Skip to content

Commit 7c12136

Browse files
hpk42hpk42
committed
move out nginx deployer
1 parent 3637bba commit 7c12136

File tree

2 files changed

+119
-111
lines changed

2 files changed

+119
-111
lines changed

‎cmdeploy/src/cmdeploy/deployers.py‎

Lines changed: 2 additions & 111 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
from io import StringIO
99
from pathlib import Path
1010

11-
from chatmaild.config import Config, read_config
11+
from chatmaild.config import read_config
1212
from pyinfra import facts, host, logger
1313
from pyinfra.api import FactBase
1414
from pyinfra.facts.files import Sha256File
@@ -26,6 +26,7 @@
2626
get_resource,
2727
)
2828
from .dovecot.deployer import DovecotDeployer
29+
from .nginx.deployer import NginxDeployer
2930
from .opendkim.deployer import OpendkimDeployer
3031
from .postfix.deployer import PostfixDeployer
3132
from .www import build_webpages, find_merge_conflict, get_paths
@@ -208,116 +209,6 @@ def activate(self):
208209
)
209210

210211

211-
def _configure_nginx(config: Config, debug: bool = False) -> bool:
212-
"""Configures nginx HTTP server."""
213-
need_restart = False
214-
215-
main_config = files.template(
216-
src=get_resource("nginx/nginx.conf.j2"),
217-
dest="/etc/nginx/nginx.conf",
218-
user="root",
219-
group="root",
220-
mode="644",
221-
config={"domain_name": config.mail_domain},
222-
disable_ipv6=config.disable_ipv6,
223-
)
224-
need_restart |= main_config.changed
225-
226-
autoconfig = files.template(
227-
src=get_resource("nginx/autoconfig.xml.j2"),
228-
dest="/var/www/html/.well-known/autoconfig/mail/config-v1.1.xml",
229-
user="root",
230-
group="root",
231-
mode="644",
232-
config={"domain_name": config.mail_domain},
233-
)
234-
need_restart |= autoconfig.changed
235-
236-
mta_sts_config = files.template(
237-
src=get_resource("nginx/mta-sts.txt.j2"),
238-
dest="/var/www/html/.well-known/mta-sts.txt",
239-
user="root",
240-
group="root",
241-
mode="644",
242-
config={"domain_name": config.mail_domain},
243-
)
244-
need_restart |= mta_sts_config.changed
245-
246-
# install CGI newemail script
247-
#
248-
cgi_dir = "/usr/lib/cgi-bin"
249-
files.directory(
250-
name=f"Ensure {cgi_dir} exists",
251-
path=cgi_dir,
252-
user="root",
253-
group="root",
254-
)
255-
256-
files.put(
257-
name="Upload cgi newemail.py script",
258-
src=get_resource("newemail.py", pkg="chatmaild").open("rb"),
259-
dest=f"{cgi_dir}/newemail.py",
260-
user="root",
261-
group="root",
262-
mode="755",
263-
)
264-
265-
return need_restart
266-
267-
268-
class NginxDeployer(Deployer):
269-
def __init__(self, config):
270-
self.config = config
271-
272-
def install(self):
273-
#
274-
# If we allow nginx to start up on install, it will grab port
275-
# 80, which then will block acmetool from listening on the port.
276-
# That in turn prevents getting certificates, which then causes
277-
# an error when we try to start nginx on the custom config
278-
# that leaves port 80 open but also requires certificates to
279-
# be present. To avoid getting into that interlocking mess,
280-
# we use policy-rc.d to prevent nginx from starting up when it
281-
# is installed.
282-
#
283-
# This approach allows us to avoid performing any explicit
284-
# systemd operations during the install stage (as opposed to
285-
# allowing it to start and then forcing it to stop), which allows
286-
# the install stage to run in non-systemd environments like a
287-
# container image build.
288-
#
289-
# For documentation about policy-rc.d, see:
290-
# https://people.debian.org/~hmh/invokerc.d-policyrc.d-specification.txt
291-
#
292-
files.put(
293-
src=get_resource("policy-rc.d"),
294-
dest="/usr/sbin/policy-rc.d",
295-
user="root",
296-
group="root",
297-
mode="755",
298-
)
299-
300-
apt.packages(
301-
name="Install nginx",
302-
packages=["nginx", "libnginx-mod-stream"],
303-
)
304-
305-
files.file("/usr/sbin/policy-rc.d", present=False)
306-
307-
def configure(self):
308-
self.need_restart = _configure_nginx(self.config)
309-
310-
def activate(self):
311-
systemd.service(
312-
name="Start and enable nginx",
313-
service="nginx.service",
314-
running=True,
315-
enabled=True,
316-
restarted=self.need_restart,
317-
)
318-
self.need_restart = False
319-
320-
321212
class WebsiteDeployer(Deployer):
322213
def __init__(self, config):
323214
self.config = config

