' => 1, 'b_c_d' => { 'c-d-e' => 2, 'e-f-g' => 3 }} , { 'a_b_c' => 10, 'b-c-d' => { 'c_d_e' => 12 } }]) + expect(hash['a_b_c']).to eq(10) + expect(hash).not_to have_key('a-b-c') + expect(hash['b-c-d']).to eq({ 'e-f-g' => 3, 'c_d_e' => 12 }) + expect(hash).not_to have_key('b_c_d') + end + end +end diff --git a/environments/production/modules/mysql/spec/unit/puppet/functions/mysql_password_spec.rb b/environments/production/modules/mysql/spec/unit/puppet/functions/mysql_password_spec.rb new file mode 100644 index 0000000..2d5feea --- /dev/null +++ b/environments/production/modules/mysql/spec/unit/puppet/functions/mysql_password_spec.rb @@ -0,0 +1,37 @@ +require 'spec_helper' + +describe 'the mysql_password function' do + before :all do + Puppet::Parser::Functions.autoloader.loadall + end + + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + it 'should exist' do + expect(Puppet::Parser::Functions.function('mysql_password')).to eq('function_mysql_password') + end + + it 'should raise a ParseError if there is less than 1 arguments' do + expect { scope.function_mysql_password([]) }.to( raise_error(Puppet::ParseError)) + end + + it 'should raise a ParseError if there is more than 1 arguments' do + expect { scope.function_mysql_password(%w(foo bar)) }.to( raise_error(Puppet::ParseError)) + end + + it 'should convert password into a hash' do + result = scope.function_mysql_password(%w(password)) + expect(result).to(eq('*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19')) + end + + it 'should convert an empty password into a empty string' do + result = scope.function_mysql_password([""]) + expect(result).to(eq('')) + end + + it 'should not convert a password that is already a hash' do + result = scope.function_mysql_password(['*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19']) + expect(result).to(eq('*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19')) + end + +end diff --git a/environments/production/modules/mysql/spec/unit/puppet/provider/mysql_database/mysql_spec.rb b/environments/production/modules/mysql/spec/unit/puppet/provider/mysql_database/mysql_spec.rb new file mode 100644 index 0000000..465e59d --- /dev/null +++ b/environments/production/modules/mysql/spec/unit/puppet/provider/mysql_database/mysql_spec.rb @@ -0,0 +1,118 @@ +require 'spec_helper' + +describe Puppet::Type.type(:mysql_database).provider(:mysql) do + + let(:defaults_file) { '--defaults-extra-file=/root/.my.cnf' } + + let(:raw_databases) do + <<-SQL_OUTPUT +information_schema +mydb +mysql +performance_schema +test + SQL_OUTPUT + end + + let(:parsed_databases) { %w(information_schema mydb mysql performance_schema test) } + + let(:resource) { Puppet::Type.type(:mysql_database).new( + { :ensure => :present, + :charset => 'latin1', + :collate => 'latin1_swedish_ci', + :name => 'new_database', + :provider => described_class.name + } + )} + let(:provider) { resource.provider } + + before :each do + Facter.stubs(:value).with(:root_home).returns('/root') + Puppet::Util.stubs(:which).with('mysql').returns('/usr/bin/mysql') + File.stubs(:file?).with('/root/.my.cnf').returns(true) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', 'show databases']).returns('new_database') + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "show variables like '%_database'", 'new_database']).returns("character_set_database latin1\ncollation_database latin1_swedish_ci\nskip_show_database OFF") + end + + let(:instance) { provider.class.instances.first } + + describe 'self.instances' do + it 'returns an array of databases' do + provider.class.stubs(:mysql).with([defaults_file, '-NBe', 'show databases']).returns(raw_databases) + raw_databases.each_line do |db| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "show variables like '%_database'", db.chomp]).returns("character_set_database latin1\ncollation_database latin1_swedish_ci\nskip_show_database OFF") + end + databases = provider.class.instances.collect {|x| x.name } + expect(parsed_databases).to match_array(databases) + end + end + + describe 'self.prefetch' do + it 'exists' do + provider.class.instances + provider.class.prefetch({}) + end + end + + describe 'create' do + it 'makes a database' do + provider.expects(:mysql).with([defaults_file, '-NBe', "create database if not exists `#{resource[:name]}` character set `#{resource[:charset]}` collate `#{resource[:collate]}`"]) + provider.expects(:exists?).returns(true) + expect(provider.create).to be_truthy + end + end + + describe 'destroy' do + it 'removes a database if present' do + provider.expects(:mysql).with([defaults_file, '-NBe', "drop database if exists `#{resource[:name]}`"]) + provider.expects(:exists?).returns(false) + expect(provider.destroy).to be_truthy + end + end + + describe 'exists?' do + it 'checks if database exists' do + expect(instance.exists?).to be_truthy + end + end + + describe 'self.defaults_file' do + it 'sets --defaults-extra-file' do + File.stubs(:file?).with('/root/.my.cnf').returns(true) + expect(provider.defaults_file).to eq '--defaults-extra-file=/root/.my.cnf' + end + it 'fails if file missing' do + File.stubs(:file?).with('/root/.my.cnf').returns(false) + expect(provider.defaults_file).to be_nil + end + end + + describe 'charset' do + it 'returns a charset' do + expect(instance.charset).to eq('latin1') + end + end + + describe 'charset=' do + it 'changes the charset' do + provider.expects(:mysql).with([defaults_file, '-NBe', "alter database `#{resource[:name]}` CHARACTER SET blah"]).returns('0') + + provider.charset=('blah') + end + end + + describe 'collate' do + it 'returns a collate' do + expect(instance.collate).to eq('latin1_swedish_ci') + end + end + + describe 'collate=' do + it 'changes the collate' do + provider.expects(:mysql).with([defaults_file, '-NBe', "alter database `#{resource[:name]}` COLLATE blah"]).returns('0') + + provider.collate=('blah') + end + end + +end diff --git a/environments/production/modules/mysql/spec/unit/puppet/provider/mysql_plugin/mysql_spec.rb b/environments/production/modules/mysql/spec/unit/puppet/provider/mysql_plugin/mysql_spec.rb new file mode 100644 index 0000000..340562f --- /dev/null +++ b/environments/production/modules/mysql/spec/unit/puppet/provider/mysql_plugin/mysql_spec.rb @@ -0,0 +1,71 @@ +require 'spec_helper' + +describe Puppet::Type.type(:mysql_plugin).provider(:mysql) do + + let(:defaults_file) { '--defaults-extra-file=/root/.my.cnf' } + + let(:resource) { Puppet::Type.type(:mysql_plugin).new( + { :ensure => :present, + :soname => 'auth_socket.so', + :name => 'auth_socket', + :provider => described_class.name + } + )} + let(:provider) { resource.provider } + + before :each do + Facter.stubs(:value).with(:root_home).returns('/root') + Puppet::Util.stubs(:which).with('mysql').returns('/usr/bin/mysql') + File.stubs(:file?).with('/root/.my.cnf').returns(true) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', 'show plugins']).returns('auth_socket ACTIVE AUTHENTICATION auth_socket.so GPL') + end + + let(:instance) { provider.class.instances.first } + + describe 'self.prefetch' do + it 'exists' do + provider.class.instances + provider.class.prefetch({}) + end + end + + describe 'create' do + it 'loads a plugin' do + provider.expects(:mysql).with([defaults_file, '-NBe', "install plugin #{resource[:name]} soname '#{resource[:soname]}'"]) + provider.expects(:exists?).returns(true) + expect(provider.create).to be_truthy + end + end + + describe 'destroy' do + it 'unloads a plugin if present' do + provider.expects(:mysql).with([defaults_file, '-NBe', "uninstall plugin #{resource[:name]}"]) + provider.expects(:exists?).returns(false) + expect(provider.destroy).to be_truthy + end + end + + describe 'exists?' do + it 'checks if plugin exists' do + expect(instance.exists?).to be_truthy + end + end + + describe 'self.defaults_file' do + it 'sets --defaults-extra-file' do + File.stubs(:file?).with('/root/.my.cnf').returns(true) + expect(provider.defaults_file).to eq '--defaults-extra-file=/root/.my.cnf' + end + it 'fails if file missing' do + File.stubs(:file?).with('/root/.my.cnf').returns(false) + expect(provider.defaults_file).to be_nil + end + end + + describe 'soname' do + it 'returns a soname' do + expect(instance.soname).to eq('auth_socket.so') + end + end + +end diff --git a/environments/production/modules/mysql/spec/unit/puppet/provider/mysql_user/mysql_spec.rb b/environments/production/modules/mysql/spec/unit/puppet/provider/mysql_user/mysql_spec.rb new file mode 100644 index 0000000..d993f42 --- /dev/null +++ b/environments/production/modules/mysql/spec/unit/puppet/provider/mysql_user/mysql_spec.rb @@ -0,0 +1,345 @@ +require 'spec_helper' + +describe Puppet::Type.type(:mysql_user).provider(:mysql) do + + # Output of mysqld -V + mysql_version_string_hash = { + 'mysql-5.5' => + { + :version => '5.5.46', + :string => '/usr/sbin/mysqld Ver 5.5.46-log for Linux on x86_64 (MySQL Community Server (GPL))', + :mysql_type => 'mysql', + }, + 'mysql-5.6' => + { + :version => '5.6.27', + :string => '/usr/sbin/mysqld Ver 5.6.27 for Linux on x86_64 (MySQL Community Server (GPL))', + :mysql_type => 'mysql', + }, + 'mysql-5.7.1' => + { + :version => '5.7.1', + :string => '/usr/sbin/mysqld Ver 5.7.1 for Linux on x86_64 (MySQL Community Server (GPL))', + :mysql_type => 'mysql', + }, + 'mysql-5.7.6' => + { + :version => '5.7.8', + :string => '/usr/sbin/mysqld Ver 5.7.8-rc for Linux on x86_64 (MySQL Community Server (GPL))', + :mysql_type => 'mysql', + }, + 'mariadb-10.0' => + { + :version => '10.0.21', + :string => '/usr/sbin/mysqld Ver 10.0.21-MariaDB for Linux on x86_64 (MariaDB Server)', + :mysql_type => 'mariadb', + }, + 'mariadb-10.0-deb8' => + { + :version => '10.0.23', + :string => '/usr/sbin/mysqld (mysqld 10.0.23-MariaDB-0+deb8u1)', + :mysql_type => 'mariadb', + }, + 'percona-5.5' => + { + :version => '5.5.39', + :string => 'mysqld Ver 5.5.39-36.0-55 for Linux on x86_64 (Percona XtraDB Cluster (GPL), Release rel36.0, Revision 824, WSREP version 25.11, wsrep_25.11.r4023)', + :mysql_type => 'percona', + }, + } + + let(:defaults_file) { '--defaults-extra-file=/root/.my.cnf' } + let(:system_database) { '--database=mysql' } + let(:newhash) { '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5' } + + let(:raw_users) do + <<-SQL_OUTPUT +root@127.0.0.1 +root@::1 +@localhost +debian-sys-maint@localhost +root@localhost +usvn_user@localhost +@vagrant-ubuntu-raring-64 + SQL_OUTPUT + end + + let(:parsed_users) { %w(root@127.0.0.1 root@::1 @localhost debian-sys-maint@localhost root@localhost usvn_user@localhost @vagrant-ubuntu-raring-64) } + + let(:resource) { Puppet::Type.type(:mysql_user).new( + { :ensure => :present, + :password_hash => '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4', + :name => 'joe@localhost', + :max_user_connections => '10', + :max_connections_per_hour => '10', + :max_queries_per_hour => '10', + :max_updates_per_hour => '10', + :provider => described_class.name + } + )} + let(:provider) { resource.provider } + + before :each do + # Set up the stubs for an instances call. + Facter.stubs(:value).with(:root_home).returns('/root') + Facter.stubs(:value).with(:mysql_version).returns('5.6.24') + provider.class.instance_variable_set(:@mysqld_version_string, '5.6.24') + Puppet::Util.stubs(:which).with('mysql').returns('/usr/bin/mysql') + Puppet::Util.stubs(:which).with('mysqld').returns('/usr/sbin/mysqld') + File.stubs(:file?).with('/root/.my.cnf').returns(true) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns('joe@localhost') + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = 'joe@localhost'"]).returns('10 10 10 10 *6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4') + end + + let(:instance) { provider.class.instances.first } + + describe 'self.instances' do + it 'returns an array of users MySQL 5.5' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.5'][:string]) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns(raw_users) + parsed_users.each do |user| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{user}'"]).returns('10 10 10 10 ') + end + + usernames = provider.class.instances.collect {|x| x.name } + expect(parsed_users).to match_array(usernames) + end + it 'returns an array of users MySQL 5.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.6'][:string]) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns(raw_users) + parsed_users.each do |user| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{user}'"]).returns('10 10 10 10 ') + end + + usernames = provider.class.instances.collect {|x| x.name } + expect(parsed_users).to match_array(usernames) + end + it 'returns an array of users MySQL >= 5.7.0 < 5.7.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.1'][:string]) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns(raw_users) + parsed_users.each do |user| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{user}'"]).returns('10 10 10 10 ') + end + + usernames = provider.class.instances.collect {|x| x.name } + expect(parsed_users).to match_array(usernames) + end + it 'returns an array of users MySQL >= 5.7.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.6'][:string]) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns(raw_users) + parsed_users.each do |user| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, AUTHENTICATION_STRING, PLUGIN FROM mysql.user WHERE CONCAT(user, '@', host) = '#{user}'"]).returns('10 10 10 10 ') + end + + usernames = provider.class.instances.collect {|x| x.name } + expect(parsed_users).to match_array(usernames) + end + it 'returns an array of users mariadb 10.0' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mariadb-10.0'][:string]) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns(raw_users) + parsed_users.each do |user| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{user}'"]).returns('10 10 10 10 ') + end + + usernames = provider.class.instances.collect {|x| x.name } + expect(parsed_users).to match_array(usernames) + end + it 'returns an array of users percona 5.5' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['percona-5.5'][:string]) + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT CONCAT(User, '@',Host) AS User FROM mysql.user"]).returns(raw_users) + parsed_users.each do |user| + provider.class.stubs(:mysql).with([defaults_file, '-NBe', "SELECT MAX_USER_CONNECTIONS, MAX_CONNECTIONS, MAX_QUESTIONS, MAX_UPDATES, SSL_TYPE, SSL_CIPHER, X509_ISSUER, X509_SUBJECT, PASSWORD /*!50508 , PLUGIN */ FROM mysql.user WHERE CONCAT(user, '@', host) = '#{user}'"]).returns('10 10 10 10 ') + end + + usernames = provider.class.instances.collect {|x| x.name } + expect(parsed_users).to match_array(usernames) + end + end + + describe 'mysql version and type detection' do + mysql_version_string_hash.each do |name,line| + version=line[:version] + string=line[:string] + mysql_type=line[:mysql_type] + it "detects type '#{mysql_type}' with version '#{version}'" do + provider.class.instance_variable_set(:@mysqld_version_string, string) + expect(provider.mysqld_version).to eq(version) + expect(provider.mysqld_type).to eq(mysql_type) + end + end + end + + describe 'self.prefetch' do + it 'exists' do + provider.class.instances + provider.class.prefetch({}) + end + end + + describe 'create' do + it 'makes a user' do + provider.expects(:mysql).with([defaults_file, system_database, '-e', "CREATE USER 'joe'@'localhost' IDENTIFIED BY PASSWORD '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4'"]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' WITH MAX_USER_CONNECTIONS 10 MAX_CONNECTIONS_PER_HOUR 10 MAX_QUERIES_PER_HOUR 10 MAX_UPDATES_PER_HOUR 10"]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE NONE"]) + provider.expects(:exists?).returns(true) + expect(provider.create).to be_truthy + end + end + + describe 'destroy' do + it 'removes a user if present' do + provider.expects(:mysql).with([defaults_file, system_database, '-e', "DROP USER 'joe'@'localhost'"]) + provider.expects(:exists?).returns(false) + expect(provider.destroy).to be_truthy + end + end + + describe 'exists?' do + it 'checks if user exists' do + expect(instance.exists?).to be_truthy + end + end + + describe 'self.mysqld_version' do + it 'uses the mysqld_version fact if unset' do + provider.class.instance_variable_set(:@mysqld_version_string, nil) + Facter.stubs(:value).with(:mysqld_version).returns('5.6.24') + expect(provider.mysqld_version).to eq '5.6.24' + end + it 'returns 5.7.6 for "mysqld Ver 5.7.6 for Linux on x86_64 (MySQL Community Server (GPL))"' do + provider.class.instance_variable_set(:@mysqld_version_string, 'mysqld Ver 5.7.6 for Linux on x86_64 (MySQL Community Server (GPL))') + expect(provider.mysqld_version).to eq '5.7.6' + end + it 'returns 5.7.6 for "mysqld Ver 5.7.6-rc for Linux on x86_64 (MySQL Community Server (GPL))"' do + provider.class.instance_variable_set(:@mysqld_version_string, 'mysqld Ver 5.7.6-rc for Linux on x86_64 (MySQL Community Server (GPL))') + expect(provider.mysqld_version).to eq '5.7.6' + end + it 'detects >= 5.7.6 for 5.7.7-log' do + provider.class.instance_variable_set(:@mysqld_version_string, 'mysqld Ver 5.7.7-log for Linux on x86_64 (MySQL Community Server (GPL))') + expect(Puppet::Util::Package.versioncmp(provider.mysqld_version, '5.7.6')).to be >= 0 + end + it 'detects < 5.7.6 for 5.7.5-log' do + provider.class.instance_variable_set(:@mysqld_version_string, 'mysqld Ver 5.7.5-log for Linux on x86_64 (MySQL Community Server (GPL))') + expect(Puppet::Util::Package.versioncmp(provider.mysqld_version, '5.7.6')).to be < 0 + end + end + + describe 'self.defaults_file' do + it 'sets --defaults-extra-file' do + File.stubs(:file?).with('/root/.my.cnf').returns(true) + expect(provider.defaults_file).to eq '--defaults-extra-file=/root/.my.cnf' + end + it 'fails if file missing' do + File.expects(:file?).with('/root/.my.cnf').returns(false) + expect(provider.defaults_file).to be_nil + end + end + + describe 'password_hash' do + it 'returns a hash' do + expect(instance.password_hash).to eq('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4') + end + end + + describe 'password_hash=' do + it 'changes the hash mysql 5.5' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.5'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "SET PASSWORD FOR 'joe'@'localhost' = '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5'"]).returns('0') + + provider.expects(:password_hash).returns('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + provider.password_hash=('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + end + it 'changes the hash mysql 5.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.6'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "SET PASSWORD FOR 'joe'@'localhost' = '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5'"]).returns('0') + + provider.expects(:password_hash).returns('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + provider.password_hash=('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + end + it 'changes the hash mysql < 5.7.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.1'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "SET PASSWORD FOR 'joe'@'localhost' = '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5'"]).returns('0') + + provider.expects(:password_hash).returns('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + provider.password_hash=('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + end + it 'changes the hash MySQL >= 5.7.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.6'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "ALTER USER 'joe'@'localhost' IDENTIFIED WITH mysql_native_password AS '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5'"]).returns('0') + + provider.expects(:password_hash).returns('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + provider.password_hash=('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + end + it 'changes the hash mariadb-10.0' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mariadb-10.0'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "SET PASSWORD FOR 'joe'@'localhost' = '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5'"]).returns('0') + + provider.expects(:password_hash).returns('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + provider.password_hash=('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + end + it 'changes the hash percona-5.5' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['percona-5.5'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "SET PASSWORD FOR 'joe'@'localhost' = '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5'"]).returns('0') + + provider.expects(:password_hash).returns('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + provider.password_hash=('*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF5') + end + end + + describe 'tls_options=' do + it 'adds SSL option grant in mysql 5.5' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.5'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE NONE"]).returns('0') + + provider.expects(:tls_options).returns(['NONE']) + provider.tls_options=(['NONE']) + end + it 'adds SSL option grant in mysql 5.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.6'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE NONE"]).returns('0') + + provider.expects(:tls_options).returns(['NONE']) + provider.tls_options=(['NONE']) + end + it 'adds SSL option grant in mysql < 5.7.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.1'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE NONE"]).returns('0') + + provider.expects(:tls_options).returns(['NONE']) + provider.tls_options=(['NONE']) + end + it 'adds SSL option grant in mysql >= 5.7.6' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mysql-5.7.6'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "ALTER USER 'joe'@'localhost' REQUIRE NONE"]).returns('0') + + provider.expects(:tls_options).returns(['NONE']) + provider.tls_options=(['NONE']) + end + it 'adds SSL option grant in mariadb-10.0' do + provider.class.instance_variable_set(:@mysqld_version_string, mysql_version_string_hash['mariadb-10.0'][:string]) + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' REQUIRE NONE"]).returns('0') + + provider.expects(:tls_options).returns(['NONE']) + provider.tls_options=(['NONE']) + end + end + + ['max_user_connections', 'max_connections_per_hour', 'max_queries_per_hour', + 'max_updates_per_hour'].each do |property| + + describe property do + it "returns #{property}" do + expect(instance.send("#{property}".to_sym)).to eq('10') + end + end + + describe "#{property}=" do + it "changes #{property}" do + provider.expects(:mysql).with([defaults_file, system_database, '-e', "GRANT USAGE ON *.* TO 'joe'@'localhost' WITH #{property.upcase} 42"]).returns('0') + provider.expects(property.to_sym).returns('42') + provider.send("#{property}=".to_sym, '42') + end + end + end + +end diff --git a/environments/production/modules/mysql/spec/unit/puppet/type/mysql_database_spec.rb b/environments/production/modules/mysql/spec/unit/puppet/type/mysql_database_spec.rb new file mode 100644 index 0000000..7897d81 --- /dev/null +++ b/environments/production/modules/mysql/spec/unit/puppet/type/mysql_database_spec.rb @@ -0,0 +1,29 @@ +require 'puppet' +require 'puppet/type/mysql_database' +describe Puppet::Type.type(:mysql_database) do + + before :each do + @user = Puppet::Type.type(:mysql_database).new(:name => 'test', :charset => 'utf8', :collate => 'utf8_blah_ci') + end + + it 'should accept a database name' do + expect(@user[:name]).to eq('test') + end + + it 'should accept a charset' do + @user[:charset] = 'latin1' + expect(@user[:charset]).to eq('latin1') + end + + it 'should accept a collate' do + @user[:collate] = 'latin1_swedish_ci' + expect(@user[:collate]).to eq('latin1_swedish_ci') + end + + it 'should require a name' do + expect { + Puppet::Type.type(:mysql_database).new({}) + }.to raise_error(Puppet::Error, 'Title or name must be provided') + end + +end diff --git a/environments/production/modules/mysql/spec/unit/puppet/type/mysql_grant_spec.rb b/environments/production/modules/mysql/spec/unit/puppet/type/mysql_grant_spec.rb new file mode 100644 index 0000000..9b33058 --- /dev/null +++ b/environments/production/modules/mysql/spec/unit/puppet/type/mysql_grant_spec.rb @@ -0,0 +1,74 @@ +require 'puppet' +require 'puppet/type/mysql_grant' +describe Puppet::Type.type(:mysql_grant) do + + before :each do + @user = Puppet::Type.type(:mysql_grant).new(:name => 'foo@localhost/*.*', :privileges => ['ALL', 'PROXY'], :table => ['*.*','@'], :user => 'foo@localhost') + end + + it 'should accept a grant name' do + expect(@user[:name]).to eq('foo@localhost/*.*') + end + + it 'should accept ALL privileges' do + @user[:privileges] = 'ALL' + expect(@user[:privileges]).to eq(['ALL']) + end + + it 'should accept PROXY privilege' do + @user[:privileges] = 'PROXY' + expect(@user[:privileges]).to eq(['PROXY']) + end + + it 'should accept a table' do + @user[:table] = '*.*' + expect(@user[:table]).to eq('*.*') + end + + it 'should accept @ for table' do + @user[:table] = '@' + expect(@user[:table]).to eq('@') + end + + it 'should accept a user' do + @user[:user] = 'foo@localhost' + expect(@user[:user]).to eq('foo@localhost') + end + + it 'should require a name' do + expect { + Puppet::Type.type(:mysql_grant).new({}) + }.to raise_error(Puppet::Error, 'Title or name must be provided') + end + + it 'should require the name to match the user and table' do + expect { + Puppet::Type.type(:mysql_grant).new(:name => 'foo', :privileges => ['ALL', 'PROXY'], :table => ['*.*','@'], :user => 'foo@localhost') + }.to raise_error /name must match user and table parameters/ + end + + describe 'it should munge privileges' do + + it 'to just ALL' do + @user = Puppet::Type.type(:mysql_grant).new( + :name => 'foo@localhost/*.*', :table => ['*.*','@'], :user => 'foo@localhost', + :privileges => ['ALL', 'PROXY'] ) + expect(@user[:privileges]).to eq(['ALL']) + end + + it 'to upcase and ordered' do + @user = Puppet::Type.type(:mysql_grant).new( + :name => 'foo@localhost/*.*', :table => ['*.*','@'], :user => 'foo@localhost', + :privileges => ['select', 'Insert'] ) + expect(@user[:privileges]).to eq(['INSERT', 'SELECT']) + end + + it 'ordered including column privileges' do + @user = Puppet::Type.type(:mysql_grant).new( + :name => 'foo@localhost/*.*', :table => ['*.*','@'], :user => 'foo@localhost', + :privileges => ['SELECT(Host,Address)', 'Insert'] ) + expect(@user[:privileges]).to eq(['INSERT', 'SELECT (Address, Host)']) + end + end + +end diff --git a/environments/production/modules/mysql/spec/unit/puppet/type/mysql_plugin_spec.rb b/environments/production/modules/mysql/spec/unit/puppet/type/mysql_plugin_spec.rb new file mode 100644 index 0000000..e94c518 --- /dev/null +++ b/environments/production/modules/mysql/spec/unit/puppet/type/mysql_plugin_spec.rb @@ -0,0 +1,24 @@ +require 'puppet' +require 'puppet/type/mysql_plugin' +describe Puppet::Type.type(:mysql_plugin) do + + before :each do + @plugin = Puppet::Type.type(:mysql_plugin).new(:name => 'test', :soname => 'test.so') + end + + it 'should accept a plugin name' do + expect(@plugin[:name]).to eq('test') + end + + it 'should accept a library name' do + @plugin[:soname] = 'test.so' + expect(@plugin[:soname]).to eq('test.so') + end + + it 'should require a name' do + expect { + Puppet::Type.type(:mysql_plugin).new({}) + }.to raise_error(Puppet::Error, 'Title or name must be provided') + end + +end diff --git a/environments/production/modules/mysql/spec/unit/puppet/type/mysql_user_spec.rb b/environments/production/modules/mysql/spec/unit/puppet/type/mysql_user_spec.rb new file mode 100644 index 0000000..3e3ae7d --- /dev/null +++ b/environments/production/modules/mysql/spec/unit/puppet/type/mysql_user_spec.rb @@ -0,0 +1,136 @@ +require 'puppet' +require 'puppet/type/mysql_user' +describe Puppet::Type.type(:mysql_user) do + + context "On MySQL 5.x" do + before :each do + Facter.stubs(:value).with(:mysql_version).returns("5.6.24") + end + it 'should fail with a long user name' do + expect { + Puppet::Type.type(:mysql_user).new({:name => '12345678901234567@localhost', :password_hash => 'pass'}) + }.to raise_error /MySQL usernames are limited to a maximum of 16 characters/ + end + end + + context "On MariaDB 10.0.0+" do + before :each do + Facter.stubs(:value).with(:mysql_version).returns("10.0.19") + @user = Puppet::Type.type(:mysql_user).new(:name => '12345678901234567@localhost', :password_hash => 'pass') + end + it 'should succeed with a long user name on MariaDB' do + expect(@user[:name]).to eq('12345678901234567@localhost') + end + end + + it 'should require a name' do + expect { + Puppet::Type.type(:mysql_user).new({}) + }.to raise_error(Puppet::Error, 'Title or name must be provided') + end + + context 'using foo@localhost' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => 'foo@localhost', :password_hash => 'pass') + end + + it 'should accept a user name' do + expect(@user[:name]).to eq('foo@localhost') + end + + it 'should accept a password' do + @user[:password_hash] = 'foo' + expect(@user[:password_hash]).to eq('foo') + end + end + + context 'using foo@LocalHost' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => 'foo@LocalHost', :password_hash => 'pass') + end + + it 'should lowercase the user name' do + expect(@user[:name]).to eq('foo@localhost') + end + end + + context 'using foo@192.168.1.0/255.255.255.0' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => 'foo@192.168.1.0/255.255.255.0', :password_hash => 'pass') + end + + it 'should create the user with the netmask' do + expect(@user[:name]).to eq('foo@192.168.1.0/255.255.255.0') + end + end + + context 'using allo_wed$char@localhost' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => 'allo_wed$char@localhost', :password_hash => 'pass') + end + + it 'should accept a user name' do + expect(@user[:name]).to eq('allo_wed$char@localhost') + end + end + + context 'ensure the default \'debian-sys-main\'@localhost user can be parsed' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => '\'debian-sys-maint\'@localhost', :password_hash => 'pass') + end + + it 'should accept a user name' do + expect(@user[:name]).to eq('\'debian-sys-maint\'@localhost') + end + end + + context 'using a quoted 16 char username' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => '"debian-sys-maint"@localhost', :password_hash => 'pass') + end + + it 'should accept a user name' do + expect(@user[:name]).to eq('"debian-sys-maint"@localhost') + end + end + + context 'using a quoted username that is too long ' do + before :each do + Facter.stubs(:value).with(:mysql_version).returns("5.6.24") + end + + it 'should fail with a size error' do + expect { + Puppet::Type.type(:mysql_user).new(:name => '"debian-sys-maint2"@localhost', :password_hash => 'pass') + }.to raise_error /MySQL usernames are limited to a maximum of 16 characters/ + end + end + + context 'using `speci!al#`@localhost' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => '`speci!al#`@localhost', :password_hash => 'pass') + end + + it 'should accept a quoted user name with special chatracters' do + expect(@user[:name]).to eq('`speci!al#`@localhost') + end + end + + context 'using in-valid@localhost' do + before :each do + @user = Puppet::Type.type(:mysql_user).new(:name => 'in-valid@localhost', :password_hash => 'pass') + end + + it 'should accept a user name with special chatracters' do + expect(@user[:name]).to eq('in-valid@localhost') + end + end + + context 'using "misquoted@localhost' do + it 'should fail with a misquoted username is used' do + expect { + Puppet::Type.type(:mysql_user).new(:name => '"misquoted@localhost', :password_hash => 'pass') + }.to raise_error /Invalid database user "misquoted@localhost/ + end + end +end diff --git a/environments/production/modules/mysql/templates/meb.cnf.erb b/environments/production/modules/mysql/templates/meb.cnf.erb new file mode 100644 index 0000000..d157af9 --- /dev/null +++ b/environments/production/modules/mysql/templates/meb.cnf.erb @@ -0,0 +1,18 @@ +### MANAGED BY PUPPET ### + +<% @options.sort.map do |k,v| -%> +<% if v.is_a?(Hash) -%> +[<%= k %>] +<% v.sort.map do |ki, vi| -%> +<% if vi == true or v == '' -%> +<%= ki %> +<% elsif vi.is_a?(Array) -%> +<% vi.each do |vii| -%> +<%= ki %> = <%= vii %> +<% end -%> +<% elsif ![nil, '', :undef].include?(vi) -%> +<%= ki %> = <%= vi %> +<% end -%> +<% end -%> +<% end %> +<% end -%> diff --git a/environments/production/modules/mysql/templates/my.cnf.erb b/environments/production/modules/mysql/templates/my.cnf.erb new file mode 100644 index 0000000..7d1f148 --- /dev/null +++ b/environments/production/modules/mysql/templates/my.cnf.erb @@ -0,0 +1,24 @@ +### MANAGED BY PUPPET ### + +<% @options.sort.map do |k,v| -%> +<% if v.is_a?(Hash) -%> +[<%= k %>] +<% v.sort.map do |ki, vi| -%> +<% if ki == 'ssl-disable' or (ki =~ /^ssl/ and v['ssl-disable'] == true) -%> +<% next %> +<% elsif vi == true or vi == '' -%> +<%= ki %> +<% elsif vi.is_a?(Array) -%> +<% vi.each do |vii| -%> +<%= ki %> = <%= vii %> +<% end -%> +<% elsif ![nil, '', :undef].include?(vi) -%> +<%= ki %> = <%= vi %> +<% end -%> +<% end -%> +<% end %> +<% end -%> + +<% if @includedir and @includedir != '' %> +!includedir <%= @includedir %> +<% end %> diff --git a/environments/production/modules/mysql/templates/my.cnf.pass.erb b/environments/production/modules/mysql/templates/my.cnf.pass.erb new file mode 100644 index 0000000..b82cca3 --- /dev/null +++ b/environments/production/modules/mysql/templates/my.cnf.pass.erb @@ -0,0 +1,11 @@ +### MANAGED BY PUPPET ### + +<% %w(mysql client mysqldump mysqladmin mysqlcheck).each do |section| %> +[<%= section -%>] +user=root +host=localhost +<% unless scope.lookupvar('mysql::server::root_password') == 'UNSET' -%> +password='<%= scope.lookupvar('mysql::server::root_password') %>' +<% end -%> +socket=<%= @options['client']['socket'] %> +<% end %> diff --git a/environments/production/modules/mysql/templates/mysqlbackup.sh.erb b/environments/production/modules/mysql/templates/mysqlbackup.sh.erb new file mode 100755 index 0000000..cd193c5 --- /dev/null +++ b/environments/production/modules/mysql/templates/mysqlbackup.sh.erb @@ -0,0 +1,104 @@ +<%- if @kernel == 'Linux' -%> +#!/bin/bash +<%- else -%> +#!/bin/sh +<%- end -%> +# +# MySQL Backup Script +# Dumps mysql databases to a file for another backup tool to pick up. +# +# MySQL code: +# GRANT SELECT, RELOAD, LOCK TABLES ON *.* TO 'user'@'localhost' +# IDENTIFIED BY 'password'; +# FLUSH PRIVILEGES; +# +##### START CONFIG ################################################### + +USER=<%= @backupuser %> +PASS='<%= @backuppassword %>' +MAX_ALLOWED_PACKET=<%= @maxallowedpacket %> +DIR=<%= @backupdir %> +ROTATE=<%= [ Integer(@backuprotate) - 1, 0 ].max %> + +# Create temporary mysql cnf file. +TMPFILE=`mktemp /tmp/backup.XXXXXX` || exit 1 +echo -e "[client]\npassword=$PASS\nuser=$USER\nmax_allowed_packet=$MAX_ALLOWED_PACKET" > $TMPFILE + +# Ensure backup directory exist. +mkdir -p $DIR + +PREFIX=mysql_backup_ +<% if @ignore_events %> +ADDITIONAL_OPTIONS="--ignore-table=mysql.event" +<% else %> +ADDITIONAL_OPTIONS="--events" +<% end %> +<%# Only include routines or triggers if we're doing a file per database -%> +<%# backup. This happens if we named databases, or if we explicitly set -%> +<%# file per database mode -%> +<% if !@backupdatabases.empty? || @file_per_database -%> +<% if @include_triggers -%> +ADDITIONAL_OPTIONS="$ADDITIONAL_OPTIONS --triggers" +<% else -%> +ADDITIONAL_OPTIONS="$ADDITIONAL_OPTIONS --skip-triggers" +<% end -%> +<% if @include_routines -%> +ADDITIONAL_OPTIONS="$ADDITIONAL_OPTIONS --routines" +<% else -%> +ADDITIONAL_OPTIONS="$ADDITIONAL_OPTIONS --skip-routines" +<% end -%> +<% end -%> + +##### STOP CONFIG #################################################### +PATH=<%= @execpath %> + + + +<%- if @kernel == 'Linux' -%> +set -o pipefail +<%- end -%> + +cleanup() +{ + find "${DIR}/" -maxdepth 1 -type f -name "${PREFIX}*.sql*" -mtime +${ROTATE} -print0 | xargs -0 -r rm -f +} + +<% if @delete_before_dump -%> +cleanup + +<% end -%> +<% if @backupdatabases.empty? -%> +<% if @file_per_database -%> +mysql --defaults-extra-file=$TMPFILE -s -r -N -e 'SHOW DATABASES' | while read dbname +do + mysqldump --defaults-extra-file=$TMPFILE --opt --flush-logs --single-transaction \ + ${ADDITIONAL_OPTIONS} \ + ${dbname} <% if @backupcompress %>| bzcat -zc <% end %>> ${DIR}/${PREFIX}${dbname}_`date +%Y%m%d-%H%M%S`.sql<% if @backupcompress %>.bz2<% end %> +done +<% else -%> +mysqldump --defaults-extra-file=$TMPFILE --opt --flush-logs --single-transaction \ + ${ADDITIONAL_OPTIONS} \ + --all-databases <% if @backupcompress %>| bzcat -zc <% end %>> ${DIR}/${PREFIX}`date +%Y%m%d-%H%M%S`.sql<% if @backupcompress %>.bz2<% end %> +<% end -%> +<% else -%> +<% @backupdatabases.each do |db| -%> +mysqldump --defaults-extra-file=$TMPFILE --opt --flush-logs --single-transaction \ + ${ADDITIONAL_OPTIONS} \ + <%= db %><% if @backupcompress %>| bzcat -zc <% end %>> ${DIR}/${PREFIX}<%= db %>_`date +%Y%m%d-%H%M%S`.sql<% if @backupcompress %>.bz2<% end %> +<% end -%> +<% end -%> + +<% unless @delete_before_dump -%> +if [ $? -eq 0 ] ; then + cleanup +fi +<% end -%> + +<% if @postscript -%> + <%- [@postscript].flatten.compact.each do |script|%> +<%= script %> + <%- end -%> +<% end -%> + +# Remove temporary file +rm -f $TMPFILE diff --git a/environments/production/modules/mysql/templates/xtrabackup.sh.erb b/environments/production/modules/mysql/templates/xtrabackup.sh.erb new file mode 100644 index 0000000..1449398 --- /dev/null +++ b/environments/production/modules/mysql/templates/xtrabackup.sh.erb @@ -0,0 +1,21 @@ +<%- if @kernel == 'Linux' -%> +#!/bin/bash +<%- else -%> +#!/bin/sh +<%- end -%> +# +# A wrapper for Xtrabackup +# +<% if @prescript -%> + <%- [@prescript].flatten.compact.each do |script| %> +<%= script %> + <%- end -%> +<% end -%> + +innobackupex "$@" + +<% if @postscript -%> + <%- [@postscript].flatten.compact.each do |script| %> +<%= script %> + <%- end -%> +<% end -%> diff --git a/environments/production/modules/postgresql/CHANGELOG.md b/environments/production/modules/postgresql/CHANGELOG.md new file mode 100644 index 0000000..4946eff --- /dev/null +++ b/environments/production/modules/postgresql/CHANGELOG.md @@ -0,0 +1,876 @@ +## Supported Release 4.9.0 +### Summary +This release adds several types and, among other bugs, fixes an issue with the yum URL. + +#### Features +- Modifying ownership of databases and schemas now available (MODULES-3247) +- Use `module_workdir` to specify a custom directory in which to execute psql commands +- `grant_role` and `grant` types added! +- Support for parallel unit testing (parallel_tests) +- Override download/installation repo URL with `repo_baseurl` +- Set your timezone with `timezone` +- Grant privileges on LANGUAGEs +- Added support for Debian Stretch and Ubuntu Yakkety Yak + +#### Bugfixes +- Usernames and passwords are now converted to strings before password hash is created +- Specify default database name if it is not the username +- Update to yum repo +- Schema name conflicts fix + +## Supported Release 4.8.0 +### Summary +This release primarily fixes an issue with `postgresql_conf` values of ipaddresses being considered floats and not getting quoted. + +#### Features +- Add `default_connect_settings` parameter to `postgresql::server` +- Running under strict variables is now supported +- Add timestamps into logs by default + +#### Bugfixes +- Obscure password in postgresql\_psql type +- Fix ip address quoting in postgresql\_conf type +- Fix handling of systemd service on Ubuntu +- Mark log_min_duration_statement setting as requiring a service restart +- Add fixes for Fedora 23, Fedora 24, FreeBSD, OpenBSD +- Fix environment handling to avoid "Overriding environment setting" message +- Work around PUP-6385, using empty arrays instead of undef when specifying resource relationships +- README editorial pass +- Reduce whitespace in templates +- Update build/test infrastructure + +## Supported Release 4.7.1 +### Summary +This release contains some bugfixes and documentation updates. + +#### Bugfixes +- (MODULES-3024) Quote database objects when creating databases. +- Properly escape case where password ends with '$'. +- Fixes password change when postgres is configure to non-standard port. +- Unpins concat dependency to be able to use concat 2.x. +- Workaround to fix installing on Amazon Linux. +- Fixes proper defaulting of `$service_provider` parameter. +- Fixes postgres server init script naming on Amazon Linux. +- Fixes service reload parameter on Arch Linux. +- Adds missing onlyif_function to sequence grant code. +- Fixes to the markdown of the README. + +## Supported Release 4.7.0 +### Summary +A release with a considerable amount of new features, including remote db support and several platform support updates. Various bugfixes including several to address warnings and a sizable README update. + +#### Features +- Remote DB support - Connection-settings allows a hash of options that can be used when connecting to a remote DB. +- Debian 8 support. +- Updated systemd-override to support fedora and CentOS paths. +- Adds the ability to define the extension name separately from the title of the resource, which allows you to add the extension to more than one database. +- Added parameter to disable automatic service restarts on config changes. +- Ubuntu 15.10 compatibility. +- OpenBSD version is now 9.4. +- Added .gitattributes to maintain line endings for .sh and .rb files. +- Adds default postgis version for 9.5. +- Allows float postgresql_conf values. +- Schedule apt update after install of repo. + +#### Bugfixes +- Fixed systemd-override for RedHat systems with unmanaged Yum repos. +- Removed inherits postgresql::params. +- Multi-node tests are now not ran by default. +- Change apt::pin to apt_postgresql_org to prevent error message. +- Removed syntax error near UTF8. +- Removal of extra blanks and backslashes in README. +- Double quotes now used around database name to prevent syntax error. +- Removes ruby 1.8.7 and puppet 2.7 from travis-ci jobs. +- Fixed paths to work on Amazon Linux. +- Fixed quotes around locale options. +- Huge README update. +- Update to use current msync configs. +- Fixes postgresql::server acceptance test descriptions. + +## Supported Release 4.6.1 +###Summary + +Small release for support of newer PE versions. This increments the version of PE in the metadata.json file. + +## 2015-09-01 - Supported Release 4.6.0 +### Summary +This release adds a proxy feature for yum, Postgis improvements, and decoupling pg_hba_rule from postgresql::server. + +#### Features +- Support setting a proxy for yum operations +- Allow for undefined PostGIS version +- Decouple pg_hba_rule from postgresql::server + +#### Bugfixes +- Fix postgis default package name on RedHat + +## 2015-07-27 - Supported Release 4.5.0 +### Summary +This release adds sequence grants, some postgresql 9.4 fixes, and `onlyif` to +the psql resource. + +### Features +- Add `onlyif` parameter to `postgresql_psql` +- Add unsupported compatibility with Ubuntu 15.04 +- Add unsupported compatibility with SLES 11/12 and OpenSuSE 13.2 +- Add `postgresql::server::grant::onlyif_exists` attribute +- Add `postgresql::server::table_grant::onlyif_exists` attribute +- Add granting permissions on sequences + +### Bugfixes +- Added docs for `postgresql::server::grant` +- Fix `pg_hba_conf_defaults => false` to not disable ipv4/ipv6 acls +- Fix 9.4 for `postgresql::server::pg_hba_rule` + +## 2015-07-07 - Supported Release 4.4.2 +### Summary +This release fixes a bug introduced in 4.4.0. + +#### Bugfixes +- Fixes `withenv` execution under Puppet 2.7. (MODULES-2185) + +## 2015-07-01 - Supported Release 4.4.1 +### Summary +This release fixes RHEL 7 & Fedora with manage_package_repo switched on. + +#### Bugfixes +- Ensure manage_package_repo variable is in scope for systemd-override file for RHEL7 + +## 2015-06-30 - Supported Release 4.4.0 +### Summary +This release has several new features, bugfixes, and test improvements. + +#### Features +- Adds a resource to manage recovery.conf. +- Adds a parameter that allows the specification of a validate connection script in `postgresql::client`. +- Adds support for plpython package management. +- Adds support for postgresql-docs management. +- Adds ability to make `postgresql::server::schema` titles unique. (MODULES-2049) +- Updates puppetlabs-apt module dependency to support version 2.1.0. + +#### Bugfixes +- Fix `postgresql_psql` parameter ordering to work on OpenBSD with Future Parser +- Fix setting postgres role password (MODULES-1869) +- Fix execution command with puppet <3.4 (MODULES-1923) +- Fix Puppet.newtype deprecation warning (MODULES-2007) +- Fix systemd override for manage_repo package versions +- Fix Copy snakeoil certificate and key instead of symlinking + +#### Test Improvements +- Allows setting BEAKER and BEAKER_RSPEC versions via environment variables. +- Enables Unit testing on Travis CI with Puppet 4. +- Cleans up spec_helper_acceptance.rb to use new puppet_install_helper gem. + +## 2015-03-24 - Supported Release 4.3.0 +### Summary +This release fixes compatibility with Puppet 4 and removes opportunities for local users to view the postgresql password. It also adds a new custom resource to aid in managing replication. + +#### Features +- Add `postgresql::server::logdir` parameter to manage the logdir +- Add `environment` parameter to `postgresql_psql` +- Add `postgresql_replication_slot` custom resource + +#### Bugfixes +- Fix for Puppet 4 +- Don't print postgresql\_psql password in command +- Allow `postgresql::validate_db_connection` for more than one host+port+database combo +- Fix service command on Debian 8 and up +- Fix `postgresql::server::extension` to work with custom user/group/port +- Fix `postgresql::server::initdb` to work with custom user/group/port +- Fix changing template1 encoding +- Fix default `postgresql::server::grant::object_name` value +- Fix idempotency of granting all tables in schema with `puppet::server::grant` +- Fix lint warnings +- Fix apt key to use 40 character key and bump puppetlabs-apt to >= 1.8.0 < 2.0.0 + + +##2015-03-10 - Supported Release 4.2.0 +###Summary + +This release has several new features including support for server extensions, improved grant support, and a number of bugfixes. + +####Features +- Changes to support OpenBSD +- Add `service_reload` parameter to `postgresql::server` +- Add `comment` parameter to `postgresql::server::database` (MODULES-1153) +- Add `postgresql::server::extension` defined type +- Add postgresql versions for utopic and jessie +- Update `postgresql::server::grant` to support 'GRANT SCHEMA' and 'ALL TABLES IN SCHEMA' + +####Bugfixes +- Lint cleanup +- Remove outdated upgrade info from README +- Use correct TCP port when checking password +- Create role before database +- Fix template1 encoding on Debian +- Require server package before user permissions +- Fix `service_status` default for FreeBSD to allow PostgreSQL to start the first run +- Fix invalid US-ASCII byte sequence in `postgresql::server::grant` comments +- Reverted to default behavior for Debian systems as `pg_config` should not be overwritten (MODULES-1485) + +##2014-11-04 - Supported Release 4.1.0 +###Summary + +This release adds the ability to change the PGDATA directory, and also includes documentation and test updates, future parser support, and a few other new features. + +####Features +- Future parser support +- Documentation updates +- Test updates +- Add a link from `/etc/sysconfig/pgsql/postgresql-${version}` to `/etc/sysconfig/pgsql/postgresql` to support init scripts from the postgresql.org repo +- Add support for changing the PGDATA directory +- Set default versions for Fedora 21 and FreeBSD + +##2014-09-03 - Supported Release 4.0.0 +###Summary + +This release removes the uninstall ability from the module, removes the firewall +management, overhauls all of the acceptance testing, as well as adds better +support for SuSE and Fedora. + +###Backwards Incompatible changes. + +- Uninstall code removal. +- Firewall management for Postgres. +- Set manage_pg_ident_conf to true. + +####Uninstallation removal + +We rely heavily on the ability to uninstall and reinstall postgres throughout +our testing code, testing features like "can I move from the distribution +packages to the upstream packages through the module" and over time we've +learnt that the uninstall code simply doesn't work a lot of the time. It +leaves traces of postgres behind or fails to remove certain packages on Ubuntu, +and generally causes bits to be left on your system that you didn't expect. + +When we then reinstall things fail because it's not a true clean slate, and +this causes us enormous problems during test. We've spent weeks and months +working on these tests and they simply don't hold up well across the full range +of PE platforms. + +Due to all these problems we've decided to take a stance on uninstalling in +general. We feel that in 2014 it's completely reasonable and normal to have a +good provisioning pipeline combined with your configuration management and the +"correct" way to uninstall a fully installed service like postgresql is to +simply reprovision the server without it in the first place. As a general rule +this is how I personally like to work and I think is a good practice. + +####I'm not OK with this! + +We understand that there are environments and situations in which it's not easy +to do that. What if you accidently deployed Postgres on 100,000 nodes? In the +future we're going to take a look at building some example 'profiles' to be +found under examples/ within this module that can uninstall postgres on popular +platforms. These can be modified and used in your specific case to uninstall +postgresql. They will be much more brute force and reliant on deleting entire +directories and require you to do more work up front in specifying where things +are installed but we think it'll prove to be a much cleaner mechanism for this +kind of thing rather than trying to weave it into the main module logic itself. + +####Features +- Removal of uninstall. +- Removal of firewall management. +- Tests ported to rspec3. +- Acceptance tests rewritten. +- Add a defined type for creating database schemas. +- Add a pg_ident_rule defined type. +- Set manage_pg_ident_conf to true. +- Manage pg_ident.conf by default. +- Improve selinux support for tablespace. +- Remove deprecation warnings. +- Support changing PGDATA on RedHat. +- Add SLES 11 support. + +####Bugfixes +- Link pg_config binary into /usr/bin. +- Fix fedora support by using systemd. +- Initdb should create xlogdir if set. +- Use a regular expression to match the major OS version on Ubuntu. + +##2014-07-31 - Supported Release 3.4.2 +###Summary + +This release fixes recent Fedora versions. + +####Features +####Bugfixes +- Fix Fedora. + +##2014-07-15 - Supported Release 3.4.1 +###Summary + +This release merely updates metadata.json so the module can be uninstalled and +upgraded via the puppet module command. + +##2014-04-14 - Supported Release 3.4.0 +###Summary + +This feature rolls up several important features, the biggest being PostGIS +handling and allowing `port` to be set on postgresql::server in order to +change the port that Postgres listens on. We've added support for RHEL7 +and Ubuntu 14.04, as well as allowing you to manage the service via +`service_ensure` finally. + +####Features +- Added `perl_package_name` for installing bindings. +- Added `service_ensure` for allowing control of services. +- Added `postgis_version` and postgis class for installing postgis. +- Added `port` for selecting the port Postgres runs on. +- Add support for RHEL7 and Ubuntu 14.04. +- Add `default_db` to postgresql::server::database. +- Widen the selection of unquoted parameters in postgresql_conf{} +- Require the service within postgresql::server::reload for RHEL7. +- Add `inherit` to postgresql::server::role. + +####Bugfixes + +##2014-03-04 - Supported Release 3.3.3 +###Summary + +This is a supported release. This release removes a testing symlink that can +cause trouble on systems where /var is on a seperate filesystem from the +modulepath. + +####Features +####Bugfixes +####Known Bugs +* SLES is not supported. + +##2014-03-04 - Supported Release 3.3.2 +###Summary +This is a supported release. It fixes a problem with updating passwords on postgresql.org distributed versions of PostgreSQL. + +####Bugfixes +- Correct psql path when setting password on custom versions. +- Documentation updates +- Test updates + +####Known Bugs +* SLES is not supported. + + +##2014-02-12 - Version 3.3.1 +####Bugfix: +- Allow dynamic rubygems host + + +##2014-01-28 - Version 3.3.0 + +###Summary + +This release rolls up a bunch of bugfixes our users have found and fixed for +us over the last few months. This improves things for 9.1 users, and makes +this module usable on FreeBSD. + +This release is dedicated to 'bma', who's suffering with Puppet 3.4.1 issues +thanks to Puppet::Util::SUIDManager.run_and_capture. + +####Features + - Add lc_ config entry settings + - Can pass template at database creation. + - Add FreeBSD support. + - Add support for customer `xlogdir` parameter. + - Switch tests from rspec-system to beaker. (This isn't really a feature) + +####Bugfixes + - Properly fix the deprecated Puppet::Util::SUIDManager.run_and_capture errors. + - Fix NOREPLICATION option for Postgres 9.1 + - Wrong parameter name: manage_pg_conf -> manage_pg_hba_conf + - Add $postgresql::server::client_package_name, referred to by install.pp + - Add missing service_provider/service_name descriptions in ::globals. + - Fix several smaller typos/issues throughout. + - Exec['postgresql_initdb'] needs to be done after $datadir exists + - Prevent defined resources from floating in the catalog. + - Fix granting all privileges on a table. + - Add some missing privileges. + - Remove deprecated and unused concat::fragment parameters. + + +##2013-11-05 - Version 3.2.0 + +###Summary + +Add's support for Ubuntu 13.10 (and 14.04) as well as x, y, z. + +####Features +- Add versions for Ubuntu 13.10 and 14.04. +- Use default_database in validate_db_connection instead of a hardcoded +'postgres' +- Add globals/params layering for default_database. +- Allow specification of default database name. + +####Bugs +- Fixes to the README. + + +##2013-10-25 - Version 3.1.0 + +###Summary + +This is a minor feature and bug fix release. + +Firstly, the postgresql_psql type now includes a new parameter `search_path` which is equivalent to using `set search_path` which allows you to change the default schema search path. + +The default version of Fedora 17 has now been added, so that Fedora 17 users can enjoy the module. + +And finally we've extended the capabilities of the defined type postgresql::validate_db_connection so that now it can handle retrying and sleeping between retries. This feature has been monopolized to fix a bug we were seeing with startup race conditions, but it can also be used by remote systems to 'wait' for PostgreSQL to start before their Puppet run continues. + +####Features +- Defined $default_version for Fedora 17 (Bret Comnes) +- add search_path attribute to postgresql_psql resource (Jeremy Kitchen) +- (GH-198) Add wait and retry capability to validate_db_connection (Ken Barber) + +####Bugs +- enabling defined postgres user password without resetting on every puppet run (jonoterc) +- periods are valid in configuration variables also (Jeremy Kitchen) +- Add zero length string to join() function (Jarl Stefansson) +- add require of install to reload class (cdenneen) +- (GH-198) Fix race condition on postgresql startup (Ken Barber) +- Remove concat::setup for include in preparation for the next concat release (Ken Barber) + + +##2013-10-14 - Version 3.0.0 + +Final release of 3.0, enjoy! + + +##2013-10-14 - Version 3.0.0-rc3 + +###Summary + +Add a parameter to unmanage pg_hba.conf to fix a regression from 2.5, as well +as allowing owner to be passed into x. + +####Features +- `manage_pg_hba_conf` parameter added to control pg_hba.conf management. +- `owner` parameter added to server::db. + + +##2013-10-09 - Version 3.0.0-rc2 + +###Summary + +A few bugfixes have been found since -rc1. + +####Fixes +- Special case for $datadir on Amazon +- Fix documentation about username/password for the postgresql_hash function + + +##2013-10-01 - Version 3.0.0-rc1 + +###Summary + +Version 3 was a major rewrite to fix some internal dependency issues, and to +make the new Public API more clear. As a consequence a lot of things have +changed for version 3 and older revisions that we will try to outline here. + +(NOTE: The format of this CHANGELOG differs to normal in an attempt to +explain the scope of changes) + +* Server specific objects now moved under `postgresql::server::` namespace: + +To restructure server specific elements under the `postgresql::server::` +namespaces the following objects were renamed as such: + +`postgresql::database` -> `postgresql::server::database` +`postgresql::database_grant` -> `postgresql::server::database_grant` +`postgresql::db` -> `postgresql::server::db` +`postgresql::grant` -> `postgresql::server::grant` +`postgresql::pg_hba_rule` -> `postgresql::server::pg_hba_rule` +`postgresql::plperl` -> `postgresql::server::plperl` +`postgresql::contrib` -> `postgresql::server::contrib` +`postgresql::role` -> `postgresql::server::role` +`postgresql::table_grant` -> `postgresql::server::table_grant` +`postgresql::tablespace` -> `postgresql::server::tablespace` + +* New `postgresql::server::config_entry` resource for managing configuration: + +Previously we used the `file_line` resource to modify `postgresql.conf`. This +new revision now adds a new resource named `postgresql::server::config_entry` +for managing this file. For example: + +```puppet + postgresql::server::config_entry { 'check_function_bodies': + value => 'off', + } +``` + +If you were using `file_line` for this purpose, you should change to this new +methodology. + +* `postgresql_puppet_extras.conf` has been removed: + +Now that we have a methodology for managing `postgresql.conf`, and due to +concerns over the file management methodology using an `exec { 'touch ...': }` +as a way to create an empty file the existing postgresql\_puppet\_extras.conf +file is no longer managed by this module. + +If you wish to recreate this methodology yourself, use this pattern: + +```puppet + class { 'postgresql::server': } + + $extras = "/tmp/include.conf" + + file { $extras: + content => 'max_connections = 123', + notify => Class['postgresql::server::service'], + }-> + postgresql::server::config_entry { 'include': + value => $extras, + } +``` + +* All uses of the parameter `charset` changed to `encoding`: + +Since PostgreSQL uses the terminology `encoding` not `charset` the parameter +has been made consisent across all classes and resources. + +* The `postgresql` base class is no longer how you set globals: + +The old global override pattern was less then optimal so it has been fixed, +however we decided to demark this properly by specifying these overrides in +the class `postgresql::global`. Consult the documentation for this class now +to see what options are available. + +Also, some parameter elements have been moved between this and the +`postgresql::server` class where it made sense. + +* `config_hash` parameter collapsed for the `postgresql::server` class: + +Because the `config_hash` was really passing data through to what was in +effect an internal class (`postgresql::config`). And since we don't want this +kind of internal exposure the parameters were collapsed up into the +`postgresql::server` class directly. + +* Lots of changes to 'private' or 'undocumented' classes: + +If you were using these before, these have changed names. You should only use +what is documented in this README.md, and if you don't have what you need you +should raise a patch to add that feature to a public API. All internal classes +now have a comment at the top indicating them as private to make sure the +message is clear that they are not supported as Public API. + +* `pg_hba_conf_defaults` parameter included to turn off default pg\_hba rules: + +The defaults should be good enough for most cases (if not raise a bug) but if +you simply need an escape hatch, this setting will turn off the defaults. If +you want to do this, it may affect the rest of the module so make sure you +replace the rules with something that continues operation. + +* `postgresql::database_user` has now been removed: + +Use `postgresql::server::role` instead. + +* `postgresql::psql` resource has now been removed: + +Use `postgresql_psql` instead. In the future we may recreate this as a wrapper +to add extra capability, but it will not match the old behaviour. + +* `postgresql_default_version` fact has now been removed: + +It didn't make sense to have this logic in a fact any more, the logic has been +moved into `postgresql::params`. + +* `ripienaar/concat` is no longer used, instead we use `puppetlabs/concat`: + +The older concat module is now deprecated and moved into the +`puppetlabs/concat` namespace. Functionality is more or less identical, but +you may need to intervene during the installing of this package - as both use +the same `concat` namespace. + +--- +##2013-09-09 Release 2.5.0 + +###Summary + +The focus of this release is primarily to capture the fixes done to the +types and providers to make sure refreshonly works properly and to set +the stage for the large scale refactoring work of 3.0.0. + +####Features + + +####Bugfixes +- Use boolean for refreshonly. +- Fix postgresql::plperl documentation. +- Add two missing parameters to config::beforeservice +- Style fixes + + +##2013-08-01 Release 2.4.1 + +###Summary + +This minor bugfix release solves an idempotency issue when using plain text +passwords for the password_hash parameter for the postgresql::role defined +type. Without this, users would continually see resource changes everytime +your run Puppet. + +####Bugfixes +- Alter role call not idempotent with cleartext passwords (Ken Barber) + + +##2013-07-19 Release 2.4.0 + +###Summary + +This updates adds the ability to change permissions on tables, create template +databases from normal databases, manage PL-Perl's postgres package, and +disable the management of `pg_hba.conf`. + +####Features +- Add `postgresql::table_grant` defined resource +- Add `postgresql::plperl` class +- Add `manage_pg_hba_conf` parameter to the `postgresql::config` class +- Add `istemplate` parameter to the `postgresql::database` define + +####Bugfixes +- Update `postgresql::role` class to be able to update roles when modified +instead of only on creation. +- Update tests +- Fix documentation of `postgresql::database_grant` + + +##2.3.0 + +This feature release includes the following changes: + +* Add a new parameter `owner` to the `database` type. This can be used to + grant ownership of a new database to a specific user. (Bruno Harbulot) +* Add support for operating systems other than Debian/RedHat, as long as the + user supplies custom values for all of the required paths, package names, etc. + (Chris Price) +* Improved integration testing (Ken Barber) + + +##2.2.1 + +This release fixes a bug whereby one of our shell commands (psql) were not ran from a globally accessible directory. This was causing permission denied errors when the command attempted to change user without changing directory. + +Users of previous versions might have seen this error: + + Error: Error executing SQL; psql returned 256: 'could not change directory to "/root" + +This patch should correct that. + +#### Detail Changes + +* Set /tmp as default CWD for postgresql_psql + + +##2.2.0 + +This feature release introduces a number of new features and bug fixes. + +First of all it includes a new class named `postgresql::python` which provides you with a convenient way of install the python Postgresql client libraries. + + class { 'postgresql::python': + } + +You are now able to use `postgresql::database_user` without having to specify a password_hash, useful for different authentication mechanisms that do not need passwords (ie. cert, local etc.). + +We've also provided a lot more advanced custom parameters now for greater control of your Postgresql installation. Consult the class documentation for PuppetDB in the README. + +This release in particular has largely been contributed by the community members below, a big thanks to one and all. + +#### Detailed Changes + +* Add support for psycopg installation (Flaper Fesp and Dan Prince) +* Added default PostgreSQL version for Ubuntu 13.04 (Kamil Szymanski) +* Add ability to create users without a password (Bruno Harbulot) +* Three Puppet 2.6 fixes (Dominic Cleal) +* Add explicit call to concat::setup when creating concat file (Dominic Cleal) +* Fix readme typo (Jordi Boggiano) +* Update postgres_default_version for Ubuntu (Kamil Szymanski) +* Allow to set connection for noew role (Kamil Szymanski) +* Fix pg_hba_rule for postgres local access (Kamil Szymanski) +* Fix versions for travis-ci (Ken Barber) +* Add replication support (Jordi Boggiano) +* Cleaned up and added unit tests (Ken Barber) +* Generalization to provide more flexability in postgresql configuration (Karel Brezina) +* Create dependent directory for sudoers so tests work on Centos 5 (Ken Barber) +* Allow SQL commands to be run against a specific DB (Carlos Villela) +* Drop trailing comma to support Puppet 2.6 (Michael Arnold) + + +##2.1.1 + + +This release provides a bug fix for RHEL 5 and Centos 5 systems, or specifically systems using PostgreSQL 8.1 or older. On those systems one would have received the error: + + Error: Could not start Service[postgresqld]: Execution of ‘/sbin/service postgresql start’ returned 1: + +And the postgresql log entry: + + FATAL: unrecognized configuration parameter "include" + +This bug is due to a new feature we had added in 2.1.0, whereby the `include` directive in `postgresql.conf` was not compatible. As a work-around we have added checks in our code to make sure systems running PostgreSQL 8.1 or older do not have this directive added. + +#### Detailed Changes + +2013-01-21 - Ken Barber +* Only install `include` directive and included file on PostgreSQL >= 8.2 +* Add system tests for Centos 5 + + +##2.1.0 + +This release is primarily a feature release, introducing some new helpful constructs to the module. + +For starters, we've added the line `include 'postgresql_conf_extras.conf'` by default so extra parameters not managed by the module can be added by other tooling or by Puppet itself. This provides a useful escape-hatch for managing settings that are not currently managed by the module today. + +We've added a new defined resource for managing your tablespace, so you can now create new tablespaces using the syntax: + + postgresql::tablespace { 'dbspace': + location => '/srv/dbspace', + } + +We've added a locale parameter to the `postgresql` class, to provide a default. Also the parameter has been added to the `postgresql::database` and `postgresql::db` defined resources for changing the locale per database: + + postgresql::db { 'mydatabase': + user => 'myuser', + password => 'mypassword', + encoding => 'UTF8', + locale => 'en_NG', + } + +There is a new class for installing the necessary packages to provide the PostgreSQL JDBC client jars: + + class { 'postgresql::java': } + +And we have a brand new defined resource for managing fine-grained rule sets within your pg_hba.conf access lists: + + postgresql::pg_hba { 'Open up postgresql for access from 200.1.2.0/24': + type => 'host', + database => 'app', + user => 'app', + address => '200.1.2.0/24', + auth_method => 'md5', + } + +Finally, we've also added Travis-CI support and unit tests to help us iterate faster with tests to reduce regression. The current URL for these tests is here: https://travis-ci.org/puppetlabs/puppet-postgresql. Instructions on how to run the unit tests available are provided in the README for the module. + +A big thanks to all those listed below who made this feature release possible :-). + +#### Detailed Changes + +2013-01-18 - Simão Fontes & Flaper Fesp +* Remove trailing commas from params.pp property definition for Puppet 2.6.0 compatibility + +2013-01-18 - Lauren Rother +* Updated README.md to conform with best practices template + +2013-01-09 - Adrien Thebo +* Update postgresql_default_version to 9.1 for Debian 7.0 + +2013-01-28 - Karel Brezina +* Add support for tablespaces + +2013-01-16 - Chris Price & Karel Brezina +* Provide support for an 'include' config file 'postgresql_conf_extras.conf' that users can modify manually or outside of the module. + +2013-01-31 - jv +* Fix typo in README.pp for postgresql::db example + +2013-02-03 - Ken Barber +* Add unit tests and travis-ci support + +2013-02-02 - Ken Barber +* Add locale parameter support to the 'postgresql' class + +2013-01-21 - Michael Arnold +* Add a class for install the packages containing the PostgreSQL JDBC jar + +2013-02-06 - fhrbek +* Coding style fixes to reduce warnings in puppet-lint and Geppetto + +2013-02-10 - Ken Barber +* Provide new defined resource for managing pg_hba.conf + +2013-02-11 - Ken Barber +* Fix bug with reload of Postgresql on Redhat/Centos + +2013-02-15 - Erik Dalén +* Fix more style issues to reduce warnings in puppet-lint and Geppetto + +2013-02-15 - Erik Dalén +* Fix case whereby we were modifying a hash after creation + + +##2.0.1 + +Minor bugfix release. + +2013-01-16 - Chris Price + * Fix revoke command in database.pp to support postgres 8.1 (43ded42) + +2013-01-15 - Jordi Boggiano + * Add support for ubuntu 12.10 status (3504405) + +##2.0.0 + +Many thanks to the following people who contributed patches to this +release: + +* Adrien Thebo +* Albert Koch +* Andreas Ntaflos +* Brett Porter +* Chris Price +* dharwood +* Etienne Pelletier +* Florin Broasca +* Henrik +* Hunter Haugen +* Jari Bakken +* Jordi Boggiano +* Ken Barber +* nzakaria +* Richard Arends +* Spenser Gilliland +* stormcrow +* William Van Hevelingen + +Notable features: + + * Add support for versions of postgres other than the system default version + (which varies depending on OS distro). This includes optional support for + automatically managing the package repo for the "official" postgres yum/apt + repos. (Major thanks to Etienne Pelletier and + Ken Barber for their tireless efforts and patience on this + feature set!) For example usage see `tests/official-postgresql-repos.pp`. + + * Add some support for Debian Wheezy and Ubuntu Quantal + + * Add new `postgres_psql` type with a Ruby provider, to replace the old + exec-based `psql` type. This gives us much more flexibility around + executing SQL statements and controlling their logging / reports output. + + * Major refactor of the "spec" tests--which are actually more like + acceptance tests. We now support testing against multiple OS distros + via vagrant, and the framework is in place to allow us to very easily add + more distros. Currently testing against Cent6 and Ubuntu 10.04. + + * Fixed a bug that was preventing multiple databases from being owned by the + same user + (9adcd182f820101f5e4891b9f2ff6278dfad495c - Etienne Pelletier ) + + * Add support for ACLs for finer-grained control of user/interface access + (b8389d19ad78b4fb66024897097b4ed7db241930 - dharwood ) + + * Many other bug fixes and improvements! + +--- +##1.0.0 + +2012-09-17 - Version 0.3.0 released + +2012-09-14 - Chris Price + * Add a type for validating a postgres connection (ce4a049) + +2012-08-25 - Jari Bakken + * Remove trailing commas. (e6af5e5) + +2012-08-16 - Version 0.2.0 released diff --git a/environments/production/modules/postgresql/CONTRIBUTING.md b/environments/production/modules/postgresql/CONTRIBUTING.md new file mode 100644 index 0000000..990edba --- /dev/null +++ b/environments/production/modules/postgresql/CONTRIBUTING.md @@ -0,0 +1,217 @@ +Checklist (and a short version for the impatient) +================================================= + + * Commits: + + - Make commits of logical units. + + - Check for unnecessary whitespace with "git diff --check" before + committing. + + - Commit using Unix line endings (check the settings around "crlf" in + git-config(1)). + + - Do not check in commented out code or unneeded files. + + - The first line of the commit message should be a short + description (50 characters is the soft limit, excluding ticket + number(s)), and should skip the full stop. + + - Associate the issue in the message. The first line should include + the issue number in the form "(#XXXX) Rest of message". + + - The body should provide a meaningful commit message, which: + + - uses the imperative, present tense: "change", not "changed" or + "changes". + + - includes motivation for the change, and contrasts its + implementation with the previous behavior. + + - Make sure that you have tests for the bug you are fixing, or + feature you are adding. + + - Make sure the test suites passes after your commit: + `bundle exec rspec spec/acceptance` More information on [testing](#Testing) below + + - When introducing a new feature, make sure it is properly + documented in the README.md + + * Submission: + + * Pre-requisites: + + - Make sure you have a [GitHub account](https://github.com/join) + + - [Create a ticket](https://tickets.puppet.com/secure/CreateIssue!default.jspa), or [watch the ticket](https://tickets.puppet.com/browse/) you are patching for. + + * Preferred method: + + - Fork the repository on GitHub. + + - Push your changes to a topic branch in your fork of the + repository. (the format ticket/1234-short_description_of_change is + usually preferred for this project). + + - Submit a pull request to the repository in the puppetlabs + organization. + +The long version +================ + + 1. Make separate commits for logically separate changes. + + Please break your commits down into logically consistent units + which include new or changed tests relevant to the rest of the + change. The goal of doing this is to make the diff easier to + read for whoever is reviewing your code. In general, the easier + your diff is to read, the more likely someone will be happy to + review it and get it into the code base. + + If you are going to refactor a piece of code, please do so as a + separate commit from your feature or bug fix changes. + + We also really appreciate changes that include tests to make + sure the bug is not re-introduced, and that the feature is not + accidentally broken. + + Describe the technical detail of the change(s). If your + description starts to get too long, that is a good sign that you + probably need to split up your commit into more finely grained + pieces. + + Commits which plainly describe the things which help + reviewers check the patch and future developers understand the + code are much more likely to be merged in with a minimum of + bike-shedding or requested changes. Ideally, the commit message + would include information, and be in a form suitable for + inclusion in the release notes for the version of Puppet that + includes them. + + Please also check that you are not introducing any trailing + whitespace or other "whitespace errors". You can do this by + running "git diff --check" on your changes before you commit. + + 2. Sending your patches + + To submit your changes via a GitHub pull request, we _highly_ + recommend that you have them on a topic branch, instead of + directly on "master". + It makes things much easier to keep track of, especially if + you decide to work on another thing before your first change + is merged in. + + GitHub has some pretty good + [general documentation](http://help.github.com/) on using + their site. They also have documentation on + [creating pull requests](http://help.github.com/send-pull-requests/). + + In general, after pushing your topic branch up to your + repository on GitHub, you can switch to the branch in the + GitHub UI and click "Pull Request" towards the top of the page + in order to open a pull request. + + + 3. Update the related GitHub issue. + + If there is a GitHub issue associated with the change you + submitted, then you should update the ticket to include the + location of your branch, along with any other commentary you + may wish to make. + +Testing +======= + +Getting Started +--------------- + +Our puppet modules provide [`Gemfile`](./Gemfile)s which can tell a ruby +package manager such as [bundler](http://bundler.io/) what Ruby packages, +or Gems, are required to build, develop, and test this software. + +Please make sure you have [bundler installed](http://bundler.io/#getting-started) +on your system, then use it to install all dependencies needed for this project, +by running + +```shell +% bundle install +Fetching gem metadata from https://rubygems.org/........ +Fetching gem metadata from https://rubygems.org/.. +Using rake (10.1.0) +Using builder (3.2.2) +-- 8><-- many more --><8 -- +Using rspec-system-puppet (2.2.0) +Using serverspec (0.6.3) +Using rspec-system-serverspec (1.0.0) +Using bundler (1.3.5) +Your bundle is complete! +Use `bundle show [gemname]` to see where a bundled gem is installed. +``` + +NOTE some systems may require you to run this command with sudo. + +If you already have those gems installed, make sure they are up-to-date: + +```shell +% bundle update +``` + +With all dependencies in place and up-to-date we can now run the tests: + +```shell +% bundle exec rake spec +``` + +This will execute all the [rspec tests](http://rspec-puppet.com/) tests +under [spec/defines](./spec/defines), [spec/classes](./spec/classes), +and so on. rspec tests may have the same kind of dependencies as the +module they are testing. While the module defines in its [Modulefile](./Modulefile), +rspec tests define them in [.fixtures.yml](./fixtures.yml). + +Some puppet modules also come with [beaker](https://github.com/puppetlabs/beaker) +tests. These tests spin up a virtual machine under +[VirtualBox](https://www.virtualbox.org/)) with, controlling it with +[Vagrant](http://www.vagrantup.com/) to actually simulate scripted test +scenarios. In order to run these, you will need both of those tools +installed on your system. + +You can run them by issuing the following command + +```shell +% bundle exec rake spec_clean +% bundle exec rspec spec/acceptance +``` + +This will now download a pre-fabricated image configured in the [default node-set](./spec/acceptance/nodesets/default.yml), +install puppet, copy this module and install its dependencies per [spec/spec_helper_acceptance.rb](./spec/spec_helper_acceptance.rb) +and then run all the tests under [spec/acceptance](./spec/acceptance). + +Writing Tests +------------- + +XXX getting started writing tests. + +If you have commit access to the repository +=========================================== + +Even if you have commit access to the repository, you will still need to +go through the process above, and have someone else review and merge +in your changes. The rule is that all changes must be reviewed by a +developer on the project (that did not write the code) to ensure that +all changes go through a code review process. + +Having someone other than the author of the topic branch recorded as +performing the merge is the record that they performed the code +review. + + +Additional Resources +==================== + +* [Getting additional help](http://puppet.com/community/get-help) + +* [Writing tests](https://docs.puppet.com/guides/module_guides/bgtm.html#step-three-module-testing) + +* [General GitHub documentation](http://help.github.com/) + +* [GitHub pull request documentation](http://help.github.com/send-pull-requests/) diff --git a/environments/production/modules/postgresql/Gemfile b/environments/production/modules/postgresql/Gemfile new file mode 100644 index 0000000..5d86325 --- /dev/null +++ b/environments/production/modules/postgresql/Gemfile @@ -0,0 +1,86 @@ +#This file is generated by ModuleSync, do not edit. + +source ENV['GEM_SOURCE'] || "https://rubygems.org" + +# Determines what type of gem is requested based on place_or_version. +def gem_type(place_or_version) + if place_or_version =~ /^git:/ + :git + elsif place_or_version =~ /^file:/ + :file + else + :gem + end +end + +# Find a location or specific version for a gem. place_or_version can be a +# version, which is most often used. It can also be git, which is specified as +# `git://somewhere.git#branch`. You can also use a file source location, which +# is specified as `file://some/location/on/disk`. +def location_for(place_or_version, fake_version = nil) + if place_or_version =~ /^(git[:@][^#]*)#(.*)/ + [fake_version, { :git => $1, :branch => $2, :require => false }].compact + elsif place_or_version =~ /^file:\/\/(.*)/ + ['>= 0', { :path => File.expand_path($1), :require => false }] + else + [place_or_version, { :require => false }] + end +end + +# Used for gem conditionals +supports_windows = false + +group :development do + gem 'puppet-lint', :require => false + gem 'metadata-json-lint', :require => false, :platforms => 'ruby' + gem 'puppet_facts', :require => false + gem 'puppet-blacksmith', '>= 3.4.0', :require => false, :platforms => 'ruby' + gem 'puppetlabs_spec_helper', '>= 1.2.1', :require => false + gem 'rspec-puppet', '>= 2.3.2', :require => false + gem 'rspec-puppet-facts', :require => false, :platforms => 'ruby' + gem 'mocha', '< 1.2.0', :require => false + gem 'simplecov', :require => false, :platforms => 'ruby' + gem 'parallel_tests', '< 2.10.0', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'parallel_tests', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.0.0') + gem 'rubocop', '0.41.2', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'rubocop', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.0.0') + gem 'rubocop-rspec', '~> 1.6', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.3.0') + gem 'pry', :require => false + gem 'json_pure', '<= 2.0.1', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'fast_gettext', '1.1.0', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.1.0') + gem 'fast_gettext', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.1.0') + gem 'rainbow', '< 2.2.0', :require => false +end + +group :system_tests do + gem 'beaker', *location_for(ENV['BEAKER_VERSION'] || '>= 3') + gem 'beaker-pe', :require => false + gem 'beaker-rspec', *location_for(ENV['BEAKER_RSPEC_VERSION']) + gem 'beaker-puppet_install_helper', :require => false + gem 'beaker-module_install_helper', :require => false + gem 'master_manipulator', :require => false + gem 'beaker-hostgenerator', *location_for(ENV['BEAKER_HOSTGENERATOR_VERSION']) + gem 'beaker-abs', *location_for(ENV['BEAKER_ABS_VERSION'] || '~> 0.1') +end + +gem 'puppet', *location_for(ENV['PUPPET_GEM_VERSION']) + +# Only explicitly specify Facter/Hiera if a version has been specified. +# Otherwise it can lead to strange bundler behavior. If you are seeing weird +# gem resolution behavior, try setting `DEBUG_RESOLVER` environment variable +# to `1` and then run bundle install. +gem 'facter', *location_for(ENV['FACTER_GEM_VERSION']) if ENV['FACTER_GEM_VERSION'] +gem 'hiera', *location_for(ENV['HIERA_GEM_VERSION']) if ENV['HIERA_GEM_VERSION'] + + +# Evaluate Gemfile.local if it exists +if File.exists? "#{__FILE__}.local" + eval(File.read("#{__FILE__}.local"), binding) +end + +# Evaluate ~/.gemfile if it exists +if File.exists?(File.join(Dir.home, '.gemfile')) + eval(File.read(File.join(Dir.home, '.gemfile')), binding) +end + +# vim:ft=ruby diff --git a/environments/production/modules/postgresql/LICENSE b/environments/production/modules/postgresql/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/environments/production/modules/postgresql/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/environments/production/modules/postgresql/MAINTAINERS.md b/environments/production/modules/postgresql/MAINTAINERS.md new file mode 100644 index 0000000..d8c8f6f --- /dev/null +++ b/environments/production/modules/postgresql/MAINTAINERS.md @@ -0,0 +1,6 @@ +## Maintenance + +Maintainers: + - Puppet Forge Modules Team `forge-modules |at| puppet |dot| com` + +Tickets: https://tickets.puppet.com/browse/MODULES. Make sure to set component to `postgresql`. diff --git a/environments/production/modules/postgresql/NOTICE b/environments/production/modules/postgresql/NOTICE new file mode 100644 index 0000000..295ce29 --- /dev/null +++ b/environments/production/modules/postgresql/NOTICE @@ -0,0 +1,29 @@ +postgresql puppet module + +Copyright (C) 2012-2016 Puppet Labs, Inc. +Copyright (C) 2012 Inkling Systems Inc +Copyright (C) 2012-2013 Camptocamp SA. + +This product includes software developed by: + The Puppet Labs Inc (http://www.puppetlabs.com/). + +This product includes also software developed by: + Camptocamp SA (http://www.camptocamp.com/) + +This product includes also software developed by: + Inkling Systems Inc (https://www.inkling.com/) + +Puppet Labs can be contacted at: info@puppetlabs.com + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/environments/production/modules/postgresql/README.md b/environments/production/modules/postgresql/README.md new file mode 100644 index 0000000..1128623 --- /dev/null +++ b/environments/production/modules/postgresql/README.md @@ -0,0 +1,1461 @@ +# postgresql + +#### Table of Contents + +1. [Module Description - What does the module do?](#module-description) +2. [Setup - The basics of getting started with postgresql module](#setup) + * [What postgresql affects](#what-postgresql-affects) + * [Getting started with postgresql](#getting-started-with-postgresql) +3. [Usage - Configuration options and additional functionality](#usage) + * [Configure a server](#configure-a-server) + * [Create a database](#create-a-database) + * [Manage users, roles, and permissions](#manage-users-roles-and-permissions) + * [Override defaults](#override-defaults) + * [Create an access rule for pg_hba.conf](#create-an-access-rule-for-pg_hbaconf) + * [Create user name maps for pg_ident.conf](#create-user-name-maps-for-pg_identconf) + * [Validate connectivity](#validate-connectivity) +4. [Reference - An under-the-hood peek at what the module is doing and how](#reference) + * [Classes](#classes) + * [Defined Types](#defined-types) + * [Types](#types) + * [Functions](#functions) +5. [Limitations - OS compatibility, etc.](#limitations) +6. [Development - Guide for contributing to the module](#development) + * [Contributors - List of module contributors](#contributors) +7. [Tests](#tests) +8. [Contributors - List of module contributors](#contributors) + +## Module description + +The postgresql module allows you to manage PostgreSQL databases with Puppet. + +PostgreSQL is a high-performance, free, open-source relational database server. The postgresql module allows you to manage packages, services, databases, users, and common security settings in PostgreSQL. + +## Setup + +### What postgresql affects + +* Package, service, and configuration files for PostgreSQL +* Listened-to ports +* IP and mask (optional) + +### Getting started with postgresql + +To configure a basic default PostgreSQL server, declare the `postgresql::server` class. + +```puppet +class { 'postgresql::server': } +``` + +## Usage + +### Configure a server + +For default settings, declare the `postgresql::server` class as above. To customize PostgreSQL server settings, specify the [parameters](#postgresqlserver) you want to change: + +```puppet +class { 'postgresql::server': + ip_mask_deny_postgres_user => '0.0.0.0/32', + ip_mask_allow_all_users => '0.0.0.0/0', + listen_addresses => '*', + ipv4acls => ['hostssl all johndoe 192.168.0.0/24 cert'], + postgres_password => 'TPSrep0rt!', +} +``` + +After configuration, test your settings from the command line: + +``` +psql -h localhost -U postgres +psql -h my.postgres.server -U +``` + +If you get an error message from these commands, your permission settings restrict access from the location you're trying to connect from. Depending on whether you want to allow connections from that location, you might need to adjust your permissions. + +For more details about server configuration parameters, consult the [PostgreSQL Runtime Configuration documentation](http://www.postgresql.org/docs/current/static/runtime-config.html). + +### Create a database + +You can set up a variety of PostgreSQL databases with the `postgresql::server::db` defined type. For instance, to set up a database for PuppetDB: + +```puppet +class { 'postgresql::server': } + +postgresql::server::db { 'mydatabasename': + user => 'mydatabaseuser', + password => postgresql_password('mydatabaseuser', 'mypassword'), +} +``` + +### Manage users, roles, and permissions + +To manage users, roles, and permissions: + +```puppet +class { 'postgresql::server': } + +postgresql::server::role { 'marmot': +password_hash => postgresql_password('marmot', 'mypasswd'), +} + +postgresql::server::database_grant { 'test1': + privilege => 'ALL', + db => 'test1', + role => 'marmot', +} + +postgresql::server::table_grant { 'my_table of test2': + privilege => 'ALL', + table => 'my_table', + db => 'test2', + role => 'marmot', +} +``` + +This example grants **all** privileges on the test1 database and on the `my_table` table of the test2 database to the specified user or group. After the values are added into the PuppetDB config file, this database would be ready for use. + +### Override defaults + +The `postgresql::globals` class allows you to configure the main settings for this module globally, so that other classes and defined resources can use them. By itself, it does nothing. + +For example, to overwrite the default `locale` and `encoding` for all classes, use the following: + +```puppet +class { 'postgresql::globals': + encoding => 'UTF-8', + locale => 'en_US.UTF-8', +}-> +class { 'postgresql::server': +} +``` + +To use a specific version of the PostgreSQL package: + +```puppet +class { 'postgresql::globals': + manage_package_repo => true, + version => '9.2', +}-> +class { 'postgresql::server': } +``` + +### Manage remote users, roles, and permissions + +Remote SQL objects are managed using the same Puppet resources as local SQL objects, along with a [`connect_settings`](#connect_settings) hash. This provides control over how Puppet connects to the remote Postgres instances and which version is used for generating SQL commands. + +The `connect_settings` hash can contain environment variables to control Postgres client connections, such as 'PGHOST', 'PGPORT', 'PGPASSWORD', and 'PGSSLKEY'. See the [PostgreSQL Environment Variables](http://www.postgresql.org/docs/9.4/static/libpq-envars.html) documentation for a complete list of variables. + +Additionally, you can specify the target database version with the special value of 'DBVERSION'. If the `connect_settings` hash is omitted or empty, then Puppet connects to the local PostgreSQL instance. + +You can provide a `connect_settings` hash for each of the Puppet resources, or you can set a default `connect_settings` hash in `postgresql::globals`. Configuring `connect_settings` per resource allows SQL objects to be created on multiple databases by multiple users. + +```puppet +$connection_settings_super2 = { + 'PGUSER' => "super2", + 'PGPASSWORD' => "foobar2", + 'PGHOST' => "127.0.0.1", + 'PGPORT' => "5432", + 'PGDATABASE' => "postgres", + } + +include postgresql::server + +# Connect with no special settings, i.e domain sockets, user postgres +postgresql::server::role{'super2': + password_hash => "foobar2", + superuser => true, + + connect_settings => {}, + require => [ + Class['postgresql::globals'], + Class['postgresql::server::service'], + ], +} + +# Now using this new user connect via TCP +postgresql::server::database { 'db1': + connect_settings => $connection_settings_super2, + +require => Postgresql::Server::Role['super2'], +} +``` + +### Create an access rule for pg_hba.conf + +To create an access rule for `pg_hba.conf`: + +```puppet +postgresql::server::pg_hba_rule { 'allow application network to access app database': + description => "Open up PostgreSQL for access from 200.1.2.0/24", + type => 'host', + database => 'app', + user => 'app', + address => '200.1.2.0/24', + auth_method => 'md5', +} +``` + +This would create a ruleset in `pg_hba.conf` similar to: + +``` +# Rule Name: allow application network to access app database +# Description: Open up PostgreSQL for access from 200.1.2.0/24 +# Order: 150 +host app app 200.1.2.0/24 md5 +``` + +By default, `pg_hba_rule` requires that you include `postgresql::server`. However, you can override that behavior by setting target and postgresql_version when declaring your rule. That might look like the following: + +```puppet +postgresql::server::pg_hba_rule { 'allow application network to access app database': + description => "Open up postgresql for access from 200.1.2.0/24", + type => 'host', + database => 'app', + user => 'app', + address => '200.1.2.0/24', + auth_method => 'md5', + target => '/path/to/pg_hba.conf', + postgresql_version => '9.4', +} +``` + +### Create user name maps for pg_ident.conf + +To create a user name map for the pg_ident.conf: + +```puppet +postgresql::server::pg_ident_rule{ 'Map the SSL certificate of the backup server as a replication user': + map_name => 'sslrepli', + system_username => 'repli1.example.com', + database_username => 'replication', +} +``` + +This would create a user name map in `pg_ident.conf` similar to: + +``` +#Rule Name: Map the SSL certificate of the backup server as a replication user +#Description: none +#Order: 150 +sslrepli repli1.example.com replication +``` + +### Create recovery configuration + +To create the recovery configuration file (`recovery.conf`): + +```puppet +postgresql::server::recovery{ 'Create a recovery.conf file with the following defined parameters': + restore_command => 'cp /mnt/server/archivedir/%f %p', + archive_cleanup_command => undef, + recovery_end_command => undef, + recovery_target_name => 'daily backup 2015-01-26', + recovery_target_time => '2015-02-08 22:39:00 EST', + recovery_target_xid => undef, + recovery_target_inclusive => true, + recovery_target => 'immediate', + recovery_target_timeline => 'latest', + pause_at_recovery_target => true, + standby_mode => 'on', + primary_conninfo => 'host=localhost port=5432', + primary_slot_name => undef, + trigger_file => undef, + recovery_min_apply_delay => 0, +} +``` + +The above creates this `recovery.conf` config file: + +``` +restore_command = 'cp /mnt/server/archivedir/%f %p' +recovery_target_name = 'daily backup 2015-01-26' +recovery_target_time = '2015-02-08 22:39:00 EST' +recovery_target_inclusive = true +recovery_target = 'immediate' +recovery_target_timeline = 'latest' +pause_at_recovery_target = true +standby_mode = 'on' +primary_conninfo = 'host=localhost port=5432' +recovery_min_apply_delay = 0 +``` + +Only the specified parameters are recognized in the template. The `recovery.conf` is only be created if at least one parameter is set **and** [manage_recovery_conf](#manage_recovery_conf) is set to true. + +### Validate connectivity + +To validate client connections to a remote PostgreSQL database before starting dependent tasks, use the `postgresql::validate_db_connection` resource. You can use this on any node where the PostgreSQL client software is installed. It is often chained to other tasks such as starting an application server or performing a database migration. + +Example usage: + +```puppet +postgresql::validate_db_connection { 'validate my postgres connection': + database_host => 'my.postgres.host', + database_username => 'mydbuser', + database_password => 'mydbpassword', + database_name => 'mydbname', +}-> +exec { 'rake db:migrate': + cwd => '/opt/myrubyapp', +} +``` + +## Reference + +The postgresql module comes with many options for configuring the server. While you are unlikely to use all of the settings below, they provide a decent amount of control over your security settings. + +**Classes:** + +* [postgresql::client](#postgresqlclient) +* [postgresql::globals](#postgresqlglobals) +* [postgresql::lib::devel](#postgresqllibdevel) +* [postgresql::lib::java](#postgresqllibjava) +* [postgresql::lib::perl](#postgresqllibperl) +* [postgresql::lib::python](#postgresqllibpython) +* [postgresql::server](#postgresqlserver) +* [postgresql::server::plperl](#postgresqlserverplperl) +* [postgresql::server::contrib](#postgresqlservercontrib) +* [postgresql::server::postgis](#postgresqlserverpostgis) + +**Defined Types:** + +* [postgresql::server::config_entry](#postgresqlserverconfig_entry) +* [postgresql::server::database](#postgresqlserverdatabase) +* [postgresql::server::database_grant](#postgresqlserverdatabase_grant) +* [postgresql::server::db](#postgresqlserverdb) +* [postgresql::server::extension](#postgresqlserverextension) +* [postgresql::server::grant](#postgresqlservergrant) +* [postgresql::server::grant_role](#postgresqlservergrant_role) +* [postgresql::server::pg_hba_rule](#postgresqlserverpg_hba_rule) +* [postgresql::server::pg_ident_rule](#postgresqlserverpg_ident_rule) +* [postgresql::server::recovery](#postgresqlserverrecovery) +* [postgresql::server::role](#postgresqlserverrole) +* [postgresql::server::schema](#postgresqlserverschema) +* [postgresql::server::table_grant](#postgresqlservertable_grant) +* [postgresql::server::tablespace](#postgresqlservertablespace) +* [postgresql::validate_db_connection](#postgresqlvalidate_db_connection) + +**Types:** + +* [postgresql_psql](#custom-resource-postgresql_psql) +* [postgresql_replication_slot](#custom-resource-postgresql_replication_slot) +* [postgresql_conf](#custom-resource-postgresql_conf) + +**Functions:** + +* [postgresql_password](#function-postgresql_password) +* [postgresql_acls_to_resources_hash](#function-postgresql_acls_to_resources_hashacl_array-id-order_offset) + +### Classes + +#### postgresql::client + +Installs PostgreSQL client software. Set the following parameters if you have a custom version you would like to install. + +>**Note:** Make sure to add any necessary yum or apt repositories if specifying a custom version. + +##### `package_ensure` + +Whether the PostgreSQL client package resource should be present. Valid values: 'present', 'absent'. Default: 'present'. + +##### `package_name` + +Sets the name of the PostgreSQL client package. Default: 'file'. + +##### `validcon_script_path` + +Specifies the path to validate the connection script. Default: '/usr/local/bin/validate_postgresql_connection.sh'. + +#### postgresql::lib::docs + +Installs PostgreSQL bindings for Postgres-Docs. Set the following parameters if you have a custom version you would like to install. + +**Note:** Make sure to add any necessary yum or apt repositories if specifying a custom version. + +##### `package_name` + +Specifies the name of the PostgreSQL docs package. + +##### `package_ensure` + +Whether the PostgreSQL docs package resource should be present. Valid values: 'present', 'absent'. Default: 'present'. + +#### postgresql::globals + +**Note:** Most server-specific defaults should be overridden in the `postgresql::server` class. This class should be used only if you are using a non-standard OS, or if you are changing elements that can only be changed here, such as `version` or `manage_package_repo`. + +##### `bindir` + +Overrides the default PostgreSQL binaries directory for the target platform. Default: OS dependent. + +##### `client_package_name` + +Overrides the default PostgreSQL client package name. Default: OS dependent. + +##### `confdir` + +Overrides the default PostgreSQL configuration directory for the target platform. Default: OS dependent. + +##### `contrib_package_name` + +Overrides the default PostgreSQL contrib package name. Default: OS dependent. + +##### `createdb_path` + +**Deprecated.** Path to the `createdb` command. Default: "${bindir}/createdb". + +##### `datadir` + +Overrides the default PostgreSQL data directory for the target platform. Default: OS dependent. + +**Note:** Changing the datadir after installation causes the server to come to a full stop before making the change. For Red Hat systems, the data directory must be labeled appropriately for SELinux. On Ubuntu, you must explicitly set `needs_initdb = true` to allow Puppet to initialize the database in the new datadir (`needs_initdb` defaults to true on other systems). + +**Warning:** If datadir is changed from the default, Puppet does not manage purging of the original data directory, which causes it to fail if the data directory is changed back to the original. + +##### `default_database` + +Specifies the name of the default database to connect with. On most systems, this is 'postgres'. + +##### `devel_package_name` + +Overrides the default PostgreSQL devel package name. Default: OS dependent. + +##### `docs_package_name` + +Overrides the default PostgreSQL docs package name. If not specified, the module uses the default for your OS distro. + +##### `encoding` + +Sets the default encoding for all databases created with this module. On certain operating systems, this is also used during the `template1` initialization, so it becomes a default outside of the module as well. Defaults to the operating system's default encoding. + +##### `group` + +Overrides the default postgres user group to be used for related files in the file system. Default: 'postgres'. + +##### `initdb_path` + +Path to the `initdb` command. + +##### `java_package_name` + +Overrides the default PostgreSQL java package name. Default: OS dependent. + +##### `locale` + +Sets the default database locale for all databases created with this module. On certain operating systems, this is also used during the `template1` initialization, so it becomes a default outside of the module as well. Default: undef, which is effectively `C`. **On Debian, you'll need to ensure that the 'locales-all' package is installed for full functionality of PostgreSQL.** + +##### `timezone` + +Sets the default timezone of the postgresql server. The postgresql built-in default is taking the systems timezone information. + +##### `logdir` + +Overrides the default PostgreSQL log directory. Default: initdb's default path. + +##### `log_line_prefix` + +Set a prefix for the server logs. Default: `'%t '` + +##### `manage_package_repo` + +Sets up official PostgreSQL repositories on your host if set to true. Default: false. + +##### `module_workdir` + +Specifies working directory under which the psql command should be executed. May need to specify if /tmp is on volume mounted with noexec option. Default: /tmp + +##### `needs_initdb` + +Explicitly calls the initdb operation after the server package is installed and before the PostgreSQL service is started. Default: OS dependent. + +##### `perl_package_name` + +Overrides the default PostgreSQL Perl package name. Default: OS dependent. + +##### `pg_hba_conf_defaults` + +Disables the defaults supplied with the module for `pg_hba.conf` if set to false. This is useful if you want to override the defaults. Be sure that your changes align with the rest of the module, as some access is required to perform some operations, such as basic `psql` operations. Default: true. + +##### `pg_hba_conf_path` + +Specifies the path to your `pg_hba.conf` file. Default: '${confdir}/pg_hba.conf'. + +##### `pg_ident_conf_path` + +Specifies the path to your `pg_ident.conf` file. Default: "${confdir}/pg_ident.conf". + +##### `plperl_package_name` + +Overrides the default PostgreSQL PL/Perl package name. Default: OS dependent. + +##### `plpython_package_name` + +Overrides the default PostgreSQL PL/Python package name. Default: OS dependent. + +##### `postgis_version` + +Defines the version of PostGIS to install, if you install PostGIS. Defaults to the lowest available with the version of PostgreSQL to be installed. + +##### `postgresql_conf_path` + +Sets the path to your `postgresql.conf` file. Default: "${confdir}/postgresql.conf". + +##### `psql_path` + +Sets the path to the `psql` command. + +##### `python_package_name` + +Overrides the default PostgreSQL Python package name. Default: OS dependent. + +##### `recovery_conf_path` + +Path to your `recovery.conf` file. + +##### `repo_proxy` + +Sets the proxy option for the official PostgreSQL yum-repositories only. Debian is currently not supported. This is useful if your server is behind a corporate firewall and needs to use proxy servers for outside connectivity. + +##### `repo_baseurl` + +Sets the baseurl for the PostgreSQL repository. Useful if you host your own mirror of the repository. Defaults to the official PostgreSQL repository. + +##### `server_package_name` + +Overrides the default PostgreSQL server package name. Default: OS dependent. + +##### `service_name` + +Overrides the default PostgreSQL service name. Default: OS dependent. + +##### `service_provider` + +Overrides the default PostgreSQL service provider. Default: OS dependent. + +##### `service_status` + +Overrides the default status check command for your PostgreSQL service. Default: OS dependent. + +##### `user` + +Overrides the default PostgreSQL super user and owner of PostgreSQL related files in the file system. Default: 'postgres'. + +##### `version` + +The version of PostgreSQL to install and manage. Default: OS system default. + +##### `xlogdir` + +Overrides the default PostgreSQL xlog directory. Default: initdb's default path. + +####postgresql::lib::devel + +Installs the packages containing the development libraries for PostgreSQL and symlinks `pg_config` into `/usr/bin` (if not in `/usr/bin` or `/usr/local/bin`). + +##### `link_pg_config` + +If the bin directory used by the PostgreSQL page is not `/usr/bin` or `/usr/local/bin`, symlinks `pg_config` from the package's bin dir into `usr/bin` (not applicable to Debian systems). Set to false to disable this behavior. Valid values: true, false. Default: true. + +##### `package_ensure` + +Overrides the `ensure` parameter during package installation. Defaults to `present`. + +##### `package_name` + +Overrides the default package name for the distribution you are installing to. Defaults to `postgresql-devel` or `postgresql-devel` depending on your distro. + +#### postgresql::lib::java + +Installs PostgreSQL bindings for Java (JDBC). Set the following parameters if you have a custom version you would like to install. + +**Note:** Make sure to add any necessary yum or apt repositories if specifying a custom version. + +##### `package_ensure` + +Specifies whether the package is present. Valid values: 'present', 'absent'. Default: 'present'. + +##### `package_name` + +Specifies the name of the PostgreSQL java package. + +#### postgresql::lib::perl + +Installs the PostgreSQL Perl libraries. + +##### `package_ensure` + +Specifies whether the package is present. Valid values: 'present', 'absent'. Default: 'present'. + +##### `package_name` + +Specifies the name of the PostgreSQL perl package to install. + +#### postgresql::server::plpython + +Installs the PL/Python procedural language for PostgreSQL. + +##### `package_name` + +Specifies the name of the postgresql PL/Python package. + +##### `package_ensure` + +Specifies whether the package is present. Valid values: 'present', 'absent'. Default: 'present'. + +#### postgresql::lib::python + +Installs PostgreSQL Python libraries. + +##### `package_ensure` + +Specifies whether the package is present. Valid values: 'present', 'absent'. Default: 'present'. + +##### `package_name` + +The name of the PostgreSQL Python package. + +#### postgresql::server + +##### `createdb_path` + +**Deprecated.** Specifies the path to the `createdb` command. Default: "${bindir}/createdb". + +##### `default_database` + +Specifies the name of the default database to connect with. On most systems this is "postgres". + +##### `default_connect_settings` + +Specifies a hash of environment variables used when connecting to a remote server. Becomes the default for other defined-types. i.e. `postgresql::server::role` + +##### `encoding` + +Sets the default encoding for all databases created with this module. On certain operating systems this is also used during the `template1` initialization, so it becomes a default outside of the module as well. Default: undef. + +##### `group` + +Overrides the default postgres user group to be used for related files in the file system. Default: OS dependent default. + +##### `initdb_path` + +Specifies the path to the `initdb` command. Default: "${bindir}/initdb". + +##### `ipv4acls` + +Lists strings for access control for connection method, users, databases, IPv4 addresses; see [PostgreSQL documentation](http://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html) on `pg_hba.conf` for information. + +##### `ipv6acls` + +Lists strings for access control for connection method, users, databases, IPv6 addresses; see [PostgreSQL documentation](http://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html) on `pg_hba.conf` for information. + +##### `ip_mask_allow_all_users` + +Overrides PostgreSQL defaults for remote connections. By default, PostgreSQL does not allow database user accounts to connect via TCP from remote machines. If you'd like to allow this, you can override this setting. + +Set to `0.0.0.0/0` to allow database users to connect from any remote machine, or `192.168.0.0/16` to allow connections from any machine on your local 192.168 subnet. Default: `127.0.0.1/32`. + +##### `ip_mask_deny_postgres_user` + +Specifies the IP mask from which remote connections should be denied for the postgres superuser. Defaults to `0.0.0.0/0`, which denies any remote connection. + +##### `listen_addresses` + +Specifies the addresses the server accepts connections to. Valid values: + * 'localhost': Accept connections from local host only. + * '*': Accept connections from any remote machine. + * Specified comma-separated list of hostnames or IP addresses. + +##### `locale` + +Sets the default database locale for all databases created with this module. On certain operating systems this is used during the `template1` initialization as well, so it becomes a default outside of the module. Default: undef, which is effectively `C`. **On Debian, you must ensure that the 'locales-all' package is installed for full functionality of PostgreSQL.** + +##### `log_line_prefix` + +Set a prefix for the server logs. Default: `'%t '` + +##### `manage_pg_hba_conf` + +Whether to manage the pg_hba.conf. If set to true, Puppet overwrites this file. If set to false, Puppet does not modify the file. Valid values: true, false. Default + +##### `manage_pg_ident_conf` + +Overwrites the pg_ident.conf file. If set to true, Puppet overwrites the file. If set to false, Puppet does not modify the file. Valid values: true, false. Default: true. + +##### `manage_recovery_conf` + +Specifies whether or not manage the recovery.conf. If set to true, Puppet overwrites this file. Valid values: true, false. Default: false. + +##### `needs_initdb` + +Explicitly calls the `initdb` operation after server package is installed, and before the PostgreSQL service is started. Default: OS dependent. + +##### `package_ensure` + +Passes a value through to the `package` resource when creating the server instance. Default: undef. + +##### `package_name` + +Specifies the name of the package to use for installing the server software. Default: OS dependent. + +##### `pg_hba_conf_defaults` + +If false, disables the defaults supplied with the module for `pg_hba.conf`. This is useful if you disagree with the defaults and wish to override them yourself. Be sure that your changes of course align with the rest of the module, as some access is required to perform basic `psql` operations for example. + +##### `pg_hba_conf_path` + +Specifies the path to your `pg_hba.conf` file. + +##### `pg_ident_conf_path` + +Specifies the path to your `pg_ident.conf` file. Default: "${confdir}/pg_ident.conf". + +##### `plperl_package_name` + +Sets the default package name for the PL/Perl extension. Default: OS dependent. + +##### `plpython_package_name` + +Sets the default package name for the PL/Python extension. Default: OS dependent. + +##### `port` + +Specifies the port for the PostgreSQL server to listen on. **Note:** The same port number is used for all IP addresses the server listens on. Also, for Red Hat systems and early Debian systems, changing the port causes the server to come to a full stop before being able to make the change. Default: `5432`, meaning the Postgres server listens on TCP port 5432. + +##### `postgres_password` + +Sets the password for the `postgres` user to your specified value. Default: undef, meaning the superuser account in the Postgres database is a user called `postgres` and this account does not have a password. + +##### `postgresql_conf_path` + +Specifies the path to your `postgresql.conf` file. Default: "${confdir}/postgresql.conf". + +##### `psql_path` + +Specifies the path to the `psql` command. Default: OS dependent. + +##### `service_manage` + +Defines whether or not Puppet should manage the service. Default: true. + +##### `service_name` + +Overrides the default PostgreSQL service name. Default: OS dependent. + +##### `service_provider` + +Overrides the default PostgreSQL service provider. Default: undef. + +##### `service_reload` + +Overrides the default reload command for your PostgreSQL service. Default: OS dependent. + +##### `service_restart_on_change` + +Overrides the default behavior to restart your PostgreSQL service when a config entry has been changed that requires a service restart to become active. Default: true. + +##### `service_status` + +Overrides the default status check command for your PostgreSQL service. Default: OS dependent. + +##### `user` + +Overrides the default PostgreSQL super user and owner of PostgreSQL related files in the file system. Default: 'postgres'. + + +#### postgresql::server::contrib + +Installs the PostgreSQL contrib package. + +##### `package_ensure` + +Sets the ensure parameter passed on to PostgreSQL contrib package resource. + +##### `package_name` + +The name of the PostgreSQL contrib package. + +#### postgresql::server::plperl + +Installs the PL/Perl procedural language for postgresql. + +##### `package_ensure` + +The ensure parameter passed on to PostgreSQL PL/Perl package resource. + +##### `package_name` + +The name of the PostgreSQL PL/Perl package. + + +#### postgresql::server::postgis + +Installs the PostgreSQL postgis packages. + +### Defined Types + +#### postgresql::server::config_entry + +Modifies your `postgresql.conf` configuration file. + +Each resource maps to a line inside the file, for example: + +```puppet +postgresql::server::config_entry { 'check_function_bodies': + value => 'off', +} +``` + +##### `ensure` + +Removes an entry if set to 'absent'. Valid values: 'present', 'absent'. + +##### `value` + +Defines the value for the setting. + +#### postgresql::server::db + +Creates a local database, user, and assigns necessary permissions. + +##### `comment` + +Defines a comment to be stored about the database using the PostgreSQL COMMENT command. + +##### `connect_settings` + +Specifies a hash of environment variables used when connecting to a remote server. Default: Connects to the local Postgres instance. + +##### `dbname` + +Sets the name of the database to be created. Defaults to the namevar. + +##### `encoding` + +Overrides the character set during creation of the database. Defaults to the default defined during installation. + +##### `grant` + +Specifies the permissions to grant during creation. Default: `ALL`. + +##### `istemplate` + +Specifies that the database is a template, if set to true. Default: false. + +##### `locale` + +Overrides the locale during creation of the database. Defaults to the default defined during installation. + +##### `owner` + +Sets a user as the owner of the database. Default: $user variable set in `postgresql::server` or `postgresql::globals`. + +##### `password` + +**Required** Sets the password for the created user. + +##### `tablespace` + +Defines the name of the tablespace to allocate the created database to. Default: PostgreSQL default. + +##### `template` + +Specifies the name of the template database from which to build this database. Defaults to `template0`. + +##### `user` + +User to create and assign access to the database upon creation. Mandatory. + +#### postgresql::server::database + +Creates a database with no users and no permissions. + +##### `dbname` + +Sets the name of the database. Defaults to the namevar. + +##### `encoding` + +Overrides the character set during creation of the database. Default: The default defined during installation. + +##### `istemplate` + +Defines the database as a template if set to true. Default: false. + +##### `locale` + +Overrides the locale during creation of the database. The default defined during installation. + +##### `owner` + +Sets name of the database owner. Default: The $user variable set in `postgresql::server` or `postgresql::globals`. + +##### `tablespace` + +Sets tablespace for where to create this database. Default: The defaults defined during PostgreSQL installation. + +##### `template` + +Specifies the name of the template database from which to build this database. Default: `template0`. + +#### postgresql::server::database_grant + +Manages grant-based access privileges for users, wrapping the `postgresql::server::database_grant` for database specific permissions. Consult the [PostgreSQL documentation for `grant`](http://www.postgresql.org/docs/current/static/sql-grant.html) for more information. + +#### `connect_settings` + +Specifies a hash of environment variables used when connecting to a remote server. Default: Connects to the local Postgres instance. + +##### `db` + +Specifies the database to which you are granting access. + +##### `privilege` + +Specifies comma-separated list of privileges to grant. Valid options: `ALL`, `CREATE`, `CONNECT`, `TEMPORARY`, `TEMP`. + +##### `psql_db` + +Defines the database to execute the grant against. **This should not ordinarily be changed from the default**, which is `postgres`. + +##### `psql_user` + +Specifies the OS user for running `psql`. Default: The default user for the module, usually `postgres`. + +##### `role` + +Specifies the role or user whom you are granting access to. + +#### postgresql::server::extension + +Manages a PostgreSQL extension. + +##### `database` + +Specifies the database on which to activate the extension. + +##### `ensure` + +Specifies whether to activate ('present') or deactivate (absent') the extension. + +#### `extension` + +Specifies the extension to activate. If left blank, uses the name of the resource. + +##### `package_name` + +Specifies a package to install prior to activating the extension. + +##### `package_ensure` + +Overrides default package deletion behavior. By default, the package specified with `package_name` is installed when the extension is activated and removed when the extension is deactivated. To override this behavior, set the `ensure` value for the package. + +#### postgresql::server::grant + +Manages grant-based access privileges for roles. See [PostgreSQL documentation for `grant`](http://www.postgresql.org/docs/current/static/sql-grant.html) for more information. + +##### `db` + +Specifies the database to which you are granting access. + +##### `object_type` + +Specifies the type of object to which you are granting privileges. Valid options: `DATABASE`, `SCHEMA`, `SEQUENCE`, `ALL SEQUENCES IN SCHEMA`, `TABLE` or `ALL TABLES IN SCHEMA`. + +##### `object_name` + +Specifies name of `object_type` to which to grant access. + +##### `port` + +Port to use when connecting. Default: undef, which generally defaults to port 5432 depending on your PostgreSQL packaging. + +##### `privilege` + +Specifies the privilege to grant. Valid options: `ALL`, `ALL PRIVILEGES` or `object_type` dependent string. + +##### `psql_db` + +Specifies the database to execute the grant against. _This should not ordinarily be changed from the default_, which is `postgres`. + +##### `psql_user` + +Sets the OS user to run `psql`. Default: the default user for the module, usually `postgres`. + +##### `role` + +Specifies the role or user whom you are granting access to. + +#### postgresql::server::grant_role + +Allows you to assign a role to a (group) role. See [PostgreSQL documentation for `Role Membership`](http://www.postgresql.org/docs/current/static/role-membership.html) for more information. + +##### `group` + +Specifies the group role to which you are assigning a role. + +##### `role` + +Specifies the role you want to assign to a group. If left blank, uses the name of the resource. + +##### `ensure` + +Specifies whether to grant ('present') or revoke ('absent') the membership. Default: 'present'. + +##### `port` + +Port to use when connecting. Default: undef, which generally defaults to port 5432 depending on your PostgreSQL packaging. + +##### `psql_db` + +Specifies the database to execute the grant against. _This should not ordinarily be changed from the default_, which is `postgres`. + +##### `psql_user` + +Sets the OS user to run `psql`. Default: the default user for the module, usually `postgres`. + +##### `connect_settings` + +Specifies a hash of environment variables used when connecting to a remote server. Default: Connects to the local Postgres instance. + +#### postgresql::server::pg_hba_rule + +Allows you to create an access rule for `pg_hba.conf`. For more details see the [usage example](#create-an-access-rule-for-pghba.conf) and the [PostgreSQL documentation](http://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html). + +##### `address` + +Sets a CIDR based address for this rule matching when the type is not 'local'. + +##### `auth_method` + +Provides the method that is used for authentication for the connection that this rule matches. Described further in the PostgreSQL `pg_hba.conf` documentation. + +##### `auth_option` + +For certain `auth_method` settings there are extra options that can be passed. Consult the PostgreSQL `pg_hba.conf` documentation for further details. + +##### `database` + +Sets a comma-separated list of databases that this rule matches. + +##### `description` + +Defines a longer description for this rule, if required. This description is placed in the comments above the rule in `pg_hba.conf`. Defaults: `none`. +Specifies a way to uniquely identify this resource, but functionally does nothing. +##### `order` + +Sets an order for placing the rule in `pg_hba.conf`. Default: `150`. + +#### `postgresql_version` + +Manages `pg_hba.conf` without managing the entire PostgreSQL instance. Default: the version set in `postgresql::server`. + +##### `target` + +Provides the target for the rule, and is generally an internal only property. **Use with caution.** + +##### `type` + +Sets the type of rule. Valid options: `local`, `host`, `hostssl` or `hostnossl`. + +##### `user` + +Sets a comma-separated list of users that this rule matches. + + +#### postgresql::server::pg_ident_rule + +Allows you to create user name maps for `pg_ident.conf`. For more details see the [usage example](#create-user-name-maps-for-pgidentconf) above and the [PostgreSQL documentation](http://www.postgresql.org/docs/current/static/auth-username-maps.html). + +##### `database_username` + +Specifies the user name of the database user. The `system_username` is mapped to this user name. + +##### `description` + +Sets a longer description for this rule if required. This description is placed in the comments above the rule in `pg_ident.conf`. Default: `none`. + +##### `map_name` + +Sets the name of the user map that is used to refer to this mapping in `pg_hba.conf`. + +##### `order` + +Defines an order for placing the mapping in `pg_ident.conf`. Default: 150. + +##### `system_username` + +Specifies the operating system user name (the user name used to connect to the database). + +##### `target` + +Provides the target for the rule and is generally an internal only property. **Use with caution.** + +#### postgresql::server::recovery + +Allows you to create the content for `recovery.conf`. For more details see the [usage example](#create-recovery-configuration) and the [PostgreSQL documentation](http://www.postgresql.org/docs/current/static/recovery-config.html). + +Every parameter value is a string set in the template except `recovery_target_inclusive`, `pause_at_recovery_target`, `standby_mode` and `recovery_min_apply_delay`. + +A detailed description of all listed parameters can be found in the [PostgreSQL documentation](http://www.postgresql.org/docs/current/static/recovery-config.html). + +The parameters are grouped into these three sections: + +##### [Archive Recovery Parameters](http://www.postgresql.org/docs/current/static/archive-recovery-settings.html) + +* `restore_command` +* `archive_cleanup_command` +* `recovery_end_command` + +##### [Recovery Target Settings](http://www.postgresql.org/docs/current/static/recovery-target-settings.html) +* `recovery_target_name` +* `recovery_target_time` +* `recovery_target_xid` +* `recovery_target_inclusive` +* `recovery_target` +* `recovery_target_timeline` +* `pause_at_recovery_target` + +##### [Standby Server Settings](http://www.postgresql.org/docs/current/static/standby-settings.html) +* `standby_mode`: Can be specified with the string ('on'/'off'), or by using a Boolean value (true/false). +* `primary_conninfo` +* `primary_slot_name` +* `trigger_file` +* `recovery_min_apply_delay` + +##### `target` +Provides the target for the rule, and is generally an internal only property. **Use with caution.** + +#### postgresql::server::role +Creates a role or user in PostgreSQL. + +##### `connection_limit` +Specifies how many concurrent connections the role can make. Default: `-1`, meaning no limit. + +##### `connect_settings` +Specifies a hash of environment variables used when connecting to a remote server. Default: Connects to the local Postgres instance. + +##### `createdb` +Specifies whether to grant the ability to create new databases with this role. Default: false. + +##### `createrole` +Specifies whether to grant the ability to create new roles with this role. Default: false. + +##### `inherit` +Specifies whether to grant inherit capability for the new role. Default: true. + +##### `login` +Specifies whether to grant login capability for the new role. Default: true. + +##### `password_hash` +Sets the hash to use during password creation. If the password is not already pre-encrypted in a format that PostgreSQL supports, use the `postgresql_password` function to provide an MD5 hash here, for example: + +```puppet +postgresql::server::role { "myusername": +password_hash => postgresql_password('myusername', 'mypassword'), +} +``` + +##### `replication` + +Provides provides replication capabilities for this role if set to true. Default: false. + +##### `superuser` + +Specifies whether to grant super user capability for the new role. Default: false. + +##### `username` + +Defines the username of the role to create. Defaults to the namevar. + +#### postgresql::server::schema + +Creates a schema. + +##### `connect_settings` + +Specifies a hash of environment variables used when connecting to a remote server. Default: Connects to the local Postgres instance. + +##### `db` + +**Required**. Sets the name of the database in which to create this schema. + +##### `owner` + +Sets the default owner of the schema. + +##### `schema` + +Sets the name of the schema. Defaults to the namevar. + +#### postgresql::server::table_grant + +Manages grant-based access privileges for users. Consult the PostgreSQL documentation for `grant` for more information. + +##### `connect_settings` + +Specifies a hash of environment variables used when connecting to a remote server. Default: Connects to the local Postgres instance. + +##### `db` + +Specifies which database the table is in. + +##### `privilege` + +Specifies comma-separated list of privileges to grant. Valid options: `ALL`, `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `TRUNCATE`, `REFERENCES`, `TRIGGER`. + +##### `psql_db` + +Specifies the database to execute the grant against. This should not ordinarily be changed from the default, which is `postgres`. + +##### `psql_user` + +Specifies the OS user for running `psql`. Defaults to the default user for the module, usually `postgres`. + +##### `role` + +Specifies the role or user to whom you are granting access. + +##### `table` + +Specifies the table to which you are granting access. + + +#### postgresql::server::tablespace + +Creates a tablespace. If necessary, also creates the location and assigns the same permissions as the PostgreSQL server. + +##### `connect_settings` + +Specifies a hash of environment variables used when connecting to a remote server. Default: Connects to the local Postgres instance. + +##### `location` + +Specifies the path to locate this tablespace. + +##### `owner` + +Specifies the default owner of the tablespace. + +##### `spcname` + +Specifies the name of the tablespace. Defaults to the namevar. + +#### postgresql::validate_db_connection + +Validates client connection with a remote PostgreSQL database. + +##### `connect_settings` + +Specifies a hash of environment variables used when connecting to a remote server. This is an alternative to providing individual parameters (database_host, etc.). If provided, the individual parameters take precedence. + +##### `create_db_first` + +Ensures that the database is created before running the test. This only works if your test is local. Default: true. + +##### `database_host` + +Sets the hostname of the database you wish to test. Default: undef, which generally uses the designated local Unix socket. + +##### `database_name` + +Specifies the name of the database you wish to test. Default: 'postgres'. + +##### `database_port` + +Defines the port to use when connecting. Default: undef, which generally defaults to port 5432 depending on your PostgreSQL packaging. + +##### `database_password` + +Specifies the password to connect with. Can be left blank, not recommended. + +##### `database_username` + +Specifies the username to connect with. Default: undef. When using a Unix socket and ident auth, this is the user you are running as. **If the host is remote you must provide a username.** + +##### `run_as` + +Specifies the user to run the `psql` command as. This is important when trying to connect to a database locally using Unix sockets and `ident` authentication. Not needed for remote testing. + +##### `sleep` + +Sets the number of seconds to sleep for before trying again after a failure. + +##### `tries` + +Sets the number of attempts after failure before giving up and failing the resource. + +### Types + +#### postgresql_psql + +Enables Puppet to run psql statements. + +##### `command` + +**Required.** Specifies the SQL command to execute via psql. + +##### `cwd` + +Specifies the working directory under which the psql command should be executed. Default: '/tmp'. + +##### `db` + +Specifies the name of the database to execute the SQL command against. + +##### `environment` + +Specifies any additional environment variables you want to set for a SQL command. Multiple environment variables should be specified as an array. + +##### `name` + +Sets an arbitrary tag for your own reference; the name of the message. This is the +namevar. + +##### `onlyif` + +Sets an optional SQL command to execute prior to the main command. This is generally intended to be used for idempotency, to check for the existence of an object in the database to determine whether or not the main SQL command needs to be executed at all. + +##### `port` + +Specifies the port of the database server to execute the SQL command against. + +##### `psql_group` + +Specifies the system user group account under which the psql command should be executed. Default: 'postgres'. + +##### `psql_path` + +Specifies the path to psql executable. Default: 'psql'. + +##### `psql_user` + +Specifies the system user account under which the psql command should be executed. Default: 'postgres'. + +##### `refreshonly` + +Specifies whether to execute the SQL only if there is a notify or subscribe event. Valid values: true, false. Default: false. + +##### `search_path` + +Defines the schema search path to use when executing the SQL command. + +##### `unless` + +The inverse of `onlyif`. + +#### postgresql_conf + +Allows Puppet to manage `postgresql.conf` parameters. + +##### `name` + +Specifies the PostgreSQL parameter name to manage. This is the namevar. + +##### `target` + +Specifies the path to `postgresql.conf`. Default: '/etc/postgresql.conf'. + +##### `value` + +Specifies the value to set for this parameter. + +#### postgresql_replication_slot + +Allows you to create and destroy replication slots to register warm standby replication on a PostgreSQL master server. + +##### `name` + +Specifies the name of the slot to create. Must be a valid replication slot name. This is the namevar. + +### Functions + +#### postgresql_password + +Generates a PostgreSQL encrypted password, use `postgresql_password`. Call it from the command line and then copy and paste the encrypted password into your manifest: + +```puppet +puppet apply --execute 'notify { "test": message => postgresql_password("username", "password") }' +``` + +Alternatively, you can call this from your production manifests, but the manifests will then contain a clear text version of your passwords. + +#### postgresql_acls_to_resources_hash(acl_array, id, order_offset) + +This internal function converts a list of `pg_hba.conf` based ACLs (passed in as an array of strings) to a format compatible with the `postgresql::pg_hba_rule` resource. + +**This function should only be used internally by the module**. + +## Limitations + +Works with versions of PostgreSQL from 8.1 through 9.5. + +Currently, the postgresql module is tested on the following operating systems: + +* Debian 6.x, 7.x, 8.x. +* CentOS 5.x, 6.x, and 7.x. +* Ubuntu 10.04 and 12.04, 14.04. + +Other systems might be compatible, but are not being actively tested. + +### Apt module support + +While this module supports both 1.x and 2.x versions of the puppetlabs-apt module, it does not support puppetlabs-apt 2.0.0 or 2.0.1. + +### PostGIS support + +PostGIS is currently considered an unsupported feature, as it doesn't work on all platforms correctly. + +### All versions of RHEL/CentOS + +If you have SELinux enabled you must add any custom ports you use to the `postgresql_port_t` context. You can do this as follows: + +``` +semanage port -a -t postgresql_port_t -p tcp $customport +``` + +## Development + +Puppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can’t access the huge number of platforms and myriad hardware, software, and deployment configurations that Puppet is intended to serve. We want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things. For more information, see our [module contribution guide](https://docs.puppetlabs.com/forge/contributing.html). + +### Tests + +There are two types of tests distributed with this module. Unit tests with `rspec-puppet` and system tests using `rspec-system`. + +For unit testing, make sure you have: + +* rake +* bundler + +Install the necessary gems: + +``` +bundle install --path=vendor +``` + +And then run the unit tests: + +``` +bundle exec rake spec +``` + +The unit tests are run in Travis-CI as well. If you want to see the results of your own tests, register the service hook through Travis-CI via the accounts section for your GitHub clone of this project. + +To run the system tests, make sure you also have: + +* Vagrant > 1.2.x +* VirtualBox > 4.2.10 + +Then run the tests using: + +``` +bundle exec rspec spec/acceptance +``` + +To run the tests on different operating systems, see the sets available in `.nodeset.yml` and run the specific set with the following syntax: + +``` +RSPEC_SET=debian-607-x64 bundle exec rspec spec/acceptance +``` + +### Contributors + +View the full list of contributors on [https://github.com/puppetlabs/puppetlabs-postgresql/graphs/contributors](GitHub). diff --git a/environments/production/modules/postgresql/Rakefile b/environments/production/modules/postgresql/Rakefile new file mode 100644 index 0000000..d12d854 --- /dev/null +++ b/environments/production/modules/postgresql/Rakefile @@ -0,0 +1,37 @@ +require 'puppetlabs_spec_helper/rake_tasks' +require 'puppet-lint/tasks/puppet-lint' +require 'puppet_blacksmith/rake_tasks' if Bundler.rubygems.find_name('puppet-blacksmith').any? + +PuppetLint.configuration.fail_on_warnings = true +PuppetLint.configuration.send('relative') + +desc 'Generate pooler nodesets' +task :gen_nodeset do + require 'beaker-hostgenerator' + require 'securerandom' + require 'fileutils' + + agent_target = ENV['TEST_TARGET'] + if ! agent_target + STDERR.puts 'TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat-64default."' + agent_target = 'redhat-64default.' + end + + master_target = ENV['MASTER_TEST_TARGET'] + if ! master_target + STDERR.puts 'MASTER_TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat7-64mdcl"' + master_target = 'redhat7-64mdcl' + end + + targets = "#{master_target}-#{agent_target}" + cli = BeakerHostGenerator::CLI.new([targets]) + nodeset_dir = "tmp/nodesets" + nodeset = "#{nodeset_dir}/#{targets}-#{SecureRandom.uuid}.yaml" + FileUtils.mkdir_p(nodeset_dir) + File.open(nodeset, 'w') do |fh| + fh.print(cli.execute) + end + puts nodeset +end diff --git a/environments/production/modules/postgresql/checksums.json b/environments/production/modules/postgresql/checksums.json new file mode 100644 index 0000000..003f97d --- /dev/null +++ b/environments/production/modules/postgresql/checksums.json @@ -0,0 +1,124 @@ +{ + "CHANGELOG.md": "792406013ffe7cdbabfd6bbea0c1f72a", + "CONTRIBUTING.md": "77d0440d7cd4206497f99065c60bed46", + "Gemfile": "064893aff1d6bf890eee483af3a79c9e", + "LICENSE": "3b83ef96387f14655fc854ddc3c6bd57", + "MAINTAINERS.md": "dede2640dfb244b2d67a280ed6496381", + "NOTICE": "7e066b054e0d528cc400e4b1adfb071d", + "README.md": "6fda39c1b01ff97992f5874fb6455a67", + "Rakefile": "3851f083966b9bbd6d46e50dba5aa52a", + "files/RPM-GPG-KEY-PGDG": "78b5db170d33f80ad5a47863a7476b22", + "files/validate_postgresql_connection.sh": "63814aa224fed8d032bba75fbcdb63e1", + "lib/puppet/parser/functions/postgresql_acls_to_resources_hash.rb": "d518a7959b950874820a3b0a7a324488", + "lib/puppet/parser/functions/postgresql_escape.rb": "41a42275ce59d8588f3d4b4918d64392", + "lib/puppet/parser/functions/postgresql_password.rb": "856b268e0d517dfcadc89bc2544e60ef", + "lib/puppet/provider/postgresql_conf/parsed.rb": "6d3d15c73db2eb9f632218fa256d024a", + "lib/puppet/provider/postgresql_psql/ruby.rb": "bfb519df4ada462cdb21c5b82d19628f", + "lib/puppet/provider/postgresql_replication_slot/ruby.rb": "dcd93860861c530a12f1233334ea5f17", + "lib/puppet/type/postgresql_conf.rb": "95c73ca169db02aa1128ae3baa2f7399", + "lib/puppet/type/postgresql_psql.rb": "d45a5f688c15b69114996fbe0232664f", + "lib/puppet/type/postgresql_replication_slot.rb": "cd9362cdb569945ca42986d005e88bcb", + "manifests/client.pp": "99acbc08beda1144d49ebcfd8ef1d217", + "manifests/globals.pp": "f0ee54e6de5c1b3291d3ad7580706af1", + "manifests/lib/devel.pp": "3b66e6f6b3dbe30b692a89175582b040", + "manifests/lib/docs.pp": "ec903581401a6629fb29d8dc6fed1a1f", + "manifests/lib/java.pp": "ed639fd6ba8392cf4239cfe02be6ace5", + "manifests/lib/perl.pp": "5213fb4284f041fe28a22d68119f646d", + "manifests/lib/python.pp": "90736f86301c4c6401ec1180c176b616", + "manifests/params.pp": "32f61ace5bae7a4d21b6f4e9c012bc0e", + "manifests/repo/apt_postgresql_org.pp": "5119a0871a57b1b0680d7493c0a1c81d", + "manifests/repo/yum_postgresql_org.pp": "82cd0adf5a3ca614c1258042dcc04508", + "manifests/repo.pp": "c7569fd4a3fb277b3706bbddd24ef2ed", + "manifests/server/config.pp": "c29e5f7a638991c071e4f596bf8aaf1e", + "manifests/server/config_entry.pp": "2ce572974656c02a91f0428ad55df0b2", + "manifests/server/contrib.pp": "01505e0dc2111421b76b119ed0c55613", + "manifests/server/database.pp": "a91bb276852ec2148a90bbb0874c382f", + "manifests/server/database_grant.pp": "ceda31baba15a6189c57c5cff2bf4512", + "manifests/server/db.pp": "ea41e1e51fc00fdb7a9129ecc5279ca3", + "manifests/server/extension.pp": "6d417d3bd69baeb6dec2e3c2b740107f", + "manifests/server/grant.pp": "5a98604c705683535593162f330c271b", + "manifests/server/grant_role.pp": "b24d40cc63ec26c3a120934f06535080", + "manifests/server/initdb.pp": "e517c4258f155e0163d8c0d862544146", + "manifests/server/install.pp": "e0ff19f2a4dc8a4814e0ee62786d1387", + "manifests/server/passwd.pp": "5ec205c563ef675db86e8f6a7c5ff46c", + "manifests/server/pg_hba_rule.pp": "f18fccac0295cf99c13b61057a6a9c2f", + "manifests/server/pg_ident_rule.pp": "0fa70e2d42d17c59f41bd3351d5d96fb", + "manifests/server/plperl.pp": "189c47d04158440874dc136ca2b3fd7a", + "manifests/server/plpython.pp": "4a1f44cd2a8019e42cb8e05075a1751c", + "manifests/server/postgis.pp": "6ac7fbd262907bb1303aa29970e908eb", + "manifests/server/recovery.pp": "e3b559cae82bd2c890f40cb7949bbe81", + "manifests/server/reload.pp": "218ac61018f7fab71f250284c4b879d0", + "manifests/server/role.pp": "ba28ba2b5756b390d9209a8b4706f69d", + "manifests/server/schema.pp": "e48c80a34f2be53283e05e456b73b77e", + "manifests/server/service.pp": "86b88df8df316c5305a7024f8b5c83a1", + "manifests/server/table_grant.pp": "e2abea574f7eb295fc56313f4896a9fc", + "manifests/server/tablespace.pp": "79e486a94083335aa139c52120897c1f", + "manifests/server.pp": "e92e49babbca58803fb10b257571f333", + "manifests/validate_db_connection.pp": "c7e64152e1dded843e043589cf44c5ab", + "metadata.json": "3b32c88265643bbdb49cec2c875a1826", + "spec/acceptance/00-utf8_encoding_spec.rb": "ac20cfbaf4efce7c8b499d32bdec47d7", + "spec/acceptance/alternative_port_spec.rb": "7f883762a8e17941a96371e96d12c06b", + "spec/acceptance/db_spec.rb": "955a6df508d04e06d0be58e3c71a4140", + "spec/acceptance/default_parameters_spec.rb": "82bb1fd9e71f6084b71ca34ba73ff05b", + "spec/acceptance/nodesets/centos-7-x64.yml": "a713f3abd3657f0ae2878829badd23cd", + "spec/acceptance/nodesets/debian-8-x64.yml": "d2d2977900989f30086ad251a14a1f39", + "spec/acceptance/nodesets/default.yml": "b42da5a1ea0c964567ba7495574b8808", + "spec/acceptance/nodesets/docker/centos-7.yml": "8a3892807bdd62306ae4774f41ba11ae", + "spec/acceptance/nodesets/docker/debian-8.yml": "ac8e871d1068c96de5e85a89daaec6df", + "spec/acceptance/nodesets/docker/ubuntu-14.04.yml": "dc42ee922a96908d85b8f0f08203ce58", + "spec/acceptance/postgresql_psql_spec.rb": "5d70b4c3e35f1b5fc89a768498f74987", + "spec/acceptance/remote_access_spec.rb": "4f2261af3b20d3556c50d3af2daef7d1", + "spec/acceptance/server/config_entry_spec.rb": "ea8f59a0824c8326a9aea2bab9a49b7f", + "spec/acceptance/server/grant_role_spec.rb": "68e06a2d67711dcb93998159178fcb18", + "spec/acceptance/server/grant_spec.rb": "a21789c35943a5e89066523dd3246b0d", + "spec/acceptance/server/recovery_spec.rb": "04c87359a23d3ac297ccf49127111ac1", + "spec/acceptance/server/schema_spec.rb": "988aa84ae180a4508897abf6a7fdb39e", + "spec/acceptance/z_alternative_pgdata_spec.rb": "cbff072f96be283ab1607febd7c1b7ef", + "spec/spec_helper.rb": "b2db3bc02b4ac2fd5142a6621c641b07", + "spec/spec_helper_acceptance.rb": "675f253b1ad46680727637c01a6f522f", + "spec/spec_helper_local.rb": "3a50ad073f49d04a019212652a67c6ba", + "spec/unit/classes/client_spec.rb": "bb1bac2c6f7ee93a18cbe083d17eb88f", + "spec/unit/classes/globals_spec.rb": "77c508dba57c1619284a4c69a13e6caf", + "spec/unit/classes/lib/devel_spec.rb": "7da9ec3cd4f50bf70d97a031084d3688", + "spec/unit/classes/lib/java_spec.rb": "0e5703c0b1883364d0fca5a5883ed816", + "spec/unit/classes/lib/perl_spec.rb": "748a923db31aa42b3ee2fa5ac534d0d6", + "spec/unit/classes/lib/pgdocs_spec.rb": "edd7c5b7fee837d8975c6a1b11954095", + "spec/unit/classes/lib/python_spec.rb": "085a1fd6809298d8774b8fd84157908d", + "spec/unit/classes/params_spec.rb": "af9c9224fb32b0e64bf575275167bebf", + "spec/unit/classes/repo_spec.rb": "cd1385198525063f7444fb7ef57b08cc", + "spec/unit/classes/server/config_spec.rb": "da3673e3211a0c0d8ddbbe169d8afbea", + "spec/unit/classes/server/contrib_spec.rb": "8df44d850f535327c5898693b788f56d", + "spec/unit/classes/server/initdb_spec.rb": "9b4948e496782922c127b52867bd9cd0", + "spec/unit/classes/server/plperl_spec.rb": "5fb32ffacadf95aa84646e32017a30f4", + "spec/unit/classes/server/plpython_spec.rb": "3b9cab37936cee039536660926b8e32d", + "spec/unit/classes/server/postgis_spec.rb": "3975f38629148de15fd2cd87385f8e2e", + "spec/unit/classes/server_spec.rb": "9b723eddc6547d289dbe15244422e851", + "spec/unit/defines/server/config_entry_spec.rb": "f8c337f65849e921110678bf3fb4586b", + "spec/unit/defines/server/database_grant_spec.rb": "52e7ba3370d10b7c23a7b29fffe1ff33", + "spec/unit/defines/server/database_spec.rb": "51a30d3b0210fa4bc220942b7bc8b483", + "spec/unit/defines/server/db_spec.rb": "33b0f3152a559f701acf1b1ee5485acd", + "spec/unit/defines/server/extension_spec.rb": "7e15125802b820edf7bd2fdb798a81cf", + "spec/unit/defines/server/grant_role_spec.rb": "c008c1acea8bdc6c7d21523bdb88f562", + "spec/unit/defines/server/grant_spec.rb": "583f8694308b86919851e280bca7005b", + "spec/unit/defines/server/pg_hba_rule_spec.rb": "fd1b947dfe0df3b81f1403928064c22f", + "spec/unit/defines/server/pg_ident_rule_spec.rb": "2e32da6f0f107359fc5ab5727812f853", + "spec/unit/defines/server/recovery_spec.rb": "86fba4b913ebeef06be8e63c52e72044", + "spec/unit/defines/server/role_spec.rb": "628bb6e2edae02f4ccf15287a2d30dbc", + "spec/unit/defines/server/schema_spec.rb": "fc110fde368c9265e4c0f18ff947d3bd", + "spec/unit/defines/server/table_grant_spec.rb": "21e375467a0635194d0f2e5effdcf22a", + "spec/unit/defines/server/tablespace_spec.rb": "efc3e4e4f1bf36b6bea5f1d7de81b5c7", + "spec/unit/defines/validate_db_connection_spec.rb": "29dc87f24f619700b5d46768d35d9869", + "spec/unit/functions/postgresql_acls_to_resources_hash_spec.rb": "ba576b0f385aa44fa352df6d5812f4ae", + "spec/unit/functions/postgresql_escape_spec.rb": "ed7d1a0f8feee7d7147c35b84b27e940", + "spec/unit/functions/postgresql_password_spec.rb": "0881299f7796b13a939315b08ae54feb", + "spec/unit/provider/postgresql_conf/parsed_spec.rb": "535a7a2f7c31d433e3540da4dd938fde", + "spec/unit/puppet/provider/postgresql_psql/ruby_spec.rb": "f08cded8801a0a3d866515f7ec58a382", + "spec/unit/puppet/provider/postgresql_replication_slot/ruby_spec.rb": "641f5e82f4b92c2de28b361cbd3361f2", + "spec/unit/puppet/type/postgresql_psql_spec.rb": "5ad61a59e91be0035a794842e33bf6f2", + "spec/unit/puppet/type/postgresql_replication_slot_spec.rb": "fcd735f400d0e981213b2ecb7cbcf0b0", + "spec/unit/type/postgresql_conf_spec.rb": "069ce03012044d4864d7e81b60f022e0", + "templates/pg_hba_rule.conf": "13b46eecdfd359eddff71fa485ef2f54", + "templates/pg_ident_rule.conf": "444c85172fd44262344588e83ebb2515", + "templates/recovery.conf.erb": "ea5dc47b65f7b9596244f7e9e48085ba", + "templates/systemd-override.erb": "8efd876775a4bb401803366ba90dd718" +} \ No newline at end of file diff --git a/environments/production/modules/postgresql/files/RPM-GPG-KEY-PGDG b/environments/production/modules/postgresql/files/RPM-GPG-KEY-PGDG new file mode 100644 index 0000000..065274e --- /dev/null +++ b/environments/production/modules/postgresql/files/RPM-GPG-KEY-PGDG @@ -0,0 +1,30 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.7 (GNU/Linux) + +mQGiBEeD8koRBACC1VBRsUwGr9gxFFRho9kZpdRUjBJoPhkeOTvp9LzkdAQMFngr +BFi6N0ov1kCX7LLwBmDG+JPR7N+XcH9YR1coSHpLVg+JNy2kFDd4zAyWxJafjZ3a +9zFg9Yx+0va1BJ2t4zVcmKS4aOfbgQ5KwIOWUujalQW5Y+Fw39Gn86qjbwCg5dIo +tkM0l19h2sx50D027pV5aPsD/2c9pfcFTbMhB0CcKS836GH1qY+NCAdUwPs646ee +Ex/k9Uy4qMwhl3HuCGGGa+N6Plyon7V0TzZuRGp/1742dE8IO+I/KLy2L1d1Fxrn +XOTBZd8qe6nBwh12OMcKrsPBVBxn+iSkaG3ULsgOtx+HHLfa1/p22L5+GzGdxizr +peBuA/90cCp+lYcEwdYaRoFVR501yDOTmmzBc1DrsyWP79QMEGzMqa393G0VnqXt +L4pGmunq66Agw2EhPcIt3pDYiCmEt/obdVtSJH6BtmSDB/zYhbE8u3vLP3jfFDa9 +KXxgtYj0NvuUVoRmxSKm8jtfmj1L7zoKNz3jl+Ba3L0WxIv4+bRBUG9zdGdyZVNR +TCBSUE0gQnVpbGRpbmcgUHJvamVjdCA8cGdzcWxycG1zLWhhY2tlcnNAcGdmb3Vu +ZHJ5Lm9yZz6IYAQTEQIAIAUCR4PySgIbIwYLCQgHAwIEFQIIAwQWAgMBAh4BAheA +AAoJEB8W0uFELfD4jnkAoMqd6ZwwsgYHZ3hP9vt+DJt1uDW7AKDbRwP8ESKFhwdJ +8m91RPBeJW/tMLkCDQRHg/JKEAgA64+ZXgcERPYfZYo4p+yMTJAAa9aqnE3U4Ni6 +ZMB57GPuEy8NfbNya+HiftO8hoozmJdcI6XFyRBCDUVCdZ8SE+PJdOx2FFqZVIu6 +dKnr8ykhgLpNNEFDG3boK9UfLj/5lYQ3Y550Iym1QKOgyrJYeAp6sZ+Nx2PavsP3 +nMFCSD67BqAbcLCVQN7a2dAUXfEbfXJjPHXTbo1/kxtzE+KCRTLdXEbSEe3nHO04 +K/EgTBjeBUOxnciH5RylJ2oGy/v4xr9ed7R1jJtshsDKMdWApwoLlCBJ63jg/4T/ +z/OtXmu4AvmWaJxaTl7fPf2GqSqqb6jLCrQAH7AIhXr9V0zPZwADBQgAlpptNQHl +u7euIdIujFwwcxyQGfee6BG+3zaNSEHMVQMuc6bxuvYmgM9r7aki/b0YMfjJBk8v +OJ3Eh1vDH/woJi2iJ13vQ21ot+1JP3fMd6NPR8/qEeDnmVXu7QAtlkmSKI9Rdnjz +FFSUJrQPHnKsH4V4uvAM+njwYD+VFiwlBPTKNeL8cdBb4tPN2cdVJzoAp57wkZAN +VA2tKxNsTJKBi8wukaLWX8+yPHiWCNWItvyB4WCEp/rZKG4A868NM5sZQMAabpLd +l4fTiGu68OYgK9qUPZvhEAL2C1jPDVHPkLm+ZsD+90Pe66w9vB00cxXuHLzm8Pad +GaCXCY8h3xi6VIhJBBgRAgAJBQJHg/JKAhsMAAoJEB8W0uFELfD4K4cAoJ4yug8y +1U0cZEiF5W25HDzMTtaDAKCaM1m3Cbd+AZ0NGWNg/VvIX9MsPA== +=au6K +-----END PGP PUBLIC KEY BLOCK----- diff --git a/environments/production/modules/postgresql/files/validate_postgresql_connection.sh b/environments/production/modules/postgresql/files/validate_postgresql_connection.sh new file mode 100644 index 0000000..1c3506c --- /dev/null +++ b/environments/production/modules/postgresql/files/validate_postgresql_connection.sh @@ -0,0 +1,34 @@ +#!/bin/sh + +# usage is: validate_db_connection 2 50 psql + +SLEEP=$1 +TRIES=$2 +PSQL=$3 + +STATE=1 + +c=1 + +while [ $c -le $TRIES ] +do + echo $c + if [ $c -gt 1 ] + then + echo 'sleeping' + sleep $SLEEP + fi + + /bin/echo "SELECT 1" | $PSQL + STATE=$? + + if [ $STATE -eq 0 ] + then + exit 0 + fi + c=$((c+1)) +done + +echo 'Unable to connect to postgresql' + +exit 1 diff --git a/environments/production/modules/postgresql/lib/puppet/parser/functions/postgresql_acls_to_resources_hash.rb b/environments/production/modules/postgresql/lib/puppet/parser/functions/postgresql_acls_to_resources_hash.rb new file mode 100644 index 0000000..7fa7854 --- /dev/null +++ b/environments/production/modules/postgresql/lib/puppet/parser/functions/postgresql_acls_to_resources_hash.rb @@ -0,0 +1,76 @@ +module Puppet::Parser::Functions + newfunction(:postgresql_acls_to_resources_hash, :type => :rvalue, :doc => <<-EOS + This internal function translates the ipv(4|6)acls format into a resource + suitable for create_resources. It is not intended to be used outside of the + postgresql internal classes/defined resources. + + This function accepts an array of strings that are pg_hba.conf rules. It + will return a hash that can be fed into create_resources to create multiple + individual pg_hba_rule resources. + + The second parameter is an identifier that will be included in the namevar + to provide uniqueness. It must be a string. + + The third parameter is an order offset, so you can start the order at an + arbitrary starting point. + EOS + ) do |args| + func_name = "postgresql_acls_to_resources_hash()" + + raise(Puppet::ParseError, "#{func_name}: Wrong number of arguments " + + "given (#{args.size} for 3)") if args.size != 3 + + acls = args[0] + raise(Puppet::ParseError, "#{func_name}: first argument must be an array") \ + unless acls.instance_of? Array + + id = args[1] + raise(Puppet::ParseError, "#{func_name}: second argument must be a string") \ + unless id.instance_of? String + + offset = args[2].to_i + raise(Puppet::ParseError, "#{func_name}: third argument must be a number") \ + unless offset.instance_of? Fixnum + + resources = {} + acls.each do |acl| + index = acls.index(acl) + + parts = acl.split + + raise(Puppet::ParseError, "#{func_name}: acl line #{index} does not " + + "have enough parts") unless parts.length >= 4 + + resource = { + 'type' => parts[0], + 'database' => parts[1], + 'user' => parts[2], + 'order' => format('%03d', offset + index), + } + if parts[0] == 'local' then + resource['auth_method'] = parts[3] + if parts.length > 4 then + resource['auth_option'] = parts.last(parts.length - 4).join(" ") + end + else + if parts[4] =~ /^\d/ + resource['address'] = parts[3] + ' ' + parts[4] + resource['auth_method'] = parts[5] + + if parts.length > 6 then + resource['auth_option'] = parts.last(parts.length - 6).join(" ") + end + else + resource['address'] = parts[3] + resource['auth_method'] = parts[4] + + if parts.length > 5 then + resource['auth_option'] = parts.last(parts.length - 5).join(" ") + end + end + end + resources["postgresql class generated rule #{id} #{index}"] = resource + end + resources + end +end diff --git a/environments/production/modules/postgresql/lib/puppet/parser/functions/postgresql_escape.rb b/environments/production/modules/postgresql/lib/puppet/parser/functions/postgresql_escape.rb new file mode 100644 index 0000000..1ec11b8 --- /dev/null +++ b/environments/production/modules/postgresql/lib/puppet/parser/functions/postgresql_escape.rb @@ -0,0 +1,25 @@ +require 'digest/md5' + +module Puppet::Parser::Functions + newfunction(:postgresql_escape, :type => :rvalue, :doc => <<-EOS + Safely escapes a string using $$ using a random tag which should be consistent + EOS + ) do |args| + + raise(Puppet::ParseError, "postgresql_escape(): Wrong number of arguments " + + "given (#{args.size} for 1)") if args.size != 1 + + password = args[0] + + if password !~ /\$\$/ and password[-1] != '$' + retval = "$$#{password}$$" + else + escape = Digest::MD5.hexdigest(password)[0..5].gsub(/\d/,'') + until password !~ /#{escape}/ + escape = Digest::MD5.hexdigest(escape)[0..5].gsub(/\d/,'') + end + retval = "$#{escape}$#{password}$#{escape}$" + end + retval + end +end diff --git a/environments/production/modules/postgresql/lib/puppet/parser/functions/postgresql_password.rb b/environments/production/modules/postgresql/lib/puppet/parser/functions/postgresql_password.rb new file mode 100644 index 0000000..e5d2620 --- /dev/null +++ b/environments/production/modules/postgresql/lib/puppet/parser/functions/postgresql_password.rb @@ -0,0 +1,18 @@ +# hash a string as mysql's "PASSWORD()" function would do it +require 'digest/md5' + +module Puppet::Parser::Functions + newfunction(:postgresql_password, :type => :rvalue, :doc => <<-EOS + Returns the postgresql password hash from the clear text username / password. + EOS + ) do |args| + + raise(Puppet::ParseError, "postgresql_password(): Wrong number of arguments " + + "given (#{args.size} for 2)") if args.size != 2 + + username = args[0] + password = args[1] + + 'md5' + Digest::MD5.hexdigest(password.to_s + username.to_s) + end +end diff --git a/environments/production/modules/postgresql/lib/puppet/provider/postgresql_conf/parsed.rb b/environments/production/modules/postgresql/lib/puppet/provider/postgresql_conf/parsed.rb new file mode 100644 index 0000000..88bd303 --- /dev/null +++ b/environments/production/modules/postgresql/lib/puppet/provider/postgresql_conf/parsed.rb @@ -0,0 +1,42 @@ +require 'puppet/provider/parsedfile' + +Puppet::Type.type(:postgresql_conf).provide( + :parsed, + :parent => Puppet::Provider::ParsedFile, + :default_target => '/etc/postgresql.conf', + :filetype => :flat +) do + desc "Set key/values in postgresql.conf." + + text_line :comment, :match => /^\s*#/ + text_line :blank, :match => /^\s*$/ + + record_line :parsed, + :fields => %w{name value comment}, + :optional => %w{comment}, + :match => /^\s*([\w\.]+)\s*=?\s*(.*?)(?:\s*#\s*(.*))?\s*$/, + :to_line => proc { |h| + + # simple string and numeric values don't need to be enclosed in quotes + if h[:value].is_a?(Numeric) + val = h[:value].to_s + else + val = h[:value] + end + dontneedquote = val.match(/^(\d+.?\d+|\w+)$/) + dontneedequal = h[:name].match(/^(include|include_if_exists)$/i) + + str = h[:name].downcase # normalize case + str += dontneedequal ? ' ' : ' = ' + str += "'" unless dontneedquote && !dontneedequal + str += val + str += "'" unless dontneedquote && !dontneedequal + str += " # #{h[:comment]}" unless (h[:comment].nil? or h[:comment] == :absent) + str + }, + :post_parse => proc { |h| + h[:name].downcase! # normalize case + h[:value].gsub!(/(^'|'$)/, '') # strip out quotes + } + +end diff --git a/environments/production/modules/postgresql/lib/puppet/provider/postgresql_psql/ruby.rb b/environments/production/modules/postgresql/lib/puppet/provider/postgresql_psql/ruby.rb new file mode 100644 index 0000000..166c8bc --- /dev/null +++ b/environments/production/modules/postgresql/lib/puppet/provider/postgresql_psql/ruby.rb @@ -0,0 +1,80 @@ +Puppet::Type.type(:postgresql_psql).provide(:ruby) do + + def run_unless_sql_command(sql) + # for the 'unless' queries, we wrap the user's query in a 'SELECT COUNT', + # which makes it easier to parse and process the output. + run_sql_command('SELECT COUNT(*) FROM (' << sql << ') count') + end + + def run_sql_command(sql) + if resource[:search_path] + sql = "set search_path to #{Array(resource[:search_path]).join(',')}; #{sql}" + end + + command = [resource[:psql_path]] + command.push("-d", resource[:db]) if resource[:db] + command.push("-p", resource[:port]) if resource[:port] + command.push("-t", "-c", '"' + sql.gsub('"', '\"') + '"') + + environment = get_environment + + if resource[:cwd] + Dir.chdir resource[:cwd] do + run_command(command, resource[:psql_user], resource[:psql_group], environment) + end + else + run_command(command, resource[:psql_user], resource[:psql_group], environment) + end + end + + private + + def get_environment + environment = (resource[:connect_settings] || {}).dup + if envlist = resource[:environment] + envlist = [envlist] unless envlist.is_a? Array + envlist.each do |setting| + if setting =~ /^(\w+)=((.|\n)+)$/ + env_name = $1 + value = $2 + if environment.include?(env_name) || environment.include?(env_name.to_sym) + if env_name == 'NEWPGPASSWD' + warning "Overriding environment setting '#{env_name}' with '****'" + else + warning "Overriding environment setting '#{env_name}' with '#{value}'" + end + end + environment[env_name] = value + else + warning "Cannot understand environment setting #{setting.inspect}" + end + end + end + return environment + end + + def run_command(command, user, group, environment) + command = command.join ' ' + if Puppet::PUPPETVERSION.to_f < 3.0 + require 'puppet/util/execution' + Puppet::Util::Execution.withenv environment do + Puppet::Util::SUIDManager.run_and_capture(command, user, group) + end + elsif Puppet::PUPPETVERSION.to_f < 3.4 + Puppet::Util.withenv environment do + Puppet::Util::SUIDManager.run_and_capture(command, user, group) + end + else + output = Puppet::Util::Execution.execute(command, { + :uid => user, + :gid => group, + :failonfail => false, + :combine => true, + :override_locale => true, + :custom_environment => environment, + }) + [output, $CHILD_STATUS.dup] + end + end + +end diff --git a/environments/production/modules/postgresql/lib/puppet/provider/postgresql_replication_slot/ruby.rb b/environments/production/modules/postgresql/lib/puppet/provider/postgresql_replication_slot/ruby.rb new file mode 100644 index 0000000..cc49f7b --- /dev/null +++ b/environments/production/modules/postgresql/lib/puppet/provider/postgresql_replication_slot/ruby.rb @@ -0,0 +1,68 @@ +Puppet::Type.type(:postgresql_replication_slot).provide(:ruby) do + # For confinement + commands :psql => 'psql' + + def self.instances + run_sql_command('SELECT * FROM pg_replication_slots;')[0].split("\n").select { |l| l =~ /\|/ }.map do |l| + name, *others = l.strip.split(/\s+\|\s+/) + new({ + :name => name, + :ensure => :present, + }) + end + end + + def self.prefetch(resources) + instances.each do |i| + if slot = resources[i.name] + slot.provider = i + end + end + end + + def exists? + @property_hash[:ensure] == :present + end + + def create + output = self.class.run_sql_command("SELECT * FROM pg_create_physical_replication_slot('#{resource[:name]}');") + if output[1].success? + @property_hash[:ensure] = :present + else + raise Puppet::Error, "Failed to create replication slot #{resource[:name]}:\n#{output[0]}" + end + end + + def destroy + output = self.class.run_sql_command("SELECT pg_drop_replication_slot('#{resource[:name]}');") + if output[1].success? + @property_hash[:ensure] = :absent + else + raise Puppet::Error, "Failed to destroy replication slot #{resource[:name]}:\n#{output[0]}" + end + end + + private + + def self.run_sql_command(sql) + command = ['psql', '-t', '-c', sql] + + self.run_command(command, 'postgres', 'postgres') + end + + def self.run_command(command, user, group) + if Puppet::PUPPETVERSION.to_f < 3.4 + Puppet::Util::SUIDManager.run_and_capture(command, user, group) + else + output = Puppet::Util::Execution.execute(command, { + :uid => user, + :gid => group, + :failonfail => false, + :combine => true, + :override_locale => true, + :custom_environment => {} + }) + [output, $CHILD_STATUS.dup] + end + end +end diff --git a/environments/production/modules/postgresql/lib/puppet/type/postgresql_conf.rb b/environments/production/modules/postgresql/lib/puppet/type/postgresql_conf.rb new file mode 100644 index 0000000..6dbaaee --- /dev/null +++ b/environments/production/modules/postgresql/lib/puppet/type/postgresql_conf.rb @@ -0,0 +1,29 @@ +Puppet::Type.newtype(:postgresql_conf) do + + @doc = "This type allows puppet to manage postgresql.conf parameters." + + ensurable + + newparam(:name) do + desc "The postgresql parameter name to manage." + isnamevar + + newvalues(/^[\w\.]+$/) + end + + newproperty(:value) do + desc "The value to set for this parameter." + end + + newproperty(:target) do + desc "The path to postgresql.conf" + defaultto { + if @resource.class.defaultprovider.ancestors.include?(Puppet::Provider::ParsedFile) + @resource.class.defaultprovider.default_target + else + nil + end + } + end + +end diff --git a/environments/production/modules/postgresql/lib/puppet/type/postgresql_psql.rb b/environments/production/modules/postgresql/lib/puppet/type/postgresql_psql.rb new file mode 100644 index 0000000..5b2702c --- /dev/null +++ b/environments/production/modules/postgresql/lib/puppet/type/postgresql_psql.rb @@ -0,0 +1,135 @@ +Puppet::Type.newtype(:postgresql_psql) do + + newparam(:name) do + desc "An arbitrary tag for your own reference; the name of the message." + isnamevar + end + + newproperty(:command) do + desc 'The SQL command to execute via psql.' + + defaultto { @resource[:name] } + + # If needing to run the SQL command, return a fake value that will trigger + # a sync, else return the expected SQL command so no sync takes place + def retrieve + if @resource.should_run_sql + return :notrun + else + return self.should + end + end + + def sync + output, status = provider.run_sql_command(value) + self.fail("Error executing SQL; psql returned #{status}: '#{output}'") unless status == 0 + end + end + + newparam(:unless) do + desc "An optional SQL command to execute prior to the main :command; " + + "this is generally intended to be used for idempotency, to check " + + "for the existence of an object in the database to determine whether " + + "or not the main SQL command needs to be executed at all." + + # Return true if a matching row is found + def matches(value) + output, status = provider.run_unless_sql_command(value) + self.fail("Error evaluating 'unless' clause, returned #{status}: '#{output}'") unless status == 0 + + result_count = output.strip.to_i + self.debug("Found #{result_count} row(s) executing 'unless' clause") + result_count > 0 + end + end + + newparam(:onlyif) do + desc "An optional SQL command to execute prior to the main :command; " + + "this is generally intended to be used for idempotency, to check " + + "for the existence of an object in the database to determine whether " + + "or not the main SQL command needs to be executed at all." + + # Return true if a matching row is found + def matches(value) + output, status = provider.run_unless_sql_command(value) + status = output.exitcode if status.nil? + + self.fail("Error evaluating 'onlyif' clause, returned #{status}: '#{output}'") unless status == 0 + + result_count = output.strip.to_i + self.debug("Found #{result_count} row(s) executing 'onlyif' clause") + result_count > 0 + end + end + + newparam(:connect_settings) do + desc "Connection settings that will be used when connecting to postgres" + end + + newparam(:db) do + desc "The name of the database to execute the SQL command against, this overrides any PGDATABASE value in connect_settings" + end + + newparam(:port) do + desc "The port of the database server to execute the SQL command against, this overrides any PGPORT value in connect_settings." + end + + newparam(:search_path) do + desc "The schema search path to use when executing the SQL command" + end + + newparam(:psql_path) do + desc "The path to psql executable." + defaultto("psql") + end + + newparam(:psql_user) do + desc "The system user account under which the psql command should be executed." + defaultto("postgres") + end + + newparam(:psql_group) do + desc "The system user group account under which the psql command should be executed." + defaultto("postgres") + end + + newparam(:cwd, :parent => Puppet::Parameter::Path) do + desc "The working directory under which the psql command should be executed." + defaultto("/tmp") + end + + newparam(:environment) do + desc "Any additional environment variables you want to set for a + SQL command. Multiple environment variables should be + specified as an array." + + validate do |values| + Array(values).each do |value| + unless value =~ /\w+=/ + raise ArgumentError, "Invalid environment setting '#{value}'" + end + end + end + end + + newparam(:refreshonly, :boolean => true) do + desc "If 'true', then the SQL will only be executed via a notify/subscribe event." + + defaultto(:false) + newvalues(:true, :false) + end + + def should_run_sql(refreshing = false) + onlyif_param = @parameters[:onlyif] + unless_param = @parameters[:unless] + return false if !onlyif_param.nil? && !onlyif_param.value.nil? && !onlyif_param.matches(onlyif_param.value) + return false if !unless_param.nil? && !unless_param.value.nil? && unless_param.matches(unless_param.value) + return false if !refreshing && @parameters[:refreshonly].value == :true + true + end + + def refresh + self.property(:command).sync if self.should_run_sql(true) + end + +end diff --git a/environments/production/modules/postgresql/lib/puppet/type/postgresql_replication_slot.rb b/environments/production/modules/postgresql/lib/puppet/type/postgresql_replication_slot.rb new file mode 100644 index 0000000..b5b317c --- /dev/null +++ b/environments/production/modules/postgresql/lib/puppet/type/postgresql_replication_slot.rb @@ -0,0 +1,16 @@ +Puppet::Type.newtype(:postgresql_replication_slot) do + @doc = "Manages Postgresql replication slots. + +This type allows to create and destroy replication slots +to register warm standby replication on a Postgresql +master server. +" + + ensurable + + newparam(:name) do + desc "The name of the slot to create. Must be a valid replication slot name." + isnamevar + newvalues /^[a-z0-9_]+$/ + end +end diff --git a/environments/production/modules/postgresql/manifests/client.pp b/environments/production/modules/postgresql/manifests/client.pp new file mode 100644 index 0000000..b805749 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/client.pp @@ -0,0 +1,27 @@ +# Install client cli tool. See README.md for more details. +class postgresql::client ( + $file_ensure = 'file', + $validcon_script_path = $postgresql::params::validcon_script_path, + $package_name = $postgresql::params::client_package_name, + $package_ensure = 'present' +) inherits postgresql::params { + validate_absolute_path($validcon_script_path) + validate_string($package_name) + + if $package_name != 'UNSET' { + package { 'postgresql-client': + ensure => $package_ensure, + name => $package_name, + tag => 'postgresql', + } + } + + file { $validcon_script_path: + ensure => $file_ensure, + source => 'puppet:///modules/postgresql/validate_postgresql_connection.sh', + owner => 0, + group => 0, + mode => '0755', + } + +} diff --git a/environments/production/modules/postgresql/manifests/globals.pp b/environments/production/modules/postgresql/manifests/globals.pp new file mode 100644 index 0000000..b005c62 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/globals.pp @@ -0,0 +1,155 @@ +# Class for setting cross-class global overrides. See README.md for more +# details. +class postgresql::globals ( + $client_package_name = undef, + $server_package_name = undef, + $contrib_package_name = undef, + $devel_package_name = undef, + $java_package_name = undef, + $docs_package_name = undef, + $perl_package_name = undef, + $plperl_package_name = undef, + $plpython_package_name = undef, + $python_package_name = undef, + $postgis_package_name = undef, + + $service_name = undef, + $service_provider = undef, + $service_status = undef, + $default_database = undef, + + $validcon_script_path = undef, + + $initdb_path = undef, + $createdb_path = undef, + $psql_path = undef, + $pg_hba_conf_path = undef, + $pg_ident_conf_path = undef, + $postgresql_conf_path = undef, + $recovery_conf_path = undef, + $default_connect_settings = {}, + + $pg_hba_conf_defaults = undef, + + $datadir = undef, + $confdir = undef, + $bindir = undef, + $xlogdir = undef, + $logdir = undef, + $log_line_prefix = undef, + + $user = undef, + $group = undef, + + $version = undef, + $postgis_version = undef, + $repo_proxy = undef, + $repo_baseurl = undef, + + $needs_initdb = undef, + + $encoding = undef, + $locale = undef, + $timezone = undef, + + $manage_pg_hba_conf = undef, + $manage_pg_ident_conf = undef, + $manage_recovery_conf = undef, + + $manage_package_repo = undef, + $module_workdir = undef, +) { + # We are determining this here, because it is needed by the package repo + # class. + $default_version = $::osfamily ? { + /^(RedHat|Linux)/ => $::operatingsystem ? { + 'Fedora' => $::operatingsystemrelease ? { + /^(24|25)$/ => '9.5', + /^(22|23)$/ => '9.4', + /^(21)$/ => '9.3', + /^(18|19|20)$/ => '9.2', + /^(17)$/ => '9.1', + default => undef, + }, + 'Amazon' => '9.2', + default => $::operatingsystemrelease ? { + /^7\./ => '9.2', + /^6\./ => '8.4', + /^5\./ => '8.1', + default => undef, + }, + }, + 'Debian' => $::operatingsystem ? { + 'Debian' => $::operatingsystemrelease ? { + /^(squeeze|6\.)/ => '8.4', + /^(wheezy|7\.)/ => '9.1', + /^(jessie|8\.)/ => '9.4', + /^(stretch|9\.)/ => '9.6', + default => undef, + }, + 'Ubuntu' => $::operatingsystemrelease ? { + /^(10.04|10.10|11.04)$/ => '8.4', + /^(11.10|12.04|12.10|13.04|13.10)$/ => '9.1', + /^(14.04)$/ => '9.3', + /^(14.10|15.04|15.10)$/ => '9.4', + /^(16.04|16.10)$/ => '9.5', + default => undef, + }, + default => undef, + }, + 'Archlinux' => $::operatingsystem ? { + /Archlinux/ => '9.2', + default => '9.2', + }, + 'Gentoo' => '9.5', + 'FreeBSD' => '93', + 'OpenBSD' => $::operatingsystemrelease ? { + /5\.6/ => '9.3', + /5\.[7-9]/ => '9.4', + /6\.[0-9]/ => '9.5', + }, + 'Suse' => $::operatingsystem ? { + 'SLES' => $::operatingsystemrelease ? { + /11\.[0-4]/ => '91', + default => '93', + }, + 'OpenSuSE' => $::operatingsystemrelease ? { + '13.2' => '93', + }, + default => undef, + }, + default => undef, + } + $globals_version = pick($version, $default_version, 'unknown') + if($globals_version == 'unknown') { + fail('No preferred version defined or automatically detected.') + } + + $default_postgis_version = $globals_version ? { + '8.1' => '1.3.6', + '8.4' => '1.5', + '9.0' => '1.5', + '9.1' => '1.5', + '91' => '1.5', + '9.2' => '2.0', + '9.3' => '2.1', + '93' => '2.1', + '9.4' => '2.1', + '9.5' => '2.2', + '9.6' => '2.3', + default => undef, + } + $globals_postgis_version = $postgis_version ? { + undef => $default_postgis_version, + default => $postgis_version, + } + + # Setup of the repo only makes sense globally, so we are doing this here. + if($manage_package_repo) { + class { 'postgresql::repo': + version => $globals_version, + proxy => $repo_proxy, + baseurl => $repo_baseurl, + } + } +} diff --git a/environments/production/modules/postgresql/manifests/lib/devel.pp b/environments/production/modules/postgresql/manifests/lib/devel.pp new file mode 100644 index 0000000..bbc5272 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/lib/devel.pp @@ -0,0 +1,30 @@ +# This class installs postgresql development libraries. See README.md for more +# details. +class postgresql::lib::devel( + $package_name = $postgresql::params::devel_package_name, + $package_ensure = 'present', + $link_pg_config = $postgresql::params::link_pg_config +) inherits postgresql::params { + + validate_string($package_name) + + if $::osfamily == 'Gentoo' { + fail('osfamily Gentoo does not have a separate "devel" package, postgresql::lib::devel is not supported') + } + + package { 'postgresql-devel': + ensure => $package_ensure, + name => $package_name, + tag => 'postgresql', + } + + if $link_pg_config { + if ( $postgresql::params::bindir != '/usr/bin' and $postgresql::params::bindir != '/usr/local/bin') { + file { '/usr/bin/pg_config': + ensure => link, + target => "${postgresql::params::bindir}/pg_config", + } + } + } + +} diff --git a/environments/production/modules/postgresql/manifests/lib/docs.pp b/environments/production/modules/postgresql/manifests/lib/docs.pp new file mode 100644 index 0000000..55825d1 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/lib/docs.pp @@ -0,0 +1,16 @@ +# This class installs the postgresql-docs See README.md for more +# details. +class postgresql::lib::docs ( + $package_name = $postgresql::params::docs_package_name, + $package_ensure = 'present', +) inherits postgresql::params { + + validate_string($package_name) + + package { 'postgresql-docs': + ensure => $package_ensure, + name => $package_name, + tag => 'postgresql', + } + +} diff --git a/environments/production/modules/postgresql/manifests/lib/java.pp b/environments/production/modules/postgresql/manifests/lib/java.pp new file mode 100644 index 0000000..0a2d45f --- /dev/null +++ b/environments/production/modules/postgresql/manifests/lib/java.pp @@ -0,0 +1,16 @@ +# This class installs the postgresql jdbc connector. See README.md for more +# details. +class postgresql::lib::java ( + $package_name = $postgresql::params::java_package_name, + $package_ensure = 'present' +) inherits postgresql::params { + + validate_string($package_name) + + package { 'postgresql-jdbc': + ensure => $package_ensure, + name => $package_name, + tag => 'postgresql', + } + +} diff --git a/environments/production/modules/postgresql/manifests/lib/perl.pp b/environments/production/modules/postgresql/manifests/lib/perl.pp new file mode 100644 index 0000000..6ed2853 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/lib/perl.pp @@ -0,0 +1,13 @@ +# This class installs the perl libs for postgresql. See README.md for more +# details. +class postgresql::lib::perl( + $package_name = $postgresql::params::perl_package_name, + $package_ensure = 'present' +) inherits postgresql::params { + + package { 'perl-DBD-Pg': + ensure => $package_ensure, + name => $package_name, + } + +} diff --git a/environments/production/modules/postgresql/manifests/lib/python.pp b/environments/production/modules/postgresql/manifests/lib/python.pp new file mode 100644 index 0000000..bfe0585 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/lib/python.pp @@ -0,0 +1,13 @@ +# This class installs the python libs for postgresql. See README.md for more +# details. +class postgresql::lib::python( + $package_name = $postgresql::params::python_package_name, + $package_ensure = 'present' +) inherits postgresql::params { + + package { 'python-psycopg2': + ensure => $package_ensure, + name => $package_name, + } + +} diff --git a/environments/production/modules/postgresql/manifests/params.pp b/environments/production/modules/postgresql/manifests/params.pp new file mode 100644 index 0000000..b07f8f2 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/params.pp @@ -0,0 +1,314 @@ +# PRIVATE CLASS: do not use directly +class postgresql::params inherits postgresql::globals { + $version = $postgresql::globals::globals_version + $postgis_version = $postgresql::globals::globals_postgis_version + $listen_addresses = 'localhost' + $port = 5432 + $log_line_prefix = '%t ' + $ip_mask_deny_postgres_user = '0.0.0.0/0' + $ip_mask_allow_all_users = '127.0.0.1/32' + $ipv4acls = [] + $ipv6acls = [] + $encoding = $postgresql::globals::encoding + $locale = $postgresql::globals::locale + $timezone = $postgresql::globals::timezone + $service_ensure = 'running' + $service_enable = true + $service_manage = true + $service_restart_on_change = true + $service_provider = $postgresql::globals::service_provider + $manage_pg_hba_conf = pick($manage_pg_hba_conf, true) + $manage_pg_ident_conf = pick($manage_pg_ident_conf, true) + $manage_recovery_conf = pick($manage_recovery_conf, false) + $package_ensure = 'present' + $module_workdir = pick($module_workdir,'/tmp') + + # Amazon Linux's OS Family is 'Linux', operating system 'Amazon'. + case $::osfamily { + 'RedHat', 'Linux': { + $link_pg_config = true + $user = pick($user, 'postgres') + $group = pick($group, 'postgres') + $needs_initdb = pick($needs_initdb, true) + $version_parts = split($version, '[.]') + $package_version = "${version_parts[0]}${version_parts[1]}" + + if $version == $postgresql::globals::default_version and $::operatingsystem != 'Amazon' { + $client_package_name = pick($client_package_name, 'postgresql') + $server_package_name = pick($server_package_name, 'postgresql-server') + $contrib_package_name = pick($contrib_package_name,'postgresql-contrib') + $devel_package_name = pick($devel_package_name, 'postgresql-devel') + $java_package_name = pick($java_package_name, 'postgresql-jdbc') + $docs_package_name = pick($docs_package_name, 'postgresql-docs') + $plperl_package_name = pick($plperl_package_name, 'postgresql-plperl') + $plpython_package_name = pick($plpython_package_name, 'postgresql-plpython') + $service_name = pick($service_name, 'postgresql') + $bindir = pick($bindir, '/usr/bin') + $datadir = $::operatingsystem ? { + 'Amazon' => pick($datadir, "/var/lib/pgsql${package_version}/data"), + default => pick($datadir, '/var/lib/pgsql/data'), + } + $confdir = pick($confdir, $datadir) + } else { + $client_package_name = pick($client_package_name, "postgresql${package_version}") + $server_package_name = pick($server_package_name, "postgresql${package_version}-server") + $contrib_package_name = pick($contrib_package_name,"postgresql${package_version}-contrib") + $devel_package_name = pick($devel_package_name, "postgresql${package_version}-devel") + $java_package_name = pick($java_package_name, "postgresql${package_version}-jdbc") + $docs_package_name = pick($docs_package_name, "postgresql${package_version}-docs") + $plperl_package_name = pick($plperl_package_name, "postgresql${package_version}-plperl") + $plpython_package_name = pick($plpython_package_name, "postgresql${package_version}-plpython") + $service_name = $::operatingsystem ? { + 'Amazon' => pick($service_name, "postgresql${version_parts[0]}${version_parts[1]}"), + default => pick($service_name, "postgresql-${version}"), + } + $bindir = $::operatingsystem ? { + 'Amazon' => pick($bindir, '/usr/bin'), + default => pick($bindir, "/usr/pgsql-${version}/bin"), + } + $datadir = $::operatingsystem ? { + 'Amazon' => pick($datadir, "/var/lib/pgsql${package_version}/data"), + default => pick($datadir, "/var/lib/pgsql/${version}/data"), + } + $confdir = pick($confdir, $datadir) + } + $psql_path = pick($psql_path, "${bindir}/psql") + + $service_status = $service_status + $service_reload = "service ${service_name} reload" + $perl_package_name = pick($perl_package_name, 'perl-DBD-Pg') + $python_package_name = pick($python_package_name, 'python-psycopg2') + + if $postgresql::globals::postgis_package_name { + $postgis_package_name = $postgresql::globals::postgis_package_name + } elsif $::operatingsystemrelease =~ /^5\./ { + $postgis_package_name = 'postgis' + } elsif $postgis_version and versioncmp($postgis_version, '2') < 0 { + $postgis_package_name = "postgis${package_version}" + } else { + $postgis_package_name = "postgis2_${package_version}" + } + } + + 'Archlinux': { + $link_pg_config = true + $needs_initdb = pick($needs_initdb, true) + $user = pick($user, 'postgres') + $group = pick($group, 'postgres') + + # Archlinux doesn't have a client-package but has a libs package which + # pulls in postgresql server + $client_package_name = pick($client_package_name, 'postgresql') + $server_package_name = pick($server_package_name, 'postgresql-libs') + $java_package_name = pick($java_package_name, 'postgresql-jdbc') + # Archlinux doesn't have develop packages + $devel_package_name = pick($devel_package_name, 'postgresql-devel') + # Archlinux does have postgresql-contrib but it isn't maintained + $contrib_package_name = pick($contrib_package_name,'undef') + # Archlinux postgresql package provides plperl + $plperl_package_name = pick($plperl_package_name, 'undef') + $plpython_package_name = pick($plpython_package_name, 'undef') + $service_name = pick($service_name, 'postgresql') + $bindir = pick($bindir, '/usr/bin') + $datadir = pick($datadir, '/var/lib/postgres/data') + $confdir = pick($confdir, $datadir) + $psql_path = pick($psql_path, "${bindir}/psql") + + $service_status = $service_status + $service_reload = "systemctl reload ${service_name}" + $python_package_name = pick($python_package_name, 'python-psycopg2') + # Archlinux does not have a perl::DBD::Pg package + $perl_package_name = pick($perl_package_name, 'undef') + } + + 'Debian': { + $link_pg_config = false + $user = pick($user, 'postgres') + $group = pick($group, 'postgres') + + if $postgresql::globals::manage_package_repo == true { + $needs_initdb = pick($needs_initdb, true) + $service_name = pick($service_name, 'postgresql') + } else { + $needs_initdb = pick($needs_initdb, false) + $service_name = $::operatingsystem ? { + 'Debian' => pick($service_name, 'postgresql'), + 'Ubuntu' => $::lsbmajdistrelease ? { + /^10/ => pick($service_name, "postgresql-${version}"), + default => pick($service_name, 'postgresql'), + }, + default => undef + } + } + + $client_package_name = pick($client_package_name, "postgresql-client-${version}") + $server_package_name = pick($server_package_name, "postgresql-${version}") + $contrib_package_name = pick($contrib_package_name, "postgresql-contrib-${version}") + if $postgis_version and versioncmp($postgis_version, '2') < 0 { + $postgis_package_name = pick($postgis_package_name, "postgresql-${version}-postgis") + } else { + $postgis_package_name = pick($postgis_package_name, "postgresql-${version}-postgis-${postgis_version}") + } + $devel_package_name = pick($devel_package_name, 'libpq-dev') + $java_package_name = $::operatingsystem ? { + 'Debian' => $::operatingsystemrelease ? { + /^6/ => pick($java_package_name, 'libpg-java'), + default => pick($java_package_name, 'libpostgresql-jdbc-java'), + }, + default => pick($java_package_name, 'libpostgresql-jdbc-java'), + } + $perl_package_name = pick($perl_package_name, 'libdbd-pg-perl') + $plperl_package_name = pick($plperl_package_name, "postgresql-plperl-${version}") + $plpython_package_name = pick($plpython_package_name, "postgresql-plpython-${version}") + $python_package_name = pick($python_package_name, 'python-psycopg2') + + $bindir = pick($bindir, "/usr/lib/postgresql/${version}/bin") + $datadir = pick($datadir, "/var/lib/postgresql/${version}/main") + $confdir = pick($confdir, "/etc/postgresql/${version}/main") + if $::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '8.0') >= 0 { + # Jessie uses systemd + $service_status = pick($service_status, "/usr/sbin/service ${service_name}@*-main status") + } elsif $::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemrelease, '15.04') >= 0 { + # Ubuntu releases since vivid use systemd + $service_status = pick($service_status, "/usr/sbin/service ${service_name} status") + } else { + $service_status = pick($service_status, "/etc/init.d/${service_name} status | /bin/egrep -q 'Running clusters: .+|online'") + } + $service_reload = "service ${service_name} reload" + $psql_path = pick($psql_path, '/usr/bin/psql') + } + + 'Gentoo': { + $user = pick($user, 'postgres') + $group = pick($group, 'postgres') + + $client_package_name = pick($client_package_name, 'UNSET') + $server_package_name = pick($server_package_name, 'postgresql') + $contrib_package_name = pick_default($contrib_package_name, undef) + $devel_package_name = pick_default($devel_package_name, undef) + $java_package_name = pick($java_package_name, 'jdbc-postgresql') + $perl_package_name = pick($perl_package_name, 'DBD-Pg') + $plperl_package_name = undef + $python_package_name = pick($python_package_name, 'psycopg') + + $service_name = pick($service_name, "postgresql-${version}") + $bindir = pick($bindir, "/usr/lib/postgresql-${version}/bin") + $datadir = pick($datadir, "/var/lib/postgresql/${version}_data") + $confdir = pick($confdir, "/etc/postgresql-${version}") + $service_status = pick($service_status, "systemctl status ${service_name}") + $service_reload = "systemctl reload ${service_name}" + $psql_path = pick($psql_path, "${bindir}/psql") + + $needs_initdb = pick($needs_initdb, true) + } + + 'FreeBSD': { + case $version { + '96': { + $user = pick($user, 'postgres') + $group = pick($group, 'postgres') + $datadir = pick($datadir, "/var/db/postgres/data${version}") + } + default: { + $user = pick($user, 'pgsql') + $group = pick($group, 'pgsql') + $datadir = pick($datadir, '/usr/local/pgsql/data') + } + } + + $link_pg_config = true + $client_package_name = pick($client_package_name, "databases/postgresql${version}-client") + $server_package_name = pick($server_package_name, "databases/postgresql${version}-server") + $contrib_package_name = pick($contrib_package_name, "databases/postgresql${version}-contrib") + $devel_package_name = pick($devel_package_name, 'databases/postgresql-libpqxx3') + $java_package_name = pick($java_package_name, 'databases/postgresql-jdbc') + $perl_package_name = pick($plperl_package_name, 'databases/p5-DBD-Pg') + $plperl_package_name = pick($plperl_package_name, "databases/postgresql${version}-plperl") + $python_package_name = pick($python_package_name, 'databases/py-psycopg2') + + $service_name = pick($service_name, 'postgresql') + $bindir = pick($bindir, '/usr/local/bin') + $confdir = pick($confdir, $datadir) + $service_status = pick($service_status, "/usr/local/etc/rc.d/${service_name} onestatus") + $service_reload = "service ${service_name} reload" + $psql_path = pick($psql_path, "${bindir}/psql") + + $needs_initdb = pick($needs_initdb, true) + } + + 'OpenBSD': { + $user = pick($user, '_postgresql') + $group = pick($group, '_postgresql') + + $client_package_name = pick($client_package_name, 'postgresql-client') + $server_package_name = pick($server_package_name, 'postgresql-server') + $contrib_package_name = pick($contrib_package_name, 'postgresql-contrib') + $devel_package_name = pick($devel_package_name, 'postgresql-client') + $java_package_name = pick($java_package_name, 'postgresql-jdbc') + $perl_package_name = pick($perl_package_name, 'databases/p5-DBD-Pg') + $plperl_package_name = undef + $python_package_name = pick($python_package_name, 'py-psycopg2') + + $service_name = pick($service_name, 'postgresql') + $bindir = pick($bindir, '/usr/local/bin') + $datadir = pick($datadir, '/var/postgresql/data') + $confdir = pick($confdir, $datadir) + $service_status = pick($service_status, "/etc/rc.d/${service_name} check") + $service_reload = "/etc/rc.d/${service_name} reload" + $psql_path = pick($psql_path, "${bindir}/psql") + + $needs_initdb = pick($needs_initdb, true) + } + + 'Suse': { + $link_pg_config = true + $user = pick($user, 'postgres') + $group = pick($group, 'postgres') + + $client_package_name = pick($client_package_name, "postgresql${version}") + $server_package_name = pick($server_package_name, "postgresql${version}-server") + $contrib_package_name = pick($contrib_package_name, "postgresql${version}-contrib") + $devel_package_name = pick($devel_package_name, "postgresql${version}-devel") + $java_package_name = pick($java_package_name, "postgresql${version}-jdbc") + $perl_package_name = pick($plperl_package_name, 'perl-DBD-Pg') + $plperl_package_name = pick($plperl_package_name, "postgresql${version}-plperl") + $python_package_name = pick($python_package_name, 'python-psycopg2') + + $service_name = pick($service_name, 'postgresql') + $bindir = pick($bindir, "/usr/lib/postgresql${version}/bin") + $datadir = pick($datadir, '/var/lib/pgsql/data') + $confdir = pick($confdir, $datadir) + $service_status = pick($service_status, "/etc/init.d/${service_name} status") + $service_reload = "/etc/init.d/${service_name} reload" + $psql_path = pick($psql_path, "${bindir}/psql") + + $needs_initdb = pick($needs_initdb, true) + } + + default: { + $link_pg_config = true + $psql_path = pick($psql_path, "${bindir}/psql") + + # Since we can't determine defaults on our own, we rely on users setting + # parameters with the postgresql::globals class. Here we are checking + # that the mandatory minimum is set for the module to operate. + $err_prefix = "Module ${module_name} does not provide defaults for osfamily: ${::osfamily} operatingsystem: ${::operatingsystem}; please specify a value for ${module_name}::globals::" + if ($needs_initdb == undef) { fail("${err_prefix}needs_initdb") } + if ($service_name == undef) { fail("${err_prefix}service_name") } + if ($client_package_name == undef) { fail("${err_prefix}client_package_name") } + if ($server_package_name == undef) { fail("${err_prefix}server_package_name") } + if ($bindir == undef) { fail("${err_prefix}bindir") } + if ($datadir == undef) { fail("${err_prefix}datadir") } + if ($confdir == undef) { fail("${err_prefix}confdir") } + } + } + + $validcon_script_path = pick($validcon_script_path, '/usr/local/bin/validate_postgresql_connection.sh') + $initdb_path = pick($initdb_path, "${bindir}/initdb") + $pg_hba_conf_path = pick($pg_hba_conf_path, "${confdir}/pg_hba.conf") + $pg_hba_conf_defaults = pick($pg_hba_conf_defaults, true) + $pg_ident_conf_path = pick($pg_ident_conf_path, "${confdir}/pg_ident.conf") + $postgresql_conf_path = pick($postgresql_conf_path, "${confdir}/postgresql.conf") + $recovery_conf_path = pick($recovery_conf_path, "${datadir}/recovery.conf") + $default_database = pick($default_database, 'postgres') +} diff --git a/environments/production/modules/postgresql/manifests/repo.pp b/environments/production/modules/postgresql/manifests/repo.pp new file mode 100644 index 0000000..5ec63c7 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/repo.pp @@ -0,0 +1,23 @@ +# PRIVATE CLASS: do not use directly +class postgresql::repo ( + $version = undef, + $proxy = undef, + $baseurl = undef, +) { + case $::osfamily { + 'RedHat', 'Linux': { + if $version == undef { + fail("The parameter 'version' for 'postgresql::repo' is undefined. You must always define it when osfamily == Redhat or Linux") + } + class { 'postgresql::repo::yum_postgresql_org': } + } + + 'Debian': { + class { 'postgresql::repo::apt_postgresql_org': } + } + + default: { + fail("Unsupported managed repository for osfamily: ${::osfamily}, operatingsystem: ${::operatingsystem}, module ${module_name} currently only supports managing repos for osfamily RedHat and Debian") + } + } +} diff --git a/environments/production/modules/postgresql/manifests/repo/apt_postgresql_org.pp b/environments/production/modules/postgresql/manifests/repo/apt_postgresql_org.pp new file mode 100644 index 0000000..71f76d5 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/repo/apt_postgresql_org.pp @@ -0,0 +1,28 @@ +# PRIVATE CLASS: do not use directly +class postgresql::repo::apt_postgresql_org inherits postgresql::repo { + include ::apt + + # Here we have tried to replicate the instructions on the PostgreSQL site: + # + # http://www.postgresql.org/download/linux/debian/ + # + $default_baseurl = 'http://apt.postgresql.org/pub/repos/apt/' + + $_baseurl = pick($postgresql::repo::baseurl, $default_baseurl) + + apt::pin { 'apt_postgresql_org': + originator => 'apt.postgresql.org', + priority => 500, + }-> + apt::source { 'apt.postgresql.org': + location => $_baseurl, + release => "${::lsbdistcodename}-pgdg", + repos => "main ${postgresql::repo::version}", + key => 'B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8', + key_source => 'https://www.postgresql.org/media/keys/ACCC4CF8.asc', + include_src => false, + } + + Apt::Source['apt.postgresql.org']->Package<|tag == 'postgresql'|> + Class['Apt::Update'] -> Package<|tag == 'postgresql'|> +} diff --git a/environments/production/modules/postgresql/manifests/repo/yum_postgresql_org.pp b/environments/production/modules/postgresql/manifests/repo/yum_postgresql_org.pp new file mode 100644 index 0000000..1ee8c9a --- /dev/null +++ b/environments/production/modules/postgresql/manifests/repo/yum_postgresql_org.pp @@ -0,0 +1,36 @@ +# PRIVATE CLASS: do not use directly +class postgresql::repo::yum_postgresql_org inherits postgresql::repo { + $version_parts = split($postgresql::repo::version, '[.]') + $package_version = "${version_parts[0]}${version_parts[1]}" + $gpg_key_path = "/etc/pki/rpm-gpg/RPM-GPG-KEY-PGDG-${package_version}" + + file { $gpg_key_path: + source => 'puppet:///modules/postgresql/RPM-GPG-KEY-PGDG', + owner => 'root', + group => 'root', + mode => '0644', + before => Yumrepo['yum.postgresql.org'] + } + + if($::operatingsystem == 'Fedora') { + $label1 = 'fedora' + $label2 = $label1 + } else { + $label1 = 'redhat' + $label2 = 'rhel' + } + $default_baseurl = "https://download.postgresql.org/pub/repos/yum/${postgresql::repo::version}/${label1}/${label2}-\$releasever-\$basearch" + + $_baseurl = pick($postgresql::repo::baseurl, $default_baseurl) + + yumrepo { 'yum.postgresql.org': + descr => "PostgreSQL ${postgresql::repo::version} \$releasever - \$basearch", + baseurl => $_baseurl, + enabled => 1, + gpgcheck => 1, + gpgkey => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-PGDG-${package_version}", + proxy => $postgresql::repo::proxy, + } + + Yumrepo['yum.postgresql.org'] -> Package<|tag == 'postgresql'|> +} diff --git a/environments/production/modules/postgresql/manifests/server.pp b/environments/production/modules/postgresql/manifests/server.pp new file mode 100644 index 0000000..2e90178 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server.pp @@ -0,0 +1,83 @@ +# This installs a PostgreSQL server. See README.md for more details. +class postgresql::server ( + $postgres_password = undef, + + $package_name = $postgresql::params::server_package_name, + $package_ensure = $postgresql::params::package_ensure, + + $plperl_package_name = $postgresql::params::plperl_package_name, + $plpython_package_name = $postgresql::params::plpython_package_name, + + $service_ensure = $postgresql::params::service_ensure, + $service_enable = $postgresql::params::service_enable, + $service_manage = $postgresql::params::service_manage, + $service_name = $postgresql::params::service_name, + $service_restart_on_change = $postgresql::params::service_restart_on_change, + $service_provider = $postgresql::params::service_provider, + $service_reload = $postgresql::params::service_reload, + $service_status = $postgresql::params::service_status, + $default_database = $postgresql::params::default_database, + $default_connect_settings = $postgresql::globals::default_connect_settings, + $listen_addresses = $postgresql::params::listen_addresses, + $port = $postgresql::params::port, + $ip_mask_deny_postgres_user = $postgresql::params::ip_mask_deny_postgres_user, + $ip_mask_allow_all_users = $postgresql::params::ip_mask_allow_all_users, + $ipv4acls = $postgresql::params::ipv4acls, + $ipv6acls = $postgresql::params::ipv6acls, + + $initdb_path = $postgresql::params::initdb_path, + $createdb_path = $postgresql::params::createdb_path, + $psql_path = $postgresql::params::psql_path, + $pg_hba_conf_path = $postgresql::params::pg_hba_conf_path, + $pg_ident_conf_path = $postgresql::params::pg_ident_conf_path, + $postgresql_conf_path = $postgresql::params::postgresql_conf_path, + $recovery_conf_path = $postgresql::params::recovery_conf_path, + + $datadir = $postgresql::params::datadir, + $xlogdir = $postgresql::params::xlogdir, + $logdir = $postgresql::params::logdir, + + $log_line_prefix = $postgresql::params::log_line_prefix, + + $pg_hba_conf_defaults = $postgresql::params::pg_hba_conf_defaults, + + $user = $postgresql::params::user, + $group = $postgresql::params::group, + + $needs_initdb = $postgresql::params::needs_initdb, + + $encoding = $postgresql::params::encoding, + $locale = $postgresql::params::locale, + $timezone = $postgresql::params::timezone, + + $manage_pg_hba_conf = $postgresql::params::manage_pg_hba_conf, + $manage_pg_ident_conf = $postgresql::params::manage_pg_ident_conf, + $manage_recovery_conf = $postgresql::params::manage_recovery_conf, + $module_workdir = $postgresql::params::module_workdir, + #Deprecated + $version = undef, +) inherits postgresql::params { + $pg = 'postgresql::server' + + if $version != undef { + warning('Passing "version" to postgresql::server is deprecated; please use postgresql::globals instead.') + $_version = $version + } else { + $_version = $postgresql::params::version + } + + if $createdb_path != undef{ + warning('Passing "createdb_path" to postgresql::server is deprecated, it can be removed safely for the same behaviour') + } + + # Reload has its own ordering, specified by other defines + class { "${pg}::reload": require => Class["${pg}::install"] } + + anchor { "${pg}::start": }-> + class { "${pg}::install": }-> + class { "${pg}::initdb": }-> + class { "${pg}::config": }-> + class { "${pg}::service": }-> + class { "${pg}::passwd": }-> + anchor { "${pg}::end": } +} diff --git a/environments/production/modules/postgresql/manifests/server/config.pp b/environments/production/modules/postgresql/manifests/server/config.pp new file mode 100644 index 0000000..205dd22 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/config.pp @@ -0,0 +1,219 @@ +# PRIVATE CLASS: do not call directly +class postgresql::server::config { + $ip_mask_deny_postgres_user = $postgresql::server::ip_mask_deny_postgres_user + $ip_mask_allow_all_users = $postgresql::server::ip_mask_allow_all_users + $listen_addresses = $postgresql::server::listen_addresses + $port = $postgresql::server::port + $ipv4acls = $postgresql::server::ipv4acls + $ipv6acls = $postgresql::server::ipv6acls + $pg_hba_conf_path = $postgresql::server::pg_hba_conf_path + $pg_ident_conf_path = $postgresql::server::pg_ident_conf_path + $postgresql_conf_path = $postgresql::server::postgresql_conf_path + $recovery_conf_path = $postgresql::server::recovery_conf_path + $pg_hba_conf_defaults = $postgresql::server::pg_hba_conf_defaults + $user = $postgresql::server::user + $group = $postgresql::server::group + $version = $postgresql::server::_version + $manage_pg_hba_conf = $postgresql::server::manage_pg_hba_conf + $manage_pg_ident_conf = $postgresql::server::manage_pg_ident_conf + $manage_recovery_conf = $postgresql::server::manage_recovery_conf + $datadir = $postgresql::server::datadir + $logdir = $postgresql::server::logdir + $service_name = $postgresql::server::service_name + $log_line_prefix = $postgresql::server::log_line_prefix + $timezone = $postgresql::server::timezone + + if ($manage_pg_hba_conf == true) { + # Prepare the main pg_hba file + concat { $pg_hba_conf_path: + owner => $user, + group => $group, + mode => '0640', + warn => true, + notify => Class['postgresql::server::reload'], + } + + if $pg_hba_conf_defaults { + Postgresql::Server::Pg_hba_rule { + database => 'all', + user => 'all', + } + + # Lets setup the base rules + $local_auth_option = $version ? { + '8.1' => 'sameuser', + default => undef, + } + postgresql::server::pg_hba_rule { 'local access as postgres user': + type => 'local', + user => $user, + auth_method => 'ident', + auth_option => $local_auth_option, + order => '001', + } + postgresql::server::pg_hba_rule { 'local access to database with same name': + type => 'local', + auth_method => 'ident', + auth_option => $local_auth_option, + order => '002', + } + postgresql::server::pg_hba_rule { 'allow localhost TCP access to postgresql user': + type => 'host', + user => $user, + address => '127.0.0.1/32', + auth_method => 'md5', + order => '003', + } + postgresql::server::pg_hba_rule { 'deny access to postgresql user': + type => 'host', + user => $user, + address => $ip_mask_deny_postgres_user, + auth_method => 'reject', + order => '004', + } + + postgresql::server::pg_hba_rule { 'allow access to all users': + type => 'host', + address => $ip_mask_allow_all_users, + auth_method => 'md5', + order => '100', + } + postgresql::server::pg_hba_rule { 'allow access to ipv6 localhost': + type => 'host', + address => '::1/128', + auth_method => 'md5', + order => '101', + } + } + + # ipv4acls are passed as an array of rule strings, here we transform + # them into a resources hash, and pass the result to create_resources + $ipv4acl_resources = postgresql_acls_to_resources_hash($ipv4acls, + 'ipv4acls', 10) + create_resources('postgresql::server::pg_hba_rule', $ipv4acl_resources) + + + # ipv6acls are passed as an array of rule strings, here we transform + # them into a resources hash, and pass the result to create_resources + $ipv6acl_resources = postgresql_acls_to_resources_hash($ipv6acls, + 'ipv6acls', 102) + create_resources('postgresql::server::pg_hba_rule', $ipv6acl_resources) + } + + # We must set a "listen_addresses" line in the postgresql.conf if we + # want to allow any connections from remote hosts. + postgresql::server::config_entry { 'listen_addresses': + value => $listen_addresses, + } + postgresql::server::config_entry { 'port': + value => $port, + } + postgresql::server::config_entry { 'data_directory': + value => $datadir, + } + if $timezone { + postgresql::server::config_entry { 'timezone': + value => $timezone, + } + } + if $logdir { + postgresql::server::config_entry { 'log_directory': + value => $logdir, + } + + } + # Allow timestamps in log by default + if $log_line_prefix { + postgresql::server::config_entry {'log_line_prefix': + value => $log_line_prefix, + } + } + + # RedHat-based systems hardcode some PG* variables in the init script, and need to be overriden + # in /etc/sysconfig/pgsql/postgresql. Create a blank file so we can manage it with augeas later. + if ($::osfamily == 'RedHat') and ($::operatingsystemrelease !~ /^7/) and ($::operatingsystem != 'Fedora') { + file { '/etc/sysconfig/pgsql/postgresql': + ensure => present, + replace => false, + } + + # The init script from the packages of the postgresql.org repository + # sources an alternate sysconfig file. + # I. e. /etc/sysconfig/pgsql/postgresql-9.3 for PostgreSQL 9.3 + # Link to the sysconfig file set by this puppet module + file { "/etc/sysconfig/pgsql/postgresql-${version}": + ensure => link, + target => '/etc/sysconfig/pgsql/postgresql', + require => File[ '/etc/sysconfig/pgsql/postgresql' ], + } + + } + + + if ($manage_pg_ident_conf == true) { + concat { $pg_ident_conf_path: + owner => $user, + group => $group, + force => true, # do not crash if there is no pg_ident_rules + mode => '0640', + warn => true, + notify => Class['postgresql::server::reload'], + } + } + + if ($manage_recovery_conf == true) { + concat { $recovery_conf_path: + owner => $user, + group => $group, + force => true, # do not crash if there is no recovery conf file + mode => '0640', + warn => true, + notify => Class['postgresql::server::reload'], + } + } + + if $::osfamily == 'RedHat' { + if $::operatingsystemrelease =~ /^7/ or $::operatingsystem == 'Fedora' { + # Template uses: + # - $::operatingsystem + # - $service_name + # - $port + # - $datadir + file { 'systemd-override': + ensure => present, + path => "/etc/systemd/system/${service_name}.service", + owner => root, + group => root, + content => template('postgresql/systemd-override.erb'), + notify => [ Exec['restart-systemd'], Class['postgresql::server::service'] ], + before => Class['postgresql::server::reload'], + } + exec { 'restart-systemd': + command => 'systemctl daemon-reload', + refreshonly => true, + path => '/bin:/usr/bin:/usr/local/bin' + } + } + } + elsif $::osfamily == 'Gentoo' { + # Template uses: + # - $::operatingsystem + # - $service_name + # - $port + # - $datadir + file { 'systemd-override': + ensure => present, + path => "/etc/systemd/system/${service_name}.service", + owner => root, + group => root, + content => template('postgresql/systemd-override.erb'), + notify => [ Exec['restart-systemd'], Class['postgresql::server::service'] ], + before => Class['postgresql::server::reload'], + } + exec { 'restart-systemd': + command => 'systemctl daemon-reload', + refreshonly => true, + path => '/bin:/usr/bin:/usr/local/bin' + } + } +} diff --git a/environments/production/modules/postgresql/manifests/server/config_entry.pp b/environments/production/modules/postgresql/manifests/server/config_entry.pp new file mode 100644 index 0000000..7c34737 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/config_entry.pp @@ -0,0 +1,126 @@ +# Manage a postgresql.conf entry. See README.md for more details. +define postgresql::server::config_entry ( + $ensure = 'present', + $value = undef, + $path = false +) { + $postgresql_conf_path = $postgresql::server::postgresql_conf_path + + $target = $path ? { + false => $postgresql_conf_path, + default => $path, + } + + Exec { + logoutput => 'on_failure', + } + + case $name { + /data_directory|timezone|hba_file|ident_file|include|listen_addresses|port|max_connections|superuser_reserved_connections|unix_socket_director(y|ies)|unix_socket_group|unix_socket_permissions|bonjour|bonjour_name|ssl|ssl_ciphers|shared_buffers|max_prepared_transactions|max_files_per_process|shared_preload_libraries|wal_level|wal_buffers|archive_mode|max_wal_senders|hot_standby|logging_collector|silent_mode|track_activity_query_size|autovacuum_max_workers|autovacuum_freeze_max_age|max_locks_per_transaction|max_pred_locks_per_transaction|restart_after_crash|lc_messages|lc_monetary|lc_numeric|lc_time/: { + if $postgresql::server::service_restart_on_change { + Postgresql_conf { + notify => Class['postgresql::server::service'], + before => Class['postgresql::server::reload'], + } + } else { + Postgresql_conf { + before => [ + Class['postgresql::server::service'], + Class['postgresql::server::reload'], + ], + } + } + } + + default: { + Postgresql_conf { + notify => Class['postgresql::server::reload'], + } + } + } + + # We have to handle ports and the data directory in a weird and + # special way. On early Debian and Ubuntu and RHEL we have to ensure + # we stop the service completely. On RHEL 7 we either have to create + # a systemd override for the port or update the sysconfig file, but this + # is managed for us in postgresql::server::config. + if $::operatingsystem == 'Debian' or $::operatingsystem == 'Ubuntu' { + if $name == 'port' and ( $::operatingsystemrelease =~ /^6/ or $::operatingsystemrelease =~ /^10\.04/ ) { + exec { "postgresql_stop_${name}": + command => "service ${::postgresql::server::service_name} stop", + onlyif => "service ${::postgresql::server::service_name} status", + unless => "grep 'port = ${value}' ${::postgresql::server::postgresql_conf_path}", + path => '/usr/sbin:/sbin:/bin:/usr/bin:/usr/local/bin', + before => Postgresql_conf[$name], + } + } + elsif $name == 'data_directory' { + exec { "postgresql_stop_${name}": + command => "service ${::postgresql::server::service_name} stop", + onlyif => "service ${::postgresql::server::service_name} status", + unless => "grep \"data_directory = '${value}'\" ${::postgresql::server::postgresql_conf_path}", + path => '/usr/sbin:/sbin:/bin:/usr/bin:/usr/local/bin', + before => Postgresql_conf[$name], + } + } + } + if $::osfamily == 'RedHat' { + if ! ($::operatingsystemrelease =~ /^7/ or $::operatingsystem == 'Fedora') { + if $name == 'port' { + # We need to force postgresql to stop before updating the port + # because puppet becomes confused and is unable to manage the + # service appropriately. + exec { "postgresql_stop_${name}": + command => "service ${::postgresql::server::service_name} stop", + onlyif => "service ${::postgresql::server::service_name} status", + unless => "grep 'PGPORT=${value}' /etc/sysconfig/pgsql/postgresql", + path => '/sbin:/bin:/usr/bin:/usr/local/bin', + require => File['/etc/sysconfig/pgsql/postgresql'], + } -> + augeas { 'override PGPORT in /etc/sysconfig/pgsql/postgresql': + lens => 'Shellvars.lns', + incl => '/etc/sysconfig/pgsql/*', + context => '/files/etc/sysconfig/pgsql/postgresql', + changes => "set PGPORT ${value}", + require => File['/etc/sysconfig/pgsql/postgresql'], + notify => Class['postgresql::server::service'], + before => Class['postgresql::server::reload'], + } + } elsif $name == 'data_directory' { + # We need to force postgresql to stop before updating the data directory + # otherwise init script breaks + exec { "postgresql_${name}": + command => "service ${::postgresql::server::service_name} stop", + onlyif => "service ${::postgresql::server::service_name} status", + unless => "grep 'PGDATA=${value}' /etc/sysconfig/pgsql/postgresql", + path => '/sbin:/bin:/usr/bin:/usr/local/bin', + require => File['/etc/sysconfig/pgsql/postgresql'], + } -> + augeas { 'override PGDATA in /etc/sysconfig/pgsql/postgresql': + lens => 'Shellvars.lns', + incl => '/etc/sysconfig/pgsql/*', + context => '/files/etc/sysconfig/pgsql/postgresql', + changes => "set PGDATA ${value}", + require => File['/etc/sysconfig/pgsql/postgresql'], + notify => Class['postgresql::server::service'], + before => Class['postgresql::server::reload'], + } + } + } + } + + case $ensure { + /present|absent/: { + postgresql_conf { $name: + ensure => $ensure, + target => $target, + value => $value, + require => Class['postgresql::server::initdb'], + } + } + + default: { + fail("Unknown value for ensure '${ensure}'.") + } + } +} diff --git a/environments/production/modules/postgresql/manifests/server/contrib.pp b/environments/production/modules/postgresql/manifests/server/contrib.pp new file mode 100644 index 0000000..4c6cdc1 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/contrib.pp @@ -0,0 +1,23 @@ +# Install the contrib postgresql packaging. See README.md for more details. +class postgresql::server::contrib ( + $package_name = $postgresql::params::contrib_package_name, + $package_ensure = 'present' +) inherits postgresql::params { + validate_string($package_name) + + if $::osfamily == 'Gentoo' { + fail('osfamily Gentoo does not have a separate "contrib" package, postgresql::server::contrib is not supported.') + } + + package { 'postgresql-contrib': + ensure => $package_ensure, + name => $package_name, + tag => 'postgresql', + } + + anchor { 'postgresql::server::contrib::start': }-> + Class['postgresql::server::install']-> + Package['postgresql-contrib']-> + Class['postgresql::server::service']-> + anchor { 'postgresql::server::contrib::end': } +} diff --git a/environments/production/modules/postgresql/manifests/server/database.pp b/environments/production/modules/postgresql/manifests/server/database.pp new file mode 100644 index 0000000..b03729c --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/database.pp @@ -0,0 +1,128 @@ +# Define for creating a database. See README.md for more details. +define postgresql::server::database( + $comment = undef, + $dbname = $title, + $owner = undef, + $tablespace = undef, + $template = 'template0', + $encoding = $postgresql::server::encoding, + $locale = $postgresql::server::locale, + $istemplate = false, + $connect_settings = $postgresql::server::default_connect_settings, +) { + $createdb_path = $postgresql::server::createdb_path + $user = $postgresql::server::user + $group = $postgresql::server::group + $psql_path = $postgresql::server::psql_path + $default_db = $postgresql::server::default_database + + # If possible use the version of the remote database, otherwise + # fallback to our local DB version + if $connect_settings != undef and has_key( $connect_settings, 'DBVERSION') { + $version = $connect_settings['DBVERSION'] + } else { + $version = $postgresql::server::_version + } + + # If the connection settings do not contain a port, then use the local server port + if $connect_settings != undef and has_key( $connect_settings, 'PGPORT') { + $port = undef + } else { + $port = $postgresql::server::port + } + + # Set the defaults for the postgresql_psql resource + Postgresql_psql { + db => $default_db, + psql_user => $user, + psql_group => $group, + psql_path => $psql_path, + port => $port, + connect_settings => $connect_settings, + } + + # Optionally set the locale switch. Older versions of createdb may not accept + # --locale, so if the parameter is undefined its safer not to pass it. + if ($version != '8.1') { + $locale_option = $locale ? { + undef => '', + default => "LC_COLLATE = '${locale}' LC_CTYPE = '${locale}'", + } + $public_revoke_privilege = 'CONNECT' + } else { + $locale_option = '' + $public_revoke_privilege = 'ALL' + } + + $template_option = $template ? { + undef => '', + default => "TEMPLATE = \"${template}\"", + } + + $encoding_option = $encoding ? { + undef => '', + default => "ENCODING = '${encoding}'", + } + + $tablespace_option = $tablespace ? { + undef => '', + default => "TABLESPACE = \"${tablespace}\"", + } + + if $createdb_path != undef { + warning('Passing "createdb_path" to postgresql::database is deprecated, it can be removed safely for the same behaviour') + } + + postgresql_psql { "CREATE DATABASE \"${dbname}\"": + command => "CREATE DATABASE \"${dbname}\" WITH ${template_option} ${encoding_option} ${locale_option} ${tablespace_option}", + unless => "SELECT 1 FROM pg_database WHERE datname = '${dbname}'", + require => Class['postgresql::server::service'] + }~> + + # This will prevent users from connecting to the database unless they've been + # granted privileges. + postgresql_psql { "REVOKE ${public_revoke_privilege} ON DATABASE \"${dbname}\" FROM public": + refreshonly => true, + } + + Postgresql_psql["CREATE DATABASE \"${dbname}\""]-> + postgresql_psql { "UPDATE pg_database SET datistemplate = ${istemplate} WHERE datname = '${dbname}'": + unless => "SELECT 1 FROM pg_database WHERE datname = '${dbname}' AND datistemplate = ${istemplate}", + } + + if $comment { + # The shobj_description function was only introduced with 8.2 + $comment_information_function = $version ? { + '8.1' => 'obj_description', + default => 'shobj_description', + } + Postgresql_psql["CREATE DATABASE \"${dbname}\""]-> + postgresql_psql { "COMMENT ON DATABASE \"${dbname}\" IS '${comment}'": + unless => "SELECT 1 FROM pg_catalog.pg_database d WHERE datname = '${dbname}' AND pg_catalog.${comment_information_function}(d.oid, 'pg_database') = '${comment}'", + db => $dbname, + } + } + + if $owner { + postgresql_psql { "ALTER DATABASE \"${dbname}\" OWNER TO \"${owner}\"": + unless => "SELECT 1 FROM pg_database JOIN pg_roles rol ON datdba = rol.oid WHERE datname = '${dbname}' AND rolname = '${owner}'", + require => Postgresql_psql["CREATE DATABASE \"${dbname}\""], + } + + if defined(Postgresql::Server::Role[$owner]) { + Postgresql::Server::Role[$owner]->Postgresql_psql["ALTER DATABASE \"${dbname}\" OWNER TO \"${owner}\""] + } + } + + if $tablespace { + postgresql_psql { "ALTER DATABASE \"${dbname}\" SET ${tablespace_option}": + unless => "SELECT 1 FROM pg_database JOIN pg_tablespace spc ON dattablespace = spc.oid WHERE datname = '${dbname}' AND spcname = '${tablespace}'", + require => Postgresql_psql["CREATE DATABASE \"${dbname}\""], + } + + if defined(Postgresql::Server::Tablespace[$tablespace]) { + # The tablespace must be there, before we create the database. + Postgresql::Server::Tablespace[$tablespace]->Postgresql_psql["CREATE DATABASE \"${dbname}\""] + } + } +} diff --git a/environments/production/modules/postgresql/manifests/server/database_grant.pp b/environments/production/modules/postgresql/manifests/server/database_grant.pp new file mode 100644 index 0000000..6c29b57 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/database_grant.pp @@ -0,0 +1,20 @@ +# Manage a database grant. See README.md for more details. +define postgresql::server::database_grant( + $privilege, + $db, + $role, + $psql_db = undef, + $psql_user = undef, + $connect_settings = undef, +) { + postgresql::server::grant { "database:${name}": + role => $role, + db => $db, + privilege => $privilege, + object_type => 'DATABASE', + object_name => $db, + psql_db => $psql_db, + psql_user => $psql_user, + connect_settings => $connect_settings, + } +} diff --git a/environments/production/modules/postgresql/manifests/server/db.pp b/environments/production/modules/postgresql/manifests/server/db.pp new file mode 100644 index 0000000..b4c1232 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/db.pp @@ -0,0 +1,47 @@ +# Define for conveniently creating a role, database and assigning the correct +# permissions. See README.md for more details. +define postgresql::server::db ( + $user, + $password, + $comment = undef, + $dbname = $title, + $encoding = $postgresql::server::encoding, + $locale = $postgresql::server::locale, + $grant = 'ALL', + $tablespace = undef, + $template = 'template0', + $istemplate = false, + $owner = undef +) { + + if ! defined(Postgresql::Server::Database[$dbname]) { + postgresql::server::database { $dbname: + comment => $comment, + encoding => $encoding, + tablespace => $tablespace, + template => $template, + locale => $locale, + istemplate => $istemplate, + owner => $owner, + } + } + + if ! defined(Postgresql::Server::Role[$user]) { + postgresql::server::role { $user: + password_hash => $password, + before => Postgresql::Server::Database[$dbname], + } + } + + if ! defined(Postgresql::Server::Database_grant["GRANT ${user} - ${grant} - ${dbname}"]) { + postgresql::server::database_grant { "GRANT ${user} - ${grant} - ${dbname}": + privilege => $grant, + db => $dbname, + role => $user, + } -> Postgresql::Validate_db_connection<| database_name == $dbname |> + } + + if($tablespace != undef and defined(Postgresql::Server::Tablespace[$tablespace])) { + Postgresql::Server::Tablespace[$tablespace]->Postgresql::Server::Database[$name] + } +} diff --git a/environments/production/modules/postgresql/manifests/server/extension.pp b/environments/production/modules/postgresql/manifests/server/extension.pp new file mode 100644 index 0000000..1c9b684 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/extension.pp @@ -0,0 +1,61 @@ +# Activate an extension on a postgresql database +define postgresql::server::extension ( + $database, + $extension = $name, + $ensure = 'present', + $package_name = undef, + $package_ensure = undef, + $connect_settings = $postgresql::server::default_connect_settings, +) { + $user = $postgresql::server::user + $group = $postgresql::server::group + $psql_path = $postgresql::server::psql_path + + case $ensure { + 'present': { + $command = "CREATE EXTENSION \"${extension}\"" + $unless_comp = '=' + $package_require = [] + $package_before = Postgresql_psql["Add ${extension} extension to ${database}"] + } + + 'absent': { + $command = "DROP EXTENSION \"${extension}\"" + $unless_comp = '!=' + $package_require = Postgresql_psql["Add ${extension} extension to ${database}"] + $package_before = [] + } + + default: { + fail("Unknown value for ensure '${ensure}'.") + } + } + + + postgresql_psql {"Add ${extension} extension to ${database}": + + psql_user => $user, + psql_group => $group, + psql_path => $psql_path, + connect_settings => $connect_settings, + + db => $database, + command => $command, + unless => "SELECT t.count FROM (SELECT count(extname) FROM pg_extension WHERE extname = '${extension}') as t WHERE t.count ${unless_comp} 1", + require => Postgresql::Server::Database[$database], + } + + if $package_name { + $_package_ensure = $package_ensure ? { + undef => $ensure, + default => $package_ensure, + } + + ensure_packages($package_name, { + ensure => $_package_ensure, + tag => 'postgresql', + require => $package_require, + before => $package_before, + }) + } +} diff --git a/environments/production/modules/postgresql/manifests/server/grant.pp b/environments/production/modules/postgresql/manifests/server/grant.pp new file mode 100644 index 0000000..2836f17 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/grant.pp @@ -0,0 +1,294 @@ +# Define for granting permissions to roles. See README.md for more details. +define postgresql::server::grant ( + $role, + $db, + $privilege = undef, + $object_type = 'database', + $object_name = undef, + $psql_db = $postgresql::server::default_database, + $psql_user = $postgresql::server::user, + $port = $postgresql::server::port, + $onlyif_exists = false, + $connect_settings = $postgresql::server::default_connect_settings, +) { + $group = $postgresql::server::group + $psql_path = $postgresql::server::psql_path + + if ! $object_name { + $_object_name = $db + } else { + $_object_name = $object_name + } + + validate_bool($onlyif_exists) + # + # Port, order of precedence: $port parameter, $connect_settings[PGPORT], $postgresql::server::port + # + if $port != undef { + $port_override = $port + } elsif $connect_settings != undef and has_key( $connect_settings, 'PGPORT') { + $port_override = undef + } else { + $port_override = $postgresql::server::port + } + + ## Munge the input values + $_object_type = upcase($object_type) + $_privilege = upcase($privilege) + + ## Validate that the object type is known + validate_re($_object_type,[ + #'^COLUMN$', + '^DATABASE$', + #'^FOREIGN SERVER$', + #'^FOREIGN DATA WRAPPER$', + #'^FUNCTION$', + #'^PROCEDURAL LANGUAGE$', + '^SCHEMA$', + '^SEQUENCE$', + '^ALL SEQUENCES IN SCHEMA$', + '^TABLE$', + '^ALL TABLES IN SCHEMA$', + '^LANGUAGE$', + #'^TABLESPACE$', + #'^VIEW$', + ] + ) + # You can use ALL TABLES IN SCHEMA by passing schema_name to object_name + # You can use ALL SEQUENCES IN SCHEMA by passing schema_name to object_name + + ## Validate that the object type's privilege is acceptable + # TODO: this is a terrible hack; if they pass "ALL" as the desired privilege, + # we need a way to test for it--and has_database_privilege does not + # recognize 'ALL' as a valid privilege name. So we probably need to + # hard-code a mapping between 'ALL' and the list of actual privileges that + # it entails, and loop over them to check them. That sort of thing will + # probably need to wait until we port this over to ruby, so, for now, we're + # just going to assume that if they have "CREATE" privileges on a database, + # then they have "ALL". (I told you that it was terrible!) + case $_object_type { + 'DATABASE': { + $unless_privilege = $_privilege ? { + 'ALL' => 'CREATE', + 'ALL PRIVILEGES' => 'CREATE', + default => $_privilege, + } + validate_re($unless_privilege, [ '^$', '^CREATE$','^CONNECT$','^TEMPORARY$','^TEMP$', + '^ALL$','^ALL PRIVILEGES$' ]) + $unless_function = 'has_database_privilege' + $on_db = $psql_db + $onlyif_function = undef + } + 'SCHEMA': { + $unless_privilege = $_privilege ? { + 'ALL' => 'CREATE', + 'ALL PRIVILEGES' => 'CREATE', + default => $_privilege, + } + validate_re($_privilege, [ '^$', '^CREATE$', '^USAGE$', '^ALL$', '^ALL PRIVILEGES$' ]) + $unless_function = 'has_schema_privilege' + $on_db = $db + $onlyif_function = undef + } + 'SEQUENCE': { + $unless_privilege = $_privilege ? { + 'ALL' => 'USAGE', + default => $_privilege, + } + validate_re($unless_privilege, [ '^$', '^USAGE$', '^SELECT$', '^UPDATE$', '^ALL$', '^ALL PRIVILEGES$' ]) + $unless_function = 'has_sequence_privilege' + $on_db = $db + $onlyif_function = undef + } + 'ALL SEQUENCES IN SCHEMA': { + validate_re($_privilege, [ '^$', '^USAGE$', '^SELECT$', '^UPDATE$', '^ALL$', '^ALL PRIVILEGES$' ]) + $unless_function = 'custom' + $on_db = $db + $onlyif_function = undef + + $schema = $object_name + + $custom_privilege = $_privilege ? { + 'ALL' => 'USAGE', + 'ALL PRIVILEGES' => 'USAGE', + default => $_privilege, + } + + # This checks if there is a difference between the sequences in the + # specified schema and the sequences for which the role has the specified + # privilege. It uses the EXCEPT clause which computes the set of rows + # that are in the result of the first SELECT statement but not in the + # result of the second one. It then counts the number of rows from this + # operation. If this number is zero then the role has the specified + # privilege for all sequences in the schema and the whole query returns a + # single row, which satisfies the `unless` parameter of Postgresql_psql. + # If this number is not zero then there is at least one sequence for which + # the role does not have the specified privilege, making it necessary to + # execute the GRANT statement. + $custom_unless = "SELECT 1 FROM ( + SELECT sequence_name + FROM information_schema.sequences + WHERE sequence_schema='${schema}' + EXCEPT DISTINCT + SELECT object_name as sequence_name + FROM ( + SELECT object_schema, + object_name, + grantee, + CASE privs_split + WHEN 'r' THEN 'SELECT' + WHEN 'w' THEN 'UPDATE' + WHEN 'U' THEN 'USAGE' + END AS privilege_type + FROM ( + SELECT DISTINCT + object_schema, + object_name, + (regexp_split_to_array(regexp_replace(privs,E'/.*',''),'='))[1] AS grantee, + regexp_split_to_table((regexp_split_to_array(regexp_replace(privs,E'/.*',''),'='))[2],E'\\s*') AS privs_split + FROM ( + SELECT n.nspname as object_schema, + c.relname as object_name, + regexp_split_to_table(array_to_string(c.relacl,','),',') AS privs + FROM pg_catalog.pg_class c + LEFT JOIN pg_catalog.pg_namespace n ON c.relnamespace = n.oid + WHERE c.relkind = 'S' + AND n.nspname NOT IN ( 'pg_catalog', 'information_schema' ) + ) P1 + ) P2 + ) P3 + WHERE grantee='${role}' + AND object_schema='${schema}' + AND privilege_type='${custom_privilege}' + ) P + HAVING count(P.sequence_name) = 0" + } + 'TABLE': { + $unless_privilege = $_privilege ? { + 'ALL' => 'INSERT', + default => $_privilege, + } + validate_re($unless_privilege,[ '^$', '^SELECT$','^INSERT$','^UPDATE$','^DELETE$', + '^TRUNCATE$','^REFERENCES$','^TRIGGER$','^ALL$','^ALL PRIVILEGES$' ]) + $unless_function = 'has_table_privilege' + $on_db = $db + $onlyif_function = $onlyif_exists ? { + true => 'table_exists', + default => undef, + } + } + 'ALL TABLES IN SCHEMA': { + validate_re($_privilege, [ '^$', '^SELECT$','^INSERT$','^UPDATE$','^DELETE$', + '^TRUNCATE$','^REFERENCES$','^TRIGGER$','^ALL$','^ALL PRIVILEGES$' ]) + $unless_function = 'custom' + $on_db = $db + $onlyif_function = undef + + $schema = $object_name + + # Again there seems to be no easy way in plain SQL to check if ALL + # PRIVILEGES are granted on a table. By convention we use INSERT + # here to represent ALL PRIVILEGES (truly terrible). + $custom_privilege = $_privilege ? { + 'ALL' => 'INSERT', + 'ALL PRIVILEGES' => 'INSERT', + default => $_privilege, + } + + # This checks if there is a difference between the tables in the + # specified schema and the tables for which the role has the specified + # privilege. It uses the EXCEPT clause which computes the set of rows + # that are in the result of the first SELECT statement but not in the + # result of the second one. It then counts the number of rows from this + # operation. If this number is zero then the role has the specified + # privilege for all tables in the schema and the whole query returns a + # single row, which satisfies the `unless` parameter of Postgresql_psql. + # If this number is not zero then there is at least one table for which + # the role does not have the specified privilege, making it necessary to + # execute the GRANT statement. + $custom_unless = "SELECT 1 FROM ( + SELECT table_name + FROM information_schema.tables + WHERE table_schema='${schema}' + EXCEPT DISTINCT + SELECT table_name + FROM information_schema.role_table_grants + WHERE grantee='${role}' + AND table_schema='${schema}' + AND privilege_type='${custom_privilege}' + ) P + HAVING count(P.table_name) = 0" + } + 'LANGUAGE': { + $unless_privilege = $_privilege ? { + 'ALL' => 'USAGE', + 'ALL PRIVILEGES' => 'USAGE', + default => $_privilege, + } + validate_re($unless_privilege, [ '^$','^CREATE$','^USAGE$','^ALL$','^ALL PRIVILEGES$' ]) + $unless_function = 'has_language_privilege' + $on_db = $db + $onlyif_function = $onlyif_exists ? { + true => 'language_exists', + default => undef, + } + } + + default: { + fail("Missing privilege validation for object type ${_object_type}") + } + } + + # This is used to give grant to "schemaname"."tablename" + # If you need such grant, use: + # postgresql::grant { 'table:foo': + # role => 'joe', + # ... + # object_type => 'TABLE', + # object_name => [$schema, $table], + # } + if is_array($_object_name) { + $_togrant_object = join($_object_name, '"."') + # Never put double quotes into has_*_privilege function + $_granted_object = join($_object_name, '.') + } else { + $_granted_object = $_object_name + $_togrant_object = $_object_name + } + + $_unless = $unless_function ? { + false => undef, + 'custom' => $custom_unless, + default => "SELECT 1 WHERE ${unless_function}('${role}', + '${_granted_object}', '${unless_privilege}')", + } + + $_onlyif = $onlyif_function ? { + 'table_exists' => "SELECT true FROM pg_tables WHERE tablename = '${_togrant_object}'", + 'language_exists' => "SELECT true from pg_language WHERE lanname = '${_togrant_object}'", + default => undef, + } + + $grant_cmd = "GRANT ${_privilege} ON ${_object_type} \"${_togrant_object}\" TO + \"${role}\"" + postgresql_psql { "grant:${name}": + command => $grant_cmd, + db => $on_db, + port => $port_override, + connect_settings => $connect_settings, + psql_user => $psql_user, + psql_group => $group, + psql_path => $psql_path, + unless => $_unless, + onlyif => $_onlyif, + require => Class['postgresql::server'] + } + + if($role != undef and defined(Postgresql::Server::Role[$role])) { + Postgresql::Server::Role[$role]->Postgresql_psql["grant:${name}"] + } + + if($db != undef and defined(Postgresql::Server::Database[$db])) { + Postgresql::Server::Database[$db]->Postgresql_psql["grant:${name}"] + } +} diff --git a/environments/production/modules/postgresql/manifests/server/grant_role.pp b/environments/production/modules/postgresql/manifests/server/grant_role.pp new file mode 100644 index 0000000..04729d4 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/grant_role.pp @@ -0,0 +1,51 @@ +# Define for granting membership to a role. See README.md for more information +define postgresql::server::grant_role ( + $group, + $role = $name, + $ensure = 'present', + $psql_db = $postgresql::server::default_database, + $psql_user = $postgresql::server::user, + $port = $postgresql::server::port, + $connect_settings = $postgresql::server::default_connect_settings, +) { + validate_string($group) + validate_string($role) + if empty($group) { + fail('$group must be set') + } + if empty($role) { + fail('$role must be set') + } + case $ensure { + 'present': { + $command = "GRANT \"${group}\" TO \"${role}\"" + $unless_comp = '=' + } + 'absent': { + $command = "REVOKE \"${group}\" FROM \"${role}\"" + $unless_comp = '!=' + } + default: { + fail("Unknown value for ensure '${ensure}'.") + } + } + + postgresql_psql { "grant_role:${name}": + command => $command, + unless => "SELECT 1 WHERE EXISTS (SELECT 1 FROM pg_roles AS r_role JOIN pg_auth_members AS am ON r_role.oid = am.member JOIN pg_roles AS r_group ON r_group.oid = am.roleid WHERE r_group.rolname = '${group}' AND r_role.rolname = '${role}') ${unless_comp} true", + db => $psql_db, + psql_user => $psql_user, + port => $port, + connect_settings => $connect_settings, + } + + if ! $connect_settings or empty($connect_settings) { + Class['postgresql::server']->Postgresql_psql["grant_role:${name}"] + } + if defined(Postgresql::Server::Role[$role]) { + Postgresql::Server::Role[$role]->Postgresql_psql["grant_role:${name}"] + } + if defined(Postgresql::Server::Role[$group]) { + Postgresql::Server::Role[$group]->Postgresql_psql["grant_role:${name}"] + } +} diff --git a/environments/production/modules/postgresql/manifests/server/initdb.pp b/environments/production/modules/postgresql/manifests/server/initdb.pp new file mode 100644 index 0000000..2252a19 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/initdb.pp @@ -0,0 +1,142 @@ +# PRIVATE CLASS: do not call directly +class postgresql::server::initdb { + $needs_initdb = $postgresql::server::needs_initdb + $initdb_path = $postgresql::server::initdb_path + $datadir = $postgresql::server::datadir + $xlogdir = $postgresql::server::xlogdir + $logdir = $postgresql::server::logdir + $encoding = $postgresql::server::encoding + $locale = $postgresql::server::locale + $group = $postgresql::server::group + $user = $postgresql::server::user + $psql_path = $postgresql::server::psql_path + $port = $postgresql::server::port + $module_workdir = $postgresql::server::module_workdir + + # Set the defaults for the postgresql_psql resource + Postgresql_psql { + psql_user => $user, + psql_group => $group, + psql_path => $psql_path, + port => $port, + cwd => $module_workdir, + } + + if $::osfamily == 'RedHat' and $::selinux == true { + $seltype = 'postgresql_db_t' + $logdir_type = 'postgresql_log_t' + } + + else { + $seltype = undef + $logdir_type = undef + } + + # Make sure the data directory exists, and has the correct permissions. + file { $datadir: + ensure => directory, + owner => $user, + group => $group, + mode => '0700', + seltype => $seltype, + } + + if($xlogdir) { + # Make sure the xlog directory exists, and has the correct permissions. + file { $xlogdir: + ensure => directory, + owner => $user, + group => $group, + mode => '0700', + seltype => $seltype, + } + } + + if($logdir) { + # Make sure the log directory exists, and has the correct permissions. + file { $logdir: + ensure => directory, + owner => $user, + group => $group, + seltype => $logdir_type, + } + } + + if($needs_initdb) { + # Build up the initdb command. + # + # We optionally add the locale switch if specified. Older versions of the + # initdb command don't accept this switch. So if the user didn't pass the + # parameter, lets not pass the switch at all. + $ic_base = "${initdb_path} --encoding '${encoding}' --pgdata '${datadir}'" + $ic_xlog = $xlogdir ? { + undef => $ic_base, + default => "${ic_base} --xlogdir '${xlogdir}'" + } + + # The xlogdir need to be present before initdb runs. + # If xlogdir is default it's created by package installer + if($xlogdir) { + $require_before_initdb = [$datadir, $xlogdir] + } else { + $require_before_initdb = [$datadir] + } + + $initdb_command = $locale ? { + undef => $ic_xlog, + default => "${ic_xlog} --locale '${locale}'" + } + + # This runs the initdb command, we use the existance of the PG_VERSION + # file to ensure we don't keep running this command. + exec { 'postgresql_initdb': + command => $initdb_command, + creates => "${datadir}/PG_VERSION", + user => $user, + group => $group, + logoutput => on_failure, + require => File[$require_before_initdb], + cwd => $module_workdir, + } + # The package will take care of this for us the first time, but if we + # ever need to init a new db we need to copy these files explicitly + if $::operatingsystem == 'Debian' or $::operatingsystem == 'Ubuntu' { + if $::operatingsystemrelease =~ /^6/ or $::operatingsystemrelease =~ /^7/ or $::operatingsystemrelease =~ /^10\.04/ or $::operatingsystemrelease =~ /^12\.04/ { + file { 'server.crt': + ensure => file, + path => "${datadir}/server.crt", + source => 'file:///etc/ssl/certs/ssl-cert-snakeoil.pem', + owner => $::postgresql::server::user, + group => $::postgresql::server::group, + mode => '0644', + require => Exec['postgresql_initdb'], + } + file { 'server.key': + ensure => file, + path => "${datadir}/server.key", + source => 'file:///etc/ssl/private/ssl-cert-snakeoil.key', + owner => $::postgresql::server::user, + group => $::postgresql::server::group, + mode => '0600', + require => Exec['postgresql_initdb'], + } + } + } + } elsif $encoding != undef { + # [workaround] + # by default pg_createcluster encoding derived from locale + # but it do does not work by installing postgresql via puppet because puppet + # always override LANG to 'C' + postgresql_psql { "Set template1 encoding to ${encoding}": + command => "UPDATE pg_database + SET datistemplate = FALSE + WHERE datname = 'template1' + ; + UPDATE pg_database + SET encoding = pg_char_to_encoding('${encoding}'), datistemplate = TRUE + WHERE datname = 'template1'", + unless => "SELECT datname FROM pg_database WHERE + datname = 'template1' AND encoding = pg_char_to_encoding('${encoding}')", + } + } +} diff --git a/environments/production/modules/postgresql/manifests/server/install.pp b/environments/production/modules/postgresql/manifests/server/install.pp new file mode 100644 index 0000000..57fd0d3 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/install.pp @@ -0,0 +1,22 @@ +# PRIVATE CLASS: do not call directly +class postgresql::server::install { + $package_ensure = $postgresql::server::package_ensure + $package_name = $postgresql::server::package_name + + $_package_ensure = $package_ensure ? { + true => 'present', + false => 'purged', + 'absent' => 'purged', + default => $package_ensure, + } + + package { 'postgresql-server': + ensure => $_package_ensure, + name => $package_name, + + # This is searched for to create relationships with the package repos, be + # careful about its removal + tag => 'postgresql', + } + +} diff --git a/environments/production/modules/postgresql/manifests/server/passwd.pp b/environments/production/modules/postgresql/manifests/server/passwd.pp new file mode 100644 index 0000000..bb922ee --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/passwd.pp @@ -0,0 +1,46 @@ +# PRIVATE CLASS: do not call directly +class postgresql::server::passwd { + $postgres_password = $postgresql::server::postgres_password + $user = $postgresql::server::user + $group = $postgresql::server::group + $psql_path = $postgresql::server::psql_path + $port = $postgresql::server::port + $database = $postgresql::server::default_database + $module_workdir = $postgresql::server::module_workdir + + # psql will default to connecting as $user if you don't specify name + $_datbase_user_same = $database == $user + $_dboption = $_datbase_user_same ? { + false => " --dbname ${database}", + default => '' + } + + if ($postgres_password != undef) { + # NOTE: this password-setting logic relies on the pg_hba.conf being + # configured to allow the postgres system user to connect via psql + # without specifying a password ('ident' or 'trust' security). This is + # the default for pg_hba.conf. + $escaped = postgresql_escape($postgres_password) + exec { 'set_postgres_postgrespw': + # This command works w/no password because we run it as postgres system + # user + command => "${psql_path}${_dboption} -c \"ALTER ROLE \\\"${user}\\\" PASSWORD \${NEWPASSWD_ESCAPED}\"", + user => $user, + group => $group, + logoutput => true, + cwd => $module_workdir, + environment => [ + "PGPASSWORD=${postgres_password}", + "PGPORT=${port}", + "NEWPASSWD_ESCAPED=${escaped}", + ], + # With this command we're passing -h to force TCP authentication, which + # does require a password. We specify the password via the PGPASSWORD + # environment variable. If the password is correct (current), this + # command will exit with an exit code of 0, which will prevent the main + # command from running. + unless => "${psql_path} -h localhost -p ${port} -c 'select 1' > /dev/null", + path => '/usr/bin:/usr/local/bin:/bin', + } + } +} diff --git a/environments/production/modules/postgresql/manifests/server/pg_hba_rule.pp b/environments/production/modules/postgresql/manifests/server/pg_hba_rule.pp new file mode 100644 index 0000000..0eecdc5 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/pg_hba_rule.pp @@ -0,0 +1,64 @@ +# This resource manages an individual rule that applies to the file defined in +# $target. See README.md for more details. +define postgresql::server::pg_hba_rule( + $type, + $database, + $user, + $auth_method, + $address = undef, + $description = 'none', + $auth_option = undef, + $order = '150', + + # Needed for testing primarily, support for multiple files is not really + # working. + $target = $postgresql::server::pg_hba_conf_path, + $postgresql_version = $postgresql::server::_version +) { + + #Allow users to manage pg_hba.conf even if they are not managing the whole PostgreSQL instance + if !defined( 'postgresql::server' ) { + $manage_pg_hba_conf = true + } + else { + $manage_pg_hba_conf = $postgresql::server::manage_pg_hba_conf + } + + if $manage_pg_hba_conf == false { + fail('postgresql::server::manage_pg_hba_conf has been disabled, so this resource is now unused and redundant, either enable that option or remove this resource from your manifests') + } else { + validate_re($type, '^(local|host|hostssl|hostnossl)$', + "The type you specified [${type}] must be one of: local, host, hostssl, hostnossl") + + if($type =~ /^host/ and $address == undef) { + fail('You must specify an address property when type is host based') + } + + $allowed_auth_methods = $postgresql_version ? { + '9.6' => ['trust', 'reject', 'md5', 'password', 'gss', 'sspi', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam', 'bsd'], + '9.5' => ['trust', 'reject', 'md5', 'password', 'gss', 'sspi', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam'], + '9.4' => ['trust', 'reject', 'md5', 'password', 'gss', 'sspi', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam'], + '9.3' => ['trust', 'reject', 'md5', 'password', 'gss', 'sspi', 'krb5', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam'], + '9.2' => ['trust', 'reject', 'md5', 'password', 'gss', 'sspi', 'krb5', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam'], + '9.1' => ['trust', 'reject', 'md5', 'password', 'gss', 'sspi', 'krb5', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam'], + '9.0' => ['trust', 'reject', 'md5', 'password', 'gss', 'sspi', 'krb5', 'ident', 'ldap', 'radius', 'cert', 'pam'], + '8.4' => ['trust', 'reject', 'md5', 'password', 'gss', 'sspi', 'krb5', 'ident', 'ldap', 'cert', 'pam'], + '8.3' => ['trust', 'reject', 'md5', 'crypt', 'password', 'gss', 'sspi', 'krb5', 'ident', 'ldap', 'pam'], + '8.2' => ['trust', 'reject', 'md5', 'crypt', 'password', 'krb5', 'ident', 'ldap', 'pam'], + '8.1' => ['trust', 'reject', 'md5', 'crypt', 'password', 'krb5', 'ident', 'pam'], + default => ['trust', 'reject', 'md5', 'password', 'gss', 'sspi', 'krb5', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam', 'crypt', 'bsd'] + } + + $auth_method_regex = join(['^(', join($allowed_auth_methods, '|'), ')$'],'') + validate_re($auth_method, $auth_method_regex, + join(["The auth_method you specified [${auth_method}] must be one of: ", join($allowed_auth_methods, ', ')],'')) + + # Create a rule fragment + $fragname = "pg_hba_rule_${name}" + concat::fragment { $fragname: + target => $target, + content => template('postgresql/pg_hba_rule.conf'), + order => $order, + } + } +} diff --git a/environments/production/modules/postgresql/manifests/server/pg_ident_rule.pp b/environments/production/modules/postgresql/manifests/server/pg_ident_rule.pp new file mode 100644 index 0000000..3e9cdcd --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/pg_ident_rule.pp @@ -0,0 +1,27 @@ +# This resource manages an individual rule that applies to the file defined in +# $target. See README.md for more details. +define postgresql::server::pg_ident_rule( + $map_name, + $system_username, + $database_username, + $description = 'none', + $order = '150', + + # Needed for testing primarily, support for multiple files is not really + # working. + $target = $postgresql::server::pg_ident_conf_path +) { + + if $postgresql::server::manage_pg_ident_conf == false { + fail('postgresql::server::manage_pg_ident_conf has been disabled, so this resource is now unused and redundant, either enable that option or remove this resource from your manifests') + } else { + + # Create a rule fragment + $fragname = "pg_ident_rule_${name}" + concat::fragment { $fragname: + target => $target, + content => template('postgresql/pg_ident_rule.conf'), + order => $order, + } + } +} diff --git a/environments/production/modules/postgresql/manifests/server/plperl.pp b/environments/production/modules/postgresql/manifests/server/plperl.pp new file mode 100644 index 0000000..6ad5cf9 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/plperl.pp @@ -0,0 +1,19 @@ +# This class installs the PL/Perl procedural language for postgresql. See +# README.md for more details. +class postgresql::server::plperl( + $package_ensure = 'present', + $package_name = $postgresql::server::plperl_package_name +) { + package { 'postgresql-plperl': + ensure => $package_ensure, + name => $package_name, + tag => 'postgresql', + } + + anchor { 'postgresql::server::plperl::start': }-> + Class['postgresql::server::install']-> + Package['postgresql-plperl']-> + Class['postgresql::server::service']-> + anchor { 'postgresql::server::plperl::end': } + +} diff --git a/environments/production/modules/postgresql/manifests/server/plpython.pp b/environments/production/modules/postgresql/manifests/server/plpython.pp new file mode 100644 index 0000000..962dbad --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/plpython.pp @@ -0,0 +1,19 @@ +# This class installs the PL/Python procedural language for postgresql. See +# README.md for more details. +class postgresql::server::plpython( + $package_ensure = 'present', + $package_name = $postgresql::server::plpython_package_name, +) { + package { 'postgresql-plpython': + ensure => $package_ensure, + name => $package_name, + tag => 'postgresql', + } + + anchor { 'postgresql::server::plpython::start': }-> + Class['postgresql::server::install']-> + Package['postgresql-plpython']-> + Class['postgresql::server::service']-> + anchor { 'postgresql::server::plpython::end': } + +} diff --git a/environments/production/modules/postgresql/manifests/server/postgis.pp b/environments/production/modules/postgresql/manifests/server/postgis.pp new file mode 100644 index 0000000..ac4c641 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/postgis.pp @@ -0,0 +1,24 @@ +# Install the postgis postgresql packaging. See README.md for more details. +class postgresql::server::postgis ( + $package_name = $postgresql::params::postgis_package_name, + $package_ensure = 'present' +) inherits postgresql::params { + validate_string($package_name) + + package { 'postgresql-postgis': + ensure => $package_ensure, + name => $package_name, + tag => 'postgresql', + } + + anchor { 'postgresql::server::postgis::start': }-> + Class['postgresql::server::install']-> + Package['postgresql-postgis']-> + Class['postgresql::server::service']-> + anchor { 'postgresql::server::postgis::end': } + + if $postgresql::globals::manage_package_repo { + Class['postgresql::repo'] -> + Package['postgresql-postgis'] + } +} diff --git a/environments/production/modules/postgresql/manifests/server/recovery.pp b/environments/production/modules/postgresql/manifests/server/recovery.pp new file mode 100644 index 0000000..22645b9 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/recovery.pp @@ -0,0 +1,38 @@ +# This resource manages the parameters that applies to the recovery.conf template. See README.md for more details. +define postgresql::server::recovery( + $restore_command = undef, + $archive_cleanup_command = undef, + $recovery_end_command = undef, + $recovery_target_name = undef, + $recovery_target_time = undef, + $recovery_target_xid = undef, + $recovery_target_inclusive = undef, + $recovery_target = undef, + $recovery_target_timeline = undef, + $pause_at_recovery_target = undef, + $standby_mode = undef, + $primary_conninfo = undef, + $primary_slot_name = undef, + $trigger_file = undef, + $recovery_min_apply_delay = undef, + $target = $postgresql::server::recovery_conf_path +) { + + if $postgresql::server::manage_recovery_conf == false { + fail('postgresql::server::manage_recovery_conf has been disabled, so this resource is now unused and redundant, either enable that option or remove this resource from your manifests') + } else { + if($restore_command == undef and $archive_cleanup_command == undef and $recovery_end_command == undef + and $recovery_target_name == undef and $recovery_target_time == undef and $recovery_target_xid == undef + and $recovery_target_inclusive == undef and $recovery_target == undef and $recovery_target_timeline == undef + and $pause_at_recovery_target == undef and $standby_mode == undef and $primary_conninfo == undef + and $primary_slot_name == undef and $trigger_file == undef and $recovery_min_apply_delay == undef) { + fail('postgresql::server::recovery use this resource but do not pass a parameter will avoid creating the recovery.conf, because it makes no sense.') + } + + # Create the recovery.conf content + concat::fragment { 'recovery.conf': + target => $target, + content => template('postgresql/recovery.conf.erb'), + } + } +} diff --git a/environments/production/modules/postgresql/manifests/server/reload.pp b/environments/production/modules/postgresql/manifests/server/reload.pp new file mode 100644 index 0000000..47f2704 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/reload.pp @@ -0,0 +1,14 @@ +# PRIVATE CLASS: do not use directly +class postgresql::server::reload { + $service_name = $postgresql::server::service_name + $service_status = $postgresql::server::service_status + $service_reload = $postgresql::server::service_reload + + exec { 'postgresql_reload': + path => '/usr/bin:/usr/sbin:/bin:/sbin', + command => $service_reload, + onlyif => $service_status, + refreshonly => true, + require => Class['postgresql::server::service'], + } +} diff --git a/environments/production/modules/postgresql/manifests/server/role.pp b/environments/production/modules/postgresql/manifests/server/role.pp new file mode 100644 index 0000000..c4a8f10 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/role.pp @@ -0,0 +1,124 @@ +# Define for creating a database role. See README.md for more information +define postgresql::server::role( + $password_hash = false, + $createdb = false, + $createrole = false, + $db = $postgresql::server::default_database, + $port = undef, + $login = true, + $inherit = true, + $superuser = false, + $replication = false, + $connection_limit = '-1', + $username = $title, + $connect_settings = $postgresql::server::default_connect_settings, +) { + $psql_user = $postgresql::server::user + $psql_group = $postgresql::server::group + $psql_path = $postgresql::server::psql_path + $module_workdir = $postgresql::server::module_workdir + + # + # Port, order of precedence: $port parameter, $connect_settings[PGPORT], $postgresql::server::port + # + if $port != undef { + $port_override = $port + } elsif $connect_settings != undef and has_key( $connect_settings, 'PGPORT') { + $port_override = undef + } else { + $port_override = $postgresql::server::port + } + + # If possible use the version of the remote database, otherwise + # fallback to our local DB version + if $connect_settings != undef and has_key( $connect_settings, 'DBVERSION') { + $version = $connect_settings['DBVERSION'] + } else { + $version = $postgresql::server::_version + } + + $login_sql = $login ? { true => 'LOGIN', default => 'NOLOGIN' } + $inherit_sql = $inherit ? { true => 'INHERIT', default => 'NOINHERIT' } + $createrole_sql = $createrole ? { true => 'CREATEROLE', default => 'NOCREATEROLE' } + $createdb_sql = $createdb ? { true => 'CREATEDB', default => 'NOCREATEDB' } + $superuser_sql = $superuser ? { true => 'SUPERUSER', default => 'NOSUPERUSER' } + $replication_sql = $replication ? { true => 'REPLICATION', default => '' } + if ($password_hash != false) { + $environment = "NEWPGPASSWD=${password_hash}" + $password_sql = "ENCRYPTED PASSWORD '\$NEWPGPASSWD'" + } else { + $password_sql = '' + $environment = [] + } + + Postgresql_psql { + db => $db, + port => $port_override, + psql_user => $psql_user, + psql_group => $psql_group, + psql_path => $psql_path, + connect_settings => $connect_settings, + cwd => $module_workdir, + require => [ + Postgresql_psql["CREATE ROLE ${username} ENCRYPTED PASSWORD ****"], + Class['postgresql::server'], + ], + } + + postgresql_psql { "CREATE ROLE ${username} ENCRYPTED PASSWORD ****": + command => "CREATE ROLE \"${username}\" ${password_sql} ${login_sql} ${createrole_sql} ${createdb_sql} ${superuser_sql} ${replication_sql} CONNECTION LIMIT ${connection_limit}", + unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}'", + environment => $environment, + require => Class['Postgresql::Server'], + } + + postgresql_psql {"ALTER ROLE \"${username}\" ${superuser_sql}": + unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolsuper = ${superuser}", + } + + postgresql_psql {"ALTER ROLE \"${username}\" ${createdb_sql}": + unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolcreatedb = ${createdb}", + } + + postgresql_psql {"ALTER ROLE \"${username}\" ${createrole_sql}": + unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolcreaterole = ${createrole}", + } + + postgresql_psql {"ALTER ROLE \"${username}\" ${login_sql}": + unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolcanlogin = ${login}", + } + + postgresql_psql {"ALTER ROLE \"${username}\" ${inherit_sql}": + unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolinherit = ${inherit}", + } + + if(versioncmp($version, '9.1') >= 0) { + if $replication_sql == '' { + postgresql_psql {"ALTER ROLE \"${username}\" NOREPLICATION": + unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolreplication = ${replication}", + } + } else { + postgresql_psql {"ALTER ROLE \"${username}\" ${replication_sql}": + unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolreplication = ${replication}", + } + } + } + + postgresql_psql {"ALTER ROLE \"${username}\" CONNECTION LIMIT ${connection_limit}": + unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolconnlimit = ${connection_limit}", + } + + if $password_hash { + if($password_hash =~ /^md5.+/) { + $pwd_hash_sql = $password_hash + } else { + $pwd_md5 = md5("${password_hash}${username}") + $pwd_hash_sql = "md5${pwd_md5}" + } + postgresql_psql { "ALTER ROLE ${username} ENCRYPTED PASSWORD ****": + command => "ALTER ROLE \"${username}\" ${password_sql}", + unless => "SELECT 1 FROM pg_shadow WHERE usename = '${username}' AND passwd = '${pwd_hash_sql}'", + environment => $environment, + } + } +} diff --git a/environments/production/modules/postgresql/manifests/server/schema.pp b/environments/production/modules/postgresql/manifests/server/schema.pp new file mode 100644 index 0000000..f0e762e --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/schema.pp @@ -0,0 +1,63 @@ +# = Type: postgresql::server::schema +# +# Create a new schema. See README.md for more details. +# +# == Requires: +# +# The database must exist and the PostgreSQL user should have enough privileges +# +# == Sample Usage: +# +# postgresql::server::schema {'private': +# db => 'template1', +# } +# +define postgresql::server::schema( + $db = $postgresql::server::default_database, + $owner = undef, + $schema = $title, + $connect_settings = $postgresql::server::default_connect_settings, +) { + $user = $postgresql::server::user + $group = $postgresql::server::group + $psql_path = $postgresql::server::psql_path + $version = $postgresql::server::_version + $module_workdir = $postgresql::server::module_workdir + + Postgresql::Server::Db <| dbname == $db |> -> Postgresql::Server::Schema[$name] + + # If the connection settings do not contain a port, then use the local server port + if $connect_settings != undef and has_key( $connect_settings, 'PGPORT') { + $port = undef + } else { + $port = $postgresql::server::port + } + + Postgresql_psql { + db => $db, + psql_user => $user, + psql_group => $group, + psql_path => $psql_path, + port => $port, + cwd => $module_workdir, + connect_settings => $connect_settings, + } + + postgresql_psql { "${db}: CREATE SCHEMA \"${schema}\"": + command => "CREATE SCHEMA \"${schema}\"", + unless => "SELECT 1 FROM pg_namespace WHERE nspname = '${schema}'", + require => Class['postgresql::server'], + } + + if $owner { + postgresql_psql { "${db}: ALTER SCHEMA \"${schema}\" OWNER TO \"${owner}\"": + command => "ALTER SCHEMA \"${schema}\" OWNER TO ${owner}", + unless => "SELECT 1 FROM pg_namespace JOIN pg_roles rol ON nspowner = rol.oid WHERE nspname = '${schema}' AND rolname = '${owner}'", + require => Postgresql_psql["${db}: CREATE SCHEMA \"${schema}\""], + } + + if defined(Postgresql::Server::Role[$owner]) { + Postgresql::Server::Role[$owner]->Postgresql_psql["${db}: ALTER SCHEMA \"${schema}\" OWNER TO \"${owner}\""] + } + } +} diff --git a/environments/production/modules/postgresql/manifests/server/service.pp b/environments/production/modules/postgresql/manifests/server/service.pp new file mode 100644 index 0000000..de06818 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/service.pp @@ -0,0 +1,46 @@ +# PRIVATE CLASS: do not call directly +class postgresql::server::service { + $service_ensure = $postgresql::server::service_ensure + $service_enable = $postgresql::server::service_enable + $service_manage = $postgresql::server::service_manage + $service_name = $postgresql::server::service_name + $service_provider = $postgresql::server::service_provider + $service_status = $postgresql::server::service_status + $user = $postgresql::server::user + $port = $postgresql::server::port + $default_database = $postgresql::server::default_database + + anchor { 'postgresql::server::service::begin': } + + if $service_manage { + + service { 'postgresqld': + ensure => $service_ensure, + enable => $service_enable, + name => $service_name, + provider => $service_provider, + hasstatus => true, + status => $service_status, + } + + if $service_ensure == 'running' { + # This blocks the class before continuing if chained correctly, making + # sure the service really is 'up' before continuing. + # + # Without it, we may continue doing more work before the database is + # prepared leading to a nasty race condition. + postgresql::validate_db_connection { 'validate_service_is_running': + run_as => $user, + database_name => $default_database, + database_port => $port, + sleep => 1, + tries => 60, + create_db_first => false, + require => Service['postgresqld'], + before => Anchor['postgresql::server::service::end'] + } + } + } + + anchor { 'postgresql::server::service::end': } +} diff --git a/environments/production/modules/postgresql/manifests/server/table_grant.pp b/environments/production/modules/postgresql/manifests/server/table_grant.pp new file mode 100644 index 0000000..452f13d --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/table_grant.pp @@ -0,0 +1,26 @@ +# This resource wraps the grant resource to manage table grants specifically. +# See README.md for more details. +define postgresql::server::table_grant( + $privilege, + $table, + $db, + $role, + $port = undef, + $psql_db = undef, + $psql_user = undef, + $connect_settings = undef, + $onlyif_exists = false, +) { + postgresql::server::grant { "table:${name}": + role => $role, + db => $db, + port => $port, + privilege => $privilege, + object_type => 'TABLE', + object_name => $table, + psql_db => $psql_db, + psql_user => $psql_user, + onlyif_exists => $onlyif_exists, + connect_settings => $connect_settings, + } +} \ No newline at end of file diff --git a/environments/production/modules/postgresql/manifests/server/tablespace.pp b/environments/production/modules/postgresql/manifests/server/tablespace.pp new file mode 100644 index 0000000..cf0b65d --- /dev/null +++ b/environments/production/modules/postgresql/manifests/server/tablespace.pp @@ -0,0 +1,56 @@ +# This module creates tablespace. See README.md for more details. +define postgresql::server::tablespace( + $location, + $owner = undef, + $spcname = $title, + $connect_settings = $postgresql::server::default_connect_settings, +) { + $user = $postgresql::server::user + $group = $postgresql::server::group + $psql_path = $postgresql::server::psql_path + $module_workdir = $postgresql::server::module_workdir + + # If the connection settings do not contain a port, then use the local server port + if $connect_settings != undef and has_key( $connect_settings, 'PGPORT') { + $port = undef + } else { + $port = $postgresql::server::port + } + + Postgresql_psql { + psql_user => $user, + psql_group => $group, + psql_path => $psql_path, + port => $port, + connect_settings => $connect_settings, + cwd => $module_workdir, + } + + file { $location: + ensure => directory, + owner => $user, + group => $group, + mode => '0700', + seluser => 'system_u', + selrole => 'object_r', + seltype => 'postgresql_db_t', + require => Class['postgresql::server'], + } + + postgresql_psql { "CREATE TABLESPACE \"${spcname}\"": + command => "CREATE TABLESPACE \"${spcname}\" LOCATION '${location}'", + unless => "SELECT 1 FROM pg_tablespace WHERE spcname = '${spcname}'", + require => [Class['postgresql::server'], File[$location]], + } + + if $owner { + postgresql_psql { "ALTER TABLESPACE \"${spcname}\" OWNER TO \"${owner}\"": + unless => "SELECT 1 FROM pg_tablespace JOIN pg_roles rol ON spcowner = rol.oid WHERE spcname = '${spcname}' AND rolname = '${owner}'", + require => Postgresql_psql["CREATE TABLESPACE \"${spcname}\""], + } + + if defined(Postgresql::Server::Role[$owner]) { + Postgresql::Server::Role[$owner]->Postgresql_psql["ALTER TABLESPACE \"${spcname}\" OWNER TO \"${owner}\""] + } + } +} diff --git a/environments/production/modules/postgresql/manifests/validate_db_connection.pp b/environments/production/modules/postgresql/manifests/validate_db_connection.pp new file mode 100644 index 0000000..9c17419 --- /dev/null +++ b/environments/production/modules/postgresql/manifests/validate_db_connection.pp @@ -0,0 +1,92 @@ +# This type validates that a successful postgres connection can be established +# between the node on which this resource is run and a specified postgres +# instance (host/port/user/password/database name). +# +# See README.md for more details. +define postgresql::validate_db_connection( + $database_host = undef, + $database_name = undef, + $database_password = undef, + $database_username = undef, + $database_port = undef, + $connect_settings = undef, + $run_as = undef, + $sleep = 2, + $tries = 10, + $create_db_first = true +) { + include postgresql::client + include postgresql::params + + $psql_path = $postgresql::params::psql_path + $module_workdir = $postgresql::params::module_workdir + $validcon_script_path = $postgresql::client::validcon_script_path + + $cmd_init = "${psql_path} --tuples-only --quiet " + $cmd_host = $database_host ? { + undef => '', + default => "-h ${database_host} ", + } + $cmd_user = $database_username ? { + undef => '', + default => "-U ${database_username} ", + } + $cmd_port = $database_port ? { + undef => '', + default => "-p ${database_port} ", + } + $cmd_dbname = $database_name ? { + undef => "--dbname ${postgresql::params::default_database} ", + default => "--dbname ${database_name} ", + } + $pass_env = $database_password ? { + undef => undef, + default => "PGPASSWORD=${database_password}", + } + $cmd = join([$cmd_init, $cmd_host, $cmd_user, $cmd_port, $cmd_dbname], ' ') + $validate_cmd = "${validcon_script_path} ${sleep} ${tries} '${cmd}'" + + # This is more of a safety valve, we add a little extra to compensate for the + # time it takes to run each psql command. + $timeout = (($sleep + 2) * $tries) + + # Combine $database_password and $connect_settings into an array of environment + # variables, ensure $database_password is last, allowing it to override a password + # from the $connect_settings hash + if $connect_settings != undef { + if $pass_env != undef { + $env = concat(join_keys_to_values( $connect_settings, '='), $pass_env) + } else { + $env = join_keys_to_values( $connect_settings, '=') + } + } else { + $env = $pass_env + } + + $exec_name = "validate postgres connection for ${database_username}@${database_host}:${database_port}/${database_name}" + + exec { $exec_name: + command => "echo 'Unable to connect to defined database using: ${cmd}' && false", + unless => $validate_cmd, + cwd => $module_workdir, + environment => $env, + logoutput => 'on_failure', + user => $run_as, + path => '/bin:/usr/bin:/usr/local/bin', + timeout => $timeout, + require => Class['postgresql::client'], + } + + # This is a little bit of puppet magic. What we want to do here is make + # sure that if the validation and the database instance creation are being + # applied on the same machine, then the database resource is applied *before* + # the validation resource. Otherwise, the validation is guaranteed to fail + # on the first run. + # + # We accomplish this by using Puppet's resource collection syntax to search + # for the Database resource in our current catalog; if it exists, the + # appropriate relationship is created here. + if($create_db_first) { + Postgresql::Server::Database<|title == $database_name|> -> Exec[$exec_name] + } +} diff --git a/environments/production/modules/postgresql/metadata.json b/environments/production/modules/postgresql/metadata.json new file mode 100644 index 0000000..a3e2c69 --- /dev/null +++ b/environments/production/modules/postgresql/metadata.json @@ -0,0 +1,73 @@ +{ + "name": "puppetlabs-postgresql", + "version": "4.9.0", + "author": "Inkling/Puppet Labs", + "summary": "Offers support for basic management of PostgreSQL databases.", + "license": "Apache-2.0", + "source": "git://github.com/puppetlabs/puppetlabs-postgresql.git", + "project_page": "https://github.com/puppetlabs/puppetlabs-postgresql", + "issues_url": "https://tickets.puppetlabs.com/browse/MODULES", + "dependencies": [ + {"name":"puppetlabs/stdlib","version_requirement":"4.x"}, + {"name":"puppetlabs/apt","version_requirement":">=1.8.0 <3.0.0"}, + {"name":"puppetlabs/concat","version_requirement":">= 1.1.0 <3.0.0"} + ], + "data_provider": null, + "operatingsystem_support": [ + { + "operatingsystem": "RedHat", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "CentOS", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "OracleLinux", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "Scientific", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "6", + "7", + "8" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "10.04", + "12.04", + "14.04", + "16.04" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">= 3.0.0 < 5.0.0" + } + ] +} diff --git a/environments/production/modules/postgresql/spec/acceptance/00-utf8_encoding_spec.rb b/environments/production/modules/postgresql/spec/acceptance/00-utf8_encoding_spec.rb new file mode 100644 index 0000000..2e7770b --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/00-utf8_encoding_spec.rb @@ -0,0 +1,37 @@ +require 'spec_helper_acceptance' + +# These tests are designed to ensure that the module, when ran with defaults, +# sets up everything correctly and allows us to connect to Postgres. +describe 'postgresql::server', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do + it 'with defaults' do + pp = <<-EOS + class { 'postgresql::globals': + encoding => 'UTF8', + locale => 'en_NG', + } -> + class { 'postgresql::server': } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe port(5432) do + it { is_expected.to be_listening } + end + + it 'can connect with psql' do + psql('--command="\l" postgres', 'postgres') do |r| + expect(r.stdout).to match(/List of databases/) + end + end + + it 'must set UTF8 as template1 encoding' do + psql('--command="SELECT pg_encoding_to_char(encoding) FROM pg_database WHERE datname=\'template1\'"') do |r| + expect(r.stdout).to match(/UTF8/) + end + end +end + + + diff --git a/environments/production/modules/postgresql/spec/acceptance/alternative_port_spec.rb b/environments/production/modules/postgresql/spec/acceptance/alternative_port_spec.rb new file mode 100644 index 0000000..11094d3 --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/alternative_port_spec.rb @@ -0,0 +1,28 @@ +require 'spec_helper_acceptance' + +# These tests ensure that postgres can change itself to an alternative port +# properly. +describe 'postgresql::server', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do + it 'on an alternative port' do + pp = <<-EOS + class { 'postgresql::server': port => '55433' } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe port(55433) do + it { is_expected.to be_listening } + end + + it 'can connect with psql' do + psql('-p 55433 --command="\l" postgres', 'postgres') do |r| + expect(r.stdout).to match(/List of databases/) + end + end + +end + + + diff --git a/environments/production/modules/postgresql/spec/acceptance/db_spec.rb b/environments/production/modules/postgresql/spec/acceptance/db_spec.rb new file mode 100644 index 0000000..449c4b0 --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/db_spec.rb @@ -0,0 +1,54 @@ +require 'spec_helper_acceptance' + +describe 'postgresql::server::db', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do + it 'creates a database' do + begin + tmpdir = default.tmpdir('postgresql') + pp = <<-EOS + class { 'postgresql::server': + postgres_password => 'space password', + } + postgresql::server::tablespace { 'postgresql-test-db': + location => '#{tmpdir}', + } -> + postgresql::server::db { 'postgresql-test-db': + comment => 'testcomment', + user => 'test-user', + password => 'test1', + tablespace => 'postgresql-test-db', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + + # Verify that the postgres password works + shell("echo 'localhost:*:*:postgres:space password' > /root/.pgpass") + shell("chmod 600 /root/.pgpass") + shell("psql -U postgres -h localhost --command='\\l'") + + psql('--command="select datname from pg_database" "postgresql-test-db"') do |r| + expect(r.stdout).to match(/postgresql-test-db/) + expect(r.stderr).to eq('') + end + + psql('--command="SELECT 1 FROM pg_roles WHERE rolname=\'test-user\'"') do |r| + expect(r.stdout).to match(/\(1 row\)/) + end + + result = shell('psql --version') + version = result.stdout.match(%r{\s(\d\.\d)})[1] + if version > "8.1" + comment_information_function = "shobj_description" + else + comment_information_function = "obj_description" + end + psql("--dbname postgresql-test-db --command=\"SELECT pg_catalog.#{comment_information_function}(d.oid, 'pg_database') FROM pg_catalog.pg_database d WHERE datname = 'postgresql-test-db' AND pg_catalog.#{comment_information_function}(d.oid, 'pg_database') = 'testcomment'\"") do |r| + expect(r.stdout).to match(/\(1 row\)/) + end + ensure + psql('--command=\'drop database "postgresql-test-db" postgres\'') + psql('--command="DROP USER test"') + end + end +end diff --git a/environments/production/modules/postgresql/spec/acceptance/default_parameters_spec.rb b/environments/production/modules/postgresql/spec/acceptance/default_parameters_spec.rb new file mode 100644 index 0000000..4763482 --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/default_parameters_spec.rb @@ -0,0 +1,28 @@ +require 'spec_helper_acceptance' + +# These tests are designed to ensure that the module, when ran with defaults, +# sets up everything correctly and allows us to connect to Postgres. +describe 'postgresql::server', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do + it 'with defaults' do + pp = <<-EOS + class { 'postgresql::server': } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe port(5432) do + it { is_expected.to be_listening } + end + + it 'can connect with psql' do + psql('--command="\l" postgres', 'postgres') do |r| + expect(r.stdout).to match(/List of databases/) + end + end + +end + + + diff --git a/environments/production/modules/postgresql/spec/acceptance/nodesets/centos-7-x64.yml b/environments/production/modules/postgresql/spec/acceptance/nodesets/centos-7-x64.yml new file mode 100644 index 0000000..5eebdef --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/nodesets/centos-7-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + centos-7-x64: + roles: + - agent + - default + platform: el-7-x86_64 + hypervisor: vagrant + box: puppetlabs/centos-7.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/postgresql/spec/acceptance/nodesets/debian-8-x64.yml b/environments/production/modules/postgresql/spec/acceptance/nodesets/debian-8-x64.yml new file mode 100644 index 0000000..fef6e63 --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/nodesets/debian-8-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + debian-8-x64: + roles: + - agent + - default + platform: debian-8-amd64 + hypervisor: vagrant + box: puppetlabs/debian-8.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/postgresql/spec/acceptance/nodesets/default.yml b/environments/production/modules/postgresql/spec/acceptance/nodesets/default.yml new file mode 100644 index 0000000..dba339c --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/nodesets/default.yml @@ -0,0 +1,10 @@ +HOSTS: + ubuntu-1404-x64: + roles: + - agent + - default + platform: ubuntu-14.04-amd64 + hypervisor: vagrant + box: puppetlabs/ubuntu-14.04-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/postgresql/spec/acceptance/nodesets/docker/centos-7.yml b/environments/production/modules/postgresql/spec/acceptance/nodesets/docker/centos-7.yml new file mode 100644 index 0000000..a3333aa --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/nodesets/docker/centos-7.yml @@ -0,0 +1,12 @@ +HOSTS: + centos-7-x64: + platform: el-7-x86_64 + hypervisor: docker + image: centos:7 + docker_preserve_image: true + docker_cmd: '["/usr/sbin/init"]' + # install various tools required to get the image up to usable levels + docker_image_commands: + - 'yum install -y crontabs tar wget openssl sysvinit-tools iproute which initscripts' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/postgresql/spec/acceptance/nodesets/docker/debian-8.yml b/environments/production/modules/postgresql/spec/acceptance/nodesets/docker/debian-8.yml new file mode 100644 index 0000000..df5c319 --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/nodesets/docker/debian-8.yml @@ -0,0 +1,11 @@ +HOSTS: + debian-8-x64: + platform: debian-8-amd64 + hypervisor: docker + image: debian:8 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get update && apt-get install -y net-tools wget locales strace lsof && echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/postgresql/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/environments/production/modules/postgresql/spec/acceptance/nodesets/docker/ubuntu-14.04.yml new file mode 100644 index 0000000..b1efa58 --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/nodesets/docker/ubuntu-14.04.yml @@ -0,0 +1,12 @@ +HOSTS: + ubuntu-1404-x64: + platform: ubuntu-14.04-amd64 + hypervisor: docker + image: ubuntu:14.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + # ensure that upstart is booting correctly in the container + - 'rm /usr/sbin/policy-rc.d && rm /sbin/initctl && dpkg-divert --rename --remove /sbin/initctl && apt-get update && apt-get install -y net-tools wget && locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/postgresql/spec/acceptance/postgresql_psql_spec.rb b/environments/production/modules/postgresql/spec/acceptance/postgresql_psql_spec.rb new file mode 100644 index 0000000..34a258c --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/postgresql_psql_spec.rb @@ -0,0 +1,183 @@ +require 'spec_helper_acceptance' + +describe 'postgresql_psql', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do + + it 'should always run SQL' do + pp = <<-EOS + class { 'postgresql::server': } -> + postgresql_psql { 'foobar': + db => 'postgres', + psql_user => 'postgres', + command => 'select 1', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :expect_changes => true) + end + + it 'should run some SQL when the unless query returns no rows' do + pp = <<-EOS + class { 'postgresql::server': } -> + postgresql_psql { 'foobar': + db => 'postgres', + psql_user => 'postgres', + command => 'select 1', + unless => 'select 1 where 1=2', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :expect_changes => true) + end + + it 'should not run SQL when the unless query returns rows' do + pp = <<-EOS + class { 'postgresql::server': } -> + postgresql_psql { 'foobar': + db => 'postgres', + psql_user => 'postgres', + command => 'select * from pg_database limit 1', + unless => 'select 1 where 1=1', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + it 'should not run SQL when refreshed and the unless query returns rows' do + pp = <<-EOS + class { 'postgresql::server': } -> + notify { 'trigger': } ~> + postgresql_psql { 'foobar': + db => 'postgres', + psql_user => 'postgres', + command => 'invalid sql statement', + unless => 'select 1 where 1=1', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :expect_changes => true) + end + + context 'with refreshonly' do + it 'should not run SQL when the unless query returns no rows' do + pp = <<-EOS + class { 'postgresql::server': } -> + postgresql_psql { 'foobar': + db => 'postgres', + psql_user => 'postgres', + command => 'select 1', + unless => 'select 1 where 1=2', + refreshonly => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + it 'should run SQL when refreshed and the unless query returns no rows' do + pp = <<-EOS.unindent + class { 'postgresql::server': } -> + notify { 'trigger': } ~> + postgresql_psql { 'foobar': + db => 'postgres', + psql_user => 'postgres', + command => 'select 1', + unless => 'select 1 where 1=2', + refreshonly => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :expect_changes => true) + end + + it 'should not run SQL when refreshed and the unless query returns rows' do + pp = <<-EOS.unindent + class { 'postgresql::server': } -> + notify { 'trigger': } ~> + postgresql_psql { 'foobar': + db => 'postgres', + psql_user => 'postgres', + command => 'invalid sql query', + unless => 'select 1 where 1=1', + refreshonly => true, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :expect_changes => true) + end + end + + it 'should not run some SQL when the onlyif query returns no rows' do + pp = <<-EOS + class { 'postgresql::server': } -> + postgresql_psql { 'foobar': + db => 'postgres', + psql_user => 'postgres', + command => 'select 1', + onlyif => 'select 1 where 1=2', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + it 'should run SQL when the onlyif query returns rows' do + pp = <<-EOS + class { 'postgresql::server': } -> + postgresql_psql { 'foobar': + db => 'postgres', + psql_user => 'postgres', + command => 'select * from pg_database limit 1', + onlyif => 'select 1 where 1=1', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :expect_changes => true) + end + + context 'with secure password passing by environment' do + it 'should run SQL that contanins password passed by environment' do + select = "select \\'$PASS_TO_EMBED\\'" + pp = <<-EOS.unindent + class { 'postgresql::server': } -> + postgresql_psql { 'password embedded by environment: #{select}': + db => 'postgres', + psql_user => 'postgres', + command => '#{select}', + environment => [ + 'PASS_TO_EMBED=pa$swD', + ], + } + EOS + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :expect_changes => false) + end + it 'should run SQL that contanins password passed by environment in check' do + select = "select 1 where \\'$PASS_TO_EMBED\\'=\\'passwD\\'" + pp = <<-EOS.unindent + class { 'postgresql::server': } -> + postgresql_psql { 'password embedded by environment in check: #{select}': + db => 'postgres', + psql_user => 'postgres', + command => 'invalid sql query', + unless => '#{select}', + environment => [ + 'PASS_TO_EMBED=passwD', + ], + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :expect_changes => false) + end + end +end diff --git a/environments/production/modules/postgresql/spec/acceptance/remote_access_spec.rb b/environments/production/modules/postgresql/spec/acceptance/remote_access_spec.rb new file mode 100644 index 0000000..9dd31de --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/remote_access_spec.rb @@ -0,0 +1,72 @@ +require 'spec_helper_acceptance' + +describe 'remote-access', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do + before do + skip "These tests require the spec/acceptance/nodesets/centos-64-x64-2-hosts nodeset" + end + + describe "configuring multi-node postgresql" do + + # Get the database's IP to connect to from the database + let(:database_ip_address) do + hosts_as('database').inject({}) do |memo,host| + fact_on host, "ipaddress_eth1" + end + end + + hosts_as('database').each do |host| + it "should be able to configure a host as database on #{host}" do + pp = <<-EOS + # Stop firewall so we can easily connect + service {'iptables': + ensure => 'stopped', + } + + class { 'postgresql::server': + ip_mask_allow_all_users => '0.0.0.0/0', + listen_addresses => '*', + } + + postgresql::server::db { 'puppet': + user => 'puppet', + password => postgresql_password('puppet', 'puppet'), + } + + postgresql::server::pg_hba_rule { 'allow full yolo access password': + type => 'host', + database => 'all', + user => 'all', + address => '0.0.0.0/0', + auth_method => 'password', + order => '002', + } + EOS + apply_manifest_on(host, pp, :catch_failures => true) + end + end + + hosts_as('client').each do |host| + it "should be able to configure a host as client on #{host} and then access database" do + pp = <<-EOS + class { 'postgresql::client':} + + $connection_settings = { + 'PGUSER' => "puppet", + 'PGPASSWORD' => "puppet", + 'PGHOST' => "#{database_ip_address}", + 'PGPORT' => "5432", + 'PGDATABASE' => "puppet", + } + + postgresql_psql { 'run using connection_settings': + command => 'select 1', + psql_user => 'root', + psql_group => 'root', + connect_settings => $connection_settings, + } + EOS + apply_manifest_on(host, pp, :catch_failures => true) + end + end + end +end diff --git a/environments/production/modules/postgresql/spec/acceptance/server/config_entry_spec.rb b/environments/production/modules/postgresql/spec/acceptance/server/config_entry_spec.rb new file mode 100644 index 0000000..6e56259 --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/server/config_entry_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper_acceptance' + +describe 'postgresql::server::config_entry' do + + let(:pp_setup) { <<-EOS + class { 'postgresql::server': + postgresql_conf_path => '/tmp/postgresql.conf', + } + EOS + } + + context 'unix_socket_directories' do + let(:pp_test) { pp_setup + <<-EOS + postgresql::server::config_entry { 'unix_socket_directories': + value => '/var/socket/, /root/' + } + EOS + } + + #get postgresql version + apply_manifest("class { 'postgresql::server': }") + result = shell('psql --version') + version = result.stdout.match(%r{\s(\d\.\d)})[1] + + if version >= '9.3' + it 'is expected to run idempotently' do + apply_manifest(pp_test, :catch_failures => true) + apply_manifest(pp_test, :catch_changes => true) + end + + it 'is expected to contain directories' do + shell('cat /tmp/postgresql.conf') do |output| + expect(output.stdout).to contain("unix_socket_directories = '/var/socket/, /root/'") + end + end + end + end +end diff --git a/environments/production/modules/postgresql/spec/acceptance/server/grant_role_spec.rb b/environments/production/modules/postgresql/spec/acceptance/server/grant_role_spec.rb new file mode 100644 index 0000000..e802a41 --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/server/grant_role_spec.rb @@ -0,0 +1,230 @@ +require 'spec_helper_acceptance' + +describe 'postgresql::server::grant_role:', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do + + db = 'grant_role_test' + user = 'psql_grant_role_tester' + group = 'test_group' + password = 'psql_grant_role_pw' + + it 'should grant a role to a user' do + begin + pp = <<-EOS.unindent + $db = #{db} + $user = #{user} + $group = #{group} + $password = #{password} + + class { 'postgresql::server': } + + # Since we are not testing pg_hba or any of that, make a local user for ident auth + user { $user: + ensure => present, + } + + postgresql::server::role { $user: + password_hash => postgresql_password($user, $password), + } + + postgresql::server::database { $db: + owner => $user, + require => Postgresql::Server::Role[$user], + } + + # Create a rule for the user + postgresql::server::pg_hba_rule { "allow ${user}": + type => 'local', + database => $db, + user => $user, + auth_method => 'ident', + order => 1, + } + + # Create a role to grant to the user + postgresql::server::role { $group: + db => $db, + login => false, + require => Postgresql::Server::Database[$db], + } + + # Grant the role to the user + postgresql::server::grant_role { "grant_role ${group} to ${user}": + role => $user, + group => $group, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + + ## Check that the role was granted to the user + psql('--command="SELECT 1 WHERE pg_has_role(\'psql_grant_role_tester\', \'test_group\', \'MEMBER\') = true" grant_role_test', 'psql_grant_role_tester') do |r| + expect(r.stdout).to match(/\(1 row\)/) + expect(r.stderr).to eq('') + end + end + end + + it 'should grant a role to a superuser' do + begin + pp = <<-EOS.unindent + $db = "#{db}" + $user = "#{user}" + $group = "#{group}" + $password = #{password} + + class { 'postgresql::server': } + + # Since we are not testing pg_hba or any of that, make a local user for ident auth + user { $user: + ensure => present, + } + + postgresql::server::role { $user: + password_hash => postgresql_password($user, $password), + superuser => true, + } + + postgresql::server::database { $db: + owner => $user, + require => Postgresql::Server::Role[$user], + } + + # Create a rule for the user + postgresql::server::pg_hba_rule { "allow ${user}": + type => 'local', + database => $db, + user => $user, + auth_method => 'ident', + order => 1, + } + + # Create a role to grant to the user + postgresql::server::role { $group: + db => $db, + login => false, + require => Postgresql::Server::Database[$db], + } + + # Grant the role to the user + postgresql::server::grant_role { "grant_role ${group} to ${user}": + role => $user, + group => $group, + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + + ## Check that the role was granted to the user + psql('--command="SELECT 1 FROM pg_roles AS r_role JOIN pg_auth_members AS am ON r_role.oid = am.member JOIN pg_roles AS r_group ON r_group.oid = am.roleid WHERE r_group.rolname = \'test_group\' AND r_role.rolname = \'psql_grant_role_tester\'" grant_role_test', 'psql_grant_role_tester') do |r| + expect(r.stdout).to match(/\(1 row\)/) + expect(r.stderr).to eq('') + end + end + end + + it 'should revoke a role from a user' do + begin + pp = <<-EOS + + $db = "#{db}" + $user = "#{user}" + $group = "#{group}" + $password = #{password} + + class { 'postgresql::server': } + + # Since we are not testing pg_hba or any of that, make a local user for ident auth + user { $user: + ensure => present, + } + + postgresql::server::role { $user: + password_hash => postgresql_password($user, $password), + } + + postgresql::server::database { $db: + owner => $user, + require => Postgresql::Server::Role[$user], + } + + # Create a rule for the user + postgresql::server::pg_hba_rule { "allow ${user}": + type => 'local', + database => $db, + user => $user, + auth_method => 'ident', + order => 1, + } + + # Create a role to grant to the user + postgresql::server::role { $group: + db => $db, + login => false, + require => Postgresql::Server::Database[$db], + } + + # Grant the role to the user + postgresql::server::grant_role { "grant_role ${group} to ${user}": + role => $user, + group => $group, + } + + postgresql::server::grant_role {"revoke ${group} from ${user}": + ensure => absent, + role => $user, + group => $group, + } + EOS + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :expect_changes => true) + + psql('--command="SELECT 1 WHERE pg_has_role(\'psql_grant_role_tester\', \'test_group\', \'MEMBER\') = true" grant_role_test', 'psql_grant_role_tester') do |r| + expect(r.stdout).to match(/\(0 rows\)/) + expect(r.stderr).to eq('') + end + end + end + + it 'should not grant permission to a nonexistent user' do + begin + pp = <<-EOS + + $db = "#{db}" + $user = "#{user}" + $group = "#{group}" + $password = #{password} + + class { 'postgresql::server': } + + # Since we are not testing pg_hba or any of that, make a local user for ident auth + user { $user: + ensure => absent, + } + + postgresql::server::database { $db: + } + + # Create a role to grant to the nonexistent user + postgresql::server::role { $group: + db => $db, + login => false, + require => Postgresql::Server::Database[$db], + } + + # Grant the role to the nonexistent user + postgresql::server::grant_role { "grant_role ${group} to ${user}": + role => $user + group => $group, + } + EOS + apply_manifest(pp, :expect_failures => true) + + psql('--command="SELECT 1 WHERE pg_has_role(\'psql_grant_role_tester\', \'test_group\', \'MEMBER\') = true" grant_role_test', 'psql_grant_role_tester') do |r| + expect(r.stdout).to match(/\(0 rows\)/) + expect(r.stderr).to eq('') + end + end + end +end diff --git a/environments/production/modules/postgresql/spec/acceptance/server/grant_spec.rb b/environments/production/modules/postgresql/spec/acceptance/server/grant_spec.rb new file mode 100644 index 0000000..63f2d7e --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/server/grant_spec.rb @@ -0,0 +1,306 @@ +require 'spec_helper_acceptance' + +describe 'postgresql::server::grant:', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do + + let(:db) { 'grant_priv_test' } + let(:owner) { 'psql_grant_priv_owner' } + let(:user) { 'psql_grant_priv_tester' } + let(:password) { 'psql_grant_role_pw' } + let(:pp_install) { "class {'postgresql::server': }"} + + let(:pp_setup) { pp_setup = <<-EOS.unindent + $db = #{db} + $owner = #{owner} + $user = #{user} + $password = #{password} + + class { 'postgresql::server': } + + postgresql::server::role { $owner: + password_hash => postgresql_password($owner, $password), + } + + # Since we are not testing pg_hba or any of that, make a local user for ident auth + user { $owner: + ensure => present, + } + + postgresql::server::database { $db: + owner => $owner, + require => Postgresql::Server::Role[$owner], + } + + # Create a user to grant privileges to + postgresql::server::role { $user: + db => $db, + require => Postgresql::Server::Database[$db], + } + + # Make a local user for ident auth + user { $user: + ensure => present, + } + + # Grant them connect to the database + postgresql::server::database_grant { "allow connect for ${user}": + privilege => 'CONNECT', + db => $db, + role => $user, + } + EOS + } + + context 'LANGUAGE' do + describe 'GRANT * ON LANGUAGE' do + #testing grants on language requires a superuser + let(:superuser) { 'postgres' } + let(:pp_lang) { pp_setup + <<-EOS.unindent + + postgresql_psql { 'make sure plpgsql exists': + command => 'CREATE LANGUAGE plpgsql', + db => $db, + psql_user => '#{superuser}', + unless => "SELECT 1 from pg_language where lanname = 'plpgsql'", + require => Postgresql::Server::Database[$db], + } + + postgresql::server::grant { 'grant usage on plpgsql': + psql_user => '#{superuser}', + privilege => 'USAGE', + object_type => 'LANGUAGE', + object_name => 'plpgsql', + role => $user, + db => $db, + require => [ Postgresql_psql['make sure plpgsql exists'], + Postgresql::Server::Role[$user], ] + } + EOS + } + + it 'is expected to run idempotently' do + apply_manifest(pp_install) + + #postgres version + result = shell('psql --version') + version = result.stdout.match(%r{\s(\d\.\d)})[1] + + if version >= '8.4.0' + apply_manifest(pp_lang, :catch_failures => true) + apply_manifest(pp_lang, :catch_changes => true) + end + end + + it 'is expected to GRANT USAGE ON LANGUAGE plpgsql to ROLE' do + result = shell('psql --version') + version = result.stdout.match(%r{\s(\d\.\d)})[1] + + if version >= '8.4.0' + ## Check that the privilege was granted to the user + psql("-d #{db} --command=\"SELECT 1 WHERE has_language_privilege('#{user}', 'plpgsql', 'USAGE')\"", superuser) do |r| + expect(r.stdout).to match(/\(1 row\)/) + expect(r.stderr).to eq('') + end + end + end + + let(:pp_onlyif) { pp_setup + <<-EOS.unindent + postgresql::server::grant { 'grant usage on BSql': + psql_user => '#{superuser}', + privilege => 'USAGE', + object_type => 'LANGUAGE', + object_name => 'bsql', + role => $user, + db => $db, + onlyif_exists => true, + } + EOS + } + + #test onlyif_exists function + it 'is expected to not GRANT USAGE ON (dummy)LANGUAGE BSql to ROLE' do + apply_manifest(pp_install) + + #postgres version + result = shell('psql --version') + version = result.stdout.match(%r{\s(\d\.\d)})[1] + + if version >= '8.4.0' + apply_manifest(pp_onlyif, :catch_failures => true) + apply_manifest(pp_onlyif, :catch_changes => true) + end + end + end + end + + context 'sequence' do + it 'should grant usage on a sequence to a user' do + begin + pp = pp_setup + <<-EOS.unindent + + postgresql_psql { 'create test sequence': + command => 'CREATE SEQUENCE test_seq', + db => $db, + psql_user => $owner, + unless => "SELECT 1 FROM information_schema.sequences WHERE sequence_name = 'test_seq'", + require => Postgresql::Server::Database[$db], + } + + postgresql::server::grant { 'grant usage on test_seq': + privilege => 'USAGE', + object_type => 'SEQUENCE', + object_name => 'test_seq', + db => $db, + role => $user, + require => [ Postgresql_psql['create test sequence'], + Postgresql::Server::Role[$user], ] + } + EOS + + apply_manifest(pp_install, :catch_failures => true) + + #postgres version + result = shell('psql --version') + version = result.stdout.match(%r{\s(\d\.\d)})[1] + + if version >= '9.0' + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + + ## Check that the privilege was granted to the user + psql("-d #{db} --command=\"SELECT 1 WHERE has_sequence_privilege('#{user}', 'test_seq', 'USAGE')\"", user) do |r| + expect(r.stdout).to match(/\(1 row\)/) + expect(r.stderr).to eq('') + end + end + end + end + + it 'should grant update on a sequence to a user' do + begin + pp = pp_setup + <<-EOS.unindent + + postgresql_psql { 'create test sequence': + command => 'CREATE SEQUENCE test_seq', + db => $db, + psql_user => $owner, + unless => "SELECT 1 FROM information_schema.sequences WHERE sequence_name = 'test_seq'", + require => Postgresql::Server::Database[$db], + } + + postgresql::server::grant { 'grant update on test_seq': + privilege => 'UPDATE', + object_type => 'SEQUENCE', + object_name => 'test_seq', + db => $db, + role => $user, + require => [ Postgresql_psql['create test sequence'], + Postgresql::Server::Role[$user], ] + } + EOS + + apply_manifest(pp_install, :catch_failures => true) + + #postgres version + result = shell('psql --version') + version = result.stdout.match(%r{\s(\d\.\d)})[1] + + if version >= '9.0' + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + + ## Check that the privilege was granted to the user + psql("-d #{db} --command=\"SELECT 1 WHERE has_sequence_privilege('#{user}', 'test_seq', 'UPDATE')\"", user) do |r| + expect(r.stdout).to match(/\(1 row\)/) + expect(r.stderr).to eq('') + end + end + end + end + end + + context 'all sequences' do + it 'should grant usage on all sequences to a user' do + begin + pp = pp_setup + <<-EOS.unindent + + postgresql_psql { 'create test sequences': + command => 'CREATE SEQUENCE test_seq2; CREATE SEQUENCE test_seq3;', + db => $db, + psql_user => $owner, + unless => "SELECT 1 FROM information_schema.sequences WHERE sequence_name = 'test_seq2'", + require => Postgresql::Server::Database[$db], + } + + postgresql::server::grant { 'grant usage on all sequences': + privilege => 'USAGE', + object_type => 'ALL SEQUENCES IN SCHEMA', + object_name => 'public', + db => $db, + role => $user, + require => [ Postgresql_psql['create test sequences'], + Postgresql::Server::Role[$user], ] + } + EOS + + apply_manifest(pp_install, :catch_failures => true) + + #postgres version + result = shell('psql --version') + version = result.stdout.match(%r{\s(\d\.\d)})[1] + + if version >= '9.0' + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + + ## Check that the privileges were granted to the user, this check is not available on version < 9.0 + psql("-d #{db} --command=\"SELECT 1 WHERE has_sequence_privilege('#{user}', 'test_seq2', 'USAGE') AND has_sequence_privilege('#{user}', 'test_seq3', 'USAGE')\"", user) do |r| + expect(r.stdout).to match(/\(1 row\)/) + expect(r.stderr).to eq('') + end + end + end + end + + it 'should grant update on all sequences to a user' do + begin + pp = pp_setup + <<-EOS.unindent + + postgresql_psql { 'create test sequences': + command => 'CREATE SEQUENCE test_seq2; CREATE SEQUENCE test_seq3;', + db => $db, + psql_user => $owner, + unless => "SELECT 1 FROM information_schema.sequences WHERE sequence_name = 'test_seq2'", + require => Postgresql::Server::Database[$db], + } + + postgresql::server::grant { 'grant usage on all sequences': + privilege => 'UPDATE', + object_type => 'ALL SEQUENCES IN SCHEMA', + object_name => 'public', + db => $db, + role => $user, + require => [ Postgresql_psql['create test sequences'], + Postgresql::Server::Role[$user], ] + } + EOS + + apply_manifest(pp_install, :catch_failures => true) + + #postgres version + result = shell('psql --version') + version = result.stdout.match(%r{\s(\d\.\d)})[1] + + if version >= '9.0' + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + + ## Check that the privileges were granted to the user + psql("-d #{db} --command=\"SELECT 1 WHERE has_sequence_privilege('#{user}', 'test_seq2', 'UPDATE') AND has_sequence_privilege('#{user}', 'test_seq3', 'UPDATE')\"", user) do |r| + expect(r.stdout).to match(/\(1 row\)/) + expect(r.stderr).to eq('') + end + end + end + end + end +end diff --git a/environments/production/modules/postgresql/spec/acceptance/server/recovery_spec.rb b/environments/production/modules/postgresql/spec/acceptance/server/recovery_spec.rb new file mode 100644 index 0000000..b27a5c5 --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/server/recovery_spec.rb @@ -0,0 +1,61 @@ +require 'spec_helper_acceptance' + +describe 'postgresql::server::recovery', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do + describe 'should manage recovery' do + after(:all) do + pp = <<-EOS.unindent + file { '/tmp/recovery.conf': + ensure => absent, + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'adds conf file' do + pp = <<-EOS.unindent + class { 'postgresql::globals': + recovery_conf_path => '/tmp/recovery.conf', + manage_recovery_conf => true, + } + + class { 'postgresql::server': } + + # Create a recovery.conf file + postgresql::server::recovery { "recovery.conf": + restore_command => 'restore_command', + recovery_target_timeline => 'recovery_target_timeline', + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file('/tmp/recovery.conf') do + it { is_expected.to be_file } + it { is_expected.to contain /restore_command = 'restore_command'/ } + it { is_expected.to contain /recovery_target_timeline = 'recovery_target_timeline'/ } + end + end + + describe 'should not manage recovery' do + it 'does not add conf file' do + pp = <<-EOS.unindent + class { 'postgresql::globals': + manage_recovery_conf => false, + } + + class { 'postgresql::server': } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file('/tmp/recovery.conf') do + it { is_expected.not_to be_file } + end + end +end + diff --git a/environments/production/modules/postgresql/spec/acceptance/server/schema_spec.rb b/environments/production/modules/postgresql/spec/acceptance/server/schema_spec.rb new file mode 100644 index 0000000..065ec63 --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/server/schema_spec.rb @@ -0,0 +1,56 @@ +require 'spec_helper_acceptance' + +describe 'postgresql::server::schema:', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do + it 'should create a schema for a user' do + begin + pp = <<-EOS.unindent + $db = 'schema_test' + $user = 'psql_schema_tester' + $password = 'psql_schema_pw' + + class { 'postgresql::server': } + + # Since we are not testing pg_hba or any of that, make a local user for ident auth + user { $user: + ensure => present, + } + + postgresql::server::role { $user: + password_hash => postgresql_password($user, $password), + } + + postgresql::server::database { $db: + owner => $user, + require => Postgresql::Server::Role[$user], + } + + # Create a rule for the user + postgresql::server::pg_hba_rule { "allow ${user}": + type => 'local', + database => $db, + user => $user, + auth_method => 'ident', + order => 1, + } + + postgresql::server::schema { $user: + db => $db, + owner => $user, + require => Postgresql::Server::Database[$db], + } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + + ## Check that the user can create a table in the database + psql('--command="create table psql_schema_tester.foo (foo int)" schema_test', 'psql_schema_tester') do |r| + expect(r.stdout).to match(/CREATE TABLE/) + expect(r.stderr).to eq('') + end + ensure + psql('--command="drop table psql_schema_tester.foo" schema_test', 'psql_schema_tester') + end + end + +end diff --git a/environments/production/modules/postgresql/spec/acceptance/z_alternative_pgdata_spec.rb b/environments/production/modules/postgresql/spec/acceptance/z_alternative_pgdata_spec.rb new file mode 100644 index 0000000..9f80f96 --- /dev/null +++ b/environments/production/modules/postgresql/spec/acceptance/z_alternative_pgdata_spec.rb @@ -0,0 +1,34 @@ +require 'spec_helper_acceptance' + +# These tests ensure that postgres can change itself to an alternative pgdata +# location properly. + +# Allow postgresql to use /tmp/* as a datadir +if fact('osfamily') == 'RedHat' and fact('selinux') == 'true' + shell 'setenforce 0' +end + +describe 'postgresql::server', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do + it 'on an alternative pgdata location' do + pp = <<-EOS + #file { '/var/lib/pgsql': ensure => directory, } -> + # needs_initdb will be true by default for all OS's except Debian + # in order to change the datadir we need to tell it explicitly to call initdb + class { 'postgresql::server': datadir => '/tmp/data', needs_initdb => true } + EOS + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe file('/tmp/data') do + it { should be_directory } + end + + it 'can connect with psql' do + psql('--command="\l" postgres', 'postgres') do |r| + expect(r.stdout).to match(/List of databases/) + end + end + +end diff --git a/environments/production/modules/postgresql/spec/spec_helper.rb b/environments/production/modules/postgresql/spec/spec_helper.rb new file mode 100644 index 0000000..22d5d68 --- /dev/null +++ b/environments/production/modules/postgresql/spec/spec_helper.rb @@ -0,0 +1,8 @@ +#This file is generated by ModuleSync, do not edit. +require 'puppetlabs_spec_helper/module_spec_helper' + +# put local configuration and setup into spec_helper_local +begin + require 'spec_helper_local' +rescue LoadError +end diff --git a/environments/production/modules/postgresql/spec/spec_helper_acceptance.rb b/environments/production/modules/postgresql/spec/spec_helper_acceptance.rb new file mode 100644 index 0000000..050660d --- /dev/null +++ b/environments/production/modules/postgresql/spec/spec_helper_acceptance.rb @@ -0,0 +1,92 @@ +require 'beaker-rspec/spec_helper' +require 'beaker-rspec/helpers/serverspec' +require 'beaker/puppet_install_helper' +require 'beaker/module_install_helper' + +run_puppet_install_helper +install_ca_certs unless ENV['PUPPET_INSTALL_TYPE'] =~ /pe/i +install_module_on(hosts) +install_module_dependencies_on(hosts) + +UNSUPPORTED_PLATFORMS = ['AIX','windows','Solaris','Suse'] + +class String + # Provide ability to remove indentation from strings, for the purpose of + # left justifying heredoc blocks. + def unindent + gsub(/^#{scan(/^\s*/).min_by{|l|l.length}}/, "") + end +end + +def shellescape(str) + str = str.to_s + + # An empty argument will be skipped, so return empty quotes. + return "''" if str.empty? + + str = str.dup + + # Treat multibyte characters as is. It is caller's responsibility + # to encode the string in the right encoding for the shell + # environment. + str.gsub!(/([^A-Za-z0-9_\-.,:\/@\n])/, "\\\\\\1") + + # A LF cannot be escaped with a backslash because a backslash + LF + # combo is regarded as line continuation and simply ignored. + str.gsub!(/\n/, "'\n'") + + return str +end + +def psql(psql_cmd, user = 'postgres', exit_codes = [0,1], &block) + psql = "psql #{psql_cmd}" + shell("su #{shellescape(user)} -c #{shellescape(psql)}", :acceptable_exit_codes => exit_codes, &block) +end + +RSpec.configure do |c| + # Readable test descriptions + c.formatter = :documentation + + # Configure all nodes in nodeset + c.before :suite do + # Set up selinux if appropriate. + if fact('osfamily') == 'RedHat' && fact('selinux') == 'true' + pp = <<-EOS + if $::osfamily == 'RedHat' and $::selinux == 'true' { + $semanage_package = $::operatingsystemmajrelease ? { + '5' => 'policycoreutils', + default => 'policycoreutils-python', + } + + package { $semanage_package: ensure => installed } + exec { 'set_postgres': + command => 'semanage port -a -t postgresql_port_t -p tcp 5433', + path => '/bin:/usr/bin/:/sbin:/usr/sbin', + subscribe => Package[$semanage_package], + } + } + EOS + + apply_manifest_on(agents, pp, :catch_failures => false) + end + + # net-tools required for netstat utility being used by be_listening + if fact('osfamily') == 'RedHat' && fact('operatingsystemmajrelease') == '7' + pp = <<-EOS + package { 'net-tools': ensure => installed } + EOS + + apply_manifest_on(agents, pp, :catch_failures => false) + end + + hosts.each do |host| + on host, "/bin/touch #{host['puppetpath']}/hiera.yaml" + on host, 'chmod 755 /root' + if fact_on(host, 'osfamily') == 'Debian' + on host, "echo \"en_US ISO-8859-1\nen_NG.UTF-8 UTF-8\nen_US.UTF-8 UTF-8\n\" > /etc/locale.gen" + on host, '/usr/sbin/locale-gen' + on host, '/usr/sbin/update-locale' + end + end + end +end diff --git a/environments/production/modules/postgresql/spec/spec_helper_local.rb b/environments/production/modules/postgresql/spec/spec_helper_local.rb new file mode 100644 index 0000000..e25a51b --- /dev/null +++ b/environments/production/modules/postgresql/spec/spec_helper_local.rb @@ -0,0 +1,14 @@ +RSpec.configure do |c| + c.mock_with :rspec + + c.include PuppetlabsSpec::Files + c.after :each do + PuppetlabsSpec::Files.cleanup + end +end + +# Convenience helper for returning parameters for a type from the +# catalogue. +def param(type, title, param) + param_value(catalogue, type, title, param) +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/client_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/client_spec.rb new file mode 100644 index 0000000..3f2e58f --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/client_spec.rb @@ -0,0 +1,58 @@ +require 'spec_helper' + +describe 'postgresql::client', :type => :class do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + } + end + + describe 'with parameters' do + let :params do + { + :validcon_script_path => '/opt/bin/my-validate-con.sh', + :package_ensure => 'absent', + :package_name => 'mypackage', + :file_ensure => 'file' + } + end + + it 'should modify package' do + is_expected.to contain_package("postgresql-client").with({ + :ensure => 'absent', + :name => 'mypackage', + :tag => 'postgresql', + }) + end + + it 'should have specified validate connexion' do + should contain_file('/opt/bin/my-validate-con.sh').with({ + :ensure => 'file', + :owner => 0, + :group => 0, + :mode => '0755' + }) + end + end + + describe 'with no parameters' do + it 'should create package with postgresql tag' do + is_expected.to contain_package('postgresql-client').with({ + :tag => 'postgresql', + }) + end + end + + describe 'with client package name explicitly set undef' do + let :params do + { + :package_name => 'UNSET' + } + end + it 'should not manage postgresql-client package' do + is_expected.not_to contain_package('postgresql-client') + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/globals_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/globals_spec.rb new file mode 100644 index 0000000..ea3ff9d --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/globals_spec.rb @@ -0,0 +1,87 @@ +require 'spec_helper' + +describe 'postgresql::globals', type: :class do + context 'on a debian 6' do + let (:facts) do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :lsbdistid => 'Debian', + :lsbdistcodename => 'squeeze' + } + end + + describe 'with no parameters' do + it 'should work' do + is_expected.to contain_class('postgresql::globals') + end + end + + describe 'manage_package_repo => true' do + let(:params) do + { + manage_package_repo: true + } + end + it 'should pull in class postgresql::repo' do + is_expected.to contain_class('postgresql::repo') + end + end + end + + context 'on redhat family systems' do + let (:facts) do + { + osfamily: 'RedHat', + operatingsystem: 'RedHat', + operatingsystemrelease: '7.1' + } + end + describe 'with no parameters' do + it 'should work' do + is_expected.to contain_class('postgresql::globals') + end + end + + describe 'manage_package_repo on RHEL => true' do + let(:params) do + { + manage_package_repo: true, + repo_proxy: 'http://proxy-server:8080' + } + end + + it 'should pull in class postgresql::repo' do + is_expected.to contain_class('postgresql::repo') + end + + it do + should contain_yumrepo('yum.postgresql.org').with( + 'enabled' => '1', + 'proxy' => 'http://proxy-server:8080' + ) + end + end + + describe 'repo_baseurl on RHEL => mirror.localrepo.com' do + let(:params) do + { + manage_package_repo: true, + repo_baseurl: 'http://mirror.localrepo.com' + } + end + + it 'should pull in class postgresql::repo' do + is_expected.to contain_class('postgresql::repo') + end + + it do + should contain_yumrepo('yum.postgresql.org').with( + 'enabled' => '1', + 'baseurl' => 'http://mirror.localrepo.com' + ) + end + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/lib/devel_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/lib/devel_spec.rb new file mode 100644 index 0000000..ca0ebb3 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/lib/devel_spec.rb @@ -0,0 +1,73 @@ +require 'spec_helper' + +describe 'postgresql::lib::devel', :type => :class do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + } + end + it { is_expected.to contain_class("postgresql::lib::devel") } + + describe 'link pg_config to /usr/bin' do + it { should_not contain_file('/usr/bin/pg_config') \ + .with_ensure('link') \ + .with_target('/usr/lib/postgresql/8.4/bin/pg_config') + } + end + + describe 'disable link_pg_config' do + let(:params) {{ + :link_pg_config => false, + }} + it { should_not contain_file('/usr/bin/pg_config') } + end + + describe 'should not link pg_config on RedHat with default version' do + let(:facts) {{ + :osfamily => 'RedHat', + :operatingsystem => 'CentOS', + :operatingsystemrelease => '6.3', + :operatingsystemmajrelease => '6', + }} + it { should_not contain_file('/usr/bin/pg_config') } + end + + describe 'link pg_config on RedHat with non-default version' do + let(:facts) {{ + :osfamily => 'RedHat', + :operatingsystem => 'CentOS', + :operatingsystemrelease => '6.3', + :operatingsystemmajrelease => '6', + }} + let :pre_condition do + "class { '::postgresql::globals': version => '9.3' }" + end + + it { should contain_file('/usr/bin/pg_config') \ + .with_ensure('link') \ + .with_target('/usr/pgsql-9.3/bin/pg_config') + } + end + + describe 'on Gentoo' do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + } + end + let :params do + { + :link_pg_config => false, + } + end + + it 'should fail to compile' do + expect { + is_expected.to compile + }.to raise_error(/is not supported/) + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/lib/java_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/lib/java_spec.rb new file mode 100644 index 0000000..76dbbd9 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/lib/java_spec.rb @@ -0,0 +1,43 @@ +require 'spec_helper' + +describe 'postgresql::lib::java', :type => :class do + + describe 'on a debian based os' do + let :facts do { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + } + end + it { is_expected.to contain_package('postgresql-jdbc').with( + :name => 'libpg-java', + :ensure => 'present', + :tag => 'postgresql' + )} + end + + describe 'on a redhat based os' do + let :facts do { + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6.4', + } + end + it { is_expected.to contain_package('postgresql-jdbc').with( + :name => 'postgresql-jdbc', + :ensure => 'present', + :tag => 'postgresql' + )} + describe 'when parameters are supplied' do + let :params do + {:package_ensure => 'latest', :package_name => 'somepackage'} + end + it { is_expected.to contain_package('postgresql-jdbc').with( + :name => 'somepackage', + :ensure => 'latest', + :tag => 'postgresql' + )} + end + end + +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/lib/perl_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/lib/perl_spec.rb new file mode 100644 index 0000000..922cfa0 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/lib/perl_spec.rb @@ -0,0 +1,31 @@ +require 'spec_helper' + +describe 'postgresql::lib::perl', :type => :class do + + describe 'on a redhat based os' do + let :facts do { + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6.4', + } + end + it { is_expected.to contain_package('perl-DBD-Pg').with( + :name => 'perl-DBD-Pg', + :ensure => 'present' + )} + end + + describe 'on a debian based os' do + let :facts do { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + } + end + it { is_expected.to contain_package('perl-DBD-Pg').with( + :name => 'libdbd-pg-perl', + :ensure => 'present' + )} + end + +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/lib/pgdocs_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/lib/pgdocs_spec.rb new file mode 100644 index 0000000..a751e98 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/lib/pgdocs_spec.rb @@ -0,0 +1,29 @@ +require 'spec_helper' + +describe 'postgresql::lib::docs', :type => :class do + + describe 'on a redhat based os' do + let :facts do { + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6.4', + } + end + it { is_expected.to contain_package('postgresql-docs').with( + :name => 'postgresql-docs', + :ensure => 'present', + :tag => 'postgresql' + )} + describe 'when parameters are supplied' do + let :params do + {:package_ensure => 'latest', :package_name => 'somepackage'} + end + it { is_expected.to contain_package('postgresql-docs').with( + :name => 'somepackage', + :ensure => 'latest', + :tag => 'postgresql' + )} + end + end + +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/lib/python_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/lib/python_spec.rb new file mode 100644 index 0000000..095c2e1 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/lib/python_spec.rb @@ -0,0 +1,31 @@ +require 'spec_helper' + +describe 'postgresql::lib::python', :type => :class do + + describe 'on a redhat based os' do + let :facts do { + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6.4', + } + end + it { is_expected.to contain_package('python-psycopg2').with( + :name => 'python-psycopg2', + :ensure => 'present' + )} + end + + describe 'on a debian based os' do + let :facts do { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + } + end + it { is_expected.to contain_package('python-psycopg2').with( + :name => 'python-psycopg2', + :ensure => 'present' + )} + end + +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/params_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/params_spec.rb new file mode 100644 index 0000000..a415966 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/params_spec.rb @@ -0,0 +1,12 @@ +require 'spec_helper' + +describe 'postgresql::params', :type => :class do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + } + end + it { is_expected.to contain_class("postgresql::params") } +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/repo_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/repo_spec.rb new file mode 100644 index 0000000..a9be84e --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/repo_spec.rb @@ -0,0 +1,19 @@ +require 'spec_helper' + +describe 'postgresql::repo', :type => :class do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :lsbdistid => 'Debian', + :lsbdistcodename => 'squeeze', + } + end + + describe 'with no parameters' do + it 'should instantiate apt_postgresql_org class' do + is_expected.to contain_class('postgresql::repo::apt_postgresql_org') + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/server/config_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/server/config_spec.rb new file mode 100644 index 0000000..16e1aef --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/server/config_spec.rb @@ -0,0 +1,136 @@ +require 'spec_helper' + +describe 'postgresql::server::config', :type => :class do + let (:pre_condition) do + "include postgresql::server" + end + + describe 'on RedHat 7' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'CentOS', + :operatingsystemrelease => '7.0', + :concat_basedir => tmpfilename('server'), + :kernel => 'Linux', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => true, + } + end + it 'should have the correct systemd-override file' do + is_expected.to contain_file('systemd-override').with ({ + :ensure => 'present', + :path => '/etc/systemd/system/postgresql.service', + :owner => 'root', + :group => 'root', + }) + is_expected.to contain_file('systemd-override') \ + .with_content(/.include \/usr\/lib\/systemd\/system\/postgresql.service/) + end + + describe 'with manage_package_repo => true and a version' do + let (:pre_condition) do + <<-EOS + class { 'postgresql::globals': + manage_package_repo => true, + version => '9.4', + }-> + class { 'postgresql::server': } + EOS + end + + it 'should have the correct systemd-override file' do + is_expected.to contain_file('systemd-override').with ({ + :ensure => 'present', + :path => '/etc/systemd/system/postgresql-9.4.service', + :owner => 'root', + :group => 'root', + }) + is_expected.to contain_file('systemd-override') \ + .with_content(/.include \/usr\/lib\/systemd\/system\/postgresql-9.4.service/) + end + end + end + + describe 'on Fedora 21' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'Fedora', + :operatingsystemrelease => '21', + :concat_basedir => tmpfilename('server'), + :kernel => 'Linux', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => true, + } + end + it 'should have the correct systemd-override file' do + is_expected.to contain_file('systemd-override').with ({ + :ensure => 'present', + :path => '/etc/systemd/system/postgresql.service', + :owner => 'root', + :group => 'root', + }) + is_expected.to contain_file('systemd-override') \ + .with_content(/.include \/lib\/systemd\/system\/postgresql.service/) + end + + describe 'with manage_package_repo => true and a version' do + let (:pre_condition) do + <<-EOS + class { 'postgresql::globals': + manage_package_repo => true, + version => '9.4', + }-> + class { 'postgresql::server': } + EOS + end + + it 'should have the correct systemd-override file' do + is_expected.to contain_file('systemd-override').with ({ + :ensure => 'present', + :path => '/etc/systemd/system/postgresql-9.4.service', + :owner => 'root', + :group => 'root', + }) + is_expected.to contain_file('systemd-override') \ + .with_content(/.include \/lib\/systemd\/system\/postgresql-9.4.service/) + end + end + end + + describe 'on Gentoo' do + let (:pre_condition) do + <<-EOS + class { 'postgresql::globals': + version => '9.5', + }-> + class { 'postgresql::server': } + EOS + end + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + :operatingsystemrelease => 'unused', + :concat_basedir => tmpfilename('server'), + :kernel => 'Linux', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => false, + } + end + it 'should have the correct systemd-override file' do + is_expected.to contain_file('systemd-override').with ({ + :ensure => 'present', + :path => '/etc/systemd/system/postgresql-9.5.service', + :owner => 'root', + :group => 'root', + }) + is_expected.to contain_file('systemd-override') \ + .with_content(/.include \/usr\/lib64\/systemd\/system\/postgresql-9.5.service/) + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/server/contrib_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/server/contrib_spec.rb new file mode 100644 index 0000000..e268436 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/server/contrib_spec.rb @@ -0,0 +1,59 @@ +require 'spec_helper' + +describe 'postgresql::server::contrib', :type => :class do + let :pre_condition do + "class { 'postgresql::server': }" + end + + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('contrib'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + describe 'with parameters' do + let(:params) do + { + :package_name => 'mypackage', + :package_ensure => 'absent', + } + end + + it 'should create package with correct params' do + is_expected.to contain_package('postgresql-contrib').with({ + :ensure => 'absent', + :name => 'mypackage', + :tag => 'postgresql', + }) + end + end + + describe 'with no parameters' do + it 'should create package with postgresql tag' do + is_expected.to contain_package('postgresql-contrib').with({ + :tag => 'postgresql', + }) + end + end + + describe 'on Gentoo' do + let :facts do + { + :osfamily => 'Gentoo', + :operatingsystem => 'Gentoo', + } + end + + it 'should fail to compile' do + expect { + is_expected.to compile + }.to raise_error(/is not supported/) + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/server/initdb_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/server/initdb_spec.rb new file mode 100644 index 0000000..3482970 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/server/initdb_spec.rb @@ -0,0 +1,127 @@ +require 'spec_helper' + +describe 'postgresql::server::initdb', :type => :class do + let (:pre_condition) do + "include postgresql::server" + end + describe 'on RedHat' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'CentOS', + :operatingsystemrelease => '6.0', + :concat_basedir => tmpfilename('server'), + :kernel => 'Linux', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => true, + } + end + it { is_expected.to contain_file('/var/lib/pgsql/data').with_ensure('directory') } + end + describe 'on Amazon' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'Amazon', + :operatingsystemrelease => '1.0', + :concat_basedir => tmpfilename('server'), + :kernel => 'Linux', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => true, + } + end + it { is_expected.to contain_file('/var/lib/pgsql92/data').with_ensure('directory') } + end + + describe 'exec with module_workdir => /var/tmp' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'CentOS', + :operatingsystemrelease => '6.0', + :concat_basedir => tmpfilename('server'), + :kernel => 'Linux', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => true, + } + end + let (:pre_condition) do + <<-EOS + class { 'postgresql::globals': + module_workdir => '/var/tmp', + }-> + class { 'postgresql::server': } + EOS + end + + it 'should contain exec with specified working directory' do + is_expected.to contain_exec('postgresql_initdb').with ({ + :cwd => '/var/tmp', + }) + end + end + + describe 'exec with module_workdir => undef' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'CentOS', + :operatingsystemrelease => '6.0', + :concat_basedir => tmpfilename('server'), + :kernel => 'Linux', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => true, + } + end + let (:pre_condition) do + <<-EOS + class { 'postgresql::globals': + }-> + class { 'postgresql::server': } + EOS + end + + it 'should contain exec with default working directory' do + is_expected.to contain_exec('postgresql_initdb').with ({ + :cwd => '/tmp', + }) + end + end + + + describe 'postgresql_psql with module_workdir => /var/tmp' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'CentOS', + :operatingsystemrelease => '6.0', + :concat_basedir => tmpfilename('server'), + :kernel => 'Linux', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => true, + } + end + + let (:pre_condition) do + <<-EOS + class { 'postgresql::globals': + module_workdir => '/var/tmp', + encoding => 'test', + needs_initdb => false, + }-> + class { 'postgresql::server': } + EOS + end + it 'should contain postgresql_psql with specified working directory' do + is_expected.to contain_postgresql_psql('Set template1 encoding to test').with({ + :cwd => '/var/tmp', + }) + end + end +end + diff --git a/environments/production/modules/postgresql/spec/unit/classes/server/plperl_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/server/plperl_spec.rb new file mode 100644 index 0000000..00ddf09 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/server/plperl_spec.rb @@ -0,0 +1,47 @@ +require 'spec_helper' + +describe 'postgresql::server::plperl', :type => :class do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('plperl'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + let :pre_condition do + "class { 'postgresql::server': }" + end + + describe 'with no parameters' do + it { is_expected.to contain_class("postgresql::server::plperl") } + it 'should create package' do + is_expected.to contain_package('postgresql-plperl').with({ + :ensure => 'present', + :tag => 'postgresql', + }) + end + end + + describe 'with parameters' do + let :params do + { + :package_ensure => 'absent', + :package_name => 'mypackage', + } + end + + it { is_expected.to contain_class("postgresql::server::plperl") } + it 'should create package with correct params' do + is_expected.to contain_package('postgresql-plperl').with({ + :ensure => 'absent', + :name => 'mypackage', + :tag => 'postgresql', + }) + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/server/plpython_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/server/plpython_spec.rb new file mode 100644 index 0000000..29a1440 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/server/plpython_spec.rb @@ -0,0 +1,48 @@ +require 'spec_helper' + +describe 'postgresql::server::plpython', :type => :class do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'CentOS', + :operatingsystemrelease => '6.0', + :concat_basedir => tmpfilename('plpython'), + :kernel => 'Linux', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => true, + } + end + + let :pre_condition do + "class { 'postgresql::server': }" + end + + describe 'on RedHat with no parameters' do + it { is_expected.to contain_class("postgresql::server::plpython") } + it 'should create package' do + is_expected.to contain_package('postgresql-plpython').with({ + :ensure => 'present', + :tag => 'postgresql', + }) + end + end + + describe 'with parameters' do + let :params do + { + :package_ensure => 'absent', + :package_name => 'mypackage', + } + end + + it { is_expected.to contain_class("postgresql::server::plpython") } + it 'should create package with correct params' do + is_expected.to contain_package('postgresql-plpython').with({ + :ensure => 'absent', + :name => 'mypackage', + :tag => 'postgresql', + }) + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/server/postgis_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/server/postgis_spec.rb new file mode 100644 index 0000000..1e53c21 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/server/postgis_spec.rb @@ -0,0 +1,44 @@ +require 'spec_helper' + +describe 'postgresql::server::postgis', :type => :class do + let :pre_condition do + "class { 'postgresql::server': }" + end + + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('postgis'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + describe 'with parameters' do + let(:params) do + { + :package_name => 'mypackage', + :package_ensure => 'absent', + } + end + + it 'should create package with correct params' do + is_expected.to contain_package('postgresql-postgis').with({ + :ensure => 'absent', + :name => 'mypackage', + :tag => 'postgresql', + }) + end + end + + describe 'with no parameters' do + it 'should create package with postgresql tag' do + is_expected.to contain_package('postgresql-postgis').with({ + :tag => 'postgresql', + }) + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/classes/server_spec.rb b/environments/production/modules/postgresql/spec/unit/classes/server_spec.rb new file mode 100644 index 0000000..852b7e4 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/classes/server_spec.rb @@ -0,0 +1,160 @@ +require 'spec_helper' + +describe 'postgresql::server', :type => :class do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :lsbdistid => 'Debian', + :lsbdistcodename => 'jessie', + :operatingsystemrelease => '8.0', + :concat_basedir => tmpfilename('server'), + :kernel => 'Linux', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + describe 'with no parameters' do + it { is_expected.to contain_class("postgresql::params") } + it { is_expected.to contain_class("postgresql::server") } + it { is_expected.to contain_exec('postgresql_reload').with({ + 'command' => 'service postgresql reload', + }) + } + it 'should validate connection' do + is_expected.to contain_postgresql__validate_db_connection('validate_service_is_running') + end + end + + describe 'service_ensure => running' do + let(:params) do + { + :service_ensure => 'running', + :postgres_password => 'new-p@s$word-to-set' + } + end + it { is_expected.to contain_class("postgresql::params") } + it { is_expected.to contain_class("postgresql::server") } + it { is_expected.to contain_class("postgresql::server::passwd") } + it 'should validate connection' do + is_expected.to contain_postgresql__validate_db_connection('validate_service_is_running') + end + it 'should set postgres password' do + is_expected.to contain_exec('set_postgres_postgrespw').with({ + 'command' => '/usr/bin/psql -c "ALTER ROLE \"postgres\" PASSWORD ${NEWPASSWD_ESCAPED}"', + 'user' => 'postgres', + 'environment' => [ + "PGPASSWORD=new-p@s$word-to-set", + "PGPORT=5432", + "NEWPASSWD_ESCAPED=$$new-p@s$word-to-set$$" + ], + 'unless' => "/usr/bin/psql -h localhost -p 5432 -c 'select 1' > /dev/null", + }) + end + end + + describe 'service_ensure => stopped' do + let(:params) {{ :service_ensure => 'stopped' }} + it { is_expected.to contain_class("postgresql::params") } + it { is_expected.to contain_class("postgresql::server") } + it 'shouldnt validate connection' do + is_expected.not_to contain_postgresql__validate_db_connection('validate_service_is_running') + end + end + + describe 'service_restart_on_change => false' do + let(:params) {{ :service_restart_on_change => false }} + it { is_expected.to contain_class("postgresql::params") } + it { is_expected.to contain_class("postgresql::server") } + it { is_expected.to_not contain_Postgresql_conf('data_directory').that_notifies('Class[postgresql::server::service]') + } + it 'should validate connection' do + is_expected.to contain_postgresql__validate_db_connection('validate_service_is_running') + end + end + + describe 'service_restart_on_change => true' do + let(:params) {{ :service_restart_on_change => true }} + it { is_expected.to contain_class("postgresql::params") } + it { is_expected.to contain_class("postgresql::server") } + it { is_expected.to contain_Postgresql_conf('data_directory').that_notifies('Class[postgresql::server::service]') + } + it 'should validate connection' do + is_expected.to contain_postgresql__validate_db_connection('validate_service_is_running') + end + end + + describe 'service_reload => /bin/true' do + let(:params) {{ :service_reload => '/bin/true' }} + it { is_expected.to contain_class("postgresql::params") } + it { is_expected.to contain_class("postgresql::server") } + it { is_expected.to contain_exec('postgresql_reload').with({ + 'command' => '/bin/true', + }) + } + it 'should validate connection' do + is_expected.to contain_postgresql__validate_db_connection('validate_service_is_running') + end + end + + describe 'service_manage => true' do + let(:params) {{ :service_manage => true }} + it { is_expected.to contain_service('postgresqld') } + end + + describe 'service_manage => false' do + let(:params) {{ :service_manage => false }} + it { is_expected.not_to contain_service('postgresqld') } + it 'shouldnt validate connection' do + is_expected.not_to contain_postgresql__validate_db_connection('validate_service_is_running') + end + end + + describe 'package_ensure => absent' do + let(:params) do + { + :package_ensure => 'absent', + } + end + + it 'should remove the package' do + is_expected.to contain_package('postgresql-server').with({ + :ensure => 'purged', + }) + end + + it 'should still enable the service' do + is_expected.to contain_service('postgresqld').with({ + :ensure => 'running', + }) + end + end + + describe 'needs_initdb => true' do + let(:params) do + { + :needs_initdb => true, + } + end + + it 'should contain proper initdb exec' do + is_expected.to contain_exec('postgresql_initdb') + end + end + + describe 'postgresql_version' do + let(:pre_condition) do + <<-EOS + class { 'postgresql::globals': + manage_package_repo => true, + version => '99.5', + before => Class['postgresql::server'], + } + EOS + end + it 'contains the correct package version' do + is_expected.to contain_class('postgresql::repo').with_version('99.5') + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/config_entry_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/config_entry_spec.rb new file mode 100644 index 0000000..34f0c70 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/config_entry_spec.rb @@ -0,0 +1,136 @@ +require 'spec_helper' + +describe 'postgresql::server::config_entry', :type => :define do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6.4', + :kernel => 'Linux', + :concat_basedir => tmpfilename('contrib'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => true, + } + end + + let(:title) { 'config_entry'} + + let :target do + tmpfilename('postgresql_conf') + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + context "syntax check" do + let(:params) { { :ensure => 'present'} } + it { is_expected.to contain_postgresql__server__config_entry('config_entry') } + end + + context 'ports' do + context 'redhat 6' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '6.4', + :kernel => 'Linux', + :concat_basedir => tmpfilename('contrib'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => true, + } + end + let(:params) {{ :ensure => 'present', :name => 'port_spec', :value => '5432' }} + + it 'stops postgresql and changes the port' do + is_expected.to contain_exec('postgresql_stop_port') + is_expected.to contain_augeas('override PGPORT in /etc/sysconfig/pgsql/postgresql') + end + end + context 'redhat 7' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '7.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('contrib'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => true, + } + end + let(:params) {{ :ensure => 'present', :name => 'port_spec', :value => '5432' }} + + it 'stops postgresql and changes the port' do + is_expected.to contain_file('systemd-override') + is_expected.to contain_exec('restart-systemd') + end + end + context 'fedora 19' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'Fedora', + :operatingsystemrelease => '19', + :kernel => 'Linux', + :concat_basedir => tmpfilename('contrib'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => true, + } + end + let(:params) {{ :ensure => 'present', :name => 'port_spec', :value => '5432' }} + + it 'stops postgresql and changes the port' do + is_expected.to contain_file('systemd-override') + is_expected.to contain_exec('restart-systemd') + end + end + end + + context "data_directory" do + let(:params) {{ :ensure => 'present', :name => 'data_directory_spec', :value => '/var/pgsql' }} + + it 'stops postgresql and changes the data directory' do + is_expected.to contain_exec('postgresql_data_directory') + is_expected.to contain_augeas('override PGDATA in /etc/sysconfig/pgsql/postgresql') + end + end + + context "passes values through appropriately" do + let(:params) {{ :ensure => 'present', :name => 'check_function_bodies', :value => 'off' }} + + it 'with no quotes' do + is_expected.to contain_postgresql_conf('check_function_bodies').with({ + :name => 'check_function_bodies', + :value => 'off' }) + end + end + + context 'unix_socket_directories' do + let :facts do + { + :osfamily => 'RedHat', + :operatingsystem => 'RedHat', + :operatingsystemrelease => '7.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('contrib'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + :selinux => true, + } + end + let(:params) {{ :ensure => 'present', :name => 'unix_socket_directories', :value => '/var/pgsql, /opt/postgresql, /root/' }} + + it 'should restart the server and change unix_socket_directories to the provided list' do + is_expected.to contain_postgresql_conf('unix_socket_directories') + .with({ :name => 'unix_socket_directories', + :value => '/var/pgsql, /opt/postgresql, /root/'}) + .that_notifies('Class[postgresql::server::service]') + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/database_grant_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/database_grant_spec.rb new file mode 100644 index 0000000..19dfce9 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/database_grant_spec.rb @@ -0,0 +1,34 @@ +require 'spec_helper' + +describe 'postgresql::server::database_grant', :type => :define do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('contrib'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + let :title do + 'test' + end + + let :params do + { + :privilege => 'ALL', + :db => 'test', + :role => 'test', + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__database_grant('test') } + it { is_expected.to contain_postgresql__server__grant('database:test') } +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/database_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/database_spec.rb new file mode 100644 index 0000000..c9993f6 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/database_spec.rb @@ -0,0 +1,78 @@ +require 'spec_helper' + +describe 'postgresql::server::database', :type => :define do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('contrib'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + let :title do + 'test' + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__database('test') } + it { is_expected.to contain_postgresql_psql('CREATE DATABASE "test"') } + + context "with comment set to 'test comment'" do + let (:params) {{ :comment => 'test comment' }} + + it { is_expected.to contain_postgresql_psql("COMMENT ON DATABASE \"test\" IS 'test comment'").with_connect_settings( {} ) } + end + + context "with specific db connection settings - default port" do + let :pre_condition do + "class {'postgresql::server':}" + end + + let (:params) {{ :connect_settings => { 'PGHOST' => 'postgres-db-server', + 'DBVERSION' => '9.1', }}} + + it { is_expected.to contain_postgresql_psql('CREATE DATABASE "test"').with_connect_settings( { 'PGHOST' => 'postgres-db-server','DBVERSION' => '9.1' } ).with_port( 5432 ) } + end + + context "with specific db connection settings - including port" do + let :pre_condition do + "class {'postgresql::globals':} + + class {'postgresql::server':}" + end + + let (:params) {{ :connect_settings => { 'PGHOST' => 'postgres-db-server', + 'DBVERSION' => '9.1', + 'PGPORT' => '1234' }}} + + it { is_expected.to contain_postgresql_psql('CREATE DATABASE "test"').with_connect_settings( { 'PGHOST' => 'postgres-db-server','DBVERSION' => '9.1','PGPORT' => '1234' } ).with_port( nil ) } + + end + + context "with global db connection settings - including port" do + let :pre_condition do + "class {'postgresql::globals': + default_connect_settings => { 'PGHOST' => 'postgres-db-server', + 'DBVERSION' => '9.2', + 'PGPORT' => '1234' } + } + + class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql_psql('CREATE DATABASE "test"').with_connect_settings( { 'PGHOST' => 'postgres-db-server','DBVERSION' => '9.2','PGPORT' => '1234' } ).with_port( nil ) } + + end + + context "with different owner" do + let (:params) {{ :owner => 'test_owner' }} + + it { is_expected.to contain_postgresql_psql('ALTER DATABASE "test" OWNER TO "test_owner"') } + end +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/db_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/db_spec.rb new file mode 100644 index 0000000..78e36b0 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/db_spec.rb @@ -0,0 +1,58 @@ +require 'spec_helper' + +describe 'postgresql::server::db', :type => :define do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('contrib'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + let :title do + 'test' + end + + context 'without dbname param' do + + let :params do + { + :user => 'test', + :password => 'test', + :owner => 'tester', + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__db('test') } + it { is_expected.to contain_postgresql__server__database('test').with_owner('tester') } + it { is_expected.to contain_postgresql__server__role('test').that_comes_before('Postgresql::Server::Database[test]') } + it { is_expected.to contain_postgresql__server__database_grant('GRANT test - ALL - test') } + + end + + context 'dbname' do + + let :params do + { + :dbname => 'testtest', + :user => 'test', + :password => 'test', + :owner => 'tester', + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__database('testtest') } + end +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/extension_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/extension_spec.rb new file mode 100644 index 0000000..54386a1 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/extension_spec.rb @@ -0,0 +1,130 @@ +require 'spec_helper' + +describe 'postgresql::server::extension', :type => :define do + let :pre_condition do + "class { 'postgresql::server': } + postgresql::server::database { 'template_postgis': + template => 'template1', + }" + end + + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('postgis'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + let (:title) { 'postgis' } + let (:params) { { + :database => 'template_postgis', + } } + + context "with mandatory arguments only" do + it { + is_expected.to contain_postgresql_psql('Add postgis extension to template_postgis').with({ + :db => 'template_postgis', + :command => 'CREATE EXTENSION "postgis"', + :unless => "SELECT t.count FROM (SELECT count(extname) FROM pg_extension WHERE extname = 'postgis') as t WHERE t.count = 1", + }).that_requires('Postgresql::Server::Database[template_postgis]') + } + end + + context "when setting package name" do + let (:params) { super().merge({ + :package_name => 'postgis', + }) } + + it { + is_expected.to contain_package('postgis').with({ + :ensure => 'present', + :name => 'postgis', + }).that_comes_before('Postgresql_psql[Add postgis extension to template_postgis]') + } + end + + context "when ensuring absence" do + let (:params) { super().merge({ + :ensure => 'absent', + :package_name => 'postgis', + }) } + + it { + is_expected.to contain_postgresql_psql('Add postgis extension to template_postgis').with({ + :db => 'template_postgis', + :command => 'DROP EXTENSION "postgis"', + :unless => "SELECT t.count FROM (SELECT count(extname) FROM pg_extension WHERE extname = 'postgis') as t WHERE t.count != 1", + }).that_requires('Postgresql::Server::Database[template_postgis]') + } + + it { + is_expected.to contain_package('postgis').with({ + :ensure => 'absent', + :name => 'postgis', + }) + } + + context "when keeping package installed" do + let (:params) { super().merge({ + :package_ensure => 'present', + }) } + + it { + is_expected.to contain_postgresql_psql('Add postgis extension to template_postgis').with({ + :db => 'template_postgis', + :command => 'DROP EXTENSION "postgis"', + :unless => "SELECT t.count FROM (SELECT count(extname) FROM pg_extension WHERE extname = 'postgis') as t WHERE t.count != 1", + }).that_requires('Postgresql::Server::Database[template_postgis]') + } + + it { + is_expected.to contain_package('postgis').with({ + :ensure => 'present', + :name => 'postgis', + }).that_requires('Postgresql_psql[Add postgis extension to template_postgis]') + } + end + end +end + +describe 'postgresql::server::extension', :type => :define do + let :pre_condition do + "class { 'postgresql::server': } + postgresql::server::database { 'template_postgis2': + template => 'template1', + }" + end + + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('postgis'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + let (:title) { 'postgis_db2' } + let (:params) { { + :database => 'template_postgis2', + :extension => 'postgis', + } } + + context "with mandatory arguments only" do + it { + is_expected.to contain_postgresql_psql('Add postgis extension to template_postgis2').with({ + :db => 'template_postgis2', + :command => 'CREATE EXTENSION "postgis"', + :unless => "SELECT t.count FROM (SELECT count(extname) FROM pg_extension WHERE extname = 'postgis') as t WHERE t.count = 1", + }).that_requires('Postgresql::Server::Database[template_postgis2]') + } + end +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/grant_role_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/grant_role_spec.rb new file mode 100644 index 0000000..d93b1e4 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/grant_role_spec.rb @@ -0,0 +1,161 @@ +require 'spec_helper' + +describe 'postgresql::server::grant_role', :type => :define do + let :pre_condition do + "class { 'postgresql::server': }" + end + + let :facts do + {:osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', :concat_basedir => tmpfilename('postgis'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + let (:title) { 'test' } + + let (:params) { { + :group => 'my_group', + :role => 'my_role', + } } + + context "with mandatory arguments only" do + it { + is_expected.to contain_postgresql_psql("grant_role:#{title}").with({ + :command => "GRANT \"#{params[:group]}\" TO \"#{params[:role]}\"", + :unless => "SELECT 1 WHERE EXISTS (SELECT 1 FROM pg_roles AS r_role JOIN pg_auth_members AS am ON r_role.oid = am.member JOIN pg_roles AS r_group ON r_group.oid = am.roleid WHERE r_group.rolname = '#{params[:group]}' AND r_role.rolname = '#{params[:role]}') = true", + }).that_requires('Class[postgresql::server]') + } + end + + context "validation" do + context "group invalid type" do + let (:params) { { + :group => ['a', 'b'], + :role => 'r', + } } + + it { + expect { catalogue }.to raise_error(Puppet::Error, /is not a string/) + } + end + + context "role invalid type" do + let (:params) { { + :group => 'g', + :role => true, + } } + + it { + expect { catalogue }.to raise_error(Puppet::Error, /is not a string/) + } + end + + context "group empty" do + let (:params) { { + :group => '', + :role => 'r', + } } + + it { + expect { catalogue }.to raise_error(/\$group must be set/) + } + end + + context "role empty" do + let (:params) { { + :group => 'g', + :role => '', + } } + + it { + expect { catalogue }.to raise_error(/\$role must be set/) + } + end + end + + context "with db arguments" do + let (:params) { super().merge({ + :psql_db => 'postgres', + :psql_user => 'postgres', + :port => '5432', + }) } + + it { + is_expected.to contain_postgresql_psql("grant_role:#{title}").with({ + :command => "GRANT \"#{params[:group]}\" TO \"#{params[:role]}\"", + :unless => "SELECT 1 WHERE EXISTS (SELECT 1 FROM pg_roles AS r_role JOIN pg_auth_members AS am ON r_role.oid = am.member JOIN pg_roles AS r_group ON r_group.oid = am.roleid WHERE r_group.rolname = '#{params[:group]}' AND r_role.rolname = '#{params[:role]}') = true", + :db => params[:psql_db], + :psql_user => params[:psql_user], + :port => params[:port], + }).that_requires('Class[postgresql::server]') + } + end + + context "with ensure => absent" do + let (:params) { super().merge({ + :ensure => 'absent', + }) } + + it { + is_expected.to contain_postgresql_psql("grant_role:#{title}").with({ + :command => "REVOKE \"#{params[:group]}\" FROM \"#{params[:role]}\"", + :unless => "SELECT 1 WHERE EXISTS (SELECT 1 FROM pg_roles AS r_role JOIN pg_auth_members AS am ON r_role.oid = am.member JOIN pg_roles AS r_group ON r_group.oid = am.roleid WHERE r_group.rolname = '#{params[:group]}' AND r_role.rolname = '#{params[:role]}') != true", + }).that_requires('Class[postgresql::server]') + } + end + + context "with ensure => invalid" do + let (:params) { super().merge({ + :ensure => 'invalid', + }) } + + it { + expect { catalogue }.to raise_error(Puppet::Error, /Unknown value for ensure/) + } + end + + context "with user defined" do + let :pre_condition do + "class { 'postgresql::server': } +postgresql::server::role { '#{params[:role]}': }" + end + + it { + is_expected.to contain_postgresql_psql("grant_role:#{title}").that_requires("Postgresql::Server::Role[#{params[:role]}]") + } + it { + is_expected.not_to contain_postgresql_psql("grant_role:#{title}").that_requires("Postgresql::Server::Role[#{params[:group]}]") + } + end + + context "with group defined" do + let :pre_condition do + "class { 'postgresql::server': } +postgresql::server::role { '#{params[:group]}': }" + end + + it { + is_expected.to contain_postgresql_psql("grant_role:#{title}").that_requires("Postgresql::Server::Role[#{params[:group]}]") + } + it { + is_expected.not_to contain_postgresql_psql("grant_role:#{title}").that_requires("Postgresql::Server::Role[#{params[:role]}]") + } + end + + context "with connect_settings" do + let (:params) { super().merge({ + :connect_settings => { 'PGHOST' => 'postgres-db-server' }, + }) } + + it { + is_expected.to contain_postgresql_psql("grant_role:#{title}").with_connect_settings( { 'PGHOST' => 'postgres-db-server' } ) + } + it { + is_expected.not_to contain_postgresql_psql("grant_role:#{title}").that_requires('Class[postgresql::server]') + } + end +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/grant_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/grant_spec.rb new file mode 100644 index 0000000..fe79636 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/grant_spec.rb @@ -0,0 +1,155 @@ +require 'spec_helper' + +describe 'postgresql::server::grant', :type => :define do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('contrib'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + let :title do + 'test' + end + + context 'plain' do + let :params do + { + :db => 'test', + :role => 'test', + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__grant('test') } + end + + context 'sequence' do + let :params do + { + :db => 'test', + :role => 'test', + :privilege => 'usage', + :object_type => 'sequence', + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__grant('test') } + it { is_expected.to contain_postgresql_psql('grant:test').with( + { + 'command' => /GRANT USAGE ON SEQUENCE "test" TO\s* "test"/m, + 'unless' => /SELECT 1 WHERE has_sequence_privilege\('test',\s* 'test', 'USAGE'\)/m, + } + ) } + end + + context 'all sequences' do + let :params do + { + :db => 'test', + :role => 'test', + :privilege => 'usage', + :object_type => 'all sequences in schema', + :object_name => 'public', + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__grant('test') } + it { is_expected.to contain_postgresql_psql('grant:test').with( + { + 'command' => /GRANT USAGE ON ALL SEQUENCES IN SCHEMA "public" TO\s* "test"/m, + 'unless' => /SELECT 1 FROM \(\s*SELECT sequence_name\s* FROM information_schema\.sequences\s* WHERE sequence_schema='public'\s* EXCEPT DISTINCT\s* SELECT object_name as sequence_name\s* FROM .* WHERE .*grantee='test'\s* AND object_schema='public'\s* AND privilege_type='USAGE'\s*\) P\s* HAVING count\(P\.sequence_name\) = 0/m, + } + ) } + end + + context "with specific db connection settings - default port" do + let :params do + { + :db => 'test', + :role => 'test', + :connect_settings => { 'PGHOST' => 'postgres-db-server', + 'DBVERSION' => '9.1', }, + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__grant('test') } + it { is_expected.to contain_postgresql_psql("grant:test").with_connect_settings( { 'PGHOST' => 'postgres-db-server','DBVERSION' => '9.1' } ).with_port( 5432 ) } + end + + context "with specific db connection settings - including port" do + let :params do + { + :db => 'test', + :role => 'test', + :connect_settings => { 'PGHOST' => 'postgres-db-server', + 'DBVERSION' => '9.1', + 'PGPORT' => '1234', }, + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__grant('test') } + it { is_expected.to contain_postgresql_psql("grant:test").with_connect_settings( { 'PGHOST' => 'postgres-db-server','DBVERSION' => '9.1','PGPORT' => '1234' } ) } + end + + context "with specific db connection settings - port overriden by explicit parameter" do + let :params do + { + :db => 'test', + :role => 'test', + :connect_settings => { 'PGHOST' => 'postgres-db-server', + 'DBVERSION' => '9.1', + 'PGPORT' => '1234', }, + :port => '5678', + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__grant('test') } + it { is_expected.to contain_postgresql_psql("grant:test").with_connect_settings( { 'PGHOST' => 'postgres-db-server','DBVERSION' => '9.1','PGPORT' => '1234' } ).with_port( '5678' ) } + end + + context 'invalid objectype' do + let :params do + { + :db => 'test', + :role => 'test', + :privilege => 'usage', + :object_type => 'invalid', + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to compile.and_raise_error(/"INVALID" does not match/) } + end +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/pg_hba_rule_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/pg_hba_rule_spec.rb new file mode 100644 index 0000000..f36d27d --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/pg_hba_rule_spec.rb @@ -0,0 +1,198 @@ +require 'spec_helper' + +describe 'postgresql::server::pg_hba_rule', :type => :define do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('pg_hba'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + let :title do + 'test' + end + let :target do + tmpfilename('pg_hba_rule') + end + + context 'test template 1' do + let :pre_condition do + <<-EOS + class { 'postgresql::server': } + EOS + end + + let :params do + { + :type => 'host', + :database => 'all', + :user => 'all', + :address => '1.1.1.1/24', + :auth_method => 'md5', + :target => target, + } + end + it do + is_expected.to contain_concat__fragment('pg_hba_rule_test').with({ + :content => /host\s+all\s+all\s+1\.1\.1\.1\/24\s+md5/ + }) + end + end + + context 'test template 2' do + let :pre_condition do + <<-EOS + class { 'postgresql::server': } + EOS + end + + let :params do + { + :type => 'local', + :database => 'all', + :user => 'all', + :auth_method => 'ident', + :target => target, + } + end + it do + is_expected.to contain_concat__fragment('pg_hba_rule_test').with({ + :content => /local\s+all\s+all\s+ident/ + }) + end + end + + context 'test template 3' do + let :pre_condition do + <<-EOS + class { 'postgresql::server': } + EOS + end + + let :params do + { + :type => 'host', + :database => 'all', + :user => 'all', + :address => '0.0.0.0/0', + :auth_method => 'ldap', + :auth_option => 'foo=bar', + :target => target, + } + end + it do + is_expected.to contain_concat__fragment('pg_hba_rule_test').with({ + :content => /host\s+all\s+all\s+0\.0\.0\.0\/0\s+ldap\s+foo=bar/ + }) + end + end + + context 'validation' do + context 'validate type test 1' do + let :pre_condition do + <<-EOS + class { 'postgresql::server': } + EOS + end + + let :params do + { + :type => 'invalid', + :database => 'all', + :user => 'all', + :address => '0.0.0.0/0', + :auth_method => 'ldap', + :target => target, + } + end + it 'should fail parsing when type is not valid' do + expect { catalogue }.to raise_error(Puppet::Error, + /The type you specified \[invalid\] must be one of/) + end + end + + context 'validate auth_method' do + let :pre_condition do + <<-EOS + class { 'postgresql::server': } + EOS + end + + let :params do + { + :type => 'local', + :database => 'all', + :user => 'all', + :address => '0.0.0.0/0', + :auth_method => 'invalid', + :target => target, + } + end + + it 'should fail parsing when auth_method is not valid' do + expect { catalogue }.to raise_error(Puppet::Error, + /The auth_method you specified \[invalid\] must be one of/) + end + end + + context 'validate unsupported auth_method' do + let :pre_condition do + <<-EOS + class { 'postgresql::globals': + version => '9.0', + } + class { 'postgresql::server': } + EOS + end + + let :params do + { + :type => 'local', + :database => 'all', + :user => 'all', + :address => '0.0.0.0/0', + :auth_method => 'peer', + :target => target, + } + end + + it 'should fail parsing when auth_method is not valid' do + expect { catalogue }.to raise_error(Puppet::Error, + /The auth_method you specified \[peer\] must be one of: trust, reject, md5, password, gss, sspi, krb5, ident, ldap, radius, cert, pam/) + end + end + + context 'validate supported auth_method' do + let :pre_condition do + <<-EOS + class { 'postgresql::globals': + version => '9.2', + } + class { 'postgresql::server': } + EOS + end + + let :params do + { + :type => 'local', + :database => 'all', + :user => 'all', + :address => '0.0.0.0/0', + :auth_method => 'peer', + :target => target, + } + end + + it do + is_expected.to contain_concat__fragment('pg_hba_rule_test').with({ + :content => /local\s+all\s+all\s+0\.0\.0\.0\/0\s+peer/ + }) + end + end + + end +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/pg_ident_rule_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/pg_ident_rule_spec.rb new file mode 100644 index 0000000..71dfff8 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/pg_ident_rule_spec.rb @@ -0,0 +1,66 @@ +require 'spec_helper' + +describe 'postgresql::server::pg_ident_rule', :type => :define do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('pg_ident'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + let :title do + 'test' + end + let :target do + tmpfilename('pg_ident_rule') + end + + context 'managing pg_ident' do + let :pre_condition do + <<-EOS + class { 'postgresql::globals': + manage_pg_ident_conf => true, + } + class { 'postgresql::server': } + EOS + end + + let :params do + { + :map_name => 'thatsmymap', + :system_username => 'systemuser', + :database_username => 'dbuser', + } + end + it do + is_expected.to contain_concat__fragment('pg_ident_rule_test').with({ + :content => /thatsmymap\s+systemuser\s+dbuser/ + }) + end + end + context 'not managing pg_ident' do + let :pre_condition do + <<-EOS + class { 'postgresql::globals': + manage_pg_ident_conf => false, + } + class { 'postgresql::server': } + EOS + end + let :params do + { + :map_name => 'thatsmymap', + :system_username => 'systemuser', + :database_username => 'dbuser', + } + end + it 'should fail because $manage_pg_ident_conf is false' do + expect { catalogue }.to raise_error(Puppet::Error, + /postgresql::server::manage_pg_ident_conf has been disabled/) + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/recovery_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/recovery_spec.rb new file mode 100644 index 0000000..8c78e3e --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/recovery_spec.rb @@ -0,0 +1,113 @@ +require 'spec_helper' + +describe 'postgresql::server::recovery', :type => :define do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('recovery'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + let :title do + 'test' + end + let :target do + tmpfilename('recovery') + end + + context 'managing recovery' do + let :pre_condition do + <<-EOS + class { 'postgresql::globals': + manage_recovery_conf => true, + } + class { 'postgresql::server': } + EOS + end + + let :params do + { + :restore_command => 'restore_command', + :recovery_target_timeline => 'recovery_target_timeline', + } + end + it do + is_expected.to contain_concat__fragment('recovery.conf').with({ + :content => /restore_command = 'restore_command'[\n]+recovery_target_timeline = 'recovery_target_timeline'/ + }) + end + end + context 'not managing recovery' do + let :pre_condition do + <<-EOS + class { 'postgresql::globals': + manage_recovery_conf => false, + } + class { 'postgresql::server': } + EOS + end + let :params do + { + :restore_command => '', + } + end + it 'should fail because $manage_recovery_conf is false' do + expect { catalogue }.to raise_error(Puppet::Error, + /postgresql::server::manage_recovery_conf has been disabled/) + end + end + context 'not managing recovery, missing param' do + let :pre_condition do + <<-EOS + class { 'postgresql::globals': + manage_recovery_conf => true, + } + class { 'postgresql::server': } + EOS + end + it 'should fail because no param set' do + expect { catalogue }.to raise_error(Puppet::Error, + /postgresql::server::recovery use this resource but do not pass a parameter will avoid creating the recovery.conf, because it makes no sense./) + end + end + + context 'managing recovery with all params' do + let :pre_condition do + <<-EOS + class { 'postgresql::globals': + manage_recovery_conf => true, + } + class { 'postgresql::server': } + EOS + end + + let :params do + { + :restore_command => 'restore_command', + :archive_cleanup_command => 'archive_cleanup_command', + :recovery_end_command => 'recovery_end_command', + :recovery_target_name => 'recovery_target_name', + :recovery_target_time => 'recovery_target_time', + :recovery_target_xid => 'recovery_target_xid', + :recovery_target_inclusive => true, + :recovery_target => 'recovery_target', + :recovery_target_timeline => 'recovery_target_timeline', + :pause_at_recovery_target => true, + :standby_mode => 'on', + :primary_conninfo => 'primary_conninfo', + :primary_slot_name => 'primary_slot_name', + :trigger_file => 'trigger_file', + :recovery_min_apply_delay => 0, + } + end + it do + is_expected.to contain_concat__fragment('recovery.conf').with({ + :content => /restore_command = 'restore_command'[\n]+archive_cleanup_command = 'archive_cleanup_command'[\n]+recovery_end_command = 'recovery_end_command'[\n]+recovery_target_name = 'recovery_target_name'[\n]+recovery_target_time = 'recovery_target_time'[\n]+recovery_target_xid = 'recovery_target_xid'[\n]+recovery_target_inclusive = true[\n]+recovery_target = 'recovery_target'[\n]+recovery_target_timeline = 'recovery_target_timeline'[\n]+pause_at_recovery_target = true[\n]+standby_mode = on[\n]+primary_conninfo = 'primary_conninfo'[\n]+primary_slot_name = 'primary_slot_name'[\n]+trigger_file = 'trigger_file'[\n]+recovery_min_apply_delay = 0[\n]+/ + }) + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/role_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/role_spec.rb new file mode 100644 index 0000000..5c608cf --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/role_spec.rb @@ -0,0 +1,135 @@ +require 'spec_helper' + +describe 'postgresql::server::role', :type => :define do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('contrib'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + let :title do + 'test' + end + + let :params do + { + :password_hash => 'new-pa$s', + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__role('test') } + it 'should have create role for "test" user with password as ****' do + is_expected.to contain_postgresql_psql('CREATE ROLE test ENCRYPTED PASSWORD ****').with({ + 'command' => "CREATE ROLE \"test\" ENCRYPTED PASSWORD '$NEWPGPASSWD' LOGIN NOCREATEROLE NOCREATEDB NOSUPERUSER CONNECTION LIMIT -1", + 'environment' => "NEWPGPASSWD=new-pa$s", + 'unless' => "SELECT 1 FROM pg_roles WHERE rolname = 'test'", + 'port' => "5432", + }) + end + it 'should have alter role for "test" user with password as ****' do + is_expected.to contain_postgresql_psql('ALTER ROLE test ENCRYPTED PASSWORD ****').with({ + 'command' => "ALTER ROLE \"test\" ENCRYPTED PASSWORD '$NEWPGPASSWD'", + 'environment' => "NEWPGPASSWD=new-pa$s", + 'unless' => "SELECT 1 FROM pg_shadow WHERE usename = 'test' AND passwd = 'md5b6f7fcbbabb4befde4588a26c1cfd2fa'", + 'port' => "5432", + }) + end + + context "with specific db connection settings - default port" do + let :params do + { + :password_hash => 'new-pa$s', + :connect_settings => { 'PGHOST' => 'postgres-db-server', + 'DBVERSION' => '9.1', + 'PGUSER' => 'login-user', + 'PGPASSWORD' => 'login-pass' }, + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__role('test') } + it 'should have create role for "test" user with password as ****' do + is_expected.to contain_postgresql_psql('CREATE ROLE test ENCRYPTED PASSWORD ****').with({ + 'command' => "CREATE ROLE \"test\" ENCRYPTED PASSWORD '$NEWPGPASSWD' LOGIN NOCREATEROLE NOCREATEDB NOSUPERUSER CONNECTION LIMIT -1", + 'environment' => "NEWPGPASSWD=new-pa$s", + 'unless' => "SELECT 1 FROM pg_roles WHERE rolname = 'test'", + 'port' => "5432", + + 'connect_settings' => { 'PGHOST' => 'postgres-db-server', + 'DBVERSION' => '9.1', + 'PGUSER' => 'login-user', + 'PGPASSWORD' => 'login-pass' }, + }) + end + it 'should have alter role for "test" user with password as ****' do + is_expected.to contain_postgresql_psql('ALTER ROLE test ENCRYPTED PASSWORD ****').with({ + 'command' => "ALTER ROLE \"test\" ENCRYPTED PASSWORD '$NEWPGPASSWD'", + 'environment' => "NEWPGPASSWD=new-pa$s", + 'unless' => "SELECT 1 FROM pg_shadow WHERE usename = 'test' AND passwd = 'md5b6f7fcbbabb4befde4588a26c1cfd2fa'", + 'port' => "5432", + + 'connect_settings' => { 'PGHOST' => 'postgres-db-server', + 'DBVERSION' => '9.1', + 'PGUSER' => 'login-user', + 'PGPASSWORD' => 'login-pass' }, + }) + end + end + + context "with specific db connection settings - including port" do + let :params do + { + :password_hash => 'new-pa$s', + :connect_settings => { 'PGHOST' => 'postgres-db-server', + 'DBVERSION' => '9.1', + 'PGPORT' => '1234', + 'PGUSER' => 'login-user', + 'PGPASSWORD' => 'login-pass' }, + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__role('test') } + it 'should have create role for "test" user with password as ****' do + is_expected.to contain_postgresql_psql('CREATE ROLE test ENCRYPTED PASSWORD ****').with({ + 'command' => "CREATE ROLE \"test\" ENCRYPTED PASSWORD '$NEWPGPASSWD' LOGIN NOCREATEROLE NOCREATEDB NOSUPERUSER CONNECTION LIMIT -1", + 'environment' => "NEWPGPASSWD=new-pa$s", + 'unless' => "SELECT 1 FROM pg_roles WHERE rolname = 'test'", + 'connect_settings' => { 'PGHOST' => 'postgres-db-server', + 'DBVERSION' => '9.1', + 'PGPORT' => '1234', + 'PGUSER' => 'login-user', + 'PGPASSWORD' => 'login-pass' }, + }) + end + it 'should have alter role for "test" user with password as ****' do + is_expected.to contain_postgresql_psql('ALTER ROLE test ENCRYPTED PASSWORD ****').with({ + 'command' => "ALTER ROLE \"test\" ENCRYPTED PASSWORD '$NEWPGPASSWD'", + 'environment' => "NEWPGPASSWD=new-pa$s", + 'unless' => "SELECT 1 FROM pg_shadow WHERE usename = 'test' AND passwd = 'md5b6f7fcbbabb4befde4588a26c1cfd2fa'", + 'connect_settings' => { 'PGHOST' => 'postgres-db-server', + 'DBVERSION' => '9.1', + 'PGPORT' => '1234', + 'PGUSER' => 'login-user', + 'PGPASSWORD' => 'login-pass' }, + }) + end + end + +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/schema_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/schema_spec.rb new file mode 100644 index 0000000..c8fa3d9 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/schema_spec.rb @@ -0,0 +1,43 @@ +require 'spec_helper' + +describe 'postgresql::server::schema', :type => :define do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('schema'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + let :title do + 'test' + end + + let :params do + { + :owner => 'jane', + :db => 'janedb', + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { should contain_postgresql__server__schema('test') } + + context "with different owner" do + let :params do + { + :owner => 'nate', + :db => 'natedb', + } + end + + it { is_expected.to contain_postgresql_psql('natedb: ALTER SCHEMA "test" OWNER TO "nate"') } + end +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/table_grant_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/table_grant_spec.rb new file mode 100644 index 0000000..eac55bd --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/table_grant_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'postgresql::server::table_grant', :type => :define do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('table_grant'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + let :title do + 'test' + end + + let :params do + { + :privilege => 'ALL', + :db => 'test', + :role => 'test', + :table => 'foo', + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__table_grant('test') } + it { is_expected.to contain_postgresql__server__grant('table:test') } +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/server/tablespace_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/server/tablespace_spec.rb new file mode 100644 index 0000000..50a93e2 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/server/tablespace_spec.rb @@ -0,0 +1,42 @@ +require 'spec_helper' + +describe 'postgresql::server::tablespace', :type => :define do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + :kernel => 'Linux', + :concat_basedir => tmpfilename('tablespace'), + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + let :title do + 'test' + end + + let :params do + { + :location => '/srv/data/foo', + } + end + + let :pre_condition do + "class {'postgresql::server':}" + end + + it { is_expected.to contain_postgresql__server__tablespace('test') } + + context "with different owner" do + let :params do + { + :location => '/srv/data/foo', + :owner => 'test_owner', + } + end + + it { is_expected.to contain_postgresql_psql('ALTER TABLESPACE "test" OWNER TO "test_owner"') } + end +end diff --git a/environments/production/modules/postgresql/spec/unit/defines/validate_db_connection_spec.rb b/environments/production/modules/postgresql/spec/unit/defines/validate_db_connection_spec.rb new file mode 100644 index 0000000..c7406dc --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/defines/validate_db_connection_spec.rb @@ -0,0 +1,72 @@ +require 'spec_helper' + +describe 'postgresql::validate_db_connection', :type => :define do + let :facts do + { + :osfamily => 'Debian', + :operatingsystem => 'Debian', + :operatingsystemrelease => '6.0', + } + end + + let :title do + 'test' + end + + describe 'should work with only default parameters' do + it { is_expected.to contain_postgresql__validate_db_connection('test') } + end + + describe 'should work with all parameters' do + let :params do + { + :database_host => 'test', + :database_name => 'test', + :database_password => 'test', + :database_username => 'test', + :database_port => 5432, + :run_as => 'postgresq', + :sleep => 4, + :tries => 30, + } + end + it { is_expected.to contain_postgresql__validate_db_connection('test') } + + it 'should have proper path for validate command' do + is_expected.to contain_exec('validate postgres connection for test@test:5432/test').with({ + :unless => %r'^/usr/local/bin/validate_postgresql_connection.sh\s+\d+' + }) + end + end + + describe 'should work while specifying validate_connection in postgresql::client' do + + let :params do + { + :database_host => 'test', + :database_name => 'test', + :database_password => 'test', + :database_username => 'test', + :database_port => 5432 + } + end + + let :pre_condition do + <<-EOS + class { 'postgresql::globals': + module_workdir => '/var/tmp', + } -> + class { 'postgresql::client': validcon_script_path => '/opt/something/validate.sh' } + EOS + end + + it 'should have proper path for validate command and correct cwd' do + is_expected.to contain_exec('validate postgres connection for test@test:5432/test').with({ + :unless => %r'^/opt/something/validate.sh\s+\d+', + :cwd => '/var/tmp', + }) + end + + end + +end diff --git a/environments/production/modules/postgresql/spec/unit/functions/postgresql_acls_to_resources_hash_spec.rb b/environments/production/modules/postgresql/spec/unit/functions/postgresql_acls_to_resources_hash_spec.rb new file mode 100644 index 0000000..e21b521 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/functions/postgresql_acls_to_resources_hash_spec.rb @@ -0,0 +1,137 @@ +require 'spec_helper' + +describe 'postgresql_acls_to_resources_hash', :type => :puppet_function do + context 'individual transform tests' do + it do + input = 'local all postgres ident' + result = { + "postgresql class generated rule test 0"=>{ + "type"=>"local", + "database"=>"all", + "user"=>"postgres", + "auth_method"=>"ident", + "order"=>"100", + }, + } + + is_expected.to run.with_params([input], 'test', 100).and_return(result) + end + + it do + input = 'local all root ident' + result = { + "postgresql class generated rule test 0"=>{ + "type"=>"local", + "database"=>"all", + "user"=>"root", + "auth_method"=>"ident", + "order"=>"100", + }, + } + + is_expected.to run.with_params([input], 'test', 100).and_return(result) + end + + it do + input_array = [ + 'local all all ident', + ] + result = { + "postgresql class generated rule test 0"=>{ + "type"=>"local", + "database"=>"all", + "user"=>"all", + "auth_method"=>"ident", + "order"=>"100", + }, + } + + is_expected.to run.with_params(input_array, 'test', 100).and_return(result) + end + + it do + input = 'host all all 127.0.0.1/32 md5' + result = { + "postgresql class generated rule test 0"=>{ + "type"=>"host", + "database"=>"all", + "user"=>"all", + "address"=>"127.0.0.1/32", + "auth_method"=>"md5", + "order"=>"100", + }, + } + + is_expected.to run.with_params([input], 'test', 100).and_return(result) + end + + it do + input = 'host all all 0.0.0.0/0 md5' + result = { + "postgresql class generated rule test 0"=>{ + "type"=>"host", + "database"=>"all", + "user"=>"all", + "address"=>"0.0.0.0/0", + "auth_method"=>"md5", + "order"=>"100", + }, + } + + is_expected.to run.with_params([input], 'test', 100).and_return(result) + end + + it do + input = 'host all all ::1/128 md5' + result = { + "postgresql class generated rule test 0"=>{ + "type"=>"host", + "database"=>"all", + "user"=>"all", + "address"=>"::1/128", + "auth_method"=>"md5", + "order"=>"100", + }, + } + + is_expected.to run.with_params([input], 'test', 100).and_return(result) + end + + it do + input = 'host all all 1.1.1.1 255.255.255.0 md5' + result = { + "postgresql class generated rule test 0"=>{ + "type"=>"host", + "database"=>"all", + "user"=>"all", + "address"=>"1.1.1.1 255.255.255.0", + "auth_method"=>"md5", + "order"=>"100", + }, + } + + is_expected.to run.with_params([input], 'test', 100).and_return(result) + end + + it do + input = 'host all all 1.1.1.1 255.255.255.0 ldap ldapserver=ldap.example.net ldapprefix="cn=" ldapsuffix=", dc=example, dc=net"' + result = { + "postgresql class generated rule test 0"=>{ + "type"=>"host", + "database"=>"all", + "user"=>"all", + "address"=>"1.1.1.1 255.255.255.0", + "auth_method"=>"ldap", + "auth_option"=>"ldapserver=ldap.example.net ldapprefix=\"cn=\" ldapsuffix=\", dc=example, dc=net\"", + "order"=>"100", + }, + } + + is_expected.to run.with_params([input], 'test', 100).and_return(result) + end + end + + it 'should return an empty hash when input is empty array' do + is_expected.to run.with_params([], 'test', 100).and_return({}) + end +end diff --git a/environments/production/modules/postgresql/spec/unit/functions/postgresql_escape_spec.rb b/environments/production/modules/postgresql/spec/unit/functions/postgresql_escape_spec.rb new file mode 100644 index 0000000..b4c9488 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/functions/postgresql_escape_spec.rb @@ -0,0 +1,14 @@ +require 'spec_helper' + +describe 'postgresql_escape', :type => :puppet_function do + it { is_expected.to run.with_params('foo'). + and_return('$$foo$$') } +end +describe 'postgresql_escape', :type => :puppet_function do + it { is_expected.to run.with_params('fo$$o'). + and_return('$ed$fo$$o$ed$') } +end +describe 'postgresql_escape', :type => :puppet_function do + it { is_expected.to run.with_params('foo$'). + and_return('$a$foo$$a$') } +end diff --git a/environments/production/modules/postgresql/spec/unit/functions/postgresql_password_spec.rb b/environments/production/modules/postgresql/spec/unit/functions/postgresql_password_spec.rb new file mode 100644 index 0000000..89699f6 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/functions/postgresql_password_spec.rb @@ -0,0 +1,8 @@ +require 'spec_helper' + +describe 'postgresql_password', :type => :puppet_function do + it { is_expected.to run.with_params('foo', 'bar'). + and_return('md596948aad3fcae80c08a35c9b5958cd89') } + it { is_expected.to run.with_params('foo', 1234). + and_return('md539a0e1b308278a8de5e007cd1f795920') } +end diff --git a/environments/production/modules/postgresql/spec/unit/provider/postgresql_conf/parsed_spec.rb b/environments/production/modules/postgresql/spec/unit/provider/postgresql_conf/parsed_spec.rb new file mode 100644 index 0000000..5055043 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/provider/postgresql_conf/parsed_spec.rb @@ -0,0 +1,147 @@ +require 'spec_helper' +require "tempfile" + +provider_class = Puppet::Type.type(:postgresql_conf).provider(:parsed) + +describe provider_class do + let(:title) { 'postgresql_conf' } + let(:provider) { + conf_class = Puppet::Type.type(:postgresql_conf) + provider = conf_class.provider(:parsed) + conffile = tmpfilename('postgresql.conf') + provider.any_instance.stub(:target).and_return conffile + provider + } + + before do + end + + after :each do + provider.initvars + end + + describe "simple configuration that should be allowed" do + it "should parse a simple ini line" do + expect(provider.parse_line("listen_addreses = '*'")).to eq( + { :name=>"listen_addreses", :value=>"*", :comment=>nil, :record_type=>:parsed } + ) + end + + it "should parse a simple ini line (2)" do + expect(provider.parse_line(" listen_addreses = '*'")).to eq( + { :name=>"listen_addreses", :value=>"*", :comment=>nil, :record_type=>:parsed } + ) + end + + it "should parse a simple ini line (3)" do + expect(provider.parse_line("listen_addreses = '*' # dont mind me")).to eq( + { :name=>"listen_addreses", :value=>"*", :comment=>"dont mind me", :record_type=>:parsed } + ) + end + + it "should parse a comment" do + expect(provider.parse_line("# dont mind me")).to eq( + { :line=>"# dont mind me", :record_type=>:comment } + ) + end + + it "should parse a comment (2)" do + expect(provider.parse_line(" \t# dont mind me")).to eq( + { :line=>" \t# dont mind me", :record_type=>:comment } + ) + end + + it "should allow includes" do + expect(provider.parse_line("include puppetextra")).to eq( + { :name=>"include", :value=>"puppetextra", :comment=>nil, :record_type=>:parsed } + ) + end + + it "should allow numbers through without quotes" do + expect(provider.parse_line("wal_keep_segments = 32")).to eq( + { :name=>"wal_keep_segments", :value=>"32", :comment=>nil, :record_type=>:parsed } + ) + end + + it "should allow blanks through " do + expect(provider.parse_line("")).to eq( + { :line=>"", :record_type=>:blank } + ) + end + + it "should parse keys with dots " do + expect(provider.parse_line("auto_explain.log_min_duration = 1ms")).to eq( + { :name => "auto_explain.log_min_duration", :value => "1ms", :comment => nil, :record_type => :parsed } + ) + end + end + + describe "configuration that should be set" do + it "should set comment lines" do + expect(provider.to_line({ :line=>"# dont mind me", :record_type=>:comment })).to eq( + '# dont mind me' + ) + end + + it "should set blank lines" do + expect(provider.to_line({ :line=>"", :record_type=>:blank })).to eq( + '' + ) + end + + it "should set simple configuration" do + expect(provider.to_line({:name=>"listen_addresses", :value=>"*", :comment=>nil, :record_type=>:parsed })).to eq( + "listen_addresses = '*'" + ) + end + + it "should set simple configuration with period in name" do + expect(provider.to_line({:name => "auto_explain.log_min_duration", :value => '100ms', :comment => nil, :record_type => :parsed })).to eq( + "auto_explain.log_min_duration = 100ms" + ) + end + + it "should set simple configuration even with comments" do + expect(provider.to_line({:name=>"listen_addresses", :value=>"*", :comment=>'dont mind me', :record_type=>:parsed })).to eq( + "listen_addresses = '*' # dont mind me" + ) + end + + it 'should quote includes' do + expect(provider.to_line( {:name=>"include", :value=>"puppetextra", :comment=>nil, :record_type=>:parsed })).to eq( + "include 'puppetextra'" + ) + end + + it 'should quote multiple words' do + expect(provider.to_line( {:name=>"archive_command", :value=>"rsync up", :comment=>nil, :record_type=>:parsed })).to eq( + "archive_command = 'rsync up'" + ) + end + + it 'shouldn\'t quote numbers' do + expect(provider.to_line( {:name=>"wal_segments", :value=>"32", :comment=>nil, :record_type=>:parsed })).to eq( + "wal_segments = 32" + ) + end + + it "should allow numbers" do + expect(provider.to_line( {:name=>"integer", :value=>42, :comment=>nil, :record_type=>:parsed })).to eq( + "integer = 42" + ) + end + + it "should allow floats" do + expect(provider.to_line( {:name=>"float", :value=>2.71828182845, :comment=>nil, :record_type=>:parsed })).to eq( + "float = 2.71828182845" + ) + end + + it "quotes addresses" do + expect(provider.to_line( {:name=>"listen_addresses", :value=>"0.0.0.0", :comment=>nil, :record_type=>:parsed })).to eq( + "listen_addresses = '0.0.0.0'" + ) + end + end +end + diff --git a/environments/production/modules/postgresql/spec/unit/puppet/provider/postgresql_psql/ruby_spec.rb b/environments/production/modules/postgresql/spec/unit/puppet/provider/postgresql_psql/ruby_spec.rb new file mode 100644 index 0000000..b75bd98 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/puppet/provider/postgresql_psql/ruby_spec.rb @@ -0,0 +1,104 @@ +require 'spec_helper' + +describe Puppet::Type.type(:postgresql_psql).provider(:ruby) do + let(:name) { 'rspec psql test' } + let(:resource) do + Puppet::Type.type(:postgresql_psql).new({ :name => name, :provider => :ruby }.merge attributes) + end + + let(:provider) { resource.provider } + + context("#run_sql_command") do + describe "with default attributes" do + let(:attributes) do { :db => 'spec_db' } end + + it "executes with the given psql_path on the given DB" do + expect(provider).to receive(:run_command).with(['psql', '-d', + attributes[:db], '-t', '-c', '"SELECT \'something\' as \"Custom column\""'], 'postgres', + 'postgres', {}) + + provider.run_sql_command('SELECT \'something\' as "Custom column"') + end + end + describe "with psql_path and db" do + let(:attributes) do { + :psql_path => '/opt/postgres/psql', + :psql_user => 'spec_user', + :psql_group => 'spec_group', + :cwd => '/spec', + :db => 'spec_db' + } end + + it "executes with the given psql_path on the given DB" do + expect(Dir).to receive(:chdir).with(attributes[:cwd]).and_yield + expect(provider).to receive(:run_command).with([attributes[:psql_path], + '-d', attributes[:db], '-t', '-c', '"SELECT \'something\' as \"Custom column\""'], + attributes[:psql_user], attributes[:psql_group], {}) + + provider.run_sql_command('SELECT \'something\' as "Custom column"') + end + end + describe "with search_path string" do + let(:attributes) do { + :search_path => "schema1" + } end + + it "executes with the given search_path" do + expect(provider).to receive(:run_command).with(['psql', '-t', '-c', + '"set search_path to schema1; SELECT \'something\' as \"Custom column\""'], + 'postgres', 'postgres', {}) + + provider.run_sql_command('SELECT \'something\' as "Custom column"') + end + end + describe "with search_path array" do + let(:attributes) do { + :search_path => ['schema1','schema2'], + } end + + it "executes with the given search_path" do + expect(provider).to receive(:run_command).with(['psql', '-t', '-c', + '"set search_path to schema1,schema2; SELECT \'something\' as \"Custom column\""'], + 'postgres', + 'postgres', + {} + ) + + provider.run_sql_command('SELECT \'something\' as "Custom column"') + end + end + end + describe "with port string" do + let(:attributes) do { :port => '5555' } end + + it "executes with the given port" do + expect(provider).to receive(:run_command).with(["psql", + "-p", "5555", + "-t", "-c", "\"SELECT something\""], + "postgres", "postgres", {} ) + + provider.run_sql_command("SELECT something") + end + end + describe "with connect_settings" do + let(:attributes) do { :connect_settings => { 'PGHOST' => '127.0.0.1' } } end + + it "executes with the given host" do + expect(provider).to receive(:run_command).with(["psql", + "-t", "-c", + "\"SELECT something\""], + "postgres", "postgres", { 'PGHOST' => '127.0.0.1' } ) + + provider.run_sql_command("SELECT something") + end + end + + context("#run_unless_sql_command") do + let(:attributes) do { } end + + it "calls #run_sql_command with SQL" do + expect(provider).to receive(:run_sql_command).with('SELECT COUNT(*) FROM (SELECT 1) count') + provider.run_unless_sql_command('SELECT 1') + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/puppet/provider/postgresql_replication_slot/ruby_spec.rb b/environments/production/modules/postgresql/spec/unit/puppet/provider/postgresql_replication_slot/ruby_spec.rb new file mode 100644 index 0000000..4fc8b55 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/puppet/provider/postgresql_replication_slot/ruby_spec.rb @@ -0,0 +1,92 @@ +require 'spec_helper' + +type = Puppet::Type.type(:postgresql_replication_slot) +describe type.provider(:ruby) do + let(:name) { 'standby' } + let(:resource) do + type.new({ :name => name, :provider => :ruby }.merge attributes) + end + + let(:sql_instances) do + "abc | | physical | | | t | | | 0/3000420 +def | | physical | | | t | | | 0/3000420\n" + end + + class SuccessStatus + def success? + true + end + end + let(:success_status) { SuccessStatus.new } + + class FailStatus + def success? + false + end + end + let(:fail_status) { FailStatus.new } + + let(:provider) { resource.provider } + + context 'when listing instances' do + let(:attributes) do { } end + + it 'should list instances' do + provider.class.expects(:run_command).with( + ['psql', '-t', '-c', 'SELECT * FROM pg_replication_slots;'], + 'postgres', 'postgres').returns([sql_instances, nil]) + instances = provider.class.instances + expect(instances.size).to eq 2 + expect(instances[0].name).to eq 'abc' + expect(instances[1].name).to eq 'def' + end + end + + context 'when creating slot' do + let(:attributes) do { :ensure => 'present' } end + + context 'when creation works' do + it 'should call psql and succeed' do + provider.class.expects(:run_command).with( + ['psql', '-t', '-c', "SELECT * FROM pg_create_physical_replication_slot('standby');"], + 'postgres', 'postgres').returns([nil, success_status]) + + expect { provider.create }.not_to raise_error + end + end + + context 'when creation fails' do + it 'should call psql and fail' do + provider.class.expects(:run_command).with( + ['psql', '-t', '-c', "SELECT * FROM pg_create_physical_replication_slot('standby');"], + 'postgres', 'postgres').returns([nil, fail_status]) + + expect { provider.create }.to raise_error(Puppet::Error, /Failed to create replication slot standby:/) + end + end + end + + context 'when destroying slot' do + let(:attributes) do { :ensure => 'absent' } end + + context 'when destruction works' do + it 'should call psql and succeed' do + provider.class.expects(:run_command).with( + ['psql', '-t', '-c', "SELECT pg_drop_replication_slot('standby');"], + 'postgres', 'postgres').returns([nil, success_status]) + + expect { provider.destroy }.not_to raise_error + end + end + + context 'when destruction fails' do + it 'should call psql and fail' do + provider.class.expects(:run_command).with( + ['psql', '-t', '-c', "SELECT pg_drop_replication_slot('standby');"], + 'postgres', 'postgres').returns([nil, fail_status]) + + expect { provider.destroy }.to raise_error(Puppet::Error, /Failed to destroy replication slot standby:/) + end + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/puppet/type/postgresql_psql_spec.rb b/environments/production/modules/postgresql/spec/unit/puppet/type/postgresql_psql_spec.rb new file mode 100644 index 0000000..3883327 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/puppet/type/postgresql_psql_spec.rb @@ -0,0 +1,251 @@ +require 'spec_helper' + +describe Puppet::Type.type(:postgresql_psql), "when validating attributes" do + [:name, :unless, :db, :psql_path, :psql_user, :psql_group, :connect_settings].each do |attr| + it "should have a #{attr} parameter" do + expect(Puppet::Type.type(:postgresql_psql).attrtype(attr)).to eq(:param) + end + end + + [:command].each do |attr| + it "should have a #{attr} property" do + expect(Puppet::Type.type(:postgresql_psql).attrtype(attr)).to eq(:property) + end + end +end + +describe Puppet::Type.type(:postgresql_psql), :unless => Puppet.features.microsoft_windows? do + subject do + Puppet::Type.type(:postgresql_psql).new({:name => 'rspec'}.merge attributes) + end + + describe "available attributes" do + { + :name => "rspec", + :command => "SELECT stuff", + :unless => "SELECT other,stuff", + :db => "postgres", + :psql_path => "/bin/false", + :psql_user => "postgres", + :psql_group => "postgres", + :cwd => "/var/lib", + :refreshonly => :true, + :search_path => [ "schema1", "schema2"], + :connect_settings => { 'PGHOST' => 'postgres-db-server', + 'DBVERSION' => '9.1', }, + }.each do |attr, value| + context attr do + let(:attributes) do { attr => value } end + + describe [attr] do + subject { super()[attr] } + it { is_expected.to eq(value) } + end + end + end + + context "default values" do + let(:attributes) do {} end + + describe '[:psql_path]' do + subject { super()[:psql_path] } + it { is_expected.to eq("psql") } + end + + describe '[:psql_user]' do + subject { super()[:psql_user] } + it { is_expected.to eq("postgres") } + end + + describe '[:psql_group]' do + subject { super()[:psql_group] } + it { is_expected.to eq("postgres") } + end + + describe '[:cwd]' do + subject { super()[:cwd] } + it { is_expected.to eq("/tmp") } + end + + describe '#refreshonly?' do + subject { super().refreshonly? } + it { is_expected.to be_falsey } + end + end + end + + describe "#command" do + let(:attributes) do {:command => 'SELECT stuff'} end + + it "will have the value :notrun if the command should execute" do + expect(subject).to receive(:should_run_sql).and_return(true) + expect(subject.property(:command).retrieve).to eq(:notrun) + end + + it "will be the 'should' value if the command should not execute" do + expect(subject).to receive(:should_run_sql).and_return(false) + expect(subject.property(:command).retrieve).to eq('SELECT stuff') + end + + it "will call provider#run_sql_command on sync" do + expect(subject.provider).to receive(:run_sql_command).with('SELECT stuff').and_return(["done", 0]) + subject.property(:command).sync + end + end + + describe "#unless" do + let(:attributes) do {:unless => 'SELECT something'} end + + describe "#matches" do + it "does not fail when the status is successful" do + expect(subject.provider).to receive(:run_unless_sql_command).and_return ["1 row returned", 0] + subject.parameter(:unless).matches('SELECT something') + end + + it "returns true when rows are returned" do + expect(subject.provider).to receive(:run_unless_sql_command).and_return ["1 row returned", 0] + expect(subject.parameter(:unless).matches('SELECT something')).to be_truthy + end + + it "returns false when no rows are returned" do + expect(subject.provider).to receive(:run_unless_sql_command).and_return ["0 rows returned", 0] + expect(subject.parameter(:unless).matches('SELECT something')).to be_falsey + end + + it "raises an error when the sql command fails" do + allow(subject.provider).to receive(:run_unless_sql_command).and_return ["Something went wrong", 1] + expect { + subject.parameter(:unless).matches('SELECT something') + }.to raise_error(Puppet::Error, /Something went wrong/) + end + end + end + + describe "#should_run_sql" do + context "without 'unless'" do + [true, :true].each do |refreshonly| + context "refreshonly => #{refreshonly.inspect}" do + let(:attributes) do { + :refreshonly => refreshonly, + } end + + context "not refreshing" do + it { expect(subject.should_run_sql).to be_falsey } + end + + context "refreshing" do + it { expect(subject.should_run_sql(true)).to be_truthy } + end + end + end + + [false, :false].each do |refreshonly| + context "refreshonly => #{refreshonly.inspect}" do + let(:attributes) do { + :refreshonly => refreshonly, + } end + + context "not refreshing" do + it { expect(subject.should_run_sql).to be_truthy } + end + + context "refreshing" do + it { expect(subject.should_run_sql(true)).to be_truthy } + end + end + end + end + + context "with matching 'unless'" do + before { expect(subject.parameter(:unless)).to receive(:matches).with('SELECT something').and_return(true) } + + [true, :true].each do |refreshonly| + context "refreshonly => #{refreshonly.inspect}" do + let(:attributes) do { + :refreshonly => refreshonly, + :unless => 'SELECT something', + } end + + context "not refreshing" do + it { expect(subject.should_run_sql).to be_falsey } + end + + context "refreshing" do + it { expect(subject.should_run_sql(true)).to be_falsey } + end + end + end + + [false, :false].each do |refreshonly| + context "refreshonly => #{refreshonly.inspect}" do + let(:attributes) do { + :refreshonly => refreshonly, + :unless => 'SELECT something', + } end + + context "not refreshing" do + it { expect(subject.should_run_sql).to be_falsey } + end + + context "refreshing" do + it { expect(subject.should_run_sql(true)).to be_falsey } + end + end + end + end + + context "when not matching 'unless'" do + before { expect(subject.parameter(:unless)).to receive(:matches).with('SELECT something').and_return(false) } + + [true, :true].each do |refreshonly| + context "refreshonly => #{refreshonly.inspect}" do + let(:attributes) do { + :refreshonly => refreshonly, + :unless => 'SELECT something', + } end + + context "not refreshing" do + it { expect(subject.should_run_sql).to be_falsey } + end + + context "refreshing" do + it { expect(subject.should_run_sql(true)).to be_truthy } + end + end + end + + [false, :false].each do |refreshonly| + context "refreshonly => #{refreshonly.inspect}" do + let(:attributes) do { + :refreshonly => refreshonly, + :unless => 'SELECT something', + } end + + context "not refreshing" do + it { expect(subject.should_run_sql).to be_truthy } + end + + context "refreshing" do + it { expect(subject.should_run_sql(true)).to be_truthy } + end + end + end + end + end + + describe "#refresh" do + let(:attributes) do {} end + + it "syncs command property when command should run" do + expect(subject).to receive(:should_run_sql).with(true).and_return(true) + expect(subject.property(:command)).to receive(:sync) + subject.refresh + end + + it "does not sync command property when command should not run" do + expect(subject).to receive(:should_run_sql).with(true).and_return(false) + expect(subject.property(:command)).not_to receive(:sync) + subject.refresh + end + end +end diff --git a/environments/production/modules/postgresql/spec/unit/puppet/type/postgresql_replication_slot_spec.rb b/environments/production/modules/postgresql/spec/unit/puppet/type/postgresql_replication_slot_spec.rb new file mode 100644 index 0000000..0d7c668 --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/puppet/type/postgresql_replication_slot_spec.rb @@ -0,0 +1,11 @@ +require 'spec_helper' + +describe Puppet::Type.type(:postgresql_replication_slot) do + subject do + Puppet::Type.type(:postgresql_psql).new({:name => 'standby'}) + end + + it 'should have a name parameter' do + expect(subject[:name]).to eq 'standby' + end +end diff --git a/environments/production/modules/postgresql/spec/unit/type/postgresql_conf_spec.rb b/environments/production/modules/postgresql/spec/unit/type/postgresql_conf_spec.rb new file mode 100644 index 0000000..4214fac --- /dev/null +++ b/environments/production/modules/postgresql/spec/unit/type/postgresql_conf_spec.rb @@ -0,0 +1,50 @@ +#! /usr/bin/env ruby +require 'spec_helper' + +describe Puppet::Type.type(:postgresql_conf) do + before do + @provider_class = described_class.provide(:simple) { mk_resource_methods } + @provider_class.stub(:suitable?).and_return true + described_class.stub(:defaultprovider).and_return @provider_class + end + + describe "namevar validation" do + it "should have :name as its namevar" do + expect(described_class.key_attributes).to eq([:name]) + end + it "should not invalid names" do + expect { described_class.new(:name => 'foo bar') }.to raise_error(Puppet::Error, /Invalid value/) + end + it "should allow dots in names" do + expect { described_class.new(:name => 'foo.bar') }.to_not raise_error + end + end + + describe "when validating attributes" do + [:name, :provider].each do |param| + it "should have a #{param} parameter" do + expect(described_class.attrtype(param)).to eq(:param) + end + end + + [:value, :target].each do |property| + it "should have a #{property} property" do + expect(described_class.attrtype(property)).to eq(:property) + end + end + end + + describe "when validating values" do + describe "ensure" do + it "should support present as a value for ensure" do + expect { described_class.new(:name => 'foo', :ensure => :present) }.to_not raise_error + end + it "should support absent as a value for ensure" do + expect { described_class.new(:name => 'foo', :ensure => :absent) }.to_not raise_error + end + it "should not support other values" do + expect { described_class.new(:name => 'foo', :ensure => :foo) }.to raise_error(Puppet::Error, /Invalid value/) + end + end + end +end diff --git a/environments/production/modules/postgresql/templates/pg_hba_rule.conf b/environments/production/modules/postgresql/templates/pg_hba_rule.conf new file mode 100644 index 0000000..af54db5 --- /dev/null +++ b/environments/production/modules/postgresql/templates/pg_hba_rule.conf @@ -0,0 +1,5 @@ + +# Rule Name: <%=@name%> +# Description: <%=@description%> +# Order: <%=@order%> +<%=@type%> <%=@database%> <%=@user%> <%=@address%> <%=@auth_method%> <%=@auth_option%> diff --git a/environments/production/modules/postgresql/templates/pg_ident_rule.conf b/environments/production/modules/postgresql/templates/pg_ident_rule.conf new file mode 100644 index 0000000..238c6e9 --- /dev/null +++ b/environments/production/modules/postgresql/templates/pg_ident_rule.conf @@ -0,0 +1,5 @@ + +# Rule Name: <%=@name%> +# Description: <%=@description%> +# Order: <%=@order%> +<%=@map_name%> <%=@system_username%> <%=@database_username%> diff --git a/environments/production/modules/postgresql/templates/recovery.conf.erb b/environments/production/modules/postgresql/templates/recovery.conf.erb new file mode 100644 index 0000000..a678fae --- /dev/null +++ b/environments/production/modules/postgresql/templates/recovery.conf.erb @@ -0,0 +1,47 @@ +<% if @restore_command -%> +restore_command = '<%= @restore_command %>' +<% end -%> +<% if @archive_cleanup_command -%> +archive_cleanup_command = '<%= @archive_cleanup_command %>' +<% end -%> +<% if @recovery_end_command -%> +recovery_end_command = '<%= @recovery_end_command %>' +<% end -%> + +<% if @recovery_target_name -%> +recovery_target_name = '<%= @recovery_target_name %>' +<% end -%> +<% if @recovery_target_time -%> +recovery_target_time = '<%= @recovery_target_time %>' +<% end -%> +<% if @recovery_target_xid -%> +recovery_target_xid = '<%= @recovery_target_xid %>' +<% end -%> +<% if @recovery_target_inclusive -%> +recovery_target_inclusive = <%= @recovery_target_inclusive %> +<% end -%> +<% if @recovery_target -%> +recovery_target = '<%= @recovery_target %>' +<% end -%> +<% if @recovery_target_timeline -%> +recovery_target_timeline = '<%= @recovery_target_timeline %>' +<% end -%> +<% if @pause_at_recovery_target -%> +pause_at_recovery_target = <%= @pause_at_recovery_target %> +<% end -%> + +<% if @standby_mode -%> +standby_mode = <%= @standby_mode %> +<% end -%> +<% if @primary_conninfo -%> +primary_conninfo = '<%= @primary_conninfo %>' +<% end -%> +<% if @primary_slot_name -%> +primary_slot_name = '<%= @primary_slot_name %>' +<% end -%> +<% if @trigger_file -%> +trigger_file = '<%= @trigger_file %>' +<% end -%> +<% if @recovery_min_apply_delay -%> +recovery_min_apply_delay = <%= @recovery_min_apply_delay %> +<% end -%> diff --git a/environments/production/modules/postgresql/templates/systemd-override.erb b/environments/production/modules/postgresql/templates/systemd-override.erb new file mode 100644 index 0000000..5a2a31c --- /dev/null +++ b/environments/production/modules/postgresql/templates/systemd-override.erb @@ -0,0 +1,14 @@ +<%- if scope.lookupvar('::osfamily') == 'Gentoo' -%> +.include /usr/lib64/systemd/system/<%= @service_name %>.service +<%- elsif scope.lookupvar('::operatingsystem') == 'Fedora' -%> +.include /lib/systemd/system/<%= @service_name %>.service +<% else -%> +.include /usr/lib/systemd/system/<%= @service_name %>.service +<% end -%> +[Service] +Environment=PGPORT=<%= @port %> +<%- if scope.lookupvar('::osfamily') == 'Gentoo' -%> +Environment=DATA_DIR=<%= @datadir %> +<%- else -%> +Environment=PGDATA=<%= @datadir %> +<%- end -%> diff --git a/environments/production/modules/puppetdb/CHANGELOG b/environments/production/modules/puppetdb/CHANGELOG new file mode 100644 index 0000000..d9b0f32 --- /dev/null +++ b/environments/production/modules/puppetdb/CHANGELOG @@ -0,0 +1,482 @@ +## puppetlabs-puppetdb changelog + +Release notes for the puppetlabs-puppetdb module. + +#### 5.1.2 - 2016/03/14 + +This is a minor bugfix release. + +Detailed changes: + +* Support RHEL upgrades from the `puppetdb-terminus` (<= PuppetDB 2) to the +`puppetdb-termini` (>= PuppetDB 3). + +------------------------------------------ + +#### 5.1.1 - 2016/02/09 + +This is a minor bugfix release. + +Detailed changes: + +* Revert a change to 'puppetdb-terminus' installation process that occurred in +the last release. + +------------------------------------------ + +#### 5.1.0 - 2016/02/09 + +This is a minor feature release. + +Detailed changes: + +* Use 'puppetdb-terminus' as the terminus package on RHEL, to avoid packaging + conflicts that could occur on upgrades from 2.x to 3.x. The + 'puppetdb-terminus' version 3.x package on RHEL will install + 'puppetdb-termini' as a dependency. +* Add jdbc_ssl_properties parameter. +* Pass 'dport' parameter to puppetlabs/firewall instead of the deprecated 'port'. +* Pass database_port parameter to the postgresql class. +* Manage the puppetdb vardir. +* Allow default java_args to be overridden. +* Linting fixes. + +------------------------------------------ + +#### 5.0.0 - 2015/07/08 + +This is a major release to provide default support for PuppetDB 3.0.0, so +lots of changes have been introduced. Ensure you read the upgrade guide +provided in the README before upgrading to this release. + +Detailed changes: + +* Packaging paths by default favour the PDB 3.0.0 AIO paths now. +* Added legacy handling for old terminus & service versions (see upgrade guide + in README for details) +* PDB 3.0.0 introduces new pathing for the API requests, so all the defaults + for this module are switched to use that now. +* Support for Puppet 4 added. +* manage_pg_repo is now on by default when using the puppetlabs/postgresql module, + as PDB 3.0.0 supports only 9.4. This enables the use of the upstream PGDG + PostgreSQL repos for all distros to obtain a working version of 9.4. The + option can be disabled if required. +* Default ssl-host is now 0.0.0.0 + +------------------------------------------ + +#### 4.3.0 - 2015/06/10 + +This is a minor feature release. + +Detailed changes: + +* Feature: Provide `database_embedded_path` option for overriding HSQLDB file path. +* Feature: Add ability to manage `command_threads`, `store_usage` and `temp_usage`. +* Bug: allow database_validation to be false +* Bug: Fix ordering issues with read_database_ini +* Testing: Fix file_concat dependency and fix rspec warnings + +------------------------------------------ + +#### 4.2.1 - 2015/04/07 + +This is a minor bugfix release. + +Detailed Changes: + +* Ignore `._foo` files when building the `.tar.gz` of the module. + +------------------------------------------ + +#### 4.2.0 - 2015/04/02 + +This is a minor feature release. + +Detailed Changes: + +* Added Puppet 4 compatibility by introspecting the value for `$puppet_confdir`. +* Added `masterless` param switch to enable or disable the masterless setup of PuppetDB. +* Added `manage_package_repo` param which will setup the official PostgreSQL repositories on your host. +* Added FreeBSD support. +* The puppetdb service now restarts if the certificates change. +* `manage_firewall` and `ssl_protocols` are now configurable through the top-level puppetdb class. +* Show the puppetdb server URI scheme in connection errors. +* `test_url` param is now properly passed from the resource to the provider. +* Removed dead PE code and unused variables from the module. +* New parameter `puppetdb_disable_ssl` to enable validation to use cleartext. +* Database validation is now optional via the `database_validate` and `read_database_validate` params. +* Documentation updates to the README and metadata.json. + +------------------------------------------ + +#### 4.1.0 - 2014/11/13 + +This is a minor feature release. + +Detailed Changes: + +* New capabilities added for installing SSL certificates and keys. +* New parameter `puppetdb_disable_ssl` to enable validation to use cleartext. +* `ssl_protocols` now provided to allow users to fine tune what protocols they want to support for PuppetDB. +* Lots of documentation and parameter cleanups, to ensure consistency. +* test_url is now supported for `puppetdb::master::config` to allow the URL one uses to be overridden. +* Corrected PE detection support. +* Correct the path for HSQLDB to use /var/lib/puppetdb/db instead of /usr/share/puppetdb/db as is standard in PuppetDB core. + +------------------------------------------ + +#### 4.0.0 - 2014/09/16 + +For this release, all dependency versions have been bumped to their latest. + +Detailed Changes: + +* The PuppetDB module now only supports Puppet 3.7.1 or later +* 'puppetlabs/postgresql' 4.0.0 or later is now required +* 'puppetlabs/inifile' 1.1.3 or later is now required +* 'puppetlabs/firewall' 1.1.3 or later is now required +* 'puppetlabs/stdlib' 4.2.2 or later is now required +* The parameter `manage_firewall` for the class `puppetdb::database::postgresql` has now been removed, since the postgresql module no longer supports this. +* The parameter `open_postgres_port` for the class `puppetdb` has also been removed, due to postgresql changes. + +------------------------------------------ + +#### 3.0.1 - 2014/02/11 + +This release contains only minor bug fixes. + +Detailed Changes: + +* Add missing PUBLISHER_LOGIN variable for auto-publish. (Ashley Penney) +* fix validation regular expressions for time configs (Scott Duckworth) +* update ripienaar/concat -> puppetlabs/concat (Joshua Hoblitt) +* Fix issue with validator when disable_ssl = true (Elliott Barrere) +* Enable soft_write_failure setting when $puppetdb::disablessl = true (Elliott Barrere) +* Support rspec-puppet v1.0.0 (Garrett Honeycutt) +* Pin rspec-puppet to 1.x releases (Ken Barber) +* Define parameter in puppetdb class to define postgres listen address (Adrian Lopez) +* Enable fast finish in Travis (Garrett Honeycutt) +* Convert tests to beaker (Ashley Penney) +* Use the /v2 metrics endpoint instead of /metrics (Ken Barber) + +------------------------------------------ + +#### 3.0.0 - 2013/10/27 + +This major release changes the main dependency for the postgresql module from +version 2.5.x to 3.x. Since the postgresql module is not backwards compatible, +this release is also not backwards compatible. As a consequence we have taken +some steps to deprecate some of the older functionality: + +* The parameter manage_redhat_firewall for the class puppetdb has now been removed completely in favor of open_postgres_port and open_ssl_listen_port. +* The parameter manage_redhat_firewall for the class puppetdb::database::postgresql, has now been renamed to manage_firewall. +* The parameter manage_redhat_firewall for the class puppetdb::server has now been removed completely in favor of open_listen_port and open_ssl_listen_port. +* The internal class: puppetdb::database::postgresql_db has been removed. If you were using this, it is now defunct. +* The class puppetdb::server::firewall has been marked as private, do not use it directly. +* The class puppetdb::server::jetty_ini and puppetdb::server::database_ini have been marked as private, do not use it directly. + +All of this is documented in the upgrade portion of the README. + +Additionally some features have been included in this release as well: + +* soft_write_failure can now be enabled in your puppetdb.conf with this + module to handle failing silently when your PuppetDB is not available + during writes. +* There is a new switch to enable SSL connectivity to PostgreSQL. While this + functionality is only in its infancy this is a good start. + +Detailed Changes: + +* FM-103: Add metadata.json to all modules. (Ashley Penney) +* Add soft_write_failure to puppetdb.conf (Garrett Honeycutt) +* Add switch to configure database SSL connection (Stefan Dietrich) +* (GH-91) Update to use rspec-system-puppet 2.x (Ken Barber) +* (GH-93) Switch to using puppetlabs-postgresql 3.x (Ken Barber) +* Fix copyright and project notice (Ken Barber) +* Adjust memory for PuppetDB tests to avoid OOM killer (Ken Barber) +* Ensure ntpdate executes early during testing (Ken Barber) + +------------------------------------------ + +#### 2.0.0 - 2013/10/04 + +This major release changes the main dependency for the inifile module from +the deprecated `cprice404/inifile` to `puppetlabs/inifile` to remove +deprecation warnings and to move onto the latest and greatest implementation +of that code. + +Its a major release, because it may affect other dependencies since modules +cannot have overlapping second part dependencies (that is inifile cannot be from +two different locations). + +It also adds the parameter `puppetdb_service_status` to the class `puppetdb` to +allow users to specify whether the module manages the puppetdb service for you. + +The `database_password` parameter is now optional, and initial Arch Linux +support has been added. + +Detailed Changes: + +* (GH-73) Switch to puppetlabs/inifile from cprice/inifile (Ken Barber) +* Make database_password an optional parameter (Nick Lewis) +* add archlinux support (Niels Abspoel) +* Added puppetdb service control (Akos Hencz) + +------------------------------------------ + +#### 1.6.0 - 2013/08/07 + +This minor feature release provides extra parameters for new configuration +items available in PuppetDB 1.4, and also provides some older parameters +that were missed previously: + +* gc_interval +* log_slow_statements +* conn_max_age +* conn_keep_alive +* conn_lifetime + +Consult the README.md file, or the PuppetDB documentation for more details. + +------------------------------------------ + +#### 1.5.0 - 2013/07/18 + +This minor feature release provides the following new functionality: + +* The module is now capable of managing PuppetDB on SUSE systems + for which PuppetDB packages are available +* The ruby code for validating the PuppetDB connection now + supports validating on a non-SSL HTTP port. + +------------------------------------------ + +#### 1.4.0 - 2013/05/13 + +This feature release provides support for managing the puppetdb report +processor on your master. + +To enable the report processor, you can do something like this: + + class { 'puppetdb::master::config': + manage_report_processor => true, + enable_reports => true + } + +This will add the 'puppetdb' report processor to the list of `reports` +inside your master's `puppet.conf` file. + +------------------------------------------ + +#### 1.3.0 - 2013/05/13 + +This feature release provides us with a few new features for the PuppetDB +module. + +You can now disable SSL when using the `puppetdb` class by using the new +parameter `disable_ssl`: + + class { 'puppetdb': + disable_ssl => true, + } + +This will remove the SSL settings from your `jetty.ini` configuration file +disabling any SSL communication. This is useful when you want to offload SSL +to another web server, such as Apache or Nginx. + +We have now added an option `java_args` for passing in Java options to +PuppetDB. The format is a hash that is passed in when declaring the use of the +`puppetdb` class: + + class { 'puppetdb': + java_args => { + '-Xmx' => '512m', + '-Xms' => '256m', + } + } + +Also, the default `report-ttl` was set to `14d` in PuppetDB to align it with an +upcoming PE release, so we've also reflected that default here now. + +And finally we've fixed the issue whereby the options `report_ttl`, `node_ttl`, +`node_purge_ttl` and `gc_interval` were not making the correct changes. On top +of that you can now set these values to zero in the module, and the correct +time modifier (`s`, `m`, `h` etc.) will automatically get applied for you. + +Behind the scenes we've also added system and unit testing, which was +previously non-existent. This should help us reduce regression going forward. + +Thanks to all the contributing developers in the list below that made this +release possible :-). + +#### Changes + +* Allows for 0 _ttl's without time signifier and enables tests (Garrett Honeycutt) +* Add option to disable SSL in Jetty, including tests and documentation (Christian Berg) +* Cleaned up ghoneycutt's code a tad (Ken Barber) +* the new settings report_ttl, node_ttl and node_purge_ttl were added but they are not working, this fixes it (fsalum) +* Also fix gc_interval (Ken Barber) +* Support for remote puppetdb (Filip Hrbek) +* Added support for Java VM options (Karel Brezina) +* Add initial rspec-system tests and scaffolding (Ken Barber) + +------------------------------------------ + +#### 1.2.1 - 2013/04/08 + +This is a minor bugfix that solves the PuppetDB startup exception: + + java.lang.AssertionError: Assert failed: (string? s) + +This was due to the default `node-ttl` and `node-purge-ttl` settings not having a time suffix by default. These settings required 's', 'm', 'd' etc. to be suffixed, even if they are zero. + +#### Changes + +* (Ken Barber) Add 's' suffix to period settings to avoid exceptions in PuppetDB + +------------------------------------------ + +#### 1.2.0 - 2013/04/05 + +This release is primarily about providing full configuration file support in the module for PuppetDB 1.2.0. (The alignment of version is a coincidence I assure you :-). + +This feature release adds the following new configuration parameters to the main `puppetdb` class: + +* node_ttl +* node_purge_ttl (available in >=1.2.0) +* report_ttl + +Consult the README for futher details about these new configurable items. + +##### Changes + +* (Nick Lewis) Add params and ini settings for node/purge/report ttls and document them + +------------------------------------------ + +1.1.5 +===== + +2013-02-13 - Karel Brezina + * Fix database creation so database_username, database_password and + database_name are correctly passed during database creation. + +2013-01-29 - Lauren Rother + * Change README to conform to new style and various other README improvements + +2013-01-17 - Chris Price + * Improve documentation in init.pp + +------------------------------------------ + +1.1.4 +===== + +This is a bugfix release, mostly around fixing backward-compatibility for the +deprecated `manage_redhat_firewall` parameter. It wasn't actually entirely +backwards-compatible in the 1.1.3 release. + +2013-01-17 - Chris Price + * Fix backward compatibility of `manage_redhat_firewall` parameter (de20b44) + +2013-01-16 - Chris Price + * Fix deprecation warnings around manage_redhat_firewall (448f8bc) + +------------------------------------------ + +1.1.3 +===== + +This is mostly a maintenance release, to update the module dependencies to newer +versions in preparation for some new features. This release does include some nice +additions around the ability to set the listen address for the HTTP port on Jetty +and manage the firewall for that port. Thanks very much to Drew Blessing for those +submissions! + +2013-01-15 - Chris Price + * Update Modulefile for 1.1.3 release (updates dependencies + on postgres and inifile modules to the latest versions) (76bfd9e) + +2012-12-19 - Garrett Honeycutt + * (#18228) updates README for style (fd2e990) + +2012-11-29 - Drew Blessing + * 17594 - Fixes suggested by cprice-puppet (0cf9632) + +2012-11-14 - Drew Blessing + * Adjust examples in tests to include new port params (0afc276) + +2012-11-13 - Drew Blessing + * 17594 - PuppetDB - Add ability to set standard host listen address and open firewall + +------------------------------------------ + +1.1.2 +===== + +2012-10-26 - Chris Price (1.1.2) + * 1.1.2 release + +2012-10-26 - Chris Price + * Add some more missing `inherit`s for `puppetdb::params` (a72cc7c) + +2012-10-26 - Chris Price (1.1.2) + * 1.1.1 release + +2012-10-26 - Chris Price (1.1.1) + * Add missing `inherit` for `puppetdb::params` (ea9b379) + +2012-10-24 - Chris Price + * 1.1.0 release + +2012-10-24 - Chris Price (1.1.0) + * Update postgres dependency to puppetlabs/postgresql (bea79b4) + +2012-10-17 - Reid Vandewiele (1.1.0) + * Fix embedded db setup in Puppet Enterprise (bf0ab45) + +2012-10-17 - Chris Price (1.1.0) + * Update manifests/master/config.pp (b119a30) + +2012-10-16 - Chris Price (1.1.0) + * Make puppetdb startup timeout configurable (783b595) + +2012-10-01 - Hunter Haugen (1.1.0) + * Add condition to detect PE installations and provide different parameters (63f1c52) + +2012-10-01 - Hunter Haugen (1.1.0) + * Add example manifest code for pe puppet master (a598edc) + +2012-10-01 - Chris Price (1.1.0) + * Update comments and docs w/rt PE params (b5df5d9) + +2012-10-01 - Hunter Haugen (1.1.0) + * Adding pe_puppetdb tests class (850e039) + +2012-09-28 - Hunter Haugen (1.1.0) + * Add parameters to enable usage of enterprise versions of PuppetDB (df6f7cc) + +2012-09-23 - Chris Price + * 1.0.3 release + +2012-09-23 - Chris Price + * Add a parameter for restarting puppet master (179b337) + +2012-09-21 - Chris Price + * 1.0.2 release + +2012-09-21 - Chris Price + * Pass 'manage_redhat_firewall' param through to postgres (f21740b) + +2012-09-20 - Chris Price + * 1.0.1 release + +2012-09-20 - Garrett Honeycutt + * complies with style guide (1aab5d9) + +2012-09-19 - Chris Price + * Fix invalid subname in database.ini (be683b7) + +2011-09-18 Chris Price - 1.0.0 +* Initial 1.0.0 release diff --git a/environments/production/modules/puppetdb/LICENSE b/environments/production/modules/puppetdb/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/environments/production/modules/puppetdb/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/environments/production/modules/puppetdb/NOTICE b/environments/production/modules/puppetdb/NOTICE new file mode 100644 index 0000000..bd9bb48 --- /dev/null +++ b/environments/production/modules/puppetdb/NOTICE @@ -0,0 +1,5 @@ +Puppet PuppetDB Module - Puppet module for managing PuppetDB + +Copyright (C) 2012-2014 Puppet Labs, Inc. + +Puppet Labs can be contacted at: info@puppetlabs.com diff --git a/environments/production/modules/puppetdb/README.md b/environments/production/modules/puppetdb/README.md new file mode 100644 index 0000000..6405538 --- /dev/null +++ b/environments/production/modules/puppetdb/README.md @@ -0,0 +1,948 @@ +puppetdb +========= + +####Table of Contents + +1. [Overview - What is the PuppetDB module?](#overview) +2. [Module Description - What does the module do?](#module-description) +3. [Setup - The basics of getting started with PuppetDB module](#setup) +4. [Upgrading - Guide for upgrading from older revisions of this module](#upgrading) +4. [Usage - The classes and parameters available for configuration](#usage) +5. [Implementation - An under-the-hood peek at what the module is doing](#implementation) +6. [Limitations - OS compatibility, etc.](#limitations) +7. [Development - Guide for contributing to the module](#development) +8. [Release Notes - Notes on the most recent updates to the module](#release-notes) + +Overview +-------- + +By guiding puppetdb setup and configuration with a Puppet master, the PuppetDB +module provides fast, streamlined access to data on puppetized infrastructure. + +Module Description +------------------- + +The PuppetDB module provides a quick way to get started using PuppetDB, an open +source inventory resource service that manages storage and retrieval of +platform-generated data. The module will install PostgreSQL and PuppetDB if you +don't have them, as well as set up the connection to Puppet master. The module +will also provide a dashboard you can use to view the current state of your +system. + +For more information about PuppetDB +[please see the official PuppetDB documentation.](http://docs.puppetlabs.com/puppetdb/) + + +Setup +----- + +**What PuppetDB affects:** + +* package/service/configuration files for PuppetDB +* package/service/configuration files for PostgreSQL (optional, but set as default) +* Puppet master's runtime (via plugins) +* Puppet master's configuration + * **note**: Using the `puppetdb::master::config` class will cause your + routes.yaml file to be overwritten entirely (see **Usage** below for options + and more information ) +* system firewall (optional) +* listened-to ports + +**Introductory Questions** + +To begin using PuppetDB, you’ll have to make a few decisions: + +* Which database back-end should I use? + * PostgreSQL (default) or our embedded database + * Embedded database + * **note:** We suggest using the embedded database only for experimental + environments rather than production, as it does not scale well and can + cause difficulty in migrating to PostgreSQL. +* Should I run the database on the same node that I run PuppetDB on? +* Should I run PuppetDB on the same node that I run my master on? + +The answers to those questions will be largely dependent on your answers to +questions about your Puppet environment: + +* How many nodes are you managing? +* What kind of hardware are you running on? +* Is your current load approaching the limits of your hardware? + +Depending on your answers to all of the questions above, you will likely fall +under one of these set-up options: + +1. [Single Node (Testing and Development)](#single-node-setup) +2. [Multiple Node (Recommended)](#multiple-node-setup) + +### Single Node Setup + +This approach assumes you will use our default database (PostgreSQL) and run +everything (PostgreSQL, PuppetDB, Puppet master) all on the same node. This +setup will be great for a testing or experimental environment. In this case, +your manifest will look like: + + node { + # Configure puppetdb and its underlying database + class { 'puppetdb': } + # Configure the Puppet master to use puppetdb + class { 'puppetdb::master::config': } + } + +You can provide some parameters for these classes if you’d like more control, +but that is literally all that it will take to get you up and running with the +default configuration. + +### Multiple Node Setup + +This approach is for those who prefer not to install PuppetDB on the same node +as the Puppet master. Your environment will be easier to scale if you are able +to dedicate hardware to the individual system components. You may even choose to +run the puppetdb server on a different node from the PostgreSQL database that it +uses to store its data. So let’s have a look at what a manifest for that +scenario might look like: + +**This is an example of a very basic 3-node setup for PuppetDB.** + + $master_host = 'master.example.lan' + $puppetdb_host = 'puppetdb.example.lan' + $postgres_host = 'postgres.example.lan' + node $master_host { + # Here we configure the Puppet master to use PuppetDB, + # telling it the hostname of the PuppetDB node + class { 'puppetdb::master::config': + puppetdb_server => $puppetdb_host, + } + } + node $postgres_host { + # Here we install and configure PostgreSQL and the PuppetDB + # database instance, and tell PostgreSQL that it should + # listen for connections to the `$postgres_host` + class { 'puppetdb::database::postgresql': + listen_addresses => $postgres_host, + } + } + node $puppetdb_host { + # Here we install and configure PuppetDB, and tell it where to + # find the PostgreSQL database. + class { 'puppetdb::server': + database_host => $postgres_host, + } + } + +This should be all it takes to get a 3-node, distributed installation of +PuppetDB up and running. Note that, if you prefer, you could easily move two of +these classes to a single node and end up with a 2-node setup instead. + +### Beginning with PuppetDB + +Whether you choose a single node development setup or a multi-node setup, a +basic setup of PuppetDB will cause: PostgreSQL to install on the node if it’s +not already there; PuppetDB postgres database instance and user account to be +created; the postgres connection to be validated and, if successful, PuppetDB to +be installed and configured; PuppetDB connection to be validated and, if +successful, the Puppet master config files to be modified to use PuppetDB; and +the Puppet master to be restarted so that it will pick up the config changes. + +If your logging level is set to INFO or finer, you should start seeing +PuppetDB-related log messages appear in both your Puppet master log and your +puppetdb log as subsequent agent runs occur. + +If you’d prefer to use PuppetDB’s embedded database rather than PostgreSQL, have +a look at the database parameter on the puppetdb class: + + class { 'puppetdb': + database => 'embedded', + } + +The embedded database can be useful for testing and very small production +environments, but it is not recommended for production environments since it +consumes a great deal of memory as your number of nodes increase. + +### Cross-node Dependencies + +It is worth noting that there are some cross-node dependencies, which means that +the first time you add the module's configurations to your manifests, you may +see a few failed puppet runs on the affected nodes. + +PuppetDB handles cross-node dependencies by taking a sort of "eventual +consistency" approach. There’s nothing that the module can do to control the +order in which your nodes check in, but the module can check to verify that the +services it depends on are up and running before it makes configuration +changes--so that’s what it does. + +When your Puppet master node checks in, it will validate the connectivity to the +puppetdb server before it applies its changes to the Puppet master config files. +If it can’t connect to puppetdb, then the puppet run will fail and the previous +config files will be left intact. This prevents your master from getting into a +broken state where all incoming puppet runs fail because the master is +configured to use a puppetdb server that doesn’t exist yet. The same strategy is +used to handle the dependency between the puppetdb server and the postgres +server. + +Hence the failed puppet runs. These failures should be limited to 1 failed run +on the puppetdb node, and up to 2 failed runs on the Puppet master node. After +that, all of the dependencies should be satisfied and your puppet runs should +start to succeed again. + +You can also manually trigger puppet runs on the nodes in the correct order +(Postgres, PuppetDB, Puppet master), which will avoid any failed runs. + +Upgrading +--------- + +### Upgrading from 4.x to 5.x + +Significant parameter changes are listed below: + +* The PuppetDB module defaults to Puppet 4 pathing and assumes `puppetserver` + is the master service by default +* The PuppetDB module manages Postgres repos by default. To turn this behavior + off, set `manage_package_repo` to `false`. +* To specify a specific version of PuppetDB to manage, you'll need to use the + `puppetdb::globals` class to set the version of PuppetDB you're using + explicitly. The ability to configure the version in the `puppetdb::server` and + `puppetdb` class have been removed. + +For example if your config looked like this before: + + class {'puppetdb': + puppetdb_version => '3.2.4-1.el7', + } + class { 'puppetdb::master::config': } + +and you'd still like to use the module with PuppetDB 3.2.4, all you'd have to +change would be: + + class { 'puppetdb::globals': + version => '3.2.4-1.el7', + } + class { 'puppetdb' : } + class { 'puppetdb::master::config' : } + +The `globals` class above takes into account the following PuppetDB 3 and Puppet +4 related changes: + * The `puppetdb::master:puppetdb_conf` class has added a `$legacy_terminus` + to support the PuppetDB 2.x terminus configuration. + * The default `test_url` for the `PuppetDBConnValidator` has also been + chaged to `/pdb/meta/v1/version` but will default to `/v3/version` when + using a PuppetDB 2.x version. + * The configuration pathing for Puppet and PuppetDB has changed with Puppet + 4 and PuppetDB 3, using PuppetDB 2.x or older assumes the old + configuration pathing. + +See the CHANGELOG file for more detailed information on changes for each release. + +### Upgrading from 3.x to 4.x + +For this release, all dependency versions have been bumped to their latest. +Significant parameter changes are listed below: + +* The PuppetDB module now only supports Puppet 3.7.1 or later +* `puppetlabs/postgresql` 4.0.0 or later is now required +* `puppetlabs/inifile` 1.1.3 or later is now required +* `puppetlabs/firewall` 1.1.3 or later is now required +* `puppetlabs/stdlib` 4.2.2 or later is now required +* The parameter `manage_firewall` for the class `puppetdb::database::postgresql` + has now been removed, since the PostgreSQL module no longer supports this. +* The parameter `open_postgres_port` for the class `puppetdb` has also been + removed, due to PostgreSQL changes. + +See the CHANGELOG file for more detailed information on changes for each release. + +### Upgrading from 2.x to 3.x + +For this release a major dependency has changed. The module +`pupppetlabs/postgresql` must now be version 3.x. Upgrading the module should +upgrade the `puppetlabs/postgresql` module for you, but if another module has a +fixed dependency that module will have to be fixed before you can continue. + +Some other changes include: + +* The parameter `manage_redhat_firewall` for the class `puppetdb` has now been + removed completely in favor of `open_postgres_port` and + `open_ssl_listen_port`. +* The parameter `manage_redhat_firewall` for the class + `puppetdb::database::postgresql`, has now been renamed to `manage_firewall`. +* The parameter `manage_redhat_firewall` for the class `puppetdb::server` has + now been removed completely in favor of `open_listen_port` and + `open_ssl_listen_port`. +* The internal class: `puppetdb::database::postgresql_db` has been removed. If + you were using this, it is now defunct. +* The class `puppetdb::server::firewall` has been marked as private, do not use + it directly. +* The class `puppetdb::server::jetty_ini` and `puppetdb::server::database_ini` + have been marked as private, do not use it directly. + +### Upgrading from 1.x to 2.x + +A major dependency has been changed, so now when you upgrade to 2.0 the +dependency `cprice404/inifile` has been replaced with `puppetlabs/inifile`. This +may interfere with other modules as they may depend on the old +`cprice404/inifile` instead, so upgrading should be done with caution. Check +that your other modules use the newer `puppetlabs/inifile` module as +interoperation with the old `cprice404/inifile` module will no longer be +supported by this module. + +Depending on how you install your modules, changing the dependency may require +manual intervention. Double check your modules contain the newer +`puppetlabs/inifile` after installing this latest module. + +Otherwise, all existing parameters from 1.x should still work correctly. + +Usage +------ + +PuppetDB supports a large number of configuration options for both configuring +the puppetdb service and connecting that service to the Puppet master. + +### puppetdb::globals + +The `puppetdb::globals` class is intended to provide similar functionality to +the `postgresql::globals` class in the `puppetlabs-postgresql` module by +exposing a top-level entry-point into the module so that we can properly set +defaults for the `puppetdb::params` class based on the version of `puppetdb` you +are using. This setting defaults to `present`. + +You must declare the class to use it: + + class { 'puppetdb::globals': } + +**Parameters within `puppetdb::globals`:** + +####`version` + +The version of the `puppetdb` package that should be installed. You may specify +an explicit version number, 'present', or 'latest' (defaults to 'present'). + +### puppetdb + +The `puppetdb` class is intended as a high-level abstraction (sort of an +'all-in-one' class) to help simplify the process of getting your puppetdb server +up and running. It wraps the slightly-lower-level classes `puppetdb::server` and +`puppetdb::database::*`, and it'll get you up and running with everything you +need (including database setup and management) on the server side. For maximum +configurability, you may choose not to use this class. You may prefer to use the +`puppetdb::server` class directly, or manage your puppetdb setup on your own. + +You must declare the class to use it: + + class { 'puppetdb': } + +**Parameters within `puppetdb`:** + +####`listen_address` + +The address that the web server should bind to for HTTP requests. Defaults to +`localhost`. Set to `0.0.0.0` to listen on all addresses. + +####`listen_port` + +The port on which the puppetdb web server should accept HTTP requests. Defaults +to `8080`. + +####`disable_cleartext` + +If true, the puppetdb web server will only serve HTTPS and not HTTP requests (defaults to false). + +####`open_listen_port` + +If `true`, open the `http_listen_port` on the firewall. Defaults to `false`. + +####`ssl_listen_address` + +The address that the web server should bind to for HTTPS requests. Defaults to +`0.0.0.0` to listen on all addresses. + +####`ssl_listen_port` + +The port on which the puppetdb web server should accept HTTPS requests. Defaults +to `8081`. + +####`disable_ssl` + +If `true`, the puppetdb web server will only serve HTTP and not HTTPS requests. +Defaults to `false`. + +####`open_ssl_listen_port` + +If true, open the `ssl_listen_port` on the firewall. Defaults to `true`. + +####`ssl_protocols` + +Specify the supported SSL protocols for PuppetDB (e.g. TLSv1, TLSv1.1, TLSv1.2.) + +###`manage_dbserver` + +If true, the PostgreSQL server will be managed by this module. Defaults to `true`. + +####`database` + +Which database backend to use; legal values are `postgres` (default) or +`embedded`. The `embedded` db can be used for very small installations or for +testing, but is not recommended for use in production environments. For more +info, see the [puppetdb docs](http://docs.puppetlabs.com/puppetdb/). + +####`database_host` + +Hostname to use for the database connection. For single case installations this +should be left as the default. Defaults to `localhost`, ignored for `embedded` +database. + +####`database_port` + +The port that the database server listens on. Defaults to `5432`, ignored for +`embedded` database. + +####`database_username` + +The name of the database user to connect as. Defaults to `puppetdb`, ignored for +`embedded` database. + +####`database_password` + +The password for the database user. Defaults to `puppetdb`, ignored for +`embedded` database. + +####`database_name` + +The name of the database instance to connect to. Defaults to `puppetdb`, ignored +for `embedded` database. + +####`database_ssl` (DEPRECATED) + +If true, PuppetDB will use SSL to connect to the postgres database. Defaults to +`false`, ignored for `embedded` database. Setting up proper trust- and keystores has to +be managed outside of the PuppetDB module. + +This parameter is deprecated and will be retired in a future release. Please use +the `jdbc_ssl_properties` parameter with the value `?ssl=true`. + +####`jdbc_ssl_properties` + +The text to append to the JDBC connection URI. This should begin with a '?' +character. For example, to use SSL for the PostgreSQL connection, set this +parameter's value to `?ssl=true`. + +This setting is only available when using PostgreSQL; when using HyperSQL (the +`embedded` database), it does nothing. + +####`database_validate` + +If true, the module will attempt to connect to the database using the specified +settings and fail if it is not able to do so. Defaults to `true`. + +####`database_embedded_path` + +*Embedded Database Only* Changes the path location for the HSQLDB database. Does + not provide migration for old data, so if you change this value and you have an + existing database you will need to manually move the content also. (defaults to + package default for 2.x release). + +####`node_ttl` + +The length of time a node can go without receiving any new data before it's +automatically deactivated. (defaults to '0', which disables auto-deactivation). +This option is supported in PuppetDB >= 1.1.0. + +####`node_purge_ttl` + +The length of time a node can be deactivated before it's deleted from the +database. (defaults to '0', which disables purging). This option is supported in +PuppetDB >= 1.2.0. + +####`report_ttl` + +The length of time reports should be stored before being deleted. (defaults to +`7d`, which is a 7-day period). This option is supported in PuppetDB >= 1.1.0. + +####`gc_interval` + +This controls how often (in minutes) to compact the database. The compaction +process reclaims space and deletes unnecessary rows. If not supplied, the +default is every 60 minutes. This option is supported in PuppetDB >= 0.9. + +####`log_slow_statements` + +This sets the number of seconds before an SQL query is considered "slow." Slow +SQL queries are logged as warnings, to assist in debugging and tuning. Note +PuppetDB does not interrupt slow queries; it simply reports them after they +complete. + +The default value is `10` seconds. A value of 0 will disable logging of slow +queries. This option is supported in PuppetDB >= 1.1. + +####`conn_max_age` + +The maximum time (in minutes) for a pooled connection to remain unused before +it is closed off. + +If not supplied, we default to `60` minutes. This option is supported in PuppetDB >= 1.1. + +####`conn_keep_alive` + +This sets the time (in minutes) for a connection to remain idle before sending +a test query to the DB. This is useful to prevent a DB from timing out +connections on its end. + +If not supplied, we default to 45 minutes. This option is supported in PuppetDB >= 1.1. + +####`conn_lifetime` + +The maximum time (in minutes) a pooled connection should remain open. Any +connections older than this setting will be closed off. Connections currently in +use will not be affected until they are returned to the pool. + +If not supplied, we won't terminate connections based on their age alone. This +option is supported in PuppetDB >= 1.4. + +####`puppetdb_package` + +The PuppetDB package name in the package manager. Defaults to `present`. + +####`puppetdb_service` + +The name of the PuppetDB service. Defaults to `puppetdb`. + +####`puppetdb_service_status` + +Sets whether the service should be `running ` or `stopped`. When set to `stopped` the +service doesn't start on boot either. Valid values are `true`, `running`, +`false`, and `stopped`. + +####`confdir` + +The PuppetDB configuration directory. Defaults to `/etc/puppetdb/conf.d`. + +####`java_args` + +Java VM options used for overriding default Java VM options specified in +PuppetDB package. Defaults to `{}`. See +[PuppetDB Configuration](http://docs.puppetlabs.com/puppetdb/1.1/configure.html) +to get more details about the current defaults. + +For example, to set `-Xmx512m -Xms256m` options use: + + { + '-Xmx' => '512m', + '-Xms' => '256m', + } + +####`merge_default_java_args` + +Sets whether the provided java args should be merged with the defaults, or +should override the defaults. This setting is necessary if any of the defaults +are to be removed. Defaults to true. If `false`, the `java_args` in the PuppetDB +init config file will reflect only what is passed via the `java_args` param. + +####`max_threads` + +Jetty option to explicitly set `max-threads`. Defaults to `undef`, so the +PuppetDB-Jetty default is used. + +####`read_database` + +Which database backend to use for the read database. Only supports +`postgres` (default). This option is supported in PuppetDB >= 1.6. + +####`read_database_host` +*This parameter must be set to enable the PuppetDB read-database.* + +The hostname or IP address of the read database server. Defaults to `undef`. +The default is to use the regular database for reads and writes. This option is +supported in PuppetDB >= 1.6. + +####`read_database_port` + +The port that the read database server listens on. Defaults to `5432`. This +option is supported in PuppetDB >= 1.6. + +####`read_database_username` + +The name of the read database user to connect as. Defaults to `puppetdb`. This +option is supported in PuppetDB >= 1.6. + +####`read_database_password` + +The password for the read database user. Defaults to `puppetdb`. This option is +supported in PuppetDB >= 1.6. + +####`read_database_name` + +The name of the read database instance to connect to. Defaults to `puppetdb`. +This option is supported in PuppetDB >= 1.6. + +####`read_database_ssl` + +If true, PuppetDB will use SSL to connect to the postgres read database +(defaults to false). Setting up proper trust- and keystores has to be managed +outside of the PuppetDB module. This option is supported in PuppetDB >= 1.6. + +####`read_log_slow_statements` + +This sets the number of seconds before an SQL query to the read database is +considered "slow." Slow SQL queries are logged as warnings, to assist in +debugging and tuning. Note PuppetDB does not interrupt slow queries; it simply +reports them after they complete. + +The default value is 10 seconds. A value of 0 will disable logging of slow +queries. This option is supported in PuppetDB >= 1.6. + +####`read_conn_max_age` + +The maximum time (in minutes) for a pooled read database connection to remain +unused before it is closed off. + +If not supplied, we default to 60 minutes. This option is supported in PuppetDB >= 1.6. + +####`read_conn_keep_alive` + +This sets the time (in minutes) for a read database connection to remain idle +before sending a test query to the DB. This is useful to prevent a DB from +timing out connections on its end. + +If not supplied, we default to 45 minutes. This option is supported in PuppetDB >= 1.6. + +####`read_conn_lifetime` + +The maximum time (in minutes) a pooled read database connection should remain +open. Any connections older than this setting will be closed off. Connections +currently in use will not be affected until they are returned to the pool. + +If not supplied, we won't terminate connections based on their age alone. This +option is supported in PuppetDB >= 1.6. + +####`ssl_dir` + +Base directory for PuppetDB SSL configuration. Defaults to `/etc/puppetdb/ssl` +or `/etc/puppetlabs/puppetdb/ssl` for FOSS and PE respectively. + +####`ssl_set_cert_paths` + +A switch to enable or disable the management of SSL certificates in your +`jetty.ini` configuration file. + +####`ssl_cert_path` + +Path to your SSL certificate for populating `jetty.ini`. + +####`ssl_key_path` + +Path to your SSL key for populating `jetty.ini`. + +####`ssl_ca_cert_path` + +Path to your SSL CA for populating `jetty.ini`. + +####`ssl_deploy_certs` + +A boolean switch to enable or disable the management of SSL keys in your +`ssl_dir`. Default is `false`. + +####`ssl_key` + +Contents of your SSL key, as a string. + +####`ssl_cert` + +Contents of your SSL certificate, as a string. + +####`ssl_ca_cert` + +Contents of your SSL CA certificate, as a string. + +####`manage_firewall` + +If `true`, puppet will manage your iptables rules for PuppetDB via the +[puppetlabs-firewall](https://forge.puppetlabs.com/puppetlabs/firewall) class. + +####`command_threads` + +The number of command processing threads to use. Defaults to `undef`, using the +PuppetDB built-in default. + +####`store_usage` + +The amount of disk space (in MB) to allow for persistent message storage. +Defaults to `undef`, using the PuppetDB built-in default. + +####`temp_usage` + +The amount of disk space (in MB) to allow for temporary message storage. +Defaults to `undef`, using the PuppetDB built-in default. + +####`certificate_whitelist_file` + +The name of the certificate whitelist file to set up and configure in PuppetDB. Defaults to `/etc/puppetdb/certificate-whitelist` or `/etc/puppetlabs/puppetdb/certificate-whitelist` for FOSS and PE respectively. + +####`certificate_whitelist` + +Array of the X.509 certificate Common Names of clients allowed to connect to PuppetDB. Defaults to empty. Be aware that this permits full access to all Puppet clients to download anything contained in PuppetDB, including the full catalogs of all nodes, which possibly contain sensitive information. Set to `[ $::servername ]` to allow access only from your (single) Puppet master, which is enough for normal operation. Set to a list of Puppet masters if you have multiple. + + +### puppetdb::server + +The `puppetdb::server` class manages the PuppetDB server independently of the +underlying database that it depends on. It will manage the PuppetDB package, +service, config files, etc., but will still allow you to manage the database +(e.g. PostgreSQL) however you see fit. + + class { 'puppetdb::server': + database_host => 'pg1.mydomain.com', + } + +### puppetdb::master::config + +The `puppetdb::master::config` class directs your Puppet master to use PuppetDB, +which means that this class should be used on your Puppet master node. It’ll +verify that it can successfully communicate with your PuppetDB server, and then +configure your master to use PuppetDB. + +Using this class allows the module to manipulate the puppet configuration files +puppet.conf and routes.yaml. The puppet.conf changes are supplemental and should +not affect any of your existing settings, but the routes.yaml file will be +overwritten entirely. If you have an existing routes.yaml file, you will want to +take care to use the `manage_routes` parameter of this class to prevent the module +from managing that file, and you’ll need to manage it yourself. + + class { 'puppetdb::master::config': + puppetdb_server => 'my.host.name', + puppetdb_port => 8081, + } + +**Parameters within `puppetdb::master::config`:** + +####`puppetdb_server` + +The dns name or ip of the PuppetDB server. Defaults to the hostname of the +current node, i.e. `$::fqdn`. + +####`puppetdb_port` + +The port that the PuppetDB server is running on. Defaults to `8081`. + +####`puppetdb_disable_ssl` + +If true, use plain HTTP to talk to PuppetDB. Defaults to the value of +`disable_ssl` if PuppetDB is on the same server as the Puppet Master, or else +false. If you set this, you probably need to set `puppetdb_port` to match the HTTP +port of the PuppetDB. + +####`puppetdb_soft_write_failure` + +Boolean to fail in a soft manner if PuppetDB is not accessible for command +submission Defaults to `false`. + +####`manage_routes` + +If `true`, the module will overwrite the Puppet master's routes file to +configure it to use PuppetDB. Defaults to `true`. + +####`manage_storeconfigs` + +If `true`, the module will manage the Puppet master's storeconfig settings. +Defaults to `true`. + +####`manage_report_processor` + +If `true`, the module will manage the 'reports' field in the puppet.conf file to +enable or disable the PuppetDB report processor. Defaults to `false`. + +####`manage_config` + +If `true`, the module will store values from `puppetdb_server` and `puppetdb_port` +parameters in the PuppetDB configuration file. If `false`, an existing PuppetDB +configuration file will be used to retrieve server and port values. + +####`strict_validation` + +If `true`, the module will fail if PuppetDB is not reachable, otherwise it will +preconfigure PuppetDB without checking. + +####`enable_reports` + +Ignored unless `manage_report_processor` is `true`, in which case this setting +will determine whether or not the PuppetDB report processor is enabled (`true`) +or disabled (`false`) in the puppet.conf file. + +####`puppet_confdir` + +Puppet's config directory. Defaults to `/etc/puppet`. + +####`puppet_conf` + +Puppet's config file. Defaults to `/etc/puppet/puppet.conf`. + +####`masterless` + +A boolean switch to enable or disable the masterless setup of PuppetDB. Defaults +to `false`. + +####`terminus_package` + +Name of the package to use that represents the PuppetDB terminus code. Defaults +to `puppetdb-termini`, when `puppetdb_version` is set to `<= 2.3.x` the default +changes to `puppetdb-terminus`. + +####`puppet_service_name` + +Name of the service that represents Puppet. You can change this to `apache2` or +`httpd` depending on your operating system, if you plan on having Puppet run +using Apache/Passenger for example. + +####`puppetdb_startup_timeout` + +The maximum amount of time that the module should wait for PuppetDB to start up. +This is most important during the initial install of PuppetDB (defaults to 15 +seconds). + +####`restart_puppet` + +If `true`, the module will restart the Puppet master when PuppetDB configuration +files are changed by the module. Defaults to `true`. If set to `false`, you +must restart the service manually in order to pick up changes to the config +files (other than `puppet.conf`). + +### puppetdb::database::postgresql + +The `puppetdb::database::postgresql` class manages a PostgreSQL server for use +by PuppetDB. It can manage the PostgreSQL packages and service, as well as +creating and managing the PuppetDB database and database user accounts. + + class { 'puppetdb::database::postgresql': + listen_addresses => 'my.postgres.host.name', + } + +####`listen_addresses` + +The `listen_address` is a comma-separated list of hostnames or IP addresses on +which the postgres server should listen for incoming connections. This defaults +to `localhost`. This parameter maps directly to PostgreSQL's `listen_addresses` +config option. Use a `*` to allow connections on any accessible address. + +####`database_name` + +Sets the name of the database. Defaults to `puppetdb`. + +####`database_username` + +Creates a user for access the database. Defaults to `puppetdb`. + +####`database_password` + +Sets the password for the database user above. Defaults to `puppetdb`. + +####`manage_server` + +Conditionally manages the PostgreSQL server via `postgresql::server`. Defaults +to `true`. If set to `false`, this class will create the database and user via +`postgresql::server::db` but not attempt to install or manage the server itself. + +####`test_url` + +The URL to use for testing if the PuppetDB instance is running. Defaults to +`/pdb/meta/v1/version`. + +####`manage_package_repo` + +If `true`, the official postgresql.org repo will be added and postgres won't +be installed from the regular repository. Defaults to `true`. + +####`postgres_version` + +If the postgresql.org repo is installed, you can install several versions of +postgres. Defaults to `9.4`, the latest stable version. + +Implementation +--------------- + +### Resource overview + +In addition to the classes and variables mentioned above, PuppetDB includes: + +**puppetdb::master::routes** + +Configures the Puppet master to use PuppetDB as the facts terminus. *WARNING*: +the current implementation simply overwrites your routes.yaml file; if you have +an existing routes.yaml file that you are using for other purposes, you should +*not* use this. + + class { 'puppetdb::master::routes': + puppet_confdir => '/etc/puppet' + } + +The optional parameter routes can be used to specify a custom route +configuration. For example to configure routes for masterless puppet. + + class { 'puppetdb::master::routes': + routes => { + 'apply' => { + 'facts' => { + 'terminus' => 'facter', + 'cache' => 'puppetdb_apply', + } + } + } + } + +**puppetdb::master::storeconfigs** + +Configures the Puppet master to enable storeconfigs and to use PuppetDB as the +storeconfigs backend. + + class { 'puppetdb::master::storeconfigs': + puppet_conf => '/etc/puppet/puppet.conf' + } + +**puppetdb::server::validate_db** + +Validates that a successful database connection can be established between the +node on which this resource is run and the specified PuppetDB database instance +(host/port/user/password/database name). + + puppetdb::server::validate_db { 'validate my puppetdb database connection': + database_host => 'my.postgres.host', + database_username => 'mydbuser', + database_password => 'mydbpassword', + database_name => 'mydbname', + } + +### Custom Types + +**puppetdb_conn_validator** + +Verifies that a connection can be successfully established between a node and +the PuppetDB server. Its primary use is as a precondition to prevent +configuration changes from being applied if the PuppetDB server cannot be +reached, but it could potentially be used for other purposes such as monitoring. + +Limitations +------------ + +Currently, PuppetDB is compatible with: + + Puppet Version: 3.7.1+ + +Platforms: +* EL 5, 6, 7 +* Debian 6, 7 +* Ubuntu 10.04, 12.04, 14.04 + +Community Maintained Platforms: +* Archlinux +* OpenBSD 5.6-current and newer +* SLES 11 SP1 + +Development +------------ + +Puppet Labs modules on the Puppet Forge are open projects, and community +contributions are essential for keeping them great. We can’t access the huge +number of platforms and myriad of hardware, software, and deployment +configurations that Puppet is intended to serve. + +We want to keep it as easy as possible to contribute changes so that our modules +work in your environment. There are a few guidelines that we need contributors +to follow so that we can have a chance of keeping on top of things. + +You can read the complete contribution guide +[on the Puppet Labs documentation website](https://docs.puppetlabs.com/contribute.html) diff --git a/environments/production/modules/puppetdb/checksums.json b/environments/production/modules/puppetdb/checksums.json new file mode 100644 index 0000000..f1941d1 --- /dev/null +++ b/environments/production/modules/puppetdb/checksums.json @@ -0,0 +1,33 @@ +{ + "CHANGELOG": "764a46f2da4fdbb49de812e242256fd7", + "LICENSE": "3b83ef96387f14655fc854ddc3c6bd57", + "NOTICE": "e328e215444c49e8425213e4f20b3617", + "README.md": "f1e5fd8f30c3c61ed367153500e97a71", + "lib/puppet/parser/functions/puppetdb_create_subsetting_resource_hash.rb": "c5109c8f035513f2dcbedffb414efe31", + "lib/puppet/parser/functions/puppetdb_flatten_java_args.rb": "d5daa06bab4940dbb513064a727c2f2b", + "lib/puppet/provider/puppetdb_conn_validator/puppet_https.rb": "40b6ae8ad2ab349f6e18121a214d70e9", + "lib/puppet/type/puppetdb_conn_validator.rb": "7cd8ca3e42a353a4b14db2c3f59084d7", + "lib/puppet/util/puppetdb_validator.rb": "51048ac552af93e83dff772391f5d07f", + "manifests/database/postgresql.pp": "5ef010fa2ef4b91a39153f8d2794b966", + "manifests/globals.pp": "194ca5e15dc2d828fd7e04a45b532c46", + "manifests/init.pp": "705ca15b0ec399e199a6082a9da4712c", + "manifests/master/config.pp": "c042e6464b022b33ce86994f5956eb17", + "manifests/master/puppetdb_conf.pp": "8519c7a3aaa6ff3134a29d42c15593e2", + "manifests/master/report_processor.pp": "d537899480e947bbf5c8d1a655efedd4", + "manifests/master/routes.pp": "5f888c12808c597ea9155537ecad33e2", + "manifests/master/storeconfigs.pp": "0cff34b35642e4c86201284095906376", + "manifests/params.pp": "b9e0d7afe8b8a6d9ecff84b5f149d3cd", + "manifests/server/command_processing.pp": "9da99d848b0502c2ca282f6fc6de07c4", + "manifests/server/database.pp": "0e57f6dcf04f67fdd799e383d85f711b", + "manifests/server/firewall.pp": "f5caf4ba95248040cf46a608dadacc32", + "manifests/server/global.pp": "6eae9edda5abd18af36e5fbc9805d592", + "manifests/server/jetty.pp": "27eb3126dd7fb6bca8e39b04eba5eaef", + "manifests/server/puppetdb.pp": "8db0a55e951593e6817e80e8fe49099e", + "manifests/server/read_database.pp": "37f9c6912a821f70938cd22995e80c6c", + "manifests/server/validate_db.pp": "28cf9760e5b6ce4a30c14ce2bc717274", + "manifests/server/validate_read_db.pp": "0ea306919029b230069d632a4b1d4883", + "manifests/server.pp": "89c9042305190b2855f98f1599d07db2", + "metadata.json": "c98a279b73e409efc9ec2267716b561b", + "templates/certificate-whitelist.erb": "2a7946e04f6a32e765d6bbbd624a7361", + "templates/routes.yaml.erb": "e66935085e7f4146c4c9b944a45b838d" +} \ No newline at end of file diff --git a/environments/production/modules/puppetdb/lib/puppet/parser/functions/puppetdb_create_subsetting_resource_hash.rb b/environments/production/modules/puppetdb/lib/puppet/parser/functions/puppetdb_create_subsetting_resource_hash.rb new file mode 100644 index 0000000..7cff4ca --- /dev/null +++ b/environments/production/modules/puppetdb/lib/puppet/parser/functions/puppetdb_create_subsetting_resource_hash.rb @@ -0,0 +1,15 @@ +module Puppet::Parser::Functions + newfunction(:puppetdb_create_subsetting_resource_hash, :type => :rvalue) do |args| + java_args = args[0] + params = args[1] + resource_hash = {} + + java_args.each { |k,v| + item_params = { 'subsetting' => k, 'value' => (v || '') } + item_params.merge!(params) + resource_hash.merge!({ "'#{k}'" => item_params }) + } + + resource_hash + end +end diff --git a/environments/production/modules/puppetdb/lib/puppet/parser/functions/puppetdb_flatten_java_args.rb b/environments/production/modules/puppetdb/lib/puppet/parser/functions/puppetdb_flatten_java_args.rb new file mode 100644 index 0000000..725af2d --- /dev/null +++ b/environments/production/modules/puppetdb/lib/puppet/parser/functions/puppetdb_flatten_java_args.rb @@ -0,0 +1,8 @@ +module Puppet::Parser::Functions + newfunction(:puppetdb_flatten_java_args, :type => :rvalue) do |args| + java_args = args[0] || {} + args = "" + java_args.each {|k,v| args += "#{k}#{v} "} + "\"#{args.chomp(' ')}\"" + end +end diff --git a/environments/production/modules/puppetdb/lib/puppet/provider/puppetdb_conn_validator/puppet_https.rb b/environments/production/modules/puppetdb/lib/puppet/provider/puppetdb_conn_validator/puppet_https.rb new file mode 100644 index 0000000..e795d62 --- /dev/null +++ b/environments/production/modules/puppetdb/lib/puppet/provider/puppetdb_conn_validator/puppet_https.rb @@ -0,0 +1,72 @@ +# See: #10295 for more details. +# +# This is a workaround for bug: #4248 whereby ruby files outside of the normal +# provider/type path do not load until pluginsync has occured on the puppetmaster +# +# In this case I'm trying the relative path first, then falling back to normal +# mechanisms. This should be fixed in future versions of puppet but it looks +# like we'll need to maintain this for some time perhaps. +$LOAD_PATH.unshift(File.join(File.dirname(__FILE__),"..","..","..")) +require 'puppet/util/puppetdb_validator' + +# This file contains a provider for the resource type `puppetdb_conn_validator`, +# which validates the puppetdb connection by attempting an https connection. + +Puppet::Type.type(:puppetdb_conn_validator).provide(:puppet_https) do + desc "A provider for the resource type `puppetdb_conn_validator`, + which validates the puppetdb connection by attempting an http(s) + connection to the puppetdb server. Uses the puppet SSL certificate + setup from the local puppet environment to authenticate if use_ssl + is set to true." + + # Test to see if the resource exists, returns true if it does, false if it + # does not. + # + # Here we simply monopolize the resource API, to execute a test to see if the + # database is connectable. When we return a state of `false` it triggers the + # create method where we can return an error message. + # + # @return [bool] did the test succeed? + def exists? + start_time = Time.now + timeout = resource[:timeout] + + success = validator.attempt_connection + + while success == false && ((Time.now - start_time) < timeout) + # It can take several seconds for the puppetdb server to start up; + # especially on the first install. Therefore, our first connection attempt + # may fail. Here we have somewhat arbitrarily chosen to retry every 2 + # seconds until the configurable timeout has expired. + Puppet.notice("Failed to connect to puppetdb; sleeping 2 seconds before retry") + sleep 2 + success = validator.attempt_connection + end + + unless success + Puppet.notice("Failed to connect to puppetdb within timeout window of #{timeout} seconds; giving up.") + end + + success + end + + # This method is called when the exists? method returns false. + # + # @return [void] + def create + # If `#create` is called, that means that `#exists?` returned false, which + # means that the connection could not be established... so we need to + # cause a failure here. + raise Puppet::Error, "Unable to connect to puppetdb server! (#{@validator.puppetdb_server}:#{@validator.puppetdb_port})" + end + + # Returns the existing validator, if one exists otherwise creates a new object + # from the class. + # + # @api private + def validator + @validator ||= Puppet::Util::PuppetdbValidator.new(resource[:puppetdb_server], resource[:puppetdb_port], resource[:use_ssl], resource[:test_url]) + end + +end + diff --git a/environments/production/modules/puppetdb/lib/puppet/type/puppetdb_conn_validator.rb b/environments/production/modules/puppetdb/lib/puppet/type/puppetdb_conn_validator.rb new file mode 100644 index 0000000..78cb07a --- /dev/null +++ b/environments/production/modules/puppetdb/lib/puppet/type/puppetdb_conn_validator.rb @@ -0,0 +1,49 @@ +Puppet::Type.newtype(:puppetdb_conn_validator) do + + @doc = "Verify that a connection can be successfully established between a node + and the puppetdb server. Its primary use is as a precondition to + prevent configuration changes from being applied if the puppetdb + server cannot be reached, but it could potentially be used for other + purposes such as monitoring." + + ensurable do + defaultvalues + defaultto :present + end + + newparam(:name, :namevar => true) do + desc 'An arbitrary name used as the identity of the resource.' + end + + newparam(:puppetdb_server) do + desc 'The DNS name or IP address of the server where puppetdb should be running.' + end + + newparam(:puppetdb_port) do + desc 'The port that the puppetdb server should be listening on.' + end + + newparam(:use_ssl) do + desc 'Whether the connection will be attemped using https' + defaultto true + end + + newparam(:test_url) do + desc 'URL to use for testing if the PuppetDB database is up' + end + + newparam(:timeout) do + desc 'The max number of seconds that the validator should wait before giving up and deciding that puppetdb is not running; defaults to 15 seconds.' + defaultto 15 + + validate do |value| + # This will raise an error if the string is not convertible to an integer + Integer(value) + end + + munge do |value| + Integer(value) + end + end + +end diff --git a/environments/production/modules/puppetdb/lib/puppet/util/puppetdb_validator.rb b/environments/production/modules/puppetdb/lib/puppet/util/puppetdb_validator.rb new file mode 100644 index 0000000..fca0e5c --- /dev/null +++ b/environments/production/modules/puppetdb/lib/puppet/util/puppetdb_validator.rb @@ -0,0 +1,45 @@ +require 'puppet/network/http_pool' + +module Puppet + module Util + # Validator class, for testing that PuppetDB is alive + class PuppetdbValidator + attr_reader :puppetdb_server + attr_reader :puppetdb_port + attr_reader :use_ssl + attr_reader :test_path + attr_reader :test_headers + + def initialize(puppetdb_server, puppetdb_port, use_ssl=true, test_path = "/pdb/meta/v1/version") + @puppetdb_server = puppetdb_server + @puppetdb_port = puppetdb_port + @use_ssl = use_ssl + @test_path = test_path + @test_headers = { "Accept" => "application/json" } + end + + # Utility method; attempts to make an http/https connection to the puppetdb server. + # This is abstracted out into a method so that it can be called multiple times + # for retry attempts. + # + # @return true if the connection is successful, false otherwise. + def attempt_connection + # All that we care about is that we are able to connect successfully via + # http(s), so here we're simpling hitting a somewhat arbitrary low-impact URL + # on the puppetdb server. + conn = Puppet::Network::HttpPool.http_instance(puppetdb_server, puppetdb_port, use_ssl) + + response = conn.get(test_path, test_headers) + unless response.kind_of?(Net::HTTPSuccess) + Puppet.notice "Unable to connect to puppetdb server (http#{use_ssl ? "s" : ""}://#{puppetdb_server}:#{puppetdb_port}): [#{response.code}] #{response.msg}" + return false + end + return true + rescue Exception => e + Puppet.notice "Unable to connect to puppetdb server (http#{use_ssl ? "s" : ""}://#{puppetdb_server}:#{puppetdb_port}): #{e.message}" + return false + end + end + end +end + diff --git a/environments/production/modules/puppetdb/manifests/database/postgresql.pp b/environments/production/modules/puppetdb/manifests/database/postgresql.pp new file mode 100644 index 0000000..c38993e --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/database/postgresql.pp @@ -0,0 +1,33 @@ +# Class for creating the PuppetDB postgresql database. See README.md for more +# information. +class puppetdb::database::postgresql( + $listen_addresses = $puppetdb::params::database_host, + $database_name = $puppetdb::params::database_name, + $database_username = $puppetdb::params::database_username, + $database_password = $puppetdb::params::database_password, + $database_port = $puppetdb::params::database_port, + $manage_server = $puppetdb::params::manage_dbserver, + $manage_package_repo = $puppetdb::params::manage_pg_repo, + $postgres_version = $puppetdb::params::postgres_version, +) inherits puppetdb::params { + + if $manage_server { + class { '::postgresql::globals': + manage_package_repo => $manage_package_repo, + version => $postgres_version, + } + # get the pg server up and running + class { '::postgresql::server': + ip_mask_allow_all_users => '0.0.0.0/0', + listen_addresses => $listen_addresses, + port => $database_port, + } + } + + # create the puppetdb database + postgresql::server::db { $database_name: + user => $database_username, + password => $database_password, + grant => 'all', + } +} diff --git a/environments/production/modules/puppetdb/manifests/globals.pp b/environments/production/modules/puppetdb/manifests/globals.pp new file mode 100644 index 0000000..833695d --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/globals.pp @@ -0,0 +1,11 @@ +# Global configuration class for PuppetDB. See README.md for more details. +class puppetdb::globals ( + $version = 'present', + $database = 'postgres', + ) { + + if !($::osfamily in ['RedHat', 'Suse', 'Archlinux', 'Debian', 'OpenBSD', 'FreeBSD']) { + fail("${module_name} does not support your osfamily ${::osfamily}") + } + +} diff --git a/environments/production/modules/puppetdb/manifests/init.pp b/environments/production/modules/puppetdb/manifests/init.pp new file mode 100644 index 0000000..96eba23 --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/init.pp @@ -0,0 +1,161 @@ +# All in one class for setting up a PuppetDB instance. See README.md for more +# details. +class puppetdb ( + $listen_address = $puppetdb::params::listen_address, + $listen_port = $puppetdb::params::listen_port, + $disable_cleartext = $puppetdb::params::disable_cleartext, + $open_listen_port = $puppetdb::params::open_listen_port, + $ssl_listen_address = $puppetdb::params::ssl_listen_address, + $ssl_listen_port = $puppetdb::params::ssl_listen_port, + $disable_ssl = $puppetdb::params::disable_ssl, + $open_ssl_listen_port = $puppetdb::params::open_ssl_listen_port, + $ssl_dir = $puppetdb::params::ssl_dir, + $ssl_set_cert_paths = $puppetdb::params::ssl_set_cert_paths, + $ssl_cert_path = $puppetdb::params::ssl_cert_path, + $ssl_key_path = $puppetdb::params::ssl_key_path, + $ssl_ca_cert_path = $puppetdb::params::ssl_ca_cert_path, + $ssl_deploy_certs = $puppetdb::params::ssl_deploy_certs, + $ssl_key = $puppetdb::params::ssl_key, + $ssl_cert = $puppetdb::params::ssl_cert, + $ssl_ca_cert = $puppetdb::params::ssl_ca_cert, + $ssl_protocols = $puppetdb::params::ssl_protocols, + $manage_dbserver = $puppetdb::params::manage_dbserver, + $manage_package_repo = $puppetdb::params::manage_pg_repo, + $postgres_version = $puppetdb::params::postgres_version, + $database = $puppetdb::params::database, + $database_host = $puppetdb::params::database_host, + $database_port = $puppetdb::params::database_port, + $database_username = $puppetdb::params::database_username, + $database_password = $puppetdb::params::database_password, + $database_name = $puppetdb::params::database_name, + $database_ssl = $puppetdb::params::database_ssl, + $jdbc_ssl_properties = $puppetdb::params::jdbc_ssl_properties, + $database_listen_address = $puppetdb::params::postgres_listen_addresses, + $database_validate = $puppetdb::params::database_validate, + $database_embedded_path = $puppetdb::params::database_embedded_path, + $node_ttl = $puppetdb::params::node_ttl, + $node_purge_ttl = $puppetdb::params::node_purge_ttl, + $report_ttl = $puppetdb::params::report_ttl, + $gc_interval = $puppetdb::params::gc_interval, + $log_slow_statements = $puppetdb::params::log_slow_statements, + $conn_max_age = $puppetdb::params::conn_max_age, + $conn_keep_alive = $puppetdb::params::conn_keep_alive, + $conn_lifetime = $puppetdb::params::conn_lifetime, + $puppetdb_package = $puppetdb::params::puppetdb_package, + $puppetdb_service = $puppetdb::params::puppetdb_service, + $puppetdb_service_status = $puppetdb::params::puppetdb_service_status, + $puppetdb_user = $puppetdb::params::puppetdb_user, + $puppetdb_group = $puppetdb::params::puppetdb_group, + $read_database = $puppetdb::params::read_database, + $read_database_host = $puppetdb::params::read_database_host, + $read_database_port = $puppetdb::params::read_database_port, + $read_database_username = $puppetdb::params::read_database_username, + $read_database_password = $puppetdb::params::read_database_password, + $read_database_name = $puppetdb::params::read_database_name, + $read_database_ssl = $puppetdb::params::read_database_ssl, + $read_database_jdbc_ssl_properties = $puppetdb::params::read_database_jdbc_ssl_properties, + $read_database_validate = $puppetdb::params::read_database_validate, + $read_log_slow_statements = $puppetdb::params::read_log_slow_statements, + $read_conn_max_age = $puppetdb::params::read_conn_max_age, + $read_conn_keep_alive = $puppetdb::params::read_conn_keep_alive, + $read_conn_lifetime = $puppetdb::params::read_conn_lifetime, + $confdir = $puppetdb::params::confdir, + $manage_firewall = $puppetdb::params::manage_firewall, + $java_args = $puppetdb::params::java_args, + $merge_default_java_args = $puppetdb::params::merge_default_java_args, + $max_threads = $puppetdb::params::max_threads, + $command_threads = $puppetdb::params::command_threads, + $store_usage = $puppetdb::params::store_usage, + $temp_usage = $puppetdb::params::temp_usage, + $certificate_whitelist_file = $puppetdb::params::certificate_whitelist_file, + $certificate_whitelist = $puppetdb::params::certificate_whitelist, +) inherits puppetdb::params { + + class { '::puppetdb::server': + listen_address => $listen_address, + listen_port => $listen_port, + disable_cleartext => $disable_cleartext, + open_listen_port => $open_listen_port, + ssl_listen_address => $ssl_listen_address, + ssl_listen_port => $ssl_listen_port, + disable_ssl => $disable_ssl, + open_ssl_listen_port => $open_ssl_listen_port, + ssl_dir => $ssl_dir, + ssl_set_cert_paths => $ssl_set_cert_paths, + ssl_cert_path => $ssl_cert_path, + ssl_key_path => $ssl_key_path, + ssl_ca_cert_path => $ssl_ca_cert_path, + ssl_deploy_certs => $ssl_deploy_certs, + ssl_key => $ssl_key, + ssl_cert => $ssl_cert, + ssl_ca_cert => $ssl_ca_cert, + ssl_protocols => $ssl_protocols, + database => $database, + database_host => $database_host, + database_port => $database_port, + database_username => $database_username, + database_password => $database_password, + database_name => $database_name, + database_ssl => $database_ssl, + jdbc_ssl_properties => $jdbc_ssl_properties, + database_validate => $database_validate, + database_embedded_path => $database_embedded_path, + node_ttl => $node_ttl, + node_purge_ttl => $node_purge_ttl, + report_ttl => $report_ttl, + gc_interval => $gc_interval, + log_slow_statements => $log_slow_statements, + conn_max_age => $conn_max_age, + conn_keep_alive => $conn_keep_alive, + conn_lifetime => $conn_lifetime, + puppetdb_package => $puppetdb_package, + puppetdb_service => $puppetdb_service, + puppetdb_service_status => $puppetdb_service_status, + confdir => $confdir, + java_args => $java_args, + merge_default_java_args => $merge_default_java_args, + max_threads => $max_threads, + read_database => $read_database, + read_database_host => $read_database_host, + read_database_port => $read_database_port, + read_database_username => $read_database_username, + read_database_password => $read_database_password, + read_database_name => $read_database_name, + read_database_ssl => $read_database_ssl, + read_database_jdbc_ssl_properties => $read_database_jdbc_ssl_properties, + read_database_validate => $read_database_validate, + read_log_slow_statements => $read_log_slow_statements, + read_conn_max_age => $read_conn_max_age, + read_conn_keep_alive => $read_conn_keep_alive, + read_conn_lifetime => $read_conn_lifetime, + puppetdb_user => $puppetdb_user, + puppetdb_group => $puppetdb_group, + manage_firewall => $manage_firewall, + command_threads => $command_threads, + store_usage => $store_usage, + temp_usage => $temp_usage, + certificate_whitelist_file => $certificate_whitelist_file, + certificate_whitelist => $certificate_whitelist, + } + + if ($database == 'postgres') { + + $database_before = str2bool($database_validate) ? { + false => Class['::puppetdb::server'], + default => [Class['::puppetdb::server'], + Class['::puppetdb::server::validate_db']], + } + + class { '::puppetdb::database::postgresql': + listen_addresses => $database_listen_address, + database_name => $database_name, + database_username => $database_username, + database_password => $database_password, + database_port => $database_port, + manage_server => $manage_dbserver, + manage_package_repo => $manage_package_repo, + postgres_version => $postgres_version, + before => $database_before + } + } +} diff --git a/environments/production/modules/puppetdb/manifests/master/config.pp b/environments/production/modules/puppetdb/manifests/master/config.pp new file mode 100644 index 0000000..469dbdf --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/master/config.pp @@ -0,0 +1,184 @@ +# Manage puppet configuration. See README.md for more details. +class puppetdb::master::config ( + $puppetdb_server = $::fqdn, + $puppetdb_port = defined(Class['puppetdb']) ? { + true => $::puppetdb::disable_ssl ? { + true => 8080, + default => 8081, + }, + default => 8081, + }, + $puppetdb_disable_ssl = defined(Class['puppetdb']) ? { + true => $::puppetdb::disable_ssl, + default => false, + }, + $masterless = $puppetdb::params::masterless, + $puppetdb_soft_write_failure = false, + $manage_routes = true, + $manage_storeconfigs = true, + $manage_report_processor = false, + $manage_config = true, + $strict_validation = true, + $enable_reports = false, + $puppet_confdir = $puppetdb::params::puppet_confdir, + $puppet_conf = $puppetdb::params::puppet_conf, + $terminus_package = $puppetdb::params::terminus_package, + $puppet_service_name = $puppetdb::params::puppet_service_name, + $puppetdb_startup_timeout = $puppetdb::params::puppetdb_startup_timeout, + $test_url = $puppetdb::params::test_url, + $restart_puppet = true, +) inherits puppetdb::params { + + # **WARNING**: Ugly hack to work around a yum bug with metadata parsing. This + # should not be copied, replicated or even looked at. In short, never rename + # your packages... + # + # With `yum` we can't have the termini package override the terminus package + # because that would prevent users from installing v2.3 of the terminus in + # PC1. We tried using a dummy terminus-3 metadata package which pulled in + # termini-3.latest as a dependency and put a requires terminus >= 3, <4. The + # idea was that doing `yum install puppetdb-termini-3.x.y-1.el7` would pull up + # the terminus package to the dummy 3 version, but `yum` has a bug which + # requires that both the dummy package and termini be installed in the same + # transaction, i.e. `yum install puppetdb-termini-3.x.y-1.el7 + # puppetdb-terminus-3` which is impossible to do via Puppet. + # + # This will orphan some old terminus files (from pre-puppet-agent, i.e. puppet + # 3.x) that are orphaned as part of the Puppet 3 to Puppet 4 upgrade anyways + # and some of the new terminus files temporarily. If this exec fails all you + # need to do is reinstall whatever 2.3 version of the terminus was already + # installed to revert the change. + if !($puppetdb::params::puppetdb_version in ['present','absent']) + and versioncmp($puppetdb::params::puppetdb_version, '3.0.0') >= 0 + and $::osfamily in ['RedHat','Suse'] { + exec { 'Remove puppetdb-terminus metadata for upgrade': + command => 'rpm -e --justdb puppetdb-terminus', + path => '/sbin/:/bin/', + onlyif => 'rpm -q puppetdb-terminus', + before => Package[$terminus_package], + } + } + + package { $terminus_package: + ensure => $puppetdb::params::puppetdb_version, + } + + if ($strict_validation) { + + # Validate the puppetdb connection. If we can't connect to puppetdb then we + # *must* not perform the other configuration steps, or else + + $conn_puppetdb_server = $manage_config ? { + true => $puppetdb_server, + default => undef, + } + $conn_puppetdb_port = $manage_config ? { + true => $puppetdb_port, + default => undef, + } + $conn_puppetdb_ssl = $puppetdb_disable_ssl ? { + true => false, + default => true, + } + + puppetdb_conn_validator { 'puppetdb_conn': + puppetdb_server => $conn_puppetdb_server, + puppetdb_port => $conn_puppetdb_port, + use_ssl => $conn_puppetdb_ssl, + timeout => $puppetdb_startup_timeout, + require => Package[$terminus_package], + test_url => $test_url, + } + + # This is a bit of puppet chicanery that allows us to create a + # conditional dependency. Basically, we're saying that "if the PuppetDB + # service is being managed in this same catalog, it needs to come before + # this validator." + Service<|title == $puppetdb::params::puppetdb_service|> -> Puppetdb_conn_validator['puppetdb_conn'] + } + + # Conditionally manage the `routes.yaml` file. Restart the puppet service + # if changes are made. + if ($manage_routes) { + $routes_require = $strict_validation ? { + true => Puppetdb_conn_validator['puppetdb_conn'], + default => Package[$terminus_package], + } + + class { 'puppetdb::master::routes': + puppet_confdir => $puppet_confdir, + masterless => $masterless, + require => $routes_require, + } + } + + # Conditionally manage the storeconfigs settings in `puppet.conf`. We don't + # need to trigger a restart of the puppet master service for this one, because + # it polls it automatically. + if ($manage_storeconfigs) { + $storeconfigs_require = $strict_validation ? { + true => Puppetdb_conn_validator['puppetdb_conn'], + default => Package[$terminus_package], + } + + class { 'puppetdb::master::storeconfigs': + puppet_conf => $puppet_conf, + masterless => $masterless, + require => $storeconfigs_require, + } + } + + # Conditionally manage the puppetdb report processor setting in `puppet.conf`. + # We don't need to trigger a restart of the puppet master service for this one, + # because it polls it automatically. + if ($manage_report_processor) { + $report_processor_require = $strict_validation ? { + true => Puppetdb_conn_validator['puppetdb_conn'], + default => Package[$terminus_package], + } + + class { 'puppetdb::master::report_processor': + puppet_conf => $puppet_conf, + masterless => $masterless, + enable => $enable_reports, + require => $report_processor_require, + } + } + + if ($manage_config) { + # Manage the `puppetdb.conf` file. Restart the puppet service if changes + # are made. + $puppetdb_conf_require = $strict_validation ? { + true => Puppetdb_conn_validator['puppetdb_conn'], + default => Package[$terminus_package], + } + + class { 'puppetdb::master::puppetdb_conf': + server => $puppetdb_server, + port => $puppetdb_port, + soft_write_failure => $puppetdb_soft_write_failure, + puppet_confdir => $puppet_confdir, + legacy_terminus => $puppetdb::params::terminus_package == 'puppetdb-terminus', + require => $puppetdb_conf_require, + } + } + + if ($restart_puppet) { + # We will need to restart the puppet master service if certain config + # files are changed, so here we make sure it's in the catalog. + if ! defined(Service[$puppet_service_name]) { + service { $puppet_service_name: + ensure => running, + } + } + + if ($manage_config) { + Class['puppetdb::master::puppetdb_conf'] ~> Service[$puppet_service_name] + } + + if ($manage_routes) { + Class['puppetdb::master::routes'] ~> Service[$puppet_service_name] + } + } + +} diff --git a/environments/production/modules/puppetdb/manifests/master/puppetdb_conf.pp b/environments/production/modules/puppetdb/manifests/master/puppetdb_conf.pp new file mode 100644 index 0000000..a3dd72f --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/master/puppetdb_conf.pp @@ -0,0 +1,43 @@ +# Manage the puppetdb.conf file on the puppeet master. See README.md for more +# details. +class puppetdb::master::puppetdb_conf ( + $server = 'localhost', + $port = '8081', + $soft_write_failure = $puppetdb::disable_ssl ? { + true => true, + default => false, + }, + $puppet_confdir = $puppetdb::params::puppet_confdir, + $legacy_terminus = $puppetdb::params::terminus_package ? { + /(puppetdb-terminus)/ => true, + default => false, + }, + ) inherits puppetdb::params { + + Ini_setting { + ensure => present, + section => 'main', + path => "${puppet_confdir}/puppetdb.conf", + } + + if $legacy_terminus { + ini_setting { 'puppetdbserver': + setting => 'server', + value => $server, + } + ini_setting { 'puppetdbport': + setting => 'port', + value => $port, + } + } else { + ini_setting { 'puppetdbserver_urls': + setting => 'server_urls', + value => "https://${server}:${port}/", + } + } + + ini_setting { 'soft_write_failure': + setting => 'soft_write_failure', + value => $soft_write_failure, + } +} diff --git a/environments/production/modules/puppetdb/manifests/master/report_processor.pp b/environments/production/modules/puppetdb/manifests/master/report_processor.pp new file mode 100644 index 0000000..f97130b --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/master/report_processor.pp @@ -0,0 +1,28 @@ +# Manage the installation of the report processor on the master. See README.md +# for more details. +class puppetdb::master::report_processor ( + $puppet_conf = $puppetdb::params::puppet_conf, + $masterless = $puppetdb::params::masterless, + $enable = false +) inherits puppetdb::params { + + if $masterless { + $puppet_conf_section = 'main' + } else { + $puppet_conf_section = 'master' + } + + $puppetdb_ensure = $enable ? { + true => present, + default => absent, + } + + ini_subsetting { 'puppet.conf/reports/puppetdb': + ensure => $puppetdb_ensure, + path => $puppet_conf, + section => $puppet_conf_section, + setting => 'reports', + subsetting => 'puppetdb', + subsetting_separator => ',', + } +} diff --git a/environments/production/modules/puppetdb/manifests/master/routes.pp b/environments/production/modules/puppetdb/manifests/master/routes.pp new file mode 100644 index 0000000..2a94d0c --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/master/routes.pp @@ -0,0 +1,43 @@ +# Manages the routes configuration file on the master. See README.md for more +# details. +class puppetdb::master::routes ( + $puppet_confdir = $puppetdb::params::puppet_confdir, + $masterless = $puppetdb::params::masterless, + $routes = { + 'master' => { + 'facts' => { + 'terminus' => 'puppetdb', + 'cache' => 'yaml', + } + } + } +) inherits puppetdb::params { + + if $masterless { + $routes_real = { + 'apply' => { + 'catalog' => { + 'terminus' => 'compiler', + 'cache' => 'puppetdb', + }, + 'facts' => { + 'terminus' => 'facter', + 'cache' => 'puppetdb_apply', + } + } + } + } else { + $routes_real = $routes + } + + # TODO: this will overwrite any existing routes.yaml; + # to handle this properly we should just be ensuring + # that the proper settings exist, but to do that we'd need + # to parse the yaml file and rewrite it, dealing with indentation issues etc + # I don't think there is currently a puppet module or an augeas lens for + # this. + file { "${puppet_confdir}/routes.yaml": + ensure => file, + content => template('puppetdb/routes.yaml.erb'), + } +} diff --git a/environments/production/modules/puppetdb/manifests/master/storeconfigs.pp b/environments/production/modules/puppetdb/manifests/master/storeconfigs.pp new file mode 100644 index 0000000..fff365b --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/master/storeconfigs.pp @@ -0,0 +1,29 @@ +# This class configures the puppet master to enable storeconfigs and to use +# puppetdb as the storeconfigs backend. See README.md for more details. +class puppetdb::master::storeconfigs ( + $puppet_conf = $puppetdb::params::puppet_conf, + $masterless = $puppetdb::params::masterless, +) inherits puppetdb::params { + + if $masterless { + $puppet_conf_section = 'main' + } else { + $puppet_conf_section = 'master' + } + + Ini_setting { + section => $puppet_conf_section, + path => $puppet_conf, + ensure => present, + } + + ini_setting { "puppet.conf/${puppet_conf_section}/storeconfigs": + setting => 'storeconfigs', + value => true, + } + + ini_setting { "puppet.conf/${puppet_conf_section}/storeconfigs_backend": + setting => 'storeconfigs_backend', + value => 'puppetdb', + } +} diff --git a/environments/production/modules/puppetdb/manifests/params.pp b/environments/production/modules/puppetdb/manifests/params.pp new file mode 100644 index 0000000..9079705 --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/params.pp @@ -0,0 +1,167 @@ +# PRIVATE CLASS - do not use directly +# +# The puppetdb default configuration settings. +class puppetdb::params inherits puppetdb::globals { + $listen_address = 'localhost' + $listen_port = '8080' + $disable_cleartext = false + $open_listen_port = false + $ssl_listen_address = '0.0.0.0' + $ssl_listen_port = '8081' + $ssl_protocols = undef + $disable_ssl = false + $open_ssl_listen_port = undef + $postgres_listen_addresses = 'localhost' + + $puppetdb_version = $puppetdb::globals::version + $database = $puppetdb::globals::database + $manage_dbserver = true + $manage_pg_repo = true + $postgres_version = '9.4' + + # The remaining database settings are not used for an embedded database + $database_host = 'localhost' + $database_port = '5432' + $database_name = 'puppetdb' + $database_username = 'puppetdb' + $database_password = 'puppetdb' + $database_ssl = undef + $jdbc_ssl_properties = '' + $database_validate = true + + # These settings manage the various auto-deactivation and auto-purge settings + $node_ttl = '0s' + $node_purge_ttl = '0s' + $report_ttl = '14d' + + $gc_interval = '60' + + $log_slow_statements = '10' + $conn_max_age = '60' + $conn_keep_alive = '45' + $conn_lifetime = '0' + + $max_threads = undef + + # These settings are for the read database + $read_database = 'postgres' + $read_database_host = undef + $read_database_port = '5432' + $read_database_name = 'puppetdb' + $read_database_username = 'puppetdb' + $read_database_password = 'puppetdb' + $read_database_ssl = undef + $read_database_jdbc_ssl_properties = '' + $read_database_validate = true + $read_log_slow_statements = '10' + $read_conn_max_age = '60' + $read_conn_keep_alive = '45' + $read_conn_lifetime = '0' + + $manage_firewall = true + $java_args = {} + $merge_default_java_args = true + + $puppetdb_package = 'puppetdb' + $puppetdb_service = 'puppetdb' + $puppetdb_user = 'puppetdb' + $puppetdb_group = 'puppetdb' + $masterless = false + + if !($puppetdb_version in ['latest','present','absent']) and versioncmp($puppetdb_version, '3.0.0') < 0 { + case $::osfamily { + 'RedHat', 'Suse', 'Archlinux','Debian': { + $etcdir = '/etc/puppetdb' + $vardir = '/var/lib/puppetdb' + $database_embedded_path = "${vardir}/db/db" + $puppet_confdir = pick($settings::confdir,'/etc/puppet') + $puppet_service_name = 'puppetmaster' + } + 'OpenBSD': { + $etcdir = '/etc/puppetdb' + $vardir = '/var/db/puppetdb' + $database_embedded_path = "${vardir}/db/db" + $puppet_confdir = pick($settings::confdir,'/etc/puppet') + $puppet_service_name = 'puppetmasterd' + } + 'FreeBSD': { + $etcdir = '/usr/local/etc/puppetdb' + $vardir = '/var/db/puppetdb' + $database_embedded_path = "${vardir}/db/db" + $puppet_confdir = pick($settings::confdir,'/usr/local/etc/puppet') + $puppet_service_name = 'puppetmaster' + } + default: { + fail("The fact 'osfamily' is set to ${::osfamily} which is not supported by the puppetdb module.") + } + } + $terminus_package = 'puppetdb-terminus' + $test_url = '/v3/version' + } else { + case $::osfamily { + 'RedHat', 'Suse', 'Archlinux','Debian': { + $etcdir = '/etc/puppetlabs/puppetdb' + $puppet_confdir = pick($settings::confdir,'/etc/puppetlabs/puppet') + $puppet_service_name = 'puppetserver' + } + 'OpenBSD': { + $etcdir = '/etc/puppetlabs/puppetdb' + $puppet_confdir = pick($settings::confdir,'/etc/puppetlabs/puppet') + $puppet_service_name = undef + } + 'FreeBSD': { + $etcdir = '/usr/local/etc/puppetlabs/puppetdb' + $puppet_confdir = pick($settings::confdir,'/usr/local/etc/puppetlabs/puppet') + $puppet_service_name = undef + } + default: { + fail("The fact 'osfamily' is set to ${::osfamily} which is not supported by the puppetdb module.") + } + } + $terminus_package = 'puppetdb-termini' + $test_url = '/pdb/meta/v1/version' + $vardir = '/opt/puppetlabs/server/data/puppetdb' + $database_embedded_path = "${vardir}/db/db" + } + + $confdir = "${etcdir}/conf.d" + $ssl_dir = "${etcdir}/ssl" + + case $::osfamily { + 'RedHat', 'Suse', 'Archlinux': { + $puppetdb_initconf = '/etc/sysconfig/puppetdb' + } + 'Debian': { + $puppetdb_initconf = '/etc/default/puppetdb' + } + 'OpenBSD','FreeBSD': { + $puppetdb_initconf = undef + } + default: { + fail("The fact 'osfamily' is set to ${::osfamily} which is not supported by the puppetdb module.") + } + } + + $puppet_conf = "${puppet_confdir}/puppet.conf" + $puppetdb_startup_timeout = 120 + $puppetdb_service_status = 'running' + + $command_threads = undef + $store_usage = undef + $temp_usage = undef + + $ssl_set_cert_paths = false + $ssl_cert_path = "${ssl_dir}/public.pem" + $ssl_key_path = "${ssl_dir}/private.pem" + $ssl_ca_cert_path = "${ssl_dir}/ca.pem" + $ssl_deploy_certs = false + $ssl_key = undef + $ssl_cert = undef + $ssl_ca_cert = undef + + $certificate_whitelist_file = "${etcdir}/certificate-whitelist" + # the default is free access for now + $certificate_whitelist = [ ] + # change to this to only allow access by the puppet master by default: + #$certificate_whitelist = [ $::servername ] +} diff --git a/environments/production/modules/puppetdb/manifests/server.pp b/environments/production/modules/puppetdb/manifests/server.pp new file mode 100644 index 0000000..d668323 --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/server.pp @@ -0,0 +1,300 @@ +# Class to configure a PuppetDB server. See README.md for more details. +class puppetdb::server ( + $listen_address = $puppetdb::params::listen_address, + $listen_port = $puppetdb::params::listen_port, + $disable_cleartext = $puppetdb::params::disable_cleartext, + $open_listen_port = $puppetdb::params::open_listen_port, + $ssl_listen_address = $puppetdb::params::ssl_listen_address, + $ssl_listen_port = $puppetdb::params::ssl_listen_port, + $disable_ssl = $puppetdb::params::disable_ssl, + $open_ssl_listen_port = $puppetdb::params::open_ssl_listen_port, + $ssl_dir = $puppetdb::params::ssl_dir, + $ssl_set_cert_paths = $puppetdb::params::ssl_set_cert_paths, + $ssl_cert_path = $puppetdb::params::ssl_cert_path, + $ssl_key_path = $puppetdb::params::ssl_key_path, + $ssl_ca_cert_path = $puppetdb::params::ssl_ca_cert_path, + $ssl_deploy_certs = $puppetdb::params::ssl_deploy_certs, + $ssl_key = $puppetdb::params::ssl_key, + $ssl_cert = $puppetdb::params::ssl_cert, + $ssl_ca_cert = $puppetdb::params::ssl_ca_cert, + $ssl_protocols = $puppetdb::params::ssl_protocols, + $database = $puppetdb::params::database, + $database_host = $puppetdb::params::database_host, + $database_port = $puppetdb::params::database_port, + $database_username = $puppetdb::params::database_username, + $database_password = $puppetdb::params::database_password, + $database_name = $puppetdb::params::database_name, + $database_ssl = $puppetdb::params::database_ssl, + $jdbc_ssl_properties = $puppetdb::params::jdbc_ssl_properties, + $database_validate = $puppetdb::params::database_validate, + $database_embedded_path = $puppetdb::params::database_embedded_path, + $node_ttl = $puppetdb::params::node_ttl, + $node_purge_ttl = $puppetdb::params::node_purge_ttl, + $report_ttl = $puppetdb::params::report_ttl, + $gc_interval = $puppetdb::params::gc_interval, + $log_slow_statements = $puppetdb::params::log_slow_statements, + $conn_max_age = $puppetdb::params::conn_max_age, + $conn_keep_alive = $puppetdb::params::conn_keep_alive, + $conn_lifetime = $puppetdb::params::conn_lifetime, + $puppetdb_package = $puppetdb::params::puppetdb_package, + $puppetdb_service = $puppetdb::params::puppetdb_service, + $puppetdb_service_status = $puppetdb::params::puppetdb_service_status, + $puppetdb_user = $puppetdb::params::puppetdb_user, + $puppetdb_group = $puppetdb::params::puppetdb_group, + $read_database = $puppetdb::params::read_database, + $read_database_host = $puppetdb::params::read_database_host, + $read_database_port = $puppetdb::params::read_database_port, + $read_database_username = $puppetdb::params::read_database_username, + $read_database_password = $puppetdb::params::read_database_password, + $read_database_name = $puppetdb::params::read_database_name, + $read_database_ssl = $puppetdb::params::read_database_ssl, + $read_database_jdbc_ssl_properties = $puppetdb::params::read_database_jdbc_ssl_properties, + $read_database_validate = $puppetdb::params::read_database_validate, + $read_log_slow_statements = $puppetdb::params::read_log_slow_statements, + $read_conn_max_age = $puppetdb::params::read_conn_max_age, + $read_conn_keep_alive = $puppetdb::params::read_conn_keep_alive, + $read_conn_lifetime = $puppetdb::params::read_conn_lifetime, + $confdir = $puppetdb::params::confdir, + $manage_firewall = $puppetdb::params::manage_firewall, + $java_args = $puppetdb::params::java_args, + $merge_default_java_args = $puppetdb::params::merge_default_java_args, + $max_threads = $puppetdb::params::max_threads, + $command_threads = $puppetdb::params::command_threads, + $store_usage = $puppetdb::params::store_usage, + $temp_usage = $puppetdb::params::temp_usage, + $certificate_whitelist_file = $puppetdb::params::certificate_whitelist_file, + $certificate_whitelist = $puppetdb::params::certificate_whitelist, +) inherits puppetdb::params { + # deprecation warnings + if $database_ssl != undef { + warning('$database_ssl is deprecated and will be removed in the next major release. Please use $jdbc_ssl_properties = "?ssl=true" instead.') + } + + if $read_database_ssl != undef { + warning('$read_database_ssl is deprecated and will be removed in the next major release. Please use $read_database_jdbc_ssl_properties = "?ssl=true" instead.') + } + + # Apply necessary suffix if zero is specified. + if $node_ttl == '0' { + $node_ttl_real = '0s' + } else { + $node_ttl_real = downcase($node_ttl) + } + + # Validate node_ttl + validate_re ($node_ttl_real, ['^\d+(d|h|m|s|ms)$'], "node_ttl is <${node_ttl}> which does not match the regex validation") + + # Apply necessary suffix if zero is specified. + if $node_purge_ttl == '0' { + $node_purge_ttl_real = '0s' + } else { + $node_purge_ttl_real = downcase($node_purge_ttl) + } + + # Validate node_purge_ttl + validate_re ($node_purge_ttl_real, ['^\d+(d|h|m|s|ms)$'], "node_purge_ttl is <${node_purge_ttl}> which does not match the regex validation") + + # Apply necessary suffix if zero is specified. + if $report_ttl == '0' { + $report_ttl_real = '0s' + } else { + $report_ttl_real = downcase($report_ttl) + } + + # Validate report_ttl + validate_re ($report_ttl_real, ['^\d+(d|h|m|s|ms)$'], "report_ttl is <${report_ttl}> which does not match the regex validation") + + # Validate puppetdb_service_status + $service_enabled = $puppetdb_service_status ? { + /(running|true)/ => true, + /(stopped|false)/ => false, + default => fail("puppetdb_service_status valid values are 'true', 'running', 'false', and 'stopped'. You provided '${puppetdb_service_status}'"), + } + + # Validate database type (Currently only postgres and embedded are supported) + if !($database in ['postgres', 'embedded']) { + fail("database must must be 'postgres' or 'embedded'. You provided '${database}'") + } + + # Validate read-database type (Currently only postgres is supported) + if !($read_database in ['postgres']) { + fail("read_database must be 'postgres'. You provided '${read_database}'") + } + + package { $puppetdb_package: + ensure => $puppetdb::params::puppetdb_version, + notify => Service[$puppetdb_service], + } + + if $manage_firewall { + class { 'puppetdb::server::firewall': + http_port => $listen_port, + open_http_port => $open_listen_port, + ssl_port => $ssl_listen_port, + open_ssl_port => $open_ssl_listen_port, + } + } + + class { 'puppetdb::server::command_processing': + command_threads => $command_threads, + store_usage => $store_usage, + temp_usage => $temp_usage, + confdir => $confdir, + notify => Service[$puppetdb_service], + } + + class { 'puppetdb::server::database': + database => $database, + database_host => $database_host, + database_port => $database_port, + database_username => $database_username, + database_password => $database_password, + database_name => $database_name, + database_ssl => $database_ssl, + jdbc_ssl_properties => $jdbc_ssl_properties, + database_validate => $database_validate, + database_embedded_path => $database_embedded_path, + node_ttl => $node_ttl, + node_purge_ttl => $node_purge_ttl, + report_ttl => $report_ttl, + gc_interval => $gc_interval, + log_slow_statements => $log_slow_statements, + conn_max_age => $conn_max_age, + conn_keep_alive => $conn_keep_alive, + conn_lifetime => $conn_lifetime, + confdir => $confdir, + notify => Service[$puppetdb_service], + } + + class { 'puppetdb::server::read_database': + database => $read_database, + database_host => $read_database_host, + database_port => $read_database_port, + database_username => $read_database_username, + database_password => $read_database_password, + database_name => $read_database_name, + database_ssl => $read_database_ssl, + jdbc_ssl_properties => $read_database_jdbc_ssl_properties, + database_validate => $read_database_validate, + log_slow_statements => $read_log_slow_statements, + conn_max_age => $read_conn_max_age, + conn_keep_alive => $read_conn_keep_alive, + conn_lifetime => $read_conn_lifetime, + confdir => $confdir, + notify => Service[$puppetdb_service], + } + + if str2bool($ssl_set_cert_paths) == true + or str2bool($ssl_deploy_certs) == true { + validate_absolute_path($ssl_key_path) + validate_absolute_path($ssl_cert_path) + validate_absolute_path($ssl_ca_cert_path) + } + + if str2bool($ssl_deploy_certs) == true { + validate_absolute_path($ssl_dir) + file{ + $ssl_dir: + ensure => directory, + owner => $puppetdb_user, + group => $puppetdb_group, + mode => '0700'; + $ssl_key_path: + ensure => file, + content => $ssl_key, + owner => $puppetdb_user, + group => $puppetdb_group, + mode => '0600', + notify => Service[$puppetdb_service]; + $ssl_cert_path: + ensure => file, + content => $ssl_cert, + owner => $puppetdb_user, + group => $puppetdb_group, + mode => '0600', + notify => Service[$puppetdb_service]; + $ssl_ca_cert_path: + ensure => file, + content => $ssl_ca_cert, + owner => $puppetdb_user, + group => $puppetdb_group, + mode => '0600', + notify => Service[$puppetdb_service]; + } + } + + class { 'puppetdb::server::jetty': + listen_address => $listen_address, + listen_port => $listen_port, + disable_cleartext => $disable_cleartext, + ssl_listen_address => $ssl_listen_address, + ssl_listen_port => $ssl_listen_port, + ssl_set_cert_paths => $ssl_set_cert_paths, + ssl_key_path => $ssl_key_path, + ssl_cert_path => $ssl_cert_path, + ssl_ca_cert_path => $ssl_ca_cert_path, + ssl_protocols => $ssl_protocols, + disable_ssl => $disable_ssl, + confdir => $confdir, + max_threads => $max_threads, + notify => Service[$puppetdb_service], + } + + class { 'puppetdb::server::puppetdb': + certificate_whitelist_file => $certificate_whitelist_file, + certificate_whitelist => $certificate_whitelist, + confdir => $confdir, + notify => Service[$puppetdb_service], + } + + if !empty($java_args) { + if $merge_default_java_args { + create_resources( + 'ini_subsetting', + puppetdb_create_subsetting_resource_hash( + $java_args, { + ensure => present, + section => '', + key_val_separator => '=', + path => $puppetdb::params::puppetdb_initconf, + setting => 'JAVA_ARGS', + require => Package[$puppetdb_package], + notify => Service[$puppetdb_service], + })) + } else { + ini_setting { 'java_args': + ensure => present, + section => '', + path => $puppetdb::params::puppetdb_initconf, + setting => 'JAVA_ARGS', + require => Package[$puppetdb_package], + notify => Service[$puppetdb_service], + value => puppetdb_flatten_java_args($java_args), + } + } + } + + service { $puppetdb_service: + ensure => $puppetdb_service_status, + enable => $service_enabled, + } + + if $manage_firewall { + Package[$puppetdb_package] -> + Class['puppetdb::server::firewall'] -> + Class['puppetdb::server::command_processing'] -> + Class['puppetdb::server::database'] -> + Class['puppetdb::server::read_database'] -> + Class['puppetdb::server::jetty'] -> + Class['puppetdb::server::puppetdb'] -> + Service[$puppetdb_service] + } else { + Package[$puppetdb_package] -> + Class['puppetdb::server::command_processing'] -> + Class['puppetdb::server::database'] -> + Class['puppetdb::server::read_database'] -> + Class['puppetdb::server::jetty'] -> + Class['puppetdb::server::puppetdb'] -> + Service[$puppetdb_service] + } +} diff --git a/environments/production/modules/puppetdb/manifests/server/command_processing.pp b/environments/production/modules/puppetdb/manifests/server/command_processing.pp new file mode 100644 index 0000000..db1f8df --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/server/command_processing.pp @@ -0,0 +1,58 @@ +# PRIVATE CLASS - do not use directly +class puppetdb::server::command_processing ( + $command_threads = $puppetdb::params::command_threads, + $store_usage = $puppetdb::params::store_usage, + $temp_usage = $puppetdb::params::temp_usage, + $confdir = $puppetdb::params::confdir, +) inherits puppetdb::params { + + + file { "${confdir}/config.ini": + ensure => 'present', + mode => '0644', + } + + # Set the defaults + Ini_setting { + path => "${confdir}/config.ini", + ensure => 'present', + section => 'command-processing', + require => File["${confdir}/config.ini"], + } + + if $command_threads { + ini_setting { 'puppetdb_command_processing_threads': + setting => 'threads', + value => $command_threads, + } + } else { + ini_setting { 'puppetdb_command_processing_threads': + ensure => 'absent', + setting => 'threads', + } + } + + if $store_usage { + ini_setting { 'puppetdb_command_processing_store_usage': + setting => 'store-usage', + value => $store_usage, + } + } else { + ini_setting { 'puppetdb_command_processing_store_usage': + ensure => 'absent', + setting => 'store-usage', + } + } + + if $temp_usage { + ini_setting { 'puppetdb_command_processing_temp_usage': + setting => 'temp-usage', + value => $temp_usage, + } + } else { + ini_setting { 'puppetdb_command_processing_temp_usage': + ensure => 'absent', + setting => 'temp-usage', + } + } +} diff --git a/environments/production/modules/puppetdb/manifests/server/database.pp b/environments/production/modules/puppetdb/manifests/server/database.pp new file mode 100644 index 0000000..83a7dc0 --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/server/database.pp @@ -0,0 +1,150 @@ +# PRIVATE CLASS - do not use directly +class puppetdb::server::database ( + $database = $puppetdb::params::database, + $database_host = $puppetdb::params::database_host, + $database_port = $puppetdb::params::database_port, + $database_username = $puppetdb::params::database_username, + $database_password = $puppetdb::params::database_password, + $database_name = $puppetdb::params::database_name, + $database_ssl = $puppetdb::params::database_ssl, + $jdbc_ssl_properties = $puppetdb::params::jdbc_ssl_properties, + $database_validate = $puppetdb::params::database_validate, + $database_embedded_path = $puppetdb::params::database_embedded_path, + $node_ttl = $puppetdb::params::node_ttl, + $node_purge_ttl = $puppetdb::params::node_purge_ttl, + $report_ttl = $puppetdb::params::report_ttl, + $gc_interval = $puppetdb::params::gc_interval, + $log_slow_statements = $puppetdb::params::log_slow_statements, + $conn_max_age = $puppetdb::params::conn_max_age, + $conn_keep_alive = $puppetdb::params::conn_keep_alive, + $conn_lifetime = $puppetdb::params::conn_lifetime, + $confdir = $puppetdb::params::confdir, +) inherits puppetdb::params { + + if str2bool($database_validate) { + # Validate the database connection. If we can't connect, we want to fail + # and skip the rest of the configuration, so that we don't leave puppetdb + # in a broken state. + # + # NOTE: + # Because of a limitation in the postgres module this will break with + # a duplicate declaration if read and write database host+name are the + # same. + class { 'puppetdb::server::validate_db': + database => $database, + database_host => $database_host, + database_port => $database_port, + database_username => $database_username, + database_password => $database_password, + database_name => $database_name, + } + } + + $ini_setting_require = str2bool($database_validate) ? { + false => undef, + default => Class['puppetdb::server::validate_db'], + } + # Set the defaults + Ini_setting { + path => "${confdir}/database.ini", + ensure => present, + section => 'database', + require => $ini_setting_require + } + + if $database == 'embedded' { + + $classname = 'org.hsqldb.jdbcDriver' + $subprotocol = 'hsqldb' + $subname = "file:${database_embedded_path};hsqldb.tx=mvcc;sql.syntax_pgs=true" + + } elsif $database == 'postgres' { + $classname = 'org.postgresql.Driver' + $subprotocol = 'postgresql' + + if !empty($jdbc_ssl_properties) { + $database_suffix = $jdbc_ssl_properties + } + elsif $database_ssl { + $database_suffix = '?ssl=true' + } + else { + $database_suffix = '' + } + + $subname = "//${database_host}:${database_port}/${database_name}${database_suffix}" + + ##Only setup for postgres + ini_setting {'puppetdb_psdatabase_username': + setting => 'username', + value => $database_username, + } + + if $database_password != undef { + ini_setting {'puppetdb_psdatabase_password': + setting => 'password', + value => $database_password, + } + } + } + + ini_setting { 'puppetdb_classname': + setting => 'classname', + value => $classname, + } + + ini_setting { 'puppetdb_subprotocol': + setting => 'subprotocol', + value => $subprotocol, + } + + ini_setting { 'puppetdb_pgs': + setting => 'syntax_pgs', + value => true, + } + + ini_setting { 'puppetdb_subname': + setting => 'subname', + value => $subname, + } + + ini_setting { 'puppetdb_gc_interval': + setting => 'gc-interval', + value => $gc_interval, + } + + ini_setting { 'puppetdb_node_ttl': + setting => 'node-ttl', + value => $node_ttl, + } + + ini_setting { 'puppetdb_node_purge_ttl': + setting => 'node-purge-ttl', + value => $node_purge_ttl, + } + + ini_setting { 'puppetdb_report_ttl': + setting => 'report-ttl', + value => $report_ttl, + } + + ini_setting { 'puppetdb_log_slow_statements': + setting => 'log-slow-statements', + value => $log_slow_statements, + } + + ini_setting { 'puppetdb_conn_max_age': + setting => 'conn-max-age', + value => $conn_max_age, + } + + ini_setting { 'puppetdb_conn_keep_alive': + setting => 'conn-keep-alive', + value => $conn_keep_alive, + } + + ini_setting { 'puppetdb_conn_lifetime': + setting => 'conn-lifetime', + value => $conn_lifetime, + } +} diff --git a/environments/production/modules/puppetdb/manifests/server/firewall.pp b/environments/production/modules/puppetdb/manifests/server/firewall.pp new file mode 100644 index 0000000..2793660 --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/server/firewall.pp @@ -0,0 +1,25 @@ +# PRIVATE CLASS - do not use directly +class puppetdb::server::firewall ( + $http_port = $puppetdb::params::listen_port, + $open_http_port = $puppetdb::params::open_listen_port, + $ssl_port = $puppetdb::params::ssl_listen_port, + $open_ssl_port = $puppetdb::params::open_ssl_listen_port, +) inherits puppetdb::params { + include firewall + + if ($open_http_port) { + firewall { "${http_port} accept - puppetdb": + dport => $http_port, + proto => 'tcp', + action => 'accept', + } + } + + if ($open_ssl_port) { + firewall { "${ssl_port} accept - puppetdb": + dport => $ssl_port, + proto => 'tcp', + action => 'accept', + } + } +} diff --git a/environments/production/modules/puppetdb/manifests/server/global.pp b/environments/production/modules/puppetdb/manifests/server/global.pp new file mode 100644 index 0000000..b74500f --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/server/global.pp @@ -0,0 +1,21 @@ +# PRIVATE CLASS - do not use directly +class puppetdb::server::global ( + $vardir = $puppetdb::params::vardir, + $confdir = $puppetdb::params::confdir, +) inherits puppetdb::params { + + # Set the defaults + Ini_setting { + path => "${confdir}/config.ini", + ensure => 'present', + section => 'global', + require => File["${confdir}/config.ini"], + } + + if $vardir { + ini_setting { 'puppetdb_global_vardir': + setting => 'vardir', + value => $vardir, + } + } +} diff --git a/environments/production/modules/puppetdb/manifests/server/jetty.pp b/environments/production/modules/puppetdb/manifests/server/jetty.pp new file mode 100644 index 0000000..97b2a12 --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/server/jetty.pp @@ -0,0 +1,100 @@ +# PRIVATE CLASS - do not use directly +class puppetdb::server::jetty ( + $listen_address = $puppetdb::params::listen_address, + $listen_port = $puppetdb::params::listen_port, + $disable_cleartext = $puppetdb::params::disable_cleartext, + $ssl_listen_address = $puppetdb::params::ssl_listen_address, + $ssl_listen_port = $puppetdb::params::ssl_listen_port, + $disable_ssl = $puppetdb::params::disable_ssl, + $ssl_set_cert_paths = $puppetdb::params::ssl_set_cert_paths, + $ssl_cert_path = $puppetdb::params::ssl_cert_path, + $ssl_key_path = $puppetdb::params::ssl_key_path, + $ssl_ca_cert_path = $puppetdb::params::ssl_ca_cert_path, + $ssl_protocols = $puppetdb::params::ssl_protocols, + $confdir = $puppetdb::params::confdir, + $max_threads = $puppetdb::params::max_threads, +) inherits puppetdb::params { + + # Set the defaults + Ini_setting { + path => "${confdir}/jetty.ini", + ensure => present, + section => 'jetty', + } + + $cleartext_setting_ensure = $disable_cleartext ? { + true => 'absent', + default => 'present', + } + + ini_setting { 'puppetdb_host': + ensure => $cleartext_setting_ensure, + setting => 'host', + value => $listen_address, + } + + ini_setting { 'puppetdb_port': + ensure => $cleartext_setting_ensure, + setting => 'port', + value => $listen_port, + } + + $ssl_setting_ensure = $disable_ssl ? { + true => 'absent', + default => 'present', + } + + ini_setting { 'puppetdb_sslhost': + ensure => $ssl_setting_ensure, + setting => 'ssl-host', + value => $ssl_listen_address, + } + + ini_setting { 'puppetdb_sslport': + ensure => $ssl_setting_ensure, + setting => 'ssl-port', + value => $ssl_listen_port, + } + + if $ssl_protocols != undef { + + validate_string($ssl_protocols) + + ini_setting { 'puppetdb_sslprotocols': + ensure => $ssl_setting_ensure, + setting => 'ssl-protocols', + value => $ssl_protocols, + } + } + + if str2bool($ssl_set_cert_paths) == true { + # assume paths have been validated in calling class + ini_setting { 'puppetdb_ssl_key': + ensure => present, + setting => 'ssl-key', + value => $ssl_key_path, + } + ini_setting { 'puppetdb_ssl_cert': + ensure => present, + setting => 'ssl-cert', + value => $ssl_cert_path, + } + ini_setting { 'puppetdb_ssl_ca_cert': + ensure => present, + setting => 'ssl-ca-cert', + value => $ssl_ca_cert_path, + } + } + + if ($max_threads) { + ini_setting { 'puppetdb_max_threads': + setting => 'max-threads', + value => $max_threads, + } + } else { + ini_setting { 'puppetdb_max_threads': + ensure => absent, + setting => 'max-threads', + } + } +} diff --git a/environments/production/modules/puppetdb/manifests/server/puppetdb.pp b/environments/production/modules/puppetdb/manifests/server/puppetdb.pp new file mode 100644 index 0000000..b1809db --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/server/puppetdb.pp @@ -0,0 +1,36 @@ +# PRIVATE CLASS - do not use directly +class puppetdb::server::puppetdb ( + $certificate_whitelist_file = $puppetdb::params::certificate_whitelist_file, + $certificate_whitelist = $puppetdb::params::certificate_whitelist, + $confdir = $puppetdb::params::confdir, +) inherits puppetdb::params { + + # Set the defaults + Ini_setting { + path => "${confdir}/puppetdb.ini", + ensure => present, + section => 'puppetdb', + } + + $certificate_whitelist_setting_ensure = empty($certificate_whitelist) ? { + true => 'absent', + default => 'present', + } + + # accept connections only from puppet master + ini_setting {'puppetdb-connections-from-master-only': + ensure => $certificate_whitelist_setting_ensure, + path => "${confdir}/puppetdb.ini", + section => 'puppetdb', + setting => 'certificate-whitelist', + value => $certificate_whitelist_file, + } + + file { $certificate_whitelist_file: + ensure => $certificate_whitelist_setting_ensure, + content => template('puppetdb/certificate-whitelist.erb'), + mode => '0644', + owner => 0, + group => 0, + } +} diff --git a/environments/production/modules/puppetdb/manifests/server/read_database.pp b/environments/production/modules/puppetdb/manifests/server/read_database.pp new file mode 100644 index 0000000..6d78b47 --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/server/read_database.pp @@ -0,0 +1,134 @@ +# PRIVATE CLASS - do not use directly +class puppetdb::server::read_database ( + $database = $puppetdb::params::read_database, + $database_host = $puppetdb::params::read_database_host, + $database_port = $puppetdb::params::read_database_port, + $database_username = $puppetdb::params::read_database_username, + $database_password = $puppetdb::params::read_database_password, + $database_name = $puppetdb::params::read_database_name, + $database_ssl = $puppetdb::params::read_database_ssl, + $jdbc_ssl_properties = $puppetdb::params::read_database_jdbc_ssl_properties, + $database_validate = $puppetdb::params::read_database_validate, + $log_slow_statements = $puppetdb::params::read_log_slow_statements, + $conn_max_age = $puppetdb::params::read_conn_max_age, + $conn_keep_alive = $puppetdb::params::read_conn_keep_alive, + $conn_lifetime = $puppetdb::params::read_conn_lifetime, + $confdir = $puppetdb::params::confdir, + $puppetdb_user = $puppetdb::params::puppetdb_user, + $puppetdb_group = $puppetdb::params::puppetdb_group, +) inherits puppetdb::params { + + # Only add the read database configuration if database host is defined. + if $database_host != undef { + if str2bool($database_validate) { + # Validate the database connection. If we can't connect, we want to fail + # and skip the rest of the configuration, so that we don't leave puppetdb + # in a broken state. + # + # NOTE: + # Because of a limitation in the postgres module this will break with + # a duplicate declaration if read and write database host+name are the + # same. + class { 'puppetdb::server::validate_read_db': + database => $database, + database_host => $database_host, + database_port => $database_port, + database_username => $database_username, + database_password => $database_password, + database_name => $database_name, + } + } + + file { "${confdir}/read_database.ini": + ensure => file, + owner => $puppetdb_user, + group => $puppetdb_group, + mode => '0600'; + } + + $ini_setting_require = str2bool($database_validate) ? { + false => undef, + default => Class['puppetdb::server::validate_read_db'], + } + # Set the defaults + Ini_setting { + path => "${confdir}/read_database.ini", + ensure => present, + section => 'read-database', + require => $ini_setting_require, + } + + if $database == 'postgres' { + $classname = 'org.postgresql.Driver' + $subprotocol = 'postgresql' + + if !empty($jdbc_ssl_properties) { + $database_suffix = $jdbc_ssl_properties + } + elsif $database_ssl { + $database_suffix = '?ssl=true' + } + else { + $database_suffix = '' + } + + $subname = "//${database_host}:${database_port}/${database_name}${database_suffix}" + + ini_setting { 'puppetdb_read_psdatabase_username': + setting => 'username', + value => $database_username, + } + + if $database_password != undef { + ini_setting { 'puppetdb_read_psdatabase_password': + setting => 'password', + value => $database_password, + } + } + } + + ini_setting { 'puppetdb_read_classname': + setting => 'classname', + value => $classname, + } + + ini_setting { 'puppetdb_read_subprotocol': + setting => 'subprotocol', + value => $subprotocol, + } + + ini_setting { 'puppetdb_read_pgs': + setting => 'syntax_pgs', + value => true, + } + + ini_setting { 'puppetdb_read_subname': + setting => 'subname', + value => $subname, + } + + ini_setting { 'puppetdb_read_log_slow_statements': + setting => 'log-slow-statements', + value => $log_slow_statements, + } + + ini_setting { 'puppetdb_read_conn_max_age': + setting => 'conn-max-age', + value => $conn_max_age, + } + + ini_setting { 'puppetdb_read_conn_keep_alive': + setting => 'conn-keep-alive', + value => $conn_keep_alive, + } + + ini_setting { 'puppetdb_read_conn_lifetime': + setting => 'conn-lifetime', + value => $conn_lifetime, + } + } else { + file { "${confdir}/read_database.ini": + ensure => absent, + } + } +} diff --git a/environments/production/modules/puppetdb/manifests/server/validate_db.pp b/environments/production/modules/puppetdb/manifests/server/validate_db.pp new file mode 100644 index 0000000..cdb1c4e --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/server/validate_db.pp @@ -0,0 +1,25 @@ +# This validates a database connection. See README.md for more details. +class puppetdb::server::validate_db ( + $database = $puppetdb::params::database, + $database_host = $puppetdb::params::database_host, + $database_port = $puppetdb::params::database_port, + $database_username = $puppetdb::params::database_username, + $database_password = $puppetdb::params::database_password, + $database_name = $puppetdb::params::database_name, + $database_ssl = $puppetdb::params::database_ssl, +) inherits puppetdb::params { + + # We don't need any validation for the embedded database, presumably. + if ( + $database == 'postgres' and + ($database_password != undef and $database_ssl == false) + ) { + postgresql::validate_db_connection { 'validate puppetdb postgres connection': + database_host => $database_host, + database_port => $database_port, + database_username => $database_username, + database_password => $database_password, + database_name => $database_name, + } + } +} diff --git a/environments/production/modules/puppetdb/manifests/server/validate_read_db.pp b/environments/production/modules/puppetdb/manifests/server/validate_read_db.pp new file mode 100644 index 0000000..a1b31ba --- /dev/null +++ b/environments/production/modules/puppetdb/manifests/server/validate_read_db.pp @@ -0,0 +1,25 @@ +# This validates a database connection. See README.md for more details. +class puppetdb::server::validate_read_db ( + $database = $puppetdb::params::database, + $database_host = $puppetdb::params::database_host, + $database_port = $puppetdb::params::database_port, + $database_username = $puppetdb::params::database_username, + $database_password = $puppetdb::params::database_password, + $database_name = $puppetdb::params::database_name, + $database_ssl = $puppetdb::params::database_ssl, +) inherits puppetdb::params { + + # Currently we only support postgres + if ( + $database == 'postgres' and + ($database_password != undef and $database_ssl == false) + ) { + postgresql::validate_db_connection { 'validate puppetdb postgres (read) connection': + database_host => $database_host, + database_port => $database_port, + database_username => $database_username, + database_password => $database_password, + database_name => $database_name, + } + } +} diff --git a/environments/production/modules/puppetdb/metadata.json b/environments/production/modules/puppetdb/metadata.json new file mode 100644 index 0000000..98923f6 --- /dev/null +++ b/environments/production/modules/puppetdb/metadata.json @@ -0,0 +1,79 @@ +{ + "name": "puppetlabs-puppetdb", + "version": "5.1.2", + "author": "puppetlabs", + "summary": "Installs PostgreSQL and PuppetDB, sets up the connection to Puppet master.", + "license": "Apache-2.0", + "source": "git://github.com/puppetlabs/puppetlabs-puppetdb.git", + "project_page": "http://github.com/puppetlabs/puppetlabs-puppetdb", + "issues_url": "https://tickets.puppetlabs.com/browse/PDB", + "dependencies": [ + {"name":"puppetlabs/inifile","version_requirement":">= 1.1.3 <2.0.0"}, + {"name":"puppetlabs/postgresql","version_requirement":">= 4.0.0 <5.0.0"}, + {"name":"puppetlabs/firewall","version_requirement":">= 1.1.3 <2.0.0"}, + {"name":"puppetlabs/stdlib","version_requirement":">= 4.2.2 <5.0.0"} + ], + "data_provider": null, + "description": "Module for installing/configuring PuppetDB", + "operatingsystem_support": [ + { + "operatingsystem": "RedHat", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "CentOS", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "OracleLinux", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "Scientific", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "SLES", + "operatingsystemrelease": [ + "11 SP1" + ] + }, + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "6", + "7" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "10.04", + "12.04", + "14.04" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">=3.7.1 <5.0.0" + } + ] +} diff --git a/environments/production/modules/puppetdb/templates/certificate-whitelist.erb b/environments/production/modules/puppetdb/templates/certificate-whitelist.erb new file mode 100644 index 0000000..a50d035 --- /dev/null +++ b/environments/production/modules/puppetdb/templates/certificate-whitelist.erb @@ -0,0 +1,3 @@ +<% @certificate_whitelist.each do |cn| -%> +<%= cn %> +<% end -%> diff --git a/environments/production/modules/puppetdb/templates/routes.yaml.erb b/environments/production/modules/puppetdb/templates/routes.yaml.erb new file mode 100644 index 0000000..b8f8bd0 --- /dev/null +++ b/environments/production/modules/puppetdb/templates/routes.yaml.erb @@ -0,0 +1,3 @@ +# This file was automatically generated by the puppetdb module. + +<%= @routes_real.to_yaml %> diff --git a/environments/production/modules/puppetexplorer/Gemfile b/environments/production/modules/puppetexplorer/Gemfile new file mode 100644 index 0000000..9687ea2 --- /dev/null +++ b/environments/production/modules/puppetexplorer/Gemfile @@ -0,0 +1,16 @@ +source "https://rubygems.org" + +group :test do + gem "rake" + gem "puppet", '~> 4.4' + gem "puppet-lint" + gem "rspec-puppet" + gem "puppet-syntax" + gem "puppetlabs_spec_helper" + gem "beaker-rspec" +end + +group :development do + gem "puppet-blacksmith" + gem "guard-rake" +end diff --git a/environments/production/modules/puppetexplorer/README.md b/environments/production/modules/puppetexplorer/README.md new file mode 100644 index 0000000..e493359 --- /dev/null +++ b/environments/production/modules/puppetexplorer/README.md @@ -0,0 +1,107 @@ +# puppetexplorer + +#### Table of Contents + +1. [Overview](#overview) +2. [Parameters](#parameters) + +## Overview + +Manage the Puppet Explorer web interface. In the default configuration it +should work if it is hosted on the same host as PuppetDB. + +## Parameters + +##### `package_ensure` + The ensure parameter of the puppetexplorer package. Default: present + +##### `ga_tracking_id` + Google Analytics tracking ID. + +##### `ga_domain` + Google Analytics domain setting. Default: auto + +##### `puppetdb_servers` + List of server name and URL tuples. Default: [ ['production', '/api'] ] + +##### `node_facts` + List of facts to display in node detail view. + Default: [ 'operatingsystem', 'operatingsystemrelease', 'manufacturer', + 'productname', 'processorcount', 'memorytotal', 'ipaddress' ] + + +##### `unresponsive_hours` + The amount of hours since the last check-in after which a node is considered + unresponsive. + Default: 2 + +##### `dashboard_panels` + Custom dashboard panels. Should be an array of hashes containing the keys + name, query and type. Default: + + [ + { + 'name' => 'Unresponsive nodes', + 'type' => 'danger', + 'query' => '#node.report_timestamp < @"now - 2 hours"' + }, + { + 'name' => 'Nodes in production env', + 'type' => 'success', + 'query' => '#node.catalog_environment = production' + }, + { + 'name' => 'Nodes in non-production env', + 'type' => 'warning', + 'query' => '#node.catalog_environment != production' + } + ] + +##### `manage_apt` + Add apt repo for the module. + This option requires the `puppetlabs/apt` module. + Defaults to true for $::osfamily Debian + +##### `manage_yum` + Add yum repo for the module. + Defaults to true for $::osfamily RedHat + +##### `manage_selinux` + Manage SELinux capabilities + This option requires the `jfryman/selinux` module + Defaults to false + +##### `webserver_class` + Name of the class that manages the webserver configuration. + Using `'::puppetexplorer::apache'` requires the `puppetlabs/apache` module. + Defaults to '::puppetexplorer::apache' + +##### `servername` + The Apache vhost servername. Default: $::fqdn + +##### `ssl` + If SSL should be turned on for the Apache vhost. Default: true + +##### `port` + Port of the Apache vhost. Default: 443 + +##### `proxy_pass` + Proxy pass configuration for Apache. This is useful to proxy the API to + PuppetDB through the same vhost that hosts Puppet Explorer. If they are not + proxied PuppetDB needs to have the Access-Control-Allow-Origin and + Access-Control-Expose-Headers "X-Records" headers. + See the proxy_pass parameter of apache::vhost in puppetlabs-apache for more + info on this. + + Default: + + [ + { 'path' => '/api/pdb/query', 'url' => 'http://localhost:8080/pdb/query' }, + { 'path' => '/api/pdb/meta', 'url' => 'http://localhost:8080/pdb/meta' }, + { 'path' => '/api/metrics', 'url' => 'http://localhost:8080/metrics' } + ] + +##### `vhost_options` + An additional hash of apache::vhost options, see puppetlabs-apache for more + info. Can be used for configuring authentication or SSL certificates for + example. Default: {} diff --git a/environments/production/modules/puppetexplorer/Rakefile b/environments/production/modules/puppetexplorer/Rakefile new file mode 100644 index 0000000..efb49cb --- /dev/null +++ b/environments/production/modules/puppetexplorer/Rakefile @@ -0,0 +1,42 @@ +require 'rubygems' +require 'puppetlabs_spec_helper/rake_tasks' +require 'puppet-lint/tasks/puppet-lint' +require 'puppet-syntax/tasks/puppet-syntax' + +# These two gems aren't always present, for instance +# on Travis with --without development +begin + require 'puppet_blacksmith/rake_tasks' +rescue LoadError +end + +PuppetLint.configuration.relative = true +PuppetLint.configuration.send("disable_80chars") +PuppetLint.configuration.log_format = "%{path}:%{linenumber}:%{check}:%{KIND}:%{message}" +PuppetLint.configuration.fail_on_warnings = true + +# Forsake support for Puppet 2.6.2 for the benefit of cleaner code. +# http://puppet-lint.com/checks/class_parameter_defaults/ +PuppetLint.configuration.send('disable_class_parameter_defaults') +# http://puppet-lint.com/checks/class_inherits_from_params_class/ +PuppetLint.configuration.send('disable_class_inherits_from_params_class') + +exclude_paths = [ + "pkg/**/*", + "vendor/**/*", + "spec/**/*", +] +PuppetLint.configuration.ignore_paths = exclude_paths +PuppetSyntax.exclude_paths = exclude_paths + +desc "Run acceptance tests" +RSpec::Core::RakeTask.new(:acceptance) do |t| + t.pattern = 'spec/acceptance' +end + +desc "Run syntax, lint, and spec tests." +task :test => [ + :syntax, + :lint, + :spec, +] diff --git a/environments/production/modules/puppetexplorer/checksums.json b/environments/production/modules/puppetexplorer/checksums.json new file mode 100644 index 0000000..0621ef0 --- /dev/null +++ b/environments/production/modules/puppetexplorer/checksums.json @@ -0,0 +1,21 @@ +{ + "Gemfile": "b457cf1c3d7744df0d83d7dad4e35e91", + "README.md": "807ee45421a5649f8fe29ba378dadada", + "Rakefile": "a7795e56e60831359d3ad45e3631768a", + "files/RPM-GPG-KEY-puppetexplorer": "0bb5670859cd66ce9e0a9ac34ab682ff", + "manifests/apache.pp": "dc5d2964645e89bdef4cb8d10eee7740", + "manifests/init.pp": "375faa181c3619346443d21b2565c672", + "metadata.json": "c182cfa0d8240cf705bd98441a4dac45", + "spec/acceptance/classes/puppetexplorer_spec.rb": "d582315508caa76b79569001c96ad172", + "spec/acceptance/nodesets/centos-7.yml": "c39567afff7d66d5a848449b172d36a2", + "spec/acceptance/nodesets/debian-7.yml": "fa763fb8e3dac9b2c3ec863caf8bd3e0", + "spec/acceptance/nodesets/default.yml": "fa763fb8e3dac9b2c3ec863caf8bd3e0", + "spec/acceptance/nodesets/ubuntu-1404.yml": "52aa47fcbd1e4dfdb90aa38a432cf174", + "spec/acceptance/nodesets/ubuntu-1604.yml": "f7f6562b0c4be5be02004f280c0d634b", + "spec/classes/init_spec.rb": "fe54cd8696609e2f78224d11fd3159ae", + "spec/spec_helper.rb": "d1a143506ad66f8a988ed723d5492794", + "spec/spec_helper_acceptance.rb": "1d7e829cd10aa0c264bd289cbed27e09", + "templates/config.js.erb": "e6ae46cc0ffbdd54fc4e7ed25d796f6a", + "tests/basic_auth.pp": "a6c495bee00f0a3fb66a1cb0c7252c25", + "tests/init.pp": "dfc3553140af3c3ec868dd2110c4b40a" +} \ No newline at end of file diff --git a/environments/production/modules/puppetexplorer/files/RPM-GPG-KEY-puppetexplorer b/environments/production/modules/puppetexplorer/files/RPM-GPG-KEY-puppetexplorer new file mode 100644 index 0000000..a170b74 --- /dev/null +++ b/environments/production/modules/puppetexplorer/files/RPM-GPG-KEY-puppetexplorer @@ -0,0 +1,32 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1 + +mQENBFQsAssBCAD3Mm28STxNhBs+yzhmXbS3nVzDsjemLqslV3cW9FfwxlvVzYB2 +VxSIUH5oMGl6UfeKgRchsbASuycr4zNlA3FDAMJASLnCQp8CPSKB2im1Y1H0Bnli +A5wN3OVwagaRtBuO3ltSbzwEyUovP+GEF/LyDiuwDH/xncPN7kwxjqyfJ5I9IaVu +gJ5Of8rFYAPVoPip/eiqAfmWxrih79q2uipyAtlf6hy4M1Wk61V2E9njILQzvkHy +W5kP/Gx6DDdVGicIRLhReDWANEmUZ+bU8QwZ56hmurID1YrHCHx397bIGszTu7Oq +sppgJeRqsSaSBu/9Xo7XVG1gRovIaGmCh8BvABEBAAG0H1Nwb3RpZnkgPGZvc3Ni +b2FyZEBzcG90aWZ5LmNvbT6JATgEEwECACIFAlQsAssCGwMGCwkIBwMCBhUIAgkK +CwQWAgMBAh4BAheAAAoJEG91xhg/9ek98PUH/1/4b+CnsmqqDw6TBpESPIf3r2cM +e1c9epDkXhPSfsXbYqE95GJqegZrIZ20Pnz0zuyqG4LxuyZEPXS6+RxI0saT3Dqv +6KvQ3/ckvt8wVpRv+DeP1+qXeYaiXyZXLMcV2rkHTcvFAsisH3hDVWabWfFYKLEf +6m9OaeZNCeLe3suDzem3HF93GT1+P8bn/aFKcboo+slUaEdnHlHjsQls1kQCJ/jL +c/na18PqjUP6IyGelt2mAFMbXdMNrsXGYbH0LCaqxbOI1YvCnH3RDSyHBwW3g5+1 +ACOV/KcMxjxny3iVpBTMcx9yOKWeIIZOP4Zw+4iSRY4iANtYWkZD/xqG9SuIRgQT +EQIABgUCVCwC2wAKCRBBK5kuhPa6UnpNAKCo4IgmFkJdhyeJGBfl3V7y0JhWzACd +HedbsXqjJO15gPeHG+ck9tOyRr65AQ0EVCwCywEIAM4EXoGTZilkudOPX36Bk860 +qgdqbOt/xEvI5NIjs2sYoQu7WSGQtyO4wQfnp2VgYeLFh33Sti2KUG9tEAi9kpiq +yHFYFpQZJ02+H9VyXdrjq4ZUVpbiQSg2K/RYcSkNqxWLefLp5YZhtqBAner60NHb +xT5ZAPpTAUB5xuWPuvyjUXJvfPXlN1u++Zr/bSOztqV7KoNpKfxRU4z+dSZLrkrO +wKlJae/iVxTLKeBuoxkVDBdDGyh1Q0SONyub4UaVwZcLsg0woSLll5F0BYQbF0en +h1ZJuvs4SD1EiNeMz2vKovi2G3++9By919WFVDcLjqwgbUyDpIa8BrPhiOrqti8A +EQEAAYkBHwQYAQIACQUCVCwCywIbDAAKCRBvdcYYP/XpPRDmCACjMamaC7bTZ17A +KbaTZk0Insp5tS1yjP35qfW2spllIlT7ILfgJRQSyd/FZC4ZclMosa4ASefkwlf/ +8FWJvxdLGSwWuIpLo1CBCRGjGaewF6TajWDNP1WKInfby3HQ0VcZS8VY3x5XZSVG +aHJkdFJL0JBYIwVldf4dI9RG3A0pHVehZ86aeWrxInZekCHz/D6aWZ5fPzvJxhNM +GV+M9IOVFQnvzYIjRVEvvIVJA9v2f0nteYC8idYitHZ3FAHaTooe9BdtDkpb8uyd +t0CVf/eBSf3ZoGbacrhrUoknWdvZs0iGlYmVQ0i5/+oi4OsxLY1vQLuq+ecCOKbS +TO+/UH58 +=x1zq +-----END PGP PUBLIC KEY BLOCK----- diff --git a/environments/production/modules/puppetexplorer/manifests/apache.pp b/environments/production/modules/puppetexplorer/manifests/apache.pp new file mode 100644 index 0000000..4d93179 --- /dev/null +++ b/environments/production/modules/puppetexplorer/manifests/apache.pp @@ -0,0 +1,19 @@ +# == Class: puppetexplorer::apache +# +# Manage the Apache configuration for the Puppet Explorer web interface. +# +class puppetexplorer::apache { + + include ::apache + + $base_vhost_options = { + docroot => '/usr/share/puppetexplorer', + ssl => $::puppetexplorer::ssl, + port => $::puppetexplorer::port, + proxy_pass => $::puppetexplorer::proxy_pass, + ssl_proxyengine => $::puppetexplorer::ssl_proxyengine, + } + + create_resources ('apache::vhost', hash([$::puppetexplorer::servername, $base_vhost_options]), $::puppetexplorer::vhost_options) + +} diff --git a/environments/production/modules/puppetexplorer/manifests/init.pp b/environments/production/modules/puppetexplorer/manifests/init.pp new file mode 100644 index 0000000..53d3367 --- /dev/null +++ b/environments/production/modules/puppetexplorer/manifests/init.pp @@ -0,0 +1,215 @@ +# == Class: puppetexplorer +# +# Manage the Puppet Explorer web interface. In the default configuration it +# should work if it is hosted on the same host as PuppetDB. +# +# === Parameters +# +# [*package_ensure*] +# The ensure parameter of the puppetexplorer package. Default: present +# +# [*ga_tracking_id*] +# Google Analytics tracking ID. +# +# [*ga_domain*] +# Google Analytics domain setting. Default: auto +# +# [*puppetdb_servers*] +# List of server name and URL tuples. Default: [ ['production', '/api'] ] +# +# [*node_facts*] +# List of facts to display in node detail view. +# Default: [ 'operatingsystem', 'operatingsystemrelease', 'manufacturer', +# 'productname', 'processorcount', 'memorytotal', 'ipaddress' ] +# +# [*unresponsive_hours*] +# The amount of hours since the last check-in after which a node is considered +# unresponsive. +# Default: 2 +# +# [*dashboard_panels*] +# Custom dashboard panels. Should be an array of hashes containing the keys +# name, query and type. +# Default: [ +# { +# 'name' => 'Unresponsive nodes', +# 'type' => 'danger', +# 'query' => '#node.report_timestamp < @"now - 2 hours"' +# }, +# { +# 'name' => 'Nodes in production env', +# 'type' => 'success', +# 'query' => '#node.catalog_environment = production' +# }, +# { +# 'name' => 'Nodes in non-production env', +# 'type' => 'warning', +# 'query' => '#node.catalog_environment != production' +# } +# ] +# +# [*manage_apt*] +# Add apt repo for the module +# This option requires the `puppetlabs/apt` module +# Defaults to true for $::osfamily Debian +# +# [*manage_yum*] +# Add yum repo for the module +# Defaults to true for $::osfamily RedHat +# +# [*manage_selinux*] +# Manage SELinux capabilities +# This option requires the `jfryman/selinux` module +# Defaults to false +# +# [*webserver_class*] +# Name of the class where the webserver is configured +# Using `'::puppetexplorer::apache'` requires the `puppetlabs/apache` module. +# Default: '::puppetexplorer::apache' +# +# [*servername*] +# The Apache vhost servername. Default: $::fqdn +# +# [*ssl*] +# If SSL should be turned on for the Apache vhost. Default: true +# +# [*port*] +# Port of the Apache vhost. Default: 443 +# +# [*proxy_pass*] +# Proxy pass configuration for Apache. This is useful to proxy the API to +# PuppetDB through the same vhost that hosts Puppet Explorer. If they are not +# proxied PuppetDB needs to have the Access-Control-Allow-Origin and +# Access-Control-Expose-Headers "X-Records" headers. +# See the proxy_pass parameter of apache::vhost in puppetlabs-apache for more +# info on this. +# Default: +# [ +# { 'path' => '/api/pdb/query', 'url' => 'http://localhost:8080/pdb/query' }, +# { 'path' => '/api/pdb/meta', 'url' => 'http://localhost:8080/pdb/meta' }, +# { 'path' => '/api/metrics', 'url' => 'http://localhost:8080/metrics' } +# ] +# +# [*ssl_proxyengine*] +# Specifies whether or not to use SSLProxyEngine in the vhost. +# Valid values are 'true' and 'false'. Default: true +# +# [*vhost_options*] +# An additional hash of apache::vhost options, see puppetlabs-apache for more +# info. Can be used for configuring authentication or SSL certificates for +# example. Default: {} +# +# === Authors +# +# Erik Dalen +# +# === Copyright +# +# Copyright 2014-2016 Erik Dalen +# +class puppetexplorer ( + $package_ensure = present, + $ga_tracking_id = 'UA-XXXXXXXX-YY', + $ga_domain = 'auto', + $puppetdb_servers = [ ['production', '/api'] ], + $node_facts = [ + 'operatingsystem', + 'operatingsystemrelease', + 'manufacturer', + 'productname', + 'processorcount', + 'memorytotal', + 'ipaddress' + ], + $unresponsive_hours = 2, + $dashboard_panels = [ + { + 'name' => 'Unresponsive nodes', + 'type' => 'danger', + 'query' => '#node.report_timestamp < @"now - 2 hours"' + }, + { + 'name' => 'Nodes in production env', + 'type' => 'success', + 'query' => '#node.catalog_environment = production' + }, + { + 'name' => 'Nodes in non-production env', + 'type' => 'warning', + 'query' => '#node.catalog_environment != production' + } + ], + $manage_apt = $::osfamily ? { + 'Debian' => true, + default => false, + }, + $manage_yum = $::osfamily ? { + 'RedHat' => true, + default => false, + }, + $manage_selinux = false, + + $webserver_class = '::puppetexplorer::apache', + + # Apache site options: + $servername = $::fqdn, + $ssl = true, + $port = 443, + $proxy_pass = [ + { 'path' => '/api/pdb/query', 'url' => 'http://localhost:8080/pdb/query' }, + { 'path' => '/api/pdb/meta', 'url' => 'http://localhost:8080/pdb/meta' }, + { 'path' => '/api/metrics', 'url' => 'http://localhost:8080/metrics' } + ], + $ssl_proxyengine = true, + $vhost_options = {}, +) { + + if $manage_apt { + apt::source { 'puppetexplorer': + location => 'http://apt.puppetexplorer.io', + release => 'stable', + repos => 'main', + key => 'CA37C758D0D8CD3AE9740C466F75C6183FF5E93D', + include_src => false, + before => Package['puppetexplorer'], + } + } + + if $manage_yum { + file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-puppetexplorer': + ensure => file, + source => 'puppet:///modules/puppetexplorer/RPM-GPG-KEY-puppetexplorer', + before => Yumrepo['puppetexplorer'], + } + yumrepo { 'puppetexplorer': + ensure => present, + descr => 'Puppet Explorer', + baseurl => 'http://yum.puppetexplorer.io/', + enabled => true, + gpgcheck => 0, + repo_gpgcheck => 1, + gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-puppetexplorer', + before => Package['puppetexplorer'], + } + if $manage_selinux { + include '::selinux' + selinux::boolean { 'httpd_can_network_connect': } + } + } + + package { 'puppetexplorer': + ensure => $package_ensure, + } + + file { '/usr/share/puppetexplorer/config.js': + ensure => file, + mode => '0644', + content => template('puppetexplorer/config.js.erb'), + require => Package['puppetexplorer'], + } + + if $webserver_class { + include $webserver_class + } + +} diff --git a/environments/production/modules/puppetexplorer/metadata.json b/environments/production/modules/puppetexplorer/metadata.json new file mode 100644 index 0000000..d28efcd --- /dev/null +++ b/environments/production/modules/puppetexplorer/metadata.json @@ -0,0 +1,28 @@ +{ + "name": "spotify-puppetexplorer", + "version": "1.1.1", + "author": "Erik Dalen", + "summary": "Manage the Puppet Explorer web application", + "license": "Apache-2.0", + "source": "https://github.com/spotify/puppet-puppetexplorer.git", + "project_page": "https://github.com/spotify/puppet-puppetexplorer", + "issues_url": "https://github.com/spotify/puppet-puppetexplorer/issues", + "dependencies": [ + {"name":"puppetlabs/stdlib","version_requirement":">= 1.0.0"} + ], + "data_provider": null, + "optional_dependencies": [ + { + "name": "puppetlabs/apt", + "version_requirement": ">= 1.0.0" + }, + { + "name": "jfryman/selinux", + "version_requirement": ">= 0.3.0" + }, + { + "name": "puppetlabs/apache", + "version_requirement": ">= 1.0.0" + } + ] +} diff --git a/environments/production/modules/puppetexplorer/spec/acceptance/classes/puppetexplorer_spec.rb b/environments/production/modules/puppetexplorer/spec/acceptance/classes/puppetexplorer_spec.rb new file mode 100644 index 0000000..b177569 --- /dev/null +++ b/environments/production/modules/puppetexplorer/spec/acceptance/classes/puppetexplorer_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper_acceptance' + +describe 'puppetexplorer hostclass' do + describe 'running puppet code' do + it 'should work with no errors' do + pp = <<-EOS + class { 'puppetexplorer': + servername => 'puppetexplorer.test', + port => 80, + ssl => false, + ssl_proxyengine => false, + proxy_pass => [ + { + "path" => "/api", + "url" => "http://demo.puppetexplorer.io" + } + ], + } + EOS + + # Run it twice and test for idempotency + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + end + + describe port(80) do + it { should be_listening } + end + + describe command("curl -f -s -H 'Host: puppetexplorer.test' http://localhost/") do + its(:exit_status) { should eq 0 } + its(:stdout) { should match /Puppet Explorer/ } + end + end +end diff --git a/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/centos-7.yml b/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/centos-7.yml new file mode 100644 index 0000000..3014769 --- /dev/null +++ b/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/centos-7.yml @@ -0,0 +1,13 @@ +HOSTS: + centos-7: + roles: + - default + platform: el-7-x86_64 + image: centos:7 + docker_image_commands: + - 'yum install -y tar iproute' + docker_cmd: '["/sbin/init"]' + hypervisor: docker +CONFIG: + log_level: verbose + type: aio diff --git a/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/debian-7.yml b/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/debian-7.yml new file mode 100644 index 0000000..afaec84 --- /dev/null +++ b/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/debian-7.yml @@ -0,0 +1,12 @@ +HOSTS: + debian-7: + roles: + - default + platform: debian-7-amd64 + image: debian:7 + docker_image_commands: + - 'apt-get install -y wget net-tools' + hypervisor: docker +CONFIG: + log_level: verbose + type: aio diff --git a/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/default.yml b/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/default.yml new file mode 100644 index 0000000..afaec84 --- /dev/null +++ b/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/default.yml @@ -0,0 +1,12 @@ +HOSTS: + debian-7: + roles: + - default + platform: debian-7-amd64 + image: debian:7 + docker_image_commands: + - 'apt-get install -y wget net-tools' + hypervisor: docker +CONFIG: + log_level: verbose + type: aio diff --git a/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/ubuntu-1404.yml b/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/ubuntu-1404.yml new file mode 100644 index 0000000..aa0e9e4 --- /dev/null +++ b/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/ubuntu-1404.yml @@ -0,0 +1,12 @@ +HOSTS: + ubuntu-1404: + roles: + - default + platform: ubuntu-14.04-amd64 + image: ubuntu:14.04 + docker_image_commands: + - 'apt-get install -y wget net-tools' + hypervisor: docker +CONFIG: + log_level: verbose + type: aio diff --git a/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/ubuntu-1604.yml b/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/ubuntu-1604.yml new file mode 100644 index 0000000..d653381 --- /dev/null +++ b/environments/production/modules/puppetexplorer/spec/acceptance/nodesets/ubuntu-1604.yml @@ -0,0 +1,12 @@ +HOSTS: + ubuntu-1604: + roles: + - default + platform: ubuntu-16.04-amd64 + image: ubuntu:16.04 + docker_image_commands: + - 'apt-get install -y wget net-tools' + hypervisor: docker +CONFIG: + log_level: verbose + type: aio diff --git a/environments/production/modules/puppetexplorer/spec/classes/init_spec.rb b/environments/production/modules/puppetexplorer/spec/classes/init_spec.rb new file mode 100644 index 0000000..23d5e60 --- /dev/null +++ b/environments/production/modules/puppetexplorer/spec/classes/init_spec.rb @@ -0,0 +1,46 @@ +require 'spec_helper' + +describe 'puppetexplorer' do + context 'with defaults for all parameters on Debian' do + let(:facts) do + { + :osfamily => 'Debian', + :operatingsystem=> 'Debian', + :operatingsystemrelease => '7.0', + :lsbdistcodename => 'wheezy', + :lsbdistid=> 'Debian', + :kernel => 'Linux', + :concat_basedir => '/var/lib/puppet/concat', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + it do + is_expected.to compile.with_all_deps + + is_expected.to contain_apt__source('puppetexplorer') + end + end + + context 'with defaults for all parameters on RedHat' do + let(:facts) do + { + :osfamily => 'RedHat', + :operatingsystem=> 'RedHat', + :operatingsystemrelease => '7.0', + :kernel => 'Linux', + :concat_basedir => '/var/lib/puppet/concat', + :id => 'root', + :path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', + } + end + + it do + is_expected.to compile.with_all_deps + + is_expected.to contain_file('/etc/pki/rpm-gpg/RPM-GPG-KEY-puppetexplorer') + is_expected.to contain_yumrepo('puppetexplorer') + end + end +end diff --git a/environments/production/modules/puppetexplorer/spec/spec_helper.rb b/environments/production/modules/puppetexplorer/spec/spec_helper.rb new file mode 100644 index 0000000..a528d26 --- /dev/null +++ b/environments/production/modules/puppetexplorer/spec/spec_helper.rb @@ -0,0 +1,27 @@ +require 'puppetlabs_spec_helper/module_spec_helper' +require 'rspec-puppet' + +fixture_path = File.expand_path(File.join(__FILE__, '..', 'fixtures')) + +RSpec.configure do |c| + c.module_path = File.join(fixture_path, 'modules') + c.manifest_dir = File.join(fixture_path, 'manifests') + + c.include PuppetlabsSpec::Files + + c.before :each do + # Ensure that we don't accidentally cache facts and environment + # between test cases. + Facter::Util::Loader.any_instance.stubs(:load_all) + Facter.clear + Facter.clear_messages + + # Store any environment variables away to be restored later + @old_env = {} + ENV.each_key {|k| @old_env[k] = ENV[k]} + end + + c.after :each do + PuppetlabsSpec::Files.cleanup + end +end diff --git a/environments/production/modules/puppetexplorer/spec/spec_helper_acceptance.rb b/environments/production/modules/puppetexplorer/spec/spec_helper_acceptance.rb new file mode 100644 index 0000000..45c792f --- /dev/null +++ b/environments/production/modules/puppetexplorer/spec/spec_helper_acceptance.rb @@ -0,0 +1,26 @@ +require 'beaker-rspec/spec_helper' +require 'beaker-rspec/helpers/serverspec' + +hosts.each do |host| + # Install Puppet + install_puppet +end + +RSpec.configure do |c| + # Project root + proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..')) + + # Readable test descriptions + c.formatter = :documentation + + # Configure all nodes in nodeset + c.before :suite do + # Install module and dependencies + hosts.each do |host| + install_dev_puppet_module_on(host, :source => proj_root, :module_name => 'puppetexplorer', + :target_module_path => '/etc/puppet/modules') + on host, puppet('module', 'install', 'puppetlabs-apt'), { :acceptable_exit_codes => [0,1] } + on host, puppet('module', 'install', 'puppetlabs-apache'), { :acceptable_exit_codes => [0,1] } + end + end +end diff --git a/environments/production/modules/puppetexplorer/templates/config.js.erb b/environments/production/modules/puppetexplorer/templates/config.js.erb new file mode 100644 index 0000000..fc70a16 --- /dev/null +++ b/environments/production/modules/puppetexplorer/templates/config.js.erb @@ -0,0 +1,19 @@ +<% require 'json' -%> +// List of PuppetDB servers, pairs of name and URL +// The first one will be used as the default server +PUPPETDB_SERVERS = <%= @puppetdb_servers.to_json %>; + +// A list of important facts that you want shown in the node detail view +NODE_FACTS = <%= @node_facts.to_json %>; + +// The amount of hours since the last check-in after which a node is considered unresponsive +UNRESPONSIVE_HOURS = <%= @unresponsive_hours %>; + +// Customisable dashboard panels +// type can be either 'primary', 'success', 'info', 'warning' or 'danger' +// Different types will be displayed with different colors +DASHBOARD_PANELS = <%= @dashboard_panels.to_json %>; + +// Google Analytics settings +GA_TRACKING_ID = '<%= @ga_tracking_id %>'; +GA_DOMAIN = '<%= @ga_domain %>'; diff --git a/environments/production/modules/puppetexplorer/tests/basic_auth.pp b/environments/production/modules/puppetexplorer/tests/basic_auth.pp new file mode 100644 index 0000000..e2568e6 --- /dev/null +++ b/environments/production/modules/puppetexplorer/tests/basic_auth.pp @@ -0,0 +1,31 @@ +# An example with basic auth enabled: +class { 'puppetexplorer': + port => 8443, + puppetdb_servers => [['puppetdb', 'api']], + vhost_options => { + directories => [ + { + 'path' => '/usr/share/puppetexplorer', + 'auth_type' => 'Basic', + 'auth_name' => 'PuppetExplorer Portal', + 'auth_require' => 'valid-user', + 'auth_user_file' => '/etc/puppetexplorer/passwd', + 'options' => 'Indexes FollowSymLinks MultiViews', + }, + ], + }, +} + +file { '/etc/puppetexplorer': + ensure => directory, + owner => 'apache', + group => 'apache', + mode => '0700', +} + +file { '/etc/puppetexplorer/passwd': + owner => 'apache', + group => 'apache', + mode => '0400', + content => 'admin:$apr1$ss9PwwCY$INUnYD89DGFjSnoMyZv8i0', +} diff --git a/environments/production/modules/puppetexplorer/tests/init.pp b/environments/production/modules/puppetexplorer/tests/init.pp new file mode 100644 index 0000000..29bb631 --- /dev/null +++ b/environments/production/modules/puppetexplorer/tests/init.pp @@ -0,0 +1,12 @@ +# The baseline for module testing used by Puppet Labs is that each manifest +# should have a corresponding test manifest that declares that class or defined +# type. +# +# Tests are then run by using puppet apply --noop (to check for compilation +# errors and view a log of events) or by fully applying the test in a virtual +# environment (to compare the resulting system state to the desired state). +# +# Learn more about module testing here: +# http://docs.puppetlabs.com/guides/tests_smoke.html +# +include puppetexplorer diff --git a/environments/production/modules/staging/CHANGELOG.md b/environments/production/modules/staging/CHANGELOG.md new file mode 100644 index 0000000..1bdfeef --- /dev/null +++ b/environments/production/modules/staging/CHANGELOG.md @@ -0,0 +1,30 @@ +# Changelog + +## 2017-02-11 - Release 2.2.0 + +This is the last release with Puppet3 support! +* Modulesync + +## 2016-12-25 - Release 2.1.0 + +* Modulesync with latest Vox Pupuli defaults +* Ability to manage file attributes on target +* Strip trailing slashes off paths +* Improve spec tests + +## 2016-07-09 - Release 2.0.1 + +* Fix some typos/spelling +* modulesync with latest Vox Pupuli defaults + +## 2016-06-10 - Release 2.0.0 + +* Drop of Ruby1.8 support! +* modulesync to latest voxpupli configs +* Add support for OpenBSD +* Allow to pass in the full path to a file instead of specifying the file name explictly +* Revocation of 1.0.6 (wrong semver) + +## 2016-03-20 - Release 1.0.6 + +* Publish the first version of this module in the puppet namespace. diff --git a/environments/production/modules/staging/CONTRIBUTING.md b/environments/production/modules/staging/CONTRIBUTING.md new file mode 100644 index 0000000..8cac3bd --- /dev/null +++ b/environments/production/modules/staging/CONTRIBUTING.md @@ -0,0 +1,97 @@ +This module has grown over time based on a range of contributions from +people using it. If you follow these contributing guidelines your patch +will likely make it into a release a little quicker. + + +## Contributing + +Please note that this project is released with a Contributor Code of Conduct. By participating in this project you agree to abide by its terms. [Contributor Code of Conduct](https://voxpupuli.org/coc/). + +1. Fork the repo. + +1. Create a separate branch for your change. + +1. Run the tests. We only take pull requests with passing tests, and + documentation. + +1. Add a test for your change. Only refactoring and documentation + changes require no new tests. If you are adding functionality + or fixing a bug, please add a test. + +1. Squash your commits down into logical components. Make sure to rebase + against the current master. + +1. Push the branch to your fork and submit a pull request. + +Please be prepared to repeat some of these steps as our contributors review +your code. + +## Dependencies + +The testing and development tools have a bunch of dependencies, +all managed by [bundler](http://bundler.io/) according to the +[Puppet support matrix](http://docs.puppetlabs.com/guides/platforms.html#ruby-versions). + +By default the tests use a baseline version of Puppet. + +If you have Ruby 2.x or want a specific version of Puppet, +you must set an environment variable such as: + + export PUPPET_VERSION="~> 4.2.0" + +Install the dependencies like so... + + bundle install + +## Syntax and style + +The test suite will run [Puppet Lint](http://puppet-lint.com/) and +[Puppet Syntax](https://github.com/gds-operations/puppet-syntax) to +check various syntax and style things. You can run these locally with: + + bundle exec rake lint + bundle exec rake validate + +## Running the unit tests + +The unit test suite covers most of the code, as mentioned above please +add tests if you're adding new functionality. If you've not used +[rspec-puppet](http://rspec-puppet.com/) before then feel free to ask +about how best to test your new feature. + +To run your all the unit tests + + bundle exec rake spec SPEC_OPTS='--format documentation' + +To run a specific spec test set the `SPEC` variable: + + bundle exec rake spec SPEC=spec/foo_spec.rb + +To run the linter, the syntax checker and the unit tests: + + bundle exec rake test + + +## Integration tests + +The unit tests just check the code runs, not that it does exactly what +we want on a real machine. For that we're using +[beaker](https://github.com/puppetlabs/beaker). + +This fires up a new virtual machine (using vagrant) and runs a series of +simple tests against it after applying the module. You can run this +with: + + bundle exec rake acceptance + +This will run the tests on an Ubuntu 12.04 virtual machine. You can also +run the integration tests against Centos 6.5 with. + + BEAKER_set=centos-64-x64 bundle exec rake acceptances + +If you don't want to have to recreate the virtual machine every time you +can use `BEAKER_DESTROY=no` and `BEAKER_PROVISION=no`. On the first run you will +at least need `BEAKER_PROVISION` set to yes (the default). The Vagrantfile +for the created virtual machines will be in `.vagrant/beaker_vagrant_fies`. + +# vim: syntax=markdown diff --git a/environments/production/modules/staging/Gemfile b/environments/production/modules/staging/Gemfile new file mode 100644 index 0000000..e8db724 --- /dev/null +++ b/environments/production/modules/staging/Gemfile @@ -0,0 +1,68 @@ +source ENV['GEM_SOURCE'] || "https://rubygems.org" + +def location_for(place, fake_version = nil) + if place =~ /^(git[:@][^#]*)#(.*)/ + [fake_version, { :git => $1, :branch => $2, :require => false }].compact + elsif place =~ /^file:\/\/(.*)/ + ['>= 0', { :path => File.expand_path($1), :require => false }] + else + [place, { :require => false }] + end +end + +group :test do + gem 'puppetlabs_spec_helper', '~> 1.2.2', :require => false + gem 'rspec-puppet', '~> 2.5', :require => false + gem 'rspec-puppet-facts', :require => false + gem 'rspec-puppet-utils', :require => false + gem 'puppet-lint-absolute_classname-check', :require => false + gem 'puppet-lint-leading_zero-check', :require => false + gem 'puppet-lint-trailing_comma-check', :require => false + gem 'puppet-lint-version_comparison-check', :require => false + gem 'puppet-lint-classes_and_types_beginning_with_digits-check', :require => false + gem 'puppet-lint-unquoted_string-check', :require => false + gem 'puppet-lint-variable_contains_upcase', :require => false + gem 'metadata-json-lint', :require => false + gem 'puppet-blacksmith', :require => false + gem 'voxpupuli-release', :require => false, :git => 'https://github.com/voxpupuli/voxpupuli-release-gem.git' + gem 'puppet-strings', '~> 1.0.0', :require => false + gem 'redcarpet', :require => false + gem 'rubocop', '~> 0.47.0', :require => false if RUBY_VERSION >= '2.3.0' + gem 'rubocop-rspec', '~> 1.10.0', :require => false if RUBY_VERSION >= '2.3.0' + gem 'json_pure', '<= 2.0.1', :require => false if RUBY_VERSION < '2.0.0' + gem 'mocha', '>= 1.2.1', :require => false + gem 'coveralls', :require => false if RUBY_VERSION >= '2.0.0' + gem 'simplecov-console', :require => false if RUBY_VERSION >= '2.0.0' +end + +group :development do + gem 'travis', :require => false + gem 'travis-lint', :require => false + gem 'guard-rake', :require => false +end + +group :system_tests do + if beaker_version = ENV['BEAKER_VERSION'] + gem 'beaker', *location_for(beaker_version) + end + if beaker_rspec_version = ENV['BEAKER_RSPEC_VERSION'] + gem 'beaker-rspec', *location_for(beaker_rspec_version) + else + gem 'beaker-rspec', :require => false + end + gem 'serverspec', :require => false + gem 'beaker-puppet_install_helper', :require => false +end + + + +if facterversion = ENV['FACTER_GEM_VERSION'] + gem 'facter', facterversion.to_s, :require => false, :groups => [:test] +else + gem 'facter', :require => false, :groups => [:test] +end + +ENV['PUPPET_VERSION'].nil? ? puppetversion = '~> 4.0' : puppetversion = ENV['PUPPET_VERSION'].to_s +gem 'puppet', puppetversion, :require => false, :groups => [:test] + +# vim: syntax=ruby diff --git a/environments/production/modules/staging/LICENSE b/environments/production/modules/staging/LICENSE new file mode 100644 index 0000000..51fca54 --- /dev/null +++ b/environments/production/modules/staging/LICENSE @@ -0,0 +1,11 @@ +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/environments/production/modules/staging/README.md b/environments/production/modules/staging/README.md new file mode 100644 index 0000000..68a1495 --- /dev/null +++ b/environments/production/modules/staging/README.md @@ -0,0 +1,79 @@ +# Staging module for Puppet + +[![Build Status](https://travis-ci.org/voxpupuli/puppet-staging.png?branch=master)](https://travis-ci.org/voxpupuli/puppet-staging) +[![Code Coverage](https://coveralls.io/repos/github/voxpupuli/puppet-staging/badge.svg?branch=master)](https://coveralls.io/github/voxpupuli/puppet-staging) +[![Puppet Forge](https://img.shields.io/puppetforge/v/puppet/staging.svg)](https://forge.puppetlabs.com/puppet/staging) +[![Puppet Forge - downloads](https://img.shields.io/puppetforge/dt/puppet/staging.svg)](https://forge.puppetlabs.com/puppet/staging) +[![Puppet Forge - endorsement](https://img.shields.io/puppetforge/e/puppet/staging.svg)](https://forge.puppetlabs.com/puppet/staging) +[![Puppet Forge - scores](https://img.shields.io/puppetforge/f/puppet/staging.svg)](https://forge.puppetlabs.com/puppet/staging) + +Manages staging directory, along with download/extraction of compressed files. + +## Usage + +Specify a different default staging path (must be declared before using resource): + +```puppet +class { 'staging': + path => '/var/staging', + owner => 'puppet', + group => 'puppet', +} +``` + +Staging files from various sources: + +```puppet +staging::file { 'sample': + source => 'puppet://modules/staging/sample', +} + +staging::file { 'apache-tomcat-6.0.35': + source => 'http://apache.cs.utah.edu/tomcat/tomcat-6/v6.0.35/bin/apache-tomcat-6.0.35.tar.gz', +} +``` + +Staging and extracting files: + +```puppet +staging::file { 'sample.tar.gz': + source => 'puppet:///modules/staging/sample.tar.gz' +} + +staging::extract { 'sample.tar.gz': + target => '/tmp/staging', + creates => '/tmp/staging/sample', + require => Staging::File['sample.tar.gz'], +} +``` + +Deploying a file (combining staging and extract): + +```puppet +staging::deploy { 'sample.tar.gz': + source => 'puppet:///modules/staging/sample.tar.gz', + target => '/usr/local', +} +``` + +Staging files currently support the following source: + +* http(s):// +* puppet:// +* ftp:// +* s3:// (requires aws cli to be installed and configured.) +* local (though this doesn't serve any real purpose.) + +## Author + +Primarily authored by Nan Liu + +## Contributors + +* Adrien Thebo +* gizero +* Harald Skoglund +* Hunter Haugen +* Justin Clayton +* Owen Jacobson +* Reid Vandewiele diff --git a/environments/production/modules/staging/Rakefile b/environments/production/modules/staging/Rakefile new file mode 100644 index 0000000..d00f247 --- /dev/null +++ b/environments/production/modules/staging/Rakefile @@ -0,0 +1,33 @@ +require 'puppetlabs_spec_helper/rake_tasks' +require 'puppet_blacksmith/rake_tasks' +require 'voxpupuli/release/rake_tasks' +require 'puppet-strings/tasks' + +PuppetLint.configuration.log_format = '%{path}:%{line}:%{check}:%{KIND}:%{message}' +PuppetLint.configuration.fail_on_warnings = true +PuppetLint.configuration.send('relative') +PuppetLint.configuration.send('disable_140chars') +PuppetLint.configuration.send('disable_class_inherits_from_params_class') +PuppetLint.configuration.send('disable_documentation') +PuppetLint.configuration.send('disable_single_quote_string_with_variables') + +exclude_paths = %w( + pkg/**/* + vendor/**/* + .vendor/**/* + spec/**/* +) +PuppetLint.configuration.ignore_paths = exclude_paths +PuppetSyntax.exclude_paths = exclude_paths + +desc 'Run acceptance tests' +RSpec::Core::RakeTask.new(:acceptance) do |t| + t.pattern = 'spec/acceptance' +end + +desc 'Run tests metadata_lint, release_checks' +task test: [ + :metadata_lint, + :release_checks, +] +# vim: syntax=ruby diff --git a/environments/production/modules/staging/checksums.json b/environments/production/modules/staging/checksums.json new file mode 100644 index 0000000..ddabcf1 --- /dev/null +++ b/environments/production/modules/staging/checksums.json @@ -0,0 +1,60 @@ +{ + "CHANGELOG.md": "f7ed8a26d6ebe0f9a90187e16bb690c1", + "CONTRIBUTING.md": "8df0e5be30b6bca932fb5e34c2264522", + "Gemfile": "38e0d1163b42b36487897d394a6aef55", + "LICENSE": "cdbf8d74b765504fbdf8e154bb4458a1", + "README.md": "a691c44ef6d43d9d8b543d2a11f5f005", + "Rakefile": "5abb3039d1d1652ede4f99b0f646d6ab", + "docs/deploy.html": "d9342a62d811e8d331c83a9521d7cb60", + "docs/extract.html": "ddfc7718ed639b24861b5a1d68cf0b0c", + "docs/file.html": "879efe671f96a8eaeb5fb023ced5b7ab", + "docs/init.html": "c16ebedfb85ab41558ad2fdea679177d", + "examples/deploy.pp": "27e2deca3fd5353dc8aa37c9162b2368", + "examples/extract.pp": "297e67b90bf07b61343973d3b46cb3e3", + "examples/file.pp": "5d658d29f0b99800c463dd3995c9ebc6", + "examples/init.pp": "485c058d83ed2662961ac28c0873c25f", + "examples/scope_defaults.pp": "b620b367fc13aad2ff6f09f0c18463ba", + "examples/staging_parse.pp": "bec31082b383ef5bf6f81e4e82ec3b94", + "files/sample": "c668e2074cc870f9ef59b6b33ffda097", + "files/sample.tar.bz2": "d063a08e52797236df1b769dbdbd2c69", + "files/sample.tar.gz": "eba24f899d8b439f5c461f728563ece6", + "lib/facter/staging_http_get.rb": "07b6449105e1f314e06f83e37c8d07d3", + "lib/facter/staging_windir.rb": "8fc9fd906d84f91eed9a90a32f2843b6", + "lib/puppet/parser/functions/scope_defaults.rb": "398b9a8ed521b8a611536ece0a250b98", + "lib/puppet/parser/functions/staging_parse.rb": "b0cd487f742d5966800dd9ee2d54afc4", + "manifests/deploy.pp": "29b3c7a114f002974760863838715679", + "manifests/extract.pp": "c0f72f295f7648f4f547f7ee297d5118", + "manifests/file.pp": "3cf65fc98691eb104b10fa9992a81138", + "manifests/init.pp": "702557945ee95cf5935ce6ebd910acab", + "manifests/params.pp": "171de83cf4e88f09d3f942c9157c1ff6", + "metadata.json": "74cb40b437d77771662541339790bd1a", + "spec/acceptance/nodesets/centos-511-x64.yml": "ca8258bc835dd985a1754689d124cd66", + "spec/acceptance/nodesets/centos-66-x64-pe.yml": "e68e03dc562bf58f7c5bba54a1a34619", + "spec/acceptance/nodesets/centos-66-x64.yml": "7ffa6d9164a88668fcd51a1988c4dc03", + "spec/acceptance/nodesets/centos-72-x64.yml": "194841a65e8835ac9ee6620e60b58f80", + "spec/acceptance/nodesets/debian-78-x64.yml": "56af2760a64c13a0bccd59404435939c", + "spec/acceptance/nodesets/debian-82-x64.yml": "26f2f696e6073549fe0a844f9a46f85b", + "spec/acceptance/nodesets/docker/centos-5.yml": "7be89192f37653cc187d6d5212d9ff3e", + "spec/acceptance/nodesets/docker/centos-6.yml": "4f135653fce91e0a0547f7caa0ba48b8", + "spec/acceptance/nodesets/docker/centos-7.yml": "5e0899d3028494d59cdcb2fec140ebe9", + "spec/acceptance/nodesets/docker/debian-7.yml": "4fefe3d2526ed8961ec21273799a5e8b", + "spec/acceptance/nodesets/docker/debian-8.yml": "33dfd53fba67debe3962413fd17ffeb9", + "spec/acceptance/nodesets/docker/ubuntu-12.04.yml": "cd32551771ad120f5c060c208ef48f4e", + "spec/acceptance/nodesets/docker/ubuntu-14.04.yml": "e0db14c00ab3c01ff88313df2e7b4d5d", + "spec/acceptance/nodesets/docker/ubuntu-16.04.yml": "936ee4f65c533165cea0c610a9071f8c", + "spec/acceptance/nodesets/fedora-24-x64.yml": "431cd85b87a65a55af193a360aa52f26", + "spec/acceptance/nodesets/fedora-25-x64.yml": "d0f3867787d6eec15fb1da4d9a7ee1ef", + "spec/acceptance/nodesets/ubuntu-server-1204-x64.yml": "0dd7639bf95bfb18169ebba9a2bac163", + "spec/acceptance/nodesets/ubuntu-server-1404-x64.yml": "7455367b784060b921360b29a56cd74c", + "spec/acceptance/nodesets/ubuntu-server-1604-x64.yml": "37673118cc3bf052755d65fb5dd90226", + "spec/classes/coverage_spec.rb": "166c74e93a4e70e9de79ae69f3c10e1d", + "spec/default_facts.yml": "3da74b0aff340a4fbcca9cc4eba104c1", + "spec/defines/staging_deploy_spec.rb": "80a7deb02237002d09f9d307e5e5768c", + "spec/defines/staging_extract_spec.rb": "9fb03aa76736d778aa3d1cffd54c0a7c", + "spec/defines/staging_file_spec.rb": "aad9c03cc4056290c57191985a69ba75", + "spec/fixtures/hiera.yaml": "3ac4663394e6a377d001eee1b1a82887", + "spec/spec.opts": "a600ded995d948e393fbe2320ba8e51c", + "spec/spec_helper.rb": "a177b1e9e840ff9ab649c51178f2c85e", + "spec/unit/puppet/parser/functions/scope_defaults_spec.rb": "e201417c1f5430b21737cbcd945b0840", + "spec/unit/puppet/parser/functions/staging_parse_spec.rb": "0df09ccc71a48119ca99469d1adef648" +} \ No newline at end of file diff --git a/environments/production/modules/staging/docs/deploy.html b/environments/production/modules/staging/docs/deploy.html new file mode 100644 index 0000000..fdcdc34 --- /dev/null +++ b/environments/production/modules/staging/docs/deploy.html @@ -0,0 +1,113 @@ + + + + + deploy.pp + + + +
+
+
+ Jump To … + +
+ + + + + + + + + + + + +

