tools/salt-install/provision.sh

   1 #!/bin/bash -x
   2
   3 # Copyright (C) The Arvados Authors. All rights reserved.
   4 #
   5 # SPDX-License-Identifier: CC-BY-SA-3.0
   6
   7 # If you want to test arvados in a single host, you can run this script, which
   8 # will install it using salt masterless
   9 # This script is run by the Vagrant file when you run it with
  10 #
  11 # vagrant up
  12
  13 set -o pipefail
  14
  15 # capture the directory that the script is running from
  16 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
  17
  18 usage() {
  19   echo >&2
  20   echo >&2 "Usage: ${0} [-h] [-h]"
  21   echo >&2
  22   echo >&2 "${0} options:"
  23   echo >&2 "  -d, --debug                                 Run salt installation in debug mode"
  24   echo >&2 "  -p <N>, --ssl-port <N>                      SSL port to use for the web applications"
  25   echo >&2 "  -c <local.params>, --config <local.params>  Path to the local.params config file"
  26   echo >&2 "  -t, --test                                  Test installation running a CWL workflow"
  27   echo >&2 "  -r, --roles                                 List of Arvados roles to apply to the host, comma separated"
  28   echo >&2 "                                              Possible values are:"
  29   echo >&2 "                                                api"
  30   echo >&2 "                                                controller"
  31   echo >&2 "                                                dispatcher"
  32   echo >&2 "                                                keepproxy"
  33   echo >&2 "                                                keepstore"
  34   echo >&2 "                                                keepweb"
  35   echo >&2 "                                                shell"
  36   echo >&2 "                                                webshell"
  37   echo >&2 "                                                websocket"
  38   echo >&2 "                                                workbench"
  39   echo >&2 "                                                workbench2"
  40   echo >&2 "                                              Defaults to applying them all"
  41   echo >&2 "  -h, --help                                  Display this help and exit"
  42   echo >&2 "  -v, --vagrant                               Run in vagrant and use the /vagrant shared dir"
  43   echo >&2
  44 }
  45
  46 arguments() {
  47   # NOTE: This requires GNU getopt (part of the util-linux package on Debian-based distros).
  48   TEMP=$(getopt -o c:dhp:r:tv \
  49     --long config:,debug,help,ssl-port:,roles:,test,vagrant \
  50     -n "${0}" -- "${@}")
  51
  52   if [ ${?} != 0 ] ; then echo "GNU getopt missing? Use -h for help"; exit 1 ; fi
  53   # Note the quotes around `$TEMP': they are essential!
  54   eval set -- "$TEMP"
  55
  56   while [ ${#} -ge 1 ]; do
  57     case ${1} in
  58       -c | --config)
  59         CONFIG_FILE=${2}
  60         shift 2
  61         ;;
  62       -d | --debug)
  63         LOG_LEVEL="debug"
  64         shift
  65         ;;
  66       -p | --ssl-port)
  67         CONTROLLER_EXT_SSL_PORT=${2}
  68         shift 2
  69         ;;
  70       -r | --roles)
  71         for i in ${2//,/ }
  72           do
  73             # Verify the role exists
  74             if [[ ! "database,api,controller,keepstore,websocket,keepweb,workbench2,webshell,keepproxy,shell,workbench,dispatcher" == *"$i"* ]]; then
