Puppet Series – Automate deploying Go application with Puppet

require 'net/http'
require 'json'

Puppet::Functions.create_function(:'profiles::get_latest_pkg_version') do
  dispatch :get_latest_pkg_version do
    param 'String', :api_url
    optional_param 'Integer', :limit
    return_type 'String'
  end

  def get_latest_pkg_version(api_url, limit = 3)
    # Raise Error if the request has more than 3 redirections (rare case)
    raise Puppet::Error, 'Too many redirects' if limit <= 0

    uri = URI(api_url)

    http = Net::HTTP.new(uri.host, uri.port)
    http.use_ssl = (uri.scheme == 'https')

    request = Net::HTTP::Get.new(uri)
    request['User-Agent'] = 'Puppet'

    response = http.request(request)

    case response
    when Net::HTTPSuccess
      data = JSON.parse(response.body)

      tag =
        data['tag_name'] ||          # GitHub & GitLab
        data.dig('release', 'tag')   # fallback

      raise Puppet::Error, "tag_name missing in #{data}" unless tag

      tag.sub(/^v/, '')
    
    # Handle GitLab API's redirection for the latest release
    when Net::HTTPRedirection
      location = response['location']
      new_uri = URI.join(uri, location)

      get_latest_pkg_version(new_uri.to_s, limit - 1)

    else
      raise Puppet::Error,
            "HTTP #{response.code} fetching #{api_url}: #{response.body}"
    end
  end
end

# Class: profiles::release
#
# Set up necessary files for an application and release application when it has new version
#
class profiles::release (
  Hash $applications,
) {
  include nginx
  $applications.each |String $app_name, Hash $configs| {
    profiles::release::app { $app_name:
      * => $configs,
    }
  }
}

# Custom resource function: profiles::release::app
#
# Set up necessary files for an application and release application when it has new version
# 
#  NOTE: some of parameters below have default options. That means we don't need to provide value in case we want to change.
#
#  @param project_path: is the directory that stores the app.
#  @param project_name: name of the project on e.g. GitLab or GitLab where we store the app. 
#  @param project_id: is the project's ID. This is for projects on GitLab.
#  @param prefix_api_url: is the prefix url of api link for $release_api_url and $download_url
#     e.g. we have https://gitlab.com/api/v4/projects/{project_id}/releases/permalink/latest
#     the $prefix_api_url should be https://gitlab.com/api/v4/projects    
#                              
#  @param release_api_url: is the api link where we get the latest version of the app
#  @param download_url: is the app's downloadable link for the new released version 
#  @param archive_path: is the archive directory where we store multiple app's versions
#  @param resource_tag: is the tag that we can specify Puppet to run this class only
#  @param app_port: is the app's port
#  @param domain_url: is the domain that we want to set up in Nginx to acces app. 
#                     App behinds Nginx through Proxy.
#  @param app_owner: is the user who owns the app. We run this app under this user.
#  @param app_group: is the Group who owns the app.
#  @param app_command: is the main command to run the app.
#  @param app_command_path: is the full path of main command
#  @param app_command_args: is the args that we want to pass in along with the main command.
#  @param db_host: is the database's host. (IP address or domain)
#  @param db_port: is the database's port
#  @param db_username: is the database's username
#  @param db_password: is the database's password
#  @param db_name: is the database's name
#  @param db_config_filename: is the config filename for the database connection
#  @param db_config_filepath: is the full path of the $db_config_filename.
#  @param arch: is the architecture of the archive file E.g. amd64
#  @param app_service_name: is the app's service name that Puppet should start through systemd
define profiles::release::app (
  String $project_path     = "/data/app/${name}",
  String $project_name     = $name,
  String $project_id,
  String $prefix_api_url,
  String $release_api_url  = '',
  String $download_url     = '',
  String $archive_path     = "${$project_path}/archived",
  String $archive_name     = '',
  String $resource_tag     = "release-${name}",
  Integer $app_port         = 8080,
  String $domain_url       = $trusted['certname'],
  String $app_owner        = 'run-app',
  String $app_group        = 'run-app',
  String $app_command      = $name,
  String $app_command_path = "${project_path}/${name}",
  Array  $app_command_args = [],
  String $db_host,
  Integer $db_port,
  String $db_username,
  String $db_password,
  String $db_name,
  String $db_config_filename = 'database_config.yaml',
  String $db_config_filepath = "${project_path}/${db_config_filename}",
  String $arch               = '',
  String $app_service_name   = "${name}-app",
) {
  include stdlib
  # Escaping to avoid systemd break
  # E.g. someone passes "--config=/etc/my app/config.yaml" into args. 
  #      it should become "--config=/etc/my\ app/config.yaml"
  $app_cmd_args_escaped = $app_command_args.map |$arg| {
    stdlib::shell_escape($arg)
  }.join(' ')

