Issue 2600 - Normalize ownership and priviliges for Nginx logs

modules/nginx/manifests/init.pp

 class nginx (
     $worker_processes = $nginx::params::worker_processes,
     $worker_connections = $nginx::params::worker_connections,
     $ssl_session_cache =  $nginx::params::ssl_session_cache
   ) inherits nginx::params {
 
   apt::source {'nginx':
     location => "http://nginx.org/packages/ubuntu",
     repos => "nginx",
     key => "7BD9BF62",
     key_source => "http://nginx.org/keys/nginx_signing.key"
   }
 
   # Ensures that nginx is not installed from the Ubuntu sources
   package {'nginx-common':
     ensure => purged,
     before => Package['nginx']
   }
 
   package {'nginx':
     ensure => '1.8.0-1~precise',
     require => Apt::Source['nginx']
   }
 
   File {
     owner => root,
     group => root,
     mode => 0644,
   }
+
+  Exec {
+    path => '/usr/bin:/bin',
+    logoutput => 'on_failure',
+  }
+
 
   file {'/etc/nginx/nginx.conf':
     content => template('nginx/nginx.conf.erb'),
     require => Package['nginx'],
     notify => Service['nginx']
   }
 
   file {'/etc/nginx/sites-available':
     ensure => directory,
     require => Package['nginx']
@@ skipping 72 matching lines @@
       require => File["/etc/nginx/sites-available/${domain}"],
       content => template('nginx/logrotate.erb')
     }
   }
 
   file {'/etc/logrotate.d/nginx':
     source => 'puppet:///modules/nginx/logrotate',
     require => Package['nginx']
   }
 
-  $log_path = '/var/log/nginx'
+  $find_cmd_base = [
+    'find', '/var/log/nginx',
+    '-mindepth', '1', '-maxdepth', '1', '-type', 'f',
+  ]
 
-  $user_quoted = shellquote($nginx::params::user)
-  $chown_find_cmd_base = "find ${log_path} -mindepth 1 -maxdepth 1 -type f \( \! -user ${user_quoted} -o \! -group adm \)"
-  $chown_cmd = "$chown_find_cmd_base -ls -exec chown ${user_quoted}.adm {} \;"
-  $chown_onlyif_cmd = "test $(${chown_find_cmd_base} -print |wc -l) -gt 0"
+  # Kill the find process to force an exit status != 0 by finding the parent pid
+  # of the exec's sh process
+  $find_kill_exec = [
+    '-exec', 'sh', '-c',
+    'ps -p $$ -o ppid= | xargs kill -TERM',
+     ';',
+  ]
+
+  $find_chown_base = [
+    $find_cmd_base,
+    '-not', '(', '-user', $nginx::params::user, '-and', '-group', 'adm', ')',
+  ]
+  $find_chown_exec = [
+    '-ls', '-exec', 'chown',
+    "${nginx::params::user}.adm", '{}', ';',
+  ]
+
   exec {"set_logfiles_owner":
-    command => $chown_cmd,
-    onlyif => $chown_onlyif_cmd,
-    path => '/bin:/usr/bin',

[mathias, 2015/07/09 14:28:47]

Please use "/usr/bin:/bin".

-    require => Package['nginx'],
+    command => shellquote($find_chown_base, $find_chown_exec),
+    unless => shellquote($find_chown_base, $find_kill_exec),
+    subscribe => Service['nginx'], 
   }
 
-  $chmod_find_cmd_base = "find ${log_path} -mindepth 1 -maxdepth 1 -type f \! -perm 0640"
-  $chmod_cmd = "$chmod_find_cmd_base -ls -exec chmod 0640 {} \;"
-  $chmod_onlyif_cmd = "test $(${chmod_find_cmd_base} -print |wc -l) -gt 0"
+  $find_chmod_base = [$find_cmd_base, '-not', '-perm', '0640']
+  $find_chmod_exec = ['-ls', '-exec', 'chmod', '0640', '{}', ';']
+
   exec {"set_logfiles_permissions":
-    command => $chmod_cmd,   
-    onlyif => $chmod_onlyif_cmd,
-    path => '/bin:/usr/bin',

[mathias, 2015/07/09 14:28:47]

It may actually be easier to use a class-wide `Exec { path => "..." }` instead
of applying the aforementioned change twice.

-    require => Package['nginx'],
+    command => shellquote($find_chmod_base, $find_chmod_exec),
+    unless => shellquote($find_chmod_base, $find_kill_exec),
+    subscribe => Service['nginx'],
   }
 
   service {'nginx':
     ensure => running,
     enable => true,
     restart => '/etc/init.d/nginx reload',
     hasstatus => true,
     require => File['/etc/nginx/nginx.conf']
   }
 }