deploy.pp

+
+ +
+

Define: staging::deploy

+ +

The define resource extracts compressed file to a staging location.

+ +

Parameters:

+ +
    +
  • [source]: the source file location, supports local files, puppet://, http://, https://, ftp:// (default: )
    • +
  • [target]: the target extraction directory (default: )
    • +
  • [staging_path]: the staging location for compressed file. defaults to ${staging::path}/${caller_module_name} (default: undef)
    • +
  • [username]: https or ftp username (default: undef)
    • +
  • [certificate]: https certifcate file (default: undef)
    • +
  • [password]: https or ftp user password or https certificate password (default: undef)
    • +
  • [environment]: environment variable for settings such as http_proxy (default: undef)
    • +
  • [timeout]: the time to wait for the file transfer to complete (default: undef)
    • +
  • [user]: extract file as this user (default: undef)
    • +
  • [group]: extract group as this group (default: undef)
    • +
  • [creates]: the file/folder created after extraction. if unspecified defaults to ${target}/${name} (default: undef)
    • +
  • [unless]: alternative way to conditionally extract file (default: undef)
    • +
  • [onlyif]: alternative way to conditionally extract file (default: undef)
    • +
+ + +

Usage:

+ +
staging::deploy { 'sample.tar.gz':
+  source => 'puppet:///modules/staging/sample.tar.gz',
+  target => '/usr/local',
+}
+
+ + 		+ 
define staging::deploy (
+  $source,               
+  $target,               
+  $staging_path = undef, 
+  $username     = undef, 
+  $certificate  = undef, 
+  $password     = undef, 
+  $environment  = undef, 
+  $timeout      = undef, 
+  $user         = undef, 
+  $group        = undef, 
+  $creates      = undef, 
+  $unless       = undef, 
+  $onlyif       = undef  
+) {
+
+  staging::file { $name:
+    source      => $source,
+    target      => $staging_path,
+    username    => $username,
+    certificate => $certificate,
+    password    => $password,
+    environment => $environment,
+    subdir      => $caller_module_name,
+    timeout     => $timeout,
+  }
+
+  staging::extract { $name:
+    target      => $target,
+    source      => $staging_path,
+    user        => $user,
+    group       => $group,
+    environment => $environment,
+    subdir      => $caller_module_name,
+    creates     => $creates,
+    unless      => $unless,
+    onlyif      => $onlyif,
+    require     => Staging::File[$name],
+  }
+
+}
+
+
+ diff --git a/environments/production/modules/staging/docs/extract.html b/environments/production/modules/staging/docs/extract.html new file mode 100644 index 0000000..0f46958 --- /dev/null +++ b/environments/production/modules/staging/docs/extract.html @@ -0,0 +1,176 @@ + + + + + extract.pp + + + +
+
+
+ Jump To … + +
+ + + + + + + + + + + + + + + + +

extract.pp

+
+ +
+

Define: staging::extract

+ +

Define resource to extract files from staging directories to target directories.

+ +

Parameters:

+ +
    +
  • [target]: the target extraction directory (default: )
    • +
  • [source]: the source compression file, supports tar, tar.gz, zip, war (default: undef)
    • +
  • [creates]: the file created after extraction. if unspecified defaults ${staging::path}/${caller_module_name}/${name} ${target}/${name} (default: undef)
    • +
  • [unless]: alternative way to conditionally check whether to extract file. (default: undef)
    • +
  • [onlyif]: alternative way to conditionally check whether to extract file. (default: undef)
    • +
  • [user]: extract file as this user. (default: undef)
    • +
  • [group]: extract file as this group. (default: undef)
    • +
  • [environment]: environment variables. (default: undef)
    • +
  • [subdir]: subdir per module in staging directory. (default: $caller_module_name)
    • +
+ + +

Usage:

+ +
$caller_module_name = 'demo'
+
+class { 'staging':
+  path => '/tmp/staging',
+}
+
+staging::file { 'sample.tar.gz':
+  source => 'puppet:///modules/staging/sample.tar.gz'
+}
+
+staging::extract { 'sample.tar.gz':
+  target  => '/tmp/staging',
+  creates => '/tmp/staging/sample',
+  require => Staging::File['sample.tar.gz'],
+}
+
+ 		+ 
define staging::extract (
+  $target,              
+  $source      = undef, 
+  $creates     = undef, 
+  $unless      = undef, 
+  $onlyif      = undef, 
+  $user        = undef, 
+  $group       = undef, 
+  $environment = undef, 
+  $subdir      = $caller_module_name 
+) {
+
+  include staging
+
+  if $source {
+    $source_path = $source
+  } else {
+    $source_path = "${staging::path}/${subdir}/${name}"
+  }
+
+
+ +
+

Use user supplied creates path, set default value if creates, unless or +onlyif is not supplied.

+ + 		+ 
  if $creates {
+    $creates_path = $creates
+  } elsif ! ($unless or $onlyif) {
+    if $name =~ /.tar.gz$/ {
+      $folder       = staging_parse($name, 'basename', '.tar.gz')
+      $creates_path = "${target}/${folder}"
+    } else {
+      $folder       = staging_parse($name, 'basename')
+      $creates_path = "${target}/${folder}"
+    }
+  }
+
+  if scope_defaults('Exec','path') {
+    Exec{
+      cwd         => $target,
+      user        => $user,
+      group       => $group,
+      environment => $environment,
+      creates     => $creates_path,
+      unless      => $unless,
+      onlyif      => $onlyif,
+      logoutput   => on_failure,
+    }
+  } else {
+    Exec{
+      path        => $::path,
+      cwd         => $target,
+      user        => $user,
+      group       => $group,
+      environment => $environment,
+      creates     => $creates_path,
+      unless      => $unless,
+      onlyif      => $onlyif,
+      logoutput   => on_failure,
+    }
+  }
+
+  case $name {
+    /.tar$/: {
+      $command = "tar xf ${source_path}"
+    }
+
+    /(.tgz|.tar.gz)$/: {
+      if $::osfamily == 'Solaris' {
+        $command = "gunzip -dc < ${source_path} | tar xf - "
+      } else {
+        $command = "tar xzf ${source_path}"
+      }
+    }
+
+    /.zip$/: {
+      $command = "unzip ${source_path}"
+    }
+
+    /.war$/: {
+      $command = "jar xf ${source_path}"
+    }
+
+    default: {
+      fail("staging::extract: unsupported file format ${name}.")
+    }
+  }
+
+  exec { "extract ${name}":
+    command => $command,
+  }
+}
+
+
+ diff --git a/environments/production/modules/staging/docs/file.html b/environments/production/modules/staging/docs/file.html new file mode 100644 index 0000000..38aa0da --- /dev/null +++ b/environments/production/modules/staging/docs/file.html @@ -0,0 +1,178 @@ + + + + + file.pp + + + +
+
+
+ Jump To … + +
+ + + + + + + + + + + + +

file.pp

+
+ +
+

Define: staging::file

+ +

Overview:

+ +

Define resource to retrieve files to staging directories. It is +intententionally not replacing files, as these intend to be large binaries +that are versioned.

+ +

Notes:

+ +

If you specify a different staging location, please manage the file + resource as necessary.

+ +

Parameters:

+ +
    +
  • [source]: the source file location, supports local files, puppet://, http://, https://, ftp:// (default: )
    • +
  • [target]: the target staging directory, if unspecified ${staging::path}/${caller_module_name} (default: undef)
    • +
  • [username]: https or ftp username (default: undef)
    • +
  • [certificate]: https certificate file (default: undef)
    • +
  • [password]: https or ftp user password or https certificate password (default: undef)
    • +
  • [environment]: environment variable for settings such as http_proxy, https_proxy, of ftp_proxy (default: undef)
    • +
  • [timeout]: the the time to wait for the file transfer to complete (default: undef)
    • +
  • [subdir]: (default: $caller_module_name)
    • +
+ + +

Usage:

+ +
$caller_module_name = 'demo'
+
+class { 'staging':
+  path => '/tmp/staging',
+}
+
+staging::file { 'sample':
+  source => 'puppet:///modules/staging/sample',
+}
+
+staging::file { 'passwd':
+  source => '/etc/passwd',
+}
+
+staging::file { 'manpage.html':
+  source => 'http://curl.haxx.se/docs/manpage.html',
+}
+
+ + 		+ 
define staging::file (
+  $source,              
+  $target      = undef, 
+  $username    = undef, 
+  $certificate = undef, 
+  $password    = undef, 
+  $environment = undef, 
+  $timeout     = undef, 
+  $subdir      = $caller_module_name
+) {
+
+  include staging
+
+  if $target {
+    $target_file = $target
+    $staging_dir = staging_parse($target, 'parent')
+  } else {
+    $staging_dir = "${staging::path}/${subdir}"
+    $target_file = "${staging_dir}/${name}"
+
+    if ! defined(File[$staging_dir]) {
+      file { $staging_dir:
+        ensure=>directory,
+      }
+    }
+  }
+
+  Exec {
+    path        => '/usr/local/bin:/usr/bin:/bin',
+    environment => $environment,
+    cwd         => $staging_dir,
+    creates     => $target_file,
+    timeout     => $timeout,
+    logoutput   => on_failure,
+  }
+
+  case $source {
+    /^\//: {
+      file { $target_file:
+        source  => $source,
+        replace => false,
+      }
+    }
+
+    /^puppet:\/\//: {
+      file { $target_file:
+        source  => $source,
+        replace => false,
+      }
+    }
+
+    /^http:\/\//: {
+      exec { $target_file:
+        command     => "curl -L -o ${name} ${source}",
+      }
+    }
+
+    /^https:\/\//: {
+      if $username {
+        $command = "curl -L -o ${name} -u ${username}:${password} ${source}"
+      } elsif $certificate {
+        $command = "curl -L -o ${name} -E ${certificate}:${password} ${source}"
+      } else {
+        $command = "curl -L -o ${name} ${source}"
+      }
+
+      exec { $target_file:
+        command     => $command,
+      }
+    }
+
+    /^ftp:\/\//: {
+      if $username {
+        $command = "curl -o ${name} -u ${username}:${password} ${source}"
+      } else {
+        $command = "curl -o ${name} ${source}"
+      }
+
+      exec { $target_file:
+        command     => $command,
+      }
+    }
+
+    default: {
+      fail("stage::file: do not recognize source ${source}.")
+    }
+  }
+
+}
+
+
+ diff --git a/environments/production/modules/staging/docs/init.html b/environments/production/modules/staging/docs/init.html new file mode 100644 index 0000000..da5b2be --- /dev/null +++ b/environments/production/modules/staging/docs/init.html @@ -0,0 +1,87 @@ + + + + + init.pp + + + +
+
+
+ Jump To … + +
+ + + + + + + + + + + + +

init.pp

+
+ +
+

Class: staging

+ +

This module manages staging and extraction of files from various sources.

+ +

Actions:

+ +

Creates the root staging directory. By default files will be created in a subdirectory matching the caller_module_name.

+ +

/opt/staging/

+ +
          |-- puppet
+          |   `-- puppet.enterprise.2.0.tar.gz
+          `-- tomcat
+              `-- tomcat.5.0.tar.gz
+
+ +

Parameters:

+ +
    +
  • [path]: staging directory filepath (default: ‘/opt/staging’)
    • +
  • [owner]: staging directory owner (default: ‘0’)
    • +
  • [group]: staging directory group (default: ‘0’)
    • +
  • [mode]: staging directory permission (default: ‘0755’)
    • +
+ + +

Usage:

