initial commit

.github/exporter.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+URL="https://exporter.akerl.app/metric"
+AUTH="Authorization: Bearer $EXPORTER_TOKEN"
+if [[ "$JOB_STATUS" == "success" ]] ; then
+    VALUE=1
+else
+    VALUE=0
+fi
+BODY="{\"name\":\"gh/${GITHUB_REPOSITORY}\",\"metrics\":[{\"name\":\"ghactions\",\"type\":\"gauge\",\"tags\":{\"repo\":\"${GITHUB_REPOSITORY}\"},\"value\":\"${VALUE}\"}]}"
+
+echo "$BODY"
+
+curl -i -XPOST -d "$BODY" -H"$AUTH" "$URL"

.github/workflows/build.yml

@@ -0,0 +1,42 @@
+---
+name: Build
+'on':
+  push:
+    branches:
+    - main
+    tags:
+    - "**"
+  pull_request_target:
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: write
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v3
+      with:
+        ref: "${{ github.ref_name }}"
+        fetch-depth: 0
+        submodules: recursive
+    - uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: '3.1'
+        bundler-cache: true
+    - name: Build
+      run: bundle exec rake
+    - name: Release
+      if: "${{ github.ref == 'refs/heads/main' }}"
+      run: |
+        git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
+        git config --global user.name 'GitHub Actions'
+        bundle exec rake release
+      env:
+        BLACKSMITH_FORGE_API_KEY: "${{ secrets.BLACKSMITH_FORGE_API_KEY }}"
+    - name: Post to hook-exporter
+      run: "./.github/exporter.sh"
+      env:
+        EXPORTER_TOKEN: "${{ secrets.EXPORTER_TOKEN }}"
+        JOB_STATUS: "${{ job.status }}"
+      if: always() && github.ref == 'refs/heads/main'

.gitignore

@@ -0,0 +1,2 @@
+Gemfile.lock
+pkg/

Gemfile

@@ -0,0 +1,8 @@
+source 'https://rubygems.org'
+
+gem 'puppet', '~> 8.0.1'
+gem 'puppet-lint', '~> 4.0.0'
+gem 'puppet-blacksmith', '~> 7.0.0'
+gem 'puppet-syntax', '~> 3.3.0'
+gem 'metadata-json-lint', '~> 3.0.3'
+gem 'voxpupuli-puppet-lint-plugins', '~> 5.0.0'

LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2024 Les Aker
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+

README.md

@@ -0,0 +1,18 @@
+puppet-maybe
+===========
+
+[![Puppet Forge](https://img.shields.io/puppetforge/v/halyard/maybe.svg)](https://forge.puppetlabs.com/halyard/maybe)
+[![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/halyard/puppet-maybe/build.yml?branch=main)](https://github.com/halyard/puppet-maybe/actions)
+[![MIT Licensed](http://img.shields.io/badge/license-MIT-green.svg?style=flat)](https://tldrlegal.com/license/mit-license)
+
+Module to configure [Maybe](https://github.com/maybe-finance/maybe/blob/main/docs/hosting/docker.md)
+
+## Usage
+
+```puppet
+include maybe
+```
+## License
+
+maybe is released under the MIT License. See the bundled LICENSE file for details.
+

Rakefile

@@ -0,0 +1,32 @@
+require 'puppet_blacksmith/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+require 'puppet-syntax/tasks/puppet-syntax'
+require 'metadata-json-lint/rake_task'
+
+PuppetLint::RakeTask.new(:lint) do |config|
+  config.fail_on_warnings = true
+  config.relative = true
+  config.ignore_paths = ['vendor/**/*', 'pkg/**/*']
+end
+
+PuppetSyntax.exclude_paths = ["vendor/**/*"]
+
+Blacksmith::RakeTask.new do |t|
+  t.tag_pattern = '%s'
+end
+
+desc 'Release a new version of the puppet module'
+deps = %i[module:clean test module:build module:tag module:push module:bump_commit]
+task :release => deps do
+  puts 'Pushing to remote git repo'
+  Blacksmith::Git.new.push!
+end
+
+desc 'Run syntax and lint checks'
+task test: [
+  :metadata_lint,
+  :syntax,
+  :lint
+]
+
+task default: [:test]

