Initial commit of MediaWiki module

Change-Id: I6181e0d4a717d0a11ea2d741034db99435d5e180
Reviewed-on: https://review.openstack.org/10521
Approved: Monty Taylor <mordred@inaugust.com>
Reviewed-by: Monty Taylor <mordred@inaugust.com>
Tested-by: Jenkins

install_modules.sh

@@ -32,6 +32,7 @@ MODULES="
   puppetlabs-apache
   puppetlabs-apt
   puppetlabs-mysql
+  saz-memcached
   "
 MODULE_LIST=`puppet module list`
 

manifests/site.pp

@@ -86,7 +86,9 @@ node 'etherpad.openstack.org' {
 }
 
 node 'wiki.openstack.org' {
-  include openstack_project::wiki
+  class { 'openstack_project::wiki':
+    mysql_root_password => hiera('wiki_db_password'),
+  }
 }
 
 node 'puppet-dashboard.openstack.org' {

modules/mediawiki/manifests/app.pp

@@ -0,0 +1,8 @@
+class mediawiki::app {
+
+  vcsrepo { "/srv/mediawiki/w":
+    ensure => latest,
+    source => "https://gerrit.wikimedia.org/r/p/mediawiki/core.git",
+    revision => "origin/master",
+  }
+}

modules/mediawiki/manifests/image_scaler.pp

@@ -0,0 +1,14 @@
+class mediawiki::image_scaler {
+  package { ["imagemagick", "ghostscript", "ffmpeg", "ffmpeg2theora", "librsvg2-bin", "djvulibre-bin", "netpbm", "libogg0", "libvorbisenc2", "libtheora0", "oggvideotools", "libvips15", "libvips-tools"]:
+    ensure => present;
+  }
+  package { [ "gsfonts", "texlive-fonts-recommended", "ttf-alee", "ttf-arabeyes", "ttf-arphic-ukai", "ttf-arphic-uming", "ttf-bengali-fonts", "ttf-devanagari-fonts", "ttf-farsiweb", "ttf-gujarati-fonts", "ttf-kacst", "ttf-kannada-fonts", "ttf-khmeros", "ttf-lao", "ttf-liberation", "ttf-linux-libertine", "ttf-malayalam-fonts", "ttf-manchufont", "ttf-mgopen", "ttf-nafees", "ttf-oriya-fonts", "ttf-punjabi-fonts", "ttf-sil-abyssinica", "ttf-sil-ezra", "ttf-sil-padauk", "ttf-sil-scheherazade", "ttf-sil-yi", "ttf-takao-gothic", "ttf-takao-mincho", "ttf-tamil-fonts", "ttf-thai-tlwg", "ttf-tmuni", "ttf-ubuntu-font-family", "ttf-unfonts-extra", "ttf-wqy-zenhei", "xfonts-100dpi", "xfonts-75dpi", "xfonts-base", "xfonts-mplus", "xfonts-scalable"]:
+    ensure => present;
+  }
+  cron { "removetmpfiles":
+    command => "for dir in /tmp; do find \$dir -ignore_readdir_race -type f \\( -name 'gs_*' -o -name 'magick-*' \\) -cmin +15 -exec rm -f {} \\;; done",
+    user => root,
+    minute => '*/5',
+    ensure => present
+  }
+}

modules/mediawiki/manifests/init.pp

@@ -0,0 +1,35 @@
+class mediawiki($role, $site_hostname, $mediawiki_location='') {
+  if ($role == "app" or $role == "all") {
+    include apache
+    require apache::dev
+    include mediawiki::php,
+            mediawiki::app
+
+    package { 'libapache2-mod-php5':
+      ensure => present
+    }
+
+    apache::vhost { $site_hostname:
+      port => 443,
+      docroot => 'MEANINGLESS ARGUMENT',
+      priority => '50',
+      template => 'mediawiki/apache/mediawiki.erb',
+      ssl => true,
+    }
+    a2mod { 'rewrite':
+      ensure => present
+    }
+    a2mod { 'expires':
+      ensure => present
+    }
+
+  }
+  if ($role == "image-scaler" or $role == "all") {
+    include mediawiki::image_scaler,
+            mediawiki::php,
+            mediawiki::app
+  }
+  if ($role == "search" or $role == "all") {
+    include mediawiki::search
+  }
+}

modules/mediawiki/manifests/php.pp

@@ -0,0 +1,6 @@
+class mediawiki::php {
+  package { ["php5", "php5-cli", "php5-mysql", "php-apc", "php5-intl"]:
+    ensure => present;
+  }
+  # TODO: apc configuration
+}

modules/mediawiki/manifests/search.pp

@@ -0,0 +1,3 @@
+class mediawiki::search {
+  # Not currently defined. We should add lucene.
+}

