Noissue - Void nginx $restart_command after package upgrade

modules/nginx/manifests/init.pp

 class nginx (
     $worker_processes = $nginx::params::worker_processes,
     $worker_connections = $nginx::params::worker_connections,
     $ssl_session_cache =  $nginx::params::ssl_session_cache,
     $geoip_country = undef,
     $geoip_city = undef,
   ) inherits nginx::params {
 
   # Class['ssh'] is assumed to handle SSL-related quirks and therefore
   # the inclusion here became necessary.
@@ skipping 202 matching lines @@
   $find_chmod_base = [$find_cmd_base, '-not', '-perm', '0640']
   $find_chmod_exec = ['-ls', '-exec', 'chmod', '0640', '{}', ';']
 
   exec {"set_logfiles_permissions":
     command => shellquote($find_chmod_base, $find_chmod_exec),
     unless => shellquote($find_chmod_base, $find_kill_exec),
     subscribe => Service['nginx'],
   }
 
   $restart_command = join([
+    'rm /tmp/nginx-restart-lock 2>/dev/null || (',
     'set -e',
     'pid=`cat /var/run/nginx.pid`',
     'kill -USR2 "$pid"',
     'sleep 2',
     'kill -QUIT "$pid"',
+    ')',
   ], "\n")
 
   service {'nginx':
     ensure => running,
     enable => true,
     restart => $restart_command,
     hasstatus => true,
     require => Package['nginx'],
   }
 
   Service['nginx'] <~ Class['ssh']
 
   file {'/usr/share/nginx/html/50x.html':
     mode => 0644,
     owner => 'root',
     require => Package['nginx'],
     source => 'puppet:///modules/nginx/50x.html',
   }
+
+  # This little hack is required to ensure the $restart_command being voided
+  # when the package is upgraded or installed for the first time, in which case
+  # the package maintainer's scripts would conflict with the Puppet resources,
+  # terminating both new and old processes (see http://hub.eyeo.com/issues/408)
+  exec {'nginx-update-hook':
+    before => Service['nginx'],
+    command => '/usr/bin/env touch /tmp/nginx-restart-lock',
+    refreshonly => true,
+    subscribe => Package['nginx'],
+  }
+
+  # The package does not know about the lock file, hence it is required to
+  # manually ensure the file being absent afterwards, for the next run
+  file {'/tmp/nginx-restart-lock':
+    ensure => 'absent',
+    require => Service['nginx'],
+  }
 }