#
# Cookbook:: irrigate-jenkins
# Recipe:: deploy_ny_host
#
# Copyright:: (C) 2016 The Orchard
#

include_recipe 'sudo'

jenkins_user = node['jenkins']['user']
jenkins_home_dir = node['jenkins']['jenkins_home_dir']
max_user_watches = node['jenkins']['sysctl']['params']['fs.inotify.max_user_watches']

fabric_user = node['jenkins']['fabric_user']
fabric_home_dir = node['jenkins']['fabric_home_dir']

# Create user for Jenkins
user jenkins_user do
  comment 'Jenkins user'
  home jenkins_home_dir
  manage_home true
  shell '/bin/bash'
end

# Create ".ssh" directory
directory "#{jenkins_home_dir}/.ssh" do
  owner jenkins_user
  group jenkins_user
  mode '0700'
  recursive true
end

# Relax ssh host key checks or initial git clone and other ssh will fail
key_config = "Host *\n\tStrictHostKeyChecking no\n"
file "#{jenkins_home_dir}/.ssh/config" do
  owner jenkins_user
  group jenkins_user
  mode '0600'
  content key_config
end

# SSH Key for master authentication
ssh_authorize_key 'jenkins@all-agents.theorchard.local' do
  key 'AAAAB3NzaC1yc2EAAAADAQABAAACAQCiosRmf5zPirdrZ1PGjh5oekGS5V5wlb3/BH4XUq2VkpvCPZn0cKZqPhLNfVSRcyEm9Zbtx5Z+Vquzu/28g13VZx+JfJstEF35/ux0FPa2xjsnxmrkIakrhqe/xLzEJxMsFsWXmAiG0wTOv6dMrebpkvyshde1OkYOfqy6mJgStyxSFnk86Ij6krW6+6hFSbyOoYI4XPH98F0Ng8KAXy2OhqFIGpNMeoz+uRgmPgqVwC+/ZKyZO/xO01MUPBIUFTAD0DUEyXhrRyehGRopCK6jhxaclu6Nmy2jc7QLOWgSIr/Pn9KxwCa64MdOcGx962QMP0mYXUIH158HLejllDWwJMrzSXgKl2MQ96AdzbW72zV6did8ZUPPKLOaBAH5eNiDZzBlqLwWUQPBgHVxam3mCJdAUk/t2zowPsgGllgOSwvcRTX5/PJsWoo4lEOnqz32bcq2vcyB1JEWjFgt9BjzhrvoZvBudWPAeKXRP6HxotUpql5WzZtKuhre8RLhLjXY0az2TbSlCgPrgkr1OtdZfJzK6gel/q9HKt9bj99H3jEdROBkTfNIi5p3fbq4Ot9j70i9LcsT7Uikq5bS0j4spHClJrHkC+xXuwDtaP1oxglZARR/EVyWHTRp1HtRnTmccbyySN8BOMqh+KuhUr1IlnDANiIRFg6eeDa60hK8Bw=='
  home jenkins_home_dir
  user jenkins_user
end

# SSH private key for OrchardCI github access
agent_ssh_key_location = jenkins_home_dir + '/.ssh/id_rsa'
agent_private_key = data_bag_item('secrets', 'jenkins_agent_ssh_private_key')
private_key = agent_private_key['key'].chomp
file agent_ssh_key_location do
  owner jenkins_user
  group jenkins_user
  mode '0600'
  content private_key
end

# Create ".aws" directory for jenkins
directory "#{jenkins_home_dir}/.aws" do
  owner jenkins_user
  group jenkins_user
  mode '0755'
  recursive true
end

# AWS credentials file for EB deployments
jenkins_aws_credentials_location = jenkins_home_dir + '/.aws/credentials'
jenkins_aws_credentials = data_bag_item('secrets', 'jenkins_aws_credentials')
access_key_id = jenkins_aws_credentials['access_key_id'].chomp
secret_access_key = jenkins_aws_credentials['secret_access_key'].chomp
template jenkins_aws_credentials_location do
  source 'aws_credentials.erb'
  owner jenkins_user
  group jenkins_user
  mode '0644'
  variables(
    access_key_id: access_key_id,
    secret_access_key: secret_access_key
  )
end

# AWS config file for EB deployments
jenkins_aws_config_location = jenkins_home_dir + '/.aws/config'
jenkins_aws_credentials = data_bag_item('secrets', 'jenkins_aws_credentials')
access_key_id = jenkins_aws_credentials['access_key_id'].chomp
secret_access_key = jenkins_aws_credentials['secret_access_key'].chomp
template jenkins_aws_config_location do
  source 'aws_config.erb'
  owner jenkins_user
  group jenkins_user
  mode '0644'
  variables(
    access_key_id: access_key_id,
    secret_access_key: secret_access_key
  )
end

# Create fabric_user for deployments
user fabric_user do
  comment 'Fabric user'
  home fabric_home_dir
  manage_home true
  shell '/bin/bash'
end