modules/mediawiki/templates/apache/mediawiki.erb

@@ -0,0 +1,106 @@
+#####################################################################
+### THIS FILE IS MANAGED BY PUPPET
+### puppet:///files/apache/sites/labconsole.wikimedia.org
+#####################################################################
+# vim: filetype=apache
+
+<VirtualHost *:80>
+        ServerAdmin noc@openstack.org
+        ServerName <%= scope.lookupvar("mediawiki::site_hostname") %>
+
+        DocumentRoot /var/www
+        <Directory />
+                Options FollowSymLinks
+                AllowOverride None
+        </Directory>
+        <Directory /var/www/>
+                Options Indexes FollowSymLinks MultiViews
+                AllowOverride None
+                Order allow,deny
+                allow from all
+        </Directory>
+
+        RewriteEngine on
+        RewriteCond %{SERVER_PORT} !^443$
+        RewriteRule ^/(.*)$ https://<%= scope.lookupvar("mediawiki::site_hostname") %>/$1 [L,R]
+
+        ErrorLog /var/log/apache2/mediawiki-error.log
+
+        # Possible values include: debug, info, notice, warn, error, crit,
+        # alert, emerg.
+        LogLevel warn
+
+        CustomLog /var/log/apache2/mediawiki-access.log combined
+        ServerSignature Off
+
+</VirtualHost>
+<VirtualHost *:443>
+        ServerAdmin noc@openstack.org
+        ServerName <%= scope.lookupvar("mediawiki::site_hostname") %>
+
+        SSLEngine on
+        SSLCertificateFile /etc/ssl/certs/<%= fqdn %>.pem
+        SSLCertificateKeyFile /etc/ssl/private/<%= fqdn %>.key
+
+        RedirectMatch ^/$ http://<%= scope.lookupvar("mediawiki::site_hostname") %>/wiki/
+
+        DocumentRoot /var/www
+        <Directory />
+                Options FollowSymLinks
+                AllowOverride None
+        </Directory>
+        <Directory /var/www/>
+                Options Indexes FollowSymLinks MultiViews
+                AllowOverride None
+                Order allow,deny
+                allow from all
+        </Directory>
+	<Directory "<%= scope.lookupvar('mediawiki::mediawiki_location') %>/images">
+		# Ignore .htaccess files
+		AllowOverride None
+ 
+		# Serve HTML as plaintext, don't execute SHTML
+		AddType text/plain .html .htm .shtml .php
+ 
+		# Don't run arbitrary PHP code.
+		php_admin_flag engine off
+	</Directory>
+	<IfModule mod_expires.c>
+		ExpiresActive On
+		<Directory "<%= scope.lookupvar('mediawiki::mediawiki_location') %>">
+			<FilesMatch "\.(gif|jpe?g|png|css|js|woff|svg|eot|ttf)$">
+				ExpiresByType image/gif A2592000
+				ExpiresByType image/png A2592000
+				ExpiresByType image/jpeg A2592000
+				ExpiresByType text/css A2592000
+				ExpiresByType text/javascript A2592000
+				ExpiresByType application/x-javascript A2592000
+				ExpiresByType application/x-font-woff A2592000
+				ExpiresByType image/svg+xml A2592000
+				ExpiresByType application/vnd.ms-fontobject A2592000
+				ExpiresByType application/x-font-ttf A2592000
+				## I think it's likely dangerous to enable this for the entire domain.
+				## I'm nearly positive we only need to do so for the WebFonts.
+				## For now I'm going to keep this disabled.
+				#Header add Access-Control-Allow-Origin "*"
+			</FilesMatch>
+		</Directory>
+	</IfModule>
+	AddType application/x-font-woff .woff
+	AddType application/vnd.ms-fontobject .eot
+	# TTF doesn't have an official MIME type, but I really don't want to use application/octet-stream for it
+	AddType application/x-font-ttf .ttf
+
+        Alias /w <%= scope.lookupvar('mediawiki::mediawiki_location') %>
+        Alias /wiki <%= scope.lookupvar('mediawiki::mediawiki_location') %>/index.php
+
+        ErrorLog /var/log/apache2/error.log
+
+        # Possible values include: debug, info, notice, warn, error, crit,
+        # alert, emerg.
+        LogLevel warn
+
+        CustomLog /var/log/apache2/access.log combined
+        ServerSignature Off
+
+</VirtualHost>

modules/openssl/manifests/init.pp

@@ -0,0 +1,5 @@
+class openssl {
+  package { ["openssl", "ssl-cert"]:
+    ensure => present;
+  }
+}

modules/openstack_project/manifests/wiki.pp

@@ -1,4 +1,8 @@
-class openstack_project::wiki {
+class openstack_project::wiki($mysql_root_password) {
+
+  include openssl
+  include subversion
+
   class { 'openstack_project::server':
     iptables_public_tcp_ports => [80, 443]
   }
@@ -6,4 +10,24 @@ class openstack_project::wiki {
   realize (
     User::Virtual::Localuser["rlane"],
   )
+
+  class { 'mediawiki':
+    role => 'all',
+    mediawiki_location => '/srv/mediawiki/w',
+    site_hostname => $fqdn;
+  }
+  class { 'memcached':
+    max_memory => 2048,
+    listen_ip => '127.0.0.1',
+    tcp_port => 11000,
+    udp_port => 11000,
+  }
+  class {"mysql::server":
+    config_hash => {
+      'root_password' => "${mysql_root_password}",
+      'default_engine' => 'InnoDB',
+      'bind_address' => '127.0.0.1',
+    }
+  }
+  include mysql::server::account_security
 }

modules/subversion/manifests/init.pp

@@ -0,0 +1,5 @@
+class subversion {
+  package { ["subversion"]:
+    ensure => latest;
+  }
+}