  # Default to Gitlab's API latest release if not specified
  # see https://docs.gitlab.com/api/releases/#get-the-latest-release
  $real_release_api_url = $release_api_url ? {
    ''      => "${prefix_api_url}/${project_id}/releases/permalink/latest",
    default => $release_api_url,
  }

  if empty($arch) {
    case $facts['os']['architecture'] {
      'x86_64', 'amd64': {
        $real_arch = 'amd64'
      }
      'aarch64': {
        $real_arch = 'arm64'
      }
      default:           {
        fail("Unsupported kernel architecture: ${facts['os']['architecture']}")
      }
    }
  } else {
    $real_arch = $arch
  }

  # Create User and Group
  group { $app_group:
    ensure => 'present',
  }

  user { $app_owner:
    ensure => 'present',
  }

  # Set all files generated by this 'profiles::release::app' with specified User/Group
  File {
    owner   => $app_owner,
    group   => $app_group,
  }

  # Create corresponding paths for the app
  file { [$project_path, $archive_path]:
    ensure  => directory,
    require => [Group[$app_group], User[$app_owner]],
  }

  # Create a database config file with provided parameters for the app
  file { $db_config_filepath:
    ensure  => file,
    content => template("profiles/release/${db_config_filename}.erb"),
    require => [Group[$app_group], User[$app_owner]],
  }

  # Get the latest version of the app
  # This is to ensure the app is updated when we release new version
  $version = profiles::get_latest_pkg_version($real_release_api_url)

  # If we set $archive_name, it overrides the $version above.
  # We have to set correct version of the archived package
  $real_archive_name = $archive_name ? {
    ''      => "${name}-linux-${real_arch}-v${version}.tar.gz",
    default => $archive_name,
  }

  # Default to Gitlab's API for generic packages if not specified
  # see https://docs.gitlab.com/user/packages/generic_packages/
  $real_download_url = $download_url ? {
    ''      => "${prefix_api_url}/${project_id}/packages/generic/${project_name}/${version}/${real_archive_name}",
    default => $download_url,
  }

  # Download the app package and extract it into $archive_path
  archive { "${archive_path}/${real_archive_name}":
    ensure       => present,
    source       => $real_download_url,
    cleanup      => false,
    extract      => true,
    extract_path => $archive_path,
    creates      => "${archive_path}/${name}-${version}",
    user         => $app_owner,
    group        => $app_group,
    tag          => $resource_tag,
    require      => File[[$project_path, $archive_path]],
  }

  # Make a symlink of the real binary app in $archive_path
  # When the 'archive' resource runs, it downloads the specified app's version if detected.
  # This ensure the link pointed to the new version
  file { $app_command_path:
    ensure  => link,
    target  => "${archive_path}/${name}-${version}",
    owner   => $app_owner,
    group   => $app_group,
    require => Archive["${archive_path}/${real_archive_name}"],
    tag     => $resource_tag,
    notify  => Service[$app_service_name],
  }

