propellor 0.9.1 → 0.9.2

raw patch · 11 files changed

+196/−20 lines, 11 filesPVP ok

version bump matches the API change (PVP)

API changes (from Hackage documentation)

Files

• CHANGELOG +11/−0
• README.md +1/−1
• config-joey.hs +3/−0
• debian/changelog +11/−0
• debian/control +1/−1
• doc/README.mdwn +1/−1
• propellor.cabal +3/−1
• src/Propellor/Property/Apache.hs +21/−15
• src/Propellor/Property/Docker.hs +1/−1
• src/Propellor/Property/Firewall.hs +91/−0
• src/Propellor/Property/Nginx.hs +52/−0

@@ -1,3 +1,14 @@+propellor (0.9.2) unstable; urgency=medium++  * Added nginx module, contributed by Félix Sipma.+  * Added firewall module, contributed by Arnaud Bailly.+  * Apache: Fix daemon reload when enabling a new module or site.+  * Docker: Stop using docker.io; that was a compat symlink in+    the Debian package which has been removed in docker.io 1.3.1~dfsg1-2.+  * Orphaned the Debian package, as I am retiring from Debian.++ -- Joey Hess <joeyh@debian.org>  Sat, 08 Nov 2014 15:57:36 -0400+ propellor (0.9.1) unstable; urgency=medium    * Docker: Add ability to control when containers restart.

@@ -62,7 +62,7 @@    Now they'll automatically update every 30 minutes, and you can    `git commit -S` and `git push` changes that affect any number of    hosts.-10. Write some neat new properties and send patches to <propellor@joeyh.name>!+10. Write some neat new properties and send patches!  ## debugging 

@@ -160,6 +160,9 @@ 		-- Some users have zsh as their login shell. 		, "zsh" 		]+	+	& Docker.configured+	& Docker.garbageCollected `period` Daily  diatom :: Host diatom = standardSystem "diatom.kitenet.net" (Stable "wheezy") "amd64"

@@ -1,3 +1,14 @@+propellor (0.9.2) unstable; urgency=medium++  * Added nginx module, contributed by Félix Sipma.+  * Added firewall module, contributed by Arnaud Bailly.+  * Apache: Fix daemon reload when enabling a new module or site.+  * Docker: Stop using docker.io; that was a compat symlink in+    the Debian package which has been removed in docker.io 1.3.1~dfsg1-2.+  * Orphaned the Debian package, as I am retiring from Debian.++ -- Joey Hess <joeyh@debian.org>  Sat, 08 Nov 2014 15:57:36 -0400+ propellor (0.9.1) unstable; urgency=medium    * Docker: Add ability to control when containers restart.

@@ -16,7 +16,7 @@ 	libghc-quickcheck2-dev, 	libghc-mtl-dev, 	libghc-monadcatchio-transformers-dev,-Maintainer: Joey Hess <joeyh@debian.org>+Maintainer: Debian QA Group <packages@qa.debian.org> Standards-Version: 3.9.5 Vcs-Git: git://git.kitenet.net/propellor Homepage: http://propellor.branchable.com/

@@ -62,7 +62,7 @@    Now they'll automatically update every 30 minutes, and you can    `git commit -S` and `git push` changes that affect any number of    hosts.-10. Write some neat new properties and send patches to <propellor@joeyh.name>!+10. Write some neat new properties and send patches!  ## debugging 

@@ -1,5 +1,5 @@ Name: propellor-Version: 0.9.1+Version: 0.9.2 Cabal-Version: >= 1.6 License: BSD3 Maintainer: Joey Hess <joey@kitenet.net>@@ -78,10 +78,12 @@     Propellor.Property.Dns     Propellor.Property.Docker     Propellor.Property.File+    Propellor.Property.Firewall     Propellor.Property.Git     Propellor.Property.Gpg     Propellor.Property.Grub     Propellor.Property.Network+    Propellor.Property.Nginx     Propellor.Property.Obnam     Propellor.Property.OpenId     Propellor.Property.Postfix

@@ -4,23 +4,26 @@ import qualified Propellor.Property.File as File import qualified Propellor.Property.Apt as Apt import qualified Propellor.Property.Service as Service+import Utility.SafeCommand  type ConfigFile = [String]  siteEnabled :: HostName -> ConfigFile -> RevertableProperty siteEnabled hn cf = RevertableProperty enable disable   where-	enable = trivial (cmdProperty "a2ensite" ["--quiet", hn])-		`describe` ("apache site enabled " ++ hn)-		`requires` siteAvailable hn cf-		`requires` installed-		`onChange` reloaded-	disable = trivial $ combineProperties+	enable = check (not <$> isenabled) $+		cmdProperty "a2ensite" ["--quiet", hn]+			`describe` ("apache site enabled " ++ hn)+			`requires` siteAvailable hn cf+			`requires` installed+			`onChange` reloaded+	disable = combineProperties 		("apache site disabled " ++ hn)  		(map File.notPresent (siteCfg hn)) 		`onChange` cmdProperty "a2dissite" ["--quiet", hn] 		`requires` installed 		`onChange` reloaded+	isenabled = boolSystem "a2query" [Param "-q", Param "-s", Param hn]  siteAvailable :: HostName -> ConfigFile -> Property siteAvailable hn cf = combineProperties ("apache site available " ++ hn) $@@ -31,17 +34,20 @@ modEnabled :: String -> RevertableProperty modEnabled modname = RevertableProperty enable disable   where-	enable = trivial $ cmdProperty "a2enmod" ["--quiet", modname]-		`describe` ("apache module enabled " ++ modname)-		`requires` installed-		`onChange` reloaded-	disable = trivial $ cmdProperty "a2dismod" ["--quiet", modname]-		`describe` ("apache module disabled " ++ modname)-		`requires` installed-		`onChange` reloaded+	enable = check (not <$> isenabled) $+		cmdProperty "a2enmod" ["--quiet", modname]+			`describe` ("apache module enabled " ++ modname)+			`requires` installed+			`onChange` reloaded+	disable = check isenabled $ +		cmdProperty "a2dismod" ["--quiet", modname]+			`describe` ("apache module disabled " ++ modname)+			`requires` installed+			`onChange` reloaded+	isenabled = boolSystem "a2query" [Param "-q", Param "-m", Param modname]  -- This is a list of config files because different versions of apache--- use different filenames. Propellor simply writen them all.+-- use different filenames. Propellor simply writes them all. siteCfg :: HostName -> [FilePath] siteCfg hn = 	-- Debian pre-2.4