  75               echo "The role '${i}' is not a valid role"
  76               usage
  77               exit 1
  78             fi
  79             ROLES="${ROLES} ${i}"
  80           done
  81           shift 2
  82         ;;
  83       -t | --test)
  84         TEST="yes"
  85         shift
  86         ;;
  87       -v | --vagrant)
  88         VAGRANT="yes"
  89         shift
  90         ;;
  91       --)
  92         shift
  93         break
  94         ;;
  95       *)
  96         usage
  97         exit 1
  98         ;;
  99     esac
 100   done
 101 }
 102
 103 CONFIG_FILE="${SCRIPT_DIR}/local.params"
 104 CONFIG_DIR="local_config_dir"
 105 LOG_LEVEL="info"
 106 CONTROLLER_EXT_SSL_PORT=443
 107 TESTS_DIR="tests"
 108
 109 CLUSTER=""
 110 DOMAIN=""
 111
 112 # Hostnames/IPs used for single-host deploys
 113 HOSTNAME_EXT=""
 114 HOSTNAME_INT="127.0.1.1"
 115
 116 # Initial user setup
 117 INITIAL_USER=""
 118 INITIAL_USER_EMAIL=""
 119 INITIAL_USER_PASSWORD=""
 120
 121 CONTROLLER_EXT_SSL_PORT=8000
 122 KEEP_EXT_SSL_PORT=25101
 123 # Both for collections and downloads
 124 KEEPWEB_EXT_SSL_PORT=9002
 125 WEBSHELL_EXT_SSL_PORT=4202
 126 WEBSOCKET_EXT_SSL_PORT=8002
 127 WORKBENCH1_EXT_SSL_PORT=443
 128 WORKBENCH2_EXT_SSL_PORT=3001
 129
 130 RELEASE="production"
 131 VERSION="2.1.2-1"
 132
 133 # Formulas versions
 134 ARVADOS_TAG="master"
 135 POSTGRES_TAG="v0.41.6"
 136 NGINX_TAG="temp-fix-missing-statements-in-pillar"
 137 DOCKER_TAG="v1.0.0"
 138 LOCALE_TAG="v0.3.4"
 139 LETSENCRYPT_TAG="v2.1.0"
 140
 141 # Salt's dir
 142 ## states
 143 S_DIR="/srv/salt"
 144 ## formulas
 145 F_DIR="/srv/formulas"
 146 ##pillars
 147 P_DIR="/srv/pillars"
 148
 149 arguments ${@}
 150
 151 if [ -s ${CONFIG_FILE} ]; then
 152   source ${CONFIG_FILE}
 153 else
 154   echo >&2 "Please create a '${CONFIG_FILE}' file with initial values, as described in"
 155   echo >&2 "  * https://doc.arvados.org/install/salt-single-host.html#single_host, or"
 156   echo >&2 "  * https://doc.arvados.org/install/salt-multi-host.html#multi_host_multi_hostnames"
 157   exit 1
 158 fi
 159
 160 if [ ! -d ${CONFIG_DIR} ]; then
 161   echo >&2 "Please create a '${CONFIG_DIR}' with initial values, as described in"
 162   echo >&2 "  * https://doc.arvados.org/install/salt-single-host.html#single_host, or"
 163   echo >&2 "  * https://doc.arvados.org/install/salt-multi-host.html#multi_host_multi_hostnames"
 164   exit 1
 165 fi
 166
 167 if grep -q 'fixme_or_this_wont_work' ${CONFIG_FILE} ; then
 168   echo >&2 "The config file ${CONFIG_FILE} has some parameters that need to be modified."
 169   echo >&2 "Please, fix them and re-run the provision script."
 170   exit 1
 171 fi
 172
 173 if ! grep -E '^[[:alnum:]]{5}$' <<<${CLUSTER} ; then
 174   echo >&2 "ERROR: <CLUSTER> must be exactly 5 alphanumeric characters long"
 175   echo >&2 "Fix the cluster name in the 'local.params' file and re-run the provision script"
 176   exit 1
 177 fi
 178
 179 # Only used in single_host/single_name deploys
 180 if [ "x${HOSTNAME_EXT}" = "x" ] ; then
 181   HOSTNAME_EXT="${CLUSTER}.${DOMAIN}"
 182 fi
 183
 184 apt-get update
 185 apt-get install -y curl git jq
 186
 187 if which salt-call; then
 188   echo "Salt already installed"
 189 else
 190   curl -L https://bootstrap.saltstack.com -o /tmp/bootstrap_salt.sh
 191   sh /tmp/bootstrap_salt.sh -XdfP -x python3
 192   /bin/systemctl stop salt-minion.service
