Code cleanup, refinement, and some minor corrections.

metadata.rb

@@ -4,7 +4,7 @@ maintainer_email 'psi-jack@linux-help.org'
 license          'GPLv3'
 description      'Installs/Configures freeipa'
 long_description 'Installs/Configures freeipa'
-version          '0.1.1'
+version          '0.1.2'
 
 depends 'ohai'
 depends 'chef-vault'

recipes/server.rb

@@ -38,14 +38,14 @@ passwords = chef_vault_item(:freeipa, 'passwords')
 #package "oddjob"
 #package "ipa-client"
 #package "ipa-server"
-package "rsync"
+#package "rsync"
 
 package 'ipa-server' do
   case node[:platform]
   when 'redhat', 'centos'
     package_name 'ipa-server'
   end
-  action :install
+  action	:install
 end
 
 ##### Security considerations
@@ -73,28 +73,24 @@ include_recipe "sshroot2rootssh"
 # negotiate for master
 freeipa_masters = search(:node, "freeipa_master:true")
 if freeipa_masters.empty? then
-  node.set[:freeipa][:master] = true
+  ##### Do master stuff
-#end
-
-##### Do master stuff
-#if node[:freeipa][:master] then
 
   # write better tests to see if freeipa is already set up.
   ## Bootstrap FreeIPA
   execute "initializing freeipa-server" do
-    not_if "ls /var/lib/ipa/sysrestore/sysrestore.state"
+    not_if	{ File.exist?('/var/liv/ipa/sysrestore/sysrestore.state') }
-    cmd = "ipa-server-install"
+    cmd =	"ipa-server-install"
-    cmd += " --hostname " + node[:fqdn]
+    cmd +=	" --hostname " + node[:fqdn]
-    #cmd += " -u " + "ipaadmin"
+    #cmd +=	" -u " + "ipaadmin"
-    cmd += " -r " + node[:domain].upcase
+    cmd +=	" -r " + node[:domain].upcase
-    cmd += " -n " + node[:domain]
+    cmd +=	" -n " + node[:domain]
-    cmd += " -p " + passwords['ldap_server_admin_pwd']
+    cmd +=	" -p " + passwords['ldap_server_admin_pwd']
-    cmd += " -P " + passwords['kdc_database_master_key']
+    cmd +=	" -P " + passwords['kdc_database_master_key']
-    cmd += " -a " + passwords['ipa_user_pwd']
+    cmd +=	" -a " + passwords['ipa_user_pwd']
-    cmd += " -N "
+    cmd +=	" -N "
-    cmd += " -U "
+    cmd +=	" -U "
-    cmd += " --no-host-dns "
+    cmd +=	" --no-host-dns --mkhomedir"
-    command "#{cmd}"
+    command 	cmd
     #notifies :start, "service[dirsrv]"
   end
 
@@ -118,61 +114,78 @@ if freeipa_masters.empty? then
   #  end
   #end
 
-#end
+  node.set[:freeipa][:master] = true
 
-### Subsequent nodes 
+elsif (node[:freeipa][:master].nil? && node[:freeipa][:master] == false) && (node[:freeipa][:replica].nil? && node[:freeipa][:replica] == false) then
-#unless node[:freeipa][:master] then
+  ### Subsequent Replica Nodes 
-else
 
   # check to see if slave is setup to replicat from master
   #"ipa-replica-manage -p 0123456789 -H authentication-1.dev.us-east-1.aws.afistfulofservers.net list"
+  ssh_noauth = "-o StrictHostKeyChecking=yes -o PasswordAuthentication=no"
+
+  execute "prepare replica from master" do
+    cmd =	"ssh #{ssh_noauth} root@#{freeipa_masters[0][:fqdn]} ipa-replica-prepare -p #{passwords['ldap_server_admin_pwd']}"
+    command	cmd
+    not_if	"ssh #{ssh_noauth} root@#{freeipa_masters[0][:fqdn]} test -f /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
+    #notifies :run, 'execute[rsyncing freeipa replication data]', :immediately
+  end
 
   # Check for replication config
   # Attempt to copy config from master.
   # Fail gracefully if not found.
-  execute "rsyncing freeipa replication data" do
+  execute "scping freeipa replication data" do
-    #only_if "ipa-replica-manage -p #{ldap_server_admin_pwd} -H #{freeipa_masters[0][:fqdn]} list | grep #{node[:fqdn]}"
+    #only_if "ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0][:fqdn]} list | grep #{node[:fqdn]}"
-    cmd = "rsync -a -e \"ssh "
+    only_if	"ssh #{ssh_noauth} root@#{freeipa_masters[0][:fqdn]} test -f /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
-    cmd += " -o StrictHostKeyChecking=yes"
+    not_if	{ File.exist?("/var/lib/ipa/replica-info-#{node[:fqdn]}.gpg") }
-    cmd += " -o PasswordAuthentication=no\""
+    #cmd = "rsync -a -e \"ssh " + ssh_noauth
-    cmd += " root@"
+    cmd =	"scp " + ssh_noauth
-    cmd += "#{freeipa_masters[0][:fqdn]}:"
+    cmd +=	" root@" + freeipa_masters[0][:fqdn]
-    cmd += "/var/lib/ipa/replica-info*"
+    cmd +=	":/var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
-    cmd += " /var/lib/ipa"
+    cmd +=	" /var/lib/ipa/"
-    command cmd
+    command	cmd
-    ignore_failure true
+    notifies	:run, 'execute[joining freeipa cluster]', :immediately
   end
 