+ +
include staging
+
+ + 		+ 
class staging (
+  $path  = '/opt/staging', 
+  $owner = '0',            
+  $group = '0',            
+  $mode  = '0755'          
+) {
+
+  file { $path:
+    ensure => directory,
+    owner  => $owner,
+    group  => $group,
+    mode   => $mode,
+  }
+
+}
+
+
+ diff --git a/environments/production/modules/staging/examples/deploy.pp b/environments/production/modules/staging/examples/deploy.pp new file mode 100644 index 0000000..cf9ac58 --- /dev/null +++ b/environments/production/modules/staging/examples/deploy.pp @@ -0,0 +1,4 @@ +staging::deploy { 'sample.tar.gz': + source => 'puppet:///modules/staging/sample.tar.gz', + target => '/usr/local', +} diff --git a/environments/production/modules/staging/examples/extract.pp b/environments/production/modules/staging/examples/extract.pp new file mode 100644 index 0000000..aca9e81 --- /dev/null +++ b/environments/production/modules/staging/examples/extract.pp @@ -0,0 +1,25 @@ +$caller_module_name = 'demo' + +class { '::staging': + path => '/tmp/staging', +} + +staging::file { 'sample.tar.gz': + source => 'puppet:///modules/staging/sample.tar.gz', +} + +staging::extract { 'sample.tar.gz': + target => '/tmp/staging', + creates => '/tmp/staging/sample', + require => Staging::File['sample.tar.gz'], +} + +staging::file { 'sample.tar.bz2': + source => 'puppet:///modules/staging/sample.tar.bz2', +} + +staging::extract { 'sample.tar.bz2': + target => '/tmp/staging', + creates => '/tmp/staging/sample-tar-bz2', + require => Staging::File['sample.tar.bz2'], +} diff --git a/environments/production/modules/staging/examples/file.pp b/environments/production/modules/staging/examples/file.pp new file mode 100644 index 0000000..ab335fa --- /dev/null +++ b/environments/production/modules/staging/examples/file.pp @@ -0,0 +1,17 @@ +$caller_module_name = 'demo' + +class { '::staging': + path => '/tmp/staging', +} + +staging::file { 'sample': + source => 'puppet:///modules/staging/sample', +} + +staging::file { 'passwd': + source => '/etc/passwd', +} + +staging::file { 'manpage.html': + source => 'http://curl.haxx.se/docs/manpage.html', +} diff --git a/environments/production/modules/staging/examples/init.pp b/environments/production/modules/staging/examples/init.pp new file mode 100644 index 0000000..af50cc7 --- /dev/null +++ b/environments/production/modules/staging/examples/init.pp @@ -0,0 +1 @@ +include ::staging diff --git a/environments/production/modules/staging/examples/scope_defaults.pp b/environments/production/modules/staging/examples/scope_defaults.pp new file mode 100644 index 0000000..3073ff4 --- /dev/null +++ b/environments/production/modules/staging/examples/scope_defaults.pp @@ -0,0 +1,7 @@ +Exec { + path => '/bin', +} + +if scope_defaults('Exec', 'path') { + notice('good') +} diff --git a/environments/production/modules/staging/examples/staging_parse.pp b/environments/production/modules/staging/examples/staging_parse.pp new file mode 100644 index 0000000..117ad16 --- /dev/null +++ b/environments/production/modules/staging/examples/staging_parse.pp @@ -0,0 +1,12 @@ +$file = '/etc/puppetlabs/foo.bar.tar.gz' +$filename = staging_parse($file) +$basename = staging_parse($file, 'basename') +$extname = staging_parse($file, 'extname') +$parent = staging_parse($file, 'parent') +$rbasename = staging_parse($file, 'basename', '.tar.gz') + +notice($filename) +notice($basename) +notice($extname) +notice($parent) +notice($rbasename) diff --git a/environments/production/modules/staging/files/sample b/environments/production/modules/staging/files/sample new file mode 100644 index 0000000..01e34c3 --- /dev/null +++ b/environments/production/modules/staging/files/sample @@ -0,0 +1 @@ +sample file to test module. diff --git a/environments/production/modules/staging/files/sample.tar.bz2 b/environments/production/modules/staging/files/sample.tar.bz2 new file mode 100644 index 0000000000000000000000000000000000000000..f7fbcf229f0fc0c218a89c7de41d9b62ef6406b7 GIT binary patch literal 27984 zcmV($K;yqcT4*^jL0KkKSxQcpxd7Ple}(dp0RVsh|NsC0|Nj5~|N8&}AP@iuV3NLh z_QP%hk8;A99oghyk_A`9`rW>=fj|_X4_C92g1QT^S66m)g(`FwvCS>Z1&?_6NlaPMyd-g-IR8=y?rcN|p!=p5~A-$s;P-romz zj6*9uzM7tZdv_UkPOh~ygR#c3cDfE4RgUIe&34JvX5F-xHEA; z%_-*q$HPqs2m%2B0%@V5V?<=hrlSdyWj2bQ(LE{Yphg;G2q6SUfDlPMDt=V;GgAks zN2!o##AGr6XlTMg5+oBr1k)oafgY4SMu({NG&C9qqyPW_0SQSE5i$m;`VyYd#YRV{ z)714cY>}FSKn8|^pa2MxAP@uu(8;MhfSFA+%_d@sc-1x|O$|>deu{b~6VwuFLIi1~ z1WeFsX{myrq}4r7(^CjXsj_CI007Vce~5p#{~z7|A1`b0$TD}3CW0;o9}9B07H{VI zbHA^yL8V2bK%r><_@6h|&&G>eFZ+L|wEw0*W?<9=XV@4%{v(JDQ8f)w8&Kqm34(`V z&VVAMbdHTW_Lu2@Txb|$;C_#}` zsyj8H&k9)%ZRN02K=<}fIa1OQ1Wh7R%uj2$K|*}eok2?x&4icA7k0*aj&O7h5$j}N zsAIz^g1ci?4vjUfW~Ig}b;L6PD#1ad##PTcGReboT^6X?lZw=_dSoET$qNEIfKP-) z|L3nLC;0bay*+{8mpVW???eD|Tqv9VPq){r!D<9XbBJve`yHswg_1U36Pfy^d!T zUYi}%UGmW4)IyHR;B5Zbk3y37AniP_-R)JyZq8ee01eNl`W>dPkSBusEYo1`loB}q zRT)8V|T5N_^kL&sdW%uMx0X9n5vLtn;?Tgz(fx|xd+s)(D+ihS|@I2 zU9b?CC*j&PFQ{=OJNpM(Ll`|_2X#mC+fCY^5kdTeT7{inc{bIn6=_7KFMS)$R{~j@8yx*?@+unWzSq*GOiL*>wkhh^mMF~K=`WTH}wq371z1kI{ zj*V2&twE1}vhBHM4>=)4O9C~U7yzP{#fY%lcQhuPMlnbcf#xTtn*J-}u+&c~Q%gWa zq0nhEllmnCmuPfpW>2vBP5C742dQ~&pCjOpj$DnIVjSLg|0S7*kro_d1&*;)z0ya1 zvSnu*!Rr2_h_ zNQYxaizYPTMWM<3OgnZOo9Inw;pOr&j~fmoNLBB?BSqb45r~JnWg^KG9Py0Eo2?sp zDkemfGSVWVO_o}HNW5N-ZPh;%Ygo&*Orp^aYbcAY=5O;`)>sQhF{2}I$l9h*EJN(( zWReJqhdJTG6(UdI?pH;-m*Y9sI+e#*#`<1ipS8?t4G@QSal7iS8|ooZVYZ=4KV)6E zyPE-cIAA6;Sja(Wg=6gc?b>Q1S-+qjHSTOmOL0jH#{e)Jt)dSD%Z!5-g!$Ce41w^K zmiG5a#+kwE3xTcfFi{3Wfut?43mJ!y)1`hrfnm%?B6RK%&=7Kh{p?=~UW{pqs>7471V-w$b3-CmoCJgaag_ zDU9k?5!|u$;?ktQh}Xqu9iyl+a99&b7CEzlXz?)f=EgWdduO6v`NbJuMZx+b|4S?0 z);B6myiUv%sE<&Hg|F1meL#q|zN=zTJ_;l=GzukXXj&D$5oQoe%3Mb&6+luJDE&$) z-|Bbo?us?GSzDWg@ELlc>MLHE*qRtJl21rqm&cO)XW%0_kNvZUu|Q2={I5z9M2m>8%pDE5c`{&DzZ}Ic+N+TY%kfG<96VD=On0 z&9o!u1q@rV8HREVlEiMzX}s8KLlRiRv14)=_`7C)yIJzjF9+M_mPut4VeAgJ+uO^$ zZ;_I%gAn2nxxEz^$`ijc`cfoMoN5D38QUq(q+;UP(*|U)&Z$|%D$%)8M$(Wxipm$y?M+Qp1dp>lWb+;wg4Oax<^i93I|A!2XmF=jFcbeKlpTsppRk z;=ulKhr%8eM>VbiQHyZ=->9gmZ6s5RYd~PJvX3%VX?2SCK+K9GF$BA~BAvk@nGd$! zNUMF|PwBDA?ncgtJYNdafWIeJ0BfObNkYl#GyEhQf0Q4U1>kR(-# z6<HV7RcbfvU)cBNE&$G?;1;HltDs9}OYe8=DeG zJK@@x`z|)aBgvzhuIkAx#}NG5L_Sm$eCi%$R0>XE5;H}>E&5u?Yf$B5(cGR?d=_^5;<8G|qelTb4?+5frLqFh+BiF`qX8`G)dsc;TG#$PtWrwc%x zyZjT1zb-+B7Ylqn8hBOnJF%a>;^MpRsvdp>SvVV4mpmXm1$jFsS2+caD_~{boKdg@ zN?~7G&=eex9Q|ZtBb+aRTo4K1?1gaS*m0YH=>cbgGJ6ml&#_W(YbW4F>;%JjbME$2 z^7~MZ=#Y$swCBwi!YjbB8_RZ^DEWp9X~`v@lwC~aai$j9?QVhmAa26Rq?*t2k?#2; zdIRS7*boPzO?%n{pYQcVA74~4j+{j=#;g}fY({f33RBArehbtA?ydX0h4} zKe2~t9PN9$_jt_mM(H=i&@gm9knB4V$qOhC%&G)lp9|Zp2nOPT6p=`<3M;!a>*#Fr zHh#GXh+I?;)@DEA-t}KE*U~s7k7c}zo^{6I{ct|X@11EZud`brA=rRzRcuY|-s|T< z!W@~CmUY<6ZJtHx)e?v8y>r?#PK+(Syft!h)%Z$#m=`F%UY@6=#UmE|2<`jeareA$ zbk19XN`)=J-3(0g$-ILkuZd_NKSM5EF{Y4oAchMv-Wf%OE!xnpijT2qle*knY~w5l zm5a8Kad9hNVC;8R$qK`mhYxfXZdI^mMN8r1aGl_76}EvYkltzj(!0le!=xf2U}mcs zm=9rG7A7t00j>k_Emq?#s5tfyRMfzj@zukfYXM zVA(M2jKdH>p4ALA-I}nqp4Xug1;VP4n@~qQ;3pU&h*W&{^fQt#`Db(Y>yN)}Y5-Pn zy(rnuWyA#dhtDLz8m@V?~utT~N3CT2H*1l4> z?dLtefJ2>x*(mUm<#{Z>Ie+fJdLIcG{-HegoN#8yz~S4_j~RTRNIt&>)$u1ku>1D1?0D46e8J|l-%Bo$4;afUE7GZ%v12FK_n6(7NQN< zc)Ab8rg=}pCTA{1?j6{S9T4jxz*`}ZG#BFBPdr_LzxKP5&VcU2p4YqGuy$|>(U>6z zh{&_)V$bvnu={ovLBqOH4kt9RRDWWYfij+VyK<+cGxODOf^Iy%bM|$HrgBLaZeLFj z=5bHYNLE3K4jw5FMf35ok>b@3bGu!?XWn3q7_-H2S7tbyK!%^?841?IRgLkM(#d5f<&-#dL&HjR|{;&KgU zL{>lIg`@GVD+$6gk2GR+q^OKa4paAU>*Ve2YQQKJ`m}gjS})M-M0c?1)#aFu>V<9y zxU21pY=?W>-kfh(#*h;h;)^Sw8ByTh^mv;$Avt#~^UrxGCJ=Rnvd%>C`n?Rb1cDCq zXvr;;>-Itn@nWlGj04@)(fO7c5$5K=wI#;k#4V^xdPC`rNDzz+u7d%mPw-*1t;#(T z)Mi5Hh=l{)@l717=nnnb1NTgD)pde5&U5{Rxe=J|R{ZiCR=_SF3&O@UBK4n ze|CF%ZwAcw5rFO|;e{USaJH7(mJEnvF`42u)nA|&y$V3);|4?*ly0v~!pcFyli%F; zQ??5o)DQUM(P5#k&<-yCv&g9;=`S^}LPEn+fQjkdq|dw2Ond$@iQdzlY_-W)D_70x zalcJb3fR(}(EFKpb*8LK&9O!op+GY#0sD|LJrbLGMFoG_{rkR0E`~Gz1!+emZ29^1 zCD%9kV)C_8>~h2ulABoU1x|t_Kkn*3!tadYj-S`V>VO^Zj3tiM z7rH>G`)e;2@ox23sP6t{mQ!9AwR5`|pa617Jnc4L^c{0K?3wKX#@GxReAj8t*i@lk zt-Tt_`W^W|ejiWIeqdNLG_-nw&KnZA{GDn)Uju_dwvgQf{Np#e6ObgM^VV$keI*!* zEOB4U<6R#He7EDHAJa0?>gt7L9mIi1M2Q%ekPt*1$0Md2h~9eJstCEO>N#h4 zfrcO{i5zeQ?_qK=5FnAGMU{HlFfXa><6H8rb4{JBd3B&MikrUyg`6f4Y|?l$Z@_sW z=xDQi;y!+?-M(G;DKJAzu!s&ECfP#UJB?%dcj?QbX_uIIKf<;&AHB48kx4jR5^r$V2bx_3_PG%b}=XfzGX% zyNgso9pUH7xN;D!bdxeNDts}<`**MzRp=7zS|ApQYsqc1aA*3T98u5Ftgxk!cQn0Q zik#c{(3~!`p|X9lyyJ)NMV7>CM2H4ICkvd*L;>vXJ89+1@6zB{E!H@OZ2xgJc0we; z8i2kv)dy7yCKOk0YlRE+)JgJd$KN(t`#k6Nwy`#H^=?se4(h4c{Bd zPmBm6QGv{Y6K_!#4xWM(6Zcw54u&%Lm=D!+({(&Iw{F|FAcLY2aTj#9>e2)E1Ukv7 zXB)X_LnQUI`JsUCN)GzX9_JS0IqkY=7I5Hf+@?kM$S(&X(Q+thKB!Zj09@VhD{>A@ zyVR_75X(_e;I0VnZ$j@RRVU%>HSaJT^f=El2vF7#mJ$>3fmgLxm~8RYX=8Ug2V4Nm z2s#UHW%;gfFh%jI{WHXf++gigp1PU3ZDPk2mZ8>TBshg820>3*_*{xG9r1wTUw{;b zsLX4wbMK7MBS>cUBa7t=esmVHsBIcA~dfSX$0a33-=M?+l^4wmW zO0k_kh`?FVd0KKQM+0Q{ht!6_Yf>%Woko}(^G4&gr(9tRA{HP} zUL_ZKdvV@}ZV@Dk?VO?Ny51}u_(40lq%%Z{?jsIhv+olF3_mAwZlqV->|FOZqmIA9 zfxL^uRJH$#-q}!^p2ey4LbHZ|JrH0S@85LK1z@r89Rh@=**=pERFx5$tzQhWYrpU# z$1OC<#_AKJ>^P@^_FR^1U1P5ws?M@JHO~(KY%u_{Fa}FJaq8%<1#jIYC6Mo@WN3Q;L}Eo;ze9qG|DYA3yRhiZw%ru&3H9~fc9oyc^E-V68`jt z+XFfN-{q@}8!;+K>{SO;9;Pul^Diw~uhXx~+%hrr)}eZlKc{N;H%X1y&fsSNMw23P zei2yrL@^s4o7Gs{l^9Z5=Y^I`K-fPp{A_SlRze(hUFd&_#c`eW#}IunSVOyy!a_0^ zAII5q^;3Loo_(XK`+9ccdp61ac#mFnsb?=%`JLNeTu0%4|~(CGT~ z9J`kn-plVQeBHmeNV@`5wygcFLs2Ezc*9|jzWK11VfrRjfw3Z-i=j?&2ai zWB`vIDg!$8gbRq@WB`)UfHmC~y>x~!5#SK}(}^HxBpShGrJ@{{aOpTR>VSg!PWJmI zjE9J-2qR%rw+#{1(TwSvi9{Aip>~i`XQf{1WW-lrI%m9P0Em!D=9{)`2bfghZQ!lFAphYAoQ6tLjF(aPx$n@RK zu|1!L_0p#8!}9TD&s_lsAHqT#(tm&R;GmR(i<+3cHwY7k*qcL{6==BupT_&}5i&K_ z?^xRn9D@-;PQxVlLxXc^_4hzHlujlDQi5j7umDXV?=0jRKd#)11uvh|`rdlG!w-`3 zUX7r){9m*7RoujUsfOitr`9KL=^`YAcVf(XVYcLOjU;+MCt;m|p!1x&nEWTyKh5AL z97aowHGa7K=Yr;qUu5lB=W&cIU_NqagIGT&VOqsjlOadhI9VFHq`Kc82ZM~-!$YKq zk)A=fUkNqx{@J7Ipdrm!8X?Mo0--~Xz~{HueTCL-<<-&-L$}Xq&eN;2MW< z!EohOCP5b3sIn%IkV6>=LFS$nbC|J_*1fWBh9}6?jTx;$u+rN_qLa8zJ$Xj6gv6ir zLT>d_p_{$@tiSM|hsou}GWS{e#) z?HIu2pK+e^5Xd3|em{?Q=&#gG^O-L#C5ouW2F`{W(RdNP zbTG?V_5(-Em}9KQS;-9BQG0&z`rXqZeq5|eMu)^_%RSmbOyEy+Ir_mzR6qH-@V1hmJ2%Zt6D@1B^Yn` z`7yTpY^QCF?!8zZ-rVZrDP1=X+MB4w?ax0&|HpsH{XY*cKbPU=^M3w*zvbKA+x|X2 zKb!RV{yu)cA76W?&DY!C|BqLL$KB=g`n;Xp-mg!m)#?AAPovTFdjE&l5$lwFcXR#= zyyF3=Q+-ESqPwg3UboO$yc>8R3@_9aQJiJli zDoG#`h#>_=B8or|sse^80zaGH75r5JE7U*nzcKeX z0RSKK*cD4nNA{r5M)f|%8%gZZ&AqFTYgMoMtoF$B%ZT`#-ovKRF?y*Aek3UoLX*NX zb%{NwK+F(;1t^DTP*9L<-TQvj_Fv2L9Sgtt!|?M+e_>}2 zi(U7Bb<`U_!+VQ|Xh6#-?GOp0l5m^=PpF|n0Ch%{Cc#5c?%DvlAaOulG z-rRws0w9Q}EMW)!KTBvyVg7iKDM=ypajrMlj=BU+`To7{C%E~DIRy%YuevPWl8js+PwXu8Ej3UGK{KZU|f)Id70X~0s2Ke6DzWBq9 zN7y~?!;jI1g!#kn;OgA}O+*#Pk;XrY$T7aWDZ$GfTf@a6I=|r3f51-PCH)p^f^(X1 z3;0u^G@id$;servAPkL%t55gn;^vk)FPF2<2g`%Xg*cFWhp>Ex@E*@!+&a@oH^DuF zlhg3s=tTE+CxCuFf$#c$Bp~+>&!?b#z6d^FA8%myk8h{D)A9NHzfZh=p#F*V0s4MF zeLXvVkT3J+)6-?;=T~yMdd7bq$I(_YODa98(96G?|Ifad@$Ro@FmVs zoT8sRhn7nccSb-NyB^okV7a2Fk9ro+_vRgySFpojTm2GYFSollh2%$DhiXDT+oXw* zhqMvBuCVf|B`3c8XaGfPJ`Ab7`Tsxb$HzB}PY=gGFiM<5v%YSue6<_6GTvbc0rCzMy^Z5>b{~UO_a$#TQgYQBJ zyzW8>;g|KwepB;@?(zQync*+c`|q;S)Ivoht}%`SrG*08Hai@Ok|`wzDsUkphR+L} z&c=A#VAabuEbum}+jC&x7S_pHc8(iURda4w;@WaYWU7Uzk`~%ggBfg1jsu9G;M0*);wYs4qk`+qoql1n~Re=ccJ(IpPKKfciDF5O}_E7jfMNXy$@0;F?m^ z_WnaN4b^TEV;vQ#bV%P~-B~ayu?@GvOGO7Q4jdCB!U%SR zHxMcW-MkA6o_UrI4j^_emkl4eqCON#uHU<#K4wP;(?2Szs#-h^_&Px0(4bF@SF?8O zA4rz9jx*f!qSaW0IzNfuYM&0EAH*|v73N{lgBnG@h^OK7`;RcV?fPr)(elWXbDue2 zmx}d0Gc2+)4*qY2NT>D&!G%FogxE<+g1`CkHba$iINO6$f>@(0vM+OFI1ng3)KE5J z_Q4$U%(Yb}q%ktc@(YJJC8h~6fE+c~Qy(q4OEuB?%ddLM4}3CtPDfL7HRW$cUy-$VebRS0r%^-g5|vDV|!|*_mC=O z{8(WS%p5_On}uu*ZagF@T-E!Ck;U3lQ|EP|(#RLj5NfXQ9lNT)!dg~N?3c`?j^gsA z{!+5de?+eZ$h#{zf?)lO8wSjzIZYi#Oq1f?kowFv2<++K`9r>;HhI$LNK!09{db23 zp~8sr>xYifjrQe5&bHZPuUvymKXvz&Ca`O9(f=73B=5%xA~)On_VZ*qUrYY7=L^A6 z7JtW%vb;;(M_{mE+nb1*{Tb^C-UX=&NnV> z!@6T0SNkF;E|f3~GgY=x1Quqs!}AsC->bP&lRVn10gCtH-!l+sWo>A|a;p{Xhu0Vt z2JnslL(%b9P+QQ`c#797;bseNYh2U^wMs9a3$!dqjxtWN&{ct|*#V{tzgf&I;u{5l z%6UB9R_NKX4a44c^I1WS8;=HPV79n}1|gt;^VZ1QiuvntvdqGo?49o7();b|x-|w; z0S9Q^5P}^75ku+rO&{q4#U3E}GeH25%^gWRV5GSJ&3?CsCBIkh<2bBgNE!Y~tC$t@ z(4(yE{Ke(PRQL2b9{@MwGoOzd?|w&#$rBPCezQ|l^7u*W`gzU9`S8oT%fsCWht1{e z^zWj|{EqrY$$`uNpTPouVh8I_sgNK7av2XFA0`*q1;7vXf|`z(DBN`WWrOT~d})4K zUM0juan??EH<=h1nyLoa7J;11;oYc)m^Gv`1;D`6plWd-Q6G$^*#N(Xu>RP3DhBMP zLU1>Uy%84(eA0i&y~?ViTVsrxKX*hqUYp)(|0SUXJNE7RcVY?wk)j9N9PpR=(r| zSK2;bexK~B6%bGHpaI(fVS0Q0z3Vr?KqzwvGv!0Hsn+{wx|2?C-S|2cUVROBAAgS?0Pn|h z2+YxN5oFnFGL|q}ZdZ}w zB$7@UYk;oO`otyH9mc7W(f>@$r&|A}RJ~Q;3pYOvuU$9Kb|kC6325Cdnk$F--FOwE zSGMmK<{ia2a+bVuw>v3d1B%U-;!4@8ozndEsVg?cCeWAy5@4j7u2-h9zgp(C_KS=4jMaSd<{MVF3Y<4*%Lr6&&lex`P$3%nVl$qCX78a+;; zgcT}1WLY2avyX9JJ{}HEk2?5nom_l>P39N8m%a&r0CGBb_f;d-7mebY(%S>-deAqF zC)YW6*Ieat7Q;S`%Hzfs)@ZiRtqVfs56Z@@vS>Wqi`S>RJ?%Zud)oROIXO8dPo)f; zoSzpb(CW!{?v6hS(ZRA!n>arcqbEYt9Gsn*Hgragzna0p!NI}V$;r{l$;oRXzJHMY zmsujZ(30G9GW8-)1+eeQf|CaoMY1t9hsjwmqC$w9&*$e)j#DVccOs6xFhfQ_qhNr-fGxMJdH z)F3-8Hwznth_0O?rT{{iz*&IJyC|(Zjl@8_6)`dt)elHpfBAeZ%g2ZAmoE?Uj{BaX z0u(=d`O70v8t(LcUXR?^Q?J6k-*s#!Ux(GCW?zTAvFCN!&pGXFl;wnc+>w3>st37X zMPQ?iR>F(j=!?%ftu@#0}*1N*x6d;Pz2`RJx6`uHMk z2o8lmh?8>A58myq&)3bvbFQ9;waV?GL29C;Aex8(y8WMCKspxa!-YW|4lykwUON>^ z$UYDlgR2N2Qa~sZW9$I~`*+IYaYQH=l(5^~J?$f;i4ui0w0L8W1M7g$zhNiBfnI)& zCODucmn5L`W+H-$0M*J71bW6ENH}Bx2(eZqER+Ef93O`F*xy+lAn@jX))nRQv`P&( z3&Q}Q{QSKK%+jdZx^U}3{++$k(k5~MU0Q?@3mfU1Z|sGumMr72}8mXfJ3Qldji zq^dF^gqomeps|@jC{RK{?P~To>~Iex9r-ZB$0e-p0KPX z2&fAsi*fun73`s`2c72T4`~lSx3^Amx^&~j{=ND$>^_ZukAIDg!|P<-of-sOkwfxi z7y@x2NiHqk+oxAX)g}MvkG)(<*q|liSNe3wm?1TQ@By?AG0YfU`^G7N@TF=3ZqzOu zTXt#?019P_?QRFY?Ht4E=S3!@wfJ~qSib%o3V{y_PZ-!Jz+ojlY6rYdLZJro(~DXt zi|ouj*Q^NCsz50O=sK4iu}2!%DAA$dcw_R9U9cJ~@!`zVp-qjGuo^| ze;9ByK3>UKMZSrn=k<|cq~lR;;qoBC(r45>@CJ<6kwHmrN14;S&+o@SGaS#i**e@e zn}~}AKv+SGAVw-83lu?C9_ng^?`kOy^7K^pq37gzn?2{auN3LF#F8fCx7KoZTm9wB z#t9>8Br!8O$?>pzqYz<>V3Et5!YST`DFz<;avhD4L(}Su4@rtYVOYym;Wt{WqKFb& zvx+(ZA*2v#fHC2>&qd5HDCATd0%KV?HjxyGql&R&-O$dDMBq3r)vpR%JzhSl>pUlK_;coGG@W%hlgppXT-F%qrGm(8G=Y;?*IcFWaH+^Ms0QO>yHfJE0 z(u!7lk=wwaaWl$5@Gek9UDu~RJ(fIe8+hlh;j?l`92D9};7b83p$(Fybbp?~y@WxG z{oXU)mb*-$6ym7XPXpu7>@>?Grw0>KixS=5<06P|10&Bqhn0}1AjpPJ#0j}M^Ok}r ztYGpv3dgEciWzoMJpDcNi6e0s#=)^22Z=yn!Bn;t!-`L(v3dfVwxLybXJ3hgQw8GCB2%s*4|8wY9KXwzaKN6pDxZW}ugz3=q_j$aKs>7L5M8ht7Mif6{$_TQ%z-@w|t#rcIGkEF&Sg@!eNV zbDZ7`WJG{@Xr+NVtZiaM2q-9;klh7QFg1B-Y>q9$J$luj;q)&)IP-V=$LW#;fg>a# z5|E;%C`q6ohA5z>B%q{XNNF$47^=mB9g{#?HpLRfM9C!tRa*zldV79fM{o%3eU9Bb z`6eMEM3G4bMT|m1NkLQ;P}4+FQ3O!cBTzzLM!_i1QBy@xF(joW7{Q`RKcD?r?$ zlScT4oqRp#=fFRF1I7k%8(a4M#lb)695Lot5A)bNow{d{+t$ijsH&uwl?G_CQ-;^6;)76Akb&-zo+rzWdL+o zN8Bw5!UgO1d%gb!Plx62t-W8$z&$tLDSh1Bsoy-w(apT`3G4MQzv)#?gnc4qjx7HS zSuuLE z1tbS!_Us0O|B@djMF+@<{YIwlI)(x0A}jaOf3N*cI{1t=G5n|Jq-O8bZLnA~rH>rt zIC{T8j(m%B@5#-ljFoF89`KF{9YOn!zAr1*Awzt6bPlss8Nl%j}Q%>`8S64ig# z?1yzw+ZyQ~5V3wiqz~~*Qz9HESt$=@1wZw7`o&GE9dM#0sZ*_i~R`=dEiDcUbCFjSY(W0Nm}@r%s+Usk;@|^jn;KY zGN@;R^#{}YJiDRkEiaUj5Ay9C$y#u1YlnU3{y%PG;yvvI)g1uyG!vSLaAD1;0m?<9 zjTw>E3nAeZT38gpm{2-7xE=+|iWv%xI}04IN;LCkHyN{7?= z^WFK4bb;%L2!j?Ni7J4kq$-4{kQF-&cJW8v{vG**fdU3bFN>FI3PgJ?-dTE~2nm29 z2U~>$F&1_%_i%*jNeDWr(ay-Co&CPP3ic=PjSNatN=Zb8SDUpDGMS`8W+EgSIBLSh zQ3RI6%yhfgiCUfcy0Bm>0A$m$1) zA-`RNmqG8o(Ny8KVFA*l!&cw)5IC*@#8Y0Kc%R*l#m-vKzj$ym^XOxs8*!lqC<`C0 z3I&Om!>tVJv^c8?5KVyfpRN$a9$}5AXfayGxNtBL5ggkFT-c2f5Ez$F1qMQU_+ES-U~skg2w1+?#=et4&T_bE*Cf@hL5!3ZBw`|LZN!@xR96e(9sW%!JdSXu!waj=337N@Krw6PQ>!&^Ws{JZzOJO1XtnreqbfZm4tR-2k zo@cWcn8C0(Fdqik+f(QE??YJ)-SxKkt92f4*U;r80PqORZG9(V3U?W4BbQrJBT%&z zENxb^W`eAU+SqY|hza^3Q8WbRoHZ?RVj>8Pa3rW_QZrHzuwlo=OQ>7v1R`YoDDH|U zT4@tlrxFRublV}Gfl+EkQY5{wpmfCsA&L5a2LM&28WQq4{~vrb`Y^V!Mus1U)}XB! z(@~1cW_P;bz6IC;a!A@f2YK3F>7WsOKP?Jv0I?F`)a}W|w{(iK81OMPUyKbzjUiN> ztt1Q-o;wCLlSxUTq{vj!NRO_Z9FT_eS(q}Y#@NQ=gB!{~c9sdY9Xw@V+8YUF%rhGqRWjm(X|@Oo$kO9P z8XH+4+TKdBki070n!%?2yFpQ9X8C2&$M;NLqiYR?*{0gB8qkaJ-9@FvmtB(8m9-FyPX3`AZ;|sORZ_o z>dP!vl{JSdizU(+TCZ|r<3z&BdHvOuv1rkRA`NLBF$WpdLL9JcHOV;?kqH(fsl{Yi z7Z9O>%5L2OmU#~oncrxJS?T#iU*AL3T)^_Qq1^H034l6*eu0J;MutdmRLXui_bN$& zo`*iauzpCg(uDwC*%#&~)1WczG*vlZWc;!_8=;Hxa|MVs(l}|_P)D##Aj$3FvbjL# zHdXp5RN68zVex0n29(IcgSZa@)L2u&A#n@BsO^Cp86oIS($pPWFsuSUA+4}IJ^*tG z>>J`Pq4SJcoKdF5D%*ODB!G6H^7HJOzGvC`v$5ReK9|$U`Sj)*GPXC?z})+K zz=;~S8Y6*}X%BV@f+T}v>h8|F2Rm|LilFVWP^VV#Ld_!fS4P4Q+}EeN6G`doZeKbN z*D0~Wy6a?l*HM>(NtY}Z%)>?yEZAm=vZdH9(d2DOnvB4b&J%R<0B;^sAgW=|k-zlW50hV$rVNMfX^O?Sb2exewspqyaJ%V`@1on<69&)fCW-P7=n{ zz+|%yxFeuJNKqoNz&=3R?3SnK`_}q9!3@u4*xmYo=TSr-}XpuT_EaQo}*G0J- zI}e*v+qAtHcjp{~$QU@iVabNv#0x7phVZ89{Nr#dF~Lg*iqtyo-h9?WXR`nrNXZ%n zksDY}#PmWwJOlix7&?M*12v z(sb9VH{VQT>zVL(Kz+q`fE}*gA-5715L_UL;NLdlOimw%?AhdUcpyHL)$h@x^tsaL*U197%&nQM|#zz4*;W#6L;D)*Z#~ySZ3>(-*;Sv}U zBpHD!`5sFUaC_xayuD1Zh~e^ZMY3mcQn`DU(ar=SXFbmM#{#mCXmJIAo0^McGOUjM z@bzei=?>c+U^7@?co>Z16UB2m0$7AWNO5XR9iE~GLX^ID%QO;cB4PVhr!4f&<+rMA zXF9-rbOd5aU0}L~Y2qyt>Sa=T-0|0A;NCUgVUK-ji&{$vUjI92pp0Y4g_R!Bj4a>Ms~P&_caE;uwN* zL#Xc!V3;VDpHr@a8#|%a6>OeFMk6j_$e88Xoy8x<?Th z;!a?sc)V{OrKllbIF~OGKEeon)|(_aI?)z>TA17* znJRHU?v}fwV=3qD!JH7v2aun%uU&sx@K{ged7i-dW)HT(*Lq_G0FE8NRRru2>tov3 zqY@7@N|Ya_)h8|2Q@NKBMd`bnw;u@MJ)otM8XV#%NK{rBD!Yt`Bj+`jdnw>C^PWG&$f!KpA5P@7hBZKbab4KA1Xog9w5$ zpF~DeAqaVK20aY%eE8njFxzLI3~jBXO47!TvG2WsFbIdvgqc2*6F)(L1t6?R+un$l zC@AbmZ5-}eSeRgJ5GJPW{Q>=2CYXwYhzGI?Qu2f72c!=pvllExH>1eloR;!s>vZ10 z_=G!M8~<{}j9C{l$a@AMr6+1~4e5`LavsJqsFWfI$}ILqN1zv4@#%B9lt#Huv*?PQ z62)(8g2*9E>wa9r&1tu{i5s;R#z z(`lxCr-R%SdJJPjJs&g3@~kA{hp2cH=`KUVkVEpp;TX*7IpBwSFAtf)g03f5$(|^n zje}pe)oFd;B*q>eui#FC#jL5hDhO4kTpE9#v8{y>3Uar=4DU!<*R@8uH_JmohcI zM2dD{RXGw^Q5zs9u_oe2!P|<#gn%;>9G0pWcT8Ns?ocm~tY>#z+Rm;l}3sU!8<8gJm{fng*Eo z@}xT}dTXYkpiz-UFRXU7W8Y;oAer0Zrt~CE{0YU}yTB)iFS2FdwwYvZmzTpGIyM}< znZCT>@$v5oTqds0Zn!gcow8?c!5kmpl|8J;ez@4mI(LwWeDKU7uo)68V~Ak5$0u9O z4-Y3!+zZ^llX92wnmW+Nu&cZV{k!_fMy2@}gsJ`JI08)oaQ9e_b5+P9=)n;IXRT3T zG9e=@Eym6tSp}MtVNY9CLhH6@4i_!Req!zU7~-NcA)ghYdaeYH2H<;6Z&Zfx5zdq8 zJ`G}>_W{T;i%>|xLTOH+!_f<6|k7ZmQywd@`nkQ{iJnmQK{ zywg}sYn94R9E}#BC)ose0fbVJ`eWc7))^tB@$x?ZhrE5HAEL39pfM(j)LMH{FXU@5 zh*5(RAjHWe8M5}5s^z-jW1P*4EjlzBqAh6(D3%&Ci#1lO6O|pxoRg;$3Wcx$M@iR#xnK48tV4x&IsEm|AZnd%R zf&BzA9H3R+D$0a0{`?CHAYQ3M1rr0hkpn>E3P7?Y2P?FIePj^*aR!J0S-f=Sn4yGV zH;5n8`?9-=Oz~vTv-qWl{c83sO`^FF3xwbxfdC;PUG+lI8z*mgati?E9sh>bL4RBo zaU^6Wiszgx%<9X=i4%MSI2m;;QoRxxs{>>RQWlUq&qpz3N(uW6gRnpj-UxA6L{&NR z%Tr=~Dt8*L!tZtufCGYrKM6zQ3jQ(|sKEl@q$*R&ef4_F)UPB%u>u7^NdeuJ9rmDo z(Jvoe5vM{IhMVqcxgS_NJSL06d?S?4R#^!k>5*+$)EWC&4G#@9NAI;_Xl?is&(Yd5 zRw)jY9sP!wlUc7b3c#R}i;U#9FfP&-vw(@{ANUMFG6oq|2X_1n)xq_l$6sz1_7Z*| z_uv=A0Pe}ih<|zfL5lzT^t=bLzaca~s1+~^?(hz2@5o3*{SlB>Kx9!86-8ImoNP6T zqJpU)f|y{Yj$;*aQ%Dt?5K%V9u0{!b|Ig9}?a|pI`0vey*jvH95-ALt1is1p3>B;X z+ZR6gQ04rUk_H@Q0WsqKT9l;&%W6YyLx^;X2~b*vM5sas#Mam&k{f$fGTdoFR3Ygi zX%dElg`j9?Xen5brD~9>f*J;aDN>qgq$#ReK&FwQqJ$|5LXaW`l9Hln5`bD-XekOJ z8b&1|Xrh2=DGH$qR*FJ^pdx4}pokKgkf2%=hzg;igrt^WsA*V$hzfUyxF_+LgJ}EY z8vM`6`>&s4L89U7&jNW&7uz}P zlv4+wdEo9sct=lhUY!|uoC&5O>SiiR7$Pa4h$f-}B&muBh>4k&WU3k_kXc%Sm>~#~ zf+i^#PBDW8#xbgr2wQYNZS)%u`x!CRD2HNIexif2;wD`Y{ zc_YM-C{6Dl)?h!!`o0Ii3BsJ1D4>levJ8MS5{2R!{y8G9Bz}^*dt-4k)z6Fv$=18N zIDUSIxCc`G`xfcVKaT;WGrxyP==V0)KVO6DnDZnsmHY1#%}O7zVRF%viiL6E3CA_ayn*SoU| zV^+f|t^{(8>OwK^lvrS5jlP6sd-n!X5m0`1#aT?$nS*D->S zOArYilsBJ?f=HNfKFaYJ!aWIOs&IM*fRDi5`fg3&=2K80&epHQmZ5&XhMjOgc+}=_Kq(K=HDHUs58G2V@9so9RUUij07^}`?E0S z%yTIIqzFEv1I#ZxAYkPLqooAqoR_me+{EI*HSp56!d3rfRX%(w*Kc0{RHCITBB~^& zl4^DM<|gTcFA%>czwY^bZ_G8{IY7(59vTf}+P8*5`X8(2Tkjw6i2@A6@U7;=FSk1z zZEMPC(#WBl0o2X~-yQM0sKA?m9&4RtY}&;>26t6>V4AYGKxRU}d~uPFngMlvK6TE6 z?=B~w6aah~4$kyb$A?|ue7Ttr%t=N~xL3vU^!#Sopnx#^z;X{tbc_wVzmFB5MFJiF4X{6yM{7iU!?g1&NZbbbXA4@sVhB4xdGU>oNxf z?TUhwB>@pi#8S{xMIcZsKs7K0DM}P5L>&kIOm}TKYSx$VG?pzhL1S`gV9&uM_KhV9oQ5OPHXOgj?U%lq@mI7%2d>mDE9F_xN?#8Gcb$o5h9WUT7J)sSVARYck9bdnZV(=dVp!5~n|Gv- zX@`<OjTQD|th>S|S7(y6lDSVJ^H3p?A@5nLYBXYR!yFetOJs@83h$YMMfx=(&ss_EOBY4W%+9eVfX_+9wJRo;VloG=_SU1 z_nLX*4;x8!S%YyEUUr(EUq)Rd*G+T^IaS-G%QQfbVGPsYXRYXtTSm{G5G9pHMyJOr z#A0w7ipUL(j<|#)VJvDVSzc2xnIw8k1XjthYB6iB4-S2F;te$J*;FSrX{Hths%oPF zw#Ty;L7_q^$+?AM90@o{Cm3MNgwZuv!HuRjb<(w@QrRrWqg5<{ZyCU@7!8jWq>%wF zX)G@ybcN(7orGxE;DuWnw$r2v+{*3l`*241Zf$eRG`G4tLgT=5!UeRvZfk7BN$xo+-YE<5k>n z#xNd$bmJu|@NXr>U-`5OSVEW8XTpbvq2O`#p)-@Vq1U8oKC}RrD%Qrd9 za-sYn)i+QOk-3aajU+)q_@NxfMWN7OaCY(G&_pHNPD5lsalmH*Pj4R+;vM>HIy*am z2uW>ajjF1Y=ZWL|W)`+%iIbx#UW3%|B3Lyh36fbxF-2Akc&Zez(ep{zac%Je0q+R= zeWDCp*MANXEmai}R6lIu zI-Lwl%6@I*Jg@Hhm{Ydi7DKvqiMWZ|17j#fJBV)}{vL;>5l&1IgxC+s8Y)TK`W!%` zn`)$kX2_dcB5ZFNgDa#WJ9Dm*s5JBtRro9EXa7zHtWdwZqckUeO5S`iL-!t3um&7QH5 za0odzB&AzBN}3*F1k;>kB-8_r8&$#KT$UmYwwy`E$L|8A0|Fx9WPDQ=2uLIg${asn z0M)>e@ry_V4hj(sIRMf6}Z_ekyw7i$m z`E+nFvwIi)&W+JAW*uGz*tUd1(R3f%~~u7F|y~StR#kkhBF_Av&=qka%r6b$UR*R z#pWqqaU9}-n0H7*vZdi*n<_OG(5E!_JMC8AVKpJ51a%_Ya9s;=F-DXPO+^ese30Yp z@jY|cFxlJ?b%d&##>#Vs15-qXsfcPSSe787d4bbOtwl`%0TdM#6zf+ps;Gn%B|iTF zP6uU&HKD5`J2&n0nT6;j+d)e;YFM)aE!uZBqa&j6K7sm|_)X<4y-cH3<}k67PQha*5pHsGNO|iOWVrWD}%byx{?*2*rqp zG<7LCK1W1V=A2Lx-y~2_6F5v4vjRK;1@t*}t`*PcL%RLG&xHYY2dYr-h@Eoy+dm## zO?OgBAxHDK8CSeYp|MUyF;e^*TfcaZpNBz;NDr%M*g}>u4yKJ>N8J^q z4%jr{e}!5`!v{0Q3KiE-ZeS}zq)wOvNIiG!hc?hJQa!k1R@x4vHAzh(V-y-AP0A1` z%W!neL_pB8kEXlB7!6(reI>XiL2QF?fgA+@ut9=iq^hE!YH6vWf@FY*s4)c;5_bnP z;G_xD(qvYYTG?WySO1xBUDlBd%SlYrDAlNKyxi~iqueTic5?cZZd>6rWPYn&4R%VMs-PIz1b~&%ZGf4GlsOL|c`1QeNft$f_n5$e zV6hp82x4F$b->|Igt{~oIT7IQ#@y@@Z-BIg1@B_ij|(Y`f3kqUEFmKl5Hg2& z=5O4Fs1^eiT7uY}fPH@*(2(-`e!JY12@AU<`H)0k)VX5P224;ele8Ryl1Kw}{w{Lp zmg#V_Jcp534~&Up5udfhbYx9{(@WQi8Ds`3m~$~)+CpZPt64LXFv1sPpGskqkcU&> znCe<)hF8h}rFCuje6U-U5==0HKL$)YZ^|5)Tw*UoHoDQl>cz3Yj3FJ0 zluc{$e_9ZJMgqn|;tz9s!kR>U(O=c*0A28!UpMDZ-GZ0hI~j`~us)L&LR2EEBE}31 z3@CyIyu#DqYu>_5_YWwFhlKh5HAFLksGMDaj0~ilk=+>rleAv4 zlzUjmGH4eQF^&f13R=)YgR>6g{)^m0g#BtVKoo*13FY;Ibr6*wRi!CFpeQ003KfU~ zhK*?XWO5}!P*NxX;4>uh_ncL*f{|7Sa~Pt|bpjd*Bi4a=2yHJ!v=tICFp?VTxR``i z`!peI&NR{lgCC-m3Y#0N{l(~?mKOglwk(?hbcVe>X`?3ip!z{&&@3R`DxM;qCqQC4 zfOxV61uYDYr?;^3koP0H!vhsEiy$->(e~DN)IYZ9a6Xd^EGg>+qTe-fGUtj&q6CPC z?n$UNKTHqsczgZ!@AG#~Rf!K-$w%F?O%#w&Qc&KLyv>f`yKuGw7!Ri^ab$x{4ssN3 zhDvijdShd8)-@FKat;(zNKh9nUKqvO7HtnKU=vH)78+%N)Sja7n+Lo%WLOi&kR)v_ z(<5m6|8i0)Fnf~il}iX^R|t0_wk5*a;p`2R{&=!vA#^^-6d-CkbNP;b;d^2Qph?ys z+ED={hIBVTqd0aTup+?H6Tvjo=|jZSz=k4#_1=fIboKwBpQT>)JTfTZPFp74S~X825n^PXO{4yog)C52hxTaC#fFw_rdu zBKVyBJ{xrJD+aZi@u!Bcw*w1vXcK-5pTKo+aR_3<0O_xlQ7+KMRg6WWD_9rO zIjQ@KA+Q*0EbgdL#z`IJ0KvipWk8I`D^`>T$nWROJcvv*CE zSg4a4Ga{)SE@epKL$Hn{67d`9dc9rkh+&N=2i;m=CU|9*dxM`$Tf<<{KKY+w_N0%< zqxHjoRWcDpIF}m$RiR^~LkJ{{iGREyMT20$=}cO#tVDk(@Ct`+m$1 zKK>>RcYf2s-W_4IWB`m8k(1j%iSrWBR6-R{)l^aa-R5TO=q9kP8ke zI3ng3B$7Gm22XtZvcbzrROufRY{b`?$jJnJP01Tc`QR-4`eEl%h5*`esp5wQUA@aa@*psQ^k^%dvoTtQ- z)&S3uG<|8krQ$D)g3TpeXaFAQ z4a=~@2qO7$HymBWfOen?DWRc!{do0r47EKXR6fjjS_a7^7{ECRGtS^>SR0k;qb6Po zsv|qvR;qgwl%koFk)R?bWQd4@B9gzmw!w%fc?D`Nwn|AZ#nc+b!)H?v#2hkpa5=C+ z)3FVstCOs9cUFg;aCub{X&hW98)~jtgJi)AMI{3y6!jW*>xSKP94OHoy12zGRSvRO zR_g5(8ZGAC3t>O@b5#E?XIWZ)itX5sU(ser8?_iV8tw#C9gLw#7L4i^7*Ly_L~4QMDI`;r8hkSoa0CZg+KzFmR5+Au z_oX2Y18@sl)@5l zkb(xfb=uNj(w^d6rbnVU=B&ZoC zq9!5X+^%}{i0H|q5z$&Q@(wTs38K3gcnbo_QlU|zB?UY82Z5pSx?%_hQ8KN{hi!vV z#8HyC)3FwnTG>XYTUBtyVb~05po2w@qgL}DVBdlvvi0w5wTMA|3ZkGNh!`d2qa~Vh& zpF-6^3);Cuw1hOJUKZLYjAZXn!AgQ8EVxdBezO84^HSRVG5~(%HCC}30+Hv3U{nq# z`Mopz2%_x-0@x^aS#g=WC7^8rd&ChmI!WC%*DUpcIq>mLPPyfwrVz$It!|)PA$^^) zJV?|z2DpKabyP&vfrrPzHwCanhQV{#h#0|65=~@L96t{?o*Z%~O|N{zY{a0ONt;BL zU@}1KjEsItBy&-@karUP`?o;gP-r5cAOiq4k3D88yQiP)%yd|Xp$?5Wl*D?;x zy?bQjH+JzTH}upnhcV^}%yZYBu2oZ2MIo{HDL%L7NXn`fCnX1v(m2O zhhZXi28Wu)TmS+@_tSj&^(Z{L<)*PC{VS&}z7|d74#f zOL%AG;EWz^tS}Az?NuIx`jMQ-BjH*cX8@9M^jniJs$9AoG<8Z~AiR0Vfz%jMs@H%VNZ(?Ss-@421d$h~7d$}V z5mtOV|6egfg;qt!Adus=_0)HoaD4G%6ACDt?TvB(A=&Kn=lZk@3VQ#i{(t`eYkqu{ z?E^I4K+|gF&NayN2V5V(v6_i)M8u1#6}Qc#MLZx>K#*p9Y%22s zcWe_-$XNboEDVdypdq$&h8{7+9@%|_qJw*xN<0IyDIn=Wg1{+6YODdv?&=sp1|qRX z3@Ruf&9oF(DM`I1(-xM7~JMio5?EwuxiY{LbOrs!>i9sZ5QL66N?*fwfN*YvfK(VHt#-3RkTajQb6O??In<+p>7*RwVuner3_|_kEfR(f zPPYv!QxNngG%BLtac&=j!xUxFAP_=Lmy#3YY((rn$rU0YRbVS8HU$C+#eu24scO8< zV<9jskiic{DcTS*2P*DJnwjEk#jvf6;9m(&G`SDL!rOhO^^VZu4IMB%%&XvsnNI|} zC0DV67b6^HuJ4_>fNfs%o&x7i2@F!VLXEjH3!)C3ZUA>-LrUc89ylv9@DyS&bqE~c zoxyX(9x)bSOCq}`c=pi+o43|iMaV@6Rj1ucT)OKKf}V08>h4)Fj(Eo))20vI+=*B(jXRNEKo9rOhM?T)F3N7L-OJq zkg^PzzU~0zixZba2~QZYISna9hZHAlIES9ZuIb=nhFgP(kkCnCLNH;8h(WY#XSM4G z9x76(Fv%C6f_kjs3^9OBXl@zR#u|YDmd|N7$e|2`=|n9EQy#Jr=;Q&~<_O zj2Qr6@L=yD7>0;!9qAdMP)!&u8lWe5VPGwv4dkvGfufdi+XO8XL$W*melm3RZSd67 zbO&{r2?t<02Kecg@(wWrV99CxqLe;&XPCp^uVjv|Y+E&*nT@cuc>yFB>hkWFlih_bl#ewNX%T-#gZ_aj8w0+Qr<|A9c#p-To^fg`ZkWVC6xj;24sXedC4qnf(g9ZCyc6>*o@L)ioX@q#K2D5k05tZqbbk?4-T{1pJi zK;M=K5703H7-)6Gk>gAS{IFYsAQ*h!ak$3D8I3?m24mhv=%wwCM@uAjR<yEmZLc^qpAz#}VXQ3Bnhgcg{IN&DJ z6HN)U({1gAacQBTCQxdKOl69c*2W6e0j54k$#t>TFj^?GXo?F|V$rt4ENmI88xTz0 zTsT>(#O<>Yj1ddbY);waitbq8(=2dg2?>m{kuvxYwN>%`UOE>>z-ct!XHR}55`M@; z&5+p#3yq9^N>Mnz;P8lqpy-7{kbIZ{XaZUSqr9+GG%0OlSEZhD&3WPwu$~^{4{;x( zuSKvN!&tV6wjgLbd7mlv`wAf`P^ktI5GbOWGBgF()W0%vZSYI(U?n9TU}QkNQLLyF zZCi>%*5QCmLK@m}1qvJ+GA#+F?7fF$(@bfit z45V@>3j>#NLzC~NpF+4BbEA}iEO(qbon+awVtJCxZ$WRA3U$jPs31rp_R&B^m2VT* z=)9JN+ZN!m@iDN`pg*w-K-3a`dEsbp)kEs=lX+~SWg8aYGJK$^$LJgX&YtU0%?Mu~ z;reL0F#{h>kZcFM1J8VWCgcF?Fa~{)Cd`7SV6q?Biy>i_VU`D%*+>#df%xJs?aLsL zmqOi{rDfcGeqDG``Ex%Qbq5y%Q=;@T_*Mto2grC78mK{&z4k@w7jZBpP(nXlRaeio z_#_9`9e%R{%kz-M2j3MuwGsA^TUg&2z?Cp1uWJQdx>WdFmqW@JheVwHe9J;^f&8Md zkWdN|lwMAX0%2(HP#>T4n0qls@H2*Ruzk{(W7Y{uYY>MXVej_∓o7P|O5c_WNWX zjIYM_+7^&}WaltYM5cfW6+-ijjU!Pf(_+$5V!B;0kbn)MhCRu@W!!rJLV3P{{tyZX zGyQ_;*qw&sU0-Z!njso~jljF~Xykt(*6QnOuxhq~pp24gwi7x6A|m0tJ$p}G+4y(- zIy3v9I)fse4f*SH0y$(0w(A>{sBPmn-|c(60uVtzOTqVZV7y!m$q7ePSbhHQZXv&f zmi;X!3Fjv@K&3xy6JtbXT&z^Le4_CiQEDjR6GX|M!;4y397`HaU4M%f>SM*C2#-{x z$dM$Tw?T8erKW(OI7k?%p=nO=1qnF;@j1jia)**bISh;jTm=xIO6Z01+OZFXdFu7z z@-;CgFx>#ohPY-@Ct?l=J3x3ZUuVzG8Z{poz7odRdPs)Ba*+Ogm$0P~K3*kZb7USK zcbzVZTZq)-zgj4$$lMNpEcPB74kB1B3Rng-Hj0giza|JGAWRv3R-cSQLK%sC=DsdE%Uf}{xsK{l!$u+l4tj~VB0Y>`Z$oh6Eag`&x*ZNV7%^34n#D9`D_^jFEXV!fDhWrRk@N2oMDo z<=TsYxOUc_*T}e@k-2Xy~kgPz>P^ZB?d9#&f{Hj zk0IkHH%G=pjSr*CsIiAuhm?rsExX~dMOx&F7GZ{kPtA*?WTo0V=UQbLO1PRF+6!U)NrHUEfv2li4`g{4KJqq@J zkM{rZlP8bd(zn{|uqdd7Jh^<)*&fdGaUUO4UM#M&yd2KUD5U|} zvpR2n<2t^(>lexPWqgB2`t;+$UE2ZF-nV(7e)r{HPY-{H23NyuoaHY%f4JoTs1bUd z{uEm4L?_3uztunS?RWb3=R5enPP8w7=Lzq`?|Z%IGR=#!M*~cH>9jY8QMZ(b?VE`D5p+FUvf-iO1>Hlt!J+@WF_7Fm6}}dM2G*MT0CKB{XUpL6HyZ z9~~7v{LRZYn_hK(r+q(rMk|w~SJyPnN1t_~cuc>5Ua0NunEpqDpy7@p9odlfJjpvY zh5Awd?#p7Br?WELgP-G@SU#m^XlZ_Tm1S4s^Hyo$bYV;!N%;tmMvq!s+cK4p_ zJb6S+?AhnfI$yX)$JF&SE|Yh>O?crE{rB=^@W|*LPmI2M{PgqiW0@p<{&Xk&_%h2U zG51Z+-#y)V7Z;V*=on0=$vC2wdh+=3?#|~=cAixpz!dR1Ch5Q60lt%s!M934i{D@2 zyO%rozs2vEsP#>vwS{kKE9J}2YnsJSDxGd`6VZLSEz94wJHLx6RD{D4kM{b~LvcSH zrNbDUsXxpn`t3HI+*?|VqW`lTD%TUpM<`-}j={%_Hib}$>nzi=oscIxo=l(abbhyz z&S^0Cm5IFW+R+1q6fB4=9u-4eCu=#gHCf4BM&j?)4Dw!_$T z0`*aM2*a835cPpor_&$Fg>efz87AX#F^h-k^y$qELvJxlMl(QvT(Uv|EFnbVyS zoe{~%Jka>>zP!$t`Wa=zqOP+;`aC+Gj*`2uftq&*^Q%HAYPpfW&aa|3$&9X=mPUp# zos2vlmaAGi*pH6niME!q$t<3x$;vSu*aPb{l&3{D?eUg3w#U!4HaNRyB46E-KCsY` zJ&C7^WSk7?n1FPnSMgN0cx9(VFqtK^!P8;OVoZext!f3|C%)} z|7Y9FNnFnJ)m!>fzi(;gIxWg9zhBkLH}Z8`BgAfm<!ewy7*n~vhQcp#z!*|19ES*P6K_BNa*#I*e#DgMH!qGg2`F9&VRaTSMZ9i2tFIbVpE%F6Tb4uu zbxLIn7AbyhTZ6CsWjBB%vumV+RV~wUOqy}T@9#$CbrKO9k_G>A`+B!}k1AgnWOop| z2F3%POUty7ZsZ{^3s_h6A$PUeO;-K7=EA7C9~@ajlf6o&NzQEPHYNQk&n_?1Qk2=5 zO=6tfB;y^(%h5ERkZ$pM|J9L7t=D_@)D-U)*PXBMEv>{}T@x%z^r8}mkW12`;s`bj z*YNoduTRg;kIz>(ZcnW0;7gK}r_q6YILO8$?eoWM2FarMiL@Acf=NbSO(wJJxJaEX z;Sa1P|42Xk{r*ovMK-|0qw|9|$7dJEr>|F!F?i^K!?eMr1+5G&6Z+v7YZRApbeU(9 zh_qz-B94kAC&t)~<^}C7op(C(mrRnyd(jGuj^1=5P>TGd5078%pUF@9AT{N(y2LG+3I{ZI-`hTFmAp&5Nd; z!ZbnBI0VC0BtF-y~oR)8v-6lD$ z-rzn`O*5i9hPd9?4XdY&$aU0@&S@+aGE@^<=PPSu^U;2&ED!$p)P zN6VBk`%LKm|osTllizzXJa02fn!Jd zS6N`k_ybz;TN1-?`0xeoZ&@($(!d5pv$UacL8E+L)777*gJSl@l1xFONaw5I4<6}1 z>1cP$+pJsC!^yv3qp4|;hIg;yr+bP9^UItxu7rmhkBP|8Q~OkzH0m$Q~7bXx4X0R6Lur|&`s~`1dY>wn|!5>=?Gzx|48zz z*jnA`I4OzG)c3gf9d{S^{=r?5ZqRh0kR-o;`coqaV+H+P=xgv^kG|+6E>6 zGwu$$!+)_1vBoi>rlWY0&8MY18gx3#fXl;H-Ur{m7Zx{2h!vH?Yg#2bE3qzBna1FL z#AU(uwN1Y#m+4)XrCiyt zn0lJbm?*F2NkMGxI`;2yqZ2m8-^O6x$ECc6yOmh>WlW3|@A8cb(l2TCnXm&1We^wG z=P40UnM`|g{B=#YFJCu0CR|;l&qT=`dtSS|z3!nRf;*BKG9P}N?|vtoM#0xJ-^esj z42jkvevfN^rF6k>ju6Vo=7&&p}t{T26C(>3EkklVkuZOQ8q~gHR2=4*=}pPz?qfs67V3= z-Ef%9%A#(P2X(ugC)j{c=HaDwH)2KXAu*^RNflku;o|k5VDxyX5Sf(^Gxkx0R_PC` zLksH~)!vF|JEH4qR9urJRDf?_@)M$z8*K3`Nk;wX^b$urr!kiNHFyrK;fTfHsdgQ( z4`wqovT>Cwv8YDu14ALM#6&kp%G-npw@8Q?V!K4tn%-nQ947#sy*d5*&Cz*-zG6>A zuZ}K`-ZZL3Q~0bv1*5c>jpKWe2b-sG+9nBD*=U}#pg)7oCSqu+o*U2?t+409wl$Cp zp*eKDjLHjG@WhFl(+Nw4^luVDEAK|cm{*iAd*1fiP>SX?J`s@yx9f4VBa*y={T zEcy|T{e-@Xbdrwa+M6_BS$0~7#FKfvUN6G>@lp4?H_8%uk93t1qhsDxS)|21Y*;jK zdNvNYW$O&$yyMuPD!F-bHK&Qlns%Es`d;U&-XB<#PYY43E=dBOj)J3n%KCc4N!ABe z9pU4t+ER!(p?M8Rdrz3cg?B;%Os1erHMR75@)eWQJxL_-RZKFElCOKHhSg8Ao)WjT z0R9Lbuaq-qj+o$vBog3F)Smbn9q?6;tCUHfZ%Jyg(?=jl!sY}Py;A7Rbl2S`q{tQ} z@g-)j{27J}=P>uJRLWWO=z0AHMzwVI2wrz_*sAVS%0S=o#n|* znvoiR&;9y`NyjA`y1E)OGvB6d0Z-3KVPyV=X`A(f2{+{Nx=>q9R;`}yJui5;`{@ki zL#L=`^w=YE)Gb(SaTnG*<8#U^Jsr!PpF(o+A5vqBq)k%HbQI^LCcub5-%3COM-Fv` z;OowhpUY0;WOgta$dSAKoz?T$1dG~&v;`H$7li6*Y%q}KVj*FY!hN+yNpDfJ;6mxNM?&x-xWF@-vr^!`Diij5? zW18tCE9GI4UYf_d*ErrijJGJpH+#Qgyf8!Ac=y`Ii-*@4@1w@?KC7Fqo7Z_AL<3J0dS2~Z`_y!}RmWeg-`78qg_4v%DQ$(A$*D0yz zBDIi|BflJ<-8}7SlUrS3q{<*mL~^*E`Eo~hiK;I20loa#`b|WjZC;9}jZ5)Vm*VOF znM?6>aVeZ8N&K;-izpq|>N9?M;>P8Pu{`k%7RLtCCc$SLX6>!$Zy;Y*5MZ;IIx{g( zOw?V7Up6Ia*~vX|4!Z-ZO#z1_jV3o6VhY7sE&zTEQq^>$q?BK{c@g&;7jYkp2upe| zzCyg;pT^}E@>@|tTY(7LddHlrJpxmIi?;TI7FbCSR+29bcgGH{&?-4gwmg5Otz`yc1Rnd){!;n4O-=rxw=1+jJ-fBDQ0)L0h7lC-Z{MMSNTG^>v#p427-}?L%|EGS$mC|Pbm0U^LZRJ9>f8-i8v~mFY`;7ayS^n>$O;qAlOCNG!F3op&v)@=eR0hsPCB9mzHE274c2tPrNO%vp6bc zG`m*!=6Pvg zFr{Th*o?TWI5ehQ6b}>Fc7`IW%Zv0S96(HRbd?oqq?3@q{f-I{x>Cb<4)sV_WTGCe za-=47<(BX!PaxmIkV_ZUqdj7N1!BBgq&<}ynq)ndCmtl}fnb@e{)(3uq#Q3G@eQIH zpIpKf3Yiyku_uw(R*s2>(n*-&UuOnQc@dyuVOjZ%aXVIk{f z(9L2_+>#FM10|tfA#2fI{Yu%XMWJin(FHESf&-s;yxlA~I5jTQTZP|qeh}M!aqPfK zZu~C3WXB3FnAteNmFpy-ekATmyi-(Os>l_w$`o0~{211Ij(hLoQ*PJT4+d5y;cd3?jk`nr-BfocMdq4Mf{VuF4d=NW#l>|u>hwBY z4X>!)7uKa?0(DoNTIH9_BHeTiF25uL^|u;$g07#6VrtADLz%ZzlHgf;-1l)ipcdQg}#Uom}E4F zhwpjgxe4)oUZ;UlN$24@9z&I#$Bk>Sz#KUMNn(oN+bx3YbK!_El^F@O-=7DK?BhW8 zju_{3PM4?{gy2I<%4X(qpzmzI(GW^^z!yR+RT8^Ou|LwXoWAfATW|4#`AEyby-3cn zH>MTu)7cDr#SueJJHy+9gb1Iv)EqM$P%i@-Ae7%xb>MDSRcQq0x@I&*INrP`e3`38 zDqHf>YgBeB&yWB2k&lpYVF~vVc3!i1Z|OwQ&P2Tq_g*nW&dUtGBMC9#a7qvvNh*1= z%}%_`qE^{XsS{z1u2hR>5w1APjCk%ltf8iuK1I-?mC&BBU4 z#5BpCOc>VWvlf+@9USL+ZVJ8LtT|{}VN92xgqtC0W3?52@_$p?WfB`L(?tBh{t>xp*+se!f-%b`<2=hL7; zT3q5)2r`UTtX6EMdSR*sD^c**OnqJi8~oY2??e0+?)ugRoQqtmiWMgeQJZMF!gMiYn$llYETB(w^B`ip~wMAE!kFAx9V z>iw$t2x;klCfcpq%X$_76Ox{^t+wMK5qeC_3`R2qktm~yu2Y(CKD@q%G6NGcJb)Er z0JoxwbBe153T!qtv16foi0L?!$r#(Ga&#{XghIahX_KijNW@~Gl%`=im)4@or zN2R{7=&Y<$MKYVYYG5{5xnmb?DUw|TKHsPqUzW4#t}cDFD*vNG7URn{dKh0e`;E6E z5^9M^%jo1KPT|2D`ZqN{0CWgWQG!+G)pzI7=IQzNqh~uU+B^5lk>G8E!#0}szJ|sB zd>aX2ThUpb-H5p)F!Y@ry)rYc25lg57)~ne-kan`4ZP6_E^XBm@12-4OCa6)H&ixhJiA4L8^>nyS&Aj&4NRSOcI@I97@-QA%QxptBQ7M5 za6tD2l-SZ4=7e9xtnsUgF{|?w>E+|CABsoSV{9FgCdX=8+rI0Oz}dq9deoq};^}lm zf_K3b(sbTm(#pTY%AcCJ&k2RtE64bS>B3eex^HrD$vJmoO+tiQFvVwQP_Zm!M6m48)*&xnsy*Zp> zpvt27)|!r9^cQ*E4qqedK5S&&i;k)_FV4TQDO+<4Bo!)fl~q|fyYE)nWBrXLE?Adh zM0~rFtyId{Nqj%T?&V5I*^15ANrw0O(Lv}y4c{B;ic<%JM94!^@t|S&lo!3%oqMW{ zTh)0yWp=-3O8X67O013qspEc=lcGlEic7R^l`Dd|y5cIfH>aqI-#*SOLdhV(+&j8> z9n~@C@*EUZUdnvU0Ii2fEfHcZJK=3pkuN%u%l(iGu0_JE+&4{9X7J#{M4k&ZahK}4 zWHarU6`KX;Iw=zpN<{|@iV+9j5y=->QWq%vK{zbdfmZ#HWiT11OH`HY8Ou_AkZ{1F zSeK^5`4D_=r^&4+H%MNfMX_KES#>B}_Q;g!9-Q&F(HJKfUuG~H*m0KdH*x<+&?+xk zTxhoaKxY5JNh}a8TB*!E`o!o?vv{iXI&rxsMk}&a&PObcnIwlSRruQwXe&`g zkNCX5v!q9ex;x+yRko^)Q{w5eC*hP7O2A0+DxI28vx3sFq#mdN`zpQyCk17av*r+C zU3_8ejnvB{z=e)To0zR`v|M~6ELrh9B?+8EQYcz)hstcBMNEYWP#uq^h9UN5>S?&XtYLg?w z3E}4&lj4Uzns?u%Ky_{4!@J z{MA&iNH~n)HXTdq#C;3Mtrvs&eAj=jYq+lY9V} zm!)NCxq+s{ksHaDzF$qPha5E`ei#s+U%JLKGt0*5uu;C2CmK4|h2oSekTkn?)JT8& zZEyd)cX)Ji^!5J5k;@F?&Dqc)$@8gg$AlX`A`a+i_1H-j7WaP3D97>M(WovycXe7Vn7Sgy$|`FmBEbh zVnAUj04j(wQcoN>(k&vYn8S(2$uXT7Pa086DQ5#q6cWdE@)3v{1GEKLqEULE)1>E? z$Q5eboO-1|Y|NI7b7Gu<%kM)*L#~c%Y|kfg=}AEnQY`po27#tR{%=#FywsZw>3Yfq z=811B_I^p2!*H2A7ip2R{d>tQZ>328WSi6JA`Ji07sZe6bL5ZC-Uue&34T$ltNIBv z4~kB9j!aM2@p6kpY4XdP6r|k%hSS z#BkM7OkMRC2G7t6cXXeMu55}Oy})oJn1C7QB(4CqZ-}d$nFRy}hUVk!NDJ6Y?iH;; zY}J?Q#f`^lc`t^5(EJ2Tw#H5w+mb=+x~`dU&rG)K(UHk2T!}VP z3kn3Zg-V+#%Q7^JSkQd@S>hMMh~$tk7s;>Q>VL@3U}Je?d>Nt8!j(Fcl%NL5b$pX% zxr=yprcI&(x_8u{ghx4MJw!vnuC;kB&S<=6><%htJp+V?rp9sh4)mhcgG__CG1oDE zU&pB7Rtc}Jcbw7ihd9pX-#On&aENUsf9olx*7fL~?Vo?wc4!s!N{>0-e!vNE3$o4$ zpmD8p0(_gl;sgj8RClcX1klKqPJr#k8b?46%hCz>Rn*^1w$0YJ1dTCbhdM<_4SAqf zyYoh02dHuHe@8)GYY={OKsj;&0^x_33MtcdMq-&KHQV?buZOVsR2r7O1e* zNL&l_cTvs^#-}Qe$QO_rPqgdj>bMaF)jHK|^zfv_W1xjf^t#J|wdD60%5KUyi*BHw zJml)Ak>HNl|AU|zP+Jf)^5b(8JbzjzSa&()sOpZ>Ox~aaP2a#4T)A9qP3a&?QD|fY z$wX{Y72_Rs))VAHlQLwB!iFtfm>880q_F@-^N-WIIt@VK3T&_y@P}XKz;7Kf`%>4r z1JzmtgfNULhCKv1b%J4aG_XEMPnhMBs_{O#cVU$FSvVnpI?=zV$1(c-GL~@Y2El8_ zeOu*s>KE_OKYY{#p3$HoCP=V1fZ!Tr6ro$gG8xR%v7%}fa?%h-j9}w&I>_O%DkZ5q zOs1QLvGdTKNF`>yNAKBi4a`L=c)!*G>`NdAWUi%CvBa}0VS1D18A|Y!(M_DEe1Xwu z-W?vli8g5~J#1dIos`4v+52>RS`?$fmW$0p`=Fn*Zx7D@u)B-fVGiRLO^BYHC6j)U zZSfU%6Q^U76O`uIORs6ZFs3D=rRxXNQHpm)HqmZMABNbCW~6-Yg zDCo?)ZVtt?!g9z{^t1nAUZvdPG6t=0Lg+=H5t$sW3D?|F3`se zs>0uTw?`d#EQYR%(K~j^mUBO3IjfjlL_XZ!PqBPmHh5b85?~hpaF|KB2J)W z2l`z=!tbvi_uZ4mbR8;xHbsChM86UT<`BY`_*Z+3mlD4`P-bA;bcNlcF^%*=eC(+5 zE!*Gv;I!T7@aPTSbVskhX5$3%B(J9FKd_|KNFf)$z-77%9y}VHn{Vn*68yTbt}&+5 zvZ%3>%MSL#>3_s$pVAjztODwgE1&0=enDE8X);HvoG zE=9YVEoGOtLQ#(^dqO*`0=}IkE^w*Nr=XR(Ep}=(PfNd`-*^llPcEFq{eh#;L`+YBb~NXq;3t3M{Wkout-(eHa_)jZQSFEddm0 zfW2K&e-J+@bt-HCMHm?Pr+7FolP|d7<1p^&*oJwjUyy>6viKcFKl@aPSSYQZ+$9_n zsZSlKF!Q%8XHcg@FVx6G3|gIyA-F(~x)QY5v;B*2KD@M91_z=>)T|Qo{{U(8zksEI z$lF*NAB1I==85S;GdEAAbsWxx)nZ(Qi^8!x2Z(+?wwaY85x$>yqRpg#)sH%OarZfX z?(xq@ovkHKSk&`D;Th>FvR2tvj%MJz+Bpz6cTRCjj$c3x7fcF-(KZ)OLIu zcV*gdk~(nNE(g`V$jnc#v_jzX7w@xmfpc_&^n5FcOD=#NA4Q0C8=jUQ`1Ca=PhGN! zlGsK&{4mfM3WSVcYc>HNE#T)dYcE?cfv8)Uvo;Iwa#h@F4kqUi3ijBj?O3V^6#%;r zz8oc1H{nvs4XGuZT0NecCso3=G^Hj4M7!h!ZShX05~Xa}s%*i@lX9L<3zu_aUkaWn zyuF!0sd5Pn5vwf*6J6fB%2Hc8PquIJwx};zC|>G>@k%MDh)YGT#~2jNVsCF{K)T}H zXk-^=)+^#mhlWQ-2BK{?q{Wb!N&bxV$X+oY;`~EvaxvA2TG5c6Vw?hGKhNe@*K~_B zk7S8J7PRUlXR-PQ$grbmbD_1zJG(rZ$2*_3q|Ci+q(zrIL`8kXfWmn(9u6y3>q7^i}90F&pe2bxuN0rf;A;W#h1Ih#si zorXYZQ5@BE%4O|6`uuZWE(?FL4?#whXvl+yGK9rJBEaR+NA(D#B8j^VL)_5i+>nqe ziDt6G1&T#qUWbr3Vj-F$xRMwZH}^9xnX9B4mC5Y|StU))Nf;)FD`KA&TF`mwUD1!f zFj3(VHHvDe#$OcrMh#>P*HV_T)iB~4963S`EYRTt)3&R}j$5^67?w*ive0AQ1PfI) zV9xbV2NSM4zDHIX$8d95hV{WEs$2PZnywz+4SQz8%)y~N$`mC7aQIFlI^r##k%ea& z9AqgDxZdX%7C!8~bmM&SmrCPAr;~g8uBfYkCh^q@8Ytx9vz$VlRbMhAiFy*Wn*?G1 zOy*ZvB5Oa$h;#yyKuSoN&xbXYbas6yDlvyROETLMDhE}CM3+>v!QgHiU5PEwqbDIoa`~^1iJ4T@p1UV4Wwv@nyhE%_jS^n#K3^L(@-Y&DOsk6$e1zuipoq9qP z;&VG_psCCRST2^U&bIPJSJLw!AN|S&L{l&R!g=`k^$XWDeh`tGI=pEG%|kk+CH!4-^KVBTho4IYes#O3i*TWkV5Q{!ov zM->+**DYVp4t7&~C8DEB`Jg}mpNQom&!I3by%gf;6+dnw)0XEh2i%0e87b~<) zM)~b3KjhrEWk?n0q@CAbaM!H%n5$jDh2JYPj;dQ@<(FR)7pTm!MHu1jK;ms6Kp9Rs zX7Ki0t&(T^fYY&nFBVz5imx63!94Mt~Mo4>bn4ASRm~j5&Bs8ZdF| zs1CcIJqlC@{Kck?0+D5DxYC@)SPS&3@t33~X158Os5DlpIe@=qk@*6C2h~E$+g?&9J-1%^(q=ZJbPELz~$b z9Q>7_Rx3)&@=XXBc&1M&Sy{{vBm{H5$l4cUCTp;dS4QfbZ3jVv71Y)0wYvKt z>FT!x&qr^k8jC*lIN7$2NJv4t3tyI_jE#C$RGBT(OsICh>FcUoOPSS&M-j6jypFog z!p#+a%9pw4AEmf}s*$=HZEL4WVrvz|x&<-1IXcyre~lX(@TW|~JWb^hL0#wia%%3=++z|su|U-@XKvn=jjcUW$4UYr&|lBFXdp`l z<4HZ>2}@>nP=_jjgbi0t#pC{7ZOV6WB%tH~&VcBfs4uWI?&LGu>%q;PD5>wPW*&EffYWd?m1^tYOOG@ zU~{nvvF=bnP;pldqMC>W6d{oJd?s3Sb~}~IE~%UyK7Q4G+1u>- zAQ9Gz3slffj~F?gi+Jm?zKuD^J6}+BxyZQqq8y_e$LyAF`Z)z_>0XNtQ<7TSR6)rHmE*;3(v zmWP;|_o%9fD<1$6^TuFjF6Sj?p>Z{Bw*f5mk{Qsl6aGQ(`+7*(K98lcGW=UW`9z!y zk#DeY;*!<@*uF~q4?-NIShn4Ww9FV~7`Xc)0zkdA5DTNx5%Rw=c zJ`ZxuO$Q*Fc%8nBx5aQr8)bNX3jVw-Y4f$M7=%3;WC8IRyMo7Id+VOP;l z8K?zE>y~Tkh1Jx8QgOyX4XDHK#fjw}Z2YeckB+n=uEwJ{FC^9Xj=O$rzDFB*bI;!# z?H}5NK2Z+3Gq?;A!EK$JTFonO_ZGiN;yxh2O_5d#U#Ut5#!<7Y;x*x!&Gi0FBfSS{ ze0(*@uWQ{(M+_II?}j*vKB?5Q zUX&z8S;u(nIu3wjr-~*USec!9he6pyK{b1JSN!(KY}dl+;Fa2X7>BiZWWq+PGCziF zp>UiZNY~8pJ#rq3a?T7po`$1v$-$#cR!ZkOblHmr|v$ZfVxeLD^p}S-lprNV1R$9VD#OMuM#8xaRxV3&6%M$5_NK{Q78*Ms`O-8>SPkP;ix&nr)#E zd&vkJvb*!_dL#GI-HMDsmv1CFk>qLpUQ`d$S$NhcYF8{UT(v3TPzT_-*2AoapQE4P0neVD{3=rzdSxU+KOH#j1jRgCy@2; zs)QUcEh z*U^Ri4+;9=VDd>eatNeS+y)b9VRS4QToR*fIbQbIn%TQ&g6Im-BaF+a)M96bpv{Ub zG-Rg~TPR$ALOg*xfmVjOlY|!TPb~~g(YHAX3e;B@pZ2HepqOz6R20sMr0kvNyS484 zsn(a|B2<-XUX^dKcAq*K=jX;P`x&R;=lS$~PitW-0C-c7jc|a!IVTW@yhw2Ba^>ha z0E=9uAE)qi(<-5)C4JVhvfSE`72cIOqi`(?z1LQxie-HD?Zg7f2WiJw_bvpInpIUv z60{l}g`w|Q{|jA<`U2qy^73$;Ngb@)7DM2FG_Lu7h%|%SS9wUU0hMzh-o28-hS~Q{ zgXSb`*dfR{Uz>1Pf1>POIV5J06{*CsSef-etFer12gp&407H07<3hY|T!{B_kro}+%g^qn9s-;I@x0bjp2Ld{wjWU~d1(JUudrcB1 zc@bkS_2Lu$l#VqFeLSx889?3#gXfZ{Yxt$#FE3|Z{YW-h@LT2E5i5*NmUp%+zC}9Z?`-&Zp&GW=rHnpBaS5@OgOSpREbPdD_+VdH*6(bO*NS+ z7uS5=U*;Jntp82^9A$Hav&g55*1kk)NEfgnvdNG6gyrBqkN*DmZuIvK{f{KpzteL3 zUEtsUenVU)Lb>5$j7&@qzd=SQW)5wLm<5_MBS|YFB8S zIwp;Cb~{f;o1DV?_Vw}iJ<-GON$#5zmI!M(vtsCx;pz5^!B!9*I9no}ip^Y_*aAZ# zj>?b}+%J!IVLtn3XNUV2`)<691i@^HwHyc}T1IB$kI11odvgk1_m6+y_Z958QcP{s z>E0H`aO=jPj$uiwjox7&@}aw(!#T>K^kdCD-!rTWTYxc1q9kpV%zI$|0U?Zd_Djp^ zk>r#=l!8ORnN)onk4e^}M2y=+ayG7Y0JrI*KM;%UMVg8z6T}C9P`7%(_9NvbA%o~x zlDB@&m6bGS&Dm}7Wif}sj=#2d`#W{q6o3q~A@0YUtS4EIE1F2_zXA}z8{asPa)+%1K!aP(Z zxzIl3oYH=8;|UT1TPd%l>KMQ&L1Xl9J2uPq`S~}fY3p$hGB%}zgs;W1fPbM9q6mfjW}rfrY^K2@ODSv{91^+F zjWz(g-?;G-50n&94D3Vm5+=?U4G#(=Ys zrRZ1!G{i1FtK#w)gZ%pZeE;k?+N6JbudNoumQjg!d0~j0!3L=ULCbBJn%~iOeFsHQ z{W%VAHc2$PBi9T=1&SoW>5~&&b0qDUp{diN?7?@kR;so}(_2bv0O~3XPVmP$z6ZO5 zVQ}NoO`6>Hqa%;jVz`)91ldVEye4t6$ANyPoVmiXi@hS7Q3HuI+RlH44qa%H5T(l$ zU@cV;{Q=(BDj-RYt#tnSZ9>8thOsb<_~lxP@X`0*SJ8pCR=H)=Bs0pw5t)S$4i;8- z__oljx3Cm+6AMU}+|BLrjmK4=EsEJ#$dfpl*nb|bTH($+ap~KsI#8E!jwE!GXUjAv zWqe_)2`XM$K%tp7;9TUXBQi>;Eh^ctZ?1@NoA9(KfD8y9n5)>msKMEiWdG-fR{1d+ z=#}{#lgD+q_?fKml=F#UFExM8uRc>+$f$Dc0D@uQ#y}j7-I=B+Gx8YcGdU()` zCK+&`tUEEcbP^x!>~`tL9$)5%=S}wwKD{`4E>qF`^HL-9 z#`i9hr1#R%o9VmMrvv-qdys3~G9WEqQyI2DHt<)qrclFIc|36p$sis`(N2nj*DW3k zlUb2kfaQ9}*Y0Sv`Djb`NETPp91ymbeULiXL3u|-@d|5VKQNz+xk@kRs$$KQXwQim zW0oW>$Sa|nfp|+gnNNI%5I5umqyQh((EBt*N7f<`s5q=37G{WxB%LKj!5bq9SYmQ> zJ#oz)@wH3bFkKk%5z|Yz>8QM31=%aB%=3%{3j%Says#Y0wJnw$mzGRo*!&U@YtX|q z%$*cz{*7~T-b=R1x2hTl1Q6fV5>`#@=zTiQxN%Y>Cj9uT4fRK-fcMZaGDA+=xRNHn z4j%HcW@cn8o=1B-JKqvZobXERe%(CfTw%NUrnzA&qAmju84(t9XW!A)^yy{CAzolktoV zZtf=WU2_iKkZZ9a4E&R;^bGFB8U8Jd!96EYW%CKx!jC=rr6IfYobMU$SGLrG+*dE) zh9hoRzO_=PVeYw_LN|*oQdGRpvGNuPL{s4=>=2F+N;C{YDtv9~0pdf7d!U?%p}5E# zdKxda3=Z0GhD%=ZnMk{d^PD6v-FrBk9D8?3oM7fe_;=6sE|K z9nFWlod~Ew3gJLdjx6~Ujd}T4O_{NL?tmI`ZE%%CgM(buKc<%sdR9D0&=bPGuUF+k40D)7>} z2=TBCVra`5NjHc!V9-}s0y$#-qLLo6#-YfEvld~(J@#o2g}Y|favfVx5@W*A?UK%b z;#h07{1vCl3^HwJN}da4u4ZY=&XG^zw963^f-`Tpit~Jw9$o~}8SEOsx0V6fL+gqg zRDnp_C?1gBHJVR4{phbQR9Cq(%gLz}Z>M&j>{MQdfv#Ha4?%9bE~X7KHd=uC_Q|h_ zY2yx0v95Gs<_&;4ue>?47^+6J!aC6pn~FA9JoT>fROUj2wkmNruz_wAF6>3U5@1UV zI#O2+-QoFFO90^=&XSRE9B-+1RV71XoR%lxc&5c#@=J9VHBP1T6;EmN@s^uazT&~l za<;ka9%HB_#Uc)o{H!WcSSPp?Ts{uKxDSoo^`hN7wJRQF0jbnEqM?odd zOiS!SZPTK`#OsloDH{uSlhslw537YUFkKdi z7@mYxIJkN{X*qMLq8Of`1$UveiLmmptw0}kq^mN8_`UT@eTl>27>ybsgmaSXy8;uU z>Tk+Gy|JXYTU4YJV90Y|$JPMxsuRGK^o~nE|CV6m06KJt|&(*fM1 zdp8@;5pfRx=a``^w(RV3V}bSmpb9zc*H%1sDlp-O4Bnh^Wa>?3T%6dy-L1{xTfstB zm&>P~v#G~prt>hCE=XYlc6rUb0mxK z(HV~Cf+%5W|@<1AubX&i) zV&ldx$|Xaq3)^(fmM#p*MgPMA67#FQHQ;Gap z5{V!tRG&~78n``)Jku+!iuWoV=2?+lini-vHZ`OJh%m8_=yu_tq@GTMxx?JASQqA( zgZN~TTTd2EYS>n*psTj|kroxy@;2g;U3g8Mstni7Zh)}zEP|7ck1k$DqdcaW@Xy{L zPyP|V?-etwZ4a@>y`9HE;coC2SiFu(n|}2aV*^I8?CyREHm}s=?`F=$?}iky^buDS z`b|+{8W{Fz0>Lcj-^GGeNN#2Dz!E%j*P|0NP1to5N0-pldUHc23H{oLK{hnW1!7^# zjJb=UABZVBjy8Jp=sB11Nv0^YWsG1&`3)EFPp?_Y_&kABFWG#m%6uZcsuo65iE3`- zHI;bhwZu=o$b4`(AZR#D9E|*+80@K z(9;&@OZa44l(83HKoRv)oPa&4IPfCLx? zM-o4eK$xm?#tZy{Fv*!(#(A0bpn_gakV9=;{>LV##oZ0bsb<^S=!!3bHj9!W@%r z`Y1|4A5o{VecTM*)d%Z~MUm0-#&+$MmoJW)bf8 zS^sg1Z?HEl$1P4IJh8UG`1<1HRjr&@^TorYMf&3S_?%@$jS)66k%@_9#iWFoLcf>U zFdHMY2Tvuv1RleLjS#>g9Wx`ECD}}~Kph)V$VuEIsOxO0@F{~4L-bHd=Y1;qW3KYg zf_-f|%5t_(2bgXEDV=ki3%b8&L+*7ZK_|R6U_BB6&MssH;}WQKV;w6NP%{8L;N4+* zwHo2FP6WjOKBV-?L>2z^+htC^8BE~(@CgQ3g8vR8R@QhJGt5biV(Z0g{!KFa)sB`` z-U?w}igJ|AO9#q`TV5{sfBp+x?Z=P*4|{c8 z8-D8C5VK8v&=S_-O;qi}`{Wqa+2S036QE7)Pv3Tz3Hcr&Rdb1ielXI?0~@zk9*p1MVNrS(r+th052v?D8v z>A)8SIe}~1lFWH(Mnth*2DqN#ccSB_rxThr0 zOI;nat`q5#aZM>k76YdOjZ$)=QrAz#(h!0&cDzG{a!| zGA6wusUX);^1B0>$c!Aj%*ktyAtL z_VB)%(B_XV3neYJfCob`@(FX{W{QofZN@WdDV9JxhVycp9nARP^!4kb0}p*JrQ20F zaj_mMCP{XR#uBP^!dw`7ADDOBs#=aXbrayOaX_&{CCa zVQadFR@W3v`$^ORMr9|AA=1cFdz}_7m}#gDV3RiAPSZQqzU%H0H{#<)QuOV&jCJ?f zUVr!L=l$KC{%&Q=>=1@WHyCTvcpx=3jmQCkwhU-;-wz!1OG8p;e$z;Ljc0Uq_defp zh9C)-^Hr(WCMn@Tk+e}mk+k*TOnz$wk~1s@CS253Yfk|U>O6+k97$2Ev>99smSVwG z+bqK@tk#BpU2fuKif47R;XjS z$fTMgBR3L&=~SlHD@r1$wd9)^o5XZy^%pqJnwG_`i##pfV-lKj5M-9~I4q!k5Fq8X zSf#+To2^oKg8A_5I;VlGjYUGA%Ny?C1kf0tJdPWQgO7H0Tc#=xHAHIgrD@?$$UxN! zo2@m2_nz)P^)-X>7Y4FT?D$cC&$+aTrO<54Nu_glt&&z3*zF4lZI&%sJ{vQsxOa%mzkyIhEpnBLh1~VDk ztsnXYVwsjlIMNTK5TIDp7AH}m2gMUY0)rT>z4!6qp{)%yTaDhL*f=I?R-(~cl)QppSe!)#&7A7j$0R(Nzwf?{!u^@1R$#S5TEi1 z=BIu`S1-_j^d%LBV9kC&S080B-%c&-%8tj(C79mE`BW>fE5go)u6WGq?97FnskW48 z?n|ve>hIQ6ho_z2kOWefATVa0atJbe3AnF4yokrkT>`isSxbI&_Ub{PM ztjKPE$F9G-dk$!L4iV$0=3DTsl`3*B9bPCjrqj04AAvtjqs{}IT1nT91*SGKpqAa8 z&v#Z~60uHESCN{uTHKRjzrsLo`(zzM8Zh*o-+Gmpz_>7VqlgR#wCm#YzEM zW4`*}Zrh&D2d$9L^32+(&#}GRd%#K6E8`-uX_8O9oERVz=??SL0aaqCY>m-Y~Xy?8j0r~T(%$mC-=72j@sQcB&i-~7xT6g1)|%*QKoa{ikzH-| zZmfU7_~IT+#OEmVqJUA*HzSrR&TTO6jW8%gMgdG`u~|je)iw?05eOa<86$jcDJ-TN z{VXWgmsauAt%WwdS!{)aaZ|VY?tk9!HYrKYG+c4Z$KPrz{%w=!FQMd0MG|v0S#=Iq zY+7E^I#dE2=aGk8ar%Lxoc~}MK@84R+)qmmNnj1y3b0};J*gCH*~OnddFIXH^amd= zI!j!ASyR+CikXAPYo=i8-yj)FQhY$cg<&VPYS@Z+ON$)8*F=jr=)GYZ5uHSI1J~Z> zzi&A}3nL@Ao73q$sbIiZ3zy77YSMG$IxDkT6kCZK-N{cAusF(r=0tZZzx_+~q)R;hV*Ls}P|7uoMMN*{;wmhYklO;@I|+2XqP!R5OF|?| zAI`Y`PnJiD((RKJuvssiQ$uwmGnFD^!Jm$rAwM*fWO#j*HwJ_80|NOFH6(!ViD)EG z+rGM567u@-p%HBm-#7^37y0CQj_ls@5}rOS-{|Aw=Ba!nRA4o)vB|&_vi54hk^F*8 zvc@zjen6sw)>#icZ0n)s^`Ou$H#0~Da=j|dvK+%x6O7Yho98%vNqPZ5aY&G7*7>n_?@5$0FA1A z*S;X*sR73WOU`o<4Q7t3kn)kn1qRJ~Z1!1}PA$`o$s!n!J=8eE$@>=LBR}A8@psL^ zPE3aUhV8dZN-a1pM7FZk)yCaEHVu1r+j#cq>*g`i18#(2H8O`B0Vz~QbJ-G7+%(Lb z3luhuRGu)LYT4uFq3aud^m3W_Gn21cXYFL+P>m9lk5F<#%y;D-8PQsMk~bPP^2r*k zf*$hoLREsW*7)L~4>?53z*=aWAMmTzHpY;=!(sYmhoA3$dBpw!9d_4O(h>6l)c0nR zQm)Z79b+sHW=>G>#YwcF2vFpD?a|}CXRBHi_|%6s*`w#{+hdc*16zBB5!N@y zt;k*xxc~|e4;xtIZJdwRUDKUzZ?|bt*(!p;Gx0!sB<*AKnNWmsXQ%rV|JJSb zBU_TnWazcEyV#|scb`4$qN^vh+j*OL;}xFv$DpX6OMPH2w5}Hs5IrNGVIHJWRHN9D zCU=_ z$^$+5N)A2i(|1}T1z}qYokb1_R6Eg#RX?+hA}G6I#=B`?>>VYBeQ#x}?LDzr&GVI_ z)ek;7m%{^K7r2dc4RYnY9OFu^Dv_qJD`r_xLqNg`MjULW5D3XsGAVudvJ}41Nh&I| znQyNWksbvs+4y7KxD6YXIixJK!M9e;EwUbhu~*q0*_UWD2!dk539Jx?Yo2KoO`rKP z$WB(=83>cRlFJZ;W|HXq_pkgtV)T2i0_d{JKw$&3uamNJQP#-B)G zm_Zp&W;I!R5}Ri5jZk%bP+9yw%#CD0KnQ}K}hP2Ky zIHrtyIM}iYr#lIB!JHc9GKF1Q$J-@9leVyiAh{8dTP>5XKD-{PpqQZ-f(E390oUzD ztsu)iEi9`yi475eD5<3i>&isU+aynX`V7a4W>SxRv8Y}JAX2J{>-96_jB_!rH`3kG zLe?x7jR}VNLE^~7fmMO&c6wRV>ntJ5R?y_KniS>!VnA>kIy4GajN7oC^daUO@b0p6 z_xW1MhG!0RYe;j0=&!j=3roxSS}qH37N>a#;py{h9Ou+ZbrMOwS!@{&X?=R2f1$S6O9o)IUMYPogw&%atzjQJ<#fcfu4~mQ6K` zz6k1x1l$$Q$At+9g$T&ebBt4}TXfBd`S|W`p{5-Uss`MF1Eqf5{@WQ2BKd(&3c#5mI&8MZsw$*+|k-fOfRQD z6W!9}udYtmn{IHdGqC0=~L_KAVx_~MUcR;oB|Nd3I*Znl+6Wv}KOu9o%JDOnB= zfZ_zNRkXaas;#G89(+ip8%xYB#z`{Ms32D!Q)}Gwfn`BLD4UsqCvU#p;p+6oSr=K! zrl`hC5|Qn@ZijBZBT3zqt);voRs~tOOr-8`TgiH5m->rUT5$NOArndqJs3nboHMgf zGS=)9b#wRxi7lkhk znF6G*4a97+SQSh1!D|YAFzJ_K6Vi+G6EevMQ+abrb-{HBQ&d%LsPdAIRU`dno}%Il zgLxcsN#jDZ53X2v)Ofet$r*y>N>`;66=68{$-D-^w=(AQ#xbAsn5o|$_p*lmE!?*! z#V&*DCK$UVwAf%l->F2Xv<0XaMT>$=4>X6hb)&P>vq#~ne z?cfDEtRr0^{@sTn`V!|@C$=;b>F4(qxWGmH{JIKA3n~c!C&6vF&adQTA+BqcX00=G zrES7|8GL(27@{2zV{ly=L06%YM6#qjAF#cc^82|Sn!6!XK z#a@FH{lg!GB%kPlZnEt)3Gw^PmhJ4Q=ydD<(eAIL-6tOV`~%VOlj~1J!_nrV%wd}V z|9DP{D8eNIEN;!W!CEWXx&-^cOe+Xr)P9SxS|+>B+4!JGqQ^o`?I{p%^!Q`t-Tlua z{SQU)|5FKmVcRzqVosB48ni?epzSv?Uoo5$S3y8ALSFUbv+tgA1mQUh4=0EFXY1We zSETOG(jN4dv>AkR#VcwA1W~o9z0|JZ$|_uQ zc%!#r_q#>SH2MDU`26hT^nl<09?oIf zk^5>R?&HQxqSr@%dw2BuJ8tME&bzt_(hMx$HT9mGH{hai11`9n-V9->4~a75tIby% zt5R$b9$8KDe*5OcC^#2RmIW0QG`iTg!?g^2eQgElT?oJwrtagfD*;*TzD*fSW7~pz zn1+4o2nRVR!eDm8BR&wEb4e7d4%F}oeVQyPExdPK=ZnqT8C{4n4NE(yjZ=KHkm`{$ zi_B&hKQ8+dWJn{Bljfz1DJk4@jVF{Wjm`5dmpqIn&fZ=GnZpf-H_%1=Ks&w8Qc(}} zco17bxpNP15v%i05-ImJ%qpprnUF^NVWZ+E+_Eg*Fk8emjbSWw%YKvr(F3QEF}HV> z#(}rMmF+Y?Me2QsCsW@q6g^E=xPCc)SWqOu|9TfbBoXn2wSi+?xQw3sGe3gpxFG+4 z18*@I*;~yZW1*%mYD8f(XHIcho1uUPEw8a$~#16<}u+ID_Qti8IQ zbk(^UkHy5eAToSv-9?f@?X#ctnDXJ&Dk1~vp-9R@E*{9rZIZk zmLY6+zG{D_Ze&%dq8!e8(`=1knBc(%c0A9gLHW&huTKw;PWFGWkZBJ!vKqeRT@n}f z?~0_PcQzkwnMa1EMwEM%R8U7WJj}}s{Y7_MThww1@6TZTzDWPkqR53$Msh2T=WQ|Y z7m7VnM))oI>&dssb#NN(M36HgwDM$kZ_Ag)V>lm`PBnle*OGrZ!Iep(V3rD8aT!<8oX8{R)Cl%Rc!BrSOLS(Y#Zlo%1(moi0--wbi4)81$)CFM6``{R?uwSvd zzU`J3cIBxV$4&oeUuj>}`u~KLu03nNX@&EiCFr!Quz#?%w(1)zLj@@iXs+PY7kWeV zj35P_r4izoC5aYSnO&%W9v+V8ymF&Nkd~3Lk)pct#A==@ZVjs) zD&>pz@wO1%1(7KTiBqLZ6GL4IK*rx{G?CQ%K|&u$(dGm}{hS*ub~?xk&1q{%O5(NZ z#lKL@gp!?^Va_ux#Te5m0NlXT08O#TA3}{VsiP*Fd=p|}X zTnuD>+$Px18wWmTt6(U-JzrC}2=b2keLhT_%x5A;SkF`pGmC}DPaQQi5yF(lImI}q zNtqAV6Ttb=o+Z=^UUB$I12w^>!ibAtAPe)`H2*3*u(|k%huJurZUxHYjFiHeC8yeI zG<2pw=;!BW$34X@(4yypvL`ji>i~*<-lf#st-!X=XHA>Knk(BeLqqf6UH}Rl45Yfj z#fHQ)H3`xkx#z@E=h5@dCqJBT8!7v(^XPv9`mQU{{y%%i-~LzZc#me=%!jcY*y*=# zPS)Gsm~Eg|OMST*R92L2TnHb?L$Jss}|Q6RfhK^C!{%T&HwRtLFlV>=MnO6|rhZ^Y7M!RhnYd#Y>k6 z?)s?pC;EDj!epd)87P%=gJsaJgp$xfw{iEOiKN&i5xQmPoitf`uRpMJayaWUcFtVZ z*Pv16XMQw)4kXCm(i8aF#e>O|!PnIm-F2WP>m>Fr%Z|TM19Oh~k0T(r_5NXG<+d^f z#bVl-BqIAfQcf~!KJ?9~EVpQ#Lm|M4L}6sjt(jXNDpa%i(#*lm!~-SG0d>Q0GEOW! zE`aTJK2^bakX|LIq9}9cQ3Fp_)Eo`AD3d$rPi3fp!_=a<+k?c1O%g3f=)cK3)s~vM7`iius&y{{!+^Tp!`M$z}QzO0FD;wi> z(}=V@QI$_vyLMHhG+UXL^U`B9vbTos6s(umTlly`-!3^6RJ8Vi0cmp;f}r=RWt^V> z<3H_7208tgO<%_q8*}}mm)m8wCBS#kz#j!x99!aFN^Y3}JCEq!rzj^mjOpyc2PPO2 zvfqEtm1URlKyan?^IFS54MH747M`1%4U7H9o&eP<^(jELeJ1OEn@%6?^#Vz)t0Djl zBtGqw8Ot9d^K%K%!YHg+89MJ;H{U~G8NeL_*h7M8F_} z>pc;$LGPyHFo~cdr`&BD9KJCgIr^6(r7qs)x!rcP zG@i{q%viO$I541W%-hi5ifcxvS{{9M$n6+i4U<5v13l@#aTXF*XUG#6qEtIE#GXMy znvHQv5zqy|j)u@%ED<6&TS0iNRX+0f?a)>xkVP!KQncF}M&WwMmRe=RHJ3u6go5hK zv?|HW&Ck+caJss-wOlj9BXmGKuse#qMHMB zBhnXm7p>5mmIrhoTUK#d~A`@qvx zlHPYi9^y_hcgXqNGrms z_CsYd5S&KzY*n@zyoYG#sU zVTEhSK8h~69;4VYZsU7{!IQUY=_8B=(nrG_?Pya&g121JSS}97ybnIoKR0^kUqZ0< zN$55bweT)wuPBOSa6(-zKkq19z#_i$CG-l3PI5ps-2gG98|0xQn8L#_u<2KBvEVch z1yaD^kScJ=ud^k}!eQ2xQbB(#D9k==z2st4Y>;&nURNdjV{^;z8@c88;;EGNSigp; zM0K9KgdK;4ZB1!hY?u(Rq9`;kjw@MsQDLx)h>N@|3)O` zYvZ68G8e{B3WyzQyG!MmB7Jr?j-_N(0p#q-1Zia6*%*pNUg<_g8QwlTIyt&H>MB6R zm7K`G>xVj8?T^!6u8yJ!wzxQj`>Zw_JLM_P~*ir*CQ^~1u6t(bycmBA_|;8veeRqt-bilHBwE5F79d1CqDh(!0cSz6F+u% zbZ+B(s%1V?l2m@hmNjQ>-Ltn8s-y>>#V>0>mpk1UivYz(VO6CyK~NnmsGQMgu2E+} zpOR47t(XwtU@UxHUFtA+LCIX-FyM=zTch#aXg(by3LO%Y0CoP*iZ3q#D`C>G+`jX| z*T|099mLc2YG_gpD|xOQOG5-Je2hexuH$u zLhZ{|Ho=NviRoJ$em?hGQ{Uw>{{31hsMH{aRg-=yRW26ir9w+=c(lA-XntGl@WwNlNiDrSO>V=ty#(l5_~d8ey75e0<4jy9 z<5`ov0H#ws)7;Uk#*SVIiuZILH-Im{;_v&>p~m=dPQ+Y$=jf8=A$-?3gzq%!5ERl7 zZ=}KYVPc6oPb6dC;3?FgW|~&Yxs5BbD9k0pktg2QV$N!71BIqI=+Kono2o_-J<3Py zox8_(d7O*TJ$-NLr)be|RMnz|=qOZ_;9+dC*GPrr&Y3Br&pTV{1QUm%ek>$zYpg*U=Y9+s-t~*vP`q93NR&fvOvOcs*`|;V$(Ukc&{Tj5xXU3*0kWZyJ6e7|~d zH6i-zcm4JGdGEDBd^L@s@?gVY?2*M0Vb6$~o;;jh4iQ1!G&Fvosqk}JxDq4<$34qw z9?Vm#8^=wk?K08aK#uWd@PCeIeQ()-lVk$09T(UwO2bP9>gkQpE$pOHZl$ius+-z= zaX%eiAHHs^Xy6`Ne~SD@o=p+@8^rL`-wOU=O-w6 z-Bz*EJ+#ikIBXlQ6VmA&qX{{jw>uo{xGa1gkx4 zM2sgDH2Rj^J3l*a=BsDN4Le8QR<|b#5`~1tAefoU)egq-^u5pV=>~~s!G^0PpVNIL zR#Z?IDk(vYQ&ND9rdjDD4HE-E$GOzLcq0zQGwpk;i98MAqj7-HzwGQ@?^Om@ki5%Z zf4P0VS8Lv>*G>Mv?LJmBZ$NT9RM9_3^XW!y<$k^;!Sh=Pp7NHjsG(|2|cfy}npIwcw#u6NJ=N?^CNQ(k`|Fb`~KgcsA3&M9B=kH5v6|JG6e7(V^e#~*&Rzit((R-9}C+v&@LTD+0Fc-ZAuR1ah< z2#Q=42Ez7oZI~{@DYN*~w0ip|C#{P{&wSjKVq>6NgI-uPRTxH{nJ}Ei>(karygt=A zIKN-7NJv*^FBKd?kT|#?Y_okYeAH^7aufms<#K*n=KSXZk8U9o%#YxTL9BV67VkNu z4{T3ssFhsf5*jrRBw+jD^lBKs%#40soF1H>&@V?XkH24iy9s`J#W3*+{n#}FI<61^ z?|4Yj|R@v(**6na_uh(%E^eSUx3BzDrb(ZT8AYQ}RR8EW_+Dfm-ValZ`8#z`?h zq!yV^FiG)uF4;sJ$5X9N7`dEGU;@Xv`9BBo2oksiE)XN#5Bw9E8q$#l$n`75DvD~Z z(sNBNTexStO}n+*U?QJZxQN11v!)4S$H)x3EU8YN%~a!!k!oizHH~hsX>@z5NB2@{ z-4YMih|u&O&2Z9>nmT&aunccbXv4-57N<$E_tP@I<8Vwk1$o1V%{P7{`&?xeMWCLU zg4vxmtHzA_LpLm?Df%OG0zdBX4a_J#t~Hv}q}$ zjCWU}4{3`B^u@iDe~+hP)_3Hg#<3-{Rk$*ZtnbO{l{ql^#cIo_;Bw&{Tw#13R|U}c zLVcmx#nfm%Uu8S58y5NxN41!zg+Z+~qR*N}^w~NmCCGQu$)AO-J0hDZsqaP4M#9R9LzW5Z!UGO*G_CVuME3 z5WN4ty(?>O95=%I>|eon9x|Jn)j^$}%4SO=xnl47(3%>1l9wq;q$RE?Qo}>G_SdHm zfQKbFIZ39HR4jwG1rk6L$A|7lqanh)jPnA}=S?;pS(a|F@qXJVLwa(qqg={ij7oKQ zr%j1O5rf+T2$x8_Wg6an9f`N~NECs(Eg*GHqG=A4e}R{45uW)$IYcXs3z;|(E87BC zlChyp(jEwP3`u)PMGMo|VbAeRKrYPoQfX>s>O_EQO9(}#kct{Qu$h;;*`N_C`BwQgXsAs)dY2k4J*Y{UodkqYPO#>0nDDZZbS?|1gBiN57ACgm z;Z|>CP+mCbA=Vy~5D=qsK$3gzLD0EJbvrhkc9C6aBx8zbYYJ$4M-E3+^OX^deUWI7 z@pj=n6J^Mn_cxh15z5ReDAVLvv+El*I`=1Z+JS`+WE)N1u?>=5HRg?w=uS%{Rb&NC zffpomc2$kHc0|sT^wA#3Is5Kf_BdvWkZKB$dYuwR@$xc`LAB6~=ZmNXs?27r1{#P6 zY6=K?ouB-|rmBr+y9mg15$%xJ>R0WBv&nS|fLj>xZkSNpT5Azm6!lu7tk;q|*Yx^k zrYnVrrHE(PX?R?pg-_9p7UdkcXL>n85ZzV!Fy&JD4t4M9QcTY&jo8vIUZ0TEW3R&zHK#2El(6q0H5J5FX94q3Efq7qxxh`Ne78 z+1Vu-%@4U44AVi7ac>P{if5#e30C}*NRtSH9RUPsWeeDE(m!|sj4+D9e+w>s>a>~2 zJ$3}{kqV5VEf%Xf1$9NN=}K6W2JDU`W1(>NiTKzAhhO|&KT~40WP(J_uPbnVBh~NF z)g%D+++I8YMFH|&ezps{=zEJgD)o=t#hyr-2ytBj;xZ)3IOS5!Ai4Ph7LGVv{{zvd zf=lj-=+YI?g$TMwk8l}9`AnTTuJ^L1N@}%AhO{dV>aH-TXCZ1LgI(^tpuwIGc=?J? zr^wtIuu@vBF0Ab*Z=J4{(-4_Hae#M)0sb*~2msbH|DQQ`6KWl3=90!Cb0)PCKsr>L z3_fk8Jys;A zHZ;jqy&|gg1XQ8z)~*}E+;+oiL`VhJT^C1tzQ2klO*CwPr#L; zyy2Z<5{)Ntm#aRAQG0tOIkEoGd2U11&3@tJB$JHHcVRfl1&gD-Cye%SQF_SXjT+nAtSTm?z9^6N1$k`x+GCWbvdgB2r&m9fg(;mx1@YTX4{(&s>rV6)~qTV9t54wS7-kUjUFxHD~e$Wjsz0%^%%E&caFsiulnN@Z%;^z@cn`y^8MC;Z*w~Z1g2jO5ugt zYG-REH718gk6xg>Y1JV@UM;LZlJYWk%+lN`fu~%m$WQepern|wEv~iw^t*!gE}KA6 z!@SY{r-|vf&uI2T8jD~YrfGgrh0rDG|@GDV#03pkg{f?7fMHRTROoEr!@ zr_^;08rj9<*7)zKysHA$*&OijOfdF2bNuCw8N5=U?E=~lofwW{u zjvsu~0PJ`%H8%KoRk=VB#0CP0U7-mKFnlzy>XalR*FZ9TSb-e4NXQ#%pe-V6z|=s5 zsexqGaIi!rtj3vmFPAPGFbHr}Vtcd#UHey4)4lN)J;ME@SM4KoC>8%y(E=hi4Fqgb zuHM)TAacnbY~dD7ln}DXW*;Ji z4JFliHY>!dlvgOTHc}eP%ECo#84B1k&J+=(kQ_t(^Fk=0Ia}a9Mj@Z&fsX&*+Rt3) z$%Kh0G?Y|4=%fWk&B|Ro=!x?y%N7A?C;$?6Qd-csIeo6<7Yh_|X(-^*&CHs<$0}#D zW|+{%mit9{+>6CBMPwREYixUET53P-xr5>XjEjn*MOYdNu#^VcCXVeou&y&dO=6L< zaaDzN)nb(f51B4gZ6nu%Un=&K=xyxNCqW>{cCRX%Q{JA(CakRB!0CYO6eHJn@n9fc zn8+L=q7x3Xq(#?&WS0}TTN)X-qEpy9F#0$cJ45$)xmdVaS?oO(0KXe?8n_7* z(A=bRJcGQMCY}!xiW^h;P4dxN^Vu?y*6HcXM8ZvDbYWfB+UN*?h9(_Eit)Cc`Cd8v z&?A~Y6`#s7ry-CW|K*5vv}d!+3$_(0dD1nWH;zMHOSeQ51O`;Z#!b!+YKZ?)hZi*y z2i`h~@E76+z8zdbgEyU!ckVV;$r{gz^VUma4sx0s{dn9uHsWY;INip3;@BtrOss^3~9YaZZDH`Tsg5DCG<8tQE$r^w%J3M*10aIJk zwUt+EJKj7UA0=Mm)0X&619j8NMK-!u02~SuB^{_}YTS`EZCsts6g?Rs%@5a;zu{l( z6n{DT?)CHk^NDSAnBFAqi1UrgXti4XZr8xSgMN?x!bksYw+EfR0l(X=ZVy7+Xtg`N zR_8mT^^NE$eNyyo1Ed6YAU^lFa$R4zUw$d$-%8^*{JeQ{^ah>SM#jVj$OfhczC*}Q zCZugH#PX>Hp42B32U>~rck0N(l`=O_7IJ6^m|>bX(k61#<f4)!t z5NhPIUOd@;1R3?Z7%s=3jL~LuVdMThDcxpaLtQUjYKLAA!!&d-5<7&GE?~Tk=r(0S zk2m@GgITd=7W3+3*vqR}yPTOyu~)fnz;$ym$1AqI-MTfiuEr3;$xaFhRdDx z>qVV%;uY5Fpoam!K&Mm)tp(SLp714!>E-$ueoei_!wk2gTDT2;tpTW_dUjDtc|hB~ zALExpSnsXv&Hh^hIKdo+iH8_2`MYs}l6iH>_GXif&A|zVQNh-$2IaoJwzrUYXkq|4 zay_~&jliu3uY*+X11=`@2rP#k45Lf?*0buS{>`4xiSA(+!_V~9_;fj)mgwfkoaPvq zkh5^@?&b5ej66qqF7`RY9)?dCPbc-L8$nt%C3%*&F^7AmD+C6g^n?Cn)y3KS5xFWHl=OTbwP$u6W8~k9(L8mFShGg2_t6P zq-%V8X&E;pOb9(Gp0CpF7OE^oR*-^JH}@h-8&XRg1|ZQ;zDQ1K7A7`D%_g~Ts%bcWXV(ya0LG1 zMlctJu`vTK!A*?6MmEbR{9Vk-##jAJzbV6EDMPA=Izvn4!%GR9N6PA?l+~E`k7{Rq zbux9RHP=fTYi5fs)xwuH4uDKvshGXoIj%EgNN1XDx{ytU9>1!Q1qh*YFQgVTO}an| z{cwJ5iRIeSn))fqt#IAJ_ZkD8Bo+3?yra}Ty0mno80tL+o4+^JV=DGwmk(0kr;G=5 zWxc-SJ+Y!TVw7cKc$n*CNLMDAXE$rSuDzXeLvvM8uQ^543#yGrw;%MNuFeU@MPY1o zT9{K=d1Cx4Lj`ls1_}t_Lhkj)4P;szG#yjQ_MaF-M72s!1$2Z0sxq>JFxaiblymBe zHIO~}a-P-tKc)ZWKi^2lcu4( o5;{67bW-$0|DUGq_4E39{k(o&Kd+zH&$s#f13UT6 3 + raise(Puppet::ParseError, 'staging_parse(): Wrong number of arguments ' \ + "given (#{arguments.size} for 1, 2, 3)") + end + + source = arguments[0] + path = URI.parse(source.tr('\\', '/')).path + + if path.nil? + raise Puppet::ParseError, "staging_parse(): #{source.inspect} has no URI " \ + "'path' component" + end + + info = arguments[1] ? arguments[1] : 'filename' + extension = arguments[2] ? arguments[2] : File.extname(path) + + case info + when 'filename' + result = File.basename(path) + when 'basename' + result = File.basename(path, extension) + when 'extname' + result = File.extname(path) + when 'parent' + result = File.expand_path(File.join(path, '..')) + else + raise Puppet::ParseError, "staging_parse(), unknown parse info #{info}." + end + + return result + end +end diff --git a/environments/production/modules/staging/manifests/deploy.pp b/environments/production/modules/staging/manifests/deploy.pp new file mode 100644 index 0000000..f502e46 --- /dev/null +++ b/environments/production/modules/staging/manifests/deploy.pp @@ -0,0 +1,59 @@ +# The define resource extracts compressed file to a staging location. +define staging::deploy ( + $target, #: the target extraction directory + $source = undef, #: the source file location, supports local files, puppet://, http://, https://, ftp:// + $staging_path = undef, #: the staging location for compressed file. defaults to ${staging::path}/${caller_module_name} + $username = undef, #: https or ftp username + $certificate = undef, #: https certifcate file + $password = undef, #: https or ftp user password or https certificate password + $environment = undef, #: environment variable for settings such as http_proxy + $strip = undef, #: extract file with the --strip=X option. Only works with GNU tar. + $unzip_opts = '', #: additional options to pass the unzip command. + $timeout = undef, #: the time to wait for the file transfer to complete + $user = undef, #: extract file as this user + $group = undef, #: extract group as this group + $creates = undef, #: the file/folder created after extraction. if unspecified defaults to ${target}/${name} + $unless = undef, #: alternative way to conditionally extract file + $onlyif = undef #: alternative way to conditionally extract file +) { + + # grab file name if path was passed in + if $name =~ /.*\/(.*)/ { + $file_name = $1 + } else { + $file_name = $name + } + + if $source { + $source_path = $source + } else { + $source_path = $name + } + + staging::file { $file_name: + source => $source_path, + target => $staging_path, + username => $username, + certificate => $certificate, + password => $password, + environment => $environment, + subdir => $caller_module_name, + timeout => $timeout, + } + + staging::extract { $file_name: + target => $target, + source => $staging_path, + user => $user, + group => $group, + environment => $environment, + strip => $strip, + unzip_opts => $unzip_opts, + subdir => $caller_module_name, + creates => $creates, + unless => $unless, + onlyif => $onlyif, + require => Staging::File[$file_name], + } + +} diff --git a/environments/production/modules/staging/manifests/extract.pp b/environments/production/modules/staging/manifests/extract.pp new file mode 100644 index 0000000..6bd5490 --- /dev/null +++ b/environments/production/modules/staging/manifests/extract.pp @@ -0,0 +1,126 @@ +# Define resource to extract files from staging directories to target directories. +define staging::extract ( + $target, #: the target extraction directory + $source = undef, #: the source compression file, supports tar, tar.gz, zip, war + $creates = undef, #: the file created after extraction. if unspecified defaults ${staging::path}/${caller_module_name}/${name} ${target}/${name} + $unless = undef, #: alternative way to conditionally check whether to extract file. + $onlyif = undef, #: alternative way to conditionally check whether to extract file. + $user = undef, #: extract file as this user. + $group = undef, #: extract file as this group. + $environment = undef, #: environment variables. + $strip = undef, #: extract file with the --strip=X option. Only works with GNU tar. + $unzip_opts = '', #: additional options to pass the unzip command. + $subdir = $caller_module_name #: subdir per module in staging directory. +) { + + include ::staging + + if $source { + $source_path = $source + } else { + if $subdir == '' { # eg when $caller_module_name is blank + $source_path = "${staging::_path}/${name}" + } else { + $source_path = "${staging::_path}/${subdir}/${name}" + } + } + + # Use user supplied creates path, set default value if creates, unless or + # onlyif is not supplied. + if $creates { + $creates_path = $creates + } elsif ! ($unless or $onlyif) { + if $name =~ /.tar.gz$/ { + $folder = staging_parse($name, 'basename', '.tar.gz') + } elsif $name =~ /.tar.bz2$/ { + $folder = staging_parse($name, 'basename', '.tar.bz2') + } else { + $folder = staging_parse($name, 'basename') + } + $creates_path = "${target}/${folder}" + } else { + $creates_path = undef + } + + if scope_defaults('Exec','path') { + Exec{ + cwd => $target, + user => $user, + group => $group, + environment => $environment, + creates => $creates_path, + unless => $unless, + onlyif => $onlyif, + logoutput => on_failure, + } + } else { + Exec{ + path => $::path, + cwd => $target, + user => $user, + group => $group, + environment => $environment, + creates => $creates_path, + unless => $unless, + onlyif => $onlyif, + logoutput => on_failure, + } + } + + if $strip { + if $::osfamily == 'Solaris' or $name !~ /(.tar|.tgz|.tar.gz|.tbz2|.tar.bz2)$/ { + warning('strip is only supported with GNU tar, ignoring the parameter') + $strip_opt = '' + } else { + $strip_opt = " --strip=${strip}" + } + } else { + $strip_opt = '' + } + + case $name { + /.tar$/: { + $command = "tar xf ${source_path}${strip_opt}" + } + + /(.tgz|.tar.gz)$/: { + if $::osfamily == 'Solaris' { + $command = "gunzip -dc < ${source_path} | tar xf - " + } else { + $command = "tar xzf ${source_path}${strip_opt}" + } + } + + /(.tbz2|.tar.bz2)$/: { + $command = "tar xjf ${source_path}${strip_opt}" + } + + /.zip$/: { + $command = "unzip ${unzip_opts} ${source_path}" + } + + /(.war|.jar)$/: { + $command = "jar xf ${source_path}" + } + + /.deb$/: { + if $::osfamily == 'Debian' { + $command = "dpkg --extract ${source_path} ." + } else { + fail('The .deb filetype is only supported on Debian family systems.') + } + } + + /.Z$/: { + $command = "uncompress ${source_path}" + } + + default: { + fail("staging::extract: unsupported file format ${name}.") + } + } + + exec { "extract ${name}": + command => $command, + } +} diff --git a/environments/production/modules/staging/manifests/file.pp b/environments/production/modules/staging/manifests/file.pp new file mode 100644 index 0000000..12782ac --- /dev/null +++ b/environments/production/modules/staging/manifests/file.pp @@ -0,0 +1,166 @@ +# #### Overview: +# +# Define resource to retrieve files to staging directories. It is +# intentionally not replacing files, as these intend to be large binaries +# that are versioned. +# +# #### Notes: +# +# If you specify a different staging location, please manage the file +# resource as necessary. +# +define staging::file ( + $source, #: the source file location, supports local files, puppet://, http://, https://, ftp://, s3:// + $target = undef, #: the target file location, if unspecified ${staging::path}/${subdir}/${name} + $username = undef, #: https or ftp username + $certificate = undef, #: https certificate file + $password = undef, #: https or ftp user password or https certificate password + $environment = undef, #: environment variable for settings such as http_proxy, https_proxy, of ftp_proxy + $timeout = undef, #: the time to wait for the file transfer to complete + $curl_option = undef, #: options to pass to curl + $wget_option = undef, #: options to pass to wget + $tries = undef, #: amount of retries for the file transfer when non transient connection errors exist + $try_sleep = undef, #: time to wait between retries for the file transfer + $owner = undef, #: file owner in the local filesystem for the target + $group = undef, #: file group in the local filesystem for the target + $mode = undef, #: file mode in the local filesystem for the target + $subdir = $caller_module_name +) { + + include ::staging + + $quoted_source = shellquote($source) + + if $target { + $target_file = $target + $staging_dir = staging_parse($target, 'parent') + } else { + $staging_dir = regsubst("${staging::_path}/${subdir}", '/$', '') # Strip off trailing slashes + $target_file = "${staging_dir}/${name}" + + if ! defined(File[$staging_dir]) { + file { $staging_dir: + ensure=>directory, + } + } + } + + Exec { + path => $staging::exec_path, + environment => $environment, + cwd => $staging_dir, + creates => $target_file, + timeout => $timeout, + try_sleep => $try_sleep, + tries => $tries, + logoutput => on_failure, + } + + case $::staging_http_get { + 'curl', default: { + $quoted_credentials = shellquote("${username}:${password}") + $http_get = "curl ${curl_option} -f -L -o ${target_file} ${quoted_source}" + $http_get_passwd = "curl ${curl_option} -f -L -o ${target_file} -u ${quoted_credentials} ${quoted_source}" + $http_get_cert = "curl ${curl_option} -f -L -o ${target_file} -E ${certificate}:${password} ${quoted_source}" + $ftp_get = "curl ${curl_option} -o ${target_file} ${quoted_source}" + $ftp_get_passwd = "curl ${curl_option} -o ${target_file} -u ${username}:${password} ${quoted_source}" + } + 'wget': { + $quoted_password = shellquote($password) + $http_get = "wget ${wget_option} -O ${target_file} ${quoted_source}" + $http_get_passwd = "wget ${wget_option} -O ${target_file} --user=${username} --password=${quoted_password} ${quoted_source}" + $http_get_cert = "wget ${wget_option} -O ${target_file} --user=${username} --certificate=${certificate} ${quoted_source}" + $ftp_get = $http_get + $ftp_get_passwd = $http_get_passwd + } + 'powershell':{ + $http_get = "powershell.exe -Command \"\$wc = New-Object System.Net.WebClient;\$wc.DownloadFile('${source}','${target_file}')\"" + $ftp_get = $http_get + $http_get_passwd = "powershell.exe -Command \"\$wc = New-Object System.Net.WebClient;\$wc.Credentials = New-Object System.Net.NetworkCredential('${username}','${password}');\$wc.DownloadFile('${source}','${target_file}')\"" + $ftp_get_passwd = $http_get_passwd + } + } + + case $source { + /^\//: { + file { $target_file: + source => $source, + owner => $owner, + group => $group, + mode => $mode, + replace => false, + } + } + /^[A-Za-z]:/: { + if versioncmp($::puppetversion, '3.4.0') >= 0 { + file { $target_file: + source => $source, + owner => $owner, + group => $group, + mode => $mode, + replace => false, + source_permissions => ignore, + } + } else { + file { $target_file: + source => $source, + owner => $owner, + group => $group, + mode => $mode, + replace => false, + } + } + } + /^puppet:\/\//: { + file { $target_file: + source => $source, + owner => $owner, + group => $group, + mode => $mode, + replace => false, + } + } + /^http:\/\//: { + if $username { $command = $http_get_passwd } + else { $command = $http_get } + exec { $target_file: + command => $command, + } + } + /^https:\/\//: { + if $username { $command = $http_get_passwd } + elsif $certificate { $command = $http_get_cert } + else { $command = $http_get } + exec { $target_file: + command => $command, + } + } + /^ftp:\/\//: { + if $username { $command = $ftp_get_passwd } + else { $command = $ftp_get } + exec { $target_file: + command => $command, + } + } + /^s3:\/\//: { + $command = "aws s3 cp ${source} ${target_file}" + exec { $target_file: + command => $command, + } + } + default: { + fail("staging::file: do not recognize source ${source}.") + } + } + + if $source =~ /^(?:https?|ftp|s3):\/\// { + file { $target_file: + ensure => file, + owner => $owner, + group => $group, + mode => $mode, + require => Exec[$target_file], + } + } + +} diff --git a/environments/production/modules/staging/manifests/init.pp b/environments/production/modules/staging/manifests/init.pp new file mode 100644 index 0000000..6fac550 --- /dev/null +++ b/environments/production/modules/staging/manifests/init.pp @@ -0,0 +1,34 @@ +# This module manages staging and extraction of files from various sources. +# +# #### Actions: +# +# Creates the root staging directory. By default files will be created in a subdirectory matching the caller_module_name. +# +# /opt/staging/ +# |-- puppet +# | `-- puppet.enterprise.2.0.tar.gz +# `-- tomcat +# `-- tomcat.5.0.tar.gz +# +class staging ( + $path = $staging::params::path, #: staging directory filepath + $owner = $staging::params::owner, #: staging directory owner + $group = $staging::params::group, #: staging directory group + $mode = $staging::params::mode, #: staging directory permission + $exec_path = $staging::params::exec_path #: executable default path +) inherits staging::params { + + # Strip off any trailing '/' + $_path = regsubst($path,'/$','') + + # Resolve conflict with pe_staging + if !defined(File[$_path]) { + file { $_path: + ensure => directory, + owner => $owner, + group => $group, + mode => $mode, + } + } + +} diff --git a/environments/production/modules/staging/manifests/params.pp b/environments/production/modules/staging/manifests/params.pp new file mode 100644 index 0000000..200b3ad --- /dev/null +++ b/environments/production/modules/staging/manifests/params.pp @@ -0,0 +1,40 @@ +# OS specific parameters +class staging::params { + case $::osfamily { + default: { + $path = '/opt/staging' + $owner = '0' + $group = '0' + $mode = '0755' + $exec_path = '/usr/local/bin:/usr/bin:/bin' + } + 'Solaris': { + $path = '/opt/staging' + $owner = '0' + $group = '0' + $mode = '0755' + $exec_path = '/usr/local/bin:/usr/bin:/bin:/usr/sfw/bin' + } + 'windows': { + $path = $::staging_windir + $owner = 'S-1-5-32-544' # Adminstrators + $group = 'S-1-5-18' # SYSTEM + $mode = '0660' + $exec_path = $::path + } + 'FreeBSD': { + $path = '/var/tmp/staging' + $owner = '0' + $group = '0' + $mode = '0755' + $exec_path = '/usr/local/bin:/usr/bin:/bin' + } + 'OpenBSD': { + $path = '/var/staging' + $owner = '0' + $group = '0' + $mode = '0755' + $exec_path = '/usr/local/bin:/usr/bin:/bin' + } + } +} diff --git a/environments/production/modules/staging/metadata.json b/environments/production/modules/staging/metadata.json new file mode 100644 index 0000000..bdb4a09 --- /dev/null +++ b/environments/production/modules/staging/metadata.json @@ -0,0 +1,115 @@ +{ + "name": "puppet-staging", + "version": "2.2.0", + "author": "Vox Pupuli", + "summary": "Compressed file staging and deployment", + "license": "Apache-2.0", + "source": "https://github.com/voxpupuli/puppet-staging", + "project_page": "https://github.com/voxpupuli/puppet-staging", + "issues_url": "https://github.com/voxpupuli/puppet-staging/issues", + "dependencies": [ + + ], + "data_provider": null, + "operatingsystem_support": [ + { + "operatingsystem": "RedHat", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "CentOS", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "OracleLinux", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "Scientific", + "operatingsystemrelease": [ + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "SLES", + "operatingsystemrelease": [ + "11 SP1" + ] + }, + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "6", + "7", + "8" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "12.04", + "14.04", + "16.04" + ] + }, + { + "operatingsystem": "Solaris", + "operatingsystemrelease": [ + "10", + "11" + ] + }, + { + "operatingsystem": "Windows", + "operatingsystemrelease": [ + "Server 2003", + "Server 2003 R2", + "Server 2008", + "Server 2008 R2", + "Server 2012", + "Server 2012 R2", + "7", + "8", + "10" + ] + }, + { + "operatingsystem": "AIX", + "operatingsystemrelease": [ + "5.3", + "6.1", + "7.1" + ] + }, + { + "operatingsystem": "OpenBSD", + "operatingsystemrelease": [ + "5.7", + "5.8", + "5.9", + "6.0" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">= 3.8.7 < 5.0.0" + } + ], + "description": "Manages compressed file staging and deployment." +} diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/centos-511-x64.yml b/environments/production/modules/staging/spec/acceptance/nodesets/centos-511-x64.yml new file mode 100644 index 0000000..089d646 --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/centos-511-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-511-x64: + roles: + - master + platform: el-5-x86_64 + box: puppetlabs/centos-5.11-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/centos-66-x64-pe.yml b/environments/production/modules/staging/spec/acceptance/nodesets/centos-66-x64-pe.yml new file mode 100644 index 0000000..1e7aea6 --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/centos-66-x64-pe.yml @@ -0,0 +1,17 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-66-x64: + roles: + - master + - database + - dashboard + platform: el-6-x86_64 + box: puppetlabs/centos-6.6-64-puppet-enterprise + hypervisor: vagrant +CONFIG: + type: pe +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/centos-66-x64.yml b/environments/production/modules/staging/spec/acceptance/nodesets/centos-66-x64.yml new file mode 100644 index 0000000..42455e7 --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/centos-66-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-66-x64: + roles: + - master + platform: el-6-x86_64 + box: puppetlabs/centos-6.6-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/centos-72-x64.yml b/environments/production/modules/staging/spec/acceptance/nodesets/centos-72-x64.yml new file mode 100644 index 0000000..85af89d --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/centos-72-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-72-x64: + roles: + - master + platform: el-7-x86_64 + box: puppetlabs/centos-7.2-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/debian-78-x64.yml b/environments/production/modules/staging/spec/acceptance/nodesets/debian-78-x64.yml new file mode 100644 index 0000000..6ef6de8 --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/debian-78-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + debian-78-x64: + roles: + - master + platform: debian-7-amd64 + box: puppetlabs/debian-7.8-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/debian-82-x64.yml b/environments/production/modules/staging/spec/acceptance/nodesets/debian-82-x64.yml new file mode 100644 index 0000000..9897a8f --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/debian-82-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + debian-82-x64: + roles: + - master + platform: debian-8-amd64 + box: puppetlabs/debian-8.2-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/docker/centos-5.yml b/environments/production/modules/staging/spec/acceptance/nodesets/docker/centos-5.yml new file mode 100644 index 0000000..c17bc3d --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/docker/centos-5.yml @@ -0,0 +1,19 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-5-x64: + platform: el-5-x86_64 + hypervisor: docker + image: centos:5 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'yum install -y crontabs initscripts iproute openssl sysvinit-tools tar wget which' + - 'sed -i -e "/mingetty/d" /etc/inittab' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/docker/centos-6.yml b/environments/production/modules/staging/spec/acceptance/nodesets/docker/centos-6.yml new file mode 100644 index 0000000..d93f884 --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/docker/centos-6.yml @@ -0,0 +1,20 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-6-x64: + platform: el-6-x86_64 + hypervisor: docker + image: centos:6 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'rm -rf /var/run/network/*' + - 'yum install -y crontabs initscripts iproute openssl sysvinit-tools tar wget which' + - 'rm /etc/init/tty.conf' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/docker/centos-7.yml b/environments/production/modules/staging/spec/acceptance/nodesets/docker/centos-7.yml new file mode 100644 index 0000000..886b1ee --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/docker/centos-7.yml @@ -0,0 +1,18 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + centos-7-x64: + platform: el-7-x86_64 + hypervisor: docker + image: centos:7 + docker_preserve_image: true + docker_cmd: '["/usr/sbin/init"]' + docker_image_commands: + - 'yum install -y crontabs initscripts iproute openssl sysvinit-tools tar wget which' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/docker/debian-7.yml b/environments/production/modules/staging/spec/acceptance/nodesets/docker/debian-7.yml new file mode 100644 index 0000000..071acbf --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/docker/debian-7.yml @@ -0,0 +1,19 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + debian-7-x64: + platform: debian-7-amd64 + hypervisor: docker + image: debian:7 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'echo deb http://ftp.debian.org/debian wheezy-backports main >> /etc/apt/sources.list' + - 'apt-get update && apt-get install -y cron locales-all net-tools wget' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/docker/debian-8.yml b/environments/production/modules/staging/spec/acceptance/nodesets/docker/debian-8.yml new file mode 100644 index 0000000..500bee5 --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/docker/debian-8.yml @@ -0,0 +1,20 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + debian-8-x64: + platform: debian-8-amd64 + hypervisor: docker + image: debian:8 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'echo deb http://ftp.debian.org/debian jessie-backports main >> /etc/apt/sources.list' + - 'apt-get update && apt-get install -y cron locales-all net-tools wget' + - 'rm -f /usr/sbin/policy-rc.d' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/docker/ubuntu-12.04.yml b/environments/production/modules/staging/spec/acceptance/nodesets/docker/ubuntu-12.04.yml new file mode 100644 index 0000000..ab77cda --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/docker/ubuntu-12.04.yml @@ -0,0 +1,19 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + ubuntu-1204-x64: + platform: ubuntu-12.04-amd64 + hypervisor: docker + image: ubuntu:12.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get install -y net-tools wget' + - 'locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/environments/production/modules/staging/spec/acceptance/nodesets/docker/ubuntu-14.04.yml new file mode 100644 index 0000000..54d5e5a --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/docker/ubuntu-14.04.yml @@ -0,0 +1,21 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + ubuntu-1404-x64: + platform: ubuntu-14.04-amd64 + hypervisor: docker + image: ubuntu:14.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'rm /usr/sbin/policy-rc.d' + - 'rm /sbin/initctl; dpkg-divert --rename --remove /sbin/initctl' + - 'apt-get install -y net-tools wget' + - 'locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/docker/ubuntu-16.04.yml b/environments/production/modules/staging/spec/acceptance/nodesets/docker/ubuntu-16.04.yml new file mode 100644 index 0000000..92a93cb --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/docker/ubuntu-16.04.yml @@ -0,0 +1,19 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + ubuntu-1604-x64: + platform: ubuntu-16.04-amd64 + hypervisor: docker + image: ubuntu:16.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get install -y net-tools wget' + - 'locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 + masterless: true +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/fedora-24-x64.yml b/environments/production/modules/staging/spec/acceptance/nodesets/fedora-24-x64.yml new file mode 100644 index 0000000..820b62d --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/fedora-24-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + fedora-24-x64: + roles: + - master + platform: fedora-24-x86_64 + box: fedora/24-cloud-base + hypervisor: vagrant +CONFIG: + type: aio +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/fedora-25-x64.yml b/environments/production/modules/staging/spec/acceptance/nodesets/fedora-25-x64.yml new file mode 100644 index 0000000..c3a3cbf --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/fedora-25-x64.yml @@ -0,0 +1,18 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +# +# platform is fedora 24 because there is no +# puppet-agent for fedora 25 by 2016-12-30 +HOSTS: + fedora-25-x64: + roles: + - master + platform: fedora-24-x86_64 + box: fedora/25-cloud-base + hypervisor: vagrant +CONFIG: + type: aio +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/ubuntu-server-1204-x64.yml b/environments/production/modules/staging/spec/acceptance/nodesets/ubuntu-server-1204-x64.yml new file mode 100644 index 0000000..29102c5 --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/ubuntu-server-1204-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + ubuntu-server-1204-x64: + roles: + - master + platform: ubuntu-12.04-amd64 + box: puppetlabs/ubuntu-12.04-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml b/environments/production/modules/staging/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml new file mode 100644 index 0000000..054e658 --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + ubuntu-server-1404-x64: + roles: + - master + platform: ubuntu-14.04-amd64 + box: puppetlabs/ubuntu-14.04-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/acceptance/nodesets/ubuntu-server-1604-x64.yml b/environments/production/modules/staging/spec/acceptance/nodesets/ubuntu-server-1604-x64.yml new file mode 100644 index 0000000..bc85e0e --- /dev/null +++ b/environments/production/modules/staging/spec/acceptance/nodesets/ubuntu-server-1604-x64.yml @@ -0,0 +1,15 @@ +--- +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +HOSTS: + ubuntu-server-1604-x64: + roles: + - master + platform: ubuntu-16.04-amd64 + box: puppetlabs/ubuntu-16.04-64-nocm + hypervisor: vagrant +CONFIG: + type: foss +... +# vim: syntax=yaml diff --git a/environments/production/modules/staging/spec/classes/coverage_spec.rb b/environments/production/modules/staging/spec/classes/coverage_spec.rb new file mode 100644 index 0000000..de44654 --- /dev/null +++ b/environments/production/modules/staging/spec/classes/coverage_spec.rb @@ -0,0 +1,4 @@ +require 'rspec-puppet' + +at_exit { RSpec::Puppet::Coverage.report! } +# vim: syntax=ruby diff --git a/environments/production/modules/staging/spec/default_facts.yml b/environments/production/modules/staging/spec/default_facts.yml new file mode 100644 index 0000000..13c4165 --- /dev/null +++ b/environments/production/modules/staging/spec/default_facts.yml @@ -0,0 +1,14 @@ +# This file is managed via modulesync +# https://github.com/voxpupuli/modulesync +# https://github.com/voxpupuli/modulesync_config +# +# use default_module_facts.yaml for module specific +# facts. +# +# Hint if using with rspec-puppet-facts ("on_supported_os.each"): +# if a same named fact exists in facterdb it will be overridden. +--- +concat_basedir: "/tmp" +ipaddress: "172.16.254.254" +is_pe: false +macaddress: "AA:AA:AA:AA:AA:AA" diff --git a/environments/production/modules/staging/spec/defines/staging_deploy_spec.rb b/environments/production/modules/staging/spec/defines/staging_deploy_spec.rb new file mode 100644 index 0000000..6145cf6 --- /dev/null +++ b/environments/production/modules/staging/spec/defines/staging_deploy_spec.rb @@ -0,0 +1,104 @@ +require 'spec_helper' +describe 'staging::deploy', type: :define do + let(:facts) do + { + caller_module_name: '', + osfamily: 'RedHat', + staging_http_get: 'curl', + path: '/usr/local/bin:/usr/bin:/bin' + } + end + + describe 'when deploying tar.gz' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { + source: 'puppet:///modules/staging/sample.tar.gz', + target: '/usr/local' + } + end + + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_file('/opt/staging') } + it { is_expected.to contain_file('/opt/staging/sample.tar.gz') } + it do + is_expected.to contain_exec('extract sample.tar.gz').with(command: 'tar xzf /opt/staging/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/usr/local', + creates: '/usr/local/sample') + end + end + + describe 'when deploying tar.gz with full path in title and no source' do + let(:title) { 'puppet:///modules/staging/sample.tar.gz' } + let(:params) do + { + target: '/usr/local' + } + end + + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_file('/opt/staging') } + it { is_expected.to contain_file('/opt/staging/sample.tar.gz') } + it do + is_expected.to contain_exec('extract sample.tar.gz').with(command: 'tar xzf /opt/staging/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/usr/local', + creates: '/usr/local/sample') + end + end + + describe 'fail when deploying tar.gz with filename in title and no source' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { + target: '/usr/local' + } + end + + it do + expect do + is_expected.to contain_exec('extract sample.tar.gz') + end.to raise_error(Puppet::Error, %r{do not recognize source}) + end + end + + describe 'when deploying tar.gz with strip' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { + source: 'puppet:///modules/staging/sample.tar.gz', + target: '/usr/local', + strip: 1 + } + end + + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_file('/opt/staging') } + it { is_expected.to contain_file('/opt/staging/sample.tar.gz') } + it do + is_expected.to contain_exec('extract sample.tar.gz').with(command: 'tar xzf /opt/staging/sample.tar.gz --strip=1', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/usr/local', + creates: '/usr/local/sample') + end + end + + describe 'when deploying zip file with unzip_opts' do + let(:title) { 'sample.zip' } + let(:params) do + { source: 'puppet:///modules/staging/sample.tar.gz', + target: '/usr/local', + unzip_opts: '-o -f' } + end + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_file('/opt/staging') } + it { is_expected.to contain_file('/opt/staging/sample.zip') } + it do + is_expected.to contain_exec('extract sample.zip').with(command: 'unzip -o -f /opt/staging/sample.zip', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/usr/local', + creates: '/usr/local/sample') + end + end +end diff --git a/environments/production/modules/staging/spec/defines/staging_extract_spec.rb b/environments/production/modules/staging/spec/defines/staging_extract_spec.rb new file mode 100644 index 0000000..0adc614 --- /dev/null +++ b/environments/production/modules/staging/spec/defines/staging_extract_spec.rb @@ -0,0 +1,175 @@ +require 'spec_helper' +describe 'staging::extract', type: :define do + # forcing a more sane caller_module_name to match real usage. + let(:facts) do + { + osfamily: 'RedHat', + path: '/usr/local/bin:/usr/bin:/bin' + } + end + + describe 'when deploying tar.gz' do + let(:title) { 'sample.tar.gz' } + let(:params) { { target: '/opt' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.tar.gz').with(command: 'tar xzf /opt/staging/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying tar.gz with strip' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { target: '/opt', + strip: 1 } + end + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.tar.gz').with(command: 'tar xzf /opt/staging/sample.tar.gz --strip=1', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying tbz2' do + let(:title) { 'sample.tbz2' } + let(:params) { { target: '/opt' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.tbz2').with(command: 'tar xjf /opt/staging/sample.tbz2', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying zip' do + let(:title) { 'sample.zip' } + let(:params) { { target: '/opt' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.zip').with(command: 'unzip /opt/staging/sample.zip', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying zip with unzip_opts' do + let(:title) { 'sample.zip' } + let(:params) do + { + target: '/opt', + unzip_opts: '-o -f' + } + end + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.zip').with(command: 'unzip -o -f /opt/staging/sample.zip', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying zip with strip (noop)' do + let(:title) { 'sample.zip' } + let(:params) do + { + target: '/opt', + strip: 1 + } + end + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.zip').with(command: 'unzip /opt/staging/sample.zip', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying war' do + let(:title) { 'sample.war' } + let(:params) { { target: '/opt' } } + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.war').with(command: 'jar xf /opt/staging/sample.war', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying war with strip (noop) and unzip_opts (noop)' do + let(:title) { 'sample.war' } + let(:params) do + { + target: '/opt', + strip: 1, + unzip_opts: '-o -f' + } + end + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.war').with(command: 'jar xf /opt/staging/sample.war', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying deb on a Debian family system' do + let(:facts) do + { + osfamily: 'Debian', + path: '/usr/local/bin:/usr/bin:/bin' + } + end + let(:title) { 'sample.deb' } + let(:params) { { target: '/opt' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('extract sample.deb').with(command: 'dpkg --extract /opt/staging/sample.deb .', + path: '/usr/local/bin:/usr/bin:/bin', + cwd: '/opt', + creates: '/opt/sample') + end + end + + describe 'when deploying deb on a non-Debian family system' do + let(:title) { 'sample.deb' } + let(:params) do + { target: '/opt' } + end + it 'fails' do + is_expected.to compile.and_raise_error(%r{The .deb filetype is only supported on Debian family systems.}) + end + end + + describe 'when deploying unknown' do + let(:title) { 'sample.zzz' } + let(:params) { { target: '/opt' } } + + it { expect { is_expected.to contain_exec('exec sample.zzz') }.to raise_error(Puppet::Error) } + end +end diff --git a/environments/production/modules/staging/spec/defines/staging_file_spec.rb b/environments/production/modules/staging/spec/defines/staging_file_spec.rb new file mode 100644 index 0000000..4562561 --- /dev/null +++ b/environments/production/modules/staging/spec/defines/staging_file_spec.rb @@ -0,0 +1,219 @@ +require 'spec_helper' +describe 'staging::file', type: :define do + # forcing a more sane caller_module_name to match real usage. + let(:facts) do + { + osfamily: 'RedHat', + staging_http_get: 'curl', + puppetversion: Puppet.version + } + end + + describe 'when deploying via puppet' do + let(:title) { 'sample.tar.gz' } + let(:params) { { source: 'puppet:///modules/staging/sample.tar.gz' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_file('/opt/staging/sample.tar.gz') + is_expected.not_to contain_exec('/opt/staging/sample.tar.gz') + end + end + + describe 'when deploying via local' do + let(:title) { 'sample.tar.gz' } + let :params do + { + source: '/nfs/sample.tar.gz', + target: '/usr/local/sample.tar.gz' + } + end + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_file('/usr/local/sample.tar.gz') + is_expected.not_to contain_exec('/opt/staging/sample.tar.gz') + end + end + + describe 'when deploying via Windows local' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { + source: 'S:/nfs/sample.tar.gz', + target: '/usr/local/sample.tar.gz' + } + end + + # it { is_expected.to compile.with_all_deps } # This test will fail unless we're running the tests on Windows. + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_file('/usr/local/sample.tar.gz') + is_expected.not_to contain_exec('/opt/staging/sample.tar.gz') + end + end + + describe 'when deploying via http' do + let(:title) { 'sample.tar.gz' } + let(:params) { { source: 'http://webserver/sample.tar.gz' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -f -L -o /opt/staging/sample.tar.gz http://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + is_expected.to contain_file('/opt/staging/sample.tar.gz').with(owner: nil, + group: nil, + mode: nil) + end + end + + describe 'when deploying via http with file parameters' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { + source: 'http://webserver/sample.tar.gz', + owner: 'root', + group: 'root', + mode: '0644' + } + end + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -f -L -o /opt/staging/sample.tar.gz http://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + is_expected.to contain_file('/opt/staging/sample.tar.gz').with(owner: 'root', + group: 'root', + mode: '0644') + end + end + + describe 'when deploying via http with custom curl options' do + let(:title) { 'sample.tar.gz' } + let(:params) do + { + source: 'http://webserver/sample.tar.gz', + curl_option: '-b' + } + end + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -b -f -L -o /opt/staging/sample.tar.gz http://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + end + end + + describe 'when deploying via http with parameters' do + let(:title) { 'sample.tar.gz' } + let :params do + { + source: 'http://webserver/sample.tar.gz', + target: '/usr/local/sample.tar.gz', + tries: '10', + try_sleep: '6' + } + end + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/usr/local/sample.tar.gz').with(command: 'curl -f -L -o /usr/local/sample.tar.gz http://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/usr/local', + creates: '/usr/local/sample.tar.gz', + tries: '10', + try_sleep: '6') + end + end + + describe 'when deploying via https' do + let(:title) { 'sample.tar.gz' } + let(:params) { { source: 'https://webserver/sample.tar.gz' } } + + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_file('/opt/staging') } + it do + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -f -L -o /opt/staging/sample.tar.gz https://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + end + end + + describe 'when deploying via https with parameters' do + let(:title) { 'sample.tar.gz' } + let :params do + { + source: 'https://webserver/sample.tar.gz', + username: 'puppet', + password: 'puppet' + } + end + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -f -L -o /opt/staging/sample.tar.gz -u puppet:puppet https://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + end + end + + describe 'when deploying via ftp' do + let(:title) { 'sample.tar.gz' } + let(:params) { { source: 'ftp://webserver/sample.tar.gz' } } + + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -o /opt/staging/sample.tar.gz ftp://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + end + end + + describe 'when deploying via ftp with parameters' do + let(:title) { 'sample.tar.gz' } + let :params do + { + source: 'ftp://webserver/sample.tar.gz', + username: 'puppet', + password: 'puppet' + } + end + it { is_expected.to compile.with_all_deps } + it do + is_expected.to contain_file('/opt/staging') + is_expected.to contain_exec('/opt/staging/sample.tar.gz').with(command: 'curl -o /opt/staging/sample.tar.gz -u puppet:puppet ftp://webserver/sample.tar.gz', + path: '/usr/local/bin:/usr/bin:/bin', + environment: nil, + cwd: '/opt/staging', + creates: '/opt/staging/sample.tar.gz', + logoutput: 'on_failure') + end + end +end diff --git a/environments/production/modules/staging/spec/fixtures/hiera.yaml b/environments/production/modules/staging/spec/fixtures/hiera.yaml new file mode 100644 index 0000000..d8adad2 --- /dev/null +++ b/environments/production/modules/staging/spec/fixtures/hiera.yaml @@ -0,0 +1,9 @@ +--- +:backends: + - puppet + +:hierarchy: + - common + +:puppet: + :datasource: data diff --git a/environments/production/modules/staging/spec/spec.opts b/environments/production/modules/staging/spec/spec.opts new file mode 100644 index 0000000..91cd642 --- /dev/null +++ b/environments/production/modules/staging/spec/spec.opts @@ -0,0 +1,6 @@ +--format +s +--colour +--loadby +mtime +--backtrace diff --git a/environments/production/modules/staging/spec/spec_helper.rb b/environments/production/modules/staging/spec/spec_helper.rb new file mode 100644 index 0000000..32709c8 --- /dev/null +++ b/environments/production/modules/staging/spec/spec_helper.rb @@ -0,0 +1,32 @@ +require 'puppetlabs_spec_helper/module_spec_helper' +require 'rspec-puppet-facts' +include RspecPuppetFacts + +if Dir.exist?(File.expand_path('../../lib', __FILE__)) && RUBY_VERSION !~ %r{^1.9} + require 'coveralls' + require 'simplecov' + require 'simplecov-console' + SimpleCov.formatters = [ + SimpleCov::Formatter::HTMLFormatter, + SimpleCov::Formatter::Console, + Coveralls::SimpleCov::Formatter + ] + SimpleCov.start do + track_files 'lib/**/*.rb' + add_filter '/spec' + add_filter '/vendor' + add_filter '/.vendor' + end +end + +RSpec.configure do |c| + default_facts = { + puppetversion: Puppet.version, + facterversion: Facter.version + } + default_facts.merge!(YAML.load(File.read(File.expand_path('../default_facts.yml', __FILE__)))) if File.exist?(File.expand_path('../default_facts.yml', __FILE__)) + default_facts.merge!(YAML.load(File.read(File.expand_path('../default_module_facts.yml', __FILE__)))) if File.exist?(File.expand_path('../default_module_facts.yml', __FILE__)) + c.default_facts = default_facts +end + +# vim: syntax=ruby diff --git a/environments/production/modules/staging/spec/unit/puppet/parser/functions/scope_defaults_spec.rb b/environments/production/modules/staging/spec/unit/puppet/parser/functions/scope_defaults_spec.rb new file mode 100644 index 0000000..3c1b0e5 --- /dev/null +++ b/environments/production/modules/staging/spec/unit/puppet/parser/functions/scope_defaults_spec.rb @@ -0,0 +1,45 @@ +#!/usr/bin/env rspec +require 'spec_helper' + +describe 'the scope_defaults function' do + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + it 'exists' do + Puppet::Parser::Functions.function('scope_defaults').should == 'function_scope_defaults' + end + + it 'raises a ParseError if there is less than 2 arguments' do + expect { scope.function_scope_defaults([]) }. + to raise_error(Puppet::ParseError) + end + + it 'raises a ParseError if there is more than 2 arguments' do + expect { scope.function_scope_defaults(%w(exec path error)) }. + to raise_error(Puppet::ParseError) + end + + it 'returns false for invalid resource' do + result = scope.function_scope_defaults(%w(foo path)) + result.should(eq(false)) + end + + it 'returns false for resource without default attributes' do + if scope.respond_to? :define_settings + scope.define_settings('Exec', Puppet::Parser::Resource::Param.new(name: :path, value: '/bin')) + else + scope.setdefaults('Exec', Puppet::Parser::Resource::Param.new(name: :path, value: '/bin')) + end + result = scope.function_scope_defaults(%w(Exec foo)) + result.should(eq(false)) + end + + it 'returns true for resource with default attributes' do + if scope.respond_to? :define_settings + scope.define_settings('Exec', Puppet::Parser::Resource::Param.new(name: :path, value: '/bin')) + else + scope.setdefaults('Exec', Puppet::Parser::Resource::Param.new(name: :path, value: '/bin')) + end + result = scope.function_scope_defaults(%w(Exec path)) + result.should(eq(true)) + end +end diff --git a/environments/production/modules/staging/spec/unit/puppet/parser/functions/staging_parse_spec.rb b/environments/production/modules/staging/spec/unit/puppet/parser/functions/staging_parse_spec.rb new file mode 100644 index 0000000..100fc69 --- /dev/null +++ b/environments/production/modules/staging/spec/unit/puppet/parser/functions/staging_parse_spec.rb @@ -0,0 +1,51 @@ +#!/usr/bin/env rspec +require 'spec_helper' + +describe 'the staging parser function' do + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + it 'exists' do + Puppet::Parser::Functions.function('staging_parse').should == 'function_staging_parse' + end + + it 'raises a ParseError if there is less than 1 arguments' do + -> { scope.function_staging_parse([]) }.should(raise_error(Puppet::ParseError)) + end + + it 'raises a ParseError if there is more than 3 arguments' do + -> { scope.function_staging_parse(['/etc', 'filename', '.zip', 'error']) }.should(raise_error(Puppet::ParseError)) + end + + it 'raises a ParseError if there is an invalid info request' do + -> { scope.function_staging_parse(['/etc', 'sheep', '.zip']) }.should(raise_error(Puppet::ParseError)) + end + + it "raises a ParseError if 'source' doesn't have a URI path component" do + -> { scope.function_staging_parse(['uri:without-path']) }.should(raise_error(Puppet::ParseError, %r{has no URI 'path' component})) + end + + it 'returns the filename by default' do + result = scope.function_staging_parse(['/etc/puppet/sample.tar.gz']) + result.should(eq('sample.tar.gz')) + end + + it 'returns the file basename' do + result = scope.function_staging_parse(['/etc/puppet/sample.tar.gz', 'basename']) + result.should(eq('sample.tar')) + end + + it 'returns the file basename with custom extensions' do + result = scope.function_staging_parse(['/etc/puppet/sample.tar.gz', 'basename', '.tar.gz']) + result.should(eq('sample')) + end + + it 'returns the file extname' do + result = scope.function_staging_parse(['/etc/puppet/sample.tar.gz', 'extname']) + result.should(eq('.gz')) + end + + it 'returns the file parent' do + result = scope.function_staging_parse(['/etc/puppet/sample.tar.gz', 'parent']) + result.should(eq('/etc/puppet')) + end +end diff --git a/environments/production/modules/stdlib/CHANGELOG.md b/environments/production/modules/stdlib/CHANGELOG.md new file mode 100644 index 0000000..eeca835 --- /dev/null +++ b/environments/production/modules/stdlib/CHANGELOG.md @@ -0,0 +1,775 @@ +## Supported Release 4.16.0 +### Summary + +This release sees a massive update to all unit tests to test UTF8 characters. There are also multiple cleanups in preparation for internationalization. Alongside this, improvements to ipv6 support, a new length function compatible with Puppet 4, and an update to path types. Also contains multiple bug fixes around functionality and tests. + +#### Features +- Addition of coverage in all unit tests for functions, data and resource types for UTF8 for i18n. +- All strings within the readme and functions that are split over two lines have been combined in preparation for i18n parser/decorator. +- Improvement on the ipv6 support for type - Improves regex to catch some valid (but lesser known) ipv6 strings, mostly those which are a mix of ipv6 strings and embedded ipv6 numbers. +- Adds a new parameter `encoding` to allow non UTF-8 files to specify a file encoding. This prevents receiving the error message "invalid byte sequence in UTF-8" when special characters that are not UTF-8 encoded appear in the input stream, such as the copyright symbol. +- Addition of the new length function. Returns the length of a given string, array or hash. To eventually replace the deprecated size() function as can handle the new type functionality introduced in Puppet 4. +- Permit double slash in absolute/Unix path types. + +#### Bugfixes +- Fix unsupported data type error with rspec-puppet master. +- Now allows test module metadata.json to be read by Puppet. +- Fix acceptance test failure "Hiera is not a class". +- Removal of unsupported platforms and future parser setting in acceptance tests. +- Regex for tuple checking has been loosened. +- Ensure_packages function - Now only tries to apply the resource if not defined. +- (MODULES-4528) Use versioncmp to check Puppet version for 4.10.x compat. +- Adds comments to warn for UTF8 incompatibility of the functions that may not be compatible with UTF8 with Ruby < 2.4.0. + +## Supported Release 4.15.0 +### Summary + +This release introduces multiple new functions, a new fact and the addition of Ubuntu Xenial support. Also includes a bugfix and documentation update. + +#### Features +- Addition of puppet_server fact to return agents server. +- Addition of a pry function. +- Addition of tests for ensure_resources. +- Addition of FQDN UUID generation function. +- Addition of Ubuntu Xenial to OS Support. + +####Bugfixes +- Ensure_packages now works with Ruby < 2.0. +- Updated the documentation of str2bool function. + +## Supported Release 4.14.0 +### Summary + +Adds several new features and updates, especially around refining the deprecation and validate_legacy functions. Also includes a Gemfile update around an issue with parallel_tests dependancy for different versions of Ruby. + +#### Features +- Deprecation function now uses puppet stacktrace if available. +- join_key_to_values function now handles array values. If values are arrays, multiple keys are added for each element. +- Updated Gemfile to deal with parallel_tests Ruby dependancy (MODULES-3983). +- Updated/Fixed ipv4 regex validator (MODULES-3980). +- Deprecation clarification added to README. + +#### Bugfixes +- README typo fixes. +- Use .dup to duplicate classes for modification (MODULES-3829). +- Fixes spec failures that were caused by a change in the tested error message in validate_legacy_spec. +- Broken link to validate_legacy docs fixed. +- Updates deprecation tests to include future parser. + +## Supported Release 4.13.1 +### Summary + +This bugfix release addresses the `undefined method 'optional_repeated_param'` error messages seen by users of puppet 3.7. + +It also improves the user experience around function deprecations by emitting one warning per function(-name) instead of only one deprecation overall. This allows users to identify all deprecated functions used in one agent run, with less back-and-forth. + +#### Bugfixes + +* Emit deprecations warnings for each function, instead of once per process. (MODULES-3961) +* Use a universally available API for the v4 deprecation stubs of `is_*` and `validate_*`. (MODULES-3962) +* Make `getvar()` compatible to ruby 1.8.7. (MODULES-3969) +* Add v4 deprecation stubs for the `is_` counterparts of the deprecated functions to emit the deprecations warnings in all cases. + + +## Supported Release 4.13.0 +### Summary + +This version of stdlib deprecates a whole host of functions, and provides stepping stones to move to Puppet 4 type validations. Be sure to check out the new `deprecation()` and `validate_legacy()` functions to migrate off the deprecated v3-style data validations. + +Many thanks to all community contributors: bob, Dmitry Ilyin, Dominic Cleal, Joris, Joseph Yaworski, Loic Antoine-Gombeaud, Maksym Melnychok, Michiel Brandenburg, Nate Potter, Romain Tartière, Stephen Benjamin, and Steve Moore, as well as anyone contributing in the code review process and by submitting issues. + +Special thanks to [Voxpupuli's](https://voxpupuli.org/) Igor Galić for donating the puppet-tea types to kickstart this part of stdlib. + + +#### Deprecations +* `validate_absolute_path`, `validate_array`, `validate_bool`, `validate_hash`, `validate_integer`, `validate_ip_address`, `validate_ipv4_address`, `validate_ipv6_address`, `validate_numeric`, `validate_re`, `validate_slength`, `validate_string`, and their `is_` counter parts are now deprecated on Puppet 4. See the `validate_legacy()` description in the README for help on migrating away from those functions. +* The `dig` function is provided by core puppet since 4.5.0 with slightly different calling convention. The stdlib version can still be accessed as `dig44` for now. + + +#### Features +* Add Puppet 4 data types for Unix, and Windows paths, and URLs. +* Add `deprecation` function to warn users of functionality that will be removed soon. +* Add `validate_legacy` function to help with migrating to Puppet 4 data types. + +* Add `any2bool` function, a combination of of `string2bool` and `num2bool`. +* Add `delete_regex` function to delete array elements matching a regular expression. +* Add `puppet_environmentpath` fact to expose the `environmentpath` setting. +* Add `regexpescape` function to safely insert arbitrary strings into regular expressions. +* Add `shell_escape`, `shell_join`, and `shell_split` functions for safer working with shell scripts.. + +* The `delete` function now also accepts regular expressions as search term. +* The `loadyaml` function now accepts a default value, which is returned when there is an error loading the file. + +#### Bugfixes +* Fix `file_line.match_for_absence` implementation and description to actually work. (MODULES-3590) +* Fix `getparam` so that it can now also return `false`. (MODULES-3933) +* Fix the fixture setup for testing and adjust `load_module_metadata` and `loadjson` tests. +* Fix `defined_with_params` to handle `undef` correctly on all puppet versions. (PUP-6422, MODULES-3543) +* Fix `file_line.path` validation to use puppet's built in `absolute_path?` matcher. + +#### Minor Improvements +* README changes: improved descriptions of `deep_merge`, `delete`, `ensure_packages`, `file_line.after`, `range`, and `validate_numeric`. +* The `getvar` function now returns nil in all situations where the variable is not found. +* Update the `dig44` function with better `undef`, `nil`, and `false` handling. +* Better wording on `str2bool` argument validation error message. + + +### Known issues +* The `validate_legacy` function relies on internal APIs from Puppet 4.4.0 (PE 2016.1) onwards, and doesn't work on earlier versions. +* Puppet 4.5.0 (PE 2016.2) has a number of improvements around data types - especially error handling - that make working with them much nicer. + +## Supported Release 4.12.0 +###Summary + +This release provides several new functions, bugfixes, modulesync changes, and some documentation updates. + +####Features +- Adds `clamp`. This function keeps values within a specified range. +- Adds `validate_x509_rsa_key_pair`. This function validates an x509 RSA certificate and key pair. +- Adds `dig`. This function performs a deep lookup in nested hashes or arrays. +- Extends the `base64` support to fit `rfc2045` and `rfc4648`. +- Adds `is_ipv6_address` and `is_ipv4_address`. These functions validate the specified ipv4 or ipv6 addresses. +- Adds `enclose_ipv6`. This function encloses IPv6 addresses in square brackets. +- Adds `ensure_resources`. This function takes a list of resources and creates them if they do not exist. +- Extends `suffix` to support applying a suffix to keys in a hash. +- Apply modulesync changes. +- Add validate_email_address function. + +####Bugfixes +- Fixes `fqdn_rand_string` tests, since Puppet 4.4.0 and later have a higher `fqdn_rand` ceiling. +- (MODULES-3152) Adds a check to `package_provider` to prevent failures if Gem is not installed. +- Fixes to README.md. +- Fixes catch StandardError rather than the gratuitous Exception +- Fixes file_line attribute validation. +- Fixes concat with Hash arguments. + +## Supported Release 4.11.0 +###Summary + +Provides a validate_absolute_paths and Debian 8 support. There is a fix to the is_package_provider fact and a test improvement. + +####Features +- Adds new parser called is_absolute_path +- Supports Debian 8 + +####Bugfixes +- Allow package_provider fact to resolve on PE 3.x + +####Improvements +- ensures that the test passes independently of changes to rubygems for ensure_resource + +##2015-12-15 - Supported Release 4.10.0 +###Summary + +Includes the addition of several new functions and considerable improvements to the existing functions, tests and documentation. Includes some bug fixes which includes compatibility, test and fact issues. + +####Features +- Adds service_provider fact +- Adds is_a() function +- Adds package_provider fact +- Adds validate_ip_address function +- Adds seeded_rand function + +####Bugfixes +- Fix backwards compatibility from an improvement to the parseyaml function +- Renaming of load_module_metadata test to include _spec.rb +- Fix root_home fact on AIX 5.x, now '-c' rather than '-C' +- Fixed Gemfile to work with ruby 1.8.7 + +####Improvements +- (MODULES-2462) Improvement of parseyaml function +- Improvement of str2bool function +- Improvement to readme +- Improvement of intersection function +- Improvement of validate_re function +- Improved speed on Facter resolution of service_provider +- empty function now handles numeric values +- Package_provider now prevents deprecation warning about the allow_virtual parameter +- load_module_metadata now succeeds on empty file +- Check added to ensure puppetversion value is not nil +- Improvement to bool2str to return a string of choice using boolean +- Improvement to naming convention in validate_ipv4_address function + +## Supported Release 4.9.1 +###Summary + +Small release for support of newer PE versions. This increments the version of PE in the metadata.json file. + +##2015-09-08 - Supported Release 4.9.0 +###Summary + +This release adds new features including the new functions dos2unix, unix2dos, try_get_value, convert_base as well as other features and improvements. + +####Features +- (MODULES-2370) allow `match` parameter to influence `ensure => absent` behavior +- (MODULES-2410) Add new functions dos2unix and unix2dos +- (MODULE-2456) Modify union to accept more than two arrays +- Adds a convert_base function, which can convert numbers between bases +- Add a new function "try_get_value" + +####Bugfixes +- n/a + +####Improvements +- (MODULES-2478) Support root_home fact on AIX through "lsuser" command +- Acceptance test improvements +- Unit test improvements +- Readme improvements + +## 2015-08-10 - Supported Release 4.8.0 +### Summary +This release adds a function for reading metadata.json from any module, and expands file\_line's abilities. + +#### Features +- New parameter `replace` on `file_line` +- New function `load_module_metadata()` to load metadata.json and return the content as a hash. +- Added hash support to `size()` + +#### Bugfixes +- Fix various docs typos +- Fix `file_line` resource on puppet < 3.3 + +##2015-06-22 - Supported Release 4.7.0 +###Summary + +Adds Solaris 12 support along with improved Puppet 4 support. There are significant test improvements, and some minor fixes. + +####Features +- Add support for Solaris 12 + +####Bugfixes +- Fix for AIO Puppet 4 +- Fix time for ruby 1.8.7 +- Specify rspec-puppet version +- range() fix for typeerror and missing functionality +- Fix pw_hash() on JRuby < 1.7.17 +- fqdn_rand_string: fix argument error message +- catch and rescue from looking up non-existent facts +- Use puppet_install_helper, for Puppet 4 + +####Improvements +- Enforce support for Puppet 4 testing +- fqdn_rotate/fqdn_rand_string acceptance tests and implementation +- Simplify mac address regex +- validate_integer, validate_numeric: explicitely reject hashes in arrays +- Readme edits +- Remove all the pops stuff for rspec-puppet +- Sync via modulesync +- Add validate_slength optional 3rd arg +- Move tests directory to examples directory + +##2015-04-14 - Supported Release 4.6.0 +###Summary + +Adds functions and function argument abilities, and improves compatibility with the new puppet parser + +####Features +- MODULES-444: `concat()` can now take more than two arrays +- `basename()` added to have Ruby File.basename functionality +- `delete()` can now take an array of items to remove +- `prefix()` can now take a hash +- `upcase()` can now take a hash or array of upcaseable things +- `validate_absolute_path()` can now take an array +- `validate_cmd()` can now use % in the command to embed the validation file argument in the string +- MODULES-1473: deprecate `type()` function in favor of `type3x()` +- MODULES-1473: Add `type_of()` to give better type information on future parser +- Deprecate `private()` for `assert_private()` due to future parser +- Adds `ceiling()` to take the ceiling of a number +- Adds `fqdn_rand_string()` to generate random string based on fqdn +- Adds `pw_hash()` to generate password hashes +- Adds `validate_integer()` +- Adds `validate_numeric()` (like `validate_integer()` but also accepts floats) + +####Bugfixes +- Fix seeding of `fqdn_rotate()` +- `ensure_resource()` is more verbose on debug mode +- Stricter argument checking for `dirname()` +- Fix `is_domain_name()` to better match RFC +- Fix `uriescape()` when called with array +- Fix `file_line` resource when using the `after` attribute with `match` + +##2015-01-14 - Supported Release 4.5.1 +###Summary + +This release changes the temporary facter_dot_d cache locations outside of the /tmp directory due to a possible security vunerability. CVE-2015-1029 + +####Bugfixes +- Facter_dot_d cache will now be stored in puppet libdir instead of tmp + +##2014-12-15 - Supported Release 4.5.0 +###Summary + +This release improves functionality of the member function and adds improved future parser support. + +####Features +- MODULES-1329: Update member() to allow the variable to be an array. +- Sync .travis.yml, Gemfile, Rakefile, and CONTRIBUTING.md via modulesync + +####Bugfixes +- Fix range() to work with numeric ranges with the future parser +- Accurately express SLES support in metadata.json (was missing 10SP4 and 12) +- Don't require `line` to match the `match` parameter + +##2014-11-10 - Supported Release 4.4.0 +###Summary +This release has an overhauled readme, new private manifest function, and fixes many future parser bugs. + +####Features +- All new shiny README +- New `private()` function for making private manifests (yay!) + +####Bugfixes +- Code reuse in `bool2num()` and `zip()` +- Fix many functions to handle `generate()` no longer returning a string on new puppets +- `concat()` no longer modifies the first argument (whoops) +- strict variable support for `getvar()`, `member()`, `values_at`, and `has_interface_with()` +- `to_bytes()` handles PB and EB now +- Fix `tempfile` ruby requirement for `validate_augeas()` and `validate_cmd()` +- Fix `validate_cmd()` for windows +- Correct `validate_string()` docs to reflect non-handling of `undef` +- Fix `file_line` matching on older rubies + + +##2014-07-15 - Supported Release 4.3.2 +###Summary + +This release merely updates metadata.json so the module can be uninstalled and +upgraded via the puppet module command. + +##2014-07-14 - Supported Release 4.3.1 +### Summary +This supported release updates the metadata.json to work around upgrade behavior of the PMT. + +#### Bugfixes +- Synchronize metadata.json with PMT-generated metadata to pass checksums + +##2014-06-27 - Supported Release 4.3.0 +### Summary +This release is the first supported release of the stdlib 4 series. It remains +backwards-compatible with the stdlib 3 series. It adds two new functions, one bugfix, and many testing updates. + +#### Features +- New `bool2str()` function +- New `camelcase()` function + +#### Bugfixes +- Fix `has_interface_with()` when interfaces fact is nil + +##2014-06-04 - Release 4.2.2 +### Summary + +This release adds PE3.3 support in the metadata and fixes a few tests. + +## 2014-05-08 - Release - 4.2.1 +### Summary +This release moves a stray symlink that can cause problems. + +## 2014-05-08 - Release - 4.2.0 +### Summary +This release adds many new functions and fixes, and continues to be backwards compatible with stdlib 3.x + +#### Features +- New `base64()` function +- New `deep_merge()` function +- New `delete_undef_values()` function +- New `delete_values()` function +- New `difference()` function +- New `intersection()` function +- New `is_bool()` function +- New `pick_default()` function +- New `union()` function +- New `validate_ipv4_address` function +- New `validate_ipv6_address` function +- Update `ensure_packages()` to take an option hash as a second parameter. +- Update `range()` to take an optional third argument for range step +- Update `validate_slength()` to take an optional third argument for minimum length +- Update `file_line` resource to take `after` and `multiple` attributes + +#### Bugfixes +- Correct `is_string`, `is_domain_name`, `is_array`, `is_float`, and `is_function_available` for parsing odd types such as bools and hashes. +- Allow facts.d facts to contain `=` in the value +- Fix `root_home` fact on darwin systems +- Fix `concat()` to work with a second non-array argument +- Fix `floor()` to work with integer strings +- Fix `is_integer()` to return true if passed integer strings +- Fix `is_numeric()` to return true if passed integer strings +- Fix `merge()` to work with empty strings +- Fix `pick()` to raise the correct error type +- Fix `uriescape()` to use the default URI.escape list +- Add/update unit & acceptance tests. + + +##2014-03-04 - Supported Release - 3.2.1 +###Summary +This is a supported release + +####Bugfixes +- Fixed `is_integer`/`is_float`/`is_numeric` for checking the value of arithmatic expressions. + +####Known bugs +* No known bugs + +--- + +##### 2013-05-06 - Jeff McCune - 4.1.0 + + * (#20582) Restore facter\_dot\_d to stdlib for PE users (3b887c8) + * (maint) Update Gemfile with GEM\_FACTER\_VERSION (f44d535) + +##### 2013-05-06 - Alex Cline - 4.1.0 + + * Terser method of string to array conversion courtesy of ethooz. (d38bce0) + +##### 2013-05-06 - Alex Cline 4.1.0 + + * Refactor ensure\_resource expectations (b33cc24) + +##### 2013-05-06 - Alex Cline 4.1.0 + + * Changed str-to-array conversion and removed abbreviation. (de253db) + +##### 2013-05-03 - Alex Cline 4.1.0 + + * (#20548) Allow an array of resource titles to be passed into the ensure\_resource function (e08734a) + +##### 2013-05-02 - Raphaël Pinson - 4.1.0 + + * Add a dirname function (2ba9e47) + +##### 2013-04-29 - Mark Smith-Guerrero - 4.1.0 + + * (maint) Fix a small typo in hash() description (928036a) + +##### 2013-04-12 - Jeff McCune - 4.0.2 + + * Update user information in gemspec to make the intent of the Gem clear. + +##### 2013-04-11 - Jeff McCune - 4.0.1 + + * Fix README function documentation (ab3e30c) + +##### 2013-04-11 - Jeff McCune - 4.0.0 + + * stdlib 4.0 drops support with Puppet 2.7 + * stdlib 4.0 preserves support with Puppet 3 + +##### 2013-04-11 - Jeff McCune - 4.0.0 + + * Add ability to use puppet from git via bundler (9c5805f) + +##### 2013-04-10 - Jeff McCune - 4.0.0 + + * (maint) Make stdlib usable as a Ruby GEM (e81a45e) + +##### 2013-04-10 - Erik Dalén - 4.0.0 + + * Add a count function (f28550e) + +##### 2013-03-31 - Amos Shapira - 4.0.0 + + * (#19998) Implement any2array (7a2fb80) + +##### 2013-03-29 - Steve Huff - 4.0.0 + + * (19864) num2bool match fix (8d217f0) + +##### 2013-03-20 - Erik Dalén - 4.0.0 + + * Allow comparisons of Numeric and number as String (ff5dd5d) + +##### 2013-03-26 - Richard Soderberg - 4.0.0 + + * add suffix function to accompany the prefix function (88a93ac) + +##### 2013-03-19 - Kristof Willaert - 4.0.0 + + * Add floor function implementation and unit tests (0527341) + +##### 2012-04-03 - Eric Shamow - 4.0.0 + + * (#13610) Add is\_function\_available to stdlib (961dcab) + +##### 2012-12-17 - Justin Lambert - 4.0.0 + + * str2bool should return a boolean if called with a boolean (5d5a4d4) + +##### 2012-10-23 - Uwe Stuehler - 4.0.0 + + * Fix number of arguments check in flatten() (e80207b) + +##### 2013-03-11 - Jeff McCune - 4.0.0 + + * Add contributing document (96e19d0) + +##### 2013-03-04 - Raphaël Pinson - 4.0.0 + + * Add missing documentation for validate\_augeas and validate\_cmd to README.markdown (a1510a1) + +##### 2013-02-14 - Joshua Hoblitt - 4.0.0 + + * (#19272) Add has\_element() function (95cf3fe) + +##### 2013-02-07 - Raphaël Pinson - 4.0.0 + + * validate\_cmd(): Use Puppet::Util::Execution.execute when available (69248df) + +##### 2012-12-06 - Raphaël Pinson - 4.0.0 + + * Add validate\_augeas function (3a97c23) + +##### 2012-12-06 - Raphaël Pinson - 4.0.0 + + * Add validate\_cmd function (6902cc5) + +##### 2013-01-14 - David Schmitt - 4.0.0 + + * Add geppetto project definition (b3fc0a3) + +##### 2013-01-02 - Jaka Hudoklin - 4.0.0 + + * Add getparam function to get defined resource parameters (20e0e07) + +##### 2013-01-05 - Jeff McCune - 4.0.0 + + * (maint) Add Travis CI Support (d082046) + +##### 2012-12-04 - Jeff McCune - 4.0.0 + + * Clarify that stdlib 3 supports Puppet 3 (3a6085f) + +##### 2012-11-30 - Erik Dalén - 4.0.0 + + * maint: style guideline fixes (7742e5f) + +##### 2012-11-09 - James Fryman - 4.0.0 + + * puppet-lint cleanup (88acc52) + +##### 2012-11-06 - Joe Julian - 4.0.0 + + * Add function, uriescape, to URI.escape strings. Redmine #17459 (fd52b8d) + +##### 2012-09-18 - Chad Metcalf - 3.2.0 + + * Add an ensure\_packages function. (8a8c09e) + +##### 2012-11-23 - Erik Dalén - 3.2.0 + + * (#17797) min() and max() functions (9954133) + +##### 2012-05-23 - Peter Meier - 3.2.0 + + * (#14670) autorequire a file\_line resource's path (dfcee63) + +##### 2012-11-19 - Joshua Harlan Lifton - 3.2.0 + + * Add join\_keys\_to\_values function (ee0f2b3) + +##### 2012-11-17 - Joshua Harlan Lifton - 3.2.0 + + * Extend delete function for strings and hashes (7322e4d) + +##### 2012-08-03 - Gary Larizza - 3.2.0 + + * Add the pick() function (ba6dd13) + +##### 2012-03-20 - Wil Cooley - 3.2.0 + + * (#13974) Add predicate functions for interface facts (f819417) + +##### 2012-11-06 - Joe Julian - 3.2.0 + + * Add function, uriescape, to URI.escape strings. Redmine #17459 (70f4a0e) + +##### 2012-10-25 - Jeff McCune - 3.1.1 + + * (maint) Fix spec failures resulting from Facter API changes (97f836f) + +##### 2012-10-23 - Matthaus Owens - 3.1.0 + + * Add PE facts to stdlib (cdf3b05) + +##### 2012-08-16 - Jeff McCune - 3.0.1 + + * Fix accidental removal of facts\_dot\_d.rb in 3.0.0 release + +##### 2012-08-16 - Jeff McCune - 3.0.0 + + * stdlib 3.0 drops support with Puppet 2.6 + * stdlib 3.0 preserves support with Puppet 2.7 + +##### 2012-08-07 - Dan Bode - 3.0.0 + + * Add function ensure\_resource and defined\_with\_params (ba789de) + +##### 2012-07-10 - Hailee Kenney - 3.0.0 + + * (#2157) Remove facter\_dot\_d for compatibility with external facts (f92574f) + +##### 2012-04-10 - Chris Price - 3.0.0 + + * (#13693) moving logic from local spec\_helper to puppetlabs\_spec\_helper (85f96df) + +##### 2012-10-25 - Jeff McCune - 2.5.1 + + * (maint) Fix spec failures resulting from Facter API changes (97f836f) + +##### 2012-10-23 - Matthaus Owens - 2.5.0 + + * Add PE facts to stdlib (cdf3b05) + +##### 2012-08-15 - Dan Bode - 2.5.0 + + * Explicitly load functions used by ensure\_resource (9fc3063) + +##### 2012-08-13 - Dan Bode - 2.5.0 + + * Add better docs about duplicate resource failures (97d327a) + +##### 2012-08-13 - Dan Bode - 2.5.0 + + * Handle undef for parameter argument (4f8b133) + +##### 2012-08-07 - Dan Bode - 2.5.0 + + * Add function ensure\_resource and defined\_with\_params (a0cb8cd) + +##### 2012-08-20 - Jeff McCune - 2.5.0 + + * Disable tests that fail on 2.6.x due to #15912 (c81496e) + +##### 2012-08-20 - Jeff McCune - 2.5.0 + + * (Maint) Fix mis-use of rvalue functions as statements (4492913) + +##### 2012-08-20 - Jeff McCune - 2.5.0 + + * Add .rspec file to repo root (88789e8) + +##### 2012-06-07 - Chris Price - 2.4.0 + + * Add support for a 'match' parameter to file\_line (a06c0d8) + +##### 2012-08-07 - Erik Dalén - 2.4.0 + + * (#15872) Add to\_bytes function (247b69c) + +##### 2012-07-19 - Jeff McCune - 2.4.0 + + * (Maint) use PuppetlabsSpec::PuppetInternals.scope (master) (deafe88) + +##### 2012-07-10 - Hailee Kenney - 2.4.0 + + * (#2157) Make facts\_dot\_d compatible with external facts (5fb0ddc) + +##### 2012-03-16 - Steve Traylen - 2.4.0 + + * (#13205) Rotate array/string randomley based on fqdn, fqdn\_rotate() (fef247b) + +##### 2012-05-22 - Peter Meier - 2.3.3 + + * fix regression in #11017 properly (f0a62c7) + +##### 2012-05-10 - Jeff McCune - 2.3.3 + + * Fix spec tests using the new spec\_helper (7d34333) + +##### 2012-05-10 - Puppet Labs - 2.3.2 + + * Make file\_line default to ensure => present (1373e70) + * Memoize file\_line spec instance variables (20aacc5) + * Fix spec tests using the new spec\_helper (1ebfa5d) + * (#13595) initialize\_everything\_for\_tests couples modules Puppet ver (3222f35) + * (#13439) Fix MRI 1.9 issue with spec\_helper (15c5fd1) + * (#13439) Fix test failures with Puppet 2.6.x (665610b) + * (#13439) refactor spec helper for compatibility with both puppet 2.7 and master (82194ca) + * (#13494) Specify the behavior of zero padded strings (61891bb) + +##### 2012-03-29 Puppet Labs - 2.1.3 + +* (#11607) Add Rakefile to enable spec testing +* (#12377) Avoid infinite loop when retrying require json + +##### 2012-03-13 Puppet Labs - 2.3.1 + +* (#13091) Fix LoadError bug with puppet apply and puppet\_vardir fact + +##### 2012-03-12 Puppet Labs - 2.3.0 + +* Add a large number of new Puppet functions +* Backwards compatibility preserved with 2.2.x + +##### 2011-12-30 Puppet Labs - 2.2.1 + +* Documentation only release for the Forge + +##### 2011-12-30 Puppet Labs - 2.1.2 + +* Documentation only release for PE 2.0.x + +##### 2011-11-08 Puppet Labs - 2.2.0 + +* #10285 - Refactor json to use pson instead. +* Maint - Add watchr autotest script +* Maint - Make rspec tests work with Puppet 2.6.4 +* #9859 - Add root\_home fact and tests + +##### 2011-08-18 Puppet Labs - 2.1.1 + +* Change facts.d paths to match Facter 2.0 paths. +* /etc/facter/facts.d +* /etc/puppetlabs/facter/facts.d + +##### 2011-08-17 Puppet Labs - 2.1.0 + +* Add R.I. Pienaar's facts.d custom facter fact +* facts defined in /etc/facts.d and /etc/puppetlabs/facts.d are + automatically loaded now. + +##### 2011-08-04 Puppet Labs - 2.0.0 + +* Rename whole\_line to file\_line +* This is an API change and as such motivating a 2.0.0 release according to semver.org. + +##### 2011-08-04 Puppet Labs - 1.1.0 + +* Rename append\_line to whole\_line +* This is an API change and as such motivating a 1.1.0 release. + +##### 2011-08-04 Puppet Labs - 1.0.0 + +* Initial stable release +* Add validate\_array and validate\_string functions +* Make merge() function work with Ruby 1.8.5 +* Add hash merging function +* Add has\_key function +* Add loadyaml() function +* Add append\_line native + +##### 2011-06-21 Jeff McCune - 0.1.7 + +* Add validate\_hash() and getvar() functions + +##### 2011-06-15 Jeff McCune - 0.1.6 + +* Add anchor resource type to provide containment for composite classes + +##### 2011-06-03 Jeff McCune - 0.1.5 + +* Add validate\_bool() function to stdlib + +##### 0.1.4 2011-05-26 Jeff McCune + +* Move most stages after main + +##### 0.1.3 2011-05-25 Jeff McCune + +* Add validate\_re() function + +##### 0.1.2 2011-05-24 Jeff McCune + +* Update to add annotated tag + +##### 0.1.1 2011-05-24 Jeff McCune + +* Add stdlib::stages class with a standard set of stages diff --git a/environments/production/modules/stdlib/CONTRIBUTING.md b/environments/production/modules/stdlib/CONTRIBUTING.md new file mode 100644 index 0000000..990edba --- /dev/null +++ b/environments/production/modules/stdlib/CONTRIBUTING.md @@ -0,0 +1,217 @@ +Checklist (and a short version for the impatient) +================================================= + + * Commits: + + - Make commits of logical units. + + - Check for unnecessary whitespace with "git diff --check" before + committing. + + - Commit using Unix line endings (check the settings around "crlf" in + git-config(1)). + + - Do not check in commented out code or unneeded files. + + - The first line of the commit message should be a short + description (50 characters is the soft limit, excluding ticket + number(s)), and should skip the full stop. + + - Associate the issue in the message. The first line should include + the issue number in the form "(#XXXX) Rest of message". + + - The body should provide a meaningful commit message, which: + + - uses the imperative, present tense: "change", not "changed" or + "changes". + + - includes motivation for the change, and contrasts its + implementation with the previous behavior. + + - Make sure that you have tests for the bug you are fixing, or + feature you are adding. + + - Make sure the test suites passes after your commit: + `bundle exec rspec spec/acceptance` More information on [testing](#Testing) below + + - When introducing a new feature, make sure it is properly + documented in the README.md + + * Submission: + + * Pre-requisites: + + - Make sure you have a [GitHub account](https://github.com/join) + + - [Create a ticket](https://tickets.puppet.com/secure/CreateIssue!default.jspa), or [watch the ticket](https://tickets.puppet.com/browse/) you are patching for. + + * Preferred method: + + - Fork the repository on GitHub. + + - Push your changes to a topic branch in your fork of the + repository. (the format ticket/1234-short_description_of_change is + usually preferred for this project). + + - Submit a pull request to the repository in the puppetlabs + organization. + +The long version +================ + + 1. Make separate commits for logically separate changes. + + Please break your commits down into logically consistent units + which include new or changed tests relevant to the rest of the + change. The goal of doing this is to make the diff easier to + read for whoever is reviewing your code. In general, the easier + your diff is to read, the more likely someone will be happy to + review it and get it into the code base. + + If you are going to refactor a piece of code, please do so as a + separate commit from your feature or bug fix changes. + + We also really appreciate changes that include tests to make + sure the bug is not re-introduced, and that the feature is not + accidentally broken. + + Describe the technical detail of the change(s). If your + description starts to get too long, that is a good sign that you + probably need to split up your commit into more finely grained + pieces. + + Commits which plainly describe the things which help + reviewers check the patch and future developers understand the + code are much more likely to be merged in with a minimum of + bike-shedding or requested changes. Ideally, the commit message + would include information, and be in a form suitable for + inclusion in the release notes for the version of Puppet that + includes them. + + Please also check that you are not introducing any trailing + whitespace or other "whitespace errors". You can do this by + running "git diff --check" on your changes before you commit. + + 2. Sending your patches + + To submit your changes via a GitHub pull request, we _highly_ + recommend that you have them on a topic branch, instead of + directly on "master". + It makes things much easier to keep track of, especially if + you decide to work on another thing before your first change + is merged in. + + GitHub has some pretty good + [general documentation](http://help.github.com/) on using + their site. They also have documentation on + [creating pull requests](http://help.github.com/send-pull-requests/). + + In general, after pushing your topic branch up to your + repository on GitHub, you can switch to the branch in the + GitHub UI and click "Pull Request" towards the top of the page + in order to open a pull request. + + + 3. Update the related GitHub issue. + + If there is a GitHub issue associated with the change you + submitted, then you should update the ticket to include the + location of your branch, along with any other commentary you + may wish to make. + +Testing +======= + +Getting Started +--------------- + +Our puppet modules provide [`Gemfile`](./Gemfile)s which can tell a ruby +package manager such as [bundler](http://bundler.io/) what Ruby packages, +or Gems, are required to build, develop, and test this software. + +Please make sure you have [bundler installed](http://bundler.io/#getting-started) +on your system, then use it to install all dependencies needed for this project, +by running + +```shell +% bundle install +Fetching gem metadata from https://rubygems.org/........ +Fetching gem metadata from https://rubygems.org/.. +Using rake (10.1.0) +Using builder (3.2.2) +-- 8><-- many more --><8 -- +Using rspec-system-puppet (2.2.0) +Using serverspec (0.6.3) +Using rspec-system-serverspec (1.0.0) +Using bundler (1.3.5) +Your bundle is complete! +Use `bundle show [gemname]` to see where a bundled gem is installed. +``` + +NOTE some systems may require you to run this command with sudo. + +If you already have those gems installed, make sure they are up-to-date: + +```shell +% bundle update +``` + +With all dependencies in place and up-to-date we can now run the tests: + +```shell +% bundle exec rake spec +``` + +This will execute all the [rspec tests](http://rspec-puppet.com/) tests +under [spec/defines](./spec/defines), [spec/classes](./spec/classes), +and so on. rspec tests may have the same kind of dependencies as the +module they are testing. While the module defines in its [Modulefile](./Modulefile), +rspec tests define them in [.fixtures.yml](./fixtures.yml). + +Some puppet modules also come with [beaker](https://github.com/puppetlabs/beaker) +tests. These tests spin up a virtual machine under +[VirtualBox](https://www.virtualbox.org/)) with, controlling it with +[Vagrant](http://www.vagrantup.com/) to actually simulate scripted test +scenarios. In order to run these, you will need both of those tools +installed on your system. + +You can run them by issuing the following command + +```shell +% bundle exec rake spec_clean +% bundle exec rspec spec/acceptance +``` + +This will now download a pre-fabricated image configured in the [default node-set](./spec/acceptance/nodesets/default.yml), +install puppet, copy this module and install its dependencies per [spec/spec_helper_acceptance.rb](./spec/spec_helper_acceptance.rb) +and then run all the tests under [spec/acceptance](./spec/acceptance). + +Writing Tests +------------- + +XXX getting started writing tests. + +If you have commit access to the repository +=========================================== + +Even if you have commit access to the repository, you will still need to +go through the process above, and have someone else review and merge +in your changes. The rule is that all changes must be reviewed by a +developer on the project (that did not write the code) to ensure that +all changes go through a code review process. + +Having someone other than the author of the topic branch recorded as +performing the merge is the record that they performed the code +review. + + +Additional Resources +==================== + +* [Getting additional help](http://puppet.com/community/get-help) + +* [Writing tests](https://docs.puppet.com/guides/module_guides/bgtm.html#step-three-module-testing) + +* [General GitHub documentation](http://help.github.com/) + +* [GitHub pull request documentation](http://help.github.com/send-pull-requests/) diff --git a/environments/production/modules/stdlib/Gemfile b/environments/production/modules/stdlib/Gemfile new file mode 100644 index 0000000..5d86325 --- /dev/null +++ b/environments/production/modules/stdlib/Gemfile @@ -0,0 +1,86 @@ +#This file is generated by ModuleSync, do not edit. + +source ENV['GEM_SOURCE'] || "https://rubygems.org" + +# Determines what type of gem is requested based on place_or_version. +def gem_type(place_or_version) + if place_or_version =~ /^git:/ + :git + elsif place_or_version =~ /^file:/ + :file + else + :gem + end +end + +# Find a location or specific version for a gem. place_or_version can be a +# version, which is most often used. It can also be git, which is specified as +# `git://somewhere.git#branch`. You can also use a file source location, which +# is specified as `file://some/location/on/disk`. +def location_for(place_or_version, fake_version = nil) + if place_or_version =~ /^(git[:@][^#]*)#(.*)/ + [fake_version, { :git => $1, :branch => $2, :require => false }].compact + elsif place_or_version =~ /^file:\/\/(.*)/ + ['>= 0', { :path => File.expand_path($1), :require => false }] + else + [place_or_version, { :require => false }] + end +end + +# Used for gem conditionals +supports_windows = false + +group :development do + gem 'puppet-lint', :require => false + gem 'metadata-json-lint', :require => false, :platforms => 'ruby' + gem 'puppet_facts', :require => false + gem 'puppet-blacksmith', '>= 3.4.0', :require => false, :platforms => 'ruby' + gem 'puppetlabs_spec_helper', '>= 1.2.1', :require => false + gem 'rspec-puppet', '>= 2.3.2', :require => false + gem 'rspec-puppet-facts', :require => false, :platforms => 'ruby' + gem 'mocha', '< 1.2.0', :require => false + gem 'simplecov', :require => false, :platforms => 'ruby' + gem 'parallel_tests', '< 2.10.0', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'parallel_tests', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.0.0') + gem 'rubocop', '0.41.2', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'rubocop', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.0.0') + gem 'rubocop-rspec', '~> 1.6', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.3.0') + gem 'pry', :require => false + gem 'json_pure', '<= 2.0.1', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem 'fast_gettext', '1.1.0', :require => false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.1.0') + gem 'fast_gettext', :require => false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.1.0') + gem 'rainbow', '< 2.2.0', :require => false +end + +group :system_tests do + gem 'beaker', *location_for(ENV['BEAKER_VERSION'] || '>= 3') + gem 'beaker-pe', :require => false + gem 'beaker-rspec', *location_for(ENV['BEAKER_RSPEC_VERSION']) + gem 'beaker-puppet_install_helper', :require => false + gem 'beaker-module_install_helper', :require => false + gem 'master_manipulator', :require => false + gem 'beaker-hostgenerator', *location_for(ENV['BEAKER_HOSTGENERATOR_VERSION']) + gem 'beaker-abs', *location_for(ENV['BEAKER_ABS_VERSION'] || '~> 0.1') +end + +gem 'puppet', *location_for(ENV['PUPPET_GEM_VERSION']) + +# Only explicitly specify Facter/Hiera if a version has been specified. +# Otherwise it can lead to strange bundler behavior. If you are seeing weird +# gem resolution behavior, try setting `DEBUG_RESOLVER` environment variable +# to `1` and then run bundle install. +gem 'facter', *location_for(ENV['FACTER_GEM_VERSION']) if ENV['FACTER_GEM_VERSION'] +gem 'hiera', *location_for(ENV['HIERA_GEM_VERSION']) if ENV['HIERA_GEM_VERSION'] + + +# Evaluate Gemfile.local if it exists +if File.exists? "#{__FILE__}.local" + eval(File.read("#{__FILE__}.local"), binding) +end + +# Evaluate ~/.gemfile if it exists +if File.exists?(File.join(Dir.home, '.gemfile')) + eval(File.read(File.join(Dir.home, '.gemfile')), binding) +end + +# vim:ft=ruby diff --git a/environments/production/modules/stdlib/LICENSE b/environments/production/modules/stdlib/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/environments/production/modules/stdlib/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/environments/production/modules/stdlib/MAINTAINERS.md b/environments/production/modules/stdlib/MAINTAINERS.md new file mode 100644 index 0000000..e8004a5 --- /dev/null +++ b/environments/production/modules/stdlib/MAINTAINERS.md @@ -0,0 +1,6 @@ +## Maintenance + +Maintainers: + - Puppet Forge Modules Team `forge-modules |at| puppet |dot| com` + +Tickets: https://tickets.puppet.com/browse/MODULES. Make sure to set component to `stdlib`. diff --git a/environments/production/modules/stdlib/NOTICE b/environments/production/modules/stdlib/NOTICE new file mode 100644 index 0000000..3c8c03a --- /dev/null +++ b/environments/production/modules/stdlib/NOTICE @@ -0,0 +1,23 @@ +stdlib puppet module + +Copyright (C) 2011-2016 Puppet Labs, Inc. + +and some parts: + +Copyright (C) 2011 Krzysztof Wilczynski + + +Puppet Labs can be contacted at: info@puppetlabs.com + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/environments/production/modules/stdlib/README.markdown b/environments/production/modules/stdlib/README.markdown new file mode 100644 index 0000000..03daae9 --- /dev/null +++ b/environments/production/modules/stdlib/README.markdown @@ -0,0 +1,1791 @@ +# stdlib + +#### Table of Contents + +1. [Overview](#overview) +2. [Module Description - What the module does and why it is useful](#module-description) +3. [Setup - The basics of getting started with stdlib](#setup) +4. [Usage - Configuration options and additional functionality](#usage) +5. [Reference - An under-the-hood peek at what the module is doing and how](#reference) +5. [Limitations - OS compatibility, etc.](#limitations) +6. [Development - Guide for contributing to the module](#development) + +## Overview + +Adds a standard library of resources for Puppet modules. + +## Module Description + +This module provides a standard library of resources for the development of Puppet modules. Puppet modules make heavy use of this standard library. The stdlib module adds the following resources to Puppet: + + * Stages + * Facts + * Functions + * Defined resource types + * Data Types + * Providers + +> *Note:* As of version 3.7, Puppet Enterprise no longer includes the stdlib module. If you're running Puppet Enterprise, you should install the most recent release of stdlib for compatibility with Puppet modules. + +## Setup + +Installing the stdlib module adds the functions, facts, and resources of this standard library to Puppet. + +## Usage + +After you've installed stdlib, all of its functions, facts, and resources are available for module use or development. + +If you want to use a standardized set of run stages for Puppet, `include stdlib` in your manifest. + +* `stdlib`: Most of stdlib's features are automatically loaded by Puppet. To use standardized run stages in Puppet, declare this class in your manifest with `include stdlib`. + + When declared, stdlib declares all other classes in the module. The only other class currently included in the module is `stdlib::stages`. + +The `stdlib::stages` class declares various run stages for deploying infrastructure, language runtimes, and application layers. The high level stages are (in order): + + * setup + * main + * runtime + * setup_infra + * deploy_infra + * setup_app + * deploy_app + * deploy + + Sample usage: + + ~~~ + node default { + include stdlib + class { java: stage => 'runtime' } + } + ~~~ + +## Reference + +### Classes + +#### Public Classes + + The stdlib class has no parameters. + +#### Private Classes + +* `stdlib::stages`: Manages a standard set of run stages for Puppet. It is managed by the stdlib class and should not be declared independently. + +### Resource Types + +#### `file_line` + +Ensures that a given line is contained within a file. The implementation matches the full line, including whitespace at the beginning and end. If the line is not contained in the given file, Puppet appends the line to the end of the file to ensure the desired state. Multiple resources can be declared to manage multiple lines in the same file. + +Example: + + file_line { 'sudo_rule': + path => '/etc/sudoers', + line => '%sudo ALL=(ALL) ALL', + } + + file_line { 'sudo_rule_nopw': + path => '/etc/sudoers', + line => '%sudonopw ALL=(ALL) NOPASSWD: ALL', + } + +In this example, Puppet ensures that both of the specified lines are contained in the file `/etc/sudoers`. + +Match Example: + + file_line { 'bashrc_proxy': + ensure => present, + path => '/etc/bashrc', + line => 'export HTTP_PROXY=http://squid.puppetlabs.vm:3128', + match => '^export\ HTTP_PROXY\=', + } + +In this code example, `match` looks for a line beginning with export followed by HTTP_PROXY and replaces it with the value in line. + +Match Example With `ensure => absent`: + + file_line { 'bashrc_proxy': + ensure => absent, + path => '/etc/bashrc', + line => 'export HTTP_PROXY=http://squid.puppetlabs.vm:3128', + match => '^export\ HTTP_PROXY\=', + match_for_absence => true, + } + +In this code example, `match` looks for a line beginning with export +followed by HTTP_PROXY and delete it. If multiple lines match, an +error will be raised unless the `multiple => true` parameter is set. + +Encoding example: + + file_line { "XScreenSaver": + ensure => present, + path => '/root/XScreenSaver' + line => "*lock: 10:00:00", + match => '^*lock:', + encoding => "iso-8859-1", + } + +Files with special characters that are not valid UTF-8 will give the +error message "invalid byte sequence in UTF-8". In this case, determine +the correct file encoding and specify the correct encoding using the +encoding attribute, the value of which needs to be a valid Ruby character +encoding. + +**Autorequires:** If Puppet is managing the file that contains the line being managed, the `file_line` resource autorequires that file. + +##### Parameters + +All parameters are optional, unless otherwise noted. + +* `after`: Specifies the line after which Puppet adds any new lines using a regular expression. (Existing lines are added in place.) Valid options: String containing a regex. Default: Undefined. +* `ensure`: Ensures whether the resource is present. Valid options: 'present', 'absent'. Default: 'present'. +* `line`: **Required.** Sets the line to be added to the file located by the `path` parameter. Valid options: String. Default: Undefined. +* `match`: Specifies a regular expression to run against existing lines in the file; if a match is found, it is replaced rather than adding a new line. A regex comparison is performed against the line value, and if it does not match, an exception is raised. Valid options: String containing a regex. Default: Undefined. +* `match_for_absence`: An optional value to determine if match should be applied when `ensure => absent`. If set to true and match is set, the line that matches match will be deleted. If set to false (the default), match is ignored when `ensure => absent` and the value of `line` is used instead. Ignored when `ensure => present`. Default: false. +* `multiple`: Determines if `match` and/or `after` can change multiple lines. If set to false, an exception will be raised if more than one line matches. Valid options: 'true', 'false'. Default: Undefined. +* `name`: Sets the name to use as the identity of the resource. This is necessary if you want the resource namevar to differ from the supplied `title` of the resource. Valid options: String. Default: Undefined. +* `path`: **Required.** Defines the file in which Puppet will ensure the line specified by `line`. Must be an absolute path to the file. +* `replace`: Defines whether the resource will overwrite an existing line that matches the `match` parameter. If set to false and a line is found matching the `match` param, the line will not be placed in the file. Valid options: true, false, yes, no. Default: true + +### Data Types + +#### `Stdlib::Absolutepath` + +A strict absolute path type. Uses a Variant of Unixpath and Windowspath types. + +Acceptable input examples: /var/log + /usr2/username/bin:/usr/local/bin:/usr/bin:. + C:\\WINDOWS\\System32 +Unacceptable input example: ../relative_path + +#### `Stdlib::Httpsurl` + +Matches https URLs. + +Acceptable input example: https://hello.com +Unacceptable input example: httds://notquiteright.org + +#### `Stdlib::Httpurl` + +Matches both https and http URLs. + +Acceptable input example: https://hello.com + http://hello.com +Unacceptable input example: httds://notquiteright.org + +#### `Stdlib::Unixpath` + +Matches paths on Unix type Operating Systems. + +Acceptable input example: /usr2/username/bin:/usr/local/bin:/usr/bin:. + /var/tmp +Unacceptable input example: C:/whatever + +#### `Stdlib::Windowspath` + +Matches paths on Windows Operating systems. + +Acceptable input example: C:\\WINDOWS\\System32 + C:\\ + \\\\host\\windows +Unacceptable input example: /usr2/username/bin:/usr/local/bin:/usr/bin:. + +### Functions + +#### `abs` + +Returns the absolute value of a number; for example, '-34.56' becomes '34.56'. Takes a single integer and float value as an argument. *Type*: rvalue. + +#### `any2array` + +Converts any object to an array containing that object. Empty argument lists are converted to an empty array. Arrays are left untouched. Hashes are converted to arrays of alternating keys and values. *Type*: rvalue. + +#### `base64` + +Converts a string to and from base64 encoding. Requires an `action` ('encode', 'decode') and either a plain or base64-encoded `string`, and an optional `method` ('default', 'strict', 'urlsafe') + +For backward compatibility, `method` will be set as `default` if not specified. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +*Examples:* +~~~ +base64('encode', 'hello') +base64('encode', 'hello', 'default') +# return: "aGVsbG8=\n" + +base64('encode', 'hello', 'strict') +# return: "aGVsbG8=" + +base64('decode', 'aGVsbG8=') +base64('decode', 'aGVsbG8=\n') +base64('decode', 'aGVsbG8=', 'default') +base64('decode', 'aGVsbG8=\n', 'default') +base64('decode', 'aGVsbG8=', 'strict') +# return: "hello" + +base64('encode', 'https://puppetlabs.com', 'urlsafe') +# return: "aHR0cHM6Ly9wdXBwZXRsYWJzLmNvbQ==" + +base64('decode', 'aHR0cHM6Ly9wdXBwZXRsYWJzLmNvbQ==', 'urlsafe') +# return: "https://puppetlabs.com" +~~~ + +*Type*: rvalue. + +#### `basename` + +Returns the `basename` of a path (optionally stripping an extension). For example: + * ('/path/to/a/file.ext') returns 'file.ext' + * ('relative/path/file.ext') returns 'file.ext' + * ('/path/to/a/file.ext', '.ext') returns 'file' + +*Type*: rvalue. + +#### `bool2num` + +Converts a boolean to a number. Converts values: + * 'false', 'f', '0', 'n', and 'no' to 0. + * 'true', 't', '1', 'y', and 'yes' to 1. + Requires a single boolean or string as an input. *Type*: rvalue. + +#### `bool2str` + +Converts a boolean to a string using optionally supplied arguments. The optional second and third arguments represent what true and false are converted to respectively. If only one argument is given, it is converted from a boolean to a string containing 'true' or 'false'. + +*Examples:* +~~~ +bool2str(true) => 'true' +bool2str(true, 'yes', 'no') => 'yes' +bool2str(false, 't', 'f') => 'f' +~~~ + +Requires a single boolean as input. *Type*: rvalue. + +#### `camelcase` + +Converts the case of a string or all strings in an array to camel case. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `capitalize` + +Capitalizes the first character of a string or array of strings and lowercases the remaining characters of each string. Requires either a single string or an array as an input. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `ceiling` + +Returns the smallest integer greater than or equal to the argument. Takes a single numeric value as an argument. *Type*: rvalue. + +#### `chomp` + +Removes the record separator from the end of a string or an array of strings; for example, 'hello\n' becomes 'hello'. Requires a single string or array as an input. *Type*: rvalue. + +#### `chop` + +Returns a new string with the last character removed. If the string ends with '\r\n', both characters are removed. Applying `chop` to an empty string returns an empty string. If you want to merely remove record separators, then you should use the `chomp` function. Requires a string or an array of strings as input. *Type*: rvalue. + +#### `clamp` + +Keeps value within the range [Min, X, Max] by sort based on integer value (order of params doesn't matter). Takes strings, arrays or numerics. Strings are converted and compared numerically. Arrays of values are flattened into a list for further handling. For example: + * `clamp('24', [575, 187])` returns 187. + * `clamp(16, 88, 661)` returns 88. + * `clamp([4, 3, '99'])` returns 4. + *Type*: rvalue. + +#### `concat` + +Appends the contents of multiple arrays onto the first array given. For example: + * `concat(['1','2','3'],'4')` returns ['1','2','3','4']. + * `concat(['1','2','3'],'4',['5','6','7'])` returns ['1','2','3','4','5','6','7']. + *Type*: rvalue. + +#### `convert_base` + +Converts a given integer or base 10 string representing an integer to a specified base, as a string. For example: + * `convert_base(5, 2)` results in: '101' + * `convert_base('254', '16')` results in: 'fe' + +#### `count` + +If called with only an array, it counts the number of elements that are **not** nil/undef. If called with a second argument, counts the number of elements in an array that matches the second argument. *Type*: rvalue. + +#### `deep_merge` + +Recursively merges two or more hashes together and returns the resulting hash. + $hash1 = {'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } } + $hash2 = {'two' => 'dos', 'three' => { 'five' => 5 } } + $merged_hash = deep_merge($hash1, $hash2) + +The resulting hash is equivalent to: + $merged_hash = { 'one' => 1, 'two' => 'dos', 'three' => { 'four' => 4, 'five' => 5 } } + +When there is a duplicate key that is a hash, they are recursively merged. When there is a duplicate key that is not a hash, the key in the rightmost hash will "win.". +*Type*: rvalue, rvalue. + +#### `defined_with_params` + +Takes a resource reference and an optional hash of attributes. Returns 'true' if a resource with the specified attributes has already been added to the catalog. Returns 'false' otherwise. + + ~~~ + user { 'dan': + ensure => present, + } + + if ! defined_with_params(User[dan], {'ensure' => 'present' }) { + user { 'dan': ensure => present, } + } + ~~~ + +*Type*: rvalue. + +#### `delete` + +Deletes all instances of a given element from an array, substring from a string, or key from a hash. + +For example, `delete(['a','b','c','b'], 'b')` returns ['a','c']; `delete('abracadabra', 'bra')` returns 'acada'. `delete({'a' => 1,'b' => 2,'c' => 3},['b','c'])` returns {'a'=> 1}, `delete(['ab', 'b'], 'b')` returns ['ab']. + +*Type*: rvalue. + +#### `delete_at` + +Deletes a determined indexed value from an array. For example, `delete_at(['a','b','c'], 1)` returns ['a','c']. *Type*: rvalue. + +#### `delete_regex` + +Deletes all instances of a given element from an array or hash that match a provided regular expression. A string will be treated as a one-item array. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +For example, `delete_regex(['a','b','c','b'], 'b')` returns ['a','c']; `delete_regex({'a' => 1,'b' => 2,'c' => 3},['b','c'])` returns {'a'=> 1}, `delete_regex(['abf', 'ab', 'ac'], '^ab.*')` returns ['ac']. `delete_regex(['ab', 'b'], 'b')` returns ['ab']. + +*Type*: rvalue. + +#### `delete_values` + +Deletes all instances of a given value from a hash. For example, `delete_values({'a'=>'A','b'=>'B','c'=>'C','B'=>'D'}, 'B')` returns {'a'=>'A','c'=>'C','B'=>'D'} *Type*: rvalue. + +#### `delete_undef_values` + +Deletes all instances of the undef value from an array or hash. For example, `$hash = delete_undef_values({a=>'A', b=>'', c=>undef, d => false})` returns {a => 'A', b => '', d => false}. *Type*: rvalue. + +#### `deprecation` + +Prints deprecation warnings and logs a warning once for a given key: + +``` +deprecation(key, message) +``` + +* key: to keep the number of messages low, during the lifetime of a puppet process, only one message per key is logged. +* message: the text to be logged. + +The Puppet settings '[disable_warnings](https://docs.puppet.com/puppet/latest/reference/configuration.html#disablewarnings)', '[max_deprecations](https://docs.puppet.com/puppet/latest/reference/configuration.html#maxdeprecations)', and '[strict](https://docs.puppet.com/puppet/latest/reference/configuration.html#strict)' affect this function. Set 'strict' to `error` to fail immediately with the deprecation message, `off` to output emit no messages at all, or `warning` (default) to log all warnings. + +Additionally you can set the environment variable `STDLIB_LOG_DEPRECATIONS` to decide whether or not to log deprecation warnings: if this environment variable is set to `true`, the functions log a warning, if it is set to `false`, no warnings are logged. If no value is set at all, Puppet 4 will emit warnings, while Puppet 3 will not. Using this setting is especially useful for automated tests to avoid flooding your logs before you are ready to migrate. + +*Type*: String, String. + +#### `difference` + +Returns the difference between two arrays. The returned array is a copy of the original array, removing any items that also appear in the second array. For example, `difference(["a","b","c"],["b","c","d"])` returns ["a"]. *Type*: rvalue. + +#### `dig` + +DEPRECATED: This function has been replaced in Puppet 4.5.0, use dig44() for backwards compatibility or use the new version. + +*Type*: rvalue. + +Retrieves a value within multiple layers of hashes and arrays via an array of keys containing a path. The function goes through the structure by each path component and tries to return the value at the end of the path. + +In addition to the required path argument, the function accepts the default argument. It is returned if the path is not correct, if no value was found, or if any other error has occurred. + +~~~ruby +$data = { + 'a' => { + 'b' => [ + 'b1', + 'b2', + 'b3', + ] + } +} + +$value = dig($data, ['a', 'b', 2]) +# $value = 'b3' + +# with all possible options +$value = dig($data, ['a', 'b', 2], 'not_found') +# $value = 'b3' + +# using the default value +$value = dig($data, ['a', 'b', 'c', 'd'], 'not_found') +# $value = 'not_found' +~~~ + +1. **$data** The data structure we are working with. +2. **['a', 'b', 2]** The path array. +3. **'not_found'** The default value. It will be returned if nothing is found. + (optional, defaults to *undef*) + +#### `dig44` + +*Type*: rvalue. + +Retrieves a value within multiple layers of hashes and arrays via an array of keys containing a path. The function goes through the structure by each path component and tries to return the value at the end of the path. + +In addition to the required path argument, the function accepts the default argument. It is returned if the path is not correct, if no value was found, or if any other error has occurred. + +~~~ruby +$data = { + 'a' => { + 'b' => [ + 'b1', + 'b2', + 'b3', + ] + } +} + +$value = dig44($data, ['a', 'b', 2]) +# $value = 'b3' + +# with all possible options +$value = dig44($data, ['a', 'b', 2], 'not_found') +# $value = 'b3' + +# using the default value +$value = dig44($data, ['a', 'b', 'c', 'd'], 'not_found') +# $value = 'not_found' +~~~ + +1. **$data** The data structure we are working with. +2. **['a', 'b', 2]** The path array. +3. **'not_found'** The default value. It will be returned if nothing is found. + (optional, defaults to *undef*) + +#### `dirname` + +Returns the `dirname` of a path. For example, `dirname('/path/to/a/file.ext')` returns '/path/to/a'. *Type*: rvalue. + +#### `dos2unix` + +Returns the Unix version of the given string. Very useful when using a File resource with a cross-platform template. *Type*: rvalue. + +~~~ +file{$config_file: + ensure => file, + content => dos2unix(template('my_module/settings.conf.erb')), +} +~~~ + +See also [unix2dos](#unix2dos). + +#### `downcase` + +Converts the case of a string or of all strings in an array to lowercase. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `empty` + +Returns true if the argument is an array or hash that contains no elements, or an empty string. Returns false when the argument is a numerical value. *Type*: rvalue. + +#### `enclose_ipv6` + +Takes an array of ip addresses and encloses the ipv6 addresses with square brackets. *Type*: rvalue. + +#### `ensure_packages` + +Takes a list of packages array/hash and only installs them if they don't already exist. It optionally takes a hash as a second parameter to be passed as the third argument to the `ensure_resource()` or `ensure_resources()` function. *Type*: statement. + +For Array: + + ensure_packages(['ksh','openssl'], {'ensure' => 'present'}) + +For Hash: + + ensure_packages({'ksh' => { ensure => '20120801-1' } , 'mypackage' => { source => '/tmp/myrpm-1.0.0.x86_64.rpm', provider => "rpm" }}, {'ensure' => 'present'}) + +#### `ensure_resource` + +Takes a resource type, title, and a hash of attributes that describe the resource(s). + +~~~ +user { 'dan': + ensure => present, +} +~~~ + +This example only creates the resource if it does not already exist: + + `ensure_resource('user', 'dan', {'ensure' => 'present' })` + +If the resource already exists, but does not match the specified parameters, this function attempts to recreate the resource, leading to a duplicate resource definition error. + +An array of resources can also be passed in, and each will be created with the type and parameters specified if it doesn't already exist. + + `ensure_resource('user', ['dan','alex'], {'ensure' => 'present'})` + +*Type*: statement. + +#### `ensure_resources` + +Takes a resource type, title (only hash), and a hash of attributes that describe the resource(s). + +~~~ +user { 'dan': + gid => 'mygroup', + ensure => present, +} + +ensure_resources($user) +~~~ + +An hash of resources should be passed in and each will be created with the type and parameters specified if it doesn't already exist: + + ensure_resources('user', {'dan' => { gid => 'mygroup', uid => '600' } , 'alex' => { gid => 'mygroup' }}, {'ensure' => 'present'}) + +From Hiera Backend: + +~~~ +userlist: + dan: + gid: 'mygroup' + uid: '600' + alex: + gid: 'mygroup' + +ensure_resources('user', hiera_hash('userlist'), {'ensure' => 'present'}) +~~~ + +### `flatten` + +Flattens deeply nested arrays and returns a single flat array as a result. For example, `flatten(['a', ['b', ['c']]])` returns ['a','b','c']. *Type*: rvalue. + +#### `floor` + +Takes a single numeric value as an argument, and returns the largest integer less than or equal to the argument. *Type*: rvalue. + +#### `fqdn_rand_string` + +Generates a random alphanumeric string using an optionally-specified character set (default is alphanumeric), combining the `$fqdn` fact and an optional seed for repeatable randomness. + +*Usage:* +~~~ +fqdn_rand_string(LENGTH, [CHARSET], [SEED]) +~~~ +*Examples:* +~~~ +fqdn_rand_string(10) +fqdn_rand_string(10, 'ABCDEF!@#$%^') +fqdn_rand_string(10, '', 'custom seed') +~~~ + +*Type*: rvalue. + +#### `fqdn_rotate` + +Rotates an array or string a random number of times, combining the `$fqdn` fact and an optional seed for repeatable randomness. + +*Usage:* + +~~~ +fqdn_rotate(VALUE, [SEED]) +~~~ + +*Examples:* + +~~~ +fqdn_rotate(['a', 'b', 'c', 'd']) +fqdn_rotate('abcd') +fqdn_rotate([1, 2, 3], 'custom seed') +~~~ + +*Type*: rvalue. + +#### `fqdn_uuid` + +Returns a rfc4122 valid version 5 UUID based on an FQDN string under the DNS namespace + + * fqdn_uuid('puppetlabs.com') returns '9c70320f-6815-5fc5-ab0f-debe68bf764c' + * fqdn_uuid('google.com') returns '64ee70a4-8cc1-5d25-abf2-dea6c79a09c8' + +*Type*: rvalue. + +#### `get_module_path` + +Returns the absolute path of the specified module for the current environment. + + `$module_path = get_module_path('stdlib')` + +*Type*: rvalue. + +#### `getparam` + +Takes a resource reference and the name of the parameter, and returns the value of the resource's parameter. + +For example, the following returns 'param_value': + + ~~~ + define example_resource($param) { + } + + example_resource { "example_resource_instance": + param => "param_value" + } + + getparam(Example_resource["example_resource_instance"], "param") + ~~~ + +*Type*: rvalue. + +#### `getvar` + +Looks up a variable in a remote namespace. + +For example: + + ~~~ + $foo = getvar('site::data::foo') + # Equivalent to $foo = $site::data::foo + ~~~ + +This is useful if the namespace itself is stored in a string: + + ~~~ + $datalocation = 'site::data' + $bar = getvar("${datalocation}::bar") + # Equivalent to $bar = $site::data::bar + ~~~ + +*Type*: rvalue. + +#### `grep` + +Searches through an array and returns any elements that match the provided regular expression. For example, `grep(['aaa','bbb','ccc','aaaddd'], 'aaa')` returns ['aaa','aaaddd']. *Type*: rvalue. + +#### `has_interface_with` + +Returns a boolean based on kind and value: + * macaddress + * netmask + * ipaddress + * network + +*Examples:* + + ~~~ + has_interface_with("macaddress", "x:x:x:x:x:x") + has_interface_with("ipaddress", "127.0.0.1") => true + ~~~ + +If no kind is given, then the presence of the interface is checked: + + ~~~ + has_interface_with("lo") => true + ~~~ + +*Type*: rvalue. + +#### `has_ip_address` + +Returns 'true' if the client has the requested IP address on some interface. This function iterates through the `interfaces` fact and checks the `ipaddress_IFACE` facts, performing a simple string comparison. *Type*: rvalue. + +#### `has_ip_network` + +Returns 'true' if the client has an IP address within the requested network. This function iterates through the `interfaces` fact and checks the `network_IFACE` facts, performing a simple string comparision. *Type*: rvalue. + +#### `has_key` + +Determines if a hash has a certain key value. + +*Example*: + + ~~~ + $my_hash = {'key_one' => 'value_one'} + if has_key($my_hash, 'key_two') { + notice('we will not reach here') + } + if has_key($my_hash, 'key_one') { + notice('this will be printed') + } + ~~~ + +*Type*: rvalue. + +#### `hash` + +Converts an array into a hash. For example, `hash(['a',1,'b',2,'c',3])` returns {'a'=>1,'b'=>2,'c'=>3}. *Type*: rvalue. + +#### `intersection` + +Returns an array an intersection of two. For example, `intersection(["a","b","c"],["b","c","d"])` returns ["b","c"]. *Type*: rvalue. + +#### `is_a` + +Boolean check to determine whether a variable is of a given data type. This is equivalent to the `=~` type checks. This function is available only in Puppet 4 or in Puppet 3 with the "future" parser. + + ~~~ + foo = 3 + $bar = [1,2,3] + $baz = 'A string!' + + if $foo.is_a(Integer) { + notify { 'foo!': } + } + if $bar.is_a(Array) { + notify { 'bar!': } + } + if $baz.is_a(String) { + notify { 'baz!': } + } + ~~~ + +See the [the Puppet type system](https://docs.puppetlabs.com/references/latest/type.html#about-resource-types) for more information about types. +See the [`assert_type()`](https://docs.puppetlabs.com/references/latest/function.html#asserttype) function for flexible ways to assert the type of a value. + +#### `is_absolute_path` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the given path is absolute. *Type*: rvalue. + +#### `is_array` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable passed to this function is an array. *Type*: rvalue. + +#### `is_bool` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable passed to this function is a boolean. *Type*: rvalue. + +#### `is_domain_name` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the string passed to this function is a syntactically correct domain name. *Type*: rvalue. + +#### `is_float` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable passed to this function is a float. *Type*: rvalue. + +#### `is_function_available` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Accepts a string as an argument and determines whether the Puppet runtime has access to a function by that name. It returns 'true' if the function exists, 'false' if not. *Type*: rvalue. + +#### `is_hash` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable passed to this function is a hash. *Type*: rvalue. + +#### `is_integer` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable returned to this string is an integer. *Type*: rvalue. + +#### `is_ip_address` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the string passed to this function is a valid IP address. *Type*: rvalue. + +#### `is_ipv6_address` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the string passed to this function is a valid IPv6 address. *Type*: rvalue. + +#### `is_ipv4_address` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the string passed to this function is a valid IPv4 address. *Type*: rvalue. + +#### `is_mac_address` + +Returns 'true' if the string passed to this function is a valid MAC address. *Type*: rvalue. + +#### `is_numeric` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable passed to this function is a number. *Type*: rvalue. + +#### `is_string` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Returns 'true' if the variable passed to this function is a string. *Type*: rvalue. + +#### `join` + +Joins an array into a string using a separator. For example, `join(['a','b','c'], ",")` results in: "a,b,c". *Type*: rvalue. + +#### `join_keys_to_values` + +Joins each key of a hash to that key's corresponding value with a separator. Keys are cast to strings. +If values are arrays, multiple keys are added for each element. +The return value is an array in which each element is one joined key/value pair. For example, `join_keys_to_values({'a'=>1,'b'=>[2,3]}, " is ")` results in ["a is 1","b is 2","b is 3"]. *Type*: rvalue. + +#### `keys` + +Returns the keys of a hash as an array. *Type*: rvalue. + +#### `length` + +Returns the length of a given string, array or hash. To eventually replace the deprecated size() function as can handle the new type functionality introduced in Puppet 4. *Type*: rvalue. + +#### `loadyaml` + +Loads a YAML file containing an array, string, or hash, and returns the data in the corresponding native data type. + +For example: + + ~~~ + $myhash = loadyaml('/etc/puppet/data/myhash.yaml') + ~~~ + +The second parameter will be returned if the file was not found or could not be parsed. + +For example: + + ~~~ + $myhash = loadyaml('no-file.yaml', {'default'=>'value'}) + ~~~ + +*Type*: rvalue. + +#### `loadjson` + +Loads a JSON file containing an array, string, or hash, and returns the data in the corresponding native data type. + +For example: + + ~~~ + $myhash = loadjson('/etc/puppet/data/myhash.json') + ~~~ + +The second parameter will be returned if the file was not found or could not be parsed. + +For example: + + ~~~ + $myhash = loadjson('no-file.json', {'default'=>'value'}) + ~~~ + +*Type*: rvalue. + +#### `load_module_metadata` + +Loads the metadata.json of a target module. Can be used to determine module version and authorship for dynamic support of modules. + + ~~~ + $metadata = load_module_metadata('archive') + notify { $metadata['author']: } + ~~~ + +If you do not want to fail the catalog compilation when a module's metadata file is absent: + + ~~~ + $metadata = load_module_metadata('mysql', true) + if empty($metadata) { + notify { "This module does not have a metadata.json file.": } + } + ~~~ + +*Type*: rvalue. + +#### `lstrip` + +Strips spaces to the left of a string. *Type*: rvalue. + +#### `max` + +Returns the highest value of all arguments. Requires at least one argument. *Type*: rvalue. + +#### `member` + +This function determines if a variable is a member of an array. The variable can be either a string, array, or fixnum. For example, `member(['a','b'], 'b')` and `member(['a','b','c'], ['b','c'])` return 'true', while `member(['a','b'], 'c')` and `member(['a','b','c'], ['c','d'])` return 'false'. *Note*: This function does not support nested arrays. If the first argument contains nested arrays, it will not recurse through them. + +*Type*: rvalue. + +#### `merge` + +Merges two or more hashes together and returns the resulting hash. + +*Example*: + + ~~~ + $hash1 = {'one' => 1, 'two' => 2} + $hash2 = {'two' => 'dos', 'three' => 'tres'} + $merged_hash = merge($hash1, $hash2) + # The resulting hash is equivalent to: + # $merged_hash = {'one' => 1, 'two' => 'dos', 'three' => 'tres'} + ~~~ + +When there is a duplicate key, the key in the rightmost hash "wins." *Type*: rvalue. + +#### `min` + +Returns the lowest value of all arguments. Requires at least one argument. *Type*: rvalue. + +#### `num2bool` + +Converts a number or a string representation of a number into a true boolean. Zero or anything non-numeric becomes 'false'. Numbers greater than 0 become 'true'. *Type*: rvalue. + +#### `parsejson` + +Converts a string of JSON into the correct Puppet structure. *Type*: rvalue. The optional second argument is returned if the data was not correct. + +#### `parseyaml` + +Converts a string of YAML into the correct Puppet structure. *Type*: rvalue. The optional second argument is returned if the data was not correct. + +#### `pick` + +From a list of values, returns the first value that is not undefined or an empty string. Takes any number of arguments, and raises an error if all values are undefined or empty. + + ~~~ + $real_jenkins_version = pick($::jenkins_version, '1.449') + ~~~ + +*Type*: rvalue. + +#### `pick_default` + +Returns the first value in a list of values. Contrary to the `pick()` function, the `pick_default()` does not fail if all arguments are empty. This allows it to use an empty value as default. *Type*: rvalue. + +#### `prefix` + +Applies a prefix to all elements in an array, or to the keys in a hash. +For example: +* `prefix(['a','b','c'], 'p')` returns ['pa','pb','pc'] +* `prefix({'a'=>'b','b'=>'c','c'=>'d'}, 'p')` returns {'pa'=>'b','pb'=>'c','pc'=>'d'}. + +*Type*: rvalue. + +#### `pry` + +This function invokes a pry debugging session in the current scope object. This is useful for debugging manifest code at specific points during a compilation. Should only be used when running `puppet apply` or running a puppet master in the foreground. This requires the `pry` gem to be installed in puppet's rubygems. + +*Examples:* +```puppet +pry() +``` +Once in a pry session, some interesting commands: + +* Run `catalog` to see the contents currently compiling catalog +* Run `cd catalog` and `ls` to see catalog methods and instance variables +* Run `@resource_table` to see the current catalog resource table + +#### `assert_private` + +Sets the current class or definition as private. Calling the class or definition from outside the current module will fail. + +For example, `assert_private()` called in class `foo::bar` outputs the following message if class is called from outside module `foo`: + + ~~~ + Class foo::bar is private + ~~~ + + To specify the error message you want to use: + + ~~~ + assert_private("You're not supposed to do that!") + ~~~ + +*Type*: statement. + +#### `pw_hash` + +Hashes a password using the crypt function. Provides a hash usable on most POSIX systems. + +The first argument to this function is the password to hash. If it is undef or an empty string, this function returns undef. + +The second argument to this function is which type of hash to use. It will be converted into the appropriate crypt(3) hash specifier. Valid hash types are: + +|Hash type |Specifier| +|---------------------|---------| +|MD5 |1 | +|SHA-256 |5 | +|SHA-512 (recommended)|6 | + +The third argument to this function is the salt to use. + +*Type*: rvalue. + +**Please note:** This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +**Note:** this uses the Puppet master's implementation of crypt(3). If your environment contains several different operating systems, ensure that they are compatible before using this function. + +#### `range` + +Extrapolates a range as an array when given in the form of '(start, stop)'. For example, `range("0", "9")` returns [0,1,2,3,4,5,6,7,8,9]. Zero-padded strings are converted to integers automatically, so `range("00", "09")` returns [0,1,2,3,4,5,6,7,8,9]. + +Non-integer strings are accepted; `range("a", "c")` returns ["a","b","c"], and `range("host01", "host10")` returns ["host01", "host02", ..., "host09", "host10"]. +NB Be explicit in including trailing zeros. Otherwise the underlying ruby function will fail. + +Passing a third argument will cause the generated range to step by that interval, e.g. `range("0", "9", "2")` returns ["0","2","4","6","8"]. + +*Type*: rvalue. + +#### `regexpescape` + +Regexp escape a string or array of strings. Requires either a single string or an array as an input. *Type*: rvalue. + +#### `reject` + +Searches through an array and rejects all elements that match the provided regular expression. For example, `reject(['aaa','bbb','ccc','aaaddd'], 'aaa')` returns ['bbb','ccc']. *Type*: rvalue. + +#### `reverse` + +Reverses the order of a string or array. *Type*: rvalue. + +#### `rstrip` + +Strips spaces to the right of the string. *Type*: rvalue. + +#### `seeded_rand` + +Takes an integer max value and a string seed value and returns a repeatable random integer smaller than max. Like `fqdn_rand`, but does not add node specific data to the seed. *Type*: rvalue. + +#### `shell_escape` + +Escapes a string so that it can be safely used in a Bourne shell command line. Note that the resulting string should be used unquoted and is not intended for use in double quotes nor in single quotes. This function behaves the same as ruby's `Shellwords.shellescape()` function, also see the [ruby documentation](http://ruby-doc.org/stdlib-2.3.0/libdoc/shellwords/rdoc/Shellwords.html#method-c-shellescape). + +*Example:* +~~~ +shell_escape('foo b"ar') => 'foo\ b\"ar' +~~~ + +*Type*: rvalue. + +#### `shell_join` + +Builds a command line string from the given array of strings. Each array item is escaped for Bourne shell. All items are +then joined together, with a single space in between. This function behaves the same as ruby's `Shellwords.shelljoin()` function, also see the [ruby documentation](http://ruby-doc.org/stdlib-2.3.0/libdoc/shellwords/rdoc/Shellwords.html#method-c-shelljoin). + +*Example:* +~~~ +shell_join(['foo bar', 'ba"z']) => 'foo\ bar ba\"z' +~~~ + +*Type*: rvalue. + +#### `shell_split` + +Splits a string into an array of tokens in the same way the Bourne shell does. This function behaves the same as ruby's `Shellwords.shellsplit()` function, also see the [ruby documentation](http://ruby-doc.org/stdlib-2.3.0/libdoc/shellwords/rdoc/Shellwords.html#method-c-shellsplit). + +*Example:* +~~~ +shell_split('foo\ bar ba\"z') => ['foo bar', 'ba"z'] +~~~ + +*Type*: rvalue. + +#### `shuffle` + +Randomizes the order of a string or array elements. *Type*: rvalue. + +#### `size` + +Returns the number of elements in a string, an array or a hash. May get confused around Puppet 4 type values and as such is to be deprecated in the next release and replaced with the new stdlib length function. *Type*: rvalue. + +#### `sort` + +Sorts strings and arrays lexically. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `squeeze` + +Returns a new string where runs of the same character that occur in this set are replaced by a single character. *Type*: rvalue. + +#### `str2bool` + +Converts certain strings to a boolean. This attempts to convert strings that contain the values '1', 'true', 't', 'y', or 'yes' to true. Strings that contain values '0', 'false', 'f', 'n', or 'no', or that are an empty string or undefined are converted to false. Any other value causes an error. These checks are case insensitive. *Type*: rvalue. + +#### `str2saltedsha512` + +Converts a string to a salted-SHA512 password hash, used for OS X versions >= 10.7. Given any string, this function returns a hex version of a salted-SHA512 password hash, which can be inserted into your Puppet +manifests as a valid password attribute. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `strftime` + +Returns formatted time. For example, `strftime("%s")` returns the time since Unix epoch, and `strftime("%Y-%m-%d")` returns the date. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + + *Format:* + + * `%a`: The abbreviated weekday name ('Sun') + * `%A`: The full weekday name ('Sunday') + * `%b`: The abbreviated month name ('Jan') + * `%B`: The full month name ('January') + * `%c`: The preferred local date and time representation + * `%C`: Century (20 in 2009) + * `%d`: Day of the month (01..31) + * `%D`: Date (%m/%d/%y) + * `%e`: Day of the month, blank-padded ( 1..31) + * `%F`: Equivalent to %Y-%m-%d (the ISO 8601 date format) + * `%h`: Equivalent to %b + * `%H`: Hour of the day, 24-hour clock (00..23) + * `%I`: Hour of the day, 12-hour clock (01..12) + * `%j`: Day of the year (001..366) + * `%k`: Hour, 24-hour clock, blank-padded ( 0..23) + * `%l`: Hour, 12-hour clock, blank-padded ( 0..12) + * `%L`: Millisecond of the second (000..999) + * `%m`: Month of the year (01..12) + * `%M`: Minute of the hour (00..59) + * `%n`: Newline (\n) + * `%N`: Fractional seconds digits, default is 9 digits (nanosecond) + * `%3N`: Millisecond (3 digits) + * `%6N`: Microsecond (6 digits) + * `%9N`: Nanosecond (9 digits) + * `%p`: Meridian indicator ('AM' or 'PM') + * `%P`: Meridian indicator ('am' or 'pm') + * `%r`: Time, 12-hour (same as %I:%M:%S %p) + * `%R`: Time, 24-hour (%H:%M) + * `%s`: Number of seconds since the Unix epoch, 1970-01-01 00:00:00 UTC. + * `%S`: Second of the minute (00..60) + * `%t`: Tab character ( ) + * `%T`: Time, 24-hour (%H:%M:%S) + * `%u`: Day of the week as a decimal, Monday being 1. (1..7) + * `%U`: Week number of the current year, starting with the first Sunday as the first day of the first week (00..53) + * `%v`: VMS date (%e-%b-%Y) + * `%V`: Week number of year according to ISO 8601 (01..53) + * `%W`: Week number of the current year, starting with the first Monday as the first day of the first week (00..53) + * `%w`: Day of the week (Sunday is 0, 0..6) + * `%x`: Preferred representation for the date alone, no time + * `%X`: Preferred representation for the time alone, no date + * `%y`: Year without a century (00..99) + * `%Y`: Year with century + * `%z`: Time zone as hour offset from UTC (e.g. +0900) + * `%Z`: Time zone name + * `%%`: Literal '%' character + +#### `strip` + +Removes leading and trailing whitespace from a string or from every string inside an array. For example, `strip(" aaa ")` results in "aaa". *Type*: rvalue. + +#### `suffix` + +Applies a suffix to all elements in an array, or to the keys in a hash. +For example: +* `suffix(['a','b','c'], 'p')` returns ['ap','bp','cp'] +* `suffix({'a'=>'b','b'=>'c','c'=>'d'}, 'p')` returns {'ap'=>'b','bp'=>'c','cp'=>'d'}. + +*Type*: rvalue. + +#### `swapcase` + +Swaps the existing case of a string. For example, `swapcase("aBcD")` results in "AbCd". *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `time` + +Returns the current Unix epoch time as an integer. For example, `time()` returns something like '1311972653'. *Type*: rvalue. + +#### `to_bytes` + +Converts the argument into bytes, for example "4 kB" becomes "4096". Takes a single string value as an argument. *Type*: rvalue. + +#### `try_get_value` + +*Type*: rvalue. + +DEPRECATED: replaced by `dig()`. + +Retrieves a value within multiple layers of hashes and arrays via a string containing a path. The path is a string of hash keys or array indexes starting with zero, separated by the path separator character (default "/"). The function goes through the structure by each path component and tries to return the value at the end of the path. + +In addition to the required path argument, the function accepts the default argument. It is returned if the path is not correct, if no value was found, or if any other error has occurred. The last argument can set the path separator character. + +~~~ruby +$data = { + 'a' => { + 'b' => [ + 'b1', + 'b2', + 'b3', + ] + } +} + +$value = try_get_value($data, 'a/b/2') +# $value = 'b3' + +# with all possible options +$value = try_get_value($data, 'a/b/2', 'not_found', '/') +# $value = 'b3' + +# using the default value +$value = try_get_value($data, 'a/b/c/d', 'not_found') +# $value = 'not_found' + +# using custom separator +$value = try_get_value($data, 'a|b', [], '|') +# $value = ['b1','b2','b3'] +~~~ + +1. **$data** The data structure we are working with. +2. **'a/b/2'** The path string. +3. **'not_found'** The default value. It will be returned if nothing is found. + (optional, defaults to *undef*) +4. **'/'** The path separator character. + (optional, defaults to *'/'*) + +#### `type3x` + +Returns a string description of the type when passed a value. Type can be a string, array, hash, float, integer, or boolean. This function will be removed when Puppet 3 support is dropped and the new type system can be used. *Type*: rvalue. + +#### `type_of` + +This function is provided for backwards compatibility but is generally not preferred over the built-in [type() function](https://docs.puppet.com/puppet/latest/reference/function.html#type) provided by Puppet. + +Returns the literal type when passed a value. Requires the new parser. Useful for comparison of types with `<=` such as in `if type_of($some_value) <= Array[String] { ... }` (which is equivalent to `if $some_value =~ Array[String] { ... }`) *Type*: rvalue. + +#### `union` + +Returns a union of two or more arrays, without duplicates. For example, `union(["a","b","c"],["b","c","d"])` returns ["a","b","c","d"]. *Type*: rvalue. + +#### `unique` + +Removes duplicates from strings and arrays. For example, `unique("aabbcc")` returns 'abc', and `unique(["a","a","b","b","c","c"])` returns ["a","b","c"]. *Type*: rvalue. + +#### `unix2dos` + +Returns the DOS version of the given string. Very useful when using a File resource with a cross-platform template. *Type*: rvalue. + +~~~ +file{$config_file: + ensure => file, + content => unix2dos(template('my_module/settings.conf.erb')), +} +~~~ + +See also [dos2unix](#dos2unix). + +#### `upcase` + +Converts an object, array or hash of objects that respond to upcase to uppercase. For example, `upcase('abcd')` returns 'ABCD'. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `uriescape` + +URLEncodes a string or array of strings. Requires either a single string or an array as an input. *Type*: rvalue. + +*Please note:* This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +#### `validate_absolute_path` + +Validates that a given string represents an absolute path in the filesystem. Works for Windows and Unix style paths. + +The following values pass: + +~~~ +$my_path = 'C:/Program Files (x86)/Puppet Labs/Puppet' +validate_absolute_path($my_path) +$my_path2 = '/var/lib/puppet' +validate_absolute_path($my_path2) +$my_path3 = ['C:/Program Files (x86)/Puppet Labs/Puppet','C:/Program Files/Puppet Labs/Puppet'] +validate_absolute_path($my_path3) +$my_path4 = ['/var/lib/puppet','/usr/share/puppet'] +validate_absolute_path($my_path4) +~~~ + +The following values fail, causing compilation to abort: + +~~~ +validate_absolute_path(true) +validate_absolute_path('../var/lib/puppet') +validate_absolute_path('var/lib/puppet') +validate_absolute_path([ 'var/lib/puppet', '/var/foo' ]) +validate_absolute_path([ '/var/lib/puppet', 'var/foo' ]) +$undefined = undef +validate_absolute_path($undefined) +~~~ + +*Type*: statement. + +#### `validate_array` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that all passed values are array data structures. Aborts catalog compilation if any value fails this check. + +The following values pass: + +~~~ +$my_array = [ 'one', 'two' ] +validate_array($my_array) +~~~ + +The following values fail, causing compilation to abort: + +~~~ +validate_array(true) +validate_array('some_string') +$undefined = undef +validate_array($undefined) +~~~ + +*Type*: statement. + +#### `validate_augeas` + +Performs validation of a string using an Augeas lens. The first argument of this function should be the string to test, and the second argument should be the name of the Augeas lens to use. If Augeas fails to parse the string with the lens, the compilation aborts with a parse error. + +A third optional argument lists paths which should **not** be found in the file. The `$file` variable points to the location of the temporary file being tested in the Augeas tree. + +For example, to make sure your $passwdcontent never contains user `foo`: + +~~~ +validate_augeas($passwdcontent, 'Passwd.lns', ['$file/foo']) +~~~ + +To ensure that no users use the '/bin/barsh' shell: + +~~~ +validate_augeas($passwdcontent, 'Passwd.lns', ['$file/*[shell="/bin/barsh"]'] +~~~ + +You can pass a fourth argument as the error message raised and shown to the user: + +~~~ +validate_augeas($sudoerscontent, 'Sudoers.lns', [], 'Failed to validate sudoers content with Augeas') +~~~ + +*Type*: statement. + +#### `validate_bool` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that all passed values are either true or false. Aborts catalog compilation if any value fails this check. + +The following values will pass: + +~~~ +$iamtrue = true +validate_bool(true) +validate_bool(true, true, false, $iamtrue) +~~~ + +The following values will fail, causing compilation to abort: + +~~~ +$some_array = [ true ] +validate_bool("false") +validate_bool("true") +validate_bool($some_array) +~~~ + +*Type*: statement. + +#### `validate_cmd` + +Performs validation of a string with an external command. The first argument of this function should be a string to test, and the second argument should be a path to a test command taking a % as a placeholder for the file path (will default to the end of the command if no % placeholder given). If the command is launched against a tempfile containing the passed string, or returns a non-null value, compilation will abort with a parse error. + +If a third argument is specified, this will be the error message raised and seen by the user. + +~~~ +# Defaults to end of path +validate_cmd($sudoerscontent, '/usr/sbin/visudo -c -f', 'Visudo failed to validate sudoers content') +~~~ +~~~ +# % as file location +validate_cmd($haproxycontent, '/usr/sbin/haproxy -f % -c', 'Haproxy failed to validate config content') +~~~ + +*Type*: statement. + +#### `validate_hash` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that all passed values are hash data structures. Aborts catalog compilation if any value fails this check. + + The following values will pass: + + ~~~ + $my_hash = { 'one' => 'two' } + validate_hash($my_hash) + ~~~ + + The following values will fail, causing compilation to abort: + + ~~~ + validate_hash(true) + validate_hash('some_string') + $undefined = undef + validate_hash($undefined) + ~~~ + +*Type*: statement. + +#### `validate_integer` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that the first argument is an integer (or an array of integers). Aborts catalog compilation if any of the checks fail. + + The second argument is optional and passes a maximum. (All elements of) the first argument has to be less or equal to this max. + + The third argument is optional and passes a minimum. (All elements of) the first argument has to be greater or equal to this min. + If, and only if, a minimum is given, the second argument may be an empty string or undef, which will be handled to just check + if (all elements of) the first argument are greater or equal to the given minimum. + + It will fail if the first argument is not an integer or array of integers, and if arg 2 and arg 3 are not convertable to an integer. + + The following values will pass: + + ~~~ + validate_integer(1) + validate_integer(1, 2) + validate_integer(1, 1) + validate_integer(1, 2, 0) + validate_integer(2, 2, 2) + validate_integer(2, '', 0) + validate_integer(2, undef, 0) + $foo = undef + validate_integer(2, $foo, 0) + validate_integer([1,2,3,4,5], 6) + validate_integer([1,2,3,4,5], 6, 0) + ~~~ + + * Plus all of the above, but any combination of values passed as strings ('1' or "1"). + * Plus all of the above, but with (correct) combinations of negative integer values. + + The following values will fail, causing compilation to abort: + + ~~~ + validate_integer(true) + validate_integer(false) + validate_integer(7.0) + validate_integer({ 1 => 2 }) + $foo = undef + validate_integer($foo) + validate_integer($foobaridontexist) + + validate_integer(1, 0) + validate_integer(1, true) + validate_integer(1, '') + validate_integer(1, undef) + validate_integer(1, , 0) + validate_integer(1, 2, 3) + validate_integer(1, 3, 2) + validate_integer(1, 3, true) + ~~~ + + * Plus all of the above, but any combination of values passed as strings ('false' or "false"). + * Plus all of the above, but with incorrect combinations of negative integer values. + * Plus all of the above, but with non-integer items in arrays or maximum / minimum argument. + + *Type*: statement. + +#### `validate_ip_address` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that the argument is an IP address, regardless of it is an IPv4 or an IPv6 +address. It also validates IP address with netmask. The argument must be given as a string. + +The following values will pass: + + ~~~ + validate_ip_address('0.0.0.0') + validate_ip_address('8.8.8.8') + validate_ip_address('127.0.0.1') + validate_ip_address('194.232.104.150') + validate_ip_address('3ffe:0505:0002::') + validate_ip_address('::1/64') + validate_ip_address('fe80::a00:27ff:fe94:44d6/64') + validate_ip_address('8.8.8.8/32') + ~~~ + +The following values will fail, causing compilation to abort: + + ~~~ + validate_ip_address(1) + validate_ip_address(true) + validate_ip_address(0.0.0.256) + validate_ip_address('::1', {}) + validate_ip_address('0.0.0.0.0') + validate_ip_address('3.3.3') + validate_ip_address('23.43.9.22/64') + validate_ip_address('260.2.32.43') + ~~~ + + +#### `validate_legacy` + +Validates a value against both a specified type and a deprecated validation function. Silently passes if both pass, errors if only one validation passes, and fails if both validations return false. + +Accepts arguments for: +* the type to check the value against, +* the full name of the previous validation function, +* the value to be checked, +* an unspecified number of arguments needed for the previous validation function. + +Example: + +``` +validate_legacy("Optional[String]", "validate_re", "Value to be validated", ["."]) +``` + +This function supports updating modules from Puppet 3 style argument validation (using the stdlib `validate_*` functions) to Puppet 4 data types, without breaking functionality for those depending on Puppet 3 style validation. + +> Note: This function is compatible only with Puppet 4.4.0 (PE 2016.1) and later. + +##### For module users + +If you are running Puppet 4, the `validate_legacy` function can help you find and resolve deprecated Puppet 3 `validate_*` functions. These functions are deprecated as of stdlib version 4.13 and will be removed in a future version of stdlib. + +Puppet 4 allows improved defined type checking using [data types](https://docs.puppet.com/puppet/latest/reference/lang_data.html). Data types avoid some of the problems with Puppet 3's `validate_*` functions, which could sometimes be inconsistent. For example, [validate_numeric](#validate_numeric) unintentionally allowed not only numbers, but also arrays of numbers or strings that looked like numbers. + +If you run Puppet 4 and use modules with deprecated `validate_*` functions, you might encounter deprecation messages. The `validate_legacy` function makes these differences visible and makes it easier to move to the clearer Puppet 4 syntax. + +The deprecation messages you get can vary, depending on the modules and data that you use. These deprecation messages appear by default only in Puppet 4: + +* `Notice: Accepting previously invalid value for target type ''`: This message is informational only. You're using values that are allowed by the new type, but would have been invalid by the old validation function. +* `Warning: This method is deprecated, please use the stdlib validate_legacy function`: The module has not yet upgraded to `validate_legacy`. Use the [deprecation](#deprecation) options to silence warnings for now, or submit a fix with the module's developer. See the information [for module developers](#for-module-developers) below for how to fix the issue. +* `Warning: validate_legacy() expected value, got _`: Your code passes a value that was accepted by the Puppet 3-style validation, but will not be accepted by the next version of the module. Most often, you can fix this by removing quotes from numbers or booleans. +* `Error: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Function Call, validate_legacy() expected value, got `: Your code passes a value that is not acceptable to either the new or the old style validation. + +##### For module developers + +The `validate_legacy` function helps you move from Puppet 3 style validation to Puppet 4 validation without breaking functionality your module's users depend on. + +Moving to Puppet 4 type validation allows much better defined type checking using [data types](https://docs.puppet.com/puppet/latest/reference/lang_data.html). Many of Puppet 3's `validate_*` functions have surprising holes in their validation. For example, [validate_numeric](#validate_numeric) allows not only numbers, but also arrays of numbers or strings that look like numbers, without giving you any control over the specifics. + +For each parameter of your classes and defined types, choose a new Puppet 4 data type to use. In most cases, the new data type allows a different set of values than the original `validate_*` function. The situation then looks like this: + +| | `validate_` pass | `validate_` fail | +| ------------ | ---------------- | ---------------- | +| matches type | pass | pass, notice | +| fails type | pass, deprecated | fail | + +The code after the validation still has to handle all possible values for now, but users of your code can change their manifests to pass only values that match the new type. + +For each `validate_*` function in stdlib, there is a matching `Stdlib::Compat::*` type that allows the appropriate set of values. See the documentation in the `types/` directory in the stdlib source code for caveats. + +For example, given a class that should accept only numbers, like this: + +~~~ +class example($value) { + validate_numeric($value) +~~~ + +the resulting validation code looks like this: + +~~~ +class example( + Variant[Stdlib::Compat::Numeric, Numeric] $value +) { + validate_legacy(Numeric, 'validate_numeric', $value) +~~~ + +Here, the type of `$value` is defined as `Variant[Stdlib::Compat::Numeric, Numeric]`, which allows any `Numeric` (the new type), as well as all values previously accepted by `validate_numeric` (through `Stdlib::Compat::Numeric`). + +The call to `validate_legacy` takes care of triggering the correct log or fail message for you. It requires the new type, the previous validation function name, and all arguments to that function. + +If your module still supported Puppet 3, this is a breaking change. Update your `metadata.json` requirements section to indicate that your module no longer supports Puppet 3, and bump the major version of your module. With this change, all existing tests for your module should still pass. Create additional tests for the new possible values. + +As a breaking change, this is also a good time to call [`deprecation`](#deprecation) for any parameters you want to get rid of, or to add additional constraints on your parameters. + +After releasing this version, you can release another breaking change release where you remove all compat types and all calls to `validate_legacy`. At that time, you can also go through your code and remove any leftovers dealing with the previously possible values. + +Always note such changes in your CHANGELOG and README. + +#### `validate_numeric` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that the first argument is a numeric value (or an array or string of numeric values). Aborts catalog compilation if any of the checks fail. + + The second argument is optional and passes a maximum. (All elements of) the first argument has to be less or equal to this max. + + The third argument is optional and passes a minimum. (All elements of) the first argument has to be greater or equal to this min. + If, and only if, a minimum is given, the second argument may be an empty string or undef, which will be handled to just check + if (all elements of) the first argument are greater or equal to the given minimum. + + It will fail if the first argument is not a numeric (Integer or Float) or array of numerics, and if arg 2 and arg 3 are not convertable to a numeric. + + For passing and failing usage, see `validate_integer()`. It is all the same for validate_numeric, yet now floating point values are allowed, too. + +*Type*: statement. + +#### `validate_re` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Performs simple validation of a string against one or more regular expressions. The first argument of this function should be the string to +test, and the second argument should be a stringified regular expression (without the // delimiters) or an array of regular expressions. If none of the regular expressions match the string passed in, compilation aborts with a parse error. + + You can pass a third argument as the error message raised and shown to the user. + + The following strings validate against the regular expressions: + + ~~~ + validate_re('one', '^one$') + validate_re('one', [ '^one', '^two' ]) + ~~~ + + The following string fails to validate, causing compilation to abort: + + ~~~ + validate_re('one', [ '^two', '^three' ]) + ~~~ + + To set the error message: + + ~~~ + validate_re($::puppetversion, '^2.7', 'The $puppetversion fact value does not match 2.7') + ~~~ + + Note: Compilation terminates if the first argument is not a string. Always use quotes to force stringification: + + ~~~ + validate_re("${::operatingsystemmajrelease}", '^[57]$') + ~~~ + +*Type*: statement. + +#### `validate_slength` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that the first argument is a string (or an array of strings), and is less than or equal to the length of the second argument. It fails if the first argument is not a string or array of strings, or if the second argument is not convertable to a number. Optionally, a minimum string length can be given as the third argument. + + The following values pass: + + ~~~ + validate_slength("discombobulate",17) + validate_slength(["discombobulate","moo"],17) + validate_slength(["discombobulate","moo"],17,3) + ~~~ + + The following values fail: + + ~~~ + validate_slength("discombobulate",1) + validate_slength(["discombobulate","thermometer"],5) + validate_slength(["discombobulate","moo"],17,10) + ~~~ + +*Type*: statement. + +#### `validate_string` + +**Deprecated. Will be removed in a future version of stdlib. See [`validate_legacy`](#validate_legacy).** + +Validates that all passed values are string data structures. Aborts catalog compilation if any value fails this check. + +The following values pass: + + ~~~ + $my_string = "one two" + validate_string($my_string, 'three') + ~~~ + + The following values fail, causing compilation to abort: + + ~~~ + validate_string(true) + validate_string([ 'some', 'array' ]) + ~~~ + +*Note:* validate_string(undef) will not fail in this version of the functions API (incl. current and future parser). + +Instead, use: + + ~~~ + if $var == undef { + fail('...') + } + ~~~ + +*Type*: statement. + +#### `validate_x509_rsa_key_pair` + +Validates a PEM-formatted X.509 certificate and private key using OpenSSL. +Verifies that the certficate's signature was created from the supplied key. + +Fails catalog compilation if any value fails this check. + +Takes two arguments, the first argument must be a X.509 certificate and the +second must be an RSA private key: + + ~~~ + validate_x509_rsa_key_pair($cert, $key) + ~~~ + +*Type*: statement. + +#### `values` + +Returns the values of a given hash. For example, given `$hash = {'a'=1, 'b'=2, 'c'=3} values($hash)` returns [1,2,3]. + +*Type*: rvalue. + +#### `values_at` + +Finds values inside an array based on location. The first argument is the array you want to analyze, and the second argument can be a combination of: + + * A single numeric index + * A range in the form of 'start-stop' (eg. 4-9) + * An array combining the above + + For example, `values_at(['a','b','c'], 2)` returns ['c']; `values_at(['a','b','c'], ["0-1"])` returns ['a','b']; and `values_at(['a','b','c','d','e'], [0, "2-3"])` returns ['a','c','d']. + +*Type*: rvalue. + +#### `zip` + +Takes one element from first array given and merges corresponding elements from second array given. This generates a sequence of n-element arrays, where *n* is one more than the count of arguments. For example, `zip(['1','2','3'],['4','5','6'])` results in ["1", "4"], ["2", "5"], ["3", "6"]. *Type*: rvalue. + +## Limitations + +As of Puppet Enterprise 3.7, the stdlib module is no longer included in PE. PE users should install the most recent release of stdlib for compatibility with Puppet modules. + +### Version Compatibility + +Versions | Puppet 2.6 | Puppet 2.7 | Puppet 3.x | Puppet 4.x | +:---------------|:-----:|:---:|:---:|:----: +**stdlib 2.x** | **yes** | **yes** | no | no +**stdlib 3.x** | no | **yes** | **yes** | no +**stdlib 4.x** | no | **yes** | **yes** | no +**stdlib 4.6+** | no | **yes** | **yes** | **yes** +**stdlib 5.x** | no | no | **yes** | **yes** + +**stdlib 5.x**: When released, stdlib 5.x will drop support for Puppet 2.7.x. Please see [this discussion](https://github.com/puppetlabs/puppetlabs-stdlib/pull/176#issuecomment-30251414). + +## Development + +Puppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can’t access the huge number of platforms and myriad hardware, software, and deployment configurations that Puppet is intended to serve. We want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things. For more information, see our [module contribution guide](https://docs.puppetlabs.com/forge/contributing.html). + +To report or research a bug with any part of this module, please go to +[http://tickets.puppetlabs.com/browse/MODULES](http://tickets.puppetlabs.com/browse/MODULES). + +## Contributors + +The list of contributors can be found at: [https://github.com/puppetlabs/puppetlabs-stdlib/graphs/contributors](https://github.com/puppetlabs/puppetlabs-stdlib/graphs/contributors). diff --git a/environments/production/modules/stdlib/README_DEVELOPER.markdown b/environments/production/modules/stdlib/README_DEVELOPER.markdown new file mode 100644 index 0000000..04349ed --- /dev/null +++ b/environments/production/modules/stdlib/README_DEVELOPER.markdown @@ -0,0 +1,35 @@ +Puppet Specific Facts +===================== + +Facter is meant to stand alone and apart from Puppet. However, Facter often +runs inside Puppet and all custom facts included in the stdlib module will +almost always be evaluated in the context of Puppet and Facter working +together. + +Still, we don't want to write custom facts that blow up in the users face if +Puppet is not loaded in memory. This is often the case if the user runs +`facter` without also supplying the `--puppet` flag. + +Ah! But Jeff, the custom fact won't be in the `$LOAD_PATH` unless the user +supplies `--facter`! You might say... + +Not (always) true I say! If the user happens to have a CWD of +`/stdlib/lib` then the facts will automatically be evaluated and +blow up. + +In any event, it's pretty easy to write a fact that has no value if Puppet is +not loaded. Simply do it like this: + + Facter.add(:node_vardir) do + setcode do + # This will be nil if Puppet is not available. + Facter::Util::PuppetSettings.with_puppet do + Puppet[:vardir] + end + end + end + +The `Facter::Util::PuppetSettings.with_puppet` method accepts a block and +yields to it only if the Puppet library is loaded. If the Puppet library is +not loaded, then the method silently returns `nil` which Facter interprets as +an undefined fact value. The net effect is that the fact won't be set. diff --git a/environments/production/modules/stdlib/README_SPECS.markdown b/environments/production/modules/stdlib/README_SPECS.markdown new file mode 100644 index 0000000..917b631 --- /dev/null +++ b/environments/production/modules/stdlib/README_SPECS.markdown @@ -0,0 +1,7 @@ +NOTE +==== + +This project's specs depend on puppet core, and thus they require the +`puppetlabs_spec_helper` project. For more information please see the README +in that project, which can be found here: [puppetlabs spec +helper](https://github.com/puppetlabs/puppetlabs_spec_helper) diff --git a/environments/production/modules/stdlib/RELEASE_PROCESS.markdown b/environments/production/modules/stdlib/RELEASE_PROCESS.markdown new file mode 100644 index 0000000..0f9328e --- /dev/null +++ b/environments/production/modules/stdlib/RELEASE_PROCESS.markdown @@ -0,0 +1,24 @@ +# Contributing to this module # + + * Work in a topic branch + * Submit a github pull request + * Address any comments / feeback + * Merge into master using --no-ff + +# Releasing this module # + + * This module adheres to http://semver.org/ + * Look for API breaking changes using git diff vX.Y.Z..master + * If no API breaking changes, the minor version may be bumped. + * If there are API breaking changes, the major version must be bumped. + * If there are only small minor changes, the patch version may be bumped. + * Update the CHANGELOG + * Update the Modulefile + * Commit these changes with a message along the lines of "Update CHANGELOG and + Modulefile for release" + * Create an annotated tag with git tag -a vX.Y.Z -m 'version X.Y.Z' (NOTE the + leading v as per semver.org) + * Push the tag with git push origin --tags + * Build a new package with puppet-module or the rake build task if it exists + * Publish the new package to the forge + * Bonus points for an announcement to puppet-users. diff --git a/environments/production/modules/stdlib/Rakefile b/environments/production/modules/stdlib/Rakefile new file mode 100644 index 0000000..d12d854 --- /dev/null +++ b/environments/production/modules/stdlib/Rakefile @@ -0,0 +1,37 @@ +require 'puppetlabs_spec_helper/rake_tasks' +require 'puppet-lint/tasks/puppet-lint' +require 'puppet_blacksmith/rake_tasks' if Bundler.rubygems.find_name('puppet-blacksmith').any? + +PuppetLint.configuration.fail_on_warnings = true +PuppetLint.configuration.send('relative') + +desc 'Generate pooler nodesets' +task :gen_nodeset do + require 'beaker-hostgenerator' + require 'securerandom' + require 'fileutils' + + agent_target = ENV['TEST_TARGET'] + if ! agent_target + STDERR.puts 'TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat-64default."' + agent_target = 'redhat-64default.' + end + + master_target = ENV['MASTER_TEST_TARGET'] + if ! master_target + STDERR.puts 'MASTER_TEST_TARGET environment variable is not set' + STDERR.puts 'setting to default value of "redhat7-64mdcl"' + master_target = 'redhat7-64mdcl' + end + + targets = "#{master_target}-#{agent_target}" + cli = BeakerHostGenerator::CLI.new([targets]) + nodeset_dir = "tmp/nodesets" + nodeset = "#{nodeset_dir}/#{targets}-#{SecureRandom.uuid}.yaml" + FileUtils.mkdir_p(nodeset_dir) + File.open(nodeset, 'w') do |fh| + fh.print(cli.execute) + end + puts nodeset +end diff --git a/environments/production/modules/stdlib/appveyor.yml b/environments/production/modules/stdlib/appveyor.yml new file mode 100644 index 0000000..c87ed7c --- /dev/null +++ b/environments/production/modules/stdlib/appveyor.yml @@ -0,0 +1,40 @@ +version: 1.1.x.{build} +skip_commits: + message: /^\(?doc\)?.*/ +clone_depth: 10 +init: +- SET +- 'mkdir C:\ProgramData\PuppetLabs\code && exit 0' +- 'mkdir C:\ProgramData\PuppetLabs\facter && exit 0' +- 'mkdir C:\ProgramData\PuppetLabs\hiera && exit 0' +- 'mkdir C:\ProgramData\PuppetLabs\puppet\var && exit 0' +environment: + matrix: + - PUPPET_GEM_VERSION: ~> 4.0 + RUBY_VER: 21 + - PUPPET_GEM_VERSION: ~> 4.0 + RUBY_VER: 21-x64 + - PUPPET_GEM_VERSION: ~> 4.0 + RUBY_VER: 23 + - PUPPET_GEM_VERSION: ~> 4.0 + RUBY_VER: 23-x64 + - PUPPET_GEM_VERSION: 4.2.3 + RUBY_VER: 21-x64 +matrix: + fast_finish: true +install: +- SET PATH=C:\Ruby%RUBY_VER%\bin;%PATH% +- bundle install --jobs 4 --retry 2 --without system_tests +- type Gemfile.lock +build: off +test_script: +- bundle exec puppet -V +- ruby -v +- bundle exec rake spec SPEC_OPTS='--format documentation' +notifications: +- provider: Email + to: + - nobody@nowhere.com + on_build_success: false + on_build_failure: false + on_build_status_changed: false diff --git a/environments/production/modules/stdlib/checksums.json b/environments/production/modules/stdlib/checksums.json new file mode 100644 index 0000000..2a972d4 --- /dev/null +++ b/environments/production/modules/stdlib/checksums.json @@ -0,0 +1,508 @@ +{ + "CHANGELOG.md": "54254f2ff8453a9c05c420820f240f0e", + "CONTRIBUTING.md": "77d0440d7cd4206497f99065c60bed46", + "Gemfile": "064893aff1d6bf890eee483af3a79c9e", + "LICENSE": "3b83ef96387f14655fc854ddc3c6bd57", + "MAINTAINERS.md": "b40ec4f2c16145af6f723c2c34bb2ff9", + "NOTICE": "b2e552587e5969886fdd60481e8b0351", + "README.markdown": "c53e1b16e6eb345241addcb867e8c2a6", + "README_DEVELOPER.markdown": "220a8b28521b5c5d2ea87c4ddb511165", + "README_SPECS.markdown": "82bb4c6abbb711f40778b162ec0070c1", + "RELEASE_PROCESS.markdown": "94b92bc99ac4106ba1a74d5c04e520f9", + "Rakefile": "3851f083966b9bbd6d46e50dba5aa52a", + "appveyor.yml": "7e0ff52cc2abe3fa4f2d8d978bf18ad7", + "examples/file_line.pp": "48f7f162127beffea8f8e3e58db2355a", + "examples/has_interface_with.pp": "d69d520cf3ff4d0b495480afaca359ef", + "examples/has_ip_address.pp": "32f42575e49aa66f0f2398a70ae2a9f4", + "examples/has_ip_network.pp": "bfb8db068c58d77c4dd7ae9697536537", + "examples/init.pp": "b52fd907330ddbd9c3e070cf39f7b317", + "lib/facter/facter_dot_d.rb": "d71e93183a680ac78bc0389fd50470a0", + "lib/facter/package_provider.rb": "539766a71dfb2f65e94a7c91bf413fcf", + "lib/facter/pe_version.rb": "60d47406026c8201e51394227ddf780d", + "lib/facter/puppet_settings.rb": "9438c0839ae28dc52fffb8348ae5124f", + "lib/facter/root_home.rb": "35702ae0c7410ec4d2101113e2f697fa", + "lib/facter/service_provider.rb": "66cc42526eae631e306b397391f1f01c", + "lib/facter/util/puppet_settings.rb": "9f1d2593d0ae56bfca89d4b9266aeee1", + "lib/puppet/functions/deprecation.rb": "59b803eaa15b5a559040497bffc172ae", + "lib/puppet/functions/is_a.rb": "9dad7f8c9b75348cd97aca986ac0b29a", + "lib/puppet/functions/is_absolute_path.rb": "96b217f26d06dbac87a2c6a8cfd2d8c8", + "lib/puppet/functions/is_array.rb": "9292a646010d167417a1936b0b0c17b9", + "lib/puppet/functions/is_bool.rb": "73957f9efd75ed8a7ab867f9de6da117", + "lib/puppet/functions/is_float.rb": "af3bd6bb56878bac8cc4fe4f7564e4f9", + "lib/puppet/functions/is_ip_address.rb": "ee231c66c3e039778bf46702d89815a6", + "lib/puppet/functions/is_ipv4_address.rb": "900d33249906c4daa02aa79cac896548", + "lib/puppet/functions/is_ipv6_address.rb": "568fba9af6a83c8b536fafcda82eb448", + "lib/puppet/functions/is_numeric.rb": "33051800b886cc3b2119826b77c9821a", + "lib/puppet/functions/is_string.rb": "230e9eabc5c9e1d8d5fb7b3c6c12b300", + "lib/puppet/functions/length.rb": "03cf801867a919f801d290424fd2bb8d", + "lib/puppet/functions/type_of.rb": "bec00841aae556993c926ab298bc81cd", + "lib/puppet/functions/validate_absolute_path.rb": "54a610baa115c7505f1b35976b632a8e", + "lib/puppet/functions/validate_array.rb": "9052b0026da174636c276a2512cf5acc", + "lib/puppet/functions/validate_bool.rb": "fe979e402a5a3a19d013ce84b39ef06a", + "lib/puppet/functions/validate_hash.rb": "92ea8fc21bbbf6cc41f6bb9cfcaefce7", + "lib/puppet/functions/validate_integer.rb": "b0982b68a599262da2c6f2e032bc7713", + "lib/puppet/functions/validate_ip_address.rb": "65a12af9a2c2a9c70d820d04d19ec891", + "lib/puppet/functions/validate_ipv4_address.rb": "4a5039b99ac97cc0447faa343b9f7416", + "lib/puppet/functions/validate_ipv6_address.rb": "fbdf685432416505fed27d5647c26f9c", + "lib/puppet/functions/validate_legacy.rb": "d9f115f30c511cef536a821b94826094", + "lib/puppet/functions/validate_numeric.rb": "41b2cc7335395f617c2bfbeac8f579da", + "lib/puppet/functions/validate_re.rb": "42092f592ebf89b8a504b10c900230d8", + "lib/puppet/functions/validate_slength.rb": "3ae6fcc3f60032c923d06ab3e457b84e", + "lib/puppet/functions/validate_string.rb": "cc967a9d0ea156b2208d1760d7f6e1b2", + "lib/puppet/parser/functions/abs.rb": "a8e46ecf4fb378d314916599651cebe5", + "lib/puppet/parser/functions/any2array.rb": "a81e71d6b67a551d38770ba9a1948a75", + "lib/puppet/parser/functions/any2bool.rb": "8bbb74cb81ebdb164e1965415364080b", + "lib/puppet/parser/functions/assert_private.rb": "cb9cd79ed4e3d647a48467dfb6237d5c", + "lib/puppet/parser/functions/base64.rb": "0d121a32fbfe25b06a4e91b0259af91d", + "lib/puppet/parser/functions/basename.rb": "c61952b3f68fd86408c84fca2c3febb1", + "lib/puppet/parser/functions/bool2num.rb": "01b070b02611fda7e1491de0a8cd89fc", + "lib/puppet/parser/functions/bool2str.rb": "c00885242abf381ba482644ded70b688", + "lib/puppet/parser/functions/camelcase.rb": "bd5da699dfe1ec27ffe91b06187c5900", + "lib/puppet/parser/functions/capitalize.rb": "c94c50b0f147a22861c3b93c724e4343", + "lib/puppet/parser/functions/ceiling.rb": "7de4a96c8bb645fd5ce5c38438667228", + "lib/puppet/parser/functions/chomp.rb": "35a16c85bc59dc285baae631da1ae771", + "lib/puppet/parser/functions/chop.rb": "3beb80906fa3c759945a2664fe510b20", + "lib/puppet/parser/functions/clamp.rb": "6920e6c11b575fc65dadb21220c01a7a", + "lib/puppet/parser/functions/concat.rb": "d10e5428917895d4bb90c638b148b7fa", + "lib/puppet/parser/functions/convert_base.rb": "c3b3e59a49318af98dcb88aed7156629", + "lib/puppet/parser/functions/count.rb": "325bbd89a29e6ed0f31e0462d0a0d301", + "lib/puppet/parser/functions/deep_merge.rb": "d83696855578fb81b64b9e92b9c7cc7c", + "lib/puppet/parser/functions/defined_with_params.rb": "80eed5cedb1b5134e6a1cf44e86ae60a", + "lib/puppet/parser/functions/delete.rb": "7af1540fee4285d93b6b28fb490db70a", + "lib/puppet/parser/functions/delete_at.rb": "a2cba60ac86a676d4ed1ff846a917014", + "lib/puppet/parser/functions/delete_regex.rb": "91cd012ef5a636ffe541814ed232b909", + "lib/puppet/parser/functions/delete_undef_values.rb": "52beef9ee37f84ed2278a69ec4383125", + "lib/puppet/parser/functions/delete_values.rb": "b410f5618b4a6158a921acb7b2dc628d", + "lib/puppet/parser/functions/deprecation.rb": "4323210434d36e37977251f906a232b8", + "lib/puppet/parser/functions/difference.rb": "467e44aeaebd0ee0a51c8b89e3769f1f", + "lib/puppet/parser/functions/dig.rb": "1a2a8918f646c13dcb9876a22f9295ab", + "lib/puppet/parser/functions/dig44.rb": "3078b97ee941c261944857373d400ed6", + "lib/puppet/parser/functions/dirname.rb": "8a5579f9a9a13fd737ba65eccf8e6d5a", + "lib/puppet/parser/functions/dos2unix.rb": "be8359a5106a7832be4180e8207dd586", + "lib/puppet/parser/functions/downcase.rb": "02376505a00accd0ce6b148f869c9c86", + "lib/puppet/parser/functions/empty.rb": "6d7d2dde2971f6a40fa913f0af1c610c", + "lib/puppet/parser/functions/enclose_ipv6.rb": "ec39936a9a51dc5cb8ada6eeb829b239", + "lib/puppet/parser/functions/ensure_packages.rb": "0fca8d6dc6608dc16e316fcd39f692b7", + "lib/puppet/parser/functions/ensure_resource.rb": "de703fe63392b939fc2b4392975263de", + "lib/puppet/parser/functions/ensure_resources.rb": "c92d8b69d6354eda24aa3a13d88177b2", + "lib/puppet/parser/functions/flatten.rb": "6a27f5b922a24fec6e823f6f51c98090", + "lib/puppet/parser/functions/floor.rb": "07ba3b1662a14c60fe908b51231355ee", + "lib/puppet/parser/functions/fqdn_rand_string.rb": "9ac5f18e563094aee62ef7586267025d", + "lib/puppet/parser/functions/fqdn_rotate.rb": "2483d17df4e6cb25d92b4e8520f30957", + "lib/puppet/parser/functions/fqdn_uuid.rb": "d357e8837ba2ed8196e926f3697be521", + "lib/puppet/parser/functions/get_module_path.rb": "d4bf50da25c0b98d26b75354fa1bcc45", + "lib/puppet/parser/functions/getparam.rb": "440a9c381b9ad589504e2e9919e83c06", + "lib/puppet/parser/functions/getvar.rb": "0c8c5cef7e158e232a8cf6e42c10d0ff", + "lib/puppet/parser/functions/grep.rb": "c2f2dbdf79d16584579c3a7bc7b5902f", + "lib/puppet/parser/functions/has_interface_with.rb": "db65f5aac94e8fe105c7ca0cd1f66403", + "lib/puppet/parser/functions/has_ip_address.rb": "6ce9e6cdfb499b6ce86bf531848a18be", + "lib/puppet/parser/functions/has_ip_network.rb": "3cc7b923fd3cde5062ed9d0eaaa8155f", + "lib/puppet/parser/functions/has_key.rb": "7cd9728c38f0b0065f832dabd62b0e7e", + "lib/puppet/parser/functions/hash.rb": "c1ebb21cc5b984153a87c252a9854db2", + "lib/puppet/parser/functions/intersection.rb": "87469eb81ab00bbacfd744165beeaeec", + "lib/puppet/parser/functions/is_absolute_path.rb": "1ce9a6d1cd0a79087d73cb879ed04542", + "lib/puppet/parser/functions/is_array.rb": "bbce6768b688bc0f36978ecb0f60f7f4", + "lib/puppet/parser/functions/is_bool.rb": "b8800ff7a11b4e8c03616041e218225f", + "lib/puppet/parser/functions/is_domain_name.rb": "5c6106c070945a605c5adbd1852f0691", + "lib/puppet/parser/functions/is_email_address.rb": "1eb786779743e93a7bb9fe8087b38b8d", + "lib/puppet/parser/functions/is_float.rb": "6257620b98c5099293be7aa4088b88ce", + "lib/puppet/parser/functions/is_function_available.rb": "f13934d6b41561ef54d88cf0da86231b", + "lib/puppet/parser/functions/is_hash.rb": "6f1ccf659c41cb5dab4db9fa89f0b364", + "lib/puppet/parser/functions/is_integer.rb": "a4ae475a5a799c0cc46519e86aed2973", + "lib/puppet/parser/functions/is_ip_address.rb": "2eabe60c213df2e642a03ebfd4852497", + "lib/puppet/parser/functions/is_ipv4_address.rb": "ab854b47367921f657410fbe79054f0b", + "lib/puppet/parser/functions/is_ipv6_address.rb": "2a2be7adbdd5ca23c3e21f00d7d8bac7", + "lib/puppet/parser/functions/is_mac_address.rb": "1af27510d3b9b936384192a4e1dfbf8c", + "lib/puppet/parser/functions/is_numeric.rb": "bfd99f39e2506953ad00178db6fa07ea", + "lib/puppet/parser/functions/is_string.rb": "c1405dd293e9e3c738b83c4ef5aab1ef", + "lib/puppet/parser/functions/join.rb": "2ed4f56d296a4535da142e01b11a126d", + "lib/puppet/parser/functions/join_keys_to_values.rb": "71ad24ac1809739713c461141aedd082", + "lib/puppet/parser/functions/keys.rb": "c10485a3d6c53b6d57a891b9852898de", + "lib/puppet/parser/functions/load_module_metadata.rb": "805c5476a6e7083d133e167129885924", + "lib/puppet/parser/functions/loadjson.rb": "ffecf61ba2ec8011915d37009b1a273e", + "lib/puppet/parser/functions/loadyaml.rb": "668265f14327cba1d1400f2078b7b26b", + "lib/puppet/parser/functions/lstrip.rb": "e9cbd5c2233233940e7344478362fb9f", + "lib/puppet/parser/functions/max.rb": "529eb6ac3d88c03caa788167594bd487", + "lib/puppet/parser/functions/member.rb": "03d618926bbb9efd117950e6078c3878", + "lib/puppet/parser/functions/merge.rb": "f3dcc5c83440cdda2036cce69b61a14b", + "lib/puppet/parser/functions/min.rb": "8d829c8a55c9330ab02f962926221d4f", + "lib/puppet/parser/functions/num2bool.rb": "ddb603cf74f92e16a00f1447a4403429", + "lib/puppet/parser/functions/parsejson.rb": "15165fd3807d9f3d657697fa854d643d", + "lib/puppet/parser/functions/parseyaml.rb": "db54578d9d798ced75952217cf11b737", + "lib/puppet/parser/functions/pick.rb": "bf01f13bbfe2318e7f6a302ac7c4433f", + "lib/puppet/parser/functions/pick_default.rb": "ad3ea60262de408767786d37a54d45dc", + "lib/puppet/parser/functions/prefix.rb": "ece9341c5b232a25c58545718a54e92f", + "lib/puppet/parser/functions/private.rb": "1500a21d5cf19961c5b1d476df892d92", + "lib/puppet/parser/functions/pry.rb": "79a48e45196e4bbf0a3e658781513cf4", + "lib/puppet/parser/functions/pw_hash.rb": "3d540eb4c483cc9c111794ac2d24a4a7", + "lib/puppet/parser/functions/range.rb": "ab19430b6b9737cf56263eb65d80cba1", + "lib/puppet/parser/functions/regexpescape.rb": "6378fdd413237a37c322859877147a50", + "lib/puppet/parser/functions/reject.rb": "689f6a7c961a55fe9dcd240921f4c7f9", + "lib/puppet/parser/functions/reverse.rb": "209e7ef512963251571c515e2d0aee10", + "lib/puppet/parser/functions/rstrip.rb": "f3226709247741825f07d9ec20bd3887", + "lib/puppet/parser/functions/seeded_rand.rb": "2ad22e7613d894ae779c0c5b0e65dade", + "lib/puppet/parser/functions/shell_escape.rb": "13662933244e1af42ddca71ced4ac9e5", + "lib/puppet/parser/functions/shell_join.rb": "b99a23d5e62e2e1b98accde5c22e45c9", + "lib/puppet/parser/functions/shell_split.rb": "5317d71f3a7e293624b57aaca23f57d5", + "lib/puppet/parser/functions/shuffle.rb": "6c0555524ebc9ed5dd8295b836fb7163", + "lib/puppet/parser/functions/size.rb": "c171d46b87e377ebcc710ad5a5925a2b", + "lib/puppet/parser/functions/sort.rb": "0b7d1411decc4a92450828809fad0779", + "lib/puppet/parser/functions/squeeze.rb": "403ea46228a8e45e89c91168ed301fb6", + "lib/puppet/parser/functions/str2bool.rb": "ff82f179970a9429614bd37fa7a1ae2a", + "lib/puppet/parser/functions/str2saltedsha512.rb": "457ab12e4329494ae6276cfa4f20eb23", + "lib/puppet/parser/functions/strftime.rb": "8f15e2e3732b6d1d357a1fa1826800d4", + "lib/puppet/parser/functions/strip.rb": "da0ce253cb63a4863f15f9d145217db5", + "lib/puppet/parser/functions/suffix.rb": "1ce493098f17ea47e9435f994adbc6cd", + "lib/puppet/parser/functions/swapcase.rb": "48cad9bf415b5d79584c8e17ab7a06cc", + "lib/puppet/parser/functions/time.rb": "cd96d1f039f8875af083091e3637190b", + "lib/puppet/parser/functions/to_bytes.rb": "45248fd0bba8cfb24eac830fc0add17a", + "lib/puppet/parser/functions/try_get_value.rb": "09cd079ec5f0e5e2ac862c9ebe0f54fe", + "lib/puppet/parser/functions/type.rb": "4709f7ab8a8aad62d77a3c5d91a3aa08", + "lib/puppet/parser/functions/type3x.rb": "5d0391205bd1cfe8de985a44e8c3e8a9", + "lib/puppet/parser/functions/union.rb": "c02fca3fe102875ba020072b7edee532", + "lib/puppet/parser/functions/unique.rb": "0f79a96896149f7034cd85e31eed1e54", + "lib/puppet/parser/functions/unix2dos.rb": "b1f5087fcaca69d9395094204cce887a", + "lib/puppet/parser/functions/upcase.rb": "e875fc4f03adec1ff3b42d22f177441e", + "lib/puppet/parser/functions/uriescape.rb": "ba78def2cd0e60bdc4412df6c7b891ec", + "lib/puppet/parser/functions/validate_absolute_path.rb": "c4b12e101055380386a235cd2c92ad10", + "lib/puppet/parser/functions/validate_array.rb": "bee8327014714d4cd8dbb5c46611f594", + "lib/puppet/parser/functions/validate_augeas.rb": "61e828e7759ba3e1e563e1fdd68aa80f", + "lib/puppet/parser/functions/validate_bool.rb": "971700229c4b581f67f6fadc9019eb2c", + "lib/puppet/parser/functions/validate_cmd.rb": "7df12370db442eddddcf4dd7a5364b5e", + "lib/puppet/parser/functions/validate_email_address.rb": "a72656cbfeda622cdd5cfdafdf464095", + "lib/puppet/parser/functions/validate_hash.rb": "c2ae6299148ea200f8dfcf9204875182", + "lib/puppet/parser/functions/validate_integer.rb": "65aa35f7450794aaadb6ad2c2e114df7", + "lib/puppet/parser/functions/validate_ip_address.rb": "b23c3d5ce6839e32d0186411147a6a44", + "lib/puppet/parser/functions/validate_ipv4_address.rb": "593e8f832469cb6a48c5f16ee66c3b2d", + "lib/puppet/parser/functions/validate_ipv6_address.rb": "48d3733012818993eae662839183d139", + "lib/puppet/parser/functions/validate_numeric.rb": "0e36d370262b8bdef2f88f0a3cb5b30e", + "lib/puppet/parser/functions/validate_re.rb": "d5963c404e3ac1670553f306221c2655", + "lib/puppet/parser/functions/validate_slength.rb": "6cbcfe15378ca4a780bac786223aacac", + "lib/puppet/parser/functions/validate_string.rb": "8afa7b0dcfe17bfbbb5704ad54664cc2", + "lib/puppet/parser/functions/validate_x509_rsa_key_pair.rb": "f17427dfc42128dc1df0ab04f37942e5", + "lib/puppet/parser/functions/values.rb": "c35978761496406cc3dafdccaa014236", + "lib/puppet/parser/functions/values_at.rb": "f7e6ad2a1126acd4fb5f7fcf9bfc2e2b", + "lib/puppet/parser/functions/zip.rb": "133f3d4c54640844e656e2e6e790318e", + "lib/puppet/provider/file_line/ruby.rb": "2bfa44964be201698186b94a60a5eb31", + "lib/puppet/type/anchor.rb": "bbd36bb49c3b554f8602d8d3df366c0c", + "lib/puppet/type/file_line.rb": "d65885f7f0afe49ee199d6bf873a5daf", + "manifests/init.pp": "9560a09f657d7eebbfdb920cefcc1d4f", + "manifests/stages.pp": "72eb4fa624474faf23b39e57cf1590bd", + "metadata.json": "c75558cd574027ce6326bc8f43d3cf07", + "spec/acceptance/abs_spec.rb": "5b60756b2b4da28314025f51989592d7", + "spec/acceptance/anchor_spec.rb": "0fdbe266d8b7c3dc172e338b978109ba", + "spec/acceptance/any2array_spec.rb": "444cfd34154539d896e5ef1488386372", + "spec/acceptance/base64_spec.rb": "6a1dd4144ba354f9bed14eb70f7d2cba", + "spec/acceptance/bool2num_spec.rb": "edc9cb8b89b95410326475d27ce74bd5", + "spec/acceptance/build_csv.rb": "f28ef587de764ade1513091c4906412c", + "spec/acceptance/capitalize_spec.rb": "4bb6471ec3a8a07260da8e249fae6ccd", + "spec/acceptance/ceiling_spec.rb": "46489eef94aa21bb1560383bb17d7d02", + "spec/acceptance/chomp_spec.rb": "8372fe8a875b1a599a89df1191f43bc0", + "spec/acceptance/chop_spec.rb": "d73d1c7c6a44df65677362bd2899bbc1", + "spec/acceptance/clamp_spec.rb": "8afaae07bf89e0af35474da489fd590f", + "spec/acceptance/concat_spec.rb": "bad5f40e0a501b436ec4264cd278290b", + "spec/acceptance/count_spec.rb": "f8abd435b077edd06ad76a96a2e610c0", + "spec/acceptance/deep_merge_spec.rb": "5f16342cb8c1b52d6a08717a2ef87117", + "spec/acceptance/defined_with_params_spec.rb": "8b47a7255b9d662009217f3cfd17ca03", + "spec/acceptance/delete_at_spec.rb": "b0c853ffe5fc121e051233d62f6e72b3", + "spec/acceptance/delete_spec.rb": "6ccb838a13037a56d1413aecb4fdac00", + "spec/acceptance/delete_undef_values_spec.rb": "7d849a978d3ecdaaf5e922acc6038ad8", + "spec/acceptance/delete_values_spec.rb": "b9f3dbffbb89fec32c6a5b2bd3b20901", + "spec/acceptance/deprecation_spec.rb": "cadc56a94cbc2f13965d698f581f582d", + "spec/acceptance/difference_spec.rb": "2f4e8ddd760f2d4dc9a4fb7b653e982f", + "spec/acceptance/dirname_spec.rb": "76e6b66474f070d8a89f3fe5bd187e85", + "spec/acceptance/downcase_spec.rb": "53f0f5b1867e0fd87ba59833c18b5ca2", + "spec/acceptance/empty_spec.rb": "be8a610f87790a321dbd4cc0542e2885", + "spec/acceptance/ensure_resource_spec.rb": "c0193d79f1db1985d313bedb93a4c7ae", + "spec/acceptance/flatten_spec.rb": "3ab1f9c9e761e5d758eeee7a2e32f295", + "spec/acceptance/floor_spec.rb": "4a20f6fc7142ef9357c8d18a408b5e52", + "spec/acceptance/fqdn_rand_string_spec.rb": "7744b45e282013c5fe637dbaf42f85b9", + "spec/acceptance/fqdn_rotate_spec.rb": "366816bb1d3102f64025d61e22eec79c", + "spec/acceptance/get_module_path_spec.rb": "d5d2258b2345359d1e51a638b97523cb", + "spec/acceptance/getparam_spec.rb": "d4037f1f546cf7a3e7dcabe787e637b5", + "spec/acceptance/getvar_spec.rb": "8451bced69bfd5599a552ddf49976d98", + "spec/acceptance/grep_spec.rb": "5e6650532658915d1004a6e6c0f1229d", + "spec/acceptance/has_interface_with_spec.rb": "e028fc7fc1023293ba32c48c9f46752a", + "spec/acceptance/has_ip_address_spec.rb": "f3443be46277f6084ca8e531562d8ac7", + "spec/acceptance/has_ip_network_spec.rb": "fa7a38450bef7e4408deb6b978d5a42f", + "spec/acceptance/has_key_spec.rb": "68e42fb69d15f27916e7943ab727afc6", + "spec/acceptance/hash_spec.rb": "1e8ff803d76d8f9e506c8a366a93ad90", + "spec/acceptance/intersection_spec.rb": "755c135f67811666b3c5152c5c5349c2", + "spec/acceptance/is_a_spec.rb": "4cdd8df78a6285de21d634c032e5a7c9", + "spec/acceptance/is_array_spec.rb": "1de1fb0b55759d4012033ae3ce0723c2", + "spec/acceptance/is_bool_spec.rb": "9984cd966d81c217f8ff4e252a4a66d1", + "spec/acceptance/is_domain_name_spec.rb": "948dc0c7372027e8f2bb9db85b8d66b2", + "spec/acceptance/is_float_spec.rb": "731d9b71e7b4ee5055339d08b2b5f707", + "spec/acceptance/is_function_available_spec.rb": "413964bfe8e18c34d8809590afcc4118", + "spec/acceptance/is_hash_spec.rb": "9095a364cba82a95a1edd0f92d2218c7", + "spec/acceptance/is_integer_spec.rb": "bc4e7192073531638be9f8a4d391a827", + "spec/acceptance/is_ip_address_spec.rb": "c2ee8738d62b4c9d42b3ef1a1b8573fc", + "spec/acceptance/is_ipv4_address_spec.rb": "09f6f3ad6a1c0a9e5dcfaab34a081ffc", + "spec/acceptance/is_ipv6_address_spec.rb": "d19a98176b2b7367e740d338df08c2ae", + "spec/acceptance/is_mac_address_spec.rb": "b53f033cc4943a19f597895df0b5210a", + "spec/acceptance/is_numeric_spec.rb": "95ecae5adde23e6b61cd090704c4572d", + "spec/acceptance/is_string_spec.rb": "d9ad89b30aff62aea4fb805c991c6abf", + "spec/acceptance/join_keys_to_values_spec.rb": "908f62013e1d797ddc0ba68c0fb7913b", + "spec/acceptance/join_spec.rb": "5609c646859140109af4ae1c63cc69d2", + "spec/acceptance/keys_spec.rb": "15edb2f0a5630dfadd9bd6c038e5cf95", + "spec/acceptance/loadjson_spec.rb": "7bf8eb220ed02b77e9956dade1acfcb3", + "spec/acceptance/loadyaml_spec.rb": "3810faad7411bc1d9c9274671bb68a9a", + "spec/acceptance/lstrip_spec.rb": "27a6e2c9e2afc5b3e0e98301798a80ad", + "spec/acceptance/max_spec.rb": "c39a2006dacdbd24a8acc5dc25f1a9f3", + "spec/acceptance/member_spec.rb": "10b9635c1daf636d66aabea6ff796e6a", + "spec/acceptance/merge_spec.rb": "a1502ebd4d069c5f818f7fd8da79e02d", + "spec/acceptance/min_spec.rb": "a6e73a33255bc202de93fd8fe679c510", + "spec/acceptance/nodesets/centos-7-x64.yml": "a713f3abd3657f0ae2878829badd23cd", + "spec/acceptance/nodesets/debian-8-x64.yml": "d2d2977900989f30086ad251a14a1f39", + "spec/acceptance/nodesets/default.yml": "b42da5a1ea0c964567ba7495574b8808", + "spec/acceptance/nodesets/docker/centos-7.yml": "8a3892807bdd62306ae4774f41ba11ae", + "spec/acceptance/nodesets/docker/debian-8.yml": "ac8e871d1068c96de5e85a89daaec6df", + "spec/acceptance/nodesets/docker/ubuntu-14.04.yml": "dc42ee922a96908d85b8f0f08203ce58", + "spec/acceptance/num2bool_spec.rb": "33ab633c5a6aa1e5e9c0cac9ec23c0d5", + "spec/acceptance/parsejson_spec.rb": "56353143de570034f59a87244bb9ff7b", + "spec/acceptance/parseyaml_spec.rb": "a564b2217350398d8a3f1b212d0c2ada", + "spec/acceptance/pick_default_spec.rb": "bc3512e0cc3bc34da5f44ae18573af5d", + "spec/acceptance/pick_spec.rb": "661747652e50bb522ad0c627fb8c3c58", + "spec/acceptance/prefix_spec.rb": "2b9df68e18e16144caa4440fd6acaa01", + "spec/acceptance/pw_hash_spec.rb": "979f0d209f1ef227a31d27a452fc2ed3", + "spec/acceptance/range_spec.rb": "f913a26f4bbe8b9432b6cb80a3b6d1ed", + "spec/acceptance/reject_spec.rb": "c63eb909288cf2210f72d3afa1e07b32", + "spec/acceptance/reverse_spec.rb": "eca705328f8e246a648e3f62434e662a", + "spec/acceptance/rstrip_spec.rb": "bad1e42f66d07b5d09ca1133b392bf6a", + "spec/acceptance/shuffle_spec.rb": "adc420bc01d83dde117b04baa4a5e2d8", + "spec/acceptance/size_spec.rb": "d923ec158f5c2275b9823dd118edd953", + "spec/acceptance/sort_spec.rb": "3ac4acd4233fbe624d926604d58acea6", + "spec/acceptance/squeeze_spec.rb": "2270c35766a5162cd732f0f761f0dc34", + "spec/acceptance/str2bool_spec.rb": "73ca9cbf9079ef52de10f90cb871e80c", + "spec/acceptance/str2saltedsha512_spec.rb": "1e89299c3802ba386589a5133a07dccc", + "spec/acceptance/strftime_spec.rb": "6cdfc95c02af2419eb14d173a23df678", + "spec/acceptance/strip_spec.rb": "711b6b73fce659ab83956c4454500e55", + "spec/acceptance/suffix_spec.rb": "c2ca0539e9e7b71f36ff470d3c18b303", + "spec/acceptance/swapcase_spec.rb": "30290d4378f19fa8bac4bc3347a36298", + "spec/acceptance/time_spec.rb": "74b6d4f21d46ca612a98efed9c48944c", + "spec/acceptance/to_bytes_spec.rb": "ff7d57f85cf1e211b0998235636edfd9", + "spec/acceptance/try_get_value_spec.rb": "8b62b969ece6f02c65f0cf3d365324b1", + "spec/acceptance/type_spec.rb": "909aa4d0c2463b04a3d3ff72cb0d4b42", + "spec/acceptance/union_spec.rb": "41b8705ac890ddd915a5f6c8b33620cd", + "spec/acceptance/unique_spec.rb": "0108f76cc12ecb0551a37a002a9bda85", + "spec/acceptance/upcase_spec.rb": "30721f352edd513a0cc36c94aa0fe760", + "spec/acceptance/uriescape_spec.rb": "69857543c97c35b23094cc6da0828055", + "spec/acceptance/validate_absolute_path_spec.rb": "b7f57e45a4d4d2a187bf9db99c481f98", + "spec/acceptance/validate_array_spec.rb": "ec0db1f08eb8d64fec1025b65b544365", + "spec/acceptance/validate_augeas_spec.rb": "744354dd9726be3624db10935ae2b13f", + "spec/acceptance/validate_bool_spec.rb": "950632bafc509e1965cd6a57646d87f6", + "spec/acceptance/validate_cmd_spec.rb": "1605939801210b1a53dc8873492551e0", + "spec/acceptance/validate_hash_spec.rb": "b79b1ef06301e1b97863281e3c419b0e", + "spec/acceptance/validate_ipv4_address_spec.rb": "547520f1ad1d55c52a257f4fb85ecc33", + "spec/acceptance/validate_ipv6_address_spec.rb": "feedad9317be19409e351011c7b852b9", + "spec/acceptance/validate_re_spec.rb": "bcc18798eccca866883b965baefc3cc9", + "spec/acceptance/validate_slength_spec.rb": "29311e9e910bba57a86be9a4893b43e5", + "spec/acceptance/validate_string_spec.rb": "cd36b419ebb8630618ec795781081101", + "spec/acceptance/values_at_spec.rb": "17e39ac5e094fb05522cb363e12186ab", + "spec/acceptance/values_spec.rb": "25d5abaffd9a108a52cdb156b5120e85", + "spec/acceptance/zip_spec.rb": "30ac38a83f8e92d642a20b53c5b66292", + "spec/aliases/absolute_path_spec.rb": "4326af270230f6d1aef6b1c68a31c53b", + "spec/aliases/absolutepath_spec.rb": "ab9a78b2aa5f6eb102ee648c5f88da61", + "spec/aliases/array_spec.rb": "09c3559333ec646387e4141ed37d671e", + "spec/aliases/bool_spec.rb": "c3f734df3cd334860bba95386b8e8ba6", + "spec/aliases/float_spec.rb": "dda76444d67dcf4e9ab4bf8d1a668b23", + "spec/aliases/hash_spec.rb": "8b0753fbb41a41655235f999a8cd8a17", + "spec/aliases/httpsurl_spec.rb": "49fa0c1da3f055228aaa7ab12471f126", + "spec/aliases/httpurl_spec.rb": "fe92b61091197895e9e0070adcaec1e9", + "spec/aliases/integer_spec.rb": "3d5c27c864e2385251f1c16a46ef717d", + "spec/aliases/ip_address.rb": "297c6577c0763f5121f9ca9c19718dfe", + "spec/aliases/ipv4_spec.rb": "8f3be58256671754f32287609c7a64ba", + "spec/aliases/ipv6_spec.rb": "68bc3bdf8f2dbb049f8f8daf93d78e82", + "spec/aliases/numeric_spec.rb": "a0031bb0085673ec7cc28d9c9b5a72e4", + "spec/aliases/string_spec.rb": "2b4661dbe97d7172b613edd50db91542", + "spec/aliases/unixpath_spec.rb": "1fac6f23e14c3589d26284a081c25c77", + "spec/aliases/windowspath_spec.rb": "4a3aec398b2c6ae86cb6d68ac5e8ab06", + "spec/fixtures/dscacheutil/root": "e1a7622f55f3d1be258c9a5b16b474be", + "spec/fixtures/lsuser/root": "2ed657fa157372a81634539bb1a56be8", + "spec/fixtures/test/manifests/absolute_path.pp": "79e9da69f05adc0e1ed41c20bf14e95f", + "spec/fixtures/test/manifests/absolutepath.pp": "8561fa141028cd38d0b8409cd69a1372", + "spec/fixtures/test/manifests/array.pp": "0e1d4146a9b2dd56063b2cab6f3d7571", + "spec/fixtures/test/manifests/bool.pp": "cf75826f36025bd73ff7f479acf7196d", + "spec/fixtures/test/manifests/ensure_resources.pp": "3265ae7af9382cfe7d9a13527265dcc9", + "spec/fixtures/test/manifests/float.pp": "132f9a63e60bba2fba68be83208c2e28", + "spec/fixtures/test/manifests/hash.pp": "84d647482ef0c7dc35348c13fb0ca23e", + "spec/fixtures/test/manifests/httpsurl.pp": "9047fc382d215ae55c065b0798a82a2d", + "spec/fixtures/test/manifests/httpurl.pp": "7165bf5607a4808f3da3f9baca911240", + "spec/fixtures/test/manifests/integer.pp": "3cb3807714ddcde25cd8eeca61581e3b", + "spec/fixtures/test/manifests/ip_address.pp": "78deea27fe1ff9e85c360eced4d2c256", + "spec/fixtures/test/manifests/ipv4.pp": "b4f0dfe6ae06d4f8b284d24e55f6a6a2", + "spec/fixtures/test/manifests/ipv6.pp": "4764f683b6013556e20d8669b21b5bdc", + "spec/fixtures/test/manifests/numeric.pp": "bffd26d7c0bb53628369f42c14b342cb", + "spec/fixtures/test/manifests/string.pp": "27b69c1eb36250bfbd474a0ef9ba847b", + "spec/fixtures/test/manifests/unixpath.pp": "fd062024efdf731e19026901d3fcc075", + "spec/fixtures/test/manifests/windowspath.pp": "7f942ec8f883a3ac0fcaf960ea24b7d8", + "spec/functions/abs_spec.rb": "7c0ebbd787b788d32b9bb21fe9061a2f", + "spec/functions/any2array_spec.rb": "22b7ce032a34d02b6858360025eb7644", + "spec/functions/any2bool_spec.rb": "d090dde9be26601a38980e8f77fa5970", + "spec/functions/assert_private_spec.rb": "a7e79ac7a1b28610a0e57e38e913c9fa", + "spec/functions/base64_spec.rb": "fa279d9a4f3060ee3f467e35b050d528", + "spec/functions/basename_spec.rb": "4aec9efc4fc6ed35de82d93b34dc0fab", + "spec/functions/bool2num_spec.rb": "6609136ff067b90d41cf27bf8838c3ea", + "spec/functions/bool2str_spec.rb": "52560617234393f960aedb496b49a628", + "spec/functions/camelcase_spec.rb": "4a13d3323535291fef3f40a96710acdb", + "spec/functions/capitalize_spec.rb": "31a8d497b274653d5ede70a0187d4053", + "spec/functions/ceiling_spec.rb": "47bd74569f8979d9195df06a863de93b", + "spec/functions/chomp_spec.rb": "8be3a83a34945dcaa6e8e193cf2751e4", + "spec/functions/chop_spec.rb": "8e1f661e93dd87b8bbeebe293fe16612", + "spec/functions/clamp_spec.rb": "65dab1e9aceb2cb4e41ef9c0c65a7ba3", + "spec/functions/concat_spec.rb": "4161a254ff4c21497e61a62ce84dafe8", + "spec/functions/convert_base_spec.rb": "f031e84b18cb010bc6233be3e4bcff83", + "spec/functions/count_spec.rb": "14ab4e4b10fe33d69d0662357cd4bf8b", + "spec/functions/deep_merge_spec.rb": "5a4e826aaa0a0c0e4247b72e03bdfbd1", + "spec/functions/defined_with_params_spec.rb": "9a0af61ab4bfc380ef4707005344fac2", + "spec/functions/delete_at_spec.rb": "188a3143799bd5cf121982883c7dc1c8", + "spec/functions/delete_regex_spec.rb": "c049a3926aded4b6a804f1c824c57d2f", + "spec/functions/delete_spec.rb": "d7c589404fdc3a6b65da7ecf1f7e0b02", + "spec/functions/delete_undef_values_spec.rb": "a2c138145333e1873ee4bf23d091f86a", + "spec/functions/delete_values_spec.rb": "e20b68a589002f1e2b52873d3dbcfb49", + "spec/functions/deprecation_spec.rb": "f5d7355b687eaaa15c20fdb214671c2a", + "spec/functions/difference_spec.rb": "66ba399c0bace1a131ecdb365e0afd4e", + "spec/functions/dig44_spec.rb": "89631bb7282f7d3c9b75d79f48446c65", + "spec/functions/dig_spec.rb": "61708160da38852c3c78bc8563e0fcb2", + "spec/functions/dirname_spec.rb": "e80baeab6a166284f5069263fb5e37b7", + "spec/functions/dos2unix_spec.rb": "d0cfe5fe19d2bf33320e6f47789826c6", + "spec/functions/downcase_spec.rb": "e2c24d41c6fb840f7b66c5205c942780", + "spec/functions/empty_spec.rb": "e6d06c193869ce8c97d3e67d5c5c5b4f", + "spec/functions/ensure_packages_spec.rb": "81f281f4c4f2146328b65b49ad4e846b", + "spec/functions/ensure_resource_spec.rb": "6461ab093bc10308e1c81b01482c409f", + "spec/functions/flatten_spec.rb": "5d59251fa8da0e4c8a376a513a25bc7a", + "spec/functions/floor_spec.rb": "7d110b1f994432e1c6c7c004a3dedbe4", + "spec/functions/fqdn_rand_string_spec.rb": "950a33e5ad8056fbfe564ec7e3b9a583", + "spec/functions/fqdn_rotate_spec.rb": "83f00ce0c48dec632e1aaa8192bb51cf", + "spec/functions/fqdn_uuid_spec.rb": "1b2980fcbecc4b51bdc6de01e9b001b7", + "spec/functions/get_module_path_spec.rb": "ef22bd80ce5dedb069830d5aa10572c1", + "spec/functions/getparam_spec.rb": "359d7c9349ec0e5666bb38e2d9224621", + "spec/functions/getvar_spec.rb": "3c7884e012bdb596df3d0640533dab96", + "spec/functions/grep_spec.rb": "0e917284860c5f96fdf56301012ba199", + "spec/functions/has_interface_with_spec.rb": "473c000e461c3497f8461eb17cf73430", + "spec/functions/has_ip_address_spec.rb": "7b36b993ea32757e74be9909906bd165", + "spec/functions/has_ip_network_spec.rb": "7086a27623ba91c5ff069397a32172c4", + "spec/functions/has_key_spec.rb": "eaa046db8632d6f76893e4b9df7b3e31", + "spec/functions/hash_spec.rb": "53a059e13781fac6b4f8eb660655d58f", + "spec/functions/intersection_spec.rb": "e906cb8ceb39b644b4b338adcd4dda26", + "spec/functions/is_a_spec.rb": "7d6322426d629e5302c52455d9c4cd55", + "spec/functions/is_array_spec.rb": "26d7eab025f333d2c4a8baf89ef4e36e", + "spec/functions/is_bool_spec.rb": "40569a4cdb50af0cc21ad749ac18e6ef", + "spec/functions/is_domain_name_spec.rb": "4ea3825d5b77a5d75eab8228dcc738f9", + "spec/functions/is_email_address_spec.rb": "699c4573dfd00db8993a18afc0eaf875", + "spec/functions/is_float_spec.rb": "8aedd9e622cd1b861d99523532dc4fc1", + "spec/functions/is_function_available.rb": "f8ab234d536532c3629ff6a5068e7877", + "spec/functions/is_hash_spec.rb": "11563529f0f1f821769edb3131277100", + "spec/functions/is_integer_spec.rb": "21a139f9a87b1561bfec60de26c435a2", + "spec/functions/is_ip_address_spec.rb": "04a15328803bb47ae431eff63aa555df", + "spec/functions/is_ipv4_address_spec.rb": "339b8c79925bb70c0de19468d58ab64a", + "spec/functions/is_ipv6_address_spec.rb": "9743a0f2bfda70ace128d2f476a208b9", + "spec/functions/is_mac_address_spec.rb": "532b8c4c63b37849e7fb9122d163ae3a", + "spec/functions/is_numeric_spec.rb": "cb846f44e8f6d79161686d7b3729967c", + "spec/functions/is_string_spec.rb": "56f34694781dfcf774e43bca06057fec", + "spec/functions/join_keys_to_values_spec.rb": "f99dff6550fdb7c245ed4dcaca0a16a3", + "spec/functions/join_spec.rb": "e190fbce526b3f4f7bb8aac029338ece", + "spec/functions/keys_spec.rb": "fba0bfa928b5684d5c918d6c06edd06d", + "spec/functions/length.rb": "c07a267ccccc4b4edbbfad155dc21475", + "spec/functions/load_module_metadata_spec.rb": "431fbe84d627a5c4398f432caaec96f8", + "spec/functions/loadjson_spec.rb": "76cbe175c90a596892b799d8e4d599e5", + "spec/functions/loadyaml_spec.rb": "60e283bc07adc67bc2c934424bf01b8d", + "spec/functions/lstrip_spec.rb": "892229ce8657490c72fc860fb0dda1b6", + "spec/functions/max_spec.rb": "47de8d59070d8d51b2184731f5d1aa43", + "spec/functions/member_spec.rb": "6a988e6368c1ce090b47fe41efbc041c", + "spec/functions/merge_spec.rb": "56297527d192640bbe82c7ccf1e39815", + "spec/functions/min_spec.rb": "8b38e2a989912406cd2c57dcd3a460c4", + "spec/functions/num2bool_spec.rb": "7c4fd30e41a11b1bd0d9e5233340f16b", + "spec/functions/parsejson_spec.rb": "958db1dde2f2244f458c399e0c3231e0", + "spec/functions/parseyaml_spec.rb": "19a2add90ca08d5a17c4e3aff89fe3c0", + "spec/functions/pick_default_spec.rb": "ab9ef2e9111cfd2709313e0e3c3befa2", + "spec/functions/pick_spec.rb": "786044a71e3bd673212949c12f37b10f", + "spec/functions/prefix_spec.rb": "2402d2ad5108050bb5c20b3ea58b64be", + "spec/functions/private_spec.rb": "f404771c4590a0cd7ce61ddff8f3eb7b", + "spec/functions/pw_hash_spec.rb": "640609cc73b4c8bbcdfc88c3e9797664", + "spec/functions/range_spec.rb": "d3af56cc8a137059423f8738e343ccff", + "spec/functions/regexpescape_spec.rb": "ce027e1b99674f39de8ddffcfed8396e", + "spec/functions/reject_spec.rb": "8ecbca64a9817ebef76be96dcf6cdeeb", + "spec/functions/reverse_spec.rb": "e40754fd34e96ac206308958504ae315", + "spec/functions/rstrip_spec.rb": "748f4587c12b5a590b985f111e282a8d", + "spec/functions/seeded_rand_spec.rb": "eb56445d10962d81ed935b53826da349", + "spec/functions/shell_escape_spec.rb": "bf108573c041f0c228f6d47d367d0aa3", + "spec/functions/shell_join_spec.rb": "92f31bd98d6e8e30e5f758f50bcb8a75", + "spec/functions/shell_split_spec.rb": "430f58733cc7855e56bfc918971b3fc1", + "spec/functions/shuffle_spec.rb": "be5d43184f2ca42db4f452085a4730fd", + "spec/functions/size_spec.rb": "f5e35878331bb12d9639522e38cc81c8", + "spec/functions/sort_spec.rb": "d9533dd37c6263b92895f7eba8485248", + "spec/functions/squeeze_spec.rb": "ffcf3b44cbdd45e14eb1173d2b7d1d99", + "spec/functions/str2bool_spec.rb": "607b25fb0badd0da5acb86c63437c8be", + "spec/functions/str2saltedsha512_spec.rb": "07586b0026757cd39229c12c7221808b", + "spec/functions/strftime_spec.rb": "f1a34fc930940213abfba3095d5d8065", + "spec/functions/strip_spec.rb": "023132b8bd0820da254f74c6fe31bb80", + "spec/functions/suffix_spec.rb": "dfe26a61bf0185291b6ae868e9d0de20", + "spec/functions/swapcase_spec.rb": "90bace1b004aa63d46eb6481c6dce2b1", + "spec/functions/time_spec.rb": "6dc8f5b42cf89345d2de424bfe19be90", + "spec/functions/to_bytes_spec.rb": "b771f8490d922de46a519e407d358139", + "spec/functions/try_get_value_spec.rb": "b917b899f5d29764dd4b1b07e07ec6ce", + "spec/functions/type3x_spec.rb": "eed4ce3a2bc92d14effedefef9690654", + "spec/functions/type_of_spec.rb": "83755d9390b9c00e086a007edff7fd9b", + "spec/functions/type_spec.rb": "7a61b4af7d3d83be590d783a7e5e80f8", + "spec/functions/union_spec.rb": "a290a38e443b856a476d14d4b1dc72fb", + "spec/functions/unique_spec.rb": "97fbcc73a0e0d82e23c723837627c712", + "spec/functions/unix2dos_spec.rb": "628c8a0c608d1fa0dd09bd1b5af97c1f", + "spec/functions/upcase_spec.rb": "4f0461a20c03d618f0c18da39bebcf65", + "spec/functions/uriescape_spec.rb": "1458afbe7e7e11dcaad8d295a7f2be59", + "spec/functions/validate_absolute_path_spec.rb": "5adbf0a0ac8b23e86195deaf3e4bd371", + "spec/functions/validate_array_spec.rb": "3aa76f3731754c637acc94b59c79efb0", + "spec/functions/validate_augeas_spec.rb": "d598e89a23912be9f24d39b809f30b47", + "spec/functions/validate_bool_spec.rb": "d1b43cd294d0588ac6d67d5d3c77a42a", + "spec/functions/validate_cmd_spec.rb": "34a4e623ab0ce7d4c218a837f896c1ea", + "spec/functions/validate_email_address_spec.rb": "1296f9934d102258091379ee07f9a2a8", + "spec/functions/validate_hash_spec.rb": "0b3ac3f7262f13ef14e3df937c8d104c", + "spec/functions/validate_integer_spec.rb": "ec55ab34e3ec4f09722349cd6aac77a6", + "spec/functions/validate_ip_address_spec.rb": "ba8c92e30f1af9e6839a2901e002c3f3", + "spec/functions/validate_ipv4_address_spec.rb": "d5d956651629f95ea531ac03b71e247b", + "spec/functions/validate_ipv6_address_spec.rb": "7ee0d6097666558d8627de424c26ef75", + "spec/functions/validate_legacy_spec.rb": "a1a3af70e71d0a6b848d75c518949b3b", + "spec/functions/validate_numeric_spec.rb": "c2f01b9c9aeae75683563ef7d3951bbb", + "spec/functions/validate_re_spec.rb": "27bcf99cd815b755548cd3979753b2f3", + "spec/functions/validate_slength_spec.rb": "c292023b2e61298499ff1f791fc03005", + "spec/functions/validate_string_spec.rb": "bc6735359ada0b3ccf69f515231e3808", + "spec/functions/validate_x509_rsa_key_pair_spec.rb": "24810bdb8ac473ae1168f1b2c5708170", + "spec/functions/values_at_spec.rb": "866ba43a4b606f6e9e72ac91c07408bd", + "spec/functions/values_spec.rb": "6b8f39665cb8fdb03658d838e50b55b0", + "spec/functions/zip_spec.rb": "986defd43a001ff28fe7c90b0366812e", + "spec/monkey_patches/alias_should_to_must.rb": "b19ee31563afb91a72f9869f9d7362ff", + "spec/monkey_patches/publicize_methods.rb": "c690e444b77c871375d321e413e28ca1", + "spec/spec_helper.rb": "b2db3bc02b4ac2fd5142a6621c641b07", + "spec/spec_helper_acceptance.rb": "cd589056b52031da19d9c31ed86ea922", + "spec/spec_helper_local.rb": "1e3ad3c06a11cbcb813dc1d31973cbda", + "spec/support/shared_data.rb": "9758f8ba2958965d287387a2513dac73", + "spec/unit/ensure_resources_spec.rb": "30cad259a3cc6c73f90209804183c818", + "spec/unit/facter/facter_dot_d_spec.rb": "420339a544851f2c7ee6fa4c651bdce8", + "spec/unit/facter/package_provider_spec.rb": "3a6ba799822fbcabc9adab5880260b7a", + "spec/unit/facter/pe_version_spec.rb": "d0fa6c0d5b01a4b9fd36ed4168635e9f", + "spec/unit/facter/root_home_spec.rb": "036c160d5543f4f3e80a300a3a170b77", + "spec/unit/facter/service_provider_spec.rb": "a97efb411817a44c511cd6cd79d9af8c", + "spec/unit/facter/util/puppet_settings_spec.rb": "6f9df9b10a1b39245ecdf002616a4122", + "spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb": "0145a78254ea716e5e7600d9464318a8", + "spec/unit/puppet/parser/functions/is_absolute_path_spec.rb": "52f8d3b9011fb1fd8a2a429fe8b2ae08", + "spec/unit/puppet/provider/file_line/ruby_spec.rb": "d269e18953fc297786a8393b20842abc", + "spec/unit/puppet/type/anchor_spec.rb": "06a669dffa44d716bf19b4e7f5f1d75d", + "spec/unit/puppet/type/file_line_spec.rb": "83e11166de4abe69cdf0dc7450e79778", + "types/absolutepath.pp": "3ae6f48dd95835df87c5dacea13c88d2", + "types/compat/absolute_path.pp": "6d0e102d1098d85d97c8f13051cb2c10", + "types/compat/array.pp": "43c41022dd743d55c8e9e82ce3ed741c", + "types/compat/bool.pp": "6e0cd7b2a7e1b9efaa0e273937211e58", + "types/compat/float.pp": "fd134a0e0e1abd420cec2107780a7afa", + "types/compat/hash.pp": "3535d98f0f3eaec44d443190f258e9ba", + "types/compat/integer.pp": "e85a20e42b3afaf5ec0718a8d9f9c5e3", + "types/compat/ip_address.pp": "d42c7435de30a469a71b69c45d642da7", + "types/compat/ipv4.pp": "c84eb3764f45b256a09be68afe61b749", + "types/compat/ipv6.pp": "d3c0fada5425d576aeca14ddbee78653", + "types/compat/numeric.pp": "f864539d78e95dabf0bab361b4ccc042", + "types/compat/re.pp": "70b05d4697e61f9af0c212ba063f395d", + "types/compat/string.pp": "b9a179664c85e121aa0277021627d126", + "types/httpsurl.pp": "108225d0273e17d541b239882287ed15", + "types/httpurl.pp": "4ba64825b11af75997c59b5acf07c62d", + "types/unixpath.pp": "5fc80523e7f474dd84056c44fafd9544", + "types/windowspath.pp": "4c1eda331ecb43de98c29ed22d0ad448" +} \ No newline at end of file diff --git a/environments/production/modules/stdlib/examples/file_line.pp b/environments/production/modules/stdlib/examples/file_line.pp new file mode 100644 index 0000000..85b1325 --- /dev/null +++ b/environments/production/modules/stdlib/examples/file_line.pp @@ -0,0 +1,9 @@ +# This is a simple smoke test +# of the file_line resource type. +file { '/tmp/dansfile': + ensure => file, +} -> +file_line { 'dans_line': + line => 'dan is awesome', + path => '/tmp/dansfile', +} diff --git a/environments/production/modules/stdlib/examples/has_interface_with.pp b/environments/production/modules/stdlib/examples/has_interface_with.pp new file mode 100644 index 0000000..a578dd2 --- /dev/null +++ b/environments/production/modules/stdlib/examples/has_interface_with.pp @@ -0,0 +1,9 @@ +include ::stdlib +info('has_interface_with(\'lo\'):', has_interface_with('lo')) +info('has_interface_with(\'loX\'):', has_interface_with('loX')) +info('has_interface_with(\'ipaddress\', \'127.0.0.1\'):', has_interface_with('ipaddress', '127.0.0.1')) +info('has_interface_with(\'ipaddress\', \'127.0.0.100\'):', has_interface_with('ipaddress', '127.0.0.100')) +info('has_interface_with(\'network\', \'127.0.0.0\'):', has_interface_with('network', '127.0.0.0')) +info('has_interface_with(\'network\', \'128.0.0.0\'):', has_interface_with('network', '128.0.0.0')) +info('has_interface_with(\'netmask\', \'255.0.0.0\'):', has_interface_with('netmask', '255.0.0.0')) +info('has_interface_with(\'netmask\', \'256.0.0.0\'):', has_interface_with('netmask', '256.0.0.0')) diff --git a/environments/production/modules/stdlib/examples/has_ip_address.pp b/environments/production/modules/stdlib/examples/has_ip_address.pp new file mode 100644 index 0000000..594143d --- /dev/null +++ b/environments/production/modules/stdlib/examples/has_ip_address.pp @@ -0,0 +1,3 @@ +include ::stdlib +info('has_ip_address(\'192.168.1.256\'):', has_ip_address('192.168.1.256')) +info('has_ip_address(\'127.0.0.1\'):', has_ip_address('127.0.0.1')) diff --git a/environments/production/modules/stdlib/examples/has_ip_network.pp b/environments/production/modules/stdlib/examples/has_ip_network.pp new file mode 100644 index 0000000..1f1130d --- /dev/null +++ b/environments/production/modules/stdlib/examples/has_ip_network.pp @@ -0,0 +1,3 @@ +include ::stdlib +info('has_ip_network(\'127.0.0.0\'):', has_ip_network('127.0.0.0')) +info('has_ip_network(\'128.0.0.0\'):', has_ip_network('128.0.0.0')) diff --git a/environments/production/modules/stdlib/examples/init.pp b/environments/production/modules/stdlib/examples/init.pp new file mode 100644 index 0000000..ad27972 --- /dev/null +++ b/environments/production/modules/stdlib/examples/init.pp @@ -0,0 +1 @@ +include ::stdlib diff --git a/environments/production/modules/stdlib/lib/facter/facter_dot_d.rb b/environments/production/modules/stdlib/lib/facter/facter_dot_d.rb new file mode 100644 index 0000000..5c5fb1f --- /dev/null +++ b/environments/production/modules/stdlib/lib/facter/facter_dot_d.rb @@ -0,0 +1,202 @@ +# A Facter plugin that loads facts from /etc/facter/facts.d +# and /etc/puppetlabs/facter/facts.d. +# +# Facts can be in the form of JSON, YAML or Text files +# and any executable that returns key=value pairs. +# +# In the case of scripts you can also create a file that +# contains a cache TTL. For foo.sh store the ttl as just +# a number in foo.sh.ttl +# +# The cache is stored in $libdir/facts_dot_d.cache as a mode +# 600 file and will have the end result of not calling your +# fact scripts more often than is needed + +class Facter::Util::DotD + require 'yaml' + + def initialize(dir="/etc/facts.d", cache_file=File.join(Puppet[:libdir], "facts_dot_d.cache")) + @dir = dir + @cache_file = cache_file + @cache = nil + @types = {".txt" => :txt, ".json" => :json, ".yaml" => :yaml} + end + + def entries + Dir.entries(@dir).reject { |f| f =~ /^\.|\.ttl$/ }.sort.map { |f| File.join(@dir, f) } + rescue + [] + end + + def fact_type(file) + extension = File.extname(file) + + type = @types[extension] || :unknown + + type = :script if type == :unknown && File.executable?(file) + + return type + end + + def txt_parser(file) + File.readlines(file).each do |line| + if line =~ /^([^=]+)=(.+)$/ + var = $1; val = $2 + + Facter.add(var) do + setcode { val } + end + end + end + rescue StandardError => e + Facter.warn("Failed to handle #{file} as text facts: #{e.class}: #{e}") + end + + def json_parser(file) + begin + require 'json' + rescue LoadError + retry if require 'rubygems' + raise + end + + JSON.load(File.read(file)).each_pair do |f, v| + Facter.add(f) do + setcode { v } + end + end + rescue StandardError => e + Facter.warn("Failed to handle #{file} as json facts: #{e.class}: #{e}") + end + + def yaml_parser(file) + require 'yaml' + + YAML.load_file(file).each_pair do |f, v| + Facter.add(f) do + setcode { v } + end + end + rescue StandardError => e + Facter.warn("Failed to handle #{file} as yaml facts: #{e.class}: #{e}") + end + + def script_parser(file) + result = cache_lookup(file) + ttl = cache_time(file) + + unless result + result = Facter::Util::Resolution.exec(file) + + if ttl > 0 + Facter.debug("Updating cache for #{file}") + cache_store(file, result) + cache_save! + end + else + Facter.debug("Using cached data for #{file}") + end + + result.split("\n").each do |line| + if line =~ /^(.+)=(.+)$/ + var = $1; val = $2 + + Facter.add(var) do + setcode { val } + end + end + end + rescue StandardError => e + Facter.warn("Failed to handle #{file} as script facts: #{e.class}: #{e}") + Facter.debug(e.backtrace.join("\n\t")) + end + + def cache_save! + cache = load_cache + File.open(@cache_file, "w", 0600) { |f| f.write(YAML.dump(cache)) } + rescue + end + + def cache_store(file, data) + load_cache + + @cache[file] = {:data => data, :stored => Time.now.to_i} + rescue + end + + def cache_lookup(file) + cache = load_cache + + return nil if cache.empty? + + ttl = cache_time(file) + + if cache[file] + now = Time.now.to_i + + return cache[file][:data] if ttl == -1 + return cache[file][:data] if (now - cache[file][:stored]) <= ttl + return nil + else + return nil + end + rescue + return nil + end + + def cache_time(file) + meta = file + ".ttl" + + return File.read(meta).chomp.to_i + rescue + return 0 + end + + def load_cache + unless @cache + if File.exist?(@cache_file) + @cache = YAML.load_file(@cache_file) + else + @cache = {} + end + end + + return @cache + rescue + @cache = {} + return @cache + end + + def create + entries.each do |fact| + type = fact_type(fact) + parser = "#{type}_parser" + + if respond_to?("#{type}_parser") + Facter.debug("Parsing #{fact} using #{parser}") + + send(parser, fact) + end + end + end +end + + +mdata = Facter.version.match(/(\d+)\.(\d+)\.(\d+)/) +if mdata + (major, minor, patch) = mdata.captures.map { |v| v.to_i } + if major < 2 + # Facter 1.7 introduced external facts support directly + unless major == 1 and minor > 6 + Facter::Util::DotD.new("/etc/facter/facts.d").create + Facter::Util::DotD.new("/etc/puppetlabs/facter/facts.d").create + + # Windows has a different configuration directory that defaults to a vendor + # specific sub directory of the %COMMON_APPDATA% directory. + if Dir.const_defined? 'COMMON_APPDATA' then + windows_facts_dot_d = File.join(Dir::COMMON_APPDATA, 'PuppetLabs', 'facter', 'facts.d') + Facter::Util::DotD.new(windows_facts_dot_d).create + end + end + end +end diff --git a/environments/production/modules/stdlib/lib/facter/package_provider.rb b/environments/production/modules/stdlib/lib/facter/package_provider.rb new file mode 100644 index 0000000..3a9117f --- /dev/null +++ b/environments/production/modules/stdlib/lib/facter/package_provider.rb @@ -0,0 +1,21 @@ +# Fact: package_provider +# +# Purpose: Returns the default provider Puppet will choose to manage packages +# on this system +# +# Resolution: Instantiates a dummy package resource and return the provider +# +# Caveats: +# +require 'puppet/type' +require 'puppet/type/package' + +Facter.add(:package_provider) do + setcode do + if defined? Gem and Gem::Version.new(Facter.value(:puppetversion).split(' ')[0]) >= Gem::Version.new('3.6') + Puppet::Type.type(:package).newpackage(:name => 'dummy', :allow_virtual => 'true')[:provider].to_s + else + Puppet::Type.type(:package).newpackage(:name => 'dummy')[:provider].to_s + end + end +end diff --git a/environments/production/modules/stdlib/lib/facter/pe_version.rb b/environments/production/modules/stdlib/lib/facter/pe_version.rb new file mode 100644 index 0000000..c9f2181 --- /dev/null +++ b/environments/production/modules/stdlib/lib/facter/pe_version.rb @@ -0,0 +1,58 @@ +# Fact: is_pe, pe_version, pe_major_version, pe_minor_version, pe_patch_version +# +# Purpose: Return various facts about the PE state of the system +# +# Resolution: Uses a regex match against puppetversion to determine whether the +# machine has Puppet Enterprise installed, and what version (overall, major, +# minor, patch) is installed. +# +# Caveats: +# +Facter.add("pe_version") do + setcode do + puppet_ver = Facter.value("puppetversion") + if puppet_ver != nil + pe_ver = puppet_ver.match(/Puppet Enterprise (\d+\.\d+\.\d+)/) + pe_ver[1] if pe_ver + else + nil + end + end +end + +Facter.add("is_pe") do + setcode do + if Facter.value(:pe_version).to_s.empty? then + false + else + true + end + end +end + +Facter.add("pe_major_version") do + confine :is_pe => true + setcode do + if pe_version = Facter.value(:pe_version) + pe_version.to_s.split('.')[0] + end + end +end + +Facter.add("pe_minor_version") do + confine :is_pe => true + setcode do + if pe_version = Facter.value(:pe_version) + pe_version.to_s.split('.')[1] + end + end +end + +Facter.add("pe_patch_version") do + confine :is_pe => true + setcode do + if pe_version = Facter.value(:pe_version) + pe_version.to_s.split('.')[2] + end + end +end diff --git a/environments/production/modules/stdlib/lib/facter/puppet_settings.rb b/environments/production/modules/stdlib/lib/facter/puppet_settings.rb new file mode 100644 index 0000000..eac9e97 --- /dev/null +++ b/environments/production/modules/stdlib/lib/facter/puppet_settings.rb @@ -0,0 +1,43 @@ +# These facter facts return the value of the Puppet vardir and environment path +# settings for the node running puppet or puppet agent. The intent is to +# enable Puppet modules to automatically have insight into a place where they +# can place variable data, or for modules running on the puppet master to know +# where environments are stored. +# +# The values should be directly usable in a File resource path attribute. +# +begin + require 'facter/util/puppet_settings' +rescue LoadError => e + # puppet apply does not add module lib directories to the $LOAD_PATH (See + # #4248). It should (in the future) but for the time being we need to be + # defensive which is what this rescue block is doing. + rb_file = File.join(File.dirname(__FILE__), 'util', 'puppet_settings.rb') + load rb_file if File.exists?(rb_file) or raise e +end + + +# These will be nil if Puppet is not available. +Facter.add(:puppet_vardir) do + setcode do + Facter::Util::PuppetSettings.with_puppet do + Puppet[:vardir] + end + end +end + +Facter.add(:puppet_environmentpath) do + setcode do + Facter::Util::PuppetSettings.with_puppet do + Puppet[:environmentpath] + end + end +end + +Facter.add(:puppet_server) do + setcode do + Facter::Util::PuppetSettings.with_puppet do + Puppet[:server] + end + end +end diff --git a/environments/production/modules/stdlib/lib/facter/root_home.rb b/environments/production/modules/stdlib/lib/facter/root_home.rb new file mode 100644 index 0000000..87c7657 --- /dev/null +++ b/environments/production/modules/stdlib/lib/facter/root_home.rb @@ -0,0 +1,45 @@ +# A facter fact to determine the root home directory. +# This varies on PE supported platforms and may be +# reconfigured by the end user. + +module Facter::Util::RootHome + class << self + def get_root_home + root_ent = Facter::Util::Resolution.exec("getent passwd root") + # The home directory is the sixth element in the passwd entry + # If the platform doesn't have getent, root_ent will be nil and we should + # return it straight away. + root_ent && root_ent.split(":")[5] + end + end +end + +Facter.add(:root_home) do + setcode { Facter::Util::RootHome.get_root_home } +end + +Facter.add(:root_home) do + confine :kernel => :darwin + setcode do + str = Facter::Util::Resolution.exec("dscacheutil -q user -a name root") + hash = {} + str.split("\n").each do |pair| + key,value = pair.split(/:/) + hash[key] = value + end + hash['dir'].strip + end +end + +Facter.add(:root_home) do + confine :kernel => :aix + root_home = nil + setcode do + str = Facter::Util::Resolution.exec("lsuser -c -a home root") + str && str.split("\n").each do |line| + next if line =~ /^#/ + root_home = line.split(/:/)[1] + end + root_home + end +end diff --git a/environments/production/modules/stdlib/lib/facter/service_provider.rb b/environments/production/modules/stdlib/lib/facter/service_provider.rb new file mode 100644 index 0000000..a117921 --- /dev/null +++ b/environments/production/modules/stdlib/lib/facter/service_provider.rb @@ -0,0 +1,17 @@ +# Fact: service_provider +# +# Purpose: Returns the default provider Puppet will choose to manage services +# on this system +# +# Resolution: Instantiates a dummy service resource and return the provider +# +# Caveats: +# +require 'puppet/type' +require 'puppet/type/service' + +Facter.add(:service_provider) do + setcode do + Puppet::Type.type(:service).newservice(:name => 'dummy')[:provider].to_s + end +end diff --git a/environments/production/modules/stdlib/lib/facter/util/puppet_settings.rb b/environments/production/modules/stdlib/lib/facter/util/puppet_settings.rb new file mode 100644 index 0000000..1ad9452 --- /dev/null +++ b/environments/production/modules/stdlib/lib/facter/util/puppet_settings.rb @@ -0,0 +1,21 @@ +module Facter + module Util + module PuppetSettings + # This method is intended to provide a convenient way to evaluate a + # Facter code block only if Puppet is loaded. This is to account for the + # situation where the fact happens to be in the load path, but Puppet is + # not loaded for whatever reason. Perhaps the user is simply running + # facter without the --puppet flag and they happen to be working in a lib + # directory of a module. + def self.with_puppet + begin + Module.const_get("Puppet") + rescue NameError + nil + else + yield + end + end + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/deprecation.rb b/environments/production/modules/stdlib/lib/puppet/functions/deprecation.rb new file mode 100644 index 0000000..39d9bc7 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/deprecation.rb @@ -0,0 +1,29 @@ +# Function to print deprecation warnings, Logs a warning once for a given key. The uniqueness key - can appear once. The msg is the message text including any positional information that is formatted by the user/caller of the method It is affected by the puppet setting 'strict', which can be set to :error (outputs as an error message), :off (no message / error is displayed) and :warning (default, outputs a warning) *Type*: String, String. +# + +Puppet::Functions.create_function(:deprecation) do + dispatch :deprecation do + param 'String', :key + param 'String', :message + end + + def deprecation(key, message) + if defined? Puppet::Pops::PuppetStack.stacktrace() + stacktrace = Puppet::Pops::PuppetStack.stacktrace() + file = stacktrace[0] + line = stacktrace[1] + message = "#{message} at #{file}:#{line}" + end + # depending on configuration setting of strict + case Puppet.settings[:strict] + when :off + # do nothing + when :error + fail("deprecation. #{key}. #{message}") + else + unless ENV['STDLIB_LOG_DEPRECATIONS'] == 'false' + Puppet.deprecation_warning(message, key) + end + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/is_a.rb b/environments/production/modules/stdlib/lib/puppet/functions/is_a.rb new file mode 100644 index 0000000..da98b03 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/is_a.rb @@ -0,0 +1,32 @@ +# Boolean check to determine whether a variable is of a given data type. This is equivalent to the `=~` type checks. +# +# @example how to check a data type +# # check a data type +# foo = 3 +# $bar = [1,2,3] +# $baz = 'A string!' +# +# if $foo.is_a(Integer) { +# notify { 'foo!': } +# } +# if $bar.is_a(Array) { +# notify { 'bar!': } +# } +# if $baz.is_a(String) { +# notify { 'baz!': } +# } +# +# See the documentation for "The Puppet Type System" for more information about types. +# See the `assert_type()` function for flexible ways to assert the type of a value. +# +Puppet::Functions.create_function(:is_a) do + dispatch :is_a do + param 'Any', :value + param 'Type', :type + end + + def is_a(value, type) + # See puppet's lib/puppet/pops/evaluator/evaluator_impl.rb eval_MatchExpression + Puppet::Pops::Types::TypeCalculator.instance?(type, value) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/is_absolute_path.rb b/environments/production/modules/stdlib/lib/puppet/functions/is_absolute_path.rb new file mode 100644 index 0000000..b61064a --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/is_absolute_path.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_absolute_path) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_absolute_path', "This method is deprecated, please use match expressions with Stdlib::Compat::Absolute_Path instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_absolute_path", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/is_array.rb b/environments/production/modules/stdlib/lib/puppet/functions/is_array.rb new file mode 100644 index 0000000..a29fe8a --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/is_array.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_array) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_array', "This method is deprecated, please use match expressions with Stdlib::Compat::Array instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_array", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/is_bool.rb b/environments/production/modules/stdlib/lib/puppet/functions/is_bool.rb new file mode 100644 index 0000000..6e2c22b --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/is_bool.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_bool) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_bool', "This method is deprecated, please use match expressions with Stdlib::Compat::Bool instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_bool", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/is_float.rb b/environments/production/modules/stdlib/lib/puppet/functions/is_float.rb new file mode 100644 index 0000000..c91aa5d --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/is_float.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_float) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_float', "This method is deprecated, please use match expressions with Stdlib::Compat::Float instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_float", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/is_ip_address.rb b/environments/production/modules/stdlib/lib/puppet/functions/is_ip_address.rb new file mode 100644 index 0000000..4c72037 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/is_ip_address.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_ip_address) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_ip_address', "This method is deprecated, please use match expressions with Stdlib::Compat::Ip_address instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_ip_address", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/is_ipv4_address.rb b/environments/production/modules/stdlib/lib/puppet/functions/is_ipv4_address.rb new file mode 100644 index 0000000..97b01ae --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/is_ipv4_address.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_ipv4_address) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_ipv4_address', "This method is deprecated, please use match expressions with Stdlib::Compat::Ipv4 instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_ipv4_address", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/is_ipv6_address.rb b/environments/production/modules/stdlib/lib/puppet/functions/is_ipv6_address.rb new file mode 100644 index 0000000..be0c98a --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/is_ipv6_address.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_ipv6_address) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_ipv4_address', "This method is deprecated, please use match expressions with Stdlib::Compat::Ipv6 instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_ipv6_address", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/is_numeric.rb b/environments/production/modules/stdlib/lib/puppet/functions/is_numeric.rb new file mode 100644 index 0000000..f5e9d41 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/is_numeric.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_numeric) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_numeric', "This method is deprecated, please use match expressions with Stdlib::Compat::Numeric instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_numeric", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/is_string.rb b/environments/production/modules/stdlib/lib/puppet/functions/is_string.rb new file mode 100644 index 0000000..a05a796 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/is_string.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:is_string) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'is_string', "This method is deprecated, please use match expressions with Stdlib::Compat::String instead. They are described at https://docs.puppet.com/puppet/latest/reference/lang_data_type.html#match-expressions.") + scope.send("function_is_string", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/length.rb b/environments/production/modules/stdlib/lib/puppet/functions/length.rb new file mode 100644 index 0000000..86e735c --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/length.rb @@ -0,0 +1,14 @@ +#A function to eventually replace the old size() function for stdlib - The original size function did not handle Puppets new type capabilities, so this function is a Puppet 4 compatible solution. +Puppet::Functions.create_function(:length) do + dispatch :length do + param 'Variant[String,Array,Hash]', :value + end + def length(value) + if value.is_a?(String) + result = value.length + elsif value.is_a?(Array) || value.is_a?(Hash) + result = value.size + end + return result + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/type_of.rb b/environments/production/modules/stdlib/lib/puppet/functions/type_of.rb new file mode 100644 index 0000000..01f1f49 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/type_of.rb @@ -0,0 +1,19 @@ +# Returns the type when passed a value. +# +# @example how to compare values' types +# # compare the types of two values +# if type_of($first_value) != type_of($second_value) { fail("first_value and second_value are different types") } +# @example how to compare against an abstract type +# unless type_of($first_value) <= Numeric { fail("first_value must be Numeric") } +# unless type_of{$first_value) <= Collection[1] { fail("first_value must be an Array or Hash, and contain at least one element") } +# +# See the documentation for "The Puppet Type System" for more information about types. +# See the `assert_type()` function for flexible ways to assert the type of a value. +# +# The built-in type() function in puppet is generally preferred over this function +# this function is provided for backwards compatibility. +Puppet::Functions.create_function(:type_of) do + def type_of(value) + Puppet::Pops::Types::TypeCalculator.infer_set(value) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/validate_absolute_path.rb b/environments/production/modules/stdlib/lib/puppet/functions/validate_absolute_path.rb new file mode 100644 index 0000000..a3c696d --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/validate_absolute_path.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_absolute_path) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_absolute_path', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Absolute_Path. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_absolute_path", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/validate_array.rb b/environments/production/modules/stdlib/lib/puppet/functions/validate_array.rb new file mode 100644 index 0000000..f59c6b4 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/validate_array.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_array) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_array', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Array. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_array", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/validate_bool.rb b/environments/production/modules/stdlib/lib/puppet/functions/validate_bool.rb new file mode 100644 index 0000000..5cfb2ac --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/validate_bool.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_bool) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_bool', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Bool. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_bool", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/validate_hash.rb b/environments/production/modules/stdlib/lib/puppet/functions/validate_hash.rb new file mode 100644 index 0000000..89ad9ab --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/validate_hash.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_hash) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_hash', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Hash. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_hash", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/validate_integer.rb b/environments/production/modules/stdlib/lib/puppet/functions/validate_integer.rb new file mode 100644 index 0000000..475ea0f --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/validate_integer.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_integer) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_integer', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Integer. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_integer", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/validate_ip_address.rb b/environments/production/modules/stdlib/lib/puppet/functions/validate_ip_address.rb new file mode 100644 index 0000000..1521c08 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/validate_ip_address.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_ip_address) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_ip_address', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ip_Address. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_ip_address", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/validate_ipv4_address.rb b/environments/production/modules/stdlib/lib/puppet/functions/validate_ipv4_address.rb new file mode 100644 index 0000000..fe66ab3 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/validate_ipv4_address.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_ipv4_address) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_ipv4_address', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ipv4_Address. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_ipv4_address", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/validate_ipv6_address.rb b/environments/production/modules/stdlib/lib/puppet/functions/validate_ipv6_address.rb new file mode 100644 index 0000000..7cc3cbd --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/validate_ipv6_address.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_ipv6_address) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_ipv6_address', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ipv6_address. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_ipv6_address", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/validate_legacy.rb b/environments/production/modules/stdlib/lib/puppet/functions/validate_legacy.rb new file mode 100644 index 0000000..c9d1f56 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/validate_legacy.rb @@ -0,0 +1,62 @@ +Puppet::Functions.create_function(:validate_legacy) do + # The function checks a value against both the target_type (new) and the previous_validation function (old). + + dispatch :validate_legacy do + param 'Any', :scope + param 'Type', :target_type + param 'String', :function_name + param 'Any', :value + repeated_param 'Any', :args + end + + dispatch :validate_legacy_s do + param 'Any', :scope + param 'String', :type_string + param 'String', :function_name + param 'Any', :value + repeated_param 'Any', :args + end + + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + + def validate_legacy_s(scope, type_string, *args) + t = Puppet::Pops::Types::TypeParser.new.parse(type_string, scope) + validate_legacy(scope, t, *args) + end + + def validate_legacy(scope, target_type, function_name, value, *prev_args) + if assert_type(target_type, value) + if previous_validation(scope, function_name, value, *prev_args) + # Silently passes + else + Puppet.notice("Accepting previously invalid value for target type '#{target_type}'") + end + else + inferred_type = Puppet::Pops::Types::TypeCalculator.infer_set(value) + error_msg = Puppet::Pops::Types::TypeMismatchDescriber.new.describe_mismatch("validate_legacy(#{function_name})", target_type, inferred_type) + if previous_validation(scope, function_name, value, *prev_args) + call_function('deprecation', 'validate_legacy', error_msg) + else + call_function('fail', error_msg) + end + end + end + + def previous_validation(scope, function_name, value, *prev_args) + # Call the previous validation function and catch any errors. Return true if no errors are thrown. + begin + scope.send("function_#{function_name}".to_s, [value, *prev_args]) + true + rescue Puppet::ParseError + false + end + end + + def assert_type(type, value) + Puppet::Pops::Types::TypeCalculator.instance?(type, value) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/validate_numeric.rb b/environments/production/modules/stdlib/lib/puppet/functions/validate_numeric.rb new file mode 100644 index 0000000..3052d35 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/validate_numeric.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_numeric) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_numeric', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Numeric. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_numeric", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/validate_re.rb b/environments/production/modules/stdlib/lib/puppet/functions/validate_re.rb new file mode 100644 index 0000000..19443a8 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/validate_re.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_re) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_re', "This method is deprecated, please use the stdlib validate_legacy function, with Pattern[]. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_re", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/validate_slength.rb b/environments/production/modules/stdlib/lib/puppet/functions/validate_slength.rb new file mode 100644 index 0000000..584232a --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/validate_slength.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_slength) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_slength', "This method is deprecated, please use the stdlib validate_legacy function, with String[]. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_slength", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/functions/validate_string.rb b/environments/production/modules/stdlib/lib/puppet/functions/validate_string.rb new file mode 100644 index 0000000..91ff004 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/functions/validate_string.rb @@ -0,0 +1,15 @@ +Puppet::Functions.create_function(:validate_string) do + dispatch :deprecation_gen do + param 'Any', :scope + repeated_param 'Any', :args + end + # Workaround PUP-4438 (fixed: https://github.com/puppetlabs/puppet/commit/e01c4dc924cd963ff6630008a5200fc6a2023b08#diff-c937cc584953271bb3d3b3c2cb141790R221) to support puppet < 4.1.0 and puppet < 3.8.1. + def call(scope, *args) + manipulated_args = [scope] + args + self.class.dispatcher.dispatch(self, scope, manipulated_args) + end + def deprecation_gen(scope, *args) + call_function('deprecation', 'validate_string', "This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::String. There is further documentation for validate_legacy function in the README.") + scope.send("function_validate_string", args) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/abs.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/abs.rb new file mode 100644 index 0000000..222a902 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/abs.rb @@ -0,0 +1,34 @@ +# +# abs.rb +# + +module Puppet::Parser::Functions + newfunction(:abs, :type => :rvalue, :doc => <<-EOS + Returns the absolute value of a number, for example -34.56 becomes + 34.56. Takes a single integer and float value as an argument. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "abs(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + # Numbers in Puppet are often string-encoded which is troublesome ... + if value.is_a?(String) + if value.match(/^-?(?:\d+)(?:\.\d+){1}$/) + value = value.to_f + elsif value.match(/^-?\d+$/) + value = value.to_i + else + raise(Puppet::ParseError, 'abs(): Requires float or integer to work with') + end + end + + # We have numeric value to handle ... + result = value.abs + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/any2array.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/any2array.rb new file mode 100644 index 0000000..e71407e --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/any2array.rb @@ -0,0 +1,33 @@ +# +# any2array.rb +# + +module Puppet::Parser::Functions + newfunction(:any2array, :type => :rvalue, :doc => <<-EOS +This converts any object to an array containing that object. Empty argument +lists are converted to an empty array. Arrays are left untouched. Hashes are +converted to arrays of alternating keys and values. + EOS + ) do |arguments| + + if arguments.empty? + return [] + end + + if arguments.length == 1 + if arguments[0].kind_of?(Array) + return arguments[0] + elsif arguments[0].kind_of?(Hash) + result = [] + arguments[0].each do |key, value| + result << key << value + end + return result + end + end + + return arguments + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/any2bool.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/any2bool.rb new file mode 100644 index 0000000..17612bf --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/any2bool.rb @@ -0,0 +1,54 @@ +# +# any2bool.rb +# + +module Puppet::Parser::Functions + newfunction(:any2bool, :type => :rvalue, :doc => <<-EOS +This converts 'anything' to a boolean. In practise it does the following: + +* Strings such as Y,y,1,T,t,TRUE,yes,'true' will return true +* Strings such as 0,F,f,N,n,FALSE,no,'false' will return false +* Booleans will just return their original value +* Number (or a string representation of a number) > 0 will return true, otherwise false +* undef will return false +* Anything else will return true + EOS + ) do |arguments| + + raise(Puppet::ParseError, "any2bool(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + # If argument is already Boolean, return it + if !!arguments[0] == arguments[0] + return arguments[0] + end + + arg = arguments[0] + + if arg == nil + return false + end + + if arg == :undef + return false + end + + valid_float = !!Float(arg) rescue false + + if arg.is_a?(Numeric) + return function_num2bool( [ arguments[0] ] ) + end + + if arg.is_a?(String) + if valid_float + return function_num2bool( [ arguments[0] ] ) + else + return function_str2bool( [ arguments[0] ] ) + end + end + + return true + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/assert_private.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/assert_private.rb new file mode 100644 index 0000000..62e2c6b --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/assert_private.rb @@ -0,0 +1,28 @@ +# +# assert_private.rb +# + +module Puppet::Parser::Functions + newfunction(:assert_private, :doc => <<-'EOS' + Sets the current class or definition as private. + Calling the class or definition from outside the current module will fail. + EOS + ) do |args| + + raise(Puppet::ParseError, "assert_private(): Wrong number of arguments given (#{args.size}}) for 0 or 1)") if args.size > 1 + + scope = self + if scope.lookupvar('module_name') != scope.lookupvar('caller_module_name') + message = nil + if args[0] and args[0].is_a? String + message = args[0] + else + manifest_name = scope.source.name + manifest_type = scope.source.type + message = (manifest_type.to_s == 'hostclass') ? 'Class' : 'Definition' + message += " #{manifest_name} is private" + end + raise(Puppet::ParseError, message) + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/base64.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/base64.rb new file mode 100644 index 0000000..d610146 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/base64.rb @@ -0,0 +1,71 @@ + +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +module Puppet::Parser::Functions + + newfunction(:base64, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args| + + Base64 encode or decode a string based on the command and the string submitted + + Usage: + + $encodestring = base64('encode', 'thestring') + $decodestring = base64('decode', 'dGhlc3RyaW5n') + + # explicitly define encode/decode method: default, strict, urlsafe + $method = 'default' + $encodestring = base64('encode', 'thestring', $method) + $decodestring = base64('decode', 'dGhlc3RyaW5n', $method) + + ENDHEREDOC + + require 'base64' + + raise Puppet::ParseError, ("base64(): Wrong number of arguments (#{args.length}; must be >= 2)") unless args.length >= 2 + + actions = ['encode','decode'] + + unless actions.include?(args[0]) + raise Puppet::ParseError, ("base64(): the first argument must be one of 'encode' or 'decode'") + end + + unless args[1].is_a?(String) + raise Puppet::ParseError, ("base64(): the second argument must be a string to base64") + end + + method = ['default','strict','urlsafe'] + + if args.length <= 2 + chosenMethod = 'default' + else + chosenMethod = args[2] + end + + unless method.include?(chosenMethod) + raise Puppet::ParseError, ("base64(): the third argument must be one of 'default', 'strict', or 'urlsafe'") + end + + case args[0] + when 'encode' + case chosenMethod + when 'default' + result = Base64.encode64(args[1]) + when 'strict' + result = Base64.strict_encode64(args[1]) + when 'urlsafe' + result = Base64.urlsafe_encode64(args[1]) + end + when 'decode' + case chosenMethod + when 'default' + result = Base64.decode64(args[1]) + when 'strict' + result = Base64.strict_decode64(args[1]) + when 'urlsafe' + result = Base64.urlsafe_decode64(args[1]) + end + end + + return result + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/basename.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/basename.rb new file mode 100644 index 0000000..f7e4438 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/basename.rb @@ -0,0 +1,34 @@ +module Puppet::Parser::Functions + newfunction(:basename, :type => :rvalue, :doc => <<-EOS + Strips directory (and optional suffix) from a filename + EOS + ) do |arguments| + + if arguments.size < 1 then + raise(Puppet::ParseError, "basename(): No arguments given") + elsif arguments.size > 2 then + raise(Puppet::ParseError, "basename(): Too many arguments given (#{arguments.size})") + else + + unless arguments[0].is_a?(String) + raise(Puppet::ParseError, 'basename(): Requires string as first argument') + end + + if arguments.size == 1 then + rv = File.basename(arguments[0]) + elsif arguments.size == 2 then + + unless arguments[1].is_a?(String) + raise(Puppet::ParseError, 'basename(): Requires string as second argument') + end + + rv = File.basename(arguments[0], arguments[1]) + end + + end + + return rv + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/bool2num.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/bool2num.rb new file mode 100644 index 0000000..92e4dde --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/bool2num.rb @@ -0,0 +1,25 @@ +# +# bool2num.rb +# + +module Puppet::Parser::Functions + newfunction(:bool2num, :type => :rvalue, :doc => <<-EOS + Converts a boolean to a number. Converts the values: + false, f, 0, n, and no to 0 + true, t, 1, y, and yes to 1 + Requires a single boolean or string as an input. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "bool2num(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = function_str2bool([arguments[0]]) + + # We have real boolean values as well ... + result = value ? 1 : 0 + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/bool2str.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/bool2str.rb new file mode 100644 index 0000000..37d4a4e --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/bool2str.rb @@ -0,0 +1,44 @@ +# +# bool2str.rb +# + +module Puppet::Parser::Functions + newfunction(:bool2str, :type => :rvalue, :doc => <<-EOS + Converts a boolean to a string using optionally supplied arguments. The + optional second and third arguments represent what true and false will be + converted to respectively. If only one argument is given, it will be + converted from a boolean to a string containing 'true' or 'false'. + + *Examples:* + + bool2str(true) => 'true' + bool2str(true, 'yes', 'no') => 'yes' + bool2str(false, 't', 'f') => 'f' + + Requires a single boolean as an input. + EOS + ) do |arguments| + + unless arguments.size == 1 or arguments.size == 3 + raise(Puppet::ParseError, "bool2str(): Wrong number of arguments given (#{arguments.size} for 3)") + end + + value = arguments[0] + true_string = arguments[1] || 'true' + false_string = arguments[2] || 'false' + klass = value.class + + # We can have either true or false, and nothing else + unless [FalseClass, TrueClass].include?(klass) + raise(Puppet::ParseError, 'bool2str(): Requires a boolean to work with') + end + + unless [true_string, false_string].all?{|x| x.kind_of?(String)} + raise(Puppet::ParseError, "bool2str(): Requires strings to convert to" ) + end + + return value ? true_string : false_string + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/camelcase.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/camelcase.rb new file mode 100644 index 0000000..085b3c6 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/camelcase.rb @@ -0,0 +1,32 @@ +# +# camelcase.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:camelcase, :type => :rvalue, :doc => <<-EOS +Converts the case of a string or all strings in an array to camel case. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "camelcase(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + klass = value.class + + unless [Array, String].include?(klass) + raise(Puppet::ParseError, 'camelcase(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.split('_').map{|e| e.capitalize}.join : i } + else + result = value.split('_').map{|e| e.capitalize}.join + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/capitalize.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/capitalize.rb new file mode 100644 index 0000000..096bc5d --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/capitalize.rb @@ -0,0 +1,30 @@ +# +# capitalize.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:capitalize, :type => :rvalue, :doc => <<-EOS + Capitalizes the first letter of a string or array of strings. + Requires either a single string or an array as an input. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "capitalize(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'capitalize(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.capitalize : i } + else + result = value.capitalize + end + + return result + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/ceiling.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/ceiling.rb new file mode 100644 index 0000000..bec4266 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/ceiling.rb @@ -0,0 +1,22 @@ +module Puppet::Parser::Functions + newfunction(:ceiling, :type => :rvalue, :doc => <<-EOS + Returns the smallest integer greater or equal to the argument. + Takes a single numeric value as an argument. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "ceiling(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + begin + arg = Float(arguments[0]) + rescue TypeError, ArgumentError => e + raise(Puppet::ParseError, "ceiling(): Wrong argument type given (#{arguments[0]} for Numeric)") + end + + raise(Puppet::ParseError, "ceiling(): Wrong argument type given (#{arg.class} for Numeric)") if arg.is_a?(Numeric) == false + + arg.ceil + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/chomp.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/chomp.rb new file mode 100644 index 0000000..f9da50f --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/chomp.rb @@ -0,0 +1,32 @@ +# +# chomp.rb +# + +module Puppet::Parser::Functions + newfunction(:chomp, :type => :rvalue, :doc => <<-'EOS' + Removes the record separator from the end of a string or an array of + strings, for example `hello\n` becomes `hello`. + Requires a single string or array as an input. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "chomp(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'chomp(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.chomp : i } + else + result = value.chomp + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/chop.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/chop.rb new file mode 100644 index 0000000..809349d --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/chop.rb @@ -0,0 +1,34 @@ +# +# chop.rb +# + +module Puppet::Parser::Functions + newfunction(:chop, :type => :rvalue, :doc => <<-'EOS' + Returns a new string with the last character removed. If the string ends + with `\r\n`, both characters are removed. Applying chop to an empty + string returns an empty string. If you wish to merely remove record + separators then you should use the `chomp` function. + Requires a string or array of strings as input. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "chop(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'chop(): Requires either an array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.chop : i } + else + result = value.chop + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/clamp.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/clamp.rb new file mode 100644 index 0000000..c4503fe --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/clamp.rb @@ -0,0 +1,29 @@ +# +# clamp.rb +# + +module Puppet::Parser::Functions + newfunction(:clamp, :type => :rvalue, :arity => -2, :doc => <<-EOS + Clamps value to a range. + EOS + ) do |args| + + args.flatten! + + raise(Puppet::ParseError, 'clamp(): Wrong number of arguments, need three to clamp') if args.size != 3 + + # check values out + args.each do |value| + case [value.class] + when [String] + raise(Puppet::ParseError, "clamp(): Required explicit numeric (#{value}:String)") unless value =~ /^\d+$/ + when [Hash] + raise(Puppet::ParseError, "clamp(): The Hash type is not allowed (#{value})") + end + end + + # convert to numeric each element + # then sort them and get a middle value + args.map{ |n| n.to_i }.sort[1] + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/concat.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/concat.rb new file mode 100644 index 0000000..0a49cfe --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/concat.rb @@ -0,0 +1,40 @@ +# +# concat.rb +# + +module Puppet::Parser::Functions + newfunction(:concat, :type => :rvalue, :doc => <<-EOS +Appends the contents of multiple arrays into array 1. + +*Example:* + + concat(['1','2','3'],['4','5','6'],['7','8','9']) + +Would result in: + + ['1','2','3','4','5','6','7','8','9'] + EOS + ) do |arguments| + + # Check that more than 2 arguments have been given ... + raise(Puppet::ParseError, "concat(): Wrong number of arguments given (#{arguments.size} for < 2)") if arguments.size < 2 + + a = arguments[0] + + # Check that the first parameter is an array + unless a.is_a?(Array) + raise(Puppet::ParseError, 'concat(): Requires array to work with') + end + + result = a + arguments.shift + + arguments.each do |x| + result = result + (x.is_a?(Array) ? x : [x]) + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/convert_base.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/convert_base.rb new file mode 100644 index 0000000..0fcbafe --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/convert_base.rb @@ -0,0 +1,35 @@ +module Puppet::Parser::Functions + + newfunction(:convert_base, :type => :rvalue, :arity => 2, :doc => <<-'ENDHEREDOC') do |args| + + Converts a given integer or base 10 string representing an integer to a specified base, as a string. + + Usage: + + $binary_repr = convert_base(5, 2) # $binary_repr is now set to "101" + $hex_repr = convert_base("254", "16") # $hex_repr is now set to "fe" + + ENDHEREDOC + + raise Puppet::ParseError, ("convert_base(): First argument must be either a string or an integer") unless (args[0].is_a?(Integer) or args[0].is_a?(String)) + raise Puppet::ParseError, ("convert_base(): Second argument must be either a string or an integer") unless (args[1].is_a?(Integer) or args[1].is_a?(String)) + + if args[0].is_a?(String) + raise Puppet::ParseError, ("convert_base(): First argument must be an integer or a string corresponding to an integer in base 10") unless args[0] =~ /^[0-9]+$/ + end + + if args[1].is_a?(String) + raise Puppet::ParseError, ("convert_base(): First argument must be an integer or a string corresponding to an integer in base 10") unless args[1] =~ /^[0-9]+$/ + end + + number_to_convert = args[0] + new_base = args[1] + + number_to_convert = number_to_convert.to_i() + new_base = new_base.to_i() + + raise Puppet::ParseError, ("convert_base(): base must be at least 2 and must not be greater than 36") unless new_base >= 2 and new_base <= 36 + + return number_to_convert.to_s(new_base) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/count.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/count.rb new file mode 100644 index 0000000..cef2637 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/count.rb @@ -0,0 +1,21 @@ +module Puppet::Parser::Functions + newfunction(:count, :type => :rvalue, :arity => -2, :doc => <<-EOS +Takes an array as first argument and an optional second argument. +Count the number of elements in array that matches second argument. +If called with only an array it counts the number of elements that are not nil/undef. + EOS + ) do |args| + + if (args.size > 2) then + raise(ArgumentError, "count(): Wrong number of arguments given #{args.size} for 1 or 2.") + end + + collection, item = args + + if item then + collection.count item + else + collection.count { |obj| obj != nil && obj != :undef && obj != '' } + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/deep_merge.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/deep_merge.rb new file mode 100644 index 0000000..6df32e9 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/deep_merge.rb @@ -0,0 +1,44 @@ +module Puppet::Parser::Functions + newfunction(:deep_merge, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args| + Recursively merges two or more hashes together and returns the resulting hash. + + For example: + + $hash1 = {'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } } + $hash2 = {'two' => 'dos', 'three' => { 'five' => 5 } } + $merged_hash = deep_merge($hash1, $hash2) + # The resulting hash is equivalent to: + # $merged_hash = { 'one' => 1, 'two' => 'dos', 'three' => { 'four' => 4, 'five' => 5 } } + + When there is a duplicate key that is a hash, they are recursively merged. + When there is a duplicate key that is not a hash, the key in the rightmost hash will "win." + + ENDHEREDOC + + if args.length < 2 + raise Puppet::ParseError, ("deep_merge(): wrong number of arguments (#{args.length}; must be at least 2)") + end + + deep_merge = Proc.new do |hash1,hash2| + hash1.merge(hash2) do |key,old_value,new_value| + if old_value.is_a?(Hash) && new_value.is_a?(Hash) + deep_merge.call(old_value, new_value) + else + new_value + end + end + end + + result = Hash.new + args.each do |arg| + next if arg.is_a? String and arg.empty? # empty string is synonym for puppet's undef + # If the argument was not a hash, skip it. + unless arg.is_a?(Hash) + raise Puppet::ParseError, "deep_merge: unexpected argument type #{arg.class}, only expects hash arguments" + end + + result = deep_merge.call(result, arg) + end + return( result ) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/defined_with_params.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/defined_with_params.rb new file mode 100644 index 0000000..99687ae --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/defined_with_params.rb @@ -0,0 +1,38 @@ +# Test whether a given class or definition is defined +require 'puppet/parser/functions' + +Puppet::Parser::Functions.newfunction(:defined_with_params, + :type => :rvalue, + :doc => <<-'ENDOFDOC' +Takes a resource reference and an optional hash of attributes. + +Returns true if a resource with the specified attributes has already been added +to the catalog, and false otherwise. + + user { 'dan': + ensure => present, + } + + if ! defined_with_params(User[dan], {'ensure' => 'present' }) { + user { 'dan': ensure => present, } + } +ENDOFDOC +) do |vals| + reference, params = vals + raise(ArgumentError, 'Must specify a reference') unless reference + if (! params) || params == '' + params = {} + end + ret = false + if resource = findresource(reference.to_s) + matches = params.collect do |key, value| + # eql? avoids bugs caused by monkeypatching in puppet + resource_is_undef = resource[key].eql?(:undef) || resource[key].nil? + value_is_undef = value.eql?(:undef) || value.nil? + (resource_is_undef && value_is_undef) || (resource[key] == value) + end + ret = params.empty? || !matches.include?(false) + end + Puppet.debug("Resource #{reference} was not determined to be defined") + ret +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/delete.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/delete.rb new file mode 100644 index 0000000..9dd5164 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/delete.rb @@ -0,0 +1,43 @@ +# +# delete.rb +# + +module Puppet::Parser::Functions + newfunction(:delete, :type => :rvalue, :doc => <<-EOS +Deletes all instances of a given element from an array, substring from a +string, or key from a hash. + +*Examples:* + + delete(['a','b','c','b'], 'b') + Would return: ['a','c'] + + delete({'a'=>1,'b'=>2,'c'=>3}, 'b') + Would return: {'a'=>1,'c'=>3} + + delete({'a'=>1,'b'=>2,'c'=>3}, ['b','c']) + Would return: {'a'=>1} + + delete('abracadabra', 'bra') + Would return: 'acada' + EOS + ) do |arguments| + + raise(Puppet::ParseError, "delete(): Wrong number of arguments given #{arguments.size} for 2") unless arguments.size == 2 + + collection = arguments[0].dup + Array(arguments[1]).each do |item| + case collection + when Array, Hash + collection.delete item + when String + collection.gsub! item, '' + else + raise(TypeError, "delete(): First argument must be an Array, String, or Hash. Given an argument of class #{collection.class}.") + end + end + collection + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/delete_at.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/delete_at.rb new file mode 100644 index 0000000..daf3721 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/delete_at.rb @@ -0,0 +1,46 @@ +# +# delete_at.rb +# + +module Puppet::Parser::Functions + newfunction(:delete_at, :type => :rvalue, :doc => <<-EOS +Deletes a determined indexed value from an array. + +*Examples:* + + delete_at(['a','b','c'], 1) + +Would return: ['a','c'] + EOS + ) do |arguments| + + raise(Puppet::ParseError, "delete_at(): Wrong number of arguments given (#{arguments.size} for 2)") if arguments.size < 2 + + array = arguments[0] + + unless array.is_a?(Array) + raise(Puppet::ParseError, 'delete_at(): Requires array to work with') + end + + index = arguments[1] + + if index.is_a?(String) and not index.match(/^\d+$/) + raise(Puppet::ParseError, 'delete_at(): You must provide non-negative numeric index') + end + + result = array.clone + + # Numbers in Puppet are often string-encoded which is troublesome ... + index = index.to_i + + if index > result.size - 1 # First element is at index 0 is it not? + raise(Puppet::ParseError, 'delete_at(): Given index exceeds size of array given') + end + + result.delete_at(index) # We ignore the element that got deleted ... + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/delete_regex.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/delete_regex.rb new file mode 100644 index 0000000..e5dc1fd --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/delete_regex.rb @@ -0,0 +1,44 @@ +# +# delete_regex.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:delete_regex, :type => :rvalue, :doc => <<-EOS +deletes all instances of a given element that match a regular expression +from an array or key from a hash. Multiple regular expressions are assumed +to be matched as an OR. + +*Examples:* + + delete_regex(['a','b','c','b'], 'b') + Would return: ['a','c'] + + delete_regex(['a','b','c','b'], ['b', 'c']) + Would return: ['a'] + + delete_regex({'a'=>1,'b'=>2,'c'=>3}, 'b') + Would return: {'a'=>1,'c'=>3} + + delete_regex({'a'=>1,'b'=>2,'c'=>3}, '^a$') + Would return: {'b'=>2,'c'=>3} + + EOS + ) do |arguments| + + raise(Puppet::ParseError, "delete_regex(): Wrong number of arguments given #{arguments.size} for 2") unless arguments.size == 2 + + collection = arguments[0].dup + Array(arguments[1]).each do |item| + case collection + when Array, Hash, String + collection.reject! { |coll_item| (coll_item =~ %r{\b#{item}\b}) } + else + raise(TypeError, "delete_regex(): First argument must be an Array, Hash, or String. Given an argument of class #{collection.class}.") + end + end + collection + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/delete_undef_values.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/delete_undef_values.rb new file mode 100644 index 0000000..00bd252 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/delete_undef_values.rb @@ -0,0 +1,31 @@ +module Puppet::Parser::Functions + newfunction(:delete_undef_values, :type => :rvalue, :doc => <<-EOS +Returns a copy of input hash or array with all undefs deleted. + +*Examples:* + + $hash = delete_undef_values({a=>'A', b=>'', c=>undef, d => false}) + +Would return: {a => 'A', b => '', d => false} + + $array = delete_undef_values(['A','',undef,false]) + +Would return: ['A','',false] + + EOS + ) do |args| + + raise(Puppet::ParseError, "delete_undef_values(): Wrong number of arguments given (#{args.size})") if args.size < 1 + + unless args[0].is_a? Array or args[0].is_a? Hash + raise(Puppet::ParseError, "delete_undef_values(): expected an array or hash, got #{args[0]} type #{args[0].class} ") + end + result = args[0].dup + if result.is_a?(Hash) + result.delete_if {|key, val| val.equal? :undef} + elsif result.is_a?(Array) + result.delete :undef + end + result + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/delete_values.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/delete_values.rb new file mode 100644 index 0000000..e799aef --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/delete_values.rb @@ -0,0 +1,23 @@ +module Puppet::Parser::Functions + newfunction(:delete_values, :type => :rvalue, :doc => <<-EOS +Deletes all instances of a given value from a hash. + +*Examples:* + + delete_values({'a'=>'A','b'=>'B','c'=>'C','B'=>'D'}, 'B') + +Would return: {'a'=>'A','c'=>'C','B'=>'D'} + + EOS + ) do |arguments| + + raise(Puppet::ParseError, "delete_values(): Wrong number of arguments given (#{arguments.size} of 2)") if arguments.size != 2 + + hash, item = arguments + + if not hash.is_a?(Hash) + raise(TypeError, "delete_values(): First argument must be a Hash. Given an argument of class #{hash.class}.") + end + hash.dup.delete_if { |key, val| item == val } + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/deprecation.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/deprecation.rb new file mode 100644 index 0000000..39d306a --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/deprecation.rb @@ -0,0 +1,16 @@ +module Puppet::Parser::Functions + newfunction(:deprecation, :doc => <<-EOS + Function to print deprecation warnings (this is the 3.X version of it), The uniqueness key - can appear once. The msg is the message text including any positional information that is formatted by the user/caller of the method.). +EOS + ) do |arguments| + + raise(Puppet::ParseError, "deprecation: Wrong number of arguments given (#{arguments.size} for 2)") unless arguments.size == 2 + + key = arguments[0] + message = arguments[1] + + if ENV['STDLIB_LOG_DEPRECATIONS'] == "true" + warning("deprecation. #{key}. #{message}") + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/difference.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/difference.rb new file mode 100644 index 0000000..c9ac478 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/difference.rb @@ -0,0 +1,35 @@ +# +# difference.rb +# + +module Puppet::Parser::Functions + newfunction(:difference, :type => :rvalue, :doc => <<-EOS +This function returns the difference between two arrays. +The returned array is a copy of the original array, removing any items that +also appear in the second array. + +*Examples:* + + difference(["a","b","c"],["b","c","d"]) + +Would return: ["a"] + EOS + ) do |arguments| + + # Two arguments are required + raise(Puppet::ParseError, "difference(): Wrong number of arguments given (#{arguments.size} for 2)") if arguments.size != 2 + + first = arguments[0] + second = arguments[1] + + unless first.is_a?(Array) && second.is_a?(Array) + raise(Puppet::ParseError, 'difference(): Requires 2 arrays') + end + + result = first - second + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/dig.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/dig.rb new file mode 100644 index 0000000..34fa701 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/dig.rb @@ -0,0 +1,16 @@ +# +# dig.rb +# + +module Puppet::Parser::Functions + newfunction(:dig, :type => :rvalue, :doc => <<-EOS + DEPRECATED: This function has been replaced in Puppet 4.5.0, please use dig44() for backwards compatibility or use the new version. + EOS + ) do |arguments| + warning("dig() DEPRECATED: This function has been replaced in Puppet 4.5.0, please use dig44() for backwards compatibility or use the new version.") + if ! Puppet::Parser::Functions.autoloader.loaded?(:dig44) + Puppet::Parser::Functions.autoloader.load(:dig44) + end + function_dig44(arguments) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/dig44.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/dig44.rb new file mode 100644 index 0000000..21c0a8c --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/dig44.rb @@ -0,0 +1,70 @@ +# +# dig44.rb +# + +module Puppet::Parser::Functions + newfunction( + :dig44, + :type => :rvalue, + :arity => -2, + :doc => <<-eos +DEPRECATED: This function has been replaced in puppet 4.5.0. + +Looks up into a complex structure of arrays and hashes and returns a value +or the default value if nothing was found. + +Key can contain slashes to describe path components. The function will go down +the structure and try to extract the required value. + +$data = { + 'a' => { + 'b' => [ + 'b1', + 'b2', + 'b3', + ] + } +} + +$value = dig44($data, ['a', 'b', '2'], 'not_found') +=> $value = 'b3' + +a -> first hash key +b -> second hash key +2 -> array index starting with 0 + +not_found -> (optional) will be returned if there is no value or the path +did not match. Defaults to nil. + +In addition to the required "key" argument, the function accepts a default +argument. It will be returned if no value was found or a path component is +missing. And the fourth argument can set a variable path separator. + eos + ) do |arguments| + # Two arguments are required + raise(Puppet::ParseError, "dig44(): Wrong number of arguments given (#{arguments.size} for at least 2)") if arguments.size < 2 + + data, path, default = *arguments + + unless data.is_a?(Hash) or data.is_a?(Array) + raise(Puppet::ParseError, "dig44(): first argument must be a hash or an array, given #{data.class.name}") + end + + unless path.is_a? Array + raise(Puppet::ParseError, "dig44(): second argument must be an array, given #{path.class.name}") + end + + value = path.reduce(data) do |structure, key| + if structure.is_a? Hash or structure.is_a? Array + if structure.is_a? Array + key = Integer key rescue break + end + break if structure[key].nil? or structure[key] == :undef + structure[key] + else + break + end + end + value.nil? ? default : value + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/dirname.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/dirname.rb new file mode 100644 index 0000000..40b300d --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/dirname.rb @@ -0,0 +1,21 @@ +module Puppet::Parser::Functions + newfunction(:dirname, :type => :rvalue, :doc => <<-EOS + Returns the dirname of a path. + EOS + ) do |arguments| + + if arguments.size < 1 then + raise(Puppet::ParseError, "dirname(): No arguments given") + end + if arguments.size > 1 then + raise(Puppet::ParseError, "dirname(): Too many arguments given (#{arguments.size})") + end + unless arguments[0].is_a?(String) + raise(Puppet::ParseError, 'dirname(): Requires string as argument') + end + + return File.dirname(arguments[0]) + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/dos2unix.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/dos2unix.rb new file mode 100644 index 0000000..ccac899 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/dos2unix.rb @@ -0,0 +1,15 @@ +# Custom Puppet function to convert dos to unix format +module Puppet::Parser::Functions + newfunction(:dos2unix, :type => :rvalue, :arity => 1, :doc => <<-EOS + Returns the Unix version of the given string. + Takes a single string argument. + EOS + ) do |arguments| + + unless arguments[0].is_a?(String) + raise(Puppet::ParseError, 'dos2unix(): Requires string as argument') + end + + arguments[0].gsub(/\r\n/, "\n") + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/downcase.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/downcase.rb new file mode 100644 index 0000000..ab04f8a --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/downcase.rb @@ -0,0 +1,31 @@ +# +# downcase.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:downcase, :type => :rvalue, :doc => <<-EOS +Converts the case of a string or all strings in an array to lower case. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "downcase(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'downcase(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.downcase : i } + else + result = value.downcase + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/empty.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/empty.rb new file mode 100644 index 0000000..4f77ad3 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/empty.rb @@ -0,0 +1,29 @@ +# +# empty.rb +# + +module Puppet::Parser::Functions + newfunction(:empty, :type => :rvalue, :doc => <<-EOS +Returns true if the variable is empty. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "empty(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(Hash) || value.is_a?(String) || value.is_a?(Numeric) + raise(Puppet::ParseError, 'empty(): Requires either array, hash, string or integer to work with') + end + + if value.is_a?(Numeric) + return false + else + result = value.empty? + + return result + end + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/enclose_ipv6.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/enclose_ipv6.rb new file mode 100644 index 0000000..1f8a454 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/enclose_ipv6.rb @@ -0,0 +1,42 @@ +# +# enclose_ipv6.rb +# + +module Puppet::Parser::Functions + newfunction(:enclose_ipv6, :type => :rvalue, :doc => <<-EOS +Takes an array of ip addresses and encloses the ipv6 addresses with square brackets. + EOS + ) do |arguments| + + require 'ipaddr' + + rescuable_exceptions = [ ArgumentError ] + if defined?