Issue 2471 - Update our Discourse instance

modules/discourse/manifests/init.pp

 class discourse(
     $domain,
     $certificate,
     $private_key,
     $is_default = false
   ) inherits private::discourse {
 
+  $hg_revision = 'd31d28147381'
+  $git_revision = '8a3a02421a39f53b6adf3ca9a6fdba73f42bc932'
+  $ruby_version = '2.1.2'
+  $postgresql_version = '9.3'
+
   class { 'postgresql::globals':
     manage_package_repo => true,
-    version => '9.3',
+    version => $postgresql_version,
   }->
   class {"postgresql::server":}
+
+  class {"postgresql::server::contrib":
+    package_ensure => 'present',
+  }
 
   postgresql::server::database {'discourse':}
 
   postgresql::server::role {'discourse':
     password_hash => postgresql_password('discourse', $database_password),
     db => 'discourse',
     login => true,
     superuser => true,
     require => Postgresql::Server::Database['discourse']
   }
 
-  $basic_dependencies = ['redis-server', 'libjemalloc1', 'curl', 'libyaml-dev']
-  $gem_dependencies = ['git', 'build-essential', 'libxml2-dev',
-      'libxslt-dev', 'libpq-dev']
+  $rvm_dependencies = ['curl', 'git-core', 'patch', 'build-essential', 'bison',
+      'zlib1g-dev', 'libssl-dev', 'libxml2-dev', 'sqlite3', 'libsqlite3-dev',
+      'autotools-dev', 'libxslt1-dev', 'libyaml-0-2', 'autoconf', 'automake',
+      'libreadline6-dev', 'libyaml-dev', 'libtool', 'libgdbm-dev',
+      'libncurses5-dev', 'libffi-dev', 'pkg-config', 'gawk']
+  $discourse_dependencies = ['redis-server', 'libjemalloc1']
+  $gem_dependencies = ['libpq-dev']
   $image_optim_dependencies = ['advancecomp', 'gifsicle', 'jhead', 'jpegoptim',
       'libjpeg-progs', 'optipng', 'pngcrush']
   $image_sorcery_dependencies = 'imagemagick'
 
-  package {[$basic_dependencies, $gem_dependencies, $image_optim_dependencies, $image_sorcery_dependencies]:
+  package {[$rvm_dependencies, $discourse_dependencies, $gem_dependencies, $image_optim_dependencies, $image_sorcery_dependencies]:
     ensure => present
   }
 
   Exec <| tag == 'rvm' |> {
-    path => '/bin:/usr/bin:/usr/sbin:/usr/local/bin:/home/discourse/.rvm/bin',
+    path => '/home/discourse/.rvm/bin:/usr/local/bin:/usr/bin:/bin',
     user => discourse,
     group => www-data,
     environment => ['HOME=/home/discourse'],
   }
 
   exec {'install-rvm-key':
     command => 'gpg --keyserver hkp://keys.gnupg.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3',
     tag => 'rvm',
     unless => 'gpg --list-keys | grep D39DC0E3',
   }
 
+  exec {'install-rvm':
+    command => 'curl -sSL https://get.rvm.io | bash -s stable',
+    tag => 'rvm',
+    creates => '/home/discourse/.rvm',
+    timeout => 0,
+    logoutput => true,
+    require => [Exec['install-rvm-key'], Package[$rvm_dependencies]],
+  }
+
   exec {'install-ruby':
-    command => 'curl -sSL https://get.rvm.io | bash -s stable --ruby=2.1.2',
-    tag => 'rvm',
-    creates => '/home/discourse/.rvm',
-    require => [Exec['install-rvm-key'], Package[$basic_dependencies]],
+    command => "rvm install $ruby_version && rvm default do rvm --default use $ruby_version",
+    tag => 'rvm',
+    unless => "rvm list | grep $ruby_version",

[mathias, 2015/05/26 10:02:16]

Please use shellquote() to ensure $ruby_version cannot break anything here --

[Wladimir Palant, 2015/05/26 10:41:17]

Given that $ruby_version is a constant set above, do you consider that
necessary? Also, if we do it for $ruby_version then we should do it for
$hg_revision as well.

[mathias, 2015/05/26 10:54:36]

Indeed, it should be done there as well.

And yes I believe it's necessary. One should always assume the next programmer
to be less careful and wise than oneself (even if it will be oneself most
likely). And such a guy may forget to check for the use of $ruby_version when
migrating it to become a parameter one day (for example, but not even unlikely),
which can also easily be overseen in a code-review.