   execute "joining freeipa cluster" do
-    not_if "ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0][:fqdn]} list | grep #{node[:fqdn]}"
+    not_if	"ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0][:fqdn]} list | grep #{node[:fqdn]}"
-    only_if "ls /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
+    #only_if "ls /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
-    cmd = "ipa-replica-install"
+    only_if	{ File.exist?("/var/lib/ipa/replica-info-#{node[:fqdn]}.gpg") }
-    cmd += " -p " + passwords['ldap_server_admin_pwd']
+    cmd =	"ipa-replica-install"
-    cmd +=" /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
+    cmd +=	" -p " + passwords['ldap_server_admin_pwd']
-    command cmd
+    cmd +=	" --unattended --mkhomedir --skip-conncheck"
+    cmd +=	" /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
+    command	cmd
+    sensitive	true
+    action 	:nothing
+    notifies	:run, 'execute[copying CA private key]', :immediately
   end
 
   # copy CA private key 
   # /etc/dirsrv/slapd-DEV-US-EAST-1-AWS-AFISTFULOFSERVERS-NET/pwdfile.txt
   execute "copying CA private key" do 
-    only_if "ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0][:fqdn]} list | grep #{node[:fqdn]}"
+    only_if	"ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0][:fqdn]} list | grep #{node[:fqdn]}"
-    only_if "ls /etc/dirsrv/slapd-#{node[:domain].upcase}/"
+    only_if	{ File.exist?("/etc/dirsrv/slapd-#{node[:domain].upcase}/") }
-    not_if "ls /etc/dirsrv/slapd-#{node[:domain].upcase}/cacert.p12"
+    not_if	{ File.exist?("/etc/dirsrv/slaved-#{node[:domain].upcase}/cacert.p12") }
-    cmd = "rsync -a -e \"ssh "
+    cmd =	"scp " + ssh_noauth
-    cmd += " -o StrictHostKeyChecking=yes"
+    cmd +=	" root@" + freeipa_masters[0][:fqdn]
-    cmd += " -o PasswordAuthentication=no\""
+    cmd +=	":/etc/dirsrv/slapd-#{node[:domain].upcase}/cacert.p12"
-    cmd += " root@"
+    cmd +=	" /etc/dirsrv/slapd-#{node[:domain].upcase}/"
-    cmd += "#{freeipa_masters[0][:fqdn]}:"
+    command	cmd
-    cmd += "/etc/dirsrv/slapd-#{node[:domain].upcase}/cacert.p12"
-    cmd += " /etc/dirsrv/slapd-#{node[:domain].upcase}/"
-    #puts "DEBUG: #{cmd}"
-    command cmd
     ignore_failure true
+    action	:nothing
+    notifies	:run, 'ruby_block[set node as replica]', :immediately
+  end
+
+  ruby_block "set node as replica" do
+    block do
+      node.set[:freeipa][:replica] = true
+    end
+    action	:nothing
   end
 end
 
 file '/etc/ipa/admin.password' do
-  content	"#{passwords['ipa_user_pwd']}"
+  content	passwords['ipa_user_pwd']
   owner		'root'
   group		'root'
   mode		'0600'
@@ -183,12 +196,13 @@ end
 # enable all the default services recommended by the freeipa docs
 
 #service "dirsrv" do
-#  action [:enable,:start]
+#  service_name	"dirsrv@#{node[:domain].upcase.gsub(".", "-")}"
+#  action	[:enable,:start]
 #end
 
 #service "krb5kdc" do
-#  only_if service[:dirsrv] => running
+#  only_if	service[:dirsrv] => running
-#  action [:enable,:start]
+#  action	[:enable,:start]
 #end
 
 #template "/etc/httpd/conf.d/ipa.conf" do
@@ -197,18 +211,18 @@ end
 #  notifies :restart, "service[httpd]"
 #end
 
-#service "httpd" do
+service "httpd" do
-#  action [:enable,:start]
+  action	[:enable,:start]
-#end
+end
 
 #service "ipa_kpasswd" do
 #  action [:enable,:start]
 #end
 
-#service "ipa" do
+service "ipa" do
-#  action [:enable,:start]
+  action	[:enable,:start]
-#end
+end
-#
+
 #service "messagebus" do
 #  action [:enable,:start]
 #end