(IPAddr::InvalidAddressError) + rescuable_exceptions << IPAddr::InvalidAddressError + end + + if (arguments.size != 1) then + raise(Puppet::ParseError, "enclose_ipv6(): Wrong number of arguments given #{arguments.size} for 1") + end + unless arguments[0].is_a?(String) or arguments[0].is_a?(Array) then + raise(Puppet::ParseError, "enclose_ipv6(): Wrong argument type given #{arguments[0].class} expected String or Array") + end + + input = [arguments[0]].flatten.compact + result = [] + + input.each do |val| + unless val == '*' + begin + ip = IPAddr.new(val) + rescue *rescuable_exceptions + raise(Puppet::ParseError, "enclose_ipv6(): Wrong argument given #{val} is not an ip address.") + end + val = "[#{ip.to_s}]" if ip.ipv6? + end + result << val + end + + return result.uniq + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/ensure_packages.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/ensure_packages.rb new file mode 100644 index 0000000..17942b8 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/ensure_packages.rb @@ -0,0 +1,47 @@ +# +# ensure_packages.rb +# + +module Puppet::Parser::Functions + newfunction(:ensure_packages, :type => :statement, :doc => <<-EOS +Takes a list of packages and only installs them if they don't already exist. +It optionally takes a hash as a second parameter that will be passed as the +third argument to the ensure_resource() function. + EOS + ) do |arguments| + + if arguments.size > 2 or arguments.size == 0 + raise(Puppet::ParseError, "ensure_packages(): Wrong number of arguments given (#{arguments.size} for 1 or 2)") + elsif arguments.size == 2 and !arguments[1].is_a?(Hash) + raise(Puppet::ParseError, 'ensure_packages(): Requires second argument to be a Hash') + end + + if arguments[0].is_a?(Hash) + if arguments[1] + defaults = { 'ensure' => 'present' }.merge(arguments[1]) + else + defaults = { 'ensure' => 'present' } + end + + Puppet::Parser::Functions.function(:ensure_resources) + function_ensure_resources(['package', arguments[0].dup, defaults ]) + else + packages = Array(arguments[0]) + + if arguments[1] + defaults = { 'ensure' => 'present' }.merge(arguments[1]) + else + defaults = { 'ensure' => 'present' } + end + + Puppet::Parser::Functions.function(:ensure_resource) + packages.each { |package_name| + if !findresource("Package[#{package_name}]") + function_ensure_resource(['package', package_name, defaults ]) + end + } + end + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/ensure_resource.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/ensure_resource.rb new file mode 100644 index 0000000..1ba6a44 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/ensure_resource.rb @@ -0,0 +1,46 @@ +# Test whether a given class or definition is defined +require 'puppet/parser/functions' + +Puppet::Parser::Functions.newfunction(:ensure_resource, + :type => :statement, + :doc => <<-'ENDOFDOC' +Takes a resource type, title, and a list of attributes that describe a +resource. + + user { 'dan': + ensure => present, + } + +This example only creates the resource if it does not already exist: + + ensure_resource('user', 'dan', {'ensure' => 'present' }) + +If the resource already exists but does not match the specified parameters, +this function will attempt to recreate the resource leading to a duplicate +resource definition error. + +An array of resources can also be passed in and each will be created with +the type and parameters specified if it doesn't already exist. + + ensure_resource('user', ['dan','alex'], {'ensure' => 'present'}) + +ENDOFDOC +) do |vals| + type, title, params = vals + raise(ArgumentError, 'Must specify a type') unless type + raise(ArgumentError, 'Must specify a title') unless title + params ||= {} + + items = [title].flatten + + items.each do |item| + Puppet::Parser::Functions.function(:defined_with_params) + if function_defined_with_params(["#{type}[#{item}]", params]) + Puppet.debug("Resource #{type}[#{item}] with params #{params} not created because it already exists") + else + Puppet.debug("Create new resource #{type}[#{item}] with params #{params}") + Puppet::Parser::Functions.function(:create_resources) + function_create_resources([type.capitalize, { item => params }]) + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/ensure_resources.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/ensure_resources.rb new file mode 100644 index 0000000..b3c51e6 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/ensure_resources.rb @@ -0,0 +1,54 @@ +require 'puppet/parser/functions' + +Puppet::Parser::Functions.newfunction(:ensure_resources, + :type => :statement, + :doc => <<-'ENDOFDOC' +Takes a resource type, title (only hash), and a list of attributes that describe a +resource. + + user { 'dan': + gid => 'mygroup', + ensure => present, + } + +An hash of resources should be passed in and each will be created with +the type and parameters specified if it doesn't already exist. + + ensure_resources('user', {'dan' => { gid => 'mygroup', uid => '600' } , 'alex' => { gid => 'mygroup' }}, {'ensure' => 'present'}) + +From Hiera Backend: + +userlist: + dan: + gid: 'mygroup' + uid: '600' + alex: + gid: 'mygroup' + +Call: +ensure_resources('user', hiera_hash('userlist'), {'ensure' => 'present'}) + +ENDOFDOC +) do |vals| + type, title, params = vals + raise(ArgumentError, 'Must specify a type') unless type + raise(ArgumentError, 'Must specify a title') unless title + params ||= {} + + if title.is_a?(Hash) + resource_hash = title.dup + resources = resource_hash.keys + + Puppet::Parser::Functions.function(:ensure_resource) + resources.each { |resource_name| + if resource_hash[resource_name] + params_merged = params.merge(resource_hash[resource_name]) + else + params_merged = params + end + function_ensure_resource([ type, resource_name, params_merged ]) + } + else + raise(Puppet::ParseError, 'ensure_resources(): Requires second argument to be a Hash') + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/flatten.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/flatten.rb new file mode 100644 index 0000000..4401bdb --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/flatten.rb @@ -0,0 +1,32 @@ +# +# flatten.rb +# + +module Puppet::Parser::Functions + newfunction(:flatten, :type => :rvalue, :doc => <<-EOS +This function flattens any deeply nested arrays and returns a single flat array +as a result. + +*Examples:* + + flatten(['a', ['b', ['c']]]) + +Would return: ['a','b','c'] + EOS + ) do |arguments| + + raise(Puppet::ParseError, "flatten(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + array = arguments[0] + + unless array.is_a?(Array) + raise(Puppet::ParseError, 'flatten(): Requires array to work with') + end + + result = array.flatten + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/floor.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/floor.rb new file mode 100644 index 0000000..9e4b504 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/floor.rb @@ -0,0 +1,22 @@ +module Puppet::Parser::Functions + newfunction(:floor, :type => :rvalue, :doc => <<-EOS + Returns the largest integer less or equal to the argument. + Takes a single numeric value as an argument. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "floor(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + begin + arg = Float(arguments[0]) + rescue TypeError, ArgumentError => e + raise(Puppet::ParseError, "floor(): Wrong argument type given (#{arguments[0]} for Numeric)") + end + + raise(Puppet::ParseError, "floor(): Wrong argument type given (#{arg.class} for Numeric)") if arg.is_a?(Numeric) == false + + arg.floor + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/fqdn_rand_string.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/fqdn_rand_string.rb new file mode 100644 index 0000000..2bb1287 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/fqdn_rand_string.rb @@ -0,0 +1,34 @@ +Puppet::Parser::Functions::newfunction( + :fqdn_rand_string, + :arity => -2, + :type => :rvalue, + :doc => "Usage: `fqdn_rand_string(LENGTH, [CHARSET], [SEED])`. LENGTH is + required and must be a positive integer. CHARSET is optional and may be + `undef` or a string. SEED is optional and may be any number or string. + + Generates a random string LENGTH characters long using the character set + provided by CHARSET, combining the `$fqdn` fact and the value of SEED for + repeatable randomness. (That is, each node will get a different random + string from this function, but a given node's result will be the same every + time unless its hostname changes.) Adding a SEED can be useful if you need + more than one unrelated string. CHARSET will default to alphanumeric if + `undef` or an empty string.") do |args| + raise(ArgumentError, "fqdn_rand_string(): wrong number of arguments (0 for 1)") if args.size == 0 + Puppet::Parser::Functions.function('is_integer') + raise(ArgumentError, "fqdn_rand_string(): first argument must be a positive integer") unless function_is_integer([args[0]]) and args[0].to_i > 0 + raise(ArgumentError, "fqdn_rand_string(): second argument must be undef or a string") unless args[1].nil? or args[1].is_a? String + + Puppet::Parser::Functions.function('fqdn_rand') + + length = args.shift.to_i + charset = args.shift.to_s.chars.to_a + + charset = (0..9).map { |i| i.to_s } + ('A'..'Z').to_a + ('a'..'z').to_a if charset.empty? + + rand_string = '' + for current in 1..length + rand_string << charset[function_fqdn_rand([charset.size, (args + [current.to_s]).join(':')]).to_i] + end + + rand_string +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/fqdn_rotate.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/fqdn_rotate.rb new file mode 100644 index 0000000..05bdcc7 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/fqdn_rotate.rb @@ -0,0 +1,61 @@ +# +# fqdn_rotate.rb +# + +Puppet::Parser::Functions.newfunction( + :fqdn_rotate, + :type => :rvalue, + :doc => "Usage: `fqdn_rotate(VALUE, [SEED])`. VALUE is required and + must be an array or a string. SEED is optional and may be any number + or string. + + Rotates VALUE a random number of times, combining the `$fqdn` fact and + the value of SEED for repeatable randomness. (That is, each node will + get a different random rotation from this function, but a given node's + result will be the same every time unless its hostname changes.) Adding + a SEED can be useful if you need more than one unrelated rotation.") do |args| + + raise(Puppet::ParseError, "fqdn_rotate(): Wrong number of arguments given (#{args.size} for 1)") if args.size < 1 + + value = args.shift + require 'digest/md5' + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'fqdn_rotate(): Requires either array or string to work with') + end + + result = value.clone + + string = value.is_a?(String) ? true : false + + # Check whether it makes sense to rotate ... + return result if result.size <= 1 + + # We turn any string value into an array to be able to rotate ... + result = string ? result.split('') : result + + elements = result.size + + seed = Digest::MD5.hexdigest([lookupvar('::fqdn'),args].join(':')).hex + # deterministic_rand() was added in Puppet 3.2.0; reimplement if necessary + if Puppet::Util.respond_to?(:deterministic_rand) + offset = Puppet::Util.deterministic_rand(seed, elements).to_i + else + if defined?(Random) == 'constant' && Random.class == Class + offset = Random.new(seed).rand(elements) + else + old_seed = srand(seed) + offset = rand(elements) + srand(old_seed) + end + end + offset.times { + result.push result.shift + } + + result = string ? result.join : result + + return result +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/fqdn_uuid.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/fqdn_uuid.rb new file mode 100644 index 0000000..30205d0 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/fqdn_uuid.rb @@ -0,0 +1,92 @@ +require 'digest/sha1' + +module Puppet::Parser::Functions + newfunction(:fqdn_uuid, :type => :rvalue, :doc => <<-END) do |args| + + Creates a UUID based on a given string, assumed to be the FQDN + + For example, to generate a UUID based on the FQDN of a system: + + Usage: + + $uuid = fqdn_uuid($::fqdn) + + The generated UUID will be the same for the given hostname + + The resulting UUID is returned on the form: + + 1d839dea-5e10-5243-88eb-e66815bd7d5c + + (u.e. without any curly braces.) + + The generated UUID is a version 5 UUID with the V5 DNS namespace: + + 6ba7b810-9dad-11d1-80b4-00c04fd430c8 + + This only supports a the V5 SHA-1 hash, using the DNS namespace. + + Please consult http://www.ietf.org/rfc/rfc4122.txt for the details on + UUID generation and example implementation. + + No verification is present at the moment as whether the domain name given + is in fact a correct fully-qualified domain name. Therefore any arbitrary + string and/or alpha-numeric value can subside for a domain name. + EOS + + END + + if args.length == 0 + raise(ArgumentError, "fqdn_uuid: No arguments given") + elsif args.length == 1 + fqdn = args[0] + else + raise(ArgumentError, "fqdn_uuid: Too many arguments given (#{args.length})") + end + + # Code lovingly taken from + # https://github.com/puppetlabs/marionette-collective/blob/master/lib/mcollective/ssl.rb + + # This is the UUID version 5 type DNS name space which is as follows: + # + # 6ba7b810-9dad-11d1-80b4-00c04fd430c8 + # + uuid_name_space_dns = [0x6b, + 0xa7, + 0xb8, + 0x10, + 0x9d, + 0xad, + 0x11, + 0xd1, + 0x80, + 0xb4, + 0x00, + 0xc0, + 0x4f, + 0xd4, + 0x30, + 0xc8 + ].map {|b| b.chr}.join + + sha1 = Digest::SHA1.new + sha1.update(uuid_name_space_dns) + sha1.update(fqdn) + + # first 16 bytes.. + bytes = sha1.digest[0, 16].bytes.to_a + + # version 5 adjustments + bytes[6] &= 0x0f + bytes[6] |= 0x50 + + # variant is DCE 1.1 + bytes[8] &= 0x3f + bytes[8] |= 0x80 + + bytes = [4, 2, 2, 2, 6].collect do |i| + bytes.slice!(0, i).pack('C*').unpack('H*') + end + + bytes.join('-') + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/get_module_path.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/get_module_path.rb new file mode 100644 index 0000000..1421b91 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/get_module_path.rb @@ -0,0 +1,17 @@ +module Puppet::Parser::Functions + newfunction(:get_module_path, :type =>:rvalue, :doc => <<-EOT + Returns the absolute path of the specified module for the current + environment. + + Example: + $module_path = get_module_path('stdlib') + EOT + ) do |args| + raise(Puppet::ParseError, "get_module_path(): Wrong number of arguments, expects one") unless args.size == 1 + if module_path = Puppet::Module.find(args[0], compiler.environment.to_s) + module_path.path + else + raise(Puppet::ParseError, "Could not find module #{args[0]} in environment #{compiler.environment}") + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/getparam.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/getparam.rb new file mode 100644 index 0000000..0a5cbe0 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/getparam.rb @@ -0,0 +1,35 @@ +# Test whether a given class or definition is defined +require 'puppet/parser/functions' + +Puppet::Parser::Functions.newfunction(:getparam, + :type => :rvalue, + :doc => <<-'ENDOFDOC' +Takes a resource reference and name of the parameter and +returns value of resource's parameter. + +*Examples:* + + define example_resource($param) { + } + + example_resource { "example_resource_instance": + param => "param_value" + } + + getparam(Example_resource["example_resource_instance"], "param") + +Would return: param_value +ENDOFDOC +) do |vals| + reference, param = vals + raise(ArgumentError, 'Must specify a reference') unless reference + raise(ArgumentError, 'Must specify name of a parameter') unless param and param.instance_of? String + + return '' if param.empty? + + if resource = findresource(reference.to_s) + return resource[param] unless resource[param].nil? + end + + return '' +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/getvar.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/getvar.rb new file mode 100644 index 0000000..3af8d48 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/getvar.rb @@ -0,0 +1,35 @@ +module Puppet::Parser::Functions + + newfunction(:getvar, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args| + Lookup a variable in a remote namespace. + + For example: + + $foo = getvar('site::data::foo') + # Equivalent to $foo = $site::data::foo + + This is useful if the namespace itself is stored in a string: + + $datalocation = 'site::data' + $bar = getvar("${datalocation}::bar") + # Equivalent to $bar = $site::data::bar + ENDHEREDOC + + unless args.length == 1 + raise Puppet::ParseError, ("getvar(): wrong number of arguments (#{args.length}; must be 1)") + end + + begin + result = nil + catch(:undefined_variable) do + result = self.lookupvar("#{args[0]}") + end + + # avoid relying on incosistent behaviour around ruby return values from catch + result + rescue Puppet::ParseError # Eat the exception if strict_variables = true is set + end + + end + +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/grep.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/grep.rb new file mode 100644 index 0000000..c611a7e --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/grep.rb @@ -0,0 +1,32 @@ +# +# grep.rb +# + +module Puppet::Parser::Functions + newfunction(:grep, :type => :rvalue, :doc => <<-EOS +This function searches through an array and returns any elements that match +the provided regular expression. + +*Examples:* + + grep(['aaa','bbb','ccc','aaaddd'], 'aaa') + +Would return: + + ['aaa','aaaddd'] + EOS + ) do |arguments| + + if (arguments.size != 2) then + raise(Puppet::ParseError, "grep(): Wrong number of arguments given #{arguments.size} for 2") + end + + a = arguments[0] + pattern = Regexp.new(arguments[1]) + + a.grep(pattern) + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/has_interface_with.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/has_interface_with.rb new file mode 100644 index 0000000..f6cb74b --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/has_interface_with.rb @@ -0,0 +1,70 @@ +# +# has_interface_with +# + +module Puppet::Parser::Functions + newfunction(:has_interface_with, :type => :rvalue, :doc => <<-EOS +Returns boolean based on kind and value: + * macaddress + * netmask + * ipaddress + * network + +has_interface_with("macaddress", "x:x:x:x:x:x") +has_interface_with("ipaddress", "127.0.0.1") => true +etc. + +If no "kind" is given, then the presence of the interface is checked: +has_interface_with("lo") => true + EOS + ) do |args| + + raise(Puppet::ParseError, "has_interface_with(): Wrong number of arguments given (#{args.size} for 1 or 2)") if args.size < 1 or args.size > 2 + + interfaces = lookupvar('interfaces') + + # If we do not have any interfaces, then there are no requested attributes + return false if (interfaces == :undefined || interfaces.nil?) + + interfaces = interfaces.split(',') + + if args.size == 1 + return interfaces.member?(args[0]) + end + + kind, value = args + + # Bug with 3.7.1 - 3.7.3 when using future parser throws :undefined_variable + # https://tickets.puppetlabs.com/browse/PUP-3597 + factval = nil + begin + catch :undefined_variable do + factval = lookupvar(kind) + end + rescue Puppet::ParseError # Eat the exception if strict_variables = true is set + end + if factval == value + return true + end + + result = false + interfaces.each do |iface| + iface.downcase! + factval = nil + begin + # Bug with 3.7.1 - 3.7.3 when using future parser throws :undefined_variable + # https://tickets.puppetlabs.com/browse/PUP-3597 + catch :undefined_variable do + factval = lookupvar("#{kind}_#{iface}") + end + rescue Puppet::ParseError # Eat the exception if strict_variables = true is set + end + if value == factval + result = true + break + end + end + + result + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/has_ip_address.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/has_ip_address.rb new file mode 100644 index 0000000..a0071c8 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/has_ip_address.rb @@ -0,0 +1,24 @@ +# +# has_ip_address +# + +module Puppet::Parser::Functions + newfunction(:has_ip_address, :type => :rvalue, :doc => <<-EOS +Returns true if the client has the requested IP address on some interface. + +This function iterates through the 'interfaces' fact and checks the +'ipaddress_IFACE' facts, performing a simple string comparison. + EOS + ) do |args| + + raise(Puppet::ParseError, "has_ip_address(): Wrong number of arguments given (#{args.size} for 1)") if args.size != 1 + + Puppet::Parser::Functions.autoloader.load(:has_interface_with) \ + unless Puppet::Parser::Functions.autoloader.loaded?(:has_interface_with) + + function_has_interface_with(['ipaddress', args[0]]) + + end +end + +# vim:sts=2 sw=2 diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/has_ip_network.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/has_ip_network.rb new file mode 100644 index 0000000..b02c0c0 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/has_ip_network.rb @@ -0,0 +1,24 @@ +# +# has_ip_network +# + +module Puppet::Parser::Functions + newfunction(:has_ip_network, :type => :rvalue, :doc => <<-EOS +Returns true if the client has an IP address within the requested network. + +This function iterates through the 'interfaces' fact and checks the +'network_IFACE' facts, performing a simple string comparision. + EOS + ) do |args| + + raise(Puppet::ParseError, "has_ip_network(): Wrong number of arguments given (#{args.size} for 1)") if args.size != 1 + + Puppet::Parser::Functions.autoloader.load(:has_interface_with) \ + unless Puppet::Parser::Functions.autoloader.loaded?(:has_interface_with) + + function_has_interface_with(['network', args[0]]) + + end +end + +# vim:sts=2 sw=2 diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/has_key.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/has_key.rb new file mode 100644 index 0000000..4657cc2 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/has_key.rb @@ -0,0 +1,28 @@ +module Puppet::Parser::Functions + + newfunction(:has_key, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args| + Determine if a hash has a certain key value. + + Example: + + $my_hash = {'key_one' => 'value_one'} + if has_key($my_hash, 'key_two') { + notice('we will not reach here') + } + if has_key($my_hash, 'key_one') { + notice('this will be printed') + } + + ENDHEREDOC + + unless args.length == 2 + raise Puppet::ParseError, ("has_key(): wrong number of arguments (#{args.length}; must be 2)") + end + unless args[0].is_a?(Hash) + raise Puppet::ParseError, "has_key(): expects the first argument to be a hash, got #{args[0].inspect} which is of type #{args[0].class}" + end + args[0].has_key?(args[1]) + + end + +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/hash.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/hash.rb new file mode 100644 index 0000000..22763f3 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/hash.rb @@ -0,0 +1,39 @@ +# +# hash.rb +# + +module Puppet::Parser::Functions + newfunction(:hash, :type => :rvalue, :doc => <<-EOS +This function converts an array into a hash. + +*Examples:* + + hash(['a',1,'b',2,'c',3]) + +Would return: {'a'=>1,'b'=>2,'c'=>3} + EOS + ) do |arguments| + + raise(Puppet::ParseError, "hash(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + array = arguments[0] + + unless array.is_a?(Array) + raise(Puppet::ParseError, 'hash(): Requires array to work with') + end + + result = {} + + begin + # This is to make it compatible with older version of Ruby ... + array = array.flatten + result = Hash[*array] + rescue StandardError + raise(Puppet::ParseError, 'hash(): Unable to compute hash from array given') + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/intersection.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/intersection.rb new file mode 100644 index 0000000..8a438f4 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/intersection.rb @@ -0,0 +1,33 @@ +# +# intersection.rb +# + +module Puppet::Parser::Functions + newfunction(:intersection, :type => :rvalue, :doc => <<-EOS +This function returns an array of the intersection of two. + +*Examples:* + + intersection(["a","b","c"],["b","c","d"]) # returns ["b","c"] + intersection(["a","b","c"],[1,2,3,4]) # returns [] (true, when evaluated as a Boolean) + + EOS + ) do |arguments| + + # Two arguments are required + raise(Puppet::ParseError, "intersection(): Wrong number of arguments given (#{arguments.size} for 2)") if arguments.size != 2 + + first = arguments[0] + second = arguments[1] + + unless first.is_a?(Array) && second.is_a?(Array) + raise(Puppet::ParseError, 'intersection(): Requires 2 arrays') + end + + result = first & second + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_absolute_path.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_absolute_path.rb new file mode 100644 index 0000000..e64777f --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_absolute_path.rb @@ -0,0 +1,50 @@ +module Puppet::Parser::Functions + newfunction(:is_absolute_path, :type => :rvalue, :arity => 1, :doc => <<-'ENDHEREDOC') do |args| + Returns boolean true if the string represents an absolute path in the filesystem. This function works + for windows and unix style paths. + + The following values will return true: + + $my_path = 'C:/Program Files (x86)/Puppet Labs/Puppet' + is_absolute_path($my_path) + $my_path2 = '/var/lib/puppet' + is_absolute_path($my_path2) + $my_path3 = ['C:/Program Files (x86)/Puppet Labs/Puppet'] + is_absolute_path($my_path3) + $my_path4 = ['/var/lib/puppet'] + is_absolute_path($my_path4) + + The following values will return false: + + is_absolute_path(true) + is_absolute_path('../var/lib/puppet') + is_absolute_path('var/lib/puppet') + $undefined = undef + is_absolute_path($undefined) + + ENDHEREDOC + function_deprecation([:is_absolute_path, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Absolute_path. There is further documentation for validate_legacy function in the README.']) + require 'puppet/util' + + path = args[0] + # This logic was borrowed from + # [lib/puppet/file_serving/base.rb](https://github.com/puppetlabs/puppet/blob/master/lib/puppet/file_serving/base.rb) + # Puppet 2.7 and beyond will have Puppet::Util.absolute_path? Fall back to a back-ported implementation otherwise. + if Puppet::Util.respond_to?(:absolute_path?) then + value = (Puppet::Util.absolute_path?(path, :posix) or Puppet::Util.absolute_path?(path, :windows)) + else + # This code back-ported from 2.7.x's lib/puppet/util.rb Puppet::Util.absolute_path? + # Determine in a platform-specific way whether a path is absolute. This + # defaults to the local platform if none is specified. + # Escape once for the string literal, and once for the regex. + slash = '[\\\\/]' + name = '[^\\\\/]+' + regexes = { + :windows => %r!^(([A-Z]:#{slash})|(#{slash}#{slash}#{name}#{slash}#{name})|(#{slash}#{slash}\?#{slash}#{name}))!i, + :posix => %r!^/! + } + value = (!!(path =~ regexes[:posix])) || (!!(path =~ regexes[:windows])) + end + value + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_array.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_array.rb new file mode 100644 index 0000000..a33afe4 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_array.rb @@ -0,0 +1,21 @@ +# +# is_array.rb +# + +module Puppet::Parser::Functions + newfunction(:is_array, :type => :rvalue, :doc => <<-EOS +Returns true if the variable passed to this function is an array. + EOS + ) do |arguments| + + function_deprecation([:is_array, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Array. There is further documentation for validate_legacy function in the README.']) + + raise(Puppet::ParseError, "is_array(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + type = arguments[0] + + result = type.is_a?(Array) + + return result + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_bool.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_bool.rb new file mode 100644 index 0000000..2ebe430 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_bool.rb @@ -0,0 +1,21 @@ +# +# is_bool.rb +# + +module Puppet::Parser::Functions + newfunction(:is_bool, :type => :rvalue, :doc => <<-EOS +Returns true if the variable passed to this function is a boolean. + EOS + ) do |arguments| + + function_deprecation([:is_bool, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Bool. There is further documentation for validate_legacy function in the README.']) + + raise(Puppet::ParseError, "is_bool(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + type = arguments[0] + + result = type.is_a?(TrueClass) || type.is_a?(FalseClass) + + return result + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_domain_name.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_domain_name.rb new file mode 100644 index 0000000..247db3b --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_domain_name.rb @@ -0,0 +1,53 @@ +# +# is_domain_name.rb +# + +module Puppet::Parser::Functions + newfunction(:is_domain_name, :type => :rvalue, :doc => <<-EOS +Returns true if the string passed to this function is a syntactically correct domain name. + EOS + ) do |arguments| + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_domain_name(): Wrong number of arguments given #{arguments.size} for 1") + end + + # Only allow string types + return false unless arguments[0].is_a?(String) + + domain = arguments[0].dup + + # Limits (rfc1035, 3.1) + domain_max_length=255 + label_min_length=1 + label_max_length=63 + + # Allow ".", it is the top level domain + return true if domain == '.' + + # Remove the final dot, if present. + domain.chomp!('.') + + # Check the whole domain + return false if domain.empty? + return false if domain.length > domain_max_length + + # The top level domain must be alphabetic if there are multiple labels. + # See rfc1123, 2.1 + return false if domain.include? '.' and not /\.[A-Za-z]+$/.match(domain) + + # Check each label in the domain + labels = domain.split('.') + vlabels = labels.each do |label| + break if label.length < label_min_length + break if label.length > label_max_length + break if label[-1..-1] == '-' + break if label[0..0] == '-' + break unless /^[a-z\d-]+$/i.match(label) + end + return vlabels == labels + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_email_address.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_email_address.rb new file mode 100644 index 0000000..bcd7921 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_email_address.rb @@ -0,0 +1,20 @@ +# +# is_email_address.rb +# + +module Puppet::Parser::Functions + newfunction(:is_email_address, :type => :rvalue, :doc => <<-EOS +Returns true if the string passed to this function is a valid email address. + EOS + ) do |arguments| + if arguments.size != 1 + raise(Puppet::ParseError, "is_email_address(): Wrong number of arguments given #{arguments.size} for 1") + end + + # Taken from http://emailregex.com/ (simpler regex) + valid_email_regex = %r{\A([\w+\-].?)+@[a-z\d\-]+(\.[a-z]+)*\.[a-z]+\z} + return (arguments[0] =~ valid_email_regex) == 0 + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_float.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_float.rb new file mode 100644 index 0000000..aa84a2b --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_float.rb @@ -0,0 +1,31 @@ +# +# is_float.rb +# + +module Puppet::Parser::Functions + newfunction(:is_float, :type => :rvalue, :doc => <<-EOS +Returns true if the variable passed to this function is a float. + EOS + ) do |arguments| + + function_deprecation([:is_float, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Float. There is further documentation for validate_legacy function in the README.']) + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_float(): Wrong number of arguments given #{arguments.size} for 1") + end + + value = arguments[0] + + # Only allow Numeric or String types + return false unless value.is_a?(Numeric) or value.is_a?(String) + + if value != value.to_f.to_s and !value.is_a? Float then + return false + else + return true + end + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_function_available.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_function_available.rb new file mode 100644 index 0000000..50cd5e1 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_function_available.rb @@ -0,0 +1,25 @@ +# +# is_function_available.rb +# + +module Puppet::Parser::Functions + newfunction(:is_function_available, :type => :rvalue, :doc => <<-EOS +This function accepts a string as an argument, determines whether the +Puppet runtime has access to a function by that name. It returns a +true if the function exists, false if not. + EOS + ) do |arguments| + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_function_available?(): Wrong number of arguments given #{arguments.size} for 1") + end + + # Only allow String types + return false unless arguments[0].is_a?(String) + + function = Puppet::Parser::Functions.function(arguments[0].to_sym) + function.is_a?(String) and not function.empty? + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_hash.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_hash.rb new file mode 100644 index 0000000..3162f7d --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_hash.rb @@ -0,0 +1,21 @@ +# +# is_hash.rb +# + +module Puppet::Parser::Functions + newfunction(:is_hash, :type => :rvalue, :doc => <<-EOS +Returns true if the variable passed to this function is a hash. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "is_hash(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + type = arguments[0] + + result = type.is_a?(Hash) + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_integer.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_integer.rb new file mode 100644 index 0000000..8965b15 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_integer.rb @@ -0,0 +1,46 @@ +# +# is_integer.rb +# + +module Puppet::Parser::Functions + newfunction(:is_integer, :type => :rvalue, :doc => <<-EOS +Returns true if the variable passed to this function is an Integer or +a decimal (base 10) integer in String form. The string may +start with a '-' (minus). A value of '0' is allowed, but a leading '0' digit may not +be followed by other digits as this indicates that the value is octal (base 8). + +If given any other argument `false` is returned. + EOS + ) do |arguments| + + function_deprecation([:is_integer, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Integer. There is further documentation for validate_legacy function in the README.']) + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_integer(): Wrong number of arguments given #{arguments.size} for 1") + end + + value = arguments[0] + + # Regex is taken from the lexer of puppet + # puppet/pops/parser/lexer.rb but modified to match also + # negative values and disallow numbers prefixed with multiple + # 0's + # + # TODO these parameter should be a constant but I'm not sure + # if there is no risk to declare it inside of the module + # Puppet::Parser::Functions + + # Integer numbers like + # -1234568981273 + # 47291 + numeric = %r{^-?(?:(?:[1-9]\d*)|0)$} + + if value.is_a? Integer or (value.is_a? String and value.match numeric) + return true + else + return false + end + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_ip_address.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_ip_address.rb new file mode 100644 index 0000000..79ddb98 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_ip_address.rb @@ -0,0 +1,33 @@ +# +# is_ip_address.rb +# + +module Puppet::Parser::Functions + newfunction(:is_ip_address, :type => :rvalue, :doc => <<-EOS +Returns true if the string passed to this function is a valid IP address. + EOS + ) do |arguments| + + require 'ipaddr' + + function_deprecation([:is_ip_address, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ip_address. There is further documentation for validate_legacy function in the README.']) + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_ip_address(): Wrong number of arguments given #{arguments.size} for 1") + end + + begin + ip = IPAddr.new(arguments[0]) + rescue ArgumentError + return false + end + + if ip.ipv4? or ip.ipv6? then + return true + else + return false + end + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_ipv4_address.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_ipv4_address.rb new file mode 100644 index 0000000..91869b6 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_ipv4_address.rb @@ -0,0 +1,29 @@ +# +# is_ipv4_address.rb +# + +module Puppet::Parser::Functions + newfunction(:is_ipv4_address, :type => :rvalue, :doc => <<-EOS +Returns true if the string passed to this function is a valid IPv4 address. + EOS + ) do |arguments| + + require 'ipaddr' + + function_deprecation([:is_ipv4_address, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ipv4. There is further documentation for validate_legacy function in the README.']) + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_ipv4_address(): Wrong number of arguments given #{arguments.size} for 1") + end + + begin + ip = IPAddr.new(arguments[0]) + rescue ArgumentError + return false + end + + return ip.ipv4? + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_ipv6_address.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_ipv6_address.rb new file mode 100644 index 0000000..4d96202 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_ipv6_address.rb @@ -0,0 +1,29 @@ +# +# is_ipv6_address.rb +# + +module Puppet::Parser::Functions + newfunction(:is_ipv6_address, :type => :rvalue, :doc => <<-EOS +Returns true if the string passed to this function is a valid IPv6 address. + EOS + ) do |arguments| + + function_deprecation([:is_ipv6_address, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ipv6. There is further documentation for validate_legacy function in the README.']) + + require 'ipaddr' + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_ipv6_address(): Wrong number of arguments given #{arguments.size} for 1") + end + + begin + ip = IPAddr.new(arguments[0]) + rescue ArgumentError + return false + end + + return ip.ipv6? + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_mac_address.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_mac_address.rb new file mode 100644 index 0000000..5993ed2 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_mac_address.rb @@ -0,0 +1,26 @@ +# +# is_mac_address.rb +# + +module Puppet::Parser::Functions + newfunction(:is_mac_address, :type => :rvalue, :doc => <<-EOS +Returns true if the string passed to this function is a valid mac address. + EOS + ) do |arguments| + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_mac_address(): Wrong number of arguments given #{arguments.size} for 1") + end + + mac = arguments[0] + + if /^[a-f0-9]{1,2}(:[a-f0-9]{1,2}){5}$/i.match(mac) then + return true + else + return false + end + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_numeric.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_numeric.rb new file mode 100644 index 0000000..7800edd --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_numeric.rb @@ -0,0 +1,74 @@ +# +# is_numeric.rb +# + +module Puppet::Parser::Functions + newfunction(:is_numeric, :type => :rvalue, :doc => <<-EOS +Returns true if the given argument is a Numeric (Integer or Float), +or a String containing either a valid integer in decimal base 10 form, or +a valid floating point string representation. + +The function recognizes only decimal (base 10) integers and float but not +integers in hex (base 16) or octal (base 8) form. + +The string representation may start with a '-' (minus). If a decimal '.' is used, +it must be followed by at least one digit. + +Valid examples: + + 77435 + 10e-12 + -8475 + 0.2343 + -23.561e3 + EOS + ) do |arguments| + + function_deprecation([:is_numeric, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Numeric. There is further documentation for validate_legacy function in the README.']) + + if (arguments.size != 1) then + raise(Puppet::ParseError, "is_numeric(): Wrong number of arguments given #{arguments.size} for 1") + end + + value = arguments[0] + + # Regex is taken from the lexer of puppet + # puppet/pops/parser/lexer.rb but modified to match also + # negative values and disallow invalid octal numbers or + # numbers prefixed with multiple 0's (except in hex numbers) + # + # TODO these parameters should be constants but I'm not sure + # if there is no risk to declare them inside of the module + # Puppet::Parser::Functions + + # TODO decide if this should be used + # HEX numbers like + # 0xaa230F + # 0X1234009C + # 0x0012 + # -12FcD + #numeric_hex = %r{^-?0[xX][0-9A-Fa-f]+$} + + # TODO decide if this should be used + # OCTAL numbers like + # 01234567 + # -045372 + #numeric_oct = %r{^-?0[1-7][0-7]*$} + + # Integer/Float numbers like + # -0.1234568981273 + # 47291 + # 42.12345e-12 + numeric = %r{^-?(?:(?:[1-9]\d*)|0)(?:\.\d+)?(?:[eE]-?\d+)?$} + + if value.is_a? Numeric or (value.is_a? String and ( + value.match(numeric) #or + # value.match(numeric_hex) or + # value.match(numeric_oct) + )) + return true + else + return false + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/is_string.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_string.rb new file mode 100644 index 0000000..0ed6aec --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/is_string.rb @@ -0,0 +1,28 @@ +# +# is_string.rb +# + +module Puppet::Parser::Functions + newfunction(:is_string, :type => :rvalue, :doc => <<-EOS +Returns true if the variable passed to this function is a string. + EOS + ) do |arguments| + + function_deprecation([:is_string, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::String. There is further documentation for validate_legacy function in the README.']) + + raise(Puppet::ParseError, "is_string(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + type = arguments[0] + + # when called through the v4 API shim, undef gets translated to nil + result = type.is_a?(String) || type.nil? + + if result and (type == type.to_f.to_s or type == type.to_i.to_s) then + return false + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/join.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/join.rb new file mode 100644 index 0000000..1c17997 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/join.rb @@ -0,0 +1,40 @@ +# +# join.rb +# + +module Puppet::Parser::Functions + newfunction(:join, :type => :rvalue, :doc => <<-EOS +This function joins an array into a string using a separator. + +*Examples:* + + join(['a','b','c'], ",") + +Would result in: "a,b,c" + EOS + ) do |arguments| + + # Technically we support two arguments but only first is mandatory ... + raise(Puppet::ParseError, "join(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + array = arguments[0] + + unless array.is_a?(Array) + raise(Puppet::ParseError, 'join(): Requires array to work with') + end + + suffix = arguments[1] if arguments[1] + + if suffix + unless suffix.is_a?(String) + raise(Puppet::ParseError, 'join(): Requires string to work with') + end + end + + result = suffix ? array.join(suffix) : array.join + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/join_keys_to_values.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/join_keys_to_values.rb new file mode 100644 index 0000000..d8966ba --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/join_keys_to_values.rb @@ -0,0 +1,53 @@ +# +# join.rb +# + +module Puppet::Parser::Functions + newfunction(:join_keys_to_values, :type => :rvalue, :doc => <<-EOS +This function joins each key of a hash to that key's corresponding value with a +separator. Keys are cast to strings. If values are arrays, multiple keys +are added for each element. The return value is an array in +which each element is one joined key/value pair. + +*Examples:* + + join_keys_to_values({'a'=>1,'b'=>2}, " is ") + +Would result in: ["a is 1","b is 2"] + + join_keys_to_values({'a'=>1,'b'=>[2,3]}, " is ") + +Would result in: ["a is 1","b is 2","b is 3"] + EOS + ) do |arguments| + + # Validate the number of arguments. + if arguments.size != 2 + raise(Puppet::ParseError, "join_keys_to_values(): Takes exactly two arguments, but #{arguments.size} given.") + end + + # Validate the first argument. + hash = arguments[0] + if not hash.is_a?(Hash) + raise(TypeError, "join_keys_to_values(): The first argument must be a hash, but a #{hash.class} was given.") + end + + # Validate the second argument. + separator = arguments[1] + if not separator.is_a?(String) + raise(TypeError, "join_keys_to_values(): The second argument must be a string, but a #{separator.class} was given.") + end + + # Join the keys to their values. + hash.map do |k,v| + if v.is_a?(Array) + v.map { |va| String(k) + separator + String(va) } + else + String(k) + separator + String(v) + end + end.flatten + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/keys.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/keys.rb new file mode 100644 index 0000000..199e319 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/keys.rb @@ -0,0 +1,25 @@ +# +# keys.rb +# + +module Puppet::Parser::Functions + newfunction(:keys, :type => :rvalue, :doc => <<-EOS +Returns the keys of a hash as an array. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "keys(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + hash = arguments[0] + + unless hash.is_a?(Hash) + raise(Puppet::ParseError, 'keys(): Requires hash to work with') + end + + result = hash.keys + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/load_module_metadata.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/load_module_metadata.rb new file mode 100644 index 0000000..c9b8488 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/load_module_metadata.rb @@ -0,0 +1,24 @@ +module Puppet::Parser::Functions + newfunction(:load_module_metadata, :type => :rvalue, :doc => <<-EOT + EOT + ) do |args| + raise(Puppet::ParseError, "load_module_metadata(): Wrong number of arguments, expects one or two") unless [1,2].include?(args.size) + mod = args[0] + allow_empty_metadata = args[1] + module_path = function_get_module_path([mod]) + metadata_json = File.join(module_path, 'metadata.json') + + metadata_exists = File.exists?(metadata_json) + if metadata_exists + metadata = PSON.load(File.read(metadata_json)) + else + if allow_empty_metadata + metadata = {} + else + raise(Puppet::ParseError, "load_module_metadata(): No metadata.json file for module #{mod}") + end + end + + return metadata + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/loadjson.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/loadjson.rb new file mode 100644 index 0000000..3a3372b --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/loadjson.rb @@ -0,0 +1,34 @@ +module Puppet::Parser::Functions + newfunction(:loadjson, :type => :rvalue, :arity => -2, :doc => <<-'ENDHEREDOC') do |args| +Load a JSON file containing an array, string, or hash, and return the data +in the corresponding native data type. +The second parameter is the default value. It will be returned if the file +was not found or could not be parsed. + +For example: + + $myhash = loadjson('/etc/puppet/data/myhash.json') + $myhash = loadjson('no-file.json', {'default' => 'value'}) + ENDHEREDOC + + raise ArgumentError, 'Wrong number of arguments. 1 or 2 arguments should be provided.' unless args.length >= 1 + + if File.exists?(args[0]) + begin + content = File.read(args[0]) + PSON::load(content) || args[1] + rescue Exception => e + if args[1] + args[1] + else + raise e + end + end + else + warning("Can't load '#{args[0]}' File does not exist!") + args[1] + end + + end + +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/loadyaml.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/loadyaml.rb new file mode 100644 index 0000000..9696362 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/loadyaml.rb @@ -0,0 +1,34 @@ +module Puppet::Parser::Functions + newfunction(:loadyaml, :type => :rvalue, :arity => -2, :doc => <<-'ENDHEREDOC') do |args| +Load a YAML file containing an array, string, or hash, and return the data +in the corresponding native data type. +The second parameter is the default value. It will be returned if the file +was not found or could not be parsed. + +For example: + + $myhash = loadyaml('/etc/puppet/data/myhash.yaml') + $myhash = loadyaml('no-file.yaml', {'default' => 'value'}) + ENDHEREDOC + + raise ArgumentError, 'Wrong number of arguments. 1 or 2 arguments should be provided.' unless args.length >= 1 + require 'yaml' + + if File.exists?(args[0]) + begin + YAML::load_file(args[0]) || args[1] + rescue Exception => e + if args[1] + args[1] + else + raise e + end + end + else + warning("Can't load '#{args[0]}' File does not exist!") + args[1] + end + + end + +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/lstrip.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/lstrip.rb new file mode 100644 index 0000000..9a9ee29 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/lstrip.rb @@ -0,0 +1,30 @@ +# +# lstrip.rb +# + +module Puppet::Parser::Functions + newfunction(:lstrip, :type => :rvalue, :doc => <<-EOS +Strips leading spaces to the left of a string. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "lstrip(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'lstrip(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.lstrip : i } + else + result = value.lstrip + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/max.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/max.rb new file mode 100644 index 0000000..758c42c --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/max.rb @@ -0,0 +1,20 @@ +module Puppet::Parser::Functions + newfunction(:max, :type => :rvalue, :doc => <<-EOS + Returns the highest value of all arguments. + Requires at least one argument. + EOS + ) do |args| + + raise(Puppet::ParseError, "max(): Wrong number of arguments need at least one") if args.size == 0 + + # Sometimes we get numbers as numerics and sometimes as strings. + # We try to compare them as numbers when possible + return args.max do |a,b| + if a.to_s =~ /\A-?\d+(.\d+)?\z/ and b.to_s =~ /\A-?\d+(.\d+)?\z/ then + a.to_f <=> b.to_f + else + a.to_s <=> b.to_s + end + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/member.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/member.rb new file mode 100644 index 0000000..fb93452 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/member.rb @@ -0,0 +1,60 @@ +# +# member.rb +# + +# TODO(Krzysztof Wilczynski): We need to add support for regular expression ... +# TODO(Krzysztof Wilczynski): Support for strings and hashes too ... + +module Puppet::Parser::Functions + newfunction(:member, :type => :rvalue, :doc => <<-EOS +This function determines if a variable is a member of an array. +The variable can be a string, fixnum, or array. + +*Examples:* + + member(['a','b'], 'b') + +Would return: true + + member(['a', 'b', 'c'], ['a', 'b']) + +would return: true + + member(['a','b'], 'c') + +Would return: false + + member(['a', 'b', 'c'], ['d', 'b']) + +would return: false + EOS + ) do |arguments| + + raise(Puppet::ParseError, "member(): Wrong number of arguments given (#{arguments.size} for 2)") if arguments.size < 2 + + array = arguments[0] + + unless array.is_a?(Array) + raise(Puppet::ParseError, 'member(): Requires array to work with') + end + + unless arguments[1].is_a? String or arguments[1].is_a? Fixnum or arguments[1].is_a? Array + raise(Puppet::ParseError, 'member(): Item to search for must be a string, fixnum, or array') + end + + if arguments[1].is_a? String or arguments[1].is_a? Fixnum + item = [arguments[1]] + else + item = arguments[1] + end + + + raise(Puppet::ParseError, 'member(): You must provide item to search for within array given') if item.respond_to?('empty?') && item.empty? + + result = (item - array).empty? + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/merge.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/merge.rb new file mode 100644 index 0000000..1b39f20 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/merge.rb @@ -0,0 +1,34 @@ +module Puppet::Parser::Functions + newfunction(:merge, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args| + Merges two or more hashes together and returns the resulting hash. + + For example: + + $hash1 = {'one' => 1, 'two', => 2} + $hash2 = {'two' => 'dos', 'three', => 'tres'} + $merged_hash = merge($hash1, $hash2) + # The resulting hash is equivalent to: + # $merged_hash = {'one' => 1, 'two' => 'dos', 'three' => 'tres'} + + When there is a duplicate key, the key in the rightmost hash will "win." + + ENDHEREDOC + + if args.length < 2 + raise Puppet::ParseError, ("merge(): wrong number of arguments (#{args.length}; must be at least 2)") + end + + # The hash we accumulate into + accumulator = Hash.new + # Merge into the accumulator hash + args.each do |arg| + next if arg.is_a? String and arg.empty? # empty string is synonym for puppet's undef + unless arg.is_a?(Hash) + raise Puppet::ParseError, "merge: unexpected argument type #{arg.class}, only expects hash arguments" + end + accumulator.merge!(arg) + end + # Return the fully merged hash + accumulator + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/min.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/min.rb new file mode 100644 index 0000000..f10a2b2 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/min.rb @@ -0,0 +1,20 @@ +module Puppet::Parser::Functions + newfunction(:min, :type => :rvalue, :doc => <<-EOS + Returns the lowest value of all arguments. + Requires at least one argument. + EOS + ) do |args| + + raise(Puppet::ParseError, "min(): Wrong number of arguments need at least one") if args.size == 0 + + # Sometimes we get numbers as numerics and sometimes as strings. + # We try to compare them as numbers when possible + return args.min do |a,b| + if a.to_s =~ /\A^-?\d+(.\d+)?\z/ and b.to_s =~ /\A-?\d+(.\d+)?\z/ then + a.to_f <=> b.to_f + else + a.to_s <=> b.to_s + end + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/num2bool.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/num2bool.rb new file mode 100644 index 0000000..9ad59b2 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/num2bool.rb @@ -0,0 +1,42 @@ +# +# num2bool.rb +# + +module Puppet::Parser::Functions + newfunction(:num2bool, :type => :rvalue, :doc => <<-EOS +This function converts a number or a string representation of a number into a +true boolean. Zero or anything non-numeric becomes false. Numbers higher then 0 +become true. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "num2bool(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + number = arguments[0] + + case number + when Numeric + # Yay, it's a number + when String + begin + number = Float(number) + rescue ArgumentError => ex + raise(Puppet::ParseError, "num2bool(): '#{number}' does not look like a number: #{ex.message}") + end + else + begin + number = number.to_s + rescue NoMethodError => ex + raise(Puppet::ParseError, "num2bool(): Unable to parse argument: #{ex.message}") + end + end + + # Truncate Floats + number = number.to_i + + # Return true for any positive number and false otherwise + return number > 0 + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/parsejson.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/parsejson.rb new file mode 100644 index 0000000..f7c2896 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/parsejson.rb @@ -0,0 +1,29 @@ +# +# parsejson.rb +# + +module Puppet::Parser::Functions + newfunction(:parsejson, :type => :rvalue, :doc => <<-EOS +This function accepts JSON as a string and converts it into the correct +Puppet structure. + +The optional second argument can be used to pass a default value that will +be returned if the parsing of YAML string have failed. + EOS + ) do |arguments| + raise ArgumentError, 'Wrong number of arguments. 1 or 2 arguments should be provided.' unless arguments.length >= 1 + + begin + PSON::load(arguments[0]) || arguments[1] + rescue StandardError => e + if arguments[1] + arguments[1] + else + raise e + end + end + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/parseyaml.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/parseyaml.rb new file mode 100644 index 0000000..ba9d98a --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/parseyaml.rb @@ -0,0 +1,33 @@ +# +# parseyaml.rb +# + +module Puppet::Parser::Functions + newfunction(:parseyaml, :type => :rvalue, :doc => <<-EOS +This function accepts YAML as a string and converts it into the correct +Puppet structure. + +The optional second argument can be used to pass a default value that will +be returned if the parsing of YAML string have failed. + EOS + ) do |arguments| + raise ArgumentError, 'Wrong number of arguments. 1 or 2 arguments should be provided.' unless arguments.length >= 1 + require 'yaml' + + begin + YAML::load(arguments[0]) || arguments[1] + # in ruby 1.9.3 Psych::SyntaxError is a RuntimeException + # this still needs to catch that and work also on rubies that + # do not have Psych available. + rescue StandardError, Psych::SyntaxError => e + if arguments[1] + arguments[1] + else + raise e + end + end + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/pick.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/pick.rb new file mode 100644 index 0000000..fdd0aef --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/pick.rb @@ -0,0 +1,29 @@ +module Puppet::Parser::Functions + newfunction(:pick, :type => :rvalue, :doc => <<-EOS + +This function is similar to a coalesce function in SQL in that it will return +the first value in a list of values that is not undefined or an empty string +(two things in Puppet that will return a boolean false value). Typically, +this function is used to check for a value in the Puppet Dashboard/Enterprise +Console, and failover to a default value like the following: + + $real_jenkins_version = pick($::jenkins_version, '1.449') + +The value of $real_jenkins_version will first look for a top-scope variable +called 'jenkins_version' (note that parameters set in the Puppet Dashboard/ +Enterprise Console are brought into Puppet as top-scope variables), and, +failing that, will use a default value of 1.449. + +EOS +) do |args| + args = args.compact + args.delete(:undef) + args.delete(:undefined) + args.delete("") + if args[0].to_s.empty? then + fail Puppet::ParseError, "pick(): must receive at least one non empty value" + else + return args[0] + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/pick_default.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/pick_default.rb new file mode 100644 index 0000000..36e33ab --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/pick_default.rb @@ -0,0 +1,35 @@ +module Puppet::Parser::Functions + newfunction(:pick_default, :type => :rvalue, :doc => <<-EOS + +This function is similar to a coalesce function in SQL in that it will return +the first value in a list of values that is not undefined or an empty string +(two things in Puppet that will return a boolean false value). If no value is +found, it will return the last argument. + +Typically, this function is used to check for a value in the Puppet +Dashboard/Enterprise Console, and failover to a default value like the +following: + + $real_jenkins_version = pick_default($::jenkins_version, '1.449') + +The value of $real_jenkins_version will first look for a top-scope variable +called 'jenkins_version' (note that parameters set in the Puppet Dashboard/ +Enterprise Console are brought into Puppet as top-scope variables), and, +failing that, will use a default value of 1.449. + +Note that, contrary to the pick() function, the pick_default does not fail if +all arguments are empty. This allows pick_default to use an empty value as +default. + +EOS +) do |args| + fail "Must receive at least one argument." if args.empty? + default = args.last + args = args[0..-2].compact + args.delete(:undef) + args.delete(:undefined) + args.delete("") + args << default + return args[0] + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/prefix.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/prefix.rb new file mode 100644 index 0000000..b1c1e35 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/prefix.rb @@ -0,0 +1,51 @@ +# +# prefix.rb +# + +module Puppet::Parser::Functions + newfunction(:prefix, :type => :rvalue, :doc => <<-EOS +This function applies a prefix to all elements in an array or a hash. + +*Examples:* + + prefix(['a','b','c'], 'p') + +Will return: ['pa','pb','pc'] + EOS + ) do |arguments| + + # Technically we support two arguments but only first is mandatory ... + raise(Puppet::ParseError, "prefix(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + enumerable = arguments[0] + + unless enumerable.is_a?(Array) or enumerable.is_a?(Hash) + raise Puppet::ParseError, "prefix(): expected first argument to be an Array or a Hash, got #{enumerable.inspect}" + end + + prefix = arguments[1] if arguments[1] + + if prefix + unless prefix.is_a?(String) + raise Puppet::ParseError, "prefix(): expected second argument to be a String, got #{prefix.inspect}" + end + end + + if enumerable.is_a?(Array) + # Turn everything into string same as join would do ... + result = enumerable.collect do |i| + i = i.to_s + prefix ? prefix + i : i + end + else + result = Hash[enumerable.map do |k,v| + k = k.to_s + [ prefix ? prefix + k : k, v ] + end] + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/private.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/private.rb new file mode 100644 index 0000000..3b00ba1 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/private.rb @@ -0,0 +1,17 @@ +# +# private.rb +# + +module Puppet::Parser::Functions + newfunction(:private, :doc => <<-'EOS' + DEPRECATED: Sets the current class or definition as private. + Calling the class or definition from outside the current module will fail. + EOS + ) do |args| + warning("private() DEPRECATED: This function will cease to function on Puppet 4; please use assert_private() before upgrading to puppet 4 for backwards-compatibility, or migrate to the new parser's typing system.") + if !Puppet::Parser::Functions.autoloader.loaded?(:assert_private) + Puppet::Parser::Functions.autoloader.load(:assert_private) + end + function_assert_private([(args[0] unless args.size < 1)]) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/pry.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/pry.rb new file mode 100644 index 0000000..c18ef7e --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/pry.rb @@ -0,0 +1,30 @@ +# +# pry.rb +# + +module Puppet::Parser::Functions + newfunction(:pry, :type => :statement, :doc => <<-EOS +This function invokes a pry debugging session in the current scope object. This is useful for debugging manifest code at specific points during a compilation. + +*Examples:* + + pry() + EOS + ) do |arguments| + begin + require 'pry' + rescue LoadError + raise(Puppet::Error, "pry(): Requires the 'pry' rubygem to use, but it was not found") + end + # + ## Run `catalog` to see the contents currently compiling catalog + ## Run `cd catalog` and `ls` to see catalog methods and instance variables + ## Run `@resource_table` to see the current catalog resource table + # + if $stdout.isatty + binding.pry # rubocop:disable Lint/Debugger + else + Puppet.warning 'pry(): cowardly refusing to start the debugger on a daemonized master' + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/pw_hash.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/pw_hash.rb new file mode 100644 index 0000000..d99ee5b --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/pw_hash.rb @@ -0,0 +1,59 @@ + +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. + +Puppet::Parser::Functions::newfunction( + :pw_hash, + :type => :rvalue, + :arity => 3, + :doc => "Hashes a password using the crypt function. Provides a hash + usable on most POSIX systems. + + The first argument to this function is the password to hash. If it is + undef or an empty string, this function returns undef. + + The second argument to this function is which type of hash to use. It + will be converted into the appropriate crypt(3) hash specifier. Valid + hash types are: + + |Hash type |Specifier| + |---------------------|---------| + |MD5 |1 | + |SHA-256 |5 | + |SHA-512 (recommended)|6 | + + The third argument to this function is the salt to use. + + Note: this uses the Puppet Master's implementation of crypt(3). If your + environment contains several different operating systems, ensure that they + are compatible before using this function.") do |args| + raise ArgumentError, "pw_hash(): wrong number of arguments (#{args.size} for 3)" if args.size != 3 + raise ArgumentError, "pw_hash(): first argument must be a string" unless args[0].is_a? String or args[0].nil? + raise ArgumentError, "pw_hash(): second argument must be a string" unless args[1].is_a? String + hashes = { 'md5' => '1', + 'sha-256' => '5', + 'sha-512' => '6' } + hash_type = hashes[args[1].downcase] + raise ArgumentError, "pw_hash(): #{args[1]} is not a valid hash type" if hash_type.nil? + raise ArgumentError, "pw_hash(): third argument must be a string" unless args[2].is_a? String + raise ArgumentError, "pw_hash(): third argument must not be empty" if args[2].empty? + raise ArgumentError, "pw_hash(): characters in salt must be in the set [a-zA-Z0-9./]" unless args[2].match(/\A[a-zA-Z0-9.\/]+\z/) + + password = args[0] + return nil if password.nil? or password.empty? + + salt = "$#{hash_type}$#{args[2]}" + + # handle weak implementations of String#crypt + if 'test'.crypt('$1$1') != '$1$1$Bp8CU9Oujr9SSEw53WV6G.' + # JRuby < 1.7.17 + if RUBY_PLATFORM == 'java' + # puppetserver bundles Apache Commons Codec + org.apache.commons.codec.digest.Crypt.crypt(password.to_java_bytes, salt) + else + # MS Windows and other systems that don't support enhanced salts + raise Puppet::ParseError, 'system does not support enhanced salts' + end + else + password.crypt(salt) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/range.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/range.rb new file mode 100644 index 0000000..72c373a --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/range.rb @@ -0,0 +1,85 @@ +# +# range.rb +# + +# TODO(Krzysztof Wilczynski): We probably need to approach numeric values differently ... + +module Puppet::Parser::Functions + newfunction(:range, :type => :rvalue, :doc => <<-EOS +When given range in the form of (start, stop) it will extrapolate a range as +an array. + +*Examples:* + + range("0", "9") + +Will return: [0,1,2,3,4,5,6,7,8,9] + + range("00", "09") + +Will return: [0,1,2,3,4,5,6,7,8,9] (Zero padded strings are converted to +integers automatically) + + range("a", "c") + +Will return: ["a","b","c"] + + range("host01", "host10") +Will return: ["host01", "host02", ..., "host09", "host10"] +NB Be explicit in including trailing zeros. Otherwise the underlying ruby function will fail. + +Passing a third argument will cause the generated range to step by that +interval, e.g. + + range("0", "9", "2") + +Will return: [0,2,4,6,8] + EOS + ) do |arguments| + + raise(Puppet::ParseError, 'range(): Wrong number of arguments given (0 for 1)') if arguments.size == 0 + + if arguments.size > 1 + start = arguments[0] + stop = arguments[1] + step = arguments[2].nil? ? 1 : arguments[2].to_i.abs + + type = '..' # Use the simplest type of Range available in Ruby + + else # arguments.size == 1 + value = arguments[0] + + if m = value.match(/^(\w+)(\.\.\.?|\-)(\w+)$/) + start = m[1] + stop = m[3] + + type = m[2] + step = 1 + elsif value.match(/^.+$/) + raise(Puppet::ParseError, "range(): Unable to compute range from the value: #{value}") + else + raise(Puppet::ParseError, "range(): Unknown range format: #{value}") + end + end + + # If we were given an integer, ensure we work with one + if start.to_s.match(/^\d+$/) + start = start.to_i + stop = stop.to_i + else + start = start.to_s + stop = stop.to_s + end + + range = case type + when /^(\.\.|\-)$/ then (start .. stop) + when '...' then (start ... stop) # Exclusive of last element + end + + result = range.step(step).to_a + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/regexpescape.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/regexpescape.rb new file mode 100644 index 0000000..2cfa3bb --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/regexpescape.rb @@ -0,0 +1,29 @@ +# +# regexpescape.rb +# +module Puppet::Parser::Functions + newfunction(:regexpescape, :type => :rvalue, :doc => <<-EOS + Regexp escape a string or array of strings. + Requires either a single string or an array as an input. + EOS + ) do |arguments| # rubocop:disable Style/ClosingParenthesisIndentation + raise(Puppet::ParseError, "regexpescape(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.empty? + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'regexpescape(): Requires either array or string to work with') + end + + result = if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + value.collect { |i| i.is_a?(String) ? Regexp.escape(i) : i } + else + Regexp.escape(value) + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/reject.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/reject.rb new file mode 100644 index 0000000..1953ffc --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/reject.rb @@ -0,0 +1,31 @@ +# +# reject.rb +# + +module Puppet::Parser::Functions + newfunction(:reject, :type => :rvalue, :doc => <<-EOS) do |args| +This function searches through an array and rejects all elements that match +the provided regular expression. + +*Examples:* + + reject(['aaa','bbb','ccc','aaaddd'], 'aaa') + +Would return: + + ['bbb','ccc'] +EOS + + if (args.size != 2) + raise Puppet::ParseError, + "reject(): Wrong number of arguments given #{args.size} for 2" + end + + ary = args[0] + pattern = Regexp.new(args[1]) + + ary.reject { |e| e =~ pattern } + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/reverse.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/reverse.rb new file mode 100644 index 0000000..aca98ce --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/reverse.rb @@ -0,0 +1,25 @@ +# +# reverse.rb +# + +module Puppet::Parser::Functions + newfunction(:reverse, :type => :rvalue, :doc => <<-EOS +Reverses the order of a string or array. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "reverse(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'reverse(): Requires either array or string to work with') + end + + result = value.reverse + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/rstrip.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/rstrip.rb new file mode 100644 index 0000000..e24abd5 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/rstrip.rb @@ -0,0 +1,29 @@ +# +# rstrip.rb +# + +module Puppet::Parser::Functions + newfunction(:rstrip, :type => :rvalue, :doc => <<-EOS +Strips leading spaces to the right of the string. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "rstrip(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'rstrip(): Requires either array or string to work with') + end + + if value.is_a?(Array) + result = value.collect { |i| i.is_a?(String) ? i.rstrip : i } + else + result = value.rstrip + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/seeded_rand.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/seeded_rand.rb new file mode 100644 index 0000000..44e27b8 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/seeded_rand.rb @@ -0,0 +1,22 @@ +Puppet::Parser::Functions::newfunction( + :seeded_rand, + :arity => 2, + :type => :rvalue, + :doc => <<-EOS +Usage: `seeded_rand(MAX, SEED)`. MAX must be a positive integer; SEED is any string. + +Generates a random whole number greater than or equal to 0 and less +than MAX, using the value of SEED for repeatable randomness. If SEED +starts with "$fqdn:", this is behaves the same as `fqdn_rand`. + +EOS +) do |args| + require 'digest/md5' + + raise(ArgumentError, "seeded_rand(): first argument must be a positive integer") unless function_is_integer([args[0]]) and args[0].to_i > 0 + raise(ArgumentError, "seeded_rand(): second argument must be a string") unless args[1].is_a? String + + max = args[0].to_i + seed = Digest::MD5.hexdigest(args[1]).hex + Puppet::Util.deterministic_rand(seed,max) +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/shell_escape.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/shell_escape.rb new file mode 100644 index 0000000..7306b7c --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/shell_escape.rb @@ -0,0 +1,29 @@ +# +# shell_escape.rb +# + +require 'shellwords' + +module Puppet::Parser::Functions + newfunction(:shell_escape, :type => :rvalue, :doc => <<-EOS +Escapes a string so that it can be safely used in a Bourne shell command line. + +Note that the resulting string should be used unquoted and is not intended for use in double quotes nor in single +quotes. + +This function behaves the same as ruby's Shellwords.shellescape() function. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "shell_escape(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + # explicit conversion to string is required for ruby 1.9 + string = arguments[0].to_s + + result = Shellwords.shellescape(string) + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/shell_join.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/shell_join.rb new file mode 100644 index 0000000..682ed8d --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/shell_join.rb @@ -0,0 +1,30 @@ +# +# shell_join.rb +# + +require 'shellwords' + +module Puppet::Parser::Functions + newfunction(:shell_join, :type => :rvalue, :doc => <<-EOS +Builds a command line string from the given array of strings. Each array item is escaped for Bourne shell. All items are +then joined together, with a single space in between. + +This function behaves the same as ruby's Shellwords.shelljoin() function + EOS + ) do |arguments| + + raise(Puppet::ParseError, "shell_join(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + array = arguments[0] + + raise Puppet::ParseError, ("First argument is not an Array: #{array.inspect}") unless array.is_a?(Array) + + # explicit conversion to string is required for ruby 1.9 + array = array.map { |item| item.to_s } + result = Shellwords.shelljoin(array) + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/shell_split.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/shell_split.rb new file mode 100644 index 0000000..09e6e78 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/shell_split.rb @@ -0,0 +1,25 @@ +# +# shell_split.rb +# + +require 'shellwords' + +module Puppet::Parser::Functions + newfunction(:shell_split, :type => :rvalue, :doc => <<-EOS +Splits a string into an array of tokens in the same way the Bourne shell does. + +This function behaves the same as ruby's Shellwords.shellsplit() function + EOS + ) do |arguments| + + raise(Puppet::ParseError, "shell_split(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + string = arguments[0].to_s + + result = Shellwords.shellsplit(string) + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/shuffle.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/shuffle.rb new file mode 100644 index 0000000..942cbce --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/shuffle.rb @@ -0,0 +1,43 @@ +# +# shuffle.rb +# + +module Puppet::Parser::Functions + newfunction(:shuffle, :type => :rvalue, :doc => <<-EOS +Randomizes the order of a string or array elements. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "shuffle(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'shuffle(): Requires either array or string to work with') + end + + result = value.clone + + string = value.is_a?(String) ? true : false + + # Check whether it makes sense to shuffle ... + return result if result.size <= 1 + + # We turn any string value into an array to be able to shuffle ... + result = string ? result.split('') : result + + elements = result.size + + # Simple implementation of Fisher–Yates in-place shuffle ... + elements.times do |i| + j = rand(elements - i) + i + result[j], result[i] = result[i], result[j] + end + + result = string ? result.join : result + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/size.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/size.rb new file mode 100644 index 0000000..b503aa0 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/size.rb @@ -0,0 +1,46 @@ +# +# size.rb +# + +module Puppet::Parser::Functions + newfunction(:size, :type => :rvalue, :doc => <<-EOS +Returns the number of elements in a string, an array or a hash + EOS + ) do |arguments| + + raise(Puppet::ParseError, "size(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + item = arguments[0] + + function_deprecation([:size, 'This method is going to be deprecated, please use the stdlib length function.']) + + if item.is_a?(String) + + begin + # + # Check whether your item is a numeric value or not ... + # This will take care about positive and/or negative numbers + # for both integer and floating-point values ... + # + # Please note that Puppet has no notion of hexadecimal + # nor octal numbers for its DSL at this point in time ... + # + Float(item) + + raise(Puppet::ParseError, 'size(): Requires either string, array or hash to work with') + + rescue ArgumentError + result = item.size + end + + elsif item.is_a?(Array) || item.is_a?(Hash) + result = item.size + else + raise(Puppet::ParseError, 'size(): Unknown type given') + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/sort.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/sort.rb new file mode 100644 index 0000000..d7792f5 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/sort.rb @@ -0,0 +1,27 @@ +# +# sort.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:sort, :type => :rvalue, :doc => <<-EOS +Sorts strings and arrays lexically. + EOS + ) do |arguments| + + if (arguments.size != 1) then + raise(Puppet::ParseError, "sort(): Wrong number of arguments given #{arguments.size} for 1") + end + + value = arguments[0] + + if value.is_a?(Array) then + value.sort + elsif value.is_a?(String) then + value.split("").sort.join("") + end + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/squeeze.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/squeeze.rb new file mode 100644 index 0000000..f5757d1 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/squeeze.rb @@ -0,0 +1,35 @@ +# +# squeeze.rb +# + +module Puppet::Parser::Functions + newfunction(:squeeze, :type => :rvalue, :doc => <<-EOS +Returns a new string where runs of the same character that occur in this set are replaced by a single character. + EOS + ) do |arguments| + + if ((arguments.size != 2) and (arguments.size != 1)) then + raise(Puppet::ParseError, "squeeze(): Wrong number of arguments given #{arguments.size} for 2 or 1") + end + + item = arguments[0] + squeezeval = arguments[1] + + if item.is_a?(Array) then + if squeezeval then + item.collect { |i| i.squeeze(squeezeval) } + else + item.collect { |i| i.squeeze } + end + else + if squeezeval then + item.squeeze(squeezeval) + else + item.squeeze + end + end + + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/str2bool.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/str2bool.rb new file mode 100644 index 0000000..38ad1ce --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/str2bool.rb @@ -0,0 +1,44 @@ +# +# str2bool.rb +# + +module Puppet::Parser::Functions + newfunction(:str2bool, :type => :rvalue, :doc => <<-EOS +This converts a string to a boolean. This attempt to convert strings that +contain things like: Y,y, 1, T,t, TRUE,true to 'true' and strings that contain things +like: 0, F,f, N,n, false, FALSE, no to 'false'. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "str2bool(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + string = arguments[0] + + # If string is already Boolean, return it + if !!string == string + return string + end + + unless string.is_a?(String) + raise(Puppet::ParseError, 'str2bool(): Requires string to work with') + end + + # We consider all the yes, no, y, n and so on too ... + result = case string + # + # This is how undef looks like in Puppet ... + # We yield false in this case. + # + when /^$/, '' then false # Empty string will be false ... + when /^(1|t|y|true|yes)$/i then true + when /^(0|f|n|false|no)$/i then false + when /^(undef|undefined)$/ then false # This is not likely to happen ... + else + raise(Puppet::ParseError, 'str2bool(): Unknown type of boolean given') + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/str2saltedsha512.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/str2saltedsha512.rb new file mode 100644 index 0000000..0410c62 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/str2saltedsha512.rb @@ -0,0 +1,31 @@ +# +# str2saltedsha512.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:str2saltedsha512, :type => :rvalue, :doc => <<-EOS +This converts a string to a salted-SHA512 password hash (which is used for +OS X versions >= 10.7). Given any simple string, you will get a hex version +of a salted-SHA512 password hash that can be inserted into your Puppet +manifests as a valid password attribute. + EOS + ) do |arguments| + require 'digest/sha2' + + raise(Puppet::ParseError, "str2saltedsha512(): Wrong number of arguments passed (#{arguments.size} but we require 1)") if arguments.size != 1 + + password = arguments[0] + + unless password.is_a?(String) + raise(Puppet::ParseError, "str2saltedsha512(): Requires a String argument, you passed: #{password.class}") + end + + seedint = rand(2**31 - 1) + seedstring = Array(seedint).pack("L") + saltedpass = Digest::SHA512.digest(seedstring + password) + (seedstring + saltedpass).unpack('H*')[0] + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/strftime.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/strftime.rb new file mode 100644 index 0000000..deae329 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/strftime.rb @@ -0,0 +1,106 @@ +# +# strftime.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:strftime, :type => :rvalue, :doc => <<-EOS +This function returns formatted time. + +*Examples:* + +To return the time since epoch: + + strftime("%s") + +To return the date: + + strftime("%Y-%m-%d") + +*Format meaning:* + + %a - The abbreviated weekday name (``Sun'') + %A - The full weekday name (``Sunday'') + %b - The abbreviated month name (``Jan'') + %B - The full month name (``January'') + %c - The preferred local date and time representation + %C - Century (20 in 2009) + %d - Day of the month (01..31) + %D - Date (%m/%d/%y) + %e - Day of the month, blank-padded ( 1..31) + %F - Equivalent to %Y-%m-%d (the ISO 8601 date format) + %h - Equivalent to %b + %H - Hour of the day, 24-hour clock (00..23) + %I - Hour of the day, 12-hour clock (01..12) + %j - Day of the year (001..366) + %k - hour, 24-hour clock, blank-padded ( 0..23) + %l - hour, 12-hour clock, blank-padded ( 0..12) + %L - Millisecond of the second (000..999) + %m - Month of the year (01..12) + %M - Minute of the hour (00..59) + %n - Newline (\n) + %N - Fractional seconds digits, default is 9 digits (nanosecond) + %3N millisecond (3 digits) + %6N microsecond (6 digits) + %9N nanosecond (9 digits) + %p - Meridian indicator (``AM'' or ``PM'') + %P - Meridian indicator (``am'' or ``pm'') + %r - time, 12-hour (same as %I:%M:%S %p) + %R - time, 24-hour (%H:%M) + %s - Number of seconds since 1970-01-01 00:00:00 UTC. + %S - Second of the minute (00..60) + %t - Tab character (\t) + %T - time, 24-hour (%H:%M:%S) + %u - Day of the week as a decimal, Monday being 1. (1..7) + %U - Week number of the current year, + starting with the first Sunday as the first + day of the first week (00..53) + %v - VMS date (%e-%b-%Y) + %V - Week number of year according to ISO 8601 (01..53) + %W - Week number of the current year, + starting with the first Monday as the first + day of the first week (00..53) + %w - Day of the week (Sunday is 0, 0..6) + %x - Preferred representation for the date alone, no time + %X - Preferred representation for the time alone, no date + %y - Year without a century (00..99) + %Y - Year with century + %z - Time zone as hour offset from UTC (e.g. +0900) + %Z - Time zone name + %% - Literal ``%'' character + EOS + ) do |arguments| + + # Technically we support two arguments but only first is mandatory ... + raise(Puppet::ParseError, "strftime(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + format = arguments[0] + + raise(Puppet::ParseError, 'strftime(): You must provide format for evaluation') if format.empty? + + # The Time Zone argument is optional ... + time_zone = arguments[1] if arguments[1] + + time = Time.new + + # There is probably a better way to handle Time Zone ... + if time_zone and not time_zone.empty? + original_zone = ENV['TZ'] + + local_time = time.clone + local_time = local_time.utc + + ENV['TZ'] = time_zone + + time = local_time.localtime + + ENV['TZ'] = original_zone + end + + result = time.strftime(format) + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/strip.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/strip.rb new file mode 100644 index 0000000..9e8366f --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/strip.rb @@ -0,0 +1,36 @@ +# +# strip.rb +# + +module Puppet::Parser::Functions + newfunction(:strip, :type => :rvalue, :doc => <<-EOS +This function removes leading and trailing whitespace from a string or from +every string inside an array. + +*Examples:* + + strip(" aaa ") + +Would result in: "aaa" + EOS + ) do |arguments| + + raise(Puppet::ParseError, "strip(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'strip(): Requires either array or string to work with') + end + + if value.is_a?(Array) + result = value.collect { |i| i.is_a?(String) ? i.strip : i } + else + result = value.strip + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/suffix.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/suffix.rb new file mode 100644 index 0000000..7c5057d --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/suffix.rb @@ -0,0 +1,52 @@ +# +# suffix.rb +# + +module Puppet::Parser::Functions + newfunction(:suffix, :type => :rvalue, :doc => <<-EOS +This function applies a suffix to all elements in an array, or to the keys +in a hash. + +*Examples:* + + suffix(['a','b','c'], 'p') + +Will return: ['ap','bp','cp'] + EOS + ) do |arguments| + + # Technically we support two arguments but only first is mandatory ... + raise(Puppet::ParseError, "suffix(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + enumerable = arguments[0] + + unless enumerable.is_a?(Array) or enumerable.is_a?(Hash) + raise Puppet::ParseError, "suffix(): expected first argument to be an Array or a Hash, got #{enumerable.inspect}" + end + + suffix = arguments[1] if arguments[1] + + if suffix + unless suffix.is_a? String + raise Puppet::ParseError, "suffix(): expected second argument to be a String, got #{suffix.inspect}" + end + end + + if enumerable.is_a?(Array) + # Turn everything into string same as join would do ... + result = enumerable.collect do |i| + i = i.to_s + suffix ? i + suffix : i + end + else + result = Hash[enumerable.map do |k,v| + k = k.to_s + [ suffix ? k + suffix : k, v ] + end] + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/swapcase.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/swapcase.rb new file mode 100644 index 0000000..f3276fb --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/swapcase.rb @@ -0,0 +1,37 @@ +# +# swapcase.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:swapcase, :type => :rvalue, :doc => <<-EOS +This function will swap the existing case of a string. + +*Examples:* + + swapcase("aBcD") + +Would result in: "AbCd" + EOS + ) do |arguments| + + raise(Puppet::ParseError, "swapcase(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'swapcase(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? i.swapcase : i } + else + result = value.swapcase + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/time.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/time.rb new file mode 100644 index 0000000..d7780c8 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/time.rb @@ -0,0 +1,49 @@ +# +# time.rb +# + +module Puppet::Parser::Functions + newfunction(:time, :type => :rvalue, :doc => <<-EOS +This function will return the current time since epoch as an integer. + +*Examples:* + + time() + +Will return something like: 1311972653 + EOS + ) do |arguments| + + # The Time Zone argument is optional ... + time_zone = arguments[0] if arguments[0] + + if (arguments.size != 0) and (arguments.size != 1) then + raise(Puppet::ParseError, "time(): Wrong number of arguments given #{arguments.size} for 0 or 1") + end + + time = Time.new + + # There is probably a better way to handle Time Zone ... + if time_zone and not time_zone.empty? + original_zone = ENV['TZ'] + + local_time = time.clone + local_time = local_time.utc + + ENV['TZ'] = time_zone + + result = local_time.localtime.strftime('%s') + + ENV['TZ'] = original_zone + else + result = time.localtime.strftime('%s') + end + + # Calling Time#to_i on a receiver changes it. Trust me I am the Doctor. + result = result.to_i + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/to_bytes.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/to_bytes.rb new file mode 100644 index 0000000..bf72503 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/to_bytes.rb @@ -0,0 +1,30 @@ +module Puppet::Parser::Functions + newfunction(:to_bytes, :type => :rvalue, :doc => <<-EOS + Converts the argument into bytes, for example 4 kB becomes 4096. + Takes a single string value as an argument. + These conversions reflect a layperson's understanding of + 1 MB = 1024 KB, when in fact 1 MB = 1000 KB, and 1 MiB = 1024 KiB. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "to_bytes(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + arg = arguments[0] + + return arg if arg.is_a? Numeric + + value,prefix = */([0-9.e+-]*)\s*([^bB]?)/.match(arg)[1,2] + + value = value.to_f + case prefix + when '' then return value.to_i + when 'k' then return (value*(1<<10)).to_i + when 'M' then return (value*(1<<20)).to_i + when 'G' then return (value*(1<<30)).to_i + when 'T' then return (value*(1<<40)).to_i + when 'P' then return (value*(1<<50)).to_i + when 'E' then return (value*(1<<60)).to_i + else raise Puppet::ParseError, "to_bytes(): Unknown prefix #{prefix}" + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/try_get_value.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/try_get_value.rb new file mode 100644 index 0000000..fc19a23 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/try_get_value.rb @@ -0,0 +1,53 @@ +module Puppet::Parser::Functions + newfunction( + :try_get_value, + :type => :rvalue, + :arity => -2, + :doc => <<-eos +DEPRECATED: this function is deprecated, please use dig() instead. + +Looks up into a complex structure of arrays and hashes and returns a value +or the default value if nothing was found. + +Key can contain slashes to describe path components. The function will go down +the structure and try to extract the required value. + +$data = { + 'a' => { + 'b' => [ + 'b1', + 'b2', + 'b3', + ] + } +} + +$value = try_get_value($data, 'a/b/2', 'not_found', '/') +=> $value = 'b3' + +a -> first hash key +b -> second hash key +2 -> array index starting with 0 + +not_found -> (optional) will be returned if there is no value or the path did not match. Defaults to nil. +/ -> (optional) path delimiter. Defaults to '/'. + +In addition to the required "key" argument, "try_get_value" accepts default +argument. It will be returned if no value was found or a path component is +missing. And the fourth argument can set a variable path separator. + eos + ) do |args| + warning("try_get_value() DEPRECATED: this function is deprecated, please use dig() instead.") + data = args[0] + path = args[1] || '' + default = args[2] + + if !(data.is_a?(Hash) || data.is_a?(Array)) || path == '' + return default || data + end + + separator = args[3] || '/' + path = path.split(separator).map{ |key| key =~ /^\d+$/ ? key.to_i : key } + function_dig([data, path, default]) + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/type.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/type.rb new file mode 100644 index 0000000..016529b --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/type.rb @@ -0,0 +1,19 @@ +# +# type.rb +# + +module Puppet::Parser::Functions + newfunction(:type, :type => :rvalue, :doc => <<-EOS + DEPRECATED: This function will cease to function on Puppet 4; please use type3x() before upgrading to puppet 4 for backwards-compatibility, or migrate to the new parser's typing system. + EOS + ) do |args| + + warning("type() DEPRECATED: This function will cease to function on Puppet 4; please use type3x() before upgrading to puppet 4 for backwards-compatibility, or migrate to the new parser's typing system.") + if ! Puppet::Parser::Functions.autoloader.loaded?(:type3x) + Puppet::Parser::Functions.autoloader.load(:type3x) + end + function_type3x(args + [false]) + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/type3x.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/type3x.rb new file mode 100644 index 0000000..b17380e --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/type3x.rb @@ -0,0 +1,50 @@ +# +# type3x.rb +# + +module Puppet::Parser::Functions + newfunction(:type3x, :type => :rvalue, :doc => <<-EOS +DEPRECATED: This function will be removed when puppet 3 support is dropped; please migrate to the new parser's typing system. + +Returns the type when passed a value. Type can be one of: + +* string +* array +* hash +* float +* integer +* boolean + EOS + ) do |args| + raise(Puppet::ParseError, "type3x(): Wrong number of arguments given (#{args.size} for 1)") if args.size < 1 + + value = args[0] + + klass = value.class + + if not [TrueClass, FalseClass, Array, Bignum, Fixnum, Float, Hash, String].include?(klass) + raise(Puppet::ParseError, 'type3x(): Unknown type') + end + + klass = klass.to_s # Ugly ... + + # We note that Integer is the parent to Bignum and Fixnum ... + result = case klass + when /^(?:Big|Fix)num$/ then 'integer' + when /^(?:True|False)Class$/ then 'boolean' + else klass + end + + if result == "String" then + if value == value.to_i.to_s then + result = "Integer" + elsif value == value.to_f.to_s then + result = "Float" + end + end + + return result.downcase + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/union.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/union.rb new file mode 100644 index 0000000..abe2dc8 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/union.rb @@ -0,0 +1,28 @@ +# +# union.rb +# + +module Puppet::Parser::Functions + newfunction(:union, :type => :rvalue, :doc => <<-EOS +This function returns a union of two or more arrays. + +*Examples:* + + union(["a","b","c"],["b","c","d"]) + +Would return: ["a","b","c","d"] + EOS + ) do |arguments| + + # Check that 2 or more arguments have been given ... + raise(Puppet::ParseError, "union(): Wrong number of arguments given (#{arguments.size} for < 2)") if arguments.size < 2 + + arguments.each do |argument| + raise(Puppet::ParseError, 'union(): Every parameter must be an array') unless argument.is_a?(Array) + end + + arguments.reduce(:|) + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/unique.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/unique.rb new file mode 100644 index 0000000..b57431d --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/unique.rb @@ -0,0 +1,48 @@ +# +# unique.rb +# + +module Puppet::Parser::Functions + newfunction(:unique, :type => :rvalue, :doc => <<-EOS +This function will remove duplicates from strings and arrays. + +*Examples:* + + unique("aabbcc") + +Will return: + + abc + +You can also use this with arrays: + + unique(["a","a","b","b","c","c"]) + +This returns: + + ["a","b","c"] + EOS + ) do |arguments| + + raise(Puppet::ParseError, "unique(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'unique(): Requires either array or string to work with') + end + + result = value.clone + + string = value.is_a?(String) ? true : false + + # We turn any string value into an array to be able to shuffle ... + result = string ? result.split('') : result + result = result.uniq # Remove duplicates ... + result = string ? result.join : result + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/unix2dos.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/unix2dos.rb new file mode 100644 index 0000000..0bd9cd1 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/unix2dos.rb @@ -0,0 +1,15 @@ +# Custom Puppet function to convert unix to dos format +module Puppet::Parser::Functions + newfunction(:unix2dos, :type => :rvalue, :arity => 1, :doc => <<-EOS + Returns the DOS version of the given string. + Takes a single string argument. + EOS + ) do |arguments| + + unless arguments[0].is_a?(String) + raise(Puppet::ParseError, 'unix2dos(): Requires string as argument') + end + + arguments[0].gsub(/\r*\n/, "\r\n") + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/upcase.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/upcase.rb new file mode 100644 index 0000000..e847e51 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/upcase.rb @@ -0,0 +1,44 @@ +# +# upcase.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# + +module Puppet::Parser::Functions + newfunction(:upcase, :type => :rvalue, :doc => <<-EOS +Converts a string or an array of strings to uppercase. + +*Examples:* + + upcase("abcd") + +Will return: + + ABCD + EOS + ) do |arguments| + + raise(Puppet::ParseError, "upcase(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size != 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(Hash) || value.respond_to?(:upcase) + raise(Puppet::ParseError, 'upcase(): Requires an array, hash or object that responds to upcase in order to work') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| function_upcase([i]) } + elsif value.is_a?(Hash) + result = {} + value.each_pair do |k, v| + result[function_upcase([k])] = function_upcase([v]) + end + else + result = value.upcase + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/uriescape.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/uriescape.rb new file mode 100644 index 0000000..4c5c400 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/uriescape.rb @@ -0,0 +1,33 @@ +# +# uriescape.rb +# Please note: This function is an implementation of a Ruby class and as such may not be entirely UTF8 compatible. To ensure compatibility please use this function with Ruby 2.4.0 or greater - https://bugs.ruby-lang.org/issues/10085. +# +require 'uri' + +module Puppet::Parser::Functions + newfunction(:uriescape, :type => :rvalue, :doc => <<-EOS + Urlencodes a string or array of strings. + Requires either a single string or an array as an input. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "uriescape(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + value = arguments[0] + + unless value.is_a?(Array) || value.is_a?(String) + raise(Puppet::ParseError, 'uriescape(): Requires either array or string to work with') + end + + if value.is_a?(Array) + # Numbers in Puppet are often string-encoded which is troublesome ... + result = value.collect { |i| i.is_a?(String) ? URI.escape(i) : i } + else + result = URI.escape(value) + end + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_absolute_path.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_absolute_path.rb new file mode 100644 index 0000000..c73f3df --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_absolute_path.rb @@ -0,0 +1,54 @@ +module Puppet::Parser::Functions + newfunction(:validate_absolute_path, :doc => <<-'ENDHEREDOC') do |args| + Validate the string represents an absolute path in the filesystem. This function works + for windows and unix style paths. + + The following values will pass: + + $my_path = 'C:/Program Files (x86)/Puppet Labs/Puppet' + validate_absolute_path($my_path) + $my_path2 = '/var/lib/puppet' + validate_absolute_path($my_path2) + $my_path3 = ['C:/Program Files (x86)/Puppet Labs/Puppet','C:/Program Files/Puppet Labs/Puppet'] + validate_absolute_path($my_path3) + $my_path4 = ['/var/lib/puppet','/usr/share/puppet'] + validate_absolute_path($my_path4) + + The following values will fail, causing compilation to abort: + + validate_absolute_path(true) + validate_absolute_path('../var/lib/puppet') + validate_absolute_path('var/lib/puppet') + validate_absolute_path([ 'var/lib/puppet', '/var/foo' ]) + validate_absolute_path([ '/var/lib/puppet', 'var/foo' ]) + $undefined = undef + validate_absolute_path($undefined) + + ENDHEREDOC + + # The deprecation function was being called twice, as validate_absolute_path calls is_absolute_path. I have removed it from here so it only calls deprecation once within is_absolute_path. + # function_deprecation([:validate_absolute_path, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Absolute_path. There is further documentation for validate_legacy function in the README.']) + + require 'puppet/util' + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_absolute_path(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + # put arg to candidate var to be able to replace it + candidates = arg + # if arg is just a string with a path to test, convert it to an array + # to avoid test code duplication + unless arg.is_a?(Array) then + candidates = Array.new(1,arg) + end + # iterate over all paths within the candidates array + candidates.each do |path| + unless function_is_absolute_path([path]) + raise Puppet::ParseError, ("#{path.inspect} is not an absolute path.") + end + end + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_array.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_array.rb new file mode 100644 index 0000000..3bf3983 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_array.rb @@ -0,0 +1,35 @@ +module Puppet::Parser::Functions + + newfunction(:validate_array, :doc => <<-'ENDHEREDOC') do |args| + Validate that all passed values are array data structures. Abort catalog + compilation if any value fails this check. + + The following values will pass: + + $my_array = [ 'one', 'two' ] + validate_array($my_array) + + The following values will fail, causing compilation to abort: + + validate_array(true) + validate_array('some_string') + $undefined = undef + validate_array($undefined) + + ENDHEREDOC + + function_deprecation([:validate_array, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Array. There is further documentation for validate_legacy function in the README.']) + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_array(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + unless arg.is_a?(Array) + raise Puppet::ParseError, ("#{arg.inspect} is not an Array. It looks to be a #{arg.class}") + end + end + + end + +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_augeas.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_augeas.rb new file mode 100644 index 0000000..2196c3e --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_augeas.rb @@ -0,0 +1,83 @@ +require 'tempfile' + +module Puppet::Parser::Functions + newfunction(:validate_augeas, :doc => <<-'ENDHEREDOC') do |args| + Perform validation of a string using an Augeas lens + The first argument of this function should be a string to + test, and the second argument should be the name of the Augeas lens to use. + If Augeas fails to parse the string with the lens, the compilation will + abort with a parse error. + + A third argument can be specified, listing paths which should + not be found in the file. The `$file` variable points to the location + of the temporary file being tested in the Augeas tree. + + For example, if you want to make sure your passwd content never contains + a user `foo`, you could write: + + validate_augeas($passwdcontent, 'Passwd.lns', ['$file/foo']) + + Or if you wanted to ensure that no users used the '/bin/barsh' shell, + you could use: + + validate_augeas($passwdcontent, 'Passwd.lns', ['$file/*[shell="/bin/barsh"]'] + + If a fourth argument is specified, this will be the error message raised and + seen by the user. + + A helpful error message can be returned like this: + + validate_augeas($sudoerscontent, 'Sudoers.lns', [], 'Failed to validate sudoers content with Augeas') + + ENDHEREDOC + unless Puppet.features.augeas? + raise Puppet::ParseError, ("validate_augeas(): this function requires the augeas feature. See http://docs.puppetlabs.com/guides/augeas.html#pre-requisites for how to activate it.") + end + + if (args.length < 2) or (args.length > 4) then + raise Puppet::ParseError, ("validate_augeas(): wrong number of arguments (#{args.length}; must be 2, 3, or 4)") + end + + msg = args[3] || "validate_augeas(): Failed to validate content against #{args[1].inspect}" + + require 'augeas' + aug = Augeas::open(nil, nil, Augeas::NO_MODL_AUTOLOAD) + begin + content = args[0] + + # Test content in a temporary file + tmpfile = Tempfile.new("validate_augeas") + begin + tmpfile.write(content) + ensure + tmpfile.close + end + + # Check for syntax + lens = args[1] + aug.transform( + :lens => lens, + :name => 'Validate_augeas', + :incl => tmpfile.path + ) + aug.load! + + unless aug.match("/augeas/files#{tmpfile.path}//error").empty? + error = aug.get("/augeas/files#{tmpfile.path}//error/message") + msg += " with error: #{error}" + raise Puppet::ParseError, (msg) + end + + # Launch unit tests + tests = args[2] || [] + aug.defvar('file', "/files#{tmpfile.path}") + tests.each do |t| + msg += " testing path #{t}" + raise Puppet::ParseError, (msg) unless aug.match(t).empty? + end + ensure + aug.close + tmpfile.unlink + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_bool.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_bool.rb new file mode 100644 index 0000000..49075b8 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_bool.rb @@ -0,0 +1,37 @@ +module Puppet::Parser::Functions + + newfunction(:validate_bool, :doc => <<-'ENDHEREDOC') do |args| + Validate that all passed values are either true or false. Abort catalog + compilation if any value fails this check. + + The following values will pass: + + $iamtrue = true + validate_bool(true) + validate_bool(true, true, false, $iamtrue) + + The following values will fail, causing compilation to abort: + + $some_array = [ true ] + validate_bool("false") + validate_bool("true") + validate_bool($some_array) + + ENDHEREDOC + + # The deprecation function was being called twice, as validate_bool calls is_bool. I have removed it from here so it only calls deprecation once within is_bool. + # function_deprecation([:validate_bool, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Bool. There is further documentation for validate_legacy function in the README.']) + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_bool(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + unless function_is_bool([arg]) + raise Puppet::ParseError, ("#{arg.inspect} is not a boolean. It looks to be a #{arg.class}") + end + end + + end + +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_cmd.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_cmd.rb new file mode 100644 index 0000000..685162b --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_cmd.rb @@ -0,0 +1,63 @@ +require 'puppet/util/execution' +require 'tempfile' + +module Puppet::Parser::Functions + newfunction(:validate_cmd, :doc => <<-'ENDHEREDOC') do |args| + Perform validation of a string with an external command. + The first argument of this function should be a string to + test, and the second argument should be a path to a test command + taking a % as a placeholder for the file path (will default to the end). + If the command, launched against a tempfile containing the passed string, + returns a non-null value, compilation will abort with a parse error. + + If a third argument is specified, this will be the error message raised and + seen by the user. + + A helpful error message can be returned like this: + + Example: + + # Defaults to end of path + validate_cmd($sudoerscontent, '/usr/sbin/visudo -c -f', 'Visudo failed to validate sudoers content') + + # % as file location + validate_cmd($haproxycontent, '/usr/sbin/haproxy -f % -c', 'Haproxy failed to validate config content') + + ENDHEREDOC + if (args.length < 2) or (args.length > 3) then + raise Puppet::ParseError, ("validate_cmd(): wrong number of arguments (#{args.length}; must be 2 or 3)") + end + + msg = args[2] || "validate_cmd(): failed to validate content with command #{args[1].inspect}" + + content = args[0] + checkscript = args[1] + + # Test content in a temporary file + tmpfile = Tempfile.new("validate_cmd") + begin + tmpfile.write(content) + tmpfile.close + + if checkscript =~ /\s%(\s|$)/ + check_with_correct_location = checkscript.gsub(/%/,tmpfile.path) + else + check_with_correct_location = "#{checkscript} #{tmpfile.path}" + end + + if Puppet::Util::Execution.respond_to?('execute') + Puppet::Util::Execution.execute(check_with_correct_location) + else + Puppet::Util.execute(check_with_correct_location) + end + rescue Puppet::ExecutionFailure => detail + msg += "\n#{detail}" + raise Puppet::ParseError, msg + rescue StandardError => detail + msg += "\n#{detail.class.name} #{detail}" + raise Puppet::ParseError, msg + ensure + tmpfile.unlink + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_email_address.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_email_address.rb new file mode 100644 index 0000000..ddd0d25 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_email_address.rb @@ -0,0 +1,31 @@ +module Puppet::Parser::Functions + newfunction(:validate_email_address, :doc => <<-ENDHEREDOC + Validate that all values passed are valid email addresses. + Fail compilation if any value fails this check. + The following values will pass: + $my_email = "waldo@gmail.com" + validate_email_address($my_email) + validate_email_address("bob@gmail.com", "alice@gmail.com", $my_email) + + The following values will fail, causing compilation to abort: + $some_array = [ 'bad_email@/d/efdf.com' ] + validate_email_address($some_array) + ENDHEREDOC + ) do |args| + rescuable_exceptions = [ArgumentError] + + if args.empty? + raise Puppet::ParseError, "validate_email_address(): wrong number of arguments (#{args.length}; must be > 0)" + end + + args.each do |arg| + raise Puppet::ParseError, "#{arg.inspect} is not a string." unless arg.is_a?(String) + + begin + raise Puppet::ParseError, "#{arg.inspect} is not a valid email address" unless function_is_email_address([arg]) + rescue *rescuable_exceptions + raise Puppet::ParseError, "#{arg.inspect} is not a valid email address" + end + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_hash.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_hash.rb new file mode 100644 index 0000000..fcdc7e1 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_hash.rb @@ -0,0 +1,35 @@ +module Puppet::Parser::Functions + + newfunction(:validate_hash, :doc => <<-'ENDHEREDOC') do |args| + Validate that all passed values are hash data structures. Abort catalog + compilation if any value fails this check. + + The following values will pass: + + $my_hash = { 'one' => 'two' } + validate_hash($my_hash) + + The following values will fail, causing compilation to abort: + + validate_hash(true) + validate_hash('some_string') + $undefined = undef + validate_hash($undefined) + + ENDHEREDOC + + function_deprecation([:validate_hash, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Hash. There is further documentation for validate_legacy function in the README.']) + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_hash(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + unless arg.is_a?(Hash) + raise Puppet::ParseError, ("#{arg.inspect} is not a Hash. It looks to be a #{arg.class}") + end + end + + end + +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_integer.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_integer.rb new file mode 100644 index 0000000..2ae0293 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_integer.rb @@ -0,0 +1,134 @@ +module Puppet::Parser::Functions + + newfunction(:validate_integer, :doc => <<-'ENDHEREDOC') do |args| + Validate that the first argument is an integer (or an array of integers). Abort catalog compilation if any of the checks fail. + + The second argument is optional and passes a maximum. (All elements of) the first argument has to be less or equal to this max. + + The third argument is optional and passes a minimum. (All elements of) the first argument has to be greater or equal to this min. + If, and only if, a minimum is given, the second argument may be an empty string or undef, which will be handled to just check + if (all elements of) the first argument are greater or equal to the given minimum. + + It will fail if the first argument is not an integer or array of integers, and if arg 2 and arg 3 are not convertable to an integer. + + The following values will pass: + + validate_integer(1) + validate_integer(1, 2) + validate_integer(1, 1) + validate_integer(1, 2, 0) + validate_integer(2, 2, 2) + validate_integer(2, '', 0) + validate_integer(2, undef, 0) + $foo = undef + validate_integer(2, $foo, 0) + validate_integer([1,2,3,4,5], 6) + validate_integer([1,2,3,4,5], 6, 0) + + Plus all of the above, but any combination of values passed as strings ('1' or "1"). + Plus all of the above, but with (correct) combinations of negative integer values. + + The following values will not: + + validate_integer(true) + validate_integer(false) + validate_integer(7.0) + validate_integer({ 1 => 2 }) + $foo = undef + validate_integer($foo) + validate_integer($foobaridontexist) + + validate_integer(1, 0) + validate_integer(1, true) + validate_integer(1, '') + validate_integer(1, undef) + validate_integer(1, , 0) + validate_integer(1, 2, 3) + validate_integer(1, 3, 2) + validate_integer(1, 3, true) + + Plus all of the above, but any combination of values passed as strings ('false' or "false"). + Plus all of the above, but with incorrect combinations of negative integer values. + Plus all of the above, but with non-integer items in arrays or maximum / minimum argument. + + ENDHEREDOC + + function_deprecation([:validate_integer, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Integer. There is further documentation for validate_legacy function in the README.']) + + # tell the user we need at least one, and optionally up to two other parameters + raise Puppet::ParseError, "validate_integer(): Wrong number of arguments; must be 1, 2 or 3, got #{args.length}" unless args.length > 0 and args.length < 4 + + input, max, min = *args + + # check maximum parameter + if args.length > 1 + max = max.to_s + # allow max to be empty (or undefined) if we have a minimum set + if args.length > 2 and max == '' + max = nil + else + begin + max = Integer(max) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_integer(): Expected second argument to be unset or an Integer, got #{max}:#{max.class}" + end + end + else + max = nil + end + + # check minimum parameter + if args.length > 2 + begin + min = Integer(min.to_s) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_integer(): Expected third argument to be unset or an Integer, got #{min}:#{min.class}" + end + else + min = nil + end + + # ensure that min < max + if min and max and min > max + raise Puppet::ParseError, "validate_integer(): Expected second argument to be larger than third argument, got #{max} < #{min}" + end + + # create lamba validator function + validator = lambda do |num| + # check input < max + if max and num > max + raise Puppet::ParseError, "validate_integer(): Expected #{input.inspect} to be smaller or equal to #{max}, got #{input.inspect}." + end + # check input > min (this will only be checked if no exception has been raised before) + if min and num < min + raise Puppet::ParseError, "validate_integer(): Expected #{input.inspect} to be greater or equal to #{min}, got #{input.inspect}." + end + end + + # if this is an array, handle it. + case input + when Array + # check every element of the array + input.each_with_index do |arg, pos| + begin + raise TypeError if arg.is_a?(Hash) + arg = Integer(arg.to_s) + validator.call(arg) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_integer(): Expected element at array position #{pos} to be an Integer, got #{arg.class}" + end + end + # for the sake of compatibility with ruby 1.8, we need extra handling of hashes + when Hash + raise Puppet::ParseError, "validate_integer(): Expected first argument to be an Integer or Array, got #{input.class}" + # check the input. this will also fail any stuff other than pure, shiny integers + else + begin + input = Integer(input.to_s) + validator.call(input) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_integer(): Expected first argument to be an Integer or Array, got #{input.class}" + end + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_ip_address.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_ip_address.rb new file mode 100644 index 0000000..5d80cfb --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_ip_address.rb @@ -0,0 +1,52 @@ +module Puppet::Parser::Functions + + newfunction(:validate_ip_address, :doc => <<-ENDHEREDOC + Validate that all values passed are valid IP addresses, + regardless they are IPv4 or IPv6 + Fail compilation if any value fails this check. + The following values will pass: + $my_ip = "1.2.3.4" + validate_ip_address($my_ip) + validate_ip_address("8.8.8.8", "172.16.0.1", $my_ip) + + $my_ip = "3ffe:505:2" + validate_ip_address(1) + validate_ip_address($my_ip) + validate_ip_address("fe80::baf6:b1ff:fe19:7507", $my_ip) + + The following values will fail, causing compilation to abort: + $some_array = [ 1, true, false, "garbage string", "3ffe:505:2" ] + validate_ip_address($some_array) + ENDHEREDOC + ) do |args| + + require "ipaddr" + rescuable_exceptions = [ ArgumentError ] + + function_deprecation([:validate_ip_address, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ip_address. There is further documentation for validate_legacy function in the README.']) + + if defined?(IPAddr::InvalidAddressError) + rescuable_exceptions << IPAddr::InvalidAddressError + end + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_ip_address(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + unless arg.is_a?(String) + raise Puppet::ParseError, "#{arg.inspect} is not a string." + end + + begin + unless IPAddr.new(arg).ipv4? or IPAddr.new(arg).ipv6? + raise Puppet::ParseError, "#{arg.inspect} is not a valid IP address." + end + rescue *rescuable_exceptions + raise Puppet::ParseError, "#{arg.inspect} is not a valid IP address." + end + end + + end + +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_ipv4_address.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_ipv4_address.rb new file mode 100644 index 0000000..0660abd --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_ipv4_address.rb @@ -0,0 +1,50 @@ +module Puppet::Parser::Functions + + newfunction(:validate_ipv4_address, :doc => <<-ENDHEREDOC + Validate that all values passed are valid IPv4 addresses. + Fail compilation if any value fails this check. + + The following values will pass: + + $my_ip = "1.2.3.4" + validate_ipv4_address($my_ip) + validate_ipv4_address("8.8.8.8", "172.16.0.1", $my_ip) + + The following values will fail, causing compilation to abort: + + $some_array = [ 1, true, false, "garbage string", "3ffe:505:2" ] + validate_ipv4_address($some_array) + + ENDHEREDOC + ) do |args| + + function_deprecation([:validate_ipv4_address, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ipv4. There is further documentation for validate_legacy function in the README.']) + + require "ipaddr" + rescuable_exceptions = [ ArgumentError ] + + if defined?(IPAddr::InvalidAddressError) + rescuable_exceptions << IPAddr::InvalidAddressError + end + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_ipv4_address(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + unless arg.is_a?(String) + raise Puppet::ParseError, "#{arg.inspect} is not a string." + end + + begin + unless IPAddr.new(arg).ipv4? + raise Puppet::ParseError, "#{arg.inspect} is not a valid IPv4 address." + end + rescue *rescuable_exceptions + raise Puppet::ParseError, "#{arg.inspect} is not a valid IPv4 address." + end + end + + end + +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_ipv6_address.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_ipv6_address.rb new file mode 100644 index 0000000..f5dd9e5 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_ipv6_address.rb @@ -0,0 +1,51 @@ +module Puppet::Parser::Functions + + newfunction(:validate_ipv6_address, :doc => <<-ENDHEREDOC + Validate that all values passed are valid IPv6 addresses. + Fail compilation if any value fails this check. + + The following values will pass: + + $my_ip = "3ffe:505:2" + validate_ipv6_address(1) + validate_ipv6_address($my_ip) + validate_bool("fe80::baf6:b1ff:fe19:7507", $my_ip) + + The following values will fail, causing compilation to abort: + + $some_array = [ true, false, "garbage string", "1.2.3.4" ] + validate_ipv6_address($some_array) + + ENDHEREDOC + ) do |args| + + function_deprecation([:validate_ipv6_address, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Ipv6. There is further documentation for validate_legacy function in the README.']) + + require "ipaddr" + rescuable_exceptions = [ ArgumentError ] + + if defined?(IPAddr::InvalidAddressError) + rescuable_exceptions << IPAddr::InvalidAddressError + end + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_ipv6_address(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + unless arg.is_a?(String) + raise Puppet::ParseError, "#{arg.inspect} is not a string." + end + + begin + unless IPAddr.new(arg).ipv6? + raise Puppet::ParseError, "#{arg.inspect} is not a valid IPv6 address." + end + rescue *rescuable_exceptions + raise Puppet::ParseError, "#{arg.inspect} is not a valid IPv6 address." + end + end + + end + +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_numeric.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_numeric.rb new file mode 100644 index 0000000..4205b30 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_numeric.rb @@ -0,0 +1,96 @@ +module Puppet::Parser::Functions + + newfunction(:validate_numeric, :doc => <<-'ENDHEREDOC') do |args| + Validate that the first argument is a numeric value (or an array of numeric values). Abort catalog compilation if any of the checks fail. + + The second argument is optional and passes a maximum. (All elements of) the first argument has to be less or equal to this max. + + The third argument is optional and passes a minimum. (All elements of) the first argument has to be greater or equal to this min. + If, and only if, a minimum is given, the second argument may be an empty string or undef, which will be handled to just check + if (all elements of) the first argument are greater or equal to the given minimum. + + It will fail if the first argument is not a numeric (Integer or Float) or array of numerics, and if arg 2 and arg 3 are not convertable to a numeric. + + For passing and failing usage, see `validate_integer()`. It is all the same for validate_numeric, yet now floating point values are allowed, too. + + ENDHEREDOC + + function_deprecation([:validate_numeric, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Numeric. There is further documentation for validate_legacy function in the README.']) + + # tell the user we need at least one, and optionally up to two other parameters + raise Puppet::ParseError, "validate_numeric(): Wrong number of arguments; must be 1, 2 or 3, got #{args.length}" unless args.length > 0 and args.length < 4 + + input, max, min = *args + + # check maximum parameter + if args.length > 1 + max = max.to_s + # allow max to be empty (or undefined) if we have a minimum set + if args.length > 2 and max == '' + max = nil + else + begin + max = Float(max) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_numeric(): Expected second argument to be unset or a Numeric, got #{max}:#{max.class}" + end + end + else + max = nil + end + + # check minimum parameter + if args.length > 2 + begin + min = Float(min.to_s) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_numeric(): Expected third argument to be unset or a Numeric, got #{min}:#{min.class}" + end + else + min = nil + end + + # ensure that min < max + if min and max and min > max + raise Puppet::ParseError, "validate_numeric(): Expected second argument to be larger than third argument, got #{max} < #{min}" + end + + # create lamba validator function + validator = lambda do |num| + # check input < max + if max and num > max + raise Puppet::ParseError, "validate_numeric(): Expected #{input.inspect} to be smaller or equal to #{max}, got #{input.inspect}." + end + # check input > min (this will only be checked if no exception has been raised before) + if min and num < min + raise Puppet::ParseError, "validate_numeric(): Expected #{input.inspect} to be greater or equal to #{min}, got #{input.inspect}." + end + end + + # if this is an array, handle it. + case input + when Array + # check every element of the array + input.each_with_index do |arg, pos| + begin + raise TypeError if arg.is_a?(Hash) + arg = Float(arg.to_s) + validator.call(arg) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_numeric(): Expected element at array position #{pos} to be a Numeric, got #{arg.class}" + end + end + # for the sake of compatibility with ruby 1.8, we need extra handling of hashes + when Hash + raise Puppet::ParseError, "validate_integer(): Expected first argument to be a Numeric or Array, got #{input.class}" + # check the input. this will also fail any stuff other than pure, shiny integers + else + begin + input = Float(input.to_s) + validator.call(input) + rescue TypeError, ArgumentError + raise Puppet::ParseError, "validate_numeric(): Expected first argument to be a Numeric or Array, got #{input.class}" + end + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_re.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_re.rb new file mode 100644 index 0000000..0ac83dd --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_re.rb @@ -0,0 +1,50 @@ +module Puppet::Parser::Functions + newfunction(:validate_re, :doc => <<-'ENDHEREDOC') do |args| + Perform simple validation of a string against one or more regular + expressions. The first argument of this function should be a string to + test, and the second argument should be a stringified regular expression + (without the // delimiters) or an array of regular expressions. If none + of the regular expressions match the string passed in, compilation will + abort with a parse error. + + If a third argument is specified, this will be the error message raised and + seen by the user. + + The following strings will validate against the regular expressions: + + validate_re('one', '^one$') + validate_re('one', [ '^one', '^two' ]) + + The following strings will fail to validate, causing compilation to abort: + + validate_re('one', [ '^two', '^three' ]) + + A helpful error message can be returned like this: + + validate_re($::puppetversion, '^2.7', 'The $puppetversion fact value does not match 2.7') + + Note: Compilation will also abort, if the first argument is not a String. Always use + quotes to force stringification: + + validate_re("${::operatingsystemmajrelease}", '^[57]$') + + ENDHEREDOC + + function_deprecation([:validate_re, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Re. There is further documentation for validate_legacy function in the README.']) + + if (args.length < 2) or (args.length > 3) then + raise Puppet::ParseError, "validate_re(): wrong number of arguments (#{args.length}; must be 2 or 3)" + end + + raise Puppet::ParseError, "validate_re(): input needs to be a String, not a #{args[0].class}" unless args[0].is_a? String + + msg = args[2] || "validate_re(): #{args[0].inspect} does not match #{args[1].inspect}" + + # We're using a flattened array here because we can't call String#any? in + # Ruby 1.9 like we can in Ruby 1.8 + raise Puppet::ParseError, msg unless [args[1]].flatten.any? do |re_str| + args[0] =~ Regexp.compile(re_str) + end + + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_slength.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_slength.rb new file mode 100644 index 0000000..383855c --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_slength.rb @@ -0,0 +1,71 @@ +module Puppet::Parser::Functions + + newfunction(:validate_slength, :doc => <<-'ENDHEREDOC') do |args| + Validate that the first argument is a string (or an array of strings), and + less/equal to than the length of the second argument. An optional third + parameter can be given the minimum length. It fails if the first + argument is not a string or array of strings, and if arg 2 and arg 3 are + not convertable to a number. + + The following values will pass: + + validate_slength("discombobulate",17) + validate_slength(["discombobulate","moo"],17) + validate_slength(["discombobulate","moo"],17,3) + + The following valueis will not: + + validate_slength("discombobulate",1) + validate_slength(["discombobulate","thermometer"],5) + validate_slength(["discombobulate","moo"],17,10) + + ENDHEREDOC + + function_deprecation([:validate_slength, 'This method is deprecated, please use the stdlib validate_legacy function, with String[]. There is further documentation for validate_legacy function in the README.']) + + raise Puppet::ParseError, "validate_slength(): Wrong number of arguments (#{args.length}; must be 2 or 3)" unless args.length == 2 or args.length == 3 + + input, max_length, min_length = *args + + begin + max_length = Integer(max_length) + raise ArgumentError if max_length <= 0 + rescue ArgumentError, TypeError + raise Puppet::ParseError, "validate_slength(): Expected second argument to be a positive Numeric, got #{max_length}:#{max_length.class}" + end + + if min_length + begin + min_length = Integer(min_length) + raise ArgumentError if min_length < 0 + rescue ArgumentError, TypeError + raise Puppet::ParseError, "validate_slength(): Expected third argument to be unset or a positive Numeric, got #{min_length}:#{min_length.class}" + end + else + min_length = 0 + end + + raise Puppet::ParseError, "validate_slength(): Expected second argument to be equal to or larger than third argument" unless max_length >= min_length + + validator = lambda do |str| + unless str.length <= max_length and str.length >= min_length + raise Puppet::ParseError, "validate_slength(): Expected length of #{input.inspect} to be between #{min_length} and #{max_length}, was #{input.length}" + end + end + + case input + when String + validator.call(input) + when Array + input.each_with_index do |arg, pos| + if arg.is_a? String + validator.call(arg) + else + raise Puppet::ParseError, "validate_slength(): Expected element at array position #{pos} to be a String, got #{arg.class}" + end + end + else + raise Puppet::ParseError, "validate_slength(): Expected first argument to be a String or Array, got #{input.class}" + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_string.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_string.rb new file mode 100644 index 0000000..6675d86 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_string.rb @@ -0,0 +1,41 @@ +module Puppet::Parser::Functions + + newfunction(:validate_string, :doc => <<-'ENDHEREDOC') do |args| + Validate that all passed values are string data structures. Abort catalog + compilation if any value fails this check. + + The following values will pass: + + $my_string = "one two" + validate_string($my_string, 'three') + + The following values will fail, causing compilation to abort: + + validate_string(true) + validate_string([ 'some', 'array' ]) + + Note: validate_string(undef) will not fail in this version of the + functions API (incl. current and future parser). Instead, use: + + if $var == undef { + fail('...') + } + + ENDHEREDOC + + function_deprecation([:validate_string, 'This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::String. There is further documentation for validate_legacy function in the README.']) + + unless args.length > 0 then + raise Puppet::ParseError, ("validate_string(): wrong number of arguments (#{args.length}; must be > 0)") + end + + args.each do |arg| + # when called through the v4 API shim, undef gets translated to nil + unless arg.is_a?(String) || arg.nil? + raise Puppet::ParseError, ("#{arg.inspect} is not a string. It looks to be a #{arg.class}") + end + end + + end + +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_x509_rsa_key_pair.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_x509_rsa_key_pair.rb new file mode 100644 index 0000000..fc9f23f --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/validate_x509_rsa_key_pair.rb @@ -0,0 +1,47 @@ +module Puppet::Parser::Functions + + newfunction(:validate_x509_rsa_key_pair, :doc => <<-ENDHEREDOC + Validates a PEM-formatted X.509 certificate and RSA private key using + OpenSSL. Verifies that the certficate's signature was created from the + supplied key. + + Fail compilation if any value fails this check. + + validate_x509_rsa_key_pair($cert, $key) + + ENDHEREDOC + ) do |args| + + require 'openssl' + + NUM_ARGS = 2 unless defined? NUM_ARGS + + unless args.length == NUM_ARGS then + raise Puppet::ParseError, + ("validate_x509_rsa_key_pair(): wrong number of arguments (#{args.length}; must be #{NUM_ARGS})") + end + + args.each do |arg| + unless arg.is_a?(String) + raise Puppet::ParseError, "#{arg.inspect} is not a string." + end + end + + begin + cert = OpenSSL::X509::Certificate.new(args[0]) + rescue OpenSSL::X509::CertificateError => e + raise Puppet::ParseError, "Not a valid x509 certificate: #{e}" + end + + begin + key = OpenSSL::PKey::RSA.new(args[1]) + rescue OpenSSL::PKey::RSAError => e + raise Puppet::ParseError, "Not a valid RSA key: #{e}" + end + + unless cert.verify(key) + raise Puppet::ParseError, "Certificate signature does not match supplied key" + end + end + +end diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/values.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/values.rb new file mode 100644 index 0000000..0ca236c --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/values.rb @@ -0,0 +1,38 @@ +# +# values.rb +# + +module Puppet::Parser::Functions + newfunction(:values, :type => :rvalue, :doc => <<-EOS +When given a hash this function will return the values of that hash. + +*Examples:* + + $hash = { + 'a' => 1, + 'b' => 2, + 'c' => 3, + } + values($hash) + +This example would return: + + [1,2,3] + EOS + ) do |arguments| + + raise(Puppet::ParseError, "values(): Wrong number of arguments given (#{arguments.size} for 1)") if arguments.size < 1 + + hash = arguments[0] + + unless hash.is_a?(Hash) + raise(Puppet::ParseError, 'values(): Requires hash to work with') + end + + result = hash.values + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/values_at.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/values_at.rb new file mode 100644 index 0000000..04a3d1a --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/values_at.rb @@ -0,0 +1,93 @@ +# +# values_at.rb +# + +module Puppet::Parser::Functions + newfunction(:values_at, :type => :rvalue, :doc => <<-EOS +Finds value inside an array based on location. + +The first argument is the array you want to analyze, and the second element can +be a combination of: + +* A single numeric index +* A range in the form of 'start-stop' (eg. 4-9) +* An array combining the above + +*Examples*: + + values_at(['a','b','c'], 2) + +Would return ['c']. + + values_at(['a','b','c'], ["0-1"]) + +Would return ['a','b']. + + values_at(['a','b','c','d','e'], [0, "2-3"]) + +Would return ['a','c','d']. + EOS + ) do |arguments| + + raise(Puppet::ParseError, "values_at(): Wrong number of arguments given (#{arguments.size} for 2)") if arguments.size < 2 + + array = arguments.shift + + unless array.is_a?(Array) + raise(Puppet::ParseError, 'values_at(): Requires array to work with') + end + + indices = [arguments.shift].flatten() # Get them all ... Pokemon ... + + if not indices or indices.empty? + raise(Puppet::ParseError, 'values_at(): You must provide at least one positive index to collect') + end + + result = [] + indices_list = [] + + indices.each do |i| + i = i.to_s + if m = i.match(/^(\d+)(\.\.\.?|\-)(\d+)$/) + start = m[1].to_i + stop = m[3].to_i + + type = m[2] + + if start > stop + raise(Puppet::ParseError, 'values_at(): Stop index in given indices range is smaller than the start index') + elsif stop > array.size - 1 # First element is at index 0 is it not? + raise(Puppet::ParseError, 'values_at(): Stop index in given indices range exceeds array size') + end + + range = case type + when /^(\.\.|\-)$/ then (start .. stop) + when /^(\.\.\.)$/ then (start ... stop) # Exclusive of last element ... + end + + range.each { |i| indices_list << i.to_i } + else + # Only positive numbers allowed in this case ... + if not i.match(/^\d+$/) + raise(Puppet::ParseError, 'values_at(): Unknown format of given index') + end + + # In Puppet numbers are often string-encoded ... + i = i.to_i + + if i > array.size - 1 # Same story. First element is at index 0 ... + raise(Puppet::ParseError, 'values_at(): Given index exceeds array size') + end + + indices_list << i + end + end + + # We remove nil values as they make no sense in Puppet DSL ... + result = indices_list.collect { |i| array[i] }.compact + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/parser/functions/zip.rb b/environments/production/modules/stdlib/lib/puppet/parser/functions/zip.rb new file mode 100644 index 0000000..13e24b6 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/parser/functions/zip.rb @@ -0,0 +1,38 @@ +# +# zip.rb +# + +module Puppet::Parser::Functions + newfunction(:zip, :type => :rvalue, :doc => <<-EOS +Takes one element from first array and merges corresponding elements from second array. This generates a sequence of n-element arrays, where n is one more than the count of arguments. + +*Example:* + + zip(['1','2','3'],['4','5','6']) + +Would result in: + + ["1", "4"], ["2", "5"], ["3", "6"] + EOS + ) do |arguments| + + # Technically we support three arguments but only first is mandatory ... + raise(Puppet::ParseError, "zip(): Wrong number of arguments given (#{arguments.size} for 2)") if arguments.size < 2 + + a = arguments[0] + b = arguments[1] + + unless a.is_a?(Array) and b.is_a?(Array) + raise(Puppet::ParseError, 'zip(): Requires array to work with') + end + + flatten = function_str2bool([arguments[2]]) if arguments[2] + + result = a.zip(b) + result = flatten ? result.flatten : result + + return result + end +end + +# vim: set ts=2 sw=2 et : diff --git a/environments/production/modules/stdlib/lib/puppet/provider/file_line/ruby.rb b/environments/production/modules/stdlib/lib/puppet/provider/file_line/ruby.rb new file mode 100644 index 0000000..fbf7d8e --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/provider/file_line/ruby.rb @@ -0,0 +1,132 @@ +Puppet::Type.type(:file_line).provide(:ruby) do + def exists? + if resource[:replace].to_s != 'true' and count_matches(match_regex) > 0 + true + else + lines.find do |line| + if resource[:ensure].to_s == 'absent' and resource[:match_for_absence].to_s == 'true' + line.chomp =~ Regexp.new(resource[:match]) + else + line.chomp == resource[:line].chomp + end + end + end + end + + def create + unless resource[:replace].to_s != 'true' and count_matches(match_regex) > 0 + if resource[:match] + handle_create_with_match + elsif resource[:after] + handle_create_with_after + else + append_line + end + end + end + + def destroy + if resource[:match_for_absence].to_s == 'true' and resource[:match] + handle_destroy_with_match + else + handle_destroy_line + end + end + + private + def lines + # If this type is ever used with very large files, we should + # write this in a different way, using a temp + # file; for now assuming that this type is only used on + # small-ish config files that can fit into memory without + # too much trouble. + @lines ||= File.readlines(resource[:path], :encoding => resource[:encoding]) + end + + def match_regex + resource[:match] ? Regexp.new(resource[:match]) : nil + end + + def handle_create_with_match() + regex_after = resource[:after] ? Regexp.new(resource[:after]) : nil + match_count = count_matches(match_regex) + + if match_count > 1 && resource[:multiple].to_s != 'true' + raise Puppet::Error, "More than one line in file '#{resource[:path]}' matches pattern '#{resource[:match]}'" + end + + File.open(resource[:path], 'w') do |fh| + lines.each do |l| + fh.puts(match_regex.match(l) ? resource[:line] : l) + if (match_count == 0 and regex_after) + if regex_after.match(l) + fh.puts(resource[:line]) + match_count += 1 #Increment match_count to indicate that the new line has been inserted. + end + end + end + + if (match_count == 0) + fh.puts(resource[:line]) + end + end + end + + def handle_create_with_after + regex = Regexp.new(resource[:after]) + count = count_matches(regex) + + if count > 1 && resource[:multiple].to_s != 'true' + raise Puppet::Error, "#{count} lines match pattern '#{resource[:after]}' in file '#{resource[:path]}'. One or no line must match the pattern." + end + + File.open(resource[:path], 'w') do |fh| + lines.each do |l| + fh.puts(l) + if regex.match(l) then + fh.puts(resource[:line]) + end + end + end + + if (count == 0) # append the line to the end of the file + append_line + end + end + + def count_matches(regex) + lines.select{|l| l.match(regex)}.size + end + + def handle_destroy_with_match + match_count = count_matches(match_regex) + if match_count > 1 && resource[:multiple].to_s != 'true' + raise Puppet::Error, "More than one line in file '#{resource[:path]}' matches pattern '#{resource[:match]}'" + end + + local_lines = lines + File.open(resource[:path],'w') do |fh| + fh.write(local_lines.reject{|l| match_regex.match(l) }.join('')) + end + end + + def handle_destroy_line + local_lines = lines + File.open(resource[:path],'w') do |fh| + fh.write(local_lines.reject{|l| l.chomp == resource[:line] }.join('')) + end + end + + ## + # append the line to the file. + # + # @api private + def append_line + File.open(resource[:path], 'w') do |fh| + lines.each do |l| + fh.puts(l) + end + fh.puts resource[:line] + end + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/type/anchor.rb b/environments/production/modules/stdlib/lib/puppet/type/anchor.rb new file mode 100644 index 0000000..fe1e5aa --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/type/anchor.rb @@ -0,0 +1,46 @@ +Puppet::Type.newtype(:anchor) do + desc <<-'ENDOFDESC' + A simple resource type intended to be used as an anchor in a composite class. + + In Puppet 2.6, when a class declares another class, the resources in the + interior class are not contained by the exterior class. This interacts badly + with the pattern of composing complex modules from smaller classes, as it + makes it impossible for end users to specify order relationships between the + exterior class and other modules. + + The anchor type lets you work around this. By sandwiching any interior + classes between two no-op resources that _are_ contained by the exterior + class, you can ensure that all resources in the module are contained. + + class ntp { + # These classes will have the correct order relationship with each + # other. However, without anchors, they won't have any order + # relationship to Class['ntp']. + class { 'ntp::package': } + -> class { 'ntp::config': } + -> class { 'ntp::service': } + + # These two resources "anchor" the composed classes within the ntp + # class. + anchor { 'ntp::begin': } -> Class['ntp::package'] + Class['ntp::service'] -> anchor { 'ntp::end': } + } + + This allows the end user of the ntp module to establish require and before + relationships with Class['ntp']: + + class { 'ntp': } -> class { 'mcollective': } + class { 'mcollective': } -> class { 'ntp': } + + ENDOFDESC + + newparam :name do + desc "The name of the anchor resource." + end + + def refresh + # We don't do anything with them, but we need this to + # show that we are "refresh aware" and not break the + # chain of propagation. + end +end diff --git a/environments/production/modules/stdlib/lib/puppet/type/file_line.rb b/environments/production/modules/stdlib/lib/puppet/type/file_line.rb new file mode 100644 index 0000000..e82b246 --- /dev/null +++ b/environments/production/modules/stdlib/lib/puppet/type/file_line.rb @@ -0,0 +1,146 @@ +Puppet::Type.newtype(:file_line) do + + desc <<-EOT + Ensures that a given line is contained within a file. The implementation + matches the full line, including whitespace at the beginning and end. If + the line is not contained in the given file, Puppet will append the line to + the end of the file to ensure the desired state. Multiple resources may + be declared to manage multiple lines in the same file. + + Example: + + file_line { 'sudo_rule': + path => '/etc/sudoers', + line => '%sudo ALL=(ALL) ALL', + } + + file_line { 'sudo_rule_nopw': + path => '/etc/sudoers', + line => '%sudonopw ALL=(ALL) NOPASSWD: ALL', + } + + In this example, Puppet will ensure both of the specified lines are + contained in the file /etc/sudoers. + + Match Example: + + file_line { 'bashrc_proxy': + ensure => present, + path => '/etc/bashrc', + line => 'export HTTP_PROXY=http://squid.puppetlabs.vm:3128', + match => '^export\ HTTP_PROXY\=', + } + + In this code example match will look for a line beginning with export + followed by HTTP_PROXY and replace it with the value in line. + + Match Example With `ensure => absent`: + + file_line { 'bashrc_proxy': + ensure => absent, + path => '/etc/bashrc', + line => 'export HTTP_PROXY=http://squid.puppetlabs.vm:3128', + match => '^export\ HTTP_PROXY\=', + match_for_absence => true, + } + + In this code example match will look for a line beginning with export + followed by HTTP_PROXY and delete it. If multiple lines match, an + error will be raised unless the `multiple => true` parameter is set. + + Encoding example: + + file_line { "XScreenSaver": + ensure => present, + path => '/root/XScreenSaver' + line => "*lock: 10:00:00", + match => '^*lock:', + encoding => "iso-8859-1", + } + + Files with special characters that are not valid UTF-8 will give the + error message "invalid byte sequence in UTF-8". In this case, determine + the correct file encoding and specify the correct encoding using the + encoding attribute, the value of which needs to be a valid Ruby character + encoding. + + **Autorequires:** If Puppet is managing the file that will contain the line + being managed, the file_line resource will autorequire that file. + EOT + + ensurable do + defaultvalues + defaultto :present + end + + newparam(:name, :namevar => true) do + desc 'An arbitrary name used as the identity of the resource.' + end + + newparam(:match) do + desc 'An optional ruby regular expression to run against existing lines in the file.' + + ' If a match is found, we replace that line rather than adding a new line.' + + ' A regex comparison is performed against the line value and if it does not' + + ' match an exception will be raised.' + end + + newparam(:match_for_absence) do + desc 'An optional value to determine if match should be applied when ensure => absent.' + + ' If set to true and match is set, the line that matches match will be deleted.' + + ' If set to false (the default), match is ignored when ensure => absent.' + + ' When `ensure => present`, match_for_absence is ignored.' + newvalues(true, false) + defaultto false + end + + newparam(:multiple) do + desc 'An optional value to determine if match can change multiple lines.' + + ' If set to false, an exception will be raised if more than one line matches' + newvalues(true, false) + end + + newparam(:after) do + desc 'An optional value used to specify the line after which we will add any new lines. (Existing lines are added in place)' + + ' This is also takes a regex.' + end + + newparam(:line) do + desc 'The line to be appended to the file or used to replace matches found by the match attribute.' + end + + newparam(:path) do + desc 'The file Puppet will ensure contains the line specified by the line parameter.' + validate do |value| + unless Puppet::Util.absolute_path?(value) + raise Puppet::Error, "File paths must be fully qualified, not '#{value}'" + end + end + end + + newparam(:replace) do + desc 'If true, replace line that matches. If false, do not write line if a match is found' + newvalues(true, false) + defaultto true + end + + newparam(:encoding) do + desc 'For files that are not UTF-8 encoded, specify encoding such as iso-8859-1' + defaultto 'UTF-8' + end + + # Autorequire the file resource if it's being managed + autorequire(:file) do + self[:path] + end + + validate do + unless self[:line] + unless (self[:ensure].to_s == 'absent') and (self[:match_for_absence].to_s == 'true') and self[:match] + raise(Puppet::Error, "line is a required attribute") + end + end + unless self[:path] + raise(Puppet::Error, "path is a required attribute") + end + end +end diff --git a/environments/production/modules/stdlib/manifests/init.pp b/environments/production/modules/stdlib/manifests/init.pp new file mode 100644 index 0000000..9ea22a7 --- /dev/null +++ b/environments/production/modules/stdlib/manifests/init.pp @@ -0,0 +1,18 @@ +# Class: stdlib +# +# This module manages stdlib. Most of stdlib's features are automatically +# loaded by Puppet, but this class should be declared in order to use the +# standardized run stages. +# +# Parameters: none +# +# Actions: +# +# Declares all other classes in the stdlib module. Currently, this consists +# of stdlib::stages. +# +# Requires: nothing +# +class stdlib { + include ::stdlib::stages +} diff --git a/environments/production/modules/stdlib/manifests/stages.pp b/environments/production/modules/stdlib/manifests/stages.pp new file mode 100644 index 0000000..7de254c --- /dev/null +++ b/environments/production/modules/stdlib/manifests/stages.pp @@ -0,0 +1,43 @@ +# Class: stdlib::stages +# +# This class manages a standard set of run stages for Puppet. It is managed by +# the stdlib class, and should not be declared independently. +# +# The high level stages are (in order): +# +# * setup +# * main +# * runtime +# * setup_infra +# * deploy_infra +# * setup_app +# * deploy_app +# * deploy +# +# Parameters: none +# +# Actions: +# +# Declares various run-stages for deploying infrastructure, +# language runtimes, and application layers. +# +# Requires: nothing +# +# Sample Usage: +# +# node default { +# include ::stdlib +# class { java: stage => 'runtime' } +# } +# +class stdlib::stages { + + stage { 'setup': before => Stage['main'] } + stage { 'runtime': require => Stage['main'] } + -> stage { 'setup_infra': } + -> stage { 'deploy_infra': } + -> stage { 'setup_app': } + -> stage { 'deploy_app': } + -> stage { 'deploy': } + +} diff --git a/environments/production/modules/stdlib/metadata.json b/environments/production/modules/stdlib/metadata.json new file mode 100644 index 0000000..419a8af --- /dev/null +++ b/environments/production/modules/stdlib/metadata.json @@ -0,0 +1,112 @@ +{ + "name": "puppetlabs-stdlib", + "version": "4.16.0", + "author": "puppetlabs", + "summary": "Standard library of resources for Puppet modules.", + "license": "Apache-2.0", + "source": "https://github.com/puppetlabs/puppetlabs-stdlib", + "project_page": "https://github.com/puppetlabs/puppetlabs-stdlib", + "issues_url": "https://tickets.puppetlabs.com/browse/MODULES", + "dependencies": [ + + ], + "data_provider": null, + "operatingsystem_support": [ + { + "operatingsystem": "RedHat", + "operatingsystemrelease": [ + "4", + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "CentOS", + "operatingsystemrelease": [ + "4", + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "OracleLinux", + "operatingsystemrelease": [ + "4", + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "Scientific", + "operatingsystemrelease": [ + "4", + "5", + "6", + "7" + ] + }, + { + "operatingsystem": "SLES", + "operatingsystemrelease": [ + "10 SP4", + "11 SP1", + "12" + ] + }, + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "6", + "7", + "8" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "10.04", + "12.04", + "14.04", + "16.04" + ] + }, + { + "operatingsystem": "Solaris", + "operatingsystemrelease": [ + "10", + "11" + ] + }, + { + "operatingsystem": "Windows", + "operatingsystemrelease": [ + "Server 2003", + "Server 2003 R2", + "Server 2008", + "Server 2008 R2", + "Server 2012", + "Server 2012 R2", + "7", + "8" + ] + }, + { + "operatingsystem": "AIX", + "operatingsystemrelease": [ + "5.3", + "6.1", + "7.1" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">=2.7.20 <5.0.0" + } + ], + "description": "Standard Library for Puppet Modules" +} diff --git a/environments/production/modules/stdlib/spec/acceptance/abs_spec.rb b/environments/production/modules/stdlib/spec/acceptance/abs_spec.rb new file mode 100755 index 0000000..5af436f --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/abs_spec.rb @@ -0,0 +1,30 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'abs function' do + describe 'success' do + it 'should accept a string' do + pp = <<-EOS + $input = '-34.56' + $output = abs($input) + notify { "$output": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: 34.56/) + end + end + + it 'should accept a float' do + pp = <<-EOS + $input = -34.56 + $output = abs($input) + notify { "$output": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: 34.56/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/anchor_spec.rb b/environments/production/modules/stdlib/spec/acceptance/anchor_spec.rb new file mode 100755 index 0000000..24a9064 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/anchor_spec.rb @@ -0,0 +1,26 @@ +require 'spec_helper_acceptance' + +describe 'anchor type' do + describe 'success' do + it 'should effect proper chaining of resources' do + pp = <<-EOS + class anchored { + anchor { 'anchored::begin': } + ~> anchor { 'anchored::end': } + } + + class anchorrefresh { + notify { 'first': } + ~> class { 'anchored': } + ~> anchor { 'final': } + } + + include anchorrefresh + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Anchor\[final\]: Triggered 'refresh'/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/any2array_spec.rb b/environments/production/modules/stdlib/spec/acceptance/any2array_spec.rb new file mode 100755 index 0000000..8a13911 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/any2array_spec.rb @@ -0,0 +1,49 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'any2array function' do + describe 'success' do + it 'should create an empty array' do + pp = <<-EOS + $input = '' + $output = any2array($input) + validate_array($output) + notify { "Output: ${output}": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: Output: /) + end + end + + it 'should leave arrays modified' do + pp = <<-EOS + $input = ['test', 'array'] + $output = any2array($input) + validate_array($output) + notify { "Output: ${output}": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: Output: (\[|)test(,\s|)array(\]|)/) + end + end + + it 'should turn a hash into an array' do + pp = <<-EOS + $input = {'test' => 'array'} + $output = any2array($input) + + validate_array($output) + # Check each element of the array is a plain string. + validate_string($output[0]) + validate_string($output[1]) + notify { "Output: ${output}": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: Output: (\[|)test(,\s|)array(\]|)/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/base64_spec.rb b/environments/production/modules/stdlib/spec/acceptance/base64_spec.rb new file mode 100755 index 0000000..e9096a7 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/base64_spec.rb @@ -0,0 +1,18 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'base64 function' do + describe 'success' do + it 'should encode then decode a string' do + pp = <<-EOS + $encodestring = base64('encode', 'thestring') + $decodestring = base64('decode', $encodestring) + notify { $decodestring: } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/thestring/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/bool2num_spec.rb b/environments/production/modules/stdlib/spec/acceptance/bool2num_spec.rb new file mode 100755 index 0000000..c69acc6 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/bool2num_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'bool2num function' do + describe 'success' do + ['false', 'f', '0', 'n', 'no'].each do |bool| + it "should convert a given boolean, #{bool}, to 0" do + pp = <<-EOS + $input = "#{bool}" + $output = bool2num($input) + notify { "$output": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: 0/) + end + end + end + + ['true', 't', '1', 'y', 'yes'].each do |bool| + it "should convert a given boolean, #{bool}, to 1" do + pp = <<-EOS + $input = "#{bool}" + $output = bool2num($input) + notify { "$output": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: 1/) + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/build_csv.rb b/environments/production/modules/stdlib/spec/acceptance/build_csv.rb new file mode 100755 index 0000000..62ecbf1 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/build_csv.rb @@ -0,0 +1,83 @@ +#!/usr/bin/env ruby +# vim: set sw=2 sts=2 et tw=80 : +require 'rspec' + +#XXX Super ugly hack to keep from starting beaker nodes +module Kernel + # make an alias of the original require + alias_method :original_require, :require + # rewrite require + def require name + original_require name if name != 'spec_helper_acceptance' + end +end +UNSUPPORTED_PLATFORMS = [] +def fact(*args) [] end +#XXX End hax + +# Get a list of functions for test coverage +function_list = Dir[File.join(File.dirname(__FILE__),"..","..","lib","puppet","parser","functions","*.rb")].collect do |function_rb| + File.basename(function_rb,".rb") +end + +## Configure rspec to parse tests +options = RSpec::Core::ConfigurationOptions.new(['spec/acceptance']) +configuration = RSpec::configuration +world = RSpec::world +options.parse_options +options.configure(configuration) +configuration.load_spec_files + +## Collect up tests and example groups into a hash +def get_tests(children) + children.inject({}) do |memo,c| + memo[c.description] = Hash.new + memo[c.description]["groups"] = get_tests(c.children) unless c.children.empty? + memo[c.description]["tests"] = c.examples.collect { |e| + e.description unless e.pending? + }.compact unless c.examples.empty? + memo[c.description]["pending_tests"] = c.examples.collect { |e| + e.description if e.pending? + }.compact unless c.examples.empty? + memo + end +end + +def count_test_types_in(type,group) + return 0 if group.nil? + group.inject(0) do |m,(k,v)| + m += v.length if k == type + m += count_tests_in(v) if v.is_a?(Hash) + m + end +end +def count_tests_in(group) + count_test_types_in('tests',group) +end +def count_pending_tests_in(group) + count_test_types_in('pending_tests',group) +end + +# Convert tests hash to csv format +def to_csv(function_list,tests) + function_list.collect do |function_name| + if v = tests["#{function_name} function"] + positive_tests = count_tests_in(v["groups"]["success"]) + negative_tests = count_tests_in(v["groups"]["failure"]) + pending_tests = + count_pending_tests_in(v["groups"]["failure"]) + + count_pending_tests_in(v["groups"]["failure"]) + else + positive_tests = 0 + negative_tests = 0 + pending_tests = 0 + end + sprintf("%-25s, %-9d, %-9d, %-9d", function_name,positive_tests,negative_tests,pending_tests) + end.compact +end + +tests = get_tests(world.example_groups) +csv = to_csv(function_list,tests) +percentage_tested = "#{tests.count*100/function_list.count}%" +printf("%-25s, %-9s, %-9s, %-9s\n","#{percentage_tested} have tests.","Positive","Negative","Pending") +puts csv diff --git a/environments/production/modules/stdlib/spec/acceptance/capitalize_spec.rb b/environments/production/modules/stdlib/spec/acceptance/capitalize_spec.rb new file mode 100755 index 0000000..03d01a8 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/capitalize_spec.rb @@ -0,0 +1,33 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'capitalize function' do + describe 'success' do + it 'should capitalize the first letter of a string' do + pp = <<-EOS + $input = 'this is a string' + $output = capitalize($input) + notify { $output: } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: This is a string/) + end + end + + it 'should capitalize the first letter of an array of strings' do + pp = <<-EOS + $input = ['this', 'is', 'a', 'string'] + $output = capitalize($input) + notify { $output: } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: This/) + expect(r.stdout).to match(/Notice: Is/) + expect(r.stdout).to match(/Notice: A/) + expect(r.stdout).to match(/Notice: String/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/ceiling_spec.rb b/environments/production/modules/stdlib/spec/acceptance/ceiling_spec.rb new file mode 100755 index 0000000..895e4a0 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/ceiling_spec.rb @@ -0,0 +1,39 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'ceiling function' do + describe 'success' do + it 'ceilings floats' do + pp = <<-EOS + $a = 12.8 + $b = 13 + $o = ceiling($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'ceilings integers' do + pp = <<-EOS + $a = 7 + $b = 7 + $o = ceiling($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-numbers' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/chomp_spec.rb b/environments/production/modules/stdlib/spec/acceptance/chomp_spec.rb new file mode 100755 index 0000000..56e0876 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/chomp_spec.rb @@ -0,0 +1,21 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'chomp function' do + describe 'success' do + it 'should eat the newline' do + pp = <<-EOS + $input = "test\n" + if size($input) != 5 { + fail("Size of ${input} is not 5.") + } + $output = chomp($input) + if size($output) != 4 { + fail("Size of ${input} is not 4.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/chop_spec.rb b/environments/production/modules/stdlib/spec/acceptance/chop_spec.rb new file mode 100755 index 0000000..0993806 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/chop_spec.rb @@ -0,0 +1,45 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'chop function' do + describe 'success' do + it 'should eat the last character' do + pp = <<-EOS + $input = "test" + if size($input) != 4 { + fail("Size of ${input} is not 4.") + } + $output = chop($input) + if size($output) != 3 { + fail("Size of ${input} is not 3.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should eat the last two characters of \r\n' do + pp = <<-'EOS' + $input = "test\r\n" + if size($input) != 6 { + fail("Size of ${input} is not 6.") + } + $output = chop($input) + if size($output) != 4 { + fail("Size of ${input} is not 4.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + + it 'should not fail on empty strings' do + pp = <<-EOS + $input = "" + $output = chop($input) + EOS + + apply_manifest(pp, :catch_failures => true) + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/clamp_spec.rb b/environments/production/modules/stdlib/spec/acceptance/clamp_spec.rb new file mode 100755 index 0000000..e8ccb96 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/clamp_spec.rb @@ -0,0 +1,40 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'clamp function' do + describe 'success' do + it 'clamps list of values' do + pp = <<-EOS + $x = 17 + $y = 225 + $z = 155 + $o = clamp($x, $y, $z) + if $o == $z { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'clamps array of values' do + pp = <<-EOS + $a = [7, 19, 66] + $b = 19 + $o = clamp($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles no arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/concat_spec.rb b/environments/production/modules/stdlib/spec/acceptance/concat_spec.rb new file mode 100755 index 0000000..8d184d1 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/concat_spec.rb @@ -0,0 +1,54 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'concat function' do + describe 'success' do + it 'should concat one array to another' do + pp = <<-EOS + $output = concat(['1','2','3'],['4','5','6']) + validate_array($output) + if size($output) != 6 { + fail("${output} should have 6 elements.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'should concat arrays and primitives to array' do + pp = <<-EOS + $output = concat(['1','2','3'],'4','5','6',['7','8','9']) + validate_array($output) + if size($output) != 9 { + fail("${output} should have 9 elements.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'should concat multiple arrays to one' do + pp = <<-EOS + $output = concat(['1','2','3'],['4','5','6'],['7','8','9']) + validate_array($output) + if size($output) != 9 { + fail("${output} should have 9 elements.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'should concat hash arguments' do + pp = <<-EOS + $output = concat([{"a" => "b"}], {"c" => "d", "e" => "f"}) + validate_array($output) + if size($output) != 2 { + fail("${output} should have 2 elements.") + } + if $output[1] != {"c" => "d", "e" => "f"} { + fail("${output} does not have the expected hash for the second element.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/count_spec.rb b/environments/production/modules/stdlib/spec/acceptance/count_spec.rb new file mode 100755 index 0000000..18c039d --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/count_spec.rb @@ -0,0 +1,30 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'count function' do + describe 'success' do + it 'should count elements in an array' do + pp = <<-EOS + $input = [1,2,3,4] + $output = count($input) + notify { "$output": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: 4/) + end + end + + it 'should count elements in an array that match a second argument' do + pp = <<-EOS + $input = [1,1,1,2] + $output = count($input, 1) + notify { "$output": } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: 3/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/deep_merge_spec.rb b/environments/production/modules/stdlib/spec/acceptance/deep_merge_spec.rb new file mode 100755 index 0000000..8222f24 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/deep_merge_spec.rb @@ -0,0 +1,20 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'deep_merge function' do + describe 'success' do + it 'should deep merge two hashes' do + pp = <<-EOS + $hash1 = {'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } } + $hash2 = {'two' => 'dos', 'three' => { 'five' => 5 } } + $merged_hash = deep_merge($hash1, $hash2) + + if $merged_hash != { 'one' => 1, 'two' => 'dos', 'three' => { 'four' => 4, 'five' => 5 } } { + fail("Hash was incorrectly merged.") + } + EOS + + apply_manifest(pp, :catch_failures => true) + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/defined_with_params_spec.rb b/environments/production/modules/stdlib/spec/acceptance/defined_with_params_spec.rb new file mode 100755 index 0000000..a332bd6 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/defined_with_params_spec.rb @@ -0,0 +1,22 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'defined_with_params function' do + describe 'success' do + it 'should successfully notify' do + pp = <<-EOS + user { 'dan': + ensure => present, + } + + if defined_with_params(User[dan], {'ensure' => 'present' }) { + notify { 'User defined with ensure=>present': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: User defined with ensure=>present/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/delete_at_spec.rb b/environments/production/modules/stdlib/spec/acceptance/delete_at_spec.rb new file mode 100755 index 0000000..d4f852a --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/delete_at_spec.rb @@ -0,0 +1,19 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'delete_at function' do + describe 'success' do + it 'should delete elements of the array' do + pp = <<-EOS + $output = delete_at(['a','b','c','b'], 1) + if $output == ['a','c','b'] { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/delete_spec.rb b/environments/production/modules/stdlib/spec/acceptance/delete_spec.rb new file mode 100755 index 0000000..f85b093 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/delete_spec.rb @@ -0,0 +1,19 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'delete function' do + describe 'success' do + it 'should delete elements of the array' do + pp = <<-EOS + $output = delete(['a','b','c','b'], 'b') + if $output == ['a','c'] { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/delete_undef_values_spec.rb b/environments/production/modules/stdlib/spec/acceptance/delete_undef_values_spec.rb new file mode 100755 index 0000000..af45a92 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/delete_undef_values_spec.rb @@ -0,0 +1,19 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'delete_undef_values function' do + describe 'success' do + it 'should delete elements of the array' do + pp = <<-EOS + $output = delete_undef_values({a=>'A', b=>'', c=>undef, d => false}) + if $output == { a => 'A', b => '', d => false } { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/delete_values_spec.rb b/environments/production/modules/stdlib/spec/acceptance/delete_values_spec.rb new file mode 100755 index 0000000..04b6920 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/delete_values_spec.rb @@ -0,0 +1,25 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'delete_values function' do + describe 'success' do + it 'should delete elements of the hash' do + pp = <<-EOS + $a = { 'a' => 'A', 'b' => 'B', 'B' => 'C', 'd' => 'B' } + $b = { 'a' => 'A', 'B' => 'C' } + $o = delete_values($a, 'B') + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles non-hash arguments' + it 'handles improper argument counts' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/deprecation_spec.rb b/environments/production/modules/stdlib/spec/acceptance/deprecation_spec.rb new file mode 100644 index 0000000..7a0b34c --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/deprecation_spec.rb @@ -0,0 +1,102 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'deprecation function' do + + if fact('operatingsystem') == 'windows' + test_file = 'C:/deprecation' + else + test_file = "/tmp/deprecation" + end + + # It seems that Windows needs everything to be on one line when using puppet apply -e, otherwise the manifests would be in an easier format + add_file_manifest = "\"deprecation('key', 'message') file { '#{test_file}': ensure => present, content => 'test', }\"" + remove_file_manifest = "file { '#{test_file}': ensure => absent }" + + before :all do + apply_manifest(remove_file_manifest) + end + + context 'with --strict=error', if: get_puppet_version =~ /^4/ do + before :all do + @result = on(default, puppet('apply', '--strict=error', '-e', add_file_manifest), acceptable_exit_codes: (0...256)) + end + + after :all do + apply_manifest(remove_file_manifest) + end + + it "should return an error" do + expect(@result.exit_code).to eq(1) + end + + it "should show the error message" do + expect(@result.stderr).to match(/deprecation. key. message/) + end + + describe file("#{test_file}") do + it { is_expected.not_to be_file } + end + end + + context 'with --strict=warning', if: get_puppet_version =~ /^4/ do + before :all do + @result = on(default, puppet('apply', '--strict=warning', '-e', add_file_manifest), acceptable_exit_codes: (0...256)) + end + + after :all do + apply_manifest(remove_file_manifest) + end + + it "should not return an error" do + expect(@result.exit_code).to eq(0) + end + + it "should show the error message" do + expect(@result.stderr).to match(/Warning: message/) + end + + describe file("#{test_file}") do + it { is_expected.to be_file } + end + end + + context 'with --strict=off', if: get_puppet_version =~ /^4/ do + before :all do + @result = on(default, puppet('apply', '--strict=off', '-e', add_file_manifest), acceptable_exit_codes: (0...256)) + end + + after :all do + apply_manifest(remove_file_manifest) + end + + it "should not return an error" do + expect(@result.exit_code).to eq(0) + end + + it "should not show the error message" do + expect(@result.stderr).not_to match(/Warning: message/) + end + + describe file("#{test_file}") do + it { is_expected.to be_file } + end + end + + context 'puppet 3 test', if: get_puppet_version =~ /^3/ do + before :all do + @result = on(default, puppet('apply', '--parser=future', '-e', add_file_manifest), acceptable_exit_codes: (0...256)) + end + after :all do + apply_manifest(remove_file_manifest) + end + + it "should return a deprecation error" do + expect(@result.stderr).to match(/Warning: message/) + end + it "should pass without error" do + expect(@result.exit_code).to eq(0) + end + end + +end diff --git a/environments/production/modules/stdlib/spec/acceptance/difference_spec.rb b/environments/production/modules/stdlib/spec/acceptance/difference_spec.rb new file mode 100755 index 0000000..68f6bbe --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/difference_spec.rb @@ -0,0 +1,26 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'difference function' do + describe 'success' do + it 'returns non-duplicates in the first array' do + pp = <<-EOS + $a = ['a','b','c'] + $b = ['b','c','d'] + $c = ['a'] + $o = difference($a, $b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles non-array arguments' + it 'handles improper argument counts' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/dirname_spec.rb b/environments/production/modules/stdlib/spec/acceptance/dirname_spec.rb new file mode 100755 index 0000000..db83f0f --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/dirname_spec.rb @@ -0,0 +1,42 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'dirname function' do + describe 'success' do + context 'absolute path' do + it 'returns the dirname' do + pp = <<-EOS + $a = '/path/to/a/file.txt' + $b = '/path/to/a' + $o = dirname($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + context 'relative path' do + it 'returns the dirname' do + pp = <<-EOS + $a = 'path/to/a/file.txt' + $b = 'path/to/a' + $o = dirname($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/downcase_spec.rb b/environments/production/modules/stdlib/spec/acceptance/downcase_spec.rb new file mode 100755 index 0000000..300bcfa --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/downcase_spec.rb @@ -0,0 +1,39 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'downcase function' do + describe 'success' do + it 'returns the downcase' do + pp = <<-EOS + $a = 'AOEU' + $b = 'aoeu' + $o = downcase($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'doesn\'t affect lowercase words' do + pp = <<-EOS + $a = 'aoeu aoeu' + $b = 'aoeu aoeu' + $o = downcase($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-strings' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/empty_spec.rb b/environments/production/modules/stdlib/spec/acceptance/empty_spec.rb new file mode 100755 index 0000000..97b7333 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/empty_spec.rb @@ -0,0 +1,53 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'empty function' do + describe 'success' do + it 'recognizes empty strings' do + pp = <<-EOS + $a = '' + $b = true + $o = empty($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'recognizes non-empty strings' do + pp = <<-EOS + $a = 'aoeu' + $b = false + $o = empty($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'handles numerical values' do + pp = <<-EOS + $a = 7 + $b = false + $o = empty($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-strings' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/ensure_resource_spec.rb b/environments/production/modules/stdlib/spec/acceptance/ensure_resource_spec.rb new file mode 100755 index 0000000..93f25dd --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/ensure_resource_spec.rb @@ -0,0 +1,30 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'ensure_resource function' do + describe 'success' do + it 'ensures a resource already declared' do + apply_manifest('') + pp = <<-EOS + notify { "test": loglevel => 'err' } + ensure_resource('notify', 'test', { 'loglevel' => 'err' }) + EOS + + apply_manifest(pp, :expect_changes => true) + end + + it 'ensures a undeclared resource' do + apply_manifest('') + pp = <<-EOS + ensure_resource('notify', 'test', { 'loglevel' => 'err' }) + EOS + + apply_manifest(pp, :expect_changes => true) + end + it 'takes defaults arguments' + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/flatten_spec.rb b/environments/production/modules/stdlib/spec/acceptance/flatten_spec.rb new file mode 100755 index 0000000..289eec9 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/flatten_spec.rb @@ -0,0 +1,39 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'flatten function' do + describe 'success' do + it 'flattens arrays' do + pp = <<-EOS + $a = ["a","b",["c",["d","e"],"f","g"]] + $b = ["a","b","c","d","e","f","g"] + $o = flatten($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'does not affect flat arrays' do + pp = <<-EOS + $a = ["a","b","c","d","e","f","g"] + $b = ["a","b","c","d","e","f","g"] + $o = flatten($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-strings' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/floor_spec.rb b/environments/production/modules/stdlib/spec/acceptance/floor_spec.rb new file mode 100755 index 0000000..8259d2a --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/floor_spec.rb @@ -0,0 +1,39 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'floor function' do + describe 'success' do + it 'floors floats' do + pp = <<-EOS + $a = 12.8 + $b = 12 + $o = floor($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'floors integers' do + pp = <<-EOS + $a = 7 + $b = 7 + $o = floor($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-numbers' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/fqdn_rand_string_spec.rb b/environments/production/modules/stdlib/spec/acceptance/fqdn_rand_string_spec.rb new file mode 100644 index 0000000..af1b2a9 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/fqdn_rand_string_spec.rb @@ -0,0 +1,66 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'fqdn_rand_string function' do + describe 'success' do + include_context "with faked facts" + context "when the FQDN is 'fakehost.localdomain'" do + before :each do + fake_fact("fqdn", "fakehost.localdomain") + end + + it 'generates random alphanumeric strings' do + pp = <<-eos + $l = 10 + $o = fqdn_rand_string($l) + notice(inline_template('fqdn_rand_string is <%= @o.inspect %>')) + eos + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rand_string is "(7oDp0KOr1b|9Acvnhkt4J)"/) + end + end + it 'generates random alphanumeric strings with custom charsets' do + pp = <<-eos + $l = 10 + $c = '0123456789' + $o = fqdn_rand_string($l, $c) + notice(inline_template('fqdn_rand_string is <%= @o.inspect %>')) + eos + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rand_string is "(7203048515|2383756694)"/) + end + end + it 'generates random alphanumeric strings with custom seeds' do + pp = <<-eos + $l = 10 + $s = 'seed' + $o = fqdn_rand_string($l, undef, $s) + notice(inline_template('fqdn_rand_string is <%= @o.inspect %>')) + eos + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rand_string is "(3HS4mbuI3E|1jJtAMs94d)"/) + end + end + it 'generates random alphanumeric strings with custom charsets and seeds' do + pp = <<-eos + $l = 10 + $c = '0123456789' + $s = 'seed' + $o = fqdn_rand_string($l, $c, $s) + notice(inline_template('fqdn_rand_string is <%= @o.inspect %>')) + eos + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rand_string is "(3104058232|7100592312)"/) + end + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-numbers for length argument' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/fqdn_rotate_spec.rb b/environments/production/modules/stdlib/spec/acceptance/fqdn_rotate_spec.rb new file mode 100755 index 0000000..66e94a9 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/fqdn_rotate_spec.rb @@ -0,0 +1,64 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'fqdn_rotate function' do + describe 'success' do + include_context "with faked facts" + context "when the FQDN is 'fakehost.localdomain'" do + before :each do + fake_fact("fqdn", "fakehost.localdomain") + end + + it 'rotates arrays' do + pp = <<-EOS + $a = ['a','b','c','d'] + $o = fqdn_rotate($a) + notice(inline_template('fqdn_rotate is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rotate is \["d", "a", "b", "c"\]/) + end + end + it 'rotates arrays with custom seeds' do + pp = <<-EOS + $a = ['a','b','c','d'] + $s = 'seed' + $o = fqdn_rotate($a, $s) + notice(inline_template('fqdn_rotate is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rotate is \["c", "d", "a", "b"\]/) + end + end + it 'rotates strings' do + pp = <<-EOS + $a = 'abcd' + $o = fqdn_rotate($a) + notice(inline_template('fqdn_rotate is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rotate is "dabc"/) + end + end + it 'rotates strings with custom seeds' do + pp = <<-EOS + $a = 'abcd' + $s = 'seed' + $o = fqdn_rotate($a, $s) + notice(inline_template('fqdn_rotate is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/fqdn_rotate is "cdab"/) + end + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles invalid arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/get_module_path_spec.rb b/environments/production/modules/stdlib/spec/acceptance/get_module_path_spec.rb new file mode 100755 index 0000000..3d10251 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/get_module_path_spec.rb @@ -0,0 +1,27 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'get_module_path function' do + describe 'success' do + it 'get_module_paths dne' do + pp = <<-EOS + $a = $::is_pe ? { + 'true' => '/etc/puppetlabs/puppet/modules/dne', + 'false' => '/etc/puppet/modules/dne', + } + $o = get_module_path('dne') + if $o == $a { + notify { 'output correct': } + } else { + notify { "failed; module path is '$o'": } + } + EOS + + apply_manifest(pp, :expect_failures => true) + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-numbers' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/getparam_spec.rb b/environments/production/modules/stdlib/spec/acceptance/getparam_spec.rb new file mode 100755 index 0000000..bd12154 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/getparam_spec.rb @@ -0,0 +1,24 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'getparam function' do + describe 'success' do + it 'getparam a notify' do + pp = <<-EOS + notify { 'rspec': + message => 'custom rspec message', + } + $o = getparam(Notify['rspec'], 'message') + notice(inline_template('getparam is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/getparam is "custom rspec message"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/getvar_spec.rb b/environments/production/modules/stdlib/spec/acceptance/getvar_spec.rb new file mode 100755 index 0000000..605cdce --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/getvar_spec.rb @@ -0,0 +1,26 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'getvar function' do + describe 'success' do + it 'getvars from classes' do + pp = <<-EOS + class a::data { $foo = 'aoeu' } + include a::data + $b = 'aoeu' + $o = getvar("a::data::foo") + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-numbers' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/grep_spec.rb b/environments/production/modules/stdlib/spec/acceptance/grep_spec.rb new file mode 100755 index 0000000..7c35ee4 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/grep_spec.rb @@ -0,0 +1,26 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'grep function' do + describe 'success' do + it 'greps arrays' do + pp = <<-EOS + $a = ['aaabbb','bbbccc','dddeee'] + $b = 'bbb' + $c = ['aaabbb','bbbccc'] + $o = grep($a,$b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/has_interface_with_spec.rb b/environments/production/modules/stdlib/spec/acceptance/has_interface_with_spec.rb new file mode 100755 index 0000000..fd33af5 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/has_interface_with_spec.rb @@ -0,0 +1,54 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'has_interface_with function', :unless => ((fact('osfamily') == 'windows') or (fact('osfamily') == 'AIX')) do + describe 'success' do + it 'has_interface_with existing ipaddress' do + pp = <<-EOS + $a = $::ipaddress + $o = has_interface_with('ipaddress', $a) + notice(inline_template('has_interface_with is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_interface_with is true/) + end + end + it 'has_interface_with absent ipaddress' do + pp = <<-EOS + $a = '128.0.0.1' + $o = has_interface_with('ipaddress', $a) + notice(inline_template('has_interface_with is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_interface_with is false/) + end + end + it 'has_interface_with existing interface' do + pp = <<-EOS + if $osfamily == 'Solaris' or $osfamily == 'Darwin' { + $a = 'lo0' + }elsif $osfamily == 'windows' { + $a = $::kernelmajversion ? { + /6\.(2|3|4)/ => 'Ethernet0', + /6\.(0|1)/ => 'Local_Area_Connection', + /5\.(1|2)/ => undef, #Broken current in facter + } + }else { + $a = 'lo' + } + $o = has_interface_with($a) + notice(inline_template('has_interface_with is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_interface_with is true/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/has_ip_address_spec.rb b/environments/production/modules/stdlib/spec/acceptance/has_ip_address_spec.rb new file mode 100755 index 0000000..878d921 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/has_ip_address_spec.rb @@ -0,0 +1,33 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'has_ip_address function', :unless => ((fact('osfamily') == 'windows') or (fact('osfamily') == 'AIX')) do + describe 'success' do + it 'has_ip_address existing ipaddress' do + pp = <<-EOS + $a = '127.0.0.1' + $o = has_ip_address($a) + notice(inline_template('has_ip_address is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_ip_address is true/) + end + end + it 'has_ip_address absent ipaddress' do + pp = <<-EOS + $a = '128.0.0.1' + $o = has_ip_address($a) + notice(inline_template('has_ip_address is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_ip_address is false/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/has_ip_network_spec.rb b/environments/production/modules/stdlib/spec/acceptance/has_ip_network_spec.rb new file mode 100755 index 0000000..f7a7d35 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/has_ip_network_spec.rb @@ -0,0 +1,33 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'has_ip_network function', :unless => ((fact('osfamily') == 'windows') or (fact('osfamily') == 'AIX')) do + describe 'success' do + it 'has_ip_network existing ipaddress' do + pp = <<-EOS + $a = '127.0.0.0' + $o = has_ip_network($a) + notice(inline_template('has_ip_network is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_ip_network is true/) + end + end + it 'has_ip_network absent ipaddress' do + pp = <<-EOS + $a = '128.0.0.0' + $o = has_ip_network($a) + notice(inline_template('has_ip_network is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/has_ip_network is false/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/has_key_spec.rb b/environments/production/modules/stdlib/spec/acceptance/has_key_spec.rb new file mode 100755 index 0000000..661c122 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/has_key_spec.rb @@ -0,0 +1,41 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'has_key function' do + describe 'success' do + it 'has_keys in hashes' do + pp = <<-EOS + $a = { 'aaa' => 'bbb','bbb' => 'ccc','ddd' => 'eee' } + $b = 'bbb' + $c = true + $o = has_key($a,$b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'has_keys not in hashes' do + pp = <<-EOS + $a = { 'aaa' => 'bbb','bbb' => 'ccc','ddd' => 'eee' } + $b = 'ccc' + $c = false + $o = has_key($a,$b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-hashes' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/hash_spec.rb b/environments/production/modules/stdlib/spec/acceptance/hash_spec.rb new file mode 100755 index 0000000..85da50b --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/hash_spec.rb @@ -0,0 +1,26 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'hash function' do + describe 'success' do + it 'hashs arrays' do + pp = <<-EOS + $a = ['aaa','bbb','bbb','ccc','ddd','eee'] + $b = { 'aaa' => 'bbb', 'bbb' => 'ccc', 'ddd' => 'eee' } + $o = hash($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'handles odd-length arrays' + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/intersection_spec.rb b/environments/production/modules/stdlib/spec/acceptance/intersection_spec.rb new file mode 100755 index 0000000..02d4e7d --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/intersection_spec.rb @@ -0,0 +1,27 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'intersection function' do + describe 'success' do + it 'intersections arrays' do + pp = <<-EOS + $a = ['aaa','bbb','ccc'] + $b = ['bbb','ccc','ddd','eee'] + $c = ['bbb','ccc'] + $o = intersection($a,$b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'intersections empty arrays' + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_a_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_a_spec.rb new file mode 100644 index 0000000..fb0019a --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_a_spec.rb @@ -0,0 +1,30 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +if get_puppet_version =~ /^4/ + describe 'is_a function' do + it 'should match a string' do + pp = <<-EOS + if 'hello world'.is_a(String) { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + + it 'should not match a integer as string' do + pp = <<-EOS + if 5.is_a(String) { + notify { 'output wrong': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).not_to match(/Notice: output wrong/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_array_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_array_spec.rb new file mode 100755 index 0000000..1a83417 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_array_spec.rb @@ -0,0 +1,67 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_array function' do + describe 'success' do + it 'is_arrays arrays' do + pp = <<-EOS + $a = ['aaa','bbb','ccc'] + $b = true + $o = is_array($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_arrays empty arrays' do + pp = <<-EOS + $a = [] + $b = true + $o = is_array($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_arrays strings' do + pp = <<-EOS + $a = "aoeu" + $b = false + $o = is_array($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_arrays hashes' do + pp = <<-EOS + $a = {'aaa'=>'bbb'} + $b = false + $o = is_array($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_bool_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_bool_spec.rb new file mode 100755 index 0000000..823cb46 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_bool_spec.rb @@ -0,0 +1,81 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_bool function' do + describe 'success' do + it 'is_bools arrays' do + pp = <<-EOS + $a = ['aaa','bbb','ccc'] + $b = false + $o = is_bool($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_bools true' do + pp = <<-EOS + $a = true + $b = true + $o = is_bool($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_bools false' do + pp = <<-EOS + $a = false + $b = true + $o = is_bool($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_bools strings' do + pp = <<-EOS + $a = "true" + $b = false + $o = is_bool($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_bools hashes' do + pp = <<-EOS + $a = {'aaa'=>'bbb'} + $b = false + $o = is_bool($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_domain_name_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_domain_name_spec.rb new file mode 100755 index 0000000..884b0bc --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_domain_name_spec.rb @@ -0,0 +1,83 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_domain_name function' do + describe 'success' do + it 'is_domain_names arrays' do + pp = <<-EOS + $a = ['aaa.com','bbb','ccc'] + $o = is_domain_name($a) + notice(inline_template('is_domain_name is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_domain_name is false/) + end + end + it 'is_domain_names true' do + pp = <<-EOS + $a = true + $o = is_domain_name($a) + notice(inline_template('is_domain_name is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_domain_name is false/) + end + end + it 'is_domain_names false' do + pp = <<-EOS + $a = false + $o = is_domain_name($a) + notice(inline_template('is_domain_name is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_domain_name is false/) + end + end + it 'is_domain_names strings with hyphens' do + pp = <<-EOS + $a = "3foo-bar.2bar-fuzz.com" + $b = true + $o = is_domain_name($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_domain_names strings beginning with hyphens' do + pp = <<-EOS + $a = "-bar.2bar-fuzz.com" + $b = false + $o = is_domain_name($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_domain_names hashes' do + pp = <<-EOS + $a = {'aaa'=>'www.com'} + $o = is_domain_name($a) + notice(inline_template('is_domain_name is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_domain_name is false/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_float_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_float_spec.rb new file mode 100755 index 0000000..0b38d94 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_float_spec.rb @@ -0,0 +1,86 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_float function' do + describe 'success' do + it 'is_floats arrays' do + pp = <<-EOS + $a = ['aaa.com','bbb','ccc'] + $o = is_float($a) + notice(inline_template('is_float is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_float is false/) + end + end + it 'is_floats true' do + pp = <<-EOS + $a = true + $o = is_float($a) + notice(inline_template('is_float is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_float is false/) + end + end + it 'is_floats strings' do + pp = <<-EOS + $a = "3.5" + $b = true + $o = is_float($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_floats floats' do + pp = <<-EOS + $a = 3.5 + $b = true + $o = is_float($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_floats integers' do + pp = <<-EOS + $a = 3 + $b = false + $o = is_float($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_floats hashes' do + pp = <<-EOS + $a = {'aaa'=>'www.com'} + $o = is_float($a) + notice(inline_template('is_float is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_float is false/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_function_available_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_function_available_spec.rb new file mode 100755 index 0000000..f8191ee --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_function_available_spec.rb @@ -0,0 +1,58 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_function_available function' do + describe 'success' do + it 'is_function_availables arrays' do + pp = <<-EOS + $a = ['fail','include','require'] + $o = is_function_available($a) + notice(inline_template('is_function_available is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_function_available is false/) + end + end + it 'is_function_availables true' do + pp = <<-EOS + $a = true + $o = is_function_available($a) + notice(inline_template('is_function_available is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_function_available is false/) + end + end + it 'is_function_availables strings' do + pp = <<-EOS + $a = "fail" + $b = true + $o = is_function_available($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_function_availables function_availables' do + pp = <<-EOS + $a = "is_function_available" + $o = is_function_available($a) + notice(inline_template('is_function_available is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_function_available is true/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_hash_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_hash_spec.rb new file mode 100755 index 0000000..64f016c --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_hash_spec.rb @@ -0,0 +1,63 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_hash function' do + describe 'success' do + it 'is_hashs arrays' do + pp = <<-EOS + $a = ['aaa','bbb','ccc'] + $o = is_hash($a) + notice(inline_template('is_hash is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_hash is false/) + end + end + it 'is_hashs empty hashs' do + pp = <<-EOS + $a = {} + $b = true + $o = is_hash($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_hashs strings' do + pp = <<-EOS + $a = "aoeu" + $b = false + $o = is_hash($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_hashs hashes' do + pp = <<-EOS + $a = {'aaa'=>'bbb'} + $b = true + $o = is_hash($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_integer_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_integer_spec.rb new file mode 100755 index 0000000..7333687 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_integer_spec.rb @@ -0,0 +1,95 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_integer function' do + describe 'success' do + it 'is_integers arrays' do + pp = <<-EOS + $a = ['aaa.com','bbb','ccc'] + $b = false + $o = is_integer($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_integers true' do + pp = <<-EOS + $a = true + $b = false + $o = is_integer($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_integers strings' do + pp = <<-EOS + $a = "3" + $b = true + $o = is_integer($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_integers floats' do + pp = <<-EOS + $a = 3.5 + $b = false + $o = is_integer($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_integers integers' do + pp = <<-EOS + $a = 3 + $b = true + $o = is_integer($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_integers hashes' do + pp = <<-EOS + $a = {'aaa'=>'www.com'} + $b = false + $o = is_integer($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_ip_address_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_ip_address_spec.rb new file mode 100755 index 0000000..2c62c77 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_ip_address_spec.rb @@ -0,0 +1,80 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_ip_address function' do + describe 'success' do + it 'is_ip_addresss ipv4' do + pp = <<-EOS + $a = '1.2.3.4' + $b = true + $o = is_ip_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ip_addresss ipv6' do + pp = <<-EOS + $a = "fe80:0000:cd12:d123:e2f8:47ff:fe09:dd74" + $b = true + $o = is_ip_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ip_addresss ipv6 compressed' do + pp = <<-EOS + $a = "fe00::1" + $b = true + $o = is_ip_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ip_addresss strings' do + pp = <<-EOS + $a = "aoeu" + $b = false + $o = is_ip_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ip_addresss ipv4 out of range' do + pp = <<-EOS + $a = '1.2.3.400' + $b = false + $o = is_ip_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_ipv4_address_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_ipv4_address_spec.rb new file mode 100755 index 0000000..abe26d8 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_ipv4_address_spec.rb @@ -0,0 +1,52 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_ipv4_address function' do + describe 'success' do + it 'is_ipv4_addresss' do + pp = <<-EOS + $a = '1.2.3.4' + $b = true + $o = is_ipv4_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ipv4_addresss strings' do + pp = <<-EOS + $a = "aoeu" + $b = false + $o = is_ipv4_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ipv4_addresss ipv4 out of range' do + pp = <<-EOS + $a = '1.2.3.400' + $b = false + $o = is_ipv4_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_ipv6_address_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_ipv6_address_spec.rb new file mode 100755 index 0000000..73a3fa4 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_ipv6_address_spec.rb @@ -0,0 +1,66 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_ipv6_address function' do + describe 'success' do + it 'is_ipv6_addresss' do + pp = <<-EOS + $a = "fe80:0000:cd12:d123:e2f8:47ff:fe09:dd74" + $b = true + $o = is_ipv6_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ipv6_addresss ipv6 compressed' do + pp = <<-EOS + $a = "fe00::1" + $b = true + $o = is_ipv6_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ipv6_addresss strings' do + pp = <<-EOS + $a = "aoeu" + $b = false + $o = is_ipv6_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_ipv6_addresss ip out of range' do + pp = <<-EOS + $a = 'fe80:0000:cd12:d123:e2f8:47ff:fe09:gggg' + $b = false + $o = is_ipv6_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_mac_address_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_mac_address_spec.rb new file mode 100755 index 0000000..617bef6 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_mac_address_spec.rb @@ -0,0 +1,38 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_mac_address function' do + describe 'success' do + it 'is_mac_addresss a mac' do + pp = <<-EOS + $a = '00:a0:1f:12:7f:a0' + $b = true + $o = is_mac_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_mac_addresss a mac out of range' do + pp = <<-EOS + $a = '00:a0:1f:12:7f:g0' + $b = false + $o = is_mac_address($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_numeric_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_numeric_spec.rb new file mode 100755 index 0000000..7e65384 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_numeric_spec.rb @@ -0,0 +1,95 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_numeric function' do + describe 'success' do + it 'is_numerics arrays' do + pp = <<-EOS + $a = ['aaa.com','bbb','ccc'] + $b = false + $o = is_numeric($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_numerics true' do + pp = <<-EOS + $a = true + $b = false + $o = is_numeric($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_numerics strings' do + pp = <<-EOS + $a = "3" + $b = true + $o = is_numeric($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_numerics floats' do + pp = <<-EOS + $a = 3.5 + $b = true + $o = is_numeric($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_numerics integers' do + pp = <<-EOS + $a = 3 + $b = true + $o = is_numeric($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_numerics hashes' do + pp = <<-EOS + $a = {'aaa'=>'www.com'} + $b = false + $o = is_numeric($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + it 'handles non-arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/is_string_spec.rb b/environments/production/modules/stdlib/spec/acceptance/is_string_spec.rb new file mode 100755 index 0000000..bee5e01 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/is_string_spec.rb @@ -0,0 +1,113 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'is_string function' do + describe 'success' do + it 'is_strings arrays' do + pp = <<-EOS + $a = ['aaa.com','bbb','ccc'] + $b = false + $o = is_string($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_strings true' do + pp = <<-EOS + $a = true + $b = false + $o = is_string($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_strings strings' do + pp = <<-EOS + $a = "aoeu" + $o = is_string($a) + notice(inline_template('is_string is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_string is true/) + end + end + it 'is_strings number strings' do + pp = <<-EOS + $a = "3" + $o = is_string($a) + notice(inline_template('is_string is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_string is false/) + end + end + it 'is_strings floats' do + pp = <<-EOS + $a = 3.5 + $b = false + $o = is_string($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_strings integers' do + pp = <<-EOS + $a = 3 + $b = false + $o = is_string($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_strings hashes' do + pp = <<-EOS + $a = {'aaa'=>'www.com'} + $b = false + $o = is_string($a) + if $o == $b { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'is_strings undef' do + pp = <<-EOS + $a = undef + $o = is_string($a) + notice(inline_template('is_string is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/is_string is true/) + end + end + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/join_keys_to_values_spec.rb b/environments/production/modules/stdlib/spec/acceptance/join_keys_to_values_spec.rb new file mode 100755 index 0000000..ae6947e --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/join_keys_to_values_spec.rb @@ -0,0 +1,24 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'join_keys_to_values function' do + describe 'success' do + it 'join_keys_to_valuess hashes' do + pp = <<-EOS + $a = {'aaa'=>'bbb','ccc'=>'ddd'} + $b = ':' + $o = join_keys_to_values($a,$b) + notice(inline_template('join_keys_to_values is <%= @o.sort.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/join_keys_to_values is \["aaa:bbb", "ccc:ddd"\]/) + end + end + it 'handles non hashes' + it 'handles empty hashes' + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/join_spec.rb b/environments/production/modules/stdlib/spec/acceptance/join_spec.rb new file mode 100755 index 0000000..75b88d8 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/join_spec.rb @@ -0,0 +1,26 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'join function' do + describe 'success' do + it 'joins arrays' do + pp = <<-EOS + $a = ['aaa','bbb','ccc'] + $b = ':' + $c = 'aaa:bbb:ccc' + $o = join($a,$b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + it 'handles non arrays' + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/keys_spec.rb b/environments/production/modules/stdlib/spec/acceptance/keys_spec.rb new file mode 100755 index 0000000..65bfe28 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/keys_spec.rb @@ -0,0 +1,23 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'keys function' do + describe 'success' do + it 'keyss hashes' do + pp = <<-EOS + $a = {'aaa'=>'bbb','ccc'=>'ddd'} + $o = keys($a) + notice(inline_template('keys is <%= @o.sort.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/keys is \["aaa", "ccc"\]/) + end + end + it 'handles non hashes' + it 'handles empty hashes' + end + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/loadjson_spec.rb b/environments/production/modules/stdlib/spec/acceptance/loadjson_spec.rb new file mode 100644 index 0000000..ebd5307 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/loadjson_spec.rb @@ -0,0 +1,52 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +tmpdir = default.tmpdir('stdlib') + +describe 'loadjson function' do + describe 'success' do + it 'loadjsons array of values' do + shell("echo '{\"aaa\":1,\"bbb\":2,\"ccc\":3,\"ddd\":4}' > #{tmpdir}/testjson.json") + pp = <<-EOS + $o = loadjson('#{tmpdir}/testjson.json') + notice(inline_template('loadjson[aaa] is <%= @o["aaa"].inspect %>')) + notice(inline_template('loadjson[bbb] is <%= @o["bbb"].inspect %>')) + notice(inline_template('loadjson[ccc] is <%= @o["ccc"].inspect %>')) + notice(inline_template('loadjson[ddd] is <%= @o["ddd"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/loadjson\[aaa\] is 1/) + expect(r.stdout).to match(/loadjson\[bbb\] is 2/) + expect(r.stdout).to match(/loadjson\[ccc\] is 3/) + expect(r.stdout).to match(/loadjson\[ddd\] is 4/) + end + end + + it 'returns the default value if there is no file to load' do + pp = <<-EOS + $o = loadjson('#{tmpdir}/no-file.json', {'default' => 'value'}) + notice(inline_template('loadjson[default] is <%= @o["default"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/loadjson\[default\] is "value"/) + end + end + + it 'returns the default value if the file was parsed with an error' do + shell("echo '!' > #{tmpdir}/testjson.json") + pp = <<-EOS + $o = loadjson('#{tmpdir}/testjson.json', {'default' => 'value'}) + notice(inline_template('loadjson[default] is <%= @o["default"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/loadjson\[default\] is "value"/) + end + end + end + describe 'failure' do + it 'fails with no arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/loadyaml_spec.rb b/environments/production/modules/stdlib/spec/acceptance/loadyaml_spec.rb new file mode 100644 index 0000000..57fb8cb --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/loadyaml_spec.rb @@ -0,0 +1,56 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +tmpdir = default.tmpdir('stdlib') + +describe 'loadyaml function' do + describe 'success' do + it 'loadyamls array of values' do + shell("echo '--- + aaa: 1 + bbb: 2 + ccc: 3 + ddd: 4' > #{tmpdir}/testyaml.yaml") + pp = <<-EOS + $o = loadyaml('#{tmpdir}/testyaml.yaml') + notice(inline_template('loadyaml[aaa] is <%= @o["aaa"].inspect %>')) + notice(inline_template('loadyaml[bbb] is <%= @o["bbb"].inspect %>')) + notice(inline_template('loadyaml[ccc] is <%= @o["ccc"].inspect %>')) + notice(inline_template('loadyaml[ddd] is <%= @o["ddd"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/loadyaml\[aaa\] is 1/) + expect(r.stdout).to match(/loadyaml\[bbb\] is 2/) + expect(r.stdout).to match(/loadyaml\[ccc\] is 3/) + expect(r.stdout).to match(/loadyaml\[ddd\] is 4/) + end + end + + it 'returns the default value if there is no file to load' do + pp = <<-EOS + $o = loadyaml('#{tmpdir}/no-file.yaml', {'default' => 'value'}) + notice(inline_template('loadyaml[default] is <%= @o["default"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/loadyaml\[default\] is "value"/) + end + end + + it 'returns the default value if the file was parsed with an error' do + shell("echo '!' > #{tmpdir}/testyaml.yaml") + pp = <<-EOS + $o = loadyaml('#{tmpdir}/testyaml.yaml', {'default' => 'value'}) + notice(inline_template('loadyaml[default] is <%= @o["default"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/loadyaml\[default\] is "value"/) + end + end + end + describe 'failure' do + it 'fails with no arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/lstrip_spec.rb b/environments/production/modules/stdlib/spec/acceptance/lstrip_spec.rb new file mode 100755 index 0000000..eba5d0d --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/lstrip_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'lstrip function' do + describe 'success' do + it 'lstrips arrays' do + pp = <<-EOS + $a = [" the "," public "," art","galleries "] + # Anagram: Large picture halls, I bet + $o = lstrip($a) + notice(inline_template('lstrip is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/lstrip is \["the ", "public ", "art", "galleries "\]/) + end + end + it 'lstrips strings' do + pp = <<-EOS + $a = " blowzy night-frumps vex'd jack q " + $o = lstrip($a) + notice(inline_template('lstrip is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/lstrip is "blowzy night-frumps vex'd jack q "/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/max_spec.rb b/environments/production/modules/stdlib/spec/acceptance/max_spec.rb new file mode 100755 index 0000000..3caa813 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/max_spec.rb @@ -0,0 +1,20 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'max function' do + describe 'success' do + it 'maxs arrays' do + pp = <<-EOS + $o = max("the","public","art","galleries") + notice(inline_template('max is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/max is "the"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/member_spec.rb b/environments/production/modules/stdlib/spec/acceptance/member_spec.rb new file mode 100755 index 0000000..2bcadd3 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/member_spec.rb @@ -0,0 +1,54 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'member function' do + shared_examples 'item found' do + it 'should output correctly' do + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + end + describe 'success' do + it 'members arrays' do + pp = <<-EOS + $a = ['aaa','bbb','ccc'] + $b = 'ccc' + $c = true + $o = member($a,$b) + if $o == $c { + notify { 'output correct': } + } + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/Notice: output correct/) + end + end + describe 'members array of integers' do + it_should_behave_like 'item found' do + let(:pp) { <<-EOS + if member( [1,2,3,4], 4 ){ + notify { 'output correct': } + } + EOS + } + end + end + describe 'members of mixed array' do + it_should_behave_like 'item found' do + let(:pp) { <<-EOS + if member( ['a','4',3], 'a' ){ + notify { 'output correct': } +} + EOS + } + end + end + it 'members arrays without members' + end + + describe 'failure' do + it 'handles improper argument counts' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/merge_spec.rb b/environments/production/modules/stdlib/spec/acceptance/merge_spec.rb new file mode 100755 index 0000000..814db4e --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/merge_spec.rb @@ -0,0 +1,23 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'merge function' do + describe 'success' do + it 'should merge two hashes' do + pp = <<-EOS + $a = {'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } } + $b = {'two' => 'dos', 'three' => { 'five' => 5 } } + $o = merge($a, $b) + notice(inline_template('merge[one] is <%= @o["one"].inspect %>')) + notice(inline_template('merge[two] is <%= @o["two"].inspect %>')) + notice(inline_template('merge[three] is <%= @o["three"].inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/merge\[one\] is ("1"|1)/) + expect(r.stdout).to match(/merge\[two\] is "dos"/) + expect(r.stdout).to match(/merge\[three\] is {"five"=>("5"|5)}/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/min_spec.rb b/environments/production/modules/stdlib/spec/acceptance/min_spec.rb new file mode 100755 index 0000000..7b18fac --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/min_spec.rb @@ -0,0 +1,20 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'min function' do + describe 'success' do + it 'mins arrays' do + pp = <<-EOS + $o = min("the","public","art","galleries") + notice(inline_template('min is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/min is "art"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/nodesets/centos-7-x64.yml b/environments/production/modules/stdlib/spec/acceptance/nodesets/centos-7-x64.yml new file mode 100644 index 0000000..5eebdef --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/nodesets/centos-7-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + centos-7-x64: + roles: + - agent + - default + platform: el-7-x86_64 + hypervisor: vagrant + box: puppetlabs/centos-7.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/stdlib/spec/acceptance/nodesets/debian-8-x64.yml b/environments/production/modules/stdlib/spec/acceptance/nodesets/debian-8-x64.yml new file mode 100644 index 0000000..fef6e63 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/nodesets/debian-8-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + debian-8-x64: + roles: + - agent + - default + platform: debian-8-amd64 + hypervisor: vagrant + box: puppetlabs/debian-8.2-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/stdlib/spec/acceptance/nodesets/default.yml b/environments/production/modules/stdlib/spec/acceptance/nodesets/default.yml new file mode 100644 index 0000000..dba339c --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/nodesets/default.yml @@ -0,0 +1,10 @@ +HOSTS: + ubuntu-1404-x64: + roles: + - agent + - default + platform: ubuntu-14.04-amd64 + hypervisor: vagrant + box: puppetlabs/ubuntu-14.04-64-nocm +CONFIG: + type: foss diff --git a/environments/production/modules/stdlib/spec/acceptance/nodesets/docker/centos-7.yml b/environments/production/modules/stdlib/spec/acceptance/nodesets/docker/centos-7.yml new file mode 100644 index 0000000..a3333aa --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/nodesets/docker/centos-7.yml @@ -0,0 +1,12 @@ +HOSTS: + centos-7-x64: + platform: el-7-x86_64 + hypervisor: docker + image: centos:7 + docker_preserve_image: true + docker_cmd: '["/usr/sbin/init"]' + # install various tools required to get the image up to usable levels + docker_image_commands: + - 'yum install -y crontabs tar wget openssl sysvinit-tools iproute which initscripts' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/stdlib/spec/acceptance/nodesets/docker/debian-8.yml b/environments/production/modules/stdlib/spec/acceptance/nodesets/docker/debian-8.yml new file mode 100644 index 0000000..df5c319 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/nodesets/docker/debian-8.yml @@ -0,0 +1,11 @@ +HOSTS: + debian-8-x64: + platform: debian-8-amd64 + hypervisor: docker + image: debian:8 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get update && apt-get install -y net-tools wget locales strace lsof && echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/stdlib/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/environments/production/modules/stdlib/spec/acceptance/nodesets/docker/ubuntu-14.04.yml new file mode 100644 index 0000000..b1efa58 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/nodesets/docker/ubuntu-14.04.yml @@ -0,0 +1,12 @@ +HOSTS: + ubuntu-1404-x64: + platform: ubuntu-14.04-amd64 + hypervisor: docker + image: ubuntu:14.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + # ensure that upstart is booting correctly in the container + - 'rm /usr/sbin/policy-rc.d && rm /sbin/initctl && dpkg-divert --rename --remove /sbin/initctl && apt-get update && apt-get install -y net-tools wget && locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 diff --git a/environments/production/modules/stdlib/spec/acceptance/num2bool_spec.rb b/environments/production/modules/stdlib/spec/acceptance/num2bool_spec.rb new file mode 100755 index 0000000..00d0ddc --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/num2bool_spec.rb @@ -0,0 +1,76 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'num2bool function' do + describe 'success' do + it 'bools positive numbers and numeric strings as true' do + pp = <<-EOS + $a = 1 + $b = "1" + $c = "50" + $ao = num2bool($a) + $bo = num2bool($b) + $co = num2bool($c) + notice(inline_template('a is <%= @ao.inspect %>')) + notice(inline_template('b is <%= @bo.inspect %>')) + notice(inline_template('c is <%= @co.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/a is true/) + expect(r.stdout).to match(/b is true/) + expect(r.stdout).to match(/c is true/) + end + end + it 'bools negative numbers as false' do + pp = <<-EOS + $a = 0 + $b = -0.1 + $c = ["-50","1"] + $ao = num2bool($a) + $bo = num2bool($b) + $co = num2bool($c) + notice(inline_template('a is <%= @ao.inspect %>')) + notice(inline_template('b is <%= @bo.inspect %>')) + notice(inline_template('c is <%= @co.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/a is false/) + expect(r.stdout).to match(/b is false/) + expect(r.stdout).to match(/c is false/) + end + end + end + describe 'failure' do + it 'fails on words' do + pp = <<-EOS + $a = "a" + $ao = num2bool($a) + notice(inline_template('a is <%= @ao.inspect %>')) + EOS + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/not look like a number/) + end + + it 'fails on numberwords' do + pp = <<-EOS + $b = "1b" + $bo = num2bool($b) + notice(inline_template('b is <%= @bo.inspect %>')) + EOS + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/not look like a number/) + + end + + it 'fails on non-numeric/strings' do + pending "The function will call .to_s.to_i on anything not a Numeric or + String, and results in 0. Is this intended?" + pp = <<-EOS + $c = {"c" => "-50"} + $co = num2bool($c) + notice(inline_template('c is <%= @co.inspect %>')) + EOS + expect(apply_manifest(ppc :expect_failures => true).stderr).to match(/Unable to parse/) + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/parsejson_spec.rb b/environments/production/modules/stdlib/spec/acceptance/parsejson_spec.rb new file mode 100755 index 0000000..52133e4 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/parsejson_spec.rb @@ -0,0 +1,55 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'parsejson function' do + describe 'success' do + it 'parses valid json' do + pp = <<-EOS + $a = '{"hunter": "washere", "tests": "passing"}' + $ao = parsejson($a) + $tests = $ao['tests'] + notice(inline_template('tests are <%= @tests.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/tests are "passing"/) + end + end + end + + describe 'failure' do + it 'raises error on incorrect json' do + pp = <<-EOS + $a = '{"hunter": "washere", "tests": "passing",}' + $ao = parsejson($a, 'tests are using the default value') + notice(inline_template('a is <%= @ao.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/tests are using the default value/) + end + end + + it 'raises error on incorrect json' do + pp = <<-EOS + $a = '{"hunter": "washere", "tests": "passing",}' + $ao = parsejson($a) + notice(inline_template('a is <%= @ao.inspect %>')) + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/expected next name/) + end + end + + it 'raises error on incorrect number of arguments' do + pp = <<-EOS + $o = parsejson() + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/wrong number of arguments/i) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/parseyaml_spec.rb b/environments/production/modules/stdlib/spec/acceptance/parseyaml_spec.rb new file mode 100755 index 0000000..acbda46 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/parseyaml_spec.rb @@ -0,0 +1,58 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'parseyaml function' do + describe 'success' do + it 'parses valid yaml' do + pp = <<-EOS + $a = "---\nhunter: washere\ntests: passing\n" + $o = parseyaml($a) + $tests = $o['tests'] + notice(inline_template('tests are <%= @tests.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/tests are "passing"/) + end + end + end + + describe 'failure' do + it 'returns the default value on incorrect yaml' do + pp = <<-EOS + $a = "---\nhunter: washere\ntests: passing\n:" + $o = parseyaml($a, {'tests' => 'using the default value'}) + $tests = $o['tests'] + notice(inline_template('tests are <%= @tests.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/tests are "using the default value"/) + end + end + + it 'raises error on incorrect yaml' do + pp = <<-EOS + $a = "---\nhunter: washere\ntests: passing\n:" + $o = parseyaml($a) + $tests = $o['tests'] + notice(inline_template('tests are <%= @tests.inspect %>')) + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/(syntax error|did not find expected key)/) + end + end + + + it 'raises error on incorrect number of arguments' do + pp = <<-EOS + $o = parseyaml() + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/wrong number of arguments/i) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/pick_default_spec.rb b/environments/production/modules/stdlib/spec/acceptance/pick_default_spec.rb new file mode 100755 index 0000000..e7e25ab --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/pick_default_spec.rb @@ -0,0 +1,54 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'pick_default function' do + describe 'success' do + it 'pick_defaults a default value' do + pp = <<-EOS + $a = undef + $o = pick_default($a, 'default') + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/picked is "default"/) + end + end + it 'pick_defaults with no value' do + pp = <<-EOS + $a = undef + $b = undef + $o = pick_default($a,$b) + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/picked is ""/) + end + end + it 'pick_defaults the first set value' do + pp = <<-EOS + $a = "something" + $b = "long" + $o = pick_default($a, $b, 'default') + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/picked is "something"/) + end + end + end + describe 'failure' do + it 'raises error with no values' do + pp = <<-EOS + $o = pick_default() + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/Must receive at least one argument/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/pick_spec.rb b/environments/production/modules/stdlib/spec/acceptance/pick_spec.rb new file mode 100755 index 0000000..c70b2d9 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/pick_spec.rb @@ -0,0 +1,44 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'pick function' do + describe 'success' do + it 'picks a default value' do + pp = <<-EOS + $a = undef + $o = pick($a, 'default') + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/picked is "default"/) + end + end + it 'picks the first set value' do + pp = <<-EOS + $a = "something" + $b = "long" + $o = pick($a, $b, 'default') + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/picked is "something"/) + end + end + end + describe 'failure' do + it 'raises error with all undef values' do + pp = <<-EOS + $a = undef + $b = undef + $o = pick($a, $b) + notice(inline_template('picked is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/must receive at least one non empty value/) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/prefix_spec.rb b/environments/production/modules/stdlib/spec/acceptance/prefix_spec.rb new file mode 100755 index 0000000..58c691d --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/prefix_spec.rb @@ -0,0 +1,42 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'prefix function' do + describe 'success' do + it 'prefixes array of values' do + pp = <<-EOS + $o = prefix(['a','b','c'],'p') + notice(inline_template('prefix is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/prefix is \["pa", "pb", "pc"\]/) + end + end + it 'prefixs with empty array' do + pp = <<-EOS + $o = prefix([],'p') + notice(inline_template('prefix is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/prefix is \[\]/) + end + end + it 'prefixs array of values with undef' do + pp = <<-EOS + $o = prefix(['a','b','c'], undef) + notice(inline_template('prefix is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/prefix is \["a", "b", "c"\]/) + end + end + end + describe 'failure' do + it 'fails with no arguments' + it 'fails when first argument is not array' + it 'fails when second argument is not string' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/pw_hash_spec.rb b/environments/production/modules/stdlib/spec/acceptance/pw_hash_spec.rb new file mode 100644 index 0000000..829d087 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/pw_hash_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +# Windows and OS X do not have useful implementations of crypt(3) +describe 'pw_hash function', :unless => (['windows', 'Darwin', 'SLES']).include?(fact('operatingsystem')) do + describe 'success' do + it 'hashes passwords' do + pp = <<-EOS + $o = pw_hash('password', 'sha-512', 'salt') + notice(inline_template('pw_hash is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/pw_hash is "\$6\$salt\$IxDD3jeSOb5eB1CX5LBsqZFVkJdido3OUILO5Ifz5iwMuTS4XMS130MTSuDDl3aCI6WouIL9AjRbLCelDCy\.g\."/) + end + end + + it 'returns nil if no password is provided' do + pp = <<-EOS + $o = pw_hash('', 'sha-512', 'salt') + notice(inline_template('pw_hash is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/pw_hash is nil/) + end + end + end + describe 'failure' do + it 'handles less than three arguments' + it 'handles more than three arguments' + it 'handles non strings' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/range_spec.rb b/environments/production/modules/stdlib/spec/acceptance/range_spec.rb new file mode 100755 index 0000000..f57f884 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/range_spec.rb @@ -0,0 +1,36 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'range function' do + describe 'success' do + it 'ranges letters' do + pp = <<-EOS + $o = range('a','d') + notice(inline_template('range is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/range is \["a", "b", "c", "d"\]/) + end + end + it 'ranges letters with a step' do + pp = <<-EOS + $o = range('a','d', '2') + notice(inline_template('range is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/range is \["a", "c"\]/) + end + end + it 'ranges letters with a negative step' + it 'ranges numbers' + it 'ranges numbers with a step' + it 'ranges numbers with a negative step' + it 'ranges numeric strings' + it 'ranges zero padded numbers' + end + describe 'failure' do + it 'fails with no arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/reject_spec.rb b/environments/production/modules/stdlib/spec/acceptance/reject_spec.rb new file mode 100755 index 0000000..ce4342d --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/reject_spec.rb @@ -0,0 +1,42 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'reject function' do + describe 'success' do + it 'rejects array of values' do + pp = <<-EOS + $o = reject(['aaa','bbb','ccc','aaaddd'], 'aaa') + notice(inline_template('reject is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/reject is \["bbb", "ccc"\]/) + end + end + it 'rejects with empty array' do + pp = <<-EOS + $o = reject([],'aaa') + notice(inline_template('reject is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/reject is \[\]/) + end + end + it 'rejects array of values with undef' do + pp = <<-EOS + $o = reject(['aaa','bbb','ccc','aaaddd'], undef) + notice(inline_template('reject is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/reject is \[\]/) + end + end + end + describe 'failure' do + it 'fails with no arguments' + it 'fails when first argument is not array' + it 'fails when second argument is not string' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/reverse_spec.rb b/environments/production/modules/stdlib/spec/acceptance/reverse_spec.rb new file mode 100755 index 0000000..3b5dfad --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/reverse_spec.rb @@ -0,0 +1,23 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'reverse function' do + describe 'success' do + it 'reverses strings' do + pp = <<-EOS + $a = "the public art galleries" + # Anagram: Large picture halls, I bet + $o = reverse($a) + notice(inline_template('reverse is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/reverse is "seirellag tra cilbup eht"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/rstrip_spec.rb b/environments/production/modules/stdlib/spec/acceptance/rstrip_spec.rb new file mode 100755 index 0000000..150dac1 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/rstrip_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'rstrip function' do + describe 'success' do + it 'rstrips arrays' do + pp = <<-EOS + $a = [" the "," public "," art","galleries "] + # Anagram: Large picture halls, I bet + $o = rstrip($a) + notice(inline_template('rstrip is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/rstrip is \[" the", " public", " art", "galleries"\]/) + end + end + it 'rstrips strings' do + pp = <<-EOS + $a = " blowzy night-frumps vex'd jack q " + $o = rstrip($a) + notice(inline_template('rstrip is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/rstrip is " blowzy night-frumps vex'd jack q"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/shuffle_spec.rb b/environments/production/modules/stdlib/spec/acceptance/shuffle_spec.rb new file mode 100755 index 0000000..0738383 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/shuffle_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'shuffle function' do + describe 'success' do + it 'shuffles arrays' do + pp = <<-EOS + $a = ["1", "2", "3", "4", "5", "6", "7", "8", "the","public","art","galleries"] + # Anagram: Large picture halls, I bet + $o = shuffle($a) + notice(inline_template('shuffle is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to_not match(/shuffle is \["1", "2", "3", "4", "5", "6", "7", "8", "the", "public", "art", "galleries"\]/) + end + end + it 'shuffles strings' do + pp = <<-EOS + $a = "blowzy night-frumps vex'd jack q" + $o = shuffle($a) + notice(inline_template('shuffle is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to_not match(/shuffle is "blowzy night-frumps vex'd jack q"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/size_spec.rb b/environments/production/modules/stdlib/spec/acceptance/size_spec.rb new file mode 100755 index 0000000..6390c20 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/size_spec.rb @@ -0,0 +1,55 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'size function' do + describe 'success' do + it 'single string size' do + pp = <<-EOS + $a = 'discombobulate' + $o = size($a) + notice(inline_template('size is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/size is 14/) + end + end + it 'with empty string' do + pp = <<-EOS + $a = '' + $o = size($a) + notice(inline_template('size is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/size is 0/) + end + end + it 'with undef' do + pp = <<-EOS + $a = undef + $o = size($a) + notice(inline_template('size is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/size is 0/) + end + end + it 'strings in array' do + pp = <<-EOS + $a = ['discombobulate', 'moo'] + $o = size($a) + notice(inline_template('size is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/size is 2/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/sort_spec.rb b/environments/production/modules/stdlib/spec/acceptance/sort_spec.rb new file mode 100755 index 0000000..e7ff7f7 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/sort_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'sort function' do + describe 'success' do + it 'sorts arrays' do + pp = <<-EOS + $a = ["the","public","art","galleries"] + # Anagram: Large picture halls, I bet + $o = sort($a) + notice(inline_template('sort is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/sort is \["art", "galleries", "public", "the"\]/) + end + end + it 'sorts strings' do + pp = <<-EOS + $a = "blowzy night-frumps vex'd jack q" + $o = sort($a) + notice(inline_template('sort is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/sort is " '-abcdefghijklmnopqrstuvwxyz"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/squeeze_spec.rb b/environments/production/modules/stdlib/spec/acceptance/squeeze_spec.rb new file mode 100755 index 0000000..3324691 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/squeeze_spec.rb @@ -0,0 +1,47 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'squeeze function' do + describe 'success' do + it 'squeezes arrays' do + pp = <<-EOS + # Real words! + $a = ["wallless", "laparohysterosalpingooophorectomy", "brrr", "goddessship"] + $o = squeeze($a) + notice(inline_template('squeeze is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/squeeze is \["wales", "laparohysterosalpingophorectomy", "br", "godeship"\]/) + end + end + it 'squeezez arrays with an argument' + it 'squeezes strings' do + pp = <<-EOS + $a = "wallless laparohysterosalpingooophorectomy brrr goddessship" + $o = squeeze($a) + notice(inline_template('squeeze is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/squeeze is "wales laparohysterosalpingophorectomy br godeship"/) + end + end + + it 'squeezes strings with an argument' do + pp = <<-EOS + $a = "countessship duchessship governessship hostessship" + $o = squeeze($a, 's') + notice(inline_template('squeeze is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/squeeze is "counteship ducheship governeship hosteship"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/str2bool_spec.rb b/environments/production/modules/stdlib/spec/acceptance/str2bool_spec.rb new file mode 100755 index 0000000..9a8c06c --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/str2bool_spec.rb @@ -0,0 +1,31 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'str2bool function' do + describe 'success' do + it 'works with "y"' do + pp = <<-EOS + $o = str2bool('y') + notice(inline_template('str2bool is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/str2bool is true/) + end + end + it 'works with "Y"' + it 'works with "yes"' + it 'works with "1"' + it 'works with "true"' + it 'works with "n"' + it 'works with "N"' + it 'works with "no"' + it 'works with "0"' + it 'works with "false"' + it 'works with undef' + end + describe 'failure' do + it 'handles no arguments' + it 'handles non arrays or strings' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/str2saltedsha512_spec.rb b/environments/production/modules/stdlib/spec/acceptance/str2saltedsha512_spec.rb new file mode 100755 index 0000000..5f03924 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/str2saltedsha512_spec.rb @@ -0,0 +1,22 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'str2saltedsha512 function' do + describe 'success' do + it 'works with "y"' do + pp = <<-EOS + $o = str2saltedsha512('password') + notice(inline_template('str2saltedsha512 is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/str2saltedsha512 is "[a-f0-9]{136}"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles more than one argument' + it 'handles non strings' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/strftime_spec.rb b/environments/production/modules/stdlib/spec/acceptance/strftime_spec.rb new file mode 100755 index 0000000..38521b0 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/strftime_spec.rb @@ -0,0 +1,22 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'strftime function' do + describe 'success' do + it 'gives the Century' do + pp = <<-EOS + $o = strftime('%C') + notice(inline_template('strftime is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/strftime is "20"/) + end + end + it 'takes a timezone argument' + end + describe 'failure' do + it 'handles no arguments' + it 'handles invalid format strings' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/strip_spec.rb b/environments/production/modules/stdlib/spec/acceptance/strip_spec.rb new file mode 100755 index 0000000..05cd395 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/strip_spec.rb @@ -0,0 +1,34 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'strip function' do + describe 'success' do + it 'strips arrays' do + pp = <<-EOS + $a = [" the "," public "," art","galleries "] + # Anagram: Large picture halls, I bet + $o = strip($a) + notice(inline_template('strip is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/strip is \["the", "public", "art", "galleries"\]/) + end + end + it 'strips strings' do + pp = <<-EOS + $a = " blowzy night-frumps vex'd jack q " + $o = strip($a) + notice(inline_template('strip is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/strip is "blowzy night-frumps vex'd jack q"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/suffix_spec.rb b/environments/production/modules/stdlib/spec/acceptance/suffix_spec.rb new file mode 100755 index 0000000..60a6264 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/suffix_spec.rb @@ -0,0 +1,42 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'suffix function' do + describe 'success' do + it 'suffixes array of values' do + pp = <<-EOS + $o = suffix(['a','b','c'],'p') + notice(inline_template('suffix is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/suffix is \["ap", "bp", "cp"\]/) + end + end + it 'suffixs with empty array' do + pp = <<-EOS + $o = suffix([],'p') + notice(inline_template('suffix is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/suffix is \[\]/) + end + end + it 'suffixs array of values with undef' do + pp = <<-EOS + $o = suffix(['a','b','c'], undef) + notice(inline_template('suffix is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/suffix is \["a", "b", "c"\]/) + end + end + end + describe 'failure' do + it 'fails with no arguments' + it 'fails when first argument is not array' + it 'fails when second argument is not string' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/swapcase_spec.rb b/environments/production/modules/stdlib/spec/acceptance/swapcase_spec.rb new file mode 100755 index 0000000..9f94c0d --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/swapcase_spec.rb @@ -0,0 +1,22 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'swapcase function' do + describe 'success' do + it 'works with strings' do + pp = <<-EOS + $o = swapcase('aBcD') + notice(inline_template('swapcase is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/swapcase is "AbCd"/) + end + end + it 'works with arrays' + end + describe 'failure' do + it 'handles no arguments' + it 'handles non arrays or strings' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/time_spec.rb b/environments/production/modules/stdlib/spec/acceptance/time_spec.rb new file mode 100755 index 0000000..dae1166 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/time_spec.rb @@ -0,0 +1,36 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'time function' do + describe 'success' do + it 'gives the time' do + pp = <<-EOS + $o = time() + notice(inline_template('time is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + m = r.stdout.match(/time is (\d+)\D/) + + # When I wrote this test + expect(Integer(m[1])).to be > 1398894170 + end + end + it 'takes a timezone argument' do + pp = <<-EOS + $o = time('UTC') + notice(inline_template('time is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + m = r.stdout.match(/time is (\d+)\D/) + + expect(Integer(m[1])).to be > 1398894170 + end + end + end + describe 'failure' do + it 'handles more arguments' + it 'handles invalid timezones' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/to_bytes_spec.rb b/environments/production/modules/stdlib/spec/acceptance/to_bytes_spec.rb new file mode 100755 index 0000000..b1015a3 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/to_bytes_spec.rb @@ -0,0 +1,27 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'to_bytes function' do + describe 'success' do + it 'converts kB to B' do + pp = <<-EOS + $o = to_bytes('4 kB') + notice(inline_template('to_bytes is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + m = r.stdout.match(/to_bytes is (\d+)\D/) + expect(m[1]).to eq("4096") + end + end + it 'works without the B in unit' + it 'works without a space before unit' + it 'works without a unit' + it 'converts fractions' + end + describe 'failure' do + it 'handles no arguments' + it 'handles non integer arguments' + it 'handles unknown units like uB' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/try_get_value_spec.rb b/environments/production/modules/stdlib/spec/acceptance/try_get_value_spec.rb new file mode 100755 index 0000000..716241c --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/try_get_value_spec.rb @@ -0,0 +1,47 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'try_get_value function' do + describe 'success' do + it 'gets a value' do + pp = <<-EOS + $data = { + 'a' => { 'b' => 'passing'} + } + + $tests = try_get_value($data, 'a/b') + notice(inline_template('tests are <%= @tests.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/tests are "passing"/) + end + end + end + describe 'failure' do + it 'uses a default value' do + pp = <<-EOS + $data = { + 'a' => { 'b' => 'passing'} + } + + $tests = try_get_value($data, 'c/d', 'using the default value') + notice(inline_template('tests are <%= @tests.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/using the default value/) + end + end + + it 'raises error on incorrect number of arguments' do + pp = <<-EOS + $o = try_get_value() + EOS + + apply_manifest(pp, :expect_failures => true) do |r| + expect(r.stderr).to match(/wrong number of arguments/i) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/type_spec.rb b/environments/production/modules/stdlib/spec/acceptance/type_spec.rb new file mode 100755 index 0000000..5cc9470 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/type_spec.rb @@ -0,0 +1,37 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'type function' do + describe 'success' do + it 'types arrays' do + pp = <<-EOS + $a = ["the","public","art","galleries"] + # Anagram: Large picture halls, I bet + $o = type($a) + notice(inline_template('type is <%= @o.to_s %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/type is Tuple\[String.*, String.*, String.*, String.*\]/) + end + end + it 'types strings' do + pp = <<-EOS + $a = "blowzy night-frumps vex'd jack q" + $o = type($a) + notice(inline_template('type is <%= @o.to_s %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/type is String/) + end + end + it 'types hashes' + it 'types integers' + it 'types floats' + it 'types booleans' + end + describe 'failure' do + it 'handles no arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/union_spec.rb b/environments/production/modules/stdlib/spec/acceptance/union_spec.rb new file mode 100755 index 0000000..7229bf5 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/union_spec.rb @@ -0,0 +1,25 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'union function' do + describe 'success' do + it 'unions arrays' do + pp = <<-EOS + $a = ["the","public"] + $b = ["art"] + $c = ["galleries"] + # Anagram: Large picture halls, I bet + $o = union($a,$b,$c) + notice(inline_template('union is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/union is \["the", "public", "art", "galleries"\]/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/unique_spec.rb b/environments/production/modules/stdlib/spec/acceptance/unique_spec.rb new file mode 100755 index 0000000..7fb5eca --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/unique_spec.rb @@ -0,0 +1,33 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'unique function' do + describe 'success' do + it 'uniques arrays' do + pp = <<-EOS + $a = ["wallless", "wallless", "brrr", "goddessship"] + $o = unique($a) + notice(inline_template('unique is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/unique is \["wallless", "brrr", "goddessship"\]/) + end + end + it 'uniques strings' do + pp = <<-EOS + $a = "wallless laparohysterosalpingooophorectomy brrr goddessship" + $o = unique($a) + notice(inline_template('unique is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/unique is "wales prohytingcmbd"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/upcase_spec.rb b/environments/production/modules/stdlib/spec/acceptance/upcase_spec.rb new file mode 100755 index 0000000..1782309 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/upcase_spec.rb @@ -0,0 +1,33 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'upcase function' do + describe 'success' do + it 'upcases arrays' do + pp = <<-EOS + $a = ["wallless", "laparohysterosalpingooophorectomy", "brrr", "goddessship"] + $o = upcase($a) + notice(inline_template('upcase is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/upcase is \["WALLLESS", "LAPAROHYSTEROSALPINGOOOPHORECTOMY", "BRRR", "GODDESSSHIP"\]/) + end + end + it 'upcases strings' do + pp = <<-EOS + $a = "wallless laparohysterosalpingooophorectomy brrr goddessship" + $o = upcase($a) + notice(inline_template('upcase is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/upcase is "WALLLESS LAPAROHYSTEROSALPINGOOOPHORECTOMY BRRR GODDESSSHIP"/) + end + end + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/uriescape_spec.rb b/environments/production/modules/stdlib/spec/acceptance/uriescape_spec.rb new file mode 100755 index 0000000..e123425 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/uriescape_spec.rb @@ -0,0 +1,23 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'uriescape function' do + describe 'success' do + it 'uriescape strings' do + pp = <<-EOS + $a = ":/?#[]@!$&'()*+,;= \\\"{}" + $o = uriescape($a) + notice(inline_template('uriescape is <%= @o.inspect %>')) + EOS + + apply_manifest(pp, :catch_failures => true) do |r| + expect(r.stdout).to match(/uriescape is ":\/\?%23\[\]@!\$&'\(\)\*\+,;=%20%22%7B%7D"/) + end + end + it 'does nothing if a string is already safe' + end + describe 'failure' do + it 'handles no arguments' + it 'handles non strings or arrays' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/validate_absolute_path_spec.rb b/environments/production/modules/stdlib/spec/acceptance/validate_absolute_path_spec.rb new file mode 100755 index 0000000..880850d --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/validate_absolute_path_spec.rb @@ -0,0 +1,31 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_absolute_path function' do + describe 'success' do + %w{ + C:/ + C:\\\\ + C:\\\\WINDOWS\\\\System32 + C:/windows/system32 + X:/foo/bar + X:\\\\foo\\\\bar + /var/tmp + /var/lib/puppet + /var/opt/../lib/puppet + }.each do |path| + it "validates a single argument #{path}" do + pp = <<-EOS + $one = '#{path}' + validate_absolute_path($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + end + describe 'failure' do + it 'handles improper number of arguments' + it 'handles relative paths' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/validate_array_spec.rb b/environments/production/modules/stdlib/spec/acceptance/validate_array_spec.rb new file mode 100755 index 0000000..a76321d --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/validate_array_spec.rb @@ -0,0 +1,37 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_array function' do + describe 'success' do + it 'validates a single argument' do + pp = <<-EOS + $one = ['a', 'b'] + validate_array($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an multiple arguments' do + pp = <<-EOS + $one = ['a', 'b'] + $two = [['c'], 'd'] + validate_array($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + [ + %{validate_array({'a' => 'hash' })}, + %{validate_array('string')}, + %{validate_array(false)}, + %{validate_array(undef)} + ].each do |pp| + it "rejects #{pp.inspect}" do + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/is not an Array\. It looks to be a/) + end + end + end + describe 'failure' do + it 'handles improper number of arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/validate_augeas_spec.rb b/environments/production/modules/stdlib/spec/acceptance/validate_augeas_spec.rb new file mode 100755 index 0000000..be213d3 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/validate_augeas_spec.rb @@ -0,0 +1,63 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_augeas function', :unless => (fact('osfamily') == 'windows') do + describe 'prep' do + it 'installs augeas for tests' + end + describe 'success' do + context 'valid inputs with no 3rd argument' do + { + 'root:x:0:0:root:/root:/bin/bash\n' => 'Passwd.lns', + 'proc /proc proc nodev,noexec,nosuid 0 0\n' => 'Fstab.lns' + }.each do |line,lens| + it "validates a single argument for #{lens}" do + pp = <<-EOS + $line = "#{line}" + $lens = "#{lens}" + validate_augeas($line, $lens) + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + end + context 'valid inputs with 3rd and 4th arguments' do + it "validates a restricted value" do + line = 'root:x:0:0:root:/root:/bin/barsh\n' + lens = 'Passwd.lns' + restriction = '$file/*[shell="/bin/barsh"]' + pp = <<-EOS + $line = "#{line}" + $lens = "#{lens}" + $restriction = ['#{restriction}'] + validate_augeas($line, $lens, $restriction, "my custom failure message") + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/my custom failure message/) + end + end + context 'invalid inputs' do + { + 'root:x:0:0:root' => 'Passwd.lns', + '127.0.1.1' => 'Hosts.lns' + }.each do |line,lens| + it "validates a single argument for #{lens}" do + pp = <<-EOS + $line = "#{line}" + $lens = "#{lens}" + validate_augeas($line, $lens) + EOS + + apply_manifest(pp, :expect_failures => true) + end + end + end + context 'garbage inputs' do + it 'raises an error on invalid inputs' + end + end + describe 'failure' do + it 'handles improper number of arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/validate_bool_spec.rb b/environments/production/modules/stdlib/spec/acceptance/validate_bool_spec.rb new file mode 100755 index 0000000..993f9ef --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/validate_bool_spec.rb @@ -0,0 +1,37 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_bool function' do + describe 'success' do + it 'validates a single argument' do + pp = <<-EOS + $one = true + validate_bool($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an multiple arguments' do + pp = <<-EOS + $one = true + $two = false + validate_bool($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + [ + %{validate_bool('true')}, + %{validate_bool('false')}, + %{validate_bool([true])}, + %{validate_bool(undef)} + ].each do |pp| + it "rejects #{pp.inspect}" do + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/is not a boolean\. It looks to be a/) + end + end + end + describe 'failure' do + it 'handles improper number of arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/validate_cmd_spec.rb b/environments/production/modules/stdlib/spec/acceptance/validate_cmd_spec.rb new file mode 100755 index 0000000..5fc7b94 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/validate_cmd_spec.rb @@ -0,0 +1,52 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_cmd function' do + describe 'success' do + it 'validates a true command' do + pp = <<-EOS + $one = 'foo' + if $::osfamily == 'windows' { + $two = 'echo' #shell built-in + } else { + $two = '/bin/echo' + } + validate_cmd($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates a fail command' do + pp = <<-EOS + $one = 'foo' + if $::osfamily == 'windows' { + $two = 'C:/aoeu' + } else { + $two = '/bin/aoeu' + } + validate_cmd($one,$two) + EOS + + apply_manifest(pp, :expect_failures => true) + end + it 'validates a fail command with a custom error message' do + pp = <<-EOS + $one = 'foo' + if $::osfamily == 'windows' { + $two = 'C:/aoeu' + } else { + $two = '/bin/aoeu' + } + validate_cmd($one,$two,"aoeu is dvorak") + EOS + + apply_manifest(pp, :expect_failures => true) do |output| + expect(output.stderr).to match(/aoeu is dvorak/) + end + end + end + describe 'failure' do + it 'handles improper number of arguments' + it 'handles improper argument types' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/validate_hash_spec.rb b/environments/production/modules/stdlib/spec/acceptance/validate_hash_spec.rb new file mode 100755 index 0000000..fc0f079 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/validate_hash_spec.rb @@ -0,0 +1,37 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_hash function' do + describe 'success' do + it 'validates a single argument' do + pp = <<-EOS + $one = { 'a' => 1 } + validate_hash($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an multiple arguments' do + pp = <<-EOS + $one = { 'a' => 1 } + $two = { 'b' => 2 } + validate_hash($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + [ + %{validate_hash('{ "not" => "hash" }')}, + %{validate_hash('string')}, + %{validate_hash(["array"])}, + %{validate_hash(undef)} + ].each do |pp| + it "rejects #{pp.inspect}" do + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(//) + end + end + end + describe 'failure' do + it 'handles improper number of arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/validate_ipv4_address_spec.rb b/environments/production/modules/stdlib/spec/acceptance/validate_ipv4_address_spec.rb new file mode 100755 index 0000000..67d3139 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/validate_ipv4_address_spec.rb @@ -0,0 +1,31 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_ipv4_address function' do + describe 'success' do + it 'validates a single argument' do + pp = <<-EOS + $one = '1.2.3.4' + validate_ipv4_address($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an multiple arguments' do + pp = <<-EOS + $one = '1.2.3.4' + $two = '5.6.7.8' + validate_ipv4_address($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + describe 'failure' do + it 'handles improper number of arguments' + it 'handles ipv6 addresses' + it 'handles non-ipv4 strings' + it 'handles numbers' + it 'handles no arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/validate_ipv6_address_spec.rb b/environments/production/modules/stdlib/spec/acceptance/validate_ipv6_address_spec.rb new file mode 100755 index 0000000..eaa845d --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/validate_ipv6_address_spec.rb @@ -0,0 +1,31 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_ipv6_address function' do + describe 'success' do + it 'validates a single argument' do + pp = <<-EOS + $one = '3ffe:0505:0002::' + validate_ipv6_address($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an multiple arguments' do + pp = <<-EOS + $one = '3ffe:0505:0002::' + $two = '3ffe:0505:0001::' + validate_ipv6_address($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + end + describe 'failure' do + it 'handles improper number of arguments' + it 'handles ipv6 addresses' + it 'handles non-ipv6 strings' + it 'handles numbers' + it 'handles no arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/validate_re_spec.rb b/environments/production/modules/stdlib/spec/acceptance/validate_re_spec.rb new file mode 100755 index 0000000..eefb286 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/validate_re_spec.rb @@ -0,0 +1,47 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_re function' do + describe 'success' do + it 'validates a string' do + pp = <<-EOS + $one = 'one' + $two = '^one$' + validate_re($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an array' do + pp = <<-EOS + $one = 'one' + $two = ['^one$', '^two'] + validate_re($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates a failed array' do + pp = <<-EOS + $one = 'one' + $two = ['^two$', '^three'] + validate_re($one,$two) + EOS + + apply_manifest(pp, :expect_failures => true) + end + it 'validates a failed array with a custom error message' do + pp = <<-EOS + $one = '3.4.3' + $two = '^2.7' + validate_re($one,$two,"The $puppetversion fact does not match 2.7") + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/does not match/) + end + end + describe 'failure' do + it 'handles improper number of arguments' + it 'handles improper argument types' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/validate_slength_spec.rb b/environments/production/modules/stdlib/spec/acceptance/validate_slength_spec.rb new file mode 100755 index 0000000..c29fd23 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/validate_slength_spec.rb @@ -0,0 +1,72 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_slength function' do + describe 'success' do + it 'validates a single string max' do + pp = <<-EOS + $one = 'discombobulate' + $two = 17 + validate_slength($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates multiple string maxes' do + pp = <<-EOS + $one = ['discombobulate', 'moo'] + $two = 17 + validate_slength($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates min/max of strings in array' do + pp = <<-EOS + $one = ['discombobulate', 'moo'] + $two = 17 + $three = 3 + validate_slength($one,$two,$three) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates a single string max of incorrect length' do + pp = <<-EOS + $one = 'discombobulate' + $two = 1 + validate_slength($one,$two) + EOS + + apply_manifest(pp, :expect_failures => true) + end + it 'validates multiple string maxes of incorrect length' do + pp = <<-EOS + $one = ['discombobulate', 'moo'] + $two = 3 + validate_slength($one,$two) + EOS + + apply_manifest(pp, :expect_failures => true) + end + it 'validates multiple strings min/maxes of incorrect length' do + pp = <<-EOS + $one = ['discombobulate', 'moo'] + $two = 17 + $three = 10 + validate_slength($one,$two,$three) + EOS + + apply_manifest(pp, :expect_failures => true) + end + end + describe 'failure' do + it 'handles improper number of arguments' + it 'handles improper first argument type' + it 'handles non-strings in array of first argument' + it 'handles improper second argument type' + it 'handles improper third argument type' + it 'handles negative ranges' + it 'handles improper ranges' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/validate_string_spec.rb b/environments/production/modules/stdlib/spec/acceptance/validate_string_spec.rb new file mode 100755 index 0000000..f04608d --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/validate_string_spec.rb @@ -0,0 +1,43 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'validate_string function' do + describe 'success' do + it 'validates a single argument' do + pp = <<-EOS + $one = 'string' + validate_string($one) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates an multiple arguments' do + pp = <<-EOS + $one = 'string' + $two = 'also string' + validate_string($one,$two) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates undef' do + pp = <<-EOS + validate_string(undef) + EOS + + apply_manifest(pp, :catch_failures => true) + end + it 'validates a non-string' do + { + %{validate_string({ 'a' => 'hash' })} => "Hash", + %{validate_string(['array'])} => "Array", + %{validate_string(false)} => "FalseClass", + }.each do |pp,type| + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/a #{type}/) + end + end + end + describe 'failure' do + it 'handles improper number of arguments' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/values_at_spec.rb b/environments/production/modules/stdlib/spec/acceptance/values_at_spec.rb new file mode 100755 index 0000000..eb0bf4f --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/values_at_spec.rb @@ -0,0 +1,73 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'values_at function' do + describe 'success' do + it 'returns a specific value' do + pp = <<-EOS + $one = ['a','b','c','d','e'] + $two = 1 + $output = values_at($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["b"\]/) + end + it 'returns a specific negative index value' do + pending("negative numbers don't work") + pp = <<-EOS + $one = ['a','b','c','d','e'] + $two = -1 + $output = values_at($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["e"\]/) + end + it 'returns a range of values' do + pp = <<-EOS + $one = ['a','b','c','d','e'] + $two = "1-3" + $output = values_at($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["b", "c", "d"\]/) + end + it 'returns a negative specific value and range of values' do + pp = <<-EOS + $one = ['a','b','c','d','e'] + $two = ["1-3",0] + $output = values_at($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["b", "c", "d", "a"\]/) + end + end + describe 'failure' do + it 'handles improper number of arguments' do + pp = <<-EOS + $one = ['a','b','c','d','e'] + $output = values_at($one) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Wrong number of arguments/) + end + it 'handles non-indicies arguments' do + pp = <<-EOS + $one = ['a','b','c','d','e'] + $two = [] + $output = values_at($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/at least one positive index/) + end + + it 'detects index ranges smaller than the start range' + it 'handles index ranges larger than array' + it 'handles non-integer indicies' + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/values_spec.rb b/environments/production/modules/stdlib/spec/acceptance/values_spec.rb new file mode 100755 index 0000000..cef1c9d --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/values_spec.rb @@ -0,0 +1,30 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'values function' do + describe 'success' do + it 'returns an array of values' do + pp = <<-EOS + $arg = { + 'a' => 1, + 'b' => 2, + 'c' => 3, + } + $output = values($arg) + notice(inline_template('<%= @output.sort.inspect %>')) + EOS + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[1, 2, 3\]/) + end + end + describe 'failure' do + it 'handles non-hash arguments' do + pp = <<-EOS + $arg = "foo" + $output = values($arg) + notice(inline_template('<%= @output.inspect %>')) + EOS + + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Requires hash/) + end + end +end diff --git a/environments/production/modules/stdlib/spec/acceptance/zip_spec.rb b/environments/production/modules/stdlib/spec/acceptance/zip_spec.rb new file mode 100755 index 0000000..ae22896 --- /dev/null +++ b/environments/production/modules/stdlib/spec/acceptance/zip_spec.rb @@ -0,0 +1,67 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper_acceptance' + +describe 'zip function' do + describe 'success' do + it 'zips two arrays of numbers together' do + pp = <<-EOS + $one = [1,2,3,4] + $two = [5,6,7,8] + $output = zip($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[\[1, 5\], \[2, 6\], \[3, 7\], \[4, 8\]\]/) + end + it 'zips two arrays of numbers & bools together' do + pp = <<-EOS + $one = [1,2,"three",4] + $two = [true,true,false,false] + $output = zip($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[\[1, true\], \[2, true\], \["three", false\], \[4, false\]\]/) + end + it 'zips two arrays of numbers together and flattens them' do + # XXX This only tests the argument `true`, even though the following are valid: + # 1 t y true yes + # 0 f n false no + # undef undefined + pp = <<-EOS + $one = [1,2,3,4] + $two = [5,6,7,8] + $output = zip($one,$two,true) + notice(inline_template('<%= @output.inspect %>')) + EOS + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[1, 5, 2, 6, 3, 7, 4, 8\]/) + end + it 'handles unmatched length' do + # XXX Is this expected behavior? + pp = <<-EOS + $one = [1,2] + $two = [5,6,7,8] + $output = zip($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[\[1, 5\], \[2, 6\]\]/) + end + end + describe 'failure' do + it 'handles improper number of arguments' do + pp = <<-EOS + $one = [1,2] + $output = zip($one) + notice(inline_template('<%= @output.inspect %>')) + EOS + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Wrong number of arguments/) + end + it 'handles improper argument types' do + pp = <<-EOS + $one = "a string" + $two = [5,6,7,8] + $output = zip($one,$two) + notice(inline_template('<%= @output.inspect %>')) + EOS + expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Requires array/) + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/absolute_path_spec.rb b/environments/production/modules/stdlib/spec/aliases/absolute_path_spec.rb new file mode 100644 index 0000000..308a3aa --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/absolute_path_spec.rb @@ -0,0 +1,67 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::absolute_path', type: :class do + describe 'valid paths handling' do + %w{ + C:/ + C:\\ + C:\\WINDOWS\\System32 + C:/windows/system32 + X:/foo/bar + X:\\foo\\bar + \\\\host\\windows + //host/windows + / + /var/tmp + /var/opt/../lib/puppet + /var/opt//lib/puppet + /var/ůťƒ8 + /var/ネット + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::Compat::Absolute_path/) } + end + end + end + + context 'relative paths' do + %w{ + relative1 + . + .. + ./foo + ../foo + etc/puppetlabs/puppet + opt/puppet/bin + relative\\windows + \var\ůťƒ8 + \var\ネット + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::Compat::Absolute_path/) } + end + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/absolutepath_spec.rb b/environments/production/modules/stdlib/spec/aliases/absolutepath_spec.rb new file mode 100644 index 0000000..cd442f2 --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/absolutepath_spec.rb @@ -0,0 +1,50 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::absolutepath', type: :class do + describe 'valid handling' do + %w{ + /usr2/username/bin:/usr/local/bin:/usr/bin:. + C:/ + C:\\ + C:\\WINDOWS\\System32 + C:/windows/system32 + X:/foo/bar + X:\\foo\\bar + \\\\host\\windows + //host/windows + /var/tmp + /var/opt/../lib/puppet + /var/opt//lib/puppet + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + "*/Users//nope", + "\\Users/hc/wksp/stdlib", + "C:noslashes", + "\\var\\tmp" + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Variant/) } + end + end + end + + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/array_spec.rb b/environments/production/modules/stdlib/spec/aliases/array_spec.rb new file mode 100644 index 0000000..89cc2af --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/array_spec.rb @@ -0,0 +1,34 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::array', type: :class do + describe 'accepts arrays' do + [ + [], + ['one'], + [1], + [{}], + [[]], + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'rejects other values' do + [ + '', + 'one', + '1', + {}, + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a Stdlib::Compat::Array/) } + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/bool_spec.rb b/environments/production/modules/stdlib/spec/aliases/bool_spec.rb new file mode 100644 index 0000000..b84ab51 --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/bool_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::bool', type: :class do + describe 'accepts booleans' do + [ + true, + false, + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'rejects other values' do + [ + [1], + [{}], + [true], + 'true', + 'false', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a Stdlib::Compat::Bool/) } + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/float_spec.rb b/environments/production/modules/stdlib/spec/aliases/float_spec.rb new file mode 100644 index 0000000..66079c6 --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/float_spec.rb @@ -0,0 +1,28 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::float', type: :class do + describe 'accepts floats' do + [ + 3.7, + '3.7', + -3.7, + '-342.2315e-12', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'rejects other values' do + [ true, 'true', false, 'false', 'iAmAString', '1test', '1 test', 'test 1', 'test 1 test', {}, { 'key' => 'value' }, { 1=> 2 }, '', :undef , 'x', 3, '3', -3, '-3'].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a value of type Float or Pattern(\[.*\]+)?/) } + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/hash_spec.rb b/environments/production/modules/stdlib/spec/aliases/hash_spec.rb new file mode 100644 index 0000000..6e5060d --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/hash_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::hash', type: :class do + describe 'accepts hashes' do + [ + {}, + {'one' => "two"}, + {'wan' => 3}, + {'001' => "helly"}, + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + describe 'rejects other values' do + [ + '', + 'one', + '1', + [], + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a Stdlib::Compat::Hash/) } + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/httpsurl_spec.rb b/environments/production/modules/stdlib/spec/aliases/httpsurl_spec.rb new file mode 100644 index 0000000..3e51118 --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/httpsurl_spec.rb @@ -0,0 +1,44 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::httpsurl', type: :class do + describe 'valid handling' do + %w{ + https://hello.com + https://notcreative.org + https://notexciting.co.uk + https://graphemica.com/❤ + https://graphemica.com/緩 + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + "httds://notquiteright.org", + "hptts:/nah", + "https;//notrightbutclose.org", + "http://graphemica.com/❤", + "http://graphemica.com/緩" + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::HTTPSUrl/) } + end + end + end + + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/httpurl_spec.rb b/environments/production/modules/stdlib/spec/aliases/httpurl_spec.rb new file mode 100644 index 0000000..fd49a47 --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/httpurl_spec.rb @@ -0,0 +1,47 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::httpurl', type: :class do + describe 'valid handling' do + %w{ + https://hello.com + https://notcreative.org + https://canstillaccepthttps.co.uk + http://anhttp.com + http://runningoutofideas.gov + http:// + http://graphemica.com/❤ + http://graphemica.com/緩 + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + "httds://notquiteright.org", + "hptts:/nah", + "https;//notrightbutclose.org", + "hts://graphemica.com/❤", + "https:graphemica.com/緩" + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::HTTPUrl/) } + end + end + end + + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/integer_spec.rb b/environments/production/modules/stdlib/spec/aliases/integer_spec.rb new file mode 100644 index 0000000..bd00c2a --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/integer_spec.rb @@ -0,0 +1,28 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::integer', type: :class do + describe 'accepts integers' do + [ + 3, + '3', + -3, + '-3', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'rejects other values' do + [ true, 'true', false, 'false', 'iAmAString', '1test', '1 test', 'test 1', 'test 1 test', {}, { 'key' => 'value' }, { 1=> 2 }, '', :undef , 'x', 3.7, '3.7',-3.7, '-342.2315e-12' ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a value of type Integer, Pattern(\[.*\]+)?, or Array/) } + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/ip_address.rb b/environments/production/modules/stdlib/spec/aliases/ip_address.rb new file mode 100644 index 0000000..67a555c --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/ip_address.rb @@ -0,0 +1,34 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::ip_address', type: :class do + describe 'accepts ipv4 and ipv6 addresses' do + [ + '224.0.0.0', + '255.255.255.255', + '0.0.0.0', + '192.88.99.0', + '2001:0db8:85a3:0000:0000:8a2e:0370:7334', + 'fa76:8765:34ac:0823:ab76:eee9:0987:1111' + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + describe 'rejects other values' do + [ + 'nope', + '77', + '4.4.4', + '2001:0db8:85a3:000000:0000:8a2e:0370:7334' + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for/) } + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/ipv4_spec.rb b/environments/production/modules/stdlib/spec/aliases/ipv4_spec.rb new file mode 100644 index 0000000..6a503ad --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/ipv4_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::ipv4', type: :class do + describe 'accepts ipv4 addresses' do + SharedData::IPV4_PATTERNS.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + describe 'rejects other values' do + SharedData::IPV4_NEGATIVE_PATTERNS.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::Compat::Ipv4/) } + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/ipv6_spec.rb b/environments/production/modules/stdlib/spec/aliases/ipv6_spec.rb new file mode 100644 index 0000000..ae90f42 --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/ipv6_spec.rb @@ -0,0 +1,40 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::ipv6', type: :class do + describe 'accepts ipv6 addresses' do + [ + '2001:0db8:85a3:0000:0000:8a2e:0370:7334', + 'fa76:8765:34ac:0823:ab76:eee9:0987:1111', + 'fe80:0000:0000:0000:0204:61ff:fe9d:f156', + 'fe80:0:0:0:204:61ff:fe9d:f156', + 'fe80::204:61ff:fe9d:f156', + 'fe80:0:0:0:0204:61ff:254.157.241.86', + '::1', + 'fe80::', + '2001::', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + describe 'rejects other values' do + [ + 'nope', + '77', + '4.4.4', + '2000:7334', + '::ffff:2.3.4', + '::ffff:257.1.2.3', + '::ffff:12345678901234567890.1.26', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::Compat::Ipv6/) } + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/numeric_spec.rb b/environments/production/modules/stdlib/spec/aliases/numeric_spec.rb new file mode 100644 index 0000000..bc17f4f --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/numeric_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::numeric', type: :class do + describe 'accepts numerics' do + [ + 3, + '3', + -3, + '-3', + 3.7, + '3.7', + -3.7, + '-342.2315e-12', + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'rejects other values' do + [ true, 'true', false, 'false', 'iAmAString', '1test', '1 test', 'test 1', 'test 1 test', {}, { 'key' => 'value' }, { 1=> 2 }, '', :undef , 'x' ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a value of type Numeric, Pattern(\[.*\]+)?, or Array/) } + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/string_spec.rb b/environments/production/modules/stdlib/spec/aliases/string_spec.rb new file mode 100644 index 0000000..d8fb885 --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/string_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::string', type: :class do + describe 'accepts strings' do + [ + '', + 'one', + nil, + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'rejects other values' do + [ + [], + {}, + 1, + true, + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a String/) } + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/unixpath_spec.rb b/environments/production/modules/stdlib/spec/aliases/unixpath_spec.rb new file mode 100644 index 0000000..6aecfe7 --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/unixpath_spec.rb @@ -0,0 +1,47 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::unixpath', type: :class do + describe 'valid handling' do + %w{ + /usr2/username/bin:/usr/local/bin:/usr/bin:. + /var/tmp + /Users/helencampbell/workspace/puppetlabs-stdlib + /var/ůťƒ8 + /var/ネット + /var//tmp + /var/../tmp + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + "C:/whatever", + "\\var\\tmp", + "\\Users/hc/wksp/stdlib", + "*/Users//nope", + "var\ůťƒ8", + "var\ネット" + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::Unixpath/) } + end + end + end + + end + end +end diff --git a/environments/production/modules/stdlib/spec/aliases/windowspath_spec.rb b/environments/production/modules/stdlib/spec/aliases/windowspath_spec.rb new file mode 100644 index 0000000..c20e373 --- /dev/null +++ b/environments/production/modules/stdlib/spec/aliases/windowspath_spec.rb @@ -0,0 +1,47 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'test::windowspath', type: :class do + describe 'valid handling' do + %w{ + C:\\ + C:\\WINDOWS\\System32 + C:/windows/system32 + X:/foo/bar + X:\\foo\\bar + \\\\host\\windows + X:/var/ůťƒ8 + X:/var/ネット + }.each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile } + end + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + "httds://notquiteright.org", + "/usr2/username/bin:/usr/local/bin:/usr/bin:.", + "C;//notright/here", + "C:noslashes", + "C:ネット", + "C:ůťƒ8" + ].each do |value| + describe value.inspect do + let(:params) {{ value: value }} + it { is_expected.to compile.and_raise_error(/parameter 'value' expects a match for Stdlib::Windowspath/) } + end + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/fixtures/dscacheutil/root b/environments/production/modules/stdlib/spec/fixtures/dscacheutil/root new file mode 100644 index 0000000..1e34519 --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/dscacheutil/root @@ -0,0 +1,8 @@ +name: root +password: * +uid: 0 +gid: 0 +dir: /var/root +shell: /bin/bash +gecos: rawr Root + diff --git a/environments/production/modules/stdlib/spec/fixtures/lsuser/root b/environments/production/modules/stdlib/spec/fixtures/lsuser/root new file mode 100644 index 0000000..afd59ca --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/lsuser/root @@ -0,0 +1,2 @@ +#name:home +root:/root diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/absolute_path.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/absolute_path.pp new file mode 100644 index 0000000..d77f6bd --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/absolute_path.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Compat::Absolute_path type alias +class test::absolute_path( + Stdlib::Compat::Absolute_path $value, + ) { + notice("Success") +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/absolutepath.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/absolutepath.pp new file mode 100644 index 0000000..8321471 --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/absolutepath.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Absolutepath type. Not to be confused with Stdlib::Compat::Absolute_path. +class test::absolutepath( + Stdlib::Absolutepath $value, + ) { + notice("Success") +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/array.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/array.pp new file mode 100644 index 0000000..84b6a5b --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/array.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::Array type alias +class test::array( + Stdlib::Compat::Array $value, + ) { + + notice("Success") + +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/bool.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/bool.pp new file mode 100644 index 0000000..ab5b5ea --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/bool.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::Bool type alias +class test::bool( + Stdlib::Compat::Bool $value, + ) { + + notice("Success") + +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/ensure_resources.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/ensure_resources.pp new file mode 100644 index 0000000..bd26002 --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/ensure_resources.pp @@ -0,0 +1,4 @@ +# A helper class to test the ensure_resources function +class test::ensure_resources($resource_type, $title_hash, $attributes_hash) { + ensure_resources($resource_type, $title_hash, $attributes_hash) +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/float.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/float.pp new file mode 100644 index 0000000..03a603d --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/float.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::Float type alias +class test::float( + Stdlib::Compat::Float $value, + ) { + + notice("Success") + +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/hash.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/hash.pp new file mode 100644 index 0000000..c243570 --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/hash.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::Hash type alias +class test::hash( + Stdlib::Compat::Hash $value, + ) { + + notice("Success") + +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/httpsurl.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/httpsurl.pp new file mode 100644 index 0000000..9d6b92d --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/httpsurl.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::HTTPSUrl type alias +class test::httpsurl( + Stdlib::HTTPSUrl $value, + ) { + notice("Success") +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/httpurl.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/httpurl.pp new file mode 100644 index 0000000..abf869e --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/httpurl.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::HTTPUrl type alias +class test::httpurl( + Stdlib::HTTPUrl $value, + ) { + notice("Success") +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/integer.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/integer.pp new file mode 100644 index 0000000..a4f26df --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/integer.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::Integer type alias +class test::integer( + Stdlib::Compat::Integer $value, + ) { + + notice("Success") + +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/ip_address.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/ip_address.pp new file mode 100644 index 0000000..bbbd804 --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/ip_address.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Compat::Ip_address type alias +class test::ip_address( + Stdlib::Compat::Ip_address $value, + ) { + notice("Success") + } diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/ipv4.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/ipv4.pp new file mode 100644 index 0000000..2e8022d --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/ipv4.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Compat::Ipv4 type alias +class test::ipv4( + Stdlib::Compat::Ipv4 $value, + ) { + notice("Success") + } diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/ipv6.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/ipv6.pp new file mode 100644 index 0000000..7912fd6 --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/ipv6.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Compat::Ipv6 type alias +class test::ipv6( + Stdlib::Compat::Ipv6 $value, + ) { + notice("Success") +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/numeric.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/numeric.pp new file mode 100644 index 0000000..2657ebc --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/numeric.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::Numeric type alias +class test::numeric( + Stdlib::Compat::Numeric $value, + ) { + + notice("Success") + +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/string.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/string.pp new file mode 100644 index 0000000..6508c70 --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/string.pp @@ -0,0 +1,8 @@ +# Class to test the Stdlib::Compat::String type alias +class test::string( + Stdlib::Compat::String $value, + ) { + + notice("Success") + +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/unixpath.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/unixpath.pp new file mode 100644 index 0000000..9311109 --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/unixpath.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Unixpath type alias +class test::unixpath( + Stdlib::Unixpath $value, + ) { + notice("Success") +} diff --git a/environments/production/modules/stdlib/spec/fixtures/test/manifests/windowspath.pp b/environments/production/modules/stdlib/spec/fixtures/test/manifests/windowspath.pp new file mode 100644 index 0000000..af93ed3 --- /dev/null +++ b/environments/production/modules/stdlib/spec/fixtures/test/manifests/windowspath.pp @@ -0,0 +1,6 @@ +# Class to test the Stdlib::Windowspath type alias +class test::windowspath( + Stdlib::Windowspath $value, + ) { + notice("Success") +} diff --git a/environments/production/modules/stdlib/spec/functions/abs_spec.rb b/environments/production/modules/stdlib/spec/functions/abs_spec.rb new file mode 100755 index 0000000..7d2257b --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/abs_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper' + +describe 'abs' do + it { is_expected.not_to eq(nil) } + + describe 'signature validation in puppet3', :unless => RSpec.configuration.puppet_future do + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params(1, 2).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + end + + describe 'signature validation in puppet4', :if => RSpec.configuration.puppet_future do + it { pending "the puppet 4 implementation"; is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(1, 2).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params([]).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params({}).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(true).and_raise_error(ArgumentError) } + end + + it { is_expected.to run.with_params(-34).and_return(34) } + it { is_expected.to run.with_params("-34").and_return(34) } + it { is_expected.to run.with_params(34).and_return(34) } + it { is_expected.to run.with_params("34").and_return(34) } + it { is_expected.to run.with_params(-34.5).and_return(34.5) } + it { is_expected.to run.with_params("-34.5").and_return(34.5) } + it { is_expected.to run.with_params(34.5).and_return(34.5) } + it { is_expected.to run.with_params("34.5").and_return(34.5) } +end diff --git a/environments/production/modules/stdlib/spec/functions/any2array_spec.rb b/environments/production/modules/stdlib/spec/functions/any2array_spec.rb new file mode 100755 index 0000000..631657f --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/any2array_spec.rb @@ -0,0 +1,21 @@ +require 'spec_helper' + +describe "any2array" do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_return([]) } + it { is_expected.to run.with_params(true).and_return([true]) } + it { is_expected.to run.with_params('one').and_return(['one']) } + it { is_expected.to run.with_params('one', 'two').and_return(['one', 'two']) } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['one']).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two']).and_return(['one', 'two']) } + it { is_expected.to run.with_params({}).and_return([]) } + it { is_expected.to run.with_params({ 'key' => 'value' }).and_return(['key', 'value']) } + it { is_expected.to run.with_params({ 'key' => 'value' }).and_return(['key', 'value']) } + + it { is_expected.to run.with_params('‰').and_return(['‰']) } + it { is_expected.to run.with_params('竹').and_return(['竹']) } + it { is_expected.to run.with_params('Ü').and_return(['Ü']) } + it { is_expected.to run.with_params('∇').and_return(['∇']) } + it { is_expected.to run.with_params('€', '万', 'Ö', '♥', '割').and_return(['€', '万', 'Ö', '♥', '割']) } +end diff --git a/environments/production/modules/stdlib/spec/functions/any2bool_spec.rb b/environments/production/modules/stdlib/spec/functions/any2bool_spec.rb new file mode 100755 index 0000000..9d351ce --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/any2bool_spec.rb @@ -0,0 +1,42 @@ +require 'spec_helper' + +describe 'any2bool' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + it { is_expected.to run.with_params(true).and_return(true) } + it { is_expected.to run.with_params(false).and_return(false) } + + it { is_expected.to run.with_params('1.5').and_return(true) } + + describe 'when testing stringy values that mean "true"' do + [ 'TRUE','1', 't', 'y', 'true', 'yes'].each do |value| + it { is_expected.to run.with_params(value).and_return(true) } + end + end + + describe 'when testing stringy values that mean "false"' do + [ 'FALSE','', '0', 'f', 'n', 'false', 'no', 'undef', 'undefined', nil, :undef ].each do |value| + it { is_expected.to run.with_params(value).and_return(false) } + end + end + + describe 'when testing numeric values that mean "true"' do + [ 1,'1',1.5, '1.5'].each do |value| + it { is_expected.to run.with_params(value).and_return(true) } + end + end + + describe 'when testing numeric that mean "false"' do + [ -1, '-1', -1.5, '-1.5', '0', 0 ].each do |value| + it { is_expected.to run.with_params(value).and_return(false) } + end + end + + describe 'everything else returns true' do + [ [], {}, ['1'], [1], {:one => 1} ].each do |value| + it { is_expected.to run.with_params(value).and_return(true) } + end + end + +end diff --git a/environments/production/modules/stdlib/spec/functions/assert_private_spec.rb b/environments/production/modules/stdlib/spec/functions/assert_private_spec.rb new file mode 100755 index 0000000..355e0dd --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/assert_private_spec.rb @@ -0,0 +1,41 @@ +require 'spec_helper' + +describe 'assert_private' do + context 'when called from inside module' do + it "should not fail" do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('foo') + + is_expected.to run.with_params() + end + end + + context "when called from private class" do + before :each do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('bar') + end + + it "should fail with a class error message" do + scope.source.expects(:name).returns('foo::baz') + scope.source.expects(:type).returns('hostclass') + + is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /Class foo::baz is private/) + end + + context "with an explicit failure message" do + it { is_expected.to run.with_params('failure message!').and_raise_error(Puppet::ParseError, /failure message!/) } + end + end + + context "when called from private definition" do + it "should fail with a class error message" do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('bar') + scope.source.expects(:name).returns('foo::baz') + scope.source.expects(:type).returns('definition') + + is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /Definition foo::baz is private/) + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/base64_spec.rb b/environments/production/modules/stdlib/spec/functions/base64_spec.rb new file mode 100755 index 0000000..842a37a --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/base64_spec.rb @@ -0,0 +1,37 @@ +require 'spec_helper' + +describe 'base64' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("one").and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("one", "two").and_raise_error(Puppet::ParseError, /first argument must be one of/) } + it { is_expected.to run.with_params("encode", ["two"]).and_raise_error(Puppet::ParseError, /second argument must be a string/) } + it { is_expected.to run.with_params("encode", 2).and_raise_error(Puppet::ParseError, /second argument must be a string/) } + it { is_expected.to run.with_params("encode", "thestring", "three").and_raise_error(Puppet::ParseError, /third argument must be one of/) } + it { is_expected.to run.with_params("decode", "dGhlc3RyaW5n\n", "strict").and_raise_error(ArgumentError) } + + it { is_expected.to run.with_params("encode", "thestring").and_return("dGhlc3RyaW5n\n") } + it { is_expected.to run.with_params("decode", "dGhlc3RyaW5n").and_return("thestring") } + it { is_expected.to run.with_params("decode", "dGhlc3RyaW5n\n").and_return("thestring") } + + it { is_expected.to run.with_params("encode", "thestring", "default").and_return("dGhlc3RyaW5n\n") } + it { is_expected.to run.with_params("decode", "dGhlc3RyaW5n", "default").and_return("thestring") } + it { is_expected.to run.with_params("decode", "dGhlc3RyaW5n\n", "default").and_return("thestring") } + + it { is_expected.to run.with_params("encode", "thestring", "strict").and_return("dGhlc3RyaW5n") } + it { is_expected.to run.with_params("decode", "dGhlc3RyaW5n", "strict").and_return("thestring") } + + it { is_expected.to run.with_params("encode", "a very long string that will cause the base64 encoder to produce output with multiple lines").and_return("YSB2ZXJ5IGxvbmcgc3RyaW5nIHRoYXQgd2lsbCBjYXVzZSB0aGUgYmFzZTY0\nIGVuY29kZXIgdG8gcHJvZHVjZSBvdXRwdXQgd2l0aCBtdWx0aXBsZSBsaW5l\ncw==\n") } + it { is_expected.to run.with_params("decode", "YSB2ZXJ5IGxvbmcgc3RyaW5nIHRoYXQgd2lsbCBjYXVzZSB0aGUgYmFzZTY0\nIGVuY29kZXIgdG8gcHJvZHVjZSBvdXRwdXQgd2l0aCBtdWx0aXBsZSBsaW5l\ncw==\n").and_return("a very long string that will cause the base64 encoder to produce output with multiple lines") } + it { is_expected.to run.with_params("decode", "YSB2ZXJ5IGxvbmcgc3RyaW5nIHRoYXQgd2lsbCBjYXVzZSB0aGUgYmFzZTY0IGVuY29kZXIgdG8gcHJvZHVjZSBvdXRwdXQgd2l0aCBtdWx0aXBsZSBsaW5lcw==").and_return("a very long string that will cause the base64 encoder to produce output with multiple lines") } + + it { is_expected.to run.with_params("encode", "a very long string that will cause the base64 encoder to produce output with multiple lines", "strict").and_return("YSB2ZXJ5IGxvbmcgc3RyaW5nIHRoYXQgd2lsbCBjYXVzZSB0aGUgYmFzZTY0IGVuY29kZXIgdG8gcHJvZHVjZSBvdXRwdXQgd2l0aCBtdWx0aXBsZSBsaW5lcw==") } + it { is_expected.to run.with_params("decode", "YSB2ZXJ5IGxvbmcgc3RyaW5nIHRoYXQgd2lsbCBjYXVzZSB0aGUgYmFzZTY0IGVuY29kZXIgdG8gcHJvZHVjZSBvdXRwdXQgd2l0aCBtdWx0aXBsZSBsaW5lcw==").and_return("a very long string that will cause the base64 encoder to produce output with multiple lines") } + it { is_expected.to run.with_params("decode", "YSB2ZXJ5IGxvbmcgc3RyaW5nIHRoYXQgd2lsbCBjYXVzZSB0aGUgYmFzZTY0IGVuY29kZXIgdG8gcHJvZHVjZSBvdXRwdXQgd2l0aCBtdWx0aXBsZSBsaW5lcw==", "strict").and_return("a very long string that will cause the base64 encoder to produce output with multiple lines") } + + it { is_expected.to run.with_params("encode", "https://www.google.com.tw/?gws_rd=ssl#q=hello+world", "urlsafe").and_return("aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS50dy8_Z3dzX3JkPXNzbCNxPWhlbGxvK3dvcmxk") } + it { is_expected.to run.with_params("decode", "aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS50dy8_Z3dzX3JkPXNzbCNxPWhlbGxvK3dvcmxk", "urlsafe").and_return("https://www.google.com.tw/?gws_rd=ssl#q=hello+world") } + + it { is_expected.to run.with_params("encode", "https://github.com/puppetlabs/puppetlabs-stdlib/pulls?utf8=%E2%9C%93&q=is%3Apr+is%3Aopen+Add", "urlsafe").and_return("aHR0cHM6Ly9naXRodWIuY29tL3B1cHBldGxhYnMvcHVwcGV0bGFicy1zdGRsaWIvcHVsbHM_dXRmOD0lRTIlOUMlOTMmcT1pcyUzQXByK2lzJTNBb3BlbitBZGQ=") } + it { is_expected.to run.with_params("decode", "aHR0cHM6Ly9naXRodWIuY29tL3B1cHBldGxhYnMvcHVwcGV0bGFicy1zdGRsaWIvcHVsbHM_dXRmOD0lRTIlOUMlOTMmcT1pcyUzQXByK2lzJTNBb3BlbitBZGQ=", "urlsafe").and_return("https://github.com/puppetlabs/puppetlabs-stdlib/pulls?utf8=%E2%9C%93&q=is%3Apr+is%3Aopen+Add") } +end diff --git a/environments/production/modules/stdlib/spec/functions/basename_spec.rb b/environments/production/modules/stdlib/spec/functions/basename_spec.rb new file mode 100755 index 0000000..3e02b01 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/basename_spec.rb @@ -0,0 +1,19 @@ +require 'spec_helper' + +describe 'basename' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two', 'three').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('/path/to/a/file.ext', []).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('/path/to/a/file.ext').and_return('file.ext') } + it { is_expected.to run.with_params('relative_path/to/a/file.ext').and_return('file.ext') } + it { is_expected.to run.with_params('/path/to/a/file.ext', '.ext').and_return('file') } + it { is_expected.to run.with_params('relative_path/to/a/file.ext', '.ext').and_return('file') } + it { is_expected.to run.with_params('scheme:///path/to/a/file.ext').and_return('file.ext') } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('scheme:///√ạĺűē/竹.ext').and_return('竹.ext') } + it { is_expected.to run.with_params('ҝẽγ:/√ạĺűē/竹.ㄘ', '.ㄘ').and_return('竹') } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/bool2num_spec.rb b/environments/production/modules/stdlib/spec/functions/bool2num_spec.rb new file mode 100755 index 0000000..e506859 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/bool2num_spec.rb @@ -0,0 +1,14 @@ +require 'spec_helper' + +describe 'bool2num' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + + [ true, 'true', AlsoString.new('true') ].each do |truthy| + it { is_expected.to run.with_params(truthy).and_return(1) } + end + + [ false, 'false', AlsoString.new('false') ].each do |falsey| + it { is_expected.to run.with_params(falsey).and_return(0) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/bool2str_spec.rb b/environments/production/modules/stdlib/spec/functions/bool2str_spec.rb new file mode 100755 index 0000000..23a754b --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/bool2str_spec.rb @@ -0,0 +1,17 @@ +require 'spec_helper' + +describe 'bool2str' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + [ 'true', 'false', nil, :undef, ''].each do |invalid| + it { is_expected.to run.with_params(invalid).and_raise_error(Puppet::ParseError) } + end + it { is_expected.to run.with_params(true, 'yes', 'no', 'maybe').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(true, 'maybe').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(true, 0, 1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(true).and_return("true") } + it { is_expected.to run.with_params(false).and_return("false") } + it { is_expected.to run.with_params(true, 'yes', 'no').and_return("yes") } + it { is_expected.to run.with_params(false, 'yes', 'no').and_return("no") } + +end diff --git a/environments/production/modules/stdlib/spec/functions/camelcase_spec.rb b/environments/production/modules/stdlib/spec/functions/camelcase_spec.rb new file mode 100755 index 0000000..c78aa62 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/camelcase_spec.rb @@ -0,0 +1,17 @@ +require 'spec_helper' + +describe 'camelcase' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(100).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("abc").and_return("Abc") } + it { is_expected.to run.with_params("aa_bb_cc").and_return("AaBbCc") } + it { is_expected.to run.with_params("_aa__bb__cc_").and_return("AaBbCc") } + it { is_expected.to run.with_params("100").and_return("100") } + it { is_expected.to run.with_params("1_00").and_return("100") } + it { is_expected.to run.with_params("_").and_return("") } + it { is_expected.to run.with_params("").and_return("") } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(["abc", "aa_bb_cc"]).and_return(["Abc", "AaBbCc"]) } + it { is_expected.to run.with_params(["abc", 1, "aa_bb_cc"]).and_return(["Abc", 1, "AaBbCc"]) } +end diff --git a/environments/production/modules/stdlib/spec/functions/capitalize_spec.rb b/environments/production/modules/stdlib/spec/functions/capitalize_spec.rb new file mode 100755 index 0000000..7ce2e16 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/capitalize_spec.rb @@ -0,0 +1,15 @@ +require 'spec_helper' + +describe 'capitalize' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(100).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("one").and_return("One") } + it { is_expected.to run.with_params("one two").and_return("One two") } + it { is_expected.to run.with_params("ONE TWO").and_return("One two") } + + it { is_expected.to run.with_params(AlsoString.new("one")).and_return("One") } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(["one", "two"]).and_return(["One", "Two"]) } + it { is_expected.to run.with_params(["one", 1, "two"]).and_return(["One", 1, "Two"]) } +end diff --git a/environments/production/modules/stdlib/spec/functions/ceiling_spec.rb b/environments/production/modules/stdlib/spec/functions/ceiling_spec.rb new file mode 100755 index 0000000..567426f --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/ceiling_spec.rb @@ -0,0 +1,13 @@ +require 'spec_helper' + +describe 'ceiling' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("foo").and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(34).and_return(34) } + it { is_expected.to run.with_params(-34).and_return(-34) } + it { is_expected.to run.with_params(33.1).and_return(34) } + it { is_expected.to run.with_params(-33.1).and_return(-33) } +end + diff --git a/environments/production/modules/stdlib/spec/functions/chomp_spec.rb b/environments/production/modules/stdlib/spec/functions/chomp_spec.rb new file mode 100755 index 0000000..56bd9b1 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/chomp_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' + +describe 'chomp' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params("a", "b").and_raise_error(Puppet::ParseError) + } + it { is_expected.to run.with_params("one").and_return("one") } + it { is_expected.to run.with_params("one\n").and_return("one") } + it { is_expected.to run.with_params("one\n\n").and_return("one\n") } + it { is_expected.to run.with_params(["one\n", "two", "three\n"]).and_return(["one", "two", "three"]) } + + it { is_expected.to run.with_params(AlsoString.new("one")).and_return("one") } + it { is_expected.to run.with_params(AlsoString.new("one\n")).and_return("one") } + it { is_expected.to run.with_params(AlsoString.new("one\n\n")).and_return("one\n") } + it { is_expected.to run.with_params([AlsoString.new("one\n"), AlsoString.new("two"), "three\n"]).and_return(["one", "two", "three"]) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params("ůťƒ8\n\n").and_return("ůťƒ8\n") } + it { is_expected.to run.with_params("ネット\n\n").and_return("ネット\n") } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/chop_spec.rb b/environments/production/modules/stdlib/spec/functions/chop_spec.rb new file mode 100755 index 0000000..b70fc37 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/chop_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' + +describe 'chop' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params("a", "b").and_raise_error(Puppet::ParseError) + } + it { is_expected.to run.with_params("one").and_return("on") } + it { is_expected.to run.with_params("one\n").and_return("one") } + it { is_expected.to run.with_params("one\n\n").and_return("one\n") } + it { is_expected.to run.with_params(["one\n", "two", "three\n"]).and_return(["one", "tw", "three"]) } + + it { is_expected.to run.with_params(AlsoString.new("one")).and_return("on") } + it { is_expected.to run.with_params(AlsoString.new("one\n")).and_return("one") } + it { is_expected.to run.with_params(AlsoString.new("one\n\n")).and_return("one\n") } + it { is_expected.to run.with_params([AlsoString.new("one\n"), AlsoString.new("two"), "three\n"]).and_return(["one", "tw", "three"]) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params("ůťƒ8\n\n").and_return("ůťƒ8\n") } + it { is_expected.to run.with_params("ネット\n\n").and_return("ネット\n") } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/clamp_spec.rb b/environments/production/modules/stdlib/spec/functions/clamp_spec.rb new file mode 100644 index 0000000..3e2fe7a --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/clamp_spec.rb @@ -0,0 +1,16 @@ +require 'spec_helper' + +describe 'clamp' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(12, 88, 71, 190).and_raise_error(Puppet::ParseError, /Wrong number of arguments, need three to clamp/) } + it { is_expected.to run.with_params('12string', 88, 15).and_raise_error(Puppet::ParseError, /Required explicit numeric/) } + it { is_expected.to run.with_params(1, 2, {'a' => 55}).and_raise_error(Puppet::ParseError, /The Hash type is not allowed/) } + it { is_expected.to run.with_params('24', [575, 187]).and_return(187) } + it { is_expected.to run.with_params([4, 3, '99']).and_return(4) } + it { is_expected.to run.with_params(16, 750, 88).and_return(88) } + it { is_expected.to run.with_params([3, 873], 73).and_return(73) } + it { is_expected.to run.with_params([4], 8, 75).and_return(8) } + it { is_expected.to run.with_params([6], [31], 9911).and_return(31) } +end diff --git a/environments/production/modules/stdlib/spec/functions/concat_spec.rb b/environments/production/modules/stdlib/spec/functions/concat_spec.rb new file mode 100755 index 0000000..6ab1b6e --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/concat_spec.rb @@ -0,0 +1,29 @@ +require 'spec_helper' + +describe 'concat' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([1]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1, [2]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([1], [2], [3]).and_return([1, 2, 3]) } + it { is_expected.to run.with_params(['1','2','3'],['4','5','6']).and_return(['1','2','3','4','5','6']) } + it { is_expected.to run.with_params(['1','2','3'],'4').and_return(['1','2','3','4']) } + it { is_expected.to run.with_params(['1','2','3'],[['4','5'],'6']).and_return(['1','2','3',['4','5'],'6']) } + it { is_expected.to run.with_params(['1','2'],['3','4'],['5','6']).and_return(['1','2','3','4','5','6']) } + it { is_expected.to run.with_params(['1','2'],'3','4',['5','6']).and_return(['1','2','3','4','5','6']) } + +context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params([{"a" => "b"}], {"c" => "d", "e" => "f"}).and_return([{"a" => "b"}, {"c" => "d", "e" => "f"}]) } + it { is_expected.to run.with_params(['ấ','β','©'],['đ','ể','文字列']).and_return(['ấ','β','©','đ','ể','文字列']) } +end + + it "should leave the original array intact" do + argument1 = ['1','2','3'] + original1 = argument1.dup + argument2 = ['4','5','6'] + original2 = argument2.dup + result = subject.call([argument1,argument2]) + expect(argument1).to eq(original1) + expect(argument2).to eq(original2) + end +end diff --git a/environments/production/modules/stdlib/spec/functions/convert_base_spec.rb b/environments/production/modules/stdlib/spec/functions/convert_base_spec.rb new file mode 100644 index 0000000..8ab2284 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/convert_base_spec.rb @@ -0,0 +1,24 @@ +require 'spec_helper' + +describe 'convert_base' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { is_expected.to run.with_params("asdf").and_raise_error(ArgumentError) } + it { is_expected.to run.with_params("asdf","moo","cow").and_raise_error(ArgumentError) } + it { is_expected.to run.with_params(["1"],"2").and_raise_error(Puppet::ParseError, /argument must be either a string or an integer/) } + it { is_expected.to run.with_params("1",["2"]).and_raise_error(Puppet::ParseError, /argument must be either a string or an integer/) } + it { is_expected.to run.with_params("1",1).and_raise_error(Puppet::ParseError, /base must be at least 2 and must not be greater than 36/) } + it { is_expected.to run.with_params("1",37).and_raise_error(Puppet::ParseError, /base must be at least 2 and must not be greater than 36/) } + + it "should raise a ParseError if argument 1 is a string that does not correspond to an integer in base 10" do + is_expected.to run.with_params("ten",6).and_raise_error(Puppet::ParseError, /argument must be an integer or a string corresponding to an integer in base 10/) + end + + it "should raise a ParseError if argument 2 is a string and does not correspond to an integer in base 10" do + is_expected.to run.with_params(100,"hex").and_raise_error(Puppet::ParseError, /argument must be an integer or a string corresponding to an integer in base 10/) + end + + it { is_expected.to run.with_params("11",'16').and_return('b') } + it { is_expected.to run.with_params("35",'36').and_return('z') } + it { is_expected.to run.with_params(5, 2).and_return('101') } +end diff --git a/environments/production/modules/stdlib/spec/functions/count_spec.rb b/environments/production/modules/stdlib/spec/functions/count_spec.rb new file mode 100755 index 0000000..3854cb8 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/count_spec.rb @@ -0,0 +1,23 @@ +require 'spec_helper' + +describe 'count' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { is_expected.to run.with_params("one").and_raise_error(ArgumentError) } + it { is_expected.to run.with_params("one", "two").and_return(1) } + it { + pending("should actually be like this, and not like above") + is_expected.to run.with_params("one", "two").and_raise_error(ArgumentError) + } + it { is_expected.to run.with_params("one", "two", "three").and_raise_error(ArgumentError) } + it { is_expected.to run.with_params(["one", "two", "three"]).and_return(3) } + it { is_expected.to run.with_params(["one", "two", "two"], "two").and_return(2) } + it { is_expected.to run.with_params(["one", nil, "two"]).and_return(2) } + it { is_expected.to run.with_params(["one", "", "two"]).and_return(2) } + it { is_expected.to run.with_params(["one", :undef, "two"]).and_return(2) } + + it { is_expected.to run.with_params(["ổņ℮", "ŧщộ", "three"]).and_return(3) } + it { is_expected.to run.with_params(["ổņ℮", "ŧщộ", "ŧщộ"], "ŧщộ").and_return(2) } + it { is_expected.to run.with_params(["ổņ℮", nil, "ŧщộ"]).and_return(2) } + it { is_expected.to run.with_params(["ổņ℮", :undef, "ŧщộ"]).and_return(2) } +end diff --git a/environments/production/modules/stdlib/spec/functions/deep_merge_spec.rb b/environments/production/modules/stdlib/spec/functions/deep_merge_spec.rb new file mode 100755 index 0000000..c91a07e --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/deep_merge_spec.rb @@ -0,0 +1,59 @@ +require 'spec_helper' + +describe 'deep_merge' do + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params({ 'key' => 'value' }).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params({}, '2').and_raise_error(Puppet::ParseError, /unexpected argument type String/) } + it { is_expected.to run.with_params({}, 2).and_raise_error(Puppet::ParseError, /unexpected argument type Fixnum/) } + it { is_expected.to run.with_params({}, '').and_return({}) } + it { is_expected.to run.with_params({}, {}).and_return({}) } + it { is_expected.to run.with_params({}, {}, {}).and_return({}) } + it { is_expected.to run.with_params({}, {}, {}, {}).and_return({}) } + it { is_expected.to run.with_params({'key' => 'value'}, '').and_return({'key' => 'value'}) } + it { is_expected.to run.with_params({'key1' => 'value1'}, {'key2' => 'value2' }).and_return({'key1' => 'value1', 'key2' => 'value2'}) } + + describe 'when arguments have key collisions' do + it 'should prefer values from the last hash' do + is_expected.to run \ + .with_params( + {'key1' => 'value1', 'key2' => 'value2' }, + {'key2' => 'replacement_value', 'key3' => 'value3'}) \ + .and_return( + {'key1' => 'value1', 'key2' => 'replacement_value', 'key3' => 'value3'}) + end + it { is_expected.to run \ + .with_params({'key1' => 'value1'}, {'key1' => 'value2'}, {'key1' => 'value3'}) \ + .and_return({'key1' => 'value3' }) + } + end + + describe 'when arguments have subhashes' do + it { is_expected.to run \ + .with_params({'key1' => 'value1'}, {'key2' => 'value2', 'key3' => {'subkey1' => 'value4'}}) \ + .and_return( {'key1' => 'value1', 'key2' => 'value2', 'key3' => {'subkey1' => 'value4'}}) + } + it { is_expected.to run \ + .with_params({'key1' => {'subkey1' => 'value1'}}, {'key1' => {'subkey2' => 'value2'}}) \ + .and_return( {'key1' => {'subkey1' => 'value1', 'subkey2' => 'value2'}}) + } + it { is_expected.to run \ + .with_params({'key1' => {'subkey1' => {'subsubkey1' => 'value1'}}}, {'key1' => {'subkey1' => {'subsubkey1' => 'value2'}}}) \ + .and_return( {'key1' => {'subkey1' => {'subsubkey1' => 'value2'}}}) + } + end + + it 'should not change the original hashes' do + argument1 = { 'key1' => 'value1' } + original1 = argument1.dup + argument2 = { 'key2' => 'value2' } + original2 = argument2.dup + + subject.call([argument1, argument2]) + expect(argument1).to eq(original1) + expect(argument2).to eq(original2) + end + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params({'ĸέỹ1' => 'ϋǻļủë1'}, {'この文字列' => '万' }).and_return({'ĸέỹ1' => 'ϋǻļủë1', 'この文字列' => '万'}) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/defined_with_params_spec.rb b/environments/production/modules/stdlib/spec/functions/defined_with_params_spec.rb new file mode 100755 index 0000000..a0db0b7 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/defined_with_params_spec.rb @@ -0,0 +1,40 @@ +require 'spec_helper' + +describe 'defined_with_params' do + describe 'when no resource is specified' do + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + end + describe 'when compared against a resource with no attributes' do + let :pre_condition do + 'user { "dan": }' + end + it { is_expected.to run.with_params('User[dan]', {}).and_return(true) } + it { is_expected.to run.with_params('User[bob]', {}).and_return(false) } + it { is_expected.to run.with_params('User[dan]', {'foo' => 'bar'}).and_return(false) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('User[ĵĭмოү]', {}).and_return(false) } + it { is_expected.to run.with_params('User[ポーラ]', {}).and_return(false) } + end + end + + describe 'when compared against a resource with attributes' do + let :pre_condition do + 'user { "dan": ensure => present, shell => "/bin/csh", managehome => false}' + end + it { is_expected.to run.with_params('User[dan]', {}).and_return(true) } + it { is_expected.to run.with_params('User[dan]', '').and_return(true) } + it { is_expected.to run.with_params('User[dan]', {'ensure' => 'present'}).and_return(true) } + it { is_expected.to run.with_params('User[dan]', {'ensure' => 'present', 'managehome' => false}).and_return(true) } + it { is_expected.to run.with_params('User[dan]', {'ensure' => 'absent', 'managehome' => false}).and_return(false) } + end + + describe 'when passing undef values' do + let :pre_condition do + 'file { "/tmp/a": ensure => present }' + end + + it { is_expected.to run.with_params('File[/tmp/a]', {}).and_return(true) } + it { is_expected.to run.with_params('File[/tmp/a]', { 'ensure' => 'present', 'owner' => :undef }).and_return(true) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/delete_at_spec.rb b/environments/production/modules/stdlib/spec/functions/delete_at_spec.rb new file mode 100755 index 0000000..0471039 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/delete_at_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper' + +describe 'delete_at' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1, 1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(['one'], 'two').and_raise_error(Puppet::ParseError) } + it { + pending("Current implementation ignores parameters after the first two.") + is_expected.to run.with_params(['one'], 0, 1).and_raise_error(Puppet::ParseError) + } + + describe 'argument validation' do + it { is_expected.to run.with_params([0, 1, 2], 3).and_raise_error(Puppet::ParseError) } + end + + it { is_expected.to run.with_params([0, 1, 2], 1).and_return([0, 2]) } + it { is_expected.to run.with_params([0, 1, 2], -1).and_return([0, 1]) } + it { is_expected.to run.with_params([0, 1, 2], -4).and_return([0, 1, 2]) } + it { is_expected.to run.with_params(["ƒờở", "βāř", "ьầż"], 1).and_return(["ƒờở", "ьầż"]) } + + + it "should leave the original array intact" do + argument = [1, 2, 3] + original = argument.dup + result = subject.call([argument,2]) + expect(argument).to eq(original) + end +end diff --git a/environments/production/modules/stdlib/spec/functions/delete_regex_spec.rb b/environments/production/modules/stdlib/spec/functions/delete_regex_spec.rb new file mode 100755 index 0000000..f27a946 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/delete_regex_spec.rb @@ -0,0 +1,54 @@ +require 'spec_helper' + +describe 'delete_regex' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], 'two') } + it { is_expected.to run.with_params({}, 'two') } + it { is_expected.to run.with_params([], 'two', 'three').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], 'two', 'three', 'four').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1, 'two').and_raise_error(TypeError) } + + describe 'deleting from an array' do + it { is_expected.to run.with_params([], '').and_return([]) } + it { is_expected.to run.with_params([], 'two').and_return([]) } + it { is_expected.to run.with_params(['two'], 'two').and_return([]) } + it { is_expected.to run.with_params(['two', 'two'], 'two').and_return([]) } + it { is_expected.to run.with_params(['one', 'two', 'three'], '^t.