  # Create a systemd service config for $app_service_name-app.service.
  # This code block generates /etc/systemd/system/$app_service_name-app.service file with specified parameters below
  systemd::manage_unit { "${app_service_name}.service":
    unit_entry    => {
      'Description' => "${name} App Service",
      'Wants'       => ['basic.target'],
      'After'       => ['basic.target', 'network.target'],
    },
    service_entry => {
      'User'             => $app_owner,
      'Group'            => $app_group,
      'WorkingDirectory' => $project_path,
      'ExecStart'        => "${app_command_path} ${app_cmd_args_escaped}",
      'KillMode'         => 'process',
      'Restart'          => 'on-failure',
      'RestartSec'       => '10s',
    },
    install_entry => {
      'WantedBy' => 'multi-user.target',
    },
    require       => [File[$app_command_path], Archive["${archive_path}/${real_archive_name}"]],
    tag           => $resource_tag,
  }

  service { $app_service_name:
    ensure  => running,
    enable  => true,
    require => Systemd::Manage_unit["${app_service_name}.service"],
    tag     => $resource_tag,
  }

  # Configure Nginx host to forward requests to the specified "application" app
  nginx::resource::server { $domain_url:
    listen_port => 80,
    proxy       => "http://localhost:${app_port}",
    require     => Service[$app_service_name],
    tag         => $resource_tag,
  }

  # Reload Nginx when it detects a new app version is released
  exec { "reload-nginx-for-${name}":
    command     => 'nginx -t && nginx -s reload',
    path        => ['/usr/bin', '/bin', '/usr/sbin'],
    refreshonly => true,
    require     => [File[$app_command_path], Archive["${archive_path}/${real_archive_name}"]],
  }

  # Make Reload Nginx run after all other resources
  File<| tag == $resource_tag |> ~> Exec["reload-nginx-for-${name}"]

  # Create a cron job release to make it automatically run to check whether it has new version every 5 minutes
  cron { "${name}-update":
    ensure  => present,
    command => "/opt/puppetlabs/bin/puppet agent -t --tags ${resource_tag} >> /var/log/puppetlabs/${name}.log 2>&1 ",
    user    => 'root',
    minute  => 5,
    tag     => $resource_tag,
  }
}

---
# Let Hiera knows that app-01 should use 'roles::application'
server::role: 'roles::application'


# The lookup_options makes profiles::release::applications merge the DB credentials 
# that we defined in data/secrets/app-01.srv.local.eyaml
lookup_options:
  profiles::release::applications:
    merge: deep

#
profiles::release::applications:
  # Here are the list of parameters at least I need to configure my todo-app
  # You could set more or less depends on your app.
  todo:
    # the parameters below correlate with parameters set in the profiles::release::app resource
    prefix_api_url: 'https://gitlab.com/api/v4/projects'
    project_id: '63145046'
    domain_url: 'mytodo.srv.local'
    app_command_args:
      - 'agent'
    db_host: 'todo-postgres.srv.local'
    db_port: 5432
    db_name: 'todos'

# Enter the real db_username
eyaml encrypt -p
Enter password: ********

---
# The lookup_options makes profiles::release::applications merge the DB credentials 
# into the object we defined in data/nodes/app-01.srv.local.yaml
lookup_options:
  profiles::release::applications:
    merge: deep

# Paste your corresponding encrypted strings to replace values of $db_username and $db_password below
profiles::release::applications:
  todo:
    db_username: >
      ENC[PKCS7,MIIBeQYJKoZIhvcNAQcDoIIBajCCAWYCAQAxggEhMIIBHQIBAD
      .....
      Kk8xO9e5jsOAU4gBAMPq/tBp72Bc45wPLrbSVl]
    db_password: >
      ENC[PKCS7,MIIBeQYJKoZIhvcNAQcDoIIBajCCAWYCAQAxggEhMIIBHQIBAD
      ....
      Kk8xO9e5jsOAU4gBAMPq/tBp72Bc45wPLrbSVl]

# Class: roles::application
#
# Inherit configurations from roles::base and install configurations for an app server
#
class roles::application inherits roles::base {
  # Other profile classes
  # ...
  
  include profiles::release
}

sudo cat /etc/passwd | grep run-app