# Set fs.inotify.max_user_watches
sysctl 'fs.inotify.max_user_watches' do
  value max_user_watches
end

# Give Jenkins user read access to fabric home directory
directory fabric_home_dir do
  owner fabric_user
  group jenkins_user
  mode '0750'
end

# Allow Jenkins user to run commands as Fabric user
template "/etc/sudoers.d/#{jenkins_user}" do
  source 'sudoers.jenkins.erb'
  owner 'root'
  group 'root'
  mode '0440'
end

# Create ".ssh" directory for fabric_user
directory "#{fabric_home_dir}/.ssh" do
  owner fabric_user
  group fabric_user
  mode '0700'
  recursive true
end

# Relax ssh host key checks or initial git clone and other ssh will fail
key_config = "Host *\n\tStrictHostKeyChecking no\n"
file "#{fabric_home_dir}/.ssh/config" do
  owner fabric_user
  group fabric_user
  mode '0600'
  content key_config
end

# SSH private key for fabric_user to access app. hosts
fabric_ssh_key_location = fabric_home_dir + '/.ssh/id_rsa'
fabric_private_key = data_bag_item('secrets', 'qa_fabric_deploy_ssh_private_key')
private_key = fabric_private_key['key'].chomp
file fabric_ssh_key_location do
  owner fabric_user
  group fabric_user
  mode '0600'
  content private_key
end

if platform_family?('rhel')
  if node['platform_version'].start_with?('7')

    # Add IUS repo
    yum_repository 'IUS' do
      description 'IUS Community Packages for Enterprise Linux 7'
      baseurl 'https://repo.ius.io/7/x86_64/'
      gpgkey 'https://repo.ius.io/RPM-GPG-KEY-IUS-7'
      action :create
    end

    # Install git v2+ from IUS
    package 'git' do
      action :remove
    end

    package 'git236'

    # Add EPEL repo
    yum_repository 'epel' do
      description 'Extra Packages for Enterprise Linux 7'
      mirrorlist 'https://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch'
      gpgcheck true
      gpgkey 'https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7'
      action :create
    end

    # Remove Java 1.8 packages
    packages = %w(
      java-1.8.0-openjdk
      java-1.8.0-openjdk-devel
    )

    packages.each do |name|
      package name do
        action :remove
      end
    end

    # Required packages for deploy hosts
    packages = %w(
      bzip2
      epel-release
      gcc
      gcc-c++
      java-11-openjdk-devel
      jq
      openssl-devel
      python2-pip
      subversion
      zip
      unzip
    )

    packages.each do |name|
      package name
    end

    python27_packages = %w(
      fabric
    )

    python27_packages.each do |name|
      execute 'install_package' do
        command "/usr/bin/pip2 install #{name}"
        not_if "/usr/bin/pip2 list | grep -i #{name}"
      end
    end

    python3_packages = %w(
      awscli
      awsebcli
      boto
    )

    python3_packages.each do |name|
      python_package name do
        python '/usr/bin/python3'
      end
    end

    git 'parsley' do
      repository 'git@github.com:/theorchard/parsley.git'
      reference 'master'
      destination "#{fabric_home_dir}/parsley"
      user fabric_user
      group fabric_user
      action :checkout
    end

    # Ensure docker is installed, presumably via https://github.com/theorchard/irrigate-docker
    execute 'permit_jenkins_docker' do
      command "gpasswd -a #{jenkins_user} docker &&" \
               'touch /var/cache/.dockerenabled'
      creates '/var/cache/.dockerenabled'
      notifies :restart, 'service[docker]'
    end

    # Docker disk space cleanup
    cron 'docker_cleanup' do
      hour '*/2'
      minute '0'
      user 'root'
      command '/usr/bin/docker rm -v $(/usr/bin/docker ps -a -q -f status=exited) >/dev/null 2>&1'
    end

    # Docker images cleanup to remove all unused images.
    cron 'docker_images_cleanup' do
      hour '*/4'
      minute '0'
      user 'root'
      command '/usr/bin/docker system prune -a -f --filter until=24h >/dev/null 2>&1'
    end

    # Remove anything in /tmp that has been modified more than an hour ago.
    cron 'temp_cleanup' do
      hour '*'
      minute '30'
      user 'root'
      command '/bin/find /tmp -type f -mmin +60 -exec rm -rf {} \; > /dev/null 2>&1'
    end

    # Remove any jobs that have been modified more than 2 days ago.
    cron 'jobs_cleanup' do
      hour '*/4'
      minute '40'
      user 'root'
      command "/bin/find #{jenkins_home_dir}/workspace -maxdepth 1 -type d -mtime +2 -exec rm -rf {} \\; > /dev/null 2>&1"
    end

    # CIS 4.1.1 - allow auditd configuration to remain compliant but clean Docker audit logs, which fill up to 10s of GB/day.
    # If CIS score were not affected, we would simply adjust auditd rules, but instead handle out-of-band.
    cron 'auditd_cleanup' do
      hour '*/4'
      minute '15'
      user 'root'
      command '/bin/find /var/log/audit -type f -mtime +1 -exec rm -rf {} \; > /dev/null 2>&1'
    end

  end
end