*').and_return(['one']) } + it { is_expected.to run.with_params(['ab', 'b', 'c', 'b'], 'b').and_return(['ab', 'c']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'four').and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'e').and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'two').and_return(['one', 'three']) } + it { is_expected.to run.with_params(['two', 'one', 'two', 'three', 'two'], 'two').and_return(['one', 'three']) } + it { is_expected.to run.with_params(['abracadabra'], 'abr').and_return(['abracadabra']) } + it { is_expected.to run.with_params(['abracadabra'], '^.*jimbob.*$').and_return(['abracadabra']) } + end + + describe 'deleting from an array' do + it { is_expected.to run.with_params({}, '').and_return({}) } + it { is_expected.to run.with_params({}, 'key').and_return({}) } + it { is_expected.to run.with_params({'key' => 'value'}, 'key').and_return({}) } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3'}, 'key2') \ + .and_return( {'key1' => 'value1', 'key3' => 'value3'}) + } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3'}, ['key1', 'key2']) \ + .and_return( {'key3' => 'value3'}) + } + end + + it "should leave the original array intact" do + argument1 = ['one','two','three'] + original1 = argument1.dup + subject.call([argument1,'two']) + expect(argument1).to eq(original1) + end + it "should leave the original hash intact" do + argument1 = {'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3'} + original1 = argument1.dup + subject.call([argument1,'key2']) + expect(argument1).to eq(original1) + end +end diff --git a/environments/production/modules/stdlib/spec/functions/delete_spec.rb b/environments/production/modules/stdlib/spec/functions/delete_spec.rb new file mode 100755 index 0000000..4e37865 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/delete_spec.rb @@ -0,0 +1,76 @@ +require 'spec_helper' + +describe 'delete' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], 'two') } + it { is_expected.to run.with_params([], 'two', 'three').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1, 'two').and_raise_error(TypeError) } + + describe 'deleting from an array' do + it { is_expected.to run.with_params([], '').and_return([]) } + it { is_expected.to run.with_params([], 'two').and_return([]) } + it { is_expected.to run.with_params(['two'], 'two').and_return([]) } + it { is_expected.to run.with_params(['two', 'two'], 'two').and_return([]) } + it { is_expected.to run.with_params(['ab', 'b', 'c', 'b'], 'b').and_return(['ab', 'c']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'four').and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'e').and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'two').and_return(['one', 'three']) } + it { is_expected.to run.with_params(['two', 'one', 'two', 'three', 'two'], 'two').and_return(['one', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'two'], ['one', 'two']).and_return(['three']) } + it { is_expected.to run.with_params(['ồאּẻ', 'ŧẅơ', 'ŧңŗё℮', 'ŧẅơ'], ['ồאּẻ', 'ŧẅơ']).and_return(['ŧңŗё℮']) } + end + + describe 'deleting from a string' do + it { is_expected.to run.with_params('', '').and_return('') } + it { is_expected.to run.with_params('bar', '').and_return('bar') } + it { is_expected.to run.with_params('', 'bar').and_return('') } + it { is_expected.to run.with_params('bar', 'bar').and_return('') } + it { is_expected.to run.with_params('barbar', 'bar').and_return('') } + it { is_expected.to run.with_params('barfoobar', 'bar').and_return('foo') } + it { is_expected.to run.with_params('foobarbabarz', 'bar').and_return('foobaz') } + it { is_expected.to run.with_params('foobarbabarz', ['foo', 'bar']).and_return('baz') } + it { is_expected.to run.with_params('ƒōōβậяβậβậяź', ['ƒōō', 'βậя']).and_return('βậź') } + + it { is_expected.to run.with_params('barfoobar', ['barbar', 'foo']).and_return('barbar') } + it { is_expected.to run.with_params('barfoobar', ['foo', 'barbar']).and_return('') } + end + + describe 'deleting from an array' do + it { is_expected.to run.with_params({}, '').and_return({}) } + it { is_expected.to run.with_params({}, 'key').and_return({}) } + it { is_expected.to run.with_params({'key' => 'value'}, 'key').and_return({}) } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3'}, 'key2') \ + .and_return( {'key1' => 'value1', 'key3' => 'value3'}) + } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3'}, ['key1', 'key2']) \ + .and_return( {'key3' => 'value3'}) + } + it { is_expected.to run \ + .with_params({'ĸəұ1' => 'νãŀủĕ1', 'ĸəұ2' => 'νãŀủĕ2', 'ĸəұ3' => 'νãŀủĕ3'}, ['ĸəұ1', 'ĸəұ2']) \ + .and_return( {'ĸəұ3' => 'νãŀủĕ3'}) + } + end + + it "should leave the original array intact" do + argument1 = ['one','two','three'] + original1 = argument1.dup + result = subject.call([argument1,'two']) + expect(argument1).to eq(original1) + end + it "should leave the original string intact" do + argument1 = 'onetwothree' + original1 = argument1.dup + result = subject.call([argument1,'two']) + expect(argument1).to eq(original1) + end + it "should leave the original hash intact" do + argument1 = {'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3'} + original1 = argument1.dup + result = subject.call([argument1,'key2']) + expect(argument1).to eq(original1) + end +end diff --git a/environments/production/modules/stdlib/spec/functions/delete_undef_values_spec.rb b/environments/production/modules/stdlib/spec/functions/delete_undef_values_spec.rb new file mode 100755 index 0000000..c20cee2 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/delete_undef_values_spec.rb @@ -0,0 +1,57 @@ +require 'spec_helper' + +describe 'delete_undef_values' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError) } + + describe 'when deleting from an array' do + [ :undef, '', nil ].each do |undef_value| + describe "when undef is represented by #{undef_value.inspect}" do + before do + pending("review behaviour when being passed undef as #{undef_value.inspect}") if undef_value == '' + pending("review behaviour when being passed undef as #{undef_value.inspect}") if undef_value == nil + end + it { is_expected.to run.with_params([undef_value]).and_return([]) } + it { is_expected.to run.with_params(['one',undef_value,'two','three']).and_return(['one','two','three']) } + it { is_expected.to run.with_params(['ớņέ',undef_value,'ŧשּׁō','ŧħґëə']).and_return(['ớņέ','ŧשּׁō','ŧħґëə']) } + end + + it "should leave the original argument intact" do + argument = ['one',undef_value,'two'] + original = argument.dup + result = subject.call([argument,2]) + expect(argument).to eq(original) + end + end + + it { is_expected.to run.with_params(['undef']).and_return(['undef']) } + end + + describe 'when deleting from a hash' do + [ :undef, '', nil ].each do |undef_value| + describe "when undef is represented by #{undef_value.inspect}" do + before do + pending("review behaviour when being passed undef as #{undef_value.inspect}") if undef_value == '' + pending("review behaviour when being passed undef as #{undef_value.inspect}") if undef_value == nil + end + it { is_expected.to run.with_params({'key' => undef_value}).and_return({}) } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'undef_key' => undef_value, 'key2' => 'value2'}) \ + .and_return({'key1' => 'value1', 'key2' => 'value2'}) + } + end + + it "should leave the original argument intact" do + argument = { 'key1' => 'value1', 'key2' => undef_value } + original = argument.dup + result = subject.call([argument,2]) + expect(argument).to eq(original) + end + end + + it { is_expected.to run.with_params({'key' => 'undef'}).and_return({'key' => 'undef'}) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/delete_values_spec.rb b/environments/production/modules/stdlib/spec/functions/delete_values_spec.rb new file mode 100755 index 0000000..329fa0b --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/delete_values_spec.rb @@ -0,0 +1,41 @@ +require 'spec_helper' + +describe 'delete_values' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two', 'three').and_raise_error(Puppet::ParseError) } + describe 'when the first argument is not a hash' do + it { is_expected.to run.with_params(1, 'two').and_raise_error(TypeError) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(TypeError) } + it { is_expected.to run.with_params([], 'two').and_raise_error(TypeError) } + end + + describe 'when deleting from a hash' do + it { is_expected.to run.with_params({}, 'value').and_return({}) } + it { is_expected.to run \ + .with_params({'key1' => 'value1'}, 'non-existing value') \ + .and_return({'key1' => 'value1'}) + } + it { is_expected.to run \ + .with_params({'ҝếỵ1 ' => 'νâĺūẹ1', 'ҝếỵ2' => 'value to delete'}, 'value to delete') \ + .and_return({'ҝếỵ1 ' => 'νâĺūẹ1'}) + } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'key2' => 'νǎŀữ℮ ťớ đêłểťė'}, 'νǎŀữ℮ ťớ đêłểťė') \ + .and_return({'key1' => 'value1'}) + } + it { is_expected.to run \ + .with_params({'key1' => 'value1', 'key2' => 'value to delete', 'key3' => 'value to delete'}, 'value to delete') \ + .and_return({'key1' => 'value1'}) + } + end + + it "should leave the original argument intact" do + argument = { 'key1' => 'value1', 'key2' => 'value2' } + original = argument.dup + result = subject.call([argument, 'value2']) + expect(argument).to eq(original) + end +end diff --git a/environments/production/modules/stdlib/spec/functions/deprecation_spec.rb b/environments/production/modules/stdlib/spec/functions/deprecation_spec.rb new file mode 100644 index 0000000..bde4e89 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/deprecation_spec.rb @@ -0,0 +1,60 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.5.0') >= 0 + describe 'deprecation' do + before(:each) { + # this is to reset the strict variable to default + Puppet.settings[:strict] = :warning + } + + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + + it 'should display a single warning' do + Puppet.expects(:warning).with(includes('heelo')) + is_expected.to run.with_params('key', 'heelo') + end + + it 'should display a single warning, despite multiple calls' do + Puppet.expects(:warning).with(includes('heelo')).once + is_expected.to run.with_params('key', 'heelo') + is_expected.to run.with_params('key', 'heelo') + end + + it 'should fail twice with message, with multiple calls. when strict= :error' do + Puppet.settings[:strict] = :error + Puppet.expects(:warning).with(includes('heelo')).never + is_expected.to run.with_params('key', 'heelo').and_raise_error(RuntimeError, /deprecation. key. heelo/) + is_expected.to run.with_params('key', 'heelo').and_raise_error(RuntimeError, /deprecation. key. heelo/) + end + + it 'should display nothing, despite multiple calls. strict= :off' do + Puppet.settings[:strict] = :off + Puppet.expects(:warning).with(includes('heelo')).never + is_expected.to run.with_params('key', 'heelo') + is_expected.to run.with_params('key', 'heelo') + end + + after(:all) { + # this is to reset the strict variable to default + Puppet.settings[:strict] = :warning + } + end +elsif Puppet.version.to_f < 4.0 + # Puppet version < 4 will use these tests. + describe 'deprecation' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + before(:all) do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + end + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + it 'should display a single warning' do + scope.expects(:warning).with(includes('heelo')) + is_expected.to run.with_params('key', 'heelo') + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/difference_spec.rb b/environments/production/modules/stdlib/spec/functions/difference_spec.rb new file mode 100755 index 0000000..0ae3689 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/difference_spec.rb @@ -0,0 +1,23 @@ +require 'spec_helper' + +describe 'difference' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two', 'three').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', []).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], 'two').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params({}, {}).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], []).and_return([]) } + it { is_expected.to run.with_params([], ['one']).and_return([]) } + it { is_expected.to run.with_params(['one'], ['one']).and_return([]) } + it { is_expected.to run.with_params(['ớņέ'], ['']).and_return(['ớņέ']) } + it { is_expected.to run.with_params(['one'], []).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'three']).and_return(['one']) } + it { is_expected.to run.with_params(['ớņέ', 'ŧשּׁō', 'ŧħґëə', 2], ['ŧשּׁō', 'ŧħґëə']).and_return(['ớņέ', 2]) } + it { is_expected.to run.with_params(['one', 'two', 'two', 'three'], ['two', 'three']).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'two', 'three']).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'three', 'four']).and_return(['one']) } + it 'should not confuse types' do is_expected.to run.with_params(['1', '2', '3'], [1, 2]).and_return(['1', '2', '3']) end +end diff --git a/environments/production/modules/stdlib/spec/functions/dig44_spec.rb b/environments/production/modules/stdlib/spec/functions/dig44_spec.rb new file mode 100644 index 0000000..a7b8a3d --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/dig44_spec.rb @@ -0,0 +1,131 @@ +require 'spec_helper' + +describe 'dig44' do + + let(:data) do + { + 'a' => { + 'g' => '2', + 'e' => [ + 'f0', + 'f1', + { + 'x' => { + 'y' => 'z' + } + }, + 'f3', + ] + }, + 'b' => true, + 'c' => false, + 'd' => '1', + 'e' => :undef, + 'f' => nil, + } + end + + let(:utf8_data) do + { + 'ẵ' => { + 'в' => [ + '©', + 'ĝ', + 'に', + ] + } + } + end + + context 'single values' do + it 'should exist' do + is_expected.not_to be_nil + end + + it 'should require two arguments' do + is_expected.to run.with_params().and_raise_error(ArgumentError) + end + + it 'should fail if the data is not a structure' do + is_expected.to run.with_params('test', []).and_raise_error(Puppet::Error) + end + + it 'should fail if the path is not an array' do + is_expected.to run.with_params({}, '').and_raise_error(Puppet::Error) + end + + it 'should return the value if the value is string' do + is_expected.to run.with_params(data, ['d'], 'default').and_return('1') + end + + it 'should return true if the value is true' do + is_expected.to run.with_params(data, ['b'], 'default').and_return(true) + end + + it 'should return false if the value is false' do + is_expected.to run.with_params(data, ['c'], 'default').and_return(false) + end + + it 'should return the default if the value is nil' do + is_expected.to run.with_params(data, ['f'], 'default').and_return('default') + end + + it 'should return the default if the value is :undef (same as nil)' do + is_expected.to run.with_params(data, ['e'], 'default').and_return('default') + end + + it 'should return the default if the path is not found' do + is_expected.to run.with_params(data, ['missing'], 'default').and_return('default') + end + end + + context 'structure values' do + + it 'should be able to extract a deeply nested hash value' do + is_expected.to run.with_params(data, %w(a g), 'default').and_return('2') + end + + it 'should return the default value if the path is too long' do + is_expected.to run.with_params(data, %w(a g c d), 'default').and_return('default') + end + + it 'should support an array index (number) in the path' do + is_expected.to run.with_params(data, ['a', 'e', 1], 'default').and_return('f1') + end + + it 'should support an array index (string) in the path' do + is_expected.to run.with_params(data, %w(a e 1), 'default').and_return('f1') + end + + it 'should return the default value if an array index is not a number' do + is_expected.to run.with_params(data, %w(a b c), 'default').and_return('default') + end + + it 'should return the default value if and index is out of array length' do + is_expected.to run.with_params(data, %w(a e 5), 'default').and_return('default') + end + + it 'should be able to path though both arrays and hashes' do + is_expected.to run.with_params(data, %w(a e 2 x y), 'default').and_return('z') + end + + it 'should return "nil" if value is not found and no default value is provided' do + is_expected.to run.with_params(data, %w(a 1)).and_return(nil) + end + end + + context 'Internationalization (i18N) values' do + + it 'should be able to return a unicode character' do + is_expected.to run.with_params(utf8_data, ['ẵ', 'в', 0]).and_return('©') + end + + it 'should be able to return a utf8 character' do + is_expected.to run.with_params(utf8_data, ['ẵ', 'в', 1]).and_return('ĝ') + end + + it 'should be able to return a double byte character' do + is_expected.to run.with_params(utf8_data, ['ẵ', 'в', 2]).and_return('に') + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/dig_spec.rb b/environments/production/modules/stdlib/spec/functions/dig_spec.rb new file mode 100644 index 0000000..ad16fdd --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/dig_spec.rb @@ -0,0 +1,13 @@ +require 'spec_helper' + +describe 'dig' do + + it "should exist" do + expect(Puppet::Parser::Functions.function("dig")).to eq("function_dig") + end + + it "should give a deprecation warning when called" do + scope.expects(:warning).with("dig() DEPRECATED: This function has been replaced in Puppet 4.5.0, please use dig44() for backwards compatibility or use the new version.") + scope.function_dig([{}, []]) + end +end diff --git a/environments/production/modules/stdlib/spec/functions/dirname_spec.rb b/environments/production/modules/stdlib/spec/functions/dirname_spec.rb new file mode 100755 index 0000000..c494915 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/dirname_spec.rb @@ -0,0 +1,18 @@ +require 'spec_helper' + +describe 'dirname' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('/path/to/a/file.ext', []).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('/path/to/a/file.ext').and_return('/path/to/a') } + it { is_expected.to run.with_params('relative_path/to/a/file.ext').and_return('relative_path/to/a') } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('scheme:///√ạĺűē/竹.ext').and_return('scheme:///√ạĺűē') } + it { is_expected.to run.with_params('ҝẽγ:/√ạĺűē/竹.ㄘ').and_return('ҝẽγ:/√ạĺűē') } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/dos2unix_spec.rb b/environments/production/modules/stdlib/spec/functions/dos2unix_spec.rb new file mode 100644 index 0000000..97abae7 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/dos2unix_spec.rb @@ -0,0 +1,47 @@ +require 'spec_helper' + +describe 'dos2unix' do + context 'Checking parameter validity' do + it { is_expected.not_to eq(nil) } + it do + is_expected.to run.with_params.and_raise_error(ArgumentError, /Wrong number of arguments/) + end + it do + is_expected.to run.with_params('one', 'two').and_raise_error(ArgumentError, /Wrong number of arguments/) + end + it do + is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) + end + it do + is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError) + end + it do + is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) + end + end + + context 'Converting from dos to unix format' do + sample_text = "Hello\r\nWorld\r\n" + desired_output = "Hello\nWorld\n" + + it 'should output unix format' do + should run.with_params(sample_text).and_return(desired_output) + end + end + + context 'Internationalization (i18N) values' do + sample_text_utf8 = "Ħ℮ļłǿ\r\nשׁөŕłđ\r\n" + desired_output_utf8 = "Ħ℮ļłǿ\nשׁөŕłđ\n" + + sample_text_doublebyte = "こんにちは\r\n世界\r\n" + desired_output_doublebyte = "こんにちは\n世界\n" + + it 'should output uft8 string' do + should run.with_params(sample_text_utf8).and_return(desired_output_utf8) + end + + it 'should output double byte string' do + should run.with_params(sample_text_doublebyte).and_return(desired_output_doublebyte) + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/downcase_spec.rb b/environments/production/modules/stdlib/spec/functions/downcase_spec.rb new file mode 100755 index 0000000..c594560 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/downcase_spec.rb @@ -0,0 +1,15 @@ +require 'spec_helper' + +describe 'downcase' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(100).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("abc").and_return("abc") } + it { is_expected.to run.with_params("Abc").and_return("abc") } + it { is_expected.to run.with_params("ABC").and_return("abc") } + + it { is_expected.to run.with_params(AlsoString.new("ABC")).and_return("abc") } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(["ONE", "TWO"]).and_return(["one", "two"]) } + it { is_expected.to run.with_params(["One", 1, "Two"]).and_return(["one", 1, "two"]) } +end diff --git a/environments/production/modules/stdlib/spec/functions/empty_spec.rb b/environments/production/modules/stdlib/spec/functions/empty_spec.rb new file mode 100755 index 0000000..a3a25d6 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/empty_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' + +describe 'empty' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError) + } + it { is_expected.to run.with_params(0).and_return(false) } + it { is_expected.to run.with_params('').and_return(true) } + it { is_expected.to run.with_params('one').and_return(false) } + + it { is_expected.to run.with_params(AlsoString.new('')).and_return(true) } + it { is_expected.to run.with_params(AlsoString.new('one')).and_return(false) } + + it { is_expected.to run.with_params([]).and_return(true) } + it { is_expected.to run.with_params(['one']).and_return(false) } + + it { is_expected.to run.with_params({}).and_return(true) } + it { is_expected.to run.with_params({'key' => 'value'}).and_return(false) } +end diff --git a/environments/production/modules/stdlib/spec/functions/ensure_packages_spec.rb b/environments/production/modules/stdlib/spec/functions/ensure_packages_spec.rb new file mode 100755 index 0000000..6f94d72 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/ensure_packages_spec.rb @@ -0,0 +1,51 @@ +require 'spec_helper' + +describe 'ensure_packages' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { + pending("should not accept numbers as arguments") + is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) + } + it { + pending("should not accept numbers as arguments") + is_expected.to run.with_params(["packagename", 1]).and_raise_error(Puppet::ParseError) + } + it { is_expected.to run.with_params("packagename") } + it { is_expected.to run.with_params(["packagename1", "packagename2"]) } + + context 'given a catalog with "package { puppet: ensure => absent }"' do + let(:pre_condition) { 'package { puppet: ensure => absent }' } + + describe 'after running ensure_package("facter")' do + before { subject.call(['facter']) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_package('puppet').with_ensure('absent') } + it { expect(lambda { catalogue }).to contain_package('facter').with_ensure('present') } + end + + describe 'after running ensure_package("facter", { "provider" => "gem" })' do + before { subject.call(['facter', { "provider" => "gem" }]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_package('puppet').with_ensure('absent').without_provider() } + it { expect(lambda { catalogue }).to contain_package('facter').with_ensure('present').with_provider("gem") } + end + end + + context 'given hash of packages' do + before { subject.call([{"foo" => { "provider" => "rpm" }, "bar" => { "provider" => "gem" }}, { "ensure" => "present"}]) } + before { subject.call([{"パッケージ" => { "ensure" => "absent"}}]) } + before { subject.call([{"ρǻ¢κầģẻ" => { "ensure" => "absent"}}]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_package('foo').with({'provider' => 'rpm', 'ensure' => 'present'}) } + it { expect(lambda { catalogue }).to contain_package('bar').with({'provider' => 'gem', 'ensure' => 'present'}) } + + context 'should run with UTF8 and double byte characters' do + it { expect(lambda { catalogue }).to contain_package('パッケージ').with({'ensure' => 'absent'}) } + it { expect(lambda { catalogue }).to contain_package('ρǻ¢κầģẻ').with({'ensure' => 'absent'}) } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/ensure_resource_spec.rb b/environments/production/modules/stdlib/spec/functions/ensure_resource_spec.rb new file mode 100755 index 0000000..5366205 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/ensure_resource_spec.rb @@ -0,0 +1,117 @@ +require 'spec_helper' + +describe 'ensure_resource' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /Must specify a type/) } + it { is_expected.to run.with_params('type').and_raise_error(ArgumentError, /Must specify a title/) } + if Puppet::Util::Package.versioncmp(Puppet.version, '4.6.0') >= 0 + it { is_expected.to run.with_params('type', 'title', {}, 'extras').and_raise_error(ArgumentError) } + else + it { is_expected.to run.with_params('type', 'title', {}, 'extras').and_raise_error(Puppet::ParseError) } + end + + it { + pending("should not accept numbers as arguments") + is_expected.to run.with_params(1,2,3).and_raise_error(Puppet::ParseError) + } + + context 'given an empty catalog' do + describe 'after running ensure_resource("user", "username1", {})' do + before { subject.call(['User', 'username1', {}]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').without_ensure } + end + + describe 'after running ensure_resource("user", "username1", { gid => undef })' do + before { subject.call(['User', 'username1', { 'gid' => :undef }]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').without_ensure } + it { expect(lambda { catalogue }).to contain_user('username1').without_gid } + end + + describe 'after running ensure_resource("user", "username1", { ensure => present, gid => undef })' do + before { subject.call(['User', 'username1', { 'ensure' => 'present', 'gid' => :undef }]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').with_ensure('present') } + it { expect(lambda { catalogue }).to contain_user('username1').without_gid } + end + end + + context 'given a catalog with UTF8 chars' do + describe 'after running ensure_resource("user", "Şắოрŀễ Ţëם", {})' do + before { subject.call(['User', 'Şắოрŀễ Ţëם', {}]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('Şắოрŀễ Ţëם').without_ensure } + end + + describe 'after running ensure_resource("user", "Şắოрŀễ Ţëם", { gid => undef })' do + before { subject.call(['User', 'Şắოрŀễ Ţëם', { 'gid' => :undef }]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('Şắოрŀễ Ţëם').without_ensure } + it { expect(lambda { catalogue }).to contain_user('Şắოрŀễ Ţëם').without_gid } + end + + describe 'after running ensure_resource("user", "Şắოрŀễ Ţëם", { ensure => present, gid => undef })' do + before { subject.call(['User', 'Şắოрŀễ Ţëם', { 'ensure' => 'present', 'gid' => :undef }]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('Şắოрŀễ Ţëם').with_ensure('present') } + it { expect(lambda { catalogue }).to contain_user('Şắოрŀễ Ţëם').without_gid } + end + end + + context 'given a catalog with "user { username1: ensure => present }"' do + let(:pre_condition) { 'user { username1: ensure => present }' } + + describe 'after running ensure_resource("user", "username1", {})' do + before { subject.call(['User', 'username1', {}]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').with_ensure('present') } + end + + describe 'after running ensure_resource("user", "username2", {})' do + before { subject.call(['User', 'username2', {}]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').with_ensure('present') } + it { expect(lambda { catalogue }).to contain_user('username2').without_ensure } + end + + describe 'after running ensure_resource("user", "username1", { gid => undef })' do + before { subject.call(['User', 'username1', { 'gid' => :undef }]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').with_ensure('present') } + end + + describe 'after running ensure_resource("user", ["username1", "username2"], {})' do + before { subject.call(['User', ['username1', 'username2'], {}]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').with_ensure('present') } + it { expect(lambda { catalogue }).to contain_user('username2').without_ensure } + end + + describe 'when providing already set params' do + let(:params) { { 'ensure' => 'present' } } + before { subject.call(['User', ['username2', 'username3'], params]) } + + # this lambda is required due to strangeness within rspec-puppet's expectation handling + it { expect(lambda { catalogue }).to contain_user('username1').with(params) } + it { expect(lambda { catalogue }).to contain_user('username2').with(params) } + end + + context 'when trying to add params' do + it { is_expected.to run \ + .with_params('User', 'username1', { 'ensure' => 'present', 'shell' => true }) \ + .and_raise_error(Puppet::Resource::Catalog::DuplicateResourceError, /User\[username1\] is already declared/) + } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/flatten_spec.rb b/environments/production/modules/stdlib/spec/functions/flatten_spec.rb new file mode 100755 index 0000000..b80f3c5 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/flatten_spec.rb @@ -0,0 +1,15 @@ +require 'spec_helper' + +describe 'flatten' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], []).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['one']).and_return(['one']) } + it { is_expected.to run.with_params([['one']]).and_return(['one']) } + it { is_expected.to run.with_params(["a","b","c","d","e","f","g"]).and_return(["a","b","c","d","e","f","g"]) } + it { is_expected.to run.with_params([["a","b",["c",["d","e"],"f","g"]]]).and_return(["a","b","c","d","e","f","g"]) } + it { is_expected.to run.with_params(["ã","β",["ĉ",["đ","ẽ","ƒ","ġ"]]]).and_return(["ã","β","ĉ","đ","ẽ","ƒ","ġ"]) } +end diff --git a/environments/production/modules/stdlib/spec/functions/floor_spec.rb b/environments/production/modules/stdlib/spec/functions/floor_spec.rb new file mode 100755 index 0000000..608c602 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/floor_spec.rb @@ -0,0 +1,12 @@ +require 'spec_helper' + +describe 'floor' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params("foo").and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params(34).and_return(34) } + it { is_expected.to run.with_params(-34).and_return(-34) } + it { is_expected.to run.with_params(33.1).and_return(33) } + it { is_expected.to run.with_params(-33.1).and_return(-34) } +end diff --git a/environments/production/modules/stdlib/spec/functions/fqdn_rand_string_spec.rb b/environments/production/modules/stdlib/spec/functions/fqdn_rand_string_spec.rb new file mode 100644 index 0000000..861a59e --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/fqdn_rand_string_spec.rb @@ -0,0 +1,66 @@ +require 'spec_helper' + +describe 'fqdn_rand_string' do + let(:default_charset) { %r{\A[a-zA-Z0-9]{100}\z} } + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(0).and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params(1.5).and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params(-10).and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params("-10").and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params("string").and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params([]).and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params({}).and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params(1, 1).and_raise_error(ArgumentError, /second argument must be undef or a string/) } + it { is_expected.to run.with_params(1, []).and_raise_error(ArgumentError, /second argument must be undef or a string/) } + it { is_expected.to run.with_params(1, {}).and_raise_error(ArgumentError, /second argument must be undef or a string/) } + it { is_expected.to run.with_params(100).and_return(default_charset) } + it { is_expected.to run.with_params("100").and_return(default_charset) } + it { is_expected.to run.with_params(100, nil).and_return(default_charset) } + it { is_expected.to run.with_params(100, '').and_return(default_charset) } + it { is_expected.to run.with_params(100, 'a').and_return(/\Aa{100}\z/) } + it { is_expected.to run.with_params(100, 'ab').and_return(/\A[ab]{100}\z/) } + it { is_expected.to run.with_params(100, 'ãβ').and_return(/\A[ãβ]{100}\z/) } + + it "provides the same 'random' value on subsequent calls for the same host" do + expect(fqdn_rand_string(10)).to eql(fqdn_rand_string(10)) + end + + it "considers the same host and same extra arguments to have the same random sequence" do + first_random = fqdn_rand_string(10, :extra_identifier => [1, "same", "host"]) + second_random = fqdn_rand_string(10, :extra_identifier => [1, "same", "host"]) + + expect(first_random).to eql(second_random) + end + + it "allows extra arguments to control the random value on a single host" do + first_random = fqdn_rand_string(10, :extra_identifier => [1, "different", "host"]) + second_different_random = fqdn_rand_string(10, :extra_identifier => [2, "different", "host"]) + + expect(first_random).not_to eql(second_different_random) + end + + it "should return different strings for different hosts" do + val1 = fqdn_rand_string(10, :host => "first.host.com") + val2 = fqdn_rand_string(10, :host => "second.host.com") + + expect(val1).not_to eql(val2) + end + + def fqdn_rand_string(max, args = {}) + host = args[:host] || '127.0.0.1' + charset = args[:charset] + extra = args[:extra_identifier] || [] + + # workaround not being able to use let(:facts) because some tests need + # multiple different hostnames in one context + scope.stubs(:lookupvar).with("::fqdn", {}).returns(host) + + function_args = [max] + if args.has_key?(:charset) or !extra.empty? + function_args << charset + end + function_args += extra + scope.function_fqdn_rand_string(function_args) + end +end diff --git a/environments/production/modules/stdlib/spec/functions/fqdn_rotate_spec.rb b/environments/production/modules/stdlib/spec/functions/fqdn_rotate_spec.rb new file mode 100755 index 0000000..7c1038a --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/fqdn_rotate_spec.rb @@ -0,0 +1,76 @@ +require 'spec_helper' + +describe 'fqdn_rotate' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(0).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('a').and_return('a') } + it { is_expected.to run.with_params('ã').and_return('ã') } + + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['a']).and_return(['a']) } + + it "should rotate a string and the result should be the same size" do + expect(fqdn_rotate("asdf").size).to eq(4) + end + + it "should rotate a string to give the same results for one host" do + val1 = fqdn_rotate("abcdefg", :host => 'one') + val2 = fqdn_rotate("abcdefg", :host => 'one') + expect(val1).to eq(val2) + end + + it "allows extra arguments to control the random rotation on a single host" do + val1 = fqdn_rotate("abcdefg", :extra_identifier => [1, "different", "host"]) + val2 = fqdn_rotate("abcdefg", :extra_identifier => [2, "different", "host"]) + expect(val1).not_to eq(val2) + end + + it "considers the same host and same extra arguments to have the same random rotation" do + val1 = fqdn_rotate("abcdefg", :extra_identifier => [1, "same", "host"]) + val2 = fqdn_rotate("abcdefg", :extra_identifier => [1, "same", "host"]) + expect(val1).to eq(val2) + end + + it "should rotate a string to give different values on different hosts" do + val1 = fqdn_rotate("abcdefg", :host => 'one') + val2 = fqdn_rotate("abcdefg", :host => 'two') + expect(val1).not_to eq(val2) + end + + it "should accept objects which extend String" do + result = fqdn_rotate(AlsoString.new('asdf')) + expect(result).to eq('dfas') + end + + it "should use the Puppet::Util.deterministic_rand function" do + if Puppet::Util.respond_to?(:deterministic_rand) + Puppet::Util.expects(:deterministic_rand).with(44489829212339698569024999901561968770,4) + fqdn_rotate("asdf") + else + skip 'Puppet::Util#deterministic_rand not available' + end + end + + it "should not leave the global seed in a deterministic state" do + fqdn_rotate("asdf") + rand1 = rand() + fqdn_rotate("asdf") + rand2 = rand() + expect(rand1).not_to eql(rand2) + end + + def fqdn_rotate(value, args = {}) + host = args[:host] || '127.0.0.1' + extra = args[:extra_identifier] || [] + + # workaround not being able to use let(:facts) because some tests need + # multiple different hostnames in one context + scope.stubs(:lookupvar).with("::fqdn").returns(host) + + function_args = [value] + extra + scope.function_fqdn_rotate(function_args) + end +end diff --git a/environments/production/modules/stdlib/spec/functions/fqdn_uuid_spec.rb b/environments/production/modules/stdlib/spec/functions/fqdn_uuid_spec.rb new file mode 100644 index 0000000..d0c30d6 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/fqdn_uuid_spec.rb @@ -0,0 +1,13 @@ +require 'spec_helper' + +describe 'fqdn_uuid' do + + context "Invalid parameters" do + it { should run.with_params().and_raise_error(ArgumentError, /No arguments given$/) } + end + + context "given string" do + it { should run.with_params('puppetlabs.com').and_return('9c70320f-6815-5fc5-ab0f-debe68bf764c') } + it { should run.with_params('google.com').and_return('64ee70a4-8cc1-5d25-abf2-dea6c79a09c8') } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/get_module_path_spec.rb b/environments/production/modules/stdlib/spec/functions/get_module_path_spec.rb new file mode 100755 index 0000000..a39e413 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/get_module_path_spec.rb @@ -0,0 +1,48 @@ +require 'spec_helper' + +describe 'get_module_path' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /Wrong number of arguments, expects one/) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /Wrong number of arguments, expects one/) } + it { is_expected.to run.with_params('one', 'two', 'three').and_raise_error(Puppet::ParseError, /Wrong number of arguments, expects one/) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /Could not find module/) } + + class StubModule + attr_reader :path + def initialize(path) + @path = path + end + end + + describe 'when locating a module' do + let(:modulepath) { "/tmp/does_not_exist" } + let(:path_of_module_foo) { StubModule.new("/tmp/does_not_exist/foo") } + + before(:each) { Puppet[:modulepath] = modulepath } + + context 'in the default environment' do + before(:each) { Puppet::Module.expects(:find).with('foo', 'rp_env').returns(path_of_module_foo) } + + it { is_expected.to run.with_params('foo').and_return(path_of_module_foo.path) } + + context 'when the modulepath is a list' do + before(:each) { Puppet[:modulepath] = modulepath + 'tmp/something_else' } + + it { is_expected.to run.with_params('foo').and_return(path_of_module_foo.path) } + end + end + + context 'in a non-default default environment' do + let(:environment) { 'test' } + before(:each) { Puppet::Module.expects(:find).with('foo', 'test').returns(path_of_module_foo) } + + it { is_expected.to run.with_params('foo').and_return(path_of_module_foo.path) } + + context 'when the modulepath is a list' do + before(:each) { Puppet[:modulepath] = modulepath + 'tmp/something_else' } + + it { is_expected.to run.with_params('foo').and_return(path_of_module_foo.path) } + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/getparam_spec.rb b/environments/production/modules/stdlib/spec/functions/getparam_spec.rb new file mode 100755 index 0000000..522ed3b --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/getparam_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'getparam' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /Must specify a reference/) } + it { is_expected.to run.with_params('User[one]').and_raise_error(ArgumentError, /Must specify name of a parameter/) } + it { is_expected.to run.with_params('User[one]', 2).and_raise_error(ArgumentError, /Must specify name of a parameter/) } + it { is_expected.to run.with_params('User[one]', []).and_raise_error(ArgumentError, /Must specify name of a parameter/) } + it { is_expected.to run.with_params('User[one]', {}).and_raise_error(ArgumentError, /Must specify name of a parameter/) } + + describe 'when compared against a user resource with no params' do + let(:pre_condition) { 'user { "one": }' } + + it { is_expected.to run.with_params('User[one]', 'ensure').and_return('') } + it { is_expected.to run.with_params('User[two]', 'ensure').and_return('') } + it { is_expected.to run.with_params('User[one]', 'shell').and_return('') } + end + + describe 'when compared against a user resource with params' do + let(:pre_condition) { 'user { "one": ensure => present, shell => "/bin/sh", managehome => false, }' } + + it { is_expected.to run.with_params('User[one]', 'ensure').and_return('present') } + it { is_expected.to run.with_params('User[two]', 'ensure').and_return('') } + it { is_expected.to run.with_params('User[one]', 'shell').and_return('/bin/sh') } + it { is_expected.to run.with_params('User[one]', 'managehome').and_return(false) } + end + + describe 'when compared against a user resource with UTF8 and double byte params' do + let(:pre_condition) { 'user { ["三", "ƒốưř"]: ensure => present }' } + + it { is_expected.to run.with_params('User[三]', 'ensure').and_return('present') } + it { is_expected.to run.with_params('User[ƒốưř]', 'ensure').and_return('present') } + + end +end diff --git a/environments/production/modules/stdlib/spec/functions/getvar_spec.rb b/environments/production/modules/stdlib/spec/functions/getvar_spec.rb new file mode 100755 index 0000000..55789d8 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/getvar_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'getvar' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + it { is_expected.to run.with_params('$::foo').and_return(nil) } + + context 'given variables in namespaces' do + let(:pre_condition) { + <<-'ENDofPUPPETcode' + class site::data { $foo = 'baz' } + include site::data + ENDofPUPPETcode + } + + it { is_expected.to run.with_params('site::data::foo').and_return('baz') } + it { is_expected.to run.with_params('::site::data::foo').and_return('baz') } + it { is_expected.to run.with_params('::site::data::bar').and_return(nil) } + end + + context 'given variables in namespaces' do + let(:pre_condition) { + <<-'ENDofPUPPETcode' + class site::info { $lock = 'ŧҺîš íš ắ śţřĭŋĝ' } + class site::new { $item = '万Ü€‰' } + include site::info + include site::new + ENDofPUPPETcode + } + + it { is_expected.to run.with_params('site::info::lock').and_return('ŧҺîš íš ắ śţřĭŋĝ') } + it { is_expected.to run.with_params('::site::new::item').and_return('万Ü€‰') } + end +end + diff --git a/environments/production/modules/stdlib/spec/functions/grep_spec.rb b/environments/production/modules/stdlib/spec/functions/grep_spec.rb new file mode 100755 index 0000000..d2152b1 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/grep_spec.rb @@ -0,0 +1,20 @@ +require 'spec_helper' + +describe 'grep' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("grep does not actually check this, and raises NoMethodError instead") + is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /first argument not an array/) + } + it { + pending("grep does not actually check this, and raises NoMethodError instead") + is_expected.to run.with_params(1, 'two').and_raise_error(Puppet::ParseError, /first argument not an array/) + } + it { is_expected.to run.with_params('one', 'two', 'three').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([], 'two').and_return([]) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'two').and_return(['two']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 't(wo|hree)').and_return(['two', 'three']) } + it { is_expected.to run.with_params(['ờאּê', 'ţשּׂỡ', 'ţһŗəè'], 'ţ(שּׂỡ|һŗəè)').and_return(['ţשּׂỡ', 'ţһŗəè']) } +end diff --git a/environments/production/modules/stdlib/spec/functions/has_interface_with_spec.rb b/environments/production/modules/stdlib/spec/functions/has_interface_with_spec.rb new file mode 100755 index 0000000..7334d38 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/has_interface_with_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'has_interface_with' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one", "two", "three").and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + # We need to mock out the Facts so we can specify how we expect this function + # to behave on different platforms. + context "On Mac OS X Systems" do + let(:facts) { { :interfaces => 'lo0,gif0,stf0,en1,p2p0,fw0,en0,vmnet1,vmnet8,utun0' } } + it { is_expected.to run.with_params('lo0').and_return(true) } + it { is_expected.to run.with_params('lo').and_return(false) } + end + + context "On Linux Systems" do + let(:facts) do + { + :interfaces => 'eth0,lo', + :ipaddress => '10.0.0.1', + :ipaddress_lo => '127.0.0.1', + :ipaddress_eth0 => '10.0.0.1', + :muppet => 'kermit', + :muppet_lo => 'mspiggy', + :muppet_eth0 => 'kermit', + } + end + + it { is_expected.to run.with_params('lo').and_return(true) } + it { is_expected.to run.with_params('lo0').and_return(false) } + it { is_expected.to run.with_params('ipaddress', '127.0.0.1').and_return(true) } + it { is_expected.to run.with_params('ipaddress', '10.0.0.1').and_return(true) } + it { is_expected.to run.with_params('ipaddress', '8.8.8.8').and_return(false) } + it { is_expected.to run.with_params('muppet', 'kermit').and_return(true) } + it { is_expected.to run.with_params('muppet', 'mspiggy').and_return(true) } + it { is_expected.to run.with_params('muppet', 'bigbird').and_return(false) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/has_ip_address_spec.rb b/environments/production/modules/stdlib/spec/functions/has_ip_address_spec.rb new file mode 100755 index 0000000..42a5a79 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/has_ip_address_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' + +describe 'has_ip_address' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one", "two").and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + context "On Linux Systems" do + let(:facts) do + { + :interfaces => 'eth0,lo', + :ipaddress => '10.0.0.1', + :ipaddress_lo => '127.0.0.1', + :ipaddress_eth0 => '10.0.0.1', + } + end + + it { is_expected.to run.with_params('127.0.0.1').and_return(true) } + it { is_expected.to run.with_params('10.0.0.1').and_return(true) } + it { is_expected.to run.with_params('8.8.8.8').and_return(false) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/has_ip_network_spec.rb b/environments/production/modules/stdlib/spec/functions/has_ip_network_spec.rb new file mode 100755 index 0000000..57cf613 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/has_ip_network_spec.rb @@ -0,0 +1,21 @@ +require 'spec_helper' + +describe 'has_ip_network' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one", "two").and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + context "On Linux Systems" do + let(:facts) do + { + :interfaces => 'eth0,lo', + :network_lo => '127.0.0.0', + :network_eth0 => '10.0.0.0', + } + end + + it { is_expected.to run.with_params('127.0.0.0').and_return(true) } + it { is_expected.to run.with_params('10.0.0.0').and_return(true) } + it { is_expected.to run.with_params('8.8.8.0').and_return(false) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/has_key_spec.rb b/environments/production/modules/stdlib/spec/functions/has_key_spec.rb new file mode 100755 index 0000000..0e0e1cc --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/has_key_spec.rb @@ -0,0 +1,20 @@ +require 'spec_helper' + +describe 'has_key' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one").and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one", "two", "three").and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one", "two").and_raise_error(Puppet::ParseError, /expects the first argument to be a hash/) } + it { is_expected.to run.with_params(1, "two").and_raise_error(Puppet::ParseError, /expects the first argument to be a hash/) } + it { is_expected.to run.with_params([], "two").and_raise_error(Puppet::ParseError, /expects the first argument to be a hash/) } + + it { is_expected.to run.with_params({ 'key' => 'value' }, "key").and_return(true) } + it { is_expected.to run.with_params({}, "key").and_return(false) } + it { is_expected.to run.with_params({ 'key' => 'value'}, "not a key").and_return(false) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params({ 'κéỳ ' => '٧ậļųể' }, "κéỳ ").and_return(true) } + it { is_expected.to run.with_params({ 'キー' => '٧ậļųể' }, "キー").and_return(true) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/hash_spec.rb b/environments/production/modules/stdlib/spec/functions/hash_spec.rb new file mode 100755 index 0000000..092474b --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/hash_spec.rb @@ -0,0 +1,15 @@ +require 'spec_helper' + +describe 'hash' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], 'two').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(['one']).and_raise_error(Puppet::ParseError, /Unable to compute/) } + it { is_expected.to run.with_params([]).and_return({}) } + it { is_expected.to run.with_params(['key1', 'value1']).and_return({ 'key1' => 'value1' }) } + it { is_expected.to run.with_params(['κ℮ұ1', '√āĺűẻ1']).and_return({ 'κ℮ұ1' => '√āĺűẻ1' }) } + it { is_expected.to run.with_params(['key1', 'value1', 'key2', 'value2']).and_return({ 'key1' => 'value1', 'key2' => 'value2' }) } +end diff --git a/environments/production/modules/stdlib/spec/functions/intersection_spec.rb b/environments/production/modules/stdlib/spec/functions/intersection_spec.rb new file mode 100755 index 0000000..ec368a5 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/intersection_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' + +describe 'intersection' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', 'two', 'three').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params('one', []).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], 'two').and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params({}, {}).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([], []).and_return([]) } + it { is_expected.to run.with_params([], ['one']).and_return([]) } + it { is_expected.to run.with_params(['one'], []).and_return([]) } + it { is_expected.to run.with_params(['one'], ['one']).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'three']).and_return(['two', 'three']) } + it { is_expected.to run.with_params(['ōŋể', 'ŧשợ', 'ţђŕẽё'], ['ŧשợ', 'ţђŕẽё']).and_return(['ŧשợ', 'ţђŕẽё']) } + it { is_expected.to run.with_params(['one', 'two', 'two', 'three'], ['two', 'three']).and_return(['two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'two', 'three']).and_return(['two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'three', 'four']).and_return(['two', 'three']) } + it 'should not confuse types' do is_expected.to run.with_params(['1', '2', '3'], [1, 2]).and_return([]) end +end diff --git a/environments/production/modules/stdlib/spec/functions/is_a_spec.rb b/environments/production/modules/stdlib/spec/functions/is_a_spec.rb new file mode 100644 index 0000000..2d6cb46 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_a_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper' + +if ENV["FUTURE_PARSER"] == 'yes' + describe 'type_of' do + pending 'teach rspec-puppet to load future-only functions under 3.7.5' do + it { is_expected.not_to eq(nil) } + end + end +end + +if Puppet.version.to_f >= 4.0 + describe 'is_a' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { is_expected.to run.with_params('', '').and_raise_error(ArgumentError) } + + it 'succeeds when comparing a string and a string' do + is_expected.to run.with_params('hello world', String).and_return(true) + end + + it 'fails when comparing an integer and a string' do + is_expected.to run.with_params(5, String).and_return(false) + end + + it 'suceeds when comparing an UTF8 and double byte characters' do + is_expected.to run.with_params('このテキスト', String).and_return(true) + is_expected.to run.with_params('ŧћịś ŧêχŧ', String).and_return(true) + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/is_array_spec.rb b/environments/production/modules/stdlib/spec/functions/is_array_spec.rb new file mode 100755 index 0000000..e89f54b --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_array_spec.rb @@ -0,0 +1,36 @@ +require 'spec_helper' + +describe 'is_array' do + + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], []).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params([]).and_return(true) } + it { is_expected.to run.with_params(['one']).and_return(true) } + it { is_expected.to run.with_params([1]).and_return(true) } + it { is_expected.to run.with_params([{}]).and_return(true) } + it { is_expected.to run.with_params([[]]).and_return(true) } + it { is_expected.to run.with_params('').and_return(false) } + it { is_expected.to run.with_params('one').and_return(false) } + it { is_expected.to run.with_params(1).and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + context 'Checking for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(['1.2.3.4']).and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(['1.2.3.4']).and_return(true) + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/is_bool_spec.rb b/environments/production/modules/stdlib/spec/functions/is_bool_spec.rb new file mode 100755 index 0000000..d21345c --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_bool_spec.rb @@ -0,0 +1,33 @@ +require 'spec_helper' + +describe 'is_bool' do + + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(true, false).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(true).and_return(true) } + it { is_expected.to run.with_params(false).and_return(true) } + it { is_expected.to run.with_params([1]).and_return(false) } + it { is_expected.to run.with_params([{}]).and_return(false) } + it { is_expected.to run.with_params([[]]).and_return(false) } + it { is_expected.to run.with_params([true]).and_return(false) } + it { is_expected.to run.with_params('true').and_return(false) } + it { is_expected.to run.with_params('false').and_return(false) } + context 'Checking for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(true).and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(false).and_return(true) + end + end +end + diff --git a/environments/production/modules/stdlib/spec/functions/is_domain_name_spec.rb b/environments/production/modules/stdlib/spec/functions/is_domain_name_spec.rb new file mode 100755 index 0000000..c1bf0e3 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_domain_name_spec.rb @@ -0,0 +1,43 @@ +require 'spec_helper' + +describe 'is_domain_name' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_return(false) } + it { is_expected.to run.with_params([]).and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params('').and_return(false) } + it { is_expected.to run.with_params('.').and_return(true) } + it { is_expected.to run.with_params('com').and_return(true) } + it { is_expected.to run.with_params('com.').and_return(true) } + it { is_expected.to run.with_params('x.com').and_return(true) } + it { is_expected.to run.with_params('x.com.').and_return(true) } + it { is_expected.to run.with_params('foo.example.com').and_return(true) } + it { is_expected.to run.with_params('foo.example.com.').and_return(true) } + it { is_expected.to run.with_params('2foo.example.com').and_return(true) } + it { is_expected.to run.with_params('2foo.example.com.').and_return(true) } + it { is_expected.to run.with_params('www.2foo.example.com').and_return(true) } + it { is_expected.to run.with_params('www.2foo.example.com.').and_return(true) } + describe 'inputs with spaces' do + it { is_expected.to run.with_params('invalid domain').and_return(false) } + end + describe 'inputs with hyphens' do + it { is_expected.to run.with_params('foo-bar.example.com').and_return(true) } + it { is_expected.to run.with_params('foo-bar.example.com.').and_return(true) } + it { is_expected.to run.with_params('www.foo-bar.example.com').and_return(true) } + it { is_expected.to run.with_params('www.foo-bar.example.com.').and_return(true) } + it { is_expected.to run.with_params('-foo.example.com').and_return(false) } + it { is_expected.to run.with_params('-foo.example.com').and_return(false) } + end + # Values obtained from Facter values will be frozen strings + # in newer versions of Facter: + it { is_expected.to run.with_params('www.example.com'.freeze).and_return(true) } + describe 'top level domain must be alphabetic if there are multiple labels' do + it { is_expected.to run.with_params('2com').and_return(true) } + it { is_expected.to run.with_params('www.example.2com').and_return(false) } + end + describe 'IP addresses are not domain names' do + it { is_expected.to run.with_params('192.168.1.1').and_return(false) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/is_email_address_spec.rb b/environments/production/modules/stdlib/spec/functions/is_email_address_spec.rb new file mode 100755 index 0000000..8b7b358 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_email_address_spec.rb @@ -0,0 +1,14 @@ +require 'spec_helper' + +describe 'is_email_address' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([], []).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('bob@gmail.com').and_return(true) } + it { is_expected.to run.with_params('alice+puppetlabs.com@gmail.com').and_return(true) } + it { is_expected.to run.with_params('peter.parker@gmail.com').and_return(true) } + it { is_expected.to run.with_params('1.2.3@domain').and_return(false) } + it { is_expected.to run.with_params('1.2.3.4.5@').and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params([]).and_return(false) } +end diff --git a/environments/production/modules/stdlib/spec/functions/is_float_spec.rb b/environments/production/modules/stdlib/spec/functions/is_float_spec.rb new file mode 100755 index 0000000..af3322e --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_float_spec.rb @@ -0,0 +1,42 @@ +require 'spec_helper' + +describe 'is_float' do + + it { is_expected.not_to eq(nil) } + + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(0.1, 0.2).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + describe 'passing a string' do + it { is_expected.to run.with_params('0.1').and_return(true) } + it { is_expected.to run.with_params('1.0').and_return(true) } + it { is_expected.to run.with_params('1').and_return(false) } + it { is_expected.to run.with_params('one').and_return(false) } + it { is_expected.to run.with_params('one 1.0').and_return(false) } + it { is_expected.to run.with_params('1.0 one').and_return(false) } + end + + describe 'passing numbers' do + it { is_expected.to run.with_params(0.1).and_return(true) } + it { is_expected.to run.with_params(1.0).and_return(true) } + it { is_expected.to run.with_params(1).and_return(false) } + end + + context 'Checking for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(2.2).and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(1.0).and_return(true) + end + end + +end diff --git a/environments/production/modules/stdlib/spec/functions/is_function_available.rb b/environments/production/modules/stdlib/spec/functions/is_function_available.rb new file mode 100755 index 0000000..44f08c0 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_function_available.rb @@ -0,0 +1,9 @@ +require 'spec_helper' + +describe 'is_function_available' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('include').and_return(true) } + it { is_expected.to run.with_params('no_such_function').and_return(false) } +end diff --git a/environments/production/modules/stdlib/spec/functions/is_hash_spec.rb b/environments/production/modules/stdlib/spec/functions/is_hash_spec.rb new file mode 100755 index 0000000..c2599a0 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_hash_spec.rb @@ -0,0 +1,11 @@ +require 'spec_helper' + +describe 'is_hash' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params({}, {}).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('').and_return(false) } + it { is_expected.to run.with_params({}).and_return(true) } + it { is_expected.to run.with_params([]).and_return(false) } + it { is_expected.to run.with_params(1).and_return(false) } +end diff --git a/environments/production/modules/stdlib/spec/functions/is_integer_spec.rb b/environments/production/modules/stdlib/spec/functions/is_integer_spec.rb new file mode 100755 index 0000000..b296830 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_integer_spec.rb @@ -0,0 +1,45 @@ +require 'spec_helper' + +describe 'is_integer' do + + it { is_expected.not_to eq(nil) } + + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1, 2).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + it { is_expected.to run.with_params(3).and_return(true) } + it { is_expected.to run.with_params('3').and_return(true) } + it { is_expected.to run.with_params(-3).and_return(true) } + it { is_expected.to run.with_params('-3').and_return(true) } + + it { is_expected.to run.with_params(3.7).and_return(false) } + it { is_expected.to run.with_params('3.7').and_return(false) } + it { is_expected.to run.with_params(-3.7).and_return(false) } + it { is_expected.to run.with_params('3.7').and_return(false) } + + it { is_expected.to run.with_params('one').and_return(false) } + it { is_expected.to run.with_params([]).and_return(false) } + it { is_expected.to run.with_params([1]).and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params(true).and_return(false) } + it { is_expected.to run.with_params(false).and_return(false) } + it { is_expected.to run.with_params('0001234').and_return(false) } + + context 'Checking for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(50).and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(50).and_return(true) + end + end + +end diff --git a/environments/production/modules/stdlib/spec/functions/is_ip_address_spec.rb b/environments/production/modules/stdlib/spec/functions/is_ip_address_spec.rb new file mode 100755 index 0000000..39525d7 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_ip_address_spec.rb @@ -0,0 +1,40 @@ +require 'spec_helper' + +describe 'is_ip_address' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([], []).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('1.2.3.4').and_return(true) } + it { is_expected.to run.with_params('1.2.3.255').and_return(true) } + it { is_expected.to run.with_params('1.2.3.256').and_return(false) } + it { is_expected.to run.with_params('1.2.3').and_return(false) } + it { is_expected.to run.with_params('1.2.3.4.5').and_return(false) } + it { is_expected.to run.with_params('fe00::1').and_return(true) } + it { is_expected.to run.with_params('fe80:0000:cd12:d123:e2f8:47ff:fe09:dd74').and_return(true) } + it { is_expected.to run.with_params('FE80:0000:CD12:D123:E2F8:47FF:FE09:DD74').and_return(true) } + it { is_expected.to run.with_params('fe80:0000:cd12:d123:e2f8:47ff:fe09:zzzz').and_return(false) } + it { is_expected.to run.with_params('fe80:0000:cd12:d123:e2f8:47ff:fe09').and_return(false) } + it { is_expected.to run.with_params('fe80:0000:cd12:d123:e2f8:47ff:fe09:dd74:dd74').and_return(false) } + it { is_expected.to run.with_params('').and_return(false) } + it { is_expected.to run.with_params('one').and_return(false) } + it { is_expected.to run.with_params(1).and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params([]).and_return(false) } + + context 'Checking for deprecation warning', if: Puppet.version.to_f < 4.0 do + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('1.2.3.4').and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params('1.2.3.4').and_return(true) + end + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/is_ipv4_address_spec.rb b/environments/production/modules/stdlib/spec/functions/is_ipv4_address_spec.rb new file mode 100644 index 0000000..985260c --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_ipv4_address_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +describe 'is_ipv4_address' do + + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + SharedData::IPV4_PATTERNS.each do |value| + it { is_expected.to run.with_params(value).and_return(true) } + end + + SharedData::IPV4_NEGATIVE_PATTERNS.each do |value| + it { is_expected.to run.with_params(value).and_return(false) } + end + + context 'Checking for deprecation warning', if: Puppet.version.to_f < 4.0 do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(SharedData::IPV4_PATTERNS.first).and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(SharedData::IPV4_PATTERNS.first).and_return(true) + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/is_ipv6_address_spec.rb b/environments/production/modules/stdlib/spec/functions/is_ipv6_address_spec.rb new file mode 100644 index 0000000..acd6a87 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_ipv6_address_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper' + +describe 'is_ipv6_address' do + + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('2001:0db8:85a3:0000:0000:8a2e:0370:7334').and_return(true) } + it { is_expected.to run.with_params('85a3:0000:0000:8a2e:0370:7334:100.100.100.100').and_return(true) } + it { is_expected.to run.with_params('1.2.3').and_return(false) } + it { is_expected.to run.with_params('1.2.3.4.5').and_return(false) } + it { is_expected.to run.with_params('').and_return(false) } + it { is_expected.to run.with_params('one').and_return(false) } + + context 'Checking for deprecation warning', if: Puppet.version.to_f < 4.0 do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('2001:0db8:85a3:0000:0000:8a2e:0370:7334').and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params('2001:0db8:85a3:0000:0000:8a2e:0370:7334').and_return(true) + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/is_mac_address_spec.rb b/environments/production/modules/stdlib/spec/functions/is_mac_address_spec.rb new file mode 100755 index 0000000..c1e33b8 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_mac_address_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper' + +describe 'is_mac_address' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([], []).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('00:a0:1f:12:7f:a0').and_return(true) } + it { is_expected.to run.with_params('00:A0:1F:12:7F:A0').and_return(true) } + it { is_expected.to run.with_params('00:00:00:00:00:0g').and_return(false) } + it { is_expected.to run.with_params('').and_return(false) } + it { is_expected.to run.with_params('one').and_return(false) } + + context 'function can handle UTF8 and double byte characters' do + it { is_expected.to run.with_params('ƒốưř').and_return(false) } + it { is_expected.to run.with_params('三+').and_return(false) } + end + + it { + pending "should properly typecheck its arguments" + is_expected.to run.with_params(1).and_return(false) + } + it { + pending "should properly typecheck its arguments" + is_expected.to run.with_params({}).and_return(false) + } + it { + pending "should properly typecheck its arguments" + is_expected.to run.with_params([]).and_return(false) + } +end diff --git a/environments/production/modules/stdlib/spec/functions/is_numeric_spec.rb b/environments/production/modules/stdlib/spec/functions/is_numeric_spec.rb new file mode 100755 index 0000000..5962d8a --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_numeric_spec.rb @@ -0,0 +1,48 @@ +require 'spec_helper' + +describe 'is_numeric' do + + it { is_expected.not_to eq(nil) } + + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1, 2).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + it { is_expected.to run.with_params(3).and_return(true) } + it { is_expected.to run.with_params('3').and_return(true) } + it { is_expected.to run.with_params(-3).and_return(true) } + it { is_expected.to run.with_params('-3').and_return(true) } + + it { is_expected.to run.with_params(3.7).and_return(true) } + it { is_expected.to run.with_params('3.7').and_return(true) } + it { is_expected.to run.with_params(-3.7).and_return(true) } + it { is_expected.to run.with_params('3.7').and_return(true) } + + it { is_expected.to run.with_params('-342.2315e-12').and_return(true) } + + it { is_expected.to run.with_params('one').and_return(false) } + it { is_expected.to run.with_params([]).and_return(false) } + it { is_expected.to run.with_params([1]).and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params(true).and_return(false) } + it { is_expected.to run.with_params(false).and_return(false) } + it { is_expected.to run.with_params('0001234').and_return(false) } + it { is_expected.to run.with_params(' - 1234').and_return(false) } + + context 'Checking for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(7).and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(7).and_return(true) + end + end + +end diff --git a/environments/production/modules/stdlib/spec/functions/is_string_spec.rb b/environments/production/modules/stdlib/spec/functions/is_string_spec.rb new file mode 100755 index 0000000..e92f85c --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/is_string_spec.rb @@ -0,0 +1,47 @@ +require 'spec_helper' + +describe 'is_string' do + + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + + it { is_expected.to run.with_params(3).and_return(false) } + it { is_expected.to run.with_params('3').and_return(false) } + it { is_expected.to run.with_params(-3).and_return(false) } + it { is_expected.to run.with_params('-3').and_return(false) } + + it { is_expected.to run.with_params(3.7).and_return(false) } + it { is_expected.to run.with_params('3.7').and_return(false) } + it { is_expected.to run.with_params(-3.7).and_return(false) } + it { is_expected.to run.with_params('3.7').and_return(false) } + + it { is_expected.to run.with_params([]).and_return(false) } + it { is_expected.to run.with_params([1]).and_return(false) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params(true).and_return(false) } + it { is_expected.to run.with_params(false).and_return(false) } + it { is_expected.to run.with_params('one').and_return(true) } + it { is_expected.to run.with_params('0001234').and_return(true) } + + context 'Checking for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('sponge').and_return(true) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params('bob').and_return(true) + end + end + +end diff --git a/environments/production/modules/stdlib/spec/functions/join_keys_to_values_spec.rb b/environments/production/modules/stdlib/spec/functions/join_keys_to_values_spec.rb new file mode 100755 index 0000000..0a2a50c --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/join_keys_to_values_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper' + +describe 'join_keys_to_values' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /Takes exactly two arguments/) } + it { is_expected.to run.with_params({}, '', '').and_raise_error(Puppet::ParseError, /Takes exactly two arguments/) } + it { is_expected.to run.with_params('one', '').and_raise_error(TypeError, /The first argument must be a hash/) } + it { is_expected.to run.with_params({}, 2).and_raise_error(TypeError, /The second argument must be a string/) } + + it { is_expected.to run.with_params({}, '').and_return([]) } + it { is_expected.to run.with_params({}, ':').and_return([]) } + it { is_expected.to run.with_params({ 'key' => 'value' }, '').and_return(['keyvalue']) } + it { is_expected.to run.with_params({ 'key' => 'value' }, ':').and_return(['key:value']) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params({ 'ҝẽγ' => '√ạĺűē' }, ':').and_return(['ҝẽγ:√ạĺűē']) } + it { is_expected.to run.with_params({ 'ҝẽγ' => '√ạĺűē' }, '万').and_return(['ҝẽγ万√ạĺűē']) } + end + + it { is_expected.to run.with_params({ 'key' => nil }, ':').and_return(['key:']) } + it 'should run join_keys_to_values(, ":") and return the proper array' do + result = subject.call([{ 'key1' => 'value1', 'key2' => 'value2' }, ':']) + expect(result.sort).to eq(['key1:value1', 'key2:value2'].sort) + end + it 'should run join_keys_to_values(, " ") and return the proper array' do + result = subject.call([{ 'key1' => 'value1', 'key2' => ['value2', 'value3'] }, ' ']) + expect(result.sort).to eq(['key1 value1', 'key2 value2', 'key2 value3'].sort) + end +end + diff --git a/environments/production/modules/stdlib/spec/functions/join_spec.rb b/environments/production/modules/stdlib/spec/functions/join_spec.rb new file mode 100755 index 0000000..98852d5 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/join_spec.rb @@ -0,0 +1,20 @@ +require 'spec_helper' + +describe 'join' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the second.") + is_expected.to run.with_params([], '', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /Requires array to work with/) } + it { is_expected.to run.with_params([], 2).and_raise_error(Puppet::ParseError, /Requires string to work with/) } + + it { is_expected.to run.with_params([]).and_return('') } + it { is_expected.to run.with_params([], ':').and_return('') } + it { is_expected.to run.with_params(['one']).and_return('one') } + it { is_expected.to run.with_params(['one'], ':').and_return('one') } + it { is_expected.to run.with_params(['one', 'two', 'three']).and_return('onetwothree') } + it { is_expected.to run.with_params(['one', 'two', 'three'], ':').and_return('one:two:three') } + it { is_expected.to run.with_params(['ōŋể', 'ŧשợ', 'ţђŕẽё'], ':').and_return('ōŋể:ŧשợ:ţђŕẽё') } +end diff --git a/environments/production/modules/stdlib/spec/functions/keys_spec.rb b/environments/production/modules/stdlib/spec/functions/keys_spec.rb new file mode 100755 index 0000000..fc7d6d8 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/keys_spec.rb @@ -0,0 +1,24 @@ +require 'spec_helper' + +describe 'keys' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params({}, {}).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params('').and_raise_error(Puppet::ParseError, /Requires hash to work with/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires hash to work with/) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError, /Requires hash to work with/) } + it { is_expected.to run.with_params({}).and_return([]) } + it { is_expected.to run.with_params({ 'key' => 'value' }).and_return(['key']) } + it 'should return the array of keys' do + result = subject.call([{ 'key1' => 'value1', 'key2' => 'value2' }]) + expect(result).to match_array(['key1', 'key2']) + end + + it 'should run with UTF8 and double byte characters' do + result = subject.call([{ 'ҝểү' => '√ẳŀμệ', 'キー' => '値' }]) + expect(result).to match_array(['ҝểү', 'キー']) + end +end diff --git a/environments/production/modules/stdlib/spec/functions/length.rb b/environments/production/modules/stdlib/spec/functions/length.rb new file mode 100755 index 0000000..d1ab003 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/length.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'length' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /'length' expects 1 argument, got none/) } + it { is_expected.to run.with_params([], 'extra').and_raise_error(ArgumentError, /'length' expects 1 argument, got 2/) } + it { is_expected.to run.with_params(1).and_raise_error(ArgumentError, /expects a value of type String, Array, or Hash, got Integer/) } + it { is_expected.to run.with_params(true).and_raise_error(ArgumentError, /expects a value of type String, Array, or Hash, got Boolean/) } + it { is_expected.to run.with_params('1').and_return(1) } + it { is_expected.to run.with_params('1.0').and_return(3) } + it { is_expected.to run.with_params([]).and_return(0) } + it { is_expected.to run.with_params(['a']).and_return(1) } + it { is_expected.to run.with_params(['one', 'two', 'three']).and_return(3) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'four']).and_return(4) } + + it { is_expected.to run.with_params({}).and_return(0) } + it { is_expected.to run.with_params({'1' => '2'}).and_return(1) } + it { is_expected.to run.with_params({'1' => '2', '4' => '4'}).and_return(2) } + it { is_expected.to run.with_params({'€' => '@', '竹' => 'ǿňè'}).and_return(2) } + + it { is_expected.to run.with_params('').and_return(0) } + it { is_expected.to run.with_params('a').and_return(1) } + it { is_expected.to run.with_params('abc').and_return(3) } + it { is_expected.to run.with_params('abcd').and_return(4) } + it { is_expected.to run.with_params('万').and_return(1) } + it { is_expected.to run.with_params('āβćđ').and_return(4) } + + context 'when using a class extending String' do + it 'should call its size method' do + value = AlsoString.new('asdfghjkl') + value.expects(:length).returns('foo') + expect(subject).to run.with_params(value).and_return('foo') + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/load_module_metadata_spec.rb b/environments/production/modules/stdlib/spec/functions/load_module_metadata_spec.rb new file mode 100755 index 0000000..9496fcb --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/load_module_metadata_spec.rb @@ -0,0 +1,61 @@ +require 'spec_helper' + +describe 'load_module_metadata' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params("one", "two", "three").and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + describe "when calling with valid arguments" do + before :each do + allow(File).to receive(:read).with(/\/(stdlib|test)\/metadata.json/, {:encoding=>"utf-8"}).and_return('{"name": "puppetlabs-stdlib"}') + allow(File).to receive(:read).with(/\/(stdlib|test)\/metadata.json/).and_return('{"name": "puppetlabs-stdlib"}') + end + + context "when calling with valid utf8 and double byte character arguments" do + before :each do + allow(File).to receive(:read).with(/\/(stdlib|test)\/metadata.json/, {:encoding=>"utf-8"}).and_return('{"ĭďèʼnţĩƒіểя": "ċơņťęאּť ỡƒ ţħíš - +この文字"}') + allow(File).to receive(:read).with(/\/(stdlib|test)\/metadata.json/).and_return('{"ĭďèʼnţĩƒіểя": "ċơņťęאּť ỡƒ ţħíš - +この文字"}') + end + + it "should json parse the file" do + if Puppet::Util::Platform.windows? + allow(scope).to receive(:function_get_module_path).with(['science']).and_return('C:/path/to/module/') + allow(File).to receive(:exists?).with('C:/path/to/module/metadata.json').and_return(true) + allow(File).to receive(:read).with('C:/path/to/module/metadata.json').and_return('{"name": "spencer-science"}') + else + allow(scope).to receive(:function_get_module_path).with(['science']).and_return('/path/to/module/') + allow(File).to receive(:exists?).with('/path/to/module/metadata.json').and_return(true) + allow(File).to receive(:read).with('/path/to/module/metadata.json').and_return('{"name": "spencer-science"}') + end + + result = subject.call(['science']) + expect(result['name']).to eq('spencer-science') + end + + it "should fail by default if there is no metadata.json" do + if Puppet::Util::Platform.windows? + allow(scope).to receive(:function_get_module_path).with(['science']).and_return('C:/path/to/module/') + allow(File).to receive(:exists?).with('C:/path/to/module/metadata.json').and_return(false) + else + allow(scope).to receive(:function_get_module_path).with(['science']).and_return('/path/to/module/') + allow(File).to receive(:exists?).with('/path/to/module/metadata.json').and_return(false) + end + expect {subject.call(['science'])}.to raise_error(Puppet::ParseError) + end + + it "should return nil if user allows empty metadata.json" do + if Puppet::Util::Platform.windows? + allow(scope).to receive(:function_get_module_path).with(['science']).and_return('C:/path/to/module/') + allow(File).to receive(:exists?).with('C:/path/to/module/metadata.json').and_return(false) + else + allow(scope).to receive(:function_get_module_path).with(['science']).and_return('/path/to/module/') + allow(File).to receive(:exists?).with('/path/to/module/metadata.json').and_return(false) + end + result = subject.call(['science', true]) + expect(result).to eq({}) + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/loadjson_spec.rb b/environments/production/modules/stdlib/spec/functions/loadjson_spec.rb new file mode 100644 index 0000000..dbef805 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/loadjson_spec.rb @@ -0,0 +1,66 @@ +require 'spec_helper' + +describe 'loadjson' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /wrong number of arguments/i) } + + describe "when calling with valid arguments" do + before :each do + allow(File).to receive(:read).with(/\/(stdlib|test)\/metadata.json/, {:encoding=>"utf-8"}).and_return('{"name": "puppetlabs-stdlib"}') + allow(File).to receive(:read).with(/\/(stdlib|test)\/metadata.json/).and_return('{"name": "puppetlabs-stdlib"}') + end + + context 'when a non-existing file is specified' do + let(:filename) { + if Puppet::Util::Platform.windows? + 'C:/tmp/doesnotexist' + else + '/tmp/doesnotexist' + end + } + before { + allow(File).to receive(:exists?).with(filename).and_return(false).once + allow(PSON).to receive(:load).never + } + it { is_expected.to run.with_params(filename, {'default' => 'value'}).and_return({'default' => 'value'}) } + it { is_expected.to run.with_params(filename, {'đẽƒằưļŧ' => '٧ẵłựέ'}).and_return({'đẽƒằưļŧ' => '٧ẵłựέ'}) } + it { is_expected.to run.with_params(filename, {'デフォルト' => '値'}).and_return({'デフォルト' => '値'}) } + end + + context 'when an existing file is specified' do + let(:filename) { + if Puppet::Util::Platform.windows? + 'C:/tmp/doesexist' + else + '/tmp/doesexist' + end + } + let(:data) { { 'key' => 'value', 'ķęŷ' => 'νậŀųề', 'キー' => '値'} } + let(:json) { '{"key":"value", {"ķęŷ":"νậŀųề" }, {"キー":"値" }' } + before { + allow(File).to receive(:exists?).with(filename).and_return(true).once + allow(File).to receive(:read).with(filename).and_return(json).once + allow(File).to receive(:read).with(filename).and_return(json).once + allow(PSON).to receive(:load).with(json).and_return(data).once + } + it { is_expected.to run.with_params(filename).and_return(data) } + end + + context 'when the file could not be parsed' do + let(:filename) { + if Puppet::Util::Platform.windows? + 'C:/tmp/doesexist' + else + '/tmp/doesexist' + end + } + let(:json) { '{"key":"value"}' } + before { + allow(File).to receive(:exists?).with(filename).and_return(true).once + allow(File).to receive(:read).with(filename).and_return(json).once + allow(PSON).to receive(:load).with(json).once.and_raise StandardError, 'Something terrible have happened!' + } + it { is_expected.to run.with_params(filename, {'default' => 'value'}).and_return({'default' => 'value'}) } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/loadyaml_spec.rb b/environments/production/modules/stdlib/spec/functions/loadyaml_spec.rb new file mode 100755 index 0000000..e9428e3 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/loadyaml_spec.rb @@ -0,0 +1,36 @@ +require 'spec_helper' + +describe 'loadyaml' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /wrong number of arguments/i) } + + context 'when a non-existing file is specified' do + let(:filename) { '/tmp/doesnotexist' } + before { + File.expects(:exists?).with(filename).returns(false).once + YAML.expects(:load_file).never + } + it { is_expected.to run.with_params(filename, {'default' => 'value'}).and_return({'default' => 'value'}) } + it { is_expected.to run.with_params(filename, {'đẽƒằưļŧ' => '٧ẵłựέ'}).and_return({'đẽƒằưļŧ' => '٧ẵłựέ'}) } + it { is_expected.to run.with_params(filename, {'デフォルト' => '値'}).and_return({'デフォルト' => '値'}) } + end + + context 'when an existing file is specified' do + let(:filename) { '/tmp/doesexist' } + let(:data) { { 'key' => 'value', 'ķęŷ' => 'νậŀųề', 'キー' => '値'} } + before { + File.expects(:exists?).with(filename).returns(true).once + YAML.expects(:load_file).with(filename).returns(data).once + } + it { is_expected.to run.with_params(filename).and_return(data) } + end + + context 'when the file could not be parsed' do + let(:filename) { '/tmp/doesexist' } + before { + File.expects(:exists?).with(filename).returns(true).once + YAML.stubs(:load_file).with(filename).once.raises StandardError, 'Something terrible have happened!' + } + it { is_expected.to run.with_params(filename, {'default' => 'value'}).and_return({'default' => 'value'}) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/lstrip_spec.rb b/environments/production/modules/stdlib/spec/functions/lstrip_spec.rb new file mode 100755 index 0000000..a5a09ed --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/lstrip_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'lstrip' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params(' ').and_return('') } + it { is_expected.to run.with_params(' ').and_return('') } + it { is_expected.to run.with_params("\t").and_return('') } + it { is_expected.to run.with_params("\t ").and_return('') } + it { is_expected.to run.with_params('one').and_return('one') } + it { is_expected.to run.with_params(' one').and_return('one') } + it { is_expected.to run.with_params(' one').and_return('one') } + it { is_expected.to run.with_params("\tone").and_return('one') } + it { is_expected.to run.with_params("\t one").and_return('one') } + it { is_expected.to run.with_params('one ').and_return('one ') } + it { is_expected.to run.with_params(' one ').and_return('one ') } + it { is_expected.to run.with_params(' one ').and_return('one ') } + it { is_expected.to run.with_params(' ǿňè ').and_return('ǿňè ') } + it { is_expected.to run.with_params("\tone ").and_return('one ') } + it { is_expected.to run.with_params("\t one ").and_return('one ') } + it { is_expected.to run.with_params("one \t").and_return("one \t") } + it { is_expected.to run.with_params(" one \t").and_return("one \t") } + it { is_expected.to run.with_params(" one \t").and_return("one \t") } + it { is_expected.to run.with_params("\tone \t").and_return("one \t") } + it { is_expected.to run.with_params("\t one \t").and_return("one \t") } + it { is_expected.to run.with_params(' o n e ').and_return('o n e ') } + it { is_expected.to run.with_params(AlsoString.new(' one ')).and_return('one ') } +end diff --git a/environments/production/modules/stdlib/spec/functions/max_spec.rb b/environments/production/modules/stdlib/spec/functions/max_spec.rb new file mode 100755 index 0000000..66fb0c8 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/max_spec.rb @@ -0,0 +1,21 @@ +require 'spec_helper' + +describe 'max' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_return(1) } + it { is_expected.to run.with_params(1, 2).and_return(2) } + it { is_expected.to run.with_params(1, 2, 3).and_return(3) } + it { is_expected.to run.with_params(3, 2, 1).and_return(3) } + it { is_expected.to run.with_params('one').and_return('one') } + it { is_expected.to run.with_params('one', 'two').and_return('two') } + it { is_expected.to run.with_params('one', 'two', 'three').and_return('two') } + it { is_expected.to run.with_params('three', 'two', 'one').and_return('two') } + + describe 'implementation artifacts' do + it { is_expected.to run.with_params(1, 'one').and_return('one') } + it { is_expected.to run.with_params('1', 'one').and_return('one') } + it { is_expected.to run.with_params('1.3e1', '1.4e0').and_return('1.4e0') } + it { is_expected.to run.with_params(1.3e1, 1.4e0).and_return(1.3e1) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/member_spec.rb b/environments/production/modules/stdlib/spec/functions/member_spec.rb new file mode 100755 index 0000000..8988632 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/member_spec.rb @@ -0,0 +1,23 @@ +require 'spec_helper' + +describe 'member' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], [], []).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params([], '').and_return(false) } + it { is_expected.to run.with_params([], ['']).and_return(false) } + it { is_expected.to run.with_params([''], '').and_return(true) } + it { is_expected.to run.with_params([''], ['']).and_return(true) } + it { is_expected.to run.with_params([], 'one').and_return(false) } + it { is_expected.to run.with_params([], ['one']).and_return(false) } + it { is_expected.to run.with_params(['one'], 'one').and_return(true) } + it { is_expected.to run.with_params(['one'], ['one']).and_return(true) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'four'], ['four', 'two']).and_return(true) } + it { is_expected.to run.with_params(['ọאּẹ', 'ŧẅồ', 'ţҺŗęē', 'ƒơџŕ'], ['ƒơџŕ', 'ŧẅồ']).and_return(true) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'four'], ['four', 'five']).and_return(false) } + it { is_expected.to run.with_params(['ọאּẹ', 'ŧẅồ', 'ţҺŗęē', 'ƒơџŕ'], ['ƒơџŕ', 'ƒί√ə']).and_return(false) } +end diff --git a/environments/production/modules/stdlib/spec/functions/merge_spec.rb b/environments/production/modules/stdlib/spec/functions/merge_spec.rb new file mode 100755 index 0000000..7b53363 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/merge_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' + +describe 'merge' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params({}, 'two').and_raise_error(Puppet::ParseError, /unexpected argument type String/) } + it { is_expected.to run.with_params({}, 1).and_raise_error(Puppet::ParseError, /unexpected argument type Fixnum/) } + it { + pending 'should not special case this' + is_expected.to run.with_params({}).and_return({}) + } + it { is_expected.to run.with_params({}, {}).and_return({}) } + it { is_expected.to run.with_params({}, {}, {}).and_return({}) } + describe 'should accept empty strings as puppet undef' do + it { is_expected.to run.with_params({}, '').and_return({}) } + end + it { is_expected.to run.with_params({ 'key' => 'value' }, {}).and_return({ 'key' => 'value' }) } + it { is_expected.to run.with_params({}, { 'key' => 'value' }).and_return({ 'key' => 'value' }) } + it { is_expected.to run.with_params({ 'key' => 'value1' }, { 'key' => 'value2' }).and_return({ 'key' => 'value2' }) } + it { + is_expected.to run \ + .with_params({ 'key1' => 'value1' }, { 'key2' => 'value2' }, { 'key3' => 'value3' }) \ + .and_return({ 'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3' }) + } +end diff --git a/environments/production/modules/stdlib/spec/functions/min_spec.rb b/environments/production/modules/stdlib/spec/functions/min_spec.rb new file mode 100755 index 0000000..c840a72 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/min_spec.rb @@ -0,0 +1,21 @@ +require 'spec_helper' + +describe 'min' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_return(1) } + it { is_expected.to run.with_params(1, 2).and_return(1) } + it { is_expected.to run.with_params(1, 2, 3).and_return(1) } + it { is_expected.to run.with_params(3, 2, 1).and_return(1) } + it { is_expected.to run.with_params('one').and_return('one') } + it { is_expected.to run.with_params('one', 'two').and_return('one') } + it { is_expected.to run.with_params('one', 'two', 'three').and_return('one') } + it { is_expected.to run.with_params('three', 'two', 'one').and_return('one') } + + describe 'implementation artifacts' do + it { is_expected.to run.with_params(1, 'one').and_return(1) } + it { is_expected.to run.with_params('1', 'one').and_return('1') } + it { is_expected.to run.with_params('1.3e1', '1.4e0').and_return('1.3e1') } + it { is_expected.to run.with_params(1.3e1, 1.4e0).and_return(1.4e0) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/num2bool_spec.rb b/environments/production/modules/stdlib/spec/functions/num2bool_spec.rb new file mode 100755 index 0000000..494afff --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/num2bool_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' + +describe 'num2bool' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1, 2).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('abc').and_raise_error(Puppet::ParseError, /does not look like a number/) } + it { is_expected.to run.with_params(1).and_return(true) } + it { is_expected.to run.with_params('1').and_return(true) } + it { is_expected.to run.with_params(1.5).and_return(true) } + it { is_expected.to run.with_params('1.5').and_return(true) } + it { is_expected.to run.with_params(-1).and_return(false) } + it { is_expected.to run.with_params('-1').and_return(false) } + it { is_expected.to run.with_params(-1.5).and_return(false) } + it { is_expected.to run.with_params('-1.5').and_return(false) } + it { is_expected.to run.with_params(0).and_return(false) } + it { is_expected.to run.with_params('0').and_return(false) } + it { is_expected.to run.with_params([]).and_return(false) } + it { is_expected.to run.with_params('[]').and_raise_error(Puppet::ParseError, /does not look like a number/) } + it { is_expected.to run.with_params({}).and_return(false) } + it { is_expected.to run.with_params('{}').and_raise_error(Puppet::ParseError, /does not look like a number/) } +end diff --git a/environments/production/modules/stdlib/spec/functions/parsejson_spec.rb b/environments/production/modules/stdlib/spec/functions/parsejson_spec.rb new file mode 100755 index 0000000..7b07e49 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/parsejson_spec.rb @@ -0,0 +1,69 @@ +require 'spec_helper' + +describe 'parsejson' do + it 'should exist' do + is_expected.not_to eq(nil) + end + + it 'should raise an error if called without any arguments' do + is_expected.to run.with_params(). + and_raise_error(/wrong number of arguments/i) + end + + context 'with correct JSON data' do + + it 'should be able to parse JSON data with a Hash' do + is_expected.to run.with_params('{"a":"1","b":"2"}'). + and_return({'a'=>'1', 'b'=>'2'}) + end + + it 'should be able to parse JSON data with an Array' do + is_expected.to run.with_params('["a","b","c"]'). + and_return(['a', 'b', 'c']) + end + + it 'should be able to parse empty JSON values' do + is_expected.to run.with_params('[]'). + and_return([]) + is_expected.to run.with_params('{}'). + and_return({}) + end + + it 'should be able to parse JSON data with a mixed structure' do + is_expected.to run.with_params('{"a":"1","b":2,"c":{"d":[true,false]}}'). + and_return({'a' =>'1', 'b' => 2, 'c' => { 'd' => [true, false] } }) + end + + it 'should be able to parse JSON data with a UTF8 and double byte characters' do + is_expected.to run.with_params('{"×":"これ","ý":"記号","です":{"©":["Á","ß"]}}'). + and_return({'×' =>'これ', 'ý' => '記号', 'です' => { '©' => ['Á', 'ß'] } }) + end + + it 'should not return the default value if the data was parsed correctly' do + is_expected.to run.with_params('{"a":"1"}', 'default_value'). + and_return({'a' => '1'}) + end + + end + + context 'with incorrect JSON data' do + it 'should raise an error with invalid JSON and no default' do + is_expected.to run.with_params(''). + and_raise_error(PSON::ParserError) + end + + it 'should support a structure for a default value' do + is_expected.to run.with_params('', {'a' => '1'}). + and_return({'a' => '1'}) + end + + ['', 1, 1.2, nil, true, false, [], {}, :yaml].each do |value| + it "should return the default value for an incorrect #{value.inspect} (#{value.class}) parameter" do + is_expected.to run.with_params(value, 'default_value'). + and_return('default_value') + end + end + + end + +end diff --git a/environments/production/modules/stdlib/spec/functions/parseyaml_spec.rb b/environments/production/modules/stdlib/spec/functions/parseyaml_spec.rb new file mode 100755 index 0000000..c2a138c --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/parseyaml_spec.rb @@ -0,0 +1,86 @@ +require 'spec_helper' + +describe 'parseyaml' do + it 'should exist' do + is_expected.not_to eq(nil) + end + + it 'should raise an error if called without any arguments' do + is_expected.to run.with_params(). + and_raise_error(/wrong number of arguments/i) + end + + context 'with correct YAML data' do + it 'should be able to parse a YAML data with a String' do + is_expected.to run.with_params('--- just a string'). + and_return('just a string') + is_expected.to run.with_params('just a string'). + and_return('just a string') + end + + it 'should be able to parse YAML data with a Hash' do + is_expected.to run.with_params("---\na: '1'\nb: '2'\n"). + and_return({'a' => '1', 'b' => '2'}) + end + + it 'should be able to parse YAML data with an Array' do + is_expected.to run.with_params("---\n- a\n- b\n- c\n"). + and_return(['a', 'b', 'c']) + end + + it 'should be able to parse YAML data with a mixed structure' do + is_expected.to run.with_params("---\na: '1'\nb: 2\nc:\n d:\n - :a\n - true\n - false\n"). + and_return({'a' => '1', 'b' => 2, 'c' => {'d' => [:a, true, false]}}) + end + + it 'should be able to parse YAML data with a UTF8 and double byte characters' do + is_expected.to run.with_params("---\na: ×\nこれ: 記号\nです:\n ©:\n - Á\n - ß\n"). + and_return({"a"=>"×", "これ"=>"記号", "です"=>{"©"=>["Á", "ß"]} }) + end + + it 'should not return the default value if the data was parsed correctly' do + is_expected.to run.with_params("---\na: '1'\n", 'default_value'). + and_return({'a' => '1'}) + end + + end + + context 'on a modern ruby', :unless => RUBY_VERSION == '1.8.7' do + it 'should raise an error with invalid YAML and no default' do + is_expected.to run.with_params('["one"'). + and_raise_error(Psych::SyntaxError) + end + end + + context 'when running on ruby 1.8.7, which does not have Psych', :if => RUBY_VERSION == '1.8.7' do + it 'should raise an error with invalid YAML and no default' do + is_expected.to run.with_params('["one"'). + and_raise_error(ArgumentError) + end + end + + context 'with incorrect YAML data' do + it 'should support a structure for a default value' do + is_expected.to run.with_params('', {'a' => '1'}). + and_return({'a' => '1'}) + end + + [1, 1.2, nil, true, false, [], {}, :yaml].each do |value| + it "should return the default value for an incorrect #{value.inspect} (#{value.class}) parameter" do + is_expected.to run.with_params(value, 'default_value'). + and_return('default_value') + end + end + + context 'when running on modern rubies', :unless => RUBY_VERSION == '1.8.7' do + ['---', '...', '*8', ''].each do |value| + it "should return the default value for an incorrect #{value.inspect} string parameter" do + is_expected.to run.with_params(value, 'default_value'). + and_return('default_value') + end + end + end + + end + +end diff --git a/environments/production/modules/stdlib/spec/functions/pick_default_spec.rb b/environments/production/modules/stdlib/spec/functions/pick_default_spec.rb new file mode 100755 index 0000000..a7ffc86 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/pick_default_spec.rb @@ -0,0 +1,26 @@ +require 'spec_helper' + +describe 'pick_default' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::Error, /Must receive at least one argument/) } + + it { is_expected.to run.with_params('one', 'two').and_return('one') } + it { is_expected.to run.with_params('ớņệ', 'ťωơ').and_return('ớņệ') } + it { is_expected.to run.with_params('', 'two').and_return('two') } + it { is_expected.to run.with_params(:undef, 'two').and_return('two') } + it { is_expected.to run.with_params(:undefined, 'two').and_return('two') } + it { is_expected.to run.with_params(nil, 'two').and_return('two') } + + [ '', :undef, :undefined, nil, {}, [], 1, 'default' ].each do |value| + describe "when providing #{value.inspect} as default" do + it { is_expected.to run.with_params('one', value).and_return('one') } + it { is_expected.to run.with_params('ớņệ', value).and_return('ớņệ') } + it { is_expected.to run.with_params([], value).and_return([]) } + it { is_expected.to run.with_params({}, value).and_return({}) } + it { is_expected.to run.with_params(value, value).and_return(value) } + it { is_expected.to run.with_params(:undef, value).and_return(value) } + it { is_expected.to run.with_params(:undefined, value).and_return(value) } + it { is_expected.to run.with_params(nil, value).and_return(value) } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/pick_spec.rb b/environments/production/modules/stdlib/spec/functions/pick_spec.rb new file mode 100755 index 0000000..438553b --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/pick_spec.rb @@ -0,0 +1,17 @@ +require 'spec_helper' + +describe 'pick' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /must receive at least one non empty value/) } + it { is_expected.to run.with_params('', nil, :undef, :undefined).and_raise_error(Puppet::ParseError, /must receive at least one non empty value/) } + it { is_expected.to run.with_params('one', 'two').and_return('one') } + it { is_expected.to run.with_params('', 'two').and_return('two') } + it { is_expected.to run.with_params(:undef, 'two').and_return('two') } + it { is_expected.to run.with_params(:undefined, 'two').and_return('two') } + it { is_expected.to run.with_params(nil, 'two').and_return('two') } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params(nil, 'このテキスト').and_return('このテキスト') } + it { is_expected.to run.with_params('', 'ŝẳмрłề џţƒ8 ţẽם', 'このテキスト').and_return('ŝẳмрłề џţƒ8 ţẽם') } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/prefix_spec.rb b/environments/production/modules/stdlib/spec/functions/prefix_spec.rb new file mode 100755 index 0000000..5510c58 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/prefix_spec.rb @@ -0,0 +1,29 @@ +require 'spec_helper' + +describe 'prefix' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the second.") + is_expected.to run.with_params([], 'a', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /expected first argument to be an Array or a Hash/) } + it { is_expected.to run.with_params([], 2).and_raise_error(Puppet::ParseError, /expected second argument to be a String/) } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['one', 2]).and_return(['one', '2']) } + it { is_expected.to run.with_params(['ớņệ', 2]).and_return(['ớņệ', '2']) } + it { is_expected.to run.with_params([], '').and_return([]) } + it { is_expected.to run.with_params([''], '').and_return(['']) } + it { is_expected.to run.with_params(['one'], 'pre').and_return(['preone']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'pre').and_return(['preone', 'pretwo', 'prethree']) } + it { is_expected.to run.with_params({}).and_return({}) } + it { is_expected.to run.with_params({ 'key1' => 'value1', 2 => 3}).and_return({ 'key1' => 'value1', '2' => 3 }) } + it { is_expected.to run.with_params({}, '').and_return({}) } + it { is_expected.to run.with_params({ 'key' => 'value' }, '').and_return({ 'key' => 'value' }) } + it { is_expected.to run.with_params({ 'key' => 'value' }, 'pre').and_return({ 'prekey' => 'value' }) } + it { + is_expected.to run \ + .with_params({ 'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3' }, 'pre') \ + .and_return({ 'prekey1' => 'value1', 'prekey2' => 'value2', 'prekey3' => 'value3' }) + } +end diff --git a/environments/production/modules/stdlib/spec/functions/private_spec.rb b/environments/production/modules/stdlib/spec/functions/private_spec.rb new file mode 100644 index 0000000..a13be64 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/private_spec.rb @@ -0,0 +1,56 @@ +require 'spec_helper' + +describe 'private' do + it 'should issue a warning' do + scope.expects(:warning).with("private() DEPRECATED: This function will cease to function on Puppet 4; please use assert_private() before upgrading to puppet 4 for backwards-compatibility, or migrate to the new parser's typing system.") + begin + subject.call [] + rescue + # ignore this + end + end + + context "when called from inside module" do + it "should not fail" do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('foo') + expect { + subject.call [] + }.not_to raise_error + end + end + + context "with an explicit failure message" do + it "prints the failure message on error" do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('bar') + expect { + subject.call ['failure message!'] + }.to raise_error Puppet::ParseError, /failure message!/ + end + end + + context "when called from private class" do + it "should fail with a class error message" do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('bar') + scope.source.expects(:name).returns('foo::baz') + scope.source.expects(:type).returns('hostclass') + expect { + subject.call [] + }.to raise_error Puppet::ParseError, /Class foo::baz is private/ + end + end + + context "when called from private definition" do + it "should fail with a class error message" do + scope.expects(:lookupvar).with('module_name').returns('foo') + scope.expects(:lookupvar).with('caller_module_name').returns('bar') + scope.source.expects(:name).returns('foo::baz') + scope.source.expects(:type).returns('definition') + expect { + subject.call [] + }.to raise_error Puppet::ParseError, /Definition foo::baz is private/ + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/pw_hash_spec.rb b/environments/production/modules/stdlib/spec/functions/pw_hash_spec.rb new file mode 100644 index 0000000..df5348c --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/pw_hash_spec.rb @@ -0,0 +1,69 @@ +require 'spec_helper' + +describe 'pw_hash' do + + it { is_expected.not_to eq(nil) } + + context 'when there are less than 3 arguments' do + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('password').and_raise_error(ArgumentError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('password', 'sha-256').and_raise_error(ArgumentError, /wrong number of arguments/i) } + end + + context 'when there are more than 3 arguments' do + it { is_expected.to run.with_params('password', 'sha-256', 'salt', 'extra').and_raise_error(ArgumentError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('password', 'sha-256', 'salt', 'extra', 'extra').and_raise_error(ArgumentError, /wrong number of arguments/i) } + end + + context 'when the first argument is not a string' do + it { is_expected.to run.with_params([], 'sha-256', 'salt').and_raise_error(ArgumentError, /first argument must be a string/) } + it { is_expected.to run.with_params({}, 'sha-256', 'salt').and_raise_error(ArgumentError, /first argument must be a string/) } + it { is_expected.to run.with_params(1, 'sha-256', 'salt').and_raise_error(ArgumentError, /first argument must be a string/) } + it { is_expected.to run.with_params(true, 'sha-256', 'salt').and_raise_error(ArgumentError, /first argument must be a string/) } + end + + context 'when the first argument is undefined' do + it { is_expected.to run.with_params('', 'sha-256', 'salt').and_return(nil) } + it { is_expected.to run.with_params(nil, 'sha-256', 'salt').and_return(nil) } + end + + context 'when the second argument is not a string' do + it { is_expected.to run.with_params('password', [], 'salt').and_raise_error(ArgumentError, /second argument must be a string/) } + it { is_expected.to run.with_params('password', {}, 'salt').and_raise_error(ArgumentError, /second argument must be a string/) } + it { is_expected.to run.with_params('password', 1, 'salt').and_raise_error(ArgumentError, /second argument must be a string/) } + it { is_expected.to run.with_params('password', true, 'salt').and_raise_error(ArgumentError, /second argument must be a string/) } + end + + context 'when the second argument is not one of the supported hashing algorithms' do + it { is_expected.to run.with_params('password', 'no such algo', 'salt').and_raise_error(ArgumentError, /is not a valid hash type/) } + end + + context 'when the third argument is not a string' do + it { is_expected.to run.with_params('password', 'sha-256', []).and_raise_error(ArgumentError, /third argument must be a string/) } + it { is_expected.to run.with_params('password', 'sha-256', {}).and_raise_error(ArgumentError, /third argument must be a string/) } + it { is_expected.to run.with_params('password', 'sha-256', 1).and_raise_error(ArgumentError, /third argument must be a string/) } + it { is_expected.to run.with_params('password', 'sha-256', true).and_raise_error(ArgumentError, /third argument must be a string/) } + end + + context 'when the third argument is empty' do + it { is_expected.to run.with_params('password', 'sha-512', '').and_raise_error(ArgumentError, /third argument must not be empty/) } + end + + context 'when the third argument contains invalid characters' do + it { is_expected.to run.with_params('password', 'sha-512', 'one%').and_raise_error(ArgumentError, /characters in salt must be in the set/) } + end + + context 'when running on a platform with a weak String#crypt implementation' do + before(:each) { allow_any_instance_of(String).to receive(:crypt).with('$1$1').and_return('a bad hash') } + + it { is_expected.to run.with_params('password', 'sha-512', 'salt').and_raise_error(Puppet::ParseError, /system does not support enhanced salts/) } + end + + if RUBY_PLATFORM == 'java' or 'test'.crypt('$1$1') == '$1$1$Bp8CU9Oujr9SSEw53WV6G.' + describe "on systems with enhanced salts support" do + it { is_expected.to run.with_params('password', 'md5', 'salt').and_return('$1$salt$qJH7.N4xYta3aEG/dfqo/0') } + it { is_expected.to run.with_params('password', 'sha-256', 'salt').and_return('$5$salt$Gcm6FsVtF/Qa77ZKD.iwsJlCVPY0XSMgLJL0Hnww/c1') } + it { is_expected.to run.with_params('password', 'sha-512', 'salt').and_return('$6$salt$IxDD3jeSOb5eB1CX5LBsqZFVkJdido3OUILO5Ifz5iwMuTS4XMS130MTSuDDl3aCI6WouIL9AjRbLCelDCy.g.') } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/range_spec.rb b/environments/production/modules/stdlib/spec/functions/range_spec.rb new file mode 100755 index 0000000..ca569d5 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/range_spec.rb @@ -0,0 +1,126 @@ +require 'spec_helper' + +describe 'range' do + it { is_expected.not_to eq(nil) } + + describe 'signature validation in puppet3', :unless => RSpec.configuration.puppet_future do + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the third.") + is_expected.to run.with_params(1, 2, 3, 4).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params('1..2..3').and_raise_error(Puppet::ParseError, /Unable to compute range/i) } + it { is_expected.to run.with_params('').and_raise_error(Puppet::ParseError, /Unknown range format/i) } + end + + describe 'signature validation in puppet4', :if => RSpec.configuration.puppet_future do + it { pending "the puppet 4 implementation"; is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params('').and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params({}).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params([]).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(true).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(true).and_raise_error(ArgumentError) } + it { is_expected.to run.with_params(1, 2, 'foo').and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(1, 2, []).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(1, 2, {}).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(1, 2, true).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params(1, 2, 3, 4).and_raise_error(ArgumentError) } + it { pending "the puppet 4 implementation"; is_expected.to run.with_params('1..2..3').and_raise_error(ArgumentError) } + end + + context 'with characters as bounds' do + it { is_expected.to run.with_params('d', 'a').and_return([]) } + it { is_expected.to run.with_params('a', 'a').and_return(['a']) } + it { is_expected.to run.with_params('a', 'b').and_return(['a', 'b']) } + it { is_expected.to run.with_params('a', 'd').and_return(['a', 'b', 'c', 'd']) } + it { is_expected.to run.with_params('a', 'd', 1).and_return(['a', 'b', 'c', 'd']) } + it { is_expected.to run.with_params('a', 'd', '1').and_return(['a', 'b', 'c', 'd']) } + it { is_expected.to run.with_params('a', 'd', 2).and_return(['a', 'c']) } + it { is_expected.to run.with_params('a', 'd', -2).and_return(['a', 'c']) } + it { is_expected.to run.with_params('a', 'd', 3).and_return(['a', 'd']) } + it { is_expected.to run.with_params('a', 'd', 4).and_return(['a']) } + end + + context 'with strings as bounds' do + it { is_expected.to run.with_params('onea', 'oned').and_return(['onea', 'oneb', 'onec', 'oned']) } + it { is_expected.to run.with_params('two', 'one').and_return([]) } + it { is_expected.to run.with_params('true', 'false').and_return([]) } + it { is_expected.to run.with_params('false', 'true').and_return(['false']) } + end + + context 'with integers as bounds' do + it { is_expected.to run.with_params(4, 1).and_return([]) } + it { is_expected.to run.with_params(1, 1).and_return([1]) } + it { is_expected.to run.with_params(1, 2).and_return([1, 2]) } + it { is_expected.to run.with_params(1, 4).and_return([1, 2, 3, 4]) } + it { is_expected.to run.with_params(1, 4, 1).and_return([1, 2, 3, 4]) } + it { is_expected.to run.with_params(1, 4, '1').and_return([1, 2, 3, 4]) } + it { is_expected.to run.with_params(1, 4, 2).and_return([1, 3]) } + it { is_expected.to run.with_params(1, 4, -2).and_return([1, 3]) } + it { is_expected.to run.with_params(1, 4, 3).and_return([1, 4]) } + it { is_expected.to run.with_params(1, 4, 4).and_return([1]) } + end + + context 'with integers as strings as bounds' do + it { is_expected.to run.with_params('4', '1').and_return([]) } + it { is_expected.to run.with_params('1', '1').and_return([1]) } + it { is_expected.to run.with_params('1', '2').and_return([1, 2]) } + it { is_expected.to run.with_params('1', '4').and_return([1, 2, 3, 4]) } + it { is_expected.to run.with_params('1', '4', 1).and_return([1, 2, 3, 4]) } + it { is_expected.to run.with_params('1', '4', '1').and_return([1, 2, 3, 4]) } + it { is_expected.to run.with_params('1', '4', 2).and_return([1, 3]) } + it { is_expected.to run.with_params('1', '4', -2).and_return([1, 3]) } + it { is_expected.to run.with_params('1', '4', 3).and_return([1, 4]) } + it { is_expected.to run.with_params('1', '4', 4).and_return([1]) } + end + + context 'with prefixed numbers as strings as bounds' do + it { is_expected.to run.with_params('host01', 'host04').and_return(['host01', 'host02', 'host03', 'host04']) } + it { is_expected.to run.with_params('01', '04').and_return([1, 2, 3, 4]) } + end + + context 'with prefixed numbers as utf8 strings as bounds' do + it { is_expected.to run.with_params('ħөŝŧ01', 'ħөŝŧ04').and_return(['ħөŝŧ01', 'ħөŝŧ02', 'ħөŝŧ03', 'ħөŝŧ04']) } + end + + context 'with prefixed numbers as double byte character strings as bounds' do + it { is_expected.to run.with_params('ホスト01', 'ホスト04').and_return(['ホスト01', 'ホスト02', 'ホスト03', 'ホスト04']) } + end + + context 'with dash-range syntax' do + it { is_expected.to run.with_params('4-1').and_return([]) } + it { is_expected.to run.with_params('1-1').and_return([1]) } + it { is_expected.to run.with_params('1-2').and_return([1, 2]) } + it { is_expected.to run.with_params('1-4').and_return([1, 2, 3, 4]) } + end + + context 'with two-dot-range syntax' do + it { is_expected.to run.with_params('4..1').and_return([]) } + it { is_expected.to run.with_params('1..1').and_return([1]) } + it { is_expected.to run.with_params('1..2').and_return([1, 2]) } + it { is_expected.to run.with_params('1..4').and_return([1, 2, 3, 4]) } + end + + context 'with three-dot-range syntax' do + it { is_expected.to run.with_params('4...1').and_return([]) } + it { is_expected.to run.with_params('1...1').and_return([]) } + it { is_expected.to run.with_params('1...2').and_return([1]) } + it { is_expected.to run.with_params('1...3').and_return([1, 2]) } + it { is_expected.to run.with_params('1...5').and_return([1, 2, 3, 4]) } + end + + describe 'when passing mixed arguments as bounds' do + it { + pending('these bounds should not be allowed as ruby will OOM hard. e.g. `(\'host0\'..\'hosta\').to_a` has 3239930 elements on ruby 1.9, adding more \'0\'s and \'a\'s increases that exponentially') + is_expected.to run.with_params('0', 'a').and_raise_error(Puppet::ParseError, /cannot interpolate between numeric and non-numeric bounds/) + } + it { + pending('these bounds should not be allowed as ruby will OOM hard. e.g. `(\'host0\'..\'hosta\').to_a` has 3239930 elements on ruby 1.9, adding more \'0\'s and \'a\'s increases that exponentially') + is_expected.to run.with_params(0, 'a').and_raise_error(Puppet::ParseError, /cannot interpolate between numeric and non-numeric bounds/) + } + it { + pending('these bounds should not be allowed as ruby will OOM hard. e.g. `(\'host0\'..\'hosta\').to_a` has 3239930 elements on ruby 1.9, adding more \'0\'s and \'a\'s increases that exponentially') + is_expected.to run.with_params('h0', 'ha').and_raise_error(Puppet::ParseError, /cannot interpolate between numeric and non-numeric bounds/) + } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/regexpescape_spec.rb b/environments/production/modules/stdlib/spec/functions/regexpescape_spec.rb new file mode 100644 index 0000000..36dbe70 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/regexpescape_spec.rb @@ -0,0 +1,41 @@ +require 'spec_helper' + +describe 'regexpescape' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + end + + describe 'handling normal strings' do + it 'should call ruby\'s Regexp.escape function' do + Regexp.expects(:escape).with('regexp_string').returns('escaped_regexp_string').once + is_expected.to run.with_params('regexp_string').and_return('escaped_regexp_string') + end + end + + describe 'handling classes derived from String' do + it 'should call ruby\'s Regexp.escape function' do + regexp_string = AlsoString.new('regexp_string') + Regexp.expects(:escape).with(regexp_string).returns('escaped_regexp_string').once + is_expected.to run.with_params(regexp_string).and_return("escaped_regexp_string") + end + end + + describe 'strings in arrays handling' do + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['one*', "two"]).and_return(['one\*', "two"]) } + it { is_expected.to run.with_params(['one*', 1, true, {}, "two"]).and_return(['one\*', 1, true, {}, "two"]) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params(['ŏʼnε*']).and_return(['ŏʼnε\*']) } + it { is_expected.to run.with_params(['インターネット*']).and_return(['インターネット\*']) } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/reject_spec.rb b/environments/production/modules/stdlib/spec/functions/reject_spec.rb new file mode 100755 index 0000000..86db7c7 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/reject_spec.rb @@ -0,0 +1,20 @@ +require 'spec_helper' + +describe 'reject' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([], 'pattern', 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + it { + pending("reject does not actually check this, and raises NoMethodError instead") + is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /first argument not an array/) + } + it { + pending("reject does not actually check this, and raises NoMethodError instead") + is_expected.to run.with_params(1, 'two').and_raise_error(Puppet::ParseError, /first argument not an array/) + } + it { is_expected.to run.with_params([], 'two').and_return([]) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'two').and_return(['one', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 't(wo|hree)').and_return(['one']) } + it { is_expected.to run.with_params(['όʼnệ', 'ţщồ', 'ţңяέέ'], 'ţ(щồ|ңяέέ)').and_return(['όʼnệ']) } +end diff --git a/environments/production/modules/stdlib/spec/functions/reverse_spec.rb b/environments/production/modules/stdlib/spec/functions/reverse_spec.rb new file mode 100755 index 0000000..79bc0ad --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/reverse_spec.rb @@ -0,0 +1,33 @@ +require 'spec_helper' + +describe 'reverse' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['a']).and_return(['a']) } + it { is_expected.to run.with_params(['one']).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two', 'three']).and_return(['three', 'two', 'one']) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'four']).and_return(['four', 'three', 'two', 'one']) } + it { is_expected.to run.with_params(['ổňë', 'ťŵọ', 'ŧңяəė', 'ƒŏůŗ']).and_return(['ƒŏůŗ', 'ŧңяəė', 'ťŵọ', 'ổňë']) } + + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('a').and_return('a') } + it { is_expected.to run.with_params('abc').and_return('cba') } + it { is_expected.to run.with_params('abcd').and_return('dcba') } + it { is_expected.to run.with_params('āβćđ').and_return('đćβā') } + + context 'when using a class extending String' do + it 'should call its reverse method' do + value = AlsoString.new('asdfghjkl') + value.expects(:reverse).returns('foo') + expect(subject).to run.with_params(value).and_return('foo') + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/rstrip_spec.rb b/environments/production/modules/stdlib/spec/functions/rstrip_spec.rb new file mode 100755 index 0000000..a7663e2 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/rstrip_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'rstrip' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params(' ').and_return('') } + it { is_expected.to run.with_params(' ').and_return('') } + it { is_expected.to run.with_params("\t").and_return('') } + it { is_expected.to run.with_params("\t ").and_return('') } + it { is_expected.to run.with_params('one').and_return('one') } + it { is_expected.to run.with_params(' one').and_return(' one') } + it { is_expected.to run.with_params(' one').and_return(' one') } + it { is_expected.to run.with_params("\tone").and_return("\tone") } + it { is_expected.to run.with_params("\t one").and_return("\t one") } + it { is_expected.to run.with_params('one ').and_return('one') } + it { is_expected.to run.with_params(' one ').and_return(' one') } + it { is_expected.to run.with_params(' one ').and_return(' one') } + it { is_expected.to run.with_params(' ǿňè ').and_return(' ǿňè') } + it { is_expected.to run.with_params("\tone ").and_return("\tone") } + it { is_expected.to run.with_params("\t one ").and_return("\t one") } + it { is_expected.to run.with_params("one\t").and_return('one') } + it { is_expected.to run.with_params(" one\t").and_return(' one') } + it { is_expected.to run.with_params(" one\t").and_return(' one') } + it { is_expected.to run.with_params("\tone\t").and_return("\tone") } + it { is_expected.to run.with_params("\t one\t").and_return("\t one") } + it { is_expected.to run.with_params(' o n e ').and_return(' o n e') } + it { is_expected.to run.with_params(AlsoString.new(' one ')).and_return(' one') } +end diff --git a/environments/production/modules/stdlib/spec/functions/seeded_rand_spec.rb b/environments/production/modules/stdlib/spec/functions/seeded_rand_spec.rb new file mode 100644 index 0000000..ac108f4 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/seeded_rand_spec.rb @@ -0,0 +1,58 @@ +require 'spec_helper' + +describe 'seeded_rand' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_raise_error(ArgumentError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(0, '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params(1.5, '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params(-10, '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params("-10", '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params("string", '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params([], '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params({}, '').and_raise_error(ArgumentError, /first argument must be a positive integer/) } + it { is_expected.to run.with_params(1, 1).and_raise_error(ArgumentError, /second argument must be a string/) } + it { is_expected.to run.with_params(1, []).and_raise_error(ArgumentError, /second argument must be a string/) } + it { is_expected.to run.with_params(1, {}).and_raise_error(ArgumentError, /second argument must be a string/) } + + it "provides a random number strictly less than the given max" do + expect(seeded_rand(3, 'seed')).to satisfy {|n| n.to_i < 3 } + end + + it "provides a random number greater or equal to zero" do + expect(seeded_rand(3, 'seed')).to satisfy {|n| n.to_i >= 0 } + end + + it "provides the same 'random' value on subsequent calls for the same host" do + expect(seeded_rand(10, 'seed')).to eql(seeded_rand(10, 'seed')) + end + + it "allows seed to control the random value on a single host" do + first_random = seeded_rand(1000, 'seed1') + second_different_random = seeded_rand(1000, 'seed2') + + expect(first_random).not_to eql(second_different_random) + end + + it "should not return different values for different hosts" do + val1 = seeded_rand(1000, 'foo', :host => "first.host.com") + val2 = seeded_rand(1000, 'foo', :host => "second.host.com") + + expect(val1).to eql(val2) + end + + def seeded_rand(max, seed, args = {}) + host = args[:host] || '127.0.0.1' + + # workaround not being able to use let(:facts) because some tests need + # multiple different hostnames in one context + scope.stubs(:lookupvar).with("::fqdn", {}).returns(host) + + scope.function_seeded_rand([max, seed]) + end + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params(1000, 'ǿňè')} + it { is_expected.to run.with_params(1000, '文字列')} + end +end diff --git a/environments/production/modules/stdlib/spec/functions/shell_escape_spec.rb b/environments/production/modules/stdlib/spec/functions/shell_escape_spec.rb new file mode 100644 index 0000000..77917dd --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/shell_escape_spec.rb @@ -0,0 +1,27 @@ +require 'spec_helper' + +describe 'shell_escape' do + it { is_expected.not_to eq(nil) } + + describe 'signature validation' do + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('foo', 'bar').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + describe 'stringification' do + it { is_expected.to run.with_params(10).and_return('10') } + it { is_expected.to run.with_params(false).and_return('false') } + end + + describe 'escaping' do + it { is_expected.to run.with_params('foo').and_return('foo') } + it { is_expected.to run.with_params('foo bar').and_return('foo\ bar') } + it { is_expected.to run.with_params('~`!@#$%^&*()_+-=[]\{}|;\':",./<>?') + .and_return('\~\`\!@\#\$\%\^\&\*\(\)_\+-\=\[\]\\\\\{\}\|\;\\\':\",./\<\>\?') } + end + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('スペー スを含むテ キスト').and_return('\\ス\\ペ\\ー\\ \\ス\\を\\含\\む\\テ\\ \\ \\キ\\ス\\ト') } + it { is_expected.to run.with_params('μťƒ 8 ŧĕχť').and_return('\\μ\\ť\\ƒ\\ 8\\ \\ \\ŧ\\ĕ\\χ\\ť') } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/shell_join_spec.rb b/environments/production/modules/stdlib/spec/functions/shell_join_spec.rb new file mode 100644 index 0000000..46305bf --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/shell_join_spec.rb @@ -0,0 +1,28 @@ +require 'spec_helper' + +describe 'shell_join' do + it { is_expected.not_to eq(nil) } + + describe 'signature validation' do + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(['foo'], ['bar']).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('foo').and_raise_error(Puppet::ParseError, /is not an Array/i) } + end + + describe 'shell argument joining' do + it { is_expected.to run.with_params(['foo']).and_return('foo') } + it { is_expected.to run.with_params(['foo', 'bar']).and_return('foo bar') } + it { is_expected.to run.with_params(['foo', 'bar baz']).and_return('foo bar\ baz') } + it { is_expected.to run.with_params(['~`!@#$', '%^&*()_+-=', '[]\{}|;\':"', ',./<>?']) + .and_return('\~\`\!@\#\$ \%\^\&\*\(\)_\+-\= \[\]\\\\\{\}\|\;\\\':\" ,./\<\>\?') } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params(['μťƒ', '8', 'ŧĕχť']).and_return('\\μ\\ť\\ƒ 8 \\ŧ\\ĕ\\χ\\ť') } + it { is_expected.to run.with_params(['スペー', 'スを含むテ', ' キスト']).and_return('\\ス\\ペ\\ー \\ス\\を\\含\\む\\テ \\ \\キ\\ス\\ト') } + end + end + + describe 'stringification' do + it { is_expected.to run.with_params([10, false, 'foo']).and_return('10 false foo') } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/shell_split_spec.rb b/environments/production/modules/stdlib/spec/functions/shell_split_spec.rb new file mode 100644 index 0000000..f8f9c90 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/shell_split_spec.rb @@ -0,0 +1,29 @@ +require 'spec_helper' + +describe 'shell_split' do + it { is_expected.not_to eq(nil) } + + describe 'signature validation' do + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('foo', 'bar').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + describe 'stringification' do + it { is_expected.to run.with_params(10).and_return(['10']) } + it { is_expected.to run.with_params(false).and_return(['false']) } + end + + describe 'shell line spliting' do + it { is_expected.to run.with_params('foo').and_return(['foo']) } + it { is_expected.to run.with_params('foo bar').and_return(['foo', 'bar']) } + it { is_expected.to run.with_params('\~\`\!@\#\$\%\^\&\*\(\)_\+-\=\[\]\\\\\{\}\|\;\\\':\",./\<\>\?') + .and_return(['~`!@#$%^&*()_+-=[]\{}|;\':",./<>?']) } + it { is_expected.to run.with_params('\~\`\!@\#\$ \%\^\&\*\(\)_\+-\= \[\]\\\\\{\}\|\;\\\':\" ,./\<\>\?') + .and_return(['~`!@#$', '%^&*()_+-=', '[]\{}|;\':"', ',./<>?']) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('\\μ\\ť\\ƒ 8 \\ŧ\\ĕ\\χ\\ť').and_return(['μťƒ', '8', 'ŧĕχť']) } + it { is_expected.to run.with_params('\\ス\\ペ\\ー \\ス\\を\\含\\む\\テ \\ \\キ\\ス\\ト').and_return(['スペー', 'スを含むテ', ' キスト']) } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/shuffle_spec.rb b/environments/production/modules/stdlib/spec/functions/shuffle_spec.rb new file mode 100755 index 0000000..4673daa --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/shuffle_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'shuffle' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + + context 'when running with a specific seed' do + # make tests deterministic + before(:each) { srand(2) } + + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['a']).and_return(['a']) } + it { is_expected.to run.with_params(['one']).and_return(['one']) } + it { is_expected.to run.with_params(['one', 'two', 'three']).and_return(['two', 'one', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'four']).and_return(['four', 'three', 'two', 'one']) } + + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('a').and_return('a') } + it { is_expected.to run.with_params('abc').and_return('bac') } + it { is_expected.to run.with_params('abcd').and_return('dcba') } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('ůţƒ8 ŧέχŧ şŧґíńģ').and_return('ģńş ůχţέƒŧí8ґŧŧ ') } + it { is_expected.to run.with_params('日本語の文字列').and_return('字本日語文列の') } + end + + context 'when using a class extending String' do + it { is_expected.to run.with_params(AlsoString.new('asdfghjkl')).and_return('lkhdsfajg') } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/size_spec.rb b/environments/production/modules/stdlib/spec/functions/size_spec.rb new file mode 100755 index 0000000..2047423 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/size_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'size' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Unknown type given/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Unknown type given/) } + it { is_expected.to run.with_params('1').and_raise_error(Puppet::ParseError, /Requires either string, array or hash to work/) } + it { is_expected.to run.with_params('1.0').and_raise_error(Puppet::ParseError, /Requires either string, array or hash to work/) } + it { is_expected.to run.with_params([]).and_return(0) } + it { is_expected.to run.with_params(['a']).and_return(1) } + it { is_expected.to run.with_params(['one', 'two', 'three']).and_return(3) } + it { is_expected.to run.with_params(['one', 'two', 'three', 'four']).and_return(4) } + + it { is_expected.to run.with_params({}).and_return(0) } + it { is_expected.to run.with_params({'1' => '2'}).and_return(1) } + it { is_expected.to run.with_params({'1' => '2', '4' => '4'}).and_return(2) } + it { is_expected.to run.with_params({'€' => '@', '竹' => 'ǿňè'}).and_return(2) } + + it { is_expected.to run.with_params('').and_return(0) } + it { is_expected.to run.with_params('a').and_return(1) } + it { is_expected.to run.with_params('abc').and_return(3) } + it { is_expected.to run.with_params('abcd').and_return(4) } + it { is_expected.to run.with_params('万').and_return(1) } + it { is_expected.to run.with_params('āβćđ').and_return(4) } + + context 'when using a class extending String' do + it 'should call its size method' do + value = AlsoString.new('asdfghjkl') + value.expects(:size).returns('foo') + expect(subject).to run.with_params(value).and_return('foo') + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/sort_spec.rb b/environments/production/modules/stdlib/spec/functions/sort_spec.rb new file mode 100755 index 0000000..9abd039 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/sort_spec.rb @@ -0,0 +1,24 @@ +require 'spec_helper' + +describe 'sort' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([], 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { pending('stricter input checking'); is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /requires string or array/) } + it { pending('stricter input checking'); is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /requires string or array/) } + it { pending('stricter input checking'); is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /requires string or array/) } + end + + context 'when called with an array' do + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['a']).and_return(['a']) } + it { is_expected.to run.with_params(['c', 'b', 'a']).and_return(['a', 'b', 'c']) } + end + + context 'when called with a string' do + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('a').and_return('a') } + it { is_expected.to run.with_params('cbda').and_return('abcd') } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/squeeze_spec.rb b/environments/production/modules/stdlib/spec/functions/squeeze_spec.rb new file mode 100755 index 0000000..b267d9a --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/squeeze_spec.rb @@ -0,0 +1,50 @@ +require 'spec_helper' + +describe 'squeeze' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', '', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_raise_error(NoMethodError) } + it { is_expected.to run.with_params({}).and_raise_error(NoMethodError) } + it { is_expected.to run.with_params(true).and_raise_error(NoMethodError) } + + context 'when squeezing a single string' do + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('a').and_return('a') } + it { is_expected.to run.with_params('aaaaaaaaa').and_return('a') } + it { is_expected.to run.with_params('aaaaaaaaa', 'a').and_return('a') } + it { is_expected.to run.with_params('aaaaaaaaabbbbbbbbbbcccccccccc', 'b-c').and_return('aaaaaaaaabc') } + end + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params('ậậậậậậậậậậậậậậậậậậậậ').and_return('ậ') } + it { is_expected.to run.with_params('語語語語語語語', '語').and_return('語') } + it { is_expected.to run.with_params('ậậậậậậậậậậậậậậậậậ語語語語©©©©©', '©').and_return('ậậậậậậậậậậậậậậậậậ語語語語©') } + end + + context 'when squeezing values in an array' do + it { + is_expected.to run \ + .with_params(['', 'a', 'aaaaaaaaa', 'aaaaaaaaabbbbbbbbbbcccccccccc']) \ + .and_return( ['', 'a', 'a', 'abc']) + } + it { + is_expected.to run \ + .with_params(['', 'a', 'aaaaaaaaa', 'aaaaaaaaabbbbbbbbbbcccccccccc'], 'a') \ + .and_return( ['', 'a', 'a', 'abbbbbbbbbbcccccccccc']) + } + it { + is_expected.to run \ + .with_params(['', 'a', 'aaaaaaaaa', 'aaaaaaaaabbbbbbbbbbcccccccccc'], 'b-c') \ + .and_return( ['', 'a', 'aaaaaaaaa', 'aaaaaaaaabc']) + } + end + + context 'when using a class extending String' do + it 'should call its squeeze method' do + value = AlsoString.new('aaaaaaaaa') + value.expects(:squeeze).returns('foo') + expect(subject).to run.with_params(value).and_return('foo') + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/str2bool_spec.rb b/environments/production/modules/stdlib/spec/functions/str2bool_spec.rb new file mode 100755 index 0000000..7d8c47c --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/str2bool_spec.rb @@ -0,0 +1,23 @@ +require 'spec_helper' + +describe 'str2bool' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('true', 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /Unknown type of boolean given/) } + + describe 'when testing values that mean "true"' do + [ 'TRUE','1', 't', 'y', 'true', 'yes', true ].each do |value| + it { is_expected.to run.with_params(value).and_return(true) } + end + end + + describe 'when testing values that mean "false"' do + [ 'FALSE','', '0', 'f', 'n', 'false', 'no', false, 'undef', 'undefined' ].each do |value| + it { is_expected.to run.with_params(value).and_return(false) } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/str2saltedsha512_spec.rb b/environments/production/modules/stdlib/spec/functions/str2saltedsha512_spec.rb new file mode 100755 index 0000000..2e1e818 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/str2saltedsha512_spec.rb @@ -0,0 +1,17 @@ +require 'spec_helper' + +describe 'str2saltedsha512' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('password', 2).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires a String argument/) } + + context 'when running with a specific seed' do + # make tests deterministic + before(:each) { srand(2) } + + it { is_expected.to run.with_params('').and_return('0f8a612f4eeed08e47b3875d00f33c5688f7926298f2d9b5fe19d1323f910bc78b6f7b5892596d2fabaa65e7a8d99b3768c102610cf0432c4827eee01f09451e3fae4f7a') } + it { is_expected.to run.with_params('password').and_return('0f8a612f43134376566c5707718d600effcfb17581fc9d3fa64d7f447dfda317c174ffdb498d2c5bd5c2075dab41c9d7ada5afbdc6b55354980eb5ba61802371e6b64956') } + it { is_expected.to run.with_params('verylongpassword').and_return('0f8a612f7a448537540e062daa8621f9bae326ca8ccb899e1bdb10e7c218cebfceae2530b856662565fdc4d81e986fc50cfbbc46d50436610ed9429ff5e43f2c45b5d039') } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/strftime_spec.rb b/environments/production/modules/stdlib/spec/functions/strftime_spec.rb new file mode 100755 index 0000000..e76774a --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/strftime_spec.rb @@ -0,0 +1,26 @@ +require 'spec_helper' + +describe 'strftime' do + it "should exist" do + expect(Puppet::Parser::Functions.function("strftime")).to eq("function_strftime") + end + + it "should raise a ParseError if there is less than 1 arguments" do + expect { scope.function_strftime([]) }.to( raise_error(Puppet::ParseError)) + end + + it "using %s should be higher then when I wrote this test" do + result = scope.function_strftime(["%s"]) + expect(result.to_i).to(be > 1311953157) + end + + it "using %s should be lower then 1.5 trillion" do + result = scope.function_strftime(["%s"]) + expect(result.to_i).to(be < 1500000000) + end + + it "should return a date when given %Y-%m-%d" do + result = scope.function_strftime(["%Y-%m-%d"]) + expect(result).to match(/^\d{4}-\d{2}-\d{2}$/) + end +end diff --git a/environments/production/modules/stdlib/spec/functions/strip_spec.rb b/environments/production/modules/stdlib/spec/functions/strip_spec.rb new file mode 100755 index 0000000..18e943d --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/strip_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'strip' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) } + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params(' ').and_return('') } + it { is_expected.to run.with_params(' ').and_return('') } + it { is_expected.to run.with_params("\t").and_return('') } + it { is_expected.to run.with_params("\t ").and_return('') } + it { is_expected.to run.with_params('one').and_return('one') } + it { is_expected.to run.with_params(' one').and_return('one') } + it { is_expected.to run.with_params(' one').and_return('one') } + it { is_expected.to run.with_params("\tone").and_return('one') } + it { is_expected.to run.with_params("\t one").and_return('one') } + it { is_expected.to run.with_params('one ').and_return('one') } + it { is_expected.to run.with_params(' one ').and_return('one') } + it { is_expected.to run.with_params(' one ').and_return('one') } + it { is_expected.to run.with_params("\tone ").and_return('one') } + it { is_expected.to run.with_params("\t one ").and_return('one') } + it { is_expected.to run.with_params("one \t").and_return('one') } + it { is_expected.to run.with_params(" one \t").and_return('one') } + it { is_expected.to run.with_params(" one \t").and_return('one') } + it { is_expected.to run.with_params("\tone \t").and_return('one') } + it { is_expected.to run.with_params("\t one \t").and_return('one') } + it { is_expected.to run.with_params(' o n e ').and_return('o n e') } + it { is_expected.to run.with_params(' ỏŋέ ').and_return('ỏŋέ') } + it { is_expected.to run.with_params(AlsoString.new(' one ')).and_return('one') } +end diff --git a/environments/production/modules/stdlib/spec/functions/suffix_spec.rb b/environments/production/modules/stdlib/spec/functions/suffix_spec.rb new file mode 100755 index 0000000..e0eafb1 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/suffix_spec.rb @@ -0,0 +1,40 @@ +require 'spec_helper' + +describe 'suffix' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the second.") + is_expected.to run.with_params([], 'a', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /expected first argument to be an Array/) } + it { is_expected.to run.with_params([], 2).and_raise_error(Puppet::ParseError, /expected second argument to be a String/) } + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['one', 2]).and_return(['one', '2']) } + it { is_expected.to run.with_params([], '').and_return([]) } + it { is_expected.to run.with_params([''], '').and_return(['']) } + it { is_expected.to run.with_params(['one'], 'post').and_return(['onepost']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], 'post').and_return(['onepost', 'twopost', 'threepost']) } + it { is_expected.to run.with_params(['ỗńέ', 'ťשׂǿ', 'ŧҺř℮ə'], 'рổŝţ').and_return(['ỗńέрổŝţ', 'ťשׂǿрổŝţ', 'ŧҺř℮əрổŝţ']) } + + it { + is_expected.to run.with_params({}).and_return({}) + } + it { + is_expected.to run.with_params({ 'key1' => 'value1', 2 => 3}).and_return({ 'key1' => 'value1', '2' => 3 }) + } + it { + is_expected.to run.with_params({}, '').and_return({}) + } + it { + is_expected.to run.with_params({ 'key' => 'value' }, '').and_return({ 'key' => 'value' }) + } + it { + is_expected.to run.with_params({ 'key' => 'value' }, 'post').and_return({ 'keypost' => 'value' }) + } + it { + is_expected.to run \ + .with_params({ 'key1' => 'value1', 'key2' => 'value2', 'key3' => 'value3' }, 'post') \ + .and_return({ 'key1post' => 'value1', 'key2post' => 'value2', 'key3post' => 'value3' }) + } +end diff --git a/environments/production/modules/stdlib/spec/functions/swapcase_spec.rb b/environments/production/modules/stdlib/spec/functions/swapcase_spec.rb new file mode 100755 index 0000000..c175a15 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/swapcase_spec.rb @@ -0,0 +1,40 @@ +require 'spec_helper' + +describe 'swapcase' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('a', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + describe 'with strings as inputs' do + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('one').and_return('ONE') } + it { is_expected.to run.with_params('ONE').and_return('one') } + it { is_expected.to run.with_params('oNe').and_return('OnE') } + end + describe 'with arrays as inputs' do + it { is_expected.to run.with_params([]).and_return([]) } + describe 'only containing strings' do + it { is_expected.to run.with_params(['']).and_return(['']) } + it { is_expected.to run.with_params(['one']).and_return(['ONE']) } + it { is_expected.to run.with_params(['ONE']).and_return(['one']) } + it { is_expected.to run.with_params(['oNe']).and_return(['OnE']) } + it { is_expected.to run.with_params(['one', 'ONE']).and_return(['ONE', 'one']) } + it { is_expected.to run.with_params(['ONE', 'OnE']).and_return(['one', 'oNe']) } + it { is_expected.to run.with_params(['oNe', 'one']).and_return(['OnE', 'ONE']) } + end + describe 'containing mixed types' do + it { is_expected.to run.with_params(['OnE', {}]).and_return(['oNe', {}]) } + it { is_expected.to run.with_params(['OnE', 1]).and_return(['oNe', 1]) } + it { is_expected.to run.with_params(['OnE', []]).and_return(['oNe', []]) } + it { is_expected.to run.with_params(['OnE', ['two']]).and_return(['oNe', ['two']]) } + end + end + it "should accept objects which extend String" do + is_expected.to run.with_params(AlsoString.new("OnE")).and_return('oNe') + end +end diff --git a/environments/production/modules/stdlib/spec/functions/time_spec.rb b/environments/production/modules/stdlib/spec/functions/time_spec.rb new file mode 100755 index 0000000..d157939 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/time_spec.rb @@ -0,0 +1,21 @@ +require 'spec_helper' + +describe 'time' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params('a', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + context 'when running at a specific time' do + before(:each) { + # get a value before stubbing the function + test_time = Time.utc(2006, 10, 13, 8, 15, 11) + Time.expects(:new).with().returns(test_time).once + } + it { is_expected.to run.with_params().and_return(1160727311) } + it { is_expected.to run.with_params('').and_return(1160727311) } + it { is_expected.to run.with_params([]).and_return(1160727311) } + it { is_expected.to run.with_params({}).and_return(1160727311) } + it { is_expected.to run.with_params('foo').and_return(1160727311) } + it { is_expected.to run.with_params('UTC').and_return(1160727311) } + it { is_expected.to run.with_params('America/New_York').and_return(1160727311) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/to_bytes_spec.rb b/environments/production/modules/stdlib/spec/functions/to_bytes_spec.rb new file mode 100755 index 0000000..2be23ff --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/to_bytes_spec.rb @@ -0,0 +1,72 @@ +require 'spec_helper' + +describe 'to_bytes' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('1', 'extras').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([]).and_raise_error(TypeError, /(can't convert|no implicit conversion of) Array (in)?to String/) } + it { is_expected.to run.with_params({}).and_raise_error(TypeError, /(can't convert|no implicit conversion of) Hash (in)?to String/) } + it { is_expected.to run.with_params(true).and_raise_error(TypeError, /(can't convert|no implicit conversion of) (TrueClass|true) (in)?to String/) } + + describe 'when passing numbers' do + it { is_expected.to run.with_params(0).and_return(0) } + it { is_expected.to run.with_params(1).and_return(1) } + it { is_expected.to run.with_params(-1).and_return(-1) } + it { is_expected.to run.with_params(1.1).and_return(1.1) } + it { is_expected.to run.with_params(-1.1).and_return(-1.1) } + end + + describe 'when passing numbers as strings' do + describe 'without a unit' do + it { is_expected.to run.with_params('1').and_return(1) } + it { is_expected.to run.with_params('-1').and_return(-1) } + # these are so wrong + it { is_expected.to run.with_params('1.1').and_return(1) } + it { is_expected.to run.with_params('-1.1').and_return(-1) } + end + + describe 'with a unit' do + it { is_expected.to run.with_params('1k').and_return(1024) } + it { is_expected.to run.with_params('-1kB').and_return(-1024) } + it { is_expected.to run.with_params('1k').and_return(1024) } + it { is_expected.to run.with_params('1M').and_return(1024*1024) } + it { is_expected.to run.with_params('1G').and_return(1024*1024*1024) } + it { is_expected.to run.with_params('1T').and_return(1024*1024*1024*1024) } + it { is_expected.to run.with_params('1P').and_return(1024*1024*1024*1024*1024) } + it { is_expected.to run.with_params('1E').and_return(1024*1024*1024*1024*1024*1024) } + it { is_expected.to run.with_params('1.5e3M').and_return(1572864000) } + + it { is_expected.to run.with_params('4k').and_return(4*1024) } + it { is_expected.to run.with_params('-4kB').and_return(4*-1024) } + it { is_expected.to run.with_params('4k').and_return(4*1024) } + it { is_expected.to run.with_params('4M').and_return(4*1024*1024) } + it { is_expected.to run.with_params('4G').and_return(4*1024*1024*1024) } + it { is_expected.to run.with_params('4T').and_return(4*1024*1024*1024*1024) } + it { is_expected.to run.with_params('4P').and_return(4*1024*1024*1024*1024*1024) } + it { is_expected.to run.with_params('4E').and_return(4*1024*1024*1024*1024*1024*1024) } + + # these are so wrong + it { is_expected.to run.with_params('1.0001 k').and_return(1024) } + it { is_expected.to run.with_params('-1.0001 kB').and_return(-1024) } + end + + describe 'with a unknown unit' do + it { is_expected.to run.with_params('1KB').and_raise_error(Puppet::ParseError, /Unknown prefix/) } + it { is_expected.to run.with_params('1K').and_raise_error(Puppet::ParseError, /Unknown prefix/) } + it { is_expected.to run.with_params('1mb').and_raise_error(Puppet::ParseError, /Unknown prefix/) } + it { is_expected.to run.with_params('1m').and_raise_error(Puppet::ParseError, /Unknown prefix/) } + it { is_expected.to run.with_params('1%').and_raise_error(Puppet::ParseError, /Unknown prefix/) } + it { is_expected.to run.with_params('1 p').and_raise_error(Puppet::ParseError, /Unknown prefix/) } + end + end + + # these are so wrong + describe 'when passing random stuff' do + it { is_expected.to run.with_params('-1....1').and_return(-1) } + it { is_expected.to run.with_params('-1.e.e.e.1').and_return(-1) } + it { is_expected.to run.with_params('-1+1').and_return(-1) } + it { is_expected.to run.with_params('1-1').and_return(1) } + it { is_expected.to run.with_params('1 kaboom').and_return(1024) } + it { is_expected.to run.with_params('kaboom').and_return(0) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/try_get_value_spec.rb b/environments/production/modules/stdlib/spec/functions/try_get_value_spec.rb new file mode 100644 index 0000000..38c0efd --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/try_get_value_spec.rb @@ -0,0 +1,100 @@ +require 'spec_helper' + +describe 'try_get_value' do + + let(:data) do + { + 'a' => { + 'g' => '2', + 'e' => [ + 'f0', + 'f1', + { + 'x' => { + 'y' => 'z' + } + }, + 'f3', + ] + }, + 'b' => true, + 'c' => false, + 'd' => '1', + } + end + + context 'single values' do + it 'should exist' do + is_expected.not_to eq(nil) + end + + it 'should be able to return a single value' do + is_expected.to run.with_params('test').and_return('test') + end + + it 'should use the default value if data is a single value and path is present' do + is_expected.to run.with_params('test', 'path', 'default').and_return('default') + end + + it 'should return default if there is no data' do + is_expected.to run.with_params(nil, nil, 'default').and_return('default') + end + + it 'should be able to use data structures as default values' do + is_expected.to run.with_params('test', 'path', data).and_return(data) + end + end + + context 'structure values' do + it 'should be able to extracts a single hash value' do + is_expected.to run.with_params(data, 'd', 'default').and_return('1') + end + + it 'should be able to extract a deeply nested hash value' do + is_expected.to run.with_params(data, 'a/g', 'default').and_return('2') + end + + it 'should return the default value if the path is not found' do + is_expected.to run.with_params(data, 'missing', 'default').and_return('default') + end + + it 'should return the default value if the path is too long' do + is_expected.to run.with_params(data, 'a/g/c/d', 'default').and_return('default') + end + + it 'should support an array index in the path' do + is_expected.to run.with_params(data, 'a/e/1', 'default').and_return('f1') + end + + it 'should return the default value if an array index is not a number' do + is_expected.to run.with_params(data, 'a/b/c', 'default').and_return('default') + end + + it 'should return the default value if and index is out of array length' do + is_expected.to run.with_params(data, 'a/e/5', 'default').and_return('default') + end + + it 'should be able to path though both arrays and hashes' do + is_expected.to run.with_params(data, 'a/e/2/x/y', 'default').and_return('z') + end + + it 'should be able to return "true" value' do + is_expected.to run.with_params(data, 'b', 'default').and_return(true) + is_expected.to run.with_params(data, 'm', true).and_return(true) + end + + it 'should be able to return "false" value' do + is_expected.to run.with_params(data, 'c', 'default').and_return(false) + is_expected.to run.with_params(data, 'm', false).and_return(false) + end + + it 'should return "nil" if value is not found and no default value is provided' do + is_expected.to run.with_params(data, 'a/1').and_return(nil) + end + + it 'should be able to use a custom path separator' do + is_expected.to run.with_params(data, 'a::g', 'default', '::').and_return('2') + is_expected.to run.with_params(data, 'a::c', 'default', '::').and_return('default') + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/type3x_spec.rb b/environments/production/modules/stdlib/spec/functions/type3x_spec.rb new file mode 100644 index 0000000..c3eb1de --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/type3x_spec.rb @@ -0,0 +1,41 @@ +require 'spec_helper' + +describe 'type3x' do + it "should exist" do + expect(Puppet::Parser::Functions.function("type3x")).to eq("function_type3x") + end + + it "should raise a ParseError if there is less than 1 arguments" do + expect { scope.function_type3x([]) }.to( raise_error(Puppet::ParseError)) + end + + it "should return string when given a string" do + result = scope.function_type3x(["aaabbbbcccc"]) + expect(result).to(eq('string')) + end + + it "should return array when given an array" do + result = scope.function_type3x([["aaabbbbcccc","asdf"]]) + expect(result).to(eq('array')) + end + + it "should return hash when given a hash" do + result = scope.function_type3x([{"a"=>1,"b"=>2}]) + expect(result).to(eq('hash')) + end + + it "should return integer when given an integer" do + result = scope.function_type3x(["1"]) + expect(result).to(eq('integer')) + end + + it "should return float when given a float" do + result = scope.function_type3x(["1.34"]) + expect(result).to(eq('float')) + end + + it "should return boolean when given a boolean" do + result = scope.function_type3x([true]) + expect(result).to(eq('boolean')) + end +end diff --git a/environments/production/modules/stdlib/spec/functions/type_of_spec.rb b/environments/production/modules/stdlib/spec/functions/type_of_spec.rb new file mode 100644 index 0000000..cc9ef78 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/type_of_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' + +if ENV["FUTURE_PARSER"] == 'yes' + describe 'type_of' do + pending 'teach rspec-puppet to load future-only functions under 3.7.5' do + it { is_expected.not_to eq(nil) } + end + end +end + +if Puppet.version.to_f >= 4.0 + describe 'type_of' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(ArgumentError) } + it { is_expected.to run.with_params('', '').and_raise_error(ArgumentError) } + + it 'gives the type of a string' do + expect(subject.call({}, 'hello world')).to be_kind_of(Puppet::Pops::Types::PStringType) + end + + it 'gives the type of an integer' do + expect(subject.call({}, 5)).to be_kind_of(Puppet::Pops::Types::PIntegerType) + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/type_spec.rb b/environments/production/modules/stdlib/spec/functions/type_spec.rb new file mode 100755 index 0000000..4288df0 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/type_spec.rb @@ -0,0 +1,42 @@ +require 'spec_helper' + +describe 'type' do + it "should exist" do + expect(Puppet::Parser::Functions.function("type")).to eq("function_type") + end + + it "should give a deprecation warning when called" do + scope.expects(:warning).with("type() DEPRECATED: This function will cease to function on Puppet 4; please use type3x() before upgrading to puppet 4 for backwards-compatibility, or migrate to the new parser's typing system.") + scope.function_type(["aoeu"]) + end + + it "should return string when given a string" do + result = scope.function_type(["aaabbbbcccc"]) + expect(result).to(eq('string')) + end + + it "should return array when given an array" do + result = scope.function_type([["aaabbbbcccc","asdf"]]) + expect(result).to(eq('array')) + end + + it "should return hash when given a hash" do + result = scope.function_type([{"a"=>1,"b"=>2}]) + expect(result).to(eq('hash')) + end + + it "should return integer when given an integer" do + result = scope.function_type(["1"]) + expect(result).to(eq('integer')) + end + + it "should return float when given a float" do + result = scope.function_type(["1.34"]) + expect(result).to(eq('float')) + end + + it "should return boolean when given a boolean" do + result = scope.function_type([true]) + expect(result).to(eq('boolean')) + end +end diff --git a/environments/production/modules/stdlib/spec/functions/union_spec.rb b/environments/production/modules/stdlib/spec/functions/union_spec.rb new file mode 100755 index 0000000..3f36f24 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/union_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' + +describe 'union' do + describe 'argument checking' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one', []).and_raise_error(Puppet::ParseError, /Every parameter must be an array/) } + it { is_expected.to run.with_params([], 'two').and_raise_error(Puppet::ParseError, /Every parameter must be an array/) } + it { is_expected.to run.with_params({}, {}).and_raise_error(Puppet::ParseError, /Every parameter must be an array/) } + end + + it { is_expected.to run.with_params([], []).and_return([]) } + it { is_expected.to run.with_params([], ['one']).and_return(['one']) } + it { is_expected.to run.with_params(['one'], []).and_return(['one']) } + it { is_expected.to run.with_params(['one'], ['one']).and_return(['one']) } + it { is_expected.to run.with_params(['one'], ['two']).and_return(['one', 'two']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'three']).and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'two', 'three'], ['two', 'three']).and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two', 'three'], ['two', 'two', 'three']).and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two'], ['two', 'three'], ['one', 'three']).and_return(['one', 'two', 'three']) } + it { is_expected.to run.with_params(['one', 'two'], ['three', 'four'], ['one', 'two', 'three'], ['four']).and_return(['one', 'two', 'three', 'four']) } + it { is_expected.to run.with_params(['ốńə', 'ţשׂợ'], ['ŧĥяếệ', 'ƒởųŗ'], ['ốńə', 'ţשׂợ', 'ŧĥяếệ'], ['ƒởųŗ']).and_return(['ốńə', 'ţשׂợ', 'ŧĥяếệ', 'ƒởųŗ']) } + it 'should not confuse types' do is_expected.to run.with_params(['1', '2', '3'], [1, 2]).and_return(['1', '2', '3', 1, 2]) end +end diff --git a/environments/production/modules/stdlib/spec/functions/unique_spec.rb b/environments/production/modules/stdlib/spec/functions/unique_spec.rb new file mode 100755 index 0000000..7955acb --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/unique_spec.rb @@ -0,0 +1,29 @@ +require 'spec_helper' + +describe 'unique' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params([], 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + end + + context 'when called with an array' do + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(['a']).and_return(['a']) } + it { is_expected.to run.with_params(['a', 'b', 'a']).and_return(['a', 'b']) } + it { is_expected.to run.with_params(['ã', 'ъ', 'ã']).and_return(['ã', 'ъ']) } + end + + context 'when called with a string' do + it { is_expected.to run.with_params('').and_return('') } + it { is_expected.to run.with_params('a').and_return('a') } + it { is_expected.to run.with_params('aaba').and_return('ab') } + it { is_expected.to run.with_params('ããъã').and_return('ãъ') } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/unix2dos_spec.rb b/environments/production/modules/stdlib/spec/functions/unix2dos_spec.rb new file mode 100644 index 0000000..8537a26 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/unix2dos_spec.rb @@ -0,0 +1,40 @@ +require 'spec_helper' + +describe 'unix2dos' do + context 'Checking parameter validity' do + it { is_expected.not_to eq(nil) } + it do + is_expected.to run.with_params.and_raise_error(ArgumentError, /Wrong number of arguments/) + end + it do + is_expected.to run.with_params('one', 'two').and_raise_error(ArgumentError, /Wrong number of arguments/) + end + it do + is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError) + end + it do + is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError) + end + it do + is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError) + end + end + + context 'Converting from unix to dos format' do + sample_text = "Hello\nWorld\n" + desired_output = "Hello\r\nWorld\r\n" + + it 'should output dos format' do + should run.with_params(sample_text).and_return(desired_output) + end + end + + context 'Converting from dos to dos format' do + sample_text = "Hello\r\nWorld\r\n" + desired_output = "Hello\r\nWorld\r\n" + + it 'should output dos format' do + should run.with_params(sample_text).and_return(desired_output) + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/upcase_spec.rb b/environments/production/modules/stdlib/spec/functions/upcase_spec.rb new file mode 100755 index 0000000..3b7b02d --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/upcase_spec.rb @@ -0,0 +1,26 @@ +require 'spec_helper' + +describe 'upcase' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires an array, hash or object that responds to upcase/) } + it { is_expected.to run.with_params([1]).and_raise_error(Puppet::ParseError, /Requires an array, hash or object that responds to upcase/) } + end + + describe 'normal string handling' do + it { is_expected.to run.with_params("abc").and_return("ABC") } + it { is_expected.to run.with_params("Abc").and_return("ABC") } + it { is_expected.to run.with_params("ABC").and_return("ABC") } + end + + describe 'handling classes derived from String' do + it { is_expected.to run.with_params(AlsoString.new("ABC")).and_return("ABC") } + end + + describe 'strings in arrays handling' do + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(["One", "twO"]).and_return(["ONE", "TWO"]) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/uriescape_spec.rb b/environments/production/modules/stdlib/spec/functions/uriescape_spec.rb new file mode 100755 index 0000000..f05ec08 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/uriescape_spec.rb @@ -0,0 +1,36 @@ +require 'spec_helper' + +describe 'uriescape' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the first.") + is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /Requires either array or string to work/) } + end + + describe 'handling normal strings' do + it 'should call ruby\'s URI.escape function' do + URI.expects(:escape).with('uri_string').returns('escaped_uri_string').once + is_expected.to run.with_params('uri_string').and_return('escaped_uri_string') + end + end + + describe 'handling classes derived from String' do + it 'should call ruby\'s URI.escape function' do + uri_string = AlsoString.new('uri_string') + URI.expects(:escape).with(uri_string).returns('escaped_uri_string').once + is_expected.to run.with_params(uri_string).and_return("escaped_uri_string") + end + end + + describe 'strings in arrays handling' do + it { is_expected.to run.with_params([]).and_return([]) } + it { is_expected.to run.with_params(["one}", "two"]).and_return(["one%7D", "two"]) } + it { is_expected.to run.with_params(["one}", 1, true, {}, "two"]).and_return(["one%7D", 1, true, {}, "two"]) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_absolute_path_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_absolute_path_spec.rb new file mode 100755 index 0000000..9397da5 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_absolute_path_spec.rb @@ -0,0 +1,73 @@ +require 'spec_helper' + +describe 'validate_absolute_path' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('c:/') + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + describe "valid paths handling" do + %w{ + C:/ + C:\\ + C:\\WINDOWS\\System32 + C:/windows/system32 + X:/foo/bar + X:\\foo\\bar + \\\\host\\windows + //host/windows + / + /var/tmp + /var/opt/../lib/puppet + }.each do |path| + it { is_expected.to run.with_params(path) } + it { is_expected.to run.with_params(['/tmp', path]) } + end + end + + describe 'invalid path handling' do + context 'garbage inputs' do + [ + nil, + [ nil ], + [ nil, nil ], + { 'foo' => 'bar' }, + { }, + '', + ].each do |path| + it { is_expected.to run.with_params(path).and_raise_error(Puppet::ParseError, /is not an absolute path/) } + it { is_expected.to run.with_params([path]).and_raise_error(Puppet::ParseError, /is not an absolute path/) } + it { is_expected.to run.with_params(['/tmp', path]).and_raise_error(Puppet::ParseError, /is not an absolute path/) } + end + end + + context 'relative paths' do + %w{ + relative1 + . + .. + ./foo + ../foo + etc/puppetlabs/puppet + opt/puppet/bin + relative\\windows + }.each do |path| + it { is_expected.to run.with_params(path).and_raise_error(Puppet::ParseError, /is not an absolute path/) } + it { is_expected.to run.with_params([path]).and_raise_error(Puppet::ParseError, /is not an absolute path/) } + it { is_expected.to run.with_params(['/tmp', path]).and_raise_error(Puppet::ParseError, /is not an absolute path/) } + end + end + end +end + diff --git a/environments/production/modules/stdlib/spec/functions/validate_array_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_array_spec.rb new file mode 100755 index 0000000..409b3dc --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_array_spec.rb @@ -0,0 +1,37 @@ +require 'spec_helper' + +describe 'validate_array' do + + describe 'signature validation' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + it { is_expected.not_to eq(nil) } + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params([]) + end + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + describe 'valid inputs' do + it { is_expected.to run.with_params([]) } + it { is_expected.to run.with_params(['one']) } + it { is_expected.to run.with_params([], ['two']) } + it { is_expected.to run.with_params(['one'], ['two']) } + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params([], {}).and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params([], 1).and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params([], true).and_raise_error(Puppet::ParseError, /is not an Array/) } + it { is_expected.to run.with_params([], 'one').and_raise_error(Puppet::ParseError, /is not an Array/) } + end + end +end + diff --git a/environments/production/modules/stdlib/spec/functions/validate_augeas_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_augeas_spec.rb new file mode 100755 index 0000000..4236649 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_augeas_spec.rb @@ -0,0 +1,75 @@ +require 'spec_helper' + +describe 'validate_augeas' do + unless Puppet.features.augeas? + skip "ruby-augeas not installed" + else + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', '', [], '', 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('one', 'one', 'MSG to User', '4th arg').and_raise_error(NoMethodError) } + end + + describe 'valid inputs' do + inputs = [ + [ "root:x:0:0:root:/root:/bin/bash\n", 'Passwd.lns' ], + [ "proc /proc proc nodev,noexec,nosuid 0 0\n", 'Fstab.lns'], + ] + + inputs.each do |input| + it { is_expected.to run.with_params(*input) } + end + end + + describe 'valid inputs which fail augeas validation' do + # The intent here is to make sure valid inputs raise exceptions when they + # don't specify an error message to display. This is the behvior in + # 2.2.x and prior. + inputs = [ + [ "root:x:0:0:root\n", 'Passwd.lns' ], + [ "127.0.1.1\n", 'Hosts.lns' ], + ] + + inputs.each do |input| + it { is_expected.to run.with_params(*input).and_raise_error(Puppet::ParseError, /validate_augeas.*?matched less than it should/) } + end + end + + describe "when specifying nice error messages" do + # The intent here is to make sure the function returns the 4th argument + # in the exception thrown + inputs = [ + [ "root:x:0:0:root\n", 'Passwd.lns', [], 'Failed to validate passwd content' ], + [ "127.0.1.1\n", 'Hosts.lns', [], 'Wrong hosts content' ], + ] + + inputs.each do |input| + it { is_expected.to run.with_params(*input).and_raise_error(Puppet::ParseError, /#{input[3]}/) } + end + end + + describe "matching additional tests" do + inputs = [ + [ "root:x:0:0:root:/root:/bin/bash\n", 'Passwd.lns', ['$file/foobar']], + [ "root:x:0:0:root:/root:/bin/bash\n", 'Passwd.lns', ['$file/root/shell[.="/bin/sh"]', 'foobar']], + ] + + inputs.each do |input| + it { is_expected.to run.with_params(*input) } + end + end + + describe "failing additional tests" do + inputs = [ + [ "foobar:x:0:0:root:/root:/bin/bash\n", 'Passwd.lns', ['$file/foobar']], + [ "root:x:0:0:root:/root:/bin/sh\n", 'Passwd.lns', ['$file/root/shell[.="/bin/sh"]', 'foobar']], + ] + + inputs.each do |input| + it { is_expected.to run.with_params(*input).and_raise_error(Puppet::ParseError, /testing path/) } + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_bool_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_bool_spec.rb new file mode 100755 index 0000000..3074d88 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_bool_spec.rb @@ -0,0 +1,36 @@ +require 'spec_helper' + +describe 'validate_bool' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(true) + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + describe 'acceptable values' do + it { is_expected.to run.with_params(true) } + it { is_expected.to run.with_params(false) } + it { is_expected.to run.with_params(true, false, false, true) } + end + + describe 'validation failures' do + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params(true, 'one').and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params('one', false).and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params("true").and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params("false").and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params(true, "false").and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params("true", false).and_raise_error(Puppet::ParseError, /is not a boolean/) } + it { is_expected.to run.with_params("true", false, false, false, false, false).and_raise_error(Puppet::ParseError, /is not a boolean/) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_cmd_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_cmd_spec.rb new file mode 100755 index 0000000..c6559e8 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_cmd_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'validate_cmd', :unless => Puppet::Util::Platform.windows? do + let(:touch) { File.exists?('/usr/bin/touch') ? '/usr/bin/touch' : '/bin/touch' } + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', '', '', 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending('should implement stricter type checking') + is_expected.to run.with_params([], '', '').and_raise_error(Puppet::ParseError, /content must be a string/) + } + it { + pending('should implement stricter type checking') + is_expected.to run.with_params('', [], '').and_raise_error(Puppet::ParseError, /checkscript must be a string/) + } + it { + pending('should implement stricter type checking') + is_expected.to run.with_params('', '', []).and_raise_error(Puppet::ParseError, /custom error message must be a string/) + } + end + + context 'when validation fails' do + context 'with % placeholder' do + it { is_expected.to run.with_params('', "#{touch} % /no/such/file").and_raise_error(Puppet::ParseError, /Execution of '#{touch} \S+ \/no\/such\/file' returned 1:.*(cannot touch|o such file or)/) } + it { is_expected.to run.with_params('', "#{touch} % /no/such/file", 'custom error').and_raise_error(Puppet::ParseError, /custom error/) } + end + context 'without % placeholder' do + it { is_expected.to run.with_params('', "#{touch} /no/such/file").and_raise_error(Puppet::ParseError, /Execution of '#{touch} \/no\/such\/file \S+' returned 1:.*(cannot touch|o such file or)/) } + it { is_expected.to run.with_params('', "#{touch} /no/such/file", 'custom error').and_raise_error(Puppet::ParseError, /custom error/) } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_email_address_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_email_address_spec.rb new file mode 100644 index 0000000..7628383 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_email_address_spec.rb @@ -0,0 +1,23 @@ +require 'spec_helper' + +describe 'validate_email_address' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + describe 'valid inputs' do + it { is_expected.to run.with_params('bob@gmail.com') } + it { is_expected.to run.with_params('alice+puppetlabs.com@gmail.com') } + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /is not a valid email/) } + it { is_expected.to run.with_params('bob@gmail.com', {}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('bob@gmail.com', true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('bob@gmail.com', 'one').and_raise_error(Puppet::ParseError, /is not a valid email/) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_hash_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_hash_spec.rb new file mode 100755 index 0000000..7533abe --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_hash_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'validate_hash' do + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + describe 'check for deprecation warning' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params({'key' => 'value'}) + end + end + + describe 'valid inputs' do + it { is_expected.to run.with_params({}) } + it { is_expected.to run.with_params({'key' => 'value'}) } + it { is_expected.to run.with_params({}, {'key' => 'value'}) } + it { is_expected.to run.with_params({'key1' => 'value1'}, {'key2' => 'value2'}) } + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params({}, []).and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params({}, 1).and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params({}, true).and_raise_error(Puppet::ParseError, /is not a Hash/) } + it { is_expected.to run.with_params({}, 'one').and_raise_error(Puppet::ParseError, /is not a Hash/) } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_integer_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_integer_spec.rb new file mode 100755 index 0000000..6558d00 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_integer_spec.rb @@ -0,0 +1,101 @@ +require 'spec_helper' + +describe 'validate_integer' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(3) + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1, 2, 3, 4).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + [ true, 'true', false, 'false', 'iAmAString', '1test', '1 test', 'test 1', 'test 1 test', 7.0, -7.0, {}, { 'key' => 'value' }, { 1=> 2 }, '', :undef , 'x'].each do |invalid| + it { is_expected.to run.with_params(invalid).and_raise_error(Puppet::ParseError, /to be an Integer/) } + it { is_expected.to run.with_params(invalid, 10).and_raise_error(Puppet::ParseError, /to be an Integer/) } + it { is_expected.to run.with_params(invalid, 10, -10).and_raise_error(Puppet::ParseError, /to be an Integer/) } + it { is_expected.to run.with_params([0, 1, 2, invalid, 3, 4], 10, -10).and_raise_error(Puppet::ParseError, /to be an Integer/) } + end + + context 'when running on modern rubies', :unless => RUBY_VERSION == '1.8.7' do + it { is_expected.to run.with_params([0, 1, 2, {1=>2}, 3, 4], 10, -10).and_raise_error(Puppet::ParseError, /to be an Integer/) } + end + + context 'when running on ruby, which munges hashes weirdly', :if => RUBY_VERSION == '1.8.7' do + it { is_expected.to run.with_params([0, 1, 2, {1=>2}, 3, 4], 10, -10).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([0, 1, 2, {0=>2}, 3, 4], 10, -10).and_raise_error(Puppet::ParseError) } + end + + it { is_expected.to run.with_params(1, '').and_raise_error(Puppet::ParseError, /to be unset or an Integer/) } + it { is_expected.to run.with_params(1, 2, '').and_raise_error(Puppet::ParseError, /to be unset or an Integer/) } + it { is_expected.to run.with_params(1, 2, 3).and_raise_error(Puppet::ParseError, /second argument to be larger than third argument/) } + end + + context 'with no range constraints' do + it { is_expected.to run.with_params(1) } + it { is_expected.to run.with_params(-1) } + it { is_expected.to run.with_params('1') } + it { is_expected.to run.with_params('-1') } + it { is_expected.to run.with_params([1, 2, 3, 4]) } + it { is_expected.to run.with_params([1, '2', '3', 4]) } + end + + context "with a maximum limit of 10" do + describe 'rejects numbers greater than the limit' do + it { is_expected.to run.with_params(11, 10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(100, 10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(2**65, 10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params([1,2,10,100], 10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + end + + describe 'accepts numbers less or equal to the limit' do + it { is_expected.to run.with_params(10, 10) } + it { is_expected.to run.with_params(1, 10) } + it { is_expected.to run.with_params(-1, 10) } + it { is_expected.to run.with_params('1', 10) } + it { is_expected.to run.with_params('-1', 10) } + it { is_expected.to run.with_params([1, 2, 3, 4], 10) } + it { is_expected.to run.with_params([1, '2', '3', 4], 10) } + end + + context "with a minimum limit of -10" do + describe 'rejects numbers greater than the upper limit' do + it { is_expected.to run.with_params(11, 10, -10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(100, 10, -10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(2**65, 10, -10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params([1,2,10,100], 10, -10).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + end + + describe 'rejects numbers smaller than the lower limit' do + it { is_expected.to run.with_params(-11, 10, -10).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + it { is_expected.to run.with_params(-100, 10, -10).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + it { is_expected.to run.with_params(-2**65, 10, -10).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + it { is_expected.to run.with_params([-10, 1,2,10,-100], 10, -10).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + end + + describe 'accepts numbers between and including the limits' do + it { is_expected.to run.with_params(10, 10, -10) } + it { is_expected.to run.with_params(-10, 10, -10) } + it { is_expected.to run.with_params(1, 10, -10) } + it { is_expected.to run.with_params(-1, 10, -10) } + it { is_expected.to run.with_params('1', 10, -10) } + it { is_expected.to run.with_params('-1', 10, -10) } + it { is_expected.to run.with_params([1, 2, 3, 4], 10, -10) } + it { is_expected.to run.with_params([1, '2', '3', 4], 10, -10) } + end + end + end + + it { is_expected.to run.with_params(10, 10, 10) } + + describe 'empty upper limit is interpreted as infinity' do + it { is_expected.to run.with_params(11, '', 10) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_ip_address_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_ip_address_spec.rb new file mode 100644 index 0000000..0414f5e --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_ip_address_spec.rb @@ -0,0 +1,65 @@ +require 'spec_helper' + +describe 'validate_ip_address' do + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + describe 'valid inputs' do + it { is_expected.to run.with_params('0.0.0.0') } + it { is_expected.to run.with_params('8.8.8.8') } + it { is_expected.to run.with_params('127.0.0.1') } + it { is_expected.to run.with_params('10.10.10.10') } + it { is_expected.to run.with_params('194.232.104.150') } + it { is_expected.to run.with_params('244.24.24.24') } + it { is_expected.to run.with_params('255.255.255.255') } + it { is_expected.to run.with_params('1.2.3.4', '5.6.7.8') } + it { is_expected.to run.with_params('3ffe:0505:0002::') } + it { is_expected.to run.with_params('3ffe:0505:0002::', '3ffe:0505:0002::2') } + it { is_expected.to run.with_params('::1/64') } + it { is_expected.to run.with_params('fe80::a00:27ff:fe94:44d6/64') } + + context 'Checking for deprecation warning', if: Puppet.version.to_f < 4.0 do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('1.2.3.4') + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params('1.2.3.4') + end + end + + context 'with netmasks' do + it { is_expected.to run.with_params('8.8.8.8/0') } + it { is_expected.to run.with_params('8.8.8.8/16') } + it { is_expected.to run.with_params('8.8.8.8/32') } + it { is_expected.to run.with_params('8.8.8.8/255.255.0.0') } + end + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /is not a valid IP/) } + it { is_expected.to run.with_params('0.0.0').and_raise_error(Puppet::ParseError, /is not a valid IP/) } + it { is_expected.to run.with_params('0.0.0.256').and_raise_error(Puppet::ParseError, /is not a valid IP/) } + it { is_expected.to run.with_params('0.0.0.0.0').and_raise_error(Puppet::ParseError, /is not a valid IP/) } + it { is_expected.to run.with_params('1.2.3.4', {}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('1.2.3.4', 1).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('1.2.3.4', true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('1.2.3.4', 'one').and_raise_error(Puppet::ParseError, /is not a valid IP/) } + it { is_expected.to run.with_params('::1', {}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('::1', true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('::1', 'one').and_raise_error(Puppet::ParseError, /is not a valid IP/) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_ipv4_address_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_ipv4_address_spec.rb new file mode 100755 index 0000000..6e4ca05 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_ipv4_address_spec.rb @@ -0,0 +1,41 @@ +require 'spec_helper' + +describe 'validate_ipv4_address' do + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + context 'Checking for deprecation warning', if: Puppet.version.to_f < 4.0 do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(SharedData::IPV4_PATTERNS.first) + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params(SharedData::IPV4_PATTERNS.first) + end + end + + SharedData::IPV4_PATTERNS.each do |value| + it { is_expected.to run.with_params(value) } + end + + SharedData::IPV4_NEGATIVE_PATTERNS.each do |value| + it { is_expected.to run.with_params(value).and_raise_error(Puppet::ParseError, /is not a valid IPv4/) } + end + + describe 'invalid inputs' do + [ {}, [], 1, true ].each do |invalid| + it { is_expected.to run.with_params(invalid).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(SharedData::IPV4_PATTERNS.first, invalid).and_raise_error(Puppet::ParseError, /is not a string/) } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_ipv6_address_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_ipv6_address_spec.rb new file mode 100755 index 0000000..137db36 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_ipv6_address_spec.rb @@ -0,0 +1,60 @@ +require 'spec_helper' + +describe 'validate_ipv6_address' do + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + end + + context 'Checking for deprecation warning', if: Puppet.version.to_f < 4.0 do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + # Checking for deprecation warning, which should only be provoked when the env variable for it is set. + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('3ffe:0505:0002::') + end + it 'should display no warning for deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "false" + scope.expects(:warning).with(includes('This method is deprecated')).never + is_expected.to run.with_params('3ffe:0505:0002::') + end + end + + describe 'valid inputs' do + it { is_expected.to run.with_params('3ffe:0505:0002::') } + it { is_expected.to run.with_params('3ffe:0505:0002::', '3ffe:0505:0002::2') } + it { is_expected.to run.with_params('::1/64') } + it { is_expected.to run.with_params('fe80::a00:27ff:fe94:44d6/64') } + it { is_expected.to run.with_params('fe80:0000:0000:0000:0204:61ff:fe9d:f156') } + it { is_expected.to run.with_params('fe80:0:0:0:204:61ff:fe9d:f156') } + it { is_expected.to run.with_params('fe80::204:61ff:fe9d:f156') } + it { is_expected.to run.with_params('fe80:0:0:0:0204:61ff:254.157.241.86') } + it { is_expected.to run.with_params('::1') } + it { is_expected.to run.with_params('fe80::') } + it { is_expected.to run.with_params('2001::') } + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('one').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('0.0.0').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('0.0.0.256').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('0.0.0.0.0').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('::ffff:2.3.4').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('::ffff:257.1.2.3').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('::ffff:12345678901234567890.1.26').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('affe:beef').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + it { is_expected.to run.with_params('::1', {}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('::1', true).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('::1', 'one').and_raise_error(Puppet::ParseError, /is not a valid IPv6/) } + context 'unless running on ruby 1.8.7', :if => RUBY_VERSION != '1.8.7' do + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params('::1', 1).and_raise_error(Puppet::ParseError, /is not a string/) } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_legacy_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_legacy_spec.rb new file mode 100644 index 0000000..7b48f12 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_legacy_spec.rb @@ -0,0 +1,68 @@ +require 'spec_helper' + +if Puppet::Util::Package.versioncmp(Puppet.version, '4.4.0') >= 0 + describe 'validate_legacy' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params.and_raise_error(ArgumentError) } + + describe 'when passing the type assertion and passing the previous validation' do + before do + scope.expects(:function_validate_foo).with([5]).once + Puppet.expects(:notice).never + end + it 'passes without notice' do + is_expected.to run.with_params('Integer', 'validate_foo', 5) + end + end + + describe 'when passing the type assertion and failing the previous validation' do + before do + scope.expects(:function_validate_foo).with([5]).raises(Puppet::ParseError, 'foo').once + Puppet.expects(:notice).with(includes('Accepting previously invalid value for target type')) + end + it 'passes with a notice about newly accepted value' do + is_expected.to run.with_params('Integer', 'validate_foo', 5) + end + end + + describe 'when failing the type assertion and passing the previous validation' do + before do + scope.expects(:function_validate_foo).with(['5']).once + subject.func.expects(:call_function).with('deprecation', 'validate_legacy', includes('Integer')).once + end + it 'passes with a deprecation message' do + is_expected.to run.with_params('Integer', 'validate_foo', '5') + end + end + + describe 'when failing the type assertion and failing the previous validation' do + before do + scope.expects(:function_validate_foo).with(['5']).raises(Puppet::ParseError, 'foo').once + subject.func.expects(:call_function).with('fail', includes('Integer')).once + end + it 'fails with a helpful message' do + is_expected.to run.with_params('Integer', 'validate_foo', '5') + end + end + + describe 'when passing in undef' do + before do + scope.expects(:function_validate_foo).with([:undef]).once + Puppet.expects(:notice).never + end + it 'works' do + is_expected.to run.with_params('Optional[Integer]', 'validate_foo', :undef) + end + end + + describe 'when passing in multiple arguments' do + before do + scope.expects(:function_validate_foo).with([:undef, 1, 'foo']).once + Puppet.expects(:notice).never + end + it 'passes with a deprecation message' do + is_expected.to run.with_params('Optional[Integer]', 'validate_foo', :undef, 1, 'foo') + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_numeric_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_numeric_spec.rb new file mode 100755 index 0000000..4c0e24d --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_numeric_spec.rb @@ -0,0 +1,100 @@ +require 'spec_helper' + +describe 'validate_numeric' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params(3) + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params(1, 2, 3, 4).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + [ true, 'true', false, 'false', 'iAmAString', '1test', '1 test', 'test 1', 'test 1 test', {}, { 'key' => 'value' }, { 1=> 2 }, '', :undef , 'x'].each do |invalid| + it { is_expected.to run.with_params(invalid).and_raise_error(Puppet::ParseError, /to be a Numeric/) } + it { is_expected.to run.with_params(invalid, 10.0).and_raise_error(Puppet::ParseError, /to be a Numeric/) } + it { is_expected.to run.with_params(invalid, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be a Numeric/) } + end + + context 'when running on modern rubies', :unless => RUBY_VERSION == '1.8.7' do + it { is_expected.to run.with_params([0, 1, 2, {1=>2}, 3, 4], 10, -10).and_raise_error(Puppet::ParseError, /to be a Numeric/) } + end + + context 'when running on ruby, which munges hashes weirdly', :if => RUBY_VERSION == '1.8.7' do + it { is_expected.to run.with_params([0, 1, 2, {1=>2}, 3, 4], 10, -10).and_raise_error(Puppet::ParseError) } + it { is_expected.to run.with_params([0, 1, 2, {0=>2}, 3, 4], 10, -10).and_raise_error(Puppet::ParseError) } + end + + it { is_expected.to run.with_params(1, '').and_raise_error(Puppet::ParseError, /to be unset or a Numeric/) } + it { is_expected.to run.with_params(1, 2, '').and_raise_error(Puppet::ParseError, /to be unset or a Numeric/) } + it { is_expected.to run.with_params(1, 2, 3).and_raise_error(Puppet::ParseError, /second argument to be larger than third argument/) } + end + + context 'with no range constraints' do + it { is_expected.to run.with_params(1) } + it { is_expected.to run.with_params(-1) } + it { is_expected.to run.with_params('1') } + it { is_expected.to run.with_params('-1') } + it { is_expected.to run.with_params([1, 2, 3, 4]) } + it { is_expected.to run.with_params([1, '2', '3', 4]) } + end + + context "with a maximum limit of 10.0" do + describe 'rejects numbers greater than the limit' do + it { is_expected.to run.with_params(11, 10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(100, 10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(2**65, 10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params([1,2,10.0,100], 10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + end + + describe 'accepts numbers less or equal to the limit' do + it { is_expected.to run.with_params(10.0, 10.0) } + it { is_expected.to run.with_params(1, 10.0) } + it { is_expected.to run.with_params(-1, 10.0) } + it { is_expected.to run.with_params('1', 10.0) } + it { is_expected.to run.with_params('-1', 10.0) } + it { is_expected.to run.with_params([1, 2, 3, 4], 10.0) } + it { is_expected.to run.with_params([1, '2', '3', 4], 10.0) } + end + + context "with a minimum limit of -10.0" do + describe 'rejects numbers greater than the upper limit' do + it { is_expected.to run.with_params(11, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(100, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params(2**65, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + it { is_expected.to run.with_params([1,2,10.0,100], 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be smaller or equal/) } + end + + describe 'rejects numbers smaller than the lower limit' do + it { is_expected.to run.with_params(-11, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + it { is_expected.to run.with_params(-100, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + it { is_expected.to run.with_params(-2**65, 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + it { is_expected.to run.with_params([-10.0, 1,2,10.0,-100], 10.0, -10.0).and_raise_error(Puppet::ParseError, /to be greater or equal/) } + end + + describe 'accepts numbers between and including the limits' do + it { is_expected.to run.with_params(10.0, 10.0, -10.0) } + it { is_expected.to run.with_params(-10.0, 10.0, -10.0) } + it { is_expected.to run.with_params(1, 10.0, -10.0) } + it { is_expected.to run.with_params(-1, 10.0, -10.0) } + it { is_expected.to run.with_params('1', 10.0, -10.0) } + it { is_expected.to run.with_params('-1', 10.0, -10.0) } + it { is_expected.to run.with_params([1, 2, 3, 4], 10.0, -10.0) } + it { is_expected.to run.with_params([1, '2', '3', 4], 10.0, -10.0) } + end + end + end + + it { is_expected.to run.with_params(10.0, 10.0, 10.0) } + + describe 'empty upper limit is interpreted as infinity' do + it { is_expected.to run.with_params(11, '', 10.0) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_re_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_re_spec.rb new file mode 100755 index 0000000..3531182 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_re_spec.rb @@ -0,0 +1,56 @@ +require 'spec_helper' + +describe 'validate_re' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('', '') + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', '', '', 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + describe 'valid inputs' do + it { is_expected.to run.with_params('', '') } + it { is_expected.to run.with_params('', ['']) } + it { is_expected.to run.with_params('', [''], 'custom error') } + it { is_expected.to run.with_params('one', '^one') } + it { is_expected.to run.with_params('one', [ '^one', '^two' ]) } + it { is_expected.to run.with_params('one', [ '^one', '^two' ], 'custom error') } + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params('', []).and_raise_error(Puppet::ParseError, /does not match/) } + it { is_expected.to run.with_params('one', 'two').and_raise_error(Puppet::ParseError, /does not match/) } + it { is_expected.to run.with_params('', 'two').and_raise_error(Puppet::ParseError, /does not match/) } + it { is_expected.to run.with_params('', ['two']).and_raise_error(Puppet::ParseError, /does not match/) } + it { is_expected.to run.with_params('', ['two'], 'custom error').and_raise_error(Puppet::ParseError, /custom error/) } + it { is_expected.to run.with_params('notone', '^one').and_raise_error(Puppet::ParseError, /does not match/) } + it { is_expected.to run.with_params('notone', [ '^one', '^two' ]).and_raise_error(Puppet::ParseError, /does not match/) } + it { is_expected.to run.with_params('notone', [ '^one', '^two' ], 'custom error').and_raise_error(Puppet::ParseError, /custom error/) } + + describe 'non-string inputs' do + [ + 1, # Fixnum + 3.14, # Float + nil, # NilClass + true, # TrueClass + false, # FalseClass + ["10"], # Array + :key, # Symbol + {:key=>"val"}, # Hash + ].each do |input| + it { is_expected.to run.with_params(input, '.*').and_raise_error(Puppet::ParseError, /needs to be a String/) } + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_slength_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_slength_spec.rb new file mode 100755 index 0000000..e4162de --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_slength_spec.rb @@ -0,0 +1,72 @@ +require 'spec_helper' + +describe 'validate_slength' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('1234567890', 10) + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', 2, 3, 'extra').and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params('', '').and_raise_error(Puppet::ParseError, /second argument to be a positive Numeric/) } + it { is_expected.to run.with_params('', -1).and_raise_error(Puppet::ParseError, /second argument to be a positive Numeric/) } + it { is_expected.to run.with_params('', 1, '').and_raise_error(Puppet::ParseError, /third argument to be unset or a positive Numeric/) } + it { is_expected.to run.with_params('', 1, -1).and_raise_error(Puppet::ParseError, /third argument to be unset or a positive Numeric/) } + it { is_expected.to run.with_params('', 1, 2).and_raise_error(Puppet::ParseError, /argument to be equal to or larger than third argument/) } + end + + context "with a maximum length of 10" do + describe 'rejects strings longer than the limit' do + it { is_expected.to run.with_params('1234567890a', 10).and_raise_error(Puppet::ParseError, /Expected length/) } + it { is_expected.to run.with_params('1234567890abcdef', 10).and_raise_error(Puppet::ParseError, /Expected length/) } + it { is_expected.to run.with_params([ 'one', '1234567890abcdef' ], 10).and_raise_error(Puppet::ParseError, /Expected length/) } + end + + describe 'accepts strings shorter or equal to the limit' do + it { is_expected.to run.with_params('1234567890', 10) } + it { is_expected.to run.with_params('12345', 10) } + it { is_expected.to run.with_params([ 'one', 'two' ], 10) } + end + + context "with a minimum length of 5" do + describe 'rejects strings longer than the upper limit' do + it { is_expected.to run.with_params('1234567890a', 10, 5).and_raise_error(Puppet::ParseError, /Expected length/) } + it { is_expected.to run.with_params('1234567890abcdef', 10, 5).and_raise_error(Puppet::ParseError, /Expected length/) } + end + + describe 'rejects numbers shorter than the lower limit' do + it { is_expected.to run.with_params('one', 10, 5).and_raise_error(Puppet::ParseError, /Expected length/) } + it { is_expected.to run.with_params(['12345678', 'two'], 10, 5).and_raise_error(Puppet::ParseError, /Expected length/) } + end + + describe 'accepts strings of length between and including the limits' do + it { is_expected.to run.with_params('12345', 10, 5) } + it { is_expected.to run.with_params('123456', 10, 5) } + it { is_expected.to run.with_params('1234567', 10, 5) } + it { is_expected.to run.with_params('12345678', 10, 5) } + it { is_expected.to run.with_params('123456789', 10, 5) } + it { is_expected.to run.with_params('1234567890', 10, 5) } + it { is_expected.to run.with_params(['1233456', '12345678'], 10, 5) } + end + end + end + + describe 'corner cases' do + it { pending('this should work'); is_expected.to run.with_params('', 0, 0) } + it { is_expected.to run.with_params('1234567890', 10, 10) } + end + + describe 'empty upper limit is interpreted as infinity' do + it { pending('not implemented'); is_expected.to run.with_params('1234567890ab', '', 10) } + it { pending('not implemented'); is_expected.to run.with_params('12345678', '', 10).and_raise_error(Puppet::ParseError, /Expected length/) } + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_string_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_string_spec.rb new file mode 100755 index 0000000..0907ede --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_string_spec.rb @@ -0,0 +1,33 @@ +require 'spec_helper' + +describe 'validate_string' do + after(:all) do + ENV.delete('STDLIB_LOG_DEPRECATIONS') + end + + # Checking for deprecation warning + it 'should display a single deprecation' do + ENV['STDLIB_LOG_DEPRECATIONS'] = "true" + scope.expects(:warning).with(includes('This method is deprecated')) + is_expected.to run.with_params('', '') + end + + describe 'signature validation' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + + describe 'valid inputs' do + it { is_expected.to run.with_params('') } + it { is_expected.to run.with_params(nil) } + it { is_expected.to run.with_params('one') } + it { is_expected.to run.with_params('one', 'two') } + end + + describe 'invalid inputs' do + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(1).and_raise_error(Puppet::ParseError, /is not a string/) } + it { is_expected.to run.with_params(true).and_raise_error(Puppet::ParseError, /is not a string/) } + end + end +end diff --git a/environments/production/modules/stdlib/spec/functions/validate_x509_rsa_key_pair_spec.rb b/environments/production/modules/stdlib/spec/functions/validate_x509_rsa_key_pair_spec.rb new file mode 100755 index 0000000..eb63310 --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/validate_x509_rsa_key_pair_spec.rb @@ -0,0 +1,180 @@ +require 'spec_helper' + +describe 'validate_x509_rsa_key_pair' do + + let(:valid_cert) do + < 'value' }).and_return(['value']) } + it 'should return the array of values' do + result = subject.call([{ 'key1' => 'value1', 'key2' => 'value2', 'duplicate_value_key' => 'value2' }]) + expect(result).to match_array(['value1', 'value2', 'value2']) + end + + it 'should run with UTF8 and double byte characters' do + result = subject.call([{ 'かぎ' => '使用', 'ҝĕұ' => '√ẩŀứệ', 'ҝĕұďŭрļǐçằťè' => '√ẩŀứệ' }]) + expect(result).to match_array(['使用', '√ẩŀứệ', '√ẩŀứệ']) + end +end diff --git a/environments/production/modules/stdlib/spec/functions/zip_spec.rb b/environments/production/modules/stdlib/spec/functions/zip_spec.rb new file mode 100755 index 0000000..e1ae8ee --- /dev/null +++ b/environments/production/modules/stdlib/spec/functions/zip_spec.rb @@ -0,0 +1,21 @@ +require 'spec_helper' + +describe 'zip' do + it { is_expected.not_to eq(nil) } + it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { is_expected.to run.with_params([]).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) } + it { + pending("Current implementation ignores parameters after the third.") + is_expected.to run.with_params([], [], true, []).and_raise_error(Puppet::ParseError, /wrong number of arguments/i) + } + it { is_expected.to run.with_params([], []).and_return([]) } + it { is_expected.to run.with_params([1,2,3], [4,5,6]).and_return([[1,4], [2,5], [3,6]]) } + it { is_expected.to run.with_params([1,2,3], [4,5,6], false).and_return([[1,4], [2,5], [3,6]]) } + it { is_expected.to run.with_params([1,2,3], [4,5,6], true).and_return([1, 4, 2, 5, 3, 6]) } + + context 'should run with UTF8 and double byte characters' do + it { is_expected.to run.with_params(['ầ', 'ь', 'ć'], ['đ', 'ề', 'ƒ']).and_return([['ầ','đ'], ['ь','ề'], ['ć', 'ƒ']]) } + it { is_expected.to run.with_params(['ペ', '含', '値'], ['ッ', '文', 'イ']).and_return([['ペ','ッ'], ['含','文'], ['値', 'イ']]) } + end +end + diff --git a/environments/production/modules/stdlib/spec/monkey_patches/alias_should_to_must.rb b/environments/production/modules/stdlib/spec/monkey_patches/alias_should_to_must.rb new file mode 100755 index 0000000..505e240 --- /dev/null +++ b/environments/production/modules/stdlib/spec/monkey_patches/alias_should_to_must.rb @@ -0,0 +1,9 @@ +#! /usr/bin/env ruby -S rspec +require 'rspec' + +class Object + # This is necessary because the RAL has a 'should' + # method. + alias :must :should + alias :must_not :should_not +end diff --git a/environments/production/modules/stdlib/spec/monkey_patches/publicize_methods.rb b/environments/production/modules/stdlib/spec/monkey_patches/publicize_methods.rb new file mode 100755 index 0000000..3ae59f9 --- /dev/null +++ b/environments/production/modules/stdlib/spec/monkey_patches/publicize_methods.rb @@ -0,0 +1,11 @@ +#! /usr/bin/env ruby -S rspec +# Some monkey-patching to allow us to test private methods. +class Class + def publicize_methods(*methods) + saved_private_instance_methods = methods.empty? ? self.private_instance_methods : methods + + self.class_eval { public(*saved_private_instance_methods) } + yield + self.class_eval { private(*saved_private_instance_methods) } + end +end diff --git a/environments/production/modules/stdlib/spec/spec_helper.rb b/environments/production/modules/stdlib/spec/spec_helper.rb new file mode 100755 index 0000000..22d5d68 --- /dev/null +++ b/environments/production/modules/stdlib/spec/spec_helper.rb @@ -0,0 +1,8 @@ +#This file is generated by ModuleSync, do not edit. +require 'puppetlabs_spec_helper/module_spec_helper' + +# put local configuration and setup into spec_helper_local +begin + require 'spec_helper_local' +rescue LoadError +end diff --git a/environments/production/modules/stdlib/spec/spec_helper_acceptance.rb b/environments/production/modules/stdlib/spec/spec_helper_acceptance.rb new file mode 100755 index 0000000..4d85e7d --- /dev/null +++ b/environments/production/modules/stdlib/spec/spec_helper_acceptance.rb @@ -0,0 +1,55 @@ +#! /usr/bin/env ruby -S rspec +require 'puppet' +require 'beaker-rspec' +require 'beaker/puppet_install_helper' +require 'beaker/module_install_helper' + +run_puppet_install_helper +install_ca_certs unless ENV['PUPPET_INSTALL_TYPE'] =~ /pe/i +install_module_on(hosts) +install_module_dependencies_on(hosts) + +RSpec.configure do |c| + # Readable test descriptions + c.formatter = :documentation + + # Configure all nodes in nodeset + c.before :suite do + end +end + +def get_puppet_version + (on default, puppet('--version')).output.chomp +end + +RSpec.shared_context "with faked facts" do + let(:facts_d) do + puppet_version = get_puppet_version + if fact('osfamily') =~ /windows/i + if fact('kernelmajversion').to_f < 6.0 + 'C:/Documents and Settings/All Users/Application Data/PuppetLabs/facter/facts.d' + else + 'C:/ProgramData/PuppetLabs/facter/facts.d' + end + elsif Puppet::Util::Package.versioncmp(puppet_version, '4.0.0') < 0 and fact('is_pe', '--puppet') == "true" + '/etc/puppetlabs/facter/facts.d' + else + '/etc/facter/facts.d' + end + end + + before :each do + #No need to create on windows, PE creates by default + if fact('osfamily') !~ /windows/i + shell("mkdir -p '#{facts_d}'") + end + end + + after :each do + shell("rm -f '#{facts_d}/fqdn.txt'", :acceptable_exit_codes => [0,1]) + end + + def fake_fact(name, value) + shell("echo #{name}=#{value} > '#{facts_d}/#{name}.txt'") + end +end diff --git a/environments/production/modules/stdlib/spec/spec_helper_local.rb b/environments/production/modules/stdlib/spec/spec_helper_local.rb new file mode 100644 index 0000000..616490c --- /dev/null +++ b/environments/production/modules/stdlib/spec/spec_helper_local.rb @@ -0,0 +1,31 @@ +# automatically load any shared examples or contexts +Dir["./spec/support/**/*.rb"].sort.each { |f| require f } + +# hack to enable all the expect syntax (like allow_any_instance_of) in rspec-puppet examples +RSpec::Mocks::Syntax.enable_expect(RSpec::Puppet::ManifestMatchers) + +RSpec.configure do |config| + # supply tests with a possibility to test for the future parser + config.add_setting :puppet_future + config.puppet_future = Puppet.version.to_f >= 4.0 + + config.before :each do + # Ensure that we don't accidentally cache facts and environment between + # test cases. This requires each example group to explicitly load the + # facts being exercised with something like + # Facter.collection.loader.load(:ipaddress) + Facter.clear + Facter.clear_messages + + RSpec::Mocks.setup + end + + config.after :each do + RSpec::Mocks.verify + RSpec::Mocks.teardown + end +end + +# Helper class to test handling of arguments which are derived from string +class AlsoString < String +end diff --git a/environments/production/modules/stdlib/spec/support/shared_data.rb b/environments/production/modules/stdlib/spec/support/shared_data.rb new file mode 100644 index 0000000..ea9b7a0 --- /dev/null +++ b/environments/production/modules/stdlib/spec/support/shared_data.rb @@ -0,0 +1,38 @@ +module SharedData + IPV4_PATTERNS = [ + '0.0.0.0', + '1.2.3.4', + '10.10.10.10', + '127.0.0.1', + '192.88.99.0', + '194.232.104.150', + '224.0.0.0', + '244.24.24.24', + '255.255.255.255', + '8.8.8.8', + '8.8.8.8/0', + '8.8.8.8/16', + '8.8.8.8/255.255.0.0', + '8.8.8.8/32', + ] + IPV4_NEGATIVE_PATTERNS = [ + '', + '0000', + '0.0.0.0.', + '0.0.0.0./0.0.0.0.', + '0.0.0.0./1', + '0.0.0.0.0', + '0.0.0.0/0.0.0.0.', + '0.0.0.256', + '0.0.0', + '1.2.3.4.5', + '1.2.3', + '10.010.10.10', + '2001:0db8:85a3:0000:0000:8a2e:0370:73342001:0db8:85a3:0000:0000:8a2e:0370:7334', + '4.4.4', + '77', + '9999.9999.9999.9999', + 'affe::beef', + 'nope', + ] +end diff --git a/environments/production/modules/stdlib/spec/unit/ensure_resources_spec.rb b/environments/production/modules/stdlib/spec/unit/ensure_resources_spec.rb new file mode 100644 index 0000000..aea723e --- /dev/null +++ b/environments/production/modules/stdlib/spec/unit/ensure_resources_spec.rb @@ -0,0 +1,22 @@ +require 'spec_helper' + +describe 'test::ensure_resources', type: :class do + let(:params) {{ resource_type: 'user', title_hash: title_param, attributes_hash: {'ensure' => 'present'} }} + + describe 'given a title hash of multiple resources' do + + let(:title_param) { {'dan' => { 'gid' => 'mygroup', 'uid' => '600' }, 'alex' => { 'gid' => 'mygroup', 'uid' => '700'}} } + + it { is_expected.to compile } + it { is_expected.to contain_user('dan').with({ 'gid' => 'mygroup', 'uid' => '600', 'ensure' => 'present'}) } + it { is_expected.to contain_user('alex').with({ 'gid' => 'mygroup', 'uid' => '700', 'ensure' => 'present'}) } + end + + describe 'given a title hash of a single resource' do + + let(:title_param) { {'dan' => { 'gid' => 'mygroup', 'uid' => '600' }} } + + it { is_expected.to compile } + it { is_expected.to contain_user('dan').with({ 'gid' => 'mygroup', 'uid' => '600', 'ensure' => 'present'}) } + end +end diff --git a/environments/production/modules/stdlib/spec/unit/facter/facter_dot_d_spec.rb b/environments/production/modules/stdlib/spec/unit/facter/facter_dot_d_spec.rb new file mode 100755 index 0000000..0afadb2 --- /dev/null +++ b/environments/production/modules/stdlib/spec/unit/facter/facter_dot_d_spec.rb @@ -0,0 +1,32 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'facter/facter_dot_d' + +describe Facter::Util::DotD do + + context 'returns a simple fact' do + before :each do + Facter.stubs(:version).returns('1.6.1') + subject.stubs(:entries).returns(['/etc/facter/facts.d/fake_fact.txt']) + File.stubs(:readlines).with('/etc/facter/facts.d/fake_fact.txt').returns(['fake_fact=fake fact']) + subject.create + end + + it 'should return successfully' do + expect(Facter.fact(:fake_fact).value).to eq('fake fact') + end + end + + context 'returns a fact with equals signs' do + before :each do + Facter.stubs(:version).returns('1.6.1') + subject.stubs(:entries).returns(['/etc/facter/facts.d/foo.txt']) + File.stubs(:readlines).with('/etc/facter/facts.d/foo.txt').returns(['foo=1+1=2']) + subject.create + end + + it 'should return successfully' do + expect(Facter.fact(:foo).value).to eq('1+1=2') + end + end +end diff --git a/environments/production/modules/stdlib/spec/unit/facter/package_provider_spec.rb b/environments/production/modules/stdlib/spec/unit/facter/package_provider_spec.rb new file mode 100644 index 0000000..3954faf --- /dev/null +++ b/environments/production/modules/stdlib/spec/unit/facter/package_provider_spec.rb @@ -0,0 +1,44 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'puppet/type' +require 'puppet/type/package' + +describe 'package_provider', :type => :fact do + before { Facter.clear } + after { Facter.clear } + + ['4.2.2', '3.7.1 (Puppet Enterprise 3.2.1)'].each do |puppetversion| + describe "on puppet ''#{puppetversion}''" do + before :each do + Facter.stubs(:value).returns puppetversion + end + + context "darwin" do + it "should return pkgdmg" do + provider = Puppet::Type.type(:package).provider(:pkgdmg) + Puppet::Type.type(:package).stubs(:defaultprovider).returns provider + + expect(Facter.fact(:package_provider).value).to eq('pkgdmg') + end + end + + context "centos 7" do + it "should return yum" do + provider = Puppet::Type.type(:package).provider(:yum) + Puppet::Type.type(:package).stubs(:defaultprovider).returns provider + + expect(Facter.fact(:package_provider).value).to eq('yum') + end + end + + context "ubuntu" do + it "should return apt" do + provider = Puppet::Type.type(:package).provider(:apt) + Puppet::Type.type(:package).stubs(:defaultprovider).returns provider + + expect(Facter.fact(:package_provider).value).to eq('apt') + end + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/unit/facter/pe_version_spec.rb b/environments/production/modules/stdlib/spec/unit/facter/pe_version_spec.rb new file mode 100755 index 0000000..c11a1cd --- /dev/null +++ b/environments/production/modules/stdlib/spec/unit/facter/pe_version_spec.rb @@ -0,0 +1,88 @@ +#!/usr/bin/env rspec + +require 'spec_helper' + +describe "PE Version specs" do + before :each do + # Explicitly load the pe_version.rb file which contains generated facts + # that cannot be automatically loaded. Puppet 2.x implements + # Facter.collection.load while Facter 1.x markes Facter.collection.load as + # a private method. + if Facter.collection.respond_to? :load + Facter.collection.load(:pe_version) + else + Facter.collection.loader.load(:pe_version) + end + end + + context "When puppetversion is nil" do + before :each do + Facter.fact(:puppetversion).stubs(:value).returns(nil) + end + + it "pe_version is nil" do + expect(Facter.fact(:puppetversion).value).to be_nil + expect(Facter.fact(:pe_version).value).to be_nil + end + end + + context "If PE is installed" do + %w{ 2.6.1 2.10.300 }.each do |version| + puppetversion = "2.7.19 (Puppet Enterprise #{version})" + context "puppetversion => #{puppetversion}" do + before :each do + Facter.fact(:puppetversion).stubs(:value).returns(puppetversion) + end + + (major,minor,patch) = version.split(".") + + it "Should return true" do + expect(Facter.fact(:is_pe).value).to eq(true) + end + + it "Should have a version of #{version}" do + expect(Facter.fact(:pe_version).value).to eq(version) + end + + it "Should have a major version of #{major}" do + expect(Facter.fact(:pe_major_version).value).to eq(major) + end + + it "Should have a minor version of #{minor}" do + expect(Facter.fact(:pe_minor_version).value).to eq(minor) + end + + it "Should have a patch version of #{patch}" do + expect(Facter.fact(:pe_patch_version).value).to eq(patch) + end + end + end + end + + context "When PE is not installed" do + before :each do + Facter.fact(:puppetversion).stubs(:value).returns("2.7.19") + end + + it "is_pe is false" do + expect(Facter.fact(:is_pe).value).to eq(false) + end + + it "pe_version is nil" do + expect(Facter.fact(:pe_version).value).to be_nil + end + + it "pe_major_version is nil" do + expect(Facter.fact(:pe_major_version).value).to be_nil + end + + it "pe_minor_version is nil" do + expect(Facter.fact(:pe_minor_version).value).to be_nil + end + + it "Should have a patch version" do + expect(Facter.fact(:pe_patch_version).value).to be_nil + end + end + +end diff --git a/environments/production/modules/stdlib/spec/unit/facter/root_home_spec.rb b/environments/production/modules/stdlib/spec/unit/facter/root_home_spec.rb new file mode 100755 index 0000000..a5c2846 --- /dev/null +++ b/environments/production/modules/stdlib/spec/unit/facter/root_home_spec.rb @@ -0,0 +1,65 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'facter/root_home' + +describe Facter::Util::RootHome do + context "solaris" do + let(:root_ent) { "root:x:0:0:Super-User:/:/sbin/sh" } + let(:expected_root_home) { "/" } + + it "should return /" do + Facter::Util::Resolution.expects(:exec).with("getent passwd root").returns(root_ent) + expect(Facter::Util::RootHome.get_root_home).to eq(expected_root_home) + end + end + context "linux" do + let(:root_ent) { "root:x:0:0:root:/root:/bin/bash" } + let(:expected_root_home) { "/root" } + + it "should return /root" do + Facter::Util::Resolution.expects(:exec).with("getent passwd root").returns(root_ent) + expect(Facter::Util::RootHome.get_root_home).to eq(expected_root_home) + end + end + context "windows" do + before :each do + Facter::Util::Resolution.expects(:exec).with("getent passwd root").returns(nil) + end + it "should be nil on windows" do + expect(Facter::Util::RootHome.get_root_home).to be_nil + end + end +end + +describe 'root_home', :type => :fact do + before { Facter.clear } + after { Facter.clear } + + context "macosx" do + before do + Facter.fact(:kernel).stubs(:value).returns("Darwin") + Facter.fact(:osfamily).stubs(:value).returns("Darwin") + end + let(:expected_root_home) { "/var/root" } + sample_dscacheutil = File.read(fixtures('dscacheutil','root')) + + it "should return /var/root" do + Facter::Util::Resolution.stubs(:exec).with("dscacheutil -q user -a name root").returns(sample_dscacheutil) + expect(Facter.fact(:root_home).value).to eq(expected_root_home) + end + end + + context "aix" do + before do + Facter.fact(:kernel).stubs(:value).returns("AIX") + Facter.fact(:osfamily).stubs(:value).returns("AIX") + end + let(:expected_root_home) { "/root" } + sample_lsuser = File.read(fixtures('lsuser','root')) + + it "should return /root" do + Facter::Util::Resolution.stubs(:exec).with("lsuser -c -a home root").returns(sample_lsuser) + expect(Facter.fact(:root_home).value).to eq(expected_root_home) + end + end +end diff --git a/environments/production/modules/stdlib/spec/unit/facter/service_provider_spec.rb b/environments/production/modules/stdlib/spec/unit/facter/service_provider_spec.rb new file mode 100644 index 0000000..ad8a5fc --- /dev/null +++ b/environments/production/modules/stdlib/spec/unit/facter/service_provider_spec.rb @@ -0,0 +1,37 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'puppet/type' +require 'puppet/type/service' + +describe 'service_provider', :type => :fact do + before { Facter.clear } + after { Facter.clear } + + context "macosx" do + it "should return launchd" do + provider = Puppet::Type.type(:service).provider(:launchd) + Puppet::Type.type(:service).stubs(:defaultprovider).returns provider + + expect(Facter.fact(:service_provider).value).to eq('launchd') + end + end + + context "systemd" do + it "should return systemd" do + provider = Puppet::Type.type(:service).provider(:systemd) + Puppet::Type.type(:service).stubs(:defaultprovider).returns provider + + expect(Facter.fact(:service_provider).value).to eq('systemd') + end + end + + context "redhat" do + it "should return redhat" do + provider = Puppet::Type.type(:service).provider(:redhat) + Puppet::Type.type(:service).stubs(:defaultprovider).returns provider + + expect(Facter.fact(:service_provider).value).to eq('redhat') + end + end + +end diff --git a/environments/production/modules/stdlib/spec/unit/facter/util/puppet_settings_spec.rb b/environments/production/modules/stdlib/spec/unit/facter/util/puppet_settings_spec.rb new file mode 100755 index 0000000..c278b79 --- /dev/null +++ b/environments/production/modules/stdlib/spec/unit/facter/util/puppet_settings_spec.rb @@ -0,0 +1,37 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'facter/util/puppet_settings' + +describe Facter::Util::PuppetSettings do + + describe "#with_puppet" do + context "Without Puppet loaded" do + before(:each) do + Module.expects(:const_get).with("Puppet").raises(NameError) + end + + it 'should be nil' do + expect(subject.with_puppet { Puppet[:vardir] }).to be_nil + end + it 'should not yield to the block' do + Puppet.expects(:[]).never + expect(subject.with_puppet { Puppet[:vardir] }).to be_nil + end + end + context "With Puppet loaded" do + module Puppet; end + let(:vardir) { "/var/lib/puppet" } + + before :each do + Puppet.expects(:[]).with(:vardir).returns vardir + end + + it 'should yield to the block' do + subject.with_puppet { Puppet[:vardir] } + end + it 'should return the nodes vardir' do + expect(subject.with_puppet { Puppet[:vardir] }).to eq vardir + end + end + end +end diff --git a/environments/production/modules/stdlib/spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb b/environments/production/modules/stdlib/spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb new file mode 100644 index 0000000..b162127 --- /dev/null +++ b/environments/production/modules/stdlib/spec/unit/puppet/parser/functions/enclose_ipv6_spec.rb @@ -0,0 +1,69 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' + +describe "the enclose_ipv6 function" do + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + it "should exist" do + expect(Puppet::Parser::Functions.function("enclose_ipv6")).to eq("function_enclose_ipv6") + end + + it "should raise a ParseError if there is less than 1 arguments" do + expect { scope.function_enclose_ipv6([]) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError if there is more than 1 arguments" do + expect { scope.function_enclose_ipv6(['argument1','argument2']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError when given garbage" do + expect { scope.function_enclose_ipv6(['garbage']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError when given something else than a string or an array" do + expect { scope.function_enclose_ipv6([['1' => '127.0.0.1']]) }.to( raise_error(Puppet::ParseError) ) + end + + it "should not raise a ParseError when given a single ip string" do + expect { scope.function_enclose_ipv6(['127.0.0.1']) }.to_not raise_error + end + + it "should not raise a ParseError when given * as ip string" do + expect { scope.function_enclose_ipv6(['*']) }.to_not raise_error + end + + it "should not raise a ParseError when given an array of ip strings" do + expect { scope.function_enclose_ipv6([['127.0.0.1','fe80::1']]) }.to_not raise_error + end + + it "should not raise a ParseError when given differently notations of ip addresses" do + expect { scope.function_enclose_ipv6([['127.0.0.1','fe80::1','[fe80::1]']]) }.to_not raise_error + end + + it "should raise a ParseError when given a wrong ipv4 address" do + expect { scope.function_enclose_ipv6(['127..0.0.1']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError when given a ipv4 address with square brackets" do + expect { scope.function_enclose_ipv6(['[127.0.0.1]']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should raise a ParseError when given a wrong ipv6 address" do + expect { scope.function_enclose_ipv6(['fe80:::1']) }.to( raise_error(Puppet::ParseError) ) + end + + it "should embrace ipv6 adresses within an array of ip addresses" do + result = scope.function_enclose_ipv6([['127.0.0.1','fe80::1','[fe80::2]']]) + expect(result).to(eq(['127.0.0.1','[fe80::1]','[fe80::2]'])) + end + + it "should embrace a single ipv6 adresse" do + result = scope.function_enclose_ipv6(['fe80::1']) + expect(result).to(eq(['[fe80::1]'])) + end + + it "should not embrace a single ipv4 adresse" do + result = scope.function_enclose_ipv6(['127.0.0.1']) + expect(result).to(eq(['127.0.0.1'])) + end +end diff --git a/environments/production/modules/stdlib/spec/unit/puppet/parser/functions/is_absolute_path_spec.rb b/environments/production/modules/stdlib/spec/unit/puppet/parser/functions/is_absolute_path_spec.rb new file mode 100644 index 0000000..8931208 --- /dev/null +++ b/environments/production/modules/stdlib/spec/unit/puppet/parser/functions/is_absolute_path_spec.rb @@ -0,0 +1,86 @@ +require 'spec_helper' + +describe :is_absolute_path do + let(:scope) { PuppetlabsSpec::PuppetInternals.scope } + + let(:function_args) do + [] + end + + let(:function) do + scope.function_is_absolute_path(function_args) + end + + + describe 'validate arity' do + let(:function_args) do + [1,2] + end + it "should raise a ParseError if there is more than 1 arguments" do + lambda { function }.should( raise_error(ArgumentError)) + end + + end + + it "should exist" do + Puppet::Parser::Functions.function(subject).should == "function_#{subject}" + end + + # help enforce good function defination + it 'should contain arity' do + + end + + it "should raise a ParseError if there is less than 1 arguments" do + lambda { function }.should( raise_error(ArgumentError)) + end + + + describe 'should retrun true' do + let(:return_value) do + true + end + + describe 'windows' do + let(:function_args) do + ['c:\temp\test.txt'] + end + it 'should return data' do + function.should eq(return_value) + end + end + + describe 'non-windows' do + let(:function_args) do + ['/temp/test.txt'] + end + + it 'should return data' do + function.should eq(return_value) + end + end + end + + describe 'should return false' do + let(:return_value) do + false + end + describe 'windows' do + let(:function_args) do + ['..\temp\test.txt'] + end + it 'should return data' do + function.should eq(return_value) + end + end + + describe 'non-windows' do + let(:function_args) do + ['../var/lib/puppet'] + end + it 'should return data' do + function.should eq(return_value) + end + end + end +end \ No newline at end of file diff --git a/environments/production/modules/stdlib/spec/unit/puppet/provider/file_line/ruby_spec.rb b/environments/production/modules/stdlib/spec/unit/puppet/provider/file_line/ruby_spec.rb new file mode 100755 index 0000000..1f41f62 --- /dev/null +++ b/environments/production/modules/stdlib/spec/unit/puppet/provider/file_line/ruby_spec.rb @@ -0,0 +1,447 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'tempfile' +provider_class = Puppet::Type.type(:file_line).provider(:ruby) +describe provider_class do + context "when adding" do + let :tmpfile do + tmp = Tempfile.new('tmp') + path = tmp.path + tmp.close! + path + end + let :resource do + Puppet::Type::File_line.new( + {:name => 'foo', :path => tmpfile, :line => 'foo'} + ) + end + let :provider do + provider_class.new(resource) + end + + it 'should detect if the line exists in the file' do + File.open(tmpfile, 'w') do |fh| + fh.write('foo') + end + expect(provider.exists?).to be_truthy + end + it 'should detect if the line does not exist in the file' do + File.open(tmpfile, 'w') do |fh| + fh.write('foo1') + end + expect(provider.exists?).to be_nil + end + it 'should append to an existing file when creating' do + provider.create + expect(File.read(tmpfile).chomp).to eq('foo') + end + end + context 'when using replace' do + before :each do + # TODO: these should be ported over to use the PuppetLabs spec_helper + # file fixtures once the following pull request has been merged: + # https://github.com/puppetlabs/puppetlabs-stdlib/pull/73/files + tmp = Tempfile.new('tmp') + @tmpfile = tmp.path + tmp.close! + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo = bar', + :match => '^foo\s*=.*$', + :replace => false, + } + ) + @provider = provider_class.new(@resource) + end + + it 'should not replace the matching line' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo=blah\nfoo2\nfoo3") + end + expect(@provider.exists?).to be_truthy + @provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\nfoo=blah\nfoo2\nfoo3") + end + + it 'should append the line if no matches are found' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo2") + end + expect(@provider.exists?).to be_nil + @provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\nfoo2\nfoo = bar") + end + + it 'should raise an error with invalid values' do + expect { + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo = bar', + :match => '^foo\s*=.*$', + :replace => 'asgadga', + } + ) + }.to raise_error(Puppet::Error, /Invalid value "asgadga"\. Valid values are true, false\./) + end + end + context "when matching" do + before :each do + # TODO: these should be ported over to use the PuppetLabs spec_helper + # file fixtures once the following pull request has been merged: + # https://github.com/puppetlabs/puppetlabs-stdlib/pull/73/files + tmp = Tempfile.new('tmp') + @tmpfile = tmp.path + tmp.close! + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo = bar', + :match => '^foo\s*=.*$', + } + ) + @provider = provider_class.new(@resource) + end + + describe 'using match' do + it 'should raise an error if more than one line matches, and should not have modified the file' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo=blah\nfoo2\nfoo=baz") + end + expect(@provider.exists?).to be_nil + expect { @provider.create }.to raise_error(Puppet::Error, /More than one line.*matches/) + expect(File.read(@tmpfile)).to eql("foo1\nfoo=blah\nfoo2\nfoo=baz") + end + + it 'should replace all lines that matches' do + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo = bar', + :match => '^foo\s*=.*$', + :multiple => true, + } + ) + @provider = provider_class.new(@resource) + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo=blah\nfoo2\nfoo=baz") + end + expect(@provider.exists?).to be_nil + @provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\nfoo = bar\nfoo2\nfoo = bar") + end + + it 'should raise an error with invalid values' do + expect { + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo = bar', + :match => '^foo\s*=.*$', + :multiple => 'asgadga', + } + ) + }.to raise_error(Puppet::Error, /Invalid value "asgadga"\. Valid values are true, false\./) + end + + it 'should replace a line that matches' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo=blah\nfoo2") + end + expect(@provider.exists?).to be_nil + @provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\nfoo = bar\nfoo2") + end + it 'should add a new line if no lines match' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo2") + end + expect(@provider.exists?).to be_nil + @provider.create + expect(File.read(@tmpfile)).to eql("foo1\nfoo2\nfoo = bar\n") + end + it 'should do nothing if the exact line already exists' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo = bar\nfoo2") + end + expect(@provider.exists?).to be_truthy + @provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\nfoo = bar\nfoo2") + end + end + + describe 'using after' do + let :resource do + Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'inserted = line', + :after => '^foo1', + } + ) + end + + let :provider do + provider_class.new(resource) + end + context 'match and after set' do + shared_context 'resource_create' do + let(:match) { '^foo2$' } + let(:after) { '^foo1$' } + let(:resource) { + Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'inserted = line', + :after => after, + :match => match, + } + ) + } + end + before :each do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo2\nfoo = baz") + end + end + describe 'inserts at match' do + include_context 'resource_create' + it { + provider.create + expect(File.read(@tmpfile).chomp).to eq("foo1\ninserted = line\nfoo = baz") + } + end + describe 'inserts a new line after when no match' do + include_context 'resource_create' do + let(:match) { '^nevergoingtomatch$' } + end + it { + provider.create + expect(File.read(@tmpfile).chomp).to eq("foo1\ninserted = line\nfoo2\nfoo = baz") + } + end + describe 'append to end of file if no match for both after and match' do + include_context 'resource_create' do + let(:match) { '^nevergoingtomatch$' } + let(:after) { '^stillneverafter' } + end + it { + provider.create + expect(File.read(@tmpfile).chomp).to eq("foo1\nfoo2\nfoo = baz\ninserted = line") + } + end + end + context 'with one line matching the after expression' do + before :each do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo = blah\nfoo2\nfoo = baz") + end + end + + it 'inserts the specified line after the line matching the "after" expression' do + provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\ninserted = line\nfoo = blah\nfoo2\nfoo = baz") + end + end + + context 'with multiple lines matching the after expression' do + before :each do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo = blah\nfoo2\nfoo1\nfoo = baz") + end + end + + it 'errors out stating "One or no line must match the pattern"' do + expect { provider.create }.to raise_error(Puppet::Error, /One or no line must match the pattern/) + end + + it 'adds the line after all lines matching the after expression' do + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'inserted = line', + :after => '^foo1$', + :multiple => true, + } + ) + @provider = provider_class.new(@resource) + expect(@provider.exists?).to be_nil + @provider.create + expect(File.read(@tmpfile).chomp).to eql("foo1\ninserted = line\nfoo = blah\nfoo2\nfoo1\ninserted = line\nfoo = baz") + end + end + + context 'with no lines matching the after expression' do + let :content do + "foo3\nfoo = blah\nfoo2\nfoo = baz\n" + end + + before :each do + File.open(@tmpfile, 'w') do |fh| + fh.write(content) + end + end + + it 'appends the specified line to the file' do + provider.create + expect(File.read(@tmpfile)).to eq(content << resource[:line] << "\n") + end + end + end + end + + context "when removing" do + before :each do + # TODO: these should be ported over to use the PuppetLabs spec_helper + # file fixtures once the following pull request has been merged: + # https://github.com/puppetlabs/puppetlabs-stdlib/pull/73/files + tmp = Tempfile.new('tmp') + @tmpfile = tmp.path + tmp.close! + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo', + :ensure => 'absent', + } + ) + @provider = provider_class.new(@resource) + end + it 'should remove the line if it exists' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo2") + end + + it 'should remove the line without touching the last new line' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2\n") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo2\n") + end + + it 'should remove any occurence of the line' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2\nfoo\nfoo") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo2\n") + end + end + + context "when removing with a match" do + before :each do + # TODO: these should be ported over to use the PuppetLabs spec_helper + # file fixtures once the following pull request has been merged: + # https://github.com/puppetlabs/puppetlabs-stdlib/pull/73/files + tmp = Tempfile.new('tmp') + @tmpfile = tmp.path + tmp.close! + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo2', + :ensure => 'absent', + :match => 'o$', + :match_for_absence => true, + } + ) + @provider = provider_class.new(@resource) + end + + it 'should find a line to match' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2") + end + expect(@provider.exists?).to be_truthy + end + + it 'should remove one line if it matches' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo2") + end + + it 'should raise an error if more than one line matches' do + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2\nfoo\nfoo") + end + expect { @provider.destroy }.to raise_error(Puppet::Error, /More than one line/) + end + + it 'should remove multiple lines if :multiple is true' do + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo2', + :ensure => 'absent', + :match => 'o$', + :multiple => true, + :match_for_absence => true, + } + ) + @provider = provider_class.new(@resource) + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2\nfoo\nfoo") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo2\n") + end + + it 'should ignore the match if match_for_absence is not specified' do + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo2', + :ensure => 'absent', + :match => 'o$', + } + ) + @provider = provider_class.new(@resource) + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo\n") + end + + it 'should ignore the match if match_for_absence is false' do + @resource = Puppet::Type::File_line.new( + { + :name => 'foo', + :path => @tmpfile, + :line => 'foo2', + :ensure => 'absent', + :match => 'o$', + :match_for_absence => false, + } + ) + @provider = provider_class.new(@resource) + File.open(@tmpfile, 'w') do |fh| + fh.write("foo1\nfoo\nfoo2") + end + @provider.destroy + expect(File.read(@tmpfile)).to eql("foo1\nfoo\n") + end + + end + +end diff --git a/environments/production/modules/stdlib/spec/unit/puppet/type/anchor_spec.rb b/environments/production/modules/stdlib/spec/unit/puppet/type/anchor_spec.rb new file mode 100755 index 0000000..c738a27 --- /dev/null +++ b/environments/production/modules/stdlib/spec/unit/puppet/type/anchor_spec.rb @@ -0,0 +1,11 @@ +#!/usr/bin/env ruby + +require 'spec_helper' + +anchor = Puppet::Type.type(:anchor).new(:name => "ntp::begin") + +describe anchor do + it "should stringify normally" do + expect(anchor.to_s).to eq("Anchor[ntp::begin]") + end +end diff --git a/environments/production/modules/stdlib/spec/unit/puppet/type/file_line_spec.rb b/environments/production/modules/stdlib/spec/unit/puppet/type/file_line_spec.rb new file mode 100755 index 0000000..150149b --- /dev/null +++ b/environments/production/modules/stdlib/spec/unit/puppet/type/file_line_spec.rb @@ -0,0 +1,113 @@ +#! /usr/bin/env ruby -S rspec +require 'spec_helper' +require 'tempfile' +describe Puppet::Type.type(:file_line) do + let :tmp_path do + if Puppet::Util::Platform.windows? + 'C:\tmp\path' + else + '/tmp/path' + end + end + let :my_path do + if Puppet::Util::Platform.windows? + 'C:\my\path' + else + '/my/path' + end + end + let :file_line do + Puppet::Type.type(:file_line).new(:name => 'foo', :line => 'line', :path => tmp_path) + end + it 'should accept a line and path' do + file_line[:line] = 'my_line' + expect(file_line[:line]).to eq('my_line') + file_line[:path] = my_path + expect(file_line[:path]).to eq(my_path) + end + it 'should accept a match regex' do + file_line[:match] = '^foo.*$' + expect(file_line[:match]).to eq('^foo.*$') + end + it 'should accept a match regex that does not match the specified line' do + expect { + Puppet::Type.type(:file_line).new( + :name => 'foo', + :path => my_path, + :line => 'foo=bar', + :match => '^bar=blah$' + )}.not_to raise_error + end + it 'should accept a match regex that does match the specified line' do + expect { + Puppet::Type.type(:file_line).new( + :name => 'foo', + :path => my_path, + :line => 'foo=bar', + :match => '^\s*foo=.*$' + )}.not_to raise_error + end + it 'should accept utf8 characters' do + expect { + Puppet::Type.type(:file_line).new( + :name => 'ƒồỗ', + :path => my_path, + :line => 'ƒồỗ=ьåя', + :match => '^ьåя=βļάħ$' + )}.not_to raise_error + end + it 'should accept double byte characters' do + expect { + Puppet::Type.type(:file_line).new( + :name => 'フーバー', + :path => my_path, + :line => 'この=それ', + :match => '^この=ああ$' + )}.not_to raise_error + end + it 'should accept posix filenames' do + file_line[:path] = tmp_path + expect(file_line[:path]).to eq(tmp_path) + end + it 'should not accept unqualified path' do + expect { file_line[:path] = 'file' }.to raise_error(Puppet::Error, /File paths must be fully qualified/) + end + it 'should require that a line is specified' do + expect { Puppet::Type.type(:file_line).new(:name => 'foo', :path => tmp_path) }.to raise_error(Puppet::Error, /line is a required attribute/) + end + it 'should not require that a line is specified when matching for absence' do + expect { Puppet::Type.type(:file_line).new(:name => 'foo', :path => tmp_path, :ensure => :absent, :match_for_absence => :true, :match => 'match') }.not_to raise_error + end + it 'should require that a file is specified' do + expect { Puppet::Type.type(:file_line).new(:name => 'foo', :line => 'path') }.to raise_error(Puppet::Error, /path is a required attribute/) + end + it 'should default to ensure => present' do + expect(file_line[:ensure]).to eq :present + end + it 'should default to replace => true' do + expect(file_line[:replace]).to eq :true + end + it 'should default to encoding => UTF-8' do + expect(file_line[:encoding]).to eq 'UTF-8' + end + it 'should accept encoding => iso-8859-1' do + expect { Puppet::Type.type(:file_line).new(:name => 'foo', :path => tmp_path, :ensure => :present, :encoding => 'iso-8859-1', :line => 'bar') }.not_to raise_error + end + it "should autorequire the file it manages" do + catalog = Puppet::Resource::Catalog.new + file = Puppet::Type.type(:file).new(:name => tmp_path) + catalog.add_resource file + catalog.add_resource file_line + + relationship = file_line.autorequire.find do |rel| + (rel.source.to_s == "File[#{tmp_path}]") and (rel.target.to_s == file_line.to_s) + end + expect(relationship).to be_a Puppet::Relationship + end + + it "should not autorequire the file it manages if it is not managed" do + catalog = Puppet::Resource::Catalog.new + catalog.add_resource file_line + expect(file_line.autorequire).to be_empty + end +end diff --git a/environments/production/modules/stdlib/types/absolutepath.pp b/environments/production/modules/stdlib/types/absolutepath.pp new file mode 100644 index 0000000..70ec916 --- /dev/null +++ b/environments/production/modules/stdlib/types/absolutepath.pp @@ -0,0 +1,2 @@ +# A strict absolutepath type +type Stdlib::Absolutepath = Variant[Stdlib::Windowspath, Stdlib::Unixpath] diff --git a/environments/production/modules/stdlib/types/compat/absolute_path.pp b/environments/production/modules/stdlib/types/compat/absolute_path.pp new file mode 100644 index 0000000..d11784e --- /dev/null +++ b/environments/production/modules/stdlib/types/compat/absolute_path.pp @@ -0,0 +1,7 @@ +# Emulate the is_absolute_path and validate_absolute_path functions +# +# The first pattern is originally from is_absolute_path, which had it from 2.7.x's lib/puppet/util.rb Puppet::Util.absolute_path? +# slash = '[\\\\/]' +# name = '[^\\\\/]+' +# %r!^(([A-Z]:#{slash})|(#{slash}#{slash}#{name}#{slash}#{name})|(#{slash}#{slash}\?#{slash}#{name}))!i, +type Stdlib::Compat::Absolute_path = Variant[Pattern[/^(([a-zA-Z]:[\\\/])|([\\\/][\\\/][^\\\/]+[\\\/][^\\\/]+)|([\\\/][\\\/]\?[\\\/][^\\\/]+))/], Pattern[/^\//]] diff --git a/environments/production/modules/stdlib/types/compat/array.pp b/environments/production/modules/stdlib/types/compat/array.pp new file mode 100644 index 0000000..ba65dc4 --- /dev/null +++ b/environments/production/modules/stdlib/types/compat/array.pp @@ -0,0 +1,2 @@ +# Emulate the is_array and validate_array functions +type Stdlib::Compat::Array = Array[Any] diff --git a/environments/production/modules/stdlib/types/compat/bool.pp b/environments/production/modules/stdlib/types/compat/bool.pp new file mode 100644 index 0000000..5d8e27e --- /dev/null +++ b/environments/production/modules/stdlib/types/compat/bool.pp @@ -0,0 +1,2 @@ +# Emulate the is_bool and validate_bool functions +type Stdlib::Compat::Bool = Boolean diff --git a/environments/production/modules/stdlib/types/compat/float.pp b/environments/production/modules/stdlib/types/compat/float.pp new file mode 100644 index 0000000..7f98bd2 --- /dev/null +++ b/environments/production/modules/stdlib/types/compat/float.pp @@ -0,0 +1,19 @@ +# Emulate the is_float function +# The regex is what's currently used in is_float +# To keep your development moving forward, you can also add a deprecation warning using the Integer type: +# +# ```class example($value) { validate_float($value,) }``` +# +# would turn into +# +# ``` +# class example(Stdlib::Compat::Float $value) { +# validate_float($value, 10, 0) +# assert_type(Integer[0, 10], $value) |$expected, $actual| { +# warning("The 'value' parameter for the 'ntp' class has type ${actual}, but should be ${expected}.") +# } +# } +# ``` +# +# This allows you to find all places where a consumers of your code call it with unexpected values. +type Stdlib::Compat::Float = Variant[Float, Pattern[/^-?(?:(?:[1-9]\d*)|0)(?:\.\d+)(?:[eE]-?\d+)?$/]] diff --git a/environments/production/modules/stdlib/types/compat/hash.pp b/environments/production/modules/stdlib/types/compat/hash.pp new file mode 100644 index 0000000..e84a10b --- /dev/null +++ b/environments/production/modules/stdlib/types/compat/hash.pp @@ -0,0 +1,2 @@ +# Emulate the is_hash and validate_hash functions +type Stdlib::Compat::Hash = Hash[Any, Any] diff --git a/environments/production/modules/stdlib/types/compat/integer.pp b/environments/production/modules/stdlib/types/compat/integer.pp new file mode 100644 index 0000000..e5cadb6 --- /dev/null +++ b/environments/production/modules/stdlib/types/compat/integer.pp @@ -0,0 +1,23 @@ +# Emulate the is_integer and validate_integer functions +# The regex is what's currently used in is_integer +# validate_numeric also allows range checking, which cannot be mapped to the string parsing inside the function. +# For full backwards compatibility, you will need to keep the validate_numeric call around to catch everything. +# To keep your development moving forward, you can also add a deprecation warning using the Integer type: +# +# ```class example($value) { validate_integer($value, 10, 0) }``` +# +# would turn into +# +# ``` +# class example(Stdlib::Compat::Integer $value) { +# validate_numeric($value, 10, 0) +# assert_type(Integer[0, 10], $value) |$expected, $actual| { +# warning("The 'value' parameter for the 'ntp' class has type ${actual}, but should be ${expected}.") +# } +# } +# ``` +# +# > Note that you need to use Variant[Integer[0, 10], Float[0, 10]] if you want to match both integers and floating point numbers. +# +# This allows you to find all places where a consumers of your code call it with unexpected values. +type Stdlib::Compat::Integer = Variant[Integer, Pattern[/^-?(?:(?:[1-9]\d*)|0)$/], Array[Variant[Integer, Pattern[/^-?(?:(?:[1-9]\d*)|0)$/]]]] diff --git a/environments/production/modules/stdlib/types/compat/ip_address.pp b/environments/production/modules/stdlib/types/compat/ip_address.pp new file mode 100644 index 0000000..bf4c4b4 --- /dev/null +++ b/environments/production/modules/stdlib/types/compat/ip_address.pp @@ -0,0 +1 @@ +type Stdlib::Compat::Ip_address = Variant[Stdlib::Compat::Ipv4, Stdlib::Compat::Ipv6] diff --git a/environments/production/modules/stdlib/types/compat/ipv4.pp b/environments/production/modules/stdlib/types/compat/ipv4.pp new file mode 100644 index 0000000..a0ba0d6 --- /dev/null +++ b/environments/production/modules/stdlib/types/compat/ipv4.pp @@ -0,0 +1,2 @@ +# Emulate the validate_ipv4_address and is_ipv4_address functions +type Stdlib::Compat::Ipv4 = Pattern[/^((([0-9](?!\d)|[1-9][0-9](?!\d)|1[0-9]{2}(?!\d)|2[0-4][0-9](?!\d)|25[0-5](?!\d))[.]){3}([0-9](?!\d)|[1-9][0-9](?!\d)|1[0-9]{2}(?!\d)|2[0-4][0-9](?!\d)|25[0-5](?!\d)))(\/((([0-9](?!\d)|[1-9][0-9](?!\d)|1[0-9]{2}(?!\d)|2[0-4][0-9](?!\d)|25[0-5](?!\d))[.]){3}([0-9](?!\d)|[1-9][0-9](?!\d)|1[0-9]{2}(?!\d)|2[0-4][0-9](?!\d)|25[0-5](?!\d))|[0-9]+))?$/] diff --git a/environments/production/modules/stdlib/types/compat/ipv6.pp b/environments/production/modules/stdlib/types/compat/ipv6.pp new file mode 100644 index 0000000..8b82f1a --- /dev/null +++ b/environments/production/modules/stdlib/types/compat/ipv6.pp @@ -0,0 +1 @@ +type Stdlib::Compat::Ipv6 = Pattern[/\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\s*$/] diff --git a/environments/production/modules/stdlib/types/compat/numeric.pp b/environments/production/modules/stdlib/types/compat/numeric.pp new file mode 100644 index 0000000..5bfc3d3 --- /dev/null +++ b/environments/production/modules/stdlib/types/compat/numeric.pp @@ -0,0 +1,23 @@ +# Emulate the is_numeric and validate_numeric functions +# The regex is what's currently used in is_numeric +# validate_numeric also allows range checking, which cannot be mapped to the string parsing inside the function. +# For full backwards compatibility, you will need to keep the validate_numeric call around to catch everything. +# To keep your development moving forward, you can also add a deprecation warning using the Integer type: +# +# ```class example($value) { validate_numeric($value, 10, 0) }``` +# +# would turn into +# +# ``` +# class example(Stdlib::Compat::Numeric $value) { +# validate_numeric($value, 10, 0) +# assert_type(Integer[0, 10], $value) |$expected, $actual| { +# warning("The 'value' parameter for the 'ntp' class has type ${actual}, but should be ${expected}.") +# } +# } +# ``` +# +# > Note that you need to use Variant[Integer[0, 10], Float[0, 10]] if you want to match both integers and floating point numbers. +# +# This allows you to find all places where a consumers of your code call it with unexpected values. +type Stdlib::Compat::Numeric = Variant[Numeric, Pattern[/^-?(?:(?:[1-9]\d*)|0)(?:\.\d+)?(?:[eE]-?\d+)?$/], Array[Variant[Numeric, Pattern[/^-?(?:(?:[1-9]\d*)|0)(?:\.\d+)?(?:[eE]-?\d+)?$/]]]] diff --git a/environments/production/modules/stdlib/types/compat/re.pp b/environments/production/modules/stdlib/types/compat/re.pp new file mode 100644 index 0000000..e4b5f30 --- /dev/null +++ b/environments/production/modules/stdlib/types/compat/re.pp @@ -0,0 +1,3 @@ +# Emulate the validate_re function +# validate_re(value, re) translates to Pattern[re], which is not directly mappable as a type alias, but can be specified as Pattern[re]. +# Therefore this needs to be translated directly. diff --git a/environments/production/modules/stdlib/types/compat/string.pp b/environments/production/modules/stdlib/types/compat/string.pp new file mode 100644 index 0000000..b06255d --- /dev/null +++ b/environments/production/modules/stdlib/types/compat/string.pp @@ -0,0 +1,2 @@ +# Emulate the is_string and validate_string functions +type Stdlib::Compat::String = Optional[String] diff --git a/environments/production/modules/stdlib/types/httpsurl.pp b/environments/production/modules/stdlib/types/httpsurl.pp new file mode 100644 index 0000000..36fd30f --- /dev/null +++ b/environments/production/modules/stdlib/types/httpsurl.pp @@ -0,0 +1 @@ +type Stdlib::HTTPSUrl = Pattern[/^https:\/\//] diff --git a/environments/production/modules/stdlib/types/httpurl.pp b/environments/production/modules/stdlib/types/httpurl.pp new file mode 100644 index 0000000..0d93a95 --- /dev/null +++ b/environments/production/modules/stdlib/types/httpurl.pp @@ -0,0 +1 @@ +type Stdlib::HTTPUrl = Pattern[/^https?:\/\//] diff --git a/environments/production/modules/stdlib/types/unixpath.pp b/environments/production/modules/stdlib/types/unixpath.pp new file mode 100644 index 0000000..ec3bf7d --- /dev/null +++ b/environments/production/modules/stdlib/types/unixpath.pp @@ -0,0 +1,2 @@ +# this regex rejects any path component that is a / or a NUL +type Stdlib::Unixpath = Pattern[/^\/([^\/\0]+\/*)+$/] diff --git a/environments/production/modules/stdlib/types/windowspath.pp b/environments/production/modules/stdlib/types/windowspath.pp new file mode 100644 index 0000000..bc1ee9c --- /dev/null +++ b/environments/production/modules/stdlib/types/windowspath.pp @@ -0,0 +1 @@ +type Stdlib::Windowspath = Pattern[/^(([a-zA-Z]:[\\\/])|([\\\/][\\\/][^\\\/]+[\\\/][^\\\/]+)|([\\\/][\\\/]\?[\\\/][^\\\/]+))/] diff --git a/prod_env.png b/prod_env.png new file mode 100644 index 0000000000000000000000000000000000000000..2b491d7998c566e9df1ef1aadd8d55b87b73c574 GIT binary patch literal 40666 zcmb4rWmJ?=+ck=UfgqxECF7glI1UoqKw;MLhnc&W6buWI2?y7SYQsVQfPSC<>oBJhdkQk@%+&JBlN z2vP6@=_S|J*2X6JKbQ9V>U!MU#DA~IvcTab6>0OozY`N%(yXnr(Eqy%r9@L+{<}S6 zI48R-=-*XNx$i>y@7755^i;&Z8|eqF3bOOx#`S#aS!!N&`R!8UP?Ic>q9FHfXjMcn z|DGkkSsBG>3A~Sq+pO$**?4G|NwW!81;qW|H`x9djz+M>-3)AbKRw@QR;H}2{oErn zY;A&a!;P6R8<*!tU~-t;TTY!~?Y=8V$0U^0lJ4%;o!($-~-=s~b+$IfWIfnkvon3|HehA}3gb zS8`r`vl9qAndg&4xb3%C#`n2OWRa1QIdh0ok+BK2wcVy6exH`67W{AI1)ruk4UVt6 z7{P=)yG2{)(_ikP5?;qCln780hE21)m?rNh4f#~pB7N+;_5Ak_1{sC555rcD%vt|t z2SJ+6gSZ%NJII%W6j^1N#|-@x&)&hsD=I1q@1=E8KvAZN3PNp?#Kfe{5FIxhwy5Yk z+vp)#yuV+uxZ(7AnuUfC9}JJ6u2S#MCd|$uT6N2em?&9+`P|o+fMzPK_%7q+&AcEA2E zpH8hza8qE5jN6Ri8Rl|uNU)6uj-X#l)cKvPA8J*)Yx|GI2}+bBKVJFtCC2MopoGl- z43<~1srDHr z8{%@BHw;95kwgewIzMlfl6K7acJwtG0h{rB3jSF?eaZB96b7AGUkgpr5QbB;J}i-~ zQ(O?((n;w05jU!={5E|w!;S!Mhm#d0@B02OYe(cB1IyK$I(MQvDIS-|iX2Nv7>(Y% z`fnmw4EJ3x#r3?jm1kwV7t<<9LDy5g=O8EyAMdY*5oXE41rCwnM^8BfpE$P5wVRaA zaUDNz^S!o;s_5+^LpWe3tx9fFQT41uGE}W2gs)%QKD2F_7!RIQfok;A)`^`isXxU| z^Ur?MaT-;BycLM*jJ)i-KbAh_gQN+i6&zeJpJ|nRxvTf`UIlN(m7`N*t^@`1vA_MK z&ra$8Guwua*NNv1vG*O6TI$_c7e*3atTSd3{ezoOCD$UNP!%L^hbY#;Y*U2{1~XLsr$mg;Y)+_ z-*_ara4b?6Ftqw3C*x~;(6uyAQ*}~x!>4&>!v_3ibH~GPG=A}<=DO=m&o<3?369>p zb&G+ED{5?vJb-|EO>ni=X1mxYy?c!8kK>(MOq|Z+oS6e+~}%mXmQed+11s_utUb#Po}%&?w+% zF5P?Rg4!5zN8lLlJV5#3f8^mjd)ca#{2kNOe^gAvoL^M5+*+(at4`0r9Wv?XL>98_ zbG0#4mfd{UBU-b>=^j|yCB_KTk@~}$K;$-GePv}VY}PA{Q8rFlO|LD;u%+tIT%3_! zBssGu4&AEi=hAU$dum9Lb0hh?nC(!}^ep%K_dt&w#r~gAMLH{M>*}p@d_nV-+rDS% zlegMDNlY6LA@^1~iO$|lz= z6Ux+Hz2YcC)d!0A`(EX0nlC3IB}HHkrzM;;W&=2auMs_9#@+^DTO7C6#F?GI#%khp z3%;c)@^5Ieo3m5@#QSLlt(S}gk%nT0j|854`8oEMX;wTjK~XNFvK^Iru*+cJ)DsUc zHq^pH=tmsAu~Swie)+PEy1Ut#;3F^GK zqO9+^UxByO*50~((!;(3{-fS5KikyzS}!TLuP-ZIgrJDX*V50gsoiS(`JMh{SRu+Z zPoY{}wkJ<)HRVXpFg{+&1~5ZChl!N0vE%M5?eGEPXJoYAJ1TNaB(sGAIE~9O_!MF# z_;d|*p;V}(w>eX%bmzQG(ZTWY7Qc;*6P#uq+EpD;rWvh|r{ja%n30vS-Q$ItZ@{OW z(>UyJ_O$WVQyjX~5HB2u#2)cn*Av3!z&Z?{QPyL?d4(eGP=kcc)A{K) zuPb`DT)d8;n`#{yrr4v6>ReasH9iaV4d@YdTnQcd$@@5RZH@BA&6}%t$woI^K;Ck7 zy>&Q)eVboU>nn%M(qth;o$sWaoyC<^t?l+uKFs!+4hQQ*mrcW;>kbKtL$&VRyQG7H zVhze3(h;<_!?vPBn00ZiBXcrX(zHfDjHhH)MrS<(v;DBbY26{=H^eLLUmEe9iu|hi zoBdt|&V#PZJ18k>zOb<&Fe|HWlei>T>v_#5fN8fGlZKvC+cMfOn{%mI8F?CRAi^EJ zA}||(+Rm!142~o9bl?!h_4D&H`jK9*0L{&PdT75@x5Rth1|mSYFK_^|?r)6Wng2QF zgcCBuuj|&;_RwYZ_k!Cm9|L9O$apy>CnskaS@}!%`T2=L+Fsbm$we;>9|rN27K&fd zFmSy3>E%mZ*JD$Ze&5B8=AZEh%x8o5W|x9hryLncEvo$tmT{#(JuOh1>~FkXV}|?eY>FbsJnMWmi%Py? z_(MZl^=>I%<2gAsar8y{WwE=vPI-BGBJJAx`cg77!KdJxs=X$V1_;J2C9!@{%)^C_ z@cD@T`ghaw9Cb8?hTk`)>XSlySH$H=b^z?Wgrq4`(6l>#Y) zWv60Da8iE%j^}f|!LR3+GQUbREgk~Fo)ev)?b>|)93rza_{pxTD_Pj;A*^JCzro!Sn%ObAq8zTI>8=e>H*gSq{2_UOojuF0*24z!;s& zuw#Qh*vic${V%i8U9Co7OaM7S!RH&cA` z!m^$1LC9{CQnZfJ+1fZB)0>x~a=SLh(`4l3c@?tD>RbMycb1B(&P;{#_&Ko;>39>Q29}i)=^_so>D3Pge$51>bMZZW*tLf_G@2UnS}LMT(H3@qMTWS1G!9lEyRl+uspOb`%N!17Qmb z8J{9=KOME7Ka)X5{bFn=Tp&4a>gp2iJ!8x#7dGP1BM}BgN8q@P#Y5`94~%p}DqN%q zT{bd>Y?8p1=koHmY7eLvPyMx$`RyJ)meJ!u6uhG1Nb1WlN0zv^33+C_W!gjEfW=;- z$r9gZCdU*VF#WdXH0%M z@nzg5t8TEpdp{|+RE_u^=?gizhs1{8KVHFK*fJPB9q;dl)=S*`+epjCz4<`8n!wR* zG@5~pEu2lS=JvgNFC82>Kt-}ik=99+n3hHt6BBdy-o41UxQ<8$X`x=R)vYZ>d3kxS zzz2Vk0ZnLbP0hrTQ?-KtHR=K18kU`&#=p(TktpAgD`5&d>igv1C&MaAOH1pGZxgeB z)%}+=xIg{hnm6j-=B58rrd2uR69F6d+Vb_`TJjYr~WnJsmy~?L%JP7+O(Ja)tYon+H-opZ~6u zpw96QrNMDKSeaQLC1?;ikHu{e5LvYo`pk^iM+!lsr6Onx_5ano^z`NwP#NUlpvp** zo~)JC6Q7ek%a|C{OnnmO^l-sNNGDU|&m2Wo-Xoi+6Q(6;=+4`JCLQrtY1o_e$V2#`E>{EmW`kZ#!Q}zfn?Z z{P8kG0DFcOMU*)%NHHm<%7KeYiiv)(rngUCx6JGoDA@`V9g521@yI8z{~DH$+kV1xs1awW*s?RG!yO%W!0_xra|5&Ya!x5#W( z^_7y+ZP1Yd19)nQaR;S#9GHpK-Fr6E4JpY}x;S@8?vV4my+D-QcVR8_Z@WsD3iN9U z-wiNGb67UJ7mSz%R{vd{mLQ~3*i2T2wFDC3{>)Wn#v`PD1+$x;5ac3`3`p!PUPdDM zg>x`nAoW5UPM*ldvOM7By$2>n{CtO~s1_w8(Q~*m;D7ZdDS0Af^W>KIK^qyt#%vl@ zQGGy0t0YdTvy*0x_fDSvxy6i9kZr)*#|+Q9NSe zbV|k)G#Y*V#tp8i1(?`;o%@bajmzqbw{Pz=GBQrNj_Lu>0ToTTRG|J846TWY36B@V z?oV@%kyGfQ+Uc%kPnqE0Dfj6L6J+Q@j35-(T~35ut1|h+hZiS@>m4z12A=_}8R|dp zLFmdaAM}?vJkTl!Q`G1+vy2 zlv#Gn45hjtIy>JEWyyd1_>sf3`>qfKMbP+NB2cs3f;frK_J?Y=!rBfCJ&jbf3=%{D ziJSZ}4s1`KE=0+)&4YhU^A6;M4+RAi3JO>v@LwhMwVNAw4?LPb+qlVY#FcOXl%MJC z9;c?w^gVUfH~;zWT%NF^#AMtFr>J4q=?6W-`ngZrJ&~PXLo7NCKZc_a`J+Xqo!^?S zT)kTP+9SIKlwo&h?zIKYw5Q!M8KUj3{WrS0z0BD2ueGQ;+;{vl zzJb=zny5}=+k$FSoyof6n<7P%(cyPhkvS=sFyY936@@F-I2rE=Up53BGvy3jjvC~8A@L$! z(75LNK2>hq$OJa@>(CVBtqYatriN`bjr>kUA-OFTD+X0>xmMdL?j0|m1amm*G_oLQ(oJ$fO(o>2X7A2o&*N+-D=8F&CT;j)p}H@n)JZ`oatV(xKN6H!HRGWBH38mk zEB-EVjgZhTZa?JJy0yzk*tksqp$ao|vc!uQIe-$_?O``R*;^GzK}fNa*c6RAOG;h| zB&69D@Bu+4lv=DnnFyKHE&p21WbWN17O;C($>gkg{46aWzZ0G(xJ^TIwQ=tz`!=~h zw9;-;VRoiolqsdBrzZivty5IBp(2q68F_3FsISdpLyWB-9*{5%Gwe@xb$O{tQ0%5c?S-^`4>-~JfZjrr*m|4ymGotL-}{L{DRD_^Lb7{C!B;8 zVj=|;_G=Hba<`h7oCY$TML^e@Z1~Ey8ZRyTaHr|mH*|@bEag&52!H6#vue;PCDn1g zRXT5=_zWW>;Uy_rlL2|SX*ofZZvp0JNZ+I;flKhgAX35&xx}Nqd>9s(T98<3uH=WNO z@kOdoQ&R)Q*f$h@F(^{&_D6JRN&40EV-gb+nX)fk_vB?)unf)MQk0o19MZ&6~TEmG;>+H7EF9mw%~uWDND$!BhcfZ}plVVAtT! zp$}PD?)v#*)eZVrbD*WATma<=n>16reTEH)_!>^lnG8kx49%78Q}J_IG~(dhBFFhP zea6bpZa&=}rW?ya!cmD$oAN5C`|%;PSI&%5z>YllI|x6=8RjMqO~m~({g>Gh<&pydQ;d9Oia&Goc`dCs<2qmW3NB;No|#zuq6w0V~%6> zydFP!Y}?V9XlCL*qUh1ykfK(V z!vnoqH^xVgI;Ydett#%&(8ya@Sor&=46Qz7X3ide20s1h=~J|TC_g*2OCP~Z1XX5# z%o#aVS0{zunuO0T2(cx*iFx}KWSgImaG0o+aZ>Gc!Npy%!cVxOt}k>92#TfR;uF<) zWz_8)2;=DT_z3ax4$J$devNMw-f94=OH?2}HN0o_AtU3b>kI8Qen(}cWm<4UhLt=BR##eBf;%mlK1W!aY%ECC@jQ-~BSgPEcuC96Z*X?y%7wFa}g3m~WkvDNG zp3nGnoVR*Tl-bku#6lh7Fz4c84%kz;!5PuJi|)f9TTJUmDUjK8^ZwMu#bp&`<>wX_ zk4QSg(q-ciC?U;yH&%*-i%K%8*3GncMHzMTd0qPlKozM2vy-C~4{vO&$*v}2(U$X+!UN+8 zI3G^KDFKMx+%W%)$#&zVjVX+%LUwfRR-OOania^J5}syE6&1WL@~@3f$}LgW#c-da zNU!OE0cE)ap5Tvc?WudWBg3;_nos`uxEIayi_BbiE4ktncboM+dDhxKwM_nLL)hc_ZGjX~z() z=Z^*R3P7D!iRV4AML_nzO+D;*?Z4SJd2%!4bFnsSC@pVPPUou|A)hZsn5iuIyFWfZ zmH%-D)t1zR7YGURG5-k(bCbTVLNHu~P49jSYN@rh$%eJnv#}wF@>V_+83|dred*FA zT}a>2Rd1D3BMIYkVqtY z6E=JKOKhxJRb5v!({9@oR3JXGYwkTR`54?UolK`lyDYX&BCyKhoiSe$FfxFu)nQsqqo(K7Z2kop`JwC-MM-x7 zvyjXt-mx#w{Z~?BUu#;Buk+iP3`Av4xnNvbi@1p`4Z`fqKYjY7tfKPU5eU(3^8C}S z+w(2C1qCid-!Hj}m;Q&gQ&v)%J9l2}B!(_X#(n*IK_@wSzKCNp@mgi|`2mF9G*pnD zz^1prQEd(O3T+54=6Xwy*C0?F@6@R4zn6ZuDF5w0Rhck(sxliuBQIvAmuCz~^ z>6nmtggHIPJQ@>QaS#|QgU}(vDPPW&PziybZ4H=HN1+q}JvNZwx;#kQqvO9k)6{$< zBh!&~&7nqjW2_>?SvrDVgeA1`9nQ(#n!LK3dSLkK8;_8Z@`6yX$+8p@MjqSX<0wE4D9LgyJ*`4@z>OuH zsrse2PI`W0llk?SEqr_10q@pIM9ciQx`dlN>9fWFfV_~9n08&U6-}K;nYJ@OL`};j zbEG16c7T>X#5(}1$;-{1_j88-Fh~>2$jmA>S>*yOCQe`k^`Cd^>gx2?^BENijO}fU zQU~}5+9$@k0M-a^GctUJU0{E}tqggttT*lOsPH6?P=`f6ZmBO^ulCvvf`_~n^U=aU zXi@MNZ)jCg)9V9>gzNi;dMZKoc10;}&zCHq(=7$KR^X&u`K12+A=6uNM z*%ELoK=`Z;vevrEKidjc>{zum|JFH%ZetwQFFL*IQtCR%*B(Y8(ORMqh&kDNz_5O_ zQ?C(03+Mn~Aou`6k0F2-qVw)iQOR=d?gI1k^IyNlIsrtyI+O)!O>6L$sRm-0Cdd@p&wPV9xvc% z6y5V{WW}>_qEAtXTqFCt)E5| z-lHIX4>qN`mdvYH*Dlz^q)MA*{|NC1pb^9^fyAqZIbZ!(FH{7cs{FBE=FGCIvA}wB z3rIt#k~Hsm+hdY!;S`0ueCw*s4#;s`>hj&YcWdaT3q~uf?*Qc}{pwW{Q*#npTC*xt z!)#d`V^3^#cA7h`1aExk_5hwM{h=F4`boy&84hs-JQm*G57BE z72)3(W$@qPv&{lq58x(*^Pnmk$I}HKeo3e_ohR=ZE4@??CM+S?qRpy zrop>9%;^1D_Ve}Yg6CtlGBS^W@Y@uooDL%MWaZXe@&gIV{hz|shw1E`1v>Ee@hcX< zET*icHvG2N7ntPWaKGrKi|W+ai+50Lct!~D0k35zdV-O~`yEv29jx}=wi12AJzb$^ zsi`bap4`YDTBYUd9y%wdT&u4q*YZ()QLB$juq{k z&2L$8hTD#S9tME7#OKtFkWP%?*^3vKEiEl=#){wP zcSLXy`RK|DIj#O-RRoOevtWt>s{U{WFW4NUuBXtt z7eG}8+q6N^e+*1Z1-7@6hCZH``Kn=U%y9s&#**u%GeC(C7erj=I3UyjU_kG=g})_Sh=Ax{k>Br~J@E7o^M z+^&9A>YJSnvWKlYK4{zF?CgwSbSHSN!~f}HRz{&b)Rofm^1IPpl0b1o7@ukaqYU`Y zuvjSeIUJRkpXALcDIL1{<`iuDf|wWdiGoZN1Ej8|i=4k3 zjUC;!6_p)1Z#L+)eso-TB`e=#RIxiE>}Sg}8{Cl*>m4CAI`sAAX55DlmumpyX;BmD z&Q(@A#U96-BzKWlj&G7(&~yS=O(^Y(!2a-^nF(Flqurd7ELNSd24`k61D^DOwk#ko zTC3avbnU}bj+wVo>P#}h*J-`(^O}L)h{5MYksrbOtcSHW2pI-CCU@PZ{YLZpHb4IKXWb9ex=2Q!+9{>0-?q&kV3AIq0 zRCJu**L&9dk$&axETa*b8ro<@H(1u!uXjOBPw6vL?QDLr9nwhpl@3uw0LztlZfb)H z|GMbGuWOC0{4+n_V)HbVG&?nBd(C$V~C#}x24L-R!IgNlAqNPPxL+jhmj?qb*f*z$nm=xlVe3e6X_iig- zvbur(V9(Lp-a<6h5B_bP`vD9Dtvkm9f!;EmOaKSK0G=c4-pwpxz2oy8eZ>36t}@Gw z#%Q%nez_O0A16nk2Fc0Ibv)!a+!JgZ_;A_E%IXmdi_!7t7=o2qBCrtE)b7=~`Ss7Y zNKe_{6yv;JYu6%`7e4JF@)dIJ9UJq*jii%;nM1DwC6HEUd`>-16#ahJ$iYh z06#}lRC{=M!z{Vee0Dx5_VDwIf|3Lc2el{=Ga&X0 z`B3@pgH%spH9}-4O=m0>hP1YoW&Mw*Z_X$ z@slU?3u9t4#Ks?LnCaGf@N$ZBzXPJMslmZ0DWHZn@q#F*sv5Hn1s!Q^Z|Cr9dg0`Z zE*{UD;ul<7T3(vp-u)#lo%56-g4jz(5mOoX>640O8Hl^#c#{LaIJ;iiFrzC|myeE* z2hzPL0n>h;nLjRSP=%|^CqEy=(F-v^#`1BdscC^8{K679sG>Sn;}dwwIed@@J>hfO zr8BUb^R#wmHQZC)XVrm~?9|H3iEfF!_~4%u>epKAJXYdNrc-H`nNtf`w!Ig%Vzhv7p3qu61Zbwt=p_t6xHyF5;%`UT}`o2UC1 z`el)0M7LcCCkGc|v(cso0i)adUZ9o(xveK1a3&JR$1HjcA5fOLVDzD<>9C7!j5*ym zK0NfgXbb2HwVa~)^vSJc?sB^`Ee3eo%vxr}fjGkwPunElhZ0O)VP!fm;xM#zzEHoe zu%q*Mrwh<6K-i=m9v&XEQ7h1__{^3f%zqrttZ18;TO|}#{PT8Eyx`T4;a-#vz6Y8v zZFkXN=66bj*up99>R4W$Q16%f0|NuS$%4_qYXkXRUHzT!qDBi(sRjFh{;6;h@RSaK z;`@s+KM2-mp!RAXo$Y02;Eo2I?u{Ea1;3;cQq%1+g1TV$^9?@x=?QOdWo4JOyB$*= zvtMFTOzJYAn!2DITyBSsyV?ZU1syKBE!slgN) z-A>0QK5vSzwpz?of!gw1ReXk=B(M!(2Uv<+#Nu{HEDIyp36`qax5=p1cbs#)s&SuL zyt)P)M=oiSpyp|qt&MALegQ1w1Io&`^nr|uHuKzHQ2<&n{@@Uxiwd7ZzhsH!AFkMA ziQa*dqc@o|Mc7_kpDY4x{L7I;$CRJ87wqnybNN<@;Fle z?NPB|-Pv#S*+~<=`#C$iZmNk-xE7qJO8QE**=*TU#Q;!n$_mawn-z%3YIO8BC89kCA0oeUzl$r>yaEfW|WcQYy;zf(a;+kqPK11#&J|UiE$} zs5AgkaBSA}0>qr$=^EakrXkL*(J`>DlVnJk0F_8d%BuAl2m)srw0CBHgDzhViDg?_ z@H@W={D0b3Pe72r4oFGwbQH}L2&*{;MzO>5%UiZ67f`$co|^F6 zz|9JUP;n-vfRHSM&XZeI<5ia20LAnsi=~W>Ehxgt$FY~VxXK=}J~e)Z^%ZNgdKjQO zpuLl}x;d;`T{r-sYq)j9!N^^};-(@DzngXxE+gW?thx@@HX)NnC0}A<`X*f0OSD-p z=xX2KZ!pZjE3ci(^Qtk;Ecuk?3u@gB<4I57e6a)`cg#SI7hzS^o|c7}ehWeQoyst& z@_o1Dwd2&tO2Z8OM4gC8^g=X1ZYA@zTaTXR%id*XddP8H*N*m@990NkUtDiHh@Ie# zthH}QnYTKW9Wnm_Olz5W zzuD=*Ca}gZ$;CIa!lsOJ0!L8OwYfz_W*cKA0VAem;~>!p>cH%o`PqqbypkoOCw&)$Hvt{-NprWdMQ1u12q*!rQxtyE2mU0w??27R6)TtD8X^oc*ee#H9v8*4y zecYT;SxK5doENPl$dFV2T1QB4v#V&pG&G+OnIREmrsH%DW z=JoGv@4dI@p0m|%aJ4+gzj~DuSe8*GNQH#JkGtb}xzfBk)^&|#DKJkV&Mt4Kt@&`x z4jN7-;&k9t82qs_2STrc1P^_7;6#2oV+B94WpFIvJY%+^i%a?ZPV!4hg*c{Y1W-x= zJOfI8`ztzH4;P^nU7!8oi#}X8e+R^h0Wclh2M=NOTVFm0ohboy3iiH(K=LA;Snma) z0etocgt8Z&Ma2D@05W1rD%#n2aFe2Xfo9WtT>MwEvfR4g228jc!7s(*HUt!0t*5>8 z^t=ACfI@t#QFu{}0$M%b7R_q|x`6k0{^QDttQ=U3N9=F735SreXZc~z^$m8B`2fke zZHzUU#_74WA2|KB7IEf%`}Xc-2&v=wG14p9yy?SLxm1ya`1lczor0iOUKV_-1faU; z1_mz~S=n^R)=XjP;1(R4>W@#PqN6kUWGT3lNLEvm+|<-`lO`Z2`MZ&k(W6I?EVei# z7YXjs(kg&j?!u;Lo&&NS9ue)-Mtl$83~k0sKLPB*7b+*2;p!nTB%v39XKODiIT}R(Zb$54!AuM5HVtktBETN;)}l0oDW{9`LD4&j9@n z^uw>Qu~7*L!F^^7Vq&Sjn3G({zmr@+om#!f40P}=8V&4x9pJc`j?Ox*G4FqTfPiNT z4i9GnKEUD2e~0(Nakl>Te_ILZnYmyPod0q6IUOhsYW=mXN=j;n{qGNh^KrnK=IYgP z|9@^UzaHJQWVI7=We5VzmUV)Tgi8Opy*0nCS2SafVt{RZ#Ptg>+`U5c)CK%A2nLl? zT6^LD=X=Dd10xmz_6L)59cO-?_#t!l&&O;HDGVfF93n@4Wc;Vc$!;-~uholmUn|(T zrCUxyY#2Eo1Unit6W_i2i*O+L;t|$^+mwHr=A^AQ@#J_dpFL4dV6>;J&kUuJW?VKt z!BI+=YEQ=cyIsd_DND!RdP@m3b`jVZdF7Hg{cVLSVLAk4dY+H1M~Xz3oF+1|odLFj zO?ybE_ruR;vA~+e$~FqPFq2i4_HYV`XU`gQKR){N#O$umF|v=LkI+H}9xo}Lst8gKsbTzUl1MDO!F{P@5h-}%%Q zMm(E4WT}IU@ZBW=X`|b9RCj0&4V?Z|)+2=r`x*w9CUUaTz;_BPH_Kt8`qtaXH+K*? zjEtFeJ0m)ai;Ly2lY!nm7m#Fc7gPFYD!?%=7FS|yOcHdT-XCkLDVrgGPe?C|IEENz; zv>s=UV83Yl_%v8Wry>F)Xur!M5#XRkxm7iQ``)|rfrZ*xeJfAUMzsT`jWHR?xTztaq2`c+-OsXhglN=XZM>$P*O}?SRo4x$7R30847bYtm z`a4KiB#ubNvhU=rjlruXq@jU9}xTmLVyup~+v4k^}N;ozGd#t$Z zbIgeI>E)+hj|KS=`>~6|k}ZL^kj#*o=aQ1GmPeI;rd(Um(lYpTRz06im06KNNGM?I zaKmiwT@%WZDZ0AL6!E4(fAZbodVp&6jK>xRzBA8EhwC~j%s=bEz(4DfKI)1B<}?0T z-y{q^;cej68`jWkYa`QJ+&RguCdVnNL1{C|$9JBDQBnMaio-qU&ds3JiHQbaFTFWR zRNUjMuddUR-3?=&D0XDLkB zQE1|K@;ZEI)ajPIy=| zMfUHq#pQP$bC+>>tOd`adsP)ntPkx_DZC*GWO}Uzv!2nGs{KfIcDNkK2+=)kn#Es) zw~mPI>rS3T5=R1Sh)#gf*+R79?p%QuFfDLk^PvLBbV!WUcj z2;IYu2BrgG{6;U*r7b7s7cKf9&LX>e*cMjJ(;hJM!<5JS>$m9v<5!1iU+?u;x<|OQ zv;#1GO}6;{9`_qHwVgP!ROGw?=Ckc&1Q999MaW}=AD#)!ff@#$!N@cWiS*5g-BV`K z(X@-L^Gce>d+e1EM4@q3{M+;9JN7jwOgfD`)f?lv`}rJx&p=j=BU22 zYuTu-d>=bKy_1mpsn0&ow9X7-)O#TqXqjz8{bD@~M54d$&l9-Hn7>T#TiVuAA zTeEZA2F`^b-!07J)0rF?oPU6)`K6028q9h{SaO^39I5&_*Xk$jxuo(q(nm8XxL~mw zL?VsAjv_B5h4)yVpxSY=5C#^OyhfA&IKT(oiqnv8_EZmIKkPQH6A=x)(38@EQvPXo zpbqa{eY?Aeb_b=0t>aWk9Lob9p0AVkwfEi)q)R!Xa+F#0YCh%{Rowt&jhPf_z2~0E z$tSWqz_qWW^fuke*X?lnV_+aLCFPCAu@Yk~;OE8x+Yg+i>G6SFovX1fn&*d~(%=ZY zZJJ=;xo3SaYkodxWU05hgr2hS$j38xg|n81!mdV+x>~cB2AdBfA^{ zHa>6{4eQbQ9?W7r>z3E1%gob{fu~#n-yRN4&4N9&AJuK(+>fp4cPe#0T0h-Fg9QrY z-aN;~j(~0_!IWpyVZW&&SZ`LPS>z#mj;}THYUsV3DDj&;MW;FUY{Eb~l>wG)oT{CZ z_3Di%S;~)lJL1@`tUjG7tbKF_x~s-*^K+Zg_ix3;T>wH9kc!J)>JT;=g%CjmsO1s% zd^CQ7--nIbP{l9-#2G_iS6`p;L@32Au`~`}YGB3?IqWqxEV=gA3&4Gbgs1JyLFw9! zDjjxu6GEvue<%wM537lso>6U_`|^YQgtNCXfcx%)F|$o-O%9!?$}@NO_}cl)t&$x8 zXUW;wrTzzM41Q;1&Mx-pP{*-R<6HJYGm^>G26cAkFp(hkdy>QI^d@;A(@IcYD5S2i zEGOp+Vkd>F*RQKLA-h}*r|kHMj|T|Zzb+CKKuwoZ*<>>tI5JAy5Jnn zX)a?~wX3u$qQ4*iK2tkP#4agxl^W!U$*uDkfb7GmMZ2w`aD}Z@(dqG>%BU&cgiip} zgRl;GxLqjrEW2s1vGM-vp6*TrqTQ^F)9}oFcNcwpXr5+Rrslk7@xZb^l3nWkhmzCS>=Sz%$0ewC@do49y; zNWdM>7o}nD#*z4$8c++VIekdh2iVgL+5ex;RV$PXz? zSIc}U9i7bq6^#0)34=_v;k=VdIH?+qn{5e+Nf)6^XN{j1T59zHhcATsMU@bVjN6F`1MasUTys2HGQo(PdWDxU2{Z~GN)XHM6>JzonjOE_s z-1Lrc%T8H#%f)!**PKa9OKS4N^>sYUDUfovX`y}8sA3rsp@#MC&sS~<$UP}9DH-rG zZnpqhv!`q8wL%@Zeuee$$nekn*ud(;8JheL2Uqt;at0Db?Ngsj?ZjCa8>i<+GxanL zJZF#!zj$_MS8j2Zd_p2}lnDGWlg?Yx_|mSM6B0o0>~WwwEM59lVNE0`B(Q8~N))~k zN>v&)?9QBxba8xKG|p|l_H)+H`sdH@iNbyjczf&FZnhJzUJLtn%il@}tH!}`|7pq$ z>yepphc)!?t8*fa60rl)mJ?R)YNLV9$hFtc-bsa1q{kU}sm*$yrr_0cJX3UAcT=3r z2WN>AdCiOTy_`P+36|H=8{w=QeT-VYDmaI%HL#;qbM_KAkNooG%UWTS`1xM6IurvP z!9oh}lnX=VlrPh47I5;9tuBFi7NZ=EV zn9IglVglIJ#!8B{%Poq4c>kYIgBx% z2)q~O|9$z+@LI~>w*wxyT>P1ti;FzqC&hnW;k+gP|N3yP*XI3|K?;Voi`(A?;w{_< zKSHOSS2k9M$AW||-n~D0=6$HMe-`Qwe&K50rM!6a;%d1q1p4{sB9K@i`0q;&g74h_ zec8zI5%J%b|DPWo)2jV*V?_9uFVFPq+|>t^BcmQ7joQ>ojP6y}#8!Ymor8nJapTXU z-kq|sv8lsRXK8E(2eLzMi`%|2>|42&n>F1{O`KaHppoysYwBOLwbADu8CibcY=JDl zL&N5-skl$sD*SUqL{Dw=?)&LlKhHTpm6}@LW6|8!e|-f!z#(m8>R4P4P8+@CI|}WvK!)3{ zO>B;fN)WC~mj1?R%?OsCz3|s0sqo#R3GRH|Z*!(4<2sDk|GT3r#vmPv{VO zKt;NALg+<$ml8rtxFh2J?m5qQzx#X6d4A{K{NaO;tgJQHoMXP@ecv(GojN5(ez$aM zYt|k2FYaoi1ngf9PEK8oVMujKX~ahz^oOJ*QoQonnZ~fDS6!P`yOad;IIqT_O4`5; z=vHsaUlNExcBNyxZA2SP_z`7-Vk@WERT?bfhXW;U>117Ux9#(U%2cb6y#0_U12Q zH1g1ilrwyW`op$ERu=KJ?|$dF{CIX>Y-}w4@L3l%C#Pf#q>15KqH<+|zUFo7HsQu@ zd4JN;m9SZLrDv>6NECY2@nQ5!-Sw`OEQn{rl*(5?6IX zwt=>}(zb3XX1<{yvL!e;*rU?O&Uta=g-qc23|QJXwhc<$q_g^O5F?DTwTGwT)%^l& zNYs+N6*9SVy8R*{(O8eP*r^~z84g4zgCz!M+o^w+*D#1(Vz8hbOpA%aG8Gu5*nZ@6 z?k7>y`n#0f>_Jg0^5QUeJb=3oLtY*TH0`^39nCnox$o1y>Dm5m4#ZSzd}p*BK06?` z&+_Au);TZ|H$aai3+@6X$S!191ZXt=;Mx7KYV7VwEFHD)sTsrO8-;$T#1OyZn z`n@tF^tj4qI7S?2yqOy>X;i6U(~m1Gl)d``+1Q1c?ZElQE%q7+m@8^KIcX^E(pKP8 z@v|%pmYcmTErtf=>uNdX2kZOG!*nU9ZYrP~OhOi~pC~9=(6!opW6F3ly-L*8{r1v3 z4+ZH@(&6iuQBLijU$V_^dgBEhyPXg^Qrp84EH^t1u{rq6<1GCc zyJ2(Ef@?H~sW@w+)w{6X2ba^v#ICL`pQWRd0V%1#Ww9sDsy`sMpHQlP7GWt+SH9GH zeo(le?1XvPA7)V4rsK2gC07@~qB>Tq$lWi1vfY@=ks{so6I!Vn=R=5kZrI_F!}6Dv zm|L4Un)1XC#SS)=K|sG0bOt8jX(2Kq`6UK~1aBn5YIM0(Awv)h47&+x$E(;E1#-Q(|D z;#Ua)3sMjA^0%j8+D6@clz+x&HtEZkyNZ$g*EP2RXWg)#Zkiq5eQ7PRtsHa15P?AG zuJo$;GfC0rVv`F`VxqR7$5%0{jvl?as-AS!q`JmB^E~feFW0iM#D0DzV^hKI;C!jd zChMI8bWejto#!)0f*wLVP(zQ;q2!-E+cygm=_?QwTU+KUBO~VrgqI4PdQZ|;%tBvr zNB>1xm~0t+g_f7E&V9|b>@kDVVex%6#c!y{qH3y&lnE zf{u@m$7rsqkryS#zp330IDXu6%YC&u*uljmJR~H9Jwp>Kv^5quh)(|akuLV8yFQn8 zHjZ10KVkP4o=iQ5=vY2g2SHJ%IllN7XbchT{%pdk_&9fY;EpxJI5iz96x#aRZZ3WB zq^Xtu#LiV$*Aom}>r0M1n~s%zl@vdXQ=E(9laGjL-y9`G*CtilJu;s(gKYm10FRoaZVvM92>4WN=^#4Qmj_u>{*8_|^(^TVeF)BMf%6#S zO?JJ=QDlyPTka!YQtjW`nkDv+jk7cNCE^3Wo{Irh_EpAP@_o64L}v$~C4XKI$dzW&GUru?RG<>KqL#ZEnSF*hEg< z!t@EYK=!aJs%ilN0dU+uY4GRc{;bC}oT3gJ-8nI}b#<0au1sqtfs&kt6?e;?tu7d^ zB=xuMJQ{rz-nQAYtf19OZE0zNs%?kesh*fOfBzN{tv8FyM@bHH`QmrOevGP;2S3xW zsSx!Sx{nsHB)aokz1C*Aa*$Ik3m%p|-|v&FR=wZriQw(}`g@x`eNshh6v*&M5R%d= z`}1{t4<2vOGMgS5NvLck6Jb8w@ap4k@)G77Z-`7)jK^dflw~}smONPwm3b!zlv3m)8XJi8FqcY-L<%!CVVXOg_hJpDccQL>1%zAL|`?UM#g(=H*G~6{@r3^92 zs;^KdyHefEI5wv7N1$ofEw)WMa73!B%o*uS*>c9&4o=2xf8|6~5Vy_L)X?(_N8}m} z&DbX@)kt$O;CXP(=q#UM+e~MrZh=eKgd1PZEJmwY0VF{1kR^cW zP0)OiTQf^nQ4m9{s5(o7%GYl77a5F?YjmxMNJ=WvukQw5vUhRd#0c4xk2|}Q36plh zG-P-9@bQih%4aYhB*t)^7T2cP-l`as2q9fnoz45EHkInVLXt?~>)sXCWQ+87*Dbb6 z0%Vh=Qy>q@fT+j(->Iz|xALCkp*sTnAQgkno1e*NAKk+n^z^bgD}pXoD@SEc%Z6Lv zjibZPAi4SLVs&Y$-B5}99e^rt-o5LBP7Z}L(K&=vQr0kCqmtRp-D>xhwY4r;Ht)<| z4ji^H;$~GSqaxw_jk9+$jd6okScymwmcGN6@NE12$^G zMam)FQiswwkFsdV_d>AHj;V%R8rsWfzZ_CuBgRPyI`urvGAvMYp6gPVlgpi8BP1i# zHFIxC+^e zQbuaywdNQRMbezG96{F1nDy-0v!JA3Sdhw9_KNpW5-{^j_~dKUb!tHj(q7g^d6!yI zk>K8qBe0t!I;LgID=BHEDT(YVFRd*`M-KWqIu1iij4%&zf}#XUA|vq3*Uk{-^|l1* zJKPl0^?~o5yOeYZ6t!zwb*T|z=~9)j;jm3_CN%Mw_$EIQ)8I*7d(QlQb&yXvXC5E> z$9VBq~ho`VTid{rNmsReQnhO|aMD_ISe`M;{#!Qh%``8T|tGGBD^rVHiL zHgq&=EpYjf%pNUttg}T%z+WFSxUXE0{_#dQVA8YyZnFC?GvnGtLopaHySps3FZr$HmAd*Wr?LYo z#X4-ZEr!Gi7##tk7c{MzCK{A?RpuQ7uk^eZ&qHc|9g;S#lAaJHWP=$6 z!bv6Zb~o=a7_^79^Wk`*BN@S^CY$||O9B1dxRrCH?>eFb_u|?@S>as+Ruqxb`4_sU zvegq!+T#V*kxE-}q4-#Q1s+doRN!j>=UiXP1QYF~3h*8?<%&jWTdUL_S51t`RZa3r zSz2XMk}>Ub;6po_LE81E>QD^bK0!i!j_AQAhdCz&s@T<}6vh^pl;&X&VOP@p$<#?vywQ4~x0oBAxO=PmWe2cDF{N_7ran zv8y4ZqtIY&wevez&YSM|SvH-}gZ4y;2T60to}jlA>Od@8rWcQ>b3s z7_V{{bg~q6M*-WN4fSC`jiFbQr1u-DG@WVg^vs!_w(u%)%2;3Qzl;DJ8#m-({30gy ztvvd6^=+Je`(;t@Z^>}wiD#Olk=5EpGj&;d9Ed-H|DavdI@`^J=LZg_t5(Z+xc8`t zh^?X-#B~P-2L*jvm=VR{#O2l1PCK8SY+Hk}2cD8^F6_eke+cpX{cePclS#} zi0;bNx4GiH@z3*vsY4A<6oI2K>k-Ox#-K9Wy~_D{5vegoq5-Zm)be2hYC_clGZGTw-s4QZWf%GV@j&U6ZT zjLU^_tKQx%wuxrEk)D&De#M`KTxq41lStqShgoZ{hRhYzDFr=Tzx>^*CxttY+K<9Dyzydu}6omE)a`d&m&*mj`p^NFds z!Ry9O^BYeT^yKB=)GEg$mz3P}+FGuQk}}W!eBtxjr?vC^(apVEwzs@j`xl1^r6^bY zN-dKEpPm*z&bzOV16CsQ-+xyne;IeA|XNDqbE^5fcSI77x;E6=RZRjxkyhRwg`Ga&PhH$i zXSFFl{We&U^@D>36HO7FJ*r7g^Ix9C?xvj>QSJQTF5p#c8FI#ZEs@u#G!v}ny5;OJ z_4iFZw=_S-5q*j@k)gV^(sc!XEO7o>J=+_H*VxRf)5v>#4=?!mg;KmoQbK}{xx)#@ zYqxCr3&UkMS9Bz|m$nvMOHcEqo;|px-EfklD_43y{-#?lD1iMYb8&vs`RFF34(i5nOicTP5Y43xhf7|7rK-O?P%r~b*O zV7Y(p&Shv#QC{UgGwl3f!FnMyG$ypkDkZ25d-&*4wYqEr$S4WNc*)WTzFH2A(WoR9Eq?#|Hv}5hn?KY2`x(Y; zXh)U~ov6ZXAPUz5V6)fYbV7++wD_Nn93k=T}%kx74tjMVU2 zpB^$m7n<~T==&R3TU+y6i#d!xD5|~S>h1T{YG8AY_fD;lOu!}`U0^nouq_N#14g$r z|J6}O6Bw#k@guQGK=?ufg-jiR)G5N%PRJTH)ztbTPoKZ4nIFojjY&Q+)vSmc?Cw@N zOW8T?K*C%KVB#z2%^bU|Y%%cSHD+WKqNaMzoVewz24FS)i^HA@HE%@busK!Ti^Dz< z>@;EweVX~?g}{}G&MuYIci3!$av-{pkbM8mepUQ}KJ>fc)WO^hsFeDiD>j3Y=hDjR z7>Fz|F?O7jO1h6ee1_X%@H33jEBzzds-+j4ohJHJn~H9`+|$T-U(7zE@?ALN_LRfD z+425}--hBw^*cByQyZCal%x*^B;pW0BS6G$ItYzM!yJ0z>e`yiBW(PKHt`+utCEih zOTj+6ASUQD7bWQ!{^pEx_j}bO6aL6d1GUN!^CqPArZ<*TD?Oo45IF&(^Zm+FqLItI zioM+5Adq7Ghdo0uc$L5CYxK)gf$+H^DQTFcTcn{P_jlz`h0gM_FmM`)De-*7<+007 zW3|Vcx4++6*jf;-sjY3SHMtnlkbL{48edK@8vS7|FAojD?E%GWBiDtp9t|Zr>5N>v8qLrey*~OOwEbJNOq4o_ITUgU*-f__8N# zK=SWBBcSYeoVGAJTc_ykRTVXOW3kL@a&vf=9>edy199*>&-!w(HqPoib@&Ud^a6V=KvhWAcR<;ok$t?7%$m?ZTVO$Rm0 zwRl*zrWR_^5FflWF%ML80?s8~J#`uL$oF8BfMY6no3nF-ZNl;REC{N+Kx5G~j`yxZ z?cnadVNUf7vwx!ck9yf+32G#5E9jVrpW9|D%8;LE#28?Uik4{Uc&OgOQUIautz^4i zk_`6lp|gYxO@%a1FP=K(*c&FG z--$H9gO=aAG7g_O5fPy+=#N^$A0;=>_72yil$f=~WPo5k1B*rAt+fuq4j|^oSg1WBtp+ThlcA575@8(xE}=*fi3|-}djD0#UGcjC zsBulrNtj@gI2!JRM#8OqO;c<>TL>(Xsy(;c)YJ~xJ*WyGZJ5v6zI($JxULtD(!!ed zwxMGjg3ozlgVVJ8$Qk1==L392U6-;g)l<`-B<+;S2*SFRSy{XHTyA*YeO04$#dx;6 z6ni`Sl|^-JPFLp4SU2wxIP|p`NH{iKn$2h_!tLoDx^tp#xsrNi_veH?Gd>5rBz(B% zc#K87XD<_kH{A;OnQi#BROiytrH@ICwS5QRFF#%@C;nwx_OI2=(zLc-6Jw;tkGw6& zrpV<$rU5OrXofB19%rGj4TmW5AHK`5{EP8ft;c-5n` z@V@i&SpxmNt*%v?EpWZxb92kne0SaJ-~P5tY-V~QuOxph`3mjLCDB<1`xv;#ubd?w z);bbnx4LF!O<09lBVNCF)hXQeKx;~q=JgL}XzzvB$2*I0-TzCm9Z~x4N~8ZeTm0XS z{PB(%$XHz&j@$ahaDD^IKl4etm1v-`7J8Q7>K0jNJwI?nx11RyOh2HIXdE8safHOG z6PByOdL4zW@lx9K#}^|Y@qk1>t9Y0-Y*a!bZQH2K2@&sICReA-90Grf5=15n8~UgN zMO%sy{`1dUlr6H7o;*=K zPvn2|=FR<1N%KW(ctVL)%^N{bX^Ei?rwTo5`0?wrOf%~dA(XMPF+sC=IYG<$EX^b$ zCqKVh$R*`AaI_NAU2DfNLs;!Qpg1)&dA z+?)E)9+Sp(tyQrVr&zu9_a_YDeJtDS;xWLsA=Kh4DTQXujZSyQV-|gYpax^vOtY|T z{ihNjiL92M$Qjv9wCLZl1xQ1yAch*jM6XxK=vUquKZeM$F_ihRBNQq%wM2uRE zyj6d8%E6=O(hbVJ383p@RFhI`-?=N>nhvld0EOtTHPmf^O2&>j#w64|t!g|mKhKRg zd<>6qU!9r;OFX9mCe(_U5k2dvgOln_dfQiwx{V?)XfE_Q-vFXa)Q1{FBStGL(=^Ho zu~5$iQl2QH40mY_2vyE&*KXO`nhLJfL;w>T&D{^ii*qJLYnt$Q1i+<@5#(HJE~D%U zXaEuR{{0mcY8%y8WjpB6w=!6y(SPy6MUC!e32l;mv6(1f8=8v9aQ=LvF3t-1b(&1m z8D^f4Pw}0kso_t>?boLNP>i{z^Hz$a`uOn&Xl7zz87<;i20!Cmn$POydHTb%RmKa} z1QfQvAjY7iBAFwehfuN{;zZpk)$lSW@FGy_i|x6Id|02|vtS6#0D@6vLD#wP5k-bJ z5u(KGiaeFKf86}E`zlpa+jDdN(S+?%$*8SQ>;{KQ(3VVebeo@=qlGyTFAr0g)pv8P`$$~EfDd~7I{{lw7&<^RmW;8xz)KDHZDTRlT(W4q!5l%-s#Be*Q0J)#(Xt% z%-*ih{`zAHKNW8SaR;N8f?>B@n|2kne<*d};K6ij9asG3q@0MDSW`m-0^NntWCBXu z7SR#L72!PFg~-w)r%VuCw%2FUbPCeUv6P}jzT@iK>&kNIO6nFD!&SAreE1vs=&np1 zM?t&p+hRq#nU!AKO(y(MbD&JXxM!fqtPW4E{v}IK4}$1XxOKN$pq6(IPp(ZjZ#CD* zF{J2|;o%LZtcZ(;nx;TTwHisFuB?`)ztPfl@ZBTMR(clfZ*q&@H*G4L1LIYcq;aBB zoOmKENQ4>zLtsZFCMMD}6253^&Y&5=JKDdwitp6n5-?RA)VZ zmetBP3|y&D{xd@~5aU3Ah7sOttz|ElYkF*2%#;up2h0jqeu8srJftS0sK2jo=5x&v zIQ4FNb@O^_p}C&rBt{93WN`@z&Fl)h*GX7Cp z->XYO-w4TBy6TljtqS)puu@j;7g}IAcRHP~sxM(cH2P?a=IvKC}6JC z*%I5&z{JGG6ygu51L*wjQS1%1wKAtJ-)}bpg1YUIFV3S`o{*)k z3zoP*}7C~NM^o~_R3)EWT$X|TZB%&Wy zX+e~c-y}W7i!d7|>Sphgy-tQz5Kmo_jTLvlJs3Yvb2sQx;YlAC2dM@8pr~Wi)3Rw^ z0AIhOK_WGoplT1T9-T!!;@4Xhd_~*AzXvV<;L>YFL{n|b!=ogSaTR#BD&;*={Qb=T zqXTND>h>SB4?lb#E9RnC4pH%`c=i2%m!In?^R?a{P7aP<+D=9%p1bD``;(rT`R$cU z7XX9(r{C)9b6pX=a98!wGkN*@xh^8`#}mvUz1Bi{sW?F;|i2DATwqKwTKey9*5kHBo7b5;G)+?u5kbfnQK zkMRo!ItRQ29idm%H4|?iKt=$3I{FxBEHmU;n$SUa;s`ut!+B{)6P9xow#FpPgHFCDo{-D zI1r$4cJ~%cX=bQ#G*u3kITPVOJn<~d%r|WMoLFw!%R#kZ2R++;b=Z~I5qwqR`rv{t zoG-T@tphmY50C2slb6TZdne?|_w)o%bLVQ#`so&>Xe*ob!>wZ919$c6fFZig<2Nm) zT39^3y>?kyUTz;KUDd#QkgQpxjBD=;T7JvYHgwm?siH=~iDt}nn#-YqTMrT!7uP7X zP(=W29l{t@Rl**snfp*$Gh1H=nl|4r9)>zbPS7s!9umf1&mI73i2LVv-T@y2r$%~^ zQoLl=$jCz|J&j-#b9wjJcr0JM=t17&**;wKWJ_!oltx)B4N2(cj$CwJq9(sN!-GkZ z4dlFjT@^|$A#DvCA5oD5GabgDya=P6!>gyK$0F)Kp~P zkM85eFD-kC+s7p6_@jdC&g=#w8CE;TurJ^AEwmw{d6B@nQN%uz7VoV@exR(Z+}qdJ zNF);T7uIGv^KrN^KiLB;Qr`C~D=XoR;jj_oT$d!F8Y3OR3b>>?A&5hLb6D!|CB>+8 zra%HxZ?~LfRRw8Y-CHm5?7Gx!yd8<)hIhjw;vg0nyl@@zT|FrnU zlwqG;17fy8XLr^x7JAp_7Z?YegxruN?gDLP{CNT@S{lHV03HQ-no|zV5pPLelM#?WXFBddEXgo@&;zE4moN13MiDUc#*Oz@RFI#w z&B6`uonJXFUk2aduCnu7cL-3I&|RTGTftw#o~FAe9sK2@jJ=llE@24?0=Jc|6FXrXsC0@MbY zHT4FCcH_%k7StX-O!)lyGYoC&Qq}MWD7y3YnwZT_Dg| z2t+O!(*4+xgA(glu~!iMkyHbt&6fCJ3D@KI>~=k=JNJ-bv~d3A-?kgmuKvGo#r}Vz zL7p;S(eJt1ECigzOLnx`K1{Slweb z+fUwR8y-VA2K3j_A2e)#=8IxrImII@D@(}gzZJ%%DfkV$*{Gcv;1vdO_c#p>rFL{7H>ph+zYfo?QOFwcdds7w9xOO<{+OB z&UvB{%3B+3t_tYGJ^ftQuS@s4QZsc0t*~B#5WDo-;n8Jig}jrHem?3U!w{X|+q=uT z&sWd3q_Jw12HonM{#`s%5(_#wyOi@hgm~G z++6VjP$Ta+H8V5i8j^U5Z zlp`ZpId#A2plMtyrPSQDY>K}rX3o(~*fJGD%Lm7)R;wkdl=HXo>&`O+vAuA(TPJ^l zz6=QVo7+Yjz;|e6>6rC;bBv&wS&j@l?jAUDS_4KYUtBx*!abTD4q|vy_j-3QS` zcy#%)W`;gbHTB|!Y6y$zj07asG= ziy&}ne8~qFX5Cs{d{qNXT|`IGu1#KHm?K#Q?{TbSka~ApsZ>&1AOxXYxRmL&P3>?U z_My#WcNjp2Mb^l5o&389oXwy#bPw&I?nlAQNr#cwOns-f&Id8Bo_OD^K!kk6oraG; zUaSRfc0e4XTMpsT}BUfQAm-AB$VaG_lbu*-+aoN8%|H0$jHM;N-B znerg+l`Q=Xk$&QM#=V@8{!9~+_5s@Ke=ryN4`n>>V*g17N{pbW3TM)gM)M|bV4!~9M`ye=hac%?Ry`qO?&y-221|P0pnu2X_Hp?0`LMW z%Q~6BF9_Ox%c{dioAoKHsePy%DpW;xl`06s(dzf_O)YyiPy7rQ5F*LFhWRFl>f2K^ zmm8I`tpWZ{k2SZxAjxO+_a3SwxXf?d1DCxLgD4vqIE}n<(&(-t8x%4OygEPAt^rv9 z&)7On3A0W8`cI#7D*=DdBqt4Eaej*pUUG8#kVHF-d26huiha;PV+jHcq8^sLp*btl zih!}HIlPbV{7<4|8ir zE&MDInIP&sD~~R+-qhMYF~6P0=Hs=}a2rqEiq6j)^;)iHi@LEKzPby~4_Fq7@L{eS z?#FjZ^!Jz*G+QcNblQL}i<#%bLY0osBm}86p5RDE2Zb7oeyC4eeSP~j`*nGxV~*#< z`aZQ3j8V3Y2XtMAT$$!bp5p5k+e1VWUXnP0BD>9d`M7!^iO}@`4ftG#vVAP5=5c$G zjTAVro_px_hfm_yT%k$8)`+hw2jYa3_yZi0*bdb`&fiD&(el&cfsX1vA<)gDg?5vn z-{|Jn7Uz}ph?v+|F3WB@6@k4>`WA<7!KB_o?x3`tlNiLhgvU_muZHag2VGFp7m_6U6fR-m2Zlz^r-k+0fbsct$2Yiw=Sni8k z-xh4Fug`te0^q&9=ZP_BgBAtc3S`S_Fphqi~FH4N{a&unW;>dP}OXTR!3<^={9Kfka*`f}=`pwsjiI+<3h z0Oy?~Bbj0-VHd`3;H-({d5|l2DI~+=(jg6W!s@3LVE96Ve$R>b8RAA*5%R+rg{;{# z#>r~;zP{hYpwTCt7jQ(&Z>u4M3il)T?#WtCU;?>3ZRye*N;-cyAvxQ<$Rzbuv*s)* z`d+zsef>fGfae~Qc6ooWu<#&g@D;pZ9AS%ijdKN? z-+bw+KPz#HiRr1fs~+gv*xJ%5&OCqfVbB>K5ADvhs?=TTl!wIjz$!yLJR|1ez#hG) znW@ENE+Qf_Gf?UnwbiHqIf#~vOA$Lf6Ho!&g(cc-xz#wl^o#F~btP%p+GaaAI?@LC zM`=q1zJde9jCrkA!{TY$rPRFii%vAN97xa8E&Qzws9bgf&!-6*Wn{HSU_Qy5in+Ng z5_$j9#N^}|3w5j(&mgK5Iy4jzba5UpEA>{h)YR4I)LlRXU=>H)mDZriMS>kZyN>vF z^#e~CeZ_tt`Ghx-%`H*ajl)6XOBonoE-go;yRV)>Cs)hfW}l!pwBzyAgLE{kcb*$e z;m!*kijI@KL6AZx@AzdpSB%Pt+`L)eoF#PPhCK z4rM@G^z`&1qM{h+BN9<~{`%w4TB=3NLccvMT z?R&o|{oj=B&sEu2U!}P{%M1JXNPbQ14-85B*ncf^_%EGgkEZJn)S%M27U!B=ra*TT zw?6ZfldV8>NS1J2nJ)eH&r^fb_@@r|7H+n?L-Q@YaC=0O?lftesnOa_J$u#3dh!FG zOwqLx(Jm)_VY-Lndz<;Kusl`o`uT^AC&Imu{YYzNBd^VE9e*8`R6Ft|&WrtO_8u6R5 z>`ksKcgM#1@R&|MD7?(A__nx~ zbJKI$aG=Luf~9a;+Q%!GN6S@TU6z&CW$Plhfr8I#!WbyvMbC6z&y?y?kugFq*_phL zX-1&4Kdodsy5}&_-I~e6|A5vS&v!{H!O^|RqinHlA#CxX$~Gv8zTT#-t<~b~hK3<6 zV=0LgBJo~^jhFcx($*}*Y@q*^-vxmiCNocXhR$HyB|N(Z`rG?bWs$f|AB{@y-|ub0zqpu9q(x|}r-ocTpeyYgDU@C1~r%5Sf@jF*rT6!Lz z#q?;x)!`S&Z)ej8Fa;bB3U&8UUNf$b9UQ%ZGe?$N>tIjGRs(zkU6IxH+PUu zMQ9K5svH{Xg$G4f1$OkV>Bk}(+H(@GT73&+v)wG|o#QmR%+tr5l)J&r^0v7v?bC91 zI_Iw3118rR%7yi(maJ#KAt9HDh5FrVIBNC;i?SoPuw zdV-6PCFK*lqTZ=Q$6ohtAtOp$!dPD9;kT_F&*L9=b<`mwZP#nMdvGtYCp#Q*--_Kh zk|$;Z)n~TsQ85F^$VLsLC&n9uJZ%NG%Xr*XnY2^+r#&vI8_grq+eG-TSlNuJJFeAb z+(7nc@3ZZ5zCiGxUy$M%{v$0*R_(O6kb?GRB;iYws-5lMS|*Q+F0`1<`IA(w^oBE2 z4Ffm=Y$T>~p1ipkomKUr#d0abiFQYa15!A71!adRkyqe`d(Pd|=oQppcvE(e?@E(s z1i5S`U8! zn0a^m&iV@X*}$oB9TUzvo_nwWqQ2Kyk|=?GW`jhP(leIL@#YMk7qZ&cAv~bjPn<1( zj4XVR{66`)qh2|mDtdfTe`}<)Xn$)=ijx-zo07T#$S z>9p}xr2E0f6pFaB!3sHBsj=joO1xsLriWIXC$fLe&D!j>@vgc{+&%a3w=52=u0^MzY zjC?FL34$5~s`s%osmabtE%kfX6wNi_c%QZdl;rowVJ6=1&S~+`>lqO1bqx0Fn<7JY zw<1HCS^lnXOV_I))K^P4<5>g~eA95dMHjEGWZ1wn2#?*rYlmAFh_Kpu zmnmKvrHC=AGYoJMx>w|wUrgvRteoxmtl4tBDE|R>{)1#kFvmBDWoKQi5?x<$Dd_xu z%Wlr)Xbqu6;>Nv2-29CMUq9H!aO(m{eLf=*vCswWwr{n6%QtGtt%*puzYSz86HC7* zad~jKCFwQ{MU1%R>Zl3qdRfhXH5^#X=V=L^b`)iFR5JG1N{@@i&zAPiMgGYKld)@b zx`Tc>MN@Mx1aRL+%;^vP2mwEV&%pvY4~pNFV>7cUL&PrC=}1S>--8pQ^-3EicjgMb z|L#zin4M{+`k#&uPoj*Tx0;A%`>i%@!U6)0VDj6DMM_S2{wnvD;0;Z`BmsFr>QY*V z^93RGBL_F+;!u-tktLx3Jn4zBEQ>0lW1hXRoY0KQfJjQ#se?R51y2IMHSklDI z?Y`uajO~*G67nP?})9kYK?_>8N}Q*FPr4JMO9@8 zc3S%KMJ};&Tu+R?y~)lBt*WUtAeJJ>5|h=)d2&%(1}|Q@EO*50^EWZiZ(lrR3A?Ua zMyu)>8KXOdjC5q~wG^GH6+j|Sfy8{kowB3(viA%?x7re3%jq?#&N#BZmEtw<$n4R(>#=NSes3 zaFiLPmI^y*PD?Dwg&Fz&C%lCD1c8IWV=~6OCqCW7cD<}B*3ad1eqjC|izqRTmo`B` zA$pEW(p$nU=jom{9oR!Y8onor>#QDV+tK#(!mr{sCluQ|j2?5DX8IVnZP~>DOCE9L z=ej)@{JPg;vwwDwtC-zuGNMB9H44i4=86BN=RLEbS2sDS}N7J`^dE9?Ov+Ms~^mzH#(AR}v@Z)rM`o||G zEIU*EXFF1&nORt{?livhU>)Z=Nr?^ol z6fK`=6&EO~N2X>j?4#TK36L=lfDbuSDQGl0nuaY8b=V&D!;Yk-Q=5eP#^eE@%t<>J80zTzci9>W#y;3+O7itd)=&)fWXadB~L z3oA&Yh@2zTjB`^3JIj|m6NHD~r`ZnLX4`K=zgj3Tz5|bf)%M*w*7d>t2#M|cQxGv9 zOqVwHvC`T9@y~W9CokW%b6~a5xXuO9K_V6tOY&MVE(?9~a(@#C$pabCx&><)l1lq8 z?QM=z$7vbZ9lroZ!4(8_OGz6rmQ%ByKaZE(7F_5rRvt1mobBUL;nLzJPAc}ZBkBTP z(pohfKD4PYG(=jful8j)4V+3Bc~PvZcuArUFZKZV6ICd*6&x*nZPk9^)>v(zs{MCf zgj(^(77ycfeISY|+ZZGGcIEVnDVgM9y~h&k^&|9zsQ@wOVK2&?tVBr3Gq!mo3LS|` z23{n=sEr*H=f9Q?-$iPRZX_bNlL_#=Og<&)LwiKNW_2d9aWqN4I=-rfW6 zV?HagCn52%v2j>zEDz9YhjH|D`d{{PEtNy5%JHe=}MQRFX_|!E_UJQ9HEhzLs ze^bky0^_i_xKuc)51XrJpxj+6fqE!xYY#5eCzHm3~dkZ_Yp zU*D%WIrk$AJqYHEBHs|r9$u-pkNZ97&)gnG`JcNkuMoi)ev<4zN@n-k(hbE!tF|Ub-XsHJ`;WRf<7Z zZo4Dk4=`x@`W?6U`u>SkUvkDTzv#|>l0KogZ9A}$q;Fs#Xx(EEBtICST4o1kF4=6& z$ReXZ`Ld})Z-I#^Z6j$3)K%_zlStyHrY60GJ{+-jb!u>}QwA)JIxq>YY9718%7j@Q zL;*coOWS3k%UDCmWoNk9!6$XGQR|IIMWUN0bk#3TLiH(c&0cs>Im9o}YT1W%be?XL zhKIl-&~RRc9lY!JGY19+#upcDB_?Ndw87}`=I_6+xRm?BHXIlj!7i9SoX}R;e!U%j ztpZc=Kmh1t14oG6-6oWw7L&A?n3%^?`k_O`w z7-rs2`*7I9&#Pk$JquzDAQUYSx?LD_)VuV(y-84IiiI}wK(&Oi z$BKH%L+gZ)*ufN{zE1ysI^M@9kZpied0=Q52b2*9!qPIMufV)m$cBmlsw|?=hA_*C zv+k7_Ft5a9dhfoRnd(<}PqTgh>@{g!2%qPa3sX2BVgE@5R~XkYR^w8TaTJM zed?4K;=47B5HN@h^YfXb%11ll?-Sp?eIS~(g!}s|zN~%EKVb@8>#X2eY#ye4O;+EA zzw`|^H7Pg_#pK{oyKVcSg;Q5Zb(ncxy7OGe%Y1Mgs1%qr3z|$nWVxAJ^<^FCVpSQL zSGM>p*HWYfl(%1!l!BrY-fjag6mph}Z#Gz#RnzaduztSKgpRttyX1~V#`^prUgzy6 zV{u{7|LvgER*;N8V>U9oQYKJRG`W5?tc#US=r*mX@I!@z`F zpr;!-c-F4zK+groza)4Y8ynF;+L5Mk$g0k79Bk7~e3hk{vmpHo9*O>)MjL%Jo!`bW z9hNYRk}x%jT+fFxX(#jeO6Wk<@g}T^Fpg7-F@F-?WY3j{yC#13t z9GRL6lv+>M;yLR)cP4!_Ffgdsnzs}{&MlFj;px0Sf`*K4Igdy`|FLhwKmQKc@_(T0 z{$a!HQ$)_6)E@*5jZVMlCt>vN2dxOM9iSDh_iT0W^Z#G8;zx#rr9oGV>Q^KJt+(8* z*L!Cms9Tys>U zIC$!pcQ?Fhxf)wq!1LyrUg~&u_WS7Xc*^?ixjBeZjHK~XZ4p79)o!S0hp+m`g*ry+4#mPZU#(c>M&3MXl_<5<*E34dxUzdm)$!dc|%2t z$`iw7HSnQ@_RS#SVR5_gcn^%xF6vFJ-jlKYFMIRGv`N1m*67K&hUkEjkm>M61DY^~ zP%EG7pYwA@(h3#?%pVuJH(kP&SH|LYCwZcw1_A>Qe7sdW$eN4@xqRj7)x0lH6gusi z!keL`ibj?9{-ZJ1>HY!t|0f*ti;Z{xX7sD$?)tt5C7|<+0HZL~XSR)cFiUqcvNiyv zwNzOySGAMh+((__i57hPk&D<_uJJy=&<%rK;Itp%On48$y86gVjpK>w%%%YyRC)G{YTveZdyTZ00snZr_cqI?J+l zc4oQK&G}xwjOEtkVG^cZ(bm=m1gX!;8V3=wK-9Gi5$(N|r!f{@H$0^^uyN}N$c*xb zmX|$NGX9`B5f4hOyeHvi1PoQ1o@(jhw;XwNc7h!o9oB|WOLFLr&Q-Q68&%iGx-h0( zfIx0tlzG>&zR({U7iT!`mNHXp((o8(?H*=Zl4xwI$V8XzHoqqrh5ae88k33_)rO%d zw8j4Mdt3f3COy3n()NoNZlI+yxKS1>$)|gNA{RBnNtRPtfB*fP^O1S|5x0jU&G~sa zo+kq<8>p-r{}ZR{tc8#tKT1bQYzr!)Okd5!2A08@y zz0*=y_2;8HaISrt%1j^e^@rKMN_$Lt^!V|UH+NQC_~`XYTz2kSP(x#>x1CYNGKPT7 zuvy$0AO2LZmhFx_-&Y?8Y~Ed56{@}E>GQL$+rEGNcold)qlkqVu*U_Q0NeHPn4jpX zqqlEI19ul(XkzW=k};q8W(#ocHC669a9@q3<;}Jpei3z3Q&;)gEg{!qzsuKd_+fju zz}X!*p`>B1?;rH9U0*zgV~MUk`W+q>f?KAw6d|J@z) zDHA8IV`P4>f8qT_cln_Ib<8G3PlDOb$}p_UftKxTr%#^_&dOS)qN%GJ3Y=lPw(P9E z=KGp}uo-!=%u|6=uc@c)LXsXuzP-S~_se&Fe2OgMrh<7tS`` z6_pfS37o24+tX9r)!Tb{kt_Gs{QL7&`+lD<_6&M_>|fOW#JP(WE#6Z8UOwvY$yG_O zHS=l~SZuyu5evL0zUp&tWl=%F1?%@u>I*I|sAC3Bm|k48U0ln|EDYGZkJ|Kv89JNh zG3nQL`4#=)I=~&z^}q`)oZj!*?cwOS7r0d|;?0bsU!|?TMgHB9xcO`L(=LBi&-eSc zyBu!sUvuXuLxVO4B-cos0dAGi_o?%=uKOM8+{Sm!{q(d~x3bp-`}mYhJh-{Nz5QNI z@xG?=_m>(PzrVg3zC7#0gX32gR|m{Io_~K|GjNyQIz?yp*T7@xK7IOhX^#2x?DzNV zzZ_Wb4_FHnJdM-=9?;|4`S{=Gn4o`kSAmy8R{eO$Zj%2`Cbs%*>CtP!!0Z!vEk9!U zeW2}+kJ+gMcSk>0_qhbT!(i!y2eH6b^(@QeX-3AzravySn-)DO_<42xdQM@r$lv$x zevkY5vUvHjJrlmh3cPJPcd7peMl zXx{~fhOUSImw|;J#6LZ>?>s}pse_Pl7my$gnN)HVttU=RXI4j>{RN=mmuDILYyFmy@| zLpNumzxVyVbDh7=bIBz$%J1+1^-=jdGT~nw#2b^fI%%eUCf;=Egf85 z!`@)>?&7?VeyZt_wm#{ec4y@50*mV1K#OrS1O)`#m9J2XptW14jbvFxeO5Dj z!7IC?z~AxOEL>L2JX#>E^s~-aGTb{Qs?uJQmb#S~sD_{a#N?wo`|JmgFw66$q?;4T zA};;Obtfj02WbPmVd3G1(iWJqubLD5?{)4-KO`!kwx|D@niipV;|z_>(Uo@gy-ha; zF)2bSy52=BRtr?|ar+7fqk^XSu`~om2%Ki?_t=is!#T1m*lRSuc#>mz^4eY?nEKY@ z)`X}>B!c3?cx)PN%hVN#R0N&SEHiC?T$)YF%66LO`^o-ZW4=bHS3b`zU@nyfpT7%} zO~}7+Xa7Swd1}{ug^0)2;Bf?xZk|9)oCl`KlKC(K*JF+{YMvaMBu#{u$<-Wdrh9c> zP!iqx!@jv?pZYgtn^P##{vkAxg|0{Bo1CCi&rJvRYJsahHou*u^aYEVC79`kc6|~j zneSa*W$4>8w~i>Qqh!WdgIbNalG6*Mm??b)zn-jv@^7!bCAT_l?*|2=JU1okG)~wuA z%1q?f$gx*{GhA1jSHf?$L-Nj3g6A|BOR5Z78BdA|vJp-SFr}_;UfSmIT*0kpkg9%a zz;+`i)YRhv_jHcU!@mzWILqG5w9UCya2`|N&sAwTLpxK;6`V>P`Zo2@i5?HZ`+1Yi z$kMU9Lr4Ub64Z1zAenL|-;zM6-LLbM2|4Gqnv?rmkOA3huAfvCIXg}*YyuV{99q-H z^Pup1wnh$VFHUvo!h7@5Yo$83;R6@+`!OFbug*=ifaez6eBGmFe%lbOiDp+~2p*Bj z2nHM=8|vhnXWgAO2B#)f+8Di(GEQic%V}MbSh*&ms`# zN+JnH;S9AnO-R?bIk6W;sKz)1%+94`w7n)n;fhN$o7NjmyHCFQ`?&Y&>=Um*MDn=M zb`cG#^syL5Osl^sYFxPT?fjLgw%fN6r>vcC@rs}`;{?Ib085h`>ZIh!7h-ROqip8Z zCX!hkaOtS-%!PMs)i{Z3LHHQnza}m+ogEj9nl%w4h(a~<(%U1N-H2Lw6RYnaF?^1O z6ew3mL(-x(@^G0KY9$(fH(9jAjZpZ8c>eW)#t(td8MA(G)+K&t*_JSs;Z0}?r{Hs3 zmzE^T^m`e0(r33C1kpN+emd}+<3sRPu1Dw|b#sI9RSz=_hC?DBHwc^#`Qe>Y`n94v zgoqYis6B#pQ}~dWn}ncfeomCYZQ_fd+02dykN8wAjvNlkwX{GuYW}|V>wm7b@>-AB z(L=+QJ(?TIFK$7wGp4%BmHzm+Y^ktVo=#KVQ%xYsGG3yZPkFUU(=L{zb)p0(S2WC= zCNz(Y)r3tJHdF0-B)FQB_uE8=z+s{}vhHdvdbn4=g-`&0;vD<-qZePx+FZpvj>iY5 zsl&#FED!P;A;?W`5(Y%}Hw(I(O{XauemoiS{H@)^O&z5i_te58Vp4TN+vfvkTU9=*D1YmZiLgr}s0q1IR^ z!^ucO;xXRh41)T7se?<6_iqN&n38D`rPbEcQi~O&#q~Df2IC166yeK? zlP&Q0lt3LHYWq7~b-4SEtcr(&ZdFz{O)8JjZYr&-6{_!E>wq~Y+}bH0SlX8|P*HYZ zU`xlEzpS#)`sz$a?b;>17N2HD9x3evNg;Bi4t|STTkK+kTdWLbOWz|CbzN=yq-_)m zMSI`xjE#$H?M>#>t#)K;x;VqUP*FivLe(`ij*wF4EpzSRBI_jx;f)_d*Fq2;;tZ8g zbjK@g!}e;Y`9o~9|Abi#Gap|({Cqd}HYKI=e56n%?Sj0D%5n!C%%UfOvrDpbV8FUL z05|Q;;ESZ3yt^TP7hW=Fgbc#UK(gj}6HX-|UA&%WUv&DQrg&hO$>+HFM6qT=lfwnY z@J90d(3}YIxvVVi&Lb@z$C+lg#9x$qu5`kVcaxKo>&{g7QBCKc;^N31>NY9~Fqph; zv9Gg;5OcKPojZ4K-?@X`?%~$Z*YEjZGZcqhhn>wO6tqOq3Ma&-g~eU7x-Yn9%;wMG zI8V?Rj>skVImY1S9g#HarWjytbxmuDhyAVNp_AlCSzpPwq zRU@OPFPpkxCYkJkL$Xc$pIm#R)YT@kq`)A^3yF)&Qvmrzf;TSSz*<07H@+if7 zh&Rd|vol1y{CrAS>Nxu>f!nzMcd2?M-{kZV zE1mgE(7%#=!{O*R{XsOnSi)=mmuhNc7bnvf54gCjIwEK^wY4#3b~2YRV*z_D&>Xvo zX`@@?`fNRF@vt?Y#=ueVqfhhCa#GVibWhi2{6Lx=eEzrG0PFyfZ>h_n_v6EL3f2-Z zpUbr-Afhf2+py8{o#d+DY9&B>f1mL3u07p9oD1jnIK?9M#g_`o`_0-uka;g2Tf=?b zwq2c^c&n!U#K7duSBLYu4i2($kX65o-GrmeS!5llWeuMo{6>fTAZSqC0fOy`;_5oy1Lf`rZFl6;t(VgfQ(4l>sPP5d&bl{TPv8vy0WqYK*rV8 zHE7@&2c`L+pI@khTL!Zgl6g$8FhqxBDH8nL&s0jcJMN6G0MMMyR zHG3i>gP&tVe&hX?SA$rEDbf!A%G(A0RQdaZwlP-6yDME}`iaJVA}lN{)WNYFe2*T5 zdx%Hbq$K445A2$ev-1Tus=z^sN1mw&to`fPD=1g2R|9wkvhenAg@x^FdtmIi%n5*c z$`rPF8-*jKrI=&Pr7L~tEVAWoHZ6!QtF>i1cd)U~OB?un%BNF)MjRYjo&3t*E7cFl z(77D#_fCqllMu%71-bBacb(>SWqn5im*Goch}HV<((0m~)1#fd!a|nYH&~);Hfz`Z zOx6jFjEsEz^eHwm5xLM6Pa|lrle&+}hb_CJ4CVa%B(;rwUANB$Bu^p^rv2fC`c-jp zanGt8CWU9;QFv@rpmZ9%1S%>jEUc~h+}3qi6_c8|{f~MqYEVYroH$5&cL)WWvVGa9 zOgJU>`~*`DMGKadm(xi3iJK#%+IfhI>NZ7>_txZ~P)>9uG}C3dKh0;m3xLd(65El7 zM*e56FJHdg@({lS-d{3QvpXC0S<64aJU_ZbrFBG?u626*)-2*cFXl_50m^l(+KD;F zqZy6$+AD_p9j~ySRGzn#)_BhelayQaneDBPWaZ>Mc3zN=65sAzcs|`YYV2mqR9QiU z!X5giPdR$DWSl1blUa{Ae~B&Xx<&HoL%#OSP@jQZfw|4EWWwa1C)g=RvQq$7vNZ^!tvoZcDoJ%~q z8h=3Y0P;wy;I4#3I&euI&uxoSKdI$(ccX1lD#JHqIPt7Xb3cZZ@yJQrVD(r685x84N$w(Wg1Y-hcEz`29Qn#XBQ`d;icZ38EKPft$+_eodqk^r7;!Xpot^wnwf5n+fX zgbyGAu46sK)4)PZcw-t0bV>v9NX26!>4env^ty-hG~!z*kWNV=F04I?+_0a)DJdxy zXH~H2eqy1CC&1(1zkd($KgI51rkkERL?0gy*Da;keP}ncpKeTlayKT8WWJVbY;4TH z2iqP25s51+dn^bYmmbKFs9F7`>dMI|JpGJ(TrE-05QOmwu(AbuZ+l3lx?YrKB`+ zRCE#b*CW=yTj4=ytR7y}&O9wUS)%AZypFRLaJ{J}T4{uYaLVsS)x;?ybrRu|cD8(- zvtDtlCQp{AA+J`c02QgTj~No)alqogsbwB+AxMwFx(YAEJg0?JdG1(sL^DRC)+}2B z@x}LsHLeCdJwCup=bV-7biO^_xcu^RhIf>5x~S87DUv+A9RRd4t6-YA=i?lk?b#5< z?e0g#F>v_6N-n(LuDC(=)vG(Xa6eHT!#X$U_S443Qw9kyM}V^BZ&uWeyjEE5^6t`` zY>ZbB(FsOuPS)}HpZjF^pL^!0z)70pRU|{fQ~=}xq)On_*MpczS#;j&7g>g6c+759j#gZQ<+|bZAGv4p{`A!hRA$|aA&*IMp4W>z`c|MPM&mEl9oNU&GO5cMx zwUOD6{|K#`^19hHJ&^SxKESu6>0vkdkwNWg_|04Ct-DYs_>V-H3kELYm2i)Atg9_a3 zmC&-XGDpM20jZ0$WIpS`Vq>X(i30=4qXh~E|5GO-gvt018(?r$;uoho5wrqfY#AO` z(3Lg2g9@STW@3vaA7nElsCfflo@1JDJ+%ot}NUb;*bTEKcST@8N37-)E(l@Zty1FXFP~I3RJb6>fYQ*q<(DzQJ?P z3VC7#56PUWbzK8vsyb^DHm{E4i!7(PI6?>kjkVO}-0y1(rSJqZytFE65$F4BsA3fY zGq8Id0I80EdB2tB=~~-!p7uSM-8m9o{HOt*7g)ZTE@g{Ji4qiMfOHhDS2?HumnOgJ zBM^SLZtHirRa1Yq?|go|YKGGl&E@VE5S@(Y|^G*P-cbf8hk~vwhvXBf`efURGB2aWp_b->97IOBQu~h^gNpdG+cQaj=ch-d$tk z^P1%h1zX#P%(4-eMA&k3qNeMKvYVS=Zid&xqP6YCL}OOQZYJI|Ny>236jnlrBhGwB zq+OYW7%hMVz%K+XyQjzot+%O_A`8r z785@vBsgz(vGIBB{#lTZeSeecF+f9;={0V)O%pW1@6faiE8i$pF|u4o`VS~pStpCd znk?%e?vXi7YY}eEeT0A#50L?)Aay=Y$Ck4BM^mz%T3JPPi>pSEUj+RsY-Ub0^wW!H zU+y+|yO|Cx5ocvvmf9a_+fUYhy2(|2_lT##YtMG6KfMPS@8#}-xbn5WJ}rn;GAS(V z1_ar%wzmyv@eJ0ZdM@ly2{iRrrkqQk0BQ^1H=o0VFjw`=6~7bowDV4%kOl}2G}dWP z!G6SFe`;Pz4QzD&J(bZ+esN=~6U5fejt1NT=j?dT98h|&k(X|8{##Q_09tgZ88g#3cR#witzvL)LLRO}mr2G#NjEB<~=SUDGN7gkzAsM_Qy1QR? z_w;x!e$q}7u%iTw2;#HV(q#^ufRMq%#CcW8&esKST0Z;VJdKBQHvtL*&c_Ub)%v=9 z0*7vE60f<=kJn@X%m7{D>Utu3X6=2rH4E|j^94}Us+x_+H61B|9Fggf>A&V1YdA7@ z`%Zp-BA!3byH)EYKFjV~Q=ZoBNQguPek#oJWmRU0U}I?Uj>jC`)WXd5%m-m!=u`MK zAPgWp%sN)LY;6(K391?xC_a7qbi0AR=`ChLq*T3Uv{0Xp2nJg_??9ugU~FK9KYsim zK~cvKrS@VU0CozI(-nC};&NwT>-2I~%7Su;t62 zu7l@aeoCT^gOQ3wpUqNC&@%!Q*JXK|OIpI7cqJ(4v3fi=Ih-M#T#D6J?|CkR=R~C9 zyc=vsy+Du|!8y^|IdNsG_@=vo%RKyOy{8yEH?u>1y4-glviKVjzqd6rGd^9QdOJ!} zO;_#N-CGtX`x`jor(1~2pDuHdzws)Sw{!*{TdFgamUV(P>FVxo#T=CTp1Ao)GJ*i! zl}7K^1UHWo38pgkiLI{}&rwc)>Ewhk>5a0ax_vt)HMOVAvL}w2mPCB(N$V_65FzOj zFc~4Z?>>!wmBZpY3gx@xp(fO_&UfGdj~}}%^`?*i6rPq-Qc`lJ)d5KgLv(J}6UY<5 z-~c8Zp7~wE_0j-*AQ1m1wUEPvvOnMI39EoWMSEi@NBCtH;(;~ODl+H-T)FElA%nb; z5d)^_LK1AE_0Ce?C0TigFy-i(1JPiy6v;6EOO6o`MG%w+fUEo}s>J9ZD-Q+#hXoXA z#YZ@Bam}k#WpwuvUMRpN@x{;E4E)^r+q5L#R}BfLb&q60oFC1O-!tH=QlfG-OuP)? zT!yt<+09m6xB~bHu$L(phEMG%ws2HPhME^(8Co9q?_C zc*LDhaT#<15`77S6s(FSfV57y3`h|7zi)dJkdsh3$%{L?zk!agkpV@HA3r{(rKMRh zesi1H1Rk4c=%(wO)e6?7v#)RQ19Q~t?{;+5;vSCimKe@L!`ySpAEQ-$lko)wZR9y@ zaG%GSvXQpi<0l6GuB##QTpcfZ30ioY_eNRh3K>UCpS+~?z%%h^<{?(3@cXsrqTH*G zm=((z`yl}n{%Jtjv{*;&~2k0QyBkjrEfPv-A zZ{I!y1_mzN{s>aS%P`fO-yqqDJtA%P6Cv>_r3c3fq_@A&^NFdCCo)v2HOVGdYp>3+)6d4?BI${-X#B!>4 zoF|WaqD&&Hv->V^r^+mEwzsz{rV19eh#1zsVG>Oi`%(>?C`tt+Hbr#v9~DJ*&a87pUtNrJ&M zGBQqOYtJV@l6hHnDIbtjIM|#7cz+W_n(@3-upzv5qa1+mU6+l5bOCSu_WiqA_eXZ< z4aW)pi?iK7znG71;oaAM`5W~^GnXFo{7f@o>A14S+Zhnlxb*bC^|A82ygViVk-&;U z`W64e@}TBi^pHB~3G$bc9plCQ&y#vV?QXv*itsL2k?KPoJB9;nm+PnpZb8d~tD(xU_CSesjKl z4eaeztaO-s3CeWOLr9=*yBZ)71v3}l|80KhHi{|ypJJTv#=AgZO#@E}>EBIb*vLa;l9Rij zRgC`w|K7R3&1nFnA2m&szPAk=L5n_AcB&ZtGyzz|#r#!y_peFLO+ zX&}jfy!rVQn3{!!#n#a>{4zZm92&aJ;6ng`mOP3XR8M!SCzWILeG~4Bo{$KY%`|Xq z!3T?-TH~?|@*_|hR9Tw8%rORcK5M9?jpT#=10L1TRYWRv&D&Uc@l`K!Tw*bToHf=f z3{kiY&7eyEq^-R|$xMK2k&ft8fMKq*tt8@8JCmYVlxa#*@b!KnTw+v30Bl=9I4Wo@ zU_JmUQea#a{HUlp@Zxk?>hjj0er9UQ1h!BmV`$h~07AmHV-CunA(s^B^wg(c>cU4h zlC~Y#SZlrKj_~TY%+8*kdBDvtOPUM7Zx>VSidxDF(l-^v8FFFMjaRR{wJ2exjbzOg zB&Oy6&>l_&>K(r=R9jsQzkmN;eY~3QIs2X}1&a6NJ~{ZssCjwkSB0H6$l{a}xeQYv zYU;)yw_KXt^SUfBT{0%$-Cqlfi=Ysg+DkU%(XFT8%ja|G2nH+R2nRlo1yuT1zIL%i zY6uB^HwYR@AfYRZtc1n`j|Ox005yZo?rt-X4n;6ZWo&P63sy8_+qnL1hfEW8Y%lhp z_nIbEbIqpo&ioZOcHCRr)AglHh0Z|c%>rl;9IRE{595V8tG<*Mdv@hK#9JQC%Y?;L z^^MYw%)Fc|*ml(5BPe0;P`AxvP0)g|^6%vD1JZL@DsdE61kC~PDd6A` z5Y%@_bq6~<&4K9CMJqkO1@Ur*GJoz z^&JbM7%{>ml~6#B>F(d}>*+yMLIFICPYCS+o~x^?tCJw(=_!H(STW$*4<9|E8|IXd zkQft0I)SQ3*P<d<3hAuOj7GypwykOrr+2@#%=LXR~`}kdQcFJuWMqtMdI1kz%(i@ z77{RU{|{a?GTg?i*_kIon%}ZLms?G3roHq^HEtp|l^@Pk9&si|A_H_gZwrqim|-gP zx$nKf9De272E|xJy``=afjq5?Vb$3D!-o%3BnB!sDAB5Lm&`&vTNnKvXc26+eIA?M z4=W<(tbnRi8D7?tvzTq&1Mp1r)pjmSr}b~o#E|4KoA?-tYSiTj$I2mic!;QiYFW&2 z<6*7u32t3`%0o;ERa)%NPIoeVQ0^-{%t>QMd)5A?N^gsK5_MAO1YM3$>BoWdaGm$0CBiP9ly}ZcAX0nYpk>!OXunFiosa>sm*ZstmsUD0ufTc ziHOwWl)8u%FN8Nevmjq-ai&O35gAQEh`g6PfZ%E2H6$8h340p0Ha8|mf%@AR`taiu z7UZU@d9oJVF7v#$uYIti74yY z>Y1IlsCjZCuj|=YS2FNJ_CE~r^)zoEGWC%@mEwIApma?fcZ+~W99PjerkV{OF7-rN znR3!=@2IFw{&KygEvnXcm_av~s$McsN;EO0?mPj~j(a~2R_$OmrbVMy8}L6`03qJa z);BM%3QW|FyfSc9>g0#|@s=cM)FonNWMVjf;Y6VntWsWJ(jKY@vU;4gK^Ze*g6u?p zQwpo$q2hI*Z9IS;&PBboq|Txyq0tqgZD9Hf5A+#VAor%p%@?GfF;8XMw#-RqMARM_ zMzlHS4&#f|&*a^7o{3AUQ*Y`HyFMAj>y_1ZEmhJMOR;wt>UpJY%RHHDDj<9@kV5DK z+609!$b-vPs>l(g5H@g+g){X>1QBR;UtU=VKFO1HK8dlv1-lO)OYyJo)OkfuHk z=r%A!V`A+9Y#5+GuW}=HyAitQJFH0ufCbcI177pjB8$eV2lUVm(W9G38MVg2rl3T? zqf|b2PGLieaW}-h^oLkXYLA~Ub81*vJld}*+TneAvbZTkj?w9lB-w(a0TqJh_YrU9 zmkwy2(0ahz)BWYdjo4a<|9SSCjfv2v$-^}X^{J}D#^~d{)h@W--p$n}X+feOIrxbX zcV7lxv&+GB&HqkgY4fN$mO04@d*r?D_nw)I!EXs)(s=*Qto*xHW&G34ZaCQu0{47_ zG5`P8xzp&eO>c`%rHqZP$eN(TQcG?|c3Eu-BfZ2%T@fvxL+yJdnRapS>FMz|r&+v& zLccesDqU@!5Ki&BysH?AkDzA665}k>a zz@X~biq-_ZH}<_2#;82qH+=|5{~(iQ5%SmZua8EOkd58>Z==f+d#ew9?qZeBJ2+(& zo6Zk>wvQ4||NOB5^;!dzlCu7_t5>LlpWY|Oy-Q65n!#otWhS?Ld&=T6rS#CS%gzqz z5P$rTIY-aS4E^Hs3QOItGtP=^qqECUU{oyR*=S1L#ZI&bwJR)A0!4I>hAB!kiAf6R zH{S|x*Ryv~Sl(dIV`o1-*%LY%*;N1~JfW$RfY%(d52)`OxErGfJB}soIT)hZPG&lc z4RB*l>wn}l8m|_QRKrpRCnR7#8-_KEEhaI=r~>?%;77Uf^d(_s7lYSG z{@O!B8-G*RN|Ws*0nRhmw~@!D=k60*3NxuTxC5tW#ZSz_T4LUwu@`@{uv>Afee-Z; zcRtE=ck7FA)X?gA*mqk7pHY=>$23SFvyD6G# z8zVGjrhwJjc5xAQ+n!ZS=Vw4yikzP+&`6k3qkFo?N<44+dbus<&?Hv<2I+{PtI@pM zu}>rG$z95Dfp0K#q_Sj$wXtV#J}a#mU+2e^G) z2I!2vwKtJb@D@IPEVu^THnD ztVku1uYJqKMpbXk*%+gym(BP6rDiHmtep{`q|6;J8aX!^e^&_!oh~ZdwwfwSY`)ei zL^o@2H#}>`%oB#Fn02%-?{xBUt7@qwpC&X~qqsOnEs=!k0a8Zpch0=_XR7n$%C>s4 z#gFDVIwGh$5EotyJ(bB$UHHTdg8FtnQIa}a?Cuh$)OaWRvvcJt)>EzRr}LryKqMg- zL5FugC+KvycZf$ZC}1FDLzuI&#%O+rR=?hYCR+T&EZ%o(s9bqIz|S{jBhx%eI3m$% zU^aWq<!VJ@FF`2kiE`h=rvU&-qMjpHZCvfE>Ok zDas-9?QVU{}v>@xn!zT5QFv#`PvS=l7+O~Me} z1>{SyCS~59uB&zuc*%6 zeN-)(6cJjj;+DEVcCkML5HaC}!SkuGC4Nq@YgZ`|dD2puPOykMtZg{R%pNeYJ80sB z3yn#!x3OG?8-QzG3x0R8cXgWDth}{V^NhnPyiKif1flE>uKsE$D9*&m09*9|T;+bW zlEMqz*D>B-D#VHQHqYiUwDuTbL*_@!=@d~Zy-h}bpH3$re!`0%SY7mgj3#)=u%J8p zd+$?kv8|yBUDyC5PtR1-pOk&eS`-v=H!?Sui;|zJ>iGKWb@(z!5S=ulW-8pLG6BSE zL`i%f3)xH<*I^XaD>Gv$uHPeJW0Z)*JKh^x9C0_8VN?-E$ica?zJ3>_N%~M()(e~W z14Ce@2(b(h}_^!yjLy&p7u8mtnk$oN!49?`;^f}}O(X>UE?Y!iv^UtO6 zGIPewYKi5bn)>rif6#_jo_S}Z@moi;?Nifb(ycR9E*n>Z`(~U5J0};NN5<@u0J35kAl;Z~01K zEIIk($Aq}l^!DFD!FZwUm+YWs=ZhT8&pM%oI`?ejVurragJRP2@)oxPuJ;h3MMn_A z{QXaDx*z3N@1eAJel}$+x3IxYpI|bGuaI+Auuxx9tuOqTXw}p=bM7nRwoNv1aX2*L zjKNb(=Fd2~DV1696~LuvBXPQiC*bRcyd&L8;v z5-2RVZB{PErNl5C=jXqN>Q8?8h%PVlc|4Jl)UT~?5dkcO%{c8ns5Z(a_Mh4wvk>Pz z{PE)=8fDZj1^15Cg*7S(lV|IjvgIg3;2akd8p;coMu-e=npqQA6Lvn;Io@BNviFtJ z*?JMQfk#L@6B184?|)NrHs}cMc>1GjcYXYQ&%g!mC2!HcIKS&(zu#R8o6#>?OJ+Nd zxeQE+(`nC@wFu;*q^=@(4hPcQYc5K2S3bg#yE_B3KLNqHM$51Bsf|Yu>Y~5dv-yo% zXsUNOn!XsVPA3FqH=CtW2nas&YyHtB#v)S4UG4b!9)MO1KC!hdQurmM0pcHU>_SPj07zWh z0sV}%+EANEuFGkzMyEG<2Vu z$P8%Yj5R!oR?&k=P&BA?0b2nq#6w&eZ~%TKa34nqTXOlAirQlzNuW%K>2xvGr37pV zK9E>oEY6@ZD#6J~jC68KS^cS(nkoi!uW)NhMNb>ht(}yV>To2~%SECGt4WCwuS+(t z9&sA)$R8bh#2pkgY}f$G)4<4Sm|N3m)3dC!Z=CY=FTpMgsaV9VJ%3vuz={7tZyZz0 z6)T_BzE+i;QAlsDs}&>)*o=L8inl*{#%`K)ULj% zMzX+KS1Z0HVt=@*#tyT3_IgDWuqp3LHudZF-)uA1SI0Z|`g)J3x}i+g{ICBgmhaC1 z$p*kc#um>`;-WOQ$yTZ(K%Mlx+F!BNJ})Spaw?nKKrb4zm`7eoi*o&!-CX838YF*d z8rY(hEjJ^~i%Y`>S60w}ga7@*e+CcU7Zs13`MaTj>657Z7cno#8TvPu|If!UQxAW; z8XBP5ogffoyAwTVFM?cSOh56?Q9sZX=^qr^Bqim%wMhZmKU3;y*S){Dmu^Judjud{ z4eik#Wl+%6`SeLZ6BQiVVXl)9wDJ41F7LLlMF4VlW-sNckKdsBGYgBXzp^HAApOG^ z{Wr!wdFGEFZ=&DPt>V#v%KygVr;i^U*c|E>ta3mF>cz_k@(-xn_?7CX8U!7s7sSkU zfjawEl=L@Zxd+_E7W$qnlF?8797sfTX%2lP|98+p3Gx|0l|3fRyk+q96<+f4{FyAL z6B*NeV)pXo*~dGvn7U(j_MBvSr}BpSGyyxIxjFS1xPr13t0Y|e>A%H}m3Uo+2Z@?D z(G{c zC(HF+WWbV^*^j~|6m?}-%wq=tHJdSUh=gx}|yA6z9WUIB zdFF@CgH|p=;lDXzxuxCpAi{kFX73>~SpE^124?T^LV%zBnBFsS25nW$-wABh`hqowwSv&cPq(AL~t8v?w$k~~tDKkP3WOIrwS zI0u-oRX*N!F1!Bz%7$o_j|K~)#6AtTkx;JP{?f|6E=S5jrAMN~h z?6?~KJnM*}8Cv%)1SzVSsnREywI9euR2&Ho;FAJOUnZ z!>9ITH)Pt|^=q)C{tJzD82i27b(q7OleKP24&LG!4Y~qj#8s16Z5)TD9S1+`PR|Ou zj$7N%ofC8&>dyU)Q}G}h`uX4X+QiRNXH5l<&ovAiSwc=Brxc z@$s4d0;W~8tSJ4D{hMIg zx;22kywaQ#*0a+6XWH5o-d965ersx>erCHYyDd)R$YVaH_|VHk&2GF{dMa%5yt!(v zr(ZTx&8#_$xO2B&)5%?LaY&t$XAKR8EJEa5~%d#!LDs6ZJp$7UDd-bxQti^1{ zg^1GAtsKM$WC5@Xzdgo&`U@dRPk;LU0ON}M381+H6>Rp0TuYfpJ2jZM$%^Sd7O4Z# z(m(_y7?I0(!sb4Sr4qEC=%ja_99cT!V?1I5x{djcHGjmU`-HNtuE>GJ)?J(srIa>i z()(KPJ(nX<9^glh$RW)i%K|wHGLMrgKi_$XLr6s1DPo<`!s*`_IX1w!nd8Q+8LExZHZ@pSG}CkF(Ji;GLn7l!WJ;18AKqf7l`j7ba>a2RUG z8pIs6R~q3^-3=1jf8|*DXLYiU)kO+QQ0nN}77Waod>|w9h7(6f_jevt#u@clFs1Vz zJsXha-n^)y4QOX9nw>!$V}}hfE~9rsD)T02P-oO15pfFvtQ(w6o>;?SfVW&2_t z0(on~b9CH0q`Ww^kY@Yo0zS zK@q@kwk@(4hZV=74yrG5#?qX-JRCf?A(9ub>G9;=ES{%MnGEsB&!6`S;#h$Nq z2zp%Wwh_2i`_W-qd09E#?I8^49=v}P(oebo#Q>2*Z?&0djYv&b0P>7fvaPSFsnl?B z(ZYK8%)!z$rS6AU`M)seS7?Y!g05trGM_Uzd%mKS#oYgVGQNdx05~v3+G` z_HjUV7<}ih2NN;$=EHiI+UBD(6--UV(6QCVV`I9YDVo!lx-wKpg_9}-YnjK!B&MP* zJolI-#s^2wTJqT7z58X4l|@$C7G6i@bHV$i7`#4cD2tXFTG9kRbvZJyCft`@NaD>B1F6Fs z%xI);aigr76E7TiRdHWN!w~Ny?ZU6MwJERiQCn5so3mN-(RL*U)-ET{zuclgM$hL+ zP4ot;NM?Vl21+f|_ODa?E|>Chit8FuDMD}{skj#_U+!91RP^=h*Lz1AhKA`A2iyKe zmI`XTRg-4yhu8&_Xf?vgc61>nz>H5H{-EK2kTWRzM|?hvCZ04p(&s6`UwNs zDC)+c?tA|AdjmMP7nb>;-4^{KI}w7ICby1P;@gK5r+Y)Y%GGBKKhI-o|9mo%~UXa2Y4aa$V6sb+mlQ;Hu9pFiqqno|2JLp@hQvqbUQ{2nOYYqI3YGNmi*;;{V-?n*|S2w8okk zSOHB1&{}rK?$EZ6ASy{X*l6;`C#ok4`k?x5C*&|YdBJI7g4qNHAaq{)>6PM88xN6^ z;Xk*uX?yVSp)-Is%5V)0eFd3U0@>M%A772ckl%RhuzL;UIyW3X_=GDCWz`DyhA?uo zl1Ig)XS{T9piEw|$;!!^Ibf4@J@nCo{!RX*uQq$E=H+7EwqMl0YeR&f67cJ#`e((qV{q3^7^?!B1mM7EW z!^6Ybxwu#%Bp_?a`~Lk3Xpz(Zl~H}w$W?x`I&2fIsrApCq_fy%b#;@`$EMRjR{%7d z>Oe{P;PzL!Xa)-_t2rP?=SG*NI$|Bq5io z=j$Pe2zoKCOp*U4W)TgJF@Xa+T|iE^0tO5sARcF?G6Z^*e67M(r!)!mjDKOH3MiK( zlD$=>_c=L9zJT$Mc9!{o3LXf6OOafnuYcYJRf|I)`Vv`6GT%D#@h-6cXAERx7eA^M z*MV39O!$C-*kO3>S0*8lt}gZoO;5~QhW}gM&hzXs93;xvU+KYZ+k+qAXc!MsrV^3_ z$UFd$fHM?mSK|K$jHMT#xqL#P)_!dNyTt8|6*a-7RHnG;+$%K*aw*>h${SY7@QO9P zlQ1CrKdvhZ{O>M)#a$2x;9lA8n5heR!wE_BYV8iedAbol-zxcc`72DCPXca{D`^Jd zqN``i-0XALQ!Rv)1^c=>lBd?)$csTc2Sk3&57_~TEoRKt0KjeAzWrQ5|;_g_Wh{oP^}wXt$*(#`65k{08AnR{e@*l=SLAdvbH z9v(F5AZKUyNb>j(^HVf>!wqQC2my(>S-lzi-Q2_f#I3idul@U{M=@z1uj0J6fws4l zIj0pCb@=L6ef{QGI^Zh|Avs;h_Lp;ak4A1M{dp~ZGHHF6@+3W_4M7L1e+%?Snp?;J znbvKe`Nl4HH@9cm>XWL@%uGzUrlzJi0o-6dfiR8Om)WX$ny>Bcck8AuZ+?Lw#eU-U zC5x8WE)lE2#p!zS!ec!)1ia^e9pit<6s1YOQv=7#w*0fX`P4y~#BXa|YW`&Ugv+^X zc}~w=h~#6!_3wOSO3@uTtiSCm(K%`Qv548EEkXaD4Vj^E>`RRm*|`na zXVss!vgaD#_3oewhSY96Wr=RPY)z!YA{M)mMRQ8w0bweSMtS7=W9uW)<)gw`n)M#a2Utf>4ba!k!w+{o(R_b&^a0sIh4jF=X35Hg6 z+8Y;GmvX#y<|UD(&TeLIrm9nN4U5HUXoaNL9UR)DR5_Nlz{%aP@AJrCu6qwZ-oU5i zH2C1@Srb^9zPWD;wR`T_ZknXXnw4`O%x+{zoz%ELLo7rgvG{XS6C*h6#HXQAT2OuM z#`{+DhW#iKh=|_%j47kGjt-NS(vv%&PRVe6*1s^V~3mLsea|@A=j8^DmHMA-Z|a!#%iS{rh`N8~1i=#cG?B zDltm;jp{#1ea)+(S+=$PSb(E$PxIZ8;+$>a`sCLI z*CHe7Bo5wsh*6~*8VY-^^4Au*wOCa!iHg$7DBOtUF%R~x>oR(dYYOGa;(At;Od+r@ z?&jwD*VBUR2IWcgPmZcwNvgEjR!6Wb=KWgPgxHW6`kCOs0z4T;6~u2ea>Sgn8yT`K7n39&nLpd%#dj_rUo+7aDSOOUde{G)lP3J$ zhZrdsgPGY^)2cDYKaMQjB(F@)#sxNAMMcF*=i}3L)T^oUgnhEStObClFqkhMbigJtbGc`^==p@2*+J!0}apz{n9h)KzZM%A6(2 zZzB(-<>XGlUi0a5e9J3L-*%R(ibu=_^jQU23j6h0m3vEskK8C9BT80W+N`cpr&Hk{ z1&7M-lV1n_K4P&SA|l$xR&8}Sz)-8HIz##>%{^3VpFsz%DMnbjm-BxkJ#Q# z>H-L5x{iUc{w-*-A%50Fm&6 z9I#H|$jId>s zd&ob<#!8D$iU~1Ziu)6Ua~lS|AEJ>FYME)T9^O$-m&7X{TR)!=|9@?%DL<{LU}|h) zJYKeXXpOFms_Ut+z1vBjk|Plj(Oq%ziDd$SS>Rj&*Z$^Y_{Wd8ziB=^kSEU54Ey%& z0Z{ZtO9v0FNZZ-vPlvq=2{AV@XG1tE#9T*Ff02x^&9Fw>1=(A|h7l zXk%g%Hr1v}dlCxug2aRz{vYPvI;g7lZ5!T*fV6~kC@m%34T2yI(hVZg-60JUTR=cc zT0mO5yF>&ewsd!QZ@vp}@89?Q@y)#RJTuQbpTp=HH+!vXU2)cNoafmJM?_h$=PUDk zh5GsCr(1?HMpFT_=_I>369-%9kU>#hz2Ut0;?<*)(XlpLx5u>n#QljZ!K#^JCv_z1u+jM#8|->msgNhW=M99X$Z*X~ z7vjF-2Y&}B>Xp@1#`g9PNurPoHHyR}+A-4EKc#+L=S`3nbU4H}$;zG~?1sVDuwT4< zDXHefNrTJ&tzxy^x;z8yKgB$}=fM%|ZnfmnKlgw>9r`_rk=P$R`VpU*iPh21!kLeZ z58Q;+pcx~ujjiNbtjF*0_$}E9JLTZ2Aa8vrD>CDnkv1_&O0p5VZpN@>x%XRkRW;S? z>dX&LaVc?u=!vXt8}{=RN+JstsbXu6%S2zJ$$N5{G>y1OW?U$VZAtP)psAvFLxcVEVbhs88(1lFZkWwhn&xM>^uzb0&^d>UBp~!L&mU5N75l-YRwGx z_CbGX|B8f{7m5b6?rOQgYLPadrW1v0!%ax~q06Z?cUE@xJ$O5Rj6kg(>qkv>qu~H= zi;%V1dhNzB(T_`GbH0dO^h-PAP+mJ2`I9{qxX2u8ooy7W)2lwYbavNlcCKoDZ+$n! z6W;mDH%nz~+~$MH!Cgp5AFwD3OW_P$2KVCUMyCU6e`{@@o6*-dG(1V{j}dlbC1CCi zbw9s~Y&lyL+gVg7yPW%db1r})5$%vefw!T_yT$je&u11-2OFs4{8F7_4RwlQ2`4Ac zA|BG%xY#n^9g?#*x8-XlK{E@jz_f}cE0%Cnjh&-JYU&!5nsaKbI*1zWBK5nW9`YEq z;0lX~x-&V!qO~8y(Z}#Oed%$CB-{Fxm4!NHRY~f3#*s1rgpo31JcSY&NZ40qz+d7} zVNFCAz88w8__2njJBopkS?c47Wb3a7_`Hz#w_V@q znvOy6rfS!=@#OMW0x;Rr)2|TVJ9(lVN(SeIkk*R97D&Wc0HNO@HSh~0=;G^4eXIpv zzj^&ckm=hE7MX^IsNFD`GWF|a)A>6oH8CJyvBL4~BU5}s1>g;~wa z{BAtBw9$7BMKm_Hv~Id$<>KL4ST8s2?fV=t;ASgjs)qNS3Cr}fNPCyJ@$fwwQ52oE z*Sv2SWc$Wh^vh8aL|DAe$ zd%Kf-YaDnSnZROv6v~7ILm~3iJ0FHH|+bSN`NyYqQ@Jtuw;FIoNaHm(i1vJBS}nFL&N?h0M;%lv7<6J^TvBq)YRX1L3%&;x zTD~gCY&Nl^+T(AYbkA}*=rX*0`0Ex{q8;Tn>x1p*TZjV+?wn0mb#0X^cGu?RTU6;B zpPgMzx2`xYfTW?jQU^dM&(vf>Brz?yNQS4TB6fFe&-^q?4KVpiW&Hd^D|LzoVR(4B zL%2rxy%t~(ypVtBDoVj7-ag&B% z#{##8ikiCIvCDCE4A!yX*tTE~R4P~q3D!hv0Y)_biHY5v1ZLL#7xqA(h||S;Hi~=c zB14=izGbKuurX01&Uvj8Z{HlN{ibL0x6at{X#xj-|I}-50gx3*`eehy9$@#3H|$9~ zf1R8D>t2OU@$Ygc`eyi89u5vgw0#aARYaUV^9bFaI^@j%62T(TAXV}9k zDnlD3Jzq*)aZR?X6%*0dex~>QTBKU9)M0pp_9HDWcs0QsBH2Qc`z5DVhQh_!xqZQ& zikp^yzMA^mnmJ}q26ElR#QM=l3&Qs2D==vR_8Lw+HqLU)s;irNV-?H+D3}kMhZk*3o74teKq!$bs1hhSNH~*70u0DK0h@BT9P7 zwnJ>?Tp-c4fgDi2v|fF~6CDH(Y}`_{zfb(PKmjGU4htdm(z-a>1eD)1X2Vz9Bo z^Q~y8F&ojBswUgcbsj8yC+eVXw#Urf-2z$~$l+1}jni9r`0v?{+a^p78ech?eX|Xh zI$!FS5p;tKsmsy+8WEP+x>j-}Mc$&YjN1IBI}cX|k)^f2TYDvUYE zpWYp!`<97fE9)r8L!;A?CtKrGBCJ@9@r?6Q1=PTh31vyy4bsSNE1B`~E?HywLU;KY zk3l17yo=EAM)Jk&*7|lQy`Y=%!Qwsd)$$fe72_u&vvue$CzwmoE*#xa^B?-m%BFUF zc^w7P&Nnq%-rwa@t_`NkXlW4vLm%ul3Xf%+A{}n{QyRs*kv(dYZP$i5FXFYel{?vM zV5fGlYNTCvB~m0NBy9(Q;gR~F1aQ1J4dUuO^Lic>3Y@W4GcGD-W{fkNnfGydN((2v zb3hT}q7f24ZtvNVKEcEUm86b7Js6+*R{qQUOS?&VRzm|Rm>Rqir;Ht$mR)B7<8rNo z(K$bd_LcLInVBVuMSdz;T4Ep;Vf78bYrU7I$W*(-s@E8Vn47x`lkux1Ar9epjQIZB zCMqxxNS<9??Z%|Iq;Q~r@E;K@{)+GKP31-h0tGqn$$Ygbss~Srrd^JnznG!Z{kiVMZ^6~R;ds&5r2N7M=q2i>PjR}QznpijQ`XT5*%1`!{~_Kw1#;0Fow_D#^;k(S@*h9&3}}N`kN4aI%h!y3}!JaT|tW4Jp-syzAC0q-TKy^ zq}K0~g{+$!PvCY!?^h`U*Y!=|pz&}3(vq*o@#%fEOqaV841@wOYJw-MPe1v+U?z|R z)8*OTWwz-j*j@PH+^lhC@?do!s3EEiJGu3MD#trs2Pu1a-M1D3S+5izlBO*Q*24>`d5cpMRYW_?klI3)`ZO`{}!Xsw=YRLuTy8 zcc11%$RfLd02=TH2Uu7@5CpMxXlV|dED$3zV#AOqr4*BSlh zrNAA(t~jVDvXKRAwAWr8>4E^c8AlS#MuxQ>DpWZj+~`u2RPYqUX+x?{UG)kIduDWb z&}TLB%gYHE5_Tt@>D%cqe&@${Azqz$N_xYx3)18?GFmo*08bipn<=BrxNTW8@B|VBMlsZ=6YId+Ts?qIs$9PlLK}~mai_$Sce0VBM z>}DV(CT4&!{=1zYKJGJ#?@ID7h$hWPpY>}tl-8veF&rm9%)gVg*E>ClVm%KY>}jew zkoo`A%@Cofr0}1lRpz&>A|Z%C3TbO2{fz$N38h^0i$*@K?riN$keqkg6jKziKV%>wyQr{hi!tZX)7no4`g38M3#WBNMWFRj$T^!><>IT%$ zZn73ZrCZd1vME!ZRL+7S6voNxPA3##k>eW`6;-BFyc@&WoPc;|xoZ_`93LNN6r3k2bdcW!->#Q0?dEwoS7HlC^BSu=_D+4nA!IcOYBOrh?bqBd zy@l_&n@t7o7R~<{Rd2kRy|S>f>j{s`+lQa-;7!iXZ8659S!u-2C;9mjJc^eYnjQ9M za&ci`5nY~jr9s!#(ZC99n-}ReyuRdJ-`Q~~%^P{^@TH#Q1TzX8mEV;Pi14MA#9YpWC{g2GK>}tA;-FK7HzafS&Gld$u2l4I#RW7a2+%Fd74)v9YOt zj?Q>AuU$|x<@u$zTQ-cvFrAhjXiBL;s|+|#R#g)@av%bETG|}~q}`$P`N1e9Viz!5 zoSYn$y%wl|EfeZ%1OYnxPQyeHutFYhH}NU|4U_WvN8>ykFa5H~7jWRA^g{Sv)yoV= zU^G9(!;6~nI?XCBCZ~&=*uxX^&y-Tt)fHqWK$oZE{LaMq0mQ~(7mVP50fFRL5;RIX z#69xI0rZWU*Um$TMt z!768G7fD2vjGKboAp;-)Gn4jf!*QWK_vQM=hChhzshj2WbaK)wrM0I{RAi_#s=$Wc zflz=j$K`B7)cGv-XB4($_sj+!yLLhmuO^nySG#WeON55)r%=~B`|u?JVQu<5Dl_1| z-}XBVE^4;ikoz7kzFgnk5C`@X5Yj+aTf`0k&p=58PSkwcj(z7Sq{F9_KE$O(!QlHc z*3CzXQdqZ>2ffuc?i+cx{vhmfe&Gkln7bM0J*c?#CB_!IB%(24*GMet6cxUC1d%ih zfFI2nwhzL$UVE>34T{qcn7$pxyt40|!G&TH0ha zAI?Va#AEq0UB+QJ7S(PGTBC)Ij($Y?vUMmZ0mK&r_JogLcYS-EpI_7oI8*55FM=v7 zlNbyfZ-_KYwEVvV9Lnw17l^LTu5M2Z(bVk&^r!T|%)K~THHLj|0w?oDI{!#ER`cbS z)D}U0s+dON$Be9Rxakyp5AsG(XFl;q-5Y!3B8w^_?EcUWzGCx&1{e4SOU=b+Vsvo} z*-+88wr?Co`c0mblUu+5J@mW+f%>ZkRLo)wd?(((krj!R;cN(-?YH9L6KHgFcY=aj z*5+>qGEon-;bE0ps}Z`+PCd#4*Hvq7@b+%EUS_?UAbd>`*Tc=jEh);zwmai6N8VNba*tzDpk*Nq%dPO56Ba7(IK=BsobNb$h z`3x8~1yz@SsJ~xtj=V|f|8wauw~No^5+hoJTyk#zIz>AvsW)BJZn|7CB)_J{O^;+B z95v;_u}^|-CG+Hf{n7~P+~t>)gaBMuRu=WHI*E8o$=LWfu-}dTgCi^Jga90QH!mMJ z)JAtGa$*tw$4>{!RS+VfovV{F?~MJAu*6ySB}}2q^=v$*J!B6r#-6A<$MESX)x1l$Ok@scxVUe_xqZbEHCb}Su7H&{0(M}|&(Ht6#ZMH#sZaT|**IdCX58k0 z#n*OoHb-gyP1T4&TgA{23MwXQ+UEiYfX8NfzM0bTmp9EbTg}-JXXGu4@hSZbSCX_L zB0<$a8+o;Yt<6_0N?#72)5XmMO+K6 z0F1oc?4BewFk(T$7v#i#S_XhRzZv}e958Epo8QWhtz%MA`K5M1PhI#@*S9y@hrgOK zFl%wmjQt^FBy)(o!TA2;hZLw)05U>8#Kb&t50$_pg(z!kq5ye^gidhZASo=&+j4Kc zHS>MP5HYs!X(*eL@9A8&Am=Lm{5wtStR z;S5VXmyyYCXz;2p6qkA;mp39_3R8094(pA0hl*unK_m0}HSMS+_v%0j??K*23{Jo` z@H%CVl%@s+>FJM)od0E;7~ZGllh&(uM#aR$1P^U3(yq8q&#>((SfW=KP+u&-%lh&KIV~*>0Q>+z4_3?zl&6z)cjtrLp~wKE0FWpsTm@7{ z7!)d_sE8$F^OwD#GNi!Q#;)_`4ZVP%pfN|1QN_gcS*KN%POllqy0d`P^XE@QL_{ne z(fu7EiIplU*5B(aU4Qp_Cb54bZ1Pjse{k=ECGJBi&zhi*@=cWFex2DHj{h6vrFEZl?xwD=o zC-2qiMHlfqm4Q;8Aj1^7;!oL(yMfeX(DHeDUG2AnVztSWM-=^Aq$FidXSPDet%2w5 zYodfji+@KJHXRTP909W3qCV84b;m`P|~JZZc*HQY~hoAYOt2o0rhXCrz( zTb<0BCgtqS*zP<$qW|dMcgFd6zXw2ADr#O7sHmv!D=h{g8ifum2?+@ysj1f9dslNk z=?1r)JSB7Q_U-lA-eZ!aj783t5PVWVwC7J#&gTk?d>JA^%ro=qpUwePR0shaee3?e zR3WXvL)(p+CQ>Q0z)2t=Y_sNB>K&$TW8kpRW2F~JW)-6$pf)z=iRC!VP!7(_E+^nA z^r$bC`8(J5?$fs2%@YI^F*&GHv~^{LWaL(H6Fo!_wuYL5Un50GD4q1Wh5D1eK*1<=2A_%_wK>vEUQ!}O?@JL?pob# zwT}GyhILRE*MkE2=&(;xXJo{Rq2x1Z3Tz~o5Xe_Hauf3$ab{x6$uBSIalS+Z^bKL> z>O_1Ba@LYZK6d75vt*Z`ihm*`fG`zfr9buvVLTv6O>^>fK>eA3{Wu}dXdA?NjnhGoQF7&sFaykfl6?capjWN z5gq+She4f$W-u9=UyHA2RT}Ezo>pk%VlS}$;^(K(oMWNi#RSKCHU|tHX6rI$)*S8G zc=Kht!^7SPj0$|QZ&s*1r3F0elV?zIAw*>B;_7;6V9J39J3KPR#U1r`Z{ufy%~X3; z(g17ofZQGsM%e46jAN+GJV?@R4 zp3^dM;$Z_)KKyW3@O;;4&_vsT-SL}~(YH^a9=ZQzh$lqM(2&y7a?sSk*5IA6qHv5B zhJrf=*8;ecyoHqz)PGj-_m0MI8v?FT4UeMIap`*yJw^Hw*YP$Jj@FGb#CM5PvQoP( zWUi!Uj=?>Jlf8U{RnMuQE&BEfr~7};o~@O*tUaWaP~?_>oyz%qWXn(5<2e$r)u&5o z>F6@@@(AhTPzP`3J+99~pG|YfM$ZM>@&rJ{+#nU^1KK`kYtqcNWB!j}9Kl7K={k_(|1AvFzXK6!# z+)V^eNeg1U3^Xe@7YR6@#2Xu0s#;+nlyeSmx$b94TpkMP5u2L|-~B1QPPO!y;H44Q zafbd z!tl?9Eb9&9$oghv)*758)%xPj*FOsQ^!`ecsn|PtttqjY`t<4ckBJKR-HSEA0mxJ> zI2hmZ3sCh~QhN2)u0E`?E;z0valk}kZ;aqm6rz2d-iN0jA3znwKJlQn4yh@4)`!qh zJ__%AFd|LG$ohz?oQO`65^P`N8to^VUo(|M+J^iv3!DfLh&B-dAb?JW*37x%;f9-ijrgnDvZmCPDeweUh2ZyCt|JrDoKw`oXOq+|w@8G4OW_W<_Rm@8S?r-a}Ha{zGfTGL3!=d+<_ zVx_zgh^ks#xrz1@`1R@)@a&BHzqmjkz=O^13p%PwblCVc^lV49;66Ix4@pZoTu4Si z-6ML%&;A_?$GUkjuXk@q6!MFkf+7;PkjU560ZR{r?Si^Yp3A%;l-d^w=rBLJUeRMs zTxh%6YhPiy3)0|1rfr&UvS-+ckZ-CpTdIjB1}%^Sai&BkSB|`u5<$UzR2?O*FWPHA z2fFtRud;i-MMt}WSTG=cAcCs@`e%oU2G_(UCZ_u%>CMY7DfFMcF&f-_-ecGJy-PH> z)P&yHd9C|;-`1_M`}x9a1)455`_GR^OHKP?sjfRjg`z;j!{KD})iwOArGs8jl)za} z?TLIgG6aAZLBRz+bbO6n3a~M&-wmZd)=sE7sK}6zj&L3kqgG5rf*G;ja1{r3)*SWr*A~`)+iU2A^O#ySR!RuqYDnS)~9XF4xZpvJI3g z&2SQ!4T3skqU&l-H1cpzurxAiYA9vH4?x=woRX7cG=ZN5t_P07MH)=f`xXJhmxg6MU5n~>8~hBQ&>aAaE>O?P&wtQzdGgH1mUHoQLybvKbW2wK zWswZ=obPH10Q(rUwFBOKzIZe3az+PfozFl3vF>M0=bYCUQKAb|b8uwPFCqj~xTi=g z)$7iENf^xAiLd%JJ}f*cz`#z-@AkY|M8GyxaSnzJ0-se@3E2g8m@?6+V(wCW8q7?c z^BE3&=3Orov0MuQ`{zDFtM=Jw24fMt^;85GM8 z+}#yIeEDm_4NctYj5th zN|Voxa_{R8aeZH>ZO@=K0@=u>@kw%5ui?Ai}jnx znr=MFL|xHnncm-&T&?lWQP%u0B9dBI^xmHKX*Ko8;2~QmX2A%QtZ~#TBKR}_!$UN- zj2}D_*7rS(BSb2$d3!_-Uio&Vrlk~HSa@dFZ*Qi7RLO6}ib1dOekkL26}?7$)dCE! zvt4Ox>r|Kx7YQaLqqz9d9DLkue_~L0L8ZI3RT;OHjqfe z3kz$1z%f%-zYhWCh}$`f)kvDvjGrcKwB5S;v48+Bz+!!}n?IbMoJj(xvJg{JNhy6$ zASyogBj5FF3kXNuS^=?F>d3-*A7|MoX0Y5K@=FrdIZN4YTBXy(S}LL$5sZGw_C^u8 z#Gnb@rCm67Zqspa)iO&!jT$|?R#dZJ$_x^a{E=(oUl+)!vWbA z{JePaLQG+RpIN_tdhHZ+-l)FXBlJB-+@7og9ZV>CzP>7S$j>4xlpCM#>{|kv0Iu|W z-L_8a%KVV|vzA-(=EL|>qLhIp;zS|!y#Zdc&rOmin zD-%_%p=BPS6=lk;-GZwQHXKx7e9ErpS2^q^my??ZXf)^=g_xKMELxw^Bk=OR0)NH+ zx>FnQKBuff81FWK*LwNaz^zV92r(#J-dZI{+6rG%*4IyBWh4 zk7Le#9gpU2(+4wiUt8>k#Hipkxb3wkwj4tNQlwRF&2Qjw^15Y;0bepMb@Rlt@iHQP zDP``Qz~Fr0C;+<90>2X7@B0ZY_ZT7YJ|dlK&xT%;!xt!9)^|Hbo-kPva2aosCc{je zrvdF3pMZ6LO4F{hnBc!`b>~Vqlkp<1&aSSE!YvYrI}NX@8g8aWAqdnjyNNp1VSua= zu+_khG&PsQHRB+L@5WqBZ{1DVkcEV|9v7=#5!k4}6=OBo5+;rL^a;{ouWEX1?@~B$ z_VBR!R1q*HrKHw}#>Y{Crx~_ykAa0XCMu){ypM2yfAJQVO&Gvvk^?)8h&sD5t&ENi za^D;~C?-y)@~>}=WS1I3>zvFl^acU5RsO`Iv~-M@>j|~+BlOj^`b10&B0v(AcyjhT zw5Gaj!n#bW1WE=tL}wn&Daksv>*w_Swl&$S-k9ctKc!~&vyGy<#lhnx7~>Zgb0dJM zcUsqEY-BWD%!GpF{oc;!h!}J`S<6sn0R6Y}d~1mByg&N%?N)u=-EPtAj*);(Q7>0I z0v6_0!&zUvs;aevTlg9F`TPyE%%n?hd!|8VNF+dkE-uq(!5i{UwLl7%A0sXi8BOZv z9Zph^d+TxF-W|_ObMK18g{k|=o!>jWV>yXSw)WGo^G8yjRzPsXoStR}djb3Xd4%QFRq&?S4PGX)!A7_d zr9By??)cy5PL^Jb$pWrkM>~>7t^ENS6;*poN?h=-Z*nbHjgS6|Ud9SEei(|SX?*cZ zqDZ#^*T?6E4TA*mRv%K71dmxhf9sJuNG~_tw1Nd-8lWK-Mi5u*`BDLQ=Q*GbBg;hH zFR-%~KZtz}&`#Wy6`7bsUcv~1c;`Q-vjXBT~^!8V-U%POY3PzqPF{dOnunN+4s zp(0o-p&~}&WcP}KTugdJjDhlnQpGXu&q|;33z~v{{BSlK9B>wW+c^aeM!@qUBO z>5G?IjSO>ZESwrCm|kb`9)39Q3`E}nd+|d`+={_!DW=T1Rm5=3#V2|5#@hvYk-;-( zcEC7aqJ*O;iJWL}&o-g+Pw*45VHk;tzT4g=+n#7ZR}wkUPM^9xy@k)-xG5>sT%pnf zc_bm*X9<3tX`TlvR6nqE5)$GGEG5`M=bO(MTDRzgmIqC5S|SGhcG1r_M{a|5KimG1 zQ_FpL2sM~U@JmL>wy67q2*MRpVCqZ4-Yw+~kI!znr2{;;Mvv@I>g!C26m4OG!j`og z@FyHA){LYjgg&D2%hRDxP6{eJ!S6*%!@qkldF;a*hG28hCHkL>KQRk$gy_cKyUk9q zcU7g3_)F)VS6HoyfG|dJNS8^7I%9A@xARLV_;<`Q7$lbHyUn4-_2C=Y)c~{Yw_0SQ z3d6Gdd@~E=-IrAjXIFhmV{s8k#`X}-kEAsJ^K&i8Z2I;;g<)!-Z^0&b3|7u|VfBX*r1-kg}EvhVi10sl_??xm4E~4YxJ~bK*{}Lv} z7%X2RaU99jyDSHVZSydB3XmFC5rLprUO|W-DUB*Wz8rVf;u{IZIIqTT_#@Bj6Q+N{ zH6Bu|iTy6wq*F!am9X?c9x7zCcx2p-oFiJUU@}+1$Uq;q&8rU|K5xM}%xkoVH4LM| zKGEb?#Vj>DtJzQ3Xb@eNX0_zu$!>V;o|@mHDKuaHldn9Z7bj=$%#{`@kr|>xit|HY z7@u^#1-W71J#hgbpp_)NRQ~ER^t?;SX#ie*tZx-OW-X=XNC!DBRpzZW{ImCm2e=FP z`HJYM)k*ZrHYG-+$O#Zq#vnN;LIeaA!#8%Pr9(XbfzqoY zY`E3@9_s4-?yA}rKxdt`uoF+=*{gXL5FVE>*!A{qbP@yzTu*ULZN>vmbDH^Va!Pk* zSkT*pc|<61T9A68DaBiwDS=;kaS_2LXc|3tv$FD&QWN{kms@9fR}9BlWP2y}gbUyKAhjmzqyRTOLw+@4s<&t&Ez|Joxnr_(E-7 zd+ui0Poi*Um~G3wnvjY1lv@dQFr5XR|kW z6duRu53r$Py1JZ<*pz@>#M|Cpsij_q@3gvH3p>&*-B@Kh#SB4cJep1UU3p*&h!6{d zc5oagjy02sU-6KVvw^EUA0mM?EOPQ4KG#NEpBo=w0<-zeN`PF5jSB3mO+svu{jjUK zZOuPRi!VQtJpW)>ZiY6j3sA?Wj8K%xX-#V=++sVv(9D@-&-4(G0+)Mj|cK+oxLX(j%S0H0- zXvm)Ub*|Tb5`8lU1X%Qd4TcP{p1EXj?l8>i>evw(|1xk!O(%dA6{V@HQ;$;a!1<6c zalY!u@XvJ7z@j>jFsRb8mMzhcX^+g_W4|_&B3(b;$*E)qqg#5Qgq+j8o}46O!A%TV z6QR1di@7?W?*ocM`2j^gSd{JAE7U{BwM?@W0cY3hCFL%0kY?8~)tXp-(@uK&k7Pj$ z(Y+*yXL2Ddw--may!0HN8Nm#eK&X<#OtN0@PtwT^0Y8AR{xVFp!16<9UJim^IU`6oWS$XVanIMpuks*^yfl8gGdoD>!w z{Tw!?_-Vj=ly?+(Ot?S7lv*Q$q?mQeh+Iw*0lE1)fp=Iyi9TK~YJFX+NV|a;*neE3 zhORBH8;ktFb&&y^uS9<!;QievT$7kL6?@f9Is$MK=naUF6U&LJ% zMQCuJ)|a|mFgtOjv66uWn0KrbN-(Td#sqmEv@bQNgoN%nRjg&YZ!q$aMT6uff%6C- zyGk7vMkeeitH6FuR*7O&-p5ylSUF*2m*i-m@f-M;@6#b~qdkDgy&w+I}z zkQz_5uB@q9{2m_>7Og{K-*6`CJ#};TeWj4yN`vm(+UlawhKOFBBM$LKMNAA2smVdq ziYv(d0SzE$49R@r1rH04!amR1f`B8Hun)m8;thaHK(c{r3k5MTD#)Wl2&8aKqB8Qx zlqygcFT|8l8sz?QZ)kQrvP~S((eVi2r(qFcpyDK-BB2rTB)mPUS5eOJF-#KDD6}Y3M zw>ZI>_IKD?TYJ`CZYrbf)J$@4z&YKIf{dIo66{r!lER7II#kR6ci)1}mi<)&W;5SV zqx)SFKYaRx0buXQ$O%5z>jwmc_(<~d*0avo&Xc!;vrRp(UaehG`Z>*5FJ~DQ6ods( z87Oz?E^>2@CVxj(pikkC`ph54sb5rXO8(NSyYlVjO2M#D?pw{5JLVn(sxJ|rD=2i4 zhOc5G*gZyE(!&3j3t)X}zISsK_}kwRWro>Zm=a21Grn?lvrU_Fa^X9!GpEl-bab(D zdMMI#^^_{BDLRK@e0+JY%I+3Q!hZde(J+k#zU?>oTcrLV#JmJyHvYyut^XqpjPn*W zCbA@?D9FbeevN@v+U(O(36I=@HQd9Zn9S2C?pWEfQZ>7>pry4{ozq3uJh$^2%%6M8 zR~t@KS5j%XQK2Mi-?Z!1{}@J1|N2C`)9i4Br3PbsbzsY7Ye>*HYI4DTX1L66&erE_ zMl&|2MBmQ!5eFk)V#CLi21Am#QdwcsD~qk_y_Z720PL`Qy)w5q--b_XJHsryi9hpv zXYzT%l;7L*9;So3dk_djnRL_4KRY8stS6d0e!zTW(QVe5MbzQ2wp}MQv7xjNMk6XJ z3L9Me`DWusk{YMwPxj~<{saO@&@sLXe;dVvlyAQm#gN3fmam6JC#1TQ~-t9bU5CZ_=O z={Z*06rZr>xtY86tE=Ysy`~QiO%&DQNxEKM)4VjrdM+K=sOj(DcDcNCrUz~K2wPL& zt#ZAYe)6>fi|kxQHatbIKY%oJeY7Bb#aZCd%u{ISRJH4K}tC=po0% znZ3_g>c_n*w|~N2;IKruNjCFb^t!A`%76L0Z^U`h4-P~2vv=teMb$Rcl|DVy?c%i~ z1^Nv&g*NU%@^o=lk2Q4sq?7R;i_T?DPm|Ho`WCjf8U@!xjSi<{fl+M2uWpwwYi24P zqOi!PHI4nLMdzp@Xq8kK*m;slD9)4ReJy{{sI#+|%gt76?@Y-s?X1UeTrnHWf5<^V z41Ig?twvu|=DExGuKrZz>wez%;Tr|sFF!jTIp&(&cE^YJlYhNxn5$7r)$qOu-&*Sp zJDqH>tEr}=|LWwdxw5AF@lE;1TK>iFgZ6Lx(V+vS&~W^P|1xO@g>A(;A$<#Fg|GTG zN(#$jN2_gus=aS*!u#$qS@v(g8TT>mw(89=o~-i9i>;yWo7>*I)S1}aoaUEC!OpYT zn-#Vk6DS(>4aFeVuqC~@#2TvJ3BNS&5Rg^X(yF~Y-qbYqn`!9L5Zv9`>7Yel+1k3R zfOC@4up5_{Sc63|U07CDjrQQ$g*CYMbQqL&h&nuCS*g~%{s~YL!@Hczb(~*1Oc!yX_VC zCsq`a!A?fGD&HoxT;&e5spQ-(@N_|;?{tH%>Vh6c4JLUBxnT9i$Y5e$PmeB(on=KeP)H z__|n5`kTS5^bEV8!s*YJnBad-uD#9JMrrun9tGdVKqLEe(YnuI|K|eIk==TCUkC&P zdJpB#1)I?S!Y>J>D&|$x3+9o(C>hXFmbrhQ_tgl2%?!D8;72ERwWK^~y&y)$&x0fE zSlYALh7K?gF>;OUzatXUZ>47ZGq%?K#u@U~s*maEr7niWV+C>aV|hx3E_<^bGf)1! z#yhJFX(X(afiIwlQN8c!5oe)7iajO~o3eRDU3c49(2OmN8Y=(GKM;jR7Ar6C&ja3B zePM+{--Up0MhDzWN$_jj{<_lE)|L$4K6)Ruqn&#i8{4eu2pT}W#RCns>+|R`pRyl# zk@L9&@~bQ!JzQ3WTwpw3_-=#@O8OL(W9GVI`md~>FO7uiI1RqA1YciAI)5!~08A3J(J(r<$vmKWKqgY|!M{ z-_ao%>wK{Iyx5>ZE``T-s4tElpI}@Xkn?i8t6X<1i?thcK*1}J&L-e<`Ejx;;={jEu*c*19#c8;f1&Xy{hdN`vi}gW+-X$DmK^+r4H= zm&Hz0pPK>Cov9YhCr>ivlti<~tTf)P{Ukp;I2n%Ooo0{)&mg&N)hgC+&|yigQNB7Q z|LXPWZk36|^vNmXVHzGwkGr|pl6BI}M*I6;)?hU$h_bj#0?9d2<-IdGmVC2_PRr;A zN@8dEwVc-fFt2F7v5mtbdl5sEo0n&G(bLcM_E$%2PDd#AMtFZ?W+$Ui)1s+EP-+O;3ySwX>^E+yZ z!fW$J;T`SmdeHaxk&)^qzxVaI+HhKpzqFkAmJ7PIG66yGMIpuV`^SRA{rwLuEiL9k zXGPVv3e3YLd3kws!pEAjzv^AAoDY{}qsXrWqsSaW$*>wucjgLz{D@4Z6uWzolaPiU zncS*Z@eU7-@L@Tv<#x9sva0UxwKRR;uz<#h!;>ynC6nVD&IwZ*uBWuHEzp=QQ7bV? z<;El+Pjg{_sm>$V&l zbpY@M7Hwr?qkw?L7W8FI1WBabQB8)3$XItw;!5ucRpI?B(NVtDeV&Eb9Mhg(pec2M z!V%6+4OX9Ljm}a!wHmhJ~{tR9f)-(=XJ|yR*umX*(*l9?-q}I zYeZ9}G4BpqM4MIV=;Mt}^EiL9Z93tRRn3-$A08dWb(stw`K4z9(PYh&LepniRX@q# zS!C7|y;Cm?*YJT)B%(cdFlx6)UYy%6G8&6L2O~5ru@|=dCBQ7tdlpu#GCfo8q6sTu zzdYy>zFZ0t?X~74t1=Rxbf<)tOiRW;gkF`S;;X3`lZ0Q7o=`Hh;23i<0A!hG4d zhtH*}6KTkWoLj4A%8U;-r`8BAE-x7w7=Cky|CGeOd9EZRa%U6wS`KJhSg1u23u|EC zTs-5Bo&sB-;!RVI;9lcP&_Maygtg^db08dkEq}5nnz4xdoxvV|fRF6q!`{e0N)1sB z2Bx!mWoJi!fiH|5GqSs*F9!#V9RkP#?qO(uu81g*u>M>ax#RQwxp=prGXLiS5+dV| z_~+`s`%AOjHW{tvV|B---&WVYwwf15eY(5PD7)YJk?Ag0raa(`YnqvP-JFy{zdk=A zu#E~nz?m1J09nb}Gim778fgOcno%j$AN`E*Jg&~i&8_dgz8NMSxHL^J5q$67y-K4t zlbT2TM3e}-ud-#-f96uEEq!5mg#RlN``O*^)_~(VY*l(wI(7NR`+luv6dGB=v^5f! zt&VQ_-RELaIbSGTb>||Xkh8BUfRt0#KQdBSZE`2_-;scB@sU%P=HQEjb6Iz*{l9Ip z{9_^2u1ZKq9FNswCJS%TBB7upp6`L?tHZp8euew{)w@`D@BBR)1R=5lzSp&@KYd=^ z2{cMd%9AZn@bIRe`ta;5kp?u%&Goz4N}p_|)&`1{gwN;$h1WJ}k~|&ka(UTivf8H5 z6<(&6?)$BM>=blCE##d|HMDHG_1$rC*&%TnJA8l1WP1Sg=5SW9PUX6OmDNpIWHgQu}Mgtz>o9eo-1}ubCaq z357GtdR~Y3;N#+Etqvq_wFe*3PPXhdJJg@e&LwD_g3OMslMAP@0<|?&)35n0RP;)p zM?s%dT5jZH6`2LPu^s^!Ke09ZIB@AEir9)W%}&#c_9ANX8O(62Q2Oh(>`TDB}D5q*P# z9U!hs9cWxgm#DjC@rXAvTBejbi_X^H-NGHrVBO zu?`b8wIol9!ktMpOY$n==IU%?KSnZ{dn-M+q*UH7w$fn<8AxckI7+Xqc5Hi_?mIzB zG<-BTP&Df5HY2PG3KBGS50C0cLcbDFDyL4NlWA(K1D0E+lIV?Ag#p7g66@Fb%Zr=K zCv3Ne+uFXqzTw!uubD6Q5rKlr11C*R-!KUd>d2o=wydr9Jym*DcbojrQ&fC?n>9+c zbDMo^RlfV*-05#-f(Ygdf+~wyiKkDm#%lIhcCkiwh$vsNh-C1ASAO5%evk#amS?GC z`xfrbc#V2q0ZQCZ0?XV+lUrhKg7D$GVWrm@tL!iRmO5Q(>1h>XLA$0ZWfhg-&5^uP z4vwD*T5hksl!OkFIj27==yUK)I+=^Gp@mGfcNzs$Tmi5LMs zyfcf}g`v~3vjDBEfq{YCOF$7IP%;$DZ`j(WM)tV!BJMP_O28dRmVC67y zP#wZj1)piwB|ht)>d}>nCeu(?|Co|pBuGTbE+R2D7Je@jxCNk*FFx6{7FYuL@T54q z`hr{`VPTi;-|WF5Jn=MlAq-HN)pcx{bEVGxAV8zkpa7J{S2MYYuTg$AI`{20<lDD^kC9I{Ml=x+{DFQ^_HPpN zNBDnu`wyt7wxw+pZbU>u!Gvs)paKew(t_kBib#@7lLT5MNe+@zgQzG7NKO(I5NMK; zGbn-t$vFo>GDwCd-D=M{?|;Ale&desrgsnb7!G@_HRqbMX4O+q)v6-lK68g1jLnEa z@2S75;|50q3U|4!*3mk!?}Z-jPB!NaEy15qibS!yaV_&q{Nj|Csy>*tBu21`VVOJ& z?n~M*Xry|H?oJtkdQjxjD~~AGlR6NAB+*#mU7MVxyWHFx<$FJ7Tlhy+p*;}Im}k!~ z;-ldic^Rjx%X{D(=W+AChj>8*yMVi1rm8HPWe0tRslWIA$p_M3D1|H&&jCxuQU zbh4fC)tB|3jO4cor+tvL=^8uSN;%x^v^@CXOAQTw<$cM|bof#$raKU;`w}+tgEwcH zgEh_f)(GW!$oYjwS`!;vs~KB;moU74b=m8LSb`XL+yPCm(8JNuQE&jjiCNp)(nyuLZa_g!4MM!mvdClF1lt{$Jy@QKTcd>=)96~h8Z@>{&_Y{0FR6p12ifX_DU6Z(TiH5j~i2pZ%;Qxs`VPhp(%g=@Vp#N zKT}~csnE`Rglo-OR<(87(sON2b#v)LT76*L)1G;noTV$fNYlsPsmh1O=Yyct7sWr&j!sGSP! zX8({#J#cCd-|*G6QRB z#93LbLb~Q|brdxkg;oz>MMbMZS#bH)`z?oSTbxK+dez|NFJ-n96?v`35tj|Mmo$xs zm^1vQZ1@&_Gge-_crj&bDY^S@QShRZdup(>l$^U5*sQ!E%I*@`*L1t&>5_Xv^JBPo z6_uV%dI0Ec3XQja+&w zRUTaBcTs)02H!`AAB8&bG3$ZzdriTsGA>Cr>;~A!rqRm)7JFOSgNb>X zEwQ}0>eUdfP_?$s`6zUMVPh@~f)6R}?;gpG6d{+Q3ay-+ihz%hw;U=}>&x6it+-s& zJCo70ck1Lxb%!6VgBweI#2cKfn0q*dJ0m>8i@_gN|2gL{zq4wXGbt6KB!>O%CUVvK z^Y!b4QLdxeY%>|ww{Cig>Ko{*=)8~UNp@HAEP7JPcas>35HGa2qCM|Kj1BF-TsI%$ z`&O8B#{h>n)*B zH?2ou)qPb5V&>ofpuy=@TNVNxUp2Y@aO3S#@)et>8k4JUKL&7#Rtqye>UAx4z_?o` z7if7M?rOcw=JqtfL?f?x}Llqh}Df`Jp< zN7j{oJQU;yo1wBaP%dwhukB@$KUfsl4(-7lZX6U4wd;RHvAQr;M9upC{UXJlu$Qm` zm7m(F?Vz6Mj%|ydvwJ;wV~f;JjGWHZO~e%mIk#k7s9ne_r~ zh5e@EQd$wn+tykRM{y7J-n7%nq9n$dV! zb6`t;i0|rE<^OrK2t#nWII^a*-x{oOyLQU9zu80V!1{7JNUT}ka=hGV0#Osf`B7Q_ z{qmHGEAj289hT{nef`u5oL3kN&Gn*dFN$H~4t|!|{M@l`E1#Yg_VMwd6ShrvS{}^N zD|bfTxufiRf(oOo{Fzg)Ox@%bF`&kt%jUoCW~*5ZD5#}YJ0_Q$T@pf2g(nx3<5s~1 zJ2AeoDoL@@-+bFMjEJqoRwFL|g){%{;ivy4oLONpSTpy_&zu>Qo%h14zu+#dUZQbs z>p!^wWI=y|D*yi8?hTHIlf}^#Fk9VX!vBqg6ym=tWcRc~6_q zJ;9^mCk0orlQWUxq`8jsDOVmBuY6MNp=~b!k@3bZHO7R5ygio&_HqawzPE3XOyG9q zw|7n#FAc)(OElgT>om5Aw9sZAQ{FUpP5k!Uy@ZP!A#TMXf?Ew&BdeZ5DY`ZQM0aG| zr5p}CMm{ert)K9o%1_wCV`}0Tv$S;%1*h&ik(<)JU1`Q5j&h1|3W}LMo46mSBkK7+ zrLC%Sa-zE-6~Z3V({s!=)J(2!godFm>CuE6WHGVq4c)poRuD0jzS9fFkt1edwc1yy zU7LP1w~hEA&OBUeq>cz(-NZDb9_1IT&I(J7-BGX90on1qfB!|*A;ID$q)SB-Ng`5m zs_qbGY4h9AGyP=hr%#ckUfatfKs7`{xEYn!l>r6KMb>}boriEncAfGCi@uy5=wOi+ zK#Rgd@m0bPvBM7<**cia>?nOV*?>#8I}Z=`ID|P7bdiG%*rG&TBuXjq+mZh?*Qovt zGQw#3RkdfkuH+4i7j7}3@)xPrXiJn7)}lCI=(5(#_gEF0ivr4~0#GB(rEmYSFPHS)_a*h=WVfK(ap z|7_qZERwt8ARl&9srOf~SPqmoXqvE{4M0`3Llr_igfjH|1myC~dyth|gBCiUANzc( zt=*iC!p>ul2vNTw^JKaxOC$4lTVifJ+F9;=BW=65Ui1F+!`83JCF#Rs&Ka_Y*CV{B zrYrpClWItc?X+%%cCn{*vCEs|IadZ#D{B3W(Vk_t@mI7d@{HLVG&HPr-b{-on2^QA zW|$?PETjlhQ9H7A-RIUsY04>IQRVK{bSvk$aJ+mZ2YS3{XKMi4g$LegZf*|98fYEZ z`T86)pllQP_a^f~JnraFC*LFx_A;&X*$fgwuU3Nv9mM?<^&~unjd$B${SgrnkqY44 z0(uib2!u&~Lwg@D*Ren}rMGT91Tz}SsRt4;I_x;ttmn zDX6J66Gc74-@Qw69`n?MhHSmWIY6C|-JP8VlYD4wq?oChtKsD2^l~o^nsHtpf(}8O zKkv4sLvy3h6fVR1r$3{)LMbj}u&aHVg+4_P(Wun-Se1gVJc^!sTRq(wYP?YN9`Hy@ zq8PT)eH+M#WENTeF^^|&I3BuhEp~*ntA)qJWQZNE2FF4{qphW(o7B|7$Rklix_blG zJF|xc$KD*_Y#kmcSzt3(rL+3+@MDe7LcLjjqggS>(M+Oo^Uv<-k#b`}2brR`r=9&Y z%=n}exYs+wW1>Eh#=OMLBgU>c7{Z2}p2v%iU7=a*(@kL1*S#iDxbI=78CV1&o7S79 zoea@>`Gvk*&0xltZRM|Cy+ZQwXc+$9B*l244Cpviwp289 zkp>g}Q+RJNKlYBna|nrPSPhq`bfqcvku!NDEiPKVeDUHb)cu79K>lyubVS~M#N+bk zvDIjWHWwEc#hEibQ;lI9!_^i2;Ie*-j*eCh9)T!7&y(*bJ^y?qcRM=R-VDa=OG49w zoV@(}h=hb3o9Y7%X!6rVl%EI=P4nrdh}2QOJ!l4H0XtX*SMoS7>rT(is0|}dzuhNG z*HT!I;$Tu^Us?{#vp<<6KtW&fiT+Z6a7ASVoNP|d?Ra~qWpxRYPvy0Ej9~BSX|1~( zUAru@s@^tgg;dL*oD>KdZ+34CFp%joe097)OPdB>$QSMijQy&B~-jl2_ogHT*Iz2 z@pOEa(N2r~(CLds;k|%L*Cz!v*s9R5utJdEz9KKLmx)js`NQh3AI(PGvZ2I&KH0jZ zs=nmZz3>I0!}f@?ylUz;DtN>i<+z(5;?9FR^Z+-`43-1J-F>=4O3`;D-~sIsaNpUrGaP9 zjBm?Pc*qpEMomK`1L@mluZff^w5 z&_t`dKJdyWglZxBQ1*L;Et5@|E}-r@WZFS^NeMcHb(PrtA|CXe9Tx~DvEIDNarNpr z{=gpvG9FDlvfz%eadD~Oj`qg%R&u%bqF9B6bX!NXk}}WK zbYXbDN6vjsmI3$svhmFuW#}xSg|u~99oN|v9lOV6Tc#eY@)AMzR@(T{;lyIF8 zvS5{kfJMQjTUtq@mF`g`7g9S4^!(dF)`)Bs?UG$V^p=Y%o@cVd5Uayt3ljh z>0mMdb@9p-u*8HWM|wPLSVAY5j-F~94or(JEx9szNVWQzT}q_tm0fu$d?;zs#2Q2~ zTIZMFJ6+YDU~um-5x#TMT|Z$hm=W_k&p3}>aB|tU>7tN%IED4f$3kg+duKM|vae$I zM6Am+ul?>_+vF}s(|40-xaagTdS!G!5{cU>RQ1?nU)x;EwJ(Q_2N=`~{t2A(edJ2p zcDtq`bUFf1Kto4|H*Suc1HIif-;+7Qpb`J8mHzpD>cn+ihR77Eq_eOI>y3X*MWr5F zYaZd3mX;S57O}bdBQG_r9G&8JjhP>_5LA(JRqd{$g;&(K=QfdQRIcukUUl@FiMdhL zUR`!&L=-9p{|olsBHMX|2SD?ZO!KI>l~Kek9ST1{7L@+&2LT)qLFpqb=C?WQt{Fpy z_fvo=%T%YHwl`pN&aBbu&go2}#4)zym?K_dAKS@QUYcYlDqur(SF7rkUDBtkwK`LRf#@SjQo+WzzUbdw> z9VeoMR=nL8q}EK+wa-7_yU3r1w$eREf=D{wfE@;4EUqW+Lz-$oXj!(?!r$a_`?0TOM1fy8&sSY3z%vo;eGozo55x zrNQ7OVMVvy?ag;#+IG;jiU!f1^sf3JYT{Tv$D~PrH#DnlZ7s>+ew}gldu}e^WKbTY z*Pm1JSqyorguK|ZSJPEYeoMHq`Bu!Max@*n7QIGm$c!_)+JGIuaZ!NoDlFu}T$dbf zU16FD4GXC(`6#G5mGn2?{19QAV#}hn=N)148|U0iYAEkQpK;X()deoqU(3q@l!)OM z`>9^na2aXvER%#~DnwrtGfIiJH@j=qtV@P!J|wHckf;QN-jzydxF?j?N+=xchlCT{ z8mGjO`+}RB-!@a>(+enIuJgti@&r|ljEu5h(Vjb}vP^*D#ukhHUjR9%0EUPFwE+Lp zXMVZ|qq11ou~oQ8`ZT=(JAZR6%I#C^Zgb(!D*`w9h2e$H`t{&1psLb;2Fo4&I`(VG z)x5My@c=u(zz6Fy-z3TwfADGFs?|%aWP}Ey<^^V5pUyY)S@vI5YFpS#^8%d%YP6!r zdIS$fnU#fQwnr0NnZwmx1YS!S`gqb;I8aA0vJV}|BexBd1S zAoOxOV3j6Iruqjy$qD(8qxo!rJKkfC6?SOB(sQ1JF!9s0%u-}#Sy`Ee7U?Q)a(QTT zaX<~!dI(E4wpw4rZQ~uw%m0G6?^qz|-x<_i6ma@H0M&16eHJI;@_$=B*-k*Xn>D1= zL~NjuiGe?(qpWGxNH61**-awoH28M>V1gRgK3w|D@y~d!rbUA1mbL<5C$#f&wslQrBQu-t&KN9n%!Is1B3@NU6s@#BGC?2%|7vTl^nVE! z8@JUU&lyHxE#efIgM~kWphgUcz73Rpu)qa2B}iobEj=^|p(3-kXM2_$lz1eOEYuPn z9MuRqN(fqHcEQ^_^yxX9)%nxJf_=2myLaz-Bnq1Y=*e?;I*KS1EM`sN>~4!+e(*p8 z)XkMKY$EQkl!YBYA{ZLr`g#Fy!GbQz)!EL(JDY>YI{3xVFElii2f(939G?O}8aYKp zC)TT>@FjwPdsXd3`_AewV{V$mgi(O$I;HlhC#V^-AbWBSjBaF#+zR#_$p0xgB9?p> z<26390(MVIe|#)~!v?VUQAS1vBwL1c&1I=4B9Ku2XbN?Pc)0y7$Ex(!L7xs-Y5+o> z{Pl}9B3`qmq{KIw(OxS%k6r}dEq3r`3X#{3GH(pVVKkQQXausBsmN)#it!yzkhlym z_zJ&uID|`bS90?^sp)uRAS)U3;K3^ZTWLN}r8{&Pa*!$ywub!u{X0SCGqm$fWJ3WX zS{zc9kLb@8Lq`TEo8O&_6%#q!`K43lkdc5pbk+2L54$zY&GD*gYK1mqqJ3VF#+lOx z-CNaERU!0eA08c@ZczIQV|LU8l|e!&W;oeZd%v(PcStk!0P0Hr{{6eqU00+s)4S>< z0XQ`o|2j3-A>||WH}`ZQwc*DamA3w8_6}yvml$wcU{Rh6nM{AEUYOmr67JLK!)$SM zHw`RO`$yxj!v9bh+SI@Y+wwD8vh4nxjxrEHGPr zCfxoPNSTSerL8(we8+9$DbdLVInUF&1-Y0u7wPG5W&Al83sqo=DN^8+_rM0rTh$tI z6FqC_R_i}GIjO6ujx5JHMmXMrZvnz1FajJNK>Q3ATHJ(;ROsK!4s-E3Iyfaf1bz7%E2AFN4w7jBb(ofwo0DU?i@|==3ywozLwQ4i6TvCD|VrPA* zTDZ?`bmT+Qt(I3B9yH&F@wVmMr~g+0q`e4^0N#bg*XLyOU`^hjCHy(8uD3y^-P7jC z+fXuAZLG?((4>W~FPR(sSWN)sZkzL|K*P+#R^49rd`rhG2VSQ2o1ur9c{uH`w~=XC zhCm>kKEt5n@-xwGp8WvoQuW0?2k=Y2zO;agmk6{s>XKN3APG;*#-p8YS_7@d+;QvWHA zhkG73wWLi*qOmqf+Tm6+XFEGP)tHAZn_5@=w&jWPwW()!YTrmlZ`|Rmq=7QH`WMwlt4u>mA zl8WFIlr>;adp|!h{8~`p^v{H_WM4fyuw`((UQhsTm` zT@*OoNndK#lh+kiHs{us51UU#7rG082FP4@P<|h1z7iFZnGexyn+d2OOnd>0Aedhsq zU5DYmYbz&p9}!T_em-v2jltC5vX-DvBg91{4xcah?2~!l_o=-D>?@Vh``P6??cyGv zXAA`2KRnc+onk_Nsvso~$1O&eOOkjanZfbC|93xX^meRSNk7M<(+biOO^WPv`JK`* z&07Zw&Q2~GfgW)s==UesO@C0ud#;Gk7@3qsy7F7$ulxws6t~Q}!c6MjMD*bw98P*o zp=|k=$J2koiwNDdNq8THDo0=BxwA_qIB4(jVU2QUqpqC$uoY*PUS>sjcxI%#t1DPM1=dKb{?8H#34Pm22S6C{ zdhNSdjg(2JCD7gyd5t%^Te5{PK;1V z`cYwEaW+9Aa{zjSBzRWBEw4fV8{lh0*Y_Lw16dCO>C6D&5~Zo}i*nr{U0$LGB4Z zVqs^OO@0sF^JEOFUYWJV39`b8Enq7f{>MaH$%#$i}-*N{O71hHPwV%E7{Nzuaj__36`e5LF@% zEZYh7!D%jBNN#U$ms?uN>GyvK$c4zEwZ@|%6F0ad=YB-5sPY&n9?omHQZMt^YWRYl zjhkB)xMs*>6+_9!3OVA5J^{2|g(>toj^0`j=8z?#bSNdh0nOr@A$9X79}x}&UcUPP z2!2(_DTF{VeAM|BR_}3Whfsq-A#$nuXb7|ttB2F$*yUhXJ^h6Jf%Imupzvu9%ZOv2 zp3aviFTrE}^_L0x|At%Ct0R#mez?FQNKX~WB&HA8DAb`%Wcw-bsdU0FpCP=G3fuK4 z6j@n~e!`LGx#tAA@=Ac80PXn)2c!6%lB%xaB=qhdJ~^E#@;fFxJO%cYgO?ZM>gozf z8lg?1ZE~GZo;(BSQuv1D_jFN6Xy`}hQCI21!$UxPABiRUW#4Bmkb;&nBx@sLaeyB_rm69gW7O-q4)3U zfs`a7Ud-Sa!xx&>wKe3XOGKaOV~B=6>qdw4=D064622z={$kuX-Zb?a zS|bXD)i<~TsVi{sLe-z-aJTlhx`V|I(}}Unoj((VHr!$Uwt5V1{}&T+NnTMg;ECZR&0Q8n*{TZYaJ_haT=q!22p#!*$E;MAHbCLomLzl8Nv~-^%lqMcW%0 ztIr10!p2+l^DV;Hny2l}HcRYGew-9qs(-68vg*0H8!O!sbYA`Rfa8R>Eca=Xl&W@R zl@AKrW4ZHzSEzS%T+ZMzD*wp^m}za=sXhw3jl}m1W#jQgGPdw($907S;nJQ3Q&ZDt z9O^ECF$~WSCq*`B$C9ddP8`$~d-PyE48STudkJ+=%EXT$7l4@VFdaT%XR|GgN3<(z zXJqTz(O;TWt*p{MdjG(&^r69)O#ZLq43E^q%Z72)O~2bT2T;}NMW2;hr;O_8?PW5l zmiCh+d{1O3C5p!Kn1#}I9XpBHpw&9_?*S(O6?76~Q1Hb77=)EdU;3+6k2z?bbY!2&g zVtUnw-bFS9g6Tu`)&6#@_js*$?QzT%zNbHaFvT&D{=pmXCgMxhYW5OH5zk2v$iBWl zJa(M+1ihCARzK&P^C%26ej#98RNYap6h=qrKfp=cNv=kG^(FC3?6DrpX_{_s2_o6~ z-mBM)(NHsTI*ss->cF1;32*l2am|GE84RW=k-Kj3A8)0W0Ur6n&G(6C5MQ4kK35jU zkvu0Qr4qyIR_gSWmYV!Pc;M6ReJMEjq8UgL9KpB@6dm^L#@DV(>MLb05YD zB=HO8RoB4J9&E$gMnAC|mBvr#Y9Kz-6DaRpJ|O$d={G>~Tu(v52j7=#(<5|FuN=8K z89>wfCE1*k60_6$2pK0<-8g+)TQl?tumJN?v}SuhV+J?Z+d^4Dtc7&lvx|gxQ*?WJ zMt46=JZn^m5#srEkM({^X4WSy%A%@Fh17sp-O*4-)(rV?XBh_PjvZ9&I!;IKUzfEX zWOh{ljUkvEJOjBf!?b?$-$drJYiJosuXy}IAgYt9YiMUt2#-K!0gv>mj~^9gaz5#~ zruvKRJ+#QFP#wa$N@Yap^)9YOW^u@7(CVdRD~V-?Q=*2;Zy7IY(Nt_+nyz{Bz^O{T zxfu7MFG@GpHEyikARcAzi6f65BqA@*3TbwU__R z^tm!Jx_VQOxOIY-239&uh;b&E*m>f_?EL+M|KW>k`rWer^hzdYnT!mx_(kROm8!YLf*I4$6j z@?^S+FOk+fIN;flq@=GLZb#yrwss4rO=DT8I$^0;=UESiLSCt_bs!(3sm|j5@TZrb z=Qq0R^vg$WoV-u1R+Z#}<~#o-Lzw|y?N{V;H9hXf_O9$`PZ!pa({Bx2D%^}fvSIsv zZ;~JmC2&5d4lH7aj+BZiJvUvsaVD|Y^`O;xB()@j*;pXn|B9e0@1r6fqEsxO3yDbm z43I2V0+u;~M*{mO0xDa-a0nM4&Ejff0N86!D`r52n^sCToo zMoQsYr7X7nT=RJj;XzOf&amFIvZPQ#cK>IimQf!0h(cBc z&ZrbSQf%jBMR2U=+uBQ?YPsv@egt;)jN2c*4F@%3G!wvU+Ql)b9Y6N_CpvST=jsyA z!0GatBNBvG0@1Q|9w*4xBvrR#5e0!0_DfZGwJVldf=V$Wer|V_l>1kwqma>pU5o#` z>$d*+PY=VGW@4^u_afUnho@Oq@;<lsSy)*vjI`gfEkj@dyKzj12t1-t^fi%%1e7HmA)yp>p1NZsG8T9XrqN=9Fe-LNaz$i6$V7+U8c-P9$J1=$S zkm-7yeEKFZH9%cY(*$O5(shG2X&NpYH>{aZ;N>;BiMaJ4=Y#)HHi>vrQZ?c>7@cEG z?&(qCM@@pR;ue-eh2IuW{_DvLU|wtLy=y7y@OX7u34{)7t|jZtmt)><;CTzgVc|!4 zq-HiZ`q*Rkp=QlE1`@@vZM&f-6M+ zeT78NU?IHit&Go4dS=eWg#KJi#~npbLAi4pM-PX1sJEEwkrdPeT|ianMCPn=HIgv#NI8%+d$29Y4H z`5hiBU;qfCds;x)sNeG629h@^Q! z2R7@^X}I|z+^nAOnh(>J=g1f|cRG$ZDF|lwF5s3sppnlOYmo}8X?+Wj(Wu0d|CZCVqsy_6~8@AAApw zxx9tvo(^K!qmLWPH-5+ z8(@R!x98OM>($#PfCpXbq&6qw` z+O>F6;C25wNet5^GpEz^_ob{d{?4>JVlDQ{>@2ERS*3PPUp#5zBo%eP;gg?1-Zu)E z_!R~3enLK!r_tuoG~83_{2VkB$3Us@+V(Sw#JgJHiD3&|mZIwrQq~rYzhfA4Jz&O6 z_efT#;KBi`vXsC;l(%^8IoPak-{5&-uNg#jGk*PO(kNBbvCmY;UX$fst5y&G84%tz zgC*EC#|w~Rm%fP0J`@U*Q z9nuzzstS591%19S{b#u^oilJcE;H{kq~O0iqB*$ZAC4~HC6CGtTV2rex8}cxTV79J zYtoo)c2wHC$rgLDl^ux~=ii8`X`kDQqbV$|-tXS`ZSHN-+H#h<8Qksa$*4J+GfjAY z_(X^}M9B$1a;P_FB7M?qsa5omU>8=yVeh)x#PN*TtF?iiG%b-|Y@c^>6kAwUoAR