However, please note that we agreed last year on making use of shell_escape()
wherever it may make sense - just to have an easy but secure guideline that does
not require the same decision ("is it necessary?") over and over again..

+    timeout => 0,
+    logoutput => true,
+    notify => Exec['init-discourse'],
+    require => Exec['install-rvm'],
   }
 
   exec {'install-bundler':
     command => 'rvm default do gem install bundler',
     tag => 'rvm',
-    unless => 'rvm default do gem list | grep "^bundler ")',
+    unless => 'rvm default do gem list | grep "^bundler "',
     require => Exec['install-ruby'],
   }
 
   file {'/opt/discourse':
     ensure => directory,
     mode => 755,
     owner => discourse,
     group => www-data
   }
 
   file {['/opt/discourse/tmp', '/opt/discourse/tmp/pids']:
     ensure => directory,
     mode => 755,
     owner => discourse,
     group => www-data,
     require => Exec['fetch-discourse']
   }
 
   file {'/opt/discourse/config/discourse.conf':
     mode => 600,
     owner => discourse,
     group => www-data,
     content => template('discourse/discourse.conf.erb'),
     notify => Service['discourse'],
-    require => Exec['fetch-discourse']
+    require => Exec['update-discourse']
   }
 
   file {'/usr/local/bin/init-discourse':
     mode => 0755,
     owner => root,
     group => root,
     source => 'puppet:///modules/discourse/init-discourse'
   }
 
   user {'discourse':
     ensure => present,
     comment => 'Discourse user',
     home => '/home/discourse',
     gid => www-data,
     password => '*',
     managehome => true
   }
 
   file {'/etc/sudoers.d/discourse':
     ensure => present,
     owner => root,
     group => root,
     mode => 0440,
     source => 'puppet:///modules/discourse/sudoers',
     require => User['discourse']
   }
 
   exec {'fetch-discourse':
-    command => "hg clone https://hg.adblockplus.org/discourse /opt/discourse",
+    command => 'hg clone --noupdate https://hg.adblockplus.org/discourse /opt/discourse',
     path => ["/usr/bin/", "/bin/"],
     user => discourse,
     group => www-data,
+    timeout => 0,
     require => [Package['mercurial'], File['/opt/discourse']],
+    onlyif => "test ! -d /opt/discourse/.hg"
+  }
+
+  exec {'update-discourse':
+    command => "hg update -R /opt/discourse --clean -r $hg_revision",
+    unless => "hg id -R /opt/discourse | grep $hg_revision",
+    path => ["/usr/bin/", "/bin/"],
+    user => discourse,
+    group => www-data,
     notify => Exec['init-discourse'],
-    onlyif => "test ! -d /opt/discourse/.hg"
-  }
-
-  file {'/opt/discourse/config/initializers/airbrake.rb':
-    ensure => absent,
-    before => Exec['init-discourse'],
+    require => Exec['fetch-discourse'],
   }
 
   file {'/opt/discourse/config/version.rb':
     ensure => present,
     owner => discourse,
     group => www-data,
 
     # This is hardcoded here so that Discourse doesn't try to extract it from
     # the repository. Ideally, we should update it when updating Discourse.
-    content => '$git_version = "8a3a02421a39f53b6adf3ca9a6fdba73f42bc932"',
+    content => "\$git_version = '$git_revision'",
+    require => Exec['update-discourse'],
     before => Exec['init-discourse'],
   }
 
   exec {'init-discourse':
     command => 'rvm default do /usr/local/bin/init-discourse',
     tag => 'rvm',
     subscribe => File['/usr/local/bin/init-discourse'],
     refreshonly => true,
     timeout => 0,
     logoutput => true,
     require => [Exec['install-bundler'],
-                Package['postgresql-server', $gem_dependencies],
+                Package[$discourse_dependencies, $gem_dependencies],
                 User['discourse'], File['/etc/sudoers.d/discourse'],
-                Exec['fetch-discourse'],
+                Exec['update-discourse'],
                 File['/opt/discourse/config/discourse.conf'],
                 Postgresql::Server::Role['discourse']]
   }
 
   Discourse::Sitesetting <| |> {
     require => Exec['init-discourse']
   }
 
   discourse::sitesetting {'title':
     ensure => present,
@@ skipping 178 matching lines @@
     global_config => '
       upstream discourse {
         server localhost:3000;
       }',
     is_default => $is_default,
     certificate => $certificate,
     private_key => $private_key,
     log => 'access_log_intraforum'
   }
 }