manifests/init.pp

@@ -0,0 +1,136 @@
+# @summary Configure Maybe instance
+#
+# @param hostname is the service hostname
+# @param aws_access_key_id sets the AWS key to use for Route53 challenge
+# @param aws_secret_access_key sets the AWS secret key to use for the Route53 challenge
+# @param email sets the contact address for the certificate
+# @param secret_key_base sets the Rails cookie secret
+# @param database_password sets the postgres password
+# @param datadir sets the storage location on disk
+# @param container_ip sets the IP for the service container
+# @param postgres_ip sets the IP for the database docker container
+# @param backup_target sets the target repo for backups
+# @param backup_database_watchdog sets the watchdog URL to confirm backups are working
+# @param backup_password sets the encryption key for backup snapshots
+# @param backup_environment sets the env vars to use for backups
+# @param backup_rclone sets the config for an rclone backend
+class maybe (
+  String $hostname,
+  String $aws_access_key_id,
+  String $aws_secret_access_key,
+  String $email,
+  String $secret_key_base,
+  String $database_password,
+  String $datadir = '/opt/maybe',
+  String $container_ip = '172.17.0.2',
+  String $postgres_ip = '172.17.0.3',
+  Optional[String] $backup_target = undef,
+  Optional[String] $backup_database_watchdog = undef,
+  Optional[String] $backup_password = undef,
+  Optional[Hash[String, String]] $backup_environment = undef,
+  Optional[String] $backup_rclone = undef,
+) {
+  file { [
+      $datadir,
+      "${datadir}/data",
+      "${datadir}/backup",
+      "${datadir}/postgres",
+    ]:
+      ensure => directory,
+  }
+
+  docker::container { 'maybe':
+    image => 'ghcr.io/maybe-finance/maybe:latest',
+    args  => [
+      "--ip ${container_ip}",
+      "-v ${datadir}/data:/rails/storage",
+      '-e SELF_HOSTED=true',
+      '-e RAILS_FORCE_SSL=false',
+      '-e RAILS_ASSUME_SSL=false',
+      '-e GOOD_JOB_EXECUTION_MODE=async',
+      "-e SECRET_KEY_BASE=${secret_key_base}",
+      "-e DB_HOST=${postgres_ip}",
+      '-e POSTGRES_DB=maybe_production',
+      '-e POSTGRES_USER=maybe_user',
+      "-e POSTGRES_PASSWORD=${database_password}",
+    ],
+    cmd   => '',
+  }
+
+  nginx::site { $hostname:
+    proxy_target          => "http://${container_ip}:3000",
+    aws_access_key_id     => $aws_access_key_id,
+    aws_secret_access_key => $aws_secret_access_key,
+    email                 => $email,
+  }
+
+  firewall { '101 allow cross container from maybe to postgres':
+    chain       => 'FORWARD',
+    action      => 'accept',
+    proto       => 'tcp',
+    source      => $container_ip,
+    destination => $postgres_ip,
+    dport       => 5432,
+  }
+
+  docker::container { 'postgres':
+    image   => 'postgres:17',
+    args    => [
+      "--ip ${postgres_ip}",
+      "-v ${datadir}/postgres:/var/lib/postgresql/data",
+      '-e POSTGRES_USER=maybe_user',
+      "-e POSTGRES_PASSWORD=${database_password}",
+      '-e POSTGRES_DB=maybe_production',
+    ],
+    cmd     => '-c ssl=on -c ssl_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem -c ssl_key_file=/etc/ssl/private/ssl-cert-snakeoil.key',
+    require => File["${datadir}/postgres"],
+  }
+
+  file { '/usr/local/bin/maybe-backup.sh':
+    ensure => file,
+    source => 'puppet:///modules/maybe/maybe-backup.sh',
+    mode   => '0755',
+  }
+
+  file { '/etc/systemd/system/maybe-backup.service':
+    ensure  => file,
+    content => template('maybe/maybe-backup.service.erb'),
+    notify  => Service['maybe-backup.timer'],
+  }
+
+  file { '/etc/systemd/system/maybe-backup.timer':
+    ensure => file,
+    source => 'puppet:///modules/maybe/maybe-backup.timer',
+    notify => Service['maybe-backup.timer'],
+  }
+
+  service { 'maybe-backup.timer':
+    ensure => running,
+    enable => true,
+  }
+
+  tidy { "${datadir}/backup weekly":
+    path    => "${datadir}/backup",
+    age     => '100d',
+    recurse => true,
+    matches => 'dump_??????{01,07,14,21,28}-??????.sql',
+  }
+
+  tidy { "${datadir}/backup all":
+    path    => "${datadir}/backup",
+    age     => '14d',
+    recurse => true,
+    matches => 'dump_*.sql',
+  }
+
+  if $backup_target != '' {
+    backup::repo { 'maybe-database':
+      source        => "${datadir}/backup",
+      target        => "${backup_target}/database",
+      watchdog_url  => $backup_database_watchdog,
+      password      => $backup_password,
+      environment   => $backup_environment,
+      rclone_config => $backup_rclone,
+    }
+  }
+}

metadata.json

@@ -0,0 +1,16 @@
+{
+  "name": "halyard-maybe",
+  "version": "0.0.1",
+  "author": "Les Aker",
+  "license": "MIT",
+  "summary": "Configure maybe instance",
+  "source": "https://github.com/halyard/puppet-maybe",
+  "project_page": "https://github.com/halyard/puppet-maybe",
+  "issues_url": "https://github.com/halyard/puppet-maybe/issues",
+  "dependencies": [
+
+  ],
+  "operatingsystem_support": [
+
+  ]
+}