R? zQ_-@{?@H)f78gjA=U0bM{2_GRJrTRgJx`fBee}-Usld}PZZtgPD3xFmI5vX)WU-Jl zJxUpHiKx%~DmzIx%bj8vu1y(<+9$qWnl!eIzOke;7a!Og*`T!Cv%Z*Z zSJR=V=l;D%S1Z(R<}<%|OU19B8U3|3rDa7%zIvl2Y*B~ZaL&qKfgzh{rav*PZzwDW zRJn34-n^EV{O=RIpZ04kM{OhNL+5Yj)Ku)wZ&@eKsK{Y_Nx=mk>+yiWf?u>ySN`vb zM}bytA|Ih-@GC&9kuL(5YM7S0ge2f zcgg&`KyVM`WRTzkLA4tkRoH@pKW^+RYWd8(Rzo+rFX`u6KX}2pxR+ud8gvI8GA$+a zOML~;k3NBTahed|{C#B^W#^fkBGo59B+7+W?V3gDOA{ZRmhMt>k}@oCU2EuPNG!h9 zc@*h>KkzNDl1xP0&!BGZ9G%Mx*wAw^A11V;o<5#GMX+27LuRtyLC3HPT7}s6gT4bZ z>w7qP+0-1*yZUVhihjhh?d z*_U?e76q)-N@eTUa7b>u^!kk*KMG{;f|$jTu@kac_D$o5s|atV4(uT3uN*YZKz3$0 zT3$!24Q_%Jry#C4SOd0??#}tlT5@}oDD`i4(#>o;IyxKS19laLKZGx%f3v6l`X_Kn zOqPS9x(oGaj0YWI%p&c`g+7LOK~IohNO{YU`QlelXc6xAZI8}H0Wd(TC;x5qFGhww zaXK#l`ZC``vnVV}vU&2`)MEL~X%p$Ss@p5g4SV-0^EffVqQP^1w{6&pzkifY+flLn zXYVW#JER&vp%zg$iwX?G^UKMvyqj&F5%u7}gqPcw`TRcw|=T*2kI}1-JH|(~e3P-cj6Nx(bV*H&o&$ z{C6bRqS>c^?Lobt{FNK>#v8Qz|A9sJJ-x^*Npegs*2XE^yKA+#n!U^h$G(j*>k2mc zv6{P9$Q^m0$F=lee&0*Ue5lo!utG3xQKYe*WbOn33eyWej`(wvAm1f4;uQ9guo1>r zb;FAAby46@3TH-CJ|!gzS!t&w4H$%?yweX#y8xr*%8bQ zx_Bd2^{*~Yi8pcj=zX54L*mtGB3_yOP)(mSGGLmyw-I$QqO5BKOCf1l@&!eZ&nH^- zNifp`*RQjkESK6^$_&C)>OPSC@^<<{>L7!OG{ryl^_r;_ZQWuP6>i&%88&>1n)(A2 z`Gzr^oWdAI_ZL9;T%BsideQdeCJH?)c?kCw>@#M3>R*&0@jdJWDE=4tNi2RgK)UT& zP|^zd)(}_(RzcOTLT`Ul-ZDqMTZI{jZ4X4z48>Y*6O^ z(yGm&;U;R??q9stH32$UZl$rADkCRkb^c{4DL>Y~T0w(tJ8I+9g^T5B)wgzs7X^C7 zaUn!Q#?UwZ=Q;3XQm^_CrY%i2_e7k$MXD)KVI6n%O;#!8#*rLp(nNV1ux3785G*+k|ga-G}F5EPe?zxfgyQ?eb zQ1p$V12CueI~utI*6SSd3^rA*BUlZQTbSt>hQ>)?a)>$&^#&4w>X^KqI-O3O_h=iT zSQ(b6e|1@P?g=oZQF!6Y98AhC-^AlPmu}E#T6NvDVB|wbC>ejJzC%2_70Pp{bMa`I z(z~glQYJr6aRNO<@`}VS>P2d548vDbRR|&PpYxMmj)!l-l3_mc%OESJX03hx>Hg%+s468kv{}l)n+harS)49KWxybb zc+IJAhv#uqAx$xB6_a~)G6B}%MP5cuDeVAsA9Dwd|2gme@GX&0`|B62Ml%a)$FG#> zZ8f-EUPuT<^2IW+^YE%SYi)mARMB(L`dvpCZXYVDw^xER4`@;R{iStP^5Vp6BA5E2 zVtfJR+;C3&X11pezJV95`t)Np;?6l(X@3U3hc9!h!4U~|AXE?0#Dp<3JAW$hN*J)a zDoaz!9XXbqo?;-B+2=W^U!{|n>-lX_opCPoPCs}w-XqUHR2%IdP)YrE0DC99FcZr_ zPUL*p!P*5Za&g%gSeQD!<&&)%KQ{d^@nian7Vb-W97~T&&e{6UG->T}y&XAd+|Avq?L2dor{^r}<7 zDvs-0ZNzTPeZgPMDQ8f!#+fZaFM7d``ojfo{BIeVcc1{S+2(#8UX8p$Gh&leFn8N* zfZybY&&?){W-X_*C#pdmFG&-6B0K8{=Cv&OYP^ls0yGnEfocb=k=2eB8X@pYZ8BW7 z@_MARRXAWbehSDRriqI*sC;Q@j^)?PKZ82bQ|`7Zw-(US#Orh3F3~~4;`0zKT8R$B zd=qccSl4`_oBzNYx`=p(=x<9Za5xeB5?8mQoDA#J|LR?h-^-|>%ht!wz_U@mPEw)r zr5+&XQo;(>hiqDc@-&Td_2*pJv9LuhLk;W=p+LfwGke4B@`7uS6RU(3%3>K{KK5eFn&0fB1iX7IuYS?)DH2=Mh zR;=-@QmHqrl%R4c=>}XYGVJUJ88YrrtsM9Era5`QdJt>T?b-YA<B(T>&hQxpfr;bO596~+7@f9V@w#QTqvk}95r^hwPlkF~RrAs^lj zS%3!3!}0=f;PH# z#&j#oJo7EhHpg{?&x$Rj3Q`eqn{%Y98Sgv7ac_d5M zJ9jKm1oKeKJ+*G*&%hQ5Vsv`pFw|`>bzbyY?Db>~`2g$3B|ecrRtTItK`&|)@LIY2 zZrcXI=@*rl?udRu$_t58+?U2!to9lf+I-G_*_6B-V533p4y@sfoudN%#Aez*@0^gu z8l(uyRSfQp*uL#_#eT&kdA)pqO=ywV?Ba4$AF^^xWX%!H&mH-TUs@=OmsJ0 z^+y8dP?>3pBTD8BMt^|so|a_9TgNbC?0VLNPlvLm+ZCGUf&_9c2d!VQbJ(S87Lg(T zFePq8*`+mWRhL(HcVWk`!IC_%Jwt`f%+)OKQdH~MTX8RlQFI>0HzbG{Pql{f?JuU< z)`%kc8g@3VrC87O305*`cn!#TepzM@<{Ln58kOpDHvUn4fbhn-WK%6+ST1df5tUMr9WuJLpQ--SmQ++jSi1h(DY?wy zPhSoadd4@3m_7}ojSCj}(r9Z*5c^-d4m%Gk*1J9HFG}68j<|G)K|U!VVS-gZOG;I3 z+tbHk(hvC&7etI+msRe(Jx{%YG#ogReKfkMB9wG0ZY%`6{P_zp8I*2f_@FNbj|$yP zzA5+ccN5s?5jA~-o!BQ%+fgr6^jHa$KY@|EN0*kq<0B%Z0}Mze1RQ+D`X`ioC6B_H zuj$mkVpknNj*%aaRegjs+zhk-?$F1j9fi-zdAO2WrleXcp~(=!r3k=n#Qyh+tO@pV`N4CxU7Pcwj{fg?#TvDo z$ZO9W56Z)EM~>$7e-xzSf1DT8SW!0Mw=I7VX8FpQQ;{5TM@gO_|0B*uxwV_!zPB|p za0zit{pESlB`GQA^w8f})@j@{@g{JF-hK714F-}- zPIP;?@`w@AiSiP0a*a2sBEL+En*F+Up^N0U=~Qd@mo<_z{!A(BZem$mDtg;qRx*Ci z)K?~lF^H3waEquA_%vl`T`6Paly6GJw(J$t*l4P!ME7$ah!m!QZ{NaQCf^_l;h7Bza8omx#a86DdoEl^qi0MV}gn!1>j5pyN-Sj*~>{5&7A2xv0iFJ5vy?jcnnJ zfEcn7;Cy9+8iNz=Dd8jgnD->jja54K_haIZA;vkjWHJ^aOwte)0f4D#PSBg!eV57j z5f^{#Pf)=Hc5=j7iuYeso4ANq!1f(yfGfU8%P}ZMSx&%=gbjnkJC*E?&LB=&!;`wS zA*9U&-kscOfuBatY`st2{Q93<06aw&YR~*lW)P|P>>UWK9)pRqagE=3Wc2D{SMB0O z@uBZqq1VyT#97&N#HW_%!nV>p2kC&Cfxtl-gk#Jxqayd5jldwu^@^Rl_nq{NKvYalz_C* zyNYz_Jyi7w#|9djbfgm?)KC%vC?Wy^QbKRiNr2EofKcv^=lo`#dFI}^znN$5Kl5Dv zA;8D}zFoex-nI5#@9PJ0y@f5JAVqHu64ghg!39?&Q?bZKxgMR^E3gh7I>>d4d&pS7 zXG22a@gQ!z6HTX{G3d=dzk0SJ2Ga3bBc?}Z3JG>dDGv{v1fi!k*^kmfn$zb!j-Czz zfrW8}0i=WI`TBA6b$JHJCA~r3Me*N)LC5&6PyQxVbzNxs2)N=cG5F(S4=rg(BhO${ zj#!uk=mxDBNze>OP))3qsV0}J-{}Wo1%evT$eJ)UI>=zcDFJ>kb>U#@G#)md`jfK^ zHrxukA2kGpR1b2my#D4nE)2;KiaJkG&WF7=Udy5+xGd+|i4fJASfcRL^0uFEgM zPi4h?`A`G_3x4Q675(3UJM(RcS8J&VYnL?Js}(C@q2)h;=MZeSW9wBro+z#&`) zyWwnupU3zwyVMOqe-|znOL&CEh5?QUN9JATy|=&)C>-N7e#jhi`k3a0`J~jNpTwqv zg+4Y=9RRO{F4zqQDRBrm_8D)Dx@%ycjH^!Iv zAmI;G!=6@yEylg4O-m3*UWaFW2UmrPQe)+Nm!wL|#n`phLTIniWY8vi0P{Y>ZQk=9 zrinLnG&u{qIUJ@?iI2o{*VOkS*lr6$LfV)$KQ z8yCOKs@H9?7|Tnl*;>-gJ@FI}ENY9>c7$VZ-XjFpSFZUwwFFZngR=X`noi4n1s}gg zPh=-F&(w&Ie!ZLufrxx;kZM4IB^55P+IEWRiH^{`dBJ3mQ#;l^&nda+b&hMghWt6r zvay_^wH4W&-1zFpR;^Yn{q>i8aeI_!?>y76_e^U!edH{hWf5KwNU7K^m@0_*OOt55 zhtaXHD8y+-O%ZMcp}j+=Pp)B{x0S#3-3hFrMbF-^!wga93xZRr?odrRLu6Zwuvf^= z*me}JF(EK{=FR*&9Y{F2+lC_y>{3BEn!|Zx2R~=8o-H_3>G@inok;>sGKo=aR0Oop zIX#3tmU7ww1*F)!N0{1#NOTN><^8L9O?vK;!%|%l4W+wnH!fLUhV2YWXV(Z}gG zJ*U1@p)6rFM#o#ZaOW9A9}a>S3D)D`G~f=iN*sD=?lzJKQ$Yg*Ww_b@?})56n`YoEWf+zBhY`fD^;o{fBo z5DtnxJ9LK-7#Zt{8ggRkJcXt5aAao=!3-1Tz`nQ@RCw=>xlh*F_j3m`S-GZO_ef!b z4wu?*>JkF6XA{M4UFp!FhlIO#+l+!${^RN~&X1kkm-(X+$CN~yLCQe87d}3v)X?Xl zu^gdgG?HWkPNGo$BwSI=)@a@sJ+#JdP@0tJjrJgv!-|>r!2~+UZ@_hdXh`Za(Az;( zq3ZtS*x7Z1Wig5%q_!fvP1`|AcwHr6Op*W>?Do0L`2kG>S!q6X&L++ zs+?W%u?=_4v$SvL2xVF`;lswh48NobL9*YG#cqODbWW;=r&$=vkyP zQFnzcrj<%6{33^(E34x zkOn{VsOqOSiea^+MGdw0!yivM+m1tSd;i)OKhnr|;^q%2;1%5dh`nhzeDF5*u-34; zeaZ0Sr&IIw=5T5j-$kqt1R|;yCP8buH2~-*3~|ER-ox7TVT&*)qB;x@9126;Hyv1{ zK~By1%7zOagtkGu2fWv%+t(*=w=V@&XmVZyb^*B#VstI6aZ<8~De#+eQ9q|Fei^;y zYA`)VPSCSdrYXW+b;e?>FB`FI%FjVxC__PJRj}fm`gc;~j|f35$p+AY27}Zx7qAj^ zZ|E3@J5MbioB?aZ17lckJ$!&REdR0e_^If_(paxI*vC*rhm$jq#<-az-S$tw*qVYz z3m8a~t>28v-ipL_g@{@Suyw_0p3`!^E}eEbI9jcy#Uap4iQ{ml)E>%X0aqd2i-U5o zR~(LB(`1bmHb@725*rbLtsHTQN-gy^}sa^kM4? z^Lt|!2sb^;(FjHN%I?&$u+xlMzIF{^nR>My zAs4G(b--K~mBKVf!w7|aySln3{DnLPG&;8@4*%ew}Gd8x8*xP zR8n9hFJ*ugF*!^*c?%gsB>_;-Kr9SX&h9a)rg~^5%s6}SC=KiJ);i}z$Wf+USz0|X z${`XAXi{($Y`FR$U@#XJl~y>%^Cf zA-0^|VS~U~ghzwT=*GM!_Kd&ysUWLo=|SJX*MqxCpG-lo ze|`9$c~P1=Jxi0liHZuYx*YWXcRdpeUM%nT%K1ECXns#o;PAMo*6i%ynfCXejm4)C7d$wyVG@xQPzGEXVV?i0(M1%L{) zMGF+xAJhAyrG-1YjC_q=5QtX+6KaO1pZbT-yqU3}A(p(rynGF?;33c6xBNZskP2YJ z{s+&%e{y}XRL}z3!wf}(zCEAY>i2e;RBU;HhuLWK{03O zAmO*CH|ScJ#g$5u2+myIOP+*YENOg}R7b6Jv;-3EDSa15vq zDo9OSgH+yi*_uyDSwR*R!6G+Vf)Ye6s_xUq51e*aTcn3b5i5H;^`ci4fzouY>;zl| zl)>~(>nb3_6t}X6x|5oNQr)-7gQ)}7L8>iW{&g6im7W<}8Mo1Vp3v=dVPTQjF=-2R zPS4mSKWb=nqO3dW+_e<(Jir@kAtQ@P?dgF51s#*Nu66@B9HSPkbVpxb-+Dh363}%y z^28Xmt3BZm2@0&P;#AbZsd=ZMgf6&UgeG8rnf#<8)yzc!d{6M&b*=` zRFdSZ>IIo(aI_~DD`9ec?YP`ZO*bIx86)ikyoChk@l!Xr$GqYBDsV zM}7OIVPtF!=)U0hbd|}LS)wycHq^`WHlr6o5wq1A!yA~->tq-2W(;x9c* z-ayz$Q+6ykOH)g0OAH8Hn2>w4dbivd!^xnsWg*pnqQA#Z3lswXG_RjB!R^cu5!v3I zfZEn5E~u+}VxX|3qla1izJ6X*D&HCh-BCoe@{S(RZ3D$`C0VkwTI=hSx%v?XA67ev-`GfvO|K2X%H392O)BS~ZP+Z2-QZNQ2^RrK3jIOEfFQWg}v`%*UdD4(vDoVq=ktfGxE|s)8i#K-#siJ+B!6<)|wZS z1MKr`+}xf&Cgdrz#X7a~J0sP)PU|?7v=#f?jgeEFi%wiVYpMx^<^%zk^_h9VWmGyb z5Vm8N=Ir7Umy%Ls;Z|!E@sP%*aE4TCp?s)dfvEJF)x`Jr3o9wzsUCwz0*#se5}Q0$ z7Maq#7&l zZ7V~27SvWUeAb#1kOnO}uYO}4pml{!BsA`e%hBH#%F8h;ihHsG0&4rzlaA|Uv{}97 z9Xd>!pi+1;Ku!E|c#GopWENP!S@qjf8_y5MYsKAt+Z4MR)NM(=#fuon6q}Myo`9)} z*nSxL5fC>4jjL2@NO5NQUBp>-cJZd`TL%?0N+nPP5-IF29xeaiN_7j$s==KC3hhQn zE-x4uthdD=9~Qy9^=Cu77RLN1V1V=(l;KAy5k3g;@UXKBLWRZs8@{fB#mTzm0BKBn z{YDM!@9<_-V0_!1Ha%sqR7y+y-uTdYUHRFxdF2oNepX9eCG;$SOUuHoUVGqv&3br= zonLD#-|U>*51@z?7l${p3EPMRN6U>(peq&!8a;q-qY~cX?At*=x(1GHjp)GPj6=(Q z;Eg8kZ5(7aMc@1!BGwC3N|tI~2XBwjtwwgYaFwuIf5--m*w7vzFvX$RRbQHM8z>C) zuqxNEE|1)hn3q0M3h|#X1c$B(L}K!u-t+wnkW!MWnnfmmga1mqLu&bZid@rm^HJaK zn++^C`9P6Nz1(tNFGari9^%-E^ZB9syDp18{1~4-)mLxc7^=Pql9TaUYDSD!BZwo_ z=``ojE`~J)#b;_)RVY_uZ6n{)2v3uRa%JH?%IlDtQ=ER_tW8B zeEj@Q3qMpS+)+1oYre7$VGkl2goTBjNyKj-Zgj?irSX74XxV@dx-oy4IjwtB?eJi7 zTCJq%)4>UdV=)-%T5%iSwy)zvP;zPU>(Q+q``DOR2ciL2#FmBq`3P?Ksy@vq)2i%U zU5jaUWISxVL_dpVf?D(Pa62!8NAB*!hYw!?K9~X25aW|WLZRS7Zo^n6%BsT1z@XS~ z89|=+?(D^zXs_;2jx|!$cx25H)Rg8^yeux862L_PUk3whNMhI}rnlVt)MR?_GC#Pe zxcdi=ME3Mt>#%+t3kLfKhv+`en-x6n+&Iy^2Mlx5tXJ)K7CMM1_`V5_-xHdm4~mud z7Y)bY?aM(8#+H`Z5)NqsP&gScOBw$R`0F8#LO0~?ysg+7=P3q;kc?v5s1x0{3kd|m zMR4{~okD&5AgXSpeslUJ>xoxyFaLr_-o?VH1Wva!|D z6NMu*Rmlfw8A{Kld7{U2N>{IoCN>yOgzab1+T!)!S7T#8N8HouG6=q#!nat&+|~EF zmYLi%piD?9a|l|lojNnM`TdO`u1b+Mc5@p$;nTyf-F}n_auwUKi<_)q-fC*=;_U{k zGR3U08eZvY>uv4sj*HLuy&_%|OiYH#9U_!PWW|c)dr)g!VwyFOhbwqXloh^w*;+6)5D}%g zxFDm<^E+WUuQH+O;ec#~taZ=x0U$0EPB=U-m<7isHVmozG(5(!uDc_Yud@+|iC*s;@t> zPV1nkL}_1*UtY7%;emUq{0b*-cb&NFx+C1o|7Gzz^H;~d?#RVyf2D2{@DwdJp@tC; zf#9Ftj;P$qjIGc5hZw1_&LcP~fjXR4ZMAGLLj2C$`Qt|u%X>c8t`XE?jJ@+R(w84NoP>-_qS6&ap?0s!VJ2mCvM#juA2CNh0KQWZ0+!pHq zjd`m*2kj6yOn>pvr2hExSz)nj{h(1)=<{7dcPlF~^Z4}U*7s`kgU-9rY3#q*L0ey9 z*4<4AucHqOlS^uhO6vD8{RdUXfFM97xmcA-o!Zgz?YH^55L={@G+?UT)B(xL$W4HFr-@Vpby6W7tvg zaFDreB)%jf;+P_NvVtb#Fn{KZZ%46-i}y;rz=qTS$dvVWBcl5INEsctlFGjN)R_A7 zrhAf;H>c}*`-;_NbFy=P2#)UO&ur9RKyx>rMOx) z=m%PCRJ!5i-eTcJa(*lMs4+?3o(qC2V=F17P-CC_l{8Z@b>@te2{Qe<+8p4)P; z!F`2%oGM~&xr#GL!caQ()1Tt{{BPTwyr5*dJY3ydCdgBa8J2VHnm}dG@R7NHSbzoq za95_XlL-R`V5UKYB6-58J=b;EtlU7ID=Zs@3wd^h_cQvI|7#id!6Lx*YUB)mC5iFr zkr3p>JH|ivWrBqJR%T~OljR+~Ng|?X_xWt`W9J$ypEs2bg@xV4T9IibOI$DH&z`x6 zqXY*5-V9B{$A*8bSF>G}5mN(bQ(82qd->eCvqE7bepWuaIaE;|x%JyYA)2|aj->cno=(bJaU4qC{4dq(=$Z>oNg1`%siC4xr{_D%>cXoAOg z^C3KBI2kipzCmtZVvw6His6SIf4PR)uOHdmiA*PcIt((E!CJMX`Mf#C*<({nlxcOV zE)3CJf2zC9DE~?`Y5CW?-b#9^z0Wc{O4Za_9=R1lmKPfS+V}cRm9DmNpxKKyzc?WQ z88w6!cO9H*D*~#Tjv2&z_)*hUz%M!?y4)C&KAz>*9t$S5KJoj;1Pus@&s0u;<;{#)>{a zySq=WIt~_tIrcqesRgQ1BI{e!CI;!fXh ze_j?A6~Z@6>}kkr`4g&V3pYQX5eI>8kISKJxSscRS(afbP6M!)s9MOl>Hpli5<+eE zH^({`A3L!!k-I;(=;Qq5eG_@NPgZLE+s`0zOH2uPe{^kZA(fT^_i7@z{QevdoK-xj zk1!K+6WI{Y!ynPHdz|QnzY#u0+jW+iMOvnOWn7XP;?>20qGI+zRGPp7mPKk zdzq)m00Jp$iizqUrM}|Jaq#&OJ#mozZ25(Gtxt{;b<#WC?kOcv&X~r8_wx|dd$D)C zPf>Ov53?(G@_di(^kD-oD7vfm;PB?bDC+IQNS7NOSCi*{?eE;F z^_ z&iu49rqo;EYlg;vZtJwQ-uAQK-tz23C=|lmlp7lcJ5)qFfCKpYu#0-zg%T$iv1zif zcO9n`To>%TogbRD`|98_=DzctMenOMo4)+~9@j*2rNCwhq`Gvw=4eOCO^c1s4mQ5c zaiV^t(X2Qv6DzU{kjQN8c+2=4pw(JA|CKsej6tPyrOu`~TE~HZgDp`ICBo)OW?T4mRzwn)FpqB(x4f+6H#K=cO~Kmzp^hEXQ*oHBmLy z^bilChcM|#8_ZZOHvrS-h*BdPw?8 zF+m!cU~5MkFgG7r-$n`BsV9LS6lbi8kva~kVqla9GeYvHc;ZWSe&|r*konF)4Fn=9+@zT4B`VMvY+#%F2If&Xxh}>K{x(JAW_!n&w%dvu(yTBy zqJHm zUyOemqTE`0mqFUC-!z(ai5EOP6b3iPd}bFN`1xFY#t3iVd$C_cGBnuonX#xvaSgBM z`uY}(qGW|fS^?qZyUk4es1b83_0U^L>7VakMZZoMTKd=-?Pm;bs}-ySF`1uP;!}^w zS_hg6e5svE#jFX%-K-ObSE0^6x+;qMdjcX@g1?xp95Z{xXW4O+X*a$o{EaCmGL}XrO}MonX^V41-a@} zir$8@a-9ZLNB>JE+b-Fos16B7-g!X3JXEXBY=Uz@>u3QI!`w(^iMygCtcmjSYvZv9 zU!$=Bb+CN!Gq=t#w{Xi&X`_Qmi@6C~lhSXcH=94@>>eJ0xEaU83(=H}_}#>F0JweiVx2V(KmWa-L`&smtxdrrB6qag8JL!@#4hSc`l8sd6jO>a?2yQ z3Dm}ss|24dr(zZh5kUt*u!>C(o1g0RQg4N*k*<9}R?q1eJ9{CO%-3G>4S`vEdkd*r z5$`xC(k1+B)--!QUm%IdQdn^kAt`Agc7Hw!t*^3bm6K%JK@VHE{3TGPW`+J`li zaQJ>j9`_<%)m5$%2G%e_mro0GewFVqzUZBwXi4BTfC{TN`=`dAn-dPJc3mdyxdUu# z#ezIG7Y4L_2?Ou>UQ{x7tG5q85mB6S$nBbdw@FgE-1h#^o*xOvh|Nz+gq6gs*{p*k+#nW;L^-75BPDSqia(@+mDAs>TpKU-GzSL@s$j%i_%6Hljcr{#W;orX|?uqLs z$OTNk`)ONZydt3f6(JyN;~qRJrcJ5Hkx4`Q~WS53Q2ucSF4@ zh|R9c`?G{Oq%bOuAA0BVo!!fXN8x4jBZp=LmS z!`hm+60bB2qx-Ixe$1?Y3EPh#S5mMfe8!p;umOhlYVn+$*%PM`Gd3+Y%iI_nZhKZE zuY&w9(+xsvrkU0p$}qg!Mm(SILZ6OE0t%BE-{AIWw7z$ruoe*gs0BTn6j~X^ihdI0 z{&O1)YTrs~P+yjfziP;t9Dxq{*}0Wm*W^R*4qH0NwTc{Fb_#bTP;MPOa4&4wa<$l1 zK&2B;d)&O4B$oc;v9P6c+WYv+Ce^|(EjRl)u&y$Z6{sGh$(3SuY43F>2A) zQp|~g3UT}h(R)9TTwUefb<)Mx&hByRNDKCx1gp>DgMnLgmYW0GY9b~D*J4@?XGmT9 zo;q48350AyxME^(Wl2Hx#uHGaC*+cKz+} zufvmHwzitFuq3cY$=$N5tJ+v!=ZCruSN9~XYLLU`JVOr0>ObR8*z2<5WPFS22lrm& zzD*ZXkAZT@`|CYeRg~jS1~SHm=iN*t;XNWf&CMUZq;9o6mSmGhi4Ig|*>O(Br>CyT|+I7YOOO&Q+imvzyq4SlUC&EviwI#<-0 zqQq+=YXXJY!y~*p=Ky}XX5uePqwfekTFGzDIjl6y6{>2yJI2Cu)t^%AvVqX^4hZHuGM%~NbNLkqMHgsVi|(qg*gX2oTn}MP6!dr z^>*9Hyw8VyUD_L>8sc#mbNgZnG!+w(KNwD}v#uK4#zBlIWc}Ow5Y=nus58d}&j#`7 zSPZy}D%7hMo&(!o_y$>51Gkl1b}4N=!>iF}y;nN_c9Km0HyoHpKAGp4IklAHQbzf2`+Bqbw{WIQSlM!+?WNXt{Yu^SDOv?Z0-f&O? zGwAVIXuJ$C_iM>QhMW>hTYhzQb(~aac7KGr^Ll;(=AHkYr+3~;2Yku+Y}IFTek0}c zIW@=ig=zpQw4Qd*`+~b7W@eWQ$_&(mBp;DnNNx9F&bleyWd~#=lgjWUk%GSH! z;MYn=Z2trF?h|$g^2)=`_2(%JQ1cGV%(WruOQAT$fUOB$FEQdXXrLI*CMiqoPw z0>&+Mm!Unqw*etF&7NFbT+&N;2evZD+HnqQ)pu+AF?@bn=-ZcZkHf@|c<2*ZiqYOw zF|?ciPAJE}#rFRfJpV0XrnyYU4T@Tg>IGb!g%hi)j1D?oB!LG0D$!HlW=9cR-pB+?#_YG`H)QS=(Ke=n}b^ zowyZzCMP4l!|>yy7hd@+kS7TM=kR=IH9BzH&sLzy$inV`IC1c$H`cy&35QO)Kp>-U+z8>eQ{QEcK0adDucU<6?=-l#V>ux*`KBMAjgF3? z0>+w_iYW12B9X5klf!ln_JyyKi6`Z`!E(!zWWA|&A^`ZX>VYn0?!L9bfSv8#g~a#t zv;KMM*{`GD7nxTXGj8qk%`>s})tK2TDwXQ~yqE$2=?iglR1;(Lw?bqdL8i#$@g4|i zi_NRdJ=Ldxg~(Y6!61#WzeCGiE@07^s68)3m(RRxJnZ5XLn^5}%SBPCBMIBVkZbL2 z-}=7g*>v~$=Pj@_WTso16X+qRhCilX!fj`ck}nRbk5q@|e1CIa+POzBB%MGDM)bdb zYVwlB61xu+@wp))A-ii1!v{MiNfl3WIXOA`pd}|R6fDJO{){DaN3iG_2pjvcbc+O78=fu}+ zXc0|>6o@NvazE{wxfF9lg0`I2Q(huaDHBKkHQX`jb7~I=Q`J4{AyV2$Ec)fhFZ74i zM7-fF0_%d0W~)DT5S8#LtoE9Sh<_WE&_a*Rv5Vh)haUS3Y`Nnpi{nXhVdbNWqm=^J zV2IfC^b)g}c_CRr^%#5IA2ngP-0ub#;O@hB0RYfIj3?J?1hTJ7J^UJQGBEJZ(^33q zqmonOiWl8G^>A2%V?V;bkF=;nOTqwnzJweww_0>sOp*?a;*iBz++f!o2>+?;H1^7O zxH_o8YM$XzvBl2IV?I2F+YW0fIp+?klNe(!Jg7)}I-Bs_3l$Q00 zm-7wMBXyZ)&Sb~XLZv+?=Eq)=PHm%5c<6U;O@)JGZL}FCVMJ2-{j2ne6FiFd6?c6H zQpqcQ>)H=7g86G~^ENl9LuTg=KFa1s_g0jg(Er{Q`MMY%zb5uk@JJ2YU=Q&Xu{(Z6 zq-xibL`U9r&{gayWDcPm^S0vFU+gYPCiIo?LYbV{Go#~6V)(dj`53Nwu5m~^r73)0 zL1cdvKiU79-o_}{vQ8LdXt?y#RNF>D8y^zF2Tcu9D6%6(Xd?VbgIU5Tqs_q>93NEM zLQ21PPWvp{yLzQ)+GYw~jHjg;5<9pFI|2Ssgo9B9chI_oo&DqZ?G%XEE|r_Jvon6g z&ore_xy~Ei`9Sd?F_7$U?W!&B8ODsEQN*Fw%s)q;`0-}MjN6>>iD5t za_HW+oI+Io?DASK+ZiriD9x|z^c7hz;YNoQCVK?Kn>*Z#pnt_2uZuK@!$h7WdEWyg zmyq2ZI+?@H#g`B_hN?}>6x`>|ojYX|HVfK&WL||cK~%bKge_oY-~B7FhmF5rMr6OK zJW-1=5=v3fKn%4T0Nc0l7=|1jwVIuryp&F;w(=dV>@xs}E0b=Fku4AxNPK`Lpp8w8 z)#B?y>RxktJN1H+Hz7CHsHs>Z9*7?1zD}o?M@^kaU+d!3=p}J+8$=&?^NWv18v+wM zK$%$X<;7t%5Z}|d;jRSJkg^?S?TgA*Q35ewCnckCGRQ|k=8iy2!S&J7$D7$E*~;uT zH-yyVfVKejz^tFp*16t)kk9jq^9)YeoLy|D0J?D-+j(+wnATU15Rh-koqcUWXz!{b z8WMyUA}v$S3vlWhnmZ?1pO?1;l-qK9?Wa1Dq|~KdcG_C1F(B_5n-(u7?k@g%T3%kB zeP@VTHAR~3pQGDaFCqv*HMO7yZ%0Ck`~U9H)~1{mC2sQFqzhBgaxp^=3A6M`Kjps> zQO5rTl?vRnSVt0a8t0zMz5l=m1>tqypitJ?3uQX#?t6E2bOab)934^E z89ZNW#_AuWp;WKR^R&!30b~O}O0XXQ^QIN=P zxH})YNd7rJYtW=lzKA#3WbL+tF>9u)e6p#gZ%}I~f23J)4g&FDejTm#5fVvtxJCv2EM7ZQHhOvt!%o*tXfRjW2!2`|j`F_x^ZijI+RkT&h%OdpSt7Us5;q57UWrF#m6Zzgm~jtAe6HcN+B#-|W27 z?&swfyO|7Ue{TMijP3W+S&5F0z=Xtj=@!HvOqEwH_bt?x(IR{plQT zwxT_SatA1Z&L!I{(77qIvq29hV+iSsm?PDkliEnN$2 z?EozwJNgs6Z+28_GrF0&662|~!&_aR_OE|S1JmuFHeC(BZIDK%9}w%fYMi>e6NoTW zt=&=Ue5NvyMh{||>&+6w{kUS^<$7@H{@vi;GC$9R@*E7{yX^pNc$`(aUA7(5+3yKW zWOJg|cwboBZ#pmQPi8Q$G?*fUgoN0AcVsx4K>U0i%6op-bw4Kw1gPd`P={ zBC0gU0~#>1yo{cF?DO^3^W~}1EVR%d-MG|xlwnzGGKnRX!30H`<3_0SSfBbrZQLVy z`yW7fl~%am(~HOmvh6;T#L!^-@uQ>@1W*g#o6z&jm9tfBKT*0J7VCS?>p#c{0Id5y zVk~)`(QMf5`-U!g4khrsJKFU>|9^gK#8wfp`S zEL!a5cwY9gcHh9k!ou#<4!~nCd**TcxX8KcxZ?3T=G^W(Uv048azEC0azepovFa@n zPn@x6vU^-L6(kQ{x9!2*{`!2PcRZ5n{3~tS@4T!Xn$79DCvEHT1F+Kzf-nKBllt}k za(9!l+zI~A7Zz1@;Q(wO_wzu2Sl&;z@5NS|$Ye!u-S%d!?!1-Iau_8B_)%830#~WP zNT$+&A?>c3=7KRU2h117a6sF7pK02^9Hxry+PaTx+MU-8e`@ewl=3`~N5#Y#ELUsK zXnYTgSTe=vP=Rz^I1+8KSzK2apXY6L+Q7{XgVy`6VJdojBSDi1n~N}w%elWRt)~99WjsN#WWD$J8;0e?{{tYx2w6(=kY)BpHD@n21d$# zK>+Waj`VcLxMbs-`xI{9LvTBY7oFMOj+OO&o#%Ns<$c4H;eJ>kyG$ZieCN3fhC$zh z(R~KK{I)NS$4UOa2f_jZs7=>{3R$t;%^_Tt}3JSLF1i%V}1)buWSv0I>DB%lwk$yC{*){9ao+ zHny;D&)Jz^oc_ZPft!>pnQeu@d0xB5;{N@{TK7AXEZ@%;w!@kaR*8Nr_tMlMj zCBAtyHrJ-_*T;;8;nh~xN{4F=g757pY27zSO=K{ShmK-yvO7*p3QcoAX*Hr6cV5jO zQ)@QseOn9z2PbOJsY6@K^PFpnz2DKE zeQ4Vs1SRkOZ`$?`i>mvc+i!T)ZAVx*zVA0~la@M)ZB=B%5H{oW?@fUksZYZ^k9BLV zm#mDjG$tDWwQfSvM+>V9Qa?ZW|5skCcO;+p@^_%=A!UF|g^cJrPsk3G=mp(JnL z&(MkfW!fGP-xmozrw7)V3~%uJ80Iv$HPTwwX^+}9TdiOQ#{Y5%yIvr-uea^1fn1MM za<9+3+~IEnU*D$obS8k)0q_CeE0mILKGn6Xv0M!)mCJ*R&1&=K@nZcSL4NtH)*H9J zU3S!c138s?J!mG2bwBUtKCg&5P#)Fzd2%VuRHONPt?@XT?_)ldq}5g@=6tE_^ldKB zH@5n_ZNF_Dn|5Ed9pjz1Z2P$VmDJ7nVJ#$z=WfJurHdY|9Ag<;XQa7I@(rCJfd6uV zZ(ON2{-PQEUu50b z58X922%0T6gR#EvhE!S@-9hJbInGP!&)<+7S>ts`$+jQG`0jK6?ZW`TQk7=tXdQ`svta2wkR0u|N3dUY-qA5J1!3E?0(H1v4IPXo z)_K3Vz{0`34D9~DK>eSN8jLjE`+Cn^4rmMX?Rdvk`}`wIr?3@TCE5wzP?{Urway9{ z_J++CkL>dtf@n^m)&%dh8WtPpeLX3(U$<`2e>h$Iti2i;fwbvvax?5?tR<{f|K2cleL~1tSRHvi*$4>)T0( zXJ!y}p4yjpgMP?hEc5A&C6T*b_d)y@$A5<;+ua1C{hE2{hYIkz4%euQ+aaays$#RV zH3I`ffNR&8cI$2kw%stUtKK)WFq%%?AA|XAQ@j61{C<#xt5j>X$wHdBg?N7@TzAij^1jOdQw;d;I}o|cZ~uwEe|Hjw)sRJvrXN(DM?02v?jLl1U+wBk zb54E#fhruv?al{uDIjz)Zn+wv-JN| zyZWDxm*rE;3L7rrVDjsKx1+Pz{5YWjfP#Yv0T=@qpf=uvKn&PPSm7})OYjjdYd`)^ z6Z~kqP13-;bniMNM`M$(WMC8UAHlcbatwtq0ZVJQ*8P020dM{Ozh(Ik?nss}$e

