= misaka =

'''DECOMMISSIONED'''

{{attachment:misaka_imouto.jpg}}

 * debian squeeze x64
 * puppet managed

== local work ==
 * mount `/home` with `acl`s
 * `/etc/skel`
  * `.bashrc` {{{
# Timestamped shell FTW
export HISTTIMEFORMAT='%Y-%m-%d %H:%M:%S  '
}}}
  * `.screenrc`
  * `.vimrc`
  * add self to `.ssh/authorized_keys`
  * `mkdir -m 0701 public_html`


== IPv6 ==

{{{
For VLAN 457 (legacy) machines, just assign addresses out of:
My address space:  2407:7800:100:1c9:0:14::/64 - 2407:7800:100:1c9:0:14:FFFF:FFFF/64
Gateway:           2407:7800:100:1c9::1

2407:7800:100:1c9:0:14::1/64   base address
2407:7800:100:1c9:0:14::2/64   nginx    lastorder
2407:7800:100:1c9:0:14::3/64   apache   biribiri
}}}


== Migrating from other systems ==

Lock other accounts and pack the homedir:

{{{
INACTIVE=oldUserName
usermod -L $INACTIVE
tar zcvf "${INACTIVE}.tar.gz" "$INACTIVE"
}}}



== thinking about apache ==

Our puppet management of apache is still a mess, so we'll do it manually. What do we want to take care of?

 * install `apache2-mpm-itk`
 * a couple of timeout tweaks to `apache2.conf`
 * `ports.conf` (listen only on 202.4.224.31, ''not'' ssl, etc.)
  * aka. biribiri.meidokon.net
 * `a2enmod ssl`
  * fix `ports.conf` again for SSL, no generic Listens
 * conf.d/priv.conf {{{
SetEnvIf Remote_Addr ^202\.4\.235\.109$ priv-group
}}}
 * install `libapache2-mod-php5`
 * start the service
 * stub out `/var/www/html/monitor` for the default site
  * fix up an index.html
  * edit `mods-enabled/status.conf` to get a usable `/server-status`
  * fix up an `info.php`
 * install `libapache2-mod-wsgi`
 * `AssignUserId [username] [groupname]` for itk
 * nice logging
  * log to homedirs, `~/logs/apache/{access,error}.log`
  * fix up logrotate fragment, `apache2-vhost-logs`


== Some puppet manifest ==

{{{#!highlight puppet
@kvm::guest { "misaka.anchor.net.au":
	server  => "jellyfish.engineroom.anchor.net.au",
	profile => linux,
	memory  => "2G",
	vcpus   => 4,
	disks   => "40G",
	nets    => [ "vps", "backups" ];
}

class misaka::sshkey::furinkan {
	$key = "AAAAB3NzaC1yc2EAAAABIwAAAQEAzCHxTgSiO02ZMx148OifiDQxNSVHnI00tuoEZDcy+DFiwsxvjw06rvY5h7fCqkq0Sw+i/71YhEq6uddRARi4MKLKoCWDLf8s4Z/41NS6Rm2/vk5/nD8Wtgyeqm5MHb7Io2gOsE0RGN7Uwi3dC5deD3iHS8FkEnnaQAiXCbEsTePA+JE2PmmPG/RkJehYTCz1qRnKeifJm3j8WGzzODgfIRFURE9tYPsN9+Kpd4LtCXFahioKy7K/0MU2Bbfp6xHozbtMbrZS0cY6mZsjNv5zAUUcKmV6Xz5Cdk9Lw8T3FXY8rDH//tqdH020PhyoNx2mn5xSZ7iyZzVRG387/I0NoQ=="
}

define misaka::imouto(
		$ensure  = present,
		$comment = "no comment entered"
	) {
	include misaka::sshkey::furinkan

