Using the cookbooks

Using the cookbooks

This section describes how to install and use Chake gem, a handler for Chef, to configure all the LAPPIS's services.

Configuring workstation

The workstation is where you'll create and run any cookbook. You must have some packages and tricks to be able to use Chake. We'll describe here how to install, but you can check it out at Chake's official repository

Chake install

gem install chake

Generating SSH keys

The workstation's user must have a pair of keys. If you already have, skip this section.

ssh-keygen

Then fill out the script questions. Now you have a pair of keys on ~/.ssh folder. It will be necessary to remotely access the server without typing your password.

Clone this repo

git clone https://github.com/lappis-tools/chef-lappis.git

We will explain how to use cookbooks later, now we have to configure the servers where the recipes will run.

Configuring servers

The servers will be the place where Chef will run the specified cookbooks. Chake requires some configurations to access and run some commands inside the servers across ssh connection.

Inside the virtual machine run the following commands

Create user

We use a common user named as lappis, so we have to create it first. Run as root.

adduser lappis

Skip the script's questions typing enter

Add a passphrase to user lappis

passwd lappis

Permissions for user lappis

User lappis must be a super user and the system should not ask for his passphrase when executing sudo commands.

cat >> /etc/sudoers << EOT
lappis ALL=(ALL) NOPASSWD:ALL
EOT

Only for RedHat like systems

You must comment requiretty at /etc/sudoers

sed -i.bak 's/^\(Defaults\s*requiretty\)/#\1/' /etc/sudoers

Authorize workspace's lappis user to connect via ssh without typing passphrase

Into the workstation with lappis user, use the command ssh-copy-id to transfer its public key to the server virtual machine.

ssh-copy-id <virtual-machine-ip>

Type the passphrase for the user lappis of the virtual machine.

Chake files

The folder structure for chake is:

 ├── chake_folder
   ├── config
     ├── ips.yaml
     ├── ssh_config
     ├── roles
   ├── config.rb
   ├── cookbooks
     ├── basics
       ├── recipes
       ├── files
       ├── templates
       ├── attributes
   ├── nodes.yaml
   ├── Rakefile
   └── README.md

File description:

• config: Folder containing IP configurations for all machines, it contains: ips.yaml, ssh_config and the roles folder.
• ips.yaml: Contains the machine names and ips. Example:

boca: 10.0.0.11
codeschool: 10.0.0.137
letsencrypt: 10.0.0.100
rocketchat: 10.0.0.169 

• ssh_config: Ssh configuration file, it should contain all Hostanames, ips, ports and needed configuration to perform a ssh connection with the target machine.

Host boca
  Hostname 10.0.0.163
  User lappis

• roles: Contains role files, all files must contain the runlist of recipes that must be executed on the machine, a example of a role file is:

name 'Mysql'
description "Configure mysql network"

run_list *[
  'recipe[basics]',
  'recipe[mysql]'
]

• config.rb: Default configuration file of chake, leave as it is. Your config.rb should look like this:

root = File.expand_path(File.dirname(__FILE__))
file_cache_path   root + '/cache'
cookbook_path     root + '/cookbooks'
role_path         root + '/config/roles'

• cookbooks: Folder with all cookbooks, recipes, templates, files and attributes.
• basics: Default chake recipe, runs on all machines.
• recipes: Folder with recipes to be run. A recipe is written using ruby, you can check its syntax here, an example is show below:

package 'mysql-server'

execute 'create db redmine_devel' do
  command 'mysql -uroot -e "create database IF NOT EXISTS redmine_devel"'
end

execute 'create db dotproject' do
  command 'mysql -uroot -e "create database IF NOT EXISTS dotproject"'
end

user = 'root'
execute 'change mysql user password' do
  command' mysql mysql -e "UPDATE user SET Password=PASSWORD(\'password-here\') WHERE User=\'root\';FLUSH PRIVILEGES;"'
end

• templates: Templates are files that can be changed in execution time as show below.

export ROOT_URL=<%= @external_address %>
export MONGO_URL=<%= @mongo_url %>
export PORT=<%= @port %>
export MONGO_OPLOG_URL=<%= @mongo_oplog_url %>

• files: Files will be copied to the machine on the same way as a template, but files are statical and can't be changed on execution time.

[Unit]
Description=Rocket.Chat

[Service]
Type=simple
ExecStart=/etc/init.d/rocketchat start
ExecStop=/etc/init.d/rocketchat stop
User=root
Group=root
Restart=on-failure

[Install]
WantedBy=multi-user.target

• attributes: An attribute is a specific detail or configuration in a node. Example:

default[:rocketchat][:initd][:port] = "3000"
default[:rocketchat][:initd][:mongo_oplog_url] = "mongodb://localhost:27017/local"

• nodes.yaml: Configuration telling which roles are on specific machines. Example:

letsencrypt:
  run_list:
    - role[letsencrypt_server]

boca:
  run_list:
    - role[boca_server]

• Rakefile: Configurations for rake tasks. Example:

require 'yaml'
environment = "lappis"

ssh_config_file = "config/#{environment}/ssh_config"
ips_file = "config/#{environment}/ips.yaml"
passwd_file = "config/#{environment}/passwd.yaml"
certificate_domains_file = "config/#{environment}/certificate_domains.yaml"

ENV['CHAKE_SSH_CONFIG'] = ssh_config_file
ENV['CHAKE_RSYNC_OPTIONS'] = " --exclude backups"

require "chake"

ips ||= YAML.load_file(ips_file)
passwords ||= YAML.load_file(passwd_file)
crt_domains ||= YAML.load_file(certificate_domains_file)

$nodes.each do |node|
  node.data['peers'] = ips
  node.data['passwd'] = passwords
  node.data['crt_domains'] = crt_domains
end

def ssh_cmd(cmd, host)
  sh 'ssh', '-F', ENV['CHAKE_SSH_CONFIG'], host, cmd
end

def scp_cmd(file, dest, host, flags='')
  sh 'scp', flags,'-F', ENV['CHAKE_SSH_CONFIG'], file, "#{host}:#{dest}"
end
Rake.add_rakelib 'lib/tasks'

Creating new recipes

To create a new recipe, create a folder under the cookbooks folder.

mkdir chake_root/cookbooks/<new_recipe>

Then create a folders for attributes, files, templates and recipes.

mkdir chake_root/cookbooks/<new_recipe>/files
mkdir chake_root/cookbooks/<new_recipe>/recipes
mkdir chake_root/cookbooks/<new_recipe>/templates
mkdir chake_root/cookbooks/<new_recipe>/attributes

After that just write your new recipes using this directory structure.

Checking connection with chake

To check if passwordless ssh is working for all machines, run:

rake check

If you want to login in a specific machine, run:

rake login:<machine_name>

Applying recipes to specific machine

On the lappis-chef project folder, run:

rake apply:<machine_name>

This will list all possible recipes to run on that machine. After that just type the recipe name, as show below

chat::rocketchat

Run all recipes

If you want to run all recipes on all machines, run:

rake converge

If you want to run all recipes on a specific machine, run:

rake converge:<machine_name>