0y8!sq(+mZwFSk7(cTfH6SL@QmRp0&ZX@f%JlNcf{Lv!nba{qep_5Z& zDNqC8)M9gOnQ9Z~p2Xx|!2WQ80!YX!+?oux< zjSpWfV+9nH_oBG8Fy)2P*`BIPaCB{ncvqJeT~h!4c)1Mhv?Q-!-5?U!bga3@>2csU z*EE@zi}v8~6f-P~ouRkfR|~@CmXfGS)LxJ?L|>I;lK-*vuqokoO<(f5$b%|OT0P2W z^8=rn*$8z&WmpflM?6XCi?S^km>qh2L3u@*u)GsLS6=+0^+B@W!&{A}2XYTF&4>fr zn2N{|d_qh}9th?Yo#yIUXTC`QW0{;GN>_U+LaY>Cwm=vFF+Y^0HANf z!8!ZsTi{pFI9X^+xhj7>rqZ9Z+snZy2xN!R0hZT821`)dD!;iS9GG93;7PTI)z2JY zZRP-v&o{ajLhc6uo3AaB+HXk;02kCeJ_HvZgU52hbdzh|5J25(L#8xyX@W?qcc6~0 zVQv}9 zD%c7Z2kys(vYOy*JrwbOt>y@y;)d*T&N|9a>}El;+EZ!2Wr9uB;?f@2*wj`HsqG2|bD>*Iv1~V=iN%hH0~H)khTgd|AMu z_iXl!bMmjH?y|vFGpY{Va0_1&7F#W^Xx#9k*-_yuc8l0MJ-gzrIk)pOd`!_V#uJY< z4P{;xOx=Za!QXZ^y}Nc=!Z}Luf#-}sW=kW@OVbps{2u(!mCWtHGuY=ssJ*9NrI8Sv zNEw+}Bfy_{ljC~Zot3Kyh}_MBX>l=;g(F-=e4NmU4@mWofUN*8)=^=V=1b-LBzyoy z>M^v5U3U}pbE)5j7lx0Iwod zqql!tfbCQW>k%S&&EFa~MeB{+_LBh`CuRnYu0%Mkz$*9&8pGtC?_q=c;d!LC)&g9X z#V1Y!al<3(qXpK65XXj6T&?dYf@0|W5>}(U`h55l8~_s9xXY42d1(2X78PFnXf%qX zoDHuAt#fN*Y7O!vtiVC?G`Db9V=Tp|3U5GAX?ewUKl3qu1B;l=fgz9Hu3=HZ zSwa7?J{I$^!KhQj;ojqiW+Z?G4rQcgg1JL(l5)uA=W14mtoi8g5SNiGEBTNn$Pu4fuv8+ zX)tP~)COMC6h$<5X7(=87!0O1+WR4<7*VJIVMpf49j)+|VNg#Jlfxfbgj4c6`Z)=A zO*DrXj?}3aAlBJ~`8Ifa#COJwophe<||EU){e_c!h8oN~S9T zFgk=o9t=6|sjzaxbB!oer4850ISe8N5TWd2Ag=o6pf7 zm4y;&=~>PkRkZ` zevo>)zf<>i@)>GI0DT@Efni&bcAX+2qr8Y+<@p1Z!xA_7-w$1{k`hr0VKg_ufzVmK%|hr~rC!4_*H8juJRni=;~ zDvU=vjfjLBhW2-AUgL-%paSegg?ZBpN19ee0|7ur(Oab#1h2-83UTD6a}Z=i_ppNU zZX2S4^!pc)3aOOoLN9EYmUs#|r)v_Yc#%#tT=E1l{ux*0&gIk~LYyzv<4Wpjkd&JY zL=j%UE5*7aq1}Ew#KIQtn?;P+*x#4-%bqLMBPH@72Ta6QM4rEycZ7441~QDUrzthv zEbT83VaJk;J1r_JkDHbJoUi(IBUxHQV_jA2nV95lq4~=<#uu~iZ*`KR@R3%cEsj70 z*B0ac5BPNk&}NVk89s0vlDD`PtaFpApZ9@)B@;?UfNCDZEy{fz9?xc@F<7h0XQWc7}-1SLl2+QyzL!aM)R-Fubl~FM= zB~T?^S|g;1CDT^zTd2k2%{zgE3gRkoq7tN|p*7{q!NiSJ(Az8J<$!L9WJGpBEngG~ zk~9pDlUwxmuysrZpwGl_SA)dpKa_vetGQK4z%wQC)aqEsvWXnDw zOup`@zatWG(^>;x2<&GxNU<0b-Q)Pc9n^q0K*B{SROo=SScr-pFvjYi}=kp9*X~7ok=^< zXa5h;lLiq|!kb?af9H<@sK!3WMn_J;r^3*zfrH_%iq`LJT$7sj#AiR|l)!oEhf1~R z@v}gej}cGtYhH^SzzI|k=efTDfwmgpKIdS@wjp=E-J*gxWRSZ! zV~(ajvN{x9dUuUY-Cc0VSknx^Bg1The>#lD<6Kazt$^<9 zT=>qmr8(}-0Y;cRd$Sg_OsrA`HYyva{*cRa?28omD+=m2UxB7ycHV~0&_P(EVgix( zE~0Jd3g~u1zgD#H>-tbWcTw_vXfP>Y2#E>n2OM`8<$=x^N5lKkK;p9ail)<7V&Wn) zp)jFHfVbVlH1ptG&a7pblC9!l_+#cdrPJSr49|Wp2LtpF&er5}L-32uS=Qa8 zG>qXPD*8j%2k&GWR=ZjI1;e;zAg@{Y}SE_W%!>W-m;rVB~sp!mYIp z@wVqn;(FQ4@^eJf!shl#n)<^LqoGUID}a+GOLtx9$(Sz=j%qSQ*+IXjF!{w-`BgI8 z|0R$2;&C{o^UR=~gTl*LisV;*9&{P4oNF~`@T4&PYte-j+3WQp(xJpjY7Z_k*Y zS-;}#x{&*^*J1U_XF_%)WFWC=x zA!TVW%$QXO_AU)5=(ole;3BIntx^AZUWiT!i|WA0X`>{I7#Q%K zPB*r8IVhUj_FuSJ&%eqwIrV*K;Up_FVxoZ#-5yS_95NN1GS>o>s=7PV{>m#4QFX&< zF+4aB&&$&xaHg^&zQZzIwFjDxZ7mRGHohDOSn8T}Qi3>;aE?cwW!lSS@IZ+58^hL1 zDrB(){%o-F=yH*F)EoIcLPU813EC^bv`04gg_5w1|9!xo((Q2Da_JoddGm;4C;h$> z>(Mes7@epa`-x5E_~1Pzl9P%D9;--G!CV%??w1@iP7t#nn{3$#EKl!R;9LCh)6$du zbF?I=TtNsffpnQ>c1K|)5s#(V<1?>2t+%>YG1*2``Eht8QW&J8$sf`a__|>w-kSgd ze9|xI;(*4I_f8gkE@+cPKK2;$J2#E+tyJUk)W&8AZJcJK;sQ6YE+C@Zg`1#~$bY!Z zWln}zr26*WBuxKFse^Ap>9ZDI&f)b1PnL4;_6p!el)ik;Cm@pQW}1cH-#jTNNZZGQm( zc}{DF?xylWb!|f~9QnX%@#23hPexiTURUIV?cM9LB3zsu1?r!6zK!9(w%$JdVeN*s zA=k~l!EtjyKdq6qQ#{VAp#lDS0ok#o0!_=W=?1Hc&563Du8^nMfWni{)0GmvIUL-v zwnk`uQ9kqA_JmHOhhAHN=yt&y`^t)qS@KgjsSWX1ZOCJ-1TldJ$$ZVL;ev$jg#=J^ zkfHd?tOi|P@xtfyV6QBN?sdTUVI#m=Ou_4QXhu}_ul5w1pe&UN_T{wIuID7R1%zR) z-2djJf5?p$IGZKs*}l|Yue*y?(HqOnIeqB#yfumH_Q4$s=H&N;ZoJI&_xI(7UD*Ua z&o}tkGnLn>MN8v`-C96+9pX3p_zNA?`PhRwV~Y@opmk>$)#(kjcBKyIyoZ)&l(fwO zdH4hm3Mf-#&3EoglncE8zLKADy$ZcVM*zCA@CSm``cjP2@xalr)rE0BvAKri=cNm} zm^pp&3IUI^M%aRJ^}O1af)?MPKHx!{wS;JnMRm#B`jpACyH z*oY84zg~W^J_}hbvbhw3j%Y(bDT6@Rbi)iBXXS(i@7bA-#2Mvqz#@YCxS@+|xgme+ z9|-3$mORk0aRi~K4o3i>inUtw=Jg>jy>KVmo2(`y@G{v^%7o==3G7V1(+9+CiR`(J zCrNd(*?z*a4Vl0fq30fjwt@>1rL2*H8K}_#ILSQzU1m=tMa^>H|DFY4BXkinOwfc% znwmJ4B-E9U!NxeDBb$Kt@lqR$G@Hg-EFX!nC}?953t;mgJxw(nMW+MLxY<(TF)>P& zTuKa(399^Iw=PM1;8`6>AS!klYyGt*qh+0kVlv8xx|3b*9iv-ru2%j|H*4g^H1h-4 zp?7Msdu&wr!1fSI)fF;NH#`YS@(oehSS9o5MQ&l3oPuz|LREbPF2$<6JpER)l**?e zFP75WKrZSR*}F?uJk>a=Av|w+tuv%w{J9IrU23KFPvEe?3Aiw4Q-V>`L(&xQ2Ji`x zFP#8yd0sT>!yN5si?_}Tb)0iUuW0JdoR`J;KPnkzOQP`uZq-}*B|IYwm1sef_t~0z zaZAK?i~xPYMH@^8Ra=jnj$~Bd&58=#zU{bQ(^70h*=icXKcBSH`HX9N7c%6@I(ov- znNwXvJeKikhkGv^>0ZV|L9B-^Su246QQc`$2y4;WSDqM+Rl%Q} zj}U;UPBU(iDIe&>&t0=J=Rh*_^Zp!3Jn-fRf16A&aJt=S(?Cp&&r1aQ-S>tM?>gel zEAXU@eBDl<(^rs5)Qm`1KN@dDj~7I7=5-O$+{PMp(G@;ork zJf7PA1$E2D@I09n=nwy7GhcoB=g$whsa3F#QcAvQY0%4DtZE2i#V=0%MV~57()ot$9|xF+;`ODRkJ}7o69t3@~3BKg?`Z?%+>b8lgH1=$V>t zk=C^GCK{`^w~ZG_W9byT4czGtcW;USftLw8u^qhxq4GMlzc5BF^#(#I|7nEQp3943 zMz3M(u|cWx)+Af#`NBU#S>pF9(YSRBs)4T-JvAJAy;=Q`Gd%OL_j4u|J^;MKtjm&G z<4QYlY8V{^5Ta`X`09n@edtjfw&o}W&8E-WBPG#$&SK0@u@ZjkvZQ})PR!G(hpKAf z4WEsaEn8cLUdcO=bswNgTAmi!-sXy$jm3e&%86WpP|frQfE+e8$Y-_iU_qkLt_Izb zzP%hjimD21GY8Eg;DBt+f=gct;CA6wZTn&sKCPifCbr}|@6Mli-O`;f|HwnTQ~UcYFzC?nw3Pd_<4y8y0hlpHv~Ys~=S{6f?I};^ z-z|r(wOixE1fj4YNHCAXR%4G1N zy^%v$Iew!p#sl2BsQS{5)JF^}P3->`H#lYy>t~^nti;x405Xu6q&g5pZRO2dpNS3J z)3((woOWn5cMtm9n;_Gd&b-1HM6!y+_RSonvCbLfe3QxY0c@rF(lP_;+t&I&z( z*h<9eX%z|5h9;Zk733^P$^D>Z)>r-C$an^?Jmh8oc$zWnTa}l{LFc~^{$5F}r;oPV zS1EYlZm1@39O5z7j|My>1ysUu3YdDY!&vRQyFzwW^9Avvv%9zYAa~lGs8(B4Q-Rgr zd{c!O-9Bg_x1cRFTVMiq4581T7PxmXGRRl7p+tjbTp%;aPlpS%SN$@;nJ z2$jY?4=&6L(w1;7uDYC2#1KGX2xyd?BXd!9M?ey3E}FdcFML@oGY;e3hLh*uH#|X@ zi$wbyqe4Vhsdpy`erai}Qr7(OB6VtAf2hF%SP%RpR4HlK|ech2nraXZO zTziEe=b>|&HbJHz_q9SV0aaPhaBv>$7T1TNz`VKeD6oS;EYONaytLrlTyR{Ky_s)( zU+s`i8)#${GXVh}i-|kF>abiKsO9SdmWN6wwA8>oui|9Q5J}U%IGeQ8AwEV}V_ndP zMDsHrbA$lCTm>^Ee_Az=hsi+ybyMID)Cgup{~ElA+eKNwkqv_b+iN87Bz68Dbp2S` zEbH+c8MBK=?|$rg21ccl4V^5z)$ABN)?G8I{UhdQv%bSP_BjIjr(Zl!-Ux8~(P(m< zYbS3lOx3yyA_C8QCAD@Ae_Vx2OnJR36Npz5ZKQ&{1 z%sPC=*3Ela1519Va|!FE#V%gblN5yQ83>bqON;!c6S&CNxfz?}M*Fq76OSj|{Vl&< zk)IAv*wit+OfV87sk-cQ%z+3RSNpv=OV+qvmQVrJm6H^9oOX&6SQ2k`%x%g?o@+~f zOY`hYXkZ^G%5jb8aRW^6IE4Q$@ar!B_d5|IU|8G?b+dYavVGM6U0%p^Rw_yyU$uZi zFl-Ncw49Xy;9;UsGXa)>FSf`mLpamQG($veUZPKFL=Q^7)_LLGh2lP0hwy&f1`|xq z-SsaQV-nK=BknFPBg|X>#GaTMC8WTQur;7scrlfbT?7SDsqj`F1l+yXZfy7MH1ltg z2Mt=We-i?+7;j$2q)nXBF^4IoIQTMsUY*tQ{6jD{3W6j*ms`j+7cs_KPtA>xEEdLy zeuE*;y+K8Mt`bhSB56e@l|BEZ=!pk+5R_FAZd3md+VL{o>~D!b9xF?b!PD3RifT?P zagoE#ccy|M&@aKIi2GO{zRoU#n5S|0Qft(1Y-Q=`}(G$zwNrBfD5eY6> zI>&sGHTZ5wUagccT_8QpX0n#PtoqG8D2nIn47(Ml#&`HNxM4?ZdY`P*L0Q#EEe7JA z`|M*y8Cc>Xptd(pgnT#{!;7yV%*hx;zSCx8%o#*$=!%siQMF*Lo4C)*b{w*q|BWhXN+dJthR5QSD1O@E?oFWVz z+VA(q!oPO`1bEFcR~{Y#;IhGXIned9bQ&Nsxv~L%w++ltk_w;yMNO2#k(bHhjMNP` zu3jJlpu&gO0|u^z_FPFC>JF9?(=*5z#wV;&29%mHvpl2OM`;o{O*IFYOLvRwkQ1vLep9r_Ph;5HPnQPbYrXYmkQm$r_E<5kLcDW(Ot4Dr>rf;1xfz}h;yly@2!y?vKKw5YaBWUT9`bxKw`=Af7XDG z$Nk;4t2qA>N6o^Fr&Pl6YYTxy{}>znB%+#XCquNPSaF5=l?nT- zjax`9FiP2RN&!es-Q+m}i+qr~rd{Nt<{V)D zUSahW1R6TNv5i7#R#FonXuakmwU5RDRuqZ!3o)5CF9;Zr?5W2 z+L*XIDJZ_qD?HNa7#$_RinsXU;AqWlr&=9@=R;k}!-ye7_B+qOX&M}liR994%WkF$ z6Nt}?X0b1Hf)p&H3*p&gU-1FW7~D({%mWNPc~ZcnP8L8TiBf*uz&N<%%`oyuP=P#lj*87LGQ#H#hj*5}+V|oUL$z z3`O<6F;`t8nPrh7YP>#=p+^D;2vV)72Ocqc*H0$HZpkQsCpPKNhVS6l#nr>51?Vouiys}Ll~2-o8`DR z6t%{J7yIro=!hk$^B3dX6qRF4D7{wcGrfY>5IkWjEkKF@=v4g?ELF){Jv6!^occ4V z{nvJBdaV>npjusq9C@KC7zNiMa*^w8sSD{HPWrO<>@Y|39;W9&a@Ix_tzdJle3MWN zTCTF;F;x#7fqQyXTY!$uxP4+I-pU$>n2MsM0NwNCB6Zm0t4+^?D3&0!+t_0CfDllx zk8|Hix!*k!-Y((@-O8ek<*lhzVfT@WC)?D}(snLfvLBCzNZA_Qld2CO9*EH%*8+q$ zZ}zBMMK#0{qy-DH*#$|XZGi34cw=X`Tu#jd5}dDtE6sl?Bpid=i1XFAE?0Zj*a`iT z@8(=6jUS>=jTdQCu(|MK$LWq(2XNSrD>p3@HvS7h><0OaPAnCdR;B{{@EBSPy4hTs{(TXG+S4-;Vo!_j7(KqBqnAA}4*PChCBc zq=3x|;(of+vsf|G1(=R4mv1Ik8r=I9qYU?hU{cQIugHqDSrrg;Z@Vxw(c?zoygrn~ zc*5*y;O2C(e2Pg89^ihH9$WM4)->(eHdO!l9xm-sm2^EbQVNVy)ON7(DF=nL4FTDH1DVWx;Y^_Cy-=RJovd|Kg1k3}bDQq&>L<4LD5J6zHt60b9rQ^)0 zy2bAt62?@o0>qdm=nw0r(V+gXd?*0nfShYcrH}mXap;1qt@kLKUGzm7@ghb|7 zV=Iez!r7@!5X)bPyMGx@{^J?k84zNQ(2L$FSFQkY-ZWb{Zv8!kBZDVS6#?2UAm(^^ znl=BfD=$!x<>{w3_U?rts2NkM#`UNje-I40iV^|*9x%X+@1XvP&NJDw+TBLMbrVwq zEMX5?7F)RGu|St8>RP00zHPv&f`ZmN*?rU9j4>QZUgs%6BaIJ=(~3)8P2^r!wpq{m zhLB=!wTsu8-b^l!)gG*qe;>_Bqcqvq@`q0NCLSB>z_!9IU9>iL9dwEQwbXCsc4PCT zah9wl6TaeR1ik5(SV3#df3Z$?K7zn!IZ5#Nxs|xnM{{39!%=G8d%_7f?Oh~C7Q9y; zIP3jHv_sUw|K!>mY7Mb{_4W*!DpSK!`x^o%9RYe4&UR^;Q` zk^pY^4-B&Wn3dq~g2^e|cY;Bl%6p2&J34VAO5EbwLhQ>6OT)Jljj0es>bu=$@Djw5 z3Xuw*G)5)%D#agoool|Kp`%1~y!@Dr z=*Qej!I#ZdD12C*?by9RO+q~iYf%^21x*~n{Bb%r3PQ|b6IFX9(B7QPYtQ>L7`Q~0 ztYuYl(b0_YCEEPb#W;?cj`GE_OJR*N*qYxEZN3g=Vbo$$9i9q6Z5(j}Zm6}1C40+O zY}p|RZgQ8+zj#vh6H=cqYWiYCv&tZu_F^0Q-h}Fb&R&bDDrkQEJ%jx0;4vQ_T`iR0 zKG02omEaNnlBO?{BXRlJ4(7(HiW{ntP@B^@!F!vr z1z+P&ej3F0hJhzuuXgv|r^j`bRYT+OyU8+*%Eyrqg&)I~Gu`J%eDoo@H-z}48{h=D z(o_i?KAdCgkBsj*wWx>D4Z>LfkrnozP{@=?98hSxecwsc4F5-b-k3``2sgoF9haVZ zz@TNW@LB9qz$>$xBlc_c$IQz(QK!^>_WW%2693yk1)rnH#6!MrZtP=mg+N<#<@Xjv z!1wL!XD^oDxoQYyz#4&Uz%G?Am1Rc^raR27zOX9h=0H6nCHs|LO?Wnd-TCKFFN~~8yjGi zb<1l~*l8T1HplYf%JaR^B$>naMr0ZF*?EtGKpD^kUi6YMc_yqLh_JUGs()1xbuccO zM1kW}NYG=^NM#3^$c!^e@9}qC$As)KR*ZMg3j?(#$v7f$8w!D3Q-|f|O$uH)?qGd< zF}*WJc}0)?iA1LsQsPWE{>Naf*nUYc2Rn(B;yaD5=%^Z80dW5z4a$MKxpq3LR;Q3Z z`ET8^R*c4w@a-sTl-m(YXw?Ip!3s^N6skH&QVNpwfd}PdSuz=$&!Ke}4_zX1{9-@P zmyiq>No>IrNhTz7>?!nPr)-7by4_J~-bK%Yz~dVv?Zk1Uwnpk4ZG8GRH6Xt(aRxf_ zSAUdjHB>v=wADZ_gi2wC7VSYto8&AjA6Qm@OR$n8+OaB{;*zM*7hG2&67j{y+xz3P zqzg5wCTgS8zV^7becBN`6H2u7+xK6*3ed(tx81(bn$4?lzyzauh|bN&>42gj52 z6zzU-sG(1~gh`b;pGHDl6~+(Xrl0CZYqM4);S)d7_Hv*PlsBqaATkcGMuO+#)1ODH z%#Q%}rmMgP!@OyN{>s)Pr*7RkJOmR^$10XPQta13YV0M{Ur%Mn(3)BajPH48C(&{M zPh&14le4&+WpphlTF_2JkAIQNNKPj-ew?Czi_MJ|mr>dC5D~M8>qLF7((jOxfOdm8-b_20gb89xc+uPKUtsXKj$$Mu zN7*R|ledULGI$SRs@@{F3r|;DTdZ4Go>$c0_{dEe*q7-}zcW}pMa6MI$^Z{jQO3(2 z;5hK*@5R?oAP1Rcbr*BU$Xnep&c}K^{gx?IUT^G&G~PQ{)4WZY^~}#z-kTXxud~xy zX41r`h6N4Cj`JbPB)iVBwuCxD&K6Iqo4YE?9wD#BNjp{|mR3P0MNeIQ)BH-1w{BtT zvRq%QcfhS}ffs&cP6&r7yvD8t3?Jg0B~42nB}&y=Jgok8BgoGi~PvIt|aG(0Q88Nh{+cJitGA7N{QXE3f1I$+5&2+W~j!aO^ z0{5PVi&}yQPZ{D56^a@sbSolNclC(BY8=Fc+iWZXbwSEHd5H)>YcY@fl5n|&T5ymW zxBtkf`2YayuGe+pA-=Nx94M~9j^NQu-$BUTtx>H|+3Wl0rQnG(nO9ba4=JHoT+MxHGBF-_dXu@(Kg%K0%6Gk;#muvc4`RhN}a zX!--0l;X8ER%=+VDvctC-s66Wl+%(!rri06oj`7RZOMN$FN~O6HD8k34RV_?u3jY8 zXAjQwoyxs3?6;2NnbD;WgM|}u)!iLogs-SqLs&wy=n$TAz`VzzGuD(IAN+1S_wRbG z{D{*Pp;3w;h)9M)ozu;Az(d|b3Kv58?BE8wh%W5m8tBW-6VGy0wQWqQ!xTy3j$wLK zQg#tuGIpW@s?;RjxRAj^Z(pYpKKUr=aINTxIjkoXY(K2)3W-u;spp`4(DhpTg4+}U zS<}Eh%BsD3xD>>-Ik1?^df3V?@9|GDHB(L^U3LFrHE{FH=c*^GX|MWgH?*(dgGWyg zm+Qh+>qYnW=3T3n zC;}?=)`Vz1kY{_wWuzY}@~BxxkVQ?Vy}8aL4bdgulU|KIJ-x<|q|WNqnY+Z4?{m>} zkdN7XhCGgr>8aVL70Oj73jq*1RCU=*jJ)<*Y=y}Md1_T z9*!UhAvBUnf8>P6mByRHYhYGrqhAq}YT1(!5Zhh&^vX|F9C2(|sh7KNzISCUQSX5~ z`7$A9T*p68I!t(yK31~Q)fgVE(8nmE18A6&2+O*G2aL_Z`Srp)VS9qNm|mnbEomC(TOmP))<2HBOt9s=b%tof4>Eo8uv2p&U+l z6NMyZwVD2WG*{e@`*Y_pINth#KGN*vd9I+&nEjrL~n_nTjbs^{tm2U)cbNVjkx;RPNVEL;}$ z9*KY+BV=&lgOqRsW_4Kbc-NHk6S)dF&8iTaVy7N)bXN#L(>QNefv*+TR~?Og1}Nf8 ztW7$sy*F6!T~jMLJrz-e)+2*7MY0fi-2cHyPJ@Y_)Ja>Ih#gNVJ|&qUdZ2KQJMH9ZC)0l zv~SK)6eeD z{2*3g@qJPmv#ge?V`Y#|d|-Xyq5!m-Fb`6?9LNiM*E68GJ8DS&{yzYKK!3l3iTuay zFh!c^S@7(XR2p_)mzq3MQT1xmv zfw04J_hU2`%J%%coRIh zF5{ZUIXBr>Ik7qX#;G02@l(TZCGQ>`A?+u1eJV>e`Bny+H65^0cWWozG_cEiA5D*E zsTb?xP5aB_ljbRP$6=bfGAxFXTezdVyi7BGM$G2NDk~nMS!$U#*|Ob*C~kKHqfaS2 ziD>LxiC5AnEKsFolSWAiDu=OeY#2Q1XP*(J1VL03;2LTWR1+rC?_Ai7k#QuE86H(-P-KOuzeaHXUz5jB;*>I=rgmOr4zx`z=pB0hW z^`bd^h|eZ(`3AA2x(1A|o=WzdIib5*cQ0J{*=LBxckNV=0njD8gGdayOhn$fTLEeI z-xX+C1g;r?GW*h10%AOmZ12W*jY;N|xbF*O6tLyKW1!dzwy<~h6YFrrraLHOXVqL8 z+JY0K*vbwx0_Z0;1Ckcpfsn9pqgnfrE9(+WW+kA|um@LwJ`^AYbh$*qZciMctF`GA z#DE3ptQo9;R#5<2gUOtGP)Zp-Y=>tybp&gBI}yWoMc0l_Ct!GCuwRmDwG^~wwCoqA zJ7sCU@~le?6bhPw4gprRia=EzzbW*;pmPL*r-QrU6gQcEPksTnhPr+4D_8H#m_|T&D`h-baqpi$^j_^7p5(a_?p0 zUV{K2zKb)?uPWZ4v&rIFlz&vaw2#z+uNry8nI$hAPc`z)>3k)EeOHO+m9Sbg;u|*H z`$`qkQ{t6@a4s$fHbiOcdB`#(L?FVg?{j|8_4zcKY*&jOLIi0mqv}YxQzCv&>L_^D zLh32#p2DXLw%=e(_H}bxpQBrJ93X?cT0O3v`v5GF5)%H6Rw54!$x)X zd5OecUP_9%qMz>CQRmlOr}ecF5;XA~CU(u}FtFU->G}4I*_|bDD>i1A3&Wi4EJy|G zscboLeT30+h9NKk$Wcm6Ze&w6CfX~R+cOomlQ0l~l3flZgndq_be%sppGJ1YnfC>P zKs|`HGt_SH6p_ov#A}f9jUC?|`+vQdB|10B7lF$$@Q`pX1*(k}?3rZJ&Wv zGq)9KmRiEdf?w)Qg( zr2LYf7I_ArB|Em%EQm;vn$(cAzBvStr>K)l+e@}9dt;LW3icmiL^yt#l$CgmF}8hp z8B~f-Jalw}SMS`$EU*HINc>In7%R^)8%;#bGoGFgdj8vzoN;&mrU0Nvo>_fLyh0S_ ze%IyMyWM-qnR~QzaBd=?l7ljfwMC9QAryE1UkfvyOJR4e79aL*`+ zxw8Rd$eD8wlzH#!Bl~Oya79!TPUGqg`95FAT16=mo0;Xu@gE9$KD{a>=kF73sq)d& zKC@Rl&s9YpE>8TSa>l49vtvhbsH~@KvZf^Vtz(w6uM{=;c=&f z4v2ovAqJ;>#s1kMIFIw(4~L=*d=U1-_8V;{g5AuwEW=$5>fAOPFk0nB_CcqwS$7<8 zk{le!l?XZiXwr(qL_icF02-xr2 zdOl6+mK2S=_c~pckUqst=!VKlV-hOm?p!6RUAo4*8xZico{b|$>E zhk$(*f|K*N3Q5`6<(ih056oUL1x8`DQIpwAS2EiJ*XDdfo5KFmQoH3Qvxk4QETNSB zRGVG(@II8;uPgv;Chb}D6YuPu48%68$k~K`Wxl>_%IFtHwQr9oXkgd**qmp;yw!d083gj}6S^-(s1JW`$Nnb|}SdDk} zEL%<{l9Wp>>q@$Sf~r}LleaW;_ea?bq{V~dh}9VtK+!Jig;;N9e~(je9S40{B0n&&yQ^v-O;u z34q%+E`f0vC?sNZ%p|k>kt~4-gUdXeo%Pp%+q|T&W^;9>-4G zc6Ke;lyQ(Xe?6RDZzq>?F>!l^E-ES=%`A+KXygiFB$dGutv`AO#kt!+vpeARedvB+ z4$75t2&S}ZmMszft3#c0EQ1guEJjYP{U&ix@t%9 zIp@@pq#mR%KBmfV3e2*4un*+xmjPL6f1rfF!;bbT#<^gKxFQ+3SGun_R9TlF#RnaG z7Tc3038*tX5zzOowE%$8-#@rVW;r|jE279IB%spS?TQ_%w=vcBP3>(8D`Sx76Uwx` zY)8)b@ni#9QTk?qOiz zS4%{DiF&z}fU1~Hh#Tnn8z(^l?5Fjlco3tlKQF=I8v=F^nRp@I4WDufI{)KPsI#`A z@ABoKY28Ym!^fS5;nPn>`R!R~y>&g>AAVdEC^Abskyi}YZ+dVqN4yaLjbr-aoFPrC zhg?8#sD2M30Rz9d7X!bzH%T;xQ{h-=tH>fLmlB1s;pDc0S-lj(%9Kgrf9Y&e=iAn3 ze{~gF7j8oL|DTJI(~igJ`woRVb4P`}igpdhO#&Uk@9Qf8)Ni3g@6tBgErWt0ZE zfodiVC9hojxVETU4d_8Vd`KQcP!hp~`3pVjauR(c4enLA?S})ae&GRsU3L||#v&^} zvbvdmqbuZP3v_>&$0#H1`@Py>tao*G%KRw*Wk0AB_ClSwXPjk>trI=T>l}g|k$_L~ z-AlP58>0|zgsBuJ@)K!#GAKxvpY|D0R0r?Zdvw>hs4@5%Z@7P!z61!e6?KUobB-&H zQB7CV>6|#&<;>o07g$o!`#o9ALnUtTZBRmxS!HCCoD zA=DrsDHvmD-C^i*alc0U6_no ziY4|Ej8bc8U7BoU>jD1z3X;#Lz7D{FP->0QvP4G|<_0#T%(oBZKwy-CE}O&CU3S-o z8os)vMrlhewFcXGKv0OV(jxvBT~rG`x(oI|?>CC>yuCtZEN&SxX9k?SS}(HtELk~kbe8TBrTaeX*XtbT`WaO0HZ-QPvi0!^u9*V>R6NRhwJ(WMeIbf?Nv9&Cj;fplfmoy zP+Yt@A2+MB)t~wDYCvO^nVNJxqDCkv0b`NB61q}hr$^b5fz6<X^oK{X)4h^l7J;XfbSO)!%eL%LGuCdj?2Nk8CMKBS#@hnrn|iqnXE zoGjdXw=GHHYm$0GfjD5^xNVj>7|V=3uUL8<{E-Thdwhp}iDCpTf6knT%{_FSm zO6K-YyD!(7P6c#Xn;CmjXx|loEUUaTlr?(V5-@;%$M>JEhFZD_G@%5onFRgGgTc!u z0|a!zD1L7})Z3o|&lv%)?}xf(HuSgVg1Z{6Rttay`{ddOW+lcRzL%X#?N!+OiuF)? z3g}60&|}^eN@4h%_1JUKlPKry1$Gx`{cIXqpFRk*wa!C|+-Q zK5!KLbRW83JOJf2Gkl!}9x}7{<-gB@dc{`I#1eY-1a$xU|I+s6@tPe)-T1fqoaf#< z`;ttO*)lVktdIo=*%wyXeZ^Nrc7d?IA}X>7FA$Jb-yn+eDo7ATAb5E0o)2m}EM zWSbr@OkUy1J^mySjTF>@OCEDrIj# z;Lq9T2N(=s>Ss45-}S1%^jVJ%zpH0Hi29`(pOt9;>Db`RyRtuWIDO_gn9E!^4k~v0 z5=u!FRn}esIc?ke{JX_FI!B&kzyPXe>_PqV9iR;}-~$!x4GYn{dkuJ(>su1y z(|+n$n5XOoEwHegrqKM+YS^3RJH!W!!CUS@^^85>BL?liEbFp$iADYD9WamG2Rg0+ z&l31Q=cD<=3fSuwl^K>KF%m%aYr9du`~lFaA^6?_+RrXS^YIlx>l$V1wwoNzpF9TU zsrw?%Z(jv_(|k7*RWk-}y$97Z_I7dB?JSK`FvOGB-vZ1U%slqg4z`ouz8x4?%v^lB z398{>?Z&)c-wt2PZzo-(Y$RX?9b`K1aLhkDviEr)r`0niDJ>w~8}48;`C z7rhR^5}J=4gTa;eqgg)--ZD{ivg+6GK=qq@fflgeScvM^_C*?tsb>I`Amjg1mRE&a z1n(iy3mj=Fj8D4NdgEHsEq$pcuX~;0tC3`QdU^}@)HjDyFDX=AQkdhw7=;8E;Ooz- zp5VJ7%s|KT93mmai*=5<%tWhhz!4PSPjzI+$+x4o9|D6w4zD0|d7leD%{sobarRG1#;id*65~rqAon zXe|8O^{@+COh4`cEPLm}!HXIkdhRwi;JA1X4!-eLOx(B(%YNlzOn&2d9D3DVIP$E! z(Xw?RGwc{0!g{iIEi;x}b~zSbc6q3C{w0@T^3uyuUvgO-MP9NO!#CdsbL(PEJ@W#X z+ZUmE%O*4z?hXQEk&ooq$96eKxwRJ47hHmw3*&`ZGyZwz!b{!855-?@3}$}y(HQ>8 zMwl}Wp#I-?Kt}E6l0B&3vI+ddWvHKi5zN<)L;LD2Xr6sHKyH=5Z*R~G7?3-_^CdU4 zc>$)MaUaZ40GweM1cVS4-ICXayEwVS`YK^Lm0ecORSFlO29eiYwD7J z(`TQD>9eDwK7H1C;h!XP`92KZxf%B73o!Gzb6{^?fWf=BIDATEo^%AWFF7647e5ls zU$5$B(8fdl>4peuL4Q|mDzugWgR+vi<#QJ<{ z{$drd$fA1M9t>Z*-nG|DcO;;j51tV7{QkO59`nR~n0@^^OrLuenm<{E>ZyBCzvb=@ zUOa0s^Q4Di_>MI&XCB7jUEAYq%nKew^_#oUesc+CfB7^w*viu216xtOU?+y}UW4iL z&cw{)&p`9(V^P2OLCop(D96e?_5cR&*$(@?MVP+mVQ9a!6!jbKNByFm9%rRnh6XcF zJRQTguXZ@U+tI}=IPXULjm4OK#;Ks=XN&Ejn>!ik5x}=jfmY4}Q#Q>spFtJU=&tna7`s;gu_4&OCy_dkd?C9Rl)qeObi0O=V3oYP8Mc z4r1`$dth&xhnY)Hh5f}m4BmGS%w-2qN_6rJW?!%#)90R!<}X*2{XtRYf|#nX{rnQ} zK7;xtyHwuzz51W~P`_*!?DY#U`;?8qB6YlN-iBr3$4qempa)r{xr5?!=Uo}Ou`uhI zOkn*@1IoMF7y}Lh!cpQtrsKp()(pr7i_z|76eT(}ud(!gRMIvigCw)>;@OLDV2l?x zS4QH~9bU3w*16e+C{^`dP7}X_Qbvc_b)P>B61-0t`AC5RkV%><#PWOiGDGh@9MAqF zSLB{*CmBw3XX?{1q8Mpm5_l3EYa|lHm=MxVn7 zY+vy}co{coXF|&i!yr^Uox*JwH<&*40BC41bILxni=08K9-M?_#@=Ub0RSxd)Owi1 z6&8JdEdb!q)9%mVCWvs>fcsyv8C+W|{mWA@`ST^9S%Zl?=i|65&kjWIf3~Y@@n_bd z+E-)oHR}KX2cNUGL&)Hk#o>2-vzr~W$Iil9;P7*{0s!WJ;zZD)3X`8*0|1zL#(j{u zs+Jk8cmA#Qn=CkPwh&gfim;Zg+o5jZMx#s^K7YI8*Wa%J@2)ZUhZ6w+!{=`c4QRnI zzVR#oYYb)@>yApTs<7!gNo3q8yUK_TRA`c~H{!#4YBX1$;NHKqiw^({-@Oie&m?fzp!v`$ z4a)tHeE=e#xigsl=qF_q&*%GZvodPXaNWQ9rT2TfPH=R6)URs3?0#iXU9vx$uYUXX zIw5t!<$YhC;qR>n-!>1JHE93Y&5D}~4|-xEoc6De2M!suUta29Y@C5Gs(R)ghx6YY z=WzbWaUIglBM!O0>!%$J2P)WaFUIUkPg0EN;jemKzswC{n!h>@IB3xPo$EW*v-Wf# zw10J+!}&`~+_#fw!nf*~dp*u8z}Yjz)XyBtqK~QUIhL`+W5tcC`O@1#md0EAzxU&Sm~LGjh7(&cGlw2E4mQ``5?LQGrfe_}7z7|0q5a`foKxxvfjT`(KTpsYFHrhmm#UG>)6Z z$=6}VV--^2%tuvO7kUwO62xXW;7_QxHVL~^%)dp5=dCq6j( zgW!FZ8Ax_wfp^}8RSB5ZA*I`eFZhHn`TkCPqkYif{Ky8^}cDmWpnT-cv zm(F7G=hk8WZ*0YphdE_m@0tS0V0OJTM%zD=hOP`(9w`Ek%tvS_0%3T%oADU@VhJRU zD#R<3TRoUv=jy8Oo(F(X`B}i>hC`mpSVs&?0=V_88#v|Lc${~AJ`FdqtESVNj`RF8 z-~a$107*naRDI_G$DQt)mewX0HKSz;!fxS~mFxyr7vD4AUF@*cg;d#%htc@H+_LpY zAUc>WyK`L$?$jNBR!_pu5c?&~t7zwamHRQH!de_xKqtA4VS}%vp(4C$8i$(}696Xb zN`>qD-Yld;-9G@p+~pjnDq9g?061X=2VS)qvuE#xT{eVVh0KeFs4I7j>qKQBu7us< zPw$Z>LcNrpJA;`Xua{1CZNb~797K&xg@zwTa`M;`($Z=xJ7X*#&MeoDZsZc}$rA+4VAxK1QECun?UF{-ER zMg52OqW=B+VgGXh+OIA_d+jkEcjc(|4yFin$}|9A^17STFKhh%Fs-`xRu1g2D~Ghk zzFo?FJLN^m;eIwVPdA+B;O6=6zgyh>E=A#4wFtr#({X5d9|(Ttr?C5OR2==nS~T zdXHAs5Y!QpB>;T@8NK5c0P(`eVBWf3edn~Z@GZ(_cdfgiT*U!S%ICs|g6v4q9zwj0 zVh}nZZtOSX`irV80JN>k&pK%PE@;K;Qjl<2z9+zF{*TLHj?`csJB9RmX3c1w^5qsl#hqCoT^@pu;X-h_OK_6F7sv5(# z1yu%Yty*3Jz}=baDCfEN(_w;pJ?UUfKkg#nuz`{DX36^HD1*i_$hMdm)WX=PE3(=3 zdDpJNyldA2U>thYT|Se$rTD=Az7@lB_F>_NH)7sDp8y&X9{Bg~0fcZlTE$xM+zJcB z9TRH?HQ2U@RLujsA zjpnn*05ibUfBkHPFPSmM0D0_9P1377)fN1eDVp7s{k7ir@R=S#_EfGJ+b5^je?^x=zQWkkhY7;P~(II zgXSa0xQP)dSr=?h5s3OxtcNmwaq=h6>ON^lPJJjA;OsF`7^A)NZkL!l1(6VXOZ4^V z$GqOYXL(6w#ERA+bLJ#hyr{KDjz=RANy`*K2Q%^elzcM-rgA=!QMj=SKk*l%`V}%# zcRu+@5a;Z&a?YhHIlI4yE}2weH+yeej{cnIQ=lsoF}Ghc!j0~~3=T3r%Ve?Y-%?6$ z1`c6C!KaITOKv|7&VArHXYPxKl0>FBJQ?v`sem)VN2f%;)e!lO+twf13jdt)(6mgz z{ch%Ec-lb>Ze9!=sxWoqF&Licm!lt?g0(=s*)5IFZaCx|Y4{^8;hbmd$+ZB?5jRua zPP8G^#xdPuaH|X7nK@%`Jjw~|ZaniaCbqh|nzcv3U^J`UjNZWGU=hVqJOBAc(dsU@ z$#Qto!LY|i93Sypq!D~8LGN@AHx845fC7I3g9-#| zEgBFSp%Dm&o-o|yYI)~pP6r3>0uMrSnp@?W{Ku7`gEfXH#u-=wP!nOoM58mWt}#&& zY6Ew4D!bd1!>uHBrOK-%NC4&xCzs7N#{&l|(1vM^AQG%Sugs$ye)jq$Wgh|vv%)m+ z9Y6PqN@<+%AqMykCmVF)jBDL>el~DZ$)R;L6e0IH45fE!r7Zt0_+Z_PBO%~3ui&uv zB&7hSZo1KJQqK85GO4`mWh)d_g9MT1ues2h>ha}$42~|R%Y?tA=^BOC810z*?B?N4 z#+!dQ7C2CWPMS$GbVi${I@yI>0ig9W00^{UwwrfIXsPR-K310<1ZE6)vkDDD-X9BFf;}QQU zmny?qfs+YI9g&bsQg-*&^`&qMO~|fkPHEuI8~Kp(L@tifwIpQb@3jifD@bHV(Jd+l zK$tibSl;m_q9okdkW4zrnTHgC_=$^fHvq}XgNls@Ql~eN;op&Ss;x&cJ(`muIfygp zn%q?V%cf@=n_lQf)McrQ;7__F@^!04g>X5Q+=s;~(jwka%)&@kL}ofUPWfj|FU2VG zO-@uIQ$dD0ZjVD(CmPED4jIr9cg5_)jmyz8WAeJVVUiwnv&D-(?PA{dykZk(R~|+? zufdVC_F(5b|0@`AiT|oMIS2gkV;_hsl^*d$AKL(G4EDWx6J{R14|dREcI{#8{==I? zjQXNauLl4ec-D5<#SQj9+igf*_~~`Rzb{4a^JO=DOzZ*0^Io zNd^$^@`uJR<&g1bz#0mIMg;JEZY8EVR~#SJaYiIzLHqZs0RZ)D?gFho0xWD{9@9`8qfVd~%#rJ`hHg0c#e?P9Wz_}Kc7uIwn#@hTqmN*VJEQ8iCfD4QDC=9(3-x6Vg>#STMMLq{6|kH;Fz~(q23WJu(!EENAX+{XEo(!(yUH@R_*jD7GzIhUBWORr%)z~O8R+zB*iBPu zSeBw8keB{&Pd=>3TySVidX6TE(}6B)OSH~Gf7lc7(p{is7WFG!jD91r`QuD71iVJ& z&78_D6KKD_&}|wv5zY3qu1(D=9|SFLP`$En)M)YYm%av9 zBS3f5JD7p$fhjcW4rAiSZiC|B2g`w$K!+;utbqk%>bonj?8=AZ;Ip@3$47q%V#46o zMOgT`6V=GdEpROS;3+up2e)DW?{C7sH{J>WSoQeFfx(!#X$g+~y+`7}^S5BvdwvE? zSyWr+W6`Hi3@h4`H!R1ptIoiI=WM}!pSvE_{gYVwC#Pfbhs)91BRh#P@$D5@^wx*r z$aA-2-^XtRm{8ra2$R>Wb<8Tv1IXyf^T-ReukiyLfmh!J`rt2MWhwRI%U~_TT(=zj zp3^`t+=_{Ry%Buh1cvWC754kfLwn1Lt_`C}GWYn*|3xf~-9Po8b zUvMdksW4mCe)Cx14^Kz+g1a&K>7M`~*k3F}`^nXAMTG%|+xt+%K*qm@72Q>Y8+Axp z7c*nwdr!lm*KWeWH{Aw0RAcfRD^xjI28-nk7!yPo)CNOqVaf4$;)WYKq)q)KzMFp3 zMHpVW5ra2x#^4=yf)CWNUpofC-Yy>iOx^gyc(d?FR)hCc9i=w)Uq5iX*jJGnHIF}(65)K}bt>Ki`+-!p;XTTg<$ZfQ_>Y2k7m=>=ikcQa?7 zA7py?$Llb7?KVvO&22#K-pR>9_B%^3ymABTEAB=0t)Du4-m<~rQ%X4>+{=FAlh72& zOHq?0f4qj(%2k$hqZt8a3}#<+8tPZxi~9B3F}P|7zHb7}hgXJj_B)F)eA{}|FTD?w z-~O4WYd!4umh|9SMt{yM3=H3VA_iC9jlp}ixg%`9qIp*s-1OX5+K-53d|)N2=RSz~%DX{JTDO_=UzVZy)0NOYvzH*x_x5W`fY+=?_0k=f{FmDS zCfJ|NL-Vl}J!Q+O`NT1x4Kp6+gJ{3hBR4rFA{xGJ`IbrGj3a2j;L5jOT#EYlcYtr6 z4CKghraDdC9^Xx$8jlAZzH2oGZ@do^AKwyX{?s!&{SiRc6nSWCNzR=czzl@h`z;gE zd646$JLMA&cz6c(TZ=G!^J>(u*on#OZv)>w!0-=O!+v+6*9kd}*^BU~oV^VFqQnu< ze(YFOpWck>mkyx)cQ^6TetJ1*-4OM!?}7QZJ7K>e6C#NHc`OIFpci`8hMo$T1AZs$ zu+*q!0Li$K3J<{V;RPrhT?cw$o4s*Pt1_SF+u*0yBGMKI~0ECbt23!oj!q2^fi@;!s4ABD&0>j4H zbwtOX!jgy6hiTjD4x{UI?HV@=J1HRm*7_(08OVro^WjTzLM`lsRc#?FC(-ejI}{uW z%5e`&QwVDu$(z40Oz|fm`Na z?_{|~1X9UZY;2DGTi_Z6H|{;);27kqq5?-kpL85m$j8EHSH_*~iV&wxVyG!Lf}Hmc z-%yqrt^ZBzLYNx1fT@CUvmWCho*ac)XsIjXm+%A*N8SeL0V?8IyZ7Qh%4E$0jTkCEgHg3;^w7qQTj%~&6C^6aRAo(C-Aag&QNPVof8)JN`!Z=N4o8%yWz*sqarir&QdNh@ddJNm;}+lLHC zQD3m#6lAgJEoj zy5DAAQ7#K(!KAFMkSfzGZydkoJT172B@rng82U{giaEYX9etT|dDjqBo90eLsgBOK zOwL6{ncCVzMv`2GQAE;}XkO-GlO+XDWjZyhqCZB3*hh-6>K zDCni&7-iqaF^>U!CX=E&gCSSX*@VVu+3Uk6lW|S+nBhf0^s_o5m9v7Vj8*3J#&a9$jTPo?{D$z(&EAII|cU>0rt7nOv6U@OJAAhD_KlBLeB*Sr`WDs)l77cnQmx zB7^D5pg|J`16oN4AG0+-s76z%-;ji+>hL#LE;&4ESxdwwdy!j_{(@N^ksTn0T5v3yfa`H6^7lo@IszLtrqz=>NwMUGYG2>~OM?KS zuI>%==lxVCu;T4w=Jo~x(2aLx8#mt=M8%KDhz zAzHnsESG{+&{3RbRu2G(V?QZ)I5GgxO*?qsy=Xpq4EVly3$gvq0!5NG5 z7rl_RS$IzMlh{(1#}D`mY<6tbok{DUK0L$xw8BM%Mc!%s=}K4zP@6Er4FIx1mH}tW zRo@F?L0U(vjz^Lw!!P)!9r;M@3ISki-9Cj(*ClyGu9a;}ZL>a6(#rtLF`j_l{}3^7 z{4qoUUk6^xE``&AoL}nyl2T!Nc>D+6f#l>13mka!p1B+X~baHd_co7$N}V z9mnKEtuTYGmhNSi7=G5C0jPL)DHkdVgAMYt$evJXcz+TNv%i533<~$SaTo=`&nO3D zL#%`&$`V`ILl&L>M$K?Xz2i1<=!*j@7=PohgVC@>4e~r`Jzj25(SiZ%aVAD1x4uyf ziy^pJHUeQtjG7rWRcN>kXLW`RAB=FkDMWbmNIZX+q-a9qnrT=I3yYczn%3mDz^#iJBVxaL0a#d6)`sh*Asiw19%FsBZVJX`G zb3)9ZLn`!-#IckQ;z(+IN3fy)W%`Z_?|PiUq)j+FQu+7zKEoi_r-d2ij%+5VzfV@5N|X1|!n5n>2@ppr6&S>cJXv-pBU+XidnKvH zdvjs-)!TdT;Zf+vgj^azZAzZR{~&*}E`Z>RMA9O!qVF1c>+1Bg>WU^JOBJi~%A6*kykN0%^aiFnhMZ4|&RyaRY20P?eBZ;Ftl<(;w)Uum9 z;?6<&$}B8X8p@NL(gW*`Y~mzZ3-A|nnaZRa9)iA(vFMJGk%`vYa9IM|cuZ1MWp0MK zl?L)1JkBzQmVqd1@^~{4LT&_KVGt3a^?BVaM(cArAP1qHGfnUb3iQ$bR6VKh>;93b-OyK4zBTM-%gN$0nmV4=QjYu zc-d5jzmHGyoG`P`IB}vR6PeZd`y5U}Y?uFL3JN|Wka|dt%|Tga4j-c~*X2^e!%2%nMb6g zpJ%v9JsxPB23pc4o-lirjWalr+ zX-ndK`)OX)P{xPobe0$B)u;vku8C%e&SoAFl4m>h%@?<*Cuxk2-rB|?=CIN21j}&$Ll#FLY+*~ zP*lsHI0qk@s|^}=l?w^r*cfrf-Jz^+uC@NVtIi)ns%9=A!p;t!JC4cCvdBgY5oUe- zWi%?R8rL6b#Zj(p5WVPpON@GAlbqO~^6e+gH$?u}G=J9t{1K{bp*N0ot`vtfHp7yO zoo}thL{&w8#s48NUe96%#Vh>EBsWnG&Y*BbZh%Grg*zZDEDS6Y$hf;98tc#tZl;} z!pI03QTRb6)i7?-243+|9MnX+7HW8Cm5zXu0VL959o|KH6C^w3lcnLKO+9w1{89hS zJ|}ivYf=9(PBE4F+t-}kyoHKNbr;FiUXL=?odPAI zdWa(w@=A#)ak|||eJfpTrJ;1fx1^ecVY*MM*QGq@zSFj6oHWkj$oL?|(NWLZ`3N(j zrS_35S^RS+srKw-8`Z`cUrU55r=ln#1++&l^5iIK0L4CbG`i{`>a{$1XREkptgqTq zzLHobDy&C8>g+Tch0JwRY>fbeuO{*#XYqG{b8Ng)carx4BYeyK4d?7y?|9b$WVS!S zMs)!OASa8HA2ozFfR0j5gSWp zb)$YF$P$NekKixk;^?@0(!z|e%vHI8jfWYWKram0NP_(`21CL_A~OsbM7KSyM>AV5 z@qvZGniiV~L1^x<;^8(}0B#n%f{N?Ul&07t*)S_-*b*5u*161X87%S(o+b+bmCI*L z1qRUgkfE0SrehB)xdl%5Ak|r7Bar&zI=$QIY|&bPEW;9EU`*Ii9>$#3{chn_4A_6K zJd-L&dlTH|I>i&jdIOop?PRxB;V-?8ISd$NFe8IB*E!?yV*?^I+@hw+9lh!esFm67 zyw4U>pEEQne`aL8vgxfS820~03RP0~U1_yJ^mm7T)ep26)@!KevfzcR#WLwTy$QZI zl~!xQZ{NoG>{C)+=N&Bw1X9jQsw+A;=o!mAR=ICgDEU+{w!O~JTzoIc1E_0tim9w4 z%Hd2$lJ-8h1)Tc8l*`4oO^S}w zbfpS=^Qno}o*94FYvLqkT8-+X>>11%}UIh=p8Rd?0Y5=hfU8!go@l{W-^;Cmyc9_xfYtuKmY(B07*naRK>8n z0lM{rN6Wy#7=IUo0kgY}xn=f83~_Yu^va1(Q$PMb0ATu&7b)iTXkgKGO1pCIh>j}n zJLxFvHubX~I(*JPzgt%0Ag_`ig{nK&DE7mtpWW!|Ixj63V1`c8Z#avjC|uHA;K}FC zK(&Z>j(`4pR6gC@Bj^aPqeVyt1zl!$@fmSrYp14?Bc*5Dn9=7fCkTtd%bk^RoSZ%* z*9W&BP*0w&;S|l8mkcC#z$jzUQ)|CiQkILlnF4@5T1NNPv68oC|J@Y3WV9(=Ihw1U z9@!h0&b|TnC{fL2b40#g42mCoA0Z%FU7CxI5q%@9pzE$EtP#gjJhmP+pu17$`&=n$ z2FhOP3cHS-1~O+4)p|G-Rk^jk3@`c#>GbKIRjP0rqCgBHEYSnbuSuL~H5nLCDouJR zY^2NO5i3N|FA44_xpVy)@!*qWHLhzmLp`BCF;WLV(N`Rajf_b7rQDKaZ%Dx1)#b=0 zm@rYRbsa~CK5&e5l>r~Ox770@?{|r8J2*7}Jopzs#_YrPVbN#SVev;c0$}WW*&R6a z?CqGic?p*P_PIfm>lt{W3L*Xo>`#W_cIaaW@_8HbeZb#iRMqg2@e6p%Oj%ZClFYcctU<* zMs7XEbPn=RBM*)-V$je@;}}Ou=@doShjQ*`72h+=xd%|c{63hA-AO9bXPp=F699U| zK~%qWKg{|2K{a4EPoe$facKYL*g&k2JQwT-4FKLzqy5HGv{$bJ@2i{~Q`k)pX(TG) zG-~xg6OoGnjmodeXr4sxt&B_tUsf|U$dtE{Hg)}EN)OTKwi?IjRgRBKdP7{dd|*wW zg)lM>gkT#ZdN+g%w(kvBt{tL+sGV+9=woBu`Fws8IdpWb}*T zppLV~?^59TD%LUElt{?N7s~n2j!*V3R+lo}P5N-+K&3Xm%K!;Szr) zRrD3(>}8)Wicm+_?fYmv#?kd7*7+1-VFJAbH$S~<)2i~(AC9u z5Jy@{6>b1UT@~rg9U~&6b!j3Egmrn z0L`ff&{~V;)PssVMExa#DVtM#y+krY@AA46ar_b$J7?aIqo!?JzY0->I@tPi@G0W& zHnaNMh!wFm+j%~F`Ne47d_G?xYfQz9P{JZ{%lc^aUnJSEL#RZ7Ld3xw(3Sc#0|V+DBLi@cS5T>Q{*KhUhN$n zdbKGBKvkJw_+>vqm@V*s4S?E^znRat!HY4dj2zqQ1|cXfF5mq(&4>a)UUoL+~`}%TEBi9 z?AMlI_UUJ1`ibX&Z(4}Kdp7&qm0jia8@9pz$5PBb{VYshb`IKqJ{I+hcVO_RcX%AB z%cmR_O;2dQ+#o91m4b09We&Qv)|Qze4SVj?almqmt7&1R&%R!ry_kAu(lWpaDq7%+ zURl8z)6TH_>mai(mB5&jJdFZ%pXW-Y*z0)YU-qGcUcp1nUnTARP&#VtH#ztOrmXCG ziiEEL1)nwHp$x2Y=O)yw8$6eza{mfA&m~ghBpx$+o=Fo~@}%d2b(DRyi$d0Cb9*of zY+$uM-D+fIeXr*H7|@{HjgIfTVygwFFnc@_kElBnHmi4*)qP83To`n4(t#vI#{)@1 zdvtXf+A?XIkSD7PB#{{uoN`CL4@p-83kv@!Us3)qex3M4isq;nDOJl#--No;T3l(_ z*P0DZEZZ<4E4K}U^AJI5Xg1pOz@IV+^nL56ZTDLXHg z;~z=Qy2EIf&!Sy>STR%-CxLZ?B96r5aw}QEh?iSPH570gR3==0g^MnSg}Z!=!QPn-%} z;3;{d=2w6m9qE*($d;_uxNXdC)uLs_WIb?uFPLBrVOBFL#Etn-B$gEt#`L)tBQyv@ zt(b&{9-Y+8NAMT&KE>kza;bNA|7iRQJ+swUnAy$Fk8lq1>N%O&z}#gCn0@i-y|@#A z+2@`Sj1Ym){P`MG&)$LRxjWE)Y$cf44ssbj-U-o zK%(U2aL?liVlxMOWY|*cUoG?)GxZ^fnJ{z$m7^j-g4Tg5>CqI zGD2B9J{0`*>#PsX*(N=etCe>5gJa)9{M+e&p&xnwCE;bZ&$3Woe0Kj6nX>>Iz}tO4 z&|r%S2GJ?>K1i+#1O60sxc3qCeNb^i$LSmK-CSgWT(pIdKXwtd$5NZUlI-}h`PZ(A$9fXMkj0Uw-H*f1-3oic49xwLnEJ#zOn&8fcU%-P z9{l#V00754_OXG|J^tO&%O4Yn+4r4q0{|wzxC+gMyJ3%;0Ssfw<&S|FeIFekR~y3e zQ#KMjVleyE9iYP%ctPvg?l+$jFnr<;%shV^+OwsJ09C0w3a3_<~{ZsS4=A_$4*lHZVjO)HQ}}6neJ`V?bx@NBfek zz&QtiDGS`O0J9%oh4!1r2DsHP??C;c?Vy#j;QJ=f{Oww_Up_wIX}|YvOarK|U4`}u zJAwHv%;p7{|Nf1rZ&?fr#_sPp-pu>LYRo)tCwP8?YV$%Y`M}AjZ&?KRA=&iPcHr>y zwxKX zY3jxpN;Q4{B?0frA6}Q_n?CoVP6w}kWhd$v-wj$d3%+*(&DCqr{>zF8+wU)EKYIeq zFYN-&Z(;A8kM`Z`(f)h^(xf#=S4m5lPrxT15Y&vpo3^5Q`Y!MhgZ9hEc3_N~rf$mW zI_vxdFIv)~e&szdkJ$rSF$B*N_$Ld|eDVa?>ldfM`kYs<)WnhLO=@Wr1kmE4dwtvx zY#3;>vXd6|Z|(#Dv|nB3byddGju)9PwU!Ok$XU-mr+gG$3A{PV3H{K;dPfPx;$x*e zWAAKuCnHL7JF-Zgr(*yM8Adrz`5<&09JKQzN>+}-*cz%XgoqHW)$2oGWgcPq^BkSy(L{ACFLjG_j2j=it={8^3!tM&PQQ7n@JNuKC~p1H@Rr^2@ue;l z4(aQ`gVkfOwlee2v0NI)-e)`f3r0u0r4r(9A(0jG;X~s1v&Y|(3QJ=4s~3vFeqbr9 zBco(XcUM^Lr-`__}bCjb#^J()#-dglJ|r>d}!l)#e45dB%M(TjqD_x6GKm^g&Gi(P>!x z??vG4V_g-*m-i5=zu|2HN%$&6s zyZ+**Xx1IU@;9G_W1e;q7QXis%sgcW>Z(FjRakWCWtex#rLoEjF2VGLmtf|COOp;X zecr{GKJSuL2&DrMp}K4@23Otz`-_E`dGfiiw=Bfq9e2Q7vKM*cS%cYMek6wP*#Psf zgQ(wrm-^`8rX@Nsrq4cqWUPPvyd9{1;{mkaT8i2Kc^2sSnQkUMJ2GN+c>1jK-3H;b zaQHR&lRHp7?|uy5w;t0MpNpBNJOa&Ujz|4lI|^ioQcqz#l*9~FFK~76?m=e|Fm=<7 znEKI=QNMOO+Rv@P@U81n)FvG?atEiU0AXoBiEGv!JC zp6?-Fj(AVoCVFdBMY;2mTY3)u2+MLTry%6`h!`3}s_EiNXX3Qzf5?94e&<}x+cOsG z(w=`fO1T-U!lQwqQsU?Pht7(bs(Y+>kj&i|oi_^gAj6bBqg&tDtW)was%}oRCry;+ zNnQ!R1a<1mdX!Dw*UprEX4OXhgPsng5xgi)(&SB^_n}UExDVaMSdM>L^Um)D1cS(h z`g`asw`9?G-oA`Yi8s8LuX zxOKXp_^|H8#QfxIg$IdDpR2%14C}# zr7>!ciW&p}fC(WS(*_H_w8|Z%Zx{=|v>Me+4T3|Eh;jHiTL1v_KYb$1z6s3#)QJFq z!_VESkoL^5+;RH5ECl9#;1rnqr(lj$nEcrKuyo^uMB>WDD8w`Vb;P~dya0C9G$AWYE1+z#)VB>h zEXcm)478i(!_FA+za8f?K6)=|GD$sQMA>?`eM-iRG1J8Nzl(|QT@UlSn?c`O4)f<5 zF#&hflVKN%WXL_cPA7XYd`Ecs7NEA^_ix1Trwh@{5O~u9%)a&v$ZA^s!tDTn=I_>m z_ta?qZVdpS{;j*azRAZ=M0=@N>2S z02cnkiKq_OnE#KiuIXpo?_~@)bj4P1ZL#Qs8!@yEfSf1rZ>?o!OY@{|JlN?Dft zMx`t}=&Jt%1asj&RL^xA`rD76(8)i2)_It@^pUXNT#D*9cB1;t2U27@)`2>Bj-N6@ zgRU8sS0(903O7pdDHn^)FbBT9?JUmF=;DdBFM$e6>K(*-!S!YdGk}6$4>~~1b2??rFTcwP4afq9t5i_9d|5x zWutV~*tjVE^|e#-dyK(Nsb7X_N~<%uL6kpZ5D`SCq(JAArEW@n^s+qa#kG|Gna7<2 z7L}HWGWQhe>Q0t+_o*g>f!`2pB!t{&lxl)Rb^0wOKP4RmI$6^jg`@R~|A_QE z%?|4Prrah3BvS`J;ZEoRvbP|~2;E+SO1@HOEeAhZ>eOA>%?ENo$6A|Qma9)@BDj?S z6ZnVN#zgMaAb6%N{HL`z;GMMvUs#i1NdSiH4*>w`yXOJSsJ71o0JJ9^Lb`DdVR@pc zkafOo^OVF&M~{j(Eb~}SHm)XW=T0{OsJAUZlU2tnXE5`s&1lZv3tl#Ko1p<<@z7n% z%$e=qJ`WH_I`E2I>V#R~w>P7H#6D0`SL62=#EL5N*Fo1VlnK)Y zt!oG?t=Ni$*BBbz^$6J2uF>2!H_sQJlt)bZhp4dU*3ku zdkJ zKWU?8)imTN+2I+^L7n);vVf-uyhP*0rCVQxmnmx*Omgax2u_c-V}MTbv~QaNK)|*s zPy3-xIo@A8VHj3{_Fxx7rjm0uzSX7GZUsQvfVWI_^I%+8fclLufcAS!Q9Wrl>ep{W z{hGUBf4m6oe=I}$g%!Y1p2*@aT$PRU{UH?Z!)u(v z1jLgQJOD-)mCoQ-XG$9+-i6bLOUYHtovo4CyLcokQe4opVkA&#?*x(2spF_?GBWf;NpNpPY}c2c~ZN|1el&i@Ge z1L4AjNR^>n=G2??P6754o|Ve${S2s$yW$Vof-~H38Mmi9lAhYeFHF@6L|KNWZhJ=jk=0v$BeV#+nom5U-O~){YUCP~N74Yu94J z&o1LtcLnA%GmgCFRa|%xgH>3#y4~rNO;)hI2SK%@0r)-Av4UZLHqetz;AB> ze(3?=PdB=a!PdIF2aNH{NCer9!t730sv?*Wwk7A|$BioypXAv!M8fRZ#-bv3vQI=Y zy#%ARwlFK`Hv>&M9FBYHC7{FpE@nTQ;W3XTtUeaYof^c3!_Ch+)d1K4Och$TXhWS` zPyotcWGRt^K4VfeFy)PkvH>tHJf^eQTUn|8JnLM>8W_H5BkT_rqk8;a(AfuIF52h* zJ@O!iZ`v>is$!t$!dn4Y&|>04n?OriwEwXT!#8dmNuC>+0_6Kgnl!a!| zIZ@twXROr&>v<>lEtMfk@|KgfS{{C1_=KWi+$gB9Xpz5HhBrWY&PRZo3Rd=|k2OX5DcF*DsiqjPQho(r_>`kvLUFF<3ihl}X@ON8LDF4| z^13pZq%(RSs)KBBJJWahvDn3~sa|INz=^nWUULAwtEC0lp_F$v18t6`=&Vx^+bH6c z!9di_sx3np4TC48DjHfd359rb2#)SObBcG*ukreJJ2PZMr4eiRChR-#8Q+xh%^il23y?b z$ac+Px8Y;$GytI9yZ{8hk->T(1JB$gO#-e{g)H|f?Jvh)>PFO}@0c86SZm$IUy0pv zx$S9ghI#Oht3U@U*c0Q)LZ#S9X1^o@xDk^vV1G=fVS;u`h}|v3jqmq#x~t1xyBau9 z0qc*1yhEFYLo>r2k@-kh2H#(X+87KJhsfhoc@|Rb&h;NEPRdcM@diIBY{0)*=zgBH zzaVfPkGtGz3ay<6m_chD&V1*5XM7b?9lPAk3L*L1q9ytJz0#RM|Gm1);nQwB>@c8s zbgaa<4Q^co0GNIFzECH89$8c*_;ZSUB@+f1Fk=FYNg_=8rLKyQ8ba|he18tKpE%?H zPJ7z(O~7-cjvW=+MmY_-uy31tyz{$m#_@h#caJ~^VsKo?uEwPyq5a%(n0?i$n7Qmx z7`|a60HAvOo-||8>6k0&$`~+=iL34eoivU1-Ont18Ns5W|C#9h!arS(vcLYf(?c07MrKn`=24R2|Kl`r#5W>;?})09 z#zH&q5K>bLqufd{2NQq(bX=&aJ`P#tIa zsI0rhc^)OuM=Qz&a-CXn6NOgEqN}ygFxg;*l>Q2X0bkbnfEKyF4*H0ZL4f;W_TNoJ7O{v%Fm?`Av!*eG+AgaI7sc6G|qM)>3{E`;Z_Rcr9-Y_qDOYZWSGOj~BO zwso`2%xLw|OaPi7((ZyQ_I1%EyFg2Z7`$RjLZhDSZ^#0t?+0D671%imT(iaSrzI0qx5gDr{$Q{{Y{=tm9^u<-`|Yt3A;f{8W+BG(5)ZY+vj!2Ow*j+P$z%= zy6rHR?nC?4s7@fOMQv6p=T1B(4*%$`={EZh+?5rdU8>aGB(R2A3At({GQY~!l?@m*N731E;EW3dO%5p{xdjr8}#(i&L{Pd z$a0BkCC64}D-H;{)g<8NU{CH)B_TFhDv9;~ALFtBd@kI_OMLGn| zotVSHABv$okz%>Ew>SY3vc<_fqkM_5N<#>fU11@&Q{$2x$98fKZ&J(dGUUV7Scb*FKhC48L%WdF;HSE_{0N4{6QJd+>?_Ljna02+j zGPGB(h27(0>x~I@m>a(58h`%)_~x;wt~wbt42UT%iJ?2ThUW$UbTNi6KO5B*TQT^v zn?X|+_O5wo|87kXWP9Cm4BvGM>fhRq$*=wheD4H??>GhahUHxaP5_Y!w*q^zl1$+i zLH*7Yb*Bt@lC*#h1oLS4keg*-%>UrYIQ*(RG5vv`gKIa+n!4x`7$OXBaL2*w z`DA^Z==6D)z+Sfu!*`y7`bClU<{hWNet#LHGp8vxMA6xk^Mlh7e(d;@Km9?cjr4J% z(`TQL=2ORm)*nIjv|TV4?nnFOV>)G$dU{fROex?_;|X=0bv~L8u0{3i9jM>B6|}ek z@2=5)`4}{RzE>#o(ERl()K}aG z^T;~^0CwvXhF5Mt`-NjvWqnrA8<4RKv*-|jd!4FM9kFcujVw~5$NBPdl3usfi&{_B zrH^B#LeUTwL`q)s)riy^Ps@|$_jq`PGU9sznI3m~H>}zffpp7_Q8Utz2l=6$0E#&2 zS4A1g7@F8l1tG8Np`;?61wAAKl|(#sJ}sqltyU_3Aa5{GnfXUU-ne=708Q!IB9Jgx zqeynCFO4HN$;4U?D3hhU8Rn{})E7z35Qjmps;5K5h#GSE!LdSYx8U#PeISRWc>mkzap})m=f669!WPl+uV~9{!?p_AlI_JMt zOKCw&{a_^yGz^&B8Ua1>@y}xcu49wZE|5r5(CF?=Sm(A{W`A>S+_a&WPYA{>5m|R& zygS=eVyW~Ar>d?XXmKFGfniZc$z=*AX;dNAH4Bqde?bsfUnXIEc#Wdf4+2`aczY2N zcR_|5<+?MKDBPasTge^kq#8a%q>vItX4GWR8o*cv459MEYrGON#<;xz1i%7JgqB;# zP{DX*(ZJO|;rTY>FAF0EjE|d-OHok}LkwGDjI}^U-++CGBerffp8Nq*{(I$DWL%$g z({1kR@YpU@Qis~nF3WZ{&IE|;NYq>CObo#I%SyDpWw(N3nK5h`FcoH-7A+Bm>`!DO z1K8HV^NP#ymQ{!MNw;AzLYeCA*kbiU8&E&$mgU7%8$voTZ=;yV^E`UwSTC&7({Oxgd{Euc0o<(wub&@T}gP ztR$oAASVBgl=a#vC^|R&PD%J4WSi3>)J1ZX$c5axk5HkVLO01Sf+_(_XdNS8f{gUB zzQUPYCj*&>Cf7yW1l(A8v-ap)A?z?)*?En-?k-0wzvHAi!DT`@4nKO-YUkU?CMvs* zoxLh^1BwtRTE8$Go)5-Hf=L}(0^((P8tu++Du36wAnMa(z!>oAQEURwsE7^nks9p% z1GsSA3h+l+##4igs#{|FDcqQv`U|Dj&^(A6lFJ=Bv>&9!$lcH@c};Yf<&>R}ST5C7 z4s{?`$t5_{CN&We+==rnpu%1)2|wb{4*o7JD`8Q3Z)7@oF21S-&{&2wz--fc|JC`F z;v)lYAF9KZg2>j=wxJ3VCs3S*=!gUt!aFp{!iRz(JH*KtILhM)+mH+K(bp?SwIjkH z#~Ve%#01E-%8V!<>7dlZvg~iAC0PH?Fv6{BvGD}&C}biK>_0mnJqo`e@+-c+vuGT3 zhnAMs+*8Oh5r$y#ncYpphQa}|75Pgc{7t#!V~`03#y2o~-pb(18lVQD^3~KJv?6G1 z{Y-jn{Me$>gx$^Efjboa2?L7PbQ|Mi)I@n=3Z0A_~U)XZ*qu=2uYEu*dsvl0=i%F$69M^j_j-*+Gf4-=BzfihJQMm^j`LF7eS!;Xz0)#j>P zPzI4SePTg`pA*UfX3^dimKMvYtNK#KK8{h3hL4myj4qqErS8ngXdaiALJg!0*2wyE z?`K3Br&th$R4(S^X4clhfN)ki%pmmP7YcQeqV%y$PzH;;pCau_VUQvr{Lg39r_|_t zMFB6Tj-T1rT!{|zeOk$AGC1h;)e$f|?cH@I`e`ZU&A;_jp4Z*yaFyB{KxYOy$Yuct z4TmZHmVnO?N^WG!89HA3=4=?RBpp>1t{&0pN?+^x73iZ)fwd2zpss%Wo5H2mZt5ID zl&jpBGcA;T&v7YgGG()Z4O1{gm56U>K&X_ucTR+R5p<3>WKfd}$kKaFD~@1+oGlya9z1t^`dfSCisUbfzSOG+%1y0udBBZ6NVl9AU8B zC}$y?JsEDM+Rd)B@X|T5iOGmdL~%4D#zsa*si0bY%b0e)0 zcPHaGT-mzDllXIS{zdpWSTX5nlnI^s?P+fbu4ye{f_xdNp8&)DVlQ&56HGF@F49_g zzA~(F4z}>k0BC(18Zv0vEpa8nt#x~zM9>jeT|{QW5}YxB-;+VCW8D0J%DVTJA%9zR zI`c1#;e>C>u7}wIix^jk@LPB(y@z~;$`AY|2Q?bMTEIT$*2;{(a&VGanIJG)bC034 z_3}@Uvp|S4P6}klwknI&Q9>$p1|5ZbVW8d9$VX#{L@^59QfGKB!OE9drToeL}JkA-UE zk5PIq^X(FSRRZktac;}VTX64VxU3c+6P#ArHzSUJ^d&gL71YEJ%BqpUomQptCYVo- zBy3(d#nr>qMW{IqS|HN%u1l5W?hbh?t;A zE3|*)HyX2xevkv#t(U)uxso?eu#C+RMk2mF%CYA;6CA?v%yxHlWSBuG_*rYMg5;zL z)geGWgv2)$0eYkqV0sjY+>E(6ITZ56jlO^zScp?9m`hx6m_-+W1w|tx%nI(9P_d(y z7!9`}oQS0{f?y+)-YDdOds?^2QWF7jNVTyT#R~A3nW;@Cp3J6g{V}F4T&%TDtQqcVYoXq|=xDt>xVyph zKuI${ZwF2`>@c7<1O@dR6i4JMqXJ_37uB3~4rgVxdV z(q|AT`xJmZ1hYA6_Fu1L^dW+X%hA|UMZ8kId=x;WymCTvqbQo8PYiQVA!)}(^|fBd zZ497!{kq-rDs}!|8KCs9u9B3N&EZN)>gwAOgbw4VS1{+QB*RhX(AhG)=1xb`9^IcQ z4C=nq>UFNF#+2Qdt<>QEy$V#f>Spi5zbGS={Z{fc3ODM@N8QJ~iV@kzN~3hd#)#8Kq~9%m1V8&EtJLsyfl{s{K3X+)OufZsrM) z!6e8Sl8|U)zo#PYOgB#fho;{{u~i(O*ggkPP(M%c^V$)$aiB$L+HOVOQxus(7y^pO zOhz(?%s2O*d(LmydVj2;R@JWk`<)BjJD;1ge|y)iTD5A`nrhXm2|t=bIX_)neFfMv z@|?x19A=TvCE~-vfUNJOUNb1_mP!YUvs(XE1&iJq#ffbOW~+cn!mF)#woi*=m`(3Z zMUO0^%4C$ii%9P|9;gA83#$B6t&4(~fkd37lyqN(hCy41P#8Q@vsvM@m4MMhir97F zcDOvsKI;3%~Tk`IELfQ!B~K?3BobMfMXXMSP(EUV`~_y6Pd{mXS0bM)+rk1 zJ9`CdqG#iTf`x%rm(WPX_k-bEwG$Q1N>CNX*-R&y((44OgHkwbZvkTU6%6CZPb#hQ zOVJ8C5}(`m*1=eI50byaO(m2IuE(?L4w9g&a~Ic0h)HoalglF1<&cK78Tf?_T$H$cQpAy^({5;_tKZRj5Xmi z`gav=HLKs_okY%%dX+T^vNFHEERi8dy<)FsM~5*2HM>IlPl`G2D{-x z-<#9B4PA;lskafz#7)DLlE0TWTNx7mg?9_PNv2tG`7~~dFzXH~s0>8d32IzAV+vF( zYU)VbP?3US<0QedL8I`+xZ)7%B8~ee{Z@&WDd}mpGN>tu$D5*JrS)VkC*A=X+M-At z6%W~9g6}DnnDc=!a01z8Ugj#(QDv+c(MR43($q!*)h+;HU`VpDI>Yt|h;m;oA+YQR zK-MrH5@HxgHW%+35|)`UvKSOHY)MuQ7(S*0>@YG$JdDDuqbgeyk%T`nFzC4ooCb_} zgq>uU!uq5yS1G=dcGu1V9LFqsI)NH{WP#Jwm{a#x8*)R3C&t8k^Mku)8puKK3B1kt{h z<%%83voKEG%Y{~9oDg(0a=|B2O`pAL8;L!Ug&pC@?XxD1xulMpqG;Nu0%PGDbw5i> z)b_jqlso;Twwh87VZ7tB=JQB5d(khdVKSaUp^XT3pojkWv~(8x-r}h#+kV#mrtsVx zJr!JYovla9D(n?4Q>`7#_Ull_@sRzkk5R9Zy};=XE&b5s6r0ek2Bq+Q4$J+K2ZZUm z8U~=GN9bR*3~68X#(u>kMsVV+0nD`yDtw0mJ$fh6@T5+Ck(Lo;zdrWyWqX_I@ouMb zr*C}+N|#g6LL)qT#PNTl7CUi3-@ic$WbJe3pWE>CE z`C>T={2(-_;XnlF3OiSGy6|HQg(1%}C{59%WQ2{Cwunj?xI_tC`Zl^sSK4{ZH8*92_X<` ziIM6tjpF48`~F!}rKuoT+7(0_fsjy(D4d$jCK&+)W^M#&L}m(}tXxRnB`c5+?FfiM zJ!U5sf@BhkiZC}5U)snDv?VtUJXEPlK#)ERAkh2YBd@QxrYIRn-pPsroVcZv>g5JFP5dLY7x)&MN~AEX(ZNTp9p9yMRBY!UpF5As3SD^s;=Ji$)h=rT>#kkPm+>!`?6<-&!}6!&(w*$sr$D=Qmnr!f}Ymz zzoX!CwjbNJ`=%Z?<0vQ!Glmc|W8Xht4*=M{^cf8-)CX-3S1ZJWrvq&YJ>!Yh_ zGXXx7uUnTY<~B#8kB@FYTezl==07RUlQNz`>P_l#sj|BIbWJqRQL7mkPQNG&F29(DI#T&?@E=VFD@-3$^3j z(0Y#+)}oF3KO1&XU({imO>NPNKN?;V*&A`CORxH53Sz@cqM&T&Vbrzav|ZJr@z+XL zv|~ZqoH;K-I1q~wM}arwY?*juUV5g-pa*!Jp>Lj6-V}MV%z-)RD>mo3KwE)Zbgar) zK+)GqNKk+QaD&FnGdBWX>2pltqP7n1t0_ z)PZHS?yNsq4`!g0Kr9Bz$c#lwRevT+LteQ}s^pKY&o+4|Oo&*IDfa9WNUjXY#N!5z zS&=003}l}zC|1dM#?!#MJS+b}-uA<)3Ut;b^P z&1YlhFHe>Jr&Q*PZ5CH##Mthwk6Z@;7~gsZc7NtE*m%`vF?`(@007%hy+X?!wN}u* z${8A8WPJ*@pEa;c;CnZbuRRgV-#rU__tvxw04xc7&nCvdI~mL0JQsMhmya?wQsA?5 z1;)QP4ZA;e5jI|PBZlYR2cV~<$NNS)8t-UzjsH zoEs4pqptV+Xs_S^QD|3ZMDgKmm4q+lirP`9y{2SexJ5?~LVrrK2Y=o}S!;2$B-t*f z`4E=xCc0VFx|&CQgQ@*Z%{!VeK3iSnn$)~oQ&A;Sg5lA>hqVd_q`r1HGGlF(U=^xyu!{;J$$lEj}q-l_GuFOoEC zpmoiLk^v@hu-UmngNCuV?qup-(WL4=P|$HgsiGCL*Jmnzm9pDF<_2qA+P8Y$ATcy> z37z%`1zR};>taZU9xA6!ad6fsC3kwdq92$9LG}z}J;*gWIEoQjLZS*?jwL*Q711-x ziU0sS_`;j<;EQj>iEq3B```3bfPuqbaX%h@@y$5n!>0ztP|+N$zJgIx?s^E90wolu z`V1ALaROi`>NX=21L7IygfV3a-68maQ<=GfFC{7)L}0OcWm1c^7*;YmM$6DH$=%dI$Jo5)g@&lwP;ESNseyN zjUxrG*?Brk?p&Q?wju#FFcOJ^P0mD$C7+o=LjiR2imPSvXSLL+1(kCbDjBO+dg4KVf%L>j>%Ib-wpG6}T>IE^RZp!b)JjC< ziLG0h;JAI(E3y5Irz1V#5H?=>S!`bOAa?%smxCYJsLNdTOkk6-c;Vex{LrnS{Y&ir z^u^PPBOmN&lIcm0R)71~DydFhqVS9O%^ahPaQSquK%cv|pZ+wYCq9ae*WQ55YaYVR z^PdEMU{RO3^y$Dx#^OcyVDa+XKqoA*`_mUG$ZIqdA}n5dCl)We1Iyn#6TAQE0FZ%n z`6F1o>`v^w?}SQes2l_Yp9gCiX%JEKY=_eX-5f4m+FLc9v6|>Xt+KOfe0xHxrv|mK zb?S2+!90{Db>8eH6LtQz3EVOeHEiZA5P!O-|Aj&t8#6 z+Q;^NTV~Zn>WyI-ziLjlZFX?et9mcpYCbITeeI-~uZ4h;3UX$QYX;x1D6XQ-Lfm;^ z`j!2!8Y8)94qtO1YbwttD6R~XDRQgwO}nOh3Pvn9Ah2X{S`Mj1c@%0YvW@h;>t|jD z9)?vCzvy1hM6R#c>V2U&a^2D9YRs-vC6OT%FTT!8vn_0#qi!WUpzvYNEMYn3?9P5$ z=!}bTBmGUT{|JZ$Ho)|im?_Alo>m+XDW?WY_&yV1cN~#5Lu8pN4bP9mOF&8_8(|-L z-t8Ff+rr6z@E8n_ERYT^aO``}z?nbvwBWIhn=^7@h^m~`tb!fMo}bkQ0lBLjTJaVs zF1!s%R?cREb~IV>EJ#TNKhz4joHXZ~FO1N9VsXd>R3@pVp0v~PSP4cp>&o)f!WevS z(ra6m^(Il$&A#l}k_MFM&;f)EW^6F9xZ)b%imSm$7#YYQ5Dh3XZecv#D9B}R1c1#n zxUy}^y=@Xsl-%=ejIxw7{Mr~OBh{4=knZyc3jB~rLy{ybPl$ofuTqy+agKxxE7o0Re7JOa$v_mayny!~|Wg9C7I0s74g{F1qkA=(HWs1&6EWHM7-cR8`wl6#g2c>?j4>mtBtS%Puc1tn;Mx1WqR8PaKcs zZ=DM|u!G^ncXfaUu$!>_voiny>6!=UVeWlvMK0O~owf_QV7vc*9`gF~`X`!HRc!l` zr(^q)r>}%*?UjN2iQ};R&2t1l-+5ObpxuP!8|4)B^py`auesm8J{$hcz2JK{uzc;= z;D-kABLl|2JqbH6dOU0$olNNVh^a7u=@`dHt8g%(o8D-&&kC=Y(Cn04(I2b!Z(A-Z zTcL7qqlT##m_fjYXY+WV8umud>weZ+m6P#l+vFP8)V&SYQ4nrt2-%c|&d_yRrRHD7 z{CJ+0J7dwUfA-t{MRPy)%q;50>pdR527B}v8|CR#nN-)(Z(GOSFK+&IL7Mw;=2{7X zk3CHao8D7BsLB^wA3zf3l5K1udV$o@!6k%Zb1a6&4&6yTvjKt65>S`zZ{OAH4$09y)4apNT8;Md%R zga6wt7!Mr5aQ7CDdFz=t_RZ(X?p3w6@A><`2LK%V7w6!}Gw;KA#t|SfPXDT}0suVl zh7V#q=P>ra;!(QeSRN?7fAf|2w?fVJ2AZI^PmGqfV;Mk|Kd#GPtU=SEssC2^?nJF z$$x$}=vnuJ&Nu=LjGZg40fRA|IAZv>Hv(6F0d(3fu$#aiJps!%orB>6CyQZ0gxrSO zJnNb=6-eU#`FVF^e9^7ovvxptZesYO^O64Q00!MCJ6@;z3*K@z(pTS$tz$;y8;`^C zmoElBxgW+D2O?~|UqWeiF2BkN*f!wgB>f*u`6gZ6$PyOSi`yqMrb~rikgMbJObx6N zJejC+CPgkQNNS?{womqSpL$5;(^yb?)#|3{f}=t zfb{GKK?in#fwBFRXSwyT?;qb^H7mvd0z8D_>$R;5x51AL$RFH~@iiAB-&cFH4NLjM zCkURddKmcij?KUfcPkC8cGM~d9Pkq=I!qY8@e37x;y3BJ_ha$z?kq5WU_X|xIUjtV ztWXdETN;it{@EEwS3d|kuq*hv^yylLu=TMIRW%>E^clqi#6lCp^X|vuB~4qeJ|BF4 z2R{tt4*}LF7 zHZcB|Q?dNR17)8qGxmMr9|S*dJPqlZhaEphE_o_AGq(P}Pk_!pf}QWX82Rr{M0(Cc z*!+zf!MAMT$k#r}n;gEiY3t3WV)=(>2qVyI->3euv~~5vpfhzWp73P&fJFtk+6WtI zBPbmlXs03{uFF=>>i52CQW!+7;Pt%0?MgtSpjRf0!sm*SO8>Upq=MECGOfWts04I- zzv>FcPNTQa`UYJ8%5^)sqP95Nxx$BdR6LAZA2`jCxpUjVID}(=;K?}tYp=rA>n|vtVjYQ;EZ)BifHk&w-zflqeCdPIUxkMh&IH16 z<%3AC_zduYld<#MXJLH%8A#uM6X*rE>t^CgMgkW+ik+8ThVB353M_yBJTQypmVW+| zpy%I?@z)-U{J&m_<+nT?yZ`kp4Bvi-9CkH`Va_hb1}p8;R-fQ0e{PuQ*{@eHB$ltyfM}GGoF=btd+#;CgWK2#69QPAO(7YH%2z>lE}zjnn_1$7AF6W06nZ!2>V85x4&Fd-2eB+yo4T zKOB642+I9$xB$c90muK>^8f&co_8lKbyIA2|7#zQ#a+i>*k0iH*I(rCHr_9Sa(Rg; z+`E@N3;@`??i6RHhhA_q0N}Vkxd3!%z%g%@wzi*lrw?RI?{w_1J`TfO$6&F&z`j4Y z2#NG)Yh7|7=qh`F(GW=2so=isVexQZCh(-|PVu;NexdX|{ow@|4lS^J<5>WJ;hXM~ zvnndD6R`U$j{)Dg4>&wv`ML{X)R8Wguz}&c!}9Fl2GVt>124Z+4!9Z_12YB?hTx@= zuo+gvj=?X!O>p^!^N}9fz~WEN1ptgM`n-6*11yWzpO18C0RHAQ>F-5{oCr)Qwu?wo zf62LY8vX=b&LV&_z?zN8cCUkg^v=_;_1#aw#@Aksjqke@w3V^@OCQJbxe`jjKG}@{ z8lmcB1S4l)c;{(2=DWWF$2|86?EC)9fUS&2U;S|$dG0;36sOefbQ~s#O%vvf;hm@A znD71y9QXBC;F#~f478PTP#@VjKjqfo-;L+;u_^$m9(&8mz@GXDmfVA~T+Sc>$ zs}&e)>*vn}-=?(sAJ3YSLXSKut);&s{SL`5r#*48`Pq|9Ry10p?nx0jNEffVBS|Tu*eTo>pqVYbCi|4X*2fd5P*O z{P{ZNydgYCTCdF+9_GL2zUyh`gvmFNZ2c8Yl)OD%d$Dh;ITmR@z%gf~b{}&Xi=JU* zVK@m@Do|z#T_H`{qRMeJ9IBeQ7z3u{N6Z^}O|tV$JLmcWTV38BdkA^_-s0@dSdv4! ztgd2Im~w8qrS%^mO*KlDqcfvq9IE$qH5-==zA^iXL+p(2kDw9`74=|BsTg_)&GhD2 zDs;K91~xx`9M1bcF2^I!xf>6C>n+&1;88sIT{nUEF;4uwivcipE)eh0oo~Ljs&9GL zVFjl45HD^!2JCrJRUk8CU6UG1!fBx8tNf})EeWxOQ^}V1Uyb<)$n?WBv5#!&VhWyq8z?f>{ z4!6TVx&c>SFf? zPba_#Q#g|DkS53F<}02kUo(R~y&sF$d>M9r?;kLJ=dBptb^sP{XDbQyJ`gBF1dja= zPg0`_z^9JK)-OFChko}XIP@JiWAkkqqh2iu>yn%Cc$W9a{f93v7W1c0z~*Znhr_S? zN9?@lR&2iQfUgb#jC{^E4*uLHfW%n5<1}pj*|}H_vTuQyvGswP-T`3y8COnZLcZZx zp@py_AVfo;v$nDLfm@KC@(AdZT^|G5zYLr$(9117uldYHWkQ35CKoUNJknE}woY8m z*Ri1nz;>GSYx}Zi0Gq(#g?C}`L!ZaS58sO2*R;k!=);U~%AZyIR4W3~7@c(liyyuX z>1mIEPFXfEx2!Var*14bWa`UsLj*eO2!`3VX0FYEpXS=W^l88b`)1*dAH5B`uRgyt z-P2ngU@;(%e9MzCeEt1ceAiu|$82Nq{dWNSGM2wCMh-nz_ML3K^JDer=kAn>BK_RF zZ>rZ2Azyz2a5y1dau_%vBYpW{;Bb=XR`hY&*1P|C+Ez#L;+wa+{pvo8di;zYzD~8% zR`*n@U*jH9Qex(rDH<&vrqaCp?SoL=5Sl98GdWK@Jsmi*#yK6CCtYvr=X#8~8>m+h zv}K*3xpFl^CWiXaT&u=ztzuni3Nz1p^|bGgqTR}2sLFEB$l2>v>xrH3r^Y}Z>M-E0 z`9jB%rm*$eV%DS>S=9rQ6zHz6=_))lG9&4!LM-9XN$D=8M~-1sC2LU8?Hn*7AQzLO z?PD29DyVR=SzI&jh37(-9s-mSvhHQ{EI|R5n83usm0kI?P$9xfgO8w&N!@(xXJm2F z=t>V|t`(eEx^+9`*D5t0(_~Q!2KK_r5eRviaKc}oi4)#_79M=T&A9(NZ@?p8cRNn} zy^E!Ree%`W|LPi~LqkCT+rV)My8&pdMoSTyf!&1751))9SKWuh-*7v4W0bIopj+AAijn&MM@E28dck3~p@Ue>62-VUX01T!uDZfrc7;^?|HX>ri0HYTr zGy-ewM?CsV9|!MWV&h$>;n<&lf*6Rb=P+RA zGS~xMj(>VK#y>q90Aulkx4;J-jEz@*4(TZmWBKbBVEL8Kl=sb`Z;7JrBz_pDy^h{v-2(acK?I z#>cD?V7JU`+Uko*I>Yc|N^hKB1nd%)Z#o@|m*0l;b@u~i2<%0$6M)@>@xPsh@xPyj z#lO1)i+_IyhHw2sF$9$NZa?!YfI}@+@>B_EZ5pGOorHYd2}sX*2#Xhd0ocsQ?>G_I zCGWbo_4Lb{G^oyrEv<1=?okzbX`@~{J~n?cuouH zJ~P=s{eq^9?NLMAyG|VxqVT9PT)eW_en$PFA*s{(m9SIi=R~voqPo$0vcB$?mRvQg zYw5GkdBD6%Ztm$Q>e^#_)qO2DsyzY??P2m$OSj$cuG}cDT6$JqnoSqsERhDLXlL<| z51RRhSk7u1nrf%LwCrDXXtB-jV#Ab}d|wsNm&tIU%5$;ubJ}877yvV)I#7r>&`(av%;9lsYijXP5IcHa_Z9l;7^97!C-KnxS zKu?{;jnenQJnp)Q+D^VjBHekd@TfHmW>V^^1}ugJ#MrVpIL0z(aE4FLe4d0K(H&c%A$fo3+IQpNweK#QjG5J2VDW^-Xv^9! zx^oL=@fv~O`>uE6-gmv*s_+$#vQkhKem-BkoaxRjr7Ml<^FJTTF#%9Ri^Z1hbQG7(G%Aq)#a4&jqj2%9$qXl|MuHH^R^z}$?jx* z-J4!IhfdTuWc0_DX8!fs4|8bN6}|`fDzFH}6Gu&v1_@#AQ^XNXi>?O(r4M9vuKNCq zyk>P_D&y=AZH%I|&{o2Q9{u}XqhY+)X~L87;R)Q+8vaLU*W8Sos$oY{bzGM5kR*7e zF(-a_T*`a9=$C;htvy87&nlYjdJkhsp3*p>9=b>??XCXh%pRvtlwA2X-3-Co@1A&T zoq|k<{N>EdDMSbV=~O;REPCU zK1>>QK^A6JYV#EFY&d{!1}?bE5aYr6R%J?CLA<6L3{*@@i z$G_u%19Q?FF8}~M@Y2s>dCp;s$1QQ>$q(YbSN)SVR}W59-o?<+T=b20cs)Fx0XnLZtF~S5a^N10Qkr>N7%0X&SkAV_({>4v& zo^%MjnZXwyLjLg^r0v(Ai%5`h~Th+ahSjAA<#)nZ2Z7&ol?}?8%<3sU8OjcwjLDx{J`z=g$+O7dxzr3Hp7OC zq4<%_=pJU%j%)8XfXzSnG=_iq0O+J8u$8fRfhy>Kb&3}pe_zIB@ng4v&fk%+o@X4y z=5KtiQbKDaglDF7Fp%FZ@X=|y%JJ^~)#u~uBm{5qIHGMmg3aH&p^u|4RZEQu zrwJsZ=T(||RSwPH=KHp)R-u`*MS9=%VDX<^?%VpP{oz_mJ%+vTtCb39YXq*lBCc1w z2Ra5pjAf4%gm1WIR1@v7!A)zxqW^o+#dhq2qC5H5tGcDL4&8XwZ9hXFXXz%)z3So_ z#jNyY77Gn(d16TP;3<5PB982x&$$lle%~RKxnXk{$w$4ks|C2wgZa~9?@M;Ivf+2K zjXBOY#f2Ci#U3?uFrfNqDsXYBqFu0wMo6!d+&s6Hhhngl1SUY)LrO8Vc}rqmH&?3@ z22V=l`&!Ky8OaRF(jO+!x-|J)^b=-=FeyI%J}5Ca>ZIswPO`F!{G*A07DWZw~&kezhzCN^$79=jJG z#Kw)sWB9_Bd)dK^t#_Y}lYizC9DKnoxbF`>05D92Gm^9Xo4}Vm0=9Zyekq0zo{S}DIhZ7s6l8#T7pkhU^|mu`_+>X?{PIU6t>;b0 z;`o_8GYIuSEgeea^jj=sEXRI6LX9uEGYAY;poHB-t}CBt2JRTu$j-4H8Pz zfTG=>eJnP9@LzUb{EgDq-<(o^5MbVS{fFda;rE@0n&!e|~^V0`;2Sibs#NtyoD zVM3APhimsgT!f9Ez6Bevyh&24{`DyUEFb@BMN^o*5Wv2VT|b5YpUboDOP-G1pSlnm z|JSY9c-76Fw(9owefWAkd3isUzkL??!47`@=|cfOCu8}G=l8omW5_Lk|4b}ibPqOO zbrUcU_>K)MUwe+E>r`4D|Mn!{<&VMeJ$GX3&p#o&^kc_j`T7H;(yCsrp9Q6a@7@G| z<`~eI9R`2q7|j?}ME3ahlYk$*2*XS6#@2uPl(uyYmjCHMr&BmeCA5c!7WU>@d!ldX z-mDTfxmu=Jl&vacqNmWb_Yv+&AvB4@O}V{+REPV`6>7dWjfZd)_-K^cp3}jU)k&Rg z6m}0js_(hQN2qkRd)&c~{IA52&kRs|NK5oOTMP#UxaNSErR(OqEWKbr*rc$iL?s!Va(W|L2$0bI1FWPM>U5cKXyT3`TT`TxKCXNV38!BKY_(y8q~Z~ z90+M-p%(MN7?*@Bzs0irK4re0LeKDdDN6$ zp54jln!OugN;ng6CKl!?`Sj=rD&wNgX<9}dDpFj6NcZpUNlTcv)v0=}$x@!D?_!y? zpv(#BM&itAgw4;jP43C7-3rPEmR8}JYj71#tMLtR*@WS?|1%A_AfjpxPJ~bEwX`{D zTzpb>7?-1^rw)93E?eKs;CK!<)6t)n>fun;6)ODKKd$EI(O)tA(d&vrJ17Cb%-oIL z>fxj9c1NlA7gb%Ixx^8^=G%z(r~&!2HWS(0{G}Sm;6SS4u_qlpimOtH=XgwnZRW8l z2a|eczUi$Fki~L$Kycn$UJ%eY`KUavijs>4wy`i7&;xO1+Sn@n%By`()-|d~VL?d} zmH;K2Bg*+c;&e6M(|{6XD9X33BTmj9g35UjvhBA9Q!<^gp|PSnNoQi4Mt5Poq8vKv zvR&Uqh28KE^025{+ys7G^;<)KxU6!Fx#-vIx&xI|sfn;VGDenvRrM_o33Ga(-Sx>I zbV%1)BvLvYZU9w0Csq?HqRL%*VEYJFEQssPvgc%tq8S+3j5R)T%@IKl~M8blAUELhJNdv?v z$yf{tlud09GYK*lB>2wEK!&6^ zRqn`<>zJbN2&>1<{u-^Nq#2oX6Oas}OfJe9n~MQpV0Sq>?Gej55wrVv4KEwGV=1sboHP%37heojtZ~ z^{y*2xmg7pmBJ={*9pYl)%%8L?gPK=ep`7DE5PU5XXwT{z#JH}!hq@z=TREzF2V%_ z!kq%rt7Zn~`K!pOy?w~D@A_c|sQcrxWTxz1z=-p>DdtpWG&WoJOoJ^gwav`JX$n9P zmJ^`0!U-Yh7;vBiXI&A9Fn=drNiKg@&8vtKvT+~;Pf94;gLTDK8P-S19jorlP3Qnu zw+_{ODx8^PXvO7pI{7jC(|)*8KjS=Vol?AZfSRkK^)mjfb@_o|PzS2&KV2NUSSzy4 zQN^mqhzlGZcI-3)pSQ($40O(=Z)FHMG;2zo{xZWOLKz&a<$qCrQ$>;l@>Jz3eNOJ^ z7RRyBhiKrkrM19hdnU5#UzEr<7e}3Ha&<&&D#$XW3{`AXP4v>UxXGomw6yY=9uklZ zuu>*VW*GIr4yhbWHK^B~^BC$T=T~vVZ;YKU_>+m9tgX;fv(5;O%*$myc{CdV;Otp* z5|PAa>G$G6mt6me7>P3|j~KvMkXTk5q#K2yt10@gY|I|9%o!UXY$#DKKz?$sAwDI^ z=5J|9V@$p+keTOOPRf&sJZ2*x>6{xxK@m@C!I0udoX4dOGKLGrKuJP|GO$Sl1}=sQ zlf?Kl2s@mylQVYnsA2MjBiUSuaeQMQ9iEY8lgsWnO6Uz_Zvx9nYRFj*=SZoXU@agf zHz3O=p06hwQNU{Pk4B95R9HTA`7TPl!jYL-| z8Bw5>M+O}=Wy{Z=py&y602&Y3y{Ktp-L+0Z+sj3T9=i3fRDy!i5$4n!TvgvDb+1vZ zy04=G-bmbT+0{)=tLV^3Xtk`I^(yH+Zb5Tix*q2B`c$j@w~e>|R@N|mN3q}kbFLDH z8~~bY%(~H*u{qot57qs&Qj zanc9`KhSm@5p`e(VNPrWAQ!e2k`yq&PKC1!EycrcK3tvdGMC9hqs4=3c1WF3Q!~*F z;z=$sTP2K#wGBe@RRHO*2rx^%Qc@|3rgtvexWM_W@yS>=aKS|$PZF1mk(FIjJhcilEW%05L zo=W)JeeC~=?llcH@3{Z2Xqpw>OsWg0<$yzK$qy9XM`9@gz0#Px-MXS`UqA(N+Yg@H zdb{y=C0tA0VaP(;gql{GdSkW3E$H=SpY-N&HUGo=h9m|2T)zXV@ghxUs6e?gRSmT( zPYtb4D$bY;?4$!UeP_7M+#jzB+0=Q)4Z698qf+jGx^t0U8brHevc#G@zv}h@u3N=x zVwie^Ex&5uwGvK}eOXgsG&lvl+>9*X$*(EFO-Rk0x#l@%Ne>EQ%?n7OY>99%PqwvW zPDvv2)pzqTx^AlfvVxXv-ia0ufJAR_eNWPwGK39V^oGgYq_BC0MuUc^?zNL4Ioxh& zv~&ndiO!H!46Y0h%Lrt&=V{oJL}B=Nv4u5hCx=1m%M7FimdMD+itj-Fs|OW}^1L2Y zuR;4Eixc(Iks(2p+vE?+(uyJ(5>8TLRgJ+Hf_1+&nHSyYyciLt$ zn}B2%moOdD1G1c%r6N$oQ%_|eY>ru90DxH2m6w4gi?^|Q$cDS@m5?gUQY!|JpGMpW z;iPys*_A+8X2EV&OD~V*kTwFa0m4EFDO2!t>0BE*BO$plXCw)-4b&38G(u8pCKa|L zv+TPLQAna+2!4qnC-K?nu`zg^G`jiOr-;c4DhGWgUClqoRX z5$>3w_GA|gn?M20!6&eg%RY(sJ0RzLJF zxfPkEx1nQE$!8&y>f2f_#nL?uz{(f{OK8oBE`wNib={LQ5@hd{R)2c3ue8xqAUbdu zj|$^mnR^fCKA5R& z=ChXEY9nB#Dw-kFsv@Xdu=!>(CmL8zL`{V~#VkHAv|59)4mW5}#D!V*KJDVa2iIQS z1zuuvA}}NF!Z!t?GEisd*36u3OI41UJ&bEqzPg1efXnsYqq-Wzdlec$ZOTLMJ5&4s zm&aD)m%>5oHd-=bRZ~oWPmPdC9o@%m#pOrg#^!0~ihNzBqr|gIdUg#I4`VlSk<$z^ zUEZnC^)CR#(aR54fX$1aT^SHySi@^v&k9(#qH&*T)ps^oTE?%i*<#$*W65B1DpPr8 z`cc$XV#pnlhU5pwrYjEtHp#{*FsDS|F@q?1TKlrrQu;x_#OPbZL9`NNgILDUUz?Is zFTDq3lEp5$%3fp)7i5&pKVd^B3+pt`EX6um!g8Xq?gPQ1z{+E>{_F%?4rNFugQcUg z-QGSpfNxkfPf+!Hp+p1o|@*>DdJG@q!YTKB0={H9$kNj7X{UOFa9fefP>W6DIqH z2^~M>0-401C?r{wcw4Q3;?K?{7)cL|(;Yy`#u;jGvC@^r_1hThxFus8~e>J}WChUD~GD+HmASx+|m zm^j1eiJ5|yS_<_PjGjP`jG>THT}QXk76h(exlm}^i=R{TV*c{%RI@N)N*Aljc3UKr zNkTQ8QF3`FBJx8YbpBL`tl*+DPuBrjK^xkMV>x4NRGU=SX(`47s`0UJ8v5Pyb+qM6 zo3YuJznAK%c}iud>~|#ZfP)D-8mF0m(8JqgZc)n)!jD2nt_;M6T738BEigr8Tp_8x zq0T&SQX$XKfyjh8x@Bl5{z%mo-I0rGLAS>u zDewT(8LY7BE|zGf(ux9282(aXa2CD1IJ3y>Nks109#T03*HVaZLCH^W%8j*d7# zqLSx|x!2k-6KA}#iGvW8wPqj*h%wt}+tUr41<{fX#x}kREUK`xdAQX;0f7efoagMF zAyq16PFtU#hi0)4TCuz=1V|J+Q?$(($1-v`-om_ z4#q)Jbc%q?1U+oc7N9j{D@gYkz%x2Q;j`4FNMca<5~HC<>BpWq9aRk1CRi;yCR5+) zW|JXulax*~l}SrVOUvaFi!=a>0lUi)2@(QjI049yRJT4(7;7+IodE=T^$bJ>&{~gl z;S|^qHNCU%{80P!CS(^d5aI-NyXpsBV> zOdq#ZOhYKBjN7XETE^2rR22>0VtL;%_1=dq?k0fSJF3g|u8CrRzz3!un=I?oRu_wF z04Q>5o^IOC)3on1PM^I^rOy29eYm2Zm9H_;v_ui|d%Jw-dV2#p;D+aH9%m{KT|wmd zF(!Q6o~4GLS<@2pBz!XrCHSYcG0 znPE~qxCK9E2|E#Z-vtOsS1IMi6Q8^+*#~6UWGr)GHA$5hTSAhIHA+@aXj0xh+er-v z2?LV*1tmWmEN6Blr%aZt2UGwV87U1Y3|>CUm}yj%4?@-^Oz5*+V)?U&`$#q@vAT(6 zMPL8{ivd_J!=~my*C|P=QO@qE2rY^t z9cGHmDfq2$F#294*n%`H!CNSQyNWi2?%Ox^cTO`x@o3LT|JJyi2)ihtW;;UlqZSOB z+=S12h@u(?+zkD?%Y}XXAke~$Av3#L)^u@V00OJWI~FoYzoyuvtsu}>mMKCBaXTrnxdd_PE4UhwO@FVZ;Hkdm|fRRkRL9>h?so{X6M=vG@7Z+Kz= z#rr5qVI{8&4(5`Tku=MqB#S{|5!Mvh;aHl=T=k8VsGPH;-^mHVx@XXJ!@_fNF3v;> z@S4tIz}sGef+~T=c6^vfG1+bXBB;_I^@~QISI7gm~h90l;=J7?egV7WYqHpG}W4po0^vz>+kNzFDmXhY<@61P)nj z3}>>3NmmlQE%vm1tQ}w*@R-vcfW?^=i?|+-fhCN}2w?>DP_P8nl%8g60k*Hh41>@I z8*iHwEOqB0VUfudQzAl6fNio)wvl^CNV+OvyYjQg$cc3-U6pvh1(F=v%Z#L!a|UA< z2+MA^hk&ZpgdG3_YpPHHr27HH3RkmPmH%S73k^YkrnupbpvrxjAZ4|y7*LsQ6~IE& z*sXEKh(R`OfH})*hb$j}2N{>8&T>1O06Jb^#xM-X^IO_nG9Zba0UP)A zaDmXb(5a5XMxAGcne|trL;XDg73*u2i(c7QSfcc&|E=+-w(%KdrIl&MsAs)d0@Gyg zh)Xl!WzqTIf_1LlNnN2U6P>~om{5k}H>7kN``ZpkS&=NSCx{4r>R+{9A21$;voWW6 z9i)Ee{o~I2Ks)w)GNdX)^qu#haRSXL&a;aVvt&A*AO4JZ+P}FFj%J<_LX~k3X@&E` z_oIP2DcI|3q>tWIiT!Yg05x+q2w4vIvBMR;wm7PoY$;Q;of;m3$gbS$Pzkd&8sJ$T z6DtgG&dvEax2lQP`IefG93PYD@~V%;e^bVVC*#nTS9u@ltmO-HbnEX6zY-ei5W~b+ z3JuNStNkk(BV8kI9~`Ch`ug%|q%Qo#E{u!CQr zGRe@x7}5aBSsb>Db&vOYQzJe@SzX5qr+tI;mVh{VBF15#Iyagn#_ zT_%46Gblpo$~v3K64b)UEF^nx3^YKl@RMig5!gi)%^@zoQjV4IY*Y#4hfNt>+rX!$ z#mcfPy{_;{C}Bnkwpn*56EQS~ZBRlCq z#(~v<8MB_R0LGwwF%LQes#KRKTI&<6Cbks;VMZQOWaF6v%^4@?TxKQ+W6F|7RCD)k zEf!#?#hyoplZJ#NyGv}OK};asWQ-&sLo#0Msc{7c$qEG$+8c8&6I;J^-D-|;N5R`F zrp+}YF6(+{3$19kg=0D|zwPh2LFu*=E2MH?wG%#E!!v5A+XkinN+$@4t;t#E zVUvq7ftMOOs-}Jq*3e+}xb52v9k}Jm-Zoi+5&NXYe?SL^dMbUaYMXtI8-Fu>s=Nz* zT$Q!V1z&(=?&`j?HiMoQa8qR&>Nz_0%3lLNU}h}IvJsl&GL~uhm%-tOgPNl^3@bsD z=BgXyx~fG8lztVkh)TF~gw;c`i^~@UnR4eW%wV$6Z3j9k7@fgGsldI60hzVTGG#s}UCaS-^V{7@Dkd46 z0fE5 zx=O;z97UNg6Ih5-41`RwJXLxE4>3x5c$^thONc=gpc;BxMXM|UL4ArxA>^r0qSMz zRf0W!^hI95c;e>o1g`3)QBEd>c{&7DF|PhV`QSuX>3%zHs{5>Yw=%?}BZ%g62rBcK zF+3+5zSmxzw&$*uWW7e|`BJVqg{d=cYiC}ROKX}u>KW926yY)jAcP3)(Yl`~=dpOa)`2NAb65ai4+EoJv(ac!J z$xo9mMBQXM&4MN~RXuve_HfO?Sy#?IT((7RUaW4eQWzN$3Y?Pc6Ub1V#YDGHGg*BH zLZkA7w$N(q!=H9FXFL1IO83w1V zcDR15aGL>OM$iZ`21Yd`L@6$U-u4^-jDZFW3E-Tu!z@ZWTZSDD`(KL%%OUQP&9cu5 zozfw4#v%$1n%TX|N&?1JH&13MDJn z)$`WQtuCzdWLw+b{2tXApMWjA#xYxgkIwJ-yw~n(Sh}(CUBTCA0{~*$xb+fvUgWO+ z#%{S8zorOLgF72KMr{yuwTvlGNWX3a10cq<5+^}%L8Uc@B&2_p<5YwMt ztQWPQ^+Zs@Gm#x>I?jGW6>D_%YdVlNSZ6H@G`oUNx}(QyuIF#1`@~ma3}+J$HA51m zVuhogeCXE4n4MFTi(rblrR`=0GLJ~Z;G15(Y`797=hd!5x(u(;TTvdDFmn(i=+j<` zLmz6{&%O_KZr+(Qnt&4WLvfUveVfq{)l@3kCCjQpq&G@(utL2C+hv8hcp)V9e8qA@bGQi*F% z;z>prcw0F!1(D@hoFL5X2acswywdWy_A==n0hixYCLnANMB!vfPwE)69GK;kiX=;t zX7Y5ezbN(D4ZT5oAqTT*A9Of~?HmPx(GLHxObSU2vvOF0Egg;+Fz6}HLg*uFHmFo~ z>PKa+OP2&cY0c+h@CHX3b&rBF4jDSz_^#h;2Qo{XAs|MOFr8HC%_9qp3*AgCXIn^S zrIY~TEMZ@^nL8ytV1?umHI|SqDj++lN1?JOy(0>t9)mv`<*Zk)-|wNGbf7Fk;b3Y5?oDi?Hk>=GJ!QU&hYOK3p1nuif8Rx#v z(7BGHA+oA_#=r`^O<)T$ZBOk+Pv;C=El<<$iag}1oO`gHA?_6zyNpL#Jrx6~8=9b` z-6pjuhkb7)#xQZQ`4B2Z*?N~xxn$W~p4BY&6UCR-q6 z<%6nrRJzQi9rN~^{#S;J%iro?FwqfhHO$?GO&@>~iBQ2_(HtR}E(9RwQB|0-l4a^7 zp`1&#p=V}|APFCD>5wNkNTL`S@p2VOVU}0%NLzeU*(7R)gejV?T%(jNbj~DCuZ^R3J(}yi4$Mgscgd+;xUsm0^3_5yW`~)Tc#{oc8qWp?uD)n zczRKWZuo^L?_Q6VlO8}i-|o@#sZ?)ZZLVj0ANhO z5gsuT>Dd8=<&0UE{HV}VX0v=HtC8$Ouv7CSTxQISr7nYwIZOIcg0BpX<0$ov8RJ-1 ze}H1F8Dll2o*RmlcCyyTAj^WJ-=#rlGJ(Y!S6n9HCP2>ENCOriEQqj3gdqV7VhlzP zIspc<5mb7~8H3hEMw4MaTAZBg-8P10Le49ftC&2M8MyY}Dp}BJBYwR~-j`QxTTv>a zk&;c@vF^(73Cfl!{)#Vd>+b^vcZjU&h!J?jcvryR)q}z}J#@^F&50BIjML~Hm9=Z_`lP(X1Y8FX&J!ly+72ObRwlfz z;Rqbp&(Yv>EuRT=5pnDAbqKI%eGbPgy9{;5{fsNS7D2FDoIj(3XE>^hGfHY9Dr3M# z)9tr*A9MwZ4RvuH>!31kSMcUZn|pB_Si2^#P*&*)K%xPe89SUYvbZTn&8j#Ivhg?W z$;`~ic?|lb!W4AbiU$xRIZK$bAo7D(K~Wvc>X9+C4{K4n>@$axg}CE-*lk>xB=odXzX==0N38NiH1%Y0m3 z+6G`_VCFUTB@G$T%9Cxw(KKqtL3wV7=@4WkBUx#a6>+v{R_!d7l%PqOm~A@s$)?Z| z2uukB>1J9pv&}lJfQ|6WX{;$&dx$K|tK3Jat&3L3Z(^Uu{DUUE_5G_nu zEiio9L1kjNh-qPQ`ejlTSPfSUQHY0>Dvv^8XllJC+3*S!&pzu0W?3Z>ijj$;djga> zCbyzx;%3eYuZGh=4F{Cdf(K@Rl4J$2!)quZS$GXYLsX@&qn9tER-ZVH!i1Bs4qL8s zap20A8hMTbp|cFzKLI&=VbH8ZiNf(ZwdYtilv}8mF*!nF!bk*JyOI8EY;0g$j+*(1 zft2(_Ks#wsXkf8O;Bmwz>1H4ha?<3Y%D|Z5h7Y-*2;qCx#B78u*(RtxDujh6mf!1g z#D_VuqSWM?2Z>hx3==fGZxx9d-m?~{(q31=?p53BAd_!e0nyge(MGIb+m^Qxf$aCQ zs6BhYgO9TbxPS=%U4yWJzumAb?GS1J-p3U_(jk_3(&fYTcQc_)2j;f8NrI< zXY_@P_lR!~Fn1M1!d|@WrH=Sr50>5)ct^u0`Una4-j$g?x_s}$QJkOT)y|G+ zn3E=Bt6FJ}nwntLO0f)e&oo*6j%;=U=#&w7)I{t2Fj#f*I`z+etNmBW zt7NZwjUFT#bte!1W%fOY$#owfr9r0xS8_d7#+tP2`v?qX4&g}%krS}zP#rlVhV>X+ z7G)v*wYgdPV@`9?k6K=(`dOnJ8oidH76noW%+FX2cs3)#_YjbsWtBk~g1(35ru1sz z%ZY{*wRQ@~WtMoz11YJIr11ooRFwj^bUx?On5Aff4j4y7DkJd49tvOvczwHvWlcee z-H#})kOYHOM#@f{EqU9y8VH~0*3Vo*keG|YU$x=mWL{m{;LFZnYD1_Dvc=$ACw%XN z0w90Nz70V0?`P#|fItU&bgUtug@%h8hVh8GRfH zBu33(vHlEMY$7#eB(sqndrcKx>Hdbyuy{=7jGT=gG$bhl7*KNW`YKBq43m#ZnP8$| z9w{?%8q`w;%Q4?F&bH0QObgai`j};t_U>|tAr(f$;3~t5;ma5pID<2=If$Vk=OBoY z1ro!C0boeJv?m4#02;BS`ww=PBQog$Dncn(LVl0#ndorfS?OjJyP}NKC8Ij6xZ;Y= z5W;u%?TV}BZ}V3@W%Qd8YFBD7_>@O@y#eM{darId)Y(4jO5^!zsrga$X)g+sH7wtI z6Rq;p;;IV-H%|)xUwIj$jY{LH&sxRef7TVii4Km4uX@!;`Mq~#FLcnqx?h^$pn$8` z{)!W0sW%pLo;+vb0nuMnHyCxEaQh!O?;||(^zYqX=Oyma=Zbmdu!Q1OMJ~mrd@vNL zV$ApK$!^HLQZm{)nrHT1LQrx|KEf4E3-vGs6);>G5 z9*&t0V*mCsk6fIHO!g4#P#uLaG}+49CzEsFlCR&=Wfohy;HEdko`{A>qDa`KptPfp zio^B*03ZNKL_t*gh)Iy5w`!Sex@*L7(H}sjUzPV30v-_&o#N$joc$UN;`dsXb<;E# z8OLCxAt8^slqJZf>ugvJbw^^>3A?C-r~;CL=NEuxWQ8*UHhOGyfCSQXisqRXAbLtl zJ3!_kmd%(`#uOEFR_`n+@tTtBC&y{mi(*Bp(1~&=p4++!pL{Op;mV#dAYYOtC5XWE zEHuX$VIoW7L#Rj~vlFpL8o||0*kYcYz?-7CNO4@0x8e!+{RmO!p)f`BdZ$#B^=R2z zk4F|I-;nKR2V^+}WFXOWNy}LrACa6=OdwE7y5B$;*&-1%fD2>8BN>b(%h)WSvGHt& zcCm&92_Z}BeU|Ve;arL}2Lcj6BzQ(Lh7YGzNyo27EQdVAjl475x$#0&Hlv5jSS*vk z>}6S2OspT4O@N1lam;#NhV*09P3sBJRSbhg49jsGv5^2K+dH7J5ik;glHh3cW7`8x zxB)iYnt@aeNXz(5@I>L>@ov-;x)p{U0WpJfe@!*$@k5t?b64;x72ei?>wlPr8ij2~ z388q;YhYjhf;)FbS!kZOp9j}st8}gu<<*ck?aV4vd(}+8C=J%^)$PUk zvgfI~dUAQ!Tuz4B)NVfKc(Vck#=OVALTlg?j`qmU3M}(B3NU$b0#1b;j3||od zhVorIPOd)z3#qI$S}B%nLqV=M*+x^KY=AIj%q;C8h42U)G#$i3Z0vxP#@W9yChv-# z6FDo>H(1D*OUf{a0-r!7GYql!(@wDMInulaKS)b9^9r36n5F6Dv0=W+0J1<$za>s4 zt}RM}9MEOB1mMPr(2T7BOqaE)F=ShI(n*kcLQsxbmJ@+xDUCGNtc)?k`Xm!DWr1mc zoFU*?N#)#wYzKBItRrQOjUOb&&Ma+~I(8wR^2)>P?JG^BR8nZBR1PXrI0zi89fqNFzFtl#jik7SlSZY!;I@yO&S`bTo7{Uf+l`0H5@I&yPopBMw z@Us0nOZ5z-#FA{rj9E_lPS31R#*=h;A+ekxVV(sd!g7?uL}YIQumroz94qT?!m*5m zRF058uZ{IaqS-w6NkgF`>i-SjdRhA&=SfFUaa%`KPg{CU(p3^alsgK|qV@iBbHlNm zwlNn{5e0W$Sp#qHs^?DCg{od|y4#M06>E&>xt8NYrRfr4zXC6N>CzW_Y2Urt7NxPx zIOLN`;@ZYx^XpKgV{Mmx`G zrtvt{O+fp7r%lr>=F;UxPqUVs)i5XrooXpF!8dzlG6%08y5+&s;01S%- z#&L88L|hC>=vf3dk61SeC4w_hV^mogPR-TT8#~)h&m%R(%&c*aftDJYiK6(r@XEn! zxazWYEB-o1UIECUY)Q|{0h+NQZol)_RMdkB+X`)T`Eb)tG?Z3Azjo5B2z8rW+J7p5 z0;ps93kC{OiNw)2vN$NMt5u}M|4-X{hg)_O_oBb*we|^gq~eUG4QLR=q@;m8R?oL(`WF)phfTHG#5{MC0p2WZZJ!714&0+1Lo5Nx%^9W=&}!?`FVOH+xD-55Bg8%UStNRGA! zNcRBuc)3knoz!d}9ns*GAH!d(uEI+;<{D=lv|+OH%GKv9q-FiHdEn?yym{K!zcvhg zmAV3bf?OZ;<;GWK#j0_G(1)|$x~XUI+7hAYVTozKWn4PE_DU48xc3Yz2Yz3q+D+x&AcP}<|!8LqsKsRh*dpY35T>X&h1U#>uK zw_g9g6)klNpHQQGrxZrIyDXQ@@1@~%FYBvDQvI}UD_lKOsF-5_rqax9b@4)&<{^t^>RCPGu#M4?OZ z*-4R$qIg2Os|s2INff@24;x|es#hfaESRN_c}pJhlS@MpE?6D}*Wp;3!Rh2W!g3*x;oCr-Z^z+^mY1mc(NSHpQ%n2+8#-PrtE~e{}geX}k7$-xA z(!QKZ#xf94$=`@{gEyJb>!Gszvyf{()?V~(?Wm4-s98ryzS{bYJJ81d63_!qSa0ozDIAf zhfnms+S~B>@l!r1GBM-IkE;h*KUJW%=CREI)hgkHRv#elJ>SQkdECq5#`TMoU*I*MuDnon%^9OlN(o!oYDi;4!i!1T16@3-4)&66?wP7O27$e5xN zk{*<@^ffY+!IWi7A4-62CWh(*3CX%@Pi-VnCI=@b7R#zU+4~lr zEcK=^XE=Q=)g7CNkn+?+^@yYsW~a06PcY*^*GsBD|WqfA1zI8$BX)#gUh zc*%zB7^Q81i7+I_02OKuk`G_@9uT2vlI5;ea;7X!AwWPH2TH_T0T@I=4C$2Kks4nb zX2xQKi4hWGlvJjQvt+pGCSkLttB?;gbC)jjX^511aP$ObUC#7-0y1&BctHPL2EfKH zu+0ggfM%rmg0+63M;ZSZ9rHBLfV^K(>N}^+$WxOOI5anx&Z_`nZZwkcy^QJdB6qv1 z66#E&+zk{0nkdf~qct5{IrYvN{jO3!F~$p>abWvr^Dw)kUgWz+q*X^4 z=au(GyrU(mOCE7uw3aqk}!Xq@Ns*qHe-@U)AXUIC{? z^;BbrK5_d=r|s+iGG)rX$TS7B_bNm)tu4YA3IPMydoEuAmz>Nw+y zkyo{-4==4j?Jc79vAf^Hd&(Y_^?2pYGs+^FRurHUV;`BI}mZt91Wlf=+o?-Ukwq9e7%eCjJPzhrnnw zIvcN&N%<+t>nBwrxMb83RT(3l^TAdF8QSU z?T+>ly!U7ruhp5Ogz98#_S%+ug@USes5e$K{S^Hcgb(UEDYQz6ng$42VJ6vYVD-mn zS$=%j4@99O88|}TAEaj>_d8yPi=vM#h`2f4|lvW!Z)AAuPl zIb5ts#sNY|9{;EZqq)SW%xM(|>H%bs7;XtM*$@Nkfn}Kv*sTNzV3 zUeOz$I!r_)hO?U=G7l=25T`1bkr$hk9V;=!wCWWq6rMDln)wKIfMnl5j14A3+R#3V z5fgR5tevm!gmH#EKRTK`$UOkeQ1$avA5;0;nsyV^pJE6#CS2#*!fHNv=7o2RMDp-- z6b5n%`nY-(Zzb<5Jsdj!vggS+b5va{YfbX*7=^5;xUE3B=enD}(~WsL+EISAw$@5Q zA#{D+^MGnEb?N1(BslI;_ShcMc{P*y>$9s@M>>Xj$C25%I^8_%;z7pIDn3Rm{UY6O z_j%mF6vOZ6p$DvT1t!b?e4EO01+G+{0u~C?Mu8dI^DvCDW6Ak{r#l#o-I~gI(b8#( zIiQ`K2mkZ!UDg+UgO%xNycZWeaJK1NJLlUrZzQ@j-b3>RNvXaRl+Q^V zy*$h9=LSg~n)2I1j4j1{de@{L^@GJ0#*tU5yyIC}dxY*K2$?pmjl#`qkN~I-M&1B(gNhA+wDdIlU0(tM*zmtH$m~MBA(vGbz19=IoOg3+yPsJq{M|_h6w=k z@T$q>W5<%ET1F>UfzUK;3ZGhAL}VLpbDGaIfFO-mbFtxoS&5a@-4sSwf>|@h7_)Rr zFG*d=SV4-vPY5?pdq+?sWfB6D9SEm&X`e}OqANSh0Gbr%P8wPibFQYk3btCou|diq z6c8!x6Bv@5O3a#x2|yq@;7!AsQojnl5ON*>%V~mS3xX+>K@0@lxNZl5F@OL|Wm^SU z+E|9{lL(aIiY# zqrx(Os;ZJa$q5GpID;j%(MTpCi#-%0AV^0itB^v2xUp3gAcet2?U&830>peNb9ZvN ztzC5#L9=W%WREjJm)z3$PhvH##tW}Ri!0Bk{CGjsTeL?i70=xF?ADW8zORlmh_ISZ zmLKi>wW6J#`&2aFmj2@^m`C$yS7qhflcFdsO@aFqDX^mdGwtG|>G z`FX~pTh$u}pcd{^M#g!^4S<$>>wqG1U|xbi2aUywiNOdrH^#x^3j4B!7u8L4r$p#p zx*{sAtNl37cMmLW!2J8FcTiTwV4EYkpKknBAR`0VjwI-Rr+}(pZ^d-$;Q_sT3ye-W z(w?@d1huFWXp@)dHpoL~Mu7_Nb_I4@l&_*X*FmrEx&GvRnqxZRlyLiBonW0;y7e#^ z4QB@`Bk4p{NbW${nFy+=g$x&Qg4Wa&8q9t;>h#Ai{f=I~$n-5;?;lDjs9R-Uz zZ@o}c1y~16Y!7Let@BwPwb^d|R(jvr5JnjTWlB%a5XAeHjR4gj$Y|@%FMbUGaOzX8 zv_23ioEcH7xaIx;+(hxrJEa9|DKmp8Y89oBlt3YQqoZyhcKrzsKT!U~VofGEJPY?q zQp`~1UFLxGJGYZZg3VKUjcu+3WqL(xO?5{_(dhB7pyK2{|AON6F1 z94c*UN=BXzp75gMZ*mmc`3+= z$+}mitzD2V!y3u3SyZeOjTLY5y~@njlm@G|Ujfk=%v9b97~}GpH|ZPQO9h@+GL)nD zyyEcLe`Ow%i#dTLuuc8+MgYLf`Iq$9)b^$oGL5^>{d>+ZbrPeeBE5Ww+dP_x*EZV4 z+V$t-tJCVQ4G)!YiU7;?$#}3U+ozRL`-k?q0HzBXx1TtAX~CGemtXzMhP7jC07p#S zeiHy-=B)D_9<(jZLeQpDlw;=lRNPkBMImsyK#7m&`r^s1kIGsGYo|ovJ*M)rs9y>d z0Oc0P4KR_QsHU zc5ccIQefR{B7?Fbp6j*u+k@AllOza~HpO{pbF@t_U7FRo;g#tUH?9tHb#(C8A>iC+ zh}@EN>^jaw>VHpX3{^V*Mn?JkCdk2TNluZmo0McE(?i2PQ4F$@F8x%yUG=t-#@Z_c zY!MCcv}s;{(VYe?o z$mz{GTa}DvYJ^?SzX$st`yfWk=P-D96082<6dd=pHS&rRs4}4maEPX2QutWm9On*{ zUNecacS5^ZaWEc11+oh|Y6*iZSF=)XSFx0uUf%rGZvX&JeaaKl7@FM5aE7|VsEL>u z3@|sGOA4JFlogxCL*%S=la2PwUvcFu_I>0=)VD6hqW^xLrOVW@V#%(fn|-wgRqBuY z+0BS&?Z<)_UW~A7!n&vPTPI1SUTw}{PD#E5#PjxJ?)mqjdDLD|#lY4Ds6V*|;ft%Y z(ZP)7^4%D{@?P-z8PK*V)bBqT;XB78+q4Y6d=Eyi%4Nd)Qklr&sb&UUu^aTNd(o_) z0k%zn-*+FkISyVR9q{OOF{c`9TFVowpzKg6*IS_kt@1 zZ(RU<;slJoxEg_xG8J(|bNOz}zG^e#`Wb|6Q<%Qt6b!y|T%tc2z~Ke^apc8YF?;cD z0KlrpJq|k1D*K109K?ZF-h;Vw_X0<1Ec@GySp2!QY5dhdR^~!!41!otL6j?I#-Oec zIi~#+vP9Z&_V5!&%sqB54qSH+M(d8Cx^EhbZa5i(A0(LdbY}qIDjmUIQ20l(;kvf_N+N%tC zPC8}^eNEq!I(ikYRBr00{|5lje0C*eU$j zbJx^OKT2PQ1l~D;`28gqePAv4p-E|iF!did<`+f;erSN^>&IdA7wdpSRkzY!xa8i# z2K9B@Q9Wr7X!Q{MzywAgScB%%D_l_>#2!4GvaDK5ONsNSWmmqa+e=hwr%>RJf>&$9 z(*ost$56$8=^}N`Xeayd)WS=rj!x;ZWhUOY1>ws5h+kWRxnDo2C^Gf)TL1tvXP)EU z8#71Rbz70_Eb6@9rxf?rQI_*MM~3kc=ybeQM;mPF!C^V%z5>T9sK4#(U@SrC11ae@ z{cv`!f=~5SXwUrIqGAlnKJ`~(t+bTsZnJHEtHoLcdr;SY&K+8A(S}EuyJ32q&y=c~ zb`nmRt>?y)?!{%g^^|)j^AbWn{8p>g15-VmrcH{T8;gA>FnUm3G4H=DS)9r-jc71~ zMWIo>uh2o$6+~auekXk>9}Y^;)qZ_3*Jt79ju^{T*AnLq=d|wyZ|Y@JsZ3xb1*EAP zZ26-fW6#sJVfBYj#~IJL0_)#;0rsE&a7snQdF(RMe0_afEh|dn$hz3TYF#vvkav4J zvr)n&yv3v}LAJ~~q--%lEyId{d%pay*!J~rVWO@v2mw_9>WWZnx+@2` zF733Jkko=Z{2Od*tFC=s?2QP4c{lw!-KZrBK3&|vn}_ZZ$ZMvO=| zm8PnL^r<4q!5xWUXJ3662H#kLh0nVf3!e38RJSh1@XdFidC@k*PjlKK4Bv4ZXzMg4 zuDJ|!-!z8T-v&PYkibcx(+^|r`rANTrZI8#qk*l{;CJ2zKJ6e#8N#Ut!Pnmg-ZG7N z^`pUCr$O($4b5o>&~U^Au^257ML(oX$HKe;$tooVQWLWWn}ng-YRGThgYfm`pl4qM z`jtySw=4p^w#W=wr# zeL*J{uLoeXau&P(^gl3KcLXbb^HDhAr8B&?F!cvETDg?}2bQxwZdQ35k+*IyAe9BKm zYW=mObEyQhxbr+pR@ihXeV%=&7&m1`>R3Se^ypU~GwT7-h+~|N*mKQXd=ZAPI~C!- z?Zd?1-3B^t)Gc%V#h7{Yg=jvp8uhO}h`}4SwqQ6)V-pb*ANo1!7wp97Jttx2vPWX> zH%~`+%>Hg4l-YQ%fBPy{E6|S{_g6eNWpmtk+T?Ei`5(uKT(D8*)NMb-)NMbVzxX_~ zWj1U_W7VemVd^8>e$RfZF#_oP!|CUFN5;eE$EpMH(XRrM`HTn~%W-hPoM_!5g|IGZ zt1~CFg62a#%1M=8nELt8F!l4Fbrn-zTlP?(O>^z(>UG)-(y`&Oc!S#a9fJ_1vD>Ho zyt57?dIhseMvPO)#w%U|Sf7EF(b^gd0y;{Rmg&?(8P_b~F+Npit3BUCZ;Xar{4Sz@qQ3 z1`R7r-nS6z{^Xn#Ho&?y(gB;nv4OJIs4UkfAr$Gw6d-3A8IIg05Z^HYhe0^~>ML>j zQ?E24@X1l~z;IF`btR|;6Pu=>N<5(o0acZhr-3G=2LRnHi-s|iPGMxE<-Q1*V$Ct4zV?xzudD+04Z!;=;C&~j^3UFmv?K@cbM8+t38eCZ001BW zNklhnXJhP#wMr2)AHnD@;50pcf4nKVdxQ%fDE zBhTD{IwX3nDWo$N2!O1jR6&eYq0>4L1|gs(!hnFODqsSPNdhJSOb{?#SC|R`6CtI# zC2lYg2sOd}CaQqor-f=s`9_{=p0L}}pb*TC*|vp|{k0W{axT-!M?fovpbayvcJ$jZ zD3J3B($+O|!6lfv;F2-09$Ot?LcDbmM(T|y>Wmsj%65s zq2}~EGiElOkC{#9cZ-UAP2KGRKt11lH+n&C$!mX~)(=4|l2J%2hoH4{d7iXi;C^X) z^!Bpc>J()6ryVedhBfS9P_yeOgX10(=Rcd@y&iTC_c=oz2Rm|+&_&|uYIiH=+@7D z6##JD7uMt8MY}LsF$)fiGq1kVka@=!z6yVx_S7p4ySg!S_bcwgfv4>NMuY`FSdN2F zeE-K%)lb?|C z>N5izz!-tqANrL-ESi`Pe>!sY{QxnhzP8ec!E)gSLUZ;(9DdO~7@oTyn2M7<}lYM9O66%cVJEo3h!sk0J;>E<6JvZTSVq1cBuyq;$FnjJ^OH~U1JHGjC0Kme}ti{ZwyV0zi1p;H`6_1lN zuZ;MVhcWY_t!Pd>0vrse{%sj1-g7E=cP&gbAZ|K{(Mz{rbbg}4(cKGC{q;J~H ziF&wTYPt%T=?fr)U)hQJCEGwJ%z_`7MDx$9F#5Z-*{bqa=`ytuPz6koE5dBdbtIsA z`mSVfE^5kp8K|z=h58lugEr294^)UZF2U$s8^F5<)}V&tG@o3J@Yube)pJ0_m^nWy z{JJ+lFaJ!h>Y9gBTN{q#w%)w~{IH&aQC{&Uiva-Pvi-pS8lz~aMqRZHg)vBxNfVyD zC-v#;#}zN-*AkMeXY4}#@*SXcbKvb07~OCJn$MJ>LsK{ZIMwwJD-kZ=2UcMNsayX& zwe|Na5H8;jIzignbV0`R)Apdg?m^JWvkA{XT!hg(*2$O>rf&O>0wsP`!0KUO>h`kS z%vtAk&{;iG+FCaRZyR9r{?%yyCF4~07c?JRf$-G5poJ0f&MA!ka4q7^3tF`qqbn2+ z1t?q~t6GN%SilI6Jd9??L#Zjs-X#4RL=4`1KdN8e2R;(ed}dkE zo)Mdi-L|>i#`ClGpuTP=XuaZjC8ERg(IMju&$`29tIDsGAcuM{4Wkxb}~_4YQC)^Ap4sd#EJd#}&)|lYF+a-l$^TJDKrNY5S&{rr@#1e zOx?8v+g^Js4qUh!j9{BY0bp*$3{LsYOR?z2mDuyt?b!3QZOO6$W9gTY;jr&D76a`^a$wN&Q@?o608N9G zmQ>)uz8cM^ZUpw{eg(-aWsKBQBRVJOf|xk zfToe9Mi63@4b`L!Pnf$fq_p=$vn7dfAWW`VojlxOe+>|$I+S2e_gPk^97&&a7|UOC z9#&m*85aKaNeDaSL4G{O#l;n7eipX8zlwF#5n+_-p3;OE7!ErR8gs;RXTWiF+{j##1o!mjDhkxfS8^1HHJRQ)e*ulG8DB>A4ua zcXfg5aMeD{y?z5`E<6{bKVFOK>bUq0S|7zMBLt>cQA(t)Vn;qSRC+)}F>(*iBk()4j_X()3 z*@yZqI{=;U`p%Frd({~jzIAQt*Y!J~bXLE3H>&6FLG$$`nER#ElhIZ}T3R16e*Umb z00@sifWbSrBi=HN*~`yDymcCbcWuvj=Cm(j_N=@&V&=?8VCKwoFmu+q@P;G+@Q5&b z)#(Ov{SICACWOZy#NhgEh~Ha;na6HI^ZBKyU;hB=m+W#2B97)yoyFWsPQlEjXJho< zRXS=I{C`_f{pv0Z-?<($mz<5+tIove%sY_`gCH*K5B-1kmvf3Y8GKq8;i}4TY*^JYou+BMg z?3X-1*!`T%0D$8^c`~Yf6FB}88vy{jo_%l1Tk4R${2w+V?4Q7KpV$BZ*n8FeR?pIJ zu0fcsaAeay%&j<#nUj(su;Aa0&**ZrxB9(jV(`Ee>X`vne)LpFV_gC#$5cWf?0?#Q z0D$8@eiEvE6Ik}~4MqR_b==1`0*5Lr`sQi?!0d*@07$}#%B9Y#q7-I9Bq13o7JH(u zz;T2s0E0T9QsU%fwGq-_jZRF=z1}gMmy!gY!!N%VTt_VUU#FqIX)(fFKz;W@Ec(53 z#PSWc>=U*nfgVpf3?*ehX4Y4*jgO+vABX_}!wYv~`0O13fWgO4%*$I7>Ak>JdT*HT z8;xk0C}l>$%GjioGF7Yr0_u?%0uu~0O_7F`i7}E?wm~ut0SSkLszO~=azI%`g}etM zg;M1M;sz8jxOgw{-1}2of44pxN&*izqHIb?w)Vweg>a{Gj{r}mxl?VM!t&={g6VIp z#Nl6h0Q+CIS@@i8nkPGP*=R}QYFOuJGS<>*%3R0_fDtDJM={YrB{+;zY;@$A(D8qM z2Bvl{Ks{4q*KW zebYiz!wU7?3o-dSn?RgGjFJ(YH>=u-$$Al?`n9BtjXt~%I9y@$(WER^Pu~eW@C8Ip zzLf%;LU2mFD?3iW0pNS4LF;G1-Vl(g0mAV0r-AQS0L%q6pG%(ZaLN8oJpeF#=SJ}M zi3Iz5*LR-xr4IBIQ?&JY*H&NL000byCZ=NN(d571h^Zg_2=)KC5AoYeG5izdXO7W( zJQf`%K=?dn#^H`pzbx^9(TCT7_tY4D_yhnz^@;~vb@~0#^(P@Je*R)j_xT4;NcH?> zqOt1f58Ja^>Ky&$34kk8U;ChwoDMZ_KM}lr02~e&{qNE!8~*l2@Xx1#VTI?<3Ht`YR?$_N#h&S|J_XurlH211o!=^-5xEbR-_4zHVn~OY0FlSJ&+<=G@rS zuT<9Eyl*9Ns6zAkB^{XSSERN^?_UWV3>f{5;P5$ndSC~JZ(9rAHUS(882#BQyRWM^ zVdG57VzIwM{Pq&eU3+r7=V()bxC=T zf45|V85X!_s-}qCNaVnx!#j798pFkEY5bAAHXqZuLON?n|<3Y4VR=s^1 zF){`c!Z2KYIAxCkP#vzZ`1`A{?+N$gz!f_&x8Wedu)>0yj>~aYj=(3jEd(Hh;)ttF z?-`r<>u`NyqV;_X01yWEEpi20lW1R+GHlI>AP#9+OXKv}S>h>Q5J8i|rqvFi)heB| zJ2x6(qOK5`FdU6+q7VVRC~2MHaAiiG4)$nM@^}nxSz=J?9ANDvoQ1a+kwESzrGTKzh4I>9GWBW6oV?pf@fX=46@N^S)rs1hX&Kn zyacg!WmFN?dP0Nx85e`49?S{Rt3|9~41gItYVET09TI{Qs$}60V*`+6$xqou(;kks zN6=h*csnD-F;>4Eb7;6 zMR?Q!(D5S+uc4*g&A9-;Tc&#N9}{?MW>LTPK7>ad1RXyt+ZreB2hy3D(0Md-!6j)$ z;Qx65^=t3L;JnELl#MhK-_V_Wc zu2Xlmr0hq$IepUlSsUlv)Wi+Oh$xF2^aCUspRz7Gy_aT zV78>`;wEYZ!C07C%5_Mbm<|} zw3QQq(0qFds;BNl{k!+0e(i&ZKVFFDD@)LPYB?|}d9y{-kSc7Br&=tC>&<+;u|wX! zAR{e!(L8gdRd=+so!p%=o$uW0XMY=oAuRfZo&jWvf3gmsq0Lq!Wlwz+gz^?=J>xuZ>6=OU?|m+B~1*;G$pwp{X>QOMg>+K%F0 z`>B6=hhrDV6zodrUi`>5AVl1#y*`q=Uvqf=myMX zUryefeOK+kaP17HZ(fElTjlqBEsa=yv8|JNw3MAQFG$EL3bhW@Xv<*+N$z<^=rJD% z)@5Jph=$E!IXMUj#F!e?AdaXjpsvz};*>5Gpo0=RvruC4quRdt3bOD99Sd(BDI&xG zpo3)!K@E*+nkai0xOir(0fE2^Mwof`Ex?iy>Tj*U)Y~?JB_k>kKo5#=UOGxQm!zd$ zdT`SCla}Gd!}OjiRS!-ks~QAI87ys*M}3Kud0-L@(M5G5H_K#-knzx%{FHI5mW{3z z>u=f6O2}D-7K{-8-=Be&jKJSmj`#;>f}$9sl-dP=!LpdL^ej#N3eqq29JIacY0flh zGZ6z}r^J=-8Ki#fNrEpfom2GzLMHO5D=GQATK0+5LLtDEEC@jTkSJ%1lOm}&tRC!9 z#sJhD#7WEsNfiit-*h`>p12bWKe-+&pY~|1dh%nfk>Im80np{t0QHU}x*?LxRE}-~ zIBisxaj6I(@odjN{!+|b^k~dnav5eWz6>*$UDn+U+?M2OD0qCdCoZ`a1G$=ypMaT1 zUW(D*x=}1>M$g_N7aQ!{f)(Jgr zwcnFRtCJ!X?;B%)3<;x8CeL}eI(yg4)c{w&!)v@-yvir~P1OIjiwpZ{9tEPHsdl;a zyPyZ%A@A>v`s*LOYYVEY_oDgRRhYT#T+Cc>o>g1&)p3e=mXhS~<)3#QtAsXyy|!If zk971Ze;rwr6p?Vw3{a<+2XEUhon?ea%;dVQ%B-{$ZTDW>`U3`kvJKTW`_TN&3d~%x z2{Y%OZFMOB>URAo3g^-ENuyCO%UgrqC*p}(<+ZFa*|8(t3(8a~J$unPnAvom{GE%L zbI<7qphbs@pW*MEh~XcuL;UVy@EjpL<^Tq7-HyTa_qB;f`k}W~?@)OUlldJ*u5+~q zX5PYG{?&fo%S3uw3Ixd_1zU%|$L)TjC(!`P`X; z&70Dc%GNt%MPmJ7Fo2qMGOQq>(Us6tqH$D1q{jZ zm=ctm5SE3B00dy>ZMUJ>co_B9R${?h&qjzkK~jGnT;@>1m6X9vOY_)uVX59DnZ(+;Vz6m&bR!Pf|5u2E@3khR1<3O0sWpr4!~D1hE7XdL~T$`1|Q>f^ovdD?48KKNh7# zE=?^u`uJ+#UsT!}dL(R$HOf7Ik4JAUrCq2*&Rv`s`&?qI^@`R))IurO#9@ z{%Z>NsGhiYEX;hD7z-O_0Wjz!@qphsUE<$f^JBrC=cyimHl|PBK50DG+LC9qVJ^4T zcNN{s%42v$qTkWqEl+qpWw!IGRS-)YkQ$0g94-NaC zNRw>?DM;GT`0ooabJn?tH%;gJ?P@l*@VspTE%#9u76ZWH@FT|q2P)7hbH(#xy?C3f zNNk)-eL8urw_Gu0+r~>E@ST&n9yr>#W3nZqxihAPkyTXO4@bNsjcGWej~5(;uXsK* zBs71&9CO#6jM>XJVfeZe0RYt#-ToRRzC3l?&6vFP=G;amK~sK@35vPP%n&)pR63YbyOE3p%3E;A zW%_Y_kp$k37PEokOXskjTs~C(kWocIswgS&r7@DPmVu`g_u!kPpAm94fY>B#`hn6( zsw<_8Csb7hq7=59xpIq6JRXz*E&1$vOx&{=yPvxm2mjknG?NWxPCkhHUw@0ezU&`1 z0s!_tXEWlGIqZGjmg2rAu-(t!f@bLuyPvxm0I>L9Pe1}$^R5C*zr4=MFZl6tTP@&D zXsmeLImc6(5zVdnK|(w-sEfatRvz}eU<;ZhbJ+X*t!2#}!;Jj?5<5izqO8~A)jo9Y zZnM_%0To8R0HqUI>j2qDfV6L*3aG1qsh_4y3ZrxP0gJ$C)9C*`hwkZZ20gf0+CZ55Mm)QXvp2Uo3WR6F-;z2|>^6PhDc&$%DX)Clp}DU%caaZOT!bpo~KO;Y+(`b$u<_=yM<0!EVJt0Ev$+AmNM zfqv^=(4%*QzqS(mmNOAzg(^_mY)piT83Td2dCm^h3nNC)O7Kj6YMsa;F@~tzC>JQN zKm-6&pIQS%!t4vS0Sg-(eqq{|GX2?fpqPfZ`?(i|ZlV~ODMgqcGaW$p9x)dG%X-i# zVBa&ggBLW||0~--!+@oqUWb4($Fe7IB4rW+|2;{`pS|p1U|EAhuh^XD0MhE#LZQP$ zuel4&dHWHj8NBf@X8z!gWT1vbhZO<1BPsjgNxKk;L9s!t8>s#!dFAOf_h53v90p4m zlNavC;61mAQPo{-BenPngP_gG{9n5QCs+%70P)V`9H_3?13GSm!EbIW3v^yAnT#3H zHm2jWBu2c$x7A?qoA>qfL9URDl=@XWzz%p>>a7*^}yPcY=-^qJHJhR>!h&lyyE;5_2OX!Ds!7T?x;xlz!c?5;_(Zv9LX@ zu!l>it_+am7OPAhm-nd9{$Qn001BWNkl%8yW!~eGUQbXGen@9o-=-$ z7|}pB3%d@dt$SIputu7QfmH0jb97<-l6Um1C@`Z!#AFC5ExT6=jdYTntyMt`a{(v* z&V_jR1^3{gSKNWo@6KVca}vk@{mI6o7X4^BR{!bQ*!|plvH4@)L;c_+R=wvDSoq@= ziBKF})elc%%MCvSPc&Hig>_i+>Gc)^mF5*;!Hp|`m)?c?p(#vkS(rQ6;xBr$RFoKZ zyA+;!-TkGn+4qy5@ z55M9LY`gxaV2Oj@bj_7{sYm)2Y=WfJS83mC8q_)jEd9!Q9C+bSh~yNJO}w?MI2mQ zAAq^%rsd}06Lw1Ce@#xHayamJ3&|O1S6-?sxH4A)DY;dMF#Vs zFZ>YIj!7(f%h{;!Txd!&gRtvc-zxC3``als=gKRt002zfx&%w!dNvNfWHWX@{Rap; zC$ad3Q?T$;>x6U}pn%bdvR`G}bY7JasgTG<;s%|FCkglE^$rl63>7?|B1=h-UW>|VpSoQlDl zHe>LI_ka)9h+jGWsPFVWE>8RHxi@pcB^ds}DLrlN^F7P&{^&>L$-;Z;4meXky)p5} zeKne|9*@xsiGZ5Uj?6@0Kl{L-@S%QDY~?>rHM*Kfnb zhwrwqo0+pN00^BFqd=KvbavDEh~HX_;qRY>`nm@&`Q2N=+Xoo_-brI&?qX(~cBW!I z-?J5gA1zFJ&5srXuh@lf!Ql?Bd1sA@&)o@H(4hImaTtB{_?CgAXvp)(%ZlL}*JJS3 z9T@!4Ht>NO@k>hq97O*$ex8gzvK(~s460w=i}09(Xg<5Ne9bwga#i{(f5vYu!thP& zP+zwbli&L}c-sKOH?BwX?ZpXGobfumejNtCvjY=F@9 z#Y33<%pCv|;!RT+{Z-#a=kcf*{plK1FWiOtE!#m$8}RNL&F7B8=shQleFsq8z~O|U z88-6^RF==iWHRKs299s9t@H!=^v$Dp(O&DBd$z|7T^M?5@YbK*_iq|~I>oh#(b9-R zPxiH{2u*B2NY28BQ)o~=b(ldMq+FC0>+b$57TqB^%ktR+Da&mX8CpWE%DhD_$cOE- zGe;Z&vL}!N*|0GndJlJCNo@twbr=d)mW8Hvij$mzt^wu~k3%4kBoDI43x_*^L63dP ziJUL{blafaH#5yn@c;l@&`1l90=G7OYx@{34+5bnQMy&k= zkA+E5_UKa}3^(n^p7;J36JK40MQ=L`y2ruNPYK+F08rjtuEI1K&SV5`hr6*ZXGvVX z60Taz)<>2c_bCp&iIzhES}Cc84E1`)Jds1%`=MiJFu!ao__{3!e{~YV2RArHHh-#B z4hlx1jig3psIj9b?jdCnA`P`+Ibqjj8w$ECnO2_2PH}e2e>QQ`gbpo*OUFLl&c;^S zJWDw6qOI8f(tEMw?>1uDUu{(CFxs?DMFOjCvPLcmLOv_NA9JAIF&0mao&UkguoCkd z3B%MmZ1cs&S0QFw9c$c%BORkr6J5E)d`GcCBOE;Oy_ghu9k@o|4*9^CCNk!j(EzAk zz76#&@5AWBCt~!z6EhvPJ&#^^75LA1>b=Gp4jseUa~*fz6sTOzHkb7(dL8bUzj;Nh zXvWi2U!6Ty_O94GHh9}z>wtB%HZr3(j2OQd4-x=O-JCXu&z$op-{JXRI+n{jUHS{4 zGX|})^U?|fXzeG{$s*Hgez;n#v~^ML;E(g~4vn>-Y}1PGU$0Wv?nePy32Tew`{J8@ zABuYV=8&&1P`BglL1=e*-19z=#!g-86yu|{U6wq`y|N8L-bgxbI`y~La|N#r>(`zN z3Yr-+pO48Pl5%~a7dlFGi6>zbHtR9NA=(UHN~Igd8!ZJ$8e-29UC81|mtFnl~v2 z%DST3aV3h_(564tDa{-$g{kUllv)!~kW-mOcO1qD4i%avCZj6kwwW0%vq+aS(!;1q zXyJ)dx+p8^y?TgGjo4;lguPEm-snZ&U6qJIkfcXDcQ#ToEZtImo?+Fam~(H^wd?h_ zV{YSN#OVh6o|8g@rf)o67(yOmpVmp?*Hhh?C3GWH00lIn*9;rRa3ramqQalzy!B){ zO$QHAzJr8Jto-1q2uA|;yzH)Y07M)CQ8umuAPN6T2j+?rC5k2(ICSkj2uCU`e*dXy ze*sx`Md`h!t<0ys0O_UE)(-o{LXn!TNNN`jUAuuB_r+pekDKrSOe?u5`1t3%j ziBXIdP+EPMr~(FoP(LYcd~Lq6+}b9ki$ppmYx*`uc0@>93Giu1{Y%BA1LHWe7B^uF zf8!W0BcRj@w{$0)TP;Cez{@>k|f z^xUQmEuP2Q97E_*oRQLeC}6<6&T1I==H}P=%IB^j-=#dPMW?&-eB3pbZs!B6^?vbI z&wIyMRjyMI+t#ZX$cLw7nO(?bKgW;O{eqQI_AGU?7Q5mtgtf*nuh?g=GtDm8@g~YM3awCV8j&kVd_z<1C{t zb%nqz`|tvZ4wy3?Ma}O|KDDU~wUY|~oT4s&0$+@=kn_ReHK!6yx@^J?8!03ijTAYd zbxM0RL~%1lGrKEVgW4p(Q@p1!>t%?I1D;mVd1~7!Ll1pGuUEwjhYipQ(~E2Ny*z9 z5HK1wU}jX3ueFIyO4*bmv7~7>w6IL-;C7c20h4>Car(2Kh~aRQPNl14!wUuR>}Mn> zaq9QTjAg%lzA027QL)9#9s=d`jc#aDHxnM!AW5-pF*8)kUQUrs9Vd>`jSuM8^j^Vm zniNGZM0|bh83h1}$(p4XKFSOllD3N7{+z~SFsLwU8t93-F-B08V)>eeQHAt88F^7) zBr~*vO%nCMlX(a-86~KL;MMXKb7l&a=C)USlTxDeOO)u9FS#hoU!f7(2dzTW83RU3 z@{HgDTCnCfq8-i*C zF(|KuF-y3AP}JoHz$x<}0rbL0qG6z7MnjAmWShf^4emn2Cb$Zn*l`FmULkXN+(qSg z?+xa0PLG_$6l?nV~WnJQ+hfpDk%_i^oxrRWXA6l%=zGGUnXmW2N-|p z>94gdJYpV&%thq5vFzzfYg|d>pn*_W!up;vgWN_@H+M1WokZ;G=mDsp;db4f%Oj^f zFOKqVdp>KNPn#qdZfUoCoyQTK;l2+UebZ49)Kg!f9JmIETH~tHx(60%gYdC@3({sA)2CH6Xg`5qQeDgDxC{}yo%tN2+MteJG5~Z z^SGE<;c%o;7TV|N@gU7;7*LAD$hwgW6wXtipnEFqJ!PAYkW*q6-5{L|gDM122ndl8 zA>mR4#Msz)GBfD%t6$7Hb)gL|8tk?ZATb#bx7jLCX# zeU7a!!$+{RtcAs-46;cUMKOWe@~vb8HPqo)$@zcP9aWr>Mz6xh(S@2gO|wqZ#+fuC5o@c@#%=BBGPv?pcF33Lb)AsrXgl}-+KqN zU2Uge#-vPxCDQ^Gw56vt<`~D!(4&N3`IR!A=bF_Z@o!2YR3Qj0I(mlVz0A6c$-(W{`bmIUr&Af0;!mAl_}zPoZ` zX~MtNg7;W1Uzd$_8))T|CXvd}2UhVb7eFx+{@4O4|)*4|ry6?DQ~XTr-z=YRwktlQ*ePS!r%tnE4mW>pB>W z_JLO3AhWl{yKgbf@ZV8n6JnrX8kS};X(8z?C2SyV*yR#tWA@(EGEF9V=B*KlaTHQW zabIf5tKtKo8AVieRpen;#jI}=CyVD_4}6MEnR1Hd5DR@N*Wu4cfb`sZ@(B>|v)9tM zor%~hrEPg)uLMfCBv{-%Wb)|%rF8Bj=n^ugfRW_2t?J6gQzt=MjbMWz>2k6%fE<1% zU`tt;aiU{y%cPuAh^qBlQOc`ZNvh9uxCo=FgYB#*Hwkm9);uYb{hLFGs3OG1L=SZN z4Z3kz4Vc#QLN=s*kA!ZOud6kpqv6YQ?r-7`Lbt5=h}M@xJDgUUh|IfTF_;2#U8U70 zs}pXo0%d&Jo)Klhjt*qR0Z#FdDf}uFo88*;Rr{);hYZ+;;2`)1v*oC6C>!4_&n+~n zEzF8};?Yed5afU&52^o3`BeZu<4Kub!y4(i2OFpIk_qMJkO{^Zhgd^uC&LlsMFZ8<4{gv;1-&?@HxKTfwAv?x4QY2u`zA8QDv27 zVLsMS@Go+!fRksr3*6rwkAmW!RMNVRy5gYx$yHm_(v~svRpPtVs>r5jA71)srLXS) z%r)QZe6&I(&3D!w`=^5Y?&tyY(OeJa)#0dg#Tc_n!;Xo$x>}8~>q{HmUARc(QI6`> zQptH%rL>o#lxw(9hbX-fU>!hr`f_qEwQ*%yYXll<5Rr8i1$-16gb>nUq8t$^83@*l z8e?veH1$iIW=`)gP$dZr;P$<#GtBAE8J{_1x1Ac%NWk%63sdLvw+1DsT-Sqa)fwp! zWAE7}Wm%E1#dKy#=`91q&~N$WG$t94=wgnvbBajcpx#rZ!EXR5WU)g+BGmMuAq>cG z!Fn(EG+mOm7o{Bo&Gn1H2%6{0Xe?XJCWmE%X#pP*V3~Scfl&pSbRuWZ zyRR$jnr@Oh+D#sqjOvQA*CQJwnc@Of=56o{T5||%owk_EX)Y$^JvF463pi>#zxP0q z(H9xvq>6MyRO7rOknu_5nDA^Hngz&O#@AL2Y%*$wEy?^K>EW1wkux*{GinO9TEHce z6~URlJ4Tl)W5~>tI``0F)E5QH`ii>AS1`}j)?&OsN9%i^_Rzjf<%46?Y@-v$kSIFnUry!!Z0}tGE=T#v}mgUN(4nnoi^Jcj$BSF>oXSrE7us~ z$DZ{)PleEh*VBqq2KV0{f!DB)$;uF`E+ouw4qrJMQ`!?u!o){dchp(Uj7%;oSk3D zjfJvz=~&PVt{FKA_5^4-ww#@^c@;g48w3{-jM@w3JZDQ{WgBou2%dOkAhVv+PwX8T zLU~?fFQ*0=K~m*sgs2BmiPWb|%5Y_6z$-(#yP7x;h{*#(Qm{JV6yt=O1g!6yIYCI5 zWfFl`vfDo*D_VMxlcxVvyeH)>DVZvpD#;j>veyK`lZFmS=AGO$a#)H?45t(LeLt#D zE6u6_l6JMj`e<`e@$R^gs@>6#3tHhcN*hlN^d@Wt3sTzmVj4x{8)O$?FV8@=!H)6$@^ugh}dMsmd)N4Na zDQFQTDR8M!l(Zx`?lsz|^G!#w_rbidmteWuCZ_-sw`Ki(WZxp)cCn*k*w{UpuE5Ch zCx@E!LEUqCJoJ6{KZ-d$PhGwDdl25!;UX#lo*((S+I_LuCg2pTBBT^5Gsm~@>8_Yb z1%FWx^T=sFev6f`6QWb{2(R?&o;;Rv3}go&P#hwwAmy%S9ZbW5LkMz$Zc)(aLiIo6 z<+ewSp$=6;yX-dw@;Oqvf?s4dY@x1LnYRBFk0t+QNaP2~@cAIRf<{|_VU9j&B>ib> zd$$y-@{M{jMEk1k>dHVO7>-d^6dYp!Y#>WDLI~C7 z1l!;y%SM&+1WSO#&AZLPN%w3JDnc_FnYUIqZZ-{JSa>tZ0=A;;QP4v))H`e57B?@l z)tUQ~_jbUDm#wemMfTSfSE`UIm`Rxzd}=$So0W6S9l3gZW+OF*bm9`b7(W?$H3T#z zY$ANgP9&=Xif3EO<1+8f{vL&5GXG)=A6nZ2i)qG4v0O^D+)SK z%04;zri{zVEkoL7V^Z&X#&4wu3+RY6$^fb56@Vhcm?#LSVmj8{XCAO|)kX!bR1e9f zub7Mo#R1qhbnB{{hR!8AO!JGXfY?L?Il;J+u^4hXcaErBT{Grwuoxk0m&?mb3~Jpp zMZ(>q)^p#uR}3=mKgu;vp^m;#N^5SH<@R0eGna68F2~iW@BVyOPn`x!j}lRKLGDqG z?eBrBm&;I_$D#*ceK55z!A)OGQO7_$7JMAbyUmA zp2y*==jtokCjHL)#n^QF+#;Dy9Yvcx0NCmhcd019bo2@7qXN>6)_Z+@I@YT_&Yh`R zwq+x$xBdH8-o2yaJa!e&z0MjB?)%z;NtFW+)>!^o{&ub)=g^W0C?8I$Nm+tO5sl)2 z>L==Hb2Lo38IZ^ks!|Q?_5r}kCLJiqyi41OlNUV}ksT6^q0TIsU%C%40MKnbp4Ke$ zqNy07GlY=!Q^$Xeo9GvDx&{Zc>0uoPr}C8xhqw=eSN%q#ZmJOMOe(MALFK*jQh{Fs zZEDR#;uSq_6sSYb0Jh5AQiqX(D7U)#&k>7lLU96^kqem8&DOM)A;4{Fl(t3jD3P6( zs8q?%YNbqin-HzhQQ~zBIEAfbW!4j?#ce5%7o_Skj;$&XL}`Sy6i+3*szSp}&UPdUn0lc(wvIm0C3|W&(gT1jYv@;Hd>`zhYC}0rV^4(LLAcs3;|WB5M&QR2zkuZ zb8bCnq+_~uzk+DO0cq1Pf!wj?d6Mb|*X-%ecry<<*c3M9`6`r@1~g5q>MdD+$%3_# z`ixF(2z8lOXhP=#DTZ1MU#=iH)|x_<=F+H%wh|CHkAe0#y0J@PSyg$!p4Knrl)t1; z@zOM$1VmjWV<05YMZ=5{7(>o5I0TQsoMNAFM>=_JtlE2aY;u_3Eg#LRUlh;U^D5J; zFPw$IxJp~n+Wl0+&5+IqXsKg;H)%h73fA3ou2SX4C5{m*s zA#{{`0OrWEE`fn4SrS8)LWtWuM{w*{?-h29ua8Y*xC>5xXt-<{nwE7u7TAf@v6{4$ z?vZ9$9w?6yJ1N82!Fe8A+j9q}uW%}@Cn~r3oUXFenj_smX9cK_#tH~jZc>AhmWoJWVPEk!$_T=q(r-}LI2YRJXZ>tPVKqG1Cr zY+2xs|37VS9=F$3)r)`EKIeJgH%XH;O_OG9(t$!tTj<14q@^hokb6aBQuGQaIA28& zarQD@?@zrdqM{;#L#<4TGDrmqXhCMm*tt#Hq)AK1jBnoeIeXnd*09$;&w1Vi^mjg= z0TNX3C2;P%KvsHi?&h1%7 zU6PYR#NU?YoHZ3sM21}k$PT8Hw67wt7#7~IUU%5!eaD#_61Jh1%jR95Cn)oR5H<># z!>VmC=|OKX+94}r3BagP0mA^3%|}^b$tbHUHcDGHab-sENJ$FO*d`p-#z|oAbPk9h zQ$fsSMhR0FUUNBM&Uue@!3?(iOfynlu=?y8Fg)s8b(`p2^@Ed!s&h7?g~x@s;i>p+ z>C=r*f-Dg`yk(Bo`QseMgIehJqK(69nA`t=F#rG{07*naR0e+J-tRrdVQ_PR)t<5a zJ^gn@uwmLo8dNA<9HaR*XixOz+q7}$vlUoek$K1&nD~uo@UuJVy|;PrAgAzs;xd4^ z9zvfF;#jQRV?tv6EZI2vG_kuw^H1U9(f~Z=G1?EkA=PuShJUheEXhN|lRLP7GkggDU-Rlm&s8B2NTK2!AHDe{_JRATSWw`XLTU^7d*^VM6qBOG)#0 zgQEs`9e&n*c||N2i$mB#zZ*Xkv8K9TR=1g1%1OIkkYHcdb8+NQSW+8@H7!_6jRxD) zDh8@J^*x&fw{TjK;cWcaN&AA2Hc_cw*TX_!vYNq)@os4bHh}OnP`n(d@Q!g~{li5Vn*T7X~2NrLS-^YYw_cLr9&jLMmxLE;^e0p)ekDJob5qbTTwe zsr+OmIpsKqBCralvX7a)#7^qTx_a#?VwPlgqMy@7cZ~ronv`$i7QUM!Ou%HFm=jIzT?de z(XQY3)b4Da^U^#}b$YbtdUWfbsS?`=4yaU$)5mpXK&ro)!;_I=Ir4S@SVqz!B0&S! zec2Gn4iZBtzpX|+s76_iQ(AA7Y=xSXVmoMXm;1I%u%$u(%Xlq5%YD?L*e@ukaA(h2ptEPEf+&Oljt^y+&mgUybE+PtlKN0w6_(|!!YraMZn zma-G`+k4cg$*Mve)dOtEqS_#<^P0?9sj*y?hnh%k^vm-GpTq9&Njp|9)tkY9%u%>J zFUvbXF-bdD(R zAdXMlF;6G-4-sCdx7D^*c0QDfAn7o| zrxImPsvCjE4_0Nb$Y;704A?mXwg-?>@?8CB6bDS`djh-ZDP{?7sb90I*@e9@>D zyQ7{0CgT82c{b%+1uyJl#An=-80l7~V+mezAZI~5so}zaSBRwGFnK%uc^n#Gu%Dff z%pM417x-BnurhWF%(iiY_VZ>V{V5MQvR}}n#!mt ztaaP(#nTJy9-^(Wuk43RaSw*FQc%pQ5S<{SSu~RjAEvO>+#p@()O>z(L40Ft4--X~ zT6%_7)KNxmnuNv0Ma+)c;%JcNla)=EW}r*;mF$&<7RO@%Qi+I2a_EZA2wK6Ik*tu6 zMY+RR9qcd`X7p=Oo3U($vX3V=7-&-_E&GJ_Ln7EB+L59Wdup6h!5yd=>g6dLa+$P} zgD*~(9RLT0Y_Qf@9&-dmE_n94zF%l!;~}q(!^L6D8D)2b!NN`hb3|;?=L~oL#K_CY z*;WW_B9r%B$PxM=NSV{%7-Z&9Bbm$6A(Upp>9ms&$>8?o+A@a{tU8uO=ChX~C6qFu zE;TKGl3B{0kqLV^9st(mU3somA=pyF!npG?v38yVLskg736*DXJI1vyp-p0OC_3&y zS}@v{m$Qx0VGqr^!_rg!Rp-?Uh>s0kCWZT&xUyxYSwO*wx9LdGlP}E~n)2#2SSBuV z8NpS5#Ywa0>hDW+T2?8eaUWFTMAkyYK!y8b9+PWcl-G|HF-Pm8jN#k9`skWYYPn5u z=v-+ozYPK;L|Mgm1$VCdS@&qzz65=? z16*%9r3iA4fGwF6lcnYeGZ?8ifNZofB$Ei3s61+erS#!>OBPk)Nl9aoeMASv6=gAo zBqzNXQE_#^otvI;@_gZH(y$}nqto`5<46BDA<9a2f<~VSq=z__WFRq^5cVDzGZ;!) z4VG>^M$<@Mznno(n4!@nG12+#QO-6cjI*Yukd)OLXED$kPR>-tog$qy?1~)-`R7hE zxI<$&VaGkYekC)u0Ef?Dw9f%^-k;!CM;GW2r&2Mv;Tk5UE5%hBGgjhCjPnSW+Q>j7lqr(CC84^zG5V14oDf{7R(9OrJ4i1!N+OYGt z{z?%S0r!d2vB>Idkm5#{9mCVbAd~SVj`N3$g9CNObrs}}eO_?Y$s4}R=5Sa`o@R2Ux?PVP72LK$U}P6wfX9Siu? zJXD#{Z*qw)dN;$nCSR-Q8Y)Aw8h_vU8ZuTwyOCFiUnp`%=4fc&UkM0Zs?yMZ{tASE_c{m|F<_Dq}u1(rHRYH7R= z&6L3#RdcaVsy|bJixHftFmLm;Y}cJG1(Hf&G@{f#wq9t& zewTi8X0NVTP$K;$>yrVXlt72-?WSp*^qo0bifambp35j=wp0lTF);#=A16r}p$_UJ7k{ zG+STHo+eW^I{I?F(P(uj1YJHyT%NJe!@jTt43 zKv-BD14tPA83qzng<@y6ZO~=LSj$Idh8pjw;75sJip5qPs76`f6L>y6={u#2RXL73 z=5Lp>fh8Z^_X-e~bS478$$2LP1uA<7Ky}VS>BARh zBaFTbNg@5s6fmF$r%w8wUNHSpIj79NV&*t!ZIMa$20+it&`lFI7L%+fGBdgJ<_!s6 z1EPvRQm3wG-{eqE*BlG+S^J9DR_=t)x}4EA0YS`K~d=!?MR?Mwgv4C6LyfZgeT8)m|4> zV0vz;(XVGXO<=LlC=Q(ZztznZUq zf>s85AE5pt@*efc*B?XtJIH!w9+=LfBAY0V6(-OJ=@f%&9vrG@RKw!3JQymD6{{Z~ z;5A+1f~HT%p{pOXGd3}0y3`eejn#Y^=&s`LqN^t!0-_9M5h^xA z2S%G3jB{6XeMEDJ2r$DpE?e46qa!7-AD#*VIuH^vTHBLJmcFDZyQ~{&N%n5GNTQo^ zhXkGRl5|E{vNIR`R(}rDMswF<{D( zbCzBmY)TTM`uPFS{Q=MljBZ*8KH7MggXixC!Dmt7YH~U zABmv*&uVBJvISU!%ecb7^dkRo52t488U|*~U29T^dIzQNdQN<>u=q65PWTZXrLi58 zWc6;@!L~FgbDoN%gOAng=J2{(Q_m4IPAoz0-fU&XZQBD}|LCoh8MQ3l1EYWwrjrIwPW7FQ)<8 zgbjiSYLq4dWgzE8aSqx>XL|O&OAfoiT)y{B33H0#IDP+%!vRoJ@*xu?H9i>#`wr}D zC-v7{v6DIpJ_VFl%jwlNuap;4oTCGViqcS0q)h16hJfvDa3Q6F-TIX?16a>mAhfXD zMxl)?{gzd-QZ^1COA|s-9!Ta42ppCQC!2+ZCT-JTu@mJX#Gh1Wn-hm;kb0jQQirg$-@u@yQ>3HO+4kswhzPI@QMJFh~m5QTT4?eLl+l zsqGyr4JNN+ek;O6^}OQVhlxd`YCJ)P_`C<|a{>BuVUpF@+HfI)Iz7ncexz;S`2o95 znzUf1yu|)q04>;NnJptkf`E-4kZO7B)~25wU^3QE3Z+Wd75<|M#4JQo-p_d(LMye~N0FT)(K6vS$tq@4^{fI^r z(tw&Dr{L97q<@Rem5dIt0W81<)s@zzpFqr#_G>HiS(GEd?CJBZm9c~aT?XK~Xh;`= zJRK)SCJMbu1GRx@fcO@RB18Vx8>ToLlK-OyQJi0!k9~1PPaHllMV=6GKV&8-%cT9aO~L{g^I^Hx(!8SLDwDY=Z=-Q_^;lr? z#?aO0rubTKLiLF~)Xh@XP2bp}-n~9kdwY{|cq+U@{SAK=SvT=6529qyz^c{BB)a^; zX;1`(R|N7B03W5fY0pe~u;`%r-9AW1zj%_i_LYK;c3~O%tirJ-HwN0HJ{K&-)BlO< zn8!SH4asZjjqzxG^br_8FEQqLZ>-o2CA?R7hJjucu*ynsI8?b*h$w6;?}%+efCqf^j2+hx6y8>y zYrnI}8BYk-)!7mhv}wRPUZ_)(-I#`~Ku}2!s#HVRSR%$aSB1+GSr!E+eqO_Ni5<`rviV!2`4x=`Cs>rxw_e>>?Lt1N7(!6f+JUeonmz=rG#c;Bf4kCEU zhQU=u3L?6k&c?xFW9%a~R!{(^k3vuH%D=eKJT1C_# zbElg~0oKi_cABslzd@-CDAy=#87AV$4Scy>q6#WyLu9=0IjQs0N#+td*6Kl;!sN+k z6sjf>P;GK16I!J|BKStGN~A^wVz8RvC0oIgmpXGq6ed|tWp@&!bxoAg@A2RjptKkD zk(VS4w6#srIm>cS+a%dUrF@z|Xd64>`m)PSCu?6J2P7|T6GYy(HOL9!6NR$FP=25uVzE?*6TCe50L5-=Wjr_r|4ZRn zp7>Z^;o;8_M(ukN|GhT3cguOVH#a!G-2aT;@TQD)=;x#1(>srnps!L3@J~}y zXH+UJ!3wc!YtNpjU%YIoKw!_A-q<;@p9M$C-S`7fwiPm#^$_9*~=@H@MO8CY}QMxS3kjsw%LS!8Pd(<&5xfbs zo%LeWTfR-~08T#_l0E)P0fzpV4KJ}ej~#X*$Em|ZjmWKHQ6gDIAUO`}gA!a;nbKzKAE@Rs25f=aX()5J z{w?-2WCheRXUW_B<|^4ay}dXlOx&3QQ#5X-fH$cb?0K${v((TrPkV^Vvw=TikY~7q$=|1@H7y1A&@}{igzsp0 zn0mj*V-y-2e5YvOW4=rnP36^rxnKt6AOuI5Z~Z=&uv_}C9_^-CA-+eDGg4~QFqEp0 zozGErJr?&An!aK%I@p1!S!K83fvd>*^ox5R3%r(c$~vPMV$WErj4?(@%W1%1jA5A` zsRYpo;GEHEA5BVX=BaEqy{~kZ^dz!ZW!wN3b0__T=QG#~VN9F70gPN+{K z&LH0}RYWIyy0_7&(~ZofV&Ejk+fF?LI~d7Yl_DDYIa)WOb?c}&1w%I|cVl!Lo8&+# za$*TeZ>JDCu1w^9698}m`*py5RhbpNfT&FNsQkzW=*xK$QST5K~KeNP)a@p%;AF>gC(6M<`-I{ z=9rkz?JEtjAH{R>PT9%=+sTkkA|RIt3xRy87m$s^AVQZix_Dj$m%RnV z8L0ulEURdZ2IgZR{H6ZjdK0H_yrBNVz3)Y8^amZDrSjEY;reYDycOeyHkZg> zukirDWPUZ4rC<#}xs1@?O}|v*ky~|&1;I-qhxSQn!|3a?_*fs|{qclZJC!z5ewzTi zz%F-s_XeGx!l&gODuQteX@;)B`DHhZFD7K`-fdcbMN0XF%pCJNcx5MD{{0 zeo`@&^yj4Imm6YqECodxvQi*r#lT3}Xz`ZJp*|urT52S12q@|EDl=?VyGaDnqA<3{ zflMKh;GG#5C6n3OvpJ8ftM~n2Da*;rV4=ri7N;#4A5oAyW{VNf+D}=R+skInf=Hk0 zjH=v|)D+KJdNBwqTV)7s1<~)5#G~MSnH)DRdQ>q^NK~!X7ll_XiYuRekCqA-gO9>Q zmr5}ORvEXoVgGUvP}(-wPnskHApDK_SaGvS$(dF{b1jU`!}AmfQU#NeczDQYn2@p< z$(?%Q1TnOz%T5j(r!6BHsoJK|oOs2Vd6YRgV1|CDmn~aHXOF#~I@%d%L&XU1D;>_k zyEo^rn&M{U+6!Ws?hyB+0T0cJ*l%Fc?-a>PUXkzt$I;l2V`2;# zvy<@Gs2$Q@M*+p&TWZKdc%Nvnet59Ch--w;)x!a}?|=+E@c|Ps*F`zPv;EKgcPAPj z#`pBqj~+}Dyj#B&B`r^LRDo(9%2%2kWB5=U#^L5-iirNu<1HG-Pw$6BU{|i6W!bxlyscMH{`!ot` z$Lui?Pm88f;m&MD3atwGrkhjXAUkJAQhFLKK0dN=M#c}h_g z_xYI)tH<6`2W)mK!wP!@rDq+Xb;AyD!E2qFpTn4ZQF51nl$vsAmExupK&ctLnr_9C zsT5Y(9{|Wky@KFs(VTkeN+|qMKWnGhLA}#SWo_@Wx@{bgACf&BT3cbT`>|}3<%LV- zA7vD;>S7}%!LH&!-eI2{8D{GgfngBnR72NguvR@X)B(aLecVJkDbHcE^N<&m<#q1SNEz z`MhwMU^0ue?2!q;lD^hk5T%;e*&K1w+{2pJ8=*-FT%97%R!vQ#L_x+=hqYw}_Su{euG$|lsl<0J5%Gdx8y_&wbf0VP&= z$&jRSFBVRSQs1;og}~30!vFvv07*naRACp2LFD%O?=xRe>XY0Vv`;l?n*4F#r^#^_ zx!LDW`&+*f8a-AApx@`%U=z;C@T zaY#OPs$d!9NrlB(ZfNY){1-kqV>wYHve@K5L9zs_N}P>f0}i6IrAezixR|Ac1d)~S z1jc!QM;Hi7<~zEk&nM*%n0(Q4pwM%60JK~p{tPK0ZI$Od-IOfAOB#?eu^?^BSp{X) zngQQi(uJ%BD^OtxVQlH!sLYeVT0Fs;o@#6K<)Gien#rJPPgM5n8K&YNGTbrHnk7{V z{@5agq|ua!w%*f-u{AdCIycH}MVSM^eJFkA3{N1OWx&)o_~HH6ORw6x8Z7oq?6Xv3 zVQ(uwFYkz9=E+w959TFC)1_3=2~Lu~WB*eywnK`9wd*t63@ujN*vg9JL0fKErIWqa z1l>o8tY;6nS5A;9Y6g(?gIxP)mu-Gb$9TeBU#5pqh4_aRp4a{ySjt?Rf#(r{kI5BIa-qO{wr{e(ZGC=YbjW42OQTlP-G(-vV<=rflZVU{=2LY^`e?=Tw zAHo3*5mJ+oy9~<#wX$qP1Zw2eV#5Ow{8VO!M2oDpbGCksV;#S0)H(5c^eFnGeR znG$_iVrt<4%>Cb7PX9v~~McDPkaROz6C_8>p|e6b{3 zFC`0#jRlj@C^n72Tn^Y213v?uoM<0YZG3-P!3>xcC!*G5--H%$aW(>J20Xhx&_OF1 zaj`Qjoi;g6*vD-KznNfe-$3wf=P()Xxt+``2dPo9EZ7=!Rx0zSMKDXHOkq?cnv%k0 zqaR52FWd4;(#;nZ9gc>N3n`S2-M&Ccw=u=fjOt|8DgdcKR=-6in1JP1LaCM#Kf{S$ zyd^jRjZ#UiCRgyxfrvG-O5S;4a-)uyeu~B`%J`*CE=&({AtnZH4tTTot@IW7B#UEm zwhYE@R;PwkKp0aQD~Pcp6WFksDCuc?I=)0eE)#^I(QM154o;q@Mg@XTC?*qF(I9vJ zv-iuGW4>eGKs2G}5pO1d!Upon0g)12ZK$zd94aa_R{Yz~lD3q~?tZZ6VRI)DVqym8 zu|PkPb{d^_+-u*t2lVdOJ$`*Zu;SNC|CJhFlqV&E_|h5o7V-g zp%TGFd!=0p6tmTipGWww(4RlQ0n&;`CuZcXNY)U!XqHg>@L#`pVJL@ zM=@O5D-LC<=mRmhGN}8EFN(5@b>Ryn-kIVf3@h|q9GD@v`*Ju8f2nKQ{h}=DIaObd0WyF3a z$zKeI0!N=0_~>v9vQ%h=d(Td5uU7X{9;k>mrBM$32LoW3^{2o-bg$PyZ~A%4N4!6@ z-@y8a#8?W)qCh6uIj~TqTSFwqugy2DGGe*!B*GqzR)mXo4#!h)gBY~2_4CmyPT>LK z4vllF+(3`K1H6dhs5DwqGzKLN)&>cb*jF})%Ibzx4B{eJ4F?Kp#fH=exZr^i4gpg= z)Kcn`D=y|gYcvQGN#Gbpw;lVnhRfI0buP)Ha*lZkr%Bd3E zqvTXT>sP-i-da)G6lQ?4Vx>q6LyGL=-q2Gq{GyY=A@v3&GHlFY^F1@0WvN3ZXFS^! zBP|jrF&Z?EAURa5RKl@z3@Hr>-#D3d(#9Ndjvw5ia<>Bmf65i+OR+!54-Il&$;CM^ z+=$~@Q^k1JCcV}7m8gAEK9F|JiS-BwX>NFy=y6I`(o9V~6MQc4l8@EOw5G-k;p{wS z^tV3j9ZA;#s7-D-+j5>o;W=A$n#3LXMn|qV#gQz%iOWT7 zy5Xx}5=kW?)f2+9iF~tiA_AJii^73%lXB=S2vCCMnU<9mN(r`!Sa!q{04e#|wrzzc zLs8jyUsmsImBvzzIt^f$E|DRNB5a|jrIWKmpLKO3y~zcmdxb!7562aL(R;_08waQf zRSH1Vtx-<8v)qGH+bf#d;6fRgH^Vj=3td8h#I8XDF+MZ#nGmB7P{%=FHvxWnD zLcnlb{!!=j8tNlt+IJfGx&*QMMqd<; z=-unf)e55#he7{4J;L0b=zq%hc&k4=B8x@qDk$_INDY>$U1c@~t3zP-tvTNt=km&+ zE`iAmT_MoJv1CJWIBnQ;ib*&dzD@IqdA8K#sdEHeQ(AhG6_kLb`oIHCq;>r*@^2c( zvk-zV@)dUN6D<4UjP#Z!BoThI*Wf{40KQ4Q1AAtGG+@y>xo_k*`!y+#WtH_QiN4Ej z&yohh$n{^xr9^ho!$q?&>1N^GAG>A=~J*O{5GbLBa+Jry3|;?BLqWaK#4hx zO@W#+4N|CzGB=UC}mzzV4E-p`DJbpS{X$K6OVCEnEz#xT!WX>1J1f zy-f|+4O4SONO$@h9^nRsP_i(Y$)QG1!2@i`NgXL|pwwEHzxRCN699k{FS!IB^&sHE zKlw5MVC_$zU)eIYWKTr6|C93WnoBNqT-2hV_y$?Knf_rF#c`>q#W;h#Nt z?XZyxr|5_{j@3EyAGkzDVnD}*sMQ%wk}h<^ztr=le?9W)PjQ862DemoGI?O>MRG5b ztjyS$rJxp<&A}!xbq_{29;0a*Fl3d-&O)GE_9ifqt|}xgld6DdzcZixGyq`!@fR!Z zWbmWE6vJcTN6&U|$Y|uJ;Km4FU#azscmSCD@@J*5^B(V10$BH#z`vJ9!$-#C?-P9? z&~o7M5cr^q#?_3iY?W$9wOIzlnEUD%DiG$+xo}e0R{EfCI4PI9z&-}Ua_FKk)_xlk z2G)c&2$%5V-1Q>I=FfcW^ggR@bY8iBk2);qzW%#z9P}HWq_4|{X?BvmHi5>PFHFu2 zf#c8iRyykDhInrP4(@%Q7|TSP#MA_i4xkXZFnW1B8$sdCqW8nEQqG1v{^-<*_?(VJCaw- zF=MNsh(J=&F|0NW1tW$o!#%;~nFfA}#VB%L_w-pRX<3~q!M}J-9B3O>I+9iZ8tcAL z0{IF;G4K@zwstJ6AuG~`JztSP30CIJ9w^M}Tx1Xumkf{$+mndN6=MyOCVhsjvR`23 zHUrpn`QR16o%*wNluh9 zDebp7VT(ghlz${1Aj;8Ja!kosZTzG;ZUCd415jwtAmX-6o{3GpQ5pMqEH)s&S(Tma zhfkETTlCuI!g23B84teh>sUPdVa$AewU=*o8zLaj@gl&$kz=ngP^W^GE35O9Z1=I! zCpxDok)E58vF~SYLAU-0Hooj}nBBQt+KzKH0W{%Pzoc1=iU>b6?lviCTNSIu2!Q|i9G2ASAYOq`>xs{P?VZ1_AwSLmVFZ8 zjba#B&F0uQmozn2*eoY95pedic7R!Ea{a%20swHUFAA5eFxdk3W8jq%+HY|I`5*K;K40K=oJOH4%;37ASbC0du zc~yJE_`~?Z0;7z{)G}Ks02iY?qiVcd)#o11n~q{&?z%6@*v~s(8u9kwC8e#(V``F@ zBsVuEQPR?y0(+M;>ww3UZedEDGIKB$9k~KV;aqfWovu_ivDWD=(n{EZ5e*^rr0PCPd#r!OkSTfQ zHnKRrI#r`~HmqOE!v}1C&}8Jfz-(xx!TVs*9jy6Ja$AklkcVxMlF^Jx?O+>UT&ZZ1 zdX`xZB(o{qs4-PV%Wa&3Fw9=N7VYk3IQYW5F!#;XVj%ixN~IoyDI3kggmJ;6u$7+~ zrbObn>@R0KNtkpM3*ty*Mz`(=0AP0Ka*fc7K(H1{nhMJ@T$c7gnk(OE?qSXv6_(PI zc9J2JZrUNKR?u~0%+AhW+>Oz+jpw)rtbsXf!qpA8!kO7^!it9o{>&8JIPry?BTyKx zGA05KQ*nmu*F=m=C6_VlJ##PAM6o8gfUiFH7Qxox&qI;1j3lkMaU z)|-_J6`Cb?{s8inx2(KIN}r~c3PPM1NlGGtnUNa7`9jyZvYI8CQ=Of6@Na8?U2|xE za5qL@J5%-^*t~;DR;!v(=0PAdrq;uspkkQ|P^Jktr2+`p4gKc4whX#%G zfp@;$E6}Rif8@$-s1J^T=&7)IF@Zkoc>7dVEWI&~O~AB?>CBvS)widr_;hA3^<1-5 zS@rT_4H`UbC}GSTQfbQS_))I`J}|wZn5rI)M!h`7VqZ~HW#iZj*~cIE6@(OAx2;q+ z2b+@g{F^Zwy)-Z$js!CsRMrsWO+O%v!Z^HdUCCh4D3-raFS`f4ViC))*?={F^hl&}@`-lf8GEqrg*!1m=?L0;W^vqyHetnk zw#w;3fwX48ddgUY7n5^l8V~LJpEu*sW%q)Yb!d04z?wImfteduNgGT!{LH;L@B??C zJLw3TduFlx0~>MNd$(%U5~@6FheJypH+ggCz1!jCvaZt>#I`E9Wxc>#WV|>yPjP9Am z+IMcp>W^-!YTw`ZVWHXT4{XMvi|)tbx+6ehoO;C$Z_6Bl5}0G%AZt0&Rza$O9LsKj zWI1rfySCurSKNZ}=EG=q&6y25LCHg}xCQe&?gf^2NVl)R^8fn?(Dlbvbcm}=akYxc z%8r(Na8UN|P_KRWHJ_+>WamfA_tT%gLysEIIP}bW@bLHFfo{VQG<#>U>dKR`{OXOW z*BIc8J3sbG0Km%kZ^GfnJ%F*|@RX-LMbeU(3w;;^par^47)S$09o2GoX^0YVq z;pZ`b>V9l^%OkM%{af(xlkdf@U;YMW?p}sdf8_B10oQ-%;{bp)@7ap|Pq_zq#TY9; zeiGKb`4Qm7GHdodeJ>t(;hh+-KZ5q&Ssef2jX3_jTahw>JJ!SD;QLGn@OsjT;E^2$ zFxNC#R9I)A`Ie9pqlAR<-)%zo3%6r*@;uTVv*-XUg1v4wGeBn_#OP&rf*!LUv@9dv zyaL@{ZbJ95HIYa)mU@v$Pd9Kww$knZ7;|6vj|$IoU;K=Joo0g+{+eUOBU4yCDfbG$I?|o>0 zbT4Sr0{HG3bniV8gU3*R$V?P_qqqy@J0YEO80}B)0iAzH@OrL8o-BoLmF4+&-p!j*zxsK<#>*F)~KpV#8 z8O2-k+=tM<{N6CGH5k8romwI6QU31l)*?OQVZqPMa~QvFljFzwaXf2&e}TE@>_v9( z8Jh83dq1+P-LK%eWe(%lZbJTg4bS-P>(D&wA<%Ihx(}|w;_Ej9W9e+}n~Kv%mz1#C zZ%E|-$T{c9O48SR{PVTz3S4KOhu%aA3u#o%HCo-F{mH#ZmplYoHwG^d__`GsU%4Ln z)2jdi=DzZ!y07cX_xbZKfK@eXzWYI$U)$!v2O8jWtH8f=GU$O;4B0PyzJhA3D+2&9 zy6|yO=+J%7eZWihfHy9H_RfI*@kH>I8^B|+Ke{i-d+GD5z-Jx+f9iOo^A3RLI?$W9 zfZn%WR*S#qKF~|{fHy3l-7^FH<64aW_9UQ_erB%|9Cq(qhjhh*pye6))@2yKVGHs% zRsdkkeWi!zFMqL&{jul6fM!@~E4i<1nF6eZZ{$&RMl8M40=>{I3thQ3dlW!9bk&?8 zGu}IP|I0V^s=;5cxS8Q!`s_;cV(|CMW0U#P0BjS0r4B(WG$j&;!_NFN+rHBimpx+# z7WgJuLV1Xo%Vir6LWmv9KDZG8aAe0l!Z4>E1OUu@ZmoKZ<^68mJU0Bq<1zQybvW>> zyK(T@yWELA{Dk{)|Es=XJp9}0%`rptF= z)8&_;_%T)%7}F#*rsJfQMdvJ?6e}0#5qACt=w&Ct=@D z+=_$GyG!7h=I|5A838>fs#|viC%)_=%>KuTIP|Q$ap-$@>zHVwDcL+z!y6UVmdh{0 zmdkf2vxO}-#>`wi-MBi@{5LUo(<+?yL*IqDTUTSxE3e1F3+@NN6JuLA z`4G0e=6sy`+)J_MZ?}sPpNfDgx-)rgcF*3{%11o2>a06y;T#3yucmif_ zUWo@@b0g+2y3d#U;1wz3dCp_}y z7h}_(JQ9ab--kPX=6ZB2<-i^||692Ir@w*K*R924UvddfxOM~X{NbCi=fB%@m*7_;LH4htn-xAb16p_jPUnw3s zSop>5n19@3G5+1nXrA#P+F!YAum?JI9t$shB<3%E490KSi2h)zseuwi0D$>NpNIKJ zpI3iB>paY#HMt*v$AlwKKMRYm+k*7yLm0iGz>_ZBkI@_NME=xD%s=VT=svgx?W^~o zdGWozN)`JZ4k{DU`3Ep_<;|eej$rX8PsRL&XJheKx1f3U1A}89yn5=8PCJ5y7oUdt z$2}V3KVCoh3Y~TYi!VN1p81oL%DA4gAEP(kh5V`GFn{q`=stKn+E?#I`;tk1=7oeK zPkR&=U%MIU>_Zs6VV66x^Jkvx&IKT;LGx#xi}|z8ooHuh3@D-<^N%{GUJWo~t%p-y zBpkWoQCNK4W~JAz$#HL3#KLpVK=+ANXr6yR+7~H5A7y30s-exF{aDPOU3kU5m*0lk zDU*wI?u~wDCz==Ci^c!574uIz7e}6XHpcH&@bL8{Kt&uf(y}Hc#*d=y6ACeFT4n&3olYsGWf~+z`uDr z=(DTQKJ7fDtJfm`+%E8o_PS2<;k;!ta9jpG{Q=;YP6Ms#fS2r%i1w5Bfq&z6&}UWy zmp=yi!zZA9#cs4ebdTzUkPf|=aOA(8jm7_cGSXQGF?#KtCZI6?*z=3Q4`BW=@_qii z^Wm!=IzA~3qdOAR&h^!L{azQmsr5SP;c3;OX(@U8F)U-RSpZUOIXO>foI7MNvWjxw ziy5fZa}^x^SXF2d8H=1T<_<^3V=Qt;M})C$L`HNRWVxg3Ixpi2=*DOwG^ufXOd4Sd zRec;Wu(7rj&{Dq@@qu!Ep9)g z#x&u;_ul~kIPS`ANQWA%c<&a0=UID%vZ{dlQ@Er_p|ZS|U%3r>#o`kI@sX&PYSQjpL|eq)-$l@IYQI*?~-TM z{qxBHfP0_1+kATc7qt{1XN62Uom<~`3P$^9u=Ss|0|4&1bhjJoM3!?8eb2tL8-(`H zj9_`EJVyyqmMsN=rw#%oAT@+`lyKs|Z$diK;Lw>5W4!J#=C>UXKKSBVp>NnLu)*K@qr)vu{3oH;!_V9UK=`mt1Y+6Gk(z|2vF`$B z12guM=T)bpuhRekAOJ~3K~$zB{5ID%7$u-hk|x?Nw3vDCMs&}-7tIM{ha>5{X@25P zpv_qPoo&cpSqUs8@XgDx@XANRC%NLVRtbIMH5kw+OBu#lrL1v`IKdCG(U2C}mr77# z{Ekh?549M-V-oUDI=g&6)2NK4AEj-^m_rA~sVeyrxfp1z4T1?0vSPKA1kKd1>Yw-;ygLlsW z2OEt4cvHa%I~)6N6Jevi{pjPKG~l{FJqb9N(0x!=KlVn_fC338J z{sSeT6%aHT3et9d_8y>RjNiB!`Af@%e{Ncag`Ym9!sn7#kDV4@w;8;91RP2j|Ivm) z+jQ}Do4~vDnKz&0&$KVQSH|_0^}vCI?j1U=7d(i5Vq*8F>w$xW?t`lWe!^%c`sEt` zJsC4~ToZ~p{0;Y1R<74l*IqS$jUzFWS(Z3FmV0{9&D6r_T3iUdy@~CG0X2X2)_lCng6wvxo$8{aI)kpR+(4 zd9^un2rTH8AgQk@iH$-ehJT`jR_&#p0B{Gx*;Sp&VlztMxA2XgUJUY0&-NUn93q;K zq;3Z#33;iLCBjD_vOplXjKQ5aOfEUR$4N+TK&|Ff{)~|98o;CyXKHHqrGbm05Gq=_xl>{UJk%=Qxzup z5FA3K5StP;dU^6fmAYd&ajtlYaNIv_#{TcW69=EO8>{~66iB)~RXVNR-=afClXdAo zaX4941y#;^7?-Vtn8z;-NlK999X6=}=T2(owvG1{UCNk319d`;S4X>-0YsR)TLjzU zDFywRik`)#{Ox4j20L z6d-%^?4z`6`QGKA1T5bpBZ44rfum>!P9rFnZ4hEdJnbjGwm$ z>Cd-XYtvlxc zF!&CUQFQtt#V{GUYY|HIhjg~IlfSa6{62NRLp9p!Go3DcJNxlERfM(#BW=?HMz6dJ z>4F2G6UJWIi&l^8vD(L-vq$fK=%-ruAN5^+Sar#Q%DBcjf{Y?jFlE2{`YZIqF-yb9T}uAe3=kdwqRt%fh67en{{`3yP zWEME%x1~2VO9Sz>zAH6}Pky+O=OexPvQlwle=9y*;;OLRLtG_~<2<7B6ZhWhu3e4h ziU-lYdN09=~keiJ=I zSmj1{^;hb#Z8}mLw*aUspS{?^NDb9fm7lNvO6|66KBCT2X{gyZ0+4I|>5tVv7CUgj zLvw?@bfNOcg37tx&*;NfS#0|!OO`<`C(Ht}@}t~kt$au5xI?QY;yXwRDi~!St?5Gq z8$@|VM7V4UOj35^sJdc?#tU+2Rd79Px{qJTv&dTpwpM5FP;l?F`d1v8JW_ZVSu0tQv;3||E z*Eg+)#R>y+a%b~@zZ7Y{g&R{2kv_-ud$znyaYFgCJqe?&SuR*il@N+g8qs3dTRXwH zbcZ60njnUozMresZL@XklhHR(Q&-BN0%}NG`AUXv21?GDKIeJ@O-|qKAA(_K1|vN@ z!itYnHJs53}Nj;1$Z1CLObd`r6;lR1iy zCdq2Wx{qwc1DEc>13T`##S$Q%` zG>4_4M3V^PG3#dXghrhoGt9D8>k5W_oDgh&1e={5mX_2LQG zee4rsDnR_FhC86!s%skGOnsgPzsH|B7;jahL#U4PN}sQI5WwQEY)AgwN;H=}3_AA! z(i8T{zw-}Z@mEhd3c&38YxKt3LFXMne$!Uu_ne4kOu&D9spxDK5*5BRxX5}o5dm%^ zwU=H19BMpG#dPnqtBMV9v9;*CWWMWplajUxM&dGk+4OVdKa{V1YbFlg9`NVYhUMyp zj*a2_JlTyYg_lvuR1WROz^=SkQr6p4cKvbIjEI!VL6&N`Tb_Vd2|}q3#|ZE+W6Wx2 znm1DegB}%Y`&;=;s`5#oDhJ#bXe+HQFOeOq?BP?w%vaW+*}V+o?FRv3%zplafcet# z;^xBu2#Z_918nbECg}|fjBYPc)%r3M&j?f&8!ZoC|2RBD0oBsd@ zlpD`ok8Kf&;{t$Zv!|()nl5s6n-3uokheozLW_k>LW{Yb8eJN6)DZdxki~=asxQ7eVLTD= zsd@OmZ$j@&s*;uLlzXe*eKPXuMI5?fuN!tTKQNKxg}0#+%qTUQ`U5n?pq%9|GTJ05 zA2UtD?5M@esKKZuvgVnh{4AU*bFfV|e+ovMM9L2UamJ{X z{Q+@>F^D`Qk`2x=lLyF-pG1Vw-)#Y}8Y4gJTS$7kV`2t$X*`{?4^_hj8|7aVHq#ih z_dY|@$|xa|*1Oh%3&z7Rg+&CuO*gYDACvy&TbGwPTeZ$n;QAfevmqW4?ANyl}@{4q4o zllR=2)O&f7=LYF9iMan?E;?Cw%Xo};&z6plhUYkx9Br9td{X8;_gP?((7k6J7JlY* z9C^xPu=tu&007Np4^6gZI3$x%a0F8-@Vtct*!hfZ6}dr= zIP7VNrTShSfQSRBM^3=4s$b5S7n??dD<-4*0Wkm*b@5B|p9c6R=q?3+?#o}o=(;Zn zUQA!9k;H73c1q5Ewb!m{xi+jl6}=j$>NDG8$C|pF2*eo;LH3V z?C00ko{3%ufA9|E;}@}C^Y52kz0vcpR{p)@H9z>{H(_zpVdNEK%s=KqeCzes6(cDO zul!PB92O08*p&HQVfT1*!q?GjweDkh;Ky&mc+)((<%>9c?t{4R4PVhThtgPk^GX1~ z!e#fmkxNtzOBwr};N!>J!bt4e|bZWtCjfJ&LCFj|uv6gb?Y5Zq&4HTI5w z=XM#_^X@=iwTK5^AhcNf&TWVrZVM>IumemW6hl`G=>%~0KK-vwAai!=GNMW!9Y;fi z*}Iox`KQ<7!1M1yYRIeV1airS(~w)31zEg%T~%_%SuWS5-Mmnu#>;a!5m`=7fLdF6uVps#)BHrZU-qzSmqiInBYzG{oY zgv&$@6F6r{S&8M&gyigb@pu2ojhNqf2;=2r?0fWsxcOJUT$VFg+FgE|@alaR@Ab5) zu(AmNxbu5&$KuLG-1Y3+0RS65x!K1dJXZ#nBA-&&2u>vV{>gBN!qcRVK`&CRJ0(zr zozQRH$BJw@{<;(0d5rJxecm0&s~2(a^Mn>BT(iOXZqq*qy>`9yMl5VPjBfcD2hVv3 zcl_qpDreN3fi~I7P;gclx<7z?KS@J`QPZf<6sOc3WCEI9%h3G$8gxIf8_mFZL0~q6PMyc-jkh`M zcI6wyh-jYi0Q%`e-P9LibjwF4g|h z-SxQsUUeKBj?aO3SZuh?93plq$ zJZB``2U5VYPTBc~F5Evbzw6IKl%M(Q8__)VA<*$1&;Wc;=CL`>@v^>}3-*iNfvi?C z18j5W(tV&cW8kOC2I; zDGz%2&g}ZO(2$Y_!?ldQ8PJtDP@C2=E{t6>OL31jX&?&{=$vU9i~!80gi#`l5}^UB zlOQ%r1JRH6FJ@I(IZ-hg*ujXN3&nX;00LNSi!n=)Zj(E5j(~ecTrsJgbW0$V%>wdw z<})V%F9(`?=Fr};0-%_#B3HU^7We$+XMmXwD?YFpEB(h2rvw8Hu9KQAT&jB+XmVaOqmc4hQ zM~D*<##7vjZ>+Ya%=g_iBASZrlq!kNezOZ20}NaQ_Q$$8A?# zi_tx^*zkL2V#OCv)bfTkl5B!l!a$;U9-q{umFTW5B$bpShfxpnvNR||Ji$_igtkf5CfYVhdIxt|YWJIg$i||CX4E2Eop)q_Gg8xl zv()4_hGEXV^emgkWf~+(Sp9_)fj6CnZ$1BZ-28W+!swn^Z2tYTu=-0U7R(2@M{Of) z3dZ8NL)#?j7qWlDrdi3dU^mjdIgL(N5>+2q_38E4{#)nbp6BkwO>dS{XqVr#3hUpu z4IMLDN^bC<{1=bH9Y1+JZhQF+xaFrMSNTaVxT0DzoPA&ppa0!!!808;eryXiUA;9T zq^HE$bI}2SoxHv~q!_Op+UQ-4Hj-7)n>uWWu=Y#qaMusrg4u7)VfpUmu)@JH>M{G^ z9KQDE&wyt-tiO6QHhgF+Y@f*5&#VXi_BpuwIXm&qH+>eQ_}TDJB3l{~-b(~MwOPhU ziLfvhClTsUHjVJVt;ls1v>vQ9oFtkE5JW^I@+Jw zi_xFmCV0MO4&7TzwV%ab--`A(c4PF$-DrPx5AxN=hZZJr;Q^!`E_!i?q7cGZyMJ8` z{OmR~FS{4B|9q2->#NH!e)~GWWd20oedD)uwD`X_Vf5-fnEA`w3!be4(4a+0Rg?WP zqyRAY&GK9SY=Ox}Yk2tH8O*%@M$l|V_pTE#zVbvL|Ke|KMf>Z!Fnawiw7)dF*7)@n|L9Ss2~j6acjqQ(H~9Qjg{wh_}I5S+Q}n`dHGA~D{~5K^;H4{J)3 z25oc#w49_daZ&^M&fot6z`(XwN%=DNGNjOY?-?mI7>_&HUInH)?I!E*i{mkxru7{8 zrfrbBP7b+KCp4R*MZwWUaVTw`lkyiqRud|tnBebrdeUvtqU5|tlrYX2GAaodY;#DbcT%}S-ZR-z zNlu(hoaxWA?wPPTWr#AG_nQSXx);B5ewJE>$WCp~C*4r3X7+6C{hVoU!lQ=8PGw{x zJdh)VOP6)m3?@za2KJrk(%(z?=*OCIg*CsegV&!j4Y2cbb9iB z*1$>z=K>eSDN1gfJn!rIp(+h!scm-W!OEAq9L`NASt~pjEt)aMOI;8pR_KJ4!_V_^ z_uo0|V!3Zmgv}c|ZJ?+nKaw2#Sp2TpF!J5x7(t`pK6fJBC|EZ!K^m?^%-iwX&`s`o zxoOn}VYY?XAG*-av!xy0Etv)71DwtBsKNr;4<>}M?}DsZ7gmS&uz-6 ztYmu29*y6iwx*r5JdmbJMYDcDS?F~YnXuIZ%jjU2-IDGtGBH2zX`a(G2iI=!4T`!kylcYY?~)R9yFPWgE6e`*Z~&4~(LgJJ^u}o3915_HEGA&; zg*z;8h?*>4ZM;KC{bh)Z__N58;V^sq0*oC)O??6z;LJEu>4+k2J@;B!c0A!vPWOpX zb@O7zlsR6#K4G2ktrC{aq5wCBrZHAjvHib$Lw6jkYua z0#GLq)H7$n&1gITD<2w}yB66dr85n>Rh9-2HH)Y&NQo@9#Dr(nfQ8_PSZejIrU@W1 z%p1EvaT_*(N=~i+Yf%Uj)A3H4-$@V^0MN}q9`Qyt@LGC{fg1wYgk1Ene1!_ge3bEn z^n0Z6<;_(_2au%0tu|J89LrRa@shb|j zaXFZAXArlzZw!Fu=?Fv^PZy9xpt!0rAi)DU+D&<>ghY)E@RYR;oKOj}pfFmcPv}3) zjUNE*CO3-T@+&kS|Ey70WX@Q@RQc+nf{RxkLn{j7-dvEcX_j}oxzH*5A99Y(h+ThW z+JD0rr@xESox0EM{9|+U*NKW=HTT@(LX6QYdr`+fx!t*$;a{?S&|Et@6+6)=ZVyEW1u%h^GBR7v5`B%zV zNf#Sq5X^uw8%qxA3L!!^CK3l=do^j>1yL3*6yj}AO^o0IA!oiJ~3;~c~bI_ z+;gnLFf4^oC-x22feW3Sl|cig>Iaq%MLwyD8p~F~)W&T>Cey;yG(heE=1rz%#I(Xu zH>m1qwpF(#F~PQ4H1o`P8W9<-FoDlN6(^}EEp>6x^Yu*_$mZ@gT`!jaUE+a=C1qIP zLZjbP;^S`SJ%w^v=!@(c(Jn za0A%!&dzVLvtLqZtOVOe8L_Grb*eteg}w!>X+aYht2)WP8HHc>i*8J-U)DiQvpB89{|8aRp+Y7b<(Jk@Q68ou1KJjKPXl>TscyS;7rnnJDE@+ zT;pr=APGr8J| zF}8l%_QGiPTkaqkH#=PO001|*C6{fsl8FG0;HBX$NRWYIH7&f4WaCgbc#5~$VNvL8 zw?kMSv(lTB!au-JADJ0}4$}!Lp!IH{aCVKhmJvXhPoDuHdp8Q9R?RLTsTgSTkfHj? zbXCF`vDpEsaVKY#DX);y&F)9I?pFPhjC4zhwyHhT#2!fPaXct&k;%Z8Pb=9N%s?ra zV2AjItPbAh2JYskGxOJ1oXt5RqZKn>n3JkVUXbSh#m+ zNHgXokb}~curw$*`U^vYe7vlK>S*VKk3%F9V|Px2pUu`7*3kjmE6UJT;RoyB?K}Vg zAOJ~3K~&JwYxP_8bgOvJ$C02G`ss33Voozq!CDqmBbC*@CmofUA-rDrl3C=w>%mOT z9A`&JDPrWvhS}CaovM9eUwV^`Uk9`rm z1n@G9${Cy_O}f3u-QN>(gW>b?`P| z(HunY*Y2gi>l}kd2F&k!=7s(#1QZUvHWUJBz4)RlpB}7Y_6Ry_fr=dTi51xxigBHj zMD?wWOmwX9kCpU>&gnRSQ{UzGfG+~6o~}N&Mzz2$bs>cCKB_xC1#eA7uG(u+QL6J22q_>R{lrAVlO;08Txqbq4NSL9PE zMWXl|;{<@JhHG||vN-3A9{@z`OL!u8?Ko^pM`08uVRR7cWay}=&0uIBHv=e%<`j&Y zS63Vl6wD$KbPo7cDA=mhOAWj2e90;pviky8?BrqWuC7goH z>j3-aZ-(-%>rUfwYXhHx+< z1veCW(P*^@?l7u6f?X`d)mPy%J6@c!Ysww^~r<(fcq}xWgd;JIiIwwKlTOxm`4LYLG#B zJe_t;s!(_Xy_Exh&^nE)8*mO%NQE4$`b^-Is@oXy% zKm>XXQ-j;5^2_EZ=i?l$Qvj9av-3XM`RN9h-emaP7=bjOV9b%C^U#P_V#r!$;Ak8I zX(*0+ir(41y37*H&>SY}$}S?9CP-|GggiE5DBeq=RN-_>Bg?D6QO1WV zNSWuw<)ufuDL<_zls0mK)tHrWu^JnqoHWPYgr&D#k|QP!Wg}T8rXDSw)G@PJhU7Va zWcm9DuQarZF+-pwj8OZHARa~D>?lS(>#|+hD7s33R&a4T#n)*elM-ZjB_HEZ2BmQ; zyFEg!e8V7ZTO3qbjff3_p`6);h8ed&M8``ZltB)|Grd}?7)IeJ8k$n-n&QHyi#;Bc|=>s$epBt(qWr9DA_rO2>hO7)4@X4)^slA=e9%*fPt=K8gRg>9Z8 z@J9@GL*3HYX#TDcE!h?kUE(xf{62@^V~V-IWTQybXmAHP7_-#g>WY9E* zjp4y)CeKy{ps)z}yh(o04kq2?Z*{8+*q6o4QJBPH@Qruu%rnRP9Om_pQNn?b&&O!^ z=n-Mh)^sRS-&YtHacdoq9(xE&Mwfr*{-K3_2tk*nwinyj3DBhfx@UT>SbiTZjEz;F z0Wx_Jbh7;EmOqby#6@O)o|n;6d3rr+45$t-F2j4LsH0Odh(c?(w--7^zsh0#G`@Q_ zFmmv%3&hR4h-YSb_{}i6nJ$hFOaG(zePTw@lGRpOuB0FW08#aB8XFHVESPJoY=*J_ zt}@4rWG_--@Do7XxdEojEU4sQ$oHzzGs}o5Wcx2QIGc2|p~S}HIRlEuRb|)N1%yH| zN^2vsOol`U6HC$y>$vg;WU|A#2yWZ7c2L#AGNym422yicQ8+lR^Hm;N0M$1nD+Ws$ z{FLIzY{<;P!5B*yg)SeBksNUKI&7)fB8pxzvIZl0B$&*|42BAWL!?Jou4q`#t^1X?&a14T|MzEn2HTdM2X^PbZn4xVB8#796(_+eOoMw1MKQXa1+O22( zc|JW`?jA4>1m+2wqZsj=+Oqbo-Qp+T4pHGmjVU5{YL6)$5Ip}HY9!Vg(Fx0S9)_;^ zNv8`!Kns7%3XJfiZ)&m)IusR#W)rHR1*37^^vP=Xl{ZTvtkkgFw(3DdzRYLy)&&h% z&r~4ai{X2wNsLH4?bl>xCFlx{37$~cImgr$gN{9%1T0+Ah_zF^z3!=gVo|5BlU(Z8 z=$d!j%8=)RX3>Bv6au(rSz~rWRx?fW2wo#tX=G7sMfoVqMN$LWN)o%HFi6g6Ws*AG zL=xyJtPZ3&2jeJC1J|mGw|IX*6fH>JDNIcm$~sTj$J#_J>=dHJhXkM&!pOkDrjr<> zRyPp2p?t3ub~c6)R3}ufvbmo%!e)krI(#ORvUr_cNs;&T&%cF3m<0W-VG82HbQ8dN zX$cV|X#1k{$O4a>^M$}&QiU*nk>RJ8LpZJ(dmaQee-^Lwcq4N3MgzK`!CwjaWYS~# z>WqUK3^pejE&OX%eKH{Vr+!?s?>nsIn4>YfyAIh{7D(PpJBo!4v0nB)&#Qaa2;AE>8 zg?}~Ke4til%^0;oAOObbUR4S2pw{Y!t?&3o6VQ?!$lydNP*Dfyr=5^p!?$KTbBu3*7Q z^?a-~GA3Sa`XrkSD%S+Rnm5V}UzZ}oFYCD*TG5K-dD)C!WDiIIMubqW%BQT2_}H{C z!@wkIYLNW{)rT^(_5w%8K)YjFH!v7sG=b`J`w&q|DO<3~`Ib z+FEepYFA`-y7UW6KF7j?}&L7Y6j8mUWuXgvcLAC_f?6EwKwMb~&TQjX@ zZ>)vexO_P!h|;I|{VeB}=BM?r0|PGJYFFdqbMUvxYhLIvx?V73X1tT6O@D7~kWXxi zIXYa6G+nO0T3xxsw{ojjxZU6MZo_gjCt%IRc0iUiCXr-mh#~X4coiKD-pY-TbDYv< z>^-AW1C!_y-H8TNOV@1o@abJixinPgm1f_(D|3=4R*j36<&J%I?1477LrqSpWuLh_ z&=-KS4^FPq@e0F?{rF96n1Wg-ae`_p#$mP>fP7f21bbrTrK*jQ*Rh*4Rw9?rMC2Q* z+4eso>@pWIHE=dS0;LlN{RL5sSRPqm8PzwVc{P@2TDfYuDV_RcX(;l7Er;2}b>k%& zMI|wAV>~Bj?uC&N%Tiiwtel?rdE>Mcn4*hN^jV~Z?uZlx`DzjDfTa-Wu5|e=N5wp{ zZtZjRlSPSB+J;4{JuN4Auj&TRX%cTxXj#2Byc@HI12sCF!Pz2*;zSIZLth&P7sjbt zQcO0Iwu+ZQkp|#DTYg*MF{1C#{wx|7n}0S&VOERGmoi8V^%Tt&gWozcXM(~2A){L> zEW-#fT1z%w^(t3(U(7d&NK}syIv*&1lM1k5u%otvm#k!@&?0gP-8^8!BRQ|zvMI6= zpw7#rX9x`Ah{=`@Ase%tuZ{m0;cTk6NWS6M1gHvdbq)n*k$yxJHH=Mg)oRPMHUOIu zX?`x*EKA=JN+rLaS4OCP8vdxk;P5w8j`x#ZZu9*O|Ixegw9#m3H6YJSKDUdezHLvEBDPvh?w}6Ruyj=litaMnprQwx#U7-I?7$d{ zdWm3P)c>6!)X+fZO9il1CyX=z6}p)Y?i>@4>TkOnO*!p(P2p8*uTk+F^!N2${CApW! zk>6S9oaQK52cEa*W25#ych3N7fi^c&8!oUrSgk*bUsKx>RM6ESW-l(k67xk**j92 zrNbdn>|a9|>9Q~@`?O?FB6M}b4&YQ<7u4WXPLCIS45bL!216=4KJCl{vl{@h_3EUX zrfn_|A-1rCkkbc*l)Q!yW560*Gk0 zZ74Ctncoegi@ZZdC~SMiDygK3e{iL%JmrV>AO>!X?foWDTZaNLYuu`(nBa^1StjJj zQ9?ctx!#C$kx;I-101kTqm~;cOj}U~Lk{VCmL{a*FwfPLEEu-eVDd^k#SJC)i42FO zk)1liNF`z)k1XdYvl;!&5Tcmi8ILx0=!WDD>j23%X+o5&WWXy!*=8eYP=pKD34 z#v{?Pr;;TBAq>vGk=m)%7$8<%0Gh&}lZgO^l}t3a0ZI2LjwRy{%S|*|xy~4i;DOl< zv_`PI?2h(?29a*TunITIQAH!h#+zIny`kduUS(8j9Zg$pfYTMpQB&Ual^4Y+1I&}t zTZAF`+{&WG9EE;fIR2Y&?0J5Sh_a{kn;;Oykt0+2FDAZsreHEWF1iU zc$QBK&pMBD_Y5_(Yr#@{wu-RrH<=ysZrnHf$WnJ$1FS^kdwr}>#KaY(XWvA$x{;Kv zjbYVlYW2R@QeFUP1%kMzLQKR)tRPrH5Ol_{eXfX997!c&|M*XUa?^syP7QDN0$ z3`dq0W>HPSM?oo(o)ndI7)9&zh7%>_N4;F-V5=VNXA)S|5$k{`_(D#`wUwuNmX{+ZYGkgzz_7K?R*fSI7X3b*rS$N zl|&k=wP`uC6*U4DDLNKuazNpN%9FI`3SW?^s7-3R3jLX8561oO`>c2F zaM$xHfb7_p(8K+?J%%@1)jRU_AQ*QHmKH( zwf{bI0u0n0R<-))7q4E{?C`$fDbt)gBsF_Wtc%h;+v=AcFY57{@2wS}(O>_2!{SCu zlYXzy=N7eFX+#@RQjNIt(u(-UV^ZKCh{*eig^i$PQz^0*-MY0E0ws z-N@3&kJWYO#3)ck3Zh6Vh@aqA$OnYPY^GqW700&$tD`ev=twYQ+Lbpur+S`zCV+iY z#IY+kV}f7?Tkdy;0W`u7FDvOwW;Na&)aU|8y+RHSF4?JQR~SHX@Kv1<#xfOX(WoQ< z)WEdyr-@=la^7GpxPm3o`y`e}6&K7HhruURe@&C7JOG~4F9wq0Go=g}KzWjggC9k= zJnaJPhl?2PZPQISR1`SV7GytYtH^g!sxCkj-gP3=_`_jz$4nhHK%D`!f=`87R8WE9 zN~yw{?$HYc7+(`mXR6*m`$#z|FxVs>th9^GsnWKcRlD&`oI{ZL-qQRSZ8ei+t!MKq zE4-|~e9yr`3+YmWt>v7O%kGABLPh+Mn|va z!_wq!A8fvJ|C|fXb}qJEb$u-v_)CUddba5yedy)Sti7(ERwnB}ng)`d`TyYxy&ZhF z1m`iGAsgNj9qql`*57tKP0$1jFlDOqoIlb$n(@P8f4xkk_2ZZs`!Q!c<&7h~&vN8v zyx=HTDUq2yPg+-kb6~ux565{)k}lK?EOeWtHruK@M@eFbS8YL0;pNc#>~ka9&4+{% z!@pCCU=h+fzP3lCtJi=Aio+le)S9hisZFW}OXzMugV1?;HEjgGO47Hn{t9BO&kWPVaw$!g-2);srd2>H;6UD0POn?oKehJG^K9ul2yF{2x-%- zO^&oVJrjizLkh?Y3~8xI32X-@xx--!ku+_jBGsT3ScgH&K3Nowq775nqN5D#!`ihxxumPZ_$2#o{BYE+alU~n6(EBQ^C3+lqE}AFlX+Umx z8BI(`iqarr7v9BB8%8n$sp%K#CvP9=?+kZqbS7bzdfSpu@xg7I^8jK}6r3JPAT!M2 zHs$gBtfkhup~gs!@p6=g(>`)_rf~pj88B7GFv+I45d-RK1yIn$@`%-j5%&kxf&>+wkgUONsjYnJJBla#bYi zkVb{P+#Zd>1-6r%3}!bDw9cy;q%h-59Ss6tQF0~rR2joC0Mq0!#~jEx;;H_(!fv*T z*!OyGh-D~7FdmeaMmzgfISvFNhrsY>-gi}=NCtEom%T+A^%O@c3_F)?1#<9}@_TTPNcqL>CT}y0_%@@wwo{i5yBx;)^grzY%s@hi__S2o%)2#qsAa# z&}qkX0`ix2x^?kt6)u5hf~vn9Z;C2Qe}VIj-eh=s3C%{7SjCl2@Q9}yX=j7aC7J1V z3bDa54uowzf?ISAdnAWd8&Rt7UF(Dm3o>Y7y%qEzuLNpk#)j@?@r`L9Ibzo6~#N!jR-6z`7!@2LwT!2(Jd>3TX|IvH{`gh$&1~u9I1_mQ!1Zf|o@5U%VVyS_8(<80F^rr>gQSBz zkYe_d+Il97;vAlUEms?qvutz@`u@1cP-&y*)R2dK3T0VAUQ*myMrFKV(F28!U-%ev znvk??fmRLFm~O3lfaIWAAzDJ!4soois|soP=TZ=>92}dV6|YqbkjQ(apEUsK1TAU9 ze=-si>i~M780(PD%c-?uD1$44VPnMh_BI+-syL&;HUwx@9m@eD7n{l>p`XH@33tOoQgezTAC$^JsxT2lQSNy~ z7X(uSF=q4Ngi$7xagd55O5jOz@wozJ7%)vMF{-VS4ao7|w9M$LZNvb>gN`wW0+sQM z!+_+HO1p}ip~$@)Xc1VH4pik(kV1%L1>KXuF+rtUo0w>h^fsr_3{uY6wo9(;6NJ$hxztbNQC-%z{XF1b|47DH*3L0d(Nw(zYgwFPha@#5tu-<$(zF5e+!%m-)xF_;wSA~)DfL2LCDQT2*-o%bmRA27 zyfEFS4iG3R*;N9hJV>^UdS0XWi5sb6CktmmWA)i1B?Mftp@!@*=+ciG{T2}>eYe0O z;X=fs8|^}IXk@EIt{bJiau7#^U4sbIqvV6xbFw972^}u75 zCRz)e6au)!@~G1!!_*0Ecb1akWSNHGK@88KkT~Ja=Q3w(snlS1Q$mN_INzO|Fm5gl zZj@?fG!)8HZg#ooiV2-$W0ENgmmAq6b4p)=(Tu63tCJit?^~0n<%OBrUQm|O78~RM z!RHvKR>H|H${#>sl><~zSoQ!^m30zLCm&KyJF^NNuqqlvAl52Eb;4#Tm{?Nm2*Mu| zfLe+i^_OgkX0$!Om4cPdl~Lu`fa0qIMHLeu4(3SWs4!{OAchwsu(GP@gd~}nJ+gCT zGRY=1Y>*hLXN~+^@8GO0uew0-1p|=#iJSUpe(m9GjN;B9Ynlqf$Ok=R!qhY;gG@VJ zYv9flednZD8&u-CWiYWUEqh)f?PE8}^!~YKQlsdN%Ur$qfALh+CF{1&|Fk)8Z<( zxQY$ICTFcpO7=sH09M}t&@&E9N)kdQcY6217(_|fGt5!X$R@~G3?^5 zUHwoS%XGK)>l=e>b)3a}NwAX9Bl<>$$>b(XLe+M;FzWEyoKNi{*Ym?Zzc|bLH=w>-nC6iYu=WQVulh3ikQok(n&m;UEMJC~)bC zWX!&ycj;<;OZ_xWR?Q1oO;%sIIL|lpsZ&-a>>GqQsgp2V14koNa%0|9X2!g*+8Gtz zNL*$d_akmKP{8WABy$E4o8r^B801lwW=#5b-B~NX;SDNSGvpl4SoDe@@^Kglb(-|x zF)@xs?h!oAtrT}WEuv+PVj;q2DcD-AWDF(N0IKZ+%z@Fjb;67j<#`@0nGx^1VmMsjP#7884WwjB^yqeMS25gi8E)Aqm4EJ)Qvq)%eeI3KCy^P=1-KMp0B#0K1Ub62R4WLRKE_%LK2y{`Dn&}ok!qHM(-Tkf zA{(s)_KD~#9{RF5H{Pb}GmV}Xk_-|x^jh5*PO3+jtpT=*33K3^sJ;G|s%-EoWCw=W zMk7FYQkO1ED449KEYh&#bF^biX;O=LTSls<7f}1%FQwhwU}|+@(_)TXG$NLpIoZs( zB+HlNVGlp0_m(a)1x9Vf4Cy-*Bax)~jU=mdc22-J6xpZ`_zK@NO?o7K04dIjAVT&8 z6p#j4rdo9cv4W+VEef-&-W38*a781hFUOu8f>f)RP^BCm%X5`022;ivhl&5J+EA@= zW(){k7{c;Wo9I<6tZGW;AD#MqqW%>}YMJW`ig4 z-@nndjwxpbyT+ZvgHc zE}aXJ9@Vv<^w1(q{nd}XagOYn+%(5~&0P5g2IgIuGq1%`n4%b1PaAjVU96}J!=8HWFt|u9B=`);n-G= zC$3mEb2p`3Hg*Liy3JW+95n1t0Lq5ssro85yL$1#Mh>`s9`vMC74o)Zlx#v(l!|Z; zAxWe}M|?Md>hw(C3z2MWt_HEDCi%f!=^ZTv$YyMrLFWizodg=uPWfhzk#k`wQAr?}G14Q%L=Pui55niN*#=+E^ka^AQ!Du#F@frxO> zWq*#Xv$3Oz5l->ztkV~Si zU%JQadE+bQn8*U7RufQ&DxjNuEKLZ@_oW023pYbq;T+3q{|@-Cs?PPDzRq7^4V9egm0{Ds7J#zHOS`Xs7Af?74pqx z1{hQr8z^8R9NF5Im5*kdl*!==tJ7g80S`p*bj9S9xGqy!4d$q%;bTEkjEcW1PDc$? zyOR(rayt^M!*^SkG+lw~V2D5^ffswlE$w;0F)^lVj{+cq1SZFf>yd(5^u zf{B2_G^;R_iBr^8vJ|L6Uz|*YX>g@eD-w>K`NThjPiUY6fYKKg?F;aAFHdOL9W_FZ&gEm28 zqSdVN%)!8Ear4#DWG0x|TOD67ab*Qlq$)9hb>Zt|g^N8b5wzdJ8Ds0=ieex;UR@xo+04sH9w$9yI3dSl#+ZO(vVajy^hQh%;{soHa<0v-v?hh8ri8afe|7vw z&3`*7nWk}g?#8DvHrwq~HKyr6+=pRz?_vRh{%SP7wkX(oTWxXHni#c{){79~3pgtBykl8i$u9 ziVy*{dTN`oItL-<+AtXji`8!^=*On{mM!q^GcVlh-s=sg?y-P9K^RX%kE|$7};w#?uZsSbHrQvRQB12b*th(CFtS z6xai8BLVje=JdSrCAT;TgCxO(PQm&s3pB;C*eJczIaG}^nInAtv)uBIH=BWg;V|h} z{pJyANGVFFj;f?-%1nM9i@hr#h%m~*zwDcPwt~WEL(K<#%?$618Kt#lFqp{j{e?x& zze>gwEI8pdmX5n5=OClgz_r3Kxoo;J8|1jf(7BZEI|~KbQeY%>FR5&^JsHC=pw_BE z8q&?%wo*c&UlIq&ee!mxsxtvQp+4S@61lHg9~=*iKPR}hk8kk^s4iYJq?=Ghs` zt1)@COKh{2IU1JkXreF3SDDO7hpkh8<^&}H+O@vUK4^rR%d$@SrIwt`;D+}UjNrl9 z;DFXhZR3yjUqh=2RYpY_3V2mf3ZqUHn;RQoHT-E{@M`h`3o-rJ_wY=UuBL)K1x)1Q zgx$L~u$n|6O@q=`N4KG?qytCfo}ecb6EMKiIpsHo99mYj4cVAHp_s#Fo101YHmr0b zo&`LrDO#n&K(f3&#S*5{ElGncb10ti8-`HMoWt?FP5gD&665&qJb#z-{os=JUBqub zk8BpJyfH(@oEUDp_leTO)V{c68IeJ3Ahj^LA=bm%16XE=_c5~Z z_QE}fcgeXjc&xjb0JJus@-!FuAS^oCF(@!ZCV2N0`S;>zX{H4%6%a~#<@E%M80)qv z-Q*#|oCKG}6jZTyN%u^8Y7VokQ0V^v8wy2s1!C@)feqcX+lUs&p_uX|_tEJ6lqPO? zP53f9)$qjWcVk0u(Su%!vc`e4mDv*bQ=AvTD=<|Jt~>7mQE>?HH2%sWF{;vJ1YsKF zTmtiBoEO*uicXVU9VO2cns;2C>9S$w2T_<1QwAZDoLENjgA@n=#u2qnj#O_0*(M35 zDG(!*$W{zeDNhJf6{m14b6XoDQG;A@N*Ei%p!p-QD}UnZrAy7QvX;z1Yv(yR3>k7z zq`5Q`l`Nv3C$Y9;FPb3+07X1I=ONq3Ljd_^5O(|%+X?}^?>37fmi4o&Pi&qTP~X=b zL|NX>#Rw~1pp#%O+sU*?l6~1Y%mTnWaffRzEt?2`dN$t8aB4dd2ADl>a@W^9;y(cs zLT7OL>@?v>aq>ke!#R-)3^GOPpawDQ+=UQGBKS&)d1Q3-YDhL#E9k6-2a`H0m8IfT zl~V~zA*mBhIRevCAU4F#^~R#!3pAv!)bT;)qI~g=U*l&ESi7cjRB);JNE;9ZBdI|a zbVy^O9v5i6rBLRe}DoO zs9j{Mv7*D+3y5UQ8-5HXhd+%aGG3MyUpPrNZzDq{*t69mEy*nKq&$?JJpJ7=8!{ex z)#TM4OKdduVkLl=OI^z^gw`<8$H(IN=5pdIt1;IuO92w8*BF#VhX655z_M`|^3G~n zxsjZAP1|%5ctZIBh`cExfQm=LYpr_tRZ4|{F^V)`GQt?7f;EpCvV2{NEd3PHWiE2! zJ3}b`!*~$nx)EiYV`qP@25n~cg!CC9g3u-p?O>1UidXS6NNNBfHucEcu{y!pkRM8s zj|k{Ezzikwa!}?F+0s5QfE>wQ;!n-Bk~@v*?Il&z{+0xEaxD5Bxa|4&K@mIp9BTY9 z!DDI-0(OwyAs9>SfEeyF4{BwNz!w#&5zPQ1wazxJ15ksp`j~C+Ownk_ zps8rZPWdJREQc}EiQ$_y?TkLFr);!imc1wDq&9Yg37{4$NQh{jpE(nAjHbKVJ^`G= zG-g~Z_M6_G$-|}IxceUeb^np$rtce|wvAa@(DLMktwP43Wo_>SEmXkL&jd@k)TmN{ z9z>Q_*8FS|gtAoN3zVmA&r_96zIMQ2p^Awm3RHETn8GMNx2slEQXX^TBj#Y{SkXtt zm7d7S5;k^vex+$do_3VAOOH-dbZYFGJa41l+34vf{US*^mRnGSKCs^CqWQCpLA~&6 z=M2mRQzyeXzArZTe1BiO`nhJG*U+HvD3q~2t`mdPGwJ7ebq$c~eg|3{Ez(rxU}l5$ z`ZKjbv^-KX>Wt=@PRBC5*FE!muBASDzI#4x&+Le0zDy6Sz3gsLy`m}gg6(R$mh~iY zsUT)q8e-F-v5yQs-$!IZ$55@k+UIZv$p4u^A7Y5R_w{qJ)oXu5pP`oh^@iC;!p`P& zMEX*UiPP^buKH$mxN3*QJK;C9s~+|tOg&E1Eo6=dIYqV0xESHgB)w_h2k5FUvuBA| zd$n?s!)vadeH8yA93eJxp@v1L40)0ZtC1?-Ss6>lW=t|O#&HAN+uLf`$PVkO)ppG5 z6oX0zU%Z?i$H7So^VjFYa42q2;>oFGhR65@+*~!Z(eVVposV@Rt!!uMP$Md zNeRc&S}f>xg0{ym^81R1G<$tsuQ9LW^)`)%((nE@8wwK~jV$DJegRO`i1N~$Amo#( z8zpDtp`eXa%*xuwmMvpkRn2lgyTPY+n+C8k4!}yrCAyNrsfAE;goMJ5YecA>?`<8&=Z0=?2T*) z1{~3X3QJv)I+lrJ{K*a@r_6^1zNEyhooyAtxXv(CB_+mqq>vSo=$Z(3J@s;sDm|Xg zRpQ{qd=3afHvIaL^U7oHc#`C>dK#QTMdI8~T0Nttxd>GlBJ2s&li4M%@XmaA&_G^mK=JsZD$6|0+0(Z_4A^C#dv!Of9r(rytC%H7LC$>No`Bv z1O2SJd(h8TyruD*^xl-@MLtW(K>&Mj&Zi{>4A!m6AHmd^JA_!xjv@y!)FrWC zvdPBYIso;os#kB~C}HU00E2^}`o9SRk}+G|I|9QSQx zD?Q9@s?|$id#aL+K39&M$+t`h!Z-|riFPk%X*o(sMWoTE#?-h$Vk)8m(^Ro*a|7F} z6>LSo7@&YagPj6rMu8q@KMYQ2qS&<_QW70pS`XjKVImWi+R~fGgwil*iu`;Z5yRWD ze6;E-A?BIdYC>Ag$diy3@;j{$CO@Vdu*kd_A;B=Q*+maLm!nQQ=I@3n5Kzkk4&w)p}1EYof6r>3CPr4+6U0;;W^eVSl}X; zg6_?8=oB%>``r)vwUrSKZOwQwWve$EXTbR-E4psLOCzG-F9~Rn9pWo64Us-J3b;p4mRfG+Fbp&BjxI_L`fCi6} znbK<=f}jD{s!l+b#EPLAjaqy)h-?`O$?FO_9@BvAe^_`v7_Mu4&4WI+j>mgmU1vD^ zYx6m>?&7}vb;E9&qvp^2-VS{?^Sa%^w%CGy;rY0aMWe<3X^ziqJbOPKL;oehl)z7}#H!*(spZz(Wz3>UV{3qVr zPK4aBAD0YQ2g4w_&f_q+BM@E<6!Eer;IqH<5xnvz-Xg*%M*&SSJ5{?0NQ}Swg^x&o zTO)RV?Kqrv)7d!p<6H!19kWR@Hw1x+i5ucqZhe>W_jmAu8Ld!ua7#+ zFaELbbnFwQAnx@xVYk| zW?-cor)hGWdTt;~>C(X=*K{QS<2Zm>HZdE{hlUSBpnJO98l5Ar5<7~?ucPYzo=YzBi?4FkZ10YB(XqB51m)T)!52t7@V1Hb;qxa9ABM>8u*ArQ+3 zbSfpI#OGL5`q-*0sbG?QTa3-2V7oF#Djq2sEK;RBF2|Gz5vYnRo)D`J79BJ?Rg>XF zQeA=yw(F#u;wyH4=+AKEt*>z<%!#)wN=D|yu8YVrWA`6?8b`kCTbiGD|K~q%z8|^% zRm;|!{pL(ynieW#IezOehgDzC@~TssyZ`8~T6kXn&0Rb4&hC$Y21mX_?MHe|K5D%l|N zMnuX(yO>P26;s2j>m2q@-SEzle$gT9I@=BKk3Jaa`(oK3F%1RQ5t9zkQu1ND1$Myyi@I@U_x>bEJZ|GET!O_-@6=l z|M(Yh`o}K>Ozs9b|GH>mCsW>3= zJp)-lHG5UMhz4K+McT2zyE&-AiFznXiT8>+Vzr9k*%+m~Ei*u)OlT`1X{C8d=~FF= zqRi(Tw$ zOmrk3%8=%U@b5&HA|T_k^D-uu{a1wu!!UHI0!9Qz5QKr<6E=S6ew5cd28@jQ>3!IK z?U3%ska%s|M)Y}RVy(4 znfQ&`M|Uuq!`@!f66>$sAO9?le8(%&1la*k38ruSQb?HFHrk2Z{K;V#N?++>`kcX@%2qQ4~JvVLP-ZA1j<3PdhVYSA{Z zQOtLMVL1>3nS5?-5m@fMwnG%U#8To&h@mAzn>6*u!3q6Cj)OK8QgnXsn5iv0#MV>Jyn&!=9;>~`U@hBBo?gmYXu{_# zhrMD@$R1KlQ3_`(!{t_W#^Ji@kXTmg&Z(zx+Kp%7(90eM5#!J|J&b)fo+%HJL^TIZ zYY}fwptU@I`&ay*#4)9OCt)a3`??gM3}Fym_m3iC=WP^HB`OX;DWXtI(SJkKdj&Jf zR>4V+?7^iUxCSR3JOy9*)_dL968HuEr4o*R>;znX!?k$yB@a52K*wWd75V?*ioH;5 z93DzRp&~|GX-xWdo2B}Fu41|r5FbssvjS(B;=rpwXA@G|@k@+!ARrkcm@0A1R zfr}*sXN=1CP)~E5F$0HBeGaEBIsrf%k&U@&PZpnV%JoYyCEkkkp>>?L?)^}p$KtEZ zCtkg)1;v$D-rHd^OWLqayRuSRiq!9qaljcdpGt0LqZluRk}JB>Aj-+k46x4ygpE=# z60kWGY!m|331cZ33%PtA3i+nMiDmV4Q~;$wTEAX~t|rtp`9$6r-54YCc_4NchJG^v zMug3O@nzun6}JBIi?Q`%F9V%^6yrM%CPQY;)eBWuszzC)WeY1RiN8q)l}{ni+D`fo?!`whU*|CWDG z#$nuZ3v2#who*PFOptcYK#sWfzqzx_UUFI=Mpj%i=b!=3V2^eOo#O)$Hp+mp6bvRO zh%oAg|7sjplf98)WYt5(jQEg22IWA~k3AD*k0TIb){dE}ChH`ME_d1u#Bh>{j;ik5 z%y3EYtg0k#8l_+Qu_d7$k6NHq0&Ym{b;gq0Pua+KTfuCEPG?%|#;nVz@T2YOm~Ag@ ze$VtIX-Vi+ts0CGSd@d@K-+otBxhlP$w$v82XNXK&&Ivqa~sb2#HIM!%O1vsAGiu% zef0x@004)seH0J9;Q*dF|49so2b_BAnYic!S7AK7nRuA->3{bjeDnYEMjZH_TXE>h zM?n*C-p4M(nV-A}0PvSTA1OPpa%Uh55yscA{VE=Mz4movz`k3gui@}U42;ry1f2ER z^Kjtpx8S@_UYb0mcHnhm0&lV_mBOr*gu>`Glf}L?MnEb8duG{gPi?xf`s9ng zibvjj07uVx2E&sZ*#8F?b?9PIzxx!8DSmsc=BCm-`=0cbm!7|hr{aSQiee+Rzyf=6-mq@yTP!Jhk1 z!3BSQDfZuahQIs7#b3u=Z@djpo%1BhcEPE4@5c*1a1F+%Hyz@Gue}EczvW(RopJ=5 zhj!!aPhEsFKY1aDfY1HwkK@{RUx!^^Kh9}slVoe}VchtS{sQ0pQ?GBvER2x2RL92* zeEk&<0`OPA_z}F~pT7b3eBW(2bd}DF zk6wl|K5+rSghMa69nMqUyU@bFaF9O`sY{vgYS|}$`x3hyp8+6^A3FdipOyD z#G@#+;N<&H!FhjnF;2Vv^hSgq>-yNw{Jwww=)d`(f4=@F-=>IS-2bh23@7-D5lDI{JMwm$eZrL(S3)pacCD# z|L`RMMA0gGU|}KIJSLxIZV31f{^lR!oOiqqW=L6p;w!)Pah&l3uak(;o-I80{r6z& z#a~0+vjt2AN45E%)s`4xCER3 z>Q=1Yci|GXI=by}wW%NZh9S@;g{w(;}0rju;V)fn&z|V|pU^V650$pD8495TZAj;*> zfsYdEm-b-w3m1S7MLXl)`3i=&e-(847WmOkOz%Gfs~gVrfzc@|j6eJ!%FCYw?cD}e zgnHWvSiS!&)X(ez0POz6XT81MACJ#RUiXT*@pvqp>La^9@i}ed$x|hlSTTggZ372)5Y={f!-zTw}!gf5ecaFbW$yWEcRqc9%fP6?h8T zVHVD*J@UN}d4UYuBjklZ^t~Yk9ZUz96%{pNbWc*k+n@yy#E@tBu?EQxv=e|c?kw;p z{pJ0K6myE>8Eeuq9Nd}q)k*dhR8Xvf_z-|bHany--WyX?#;O3*It&|77O^U zAG{I!ziYcC7pP;2HN_vndu_KasWYOZiA6V_63c;BL*xxaBWPQ2wbY@hxd?*EY+ zvFq^@u;=#EWTG*^s5tS!UOfJahv8UIhXbH?XS^|jjaMh%{=YmIkAKs{c;IcfW6zzZ z;q=d*gHvxh6T{Ykr7N3p?gtR#=Ktz*IPJDG@Uox(7Hl5gh1GFec=F<};l6J>fYa_c z-EsQmx7>^?K70*MesB-Acdu~QcixIS-gXPF{*9Lk@4WOOJoL)@an<`?isK(T2~VH> z6z+WIUt{B`O`P_{vvBe~d-2Q#hms>;bOoNe;1KrQduk&S%z&QBdjg)g@-aO4<~wom z`(B6>4(`D-XFP@be&}X-k8;FB272I~H{$d!oQunT=W0wt#li2q3*#UuM321gKAivI z%W>kprvSSM2d}>a2Y&EoT>gK**gL=f`)2=ZKvZU@BS8SKD&X{@!NRv;;-X@ z*WQi&cboywm+Z9Ye1k9HjsHyc0(|Uee!trnAjJL3OCG|(SKN;m{^m<@(jzD1>9d}~ z%|GxZY(BjUXWp2NZ)x||@BeF@_1EX(st>#nb*#Ai^>^rPZrje$vIPbGns>b!Q8BAk zrU&160GI#93vt4OC*iqsp23~(yb&8uZ{pP3_oKh={J|S>`WMc|Wxstj>d1KDO?LrA zc=Tlt;VZ9t0GI#Ti*fwJC*s+&pT=E(??#j-HgMYK&jA&}lP`K4kG$y~T=4%~i_L>4 z;P81*1)^F?57i4V1w?BsI!)F1NP_B3e8~^+^)LZv} z_8*<$7{F|QK;NFQ0MBm_Fnq`37~cFKeC@lWppe|^OCCqmQm%0n1` z{61{|+$E^Do(S5%h4K3zZXE#v#_xRutN(aD>TM^2c2$i3<%1aCbuYI6_sbSwOGd4O zCLhNC{(h`}`2y5Cj|ZJFVf@htF#f~?SpD=RUw-gUm`GH@*Fn)=X=11 zHc&r#8kh(h|La|-e|ZYF{=rq?r$*3;E0h;LjqwM*f-Q9fj=b&_AOd!IYS1zojbV(*ML8>yiMQdo0hVd8tB@O zX6F5RDoxu>dQ_EgX00rf$yTo64!La_B`r5>CDVOH3R-;(XcqP@VM)G6bepq+Mx1S8 zSu8fds#Ot&GBk6vDSp6#2}T!mfXSS|llw>jP>NSwE9R)U{cgI-(tFfaGtp0wV666J zy@TcHIt$EkGtf%BI(?a0t&&#?Yp6&_0?H%DPGmhoi>-E&aInaaKf174!8 zPLuC5uvJD+?OmL{3%q3fN`w*>H{`kfH=cvL-*F>OyXkBUoR+ZlnQPy39roUJ8phR# z&F408{vTeBC$4;~F?P-1*?-enIOB`wVB_!xHlN~ZXPDUuk#GiN`IeP2EUn@{foO~A%8o7jKzIe6KxysCNS>fd`I_TIA(!`6shPwvL$ zAGrpHE_=);`@z@TgUdc}4Nki66qK!klkYnP7vFF-9{Tos0RVgM-iN0ycoIawbo>@R z^M8B{)9!5mz|$8zi9L7kYeYA}#wt#MpV|xH!8abj#lLe6_T0S>!`6V45AMZzzk8+P zuOxmFX4-e-S=j%DvoIdn#O`NzYcc?zfAdImP0+5{%T z=Cix7|K_vs()YG_&h*I$X``QOr4I;%`(AwyuKeJ&IOX7}7`8^7a{sBg@`Kmn-fz7} zp2><2!0ES~g)_f&Hpasn*nD~yuKd8Y2&c2ZxKS_}q>wSD1Pvp=#lLeEPP%6=hOH4N z-FpfydH>Zo`1%8jW7v1oS=j%Db1)p<#O5=*aOv-g9DC?B_u`TpuEw7G_hQ_Vd3y2h zT#ZLw_ki#-Grsc1yK(++U4`TCJ{iN&0Vfl{N9_9S={V(odnt&dMD6wu+>g!wbRot+KON(dO_aM& z27dKo@Y@c88!e&A?JxF&{`3ssnN9H5H^9GqsS}JKsSU)EI_d_5$;8W^M!oGM0KoXe z_hR+y7omP}FEH=|{0nr=M4geo{b6|f!`Ob$Mbh7q0rj?%u>DIHWB9(W`19jC9+GE1 zzXv!nfDayz?SFe|gJS^L`lnZ+e(7Y;(E@&Q#P)wY7sJb+NT98OJ%l{~VD;_`QEw7> z`0)*_-g^PcOP;VviQ#)6!S*j)fO^}Bz>$J_>xtO@`SUUSov+I187LP&hv_d*0Uz1` zCIUY>V*0aFvGq@`X!>nUs)U}IL(MQED$UMEX2TIA1Z$ZH z?xUHZTtuc6P@})Z4oG_6+I4s$b;oQR(T9-^D``owE1`JGP#!Hjjdf7FVIcXJ>M}YA zwN^cIC8NMRM|S_y(xT0l%l4TKsMRqFPvRRhsB2C8MUj&I@;LOppoIiRCOzQG_F@^B zlQt;Na5w>j2y-@G;glvu^#8H;=HYf6*L~pcbiW5Y>>vpOB*6{bM45^uS&=B&)=KRn zsl}sY?AT5me@Vt3JGLyzU*fU8nb^rVvK)I7CmAR4B$H%5Z(&`uT!V0pl4O7?N&VW9bt)Jhsy@% zIb4loMIMxYnzr5n7|nI={`y`#{E7oO`QS8DehOt-PY+fj zpdF~U&)lC=4Aju*J%ugq{;4C#Ve={;eAC@{@~X!s+G_e2jQ+4;K!0ipaeKpS-g{j| zWMA;iuH(4(EqCC+oA%?%KYG65To3NC1sXxt@_ww|ACl9MTUdsTGc2828tGhR#w`bT z7$FG2hNBy?y5+PP_!DOz$M%PI1{@K#Kd=)gb{|jp-2C7+0Clv<%vgGQ8MCdY0aS)Q zaluhs`iJKV4_Cx(JFpW6f9f`;iG&5Z6H6#7GbKWpuB+^q0)A@f6aDHacEjVFaPG%0 z#d#mQ6i>e75gd5u?Rfm^gLwHbUnlr!9XgFg)CMm2^d z@J#G{=nR3QmfQC5j#S6;(G57g<+Rb^#IEDm{@@P77BjH*e!(FTw%>au9{;Nk0{|X> z$s@oLwr2a23d4_{Jf*sdjC!^YCb*#*mnO;!Ikfm ztWldY_wRORO2Zl*VOUwk19Nyj8kwyJcUXQT_Z?P_uVA+AH2R+GP?1P0pwfmrLKy~h z9pSuN_Tkp|d=A?l+<|QecVOkv7VLcR3~YaJrzzNgUi4nD z0NC-+8F*&baqV1stPJymwU)YQ#0ML0SQSRE7-YR!)1?@d)j#GE(aqzcenWWU} z$CeqEe)=JFFMSGh)+(@}jEbfRbd)va8R=K~&X(M*Lrb8YGpmF4oRcZUNu31?7 z%SkY3`un1CQ}^Obz*PHdT@w!as7F%+miBTrm1T%1-R49r4o~E_v3`wGhhvV!H}%N4 z!e5WqksZN67Re_fJCKN_obIF+HycoBz`7|$uvzv@1E^iTW%v<>Y1Eby0^*%#zmW zsDs*(LDC7x1_q2-nbozMUEK^s55Bb%+@)u6#;GtsT|H2en6WCj&s*hd)5;+w+|Qr7 zer<_?I{hpSZM%ObUh%H$#!f5zKmDi~3Qa2k zfQ?62pl4cl;>2k_c;EwbEDdoC-2FGcfu(0Q;HrQ36098BjDEGpuwjPJzyG7kBe`Ef zq!W9NVe|L4Ho`6=yP?C@$F}3j|Mq-*>D`~gbN}BL7%W7(%HG+k63$rHYfG!j-EGj{ z{i!9CO*1SV-_Vq)*HY;x6?641m4S0)KGIL!ub%tr+|7zd4^bB->aTD8*3IK~IO4m) zT{g|oom{dub*o=Z1<@049ULDF#Ax@4UB~g{Uws%)zUaF+edbA=`Hel;^VJIy?Cy~9 zh>#b5{0f}&)$?(9-yxjb^$ZSQ_5|*I^M0KF#fx#}hn{D6=mdu&LzOf&!4VhAF|hg3 ztvGqcGvJQ#=#M;5XIx%!AI|&Ig*bKQ32c3Ad#!<7L32}EbqEDtB#xcv$U)CmAhJFy z{x&?l(du@*0C)f7H?VYk1D^NqUV@b;H=&y?VYXovUwHq=(o}9&I@|uyF(=c+y=*la z2QW%gl0*53aKT3}$2niU08d}~RK@e<-@}17@5kORUW6-dylQ0MTGJUZ8?XA_gqIii zc3e|#Yva+C)G_aiD&7Vn(g7l;c3j8MNMED~SfoP~IYD@Z#|Nz05l~f+B(I&WR1-4! zpHvV4(RDqBZU`tKZ2j*SW92h@uzKYY%+5K9 z)xUBW&-{%8So!n4*!rI@w=)fn|KS%#R6wZ_sZLKw6hk;1S_VkYDnK2G6lM%4pdw|7 z(Q(}=ZpNxZ^#FxHDwBJR*dyX|%xzOL9_r!dnZ9E8dAiJmqq_X7-vK|pgwwx%CHT>e zb$6qc0V_9trGa5y2f{UEr)H`*q!B@VU_4nrXa8w0hMRVwd)`sd-c#s*=qS3sa}cu| zc4PJj7p8jrwIC035#3xixEjM4FOo)L%AF62R60nSZfcpB#mY2TC#;k3v+0NL>wV+T z#6Vtb&g&CaW}<#6>Bb{%!I>%=wW#*eT|}w|&^8s&Qq}#f5h*>TR&AvndQt)_ zqamI)7^KfS@>bMQt^gDi+os%SrTwbTu$~>Dk@pHmu|Y-(F>x3kg@KtZ%%wm&^WVt+ zPLe|Y)SZYN=gdWRb*p-s1ZQ*XLW$IQBYtm<_V#K@Pdq z?WmO>sYnp9R$3~iYdJY-9$k-udZ4Jbryq9qP`oeTG1qFAlv!dSH;|lOJ$%`dc*$>E zgXI&;*1aQ_c`Aw@j^WH|^~uf@(8e>YjdBEzTz&{I`A4-ay$(x?NxO{I7l8nezW71x z{#ITfM)?o=Avoeq{yqufEI$k)a@0UcNbi~Z!NAI)EjYRBIJO>Nw%+9&``BjdU^6y7 zu^C4%druApvYXV!n|J`d2;CnCnE>4{PG`8P$7WV%6r8x83=b}H|SH&?p zT_o41Ef9cBhc;u=q0Ke`d1lXXdZILR001BWNkl(VDrB`Yr2q~ zjj?~k*z)8S96A3f?7C;S-92*tQ`r2(mZUHzDz`dyJx&zE(Gned0aY%-WB*?N9=YhL zv>xE-g-5XY(HNa|rzq+{&l3h#zE^qdj5~MPJ>{`F1H{<;-K{u&@eyp_U)Ni8L^yic z)AhTaqTcyg8bzk3b(XCsLg|3+*fOwV74-B5G2+0feKLd50aU7yU;f@EEI(0YXD9`; z^G@KY_kR^z{^Mn}z60B^M3Y59we=x621Ut>_B8>>WDC7#wn_c z6qiN%24t@0LmNP6p8_A>f^yGR^gsIK*g1SQ*QpNJSn8)WBvgH56Z$KUVfflkqgi+5 zG4R7H#suZwEubGf3jV^G3L%`Z^=tQnqd55!F9395Ff+OrKJ74sSs0w^>Wsl@O~ael zx5nWW!QzKk&^_lEhOg}~!%tTp10P(;ef#c443BQK+USCl*!Tyxr-1<1=mXF(*v5zR zT%n08Dzx}&<5-V|7K%cmAZs=>_5y8NZ3R=XwvNKH8Q4^y#shj^BeK1Y|!Q@J2A(fWf5vhYq7dDAnU%9?bxOPSw%aCdjxY-Sq{jIDzeky zXzx__fdY)@y9f@c6l$t??N70Yzxtw``D3i*P#tHbSR`p)-zI)sd|nZjIFA51m=qqg zW0HegI}Bxzh<}~+2LUw5AdC}rjFcJ_WP<|Izk)K9nuQ{D%!VR$iJfEj7c^U??ov)+ zEAfhD+j1PRHDx4t;3(69G6CG0kN_o8x&m{;ziv6W4G+KaKCEt9#cb1QJo)@baPQl1 zPp>H8`c7uDW*g8D#mI8N*m7_i4!-gLRyUo->Za3p;`!h8wjx{r%JK}y&pnEJ-gX-f zUvL=be|}#sCS1*3!HKhu;jXuS8@u-J9to#1o^F3?u#)EH28G1oAHvq71Z;nB2afDJ zWJ2Vh0el+wTN(2F&+fxLZ@&%4E?vEb;w!?^eDx8eNHT_SZjvUP;6y8r;NJmS3{ zy$s*^nOkwZgg!#%(9C4*JlKYrO$*mB?YOn(41f()Y_Q1?IA0f^$| ziK`#M?px2pi{5t)e&AnUja^?mf4oqbW8NX)s!CN7@U>t39KQSFhj8+Y6F?7~+I|Y( zec?fD{qDBxDzdL7$=hL7@lhNez34E?h8d3SJB<5&><*m&nTzY9AOg1Edj=kO^Ih0| zYuzzr_pRsRz;$Y#8v&z9V?(9d&`LF3i#h zjK0-Hevq2C9NdP3uez`D{N~emGVpw*R~VQxd_90v)M*Z=$kv7@HsR?PJz8_Jg;x}3 z-~N>^;IXR@;^dhp>iHVmPT|oXI*6^0Y*SJRn+Jy}^jT>j->i&@gsMLVF8usH?7!~Y zIC9}r7&gpsQ?-xn?k3OZpJ?UisIe3dj{ZQp^@Pu&x}4*b~dIC^oV*RhKZ z-)VQRC7gpIaj4_F$yd%_aa|))?oAgv+(3k-i>nRY0##E6VEw> zC;rx*0P3KyBf_D7{570-)uSl8PJnu#J8Qt{S3HiT2eug8oBr#?c;;Pq09PCZtqhO<4M|M}e&~VCxM1D-L1#=k6c1#{kN`o6*1i z37}DPIp~AHywLyv!=LQI(l6YP?zzW+O$GD=$Fcki4`BG?JyveR@85y`jZc7fpRP{U znXBku`vl6pzR7`J{OCq>uQ=rR2{r}>H9LCkUlgKRX5|xK#>ywYjHzoJbPqESK`)Ok z17_-9cs`CoW&F*nI~i3Pk3m{zotk#xdT&8P84fM)9$)?*%bEAd8HqN_+4heboI(A6 z^wcFtEOk$GipnN5cp~knPBC8rYB7E19@`GPbNTLw>K4R(U-SC`vtgc%5N&(?UG+(A zw+Fe-AZ@4F(wGpoJr%vns&nj)prr#v+(fc4EX_tdaMWN1d5^>3qBQh~v&yqlP|rOg z09|#);cEdH^?aD3Fih}|_BA@@HG*FQF$KWtP=Cijt*yCI(2A^MkO3AGFmS<4)>ByL z(-lT`)~oujaKXSuP8Lp=PR)cnQs@Uh_#)i%w%hULU%v&VAF%b|?YQ!TKZI}m;^%Cf z5oMQTdIdT%6aa7ezzvAkr+)WF`~K=*sk@F`^}!e6p10nPFTd{=l)gw?FT^)~@$(6` zPyX(W=uY?8d}s@Hefu2z(7%2e`qkbPI{X1pv^y4Br{XxJPc(Ep_tx_<+i?oF{nS@+YR5^e z9NC1upSu{lzqU7x=ZH|#d}KDjb|Daf-+A}h=+NV#x8H^17aRcy*m~biocHm|3>M{? zCtv&s&b#pnqmw(W<3XVfK13J+#`Aycc#f z-wS}T`_{d<|4nz-fj~QQ4mh_Uj@&rwuHBg3bOrAI@o(bPnJ2LE&?fBr$a8S#Pky7O zelU;dh6cYxs679++wd2{^V=TYj^}>xh4{MgJhyN(d`S>q0Ki;u;U7O255Dsb-2b!R z1{32YKldini5LFa6?pVj58%Fc><2FwYqUM}xa_IOo>ASlw|7cl@neaeBu|Y&^UP=Y94f?E1=i z2KO1apN-k})42C%zJ-%#p1_8uHe&BbufTzy`liTI*HJ8Jw1G>?`l3NfZhM; z3OxSPcj3YR{fpoY1sm_*irxR^IXL)hUok_yx(jFi z_VX)7h_K;XXQJZ{&-~QAm|c1lAfUTz2l_w002;R%*axk%VTQh6LNyw7hC&VHQV~NW zr=wOMM<>4-<)(A6^ow_4_Th6-_HV3 zFFP9-GG_me zMAZeB)%Rb4rJuVW8~^h+K+6T?JDaik+m~U(@7?Z{7v7uw%Zsu65AMbCFWm)9nAc0R7t@!_v<^2-;Y{PcEZ;@eHiK z?}|~itAB6-mjCAmvHWWXfR5`9LhHWB)%Di8j)5OpS)&sT{miJW(Uhrv$~Q;R`z~|9 znrT0r+Rj7&bzT}#WlZm6G*zQ0;bU`#%6S=#ipyjz_LDo2%76>zObT@ z^ShqSAO{?B_3}*rz*Ax3jF+ti&|qhfeMU&n0pI~XHvggPdim}B@|2&N+R}*~>$Gjr zJt@UT$}>x9q7DaC?}XHxqO%t26YHR3p1nYmMkli+TznDsAo=^oUP4$Vb=(nbe9oq@ zb*HR2B5O1Hm&2@}?|aNx(=dJZJNB`jVI^z1N*zq-Zc6FcGlgp;rUGT-0Mgt4+Rv~$ zvOX|Y1{&K%Kkcj$V!2nDqXZeRPVYExw?1>AecMW#5@iEBwG-=ZuQ)*TvYuyaxKRWn zM3#;5+&EX^@@>Ly`DZuc)xUCWcFK?uRl0&N{`x2Iga7`;*!ED}wl7YxDRm-^+DL?s z@Qs1wc?pbBBppCyCQdU>`!g;KI#Ol;$1gsNd;X`d;Rk>1HNY&;o+9om9AEj@AHhq0 z{>`?JuSXX+z?`|y1`UAWLD7)m92*yPn%#-kL6nyF%l7Uy90lBYCyWOz-w!d$;BZD5 zBHwDg+|Wy*XJ(u{>lu9e?|m6B{wJ@3OH9xZ$nQoa>8NnN(|UCmh1MP!ObGq6=v*|= z&Wno68rA7WbW%71%i4W4v3bCddNm!`oA4j350O?@&Xp&i3Nh;k{cg(7l&(P9I1r!u zy$|D+?|Msa+eIhzK<|zD3>w`b`K?-)*$!=s{fzJoLv@xt3dLZiOgG6(Eett@Qf)HZ z>BO41$})vrG-#nPp-wr20d!t-D`$R0lAt z0G58~F3`CrF#ETcq8!+g^X6OG1f1Nl0ediUC18*Yd>U-bdA%W$^SRN5GgFM(`Tyx+ zBkH&XPFnp zGZxY{@jum1tz#W0Tdxb})bJ@X|F-%uDaH6(?MJAqEi3TXxOkPFz9-v+Ky6T66zsb= znQb#W=XlYtdJYl^u6+a*$!wOTDo2^p-S$EqgbI6gw5txPJ7lt; zFFMT?;KH)7wuFVX6!@ND=No}whpHK^$lFbrl|fG2|KF=5U&w21>AES`Gnz#L)D+wj z-?ud0+J?febu+jg>IkxRo@Q&LGlhXwo#{Xa2HR=zb*+V`j@O#~Gy z)}x3gn&9R)qRl4MecEN8<#|hrT7HT3`c`VL5Wn?zzKjb$c^S4nv>m56pTfOwza8g% z`GOJ8)%Udx{mv7($eqY%I@EU}S#`i`K^y{l)}0XQA}C!Mr4a<3w(TH!nLRo6Y;cU4 zJDGS$mBk`M%+|luyS4nNgy?Y-tv|449YH&_Rm1uk@9FnAgE!3&nPifyD))2V=mh^D z#BXd1sOn7HE*fH`)#xc7*K=KD@tM*w?i&s@R#ayditJ6z1@RytHGGPrCF-Cd8C}@c zq3&{_`LhaWjIx=L365;n5&8nme*X&e*FTKq_udKGa}wo&Ejay4FI?LvbcB#(Uj(LEEb7Qe0|3`z~bEfG}{Wv$ax7F@9hR66xab=noJyAQ)^n zBN*&*7Z*}eH#+*wLZa@erRQXN0ag^bTvk7?% zDrzGrdETNKv(jW15LjQFZ`jo);fG}B`$ya-WzUOXdUeMCm7 z;w)c;?_KpM?tkN5IDYmqtQ^^dbN}K3T=2j91BwK&Y;PjYhOG_}FJ^Tr`BY*td`q3t%19wiGv|gh&^%JP$=@4SZ%t zcjg*~5^w~7>S1)Nvzgd%HA;0xz^A4wFAj`)pK7kFwgu>bqYf5lr2w5q`?cS-PqlO~ zx?<2OIAk-I1$AMuMF*n*Mt*RH4fIM_AOB1OB432(Vl*;^CIZby6^@?Gu}{JIOQX^R zf9%GbXH(sCpQnLf!MpR?p6+P67Z>>&eJ1%nB70uF^KQqRl<&7uk%ZfYm9BZYpRfRq z*j@|XxW??yPqFB{_oo#9JO!iWV}MP0nd|zTCDpBpHi8Fsy3TfKgxv3lu%rP7gaakf5hbKMCrRZH7N5kC)sWt%EU1fEYMzgdfgqWv}m_+(xPKEVzH)Ow!a}K4Q}WY zEMY_y;hMWJDl`~T*+3fl>VLhkI|tE@Y1uRgPzCP9Otj*_(9ssVZ4P~thf!#&v%%J9 zHLkr(DXH_JjcYTGI6Git|`kW4=1A;slLXw3s zUh?dlgI+7~jROQ16#Bh}eQyT>X~3KMOZGcD+%Y99If9|-1VZ>RJqV1KM_$ZGfst5) z^H+td=x!Ix_~O6(=-mG6b=A+j4t+1t`Vg729Vnusk9x17+o!p8DtR{4*`b;6|7;k< z*vWYXy6mW&`y1iC!5HiHFhTHpolEC zBI*Z>5g&@qmFd>5jlWI}1ZW<-lh;(k)D+M9WKy^nIwe!aX#xZ_Y*T|9G-cu~4Lqs> zRwAqF6n)yG&fcjbFB62-ris4pSO)3Rd?!w!lF~L9F?~!8v(*3s$svcf_?YXCf$m&8 zjhJC)+31-AHKU?Bv%Xzv;Bn*2R!Hk_hT3)4p)r6`bM*arM|CfLJAD}NO%RNalB9x(EKuFUh4Y^h%FB93KY~>40 z(;RedfWXcT3`#?>iZ&qhfdHd?`Cwk%p%*= zL_32=oCanW2!_rop-wIN6jyTa3|Xu)6b1;6AD^8eheH@J4XP#vSR~sIDC7Fy(7_4B zPU%-|!niUZs-^@XB+)UHS6tube&mvqT}XW~^+VCBUTFJ0s&xJpZI%9p(zJC%jAbVb zFdDgy@Yv63K4{@Fx?}}4sy6APz)Uaug*VsyP<9$sryKTt))g^6s8jaBW6X6Rt_G$Q z#%w5{fDAR*ntHj^_ZXNl%m#z2?|R976&aVkz?lFZT>lZ|o)NOP5w+M-SEsN^bABxi zK#3QfjRs5FMnd2^nPUp;QDD^=E@Zf=XYD=Hz!|>zBgO@-1%2--)|{VM=lZa~NheOS z_nPwN0Tzxq7Hhpr3(5rBn#v|1Y4q^fkUr0BEWo%3OR^7hjYwP16mLA6Yq24Vc6{p6 zfq-r;NkH9lUUfU_&N>$KBeAd2wCya^K*9(CU<4b}b&~Jy!IfyEB^Mwlv}(WlPU+$H zj5=SatUhKk?IbDMx=_hCh9dPgL*Zb-Ekw)Roi<1PYF}Ng^c0 z+tmj3HH3kKajYZARSh|;kaPueRJ>oEz&Vu?VKld!;ny5FkJmiAkp?2h6ma7Z;3KOb zIDFg~P%S4)gQ-p_mXc=&l;#9w_F7|I1T52hf&SWGQ!oxeg@+yYmJ=74IC*R;kS0Vv zZDsf|dz+^cV>H%s_Mr+sI2I!Oq^VB~KMN%GU;*87up(INR7mO*Lb*Y&4?UMx<%F8o z+52Uu!EU`aNtsX}0`vSxt+7(FZ+qFoIgYRCm0 zpg8G+VuRv{TI8ln9nXksT__$Gq^CWiCDLU9jbuo2JEUc!JZLYJujXFPW7bdP!2>H@ zVo?I9@4%%P_w}TaccCKHL0Z>!7>0r+Ie}R9D;qxqxP_LrtYEv-zEvI=N_EhO)d3v= zr-uQ3Un60YgVVci|u1Qi09}hp4JmEYs5|a(4~O}gx`Hi zJ>be@v=z3{=R~5Zxv4+^(_i_Wv_*`L?#vNnuY;V}wr~7A9*OrSqiM}RRP{sqe)!