@@ -567,7 +567,7 @@ 	. readish <$> readFile (identFile cid)  dockercmd :: String-dockercmd = "docker.io"+dockercmd = "docker"  report :: [Bool] -> Result report rmed

@@ -0,0 +1,91 @@+-- |Properties for configuring firewall (iptables) rules+--+-- Copyright 2014 Arnaud Bailly <arnaud.oqube@gmail.com>+-- License: BSD-2-Clause+module Propellor.Property.Firewall (+	rule,+	installed,+	Chain(..),+	Target(..),+	Proto(..),+	Rules(..),+	ConnectionState(..)+) where++import Data.Monoid+import Data.Char+import Data.List++import Propellor+import Utility.SafeCommand+import qualified Propellor.Property.Apt as Apt+import qualified Propellor.Property.Network as Network++installed :: Property+installed = Apt.installed ["iptables"]++rule :: Chain -> Target -> Rules -> Property+rule c t rs = property ("firewall rule: " <> show r) addIpTable+  where+	r = Rule c t rs+	addIpTable = liftIO $ do+		let args = toIpTable r+		exist <- boolSystem "iptables" (chk args)+		if exist+			then return NoChange+			else ifM (boolSystem "iptables" (add args))+				( return MadeChange , return FailedChange)+	add params = (Param "-A") : params+	chk params = (Param "-C") : params++toIpTable :: Rule -> [CommandParam]+toIpTable r =  map Param $+	(show $ ruleChain r) :+	(toIpTableArg (ruleRules r)) ++ [ "-j" , show $ ruleTarget r ]++toIpTableArg :: Rules -> [String]+toIpTableArg Everything        = []+toIpTableArg (Proto proto)     = ["-p", map toLower $ show proto]+toIpTableArg (Port port)       = ["--dport", show port]+toIpTableArg (PortRange (f,t)) = ["--dport", show f ++ ":" ++ show t]+toIpTableArg (IFace iface)     = ["-i", iface]+toIpTableArg (Ctstate states)  = ["-m", "conntrack","--ctstate", concat $ intersperse "," (map show states)]+toIpTableArg (r :- r')         = toIpTableArg r <> toIpTableArg r'++data Rule = Rule+	{ ruleChain :: Chain+	, ruleTarget :: Target+	, ruleRules :: Rules+	} deriving (Eq, Show, Read)++data Chain = INPUT | OUTPUT | FORWARD+	deriving (Eq,Show,Read)++data Target = ACCEPT | REJECT | DROP | LOG+	deriving (Eq,Show,Read)++data Proto = TCP | UDP | ICMP+	deriving (Eq,Show,Read)++type Port = Int++data ConnectionState = ESTABLISHED | RELATED | NEW | INVALID+	deriving (Eq,Show,Read)++data Rules+	= Everything+	| Proto Proto+	-- ^There is actually some order dependency between proto and port so this should be a specific+	-- data type with proto + ports+	| Port Port+	| PortRange (Port,Port)+	| IFace Network.Interface+	| Ctstate [ ConnectionState ]+	| Rules :- Rules   -- ^Combine two rules+	deriving (Eq,Show,Read)++infixl 0 :-++instance Monoid Rules where+	mempty  = Everything+	mappend = (:-)

@@ -0,0 +1,52 @@+module Propellor.Property.Nginx where++import Propellor+import qualified Propellor.Property.File as File+import qualified Propellor.Property.Apt as Apt+import qualified Propellor.Property.Service as Service+import System.Posix.Files++type ConfigFile = [String]++siteEnabled :: HostName -> ConfigFile -> RevertableProperty+siteEnabled hn cf = RevertableProperty enable disable+  where+	enable = check test prop+		`describe` ("nginx site enabled " ++ hn)+		`requires` siteAvailable hn cf+		`requires` installed+		`onChange` reloaded+	  where+		test = not <$> doesFileExist (siteVal hn)+		prop = property "nginx site in place" $ makeChange $+			createSymbolicLink target dir+		target = siteValRelativeCfg hn+		dir = siteVal hn+	disable = trivial $ File.notPresent (siteVal hn)+		`describe` ("nginx site disable" ++ hn)+		`requires` installed+		`onChange` reloaded++siteAvailable :: HostName -> ConfigFile -> Property+siteAvailable hn cf = ("nginx site available " ++ hn) ==>+	siteCfg hn `File.hasContent` (comment : cf)+  where+	comment = "# deployed with propellor, do not modify"++siteCfg :: HostName -> FilePath+siteCfg hn = "/etc/nginx/sites-available/" ++ hn++siteVal :: HostName -> FilePath+siteVal hn = "/etc/nginx/sites-enabled/" ++ hn++siteValRelativeCfg :: HostName -> FilePath+siteValRelativeCfg hn = "../sites-available/" ++ hn++installed :: Property+installed = Apt.installed ["nginx"]++restarted :: Property+restarted = Service.restarted "nginx"++reloaded :: Property+reloaded = Service.reloaded "nginx"