‎cmdeploy/src/cmdeploy/nginx/deployer.py‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
from chatmaild.config import Config
2+
from pyinfra.operations import apt, files, systemd
3+
4+
from cmdeploy.basedeploy import (
5+
Deployer,
6+
get_resource,
7+
)
8+
9+
10+
class NginxDeployer(Deployer):
11+
def __init__(self, config):
12+
self.config = config
13+
14+
def install(self):
15+
#
16+
# If we allow nginx to start up on install, it will grab port
17+
# 80, which then will block acmetool from listening on the port.
18+
# That in turn prevents getting certificates, which then causes
19+
# an error when we try to start nginx on the custom config
20+
# that leaves port 80 open but also requires certificates to
21+
# be present. To avoid getting into that interlocking mess,
22+
# we use policy-rc.d to prevent nginx from starting up when it
23+
# is installed.
24+
#
25+
# This approach allows us to avoid performing any explicit
26+
# systemd operations during the install stage (as opposed to
27+
# allowing it to start and then forcing it to stop), which allows
28+
# the install stage to run in non-systemd environments like a
29+
# container image build.
30+
#
31+
# For documentation about policy-rc.d, see:
32+
# https://people.debian.org/~hmh/invokerc.d-policyrc.d-specification.txt
33+
#
34+
files.put(
35+
src=get_resource("policy-rc.d"),
36+
dest="/usr/sbin/policy-rc.d",
37+
user="root",
38+
group="root",
39+
mode="755",
40+
)
41+
42+
apt.packages(
43+
name="Install nginx",
44+
packages=["nginx", "libnginx-mod-stream"],
45+
)
46+
47+
files.file("/usr/sbin/policy-rc.d", present=False)
48+
49+
def configure(self):
50+
self.need_restart = _configure_nginx(self.config)
51+
52+
def activate(self):
53+
systemd.service(
54+
name="Start and enable nginx",
55+
service="nginx.service",
56+
running=True,
57+
enabled=True,
58+
restarted=self.need_restart,
59+
)
60+
self.need_restart = False
61+
62+
63+
def _configure_nginx(config: Config, debug: bool = False) -> bool:
64+
"""Configures nginx HTTP server."""
65+
need_restart = False
66+
67+
main_config = files.template(
68+
src=get_resource("nginx/nginx.conf.j2"),
69+
dest="/etc/nginx/nginx.conf",
70+
user="root",
71+
group="root",
72+
mode="644",
73+
config={"domain_name": config.mail_domain},
74+
disable_ipv6=config.disable_ipv6,
75+
)
76+
need_restart |= main_config.changed
77+
78+
autoconfig = files.template(
79+
src=get_resource("nginx/autoconfig.xml.j2"),
80+
dest="/var/www/html/.well-known/autoconfig/mail/config-v1.1.xml",
81+
user="root",
82+
group="root",
83+
mode="644",
84+
config={"domain_name": config.mail_domain},
85+
)
86+
need_restart |= autoconfig.changed
87+
88+
mta_sts_config = files.template(
89+
src=get_resource("nginx/mta-sts.txt.j2"),
90+
dest="/var/www/html/.well-known/mta-sts.txt",
91+
user="root",
92+
group="root",
93+
mode="644",
94+
config={"domain_name": config.mail_domain},
95+
)
96+
need_restart |= mta_sts_config.changed
97+
98+
# install CGI newemail script
99+
#
100+
cgi_dir = "/usr/lib/cgi-bin"
101+
files.directory(
102+
name=f"Ensure {cgi_dir} exists",
103+
path=cgi_dir,
104+
user="root",
105+
group="root",
106+
)
107+
108+
files.put(
109+
name="Upload cgi newemail.py script",
110+
src=get_resource("newemail.py", pkg="chatmaild").open("rb"),
111+
dest=f"{cgi_dir}/newemail.py",
112+
user="root",
113+
group="root",
114+
mode="755",
115+
)
116+
117+
return need_restart

0 commit comments

Comments
 (0)