Issue 2471 - Update our Discourse instance

modules/discourse/manifests/init.pp

 class discourse(
     $domain,
     $certificate,
     $private_key,
     $is_default = false
   ) inherits private::discourse {
 
+  $hg_revision = 'd31d28147381'
+  $git_revision = '8a3a02421a39f53b6adf3ca9a6fdba73f42bc932'
+  $ruby_version = '2.1.2'
+  $postgresql_version = '9.3'
+
   class { 'postgresql::globals':
     manage_package_repo => true,
-    version => '9.3',
+    version => $postgresql_version,
   }->
   class {"postgresql::server":}
 
   class {"postgresql::server::contrib":
     package_ensure => 'present',
   }
 
   postgresql::server::database {'discourse':}
 
   postgresql::server::role {'discourse':
@@ skipping 35 matching lines @@
   exec {'install-rvm':
     command => 'curl -sSL https://get.rvm.io | bash -s stable',
     tag => 'rvm',
     creates => '/home/discourse/.rvm',
     timeout => 0,
     logoutput => true,
     require => [Exec['install-rvm-key'], Package[$rvm_dependencies]],
   }
 
   exec {'install-ruby':
-    command => 'rvm install 2.1.2 && rvm default do rvm --default use 2.1.2',
-    tag => 'rvm',
-    unless => 'rvm list | grep 2.1.2',
+    command => "rvm install $ruby_version && rvm default do rvm --default use $ruby_version",
+    tag => 'rvm',
+    unless => "rvm list | grep $ruby_version",

[mathias, 2015/05/26 10:02:16]

Please use shellquote() to ensure $ruby_version cannot break anything here --

[Wladimir Palant, 2015/05/26 10:41:17]

Given that $ruby_version is a constant set above, do you consider that
necessary? Also, if we do it for $ruby_version then we should do it for
$hg_revision as well.

[mathias, 2015/05/26 10:54:36]

Indeed, it should be done there as well.

And yes I believe it's necessary. One should always assume the next programmer
to be less careful and wise than oneself (even if it will be oneself most
likely). And such a guy may forget to check for the use of $ruby_version when
migrating it to become a parameter one day (for example, but not even unlikely),
which can also easily be overseen in a code-review.

However, please note that we agreed last year on making use of shell_escape()
wherever it may make sense - just to have an easy but secure guideline that does
not require the same decision ("is it necessary?") over and over again..

     timeout => 0,
     logoutput => true,
     notify => Exec['init-discourse'],
     require => Exec['install-rvm'],
   }
 
   exec {'install-bundler':
     command => 'rvm default do gem install bundler',
     tag => 'rvm',
     unless => 'rvm default do gem list | grep "^bundler "',
@@ skipping 14 matching lines @@
     group => www-data,
     require => Exec['fetch-discourse']
   }
 
   file {'/opt/discourse/config/discourse.conf':
     mode => 600,
     owner => discourse,
     group => www-data,
     content => template('discourse/discourse.conf.erb'),
     notify => Service['discourse'],
-    require => Exec['fetch-discourse']
+    require => Exec['update-discourse']
   }
 
   file {'/usr/local/bin/init-discourse':
     mode => 0755,
     owner => root,
     group => root,
     source => 'puppet:///modules/discourse/init-discourse'
   }
 
   user {'discourse':
     ensure => present,
     comment => 'Discourse user',
     home => '/home/discourse',
     gid => www-data,
     password => '*',
     managehome => true
   }
 
   file {'/etc/sudoers.d/discourse':
     ensure => present,
     owner => root,
     group => root,
     mode => 0440,
     source => 'puppet:///modules/discourse/sudoers',
     require => User['discourse']
   }
 
   exec {'fetch-discourse':
-    command => "hg clone https://hg.adblockplus.org/discourse /opt/discourse",
+    command => 'hg clone --noupdate https://hg.adblockplus.org/discourse /opt/discourse',
     path => ["/usr/bin/", "/bin/"],
     user => discourse,
     group => www-data,
     timeout => 0,
     require => [Package['mercurial'], File['/opt/discourse']],
+    onlyif => "test ! -d /opt/discourse/.hg"
+  }
+
+  exec {'update-discourse':
+    command => "hg update -R /opt/discourse --clean -r $hg_revision",
+    unless => "hg id -R /opt/discourse | grep $hg_revision",
+    path => ["/usr/bin/", "/bin/"],
+    user => discourse,
+    group => www-data,
     notify => Exec['init-discourse'],
-    onlyif => "test ! -d /opt/discourse/.hg"
-  }
-
-  file {'/opt/discourse/config/initializers/airbrake.rb':
-    ensure => absent,
-    before => Exec['init-discourse'],
+    require => Exec['fetch-discourse'],
   }
 
   file {'/opt/discourse/config/version.rb':
     ensure => present,
     owner => discourse,
     group => www-data,
 
     # This is hardcoded here so that Discourse doesn't try to extract it from
     # the repository. Ideally, we should update it when updating Discourse.
-    content => '$git_version = "8a3a02421a39f53b6adf3ca9a6fdba73f42bc932"',
-    require => Exec['fetch-discourse'],
+    content => "\$git_version = '$git_revision'",
+    require => Exec['update-discourse'],
     before => Exec['init-discourse'],
   }
 
   exec {'init-discourse':
     command => 'rvm default do /usr/local/bin/init-discourse',
     tag => 'rvm',
     subscribe => File['/usr/local/bin/init-discourse'],
     refreshonly => true,
     timeout => 0,
     logoutput => true,
     require => [Exec['install-bundler'],
                 Package[$discourse_dependencies, $gem_dependencies],
                 User['discourse'], File['/etc/sudoers.d/discourse'],
-                Exec['fetch-discourse'],
+                Exec['update-discourse'],
                 File['/opt/discourse/config/discourse.conf'],
                 Postgresql::Server::Role['discourse']]
   }
 
   Discourse::Sitesetting <| |> {
     require => Exec['init-discourse']
   }
 
   discourse::sitesetting {'title':
     ensure => present,
@@ skipping 178 matching lines @@
     global_config => '
       upstream discourse {
         server localhost:3000;
       }',
     is_default => $is_default,
     certificate => $certificate,
     private_key => $private_key,
     log => 'access_log_intraforum'
   }
 }