j$4K{d4 z4V&mP>N@CI0G-**y0~9w$yH8k;6Q>1M5u>>_0U<#Lb|gcr%1Q5oLj*vm8R>}7KmQ9 zOad{MWX26H~#F8;lf6a9|jAg0K-ZmS$y~Xu;b$N04Q8 zKna-1%ZRhK9%=MJ<1oYma>rO8p3+NsTDHZdLbWK;5!XKemEkx}txH`FlOnTK*3P=QySCnliR@Shd`S-x zzB<1&jXp~lGCY+>@>-X%OvI~3XsEdt-=>C#$o{sxwJ>!JG6ia57m;mbRn0gRl0MLmevC0KA6nC0CiDPyRpQFkCsiSODQ z>$>KYUr#*^(;JI7&ZRqfjS+qp?ah4}2PCnMNnT&iwLrd1mnlrV0I+A%Bz+(7>Sav4 z7?%@mSdgRsf@_gcNlbNkK`bLH%LTQJBDL+Bs%jL$ko7tiSWszfL}m`(@P zsJabg%w9#<9R_vI34rWgS{vYie?fhnae(aRBWI)_`Zg>nNa7Dkn+kRf&R3phE?6y$ zu6paxfSR5ACjk<4uq~Pgnf35l4(Dqu1i)%t?Hgsr=Nv}`Gw^Ca}R}zCB9YT-p z=dzPmQ!c8MR##_xJI1fiPB?a~&WInWN28oc;aK0tj-vD2{4R|Y`{V;v-u`P+8z%4J=3ZB3gK*yDsKQD{Ru z?*^|71-d|+gWRi=PpG-P!_Z;C;QLYw&f>Ja(ykMu*@5b=aSAhe6iW?l5&7!74ojuv zDey?8U^vCnOX)3%001BWNkle#+a1qDV<>^yhC$f7TJU(}(TzM4KSD)D^}1|q=g zFWTBR`xsTTPG*^UEu_zI`mJTyWuSe>BX<>MbTv>!oTxz{6x72#dXVu>)oZ>Jk6Qic zD?~Es$-yRfHMTB;@w&*h;*D+4P}NVUF(_q*I?_#+g{dYF)R+%RWV!uC^fH&4;;5-m zt+n>8NxO;%%JBHCq?|`kO0ZhBuMz#W=1?_PGU^0dV6A9^XN>4uIvZO+f<^6K9U#E) z#+FJnsNOD&-cs2(utAt1bPchO!p@GE* zD#7teuA>zlgeCjeh+(y{o+nj5UA0F$W+76S@E_N)%Gd!-suP0azbA6c*Z zk;$jw&Cpg}Sd#WSt&^g$bQ+QDG&B?VmjQI>u*$&*YOkZ?-#WYz|B*N&eHb)$dM)tk zLgN*$;8v0IQ>JG9Ycc+)^A^-P{h)c`#>(1i%}E*n%oCVJ5%ETDMvvBWDXDCuf@iCr z^HtHj&c>%`n1WmrbuX%JvOrtcRG}d6w01iVH&5RW5fB?#d6WfeuXXnxF2$XC35L|P zp<0hR(F$KDi;D?y7afOR^@ut6B>GPDLW=ma?DroA0gg7&muepf9yri5hXM_4J*en5 zM{P(`mRG8-QoU9&Qhl1*30q^J0ZNfyn<)r`bJ4EI$vv=bLQAPzbryJ_sgBbsK5W)G z1rOEvce&L?y+p9HVL+9B%4U9|JA=B;f-+2mLFihyB(3!fWk4@8v7MAx`=>Z}n`Kls zoffp0J)Is1G>&#KlVkNek^p7k$(q}eh-ggD;?OKKQ+Z^`veEviFs6K#e3F|bp2+DsTD zm<;J*G2C@7&+a?aE{LHhq(-`vL&O-6#dSIufJB_)K|XblZgn8)0H8V^HNqIzDd;Rh zk^WGTgT(}gz3}Ob2b4}657kL6()B9yXgZe3#B@nc8Zx&ukA`c+4->-I(6=?9bFX$V zLjl%#RfK-7Tk}oX!e-{67MpA^x0K{AI5+84%0+X;WmIlm*Rz=km@1Z{=<9EGvI?~m zhQbAU?l058I_hc{imScUU4d+wgAN$=^m-1dFPvv`<8FBJ4IoL;Vc4#I^}Wt~AfoE1 zlIbu#%~*mhMR<(JaMlTI=90)6Ct?zkFQCDUkxd!lP6jbDQ=vYW=^-5er$AW0yo7^J zhZ4N5;G|X5*S|R<#_d~_Q^kdZ;A;nrM7oeytMI^(rep%Z5*X+@*(oTT4I{rv+hw(z zlwj9^M_pdfLDxQb_JgmvvJ<&ez`z}#=#yz9&GCA**EfIQ&qfAL4TI}m&(jjT$UnV7 zu~t|4YH%t34mZeapVBYNNcGc|oiB=1BQ{QHNM>hZ4TBLw?@`E^R}ghbZgmmjbXUx= zw-QuG&&V}jfOx5MH81tjKjPJ zMLov;$;#&%df> z*Fizurm!AhCTAA}{X(c)8TLeVo57C25+z(BStyLUNZIn5nM1TL(xkb}csWBDo=g`t z11_R~a`i%7r+Xv*Y%YsxyHmtxm&Mk3Z=@hGG^MJOlALON(!I8PU~4qg9pRDsEpnNz z*dKNtm@JWl6JdOi+RBnZxssrdlCP(@wfwi(`UI#`|60Hdt}>0^<~=1ttIJ1&00S!^ zKx8nPn(%Kvb+rmp(rduUri1IjkhT%1!y=v0=y04x@2I!IMGg=_Y;YHT*Hei*@)LQ< zo~e$keA9{Co1UVo11fK`=}vW0&0%H^5$?_pL^EEF|B3EG@QFybG=&UQ>cNS6&-;;6 zcL=fXDjV@k7Huue0!Y7mxj&el)LE8_3*CUD;-z!>?nn+&t9rB-*rE2?*5m1*03pCr zA*<&M2o_|^=Ap=8l13cBc|Plam5+Q8p2kEl#DVm1h-OBB0#mgQ+M_Zj%S~U@e97`T zB`$#q3k*gb}qo zj!)%7hKiEUj_3BA9%SX)h0bZ3qlJ_(VO+eAHjc2U)MPP**k>)w$zFsXKzGR*SNd$O z1}7~81S2^--(e0_#@MRw4hG%hRM)7A;?iC-ps8hFzWrF0E7qgFgs-q5^ z^`I5yWrZz|1*1cm@nloGbNjJCzQ3=ll~8t`N8nGMfGa4^G;1KgH8QoPA#V!l0Bnvr za0k#}%KAaX8hWlb32pkmlhhtf1!8btb%{pQ3}SL0f{RDxiqNn}kD;ie;EM{okj~R} zb#8r7CSU+!zaxi)?w97)#XGNS);4TA(NyFu??o%?glWM4hFe3r&HH?8CG} z#Ur9bId9*etE{|m^o%C1C?(_6Au^Os!8(R%;{JqPH2h6g8VXZFyx_aYduE0#apY=XimYY3L?BTL6phYIXWO~!#Ux+=wP00W>4-H7Dqf* z5@smHQPtobA$Pm_tyGgBVMW)I;6Yq{(;V^%yUhcM_+`&;Ba zMTw;~0e&Mf@!$a9RQSrT)#9q&J@bR2Sd?zLZZPc#KeRWwsp+7m{MfMW{x8SC(DE;md~AX z8a4vRZDzF_A9XBRa6FA_v9V~=V2pIZkrw`;#h_ufFrWymvEecIR!MAj1f4AgX?AuISQ$r?7susv+ZKJpP<(vbQC$zBGO7kjPAQHyqm%-IrzG_f zdDQJ_O;!mYapVW~MSeYXbz4&qxU12ugw&wpvigg{*chE0T6P>v(rIEb>wMxh1=cKR z*O+Ym$O&iGX9;M9R^R|Bb)R0C4l~+=zMCHSfJXRe$pba@p6s`??Wd z-|{;XWq>53Z9Uh#_qtKrqcZOaWyCOjqABybU%h^0@IU_kKTE&g_z&NTHaX^_zxAi- z_gjAL?MX2+kITIAAHG!{dYM0O+xiD@3%__ynYUV>w7!r1(_H5Dzj{5|>*K$DL;9`w zQAPuRPyX(QQkhr$@>_iDC-&s?|Kh``%*%f9%?^lg^%wu;M^c#|`TK7f!PD0B@?X|6 zJ}CIi?`3$ddCzr;UPQo6O}}3I-s?v?ye;GS@xI^G^6Go89od&#{#gUhyRU;AlzO%D z@!Iz)o-wz~tA6EL8SAGbcxHe0=~QO*`d0|NWYM;j8$OfDoV@Pk5DSS47GdLunlf+x5r{Wr z7+Cq}=X04i{P0NLS3drQT;}yZj9iGuWnTAEdE`#Y%1vKv%Dl|ruzE&iUTV*@+{#T~ z%4J@Ab#SsOFRpyzFPeI;9`~y)^V+NZhw$Ud&0o%Cu6apj=BYBTy&7#}E1#ICr@6*$ zy*T`$$ug&2`;q{z!u*w7&uc{ngShw)R#&-q7ofFHOHegq4qG{yFvLmtlzrOD2be;X|3{H@)@c)oJehMBih7 z`q@-w$2(qOsW$5TANudP%sGGUmC0G`sKXTx&p?3jzz1_Z7yrbo(!i9#c;JJ%o<0A=D{O(UI`3`2cE0^b)i<~6$e(;J zmD&FGmxGzHDtY(?jMW>mPUx=tVVPm~9gAi+<}!Tk%dAg&GI0N)T;|kUUS>`{q3YJ< z4>x+_O@TM0t&JaP%Dnky&{F_cKALsP+`8gGpqYKZEx&Uku6a-EbhZ(IR8M#oqBF?I z2EyPu4ixP><*Ftd8g;?P*b}24&pQ(*APmT3gk4LeZZu8D$X9zm1}4@T>`yh(-es>m zDaAIh;X5}VMCZsET_d;hVm+3cL%n9(eOw=mcz^_&FB)eOyxZ<%X#zlW1mi$JZ)vJp zURMD$Cq&u3)@ii43>x=E@l_%YN73%o0kqElylYXkTBGkApP4wc_Z@3`N}}dqx413Z z5mhQS?Gx&gvUYBP;iUd9ED;kKjn@G~RdlsYmRxj3-`9vlF9U+5zDM6vYSZ9gr-REI zMgsxGU7Ss6X_|5Df;JVDbR4qHawv-Oz{xRbYg#5|q=Hb15ot9{?#nzzh_ahsKp3#- zji7^qY-qlz#gSyHyH0sS9QM*g+%#>VzNd%A6=oEf4OkuOr24FIjm%Sr*{tr(J)r*9 zbfIE%_Zk_NgL#C8(>TWK5@ zDki*|K*7I6nsY-7c`rpx_4{PxyKP8*o5G20O}*PP!BnAWSH?0nU2oHNTW(%+tqzpm zR(xcz=fgb#so!tpZVVKS;cwxaOOL6B!wnUrNmNhh_@rwVHA1;_(U}P4wdn*x>{D!y zn&&M{&Fv0#A^vjT0j0>npEVj>xLA&U2U#~HRd?jG?7Dqsgh$`evK@^rUvQY zq1uN!1FGwrW`So&>p+kd=_tWBbr_1IR#K%;S_{Z*GoHTax*qnZ+q{D7g5sIj=Lu6{ zHP+1^9G}`o95B>DLQtxW-dbvT+lV%y=%x;3j7;s~pbR`QIl4f$M+zg!*H}=eU5MO( zZ?QKnT@6yxR;*@9&aHS@<<3Eowma%H5VbDeyq=7wvjxYa9eb+dM~xG!w6+!qHfU(? zYxR2iuFX(UEj?bd8}bXoz1SsFgq$6mvG+A`nP(8YG+$A-dRd)F!@=A|$Kje%&Y?e6 ztib_mq3DRn19tY9!}q>5njRA3`gxq&t^=GrXv^s?zNkAis!9h0rebudV%3eAfhz7g zs(G9&$Jm#W)|GiHajTu!eDpWa(vsK53jwsTUoe4G7k4?okyky2?^8|(kNRC_%tBeVKM2ST4jq&Y*8nn>hzf%O{w1p z+_42T;N)G@z-wJg6=-Pe7PmZ(n?F#}m)=FPIEt3G^d{7l!~we` zK!h|9b@^D*8?An@SS5#dq9Gj-#qjF}RODOpUdJ!Ump0###zoe5g@tT7>T6!M!Cg|K zJT5t9=jQ-I^Iqi9o%uC3g{ooJ!GVbQU0*+zqO;v#$;Evhh%rS!lU|G>SEGDRhbqpAnwq2c7VJb zs~%oN=|X_o^$%HyG%GQsTru>?dBAhG+yNikE#8boG)?RDvi>2&2&{W5 z^}Yo0YBPZ z2W|!Q<3IVcHq3COM~Y_Whn!B~v8R3Hci0tg1CJG(&}*J5vX(&|zZVttLe-^Pg9;On z_hKC{10rF~opHLsB3&~Fu=Hk*{)P%CoGj0sb79pwOJOThr^gyw*pP_BP1k$s0ExRo z7EQ8o(^y}-O#mj;f|CzmL}ZDZ^; zC2O9TMm|wFQ#qjy7V$Iq+51q9O>tR9Mv$j^A@Cef25)O9T+@RJW3{+0sAUVfuCIea zs$1R-rI?|1c+y6%4?wt0ttpbK*JjWK zyY(=|4myi3v#*k#1??AVAcU#2UDqs)H}OnpU-^eLrAua5qwB3RWSFOoM8y*Mjo}y5q#Gv8FM-K5Td`V5q@X5*r7J%OPYkG znb^sN+GhP^?ehdG)p;^VnMeIi&`&wzrmXU9PswtDoOc=hIKyMlz|H-&nQmTGZrVAI zILeAmBdfj>gq9&uG9l*=K6umoY(<$3Xh-lMq0*Trw5GldMSejVrD<+@Z~G5NWgmGn z&Pur)TH6zNGpbKHAqq?Q#AI3J>ns}@Ig9+#4g%-9H~u^=WFJGG^`YuWbzDb^Xu2^U zumpbQiLw*2TFDwu3Uz}UUn1&Ih5<|c5>A&@o4!`j7z)5;kii}SDCj$YB4R5~nmeqNZSFX;|uz0j>AIT1NH9_nNa?1tKPML@=iTCHcnlLam0*mOq-eV0mz!4%9vtQ2f7E$nT&pmrnI;= zu0e)U+^34)YY7>cv)dQtt4_}b$Xq9bf~xzecM!u9e?d-dQk>}t>xCH|*RxVIHAlAuttS%4 zS%AQI;fjNR`nzC&3@)5ipQf4aSEs|ppC0N2D$TZ*s>f+uI9k5UR z$B;b3+=6b2X7$>@I;31g84QCi&9>C-)w*6Iw>6)16!{TEDcp$*65~wZ7lEZl&dK-< z_ibaSLei-?(mC)Zbedanpy*Ku1P$bH*SSsML^y{t@M5$enyNDZAnFWm z)%j-e7|j;TXzKEAQ7mWmsgkX9U7DvOk^|W?V`O4&gwx0Ru7!#+*OHv>pqSbnR;VfO zdV%1M7KK7B5Uo)Tb;*~hL5U(e4Y=T}J-((0nCr8MufUk1{831)Y}1;a3&Ejwp4}Uaa6AvL6L-Tjz?0MjY1m@5TW{8 zD{y8u4S>E+Y|HKyyRH)*H|J!JX)Ome7>nh%+(mhD6PzQ^h?pzAyEtUCC5 zm<^!Dkwa>MME^@&kD|O*jaG$$7@)466`<=-w7Xr`Va9_IuCPa@mh7AanPwmA;H3lA zwFdA30)f+vf{zX+5tQhic%A$;qxD}-oY%PKR7!3_$K@J;6nGMS&yZk{+AZxzV{{fp zP)6{~(ZLa(H5}IUUL&a168dDsc`=zLVax%b@1Ml$k=0C}QLE-Hhv$q*_>D*PhsZPA zd!EN1cT9{fnmX@=*%s19-@(BYK9fgv7dzNsyB{I|FrsvjJ{<9UoFjn3?w0&01Ib7T0MEwv;C0jz-kS7ikyjN%5j@i3md( ztO#>KFDD=qIGilZ+H?yjtRuScH_0ypAdOl{Bbac`Ddcs>REP!Aop(g>w53j**w(1q zH>W33G@j7x;Nh?-Ax!tC4mAByLp%m}GPr_K=`pNRl#M=2Oxx0j931h`h167ZZmJ_H zUp$il?be*pIjX#%2HBlY=V^WBWpcl~(urH?s)LJscacpqIyJ_zKGW|d+*cY;Nz;@; zR$7l8OmoOZAzR-$J7^?E+@@Ut+X6D~S^)S?460~i^xuw_FFrHJI=Bs?7@JlNPL~=A zk0Ogw3f)z{h%nX&vEU3;f#^F2DmwnAr~^g=UzqdGK7HHroDeSIH{RoTKa_K6%#nY8 z-4|24Y`2O>Y2ijJrg|;(g;=NJo2&6cm6f7iHC-5VC$!bM%s-_x*`oWP4#P0O4ZC1S zw$oFQQJy6putc(OPj-mPGj7G@$-r|fP-$6=&xTUxGDx-}?MNMqT5C^Xk)Tw{>{}cX z*iKmPh=4&3F=9E~j0mLb7mPoJ{!xJ&h>c<-3aFj7L;f@L6GER90Le7S#u0&E{XWO? z6;t)Qrl2N3T4R+fOJ%1=_fvp+eUpz#cya1s;Dhvdx}E6-?KJ()2&avFPP7pNX5(xA ztjXARPZWw>O|m>;%nTkfA1d=4oNQH4q5+fVjoylFsD9u&Y1Ri8SC1?Dwz??45H-3> z0v_rpL(+c8Q9uoEwP_{wi~^HfI~^Dtd_!p;hxLraA>KFs+zfx)%BLzP|;kWHd zg`O#0IqD0JA4*hj({;A83^(Nif}>Ii&FMNmBKSXZLvY^?`wF@QP{qvgenh&^ zT@{K7H#EP|6*ed++f+@)U)*n4`(O$mviCeQ`XpzfniSO<{h=)Fa|go>3YnrFXe1=? zf98o?cY6|YFi#0?&InHfFbM8j<(lL!-k7@P4F=|1Hq&BsQ5+^qG3T21Fvz6!IYa>k zRl2xsd8x-R%mjRK-uq5w1vJng-{I5Z5e%cB@J`)Lh%Gh9cf!z9Phn1i9!jRP(FKQ` zXb&Hx!1o~s0P1@TdWyD8$0MwjaOb9x-$m#fq2GC;(e@MdnU@f5M&li7G(=1^KB~Os zs`YZ&yi0j)+PPlqvi#~OE|b+b4_dPc5o`3L?fQiL%^l}Vp=}z(0NebkQsLx?Mete= zNr0g6X-=O8EgVQ2Y{UUaEo{|wQVpR?yc#o~I??~;VX@4gr!;4EtVP~9pF2=#r-74N zho54b(c6U)hz<~{e3R@t2k1rwfUHl@H<<0+v=)n~#+^}g7L9!O4`g4E=;&eo*tuAHdm0_a>)>gL0OdkM@S5r|N)XNRzg$?nuz3f&a zm^Srfa^y~%A+pW=Hzni7%ARY_jV`_r(OcI3b9k2>wrJdf@1jhmKlHcxmBy?P=Lr%u z=a~63t&8Pmr+eC>M(K2C5r;nDk~80_?rs9eO>64ZG|iJgAHS2Yl(IFhpe_7;U1=~k zF`J+Y!N@L1ut;-=j;i8G*a!+E1}FUhC1Fr*EVE9 ze33dy)~0kqTSDE7+YEDv^!fBZ87{{uT%10}nzB{2&Eu&u6V;FIC7YBhwQtU=;q)}%XE=m%16dZ;>b#bR}U16u$3~@!GOHmca%7>A!c(g&)TSsiU)yJ z1;E}nk$Vj=keX9-WZBjoX`?m}=~T2i!C@O7Kt$RCw7ynG`AT=lt9rzPX_?~1tv7Mf+t>~<~=Ky z4~na4Q9%`zpf9OriVUcO7*7onR-w=khrh9XZ73S>WMA!lpN5*!VPpy-D5WOCw`h@Y zE12ev1i47gCC%xJ!IKl8LhqVp$8S?Zt&vKM5mf0p*+tp6UGla|gAZGPO!H+- zX=1Yjoo;EjHa({aG;HduT;f$Ks&T_{Xo*%c&2;Y?h~W?~lGidJr7FWa)y zw_T|&EHv?sHkEB#cKqisz?6}Q^{jUgFa_4gNKJzfpH0r>yHHq@&MWY)Edn(<9wPul zUDW(u3+7Qfv^LJ#Yp!et7$b}az9u|$oS*Y!X>2rT=F5=1x2t2LxU zF#pJm+1TRdG+1?CHQG&9hMI)ziH|#%-OBDaNSk(AjUBG(!fSxKbt^Ku)qtB<(c^;jlC4?k3qA%}@c zGj;3a=x-#9XZli@^=O?gd7j_P-_5g;6W|FxXkqo$%s%+c47yGS0>Mcl#?2qN5!bxu zx-2j)12;~YD}7+LvWf$*zZ;J~?-8tSKaDMqZ^OP@F2kO0?j0E$h)0wfy5(d>6M}`%OHv^BI7E>)!W{tm_i`GBKUpVP-%D5$;@Q zYK7+3XSLHJgT=@Ofo%9H=bC4@PJ0rl;mB&Fq+boAdwis&yxR`noeNYcr zgsE&oEZKaEuqy2-e2*n9^H*fN$U$7y(PoCEQ~A(^s4k%Mx@t5@*B{$KJZgXyTLKS+ zPh%ja?yud65t5mL8d^lhIw(>3BlHIEV26;Y(-3DpJ2mit&3Ne6sf3#M3p4hPr|<8I zby2QyRDCqq!KlxZjgb&cG5iGls<_N9Jo{dH;48pxbw%yu24OO)&)N@%JJx~b`#OOO z^#^=%^X%DPY6qY)$!pZNfOx7nqp_S~dw#&-Y)9_0L)ng-K%J$y@JM%VZClL&P?Vm%nMw$YhW zuWOQAw`q&f?&-avNrUXRQ+1BoT7QGhDVI2j>s)c1E1hK5Bne)qx*Z0YZxF>bbaik* zO!X`WLXEm}cu5Cc=7ThHo_>ZOQ%*l=J+W+Hk;d;)*q1-_MVx%|%Vcm?U+sy|QD^5- zEX`FPfw@M)qd>*Rh4D&X@b$m@CG5I=53c?fuLP}jc;v+o;kFdCghsuABD>dKyWr3YS(pB z3QP_6RA20O8qkSSYp@Vplu$WMAYA<AOHp&cGn+<)AoK`N(U-h8ga8!+t#S{DUYx zaL%{R#dB}`E9h2xyzW=8w|YPEfg5vwIedn;IwA}rk-G6G*rT1MF1T)A#-f-y>TUeZ z90lJGpSkj9UT5vx`5$gVVM5oz_EZL=IjpSZIWY|AQMjPT1fAVWHvU@AAmFAC+=$n` z_gbhK$pgZu51JPZN9=eEWtdb41Rha^8DM4?irnESXX%-`)2@4h#xcVar>bM!Bj?8j z*2?Lrlwy06gBdqfAkuyKGk<64RM>xsh^mG0bYKN#ePexbHG8&o2F z4vPTDRv7^MLSF`CLxxHV>Z;MvZkJL(0vneikwkVHP(9Olxud$fQMY9Ls*B%ys#Ey3 zW=xHDvJv_yERA2S|RO&@NMAz$v{_X zQ@S!1gwfsfIQlX1Ucv$SMiaR?B<3;xrwpf&uoVcva;+x}?`R#+0(}Hze9b{}^BKRl z{!rVoiFeeAGXUJK6J;mP^Y$bCBy~^fP)9!=@Tl1rOI-)B%7@xW=LvP_<3d{BiA&|2 z%}G?dULD;cYkBk;rGWy=bJZz8J%5I*o!XZks5$DT_@KoGIMN$}oCCntSBTxKdaHQ9 zER!MF`cP-x^@z|@U00;`zb63H1Eol9b=H2+%`?>3Vu|`&^rG|N1%e!++IH1(tA%ZM zy{WZo`5N;LiTBRJ_v-(-#d2PYT6^TJ>uAiGcMjenylT(@PvMr)`XYzD z=|YBS)X7G#X8Vxdeddg3u>0OU3yjOCrBrV=QYxMynZ!xrPJ3`3l7nKfIX>LrczfAV z8b_T+S9oVSwa1;Sj4Nl{r0ewydAWJ|e39ch+F_}Ms&z0YEAh{-|Kyjk@#qSE`1fCh zu5|d;JHLi|UvoDu|MTZIgH*4d^;0?@Q$LcSWLI74r~$1&OLT&2q?T1Nh|%>mEY*0{ zfuSlABs!%ut~5ZB{OvNJ?|U;`ett+`mV~Bh9InMXq1RTg8ke~jjlLkSZ(7i3;0No5 zI9yd{h?1P!zMK3Ah0SbhQ&AnA$G04@PhWlHS=xGrKPu>)k21ksZtlWn)j z>SMv$i{}J%5?oR~t-6^EM`;icaYt0o7a>U@l6r0M0MW5BaPRvb!{AZ+G2I%&83H}- zTsQVNP|DU4sR?5hpE~1N+pgibPV^jigbsCUP-2gFKsK>a+RQ{=EyXhEU9xtA&&C27 zqtQ>mh}X5tT3+zi3$146L#VB1E8A07H)#mzPQ4C9nZR5ZGh50NQ9BTDq}Qq&B^O|H zA;}E;_zNDvWj94Uq=uh_8z5iTX`Jt<@bYcSl!pDB=PjU6X{ZZWg`u#Y%_Xy~8hg}EG z##J}`AT}J|2mtu-Klu}b;Y0t}zhC#hcUWIfZ#{*(Ub7#MU-lSIZ9R#ublCae8MyRI zmt)V}dlF$X79!s2b;ED|v48&!|9<`Z-eKPl{K!2xaPgToFI|d#U$|_9 zvm1W%kMV|o`WD>wmT%$l%O3+3;EGRQiG5$V6iS7(HcphWDuIvulRw4t|ND#Zombz9 z6FW{|)1l3{76IB;qVI1|MWhb_vwp$wu692Uvdx!Uw1D~p7{(m9A3eNAHU22TjX>Hl-}~s zK7?!DeXR+)UN`^FjrBf&)vc#+;0<@<$>%(d)7wsgh7LO(*oliie<^m|x!c}({0APz zf!E!QXU;u_<)=5`;#)4m1z)?Wezl%m4h!b@_Ly-yV7O{rK+7AHb=dC$Zu1M(nxeBJ95TV(8Ls zX2#PmcpQ&idjO~Q9!Gy<8N2@MQtbHbd7}6MV#d)Id=H1-asVeUK8o%{kFDQ48@oUF z9CXhto2E0x&sBffE>R&Wb@YnEc=T;|;lxEpL8m)x-G3I&``~l2d~BoW7RF<*y&sRg z`T?9i;}kX?Ucm*Q*@p{0yH7gCSlzmc1FydePc*c+@N<{o?7J#0KK|Q2Q*zS>K4jmo zdC#?upT*c4{dOIsN^orsoARrIc@2@?MH;$&-<<=cb4joBT2)NcsZr9}{5%Iw;dVH) z15@oS$#M~vLu#s1m>2KGH^*4?S;A__bXPa!Gu^5X9Z5Qyyj49Mbe+xwK%#OrO=%{Z z77XGL6fsc5>U8MZ0y*@it0_ZzY5p;aI>ZdL`MApW5h*526ut5(q&jLRowKQH+GeKe zD3l9+u)U5oB8L>|Oe1((+dLiw=x6J7Q@%B-)jjoglQcFQHzS7hHQ;6nm6Pnp3w{PC zeB9Wa-xF7mdvn-mjMp&`lz%ofHRH_sEEL0NS*XJ@cfcUgT-ncG({iex7y~KZ4|A@K zf8(Ga0?+cSmQU0UvkvZKcw2z)AZln6C)5taVn*LLhf&H*ci)pa=mrXVKQt)pv!k_^ zqBEuepSt5&WQ&MR9l+=VUE{!I&|Nj8kM&CtNBi`kgD=@6LG&n7-Rs}lU_E%#?Lm0x zK#cG|=Te#Cx=vzQvOWsAAFW%FTmM2(K;=}oXsw67O9lbgnHd6MDQ+X#GUnI-HH@AB zt~ZbGIfgBdZ=Fz_k`Jq+S9x~ZJHL+qkGVGwx1_l41b-*;zE>Nyu@p-c`>J9Wpbcap z2_qzskdQ6gk}WUY9*;fq+2bBB?fq-FcYDU)H|<{RnXlXS*lt@Ek^rFvEtWvCgg}U` zfI=))r2+&L6x0S)bu-WW5oe3Y%==y;yFCf@?!B3j5hqTZEl!*`aojgHVB<&6MK|g2 z=vz12Ky7>DV>s=Wv#@&W;ppaDJoeVj*mT{!IRCFNwpt&&`hIM@`CP1eVl}2q58|P> zZ^EW`-iHhSHkY~jSKb34PYAC0)%U=#6|OtJ|EoCqp<{5_pS=l7_ASA|We4!wi97J< zr4M7BOazA1W9XR`xc1kt19LXwqw%lT_Vd4mEf;UWt3PxxRz1BMyN}(4yRN$v^ShT| z{e8##;){IV{hqI5!@bAj{F}~4+jQ9c=7*pR%k0EvvW8V@=l37Id^67b`-`yh$yL~W z%r4yfJ$GS#&k`KD*$rmx+k@}B8%N)@9%p>`Y;=j0O0A1p2U-{--cKHyriyJ z3LT{VfcHtSdp~$5j(p%~T=E|-!~9E2FkN;4FP!`ww!G;Pn+WVU^I2^A{=2d9`txwa z=5^S2^DA(~!$G0?k4+8+6di4`H;j1TsnDF8WJ8{7EgZPLpbg)&&Kjc*5JUJ{n&BU<5=_M4M0dqw)4uZIN~FxW9cKS!Am+k|E@>z z?H_p%$NlH?poh%(3P7e46>Jn}w z*FA-2-uNw?{@>2W>ZjLW@A_TX{Db#ke)l|%zI#0Y;GPfOfukNc8n5}2%P_Zh9@FIq zvGe5Tu=P!k+C<>WU =Zux^88l;C#6@nxvs#?*iGGZ?IkOsbu(M&ArEr?cglgi&8 zej5Tx0C^!pLmM0y_r|&%e*iVGvpGOS zIUGPTV|1Lv2=I{2_(|}MeSmMAvs0Y`pdqwvCuq?PhnkPuyONc?_cuoum#bzCk!;A* zRnTA@D&B2ib-ZDn&iEZSz8vT=%QZfW=FZM(U`fXd9!i62QfwipQ4smVz8#_zBwT>9i`aMP|h}+>PmsG0!TY4 zdB!4JIY4+vV2lw0%EyMTP9=5bUDpL{@W*{Cw)z#upY?!6JwS_L=kcghW74F|cU^XD zG(>2+9A~d#MNEWF5*cJ2li|a(`43#sFy+ z=M%}w1|a7j2);AOY%&*+<6}T9#<}#afW!ZDY}?p-w*(38k|~<~jREz!Ke`E@`@@^c z_-Td>{?Ydzhhy&EfXPeqSh9O5Hr{Z)O%^WsvrBQrBS&F!Fkx=*JWjpkRoHRHGX;F- z+;BeDK7Kfw0}Yn$T853EI2X^I`Ygsm7KX0f$Lzu}4xaESIu+*6^7S%J@)!XaPH0LjrRpf!C=zv#v9MW;oAaALtI zMy%R&1e*O5EdBNhtpD?KOpK5S%1Aei*8kN;tavz&>Ewl_IQH*fg*|6IXUn+Hyk!ec`p`zK+Ojr}>6W!P{rYpT z?M;tM_XvBA-HoFjItKH*mw-B8ZqGc{-FGZ53S-e5>K?BAhR2JCC#E#y``AAWlNLf9 zg+wz?7Zv~dLs?rVRh5glW)`jZ&>>PdweNLBq6}x?v*WyK$ek{a=jmjorLxx=y5n?| zue{Ws%QeZv0d$igP{#jy*rzJ%92(T5Bxz{#-i0P5OeT_Byv?UxHc8*>tj~F3!B(I3 zTov*x{3?4!mu9$cVziJ4u{QZ#G!T_{T~;ft->Hgoc;A(8DCacogP-pkr59Za9248H zYD2#VkrgW&vw%ZAIyo_v1*5!jb?A_Uc&j89fsL9AuCF7QDrS&JrbX zn-5CUP}oFy^|DF85+ck)3~=dJ-W*L;{~`7*d@PE|qL(d@7(0*hnTA3pmU9VG4wWR6 z<(WP#0SW2+nbAn4cF35@R>6bXsFPyJrBHJH*ehKExcJHEL85E$3&-Wg& z7i*tb>tzU7yL~P89=SJ{t7hKo9zNRSY7Bsg4B*Si6y|aH`Qc9-E->cjYqqb&o@4gp zI=Q6BBR8+hv1k&rtIu9KYA;r9TOF&#$}MZ~(z?Ay1N)BI<7EVUcU?H{naHUp0}*U1Mj^D zk#M!?BR8)zp%||ND-K}ko@F2qc5Qe8NB{Zj05I*41`tRT8)>E+6xuc zC*FDrZvWqI#Y!2ArO)|T3`bMA(s8nNWmUi(6|VM6No4^AU({78nG%v(nR`jk>=f@- z<%-~FSHrdEKK|0xG52QGa@IwZ+gs5UqrEF9qcIaz4SiYJB}#c(zK zs|FoR!$Cp0847SK79in7f(tWlW0|7YBSvCfMhq(=r)?Bp?6q3}{~yXN$eIy#kQluvI4B^=a~l)D`J-)R4d(V~N&?a;cMCfKTUXZk0| zd!j%up>y#f1r&KTf`EzGc&*6rt|L1UIi);N=pdn3iI4<_1UBz~-d82GA`_*F0yuQ_ z7_O9VQV7NKWzVd@OUGoRM@w6{N>v;H=65X}s0g_Cec!+e1u&!6}l_8qj=zND)RpHV-OZ`!86x;otY0#^ZMeq{H4(M=gl*=#Ky%ZYeq%=Itp z?toDiOR4A_t0Sw{R)|VL$I=@E_vt8!j&FS zqF{iE{s+0B#Tn*-A|jhOdfYObJkZP@9Vo9-bPS-&OZ1cqTFV=X8yxJ^gQ-eCH?5&W zEq6sok-~4dhzd6VaX^m0{O;jtWN3W3PAr8V`_ z4IDdMG0*d-JcrAF|GP2w^1Ky!{?r`?+o4|65jZiZ8-97k&J|d(bA{Et`^Y`G^(Q}X z6M;BJ<|r^g7B3`LJhuWn*YCu-M?FS==lY#kv17$zYy_9LT;F%1iOAe}{PS4%$kA5n z#p8Ek^|W|tlfO1!MFRw7qRS_6;Kmo#Z!l2_X#iH z@S@Dl5@z}9vQUXzh?ao4eRDW)*nTY8v&8zg`}kd6Pv$=?+qnYEcCIj{*t>2wZvW}q zWFo*=wS6_t|I14-zjxkRGhEd|7!^&E|6a0t3HGmf3G+|SVbv3B@btM)+Qh&oW+IRd zHfSdu=wMRI)Ox=3*?>dJZ|*(u1uT1dg&1WWmTzB)-KX!ws=L=^LEUxXchH>Akp7(NMXc3Sn36l=#pk#nxk~D4urV4w!pw_kY+2z=M!V5U!n@2%I zX?C6P0+v0yA}9^Q@}0}E?D=K(>fUvGaQn~PhBI&4C=*brQg{%N2YX+Gz*>OMdrna} z+RHS|wSgl)Srm$vsd>uEM*%&i<;NJee?P9m#^1x9PEnXat@z5=+~>cS3s<{<(vNEuCoQ>m-wbT(WJwk8_g-)FsPCq^cor zE*1}+DnZdzCWnP^*$j!{aUQ&SGJr=FOTC!j59&7Sf+I8$?1KeWhxNUNcd^$%BSR#{ zz--S}9|AXQLT7r$8!AJ8xWmyARG={`-Wm_Ch>LD$S*|qK7aPl#D=aa3ryKsBH-CerFQ}mbNv1o^+fTa;{9-ea+6L`w$489yp2dsj|Us z2iYAUjsObXWMspFgWfT6lTXuGqz78*s`6ajABQomM`%3R^CH3;l@btM);-Pom=P(S-piLw7ujMVibd}<|hY)<*?8MyZYU&pQ!UO+qFV!Hewo;~L&-1!q<4mb)H zW3Xr_K)Pnz;kGa3tWTYd%~x*1bEiIA;X402?8%jQ>f&#i!1Gv4VEwHp;nC|hVb=*S zpj*;n&&e-h%lAHj?HnAgNduF!SaRBC(>BIwj z^go=4t>60q_MEf}?UEKRp12c_T=xJ@{L(2lreFJCZo?BY7My?stM*r8;e4~~`Q>=# zyr*EXNy<+|rm#!84&g(G%5S4AS`M`TqJi?U5-;iEgM05R?1;?jTH735wbVAFv8iAv zyn2fQoJF46a)Y2vIKsG?9A7M7Aiihq!@-1B1~j?A<3ZM?9rs-uL;&2LZjh?vrrUc>J zQQa;`=Ag>|QVOAB@lzVm>^974e9I!`jl_8t&A`>kV?QWHRnyR4!-t>{tYXQY-;*xu3oA1o^yzHcLs zzOLM7S(|(hKo|>UBX^p4NK_6D8ksfsJyfa{ymR%eZE|3Oi~sYbc=(!4_{uN*1Gr(V zc=|A${nxLy8VZqOOH$=^!G|u!1J~S#FZ}#x!IKuNo?MOd{{A9-^(SsKg=QTbP~x?M zebpz<#RJ#ei@V-;Czx2$hsv|hoP)<+`zSWO{XTSaEtc$Bien!>7O(m1H}v58POszd zJpubyzKlEGcROBQ^%9otT8>k0KLzXWIezq=F)>6XeGOix-FhbO`rbS7^6HncZ09nZ zdh3}u=AmOz#zXX9*5x_^aO_wkSCw%o}tl72}Z~5JP8t-|3dy$n_xp~${ z&%vf2xEq__dmli+xnq>&f}n-)3x`m zLx&Dey!&CieB2&PcFp7H8&A#ca31gt|Ic}N>iZwUFNzuTQ=T+b-RL&DU%K&$pP@vG{M7^l0>qk8i~0cWuIb@4pL7j4R}D zu~HsnBT!|`qHLaU=|p{&?spHEB32tmMFSjf8+>CI&*G>0ZY}eoJ#KHfk}Ohv+KK>$ zin(})m?Z5shi6e{dfnS>py4IDisr_BkTcmS4TD5;`C))p%MDA44xNJ9+C(iMld#5m7~UnZA90(%$a9#H~u-V{VK zDIhbhUB-iRG7Tb6&&nO!-krS9PS(vS0c~rWwX?k>UiM&9lxN9SG(e?(8{-Ten-0GD zm&wDV5;;Cvbota^mT;gjet!8)lkxBWp&#Q~-G1f|Zp4+pcx`@Va9wm^t}AA5p_frs zlwRoyV5-c33QIOarD0>C_pW|WtUF91cwE-bTrvG0a1D*XV3|r*l_^Y};N58wyus#m z_Oa{qxf~c2@etpiO$|Z7jT9thYJ~W~KqK1uIO(M5`2>&PhOGYjUU8qwCpGQd`#pDI z-w}JU@uqXJ@~PE!1hC?y(~K-#C!2=Ku0}7ad1lxRBnF!^vu$%;VsQ4L*kMi5Uduq& zW`Sc4(Aoy7Uo>}nL82{Ek*4igMbE>443r59rVe);0SpEAsw^(hQz+}BLT5CM= zc)#QQUKxdH2FDHQg<1gg%2ehY4Lh6Sd-k?P6T^5#?R-2pV_jE#T2J1ceU-|6<|lHXe+dB z3m}PX@GHwWwv~x4C|wO(>^hNWEVz{KnutKZ1CnBy@*#yFSlFAbqKLlMuq74kUFYWr zbk;UmwzjYUF?iM8x3Hq349P}o#)R^*XK^wd?Tr>45`4vo035jS%UE{prG@R?vG>VV z1bhHO43&9mLJaEcKJ~ijo+9tHt;R~n7znG`RLDG!#nzVMNdweZ^&rVPAlARmR@x)pYJhF2vSLAI06@e<${>-G{@TUWH5l4-M3;6wd@ee?3_n@ zUC&>aZq(3rY_GRgiUM%nQO@$tD+oKFiJ+V^=Jgx0e zi&TATTV*}7NP;@TNw=MblWz0VpE(#tkv{7_g@Lun4F}qH0VaJ3Ji;2n6IK~wh(-ZD z1%5Q<=bkR4!WA#4Q?jlMWEh&Jv6Z?+UVrRU*j|7=9fb?m*b0Oy69^}XahU0)D-9S% znE1K#C5iGvBPm3Yb89m+ji3Pl23z<++p%~L5ey3ff%9GfX4wENoB0k-r+IZ^dN9+q z;372*+Gz_=m+KeT6(Jw`quxDFf2y1LBzuRAE0uy`iDkoVrE@}tFvt20;H zWO42gXZ=D9pz(KoKaq#sO*AVHaw=edu1y5FDqlMua-Ia8L8Uw|O0nx0B9fKCvaLF0 zvOBTayzn{UM#foZ@-l}y<`s3%R!E`UdV!0Aj8u~4Fhea?afv`(hlz$(CBjsB)CxHR z4cX9Y=eXrU;I2iZ;g+G#B)=7rIV32bnV|oy&4_PtrY5lw7Bvwl6)qL`7utwZP8!?@ zE%;v$lfBba2;#z#LRuCx7;aHLvPx}XVMw+wSjQ`oIDZkFZ}V%BTxN$^S`-Tsw8b{bWA*}jI>-RZ|XfW{ifcK z0^nIKjrA#45cT6wDF;}MB!R6uO4%~KnDH1QK$+z*Focx{=Og7Fln@yMQG_ITV|2yO z4quURCRuvcNq`RuDl zqk$u2mDf-8L@VC7MX!3j+$Dx$BVj~TqH-|QWJKQqa4!IBT(z9q z3&#=H<%1CB0B1IgvgcJ}xLeNgh0|$^j}Y(?H%LW$6|lF>vq1lwK&B3mi&`q_*fg|QP4 zUduj?4Bsam|87={@-VeC&?7iMIer8;`e~E(;$c#DCSbsJ`Y8uZR<0t55tB9nT)HDEhWw?)Y zSPuki1fP>6F@}H`k8D{6i!RB}Vt+ztTMb_As`7C#MY8NN**K01b^58@;?9u#sppHd zqMI2&+xosIOQ))&q4gk=l*(A=Q{8I?W|1`_&!l|EkOLBt_gU#UkBF4mCpF9)gtMGT zGRJZtBSw(5jx&~tM?*0ji$V)5WaQeFk%XFLTW{dVANHJRGln;d&yqj>#}8KgVGhqk;U4NJ0bTUoErLLr`Cg63j!s z#*~hJtBkARDk=eNedyEKAz#5zTzE5U=|PElEek}a{w&`+^KdZo$-vfM_7I`yJ%vp` z^go2b59T7lg@o{wdwH^FHBJaiV;!b|;zY41XtT;%wTH1Q(OBGBoa7m(sJh(2p|z6T zr|{j%7yQ+)STjyqQlkL?#_4I`4V%dJKYMYYMLllj*rZb@qivUIMfadsQv~%=lD{3k z#R&rojR2F$B!`MgY>=kb)BM|t)o*W7zCU&P4@aX za&l>6KTVhb%u&L!x%mMnO)w-C2Sb=G)z5GlGbTgPLdZp>74TCuQ2s9Xw+3VeBT%ot zs{Q)n>XYh66`n-yo4_ap{}5n9R!-GWO^-d9R4+u1E_#u}+u`j0ZoR^{&pbV5@TI)33hV1R{B%eQ%OjW2#Y=Gbt zEs3CT!qj$bQ4Um)Nt3dJBc)_1MC}+h%9(^Z(rH(jL9IPSD|P??AOJ~3K~zRVajB6m z73bpXg`qV=QxO9CH?&#J*v;0~c{==Va`44t&N7s{0nD^<<7 z4O|lf6a*XRP$5cw(r#E9(9??5NUVjh&hQmQTB0iDa1dpo7M~N)cRn*p#OJcEEV!T% zAK!93V>7m?5;UkdBRs}fBIno`S&XLmYCLL&eori;*oL7?z2@XPnbQzai zp9i$0kS)lEE`L#uA|z010O3Mn$;hHdlIvRoJX{i3i8zZfT`-hfKZyr z16sthQPuAj!BGK)ZZmX)c>j8TPb*0JzKP^qSme;tq4jUa=O6<`^bMrSQ>Sa2zoX12>?hLpAZ0 zqD-NCYXXZ6yP*}eUeR1_G_XJF-BjH@MATYLg`t(JByspz^s#_zsQ&PNjpTt&6*Z_l zjw=8|vG@^mZ_K|HwnpT?vCyyq1+63y^(Bpz^}^oo$bto*ldB6G3x8K9u#VbL5u6{~K?8^JN5`a!*bdp$|CZ&9$aTg|l zM3&LX81f4B%d?!pn~_9j63SFDD6V!z`$v zkiHahD8`g{ysYmu(yxEvYp9E_v>v-$6h>6nIt3WDN9!}_RLM!2RMT?8QdMf}GBh0LeX15eUA72ds3S+HiIvxmLGsF+zNARwP z%Q!8-crSqOGS$W?@hSeqS(l+iF_+>CkCH!5=+EvDmwzK``p z8%|HBFDBmuW1RJ5G96=Sw^iI!d!3kLD5RGKl!uf2CQQ55_98LJQ*Z}5;`(oJ{*j&) zAP>3A_f;qAim3Lm4XgDnbK$w?qNRwAFdxXeItkf3fD(aY##Nysq!ub^ z&+U^;MD_jhik@p>nGtfCMN6!cl+axp;()9neh8Ih4=iV3qbCrk@vWM|Cj}$`w_xJ<DC1{(yc}(WuDgv>W}}e6nR_uPDzI z)G%;fVqGN&_)CFLvu&W|^L^b%!;swF1k*E}#3@si*F4vom$*C1*)X&&2BB@UDr-4x zX5`K$BU1n!DGg_NVf)t%ajLGl;_vZf3~rMS2!#6gm_X9H#0do7z)`)Yb#v@zw5mryip>$tcw^RsfdaA5vxY5riU*bL zP!shyB2*!D=2VfcK{~moJW4k4uIQB6H>V>zkhs%*ojLV0J=?}AY7;DgH03#! z5nbn}ibo$2k*{zn9(1fUzrW5qawud6N)5WMwR&2~a^^}-KQz0K3NhHYkd&v;uu28J z^emND@S~^q+R82Zdouk{H%89mBT`$kKXsHRH)`C2fCdT7EhdurCy!w=EN5q6Zl^)m zR4ru{wyhf>CHS)L_^Cpv z4_!I7_0XBIp`N~~hsF;o1k?zJ8yNk5t8j4GV>F^o25RN0@5)}P#B7^`h~z*KTMmo? z0AcsO_Ny}bnna*UW1e?H-sB5rOyMUZs?btFuB#>*`>BzNP1BfRZ~Fq|fD(cjgJgQZ z2G#zua0{`Vq)0yathy`keu>~iBK0Vg>$iI2FjVQ#822*&IHkLs8CGmud>bHwk*vO(3)qhNff6oDKH2&G*z$Fav?eFrhS) zD2Ebw=z**lNXd>F)3y~D6O`c+<-?FjsYbX$Gq-l_H$BN|QyUN3l1P zy%L6`?o@SVnZ1%ZgET55QIn;OuK009l{SGv;D0Jvr8w(JArCqr3}F{~Utp3;)SIUt zE?ca8bbyhZts@Ux(NDU6N#$nVEUZa4R00GDY{KLnBk{gDeq>0v8d(Jru6vxH4b<*Pf6qw@Vs2B)_90k*be~epx z{|3dh;@bgEfiMXbR^YReo)BU$AKx+A7ycvv9D1H%>3etUcN`|nzQ{vO%n+*n4Zk;b zdofZpT(tmN$j(?y9gDewWo_X$RKl+;O;Se3&%6y9JFW~61(YcB?73(AUc*3Dn1+fc)UlS_lgE7mk@8iu3r#m%1sY~%2W;Me#+&CHnV$~bIN zKK0iOu$1!w=R?3;i04hCIU|cMc9IxP+30r6s!SDrNd4>wkhS(GEO z6SH{O3Xc|X@TwjazoSAK7?ipXQRdWmP`NY&ChM0{e`q}nM%%WQu|}IN^bHYGYCH#h z;A7=6TM@1&7GXTplU_uQK$BJsz&~;s$9Dp|o{PhB;&_+@WE}?68Ol3)B5Bj3~EZD<=>bI3G`^~yDyS4K z6;7YWD+M?3d={-3iI4DF8M=T{a1UNypyprdm76667q~|4m|8IOz?xlWkll+m@Mn}Q z$47{o2H@1gHpEzrVCHa!Qi~~jaFVc^V6{Vi!%G(y4kRq0({c=MvN4rIf3l}^ z(hyp)r*e+xkUCP{OR~hMaOO-0CXq6()NT-1I_QF3t%L#r8;#1i+c*k7L;$)FEtw$5 zS4U~^5_5bfD#3b4s^2ya1LurH9oJ{d`g_@iolP(zGIHGu%Mw>9LB3k+WJ=nCe}eKg z2m{J(V#I2&hb3?gp^)bw@s`Q$PU8Jr$pi$_O~XlI_#H^3#{C$ z%m0oWFW(s*#Epk6xxQ1;cS0vQ&vRbxyn@hZ_k@T|33iP6CV|@wQ5$gE8ZuRBkBvMb zpSVg+u-vB?HJ&&wk(LAQ_c*|7)ldmTZy86wQ15F`r>Gt`=Ashp5fXJes~9u(yH~e1 z7`>)yGsLzAn5MQKBP$qtL>|#`s9rF;3{7K9b@|X36J6W?{=;WZmEFNTHpnD5+ zqScVea}h{k=sHl!2WPdy;W^Po)qR~zn4S=RsRtoRq5?Tc&{h&Hk3n`qbec_%vtg?# zJWZuhXSBiqI!Qd?Hm-t4{hpSb1=vM;LpAw3 z$9*UftZMQmaF$*^~qA1Y{|4mofgmjp~M zHW{jHu^0522o>AYCCYEE$yq|;*$6Gml6nH>(cnPW<%~rsN8C<3SQwj4@FI}ViA+$) zl_9A=>r7w^WwCG@)sgJp?Xh=jIW>ISEB7(1je?%MQX@%;st0h@KYKmYWAqCjU zO|z)qrLws~E>rK8SEYI>d_NRjYJG`tjEqlhdn{lNaeBV?as%Y7>wuFFDD$l#_}U-HYJK1wu~(Eq5APRMAd3 z2^US&^IEGDhS4Dy!-)XStKJMTb~U6YdpS&>77j=ijX|dRcX?mD{CRaj>nexQ+*LvG zBq`&Wl^{_Q8SaMk9D>ep6jx{lZC-;)`W~Pb)LkKr8-Md7MVV`Vy?-+A4P#|OTQ~f>s?2W;)H7Bl z2&!J0U%##=U-du>(p%nW?$_ey&H?w@~WaHQqZpZ`BTUX*#`&%DFzzfL@}xBtga6=h!YQ*Y0L zNz;)M;jaHumO1lBuCPojdOh-&pDoIq|Ko3idV@5Ku26!W2Fbt{KNlQo*ZqbL?f3Y0H3S+e#OsSW6w0q>(jq~V^QX+Uwl{QPZIS* z!{c600&f28;WAOi4vnb+&3XJkS;?rk{o=d)hm7ehe^AoumA~*#)K^{Ril4g%g{UU# z(fs8*Alh3g8$!3Vh>FOZqwcN3V3_UCM6$ zi;{j$`oI+q3o}~ou>HS(z9@6t_r1kEm*Obc_BWp^${h2)HzVt8G88=Zp|YN1zV9u_ zrm`#AC;zsrXZ;Vn)v+VvzrAYf@b7surp!3dc0fv)b{(c4yR|6u@-=US3It85y5y$Y z$}(49Rw-%1(wnO?Z@&y~4NI9%ez`1j)ur-8CnDT0^R_pjzLtLaABW2Xx?lRKs?1ey zKsn18s^|6L7cHU;00x%c@|Cj8m9IxVJL#3F>jALz)32n=>xyw85SH}dd9A^!AT7P+ z_Te%HGk<4g;#hpTDs$EALN!^DE&W7==XboJ0GJ3^a&uW`|228s8bU-!Lll5b|X;h7JYWsd#6%RNOU=k%dl|N9q;GN*s=tv->X%+s6y z;&WA*x5&Iy41EBP{J$l?pZY^@0RVGq0ffi?sw{KT`!5e7Gt059fAbGTnWNwLUC>NH zxjx48*Oz>H#CyLB7J(r3?YO?|`^tA;Y6pj@TzvV)ax9j->kYOVp?2H!#&Rs^n%5V` zIRJDwmGz`|zCrM;onsuV+FEw)Wj-gRY}oJqSlO?o*Is4^E*`Alh}Yb^E|qWWj=>-L z;eTDO>H+xl@7;j6{o=LW8K0Q-uAYal@>I;2L-*^d-k_mMVsk_H3fTHTsCdb}5H`b} zHIpx{%C)fQ_g=v@f3$t7g@ev;RR_wwqk*&jCat^rgg=rqV1Y0UqWMpLJaa zJyJbpR)N(Vvpa})N4yn^o2~;69-N}(-0`l}m~KxcC+E)Cy(|FPZWgiMls77?F_&>( z@rpnhQ;rT@aUx*%!gy&NgL`|*N|0Br2Ud(2nB|2noI$m?GUD&cv1l0UY?%8m7n!3L zYF}GJq)h=#SC5$cJXwstgX6TsAq8KcM`OiKR-EK!7if}wec2FX-Y~gcc*ukgGb|in ziO{OCTgekjy~EBT`n69=Gf7t+rB)I_tzNXeVg?Io0422D6oiDfWuR&Ba@S(o=2MM3 zVoW(N)VG{B64smT3cwiVWi;u)Iee-fT+(MMi;4lzjeQF!ik>hYDM!`wp=w1Q^aOdY z0;+D!BIX5dET(^!C}gaio-)$P1IxsI)C|~Dazz!3yT+J$;QoM}FOaR^bs@so}Z0GfF2Qnl-J_l%-;~C{?GB%2dZ%anl9cjahg3 zW*i*ke4=r~Kzq|aqPg}`6Vm2PRn-H=WK_w67a9&-eT(Sz3z&Fh0*dyh*OMZN%jMf#KgkZ1iX}1X%=6g7rP&shYEV~ znK2axV@;-{(h^>#l(kNQtmS8ri-ihR&u!JShYA&D1Q$*6FbGsOL%0+wSs=^7VJvZ- zNwYVwjX|uJId7~?VabyuyHJN5Bi%|YwF>)`+<3M`OV%;PUoMbR#9PLhdjAa)(kJMT z2WmcBfK&$_(!dv@a^RdU7RUeN*MLDfVB6TFE=sJz0O-G`aF&&ifzf~7%NArbS1BJ^ z?&mfxsRsor3eHk~veK+oD)o4}J3=-hRH1eti8JKBTgOiXLo;DRjCv{1AJas2&UAt?18UuQB84Bnvq(v;E{6G-37}$x%&3&GhT@jT-(O_8u_|Ao z?L!m{wW6@~tMk1K!-#ce z?w1*w5GXZqY^zd`MW02e=!PEmj%R^tXDS5+<`XN%L^cIO1Y;I-9Vq2x;;zewF8Oiq zDj-b17_8=n4<6WDPK_+rq_GdCip{17#s$ZFY=XRg$E&MwS9UnOLt%1?s*>13ZIr0s zM(-N5M@+bTzg%MUV^;wl80pz`Nq|kdqnA&;#zUQS&wEw_&atJ3p!$xo*wB*Kzv8Q-2JK-y?m76&q)Jvxmpw7<`=sF~7WYQBh zKFYZm%#6vTK|A#h;O>s&t5^QWE%?^^u_(icG*AJ|Xo&+1JyD~CtFAN|7#I?Z%=X2^+ zFautcU5@YCjIiQeYm2;1rJYEyJ#;ExhCKo{sjf7d{fzw_mLa`vsR>{(vDIm*e6@yx z<_iRt{4PQ`slhH2Xg@S8=vqRa2+O-U#jd<3JWG-xE3bNWAS5)CltT&i1aY{$Hr;@@ zGMNqRw(Ih~8-2%&>m-J$tTG52*vYl*GD$nBd)pE;wmsQ|L{|iv+4$FA_wPDvs!LO9 zGM^*wugfP1cQPa@X9d4fr>%M9SW`KD}$u2pU0lOMP}#NobHDnB@}?KvQ1X9uN(Iru5cjkK>UU1@bpT-ht0Denm= zh<5hXBmw=_68=*h=nVev0^&6Z&%UvrsC7!-mQ zmGCWU7^%Czu`z!kM`9rdeYvqt)7CRK>y{RyIPK!{)8zfIQXbQD1$q>B5sMazH^|@Ui~?|;2>JiR1d2031e1Vn!6(#0eVPTr@w`km|^+Anf2hE zE*yTR^s7b=VXm1NDYC9ybe(zs69HY@A|)VkgAVy{A%M|9H6SpTaz^hY$ZT7keCg79 z27sV^n7xTpFj&s;@KA`H!Ke`wwVLrnEfj&@R!A6b5Y>cO5a$Af$OtlPP-FSuAw4k4 z0|Q2XeF=TA&+^9MtQ%BaqOT3YF#>~?54c$XT~P-WbBrREul_y;Pha`l6QZj5V7Lk` z#q3u-#lm%eD6j4rALM)4#1$T=z@;K{&0!%E>697(c@mw|P0Q+Ve!-f}#=98PrtgIh zbTT1u>gsmpcX1+6izYQ-?$EZa)R$>9puvn%BH;-tpKE7SFKOsYLAnLn*v~xy@&;i5 z)9Dl-IgeN1?V|HQHDKtAk8HW>ne;SIZKGa2L6*n0S)=2oa#BA`r`8=}4}a1OO)>0N z6Dw#V>Wi>!P6duk!)FY>^9@$Fhfu-wIetZ zYamca57}Bo+S8l1^j7Lc6&zNbnL`zFYRju`vwlWYNpQ%GG5sl?>rtsmNhu69Zy4gFN>>tRCrGs`v%hkq9XK55r^+uXCynoK$S0|7n`505k;@njHGnE> zkBbF4-R0GU&OLc4?`7#a?_A1%00vsXP8=rA20|l~h`H3DwU#AyH9ZerT{y}D z_OF956h^}^yd%$NqFedUy(c48mc~cZkZt&N;V%YlBF_laan4GkasX`UpEV&waV88U zLx=T(oqtuvWKaXlta3#kve!XL_*%kT^5R=S5xH#%&m!jayYZi2kdPVVl)<|HAu2(S z-IpfBF40iiyh^}UzxG3&6-g%Pt?E;#kuUoapz@o1{KD!$AVO)v$0$y4ETl+*MTEtN zpP{M2eF8uR8=1|aphUYlLSo@o2CCwTZO?+?9I$Z@Cks1JC1nqjxeel=hF{$EolYcb zMZNG<0^56K%zk`@{X69ApR%19(kbHIa2OQMkRjXi@&{t$LNnM4aOI7HkPSX1_`=E^ zK!PwA!sF;|FJ$b1wWduO9MOo<0#M@c%tl4CsKY7#N;}dT! z@trZpE1e9~mC*3e72^#Ax)`uOhV8mxL2CG-KsQ`+XZ+@yhqXQe2VY{@9rE|NuD9=? z$vl{i-0U^;4w~Xqh!a4>=21kWblI6=jFS!m$?2#0p*Sg_sR>h(Lv~Qx4Re<_WHyBT(^edrWQUu@Jv&5%#2w}+K@;{i0jCpi zUXh@jorulFn(?GVqG1$1?to5~`xh0mxws5}1G3i)w?z>B5Ni#I0J~oqSc|q`3m`#di@# zVR(w?!#b?QPCW~Zj~6(IXH?!qnK5ceEQ<9O-{#Dh{+Y`kYTb*{0mFM6Z26a!Y1u4l zBXTV}Vq}fgZ7&7Z%D09!k~5g!9X8apj6W&&Iq0$~_vp6R8({Zl4Nfkt%&q0Wl; zF*fF*%z(HVDH*;mg79DIrDMR6H$uzy!*>>pT|N5Z694+X;hDWiF_%;$6RspwxkfLS z)~uerOa>(lXugVarH8GZB=xq$=-So{0@D2((Q8JqY(5R?VP&Gs7#8N*qEO42}-1Y#N@MOwhL3XkRuz zhXd28Z5mWVrAdUAfoa=ek`lVE1>~e-u@caMF`rUS-$w*AdBwr-Ph>KWP{{$e66!DV zld$k)pt_VUYo?hk)GEtH+8&bu@pq-?U-31Qjnz^N-|H6*mlaYAPwo(mG%yaKnOHBu z;fU~7vaAfDTBJgjtLtEycL3cGoPVm(*C`PoyDcfi4-Cj0%NWZ>^v?8m}tF7Lx4SzM1N%1D#iYo@SB8=f%b|93X*$$EFavZ38f%U`N&h7M- z5mnEJ(s=eR6>bBH+PXhNv+gh}J8BcSLSdH`ERL+pQc+ga{G7=(;ADXYth`Qy7ox=l zsw6E@>DJk#?nZyMK|@HH&<3$9Anw!yF8wT6H2{e~cE8X^5T?bFbC83!(TpXdNz*7q z<{|5XvIDtiUlpTHLiBV_bmFlhLf5ufIzKTwB}tuVOWMqGGIln?+pa^`wR!(RBOx~u zI@C1DVue%6bxXuFQbTB(iLI(p(}1TfrfrK!B217hjqhaApljt6<3^X)lAPxOOZ%r` zRg)$OKelKnS$e`&@XAnGK_QjW5M|UtR|a;FuWI2la4m*;Mv2x;mXVjJU$kd{qtFjC zVW^vl^0?_V@=`bEcFIen z_XVZ8S=72uP$8Y*;Xuqlmwcdo6S8Y;mi+@J1*9!o^%mLTHj?W(H<-&6NM>D`bQDD= zPzSC&@dBT5m&2&p&&|a9n%n6PwI(fVJ)778;Nze$bvV zL-$}9x;RTHZ|Bymgo*RIY|=4j z_Ryf>8e&8mc|O2X#Q~hrD>+iWxE~GCk+QWsDasAJq^9YRk?_x9><6-o04!`^9YWn> zSK-Nv@_P~T*WVdxBNL%{zty9_fh9>6{v*9a!?(bmiXuRje$Xrzub$dA%_frLa9~vM3hTQ)E|>Wy1Y}PD_Dnc zvG9<3#msA@$Sfv@+HQEige)r|)he30xAPSp4zNcL(JZz%FB8Sz&Vx1_E=eptONvl6=rv9@uN>sM8xW>b&R%{3h#B*96URJaf{dNk}Pg?By=2%T^5WPU@RWgw7@^x!(+c6VSG8-sd3U5D5}>$G*9c zC}(1sAWt-=T?=ADY7(a6&FlcQ$g32Zt`&k?_1xO%1*eMc>%xIdFCjt~;4f=V~C-y~L3(#^g`K|e2q01Pwlp$lrnEmJ(RWULwUR=C33dSJ; zT~#06of#f8*zl}JK2|d)1T^yfkS~E=n4vU$eMYX$SgczHvb-uCXSWO8<%SIvh1m)Y z?IAb5tS1ryW~Busm7a6z5b)%yCPnu`U1S?RW4}v!4ty7R#Oxh%kAD!PN>3U(k;5W< ziO|M@sHjt+^spg+IC>};1>6T6tDPx@N}sRXGu#_7H;&rr4xjZPA{kI%&#d~#q@xx5VP`z8N!KxNkjS2BZMp^&@_CRNo;R|@j%8! zBFF(~P618I#t?U6d~n_b%uNpS(Olz%d~g$F(lJ$;NANOoAd{lElQs!?Qln(dDX)@r zVw^yXlL_=a*N+{br$OcJ>BJ!FF2RB65i=B2xX38!xE2hcM&&S}d7=h3qri&=h8m)S z`Wlm^hoJhr@C*Z@=zqK)^aa(xFlt%j?NC|FEkR*1CS}T95!bCa%d?Sq`}w$!*Neaon=UPWH&u4rcC89?f76x{$zwlxD33Z-@`Ochn3$ zsc@*SzK4Htv^_i)CEx3v@oh&DL5rh?;9JNmL~wyW)x~TtURQ2J93Q-BO;} zPY~8Zee+4YgdCsfAw)xb;J@^A&Ujx9Y0*O7YPetQJ0YQiK+jn@=K8V{B!FA6#K9&4 zAn7+LX;`A%S0j~u`jeNn2~%`gS&EUPP6XG(3~tEMmooHuPCGiCwjj=mGRekb^|Ga; zDGc-K0Z{@Hp>12u3utlN>e)*~XcA%Can9yN38~4Gf$6jbAurX>(F6y(4pRbJ%Eq3v z0{3)Yq$lrNq?W$kboo_81Q&)@>9};>?p+J1zsMxk5Ju_?(5QtwBsX8N`m8CuLR`^E z{23Z1l@BiKYTjHJzCLFz_%3-NW-_A`!V5Nj!V4T|U7JzalxfDj@6j8rA*w1*)Q8U~ z>0>CoHS?apz~PW8W&EnEu8K+l=jRjzeL||+P#Wq`sh0a@vMl9UK+7$Nk{`Gzw3ksA z#*rh=bhESSV&`K@Bx!+jeR0oF**~A8vDz#0ULtLy8t@>$qr)z5;LXocO6b}alcuo^ z&7LfRJ@hjpHjk$|TEwy9bR6U;WP%gqcmfTF27T&xZ@^W*bglh%)mIr3LoWk3xNM4V zzU4uD`|KxhVC4ZE_UuZW_JuQW?0p*m05|{kN3HDSzy!;8F2{y%oQRYD@f4&k6?Hvv z!FGJ(d+xx6AHD?Z@7|!;0|0#d-+u(h-FG}*{h><=cy9WwkK&qNyUxmtUGI`Ii@9$2 z&FgXPufKQT{zq`_Z+Jc5x?md~d+lS`d&F)4z>!;z#K~Vh4M#nCRPo;S^S*_zzxNJY zbp0jRaPRTGdZ$aLc<}NE@Z`oPaNw~0Sh-^r&bakVtiOK)2!xOQyX!|`z4kY*a|5%| z6+?pj+Z&(618?1gy@&6`isx70Ri8Nr$2@qf35t*Z)<<#Ny~pFizq_b-?^C~f1K##; z-&HhFo&XygEUD#|Ke!QB{=z$}`&?O3p)Q@pSM}Wd+aJR6cMW3vqr;{p z2|j#;PS9cDAYF$J62>qMn-ZfTZ$^0>6J0Ivc+dF!OaIp=@y4Hihc=eq5P9Nzp*~@`&Tsmy@GiZ$p4g6Sx1zPZe)n_!DoF=c)+u=e_^;r*Yno zzfDK1Q1UhjP-9eRP`}5qXVy$aVWNP%$u1>N{~1#blKqndlPH;TO$6NkUq6Eje*A65 z2T5>E29IoZldvczATo7>ik`>iR~n5glTKrq9ROtgOWP$HNA4DY`;Cbpx?s>c7*=J*N`;o+eb`HtcvDjAMIO|hhca^XWD9=Pg0ytH;N&c5mVqP`s`KaG{ouEcXEKbt24 z71KR`{0{6}yBEuMt{8;pox#|@>EC}O{9d3V7?Mj|eU?u*U;ZGTIqhj&@QL%W^6Ays zw|XBQe$zwv#~;28*Zz7r>3H_!XRz|wRoHRzv)FJ?mC8VMt@=wuR+768p9Wldja=cbq_B2@N2R9iPd;v{Z8EZy?0>Q z&ShBr^cw5q^C#@UzQgxn*>lT>>7aMdy-|AI^ZvWA=JB;S{`M0AnfID5l>7_BF+a zzEzJ*HU~=4$|$&Q0;~l@H>H^R}aF7{}gsEH-}p zJfwqBQH<41c>*j7>C?Y|<3K;$urFw!HtIvwF_VQ#UE2c^-qnd*n2+I-pSntPE91`p z^6C6G5sG+SQ;HgM8pFF>(GDS?=PedKGDCvhIIoxXH~rVo;Orl}(pC)s*f|1SE2{vJ zo+LMVN@_T;*~f8mZ^nnx9|PfB^H8p{rFd7(jFfV^&pZjpjZ4#rsrb?)`S}NeV+kM5 zal66m+K4AH8~6Zq9h#KTqy`74Ef~ODGqJefh5jL#!8LHWy(hn0>BAxw@$p6(_+LCe;AAvEgXU4LvX6tx!91 z4Rm}E7vn{FtV}&oQMi*%z`YJl>OdrU`&Eksx$I6C7F4KCh^v_jL>WL669<@lhlV6& z&+{Z{s0jn?t8H;Ykm=Jm2p4JigTnCl7|@e?^&XMKBjc%EOeta7s!Yri00PDJ@M@r1Zlq4Ym zQ4+^Q87|n!-mDIJVv(8#=p;-^V6pJ8KwQ3x+aX1ub9crRtP){u7?jtx*F28ZPp-!4 zpFayr_AJ5NfjOM~l~Zx|s zFUH2tp4}_H=sm!r|KvN7FVqeA^K?{flQ}%j+H!U6Ly}`Kzbmu{S=$uiUsL?{q)(g-$%`*dAUiTPI|H4^VyH)VB^>Cc_g^ZuzP%sz^ zT!RYyN6$qKpJFOv3}O5-(~1X?8LearYP+rwj&%q{twbEHB;BWwnZhB8<56lMlr#lh zT^O)4%1(whBs4@SwEhNxPvkVL&S4{Mj6GK&i9PVq3KXV-d^^!p zrannR^NmgnnQh~t^_f{Vt~=3R-P_%hXL>R)Ibi?{5(!37%#xTX3L+(ulDw9+ zmKGu`*r`=jbq zxcBy8K+ErYuSiUH-&^6-sZ%FZojQe>(BK8t(r$xNDj=Urn&w)b#avhXa~#ASaj2L% z5_gim9f!j20WRZkAkHqt9R~@=K_ccNF1PU=hau*=h{s*TV&bL&pJI7C;w}OgqW^Kn zL4pAZ2E-Ug++~P6gj-nTtXV24Z(5Pl1Z830qA6Q!={!tc&So(n`c$h3(BvNVFPi{1 z|5@)1I#KO7b^&5onh6^Hv*#EO!a#YM<{dU*L0FgI8_X;dZabXc_!3zx3R$8ZCTWDY zjK@iV)@NnJaLI^5oaC9F8zM@O@GYmq{0vYRREardwi_Nwff9jx245Js3;_3KBrsag zpjoC-W!5d=VUllo@MTC{U&=B1Cn{r#Ug^9cgZ7~(tcd7cBKgYj7k{aKT97bz2sOH; z>!f*@Nf|K2Kg2V-%uGimlEW!!%fzc`P*7chUpR1Oq%#L{C)C)rP}7e=g?Kd;cpXKS z`a$!-*oBll$zcpk8UQiZ)w@KT?G*PUKqU8uzx~&EI|%?Qg9`&P+~p0F-&td2tL&*n&z3IhS<~JYy!kt?VpY)^B&HKqm6{3I+j-_L zk|1u)luQ^I69lOX$_eGDDFr3Dv-M3XPn?HGT9Xv9xl4~d;c~oj3~k%(@hk7HMDGnY zen`m*WU@EH~(@Q*8cPg^nUy_7LxPG9nD9>Yi+1{zg9B<4sf4i@87+Q zjlX{z`ajc&sr4gZK2ZHaD=JJ`CU9k96q*5)(P7ezOrP-)b_D$8hobK@8p5 zja1n@a>jE}|7x3rhgnDrxfe10bo=+W;nv^1H#D!``pa#&{rBzzV?eqnjh;JBVPy41 zEEX+*c@9eYlW5x2iprB!YP>J5J&!XVJBis9(@0Dw(EQdaH12IyAX6LLzV|fl_|toE z^xh*FZodF{!0H{V(X^{A%V^r^T*na7`DtA9!!0UW)Y=!AWhj1uh(f-FO6e*xr3j^cA<*J}E z06@YW>P`c2>0``=!O4AJ`S&v^D4DvGNN({J)CHqh6XvK@ zRG)jw0Cycn8FS$Jrg6s?mp=Ir+xs3xhSD9e79g!Pu|WJ{Wss>eR$=@K8ezIvgnTgb z{+m;<8r2@t{QpwTu;3RS_|5Fcm#ilU9}DjuSO!R-U^W>GTCoj+#6ne=XrXxTzErkd z`CCMMq4jCn%@gBC$|XQ6z;YE?Dv`Pm+~NhAKLBd+C1UK&-CVVkZJcSbu@V&0qQAsv zwZTS6kxW(%XB2^$^~p=g7}FPr5u8R5>XVkRkoYn8z75w%#v0qk=PtSMzQkM#)HN8jqz7#W>AN` zV;X5Dswu7#TXj)HKTjWX{>#1{Uu@kFih=I1^}h{!}Zwn@OxOZeJv__E8(Wy$b2JB z!@6I6l^AXuM#JGo)z);?G>S)x^`L!NCcKQUrb_0KJ7pVJxs!QFCFiYYu|*dRA2gxo zhBH|GN{52Yj55NqwZ}xi4t?eTO8d&N`CqQbtKWMbSN-sM3~cGe;m;hv6^~!7>rlm* zU5WgA;Gume>nq1Kk8Z(>-+mU?Jh}z_*Y)DSL;G;`&#p1*2`I3aVF1v_LP-iaQ@NH> zDDacg@Np`s>(^mDb*sb^KKlFjL#+-=USclY~3_Yeg05r3~Zcfwi+6D1Iy+v4gehfr4LYfyb9O;&5g*J z&p|pbjfv(F^xk|1l_#r-6e`sK03ZNKL_t&m03+=eaQHI^u;J;AC_hz&xr!MadU!ty z#tTt-x=OW9Z5;a4e$*bS!^Y<}!gGC`zP;1Hy~udaAAK?`rx|ee${{rFX$IpA6Ak0o z_xblw+FOD70L@cfcm0er*QU>PBi|*Cinm*u0MzITLw|{ zgY`%Z6k)Mp7U#Zv1hL5kiubGl;~Ya@J&3}Cm1z9VwQ#26@C(vNt(m~+-MuI}S^>r! zZ1~kX!8ym#e|{AkzkH|KanMVX;)4|YE5C9V!0cTPpK-lYAv6j>2XZno8M>2mu5K;m zvi}rW3xM{ImVeS2Umge)E=rD}v2jS<6bx`3I9x^AVB+3@(kBz{;jnB2?&6!YJqV?$y;z%JSJwVWt&y^3j_{WtYMJ^;(jCzm^GQt~hnjg?RWS|veuF9z0Wv=HO z-De>Fw>!)NII|buAe3-UaqfvX*?Ba}VoEvZa%G;{7GZoH5g@}?YumE8c9-Kks5zNu z8T3RI2E3zT<^b&$aEK^87H?2;P>hp4KPAV64(}R>AR~c;j5;}jOpF&{z;^XBU}CW6 zHHT=M>%~Q6yShCUb4s{&Il||xLskGsxP3XS18z*i*ftl((C>Sk76&!xg=i7-`mq00&1V zk%7AyQ-l8OxAcK$^ISl-1H+d(I{-j2BroQ{$=C<9-HZz_=7oy1>~6)5uf2)Z9qovv z#2B-H2ErH&Va2p!1cobrdbQmSchI=21&zB})H8b(HUO{u-2Ag^Ra*ey_zs%hYeCa{ zEq2~WuD!&VhqOi;KeW2)q#X-CAp^hyLNnG-STv)vlzY`v>rm2D3eGu-dy{B;YCZZs zb{Zwe%dIv5AbDT~l6z|ebKx8-e=K%(hCkMi+Q-+Rpr-_m!%*0rM8nV4V(9)esMuEn z&Vj*?pFztL9VqH80pmbPPZDiUuEUXEe?Nf#@L&W(Op4*v&uA5jp3l@wqvPp~$eGCj zV+@Je1gekLp!!&?Ds$$er_lcTYOFXSo|O!hV$HVo=)Lg_D$i6wHz6utajX_K@@!2E z9P6L6&lUwyZ9bo<9mndIIsgWA-gOMCUtI^zIL>bz%3g>hl-XB9m;|*W`ZjP=589tv zhmw9VrX{_lXn$%Qy6-%Nssp0010U-`+f(aM+F1$CIr1+SVAW&ml@dr4w*IfLQ!X>^ zf{WT0+Hl~z+a)Mc$l1%ppz{PK{7sK{Ag`wc96-)O9_pT4gU&zMrG(1J$NI4HCu@-3 zodoAV>`XDLf4m06Tf0!QX9axDu~0vQ>VN4#Y$_K3hclf((Y`8_9$cY$fT`Ch+zI*S zD0rp77ZP9W640ubQl@N$kuj2yOwB7gK&-+eGUFVKLW!@+s1-T++NU8jMw7y?GR6>( z2|s?ZBIm=E%>Nfx#npAjg%VMP1cL=1_=H%#MWq`eHl zbl6nS*9RWSQ#iPIVOgTVRo+X9JjF7jH0vb_huB2WT8MZYdL0;mY?FA2q!d-NezTgW z_LZ`3ByQwY{EUTp_>#b6`ECO&J}uWceNM%4Z86|vFqBO>-#C|wprc)Bm{QOKeTx7= zXS0=QK=XW#hzL52ixq!M?wTDZ14HjXF(9x}MWzZ=yVh8OZuu3kcB&facvTC_Y!J;23QgLCdaHV2q)>yAs_uoQY&biTMO-j@F^~ z>Ta~{Y`^S2{Gt-`8Cu_KMeBR5;10)F!zhk@^eARaX0hRAZRCu!jG*=1RRDnU?h2f_ z{8=rgbs3ItUaW zEeD6Mb{@b1?f{EbbI9*0Ruwacp{Os3RMniq-`vVs6!n)v`xuJ0A#oTb#+miaFk;l| zO<2M(0F7_AV9)QogW~=Yl$=c>cQhZR17%1KmO^$3(>0T*evG1jiF(WW%5ZG!K?Sp! zs!mlQm=p*hCBmkO#ezlT$X&3h+6k=q;dS5)IP&0ukggA|1(c=KnteCwCfqQHmFBsM zS(FTvnpi_|UlQ|GvkJPInrS4@l&bP}G!K!yyhZfia|UDUE@H7{0e;-m&B~5P@kVo- zm^zR@P%H$YB%1hC0-2&kg}243Ipp`2faWK29OQKuV{yftYP0m^M)ZCAJ>+y1Bd@O* zvEf|gcPCNUQw-*~hQJq}BBnoA@y|^p3#EWb0j>|b8-od(`ZT8tb=JUxxguy@a4Fn} zL}`~og8H7qiBPBj$CsfMUE#{(dA__GKwPNi(8?c^M-@o8%XS>Y5OJ9U?ufZ6i~$ee z@?f!4c;c=YdzU%LWEK%~TzN~XFf@D#uLl^H){*in@S(|;=}r^hUh9D)` z_+MT!m2s}CAWb)9U>J%d4>TDH+8+Tgd5+DsV<^Z8QAY+v!vEMlu530P{Yj?J;)LU-zKG%zB`UEjv-<4xZtzmY_Qlt5n+NI zrNBd>naOiHa{kigY9L>3F^3$kcNpl>MsY?!0?RaB6v-(AK)6@A#wt7|Un<=uiEFh< z%HV)5KuW%v8jPv7iPzEY1C6UkV@?J}P<9dA(imXUg)C<88b(B!$&zfbryDA`Scuu` zDI^C<&E{pt!UEm#T&z4?i}~U?oVvXeSN~)Sz!*}=Im{(zvEys6TlrJTIpj^`g&=9& z)rOs4-ht-bZPxRk5^y=}%$!7y=R{-xT+ddR75;pnthXH3{Ofht{+n+oLtwsS9&^cA zy!BglzvfD2kvEYK4vvE1BFt1xqjaz=qRHqU=ymAud&^%`7XSd{PURt0oI=4^fl?S! z#VO=kIHrm?T6VT!*H?C+X?Lr5#B_D00igV5!L57(9-Cc+6?1(+G+Q!P^`aH~ki=7M zX-1@(l3Bz&pqew4EATT~psGt1&xg*cgeHVkl!bRdKqwknLw)23hmkbonYoG*o6Hqk z$-V~)Ri?@^^N^9r6m?8t@t!MY?@L5d4C0{wbpVt48?%`%ckQ{>`g%KR_Sa*gX%zDn za~NwI!RfnCp#HrktbK948o#&x@D&6T?#C1RoDWcIpd<5u1x+&Hug%xg&XCX&0GUwz zp~`Tx3^NKU9;THn1-FUBD0XO|FwChU4|wZdS~j(DyX{}t0@04AXcGrgPN9>%8p*R=>3-T$zrbg^}iAtUO+eYkzi~dbanodqlsa+fz;F zN(^l3k2D0b!n;IYtTD6YDa!iGFw!(E6kUR`Wfnnnr*s&+N*Xo-tYb9UNcEZZ{of#%e2$1EsxX7;PR#!AOC6Khipk(!O#_ z7TN0{mQ+&BC^2LL5=fJc6DU7fslb|Qm_YvdLaQF-3r(w+O!x(oQj~KcA9GEUh@YrX zLSVLO61f-iRVNG26=9}v5~U~0)gj60rb+SEG54tvM3}W|6Q7GCU9^a}JgCnAOw~@Q@{X**{T`r{@M<7$iM={LrGlqlWUQf&9Td78Q!3K5Xqkwmop#~JJveDcQ82Oh{E-4o)=#4RbOmVX zc)D>CdBX*&4~1uoG0`@Tilfz1hMJ9wc{SBOhRxr+74BRNBqS%>N236Qv*?1yeXxv( zL+!dQT-QaTyJArzXSe{VmMIh+uTWtwQ!P`-xsVUn6*2pL?jvU;7m1OT zA~J^KAYD6;li%2dh9^6e&d3-vd7*lna2O$O7`^fknz!+S|h0nyAYdVt=I|)qHrlKGD+z53l=ciJ@n83H^ z33{*$AyO}-!W45HVRS$WXGa_a z(nx}&q&`RyvldRwda}+J1eAC=U?GJ$0E4N~M%EkHwG8Mn%THR*iA(_=o?VS#SwRiw zw;7uiWJA94q*sT-DWDUDeuf-V;g2T#^@S@Lq0E(vp?O$XL=X!ANOD+#P6IAz#^H`s zknPg|q`cen$y7r1&O&gULpmXten@js&UISBR~HP*-HuGg2OK6>?8zXIhDpExpc~go ze+bGAlF34i_n{Y)1UwYg$RuHF!AW(DR@X(lrjl*$j*6`Ij;5YIQfZesv8HE$Z*k70 zo1z#WI#WdS6Xn9j9I^PL&NOK&$_^i%jmX6co9;~3#DM1Atr%{*fHSwA#6rOWyts#p zt1e{8uj_I>2P==)U}&RIq9Sk!S4DRvMq6YU(TJJb_I5kEZ#a`3zGWoF!o&&y zH79CuBax{47U9@)1_=VoHkew zDb3lGyKI6+d^GNEM%V2pG2So+-}N!xIEJoUPoi;miR)d~*Vbd0ZJdOk@G#jlj#FEYsjd?vB<8Hfk#Rk)4nx_QN}Rg?7}6yR@DmwK zw2a}z*27j8_kMLJhOQn&s&pQ3ITngi7`kErMdylDzuVqejROyVfXVuCc!>dufrSzZd`oyNbUzYL@8V!o|;xdSKfIEvBM;ZT0X`%HWoL_|Wl@LVy5HV=rX zVK9Uw80vR6qRC%gG_!J<5!+X-$TaUEXXqBrpOnv2gK7z1)y(S=)_-SMyP;>=G>8s&~nDgU#{4Pp;>Jtd96cuo?YT z(1gpNX#iY?1P<<^8af<2ZKi#9bMpSnwjsBl@Tel2H8)pj@FKai~DGc&i#NNS?r` z-=M?7+@P8WiZ;0>A(IEP%QEg_3|s!`W}LX|2;Tag*8$f@!NnqM{`obyRH{4Fh-3F1 zMC-10j5d#8l@ZpGLmU|Hy6Kcv#`NGV7%fEc`4Y@jOa}q8`*T@Il+k zTSVHK%tQU52CRBV`pPrlhDUEi_w{G6^FQtYcRBJV@=<@J9<9c?g^}hFwC}Wc4Jvvn zaOOtcFL%+!O+UN^NAEn0*T42Exa*_vVll3M;##ZRzv-~BL`U*$DK@;a0SC73$6VPg z@<$7>@uf{DIad z5HHFFW(l>)fReMNSi5aK4u5(-=H-QI>$YvOE)&zuk)o)XjM)dJ0A$$>0D#6fTXFmg z2SljJu{_kj-iq?0)$pMGnyD<4(MQO|0vv$DP_}0!{L)4A{MtdJlM6^pPtwjRa1Uw;dJ+(*$+ zG1k7Y0egRar|M$+%WKhhLoYh-JqDiekTaEosuL@)`O)iCU6ox`aNwZxu49<2od6h6 z+Fyp&;8_$SnX4_!OG0&M*w=`|Tlb^>y+)Mum*Vz6y$b-a$+$UN(M2$diqRg?R>!j& zaOATGaD3}wfazO?IR|PE)FNH7fWyDE4+|wJ!8dj_p?ZI<8ng0a)!+_C&%GxxS2K;+ zR00hzt+Lu^fAk9UJa_{8zqJG0^-(ZbgtkXF;n>&TvuKM0X#Ck)^!&wm0tk_=%uXGVzUp^q|ClA$cHK6i?8u$*tI77|Tt1*0AAI^Q| zBzVF{d?JD5k!rO4{bm_6TjRX`$u;QzOeea(bQqj*-0-z~0N32sXKLrcoX29NOv@ub zFqh5cX$Me|d_;F-h)*M{xutJ?N*=@@Ty?;i^7Cab131MuCEsl(4H(*ubESeH6dnf@ zLR7;?MvAEbDON)U59ok09WoYM`ATq;fTus)xadgo8#3-F5|MeKlPF^{A_BtTRUthf zm=qVvk|kJoplG%#qpAo#k0?(Hk?6)!a7CqP8O4HcSm5*WstaggToYYH1w`-M=K$T> z3qcc%E|%h48-ng688abTOR`pQ0nq zq_VB=YcVh5BGQ>Y*7%Y9*o98 z(;0)tJypOZ!)3qnrLTl2a@+TwR)>6zp$=w?NRkXLm6bA>8l3Umphx5Pr4-9c!?&Cs zT$WyOITbHANmMVn^8y;sOXsnMZW+3{RX&j4TDRxnJT|{GCtmhCFO@7ep^#u;W|ZAX z{W{bKEypb*ArdahfP(O7e@Pvsgd6pQS2r|6)^avHc5nWV7jXO6?*%Cw#zK+0I83a3 z`0#w%+S4u`g1L}yHj|e`N#Wp#$RnkGb+$bUeQSMdwN^_dTo3r4lzO#HORD@@iE~ zjU87jQUD-5LxcioYKxQ%cB!IH7}wcbQ(iuDT}>N~>U@qn?VtLf;c705g`Wk7?>+#wriwxNkTAi z08?-%3Y1&#KDfMj*q#R@h$)&0$!^b=%8eW&^`1HKe0?DxaRgH8JnloBh18KtJQ>H_ z=TOEHXHbfMM!F&SoOU3^Jp>tJTon_MK!#j=IRXb22{LAT^<j!@ zVI3n{Avd&7Ei3~t@^INurO|xd{vND2n;>O2u%@=HvIILGBxJiEj0v}(m?K>3xQtXq zm)wcx_lCK8u5Epte74B8Ja!Ge3U)?dH&su2rdt1xU(a*S?`&uRvZs=SUjRQa- zLN%q*uIumqdH>>^$e#SMCfQwz>Y|5Pd&Yl?2GIz2Qq8jm*gsu zkX`-?;xbd1hlStc5_u>oK4%kl@b{&RfJ?R!K>t#PMOLP2yoaV~tJYxYCDG4qW-PvB zM;;46#Uf#dXvVq-Bui#)kAZ&7?N6=`C~6~shxAINcTrCQ#;?&VHEumozLa$JI0Lw& z{ru=+5P*E0bqs2u;MoVG)qIe@ILt$31eTFGayFXm)BH=Bm^JMq$KDJ(7aD8x@Oea8 z)l8T#*)$NQ;EhjTiQXH!aPZ*|FjqQ=OwI|-PQdF02;;J}9` z3?_?8k0LGkc%1`W}>&iT!c}Xco!D5A38-SLPbwqsX&%d4S0*NmL+hu|rWiW&j zGp230ycNC6{4Np7n4v_H!l-19_Lo-WgMuA`DRDy?(8ET*4CMf%Xi4D|0FBY#tOKJv zk$vn~mZ@x(HHd48WHRaH#QJ7FL(@BLXnLm&2ry*3j_7txrmY~(HijT!r^ioyT4Nn3 zVO5$14)Zn90~54B<469cLOCZjk#+_cf}Pij8Yu-neCV5f^(vp%+LYoiG#2q&@dUkf zuBkM@Zy@veCJZKGj8%7PlS8>R30&}SIf)lCazgzy`Y(hn87z)6npEgO0CdTZpc%ay z&t&^8(<1@^03ZNKL_t(O_oY5SD|V((g}gD8Nuf=Ou-JL=IphkW9uHpvs_!(AhJmB; z;K@$<5W9og)xzMTCM|`g2a9@`Jq4BWP@TFyi#~}xF--%EF*$}Ny)&B~Wm6AW_)(}U zOR|kf;3F!{l7$q$058yOX5()Lpdq7z9AdOX(Tc0yIWTQ8pX;SDaUrmttDIAL=~k!ew`syWGXMad z=K*k3C{T?<7U18;LW%k-{)EHnLOmdvLUW18)RBCVF=K&N={(TdVgPTJPUZVL0+8yV zS)VkOWW7-fLRxM~o^Be9YBxg{P%@Iy&V(Ldb)neOD{k4}EjvZ*0A$S?@hvPitjaz# zSXQm!d1-So+T48~hk%HM*O(}s-?mam1&G1d7m)wX1tid@!!YQnjF|OU#7^4-fFmbEJ9(qf(WGU=oWsf2S za;9NdVfq-=#Q`R6;#E>pfh96BLm?EfQf~r+izKPU5xGH$JOYo_9Y(4n+$c(y`p6c1 z+bxI;7MdqwCymbCXk~$7{Zld=e*hWwP$)yj_;G;rwv3m7&jF8X<%tet8Z`loA>(`U zjDgryOp_ag#1-R^mkfyrL!3h`S$eV_y$YF)&j!9kG0RIbQH5}so#qeMuONZuW`0)O8sO^t`r+VI2kPyNdrUDh7mni6FSJn(3Czh3%4@sj+r-s%a(k3_DH$35Y5U} zdYkOzITkK@;xo}_Gml=75Hvyx)=~qW}xVe)Nl+m^}1nBYCZm?VdKr&3QG^YBdO9BRJb>aZ~(tiw} z5%_maO9<@no67-h=?T8v>HiBcda^OD4_Wtz-33qiWAE?E$EMS^e z>+%y@vQEkpal3;BQ_vRCiaXc8%`BDs;Yto`aKnn#e` znB%A->cG}J^iE53S#U#HBVp-l>`<#gw-s}$lP;-*B+~+xRxmlZP#h#a30I~b>T}t4 zaK5Oz3`K-%mmPXe%7GskF#X)_n@WbV6&&x3Pl^-3;lKxwTFk)rrMVvc(j!LVFb z9hv}2or#u#EbwW<5(Evwyuk-NkT+tkMltoslyaowA&Zm zGz>2Mx#RMXuyAwJJX?hr1wckIy>lJymrnqb^5{sPe40aM(mzQtHFz>r$pBL3X(xi@ z6U}D@3x(SCqw%hM@0mP*LnI}in?C&_EU!F62jQkiiz|R$7*pYe2?LURNU+BC^6XpGpdOaWa4 zw!Dqu7oC>Y1|!%|wi%L5NJViNJIB9&%ECbZzn-!&q)Q|Ynjj{XF3*4a!zDv`Gni0R zJBE%Fow6uvOJ!M}t53GZ7|7c>SP%WSwm9YN=Yd&4)hXqNI2uSGsH;IDdZ5eEflG%D zYC7iXCpF2eueK4uqOuw7M30Lqvs_^sC}nerU*tTq>k&Ll|iR$4vnPZq>>|?V9ZaX8ZKiT4<#2QNs|ZH@HZs_^kwlN#9-*I2XntLIlQ} zLxsN!9zs`&KFwbX&xR1UlmLAmhbpoBnh7jJ)==e)iG%W{Z71>u&}sf8BUwF>Y5`+n z*M*DA!F-7G6TXn}5bg>BS`M)Q)j%r0QV+EgAsY3i5l4|pe96c>>FCQ`M=16X7n2Dm zh`@d#7lY<`;RC?J2Rg{;424zUIjZx9k{zNw(x9?T7*nG$;i0C(3P32YCfevGvL~Zr zq5($AseDH(Kf$)L)n{%yQQvH9R)1G{Sg4w;;4&zmZKaqpsK`KoaXFxBo*CbD^W-xh za~*>RFg5qp;ZlS7Gs2bR^|VTF3s#LwZj>P-9w3t8iW@LaushlFwh*> zl_1wyOF`xUm-h?^*E~^?;w1_J49qxhz-3|Trrd&%K6sk%C=zC5SdcpnO(QM8_0Ejs z5wv^2)gV}7$2e7O>;zbRj508L@r5z9vm)x_`mndeC0!h5C$ZC`b~6mdN{fWq7F0ic z(#u`;$jKJDkte&trG=puikc-;o~Uw5zyEM4%=fY|(50Hb9HypdEV|H#S5yr+LV_7=<9J2d6YG~e)UYVnlmTq8JjT>vNfS=R5>$KkxLAL=h*wT73LN5~ zaK;mEI-ci?-(18rPkWw>aze4dg#qt#4qqM~HkR_#_q69B?R&`3P6($R0;*d?22yng zdPHY|Lbwb(4!@KcBBzh0ndmvdbzdwxu$+dJE?_swbh{>e4B=;4nXo;#C}$L(k1iL{ zpot1qy&-6VLg$i+NBj)%QhH|Kh(kuPVdfJ^TGG2+n)V$yjtj?e)ZH46x}yR{#2^^+ zlg|2(8;`Efk%y5Ta24vX`@apoJc|>K1!gF%dc7-H0Yc` zjuXTU=W5zWzGvPSVY@R0u*zrwNApR0jxxlwb)eG=-+dbQee+WqTEg}+2|kmT!O7c> z<6OsCEEX-GXru^jJ62=mkvdgBrPyK&`Q!PhKiG(-cU$22bW}#9!A*lW@X-6%{KPe= zJydVC^Za+7M(vS$Z2s4)Ed)IOou_gCH@C_>Pi2Mk6VylOE=DCSHW&ss^<&?I@8hZ` zuSHz|o@c-P6dw2!!W$wb?6co`3J?5OyWPu849vPiAeN4yV5|_0dz;a+uSJdTv)|Hv z7kDl}!=Xkr8+azTgUQ6rYrpq0w*2r$6prcJhiA)Yu=`hb;-mllPW5ct_nt;Di7>QG zy|=^C1{24&?>&?C?R|f&%VzS@IC>@Vy;}=#nAfV8dMxzA?*T=H~(@Qst(j( z?W0#{MFR|P|J94Q`M2-Rf(`m(3-jh@*CJEAh~D2kjMhK98b~`9nGtiRIMc4dYzxg+_gf3_WEN9@Z970r?psuXs? z8*KsLt-pK$xBuRK(TtDVxy|bon8cByBL;yxQ)vq1w<@;i+2F2BpJ{pbuV2EJuiYbs z9y1Us${52U1#D0WWU5YbK{8Qbu8GoRJ+vZcLo54f$yMR9knzbN5N=$a=ZV#SILLUu z8i$c5-a_T4Zv$f#*@GzsMIo1qwlbbx<@6y1Hy3o0c1$ z#{=&I^{~(rtrSHT6a{i$dKamCZn(6D8b~=m+l$3t-wZwx54~fhX(aw`KNcPlcLC*Y z+ZD=_y8lL9*Yo;)#>nFVh;6+I0K?={Z=+=E&9+kRI5_vyw@~x&ZEB^M6m+^#TuU(V z-3NdI4`UB>VeZ;t_$6t?&*r1}nFi#)R}IF1{>R=@FgPg}vEf`4yuAWNFV_p8n7%Q5 z{-%o<`|5F&{cQ*G-l2~D3TaD7cT4SOdXMegKwGZD4#ux@4*KGw;&1Y}X ztKJ6viFqP!MhBlLIOlVb`{O3W_LeE#eD>*`dW;raIOlT_dub(d zUaL`cPaAoHsc@?vv&kpl3B51*)Q##q2LLQyJA#=Cn-ni}z^ro~<^rbPjS#)O_^)rH>NB?}+^9=IL9Cx6 z7Ed6H|u*s|tBP|zEG+cy{mSMvX&@hbFk6^BB4*6sGL14fbwIi7MbKiL?r2H>8 z5yFO>FQRC;7$eOWLx#XFBq`mJsn2XX0CaI!CZ54~-53tte-J$8qxHQum4}QDFYaNg zdJ4zxIE=aEEH)T;e&A0&1;6C9sxW8n zOwjw&x1YdB`!Lo&w-E*Bi!fg@kM7$~;r(BIR~>|n++k34iPgI4+DV+a{|Gidb~TCy zN-$MFiNl}!0GmehP=RnJ&8*%bCKET<}ccS)R zIuz44fp*lzPI3i7uGT0S8Cdn8NA%7zf?)j!DgKcuN(T-qq}&`~OZBw!n|B37rR78l zGWiDgfsIdW#s|N=8^=F+1RI{b($Fu263uPm34K5Ox&27?l%al4gLvio7`VO<6HVh- z|D!7vo~;F^z)Cy^aN~cvTP?P}``0gF%UAEx86?Y{ZJ0vOgD24bFIOP1w+OS1Q#kXb zL&zD+L*bC7v0!4%Hs9#4t>oLQM;36#V{X0H;b@hT7*Li~Jw`b*0v)Z@1&Tsb108y{ zpR4jp=$Rmg=|d^`vLWG?CFdCDcGMAOK*TiP;at??Nd-OQ`S5*)j4%A5#jU3D%mb&J zzkw{|3OOy|=Xgkcp$F+3FM!7YcUL*^k8QxBpm~pTWjt6Nmnn7MO$vLtFYL6j!~*j| zA=(DYQo6GohRrs+xcQO+sk=X-=r(uTu0T^!48Z`)s3)>L%NhyR8CK|nbd~ecyGY%= zC87h+j4#+QM;3RcaN_;>U@Par$77*^XEpQS1NrKC>b{Qv0CHd0rM{bnP3pcIz#N7c z7~JP}!g=6EIDoYp4amD-pwD}$3$>tE!bSI_ODJi7iZ&To%*W9GbpZMM%Tf2uYv3;c zGq+s8=vO;YuxEwpeB(E4r7m;hF7(K(tlZH;WD*u4Dq1?EOd+uLqOt< zdbijp`60*9Pq(Ayv$rD1wUj#yxV-p`=CiEG_u;inWA<0h zpz!-^;dT|mYn#E$@18*Z@H(KUKn?4{^Z*zeemW0y>Mh&W-#@|GbsL_YZ2=zM7nJT)4y{Z z&cz(W`U=&&POqMXw_*YAgIU&BZeAggz3yk(C zg8u;YUek@_*(6rIwFZfq1Y!$uH1BT1#%DH1YJ;(~i_*bTT=m4Y7~C|dJ0{a;(+JwP zufb^3NF-P-ds@-;k<;>*8sFtbx&j-SK|5VC$Gc6#(~iLYyt}a%6lp?+A?hB#z@mJ%6lq9irJ<0v86i0BR+Ng z)KuTKJ%Yw|tVLorN77g;Ha>HusGZrhn7@=F#(~}~J-FiWt5MXSgtOqF;9>zb{Paq+ zzii+9oV6#ifxhdz(eh?HlD(yHJqO92QZ&E03WGQHSa8(6(}aQBx}Xn667w=ImQw6Z zwLx3Ih8hcaK>J@`h5AQ3q%tJlx($;N>H;ZH84G;Z1F}Sl21q@X z^(-$a05`0MCFaP_tGO)w%%)lZS_vJ<1*@Hp&QhBahCn2s0lsQjkfv*>Sn&_K zfIu6=oWu7$16*d%ia1c~`Mx}W%T-sWK01Wlz9N)8+X8ng0XG##@hf#G|EJXm%3#iY zu#|(unIcsF{W{Fta6#?3k;~BH+6fdr)qsVLiOB92yj+Xf`v*WeyS4T}ZZe@U6Jw>` zb2?uTq&ZFask_f1_sK@Mokd`22eA{y$bGT_i+7)u_!0T&;4WKm5Id4Y?*D2>`p)x` zq=lQ6x%tF|I0VgZ1{OHKBjGUn#~4y~okhWu4TzsC2Fo}|be16R$p)nEJ_~XW0)YIN zYBB$b0b=HAKG=NEln;b68<(2r5L)z^!5}e*4+{rYhm9;i4oB`eg!$w=@+R`K7x*wqjhl|*v)pJY#pg>fpPaKMQE*3r z`PtNy?5U!+0-d)Xx1NnQk6_K~9ipx!s?_9U3*gI5CJN53A4JE?8&u__G}i5J2sdTH zpl1o^9NdARy8z9%Y+oG-gK{r0+5~5qXc|Y$TdSxoCd36;1E9 zT74bZ+>h>CPhl=Ohuq0rv~6Fb;SG#~o@4ePZTsFcSb3xt!>fkT@@^}}8^$nRH;#4N zHlTiggCenk&Hd;y+FG?eY_ttr)sNG+b|RHbA%8p{Ej!v#zpuf9t7*$cI z8<95@>vp+f+`1}Fe<7pBAc&ck3DmwS@h-=%+}cNvMWQz2X=ga8$R+Uci{BaV;Ea=5%7WL*V<9{ zj&M;NxU~y|H}+yNnL=VB7juN}nT9cPd#n@7%gF6v%s(=RPt=*HC) zU;yI`@BQsdxaK$RlJup^z5n+w+B63E9EDFc zBX?V^jQK8Oxd#VRnx>1_UxZ)eA@4hD;CoWp`#){)zHtQZPZ||{nMzxB0j2w#Eq`q5 z5ZwFDf>kVlkL196t_GQBYfN?mcgrZ;hX>#^&Vi4|k$Jok-m6sx?0|FqC}N);gtKY} ze9ncxrwo~YYzCiMPV5m5TB&i?Pa*b8y>QxQ!50|(!==dlpcQ;V*CSv)XT$tVje5^Y z(ujSbAI?=1V97snhb{4!|iwoc1gW@NfEjKDoj4h;6X!z|Hv}>#NJleSf0B_9{@}6ptiv=P>{Adyj z_YQ#paHVgJxcrxN0|wTY4_>*TjVOo^rNmc!f=|wEwNS>j;ReZv=$xSIFl5$Dqu?2m zLt^(P=U6FH_nw7$jwyZhX~r2pI*$zO!+iA?>vUu!}Zp?(WViU_f~*$hKk-w zj5H3TZlb}eA-3qEVP6xvx12`D>+3_E|1e5twlvZ_g0da~Pq~Drexl*h1wUjmje+GH z5T05&iM)yERR=HTW2S5xC+<9ox+C>g-N4c$kUv%c#u;YIXHYO&h}rTPFrT4dqF`BY z*=afBVdn|TzL{!+#;h_nEVg0C^lPb*)*h_I{$JXQw%6NH+FcHJF&6D60f~Rj?+oP) zNR_0Jn9QZB0RTA@xmZZ1ESTIy7c1Utz|bwdXnbz921nMVV*~5wm%^^&2z8H)07_@? z?n3*IHlc8+81uC=IQjX5$eGDOd1obP#h?0j?9&Ia@?b62KeG{joa4+#J4GE=4x#_r zUTpg5)hNDDjOmqAIP}myBxZ6@b6B|fU08D--M5^=rYEjK;khDAt(?N)hxSFndMSIh zZeIiHKWM_*G){lvP!Jmy zc-;DB>IFKas#X%9Zb&`-tNT!LxDu=W?0Up!6G-PRV!CY{!*})||6m!I!!Wac1Os0> zinc0IbkM z?2A2!eWeTOKVNOYd>-k)SPj1?A5QZe;$J^0VBR6zQsaNr34d=H7Qem`d@2T3n1Qoy z60rw|uqX|I)ZHHez=iMs-8X2Q1?Rr}n!4u(TyA1u@CWkY-f;oo9M0-#@R=B#)l+@JJ%cEGyjh`wYIh``*EcR}fJ|hrF+^oe+ zQTtN>GKmagi!lZC3&vsH`waj5=fCq5n9sl+(SH4bMy%hq3FfRAX&y#-ubA-Vy%iW~ z8AjcqpyJKY`d%BhfAtNldS^A_3vmU{a!r8cEVy$Hj5ZCULc&wgTY-`0Vbq7<%!n*) z001BWNklJU1L@#D*8I&;%5) z=jeNoEGqgcFw!)Fg3&^ZG>@R7w?Zqb%&sdsnUhGuAIdLYL>)Q?^cjRqA_I59Rdty8 z%>%{R>bd(59{^*(+UGZ*Z%YqO-*FPNE2fb@Qh>U>4QP0`8I0>g>$JFHTiL`oIQ+N= zC*v9`0t`;Zg&+6i>Vz~J0MzVg#Qs0niQ3m%;LgX?bHlcfi4GG+Y=JT;>)!X7h@mXs z#pKPBEk9q2lAa_O1B&}f(Du|i^nLs^%1>5Eg~?G3Rv)dw$^&%(V~C}Iby--u+t5V~dkWmxz8ChYy9UWE&;8DvWp zy_NcVxA;DvoL6<6zUd^^zp%+_YyAtGu;-WGwUphC=Qg0UPvlAVC(-f3Mx4H_6IGqn zOSG;HJNuJc3YAIYn|^YY-9O(!{mv%Tz0;(|&MczNf+(h~IXvgq@P?4($9=H07CsCB z%edmXCDeSSOu$$PV(P7rDU_cSh5%h!1^|_Z zSE5QP_5jDKC)R^Aj)9wd(Ejv#l=PK>bD+4l6s=FLL+{JEJL3|gL8hr*r` z06iT4l=FNi2tw!oCBF(>W2HH7Qpd=8!rN2Dq2W}X_f!arFoik>J&`UfqDeW70%0svwU4Iupwt?>6J0S5Skx$yt0 z&9XNDj>SLPpdRoA2k9TxBlppLNSg|-VrGU{fmIKX`MXy5CyT_Rl#9$iw;=Ji`xQfU zKXDf6zi)+qq7VRsf1(KKAG9L&`F?oYg&cNT=8*oIHt_Mdm{Sumc<)xgd$$5%V;_O< z0ff=(rQ8UDO1$hLX8;EB;K&^TXUz<}msY^JQn<%BHFL-WU4v}w?oK6ktelw0=dVNaF`gl(Z+;34;pjc|+;cr#=s1VN4;(=A?iQ4sD^+<$TSm~bOKcODcU7Q!%b7^f z;&Tbq9IZp&)!k^@wc3L3!=@Ut?vqWD!MDsl?5JA!7l)aY)RHjQGsIV81lyo z(7LA$&3kP_Kphr#eOy?376(6Z04?veqU2oi5{kQ>%DO8s+B%HJeT^7t8b)Qe8LfmA zn`M9=i4(h^j_RY-aQzbzH1@|^Lk59e57Yvw>3a{((73Z1jXRscU5<&yah$yK80Jdn zu=a%w7G#zY5a_3qcHzf7IE(V46mWPk4^CRF;P?hZi_OMSabP9R-_Vbm*INQr23(IM zjOI43vA`f!2gJ=p@Hv<9p+ybFeWhyUfia-CKZ&`OGy0jq2+KPwRjcMo$87m5l7nUP zx5$wkD8+2WtSUQQHG||(nT3z!V5#++_;`>$tlb&_ZpJlmDsbt=J@ss+dPc&dg?n;9 zv}LZimkw%pIA=%>lw!JS2H|7_6sBLI6(0HCR60NQpYK<5fCu0axs1(mZqyl3ueDl3 zt7vHlNB}IYedN8k2Pf^Q1u_Rr3w>D+85O!po3XLLLIbs3GGLEsNq;G3S58L)THaY5 zSaA|R<|}4VJdm^yR@9foeATSN!Q9Fj6!s;JzA_Z{CKb*Ej7dEH465>pM+DEZ%42p0nx4Jh|i2^PM1LdHZF zVLWLp;|I!QI|2}MzAIyeEIsHu7dSY0aT;tq2XGj8+YFp0^Wdk7G@cp2PZojI%&THf%PjcO;;`H@ZOFn5VxJ#?bL|*d*&>ke zLwN!=r_!y1(~EZ%T7~#{46G!r%dVVQ<&#LiGJ|+;k*arL{WywVtcMSdoMR=Jxu;*_ zPc1fZuxS^$yQ?t!u^|*c->CY)n7EmkB4=q-NoY-(VbYnw>wKAyr5zx_;iU8^BH@Fj z9b?xN7=1!S-eL)$IqeYd9m2+7&{@133nszb9t6Xl80mBg&X+;Mu5~OND3{_ z5HOd?A~ZRZ-13JDF;g{d31g!os|*0Ro{O3zb(k-i!>QXlam`P}ss8!o9Oja<*zvVD ztQzK%bJ8#0hNEp)8{YZy4m9s>3pSNCEo&!0{!Nw6V=g(1w|>ipXD&I1{4DM`Sz*v~ zb6H6-p+Fgm8WhSKkzCI~&Cxo{70;pb_7k}7CtD)(Q3~z~RP~$+$_g5rF_gd{C}us(P`U!r%KYguly;ZlipQ?OyT83%83Nh5V=9Na zQ@KbLr;s;NpvG#UIE9??9H`|$1J2qvnsE4ccVp%DM%8g8a|8PDh1ET!%0y!HC1MmfsH?7MMx>VGJ9e&7wO~zVj~4gA552~kQmRE zLXhdhxdEjx6m?3yWr5%J_aF}lg^!dkbEXq|)Izw|f{PngPY8F$4vA?biN10rOvO(} zMC%AGJ}^0KLW%R`%BANCWwrYGR+Q|n!EEa|7OLhjyLJp09z2cG?G0G*_$md{iNDw$ z!WFnUSnQGBD;s8G2?RkPf#`EU+#W66e3+(Qx(U^DeL#kCb{(w@a9?ln>mfA`(FdJ? zX>JpF$;emc82&%py?L~q$5ki#+x6Y6S+ZnHwq;A!V0lbu4jl-YJY*mq;)DbOG$FuB z4BczdFF+VO^n1{}2LT%Lc&yb-uOT$7^y5JiJ3wL*I|+eKh@Ci2EDw?`&$cXCSEDuD zd%pets6ADEbXm; z#lVRKEE!?RUwmoIl&zGHP(9Cu-*tZmNNr6RVD8U0V)WT{NG~`DI`25TmmENP&%>De zt8+2;`p14t9>Y@~`o{u4qjks8?eYDaN((D) z-hjRT>1$Z^X%7i!L$Ax7nh#k&B%gcJ)jOZ(Teoi!c+GKiyMw-XR^GD^@622G&ey?C z4@-HaT*rjq4h6-D-bGU1+^b^%h?357bgSHP(Cu4{(V53E_0&?M!qJ(>k)Byx@NM1N zvFei>vFDe*nvZBzJg6QZhF&}vMK^7mfFRd>BF=KCQ%S><4S@x?c;nn=0PDA}$Kx+~ z6l)$k)1I|OdnueY|Bnl?--|_~is=q*BZ=heFjVSF1P3V zwmpM09#U_*cbFMiw0|*H-?tV|zw(I|#E66KX9eqt0pU_UeM6|O3I+~t-fy0MBH-Yr z16cml3iDE^f}yRc;un>}<J zqwz*StMBc!a`(yt9wKVCHM4Oa*6ldQnBe~NXRvbj%Cc@7(h~a|=%uLy#7AKaRL31$ zB*s;lx=jk+DtpGo*Z_o;53I()i}qpJ-sON82?s9Thcg~J(}liO8Tx5o%Z^a-Ziw{* zoAy~45C9z9ID_T8-8(yQI1oxh2f)(3%W-hy4A$J|=VTw+bO1}AUTzRAe{uy5Z#sb0 z_pSv*VLrThe+y*MVapH$4NvTjOk;NC2}~baWaXaSbkJZWxgm7Xo~4-Hv&6>h__;^$ z;D7uQ&i&}cAOe;?yb9<4&Wl0&rvc=Z1V%n4l!?F^u^l!6Gc&rbgUU2p6_UBCFfz+U zVuCQ5nMS|%IB<9h*tr7ztM=GAesN5rw=nWM4>gnL$8*>NP9)1~B%s|C;m6 zbje}x6Moo5ziT<@UmXO0`K%#BS6E(j5XXMt<-ieF9ny;rlzEkX9Zz}1;6zuxk34x8 zbLob{lS`2OTW1W&%XAlfOcIq z8%};gaFPXsHplnt(CB4oghltAfw_Nm08_hNS2^**{g}RQl?)bJyI`P8T{hf_isLlx z*lmF+U#do+lrS2N3}+0+RPvBwU8R92?~CqVh1tswVEU3=wA>vF78*jb zoJpQn84QFW5R~x%4}Rx%9NaR4(V{sVx?n$c-f%ZAxa~rbU!?#eo7+?Xu=#&%#rA9O z!v2l>FzDl0psk<32zOt57Y=OPm-nh%un*g>y({#<=jr@LK%4|a zTHf}Bi*ffgcVYjA8O%-3Vc*7QaJRMP>F#Uq!ajlLz{VMDzxErr@beeD*O|wSZ3&6y z`t+~fgj+szv(v3=b#PiPkF^W)QrqF6JgZ`;-%WE=tjRyp@4))My8w^AX(tYDnE_8R z4sG3!N8hj$=l|X2d|yOI;ik~=rz1gRe;zi_!h25l-*7h$Y*PA}!TmSfjZL?1EBg@= zg*G&8_`+t~f5SI%;DY^_n;zlNrWri=op)oy7qWszAe{fV7h>1jx8u+S`}3VLTlVAO zcivM}Y>H0o5X()yavb8yd(XmS@3;rEXJmeGc-ssf{hsZTHRs#;GhfEcw?B^AvyOrj zV{X-P?Els$vEgRN#_pfL1A0bx?0rhf&T>~g z_Pzg&xW|ZlyZM(vri0LZXJGV_8O-%P(w|(2xqtH@`WNjB_yo8Q;ezZu%(z9scfV^n zx~p~r9S3DHe~xZG57Re3fON@W(2^0-rH3$m;{zDobe=&r_vafi{k{i~UOEFT8G+6_ zis^s*fRhFR{R7J|^|mL06(eB99J+6R2Gj4`HJ}F&2|Q0{cp79@9%DG9snJdA1?EG* z;vVU;LzupC7e+U&w=#=<<1VDDp9ao84(=GV<^;Mc_Mm@oxJu8v7o&Uiz8rt!PYqra zG)6wp)jJmdoO$|RBJiV2kzTSN{XMHdT>{^`8tEnbfyb9-PcOlgc$Liwz%(UHfwF$a zIUbz=Oo=CmIL_gS=Tg-uR!KR$fExq_cVot?PjA4{7wyBL8y-Qw>I7&>kE1Vo#=2*^ zCik*8O$?XWgk@h@izBbfit4e;XRze%7#2!ceD`Xcc)@)@a+#{_Tq!U6ma5_gE(}Mds1dO0rVDW7+Q)1_gG4QijnrksEH8*Iayu$xR2Iy8d}#eF zhAz~J08GzL;Z=Y5T5NywH*nj(|66d^W5v@e@v=YvmO5nX2pk|osD1Lgl}APC${~4_J+rsg>RC* z9IcDR&U$bi9(&QF*z}bxl_CKUadDfk#_M16^KUC4_~e)ye;2aJ_nM!78;J5P$=~(| zuf;uY{swOQ_n!f#dMw|)5-%-on8w&!ir@URZv_~5#UFkf9{%RYFmXwHO0892P z!?MR$;^;X!-kyWOU<$r4lgvl}^_;OO2$@#1S0Dk@+n8eZ zZJ)aYcfRv0IJWv2md-50*4r+^+Th)8DY6Ei8VRN!v?rI2mkLGo_WDw+@=kA6H+nLw zr?^~tim}4A(zN1{)!6#+OR?ko?!vLPN3nFzQf&KJrZL?RW=F?WysP@K@pgNVyu75% zw{F8XzxS&+zWNxJ>|2UWw{F9_?cvm=z?W=E+7OdJ&;9BK%${)^+kfB=96#e279UuO z^S`he>+U#DP6A|{wf$_&tvZ1nKk#)NJL@PG?OTEke{&HY`2Md48V&MCaNG+FloHSb z8$Ws(9(~t6xce8r2%he-^pTY~@Bg_J4}9Psp&=0Ge(WObz2Z?k{$2M0i$>`7FUG2` zufxU3cwDod7?x7^6>~htcPBUT{7JG%=>${SeaT zBl-ByKigEum)YOA6jSeg5R3otcF=T>{(CZu+R?Yup{n~ z!~;&pJDm5+FUK?AvjdO++LwW;9#fAm$JxJgIpW~gypRc4{&(v!^Pc;$>aRB8_~rYt z>ZVP(Ey4Mc?Q3x4x-)YkbaZ_#FNibC z>VT}AEZ%hn&iKey?ElgG>?Yq;f3ywLyH*rKnpB=r4*zqtSH{cuWoeict0zQw;=h01 z>U`p(p927Fc-QM~RbcUhE3xLkZN2V|Zq zs`{iBsU{fM!}s=kObZ;9lT!I>mY4u&u}34c>zf3fX_Ovk1aEOr6nPBn>haM=)O(v^ z_(-MI)kX$0zVP9{!Rz0DP4?hWGA~zVn1Pv@2gSY5T6a|9D-f&p+RqW5$C&R{S$je4 z`8wR{%FTDNam9T-_Jg*A@?VPd65u$Fq{^JF3a}`Gy?LoxFsVV*_qINTLeK(6{Hz^N z#&1e-PKCEj$1YAk(HQJ!CA9L~s+QX&&n+Li32*qobpWEmOT~C8mf|W>VKCdL3RB0S zDJEK%&KG7BtJ?5BDh3CuFCe)fDc}trpKo5?koul68fhG`VZ~sOJG=a{G0q~oA7u}J z4h|6Fq9kJ~UVnk9;9G$43YI**)H(XGd%^3EVd@XIfp;xK*N2rkQHthz#__&KPofU8 zpE^=BLg6!Du}sQ*$Y{+5BGQl6Q$HJ<3c_o&TY+Q~jQmutiHy0bQ&yBtM!smdHcX*z z)wYB3TI4g{tK;N1w*#Wik%U|Hc@C)qRjGgh5ED8%u}jZcBrS(LA3Fg@6}v=m54g5N zE*}WUVQRwrbDd7#1}8JRE^E)l5u+L5Q`Z{E>B%vBt}L?0naC zIwJt+@z+^F)qXL6(VQH`>r5q38#UxrK2=BOT|Qlpg_mVKr_kr5bu)p90JuY~Fkpg= z^zV@_%RK{X061JhM?j{VM9E5%jJb^gl;8C}3s{edb{QV)k2Y*CBmU^0-G=ku^?H+2 zkamJFYpe*=R$u5s{al+LKGk=%0FPzbHJnsh02c^-omfFV=TDmfP$Ta&Rr_3%DgnwfSerl1^%a&+`tSsnQ6@aggkJSv~Xv{ufsoAV+X|BCR~Xgd)+ygkTe@ z#8X7}5P?xtRDB@5a)I)&011mRHbd2K|5Tw@ ztSE3Uqo)D+EMi0JyeCGkZNU<#&I~5*KE_jb16pGJ%+g-zXyEI zF^nErj>SLuvK$J+EM!2KBS^SNh~|xoyb=e+Hn^HlK}#sEN=2C`BC^e1hspZfo^ylj z8rRK$D@K#rs`(Vz*fsOFlolyx$>5!kuk<=e)jB6~UsWmZ$XEI@+BJ-ae02z{;r_OH zTormZ%1xDq&N3noHF4lQRGVb3=(%;y`<=?;+4%*H#=fZn+BAY7vM(6i=%F$B+FHhs z_Fck=D1?=h8ZT_hz8c2_l)Q*V#u0&hi4Czu#|9gGDnD(}l>)Xxx3W={kkH$G4T1<0 z@6q{V7*&OU;?sa8s!33Jc1cGOwSzHGe5#?xEQX5bQ(CmPY)TAIgVQ5L6>c{+;;BIc z>FWroMQ!YKooYrtd_F&uDC!$GpjH%VNG<@}n_W_wdW@C%<_yKadKW~&caJX{Pp)B3t}7YS001BWNklW;bOzbP@!xBsu}_nqOo75w+#le^i0-W@l^n?+n*zc z8}zx5EA<3b{sHl3aul1H;q;>DXXV9lZf*4(?&?UzJ5?}L@k{Vkjox(Bz+GgT+4Sy# z>5p%~^i3P&-2W2SgnWw3v?wfjg`h{6y+a1sI8uI<3ygKXfUnn3LKA>=F?6> zuY+uc$6yphKA}yv3pU__ms31stHbkYn?TL*hxLt}BW%j5p7WzLNbCx^Z{E#beujr1 zTREt*PSCBqHoeVg4x3kXI8`xL5PJ^;(jMBWIv{|1a~wI3b2(JZQ+u8b;Y3MR#Y7&n z_u1qaQE`Vwp4$oP{ZB-4s?JdE+Hh0GDUW(T=fC0+vG3N`C?t{P0;}FDuj0t2l(J#Q z2?@YxG_t;!&aCp$lydUQ;O~^-nGsU!zk!#V+!o;)4+n^ci^O?hWDHX;fC_&ELsD-c|8q=(_$P4ScssnN}OboXas1R;}nC*Z7r$`Q#oC zm9ohr;1k4IAQp+nE*Ap3HIG!lGno>oFcal7(ZP(4voN0pV@@@jR)qzF8Ta1l&GKLL3iBaMp#=5J=8M4k zL`GjqTPfvLq$wi3lPeo|%ou^u>C9FIUGSlyKg#2nVPP%=xkZ?q-|M_$$Z?|5XALXT zJu_OrJDo&n9!o#u$~OTcF*r;u5UH;=GS1=ww5MFzS7egx{#^ z9&vB8*RD9!m3+2M*T|jKl@vz4xJ{i44hNM}L}jYAAnm6TUqkGbc(o9*@Hk^o`-5`T zn99ncbIZ*{*l*$prPrz9MfMwzJpy5J%p>#XN%bVEXJ-AboXw}&cJ!7N$QTeqnN(P) zQgE^c$ie~C1}iY@_8QL$FG;J;Q%MWZpEENa*GL4k?o^d?LR;myjR&k%$3W4JN+bti z67zuF@(x{#%p^9zrYt%$FQ$J0tQU!&osRCkGzCLqMTg8m6~llN@^`i@DE-YR3zR<1 z((?=RfUwqAG3aazq~KW&&=@QQf=a|h38;_CPBqW%uMH~~0zB_rwK8FxO&^K~G!R&n zIcI*xdRgaGIlfl2^3>2jRpxYMK*u%qJ@OE)$}5=q+fTnJ5oN!k5G7xxj@3v8AN#sF zGY&C65p2Vlbv_j6rSnef!^#FLB>_kIXW(HnH#JT;D>kY&BM7)yf37?41@JZ*S=kzm zdVmrVb(kHELb#472U<@b!hhIfhqGd(a7%2heAmBGj4^;36mj%aj^quDBjW)%v`BOb zm|s+lOI3=j2B$SubMpNKjGhQ50L)7NSm{2;F%?QgIY$E{)Jd19d}fogBHX^Lt|aV$ zfl`xcv+{z;#l*v}+;|u3h_7mSY9Oh%U;cVme9HQxQp7{pDahf-76}&nKShvJe;APS z_BGapi7>~#g`;)kr{b{eEt%FMV#P>MrM(04%7Q7G!oP)A=lPp&9PaE?Iay_3mUe)y zOGu>UBrHdF*ajRLOH)#D&KGzextxQBoeBl&z8nNKSB!$BN_Xwdf`_;0xMg@)ij!>A zk2{tGNEuLHjm-nY$TC+>*)XHbxTWB?xRU|8mq*4=`j>~4T;7Pm5uI{&i+FW<9}o;R zpfr#I2BPtkfr))n9LQ$rAU9%t*v6plnQ8quN1~@GLyFX8r>659Q&> z)nwrF;Mt@^#w6zvmd_=fYP~WLnK_(JfKF$M3S1kH;|#F6o=Kf7lq-FP1(3`D78*Pc z3z|WQLX_EZ!?6~0OFT?Sz~U<7cPN7k3YRe?ip)UlaaHVuFHixi<{Nq=5b~DY9IlR0 zh##c}CX3M+3=0jv(Qs@Ar6O!W*erD7moyVL>gxYoGSFL zp%`%)3bNzgXodqmO)y2rjQ{3PPL=npcXa5PaboTS`krMajjX-iul9!0jwv;!{Ag@5 zqaXF2SKy)$?!_F1uP97GiDtnq5uqm_nE@iBD@KT}+5mw-e!l^1;T{aOe#Lnem5y@X z1dL}C3PC{vH6sLyfsUVcLlKwnLgCV&A26u#$=ZxWH9ol~w?TOITq~F+OsTcsARy@q zP{0pYxU9j7PST(s72a58^q}n37rGmPfs_^U1QJC**GB}PAEBdUG2hXQi+cn7zx>{C z!pietn|=Ye<2XZ-P&&Lg&4;I(F zOG&X;-6F|Fdom}LUuYj}NFvR!@zx?K?%Ij{W5JA#Efx+6()`M@AgV*<&UwC>;t zWM^DHjv>sFbPFy||0a(B=kquhv#YLXGg9Z{*wq+D(+ zb(O)a4N{dXztlh^$AHBRKPaz;gfb6jXuiqJAciYSiVJDOjFlno;)w#rT-f_nBPh1n z_!y=kn<$=_Ftmg@3W2l`<2@?$Kvb04%C0$9WN__t8Tmgdgz5pZu>`{AEY`*ic&(|7 zu^)O4BkZOKR0f|4A4Ll^#uM$jjFz;#mTg(ygl3$7go}&0m5~gU_{imCZ2DefqysYJWlcmD z=Wk+(;xE$<>@$WZm_bK`Bm&%&K;)GTRW33+P?~Yv6kb)K8QVY%HF86UQ!(kBhK1x@ zF$P@uaTli}f;^+rzs&&iERGpnJ4L54@UfXehRD~V(p9I5Aw}407D#oz3W&lJPKd}d z$CL7<2tqG&Me2{-VV3(G8WvW#^2n(7n87{UdHH&>PhJu04P-K!axiTi<(G%~upE5} z`OCFvC{p&;XF2U8n}7RdS8m)fbbcf#Jt&XV0rH-~_C^@mD}JvAayB@E4217dP~_W6 zfX_OsNo6F5w;s@w%cy=}Q;9TR;1^-obKZQmP6ELd=RTajuX0!8^w~wRPM^M)uppJ; zB_aCF$BJXQH9X8M-@_4jUf_i;{wW_$5&EEY6?96@q5$99pkvMpx>>j(mD{RDMAUq# z%(I{(lR z$Wi0n<%jQUu<<6t49X5VZK?6b>^woIa9(}Ldk1@6{eja{>AYdne-eoQY*I_2)$bJ9AeqOSZ@CS%YnRGBE1q)<=A zC>>kmaEkyh#fmfTpoe(3gZHq&Pu&&mV*wRP98;NhQu1=qJ29EIZIrow+HOrfTygct zKCm8Fp!0H7-wb8}yyC@!!2EeXE>W%DbBSvz9*HVa<0~;!}D_5IEKcRvsiU@Ca5KCb%5FOh3M|0O$DN!wyNZ{ zW0;419au~DBDAAqSd5qaFG66l14L=A*~|ods!~+Z8@J1?-^i3T5mz2 zw=QRKm6dRfd(J|b@=8F@n9~h}y(kS*lWv6f4S$~O=F*^C#JJ!DRfMEGxuRwDi14-z zfqFt0TrpBg%f<*xJ1+0^IMR$mSBAh|-aU;9ub(W_GcaOc)Q^h&yalBij_bJ+6&aM@ zi&P0M3L!{?{H+Qa^CBoP!@Ol3b?68pE`SEJQQFmcetPuWmpMz8g97;}n!YaI;X zbJdOmHD2w3D*2Cn42?JH8Mm@ujQu1sofJ+tK$ki<2#C;i$-a}&rG^(tkdU2=&l3KY z^4XZs*mcqk#o<7WQg->OnaU%jHygKze=D!JiE~x)t~{xtC&O*zy+NiLS9Y04l#QVb zn{2Qyj9@1h=Q=^Lr*Ijgz@+1)FxE;n%X13VlZAJ=*I)Ukh3k^{ncy-A3v|u1HjH1_7q@NCkde zaP{W#&))pG(VU#0R@$j8;O0wh z@4)6zr=uIs=q!fO0 zh5J04;alM?fT`18z(CpL@^R_T6%(aQ}7CjhasGr9#TxUPU#G!ny*H;K?E)w7Q z80GIJOs=TA#va8|?zaE0id@}}Du(6QA`FXn-uY4R2i3Rq0Kmod4q`CP(L;1UaUi4&3A$&fO=8% z8MC7t=F_X){_(Sv3wC8GJ_;~2TA_Rs!4SMOXx#Z z3dq7lv>sb!0Bp0LqlRF|4{BrL`Rio4BA3f+B&_{IHUdHrnBk~j*O)-QsPZs<(2uEo)RAIDVr^v6tz3gAm5Fa_l6#l!Q zAf=1m$C)UBSZ9JxmvVI_&p$V^3V0Zxu-C$1rVOPy04X1}37rBIH3Ijd+e)9pF1)U| zM>KcFutC;V#L^IV#zvH^M1a_Sf5S;^N)4%4PmnKaOlp1L33~)iI*nCt{`sYoPYes=ITuXfO#viZ9uxQ| zzLZU>Y@AO^pYYmnRao3n(c`N6h9I9OMa90TX`bIFn+EDF1@>7hwCa80Qe7$NjxZ4F zTGdH`Y5((uPgwbe}m0pG%z><##&8K=M%+2+_U%(WftTmN3dY(Ys$B?;_ibk>$K_J^#VEt5s zE*cj)#-gMaE2lz~q+k)u$Z%pbiEf9RsWRs}HyeGE!Q%C}GOFq%V-yVusZV3Qhe;a_ zgE{W>w*gJH2E0X+6NoHk9kfluVQMKzR@g&uB7J&3Ro-F7R#rPRu13VjC-w}(*Q{4E zc~ntW@2%n7P`3f(tArr7xfW2Ep{ea^wUE}urE zUSKmc&A4U34&Yjjw4q97wPz=eL&cqJ3@k6jTa{sg$it){)3=l}8p`DSQg}1v({eOi z&sq%zcb*#(CM8z4*AQqzS*iVq#O52W$*K(@jR6gmbfrb1_7yv#w;Rev_KKSajp6eTVZmROU^%sVDKJknHO!5exKk>g+dH!Rgo>R&53vVCr#8a-P&eQ0Z zdD$e@V{!cl-&QeoYUG)JOs{XyPdiU3#Bchgl4h^_;M;?OlE2k-eeHjE8>%e$t6whj zyyfR^FafHH%BO$zrXtT9f9m?es9|RO?XTTjUVqLMxsi=Vy0MYLr6)USM^$n&P3eyhRD!f0>#P(2pc_~tQD;%=+( z{JQtQ#Q~v=q0jwhd9&@6GG3aPfZKkf8q@c`#h9}Sg3td}UC*^99CSJNGu4=0{gZ)y zgxKmlZ}`Ad{f4RoWGiOitKm4C1eqQz?Z^rE0NR;`6(P)J2|MhQ+JQsfd)n??WBJ#jT zK2zk`_U<=8Pc%|x?!iAP^KAOQs{zO<9F#W{Kk?C9i#+GP>q>xw-2vdqI?s1sX^Md2 z`N@xdw#akVJFhfPb1(25{EN>OdCqvp>j5r3iiiHP%(M80*Fg_-(F@Gz6JIFuoVfnA ze#5a~X~|7xo@3X)26b9;)8CEH!vLsN&ud`@hSqa)RnN7r9=7$#FP3?(dyN}jQs1DS z>t5}1NB*X7s_MD^)uL#@6zcSevL3qOwa|F@UOmZGp4sa&%z8vCAz|^&Wm}``Uju-V z!01Ft9aZ%#y5Tj3yWBYA#K+1!%ijJPOc9}@gia8-_y7HTk>~t(y&lm1NL>&ASxJW% ze*cw*!z5bd{eN8Mx%>w+&D%_7!aaXf&z-BpAZKBTgopmLtY_o*UJ;CdO!trc*=}ZJx5OW zRDHkr-B)J0r6)H5xc?*7xWD^KE5EaP7t`fGnAQ&96WsXyr$Ba^=GFuwHz?@`-QeS!AWEFhdi|*(5$R71fF}E)S<{K zDsLBwZzw!#d8&g>FsQrqn0g#~(0!V40Pa;}xF@C2MCF?(z;6?;&O!6~XrDsZLMWzQ zqgY?DA`sjfDsD@3Q}};)Voqz$4f-;c3>xDGS5oQ|W`<(|8;|Iv^6?B~Z+YXAGga@j zVuIe)Due_(P074(jmb{#Q5y^^Ys`B^Ep18rBq0k#HqjUQ{Z~o1%66QuD%#C^g$!`vpHW+@SUf;8w zmXkw$bXi}P=119+s(`p+O{RqRy`SEq&wF-%93h4ZB{{B;gK;s$vi@LJ<3j2Ue1Vab z%Y2T!tTHg6=aG%Q(r%oC`LrazIhi?c8qVQH2_wok4=Ze=FzyI_;^O%L`g-8XuPw&b zOie~Re8$i{*;0&(W_@0k0-hitFQGpU{hkXUwXSONvuaFbxn~NF+$50hNAKQVhrdg z5@dfu@-enH;IhN`4!JUIOHRczp|w7*nn6~qJRC^8{W96}kOl9w&TgWDehE2zDG9E- zl>9}Y4GtxUQ0&(k^$fO~ngdPCT(Mh@rN4cTusRm!QwT${)eAp*)XCBLgX7lgN-4=c z9u(nMwu)*uf6F^!Th#%zd3mqLS{JgtI@L^!R~8;>dIE==iW#`?k3Wmc-gBjoh3Fv+ z2|Y`x5gIg@q+DDoQoRh{Rd9{f0tRW}Iejo%e8ux9R3{P6^IX!f`{VP~?_1AWX}&xs zg~Y1uf%4KSqeMJDYfZ?u5btvTB!L_UVErD}PH)N^isuE)6XEbhM6XYkAXVJBVMs)_ zt_(G2D6qmqWvhU#06z%4&nPY9(vJ2YQ^A;{6{xd%O;-fN#&4mcV>Do=OP`e5z85hC3Xgi@O_`TGlpG%v zlunHc2WMqcND!cuW588`VwXCq46&e#;@F`yn2z*NRI`y3By5sMNa{puMQ zA^&NgJ2?kF$2W)Zr%Y#Ac`Z+8f_#q?SLsp5%~sTmoLKY&ec+%{sKZk2nNfV|oT%7< z^5a37(46r?!FkT67smDWwud`vI^=WV!TA)XIrO4HsZrt6zBAb5mS{$CgD?_diggc) zoCHNc&!ZgPLwe4?1ZQv@*A&k^g`4AhM%e>9` zrlQwR&MMJvqf$F_Dki0djVY}9TIYKhQX7AEnH1$~bn<9uR}VKPyiKW7c(1Nxs5Ovj zg5VlUHtY-z08A+>)q>kh$9bil88 zh_dHOR6&_rKq}``tBlrsTt#_01yRZtXDhCfRa{(>Iih`b0?(WJD z2`9nhq_Y$ZwlY?A{^3`F=muY_nMpOovGIHve=a)wVY{pwR+A=Gb=02KPJR?)F@NMF zo*+TE&r1JD#_Pn~oK&B($fw@M&)Q;FT8b43k+xaasdo9OvKDpF0AdQ`qY$ccsJNn_ za1mGxyE1M!8c_a71+vuK>&DG&Or(^;J_c1nRbgT8KfJ4MFf#O_TUXE|z8p!EQaN#m z38TQ#6}A{%t}({}(dYy_DN){_ZS<3si#gUy+X(8-DD*}nfd=2yc}*d+juGXa6oVC% zEaq&&BueN-nNM(!`G^>afho>P{3w8v4R7&^5`ie8hpg-xIhE3{Lpb3_`l2fZiNeW0 zGEj+3bVAx5+$f zSIX;>Ol6$LWP5)M7u3kho)<7sTf(Uq^d(aHK?dNjET4Ho+9R0M<^RTOejaYJTF@7bA=V;OqS}wub6GrW1>vR z;UGbAk{7;AFLdSllg}}tVf_L2h`I4;Jk#Nb8%BYPn)Xy_Fa=(f3{?**FyfJZ+Ln)n zC?#^^DHCCKjxjgtF&g!l?aS5NEI_HKQ@{7UD(+?fieBqn3v;vYIeWxaKu1p-0r4hY zeWVJ8DTxY4L|UIUI6ab)1$PlDJuxWX4jkZOxws6j;4({C3;B4>aR^tU?CBmEuOiHG zFB>a$*a#!^m|{W)!faNV1A0{P%}R(JB`M?I5im^&NmflpvT8DC7$@7P>?5EwQxAq_ z;OaMOMkJpS>J`SIk2numJMuH-yOaP1IBiqA`0ZI&QnKU&e@8FK0k_virIq!t=(?O|KDV8g21j$s*t?NI)}GZJ^10zGc$V)9lODBNTr3Ee!+ki7N%5yV zI?98-_Y;GZrz(F1$IvEU$xxgXxY7TDJn=A2gt91btj|(}mD%7?7!`)dM+iX%6gVhQ zGEf)2uQ41;VF{hEcFK;%Q-uh$uv3FtI*0pz#^v}Ilwwx_m&~nhpNw+!KLOgF%j!xb z=1CsiR;$C`C#Q9)lGtX$7(N?&i}KhOCikZWa@4KH)ICp&XphKqn~UXK_T^A}U+aX= zQ!08fhF(lxt8{Z84-wBQ>`k|?h!H_SC>qEGvUjdrj#q(55dZ|eMd6Fh8B-?DgQ(0m zsJ&_BIW2n##JDt>mWKvVqa{=JUEv7;&NCf-Bwbl{Weg0AdI@V8jWE|UdL~o(ROf#Jh8VIpCKX zgEJTy)qZ4V8C^wfEEm%A=1JPj!|y9RP%kR8;kL`y@8hAVq1b_KeJ#k&h@C$C;;h+5$oVhqa2o6<=^RKguYWvk&( zJleNNCvd*t?A1f7Tt4)IOQkiP88qNw+DBdKQiD9n2}MTNFczFw%4$9$?~3(DD)Hic zn@#D3j+LT8`x_N-lKBYszUVVk>Kh@mh9WM1E8c=N7*BU9_igx`L-9=7jALQ_*A&B$ z0}KLt3?~B0&>(#_@n+%q)UU|Ap3hXtU2Pph=pqX*5qrvMQgLp)pDcqXr&fKZBb8|J zMD@=`d~d6sg*16ebTJMAl{c8Gtj^EI)HzS9${9p3WM(+295=pAth`7A#cEu8gZVg# zI2!L%IGBtrH<67cHsd-Js~M}9w?M8pIZjFx$|-|qwA=LGLuHdg*hzd|C>L<$sC=r0 zU>+J}q;QBtZxMyV7`Y46LLiAZuP-DR4UuLFkt%4V$DZQ<3qa|(F^TV4X?+3#$5#c- zx^_^NC)Fad$DY}hd-ddTkA9Rl`ej4FZx7CBB|o;X8h;h6y74cHT{CEcl3?-4f^r*& z$~aSHLRp_18BvQPgQ1So&2Sdte^_6{QUZwb@s3WT6vo|0KB!hQZY6)V9uP2s9AU|f z#JS9f7@h1n7_r|>+*w$UDExuWZId#9DFX5t^|?cdNcKkfUIT?v$7iw;&|=mR&z`yv z*PIO%5+gjB&0r_UNa3#Qki;MwQJ(8l0$~rBfsjBLv2Udw30}>^3J0G-!L zV|h%bQfD{b)}C+2i5~r_G@08pxJDSKTFfu!%)>*MfW z>Dcp0$({*7Ls8@S*1c{_G>lgcDom4nnn(+D9cOZU9q?TrH$OB6TySL1QvPA53RGU_ z$|kACcIa7Os1Z=-FTK@up7@;0Jn@qx^u%j2fWwHJ(6N~Q!1J7u%DYP8(Qi?R6bv?i zlt3Zw+hc(ovU=ytKvV!?S$ZR~BHlY!3~YkyAXv zNkJ$CDvKgRrr3koPth=mm+4fGbu@)RbXKB#;g}ug*@v+bMUmml_sUI-wMg3p-%RM> zu+0%9y>}p-JuYxspTaybO2%j1X(CKY!@rEM9fv7F?h>i? z8-%2E8ZYUqWe+nzT?ZNk!&~3=c^NZXR<))0%a2&^{cE*9nF(5B`3rngBE zK-RLugE)B-Pp!2 zE7Zx9wPF=Y>MHT23W_RYJwoI+^yZ?%z*ia)2mm;_!`(DX#AsG!@ClL1H%`|$Zg0r%O!(35o_ zG?_~FV4qrtp6=u@7{>cv3>Br}0FEh+0tp96DsvMIF!^jRaUPLhtpZlVO5v|dI!1~k z=Q4@|?VsES7+MKUkbB{|*VSV2^!IWe6ghtk!)C+Mn^7h6fFUsH3Rvi-;>$<49M_0E z1S41r3*(4_}Tz{$Ja#H<`cg=aTu<;rS2v<-iDeEmy&7?L8 z+li^72w#;csxh8dDrlytn2Su5J^j>nD4xW?Vf>?zpA5UfJkFSc3(LBi;Y?7$36v|a zts2YU4rAG36p#!zQVZc}pJSH4t9hXhi*QjArI}SZQ6<974{axrD)%87O-bCYc&4+S z?0XIr?#^a{!;rchYUHahY$uM`DC>9C{H0&2AjKPojqez2HE!GkonyUINe85P3`I~w zrVwa_Y$MAH0jHpQ0*I2Fwa%cFkWvQ#nB_j7`XhbpMFE-;<$+2-0E6AVm;`b>u&NUp zHiPVC*HO^hoFi=n92RXg6-_Guwl6)rA&*zM2eU1#f)u%TRUAV+3|yGPjgIN8{W0b)?tMa;&JSjC3Q|A6n5v|qW6 z6z(OVfE$CwexQ_7it|8InM4BaNsUdJ$x>l~eo5mE0p`JZ)|D6!Pg)}6^rV*19T3zQ zs7@~+7_TP{W$?e86d2V)Q=SiX{P2QG+PB~c9B6tbj0Y=9rQ$cNy#bJ}1}LM{2~I9> zLso00KuaaS>!y|8O(dTN&9q`H3z{b$77NNk4a0n)a_*@g=8JsayZhXTy*3^uDcH3~ zdXTO5%ofWGR*C#pub6~jFx$D!;>60rktW}Rv!bVq$bKoT5^xdlje;mD6YDzvf*uc2!?v}9QKs5 z=gkyaf_qRSts$HkYqZG4Cjbj8QbR?BZO<-z2VO$}Jrar#Ds~0L@fJ`SXia&N_cs?L z?IZamR{-oz13%u-2ZNALrqM7PI`WmOL}cxe<#2@&h!;IEx=!{2NT&)KChu8}sZWNsl#=f?Pz8|!zY<#4adT5y zz1f9Sv*)V&<|iDm8HdvYBx5xSdF;E*U>9R(g;FZ4#cH*d3t`4^)D`tu*rhzG?QRCd z`>rbxn#V(Y3ZBOv->-G$Q+7O;9dslzA;TNOzk;WpL@p%KRS#bU^8V`zQY8-y3@bof z;0|J}nTc!$0~stuA7i`nXu&H2V}-*>r^xJ1ZZmI7@gHCNsijZ+-pv4jx4!SX{GgWL zGR~*m(0t`uyz%rQ|Kw67Bu}d7NgDy)W~KL!O*(0~RiM;W=1&ysQDNB{Xl0WXAmiW* z4P?IT$`Qqk;DLaOwZ;&UVROUwV@!H!Jh*~2uIzlNY(LghGWb)bfjU)&f+~1rAdphs!)o_34ArlSD#ltgXVW-n5>3Oik&{ zpm}zhHxLSv8wBRDV;kQ5+cujMiW}Yv=rUXyw{B_=Yu(;o#7|hHKLGc(y7K4hQ&f1u zfEB~VssKV2df9lIU7GoMABGkHp|=ak01pZ3)%~n8RtM2g~iO z8IB}jQf7GQ7>lu##2c^toteQ&14~?S%XyrKYi~z=ZzmiDFiTw1Ras|V2 z2Zhb@DPPDN^hwJWZG?;g@rM5tq$b1LB^1wF^PY%+q@iXkeU|!crJ){^K$HcTd5jpo zF*@_dRKiR0%a#?w3@heteq)Bf%(fXk_{ImZ_tL#U$5{5%3T*kzW^DM<#$tSwZRw(X zJ-w9~B0SH}%29TY&-fJN)3_W3RHrr7bX%vEj)*bO#_3$Kj>)J9f?}XrmWodcmZ7fJ zZ133WWBBYZ-ikH5*5FmY`EA9!CttD~_uQ}@N6vm0%b#A3%RYV?*57%KwLLC`piWP{ zWH;`4o7S@omwoJVoO|cl4iqt-dhu@D`}TV*&!vBP8P2)$oOTzL$W?;I4lAb|q|6Yx zg19VAC6frbS~cGBvtPl%tq1V!Km8gk+P7HhiOY1MZZ4U+a1i@$%fN62Lt8GOiNdut zNmzwX#bm3qrsoSSDm*MjwjqI)d0m+^##H35VGrZxHRjVUIMP@qWQ`Avnw^T5Qm8e+ zCG{n%B-P0w%)O=b7o9Q9&+E6>6?0P#@v`oqMh0Z6vil6kL` z34>OWe$ZFKxW>B!j7zYF7K;2cmLv`n*{qW1Hd~!Jc9EYY4a$aY8rNcQfb=u=NDsc z$sF$co_ptQqM&~Y%Yycv!ekAfMLEa!xLEYs2x!eai@_Yz<+kGA>Q(!>w@HKis$fj2 zFEUJJ_@=TEm34E2xD9VqJc~RmKjUH9`RHIi;;WE4#J$2jzMlEL{+=)Dp#F@5;C3No z$51i`Mu1mZwSiL6#9`m}c~wI@5$M*GV8yX&Q>Lss z&FV;L-(omQt|GtFOR-oy<63tDEH1u-*iO-y$Q{jNEU{DChR#1?h}WFLfk3XzX`H?H zKk&5BJ!f#@0q1<&=QOg>K?HOftxtMMmn+daUI`fwdZCx$(P)x`BE`tot1HKvkpK(f zaGyRIzt#N)Q(ZR*15)KLhO)J$uEMY5Qm_S82;s&nQ8?8`Xb#TC2ib4&gHsU>GW$mLpOO#Jk>QX{CmC$waTX8R+T}nRJ zgOH@yR)8gnjan}HMsWEqVL`RGzFZxx%24P>C6;`wbpKFP?h)wP`G~Gu#qqZlDvIrr zb=T^SJi-~A!va6L0I&Y#SL3`dpNHwg)0jRwjZ6OWQUJh%SM2gZDujvmuo0;|NJ^LS zZy{-NJ|Vr+WiSx%)*G+GTW`E>TvL{B@SGdJ$0+r&y=MIjO|AT`XEqnASsnh4ta}zu zzU)b?erPpT?>eI>zUzuz=(`>l-nJFfN2jp$)-C9}9=oo1XkO(%riZS42z}RM>#bWb zeQXL_KI`=;P`j?kdA8iT1=B}6Z2s(K^j(jKu6$@vUt#T!K|srZ($#>|nanu$*~BpOdA^lTjQwem(I zVFB6UN^uliY7kq?k+)Rf7?XtycW=_YZIja^y5XYE{AGNFrNAtiVr2NOR6Y*^nf+G} zmJpW6zoYUa$PRqnUzKx&rE)VaLLbW^Qw7F_Qxe4_hjrxIvZpkYkesCvNSffXMS1J;9z zR0@MEC=p(d+@uOuMw|}f=1m)=N;!1JwSy?sDPc;+SWo=%IpE5pLT>Cw6i4-FYGXt> z{KysXy#FAhoIx6TVX#H4MC{~zos;xfM&OLR8jwJ?I$-@^ zKQ5{}^BUA1UztfEpiCYkp)jISDxO6PIUfgS^? z;}c=gIZ!Byp$(cUo;Sc%&GbqpO*@#(`Pi~OU1gZQ@aoy35D+^2m|F^aYHv5 zjlm3DVIRBL&2m)!#vZSEOs%FxRYbFi7%#CgEL$ zJPOdN(V%Fu@hRt6(O;#>02_3UBCnDvol$D-5s+GEmz@9r9A9%Ry9|07WQ_=npx^xa z*+aegbDQz>3!lc(HAlgTas7K;!G7f1AH|OE*ny*Kk7DWGrMUR7FT%!u*a!gl^snE7 zG}qw`KXcWfty_NOv*@Qrc=J!b5wpwZaPPJE;i(rrh2yJ_Bh4k8wQ~)&+`1KK-@R@u zyse~r12nz$#_I}3uJ5;gZVMiN#S@rYJcpG}ti+4|^o3ac(CQi)WeWAo3CvHvumSUS zhxw6LJ&GM~-if1U9mUdTmSWQvFTjPLxe(O1;f<>T(U6JC;3VbukykweCdP)ZoIiN? z%(i_1fR#_J$e&NHD4s7gSv^m#Eb7^J(K7%tv(oSSZsijzi#$MW99CMNe9W$x#g6ND zVE2ok!tvE7K(h&F?pTdYpV@-7-&|{@AAikbc zgBKpe1K01s%*FfBFCJmVqbsrHrY%@^`?&yo$k%^qJ?`Ih08hT=acup|ZEYl&Vp2XT zAJk+-jc>zh%M#=Qs##O+-u#O1^O;Viab@{AMYYIIX+n|3=73%lQ?y!11M^fCs%}}J zgdo16zzeyVuQB}oFe)gj#0I!xDt`~*bb%{9(e5nN{*5aHTs$i4ArpheYK=pdPs*_K z?d2JgBSLY`{x(0?@DvR#p@4mg%Cs1?dUy+5;dX__W6O)viBxywk~=bo!y3u&L(t|t z2+b=|#UKmba?Y~C!CAS@3le^$Vo{HlBQlS?8Z>#SKi}yZy|~&wAuFjpOBhezV>+cA z_9B(*UJE}JM-)(C06(i`BuY1k(5Kw+NcL0^fJG^v95g2iYj0KL&9!}?XA+pR5s;yu zm79{aFFkruek3GH3UaTww2^{_Quh4_>cO?pEe?1g3B@8kGF0oyo$dlYGsVb8VTCzS zK0QVZ2UR@Pi|(wXBs{p*sRk`q@I01JsC_+1b3%#_qHhCuYVho^Cz%^(t%DI*mP zfO=f>cgGi$p5=LTfso+1t-@(+KZmeImjycRY<*M(+-9eZe;#AXvxFQEGV~>L4+2fQ zpAuz9hCV~o?X>g4FKo`0km=H5J^%n907*naRN6R6x#nhJ0*z?^ldK!1W=T4me<@52{Uwt+1`krs%Yd?4=79U)U zv%h&ZRz0=~doJIDx#>Af&pC*5i+dbh^DNHZo@2_t^4{CA=kh&x zPhYkN-}-;O66@|+hq>uFhgl4P-7kC^U;BYOvGuksxa{MX;ej_ifV;nQI{;wYEf<17 zrtB-cH{5uAq3E~BIT{7^>%Euk1pu7&z*&QG$Idzm0GK|q2)FznpT*T5yrOs>6IaC6 zu4f8=`zxQtRsZ4j^8A?5{;{);0RW~BPvf({dMmE@`71&moy@WRws-%lH+~I!U$6(S z_^ofjS$Cg>(ewy27tP?IH|@gOZ>|M1u;;~l@Qok33!6T(3ETeS5JMN2cmY z$L%P>NNp-c%^*?bJEbt*-th$A;}p;OQKcxatWZ8al^Ln`(j#Wabr@&w7@(^}u5dwg z3s)eaZIRGAdq|BMdJMT?8b0P46R%1<0hl)B-N*rU20sIg9wUy*l}*HqQvyih|NGI% z=XOfwP0gV=dA##QObWm6BT$7B;1W)u(-gu)v`pXoxG3$#6z5y1mxs0yj0pnbDvb|s zUZqiHOp?!)clJ4E%mU_| z(G>Zqub9V`w+IP~(WmT*T+vso1i6*lSL0i91YQK_=JQ$}hWz4f$_Ao_JUaA#aU7J1 zXW2wGHkHQyXx^Yo>Auw_AbNJu_;`7(Z1lON z`NC~9KaEnm9^%lJVLCv+;`G_!i6l;9GVA0Jh$I zA*POYxZsw}0D#9{_n6hY^Bp_TcReoo$fa0){~C0&9acWN5-L!c>>AXnM-dT@T_K99)e`FI^&Z zDTYXRm;h_MJ@nl7jD_4@!qilUPL5dwn<|@?5QZF;$=0UgH!5l#@}nDrOJp*0-WV%4 z{IUpe-3t(>f6t*Lk{9G}q^KcXl*qrYU2^$wS;^@LfF!azG|UF|JWJ)wpo&mzQFhkG;{N zz9B-GTh&;oQD;oZz>`ns6t;gLq*}o?UMdQ{YkUz_D#xXgQaWxPm#zQ>+9RF!C}>>i zJanaS5E*VM?3)mSfB@qc+HP)#E%ZhW6H3T`!nabQA~XjD&ZB&Z{63UTROLrAf7BTO zvi%1Yf}O5x%ykaSJk~fV9S4+sP6B`2QFj7p2ZzMatD|g>u)~~ zTW{Hlv8fW8by~4|dGq;t727ySC$=x7~-ccAkm#cdW;zzrO%9n!sTVei)7G($64Oa&r3c zGytHR6JeHuS?nG|F`-em?bUw-jZMtUWS+0|n^gg#0k??9y2P zKzD4oNYu?H%q<$BPmDMI%vI>8dV5|cGddc2j@Q%U>Yut2{j}Gk-nE$Ls-LYCx60-*XS{f5-h;bN?EgbNjj2_=Symg^L-7&OZzQxb4HY z7GHFwKM}9GV&i1smw@G;YzB&+sctCH+d|dDNwB5-cucAGQCG=&!Atg;PNE|DvPZL##acR|~ zd9&)la}Qx=%YMAzW0zyc8+T&mli2`R^;mxY@;`hT*511oyI=Yg_HCWP)0geR)0geR zGu!sz<^T6f=Wi$wGu54(lujaRonHQjFT>h<#=!hvGtB*>JZ-M|vA1CQ_)sx#dEV#q z#z(ka@OYX&I*k)6PGD}yET)f47w?ulvlNHdAI9wR6Igs;F-|N$Vb9Cz+Y>_}T=L8k z9A19}b1P=C_~2q3Up6cCEU_9i&+PJ9EIycUV%Z7HQz%~SeQve);{WnuoVooh?0MO4 z%v`u1dta~@dta~@GZ)R^MZfpr%tRJvJYRL=8!>gfvwFSG!qRB;sMMQA(x0hk8(VK0 zPh5c1H97NLurYBGuUp|j?IsE-S=Cg}`C5?{aWIxF3rQkyIUFqB?Vj6XtO~ZUQF{=X zWveM?%ynleLM@7E8>#I+jUNDo^;CFatM0I1Uga6nLfsF=ss1e9$$x|M#$8C}D#`N{ z+DZ^+ncd~#H3Z8L8H$N$IOn+Dx_RcB()dcRNed4dG7Y50xtd-rm=4sa zm+KI?{MunsK-_T)y}@9g`fqdC9{Kd7%K=*RQOD6l(VTK0bMJ%AlVO*1y=D+w10gpCmIiut3vh4xnVakXNfnH`n&1 zDr|Qrby9roSH6m8_8-9h|8zcH`&-vXRNY20leyS|P3iP{0QBIw&!)epKTw{Z`tT{( zIkbcCzUsR;?%;8_^i!AMxMz>Uqpy0jY|VJ293-7q6E6M_FT)%D*B`^X{^2`u{cpbp z0Px7GAKnu^!JIT%W-rnB$bSLivnM9>eMS5_v@{`S7Et&jZHAK|0F z-Ck!}D%Sv}%;?6-saOIv5%)wi`S$!fwye|8bB|5vZW+y0xs zjcfnSbpU|xzUC2_Nk8TOB5wyS{2ui=%lYYdm$7*2vM1NJrvMI~Th2h7{Lm@OVx6g zs;}TP$YTa5DspbS&|kj@)NK!Q&p-o9l{j_;>#SA1wpY-^I0vl$U9CNY8q zBn$Puy!}=X^5c#%0WAX`3XNN(($L4;vVO-H)~y7{+e}3G=94@w<@TMplGC;WO|aFR zdVQ(UCFNccoyx&WzF$*?CAR`zqBVg*jjd%nv}MC|sfgV|)9Z@~Qm$4NyA>(63%Nv! z@!1YpD*<;p6l*FzshL8%$!P1CggevBQ{i8YXEaVzY=238lf3;H2+QW%SHO08KeFo_dAVtn;O2!FF zsa9fr7pkLl$Bds3ZznhY%$yvPPoW!~AmBON-tyDla^#1B6PVAuPCRhg6K^Z^&HpDy zr{2mI?-BUBx8b|5`Y!f=<$PTKJFfv&UFnX&JXGV)<8;|4E(ZYI_0GF+=+qzJu6LEa z+LzboG7C<7@H9OA(x-7zy-DbzFJ6SFU-C3gd+;>BIp_2L{TJ}iYaYT6PW=H?6vsVZ zBH5=^fVXYhDw=L-bN3dCmH$5fPrrzVUi~nBaEj4fqQ^$FLUF~Plrs}I|H7>}aLz#- zI_WSTyW%l?`PaVO)pyckB`W{e6_5GzHc$I}lwS1B0>Gc-n}8}?F8;HNF|8)t{nmSM z=)}Xg`z`lCR)UNF?BdkJaSGmE{AVx2w3=|w+rEQCC#-PKTfYNY310SR7dx1F>1R35 zVche!lINwLd1`PBPPbq#yT9~b)X_|I?0v*#8* zKXKKQ_}YK_6>saZKe!yzYQi`FtK0GP6;EM4e#U|G58#$xy{RZjYWnG`inFlqRyuG^ zlemvCtCL)QH`rgdH$a_MrHpGq`{1_>cx3UnK4tp+sWwU;>?oA~{n|zTugTMvEiIB` zKnknfj$(c3_g$jXTT7l!0g3A4*wW;9s%tkJ(zXvHo&i{v19n~*{Bz{kqvzC?-vvoJ znhkzSY)4O%mwKBWJbz48N%}twQs^9$Usd&Y30U2$xxNstUMXt-`#A`Yz{BT*cSQnR zr@PY;&~Tm=tJUmvF^W=@ef)sb^9r<*WUCkTGxJVlLc*d3?h_9s^S#OAZAkElT}}-6 z=tkYEl&&rV;RU?fp-u5B#RObq3r-BJdQ_hYNwOpc!d&=x^aE_wH>jFZW>I92BV!=E zfb5{%z|sVvcN4&+$@L#-|GAA*{k$V~#-Q+`@Ix997yNJtE_S{_@_|uG4W0D<*C{!q$!*Dqh`LswzWNW8RtSRkA&%IWT^hndcyOX9+8-@_TAg~rN95n3IKonJAaI& z^s~SEvkQCfNx@RG>qFoD%Rfhvx18>MQ@uX)>~ekRj~9LOMR?^O zUWF5%I0@UP_A1Ucz2{ec&Tr@8t2sx{Mu`>5V^=(ed*1RLJa#$JeCLbs$`8F9Cq8+i z=X>bY597{vehbgMs zR*|E)DmELzhpv4Dcl`YAwVspkia&e>&i&fC73h`;_VBA8!8a+-RUdkJ$1g^ao;-*`|fxVuKfKgaQx#Zc>f=H?ZdeHXYR(q3l9J)IOFcq z@v=``f){<=Zk3+wF4#t4$5&%zD(cjXdBqQeT1f*Y%6&7X|d18~c! zk6;sR13kbXI{r3WL29!$_Sp#uL(u_OYBy>e^wlG_p+r-EBnXTZn`OCMa;!QmXb%aj z4a>oJKc+n=n}@MF(&qIUB;vfWXFk>~f4jaFdJ?228`xoUFJRzUb%#wm)d0&9TNLcZnz`Q8q}110>()B4 zL(F-geV=lrz@o;nY7;jWnIn+58c5u{g8<8bR&f=dU#jqJTa(G2&#NNdbA5BHtq!e7 zj%|KBXsx#(InZo|C(Oda38z0Q!sSaBGJ--~RR!nx1XWvX?WaA&*r4jWBV?3yb zmZyl=1L{tjook9~Q!7ZX&hm~-_0Y0$KNDuaHqoZyck=Uj5$;qUz_2k7zMCA)D{{~q z_*dGG)d$0_3QaQ0Dd{PV@h&%wu|CTMU01X1@au-libi=}CWOsrlS!7TqGUK=2j`Ww zF`FzYlN;k@;~X}LZEij*;5Q{T0fFF&kS?J*tHKQD%@{yiu1G0%yp@oh@>9IQ+#P|2 z%iSY5IRm0S#enCua1eLY#&+3=q7CTeXw#?(VI|O{W^$D5+jVLr@O%0FXwz5z!B=tr zYahUy|EHgbmx^s*Z!%o=eeHRR0Bkm~xS0{CV&&AymY3K3NMqtu0^^62>WryQh)rM} z=Iv>;^z>y<<3GOtOE~XK`|+xOeQgpORxtLYmGhC3Y{{%86X1~efj(z#FX-#e-;LTl z!-EA3vU6So2(8dd=ZuiSTu7}!@`y6GPvD7-?yTyEC0VXg{i6pGbg?6lK3iEG&iJiT zriW#<2O7pxn^_^pF(J01gO$E6Ni*|N(syn$sEm0yH14%3yU$xI!1kMU6b`yex5@!e zyH?bmbM&eJ?uKTbUG-4yYBfW4cIs+_IuK?F>>RSHu2yr%yp?rOJpf83@qW8Y)gh*% zBSP3qyln-U>p|d{L)ETGG|IEhfS;h=jAekvt_C&GQs)bgf%QYZj`-i}w}0F@X2(0m zev)ka+F+jr7zzONVx|anIX+YQH&8Os`qxfgcQXp3!z;rvBOvge`hQ{Qbq zw0OdTfaYKZO9de04PP_GM z`nHgoHrI{thKl_EiH5YNxp4yOU@(=w8bUqr-+3Hc5?T)&d9@|g(b3L^O`l^j916;=~CNVZ`q&_0kJf~uE3jJ30w8tIz zrZ!46lCO1?a!$jCwa8ev1*qw)pJk~33vA`X=Baq(Q#8NXwUcp0k`L>D>9_68FAW(N z>`+JSGiVh<7VtNRg+VpFB0k=s4t8en&xNN$Nf}F8N zzP<12ooC#_WrCKFWxpcT|A*7(bKc8JRO!zGr282C;xGNOwgh&m9hjlPT z&!vdT26|GPN8t)=-Hr(sE9+cddXz%l-2jQyMuptl!4YPoC6dd#na}W*^98HTjol z$vC7C!~Jgiy0ptJPVEhEkiF$J$6!8Z&oXg6u&wDL>~`HV2vr1JcrJ(aM(g zW0e@6^NLm)A9`SY-8>!vNVvTJMs;U-r*eaCO0BSzqj5-mp@?+Nu$s$w`_`5@UUp=M zO-t)_gv8%31^`&C%3C?-xs1s?&t(gbl&b?*b7l&!T3NK&s+*lo+d`w1uWYH&d5-Na z5?2VSfiI=4DnT`Iwf07XAIxK&AM zY*Bb_N1F0pE!miU-UqzuKQXAH`C5OATcqHQi(;;CR4(5pDjxw3t>-5qkI}VbcEI@U z?A7cv(sP?h&IF^f)hmcO8uLwHD|_X4vXO$+hrDfxW&lmc(e^2uTJ8jK&{Z@FGzMCScX>iXW%?Pe->!gEXJn;325^!m2*vhaSgOs)LhOC1bQxo@t z!R6mnCjbcAb#O>?l(yft#Il8smmM7ve^seatE^e4(WDpD+b5dsN?nA_ftAG)))TqT z3D|zr4g9W4(f)|X3iY!H`S9=rmb2uXI&m@lkD_4fZ|N5{*D2GMZ1MS zS=iti;po^Ig-N6yu;p7;;NP7nlSk*3gd-9EbeKti^nV$);*{;wGXQ37+LH!W+?rE$%%3bui8 zP)w!=Y(=G9g{oCPwO$6GKu%X zK^3k)Y`^#f+mwWj00Ow}T^`rXj{rQQTXWV>*ZK2XQDTaIP#>_qZys4`40w|()wfX7 z_?bnzw8P^3g&tM9WEZ<{9uODmRTntz5b@9Oq+h}k;xn9ZUJ;%ks(_`fYXa( zh}y2r1#%r=yOnBwAIOCt=2ngt55~C4m2ZhLv7RGCG0J>6HKKd7&LtpTUle3j%!gOr z#A>dFzIH(cSgls|UT{EX-j7f6>N+F9TXAT#g2k#c>RtE2g}J7?+Ts5~ zgRN5fL2G(>m>ndw6$8{djgtje*{TDLbW)6fI}^3eU6F1p64U@20<=lcZv6Mbwb3Nd zk+!4N`giCgq907Hk7n`}PPy-PR@URVa8X zTkwI;Lh#DIIR^pW%&D;2+=?Xz&Ct|$0U|POowliqvE4{^tAbb&aoJ1*O|lb05> zwxeRoGM5`ohjmUtcI?{vt6;RcLwdQ?Svy{71w>utl`*V0Jc8; z(YjM{8{s#sZ0^~OJ!T}Q30kiR6+wDmfZr0MQ*j7nA{`KYQa`X;0CNjaS97nM473*> z$KSGTtO9@g*XE^Y-Q82@*fDO3&wgm#QaM%7(2lBDB)J-SGx36W+c3r3F-g%$lTMHd zCg-_0Rd7BR&@>^Us;n!fdcA6#3s67kT4$TT85bxkJ2uvFkh1bZCWycO*rN0y7Y-L# zeC#)`pBRq(#^K;c8R)4xfjiTV&!c1#3`11Apa%4z{sO9)4hH1Bp~P*A>MH8NO9O&p zau$vdZv*q_G^E)MV|~;-FOBAEJR_ipqT5_&+D%sxDfWKDR>?sC5p`Y`hjvv@%bW9I zgW~(rQ4YKFc@yxndj5x_-n`asyjRz^8SuI=FxZ_Ydf{A*vyX$1XWTes15$zvq1(-7 z@eN0&zjD&_H*aNQq%2gpeLkK%TbEmtwgKboNjf?rHkD7nz5$=<*`Uq_ zj?iE20Xnk4cjeXqp;ES|!o72woSOMP0_65t0f^FAn`L5<*(e3RX(0iIh0nQ9SrLue zf%Ky_sA8CwosaFxENxwCK`sN_rFNqXkHvye4djHs8%O{Gco2^B=K=f|DgsF;DRUu< zuUu}cH;|L8gXJXWS#o_jy4C$=3WyC->kh1&GX#hv$sSQAEQcdL*o=sMvokry<)cNy z3jm%Sn3OU1sHSQG8vgdux;y0R3{GkR0;7$~8WwACa_)u&S9581`xCJF;EFAEg zQvzVJD~pBr(drt~Z3bxUEQjfbodr;09J3pkBsni|Aey#LP@h7gn8%UPBG6uul||@- z7^L)v9wud1%Gfibuj{c2>lO@txj#* zV_DCAY}0saP+R+7qx2&u=NPrW96|ra-_XrmW|3_^k7OR&)PwNCNI2&5=GMOZzOW8ktXaK~=`ms>K$H3G$>zHQ8s$g(mU ze6}_9wk85=1)>GY74Jha25($x7|*l@l=`uqG%i`$_8BYv%{)>oV)z6hzoXWz;$(B$ zI+JW=x;fG~N(LY`OH^A8lXx4KR*TS>6r%Hchs@hrbONVYQwHL^X= zM2Z<^%_O-zn5;TDh#0Q@#;%$3yxS5Km93xe;&WEG(^3v2uZw+{u}==2*e>Q4N^rq| zNU=x0^dWd5m70|L4BS4iGk z2Sfwl<`o$O#Z~qk#714-w$*EZ$$m+ECosmK&e{M+-6M~+>kbSlM?rPKoE8GC1WW-f z5$|bAx?h_-)T7LQkdAfQV{Fjn3n#$l0!O@kzSguOGSo$BQj?NzRf-oid(5O!y*|F~ z{1UCg&1XW&_=Qmja$?MKzXya0k|PLmFgUB}Cf{1-?NVQ@pEPbF#G(oAFh~`2URkmh z**_5L1K$efgn0>!6Y;PyMC%=atq=hVCI+8hsPw~VW2xn1)Aq5d=Y>v-s{;ez(QZ~4 zWlF0$(&SM3kkMJtvk6Th3{siX>J4#p#_RK0&p4+}$fm6}I^peAegsGz&5O#PR-ae; za-9kbXE1=Y$?rJ29axMOvfu4gSr>{-9D+~&Jm}C2iNJ0<&k4&zyV?Q zew)0bI!Z>LBcu{~V;&Tjd+kewv)y@LGtBK+*M847C+g4T{__G%)9R1S4W+qha$)s~ zbgHDhfNLTErWL@IG7|t5@h+9~2_ejJCWt{|?E~|{eyhZAWZTA}?0qj=7s#FyI|*db z{H2lUKp05wA%LB7w3U^rC14TiIZiM@>UN+KoG5_9&S~uK?9i$VMW5BX+`uLRxpjOK zZ;S@-SI|G}jGbw!FCg<7?yp=Fv29dkI}f~_cxf46I-locqmye<8bN<%+lzcogen4W z=?Og-dWyG4ncDZU0nbVC`lY@ID*<{b_4lSyudF2yAvB>nBe4il zs7}^!)o57s-1-&qkalNwS9??U;1HD>h-d-apjOSFi!z8WVW#^+>dwLFl!){)s?t@( z;HAH*A#)-*A=2}Cud4uS^-Zd;I}MQd8{2}yoVh#DMx{sz$C;9VVJR>2@RVU8Bb(?K zH&Civ!>B*ekM>)qFSVO>Ym<%}%2C%O6BIq?-)QLDaZp9PxQa5DL%=~u5^W6-W%zHN z8}2%&D$n_fLP&i9k{NR$N08bGe@A;wI-W+qH@o5E=~`i(0YZX#S>?p%Q=9Rtr}=J zB;HWWAE;tdJAWBxLVT-GrO1IK>0Be%^j!eQykcc@YPULSd?T3iMGSm3xMQm45C|As zWVh_m4q9?RXR23UhOC7aj%}vtI!c+m9;!8gGP64h1ELH@!}gSR%@MS1TmfErg~Vjk zcZRsAM<6KSy=qfJ*L(AMyo9N#8IyvrXEqW3<+qSEE`E}>MjO>Cv*#59jCd%4*sl`JzEJlmIQwr#v5YBHINC>hg|!GDgF0ow3pWCsdOR4(ygSvcCd zxPSdaQ?a1&h(5>nXm2mGP?QDOmo7v2&VyQpxCi&i0>=SCf6lJ(e!_(u_6NZF!7NaYAgI z{Wd5>#MKO~Qa;5T^a$VwD`}3TEhr2Wi8cr9G|axb=?WkTy~x3>GdFmq_O{a+;pfAjZqsVtk}&h3-11wfKJiN;{qVZ;nUsEQ ze{{Ae2M#38#v})`-ls2dTT*NRDfKICtCzh!cXk^%Rar6TjrE50ogMJ0krf7orbTB} zptURAU(%)ItR`8jbA``mMZ26oXyA(itUZ@P<2CYpVtY1Cl4>2dYpn)cmEDj*;zc9u8x={D>nwLi=8~Va%4EHaBPd7%GuLzDJi?9w?`#}vT zHFeT+rjoY;&h|nt4LO>91qU7_XXhdMZO`Ur9!4MRxkuYcs3(+FfO#%}W5?bu<<^?| zN{&-xi7hixzc%}Xd!9vP6MUV0UL!yK5hF<3QjP9LQ{Tu5P>PH&z(c6(;Tt#ZiA_!MB6Gx zHo@u|>1`SZ3ks!t+GHH0-VFvUzz~7K%#>JZvG$UdN$s_C^H>FWV`NhJ*v=!WM{@f< zUY$OSu&j6;){)fn0nHP&X>Ehj$=aij=F3&~B5GW4I{07M)!u-fPmR5Ra?dp1no%w*lP$e^1L` z(gb@6uq*?aUhs~NOLrZg+S+<|4G)uh3irUyX1TbZFb=6fN*z2(UKlCW}K z={|FJ{4XhrZPG}+=MUrhHqUofxRhVVeW-A zH>H0Uel`QZ(M-eRf{wXiv@?O;68)5byjI|&p!}54P*<(f-o&YDbkKEtwH<}60F;;S z7(gsl8i?1}y2DCb6|mbnXsrEK7Hh{5GM{@ed!t^4&)66QGa3R%m%1EC)M682o03!> z&3-kg$*0j`6Rcrma&#=a^-I0p3bzu_oppvNMMDV`rt=7XBalX$&XZ;yY4Fd$vGb$W zJrxvPhh?gLMgVxbO0v>wX9z;qvOX0|UYg^}iuNtVzB*a^6a1)GrWydRj#P5mgus#W zyqqZ!k@_ZO+U|t1dXw_A7*;w*x}#Zqa9N5~S%MG-)GB=r=!}NS(rL%8H?1-~#j)_o z-bSo*-G?8In9iHkRv@H`N(PmXsDr`dRNuQ{y47Sp_P?{7RcEuoNSUW$y+&Zvc(JG} zwQk+2GMsTjj7P|ucQ3yCd@AEI1DJeHh_{hV7SCm?Q;b7B1fx%p!+&$lG0)s#>KwwkR~JXQ52?wz`I2 zkaVoJ_v~ex&aq4_{Y(9cW$-5AlaK_q8qZ~C0NYh?Ov>caq1$YN0JayD0n(x2ee^8 zlLJEhDACsPZIb@Y5oKkxa^3Km{}!AwF^;)m86}OQ(Pi6Y;;^7?Jqj5$2gCHQflZOg z@9#GYt2MvrasevHS(tq#LwTQoDxj|8zyktJ;Ap&cZNjRS zo;7Y;2}WrJ>#;Ht0FS|qlS%bQ+mndDBsTmT4SiZ=Mm0{6L|Z+^Ni#rc)yDcYWq?ZD zPWfzB8PAOBVtb17GtoHM%h~M7G?f(t=WG_S9N^;dB#AX}8#A2w8(X`)zw~9aRcM3@ z++p|C3EE22Dh?m|#%?f^tu2i{j8eK~ip9CpuVeHjKz>IAk15GmpK(pyd0M4MT*l>s z=5Z7fm+`zUXjsiKwOB0lWIWs*RXS|RytS@F?d0j<%Q~aDMEG|3S|hTl01?${_Cda* z1?)d6;D4m4T^?M>wEVp(y51Ssrt-a~zD+Z_rgVj_;B0`%R&+UnX#|xOT((vmDDCs@X_9({XmqyRabH&^YzEZvDnb3p@spx#FLM1yD>MxH zh5iq2R}Cupd1=m0m%sxFzH!ZDWsY}Q*dgT5S(~+sI%8t44po9=?NNM_aI9=x%;}kY zyIAd?mYaH}Ns_)U5q++^YRsx9MAcUiAo*NSfMbpR*L;E*77#EROSa&75^OP>X7kcy zrrIk+gVC&dVUf^7S^nXUn#n`fP14jADu9u&w020?YKDI2@#(a^nRh|5t6rAuX~ub> zjk8FReoiE)AKdTSz`*e&Qlu@{8LZHF!WDV@!KeO=zzBuYpwbYut)?z)lePu?0OKw; zc-uBK_@1poGvfzkwr;913_s!&P(rus*JxNrWsZVJN0%C<1US%f8TauGW>+^_MlN}q@%Qd*!e15KNc!mP?l}o_B`v{y$D4^ z3%{^$fPc&|ZSPzvbtN0(WqKCeb{poFH4F4+z+Ezooq~nV45IvGBk8vu-ufH60RpbM zHa|?6>S*V{Sl3#0v(5O!#sLVbr}E@>i=m7nf3%vgEUpKwZj)v;ps8>nIn zMq%Cr@!NZNaD*5eTUyHVvck}8_)l$`F0{AH)>RaDl2{%H#}JRL|A55!Hq*n0E7`_E z=qwfRvCXRGRmeerKW-Rs$)?0qWxHa37B-deC`BQ46 zvFoYpY23&jF*CgzEO(odHVtv(LSKSk){ZK@S=d3t7(HwzBDMZPC29U{fe4n!X{2}r z;B5=d5~yDn>0kQohrK$G=$Cl5E`OI;v9&bsEY0Fj!AA?0uV}48cwHWe{o}oVpp?T6Pq<0k3-P{(wRIgKg1+O}5Eip16G8{_@Vu=^r3iHRfkjvy!!jnk)dRgx` zF^Zft%eY-+&}NRl1cq4Rmyw+v8T+9bAD&Cp-=sgAIi&}5hC3~ zk)@Odrv)E9@H*1;!*BxH?MO#@zM*vMHtuoJoBRHfbl?O`B-S&LZu5oIW1m` zgi@E7OY|q`v-xE=h$H~Se5S_@JxLW)w5`GTbt})5BYsTdhzCx0L{b_K5Fcbu^KB__ z#Ld;i=15KwDbW-&kYa+11bd;fja(eL4pdVQImK}4M_ zb|_RUnAKUKI%ApyJJS@r)^NT{ccjxRqJF_&r8C;GsBbHB7X9~earrG|EKAq@ydnrd|@@wT-tw zw?=LY0$qV-ejT$kQqC`A8cpxvR+5csU_%=4f7HXi?W1h>2vbaK@yU@43gwJdgt9u& z0}@7y&f{_2~z(Z4A{2G|j|9H8{PSFL&9-WgxKOq|6q=>r-pN3I0hzw+ zfF0~qG4g9mEwC$uqw$)|InWu3*%woNeZ+1IO1hDO66s3r8BOeVKAW>ABGuV!*izSQ7)0_` zsH{_sXRNu)zwyGS7<-7sZ9bI`b)m%TFGEkO0j>ixk7KS&^tFq)z=skfmnNeJ11$rr6u9#19H&8F zyZ*D0ZB)HSYaB4pm@R1*1~=6}c^#%4*ABs21Uyg$LZ7N^__*cvhQSBqXL(7z$vY^= z4#RR{c#_Kw>lNOPWB-ns7FF~*!hHdY)@wkoaV>1{s5}}z3~YV;J2+^qpkWn15Scqp z?P?yYGA8gSe)%IlRx{BzYxF^#C7OVcZ7X2tck8~}DF@wQaU^`tO` z8n^%eAOJ~3K~%AAuJXd>qCK&?RLdq53?J z1GWOxRf`Nl?CimWohmmWn7$HZpqoHz$Vt6L$CWRf_$2pL?-}<3TSfmMu|<^PD9#@P z;0r_N^6J4IiIZO5Zv{Eb<&Q`5RqK_Y@pI-C6IJ-nAfH!=w92#nuCQ&ZRG#Yg02kS= zc3Y|g?5Z!+DoZ>Y=tQGS`S*s=)}^5#5*iO9KI^8qDXXlUDQf=_hue8_mQQqEghVGf zbB%pnG?Ov0VU*a|4~;7+R0(0k(oI8s6`5fFSxDBPi!`*=vEC)h(b|M`Sa_`u(ET{> z*bA44a2|~g6AT|l8j-Dtmt}Q8!TuZ_C~ngWxf;+dFKzg~DQ{==jv+77>PP}4d#q@2 z*!v&aCz5`UYHu`U>YRW|z5VD@bf^dW7F{V>J#I`hu-i0NW}K2P?lO)Pd(b=N^%le1 z%R#FjNRLvx8R!lsRb*sEGTZSzZzSf_dR71J@kSVSr~RxXxS>`N*!c0 z19S-pOv8*j)7Ox@^h5hJECm>x^J;*DcdE(&p}l-5CS?Hs1fVTP4bV+8l^2VF*wRoa zGF6aR0dBope-hx3Xx$=I03zRtixRQ z(2Gazjed_T+FY>?SS4a(5PQnwZLapb(6d_E;qRC?ro+V0mJ^p}%rupkdb!eJkR<}K zaEfh_syr{%=JN(^3UJ%#IzP~0K)+JU=K<Z+3b8524M=K{%&W)@>VTEq2yoqBvqlq3oG8yaa zuniTh02sf@SZA9R`q%Qj zDc?A2OL?<2uE|>S@x=$6d~1+1$R~1x77&7#ho>1VEDJDIwf46`)4dPEf4d(BX~ZQN z{MO8&s5t|)O=%s7dm){Gqe;Wn5TN7Tu>V^C$5G1sv`Mg3S*zgaYuK&Lgpu;-2`Y13~O@$kZKczcB%d5HmA+~dz}kKRU| z6?ofb0On$#S)0&=_hAl$+}0IICmXcWh%qNx-?) z9~JMWHkNc`^f3Uf53%vIf?g#$bI(nNM?4ZY^sP7LS5S)7w+>nU3Jhnfdj%rP_d{FM z(YL)w?P!&qX(|VBcLdPMk)!N&#N zZDmCR$51ARO!Qsr@9s3gqRg3o;qn~iC0gQvfbE9V2tH8v)Xz$9Sq{1L>qIA8#q;Xg z2Dr1{_rljIhj!37;V7-LULDSfWZtVN;F_JTGKFFs%mFaoS*D8%{OOF7_cJvPTcL`TBfc;rUDD8W5kMTU&y9JG_KByRO*$4}e_dPK z(6KG8YtzwpV~ZwABOm#V4{pr+o?n08rph+T!AM5UcGydgy0^tv11~7|ibrIp-YNuQ zl}O$yR6kC!8#Yzk=uo)T-o$%uVqN}$VdgYm#V}Gf%TS7(?RhS)>!cZ9sduy>>@cu#V_Qly4c8yeZbH|+9yt@CZ) zG6>T2K_QMod22ug+;yJJRtI-n?Is9z@uu<<6jbv~ERG66a>IHN5|lmsXj zf6X=GJI^U!^mk$FhKs{kPVL5%?z%!j9v7D{k~0at1Bopn8Q^A6$T7OMx8W$j9TJOv zN*dF0qf-Hd1ehHisgoPdcYr>?BE~UaBGO8{L3Li}y)6vTytwB_|AkC^398ig6!GHA z$_?jmt(?z)#5SwkL;y|=RbzZ;0-{o%DU}W0)y7E=@G7@~eCw}YeHoo2-dLd?D26zM z-m&d`FsD??)xMKT3jW(F+AP2{RFQT_KIR_VCLT*mqo80f2mC4YrvQ1*F4&=v8%@72 z?R4nvSm=mui;{^{&C^;+@v`WC$uw?Z$GY0v&yrRGx|N-_Pl<-C?ph(zaV~UXYcCV=<&{*{y-$5!5~UzNWn#=;uk2 z)J=z<4aAv2aBxB-u=4jG-7q%<5AxCc?bAB>8&t`vApObqZL72-XZ$=xLM8K+O8^7} zn$O+?2AWQDQ@^64sRgp}EI;?d$qo7_hE*H7)$36L<@QgC=(qARkV8QnzGRhMKun%^ z9*wK=VSG)iXgWhH=;AgBmk`at^iBq>DFOhBKy|;b*?B@7csF@=d^ORb(i(}jy1X37 z!B!Y9GK@A^SeQW3tQ4tlCbsP_cbI5(3w$-r79EO=sn0``r#RGHS5ycr*yw0<(#MOV z|K|KTc(!c|i0ClOAfMlH!>`e2@qPv0v-Yq#(obYXJzrrQs`c`!Lt=65nhG!xZ^arW zkOaWb2?V)3W`IS0T^0e~j^Mh{bYg9yy{@%9uRJ1f=iI6C4ivyEGCH9Z^|M}eQq6%& z{iQKPd%(7KuMix0L0XEpm-(Buh2|7*XA3=OQTXyXwhVGQ3`ZHwb)K0 zm4}5l>jG#w8SU%JWGBEyN@A?SnaLG6ZyNm=O~=aWD2a>?3y-O6y7a?N3-k>7oxX1x zpp65#KK}?DtpnzJYiheKNXK%UQEKyOs!fXG*q*Hz)q6B;g!-UoS$me>$!M6Si5IAh z_x~lQpjAG-rpsxRXOyp{H(KuWo-XF!tjzZ6Z2FjVpn8-_XZwKeV1n02z9lLBysYSe z0RN*3+bFR}A8F?cM?8X^4BJQv4<0$r6XKtb&ae+~Oh%y0OB(VrtKkSGfI4?w)@Ti> zBWIx44Oc-ve)S;)Qm*~+rW~jtJ6Hm#*~kHMfF^#MOadMDvohb}wh)dcmxF_ow>>*F zpByw6OdAIb#kM}o#=S!Sx2~#ROjoa0Z#ohlVJiZg-iI^Xq)5@|J_HiV!V2 z6l%Ph>NYP0q<&^@_1+dvoX2*jIjLcz&w!ZqIs*L}A@?`K!Oy&~Q|h2^ zEidDdO7mU$@O(To8^v{*`iOvu`19aM{nv(yF3|T99c>MmPSI@J3e_t_*A-$->VPMp zz7gCdXOa0#+9ddt6`;575r5A|W%%DFIzJAk_4Y-Y4?Jgv5J33X>U?n9jqLH581~c{ zK_Y2v8*SWotwVqOFa8i`-g_3_^jkmaIll0#e~zbK@+5xtfA~8Kvx+LjkpbY3{Kkhi zZ}*^9QrQoD2mr8qXcs3xaSHa|c0Mlq!sXaKwAgU)#4Z1kB|mWJr7x&&;pjxzra4c4V>IuONDo=ohm+ zU+JpOC!oCH*F{eNsqbw``qbolb$*W&z|`#o;~Z?npsj6-VHCzjVugaYs=S+SLmm<-oB#u{QCQ_I&Osn z`wrmV>%W69{{7G6O~3OK*jepFo(f#&N%7p7&*JvC-iF)XaSLAciEA377CzVJjmhtM z|NBx`+vz_~io4$UExh6P-dKz4Fy9N6T2R@x-#Trt`1C9B<^S?axa3QhVVb9*U>XnE zA*hv&2w0p*N1b?UgekieVcez?oA6n#fntbK^gsP(ih!cgvNWzd4|ohlG}@#kbu`pj zl4{Mbacqq)94zJK$Ri(^qg(9?T3hT&xF&6(Fngxj{)YIWNv<1nlim`WC2g}feR=)_ zMP;0VpRxblfWlfQfQ*)JouIK@R{mt5rY3m7f=@=uisjo@=rAe(z818tQdF?JW07sG zV4(CfBD?uYP6u0BWxfIyyD^37vu! zoQGEcf5Y*-qE#50=S5vryl`A@6tSK=ag;J z0hA8%N`Rx<+!W0wnk`>pVceGEI)o%iP|vW{b}azFlH7xFvWUiRC3&*9Xp6wENVS8> zT_0(sL%p%!TiEI%hpvs>p4Js2x6eWBL_G1arjai{#W{(rQ3(Ul{P2Jal`qZ~SKDl- zLtDrj$@ZO}+u0UlL}F5P{?nNkqphvnBtZr@0OfJ!G1-(Rj(qIDbw3__)qMbfhpxUK z`)@nn`_opqu7U1pVrqRe*mbzS_H(N=YM!383jWc{9>IxEos2Ud+_!xjdrUg`Zz*5>u$bq}2lwH`r%%Rr zFMVXMMD*X6WN!Ts9$k{=?~zpDWi1Md?*EccD4#*2=0BrEYM^vd0=rUCWd#nD5aM=b_}@qT#V=;miX2wz-cAb%24n{O=Lu`rOBkWt~9o zrXEK`S_j|5f^fSIDh3h91k$S9#dqsS-j6QCr|3v@Xp-AK1N{zT}|!zTfbM@WsSfb z1mz~BCScbJV{9oQJ+an#t@Eb#&9=3e424dtTVAY`unr4(5s3ri@x6@cG)*}#VjE5R zKea)6!N)Gf(8m=l19LbY^$phc-Sa@PGnE(GO)_DUl5eWNN#X~3nl$Qa_p>uwT;|z< z7yr5ZCN#%v{uqCx$}aI9G)_K(YA^Wf$C=x=&&vUy;yAk#&;zy5K{T$sJI(E4D59qC z=7346FDzV^MRO#ReRejIbqLRD(62;(G(`C&|HD+Lc|Ze^h&_hf5N)4 zUR|)uTUuWLerr&v==_^5#H~MbGcNtY6?ov9`|*lTT!X)Q-95F|QtcyGK7_m8{7pQ4 z{!`fb{w~h@=6<~L<5%Oj=Z{C3f@L5-`kNoZPyNfE!OcH?6TW--Baj)m@^e?=;=i~I z0PxY@q^%|kTZ10D@4UOF&&!l;(N}) zH6ObUCmcM%^L_hS{`o6$$yYAv=(_Nhm*C+mAHuocI&XbP z+f;4Epa0rtaN##D!UZ>8h!YQ*l~HK|p0cj)@nBXR-sG{t*OU(c)VBpK zG_)WyqsP{E=L8T4PUMhKcKX-?4y2%Lxpp~aAs^|gy`*(xk@?(ai_9foRfG$Nj$_JN z^c7fG64*rW7!NVnCq`?dEYcYR`-OQ}|7oLm(YR2p{Wyu{o<`dv4%vr2V(4*$CzyVA#OcH>`L3qt;NSVgk{?0(zn{V_VUbz9E>pKKyP}Ewr^j{Uz zv{T!Vc;5i(n^A?MvJGpLfnM;A^|nQ{ZD+V9HrFvrG7xnuXwgK~>zgQ_%eSh7IhXOp z6yvSdF&l&Wy~QW~-5eFz9EzzCK#Tj3_s^H@Uy-*=0XjV0l=t?jj#gSl;&o3hLxSWu zmT6qZ#oxF<;~6))w)_3zX9f(gyFAz!+nE9>Z7^sw#Z=^LRkptQ>QG5jCEQm9jMaIW zAPt84;o|5-m9Rv6oEyk8niJ{Anr}9JUzwvyTdx|?N{8XK`#Cpbtx2vY=&qW~d7S>~ zy5Ors*0^iJC4glsOWD@-QFHt3BRS}dc2CBgmtJ>Jfw28cyvsCrxMj^2>0}8^H`7W^ zXb#HhI$&W0!{}_4()FSH{_1Re|CHzP$W;&H`BR_A+21+4p;&Ow4R_(nKYa!E-FG%t z$F1nsOK!Rl*Z$G9SnVk8e9P@#)w}z@6bH{bfZN}33(ooGd3~Ny z+7p&2nV-DiDZK1!FI&ua(>rg%HJ`i&XFPBw4xM-ix4z?M-2Brw;Ynf?F>1dTxH_O}P4#*WgU6=j}J+rgzq-NN4<^IeNv!~p`ZgX?anR_)Ucb2GP}@Rvvho%) zVn68&cG$=BQ)wL4`(w2XC6I8WkF1t!BYm4kYRMo4%VOwQcNDq*HLEWu_$@q*yh%Pk z(g$YCfaL?Pu`LUgvlA>5&J`G4B+nXm;Y%&k_qD7BOj2HOR$g#tU>=xurn-eE>v+uc z(l(xRbxfoVvV%Dg@U9t`!D?n(mq;%KXVh5ivRQ0LmWmKN3CCv1z%ZMfcPww3bX2RW zNW<`q@^c0N!XYJ{%=Fs3?Alc`cXm1%OWztzh5pCfu-Dx(-p8~1B^PgXr&ZP6K9r=e z*#=ZA?am{?rkXU*seJ7h@BUbqMvFPSsniUdf9nOf>Ahda`L~`AnR{V*!~gN7(zXb8 z4(;HI&%7L;`S1Q@*x>%#F2GA}y3iWJ)qixI|F%gE0pNz;wS%^$t*bus3ViCHd}5rr z*0*zL7l)5Olz#fiZ)9iV#Dg9gEKJ7DGy}l1XC1`JPn^2=`>Q{89nQSJ zY#Z7=w2P}hc`ZKsYoGStzx{^0aLvcB#lHKCBew6pvvJMGuf^?exve+?m5%E^b{)>V z|11Dyd(_pRqIwj#^Ub&8s?WY07u;IL;H(Gt;Z=WfHNJhrw>n4QQ=Q$o$*|1rz^Nco=sH@>e#C@05r@R_gVU_eCFOxf z9y2){{j3M6r>M*!4_}$-;MZ!P*+!U!KNv6ke1OJ5VCIN#N2z0HAaV9Oq{@ssZ*%lm zsZVicWyjv!Z1nrelO!Ig0@Kb;@S+|(51SCWVX_zExg6IU$7rqv@XUZca516nTA&As z>espQ)AmV9lI1X(3q9%5z|Mezu53;$jjHQ};uqr?&!eYpp%|YGuEPmS8d-ui^U>PA zc712rqdC!$;FRzI`vJ|PRP)J*AZ(9Wx)rXC1;&rvN;ROL?FB#IO_NOo7u2l+i|epq-%ad6)O-1d%}aogK&!F3;bjTKy1DcoW>f%F@i=K>r) z{t$M*f1HbN8y!9U!822_6Aqk!@1OjA&vWqX132q}eN?UDto!%j;EN8Xc29rcj8xC@ z2afl8Ai&f6pT_I{{Tos}XWx4^zVYs_cir55zHy+W`AhwPDGO7Al;@NuPQm4$yAqdw z?n*px&3(A>XKuv3ul}oi(@>|p`U!9($yJ61jd7p-=F+V)8Uj^Ywrh$qM2_j8UZ!np zw1SWob30EQS&i!?#V#>S>3dFFC^yd$^cp{x_a!bn3$58RBiin5<_L44U+K9v6^+`e zh_r20O-7nuw5e_=D{=TWkAcVPo1T_@38)hQ<))k_yE8w%3W)$pO*6OO$xIWKuX$E; z@NkmYKfjt+^}0lHk(h1My%>bCSn-5eXLkSuiq)z_R29HHugd7xNNd4CcDlKu2**G)d0X;BG>};H`1DoUCpt=W48fW-$MS%YQdz{p(r`3-YV@m-ck6< zLcxLbLoL^fokRNyq^*3}#^lk=1V(LCO+jU0tGLmdX3*+jw-%iYh*o*f;o*M#!2pgs$eQzwDzE>!~fp^r@7cg*pScs^Sl z^|`+c%4rFQh$osKWcF54)jk5wCXK_-mQSjl=hZn?s)X}vv)A70lhEDO;XErzT&?4jJc2$D2F?r2)66MlJIwWQ|6_KUGqxFR6pD zm7MaLYI^ym@cmju7dV7-o6orkCcrqzCK^=&MWXfM)Cwr|&O7>YN1)CFmoxq3IME+^*GHZoP8hW=AUuZGD?k z-;ciBk*pM0$-U$;;KzW@j5fom#ahL)2r+hlsz+nbCbKM?c2L#>Gn#*lE{<;BG6mYN5l||+b_o;sX03ZNK zL_t*59Uj3dF-NfqTTwd^Kpzk(H?ov%Jw-RoTKD~fSz2nb^8mr!7zDqPl;uiW9**ak zLfyE}vpH2Z8EQop0F-S{0a`*Ei31SVD=^t$u+sud@d>90Th72f=03@kl{G4?j%E(0 zxy-sQp_@by0qx*nM5J?)rEiXm;9%CPMmQoOb)~3A)ssr5=&!*9n@?hWwy3&L|79V6a!H~$!5OyGB*BW=v=yn@Cxtajko2EqGnMY*p| zYo(_d3aiIgehB^9$^{zGXilDiKZJz=XchF!6iL*@uQ0!w7*Tzcw-VNZT;>4<)?5w9SnYSU0XHXcims% z{M#;ATmQ~#XKw^8rKEe~z}?ADo`Pr3KH%GbIM4d(O8HYBKNU}2@I>0a^W+6j;FRj% zNS2_E7W;hWgJ&IPx>rUK%^#l0cc~9ZR zcfS}{{D&*B|BegN8G+G6J(8^^>j1v5RFI=#ZKZTnJ_1i9f}oBJLjfxP*jSCup%^@G zTU@JWTxZ)rk2={Zh3ylQzvLernM1Iytt{m33?$vmQNWReG>TrNGe%vm#u?ypp0D{` zn?uTNq{(?ta-z*&J4MR3e5e_T3b2w4)wlUt)ZAI71}3KJNYv;%Dmd0MRsy^Fv0R}z z&zi>Aq?zC5idqM4MuEswLAUi~^19~=w&z))vdZAF((A#2#7}T8O2N-OA7cBD14JNX zrdDc)Mg8}}$T6a`C_G9H%8&y%pC;g9X0jVfFqn+%jw+b*t^n7Fgl*2Wwkjx)cEL*d>qR*0%)8p1 zaj?Ee;E4;K#4A5}%`o3QDV{r{yhq^NZ=O5Mv!_Igv3xCm&wAiYJbuyRog=Whx>Ekq zzq}MTz3WC?|KZo+wC|pVXU_c|ZvN?;aMkBt4j@27+Hy1)!Ylv$<@o9^{71avPhW-8 zzI!_6of(h6>`{FC4R_&h{hvRP+J54tkK?TS^Ohw~TVTigue%>Fx$#0=_P@>2a)C}+zZLUoVW050=t@S=OY11ml#`0U{OA)VtSL^Hc zNEilr2_(}eABrWy-1@T-hX*$NI9yjgj4{guZ%cwjq@5CEfTvM^S@E#XL9+sovWeX{ z@F?mwjhe}}28qA{xyy=~Q3Y13l_LP#i35QjrVMk=e5O9BmU9I&0GTlB3NRz3%#sSe z2o$6%Qpu1R^Z0k(hSP$emNvsB{Jq}und$INBT%!+r72ZvDF3R<;hLzvhFl$E`no6F&QoKZSW`h0`B81F!zzYw^W@@HuKk zJ^C{CwEM%m{N1h+z5atghMV7YBmVRsmbT7#=nTB(L$Adb{_D@>vLE;mb`I^}lqXNc z{@c&Tn|}Alv2$qZ@&LfJnsDOxPQv~>&c{`sefe@n_mZ0aDHP}3u^)H*C7Dm539MaZ4I}!(Ao0S!&;b;>p{WZCeyK_Ico`lG z2_AHd3u@ptTH@Wj4zehp(C<9WRx?Vp-kb&h&9(;B=)Z$sQ_50axMeE<)8yB2I#^Sn zfcn|{8)i39iYoj}KoDr19e~Zso4KxT*sw70YR9I%DTkk>yly|$`<h(38#+4%^kFW9E(de7wa80V$@X223PqBm;*o>3 z{Lwt`0c~~)ddF+DBH(Q%{i2w7t|jNfvXm;}rO%XPdV`M=x7hcHQuczx2yl_ie+Krc;e+9X2|m zbu_`+&zou4GT+f8>flE{@S)= zzWLZ{lOy8DNW-c#Ag{qEGp}|vr_rZQXQ_X-RRaT$KmrlgpZ_O4MeDX~Xdp@1Nn$BFZ}Gx7EwwY<6B}=Oh4O=pTz{y9nlTQ2!36f#rjk zh*;^c=RT(!AhW%yG8!Aa1)v@_cR5$a%2gGm^!4 zM2;#K6eztsPiYKj#@g80XYDb7%f=eL-`N{!{&LwQ8*%OG)XIQ>hcg(#m9!+W<7e%g z8cKb(F>a0QsB`0a$#X1K)qQ6Tnd{A8dmB5#up6zf#5^3OC5+cOKq>EL+Vb@}HLngb zwypYPkUkzgYKZ1+BEA*6qUhF{WDF$i1x!i76e4W}fb+G{_08U)XZCd4+it<7e{uQH39$M<{DBWH)?@T|`xd*x7J*4X^5}!9f;9Y4ZryFXs;6$K-*w*o2qrZ()vdLlDE@}GPV$}2-#!7JP zH*lYM5*t|Q>5u3;2IVy6>B?J_9B>exLE(VTK^hzV7Md7Hm$G-h%OtZBfRkl zP1twvccw<*Lq7LPBNA27vD5m*VA+~>qnT|M2R9}ISys2vgiN>fH=c$}XQy0=Tfsxy z>JeZt2+R(B2Dhbd+Hyh;ih{Q(&FQVPrrUTW!Fc09Nr<2IM`aK-1g5qHr~x7hKTBXf zxZjUOYQeVCM6;TQT>_-H{8$2hkxQH3#tI;GZSJ3)(P4Vp4Jjk+l(#N2Ph$*}GI;wn z=Y*Eec`Dc(Y%#zD@z)FXPTBwfr{~QaXmVPwjdr0nOx+TN;1SJzs5Lch^!M;vgSp=J z8&S3vRj^G>&)YdQESrPCIgPfWEy-lx_EOplwu_)xgHxI|e7t}0mwv@nr!ml{Z`YSB zfa~;fTiz96XXppL*wo<`L%fh_Lpz(I{Y%0!dcG;5f3#_|b%%a*CCZVSb#3o;8^|Ww zKC7m*Mm2yUWo~QN@q}&D*yv&78Xq-^CO~Dt+-~CWsVbbmUf-z}&6e;x9fOctJB83Q=SVkf0WvZ zRR?2gYf*?7)TlwY*2ZVKe+Euc`%LOO6 z;X!&v*?o)>-C1BJq3teR-6or@{FUGGP|}J@8^uS+Ag}5Knk@Cj%~|7BlccW!hy?hK z7i=N5GqLO?KIOA_*&)+3e}X4f)~F#D3pyA)O3Q#b21fvzQw_hG{1L4m^v(L5+Kln* zw3-AGOXX_|OO8O)%*MQa)SM}5TJ+Y>sUGq+qTL1h7)L=@Q!us)*1Qf zFo(9e7iw?u*an(dnM5>CDH=I8cx#ATXopc)`PeQbsoL!%!x}o8k3Mk>F!wEOTNzSO zzi(J>A6$69a&B|_Vh{2z;t^*3F23)Jf1vq&CxyELmd%N`X_)Mka%YEF(fln>=An}=Pc-W-cDV{n>oNhzZqzr?e*e3q0o?`Mb85jo;*!Fj&$)UxQmx7#_TY@d1=vHCV`=V3a%yz|rM zG&@oZwyivTJ`_+#+lvenHGBxVN|^werS_@PzJ#NewgioB-^gBBqy2AbI{K4L$g%~~ zE>Eafe*%87WH`R`P7H2KqTHY(Lp|a3NSC>CM6;?>SSa*@^|nfQrjWlF73o~5!G8083VU)NTf=30&Ek>Ccx ziSbMvm=uFNRj@e*B(u(bJ*NS3)rQfUH{W=>)z~Z1sY<_TlyE>&2VN@Rf&)gcsWUb_ zw*tBpiO1V@_P`!x(oJm`bO;oMr{6^xkQd0twbT|gx&uFqoY zVb&qd;b$M{*};2jQ+c#R#p}?@L_xe5D{f5EI;P=d0_A)F2UC)>U~))GdR<^~1SnJA z5?7SA zq`q?^#I{4x>YGHRh7AO{UI86Acish^))%izZ4hi_0jbXRD%0A-#%W=jRKL~hd`FNi zZ9_vIgMuGuu2En54LXdE#)ibskBG({LiW5Jf3A7x1XKbYhnXH7%+1Yd+17~W#$%Y8 zV3vf`jcr(Koa;Z^+N~ET?Y3yd=~_paW+r>N^fW88PGQUVZ!SL?zM-USJJNekO}#nt z)tITuN&~lxTT_l1Y0I55;6E!KzD;5S zpBsbe&$NAL_14d8=Rza(DT+iCjr2j6Nbxu2d^RkwW{JLa&po=kFvYg1$AQuy!>Gun zdeW7X>&j{<;cRe%=gA=*sf>XR>z+}$e%pY7kQuPI>sBD9b?c73Olx+WLR)x55{*Si z8hEjJ2Y46lWnC80wvFH*WTPbO3#S^QK_Igb3 zQ3YB8y3_NRL8Y3uj;#Ch&%yWf)aJ{ubwT3?BtGRcBE0dBR~T$?7X*C)7j4>c;rRuC zZ%c(wNmI4fN6>d}H*F0HptepKuJ6No;Pe8dk^cP~l8$CO(Kh*$m)tkLR``yDrXNM( z<Mdv^g|TgFfgsnlCf}yi{ubp$>WxRV0wcA2wgCn#OWrtO9yb@ws`bsi z1O=NdTWX+E0@`_x?BJ)+oTcex664$vK&j0^$4)Y)zHi%VqZn`s>ab>0NsZvBl*eY7Z?ws6xoQVlKR^F{i05jip zdbeQ!VICmpC9d2FvF0NybfRyV|%TnVTV)y}9EkI|1%*6OR$?R)?~U4QM=sO}L5TQ1)9*PABE> zzR>gbb8mM(x`YPt%E_%`Z&ZCqd7baT<2XC{|B%9$5>Og|bqObWkilDEKIQvr)%^cR zI)y21J20n#Gp3pu&gUC&{XAyQRo>YV?CL)et?`X}yyNrA{%p{SBPI~b4)jR-OO^ZS zq-Lwgnsc+0_A_|c*)8_WOw3m%@d2%Ln7#__03dGl5r9_yJ&(lzz>dH_!cJlR8;68N zMC_B}0ITk{4%c;L0{ns*eNO)HZI4*4nP zT|~Bm@r>(2fqW6bdq14piNfxYwg8Z+GZFQg*e7*n3U~EfIT#>a!LqW zJi9EyQ4jd+WDnLm{=qv(GGY^sBs5#+#O4r?d2H8MTy|Up zTw4E_gA)rJJUP7VLk0^N8y`Vg>Q!N!D{q<@&wtH34se*MMW->s`1W1 zwu8G~{SN>`7P*RlIa(|xE|_TKiuL+d1n7=K%RHL=J%NpP~hOR;`kje3Bn zAt~iq=M}0Jckqr~w~_fqb02H<_vzeMoh-QYLk=2xfiHD0z-@6c#MVa5aFXmcfcDB? z=oI&Z1NxN3stCH6I|&vxVT$Nrz28O+PcAk2Lv?*iLN}V+3g~trzvYVIA|U-!z}6=b z8vmbqn9qaUwc{%e-h$(n?Q}@n|48tEt~m51ZBrDN2#jPCeM&C=ze>+Y*t>f$Fs&LM zyP(zhkiMCGd%e%9Rn$vY=#Yxar4k2)JEuikI;aS}vjJ>m+<2_e27a*s zehe5F&w1!`f(s(~;W4bJt{(+Td;O#ks9P`j_{}OJ6`ZL0$BoKG_uNplmwrU0Jqnsb zN)oBWpOB3JZ0Bx`NcLgFWCR#;66{{*!A(VWK*)2mGwH-!D9eT)<8ck zj4rCX5GI0<9H!yBJ6kHYwDEJhtHUJf8JMso#=LpC7%kNY2fwuz!H|t0A(QxkMNHx? zZxMp6g=|v?oFDE#s-Gvob!WhthyFF4S8XfPv4Cu^HQP`a>cF4tmaT>tNbJDSbmi6ryuV6MWggydGrvQA=6Re=cI)2D zew*Ns^C z4Sl>=dydySHlWx4xH4ZFb7p?S)!j%wks#||^n4q`>Q{2M6o4+<9Zp?3@T+#sOnk*p zMK8Cq1TZD^aQ(e73)SI&RV}jc(0p@FHf=RHFrBwmRpNl~M@-BoA6j`p6DQ@L7aeZ(-$ca*d%z8kV4odTHo+ve*Ra_s%Zy|Cp%m-z& zE{U@QIpmG>e!aM$D*;T{POyI=`CQ-?&lm7E^$7JVyW`_!S^g^wE89ovLOSPpDNKYz zW^!!R@tQ=@_m(nO=xb(4FmzR&Be}7y;z@l1H_b2X#!gexnHS+m%;cMrwj_AdD#Lm; zW%9Cgj&O`}O>85r_?H})Da+1rJ(JVgAk_{;Xj*GAPuM2R7NVeh-3^r8iNZ*XqNYfd zI@`3kX>CX#8N6{>&u$J_L*0I|uN(R(Xi5*WmJfIwe9{6Ei$%;uQ{!cPHgTD>esUNOgHBic*l zW9c4Qy+0ku;BfOPMK`I8p+OMee$HtIfYH}fL4r2y9@WXwV`|tTMabt|4(HXhU0%`c zH{H^s&aW3tz{q+MJX`o~Ram<#-YeD3;V{Y9FdPn(t6-sE1&h1H`U*B|MO`GKhCm(% zf5#SJEBZ1WcYE5e&@dVYMZY_bGy&j)>AjZdJAvcK`pK(QzDVD{T3{FWrxr5Ss;T&U z#t456zW#ZIvSqlzu>YMjF?mqP$p0rBlwSL*bhmQ;2y)pVbbxn5_jjkq7`PwM`?u5c zWT2`KA9oZzL;7jg;d!^9CksEFPxAM?@>R?4e}8L{0T{@U{>T5n7K?;cxY=m?CU9jmdh$hCHOOvBd@a86=iCpNK81?SDV)T-ig4tn%t4l zqAMVY4%Uhm^(0rkQkO`lKuDB#jR4$y~@DQS{p#d(4c6m+uq-cL> z&iXb*WLV4vxG6vbZ6Xj{c#+y=Dls97$s_?7>&u>#4VVB+0Jkmkj(0ZhB`3Rk(?X7$ zK9vW=v+fy!Hg?cx98}Qe`U7CE(5|Etx!Fc_-iUUF?agpKGGjN0n?Z{=OUF<3Y!vJ7 zR(Wt#p3``2yl#DVw7L7kzCX}+<#uc&@s;(*G>nD$iSYN#;&;EMv=(Sa*^8ISz%kkI z*P@_;9f6-r2IQnf`_m(>#&=u%_~+@a&Zjzl7Z1Ooj?%#<@xhKMbY}$ggFrdozCHf4 z#!rekZ)0gwagPb9slLAHg-wu#JpU*na0D{@rW>83Onou%jEK&bQEIy_b^8Dn7)1phg zZ*ZO=Rb;n;wIk5}r9&2N16{D6SYiVGCmW_dm@1U4nqKi0?TB=SVvrViY}AM{2-_fuc;%m~_+Y$uPrd)IdzG0;=wxa+KJ4Q zfkWrU0e8x}oe|g@^_-H$wpMjxh&jETY<->X0LF=@Kf%ZEOb7mc$Ex^o73XF8Q#%Mq z<0RmZr_;#%r!<-Jo5m1Y5_#aMLhoW=-z|qQ??hn} z-C)4CcZwhT1m$*d?=?x7*0%NgJ-mlX$N`^xD0}}DAkHAziRA_hjVU5@xk6(6pr0<<9twG5%x(OkAu5{~?eKSWJGf1| zrLNbQ9BiT((KqZ%R`4dEH)_Abh%dooHw&?AG-mYV2Bp_(9U9Bb>$$n0To^mDiKgAhNnYJ2Aj4@KB$0 zzu0GTB*A4HQ+sW-E)GxXt6+PHPU${9wtWyM_jhiU@2s3IC*sxnQjbw_cgRxYXHn;h z>*w8=beg%6n6%^YFiEpujVM!<;t~n9h8C(zH&62 zxQO%}fmmhkU&E}qLPp5XZU`&q>YyJhvay<ObH@}A!GFTt^sy?sZE<0Jk#1c>xWsc@j#T`9td_TKEG}c~6qkaA zbw~~nF=5>P^`3W7`tQ}oOUiYs+!r#bpq4Das@z8r`c~xPV}!?y_w{KN;E$#|AIKi>hb+CD2ag3`)%zOMoBY;W zf$poS%H5xTL*pMZ@+v*aWDYgBt5oCf0umqSGjPvwm=*O^xsi^Z-u{OYH=#8r;;}hd z)rY#cQ1?QXh#*NATdLGWoB_%aHSV&~AhUfUfcPDd%&$eR@$2m;bS{U z7qJK(5^f_;7!X=BBgHE)WWKjMZRhs(F@)=hB!GlHJ z3`Au)WieW1=KAtEx#_@Q(XRsVp#g@$uy-E;0ctljDxd__ua}oI_EoEbh--)Zly-59 z!4rct2PS?fU89nYj%tMS0`RNM=d+l(T4$(=d_E?Zid@%K^b->R^*#V!7^+vL}E(JFBT3`|JVNUy)IY+Ps}CNLr-W0I3z#1HjBfsOdv zk05)$aCiwfx=#>R-R$sSJ2c)QbOP61F8=c{YOLH*EPr+y*QEh8(Z6vki)lHd5s^99 zn#_U0rJ}Rl<4~;2g{+}ee3)7@zvS&asv>%=GMGYqEYG;0Y^?jD?a_x2h)`Y#Ho@b5 zCLxAMNKBg@NV|Ww9YfFsBttR+Z}fD_R`p{~AaVki8cN?}I{$9#Yo1sP*0Y~Yj?`dP5zfPlRnTJj9KpwuOp%+x{Z*`P^Y zHx^(>$GH|k-l&rFiQki-S?{=iYM+d{mF(n@@yrTJC&9ul}QwasQz8Jv+&g&6?x1n*YXYwFJKA{B~!JUP`G+Ep;;Q=|2j+e_Qxd8jfBpjZC=`%{pU_H*Iiu`i;qe0 zW{7zY`DLL5RRqW!H2%c&s!Cji8eoffjj9!6Hg$0ic>}>LZ$xMhaU)}iNhI1vZO#fB zb37VCKNCrAULaVhfN=K~?xlH=<5gfe#8M09Qv`p$4@xZA#&nI4&OJS_YwY3Z8m zqfL9dBJwj*erD>%=|1+;}6wDJ_+OmV2M|y0y6_xGSX$BHaA_>gI%1L5BHPH zCBYQ(h#S=ZK>!YcSSX$=73u#Zqg z#;j`e2l@sw%5L$MbjvpyKrgFW{bHHVe*y>=nR}VkC*((nQr?Rmlb@i4eg>_aq+lY3 zk8Ww?D0ovY)uziPzse4Ww^Inrn$&R}*hQl;xV@#eHe=v(r$|H5>I8cC(>zf||KQRa ztkOO$g2b*8YSATEgtc8U$-=k`*2~0V<*n~V>$RDL4jk(bO#JFKv(j`m>$(d4*%&4! zuAW0lKVdgg@0AMEZyr1GnzJ|n=DpC?&l%2Rtgd&HHtXOxrtb*^g8+gj{{=X(Ez#8uw)_7iJ&WuNFy@3rL_ z-cK?6e*y$=pnvZA;On>5h5CMT`flf{f{Fdd&w1E&-lSos#1aiW{;u7(V^@AL7Rtdf zer|J~jhqd9kdsm+=t}wr2o~m4{ZQ|X^AAJY1ZWIikDL-zR0sDe3)oY5%$mUYiaJ0% zbE36x!=T4@{Cf4v|NTf_P5JqJXay8tHsjI(2r@j$oiO6{1>n|ysb-rN6C(g)|4ywptqwDJ+4g5@?6#pN` z0Ohydj|KHLE-FXIzUzGNED$ZWmlcSxHw@k=3)oAY+24S=y;HwVs#M~feXk`Ry3F&quKROIiElod=603g1wt0BnehnX+&uP94Q4gzL- z{gYn=YkPal&k&e=JPy9!61MbK1P9VQ{cGc^(3uA~UEZm0PXCicbpqTK9J?xs*ep; z-r%_JF!{T3yt$f*T?tB-!QVlXf zaxU>N@iM(r2RVj|RePYyyMxV=;WbRBfFG~wq8NYwUjQ_dwX)mK2<*Ej8e>jX<(K)5 zHI7!VONuh6@ViUQRQ@KSiCr`R?UG+}(#Qkg#bF{QwV@SJQhv)mqdM?AY>5gTCa)b{ zVI>1ha`-W}tb|*o&8poW0C&)dXtpJ|E34p&$(%?|l&CK?>0ei>9_m}+awLcLU5<8_ z5G@Q)nb5DLNx6$PB+L#bkla;VQ?^RsR0tDGnRQ+=1hDAIlg&{H`9=FLdQUb(sjF8A z2zJHR({&C(n!E_X6x5cJUz3mEigkoTnMhL&(BUy+MHDTVNGc#^1|ZRo9`x)9@iy`!@`!Mtw7}yjuFr0wfLN_>GBF zNS5R|*@%7Ecsdmvy{@qPZjR8$r~>%$xMb0X(Gzg0JU{p8G$M zcufB$mYxQ~?+6#_+i%Th)p!3iz0l)2sMr*q^UqbyF91x~rKm``Jw#;I_h}NaB^ZaH zW}(SJOa&Mu2F|L=w6&4$XsZUsc3)LqEq%FL>A00=d>g>}OLczVX274BVir-XW@x(aBe$G%iO#@LdRF|h^AEyFo1@+eJW5Yn>%CO$~?`K-8d zUwrnz6Np;ecfGEm8|0AgldSG*>0WuRgrVjqi8EbMUbn28-2e}LP9uoIKJ zDh0PJ+D5Wseh;gcd^V<-yt1=L6?CES6K{idp~O(YsDo^%4hG6@Q+Q=s0}UlWngHXT zpofXjqE)V2*!7CB6W@EtKCJeIw1;W?(|X12emI#Ob!jhw#i(xcLp4?Jl(MXf$5mSj znW=17h3B~z<{Dp}9l06M=sv#B4*1OkpmIdEbzo!mkF(wRBiIsh3cWoi9%=b37a&+_ zQ=89Np;5*lYl|mOsfGr%KIDG?N|0R8x4WmLQWb}ad{yW3F2JCGIUEPB<}!zocUR4y zNq@K=cFg$Q)40Of`6DB`uY^`wWBL<=cT0D|)Hc}G-$lJk?n<|s*p{O!d$0M+w&ysq z_WaBO@>~8Hj~P5o_dIXLxdD@%KdQU8&2l2LZjyP#Btb{L{B(U>4=pN_9|8gFWMSCX zbF%QmTw<-yp(yM3DC{}WBw(|9Zqy;$UzgNx41igy?YLCJ=BfistoWAww3O%}&0ki*0|v87xq!G_kP+EVg~=w<6sAECE8Ev^}pW zZVLJ&sKiY^vpnb~q0N?wi?umY0dSN8asg6Rr1;5>4>2(*dmV~#w<^`Fit0{6g{2J$ zYD}2TiSOU1a+G+o`3iihG&V(6Y?8^vcd7!wdq1*0ja|XV;e${zp@}ONAuIs6qE;8s zIm+q6R|P^wLq%{a7=Cja>!Ke@wd|9VR&#_s-Hq#7Idmth8~{Bl z*a_2h$N1pL_PTc4In8U1^t!%!fj5yNOK-LKlY7R`lOE>aOIN}R} zB{C0$uTujyg{MO=WW7sVbtUt;^Dr^a5_|sKdaP{1NzBd2=g$gsFpMu>|ECgZ?R|W< zgu^WPw7yTWHjVEncQ;9RoxYKA^Kd`e_2>&9Dr3{mti4$6x(glJaYj?LSbc``_I4V= z43aYdxo8sT=`NcohW1Uu!X%f838(V{M}$euQMbfxl{anhYeLP-=TO5Ydw{TXz%~$F zM#Lz8fQmpF?(Df6z)18_)|qY8r~+~cAcb~1==r67vyRIRdYIRKdf1Q9m78V}4ifuR zE~LE0h53~L5_P3{?JQsk;QF<08v1|{z5EV)LKM9Z6uW}pBMQbm)ByO+qjNGgU3&9SFs`#c!%7OX_WiOwNB_y?wCBkbu z0E!i8t{a`k`b%R1HO9h?nOu6&c+6eeHR*2^4g;KR!oDD4ImUeE6FPT67KK57Mi|7i z&pWQ!*Uogba_j4hf;0i{_@)}woV@aiCr=(dADbY^sRC|DK_gE-O*_o<$Cy)bds*j| z%Z2_PU#5+y~hx8)-WXEE_^J&_Pag#k`tMGpS8nQ^=8&lb200000NkvXXu0mjf D@SX%V literal 0 HcmV?d00001