	case $ensure {
		present: {
			user { "${name}":
				comment    => $comment,
				gid        => "users",
				shell      => "/bin/bash",
				managehome => true,
				password   => "!!",
			}
			file { "/home/${name}/.ssh":
				ensure => directory,
				mode   => 0700,
				owner  => "${name}",
				group  => "users",
			}
			authorized_key {
				"${comment} - ${name}":
					key     => "${misaka::sshkey::furinkan::key}",
					type    => "ssh-rsa",
					user    => "${name}",
					require => File["/home/${name}/.ssh"];
				"purge-${name}":
					user    => "${name}",
					ensure  => specified_only,
					require => File["/home/${name}/.ssh"];
			}
		}
		absent: {
			user { "${name}":
				comment    => $comment,
				gid        => "users",
				shell      => "/bin/bash",
				managehome => true,
				password   => "!!",
			}
			exec { "Expire the account for ${name}":
				command => shellquote("/usr/sbin/usermod", "--expiredate", "1970-01-02", $name),
				unless  => "/usr/bin/perl -F: -lane 'print(\$F[0],\" expired \", scalar localtime(\$F[7]*86400)) if (\$F[7]) && (\$F[7] lt int(time/(60*60*24)))' /etc/shadow | /bin/grep -q '^${name} '",
			}
		}
		default: { fail("Invalid value for ensure: ${ensure}") }
	}
}

node "misaka.anchor.net.au" {
	$supportlevel = complete

	networking::interface {
		"eth0":
			ipaddress => "202.4.224.29/25",
			gateway   => "top";
		"eth0:00":
			ipaddress => "202.4.224.30/25",
			comment   => "nginx";
		"eth0:01":
			ipaddress => "202.4.224.31/25",
			comment   => "apache";
		"eth0:02":
			ipaddress => "202.4.224.48/25",
			comment   => "qqc.meidokon.net";
		"eth1":
			ipaddress => "172.22.71.103/16";
	}

	anchor::complete { complete:
		site               => SYD1,
		mailer             => true,
		backup_interface   => "eth1",
		rdiffbackup_server => "cthulhu.engineroom.anchor.net.au";
	}
	anchor::dirvish::client { dirvish:
		site       => "SYD1",
		server     => "scylla.engineroom.anchor.net.au",
	}

	# package { "apache2-mpm-itk": }
	# listen on 202.4.224.31 only - NameVirtualHost 202.4.224.31:80
	# package { "libapache2-mod-php5": }
	# package { "libapache2-mod-wsgi": }
	file { "/usr/local/sbin/check_apache_configtest":
		ensure => present,
		mode => 0755,
		source => "puppet:///modules/apache/usr/local/sbin/check_apache_configtest";
	}
	nrpe::command { check_apache_configtest:
		command => "/usr/local/sbin/check_apache_configtest",
		sudo    => true,
	}


	# Shiny new nginx
	featurerepo { "nginx-1.2":
		prefer => true,
	}
	nginx { $fqdn:
		monitor => false,
	}
	nagios::check::http { http: }

	# Monitor those HTTP connections
	nagios::check::httpconnections { httpconnections: }


	misaka::imouto { "moin": comment => "moin.meidokon.net wiki" }
	gunicorn::app { "moin":
		type      => wsgi,
		directory => "/home/moin/moin-1.9.3/wiki/server",
		user      => "moin",
		group     => "users",
		manager   => daemontools;
	}
	daemontools::sudo { "moin":
		user    => "moin",
		service => "moin_gunicorn",
		passwd  => false,
	}

	misaka::imouto { "qqc": comment => "qqc.meidokon.net" }
	# Too hard to make QQC work under gunicorn, I'll just go with apache and mod_wsgi


	# Access to the old machine
	filtergen::rule { "50.pgsql-to-shimako": content => 'output eth0 local dest 202.4.233.227 proto tcp dport 5432 accept;'; }

	mysql { mysql:
		monitor => false,
		backup  => false,
	}

	mysql::backup::zikir { misaka:
		lv           => 'misaka/mysql',
		lv_size      => '1G',
		mysql_subdir => '/',
	}

	mysql::nagios_check { mysql:
		username => "nagios",
		password => "dumb",
	}

	postgres::tuneshm { tuning: shmmax_in_mib => 42 } # postgres default plus some wiggle room
	postgres::server { $fqdn:
		version => "8.4",
		backup  => "zikir",
	}

	postfix::common_maps { common_maps: }
	postfix::nagios_check::mailq { postfix_mailq_check:
		warn_threshold => 20,
		crit_threshold => 100,
	}
}
}}}