 193   /bin/systemctl disable salt-minion.service
 194 fi
 195
 196 # Set salt to masterless mode
 197 cat > /etc/salt/minion << EOFSM
 198 file_client: local
 199 file_roots:
 200   base:
 201     - ${S_DIR}
 202     - ${F_DIR}/*
 203
 204 pillar_roots:
 205   base:
 206     - ${P_DIR}
 207 EOFSM
 208
 209 mkdir -p ${S_DIR} ${F_DIR} ${P_DIR}
 210
 211 # Get the formula and dependencies
 212 cd ${F_DIR} || exit 1
 213 git clone --branch "${ARVADOS_TAG}"     https://github.com/arvados/arvados-formula.git
 214 git clone --branch "${DOCKER_TAG}"      https://github.com/saltstack-formulas/docker-formula.git
 215 git clone --branch "${LOCALE_TAG}"      https://github.com/saltstack-formulas/locale-formula.git
 216 # git clone --branch "${NGINX_TAG}"       https://github.com/saltstack-formulas/nginx-formula.git
 217 git clone --branch "${NGINX_TAG}"       https://github.com/netmanagers/nginx-formula.git
 218 git clone --branch "${POSTGRES_TAG}"    https://github.com/saltstack-formulas/postgres-formula.git
 219 git clone --branch "${LETSENCRYPT_TAG}" https://github.com/saltstack-formulas/letsencrypt-formula.git
 220
 221 # If we want to try a specific branch of the formula
 222 if [ "x${BRANCH}" != "x" ]; then
 223   cd ${F_DIR}/arvados-formula || exit 1
 224   git checkout -t origin/"${BRANCH}" -b "${BRANCH}"
 225   cd -
 226 fi
 227
 228 if [ "x${VAGRANT}" = "xyes" ]; then
 229   EXTRA_STATES_DIR="/home/vagrant/${CONFIG_DIR}/states"
 230   SOURCE_PILLARS_DIR="/home/vagrant/${CONFIG_DIR}/pillars"
 231   SOURCE_TESTS_DIR="/home/vagrant/${TESTS_DIR}"
 232 else
 233   EXTRA_STATES_DIR="${SCRIPT_DIR}/${CONFIG_DIR}/states"
 234   SOURCE_PILLARS_DIR="${SCRIPT_DIR}/${CONFIG_DIR}/pillars"
 235   SOURCE_TESTS_DIR="${SCRIPT_DIR}/${TESTS_DIR}"
 236 fi
 237
 238 SOURCE_STATES_DIR="${EXTRA_STATES_DIR}"
 239
 240 # Replace variables (cluster,  domain, etc) in the pillars, states and tests
 241 # to ease deployment for newcomers
 242 if [ ! -d "${SOURCE_PILLARS_DIR}" ]; then
 243   echo "${SOURCE_PILLARS_DIR} does not exist or is not a directory. Exiting."
 244   exit 1
 245 fi
 246 for f in $(ls "${SOURCE_PILLARS_DIR}"/*); do
 247   sed "s#__ANONYMOUS_USER_TOKEN__#${ANONYMOUS_USER_TOKEN}#g;
 248        s#__BLOB_SIGNING_KEY__#${BLOB_SIGNING_KEY}#g;
 249        s#__CONTROLLER_EXT_SSL_PORT__#${CONTROLLER_EXT_SSL_PORT}#g;
 250        s#__CLUSTER__#${CLUSTER}#g;
 251        s#__DOMAIN__#${DOMAIN}#g;
 252        s#__HOSTNAME_EXT__#${HOSTNAME_EXT}#g;
 253        s#__HOSTNAME_INT__#${HOSTNAME_INT}#g;
 254        s#__INITIAL_USER_EMAIL__#${INITIAL_USER_EMAIL}#g;
 255        s#__INITIAL_USER_PASSWORD__#${INITIAL_USER_PASSWORD}#g;
 256        s#__INITIAL_USER__#${INITIAL_USER}#g;
 257        s#__DATABASE_PASSWORD__#${DATABASE_PASSWORD}#g;
 258        s#__KEEPWEB_EXT_SSL_PORT__#${KEEPWEB_EXT_SSL_PORT}#g;
 259        s#__KEEP_EXT_SSL_PORT__#${KEEP_EXT_SSL_PORT}#g;
 260        s#__MANAGEMENT_TOKEN__#${MANAGEMENT_TOKEN}#g;
 261        s#__RELEASE__#${RELEASE}#g;
 262        s#__SYSTEM_ROOT_TOKEN__#${SYSTEM_ROOT_TOKEN}#g;
 263        s#__VERSION__#${VERSION}#g;
 264        s#__WEBSHELL_EXT_SSL_PORT__#${WEBSHELL_EXT_SSL_PORT}#g;
 265        s#__WEBSOCKET_EXT_SSL_PORT__#${WEBSOCKET_EXT_SSL_PORT}#g;
 266        s#__WORKBENCH1_EXT_SSL_PORT__#${WORKBENCH1_EXT_SSL_PORT}#g;
 267        s#__WORKBENCH2_EXT_SSL_PORT__#${WORKBENCH2_EXT_SSL_PORT}#g;
 268        s#__CLUSTER_INT_CIDR__#${CLUSTER_INT_CIDR}#g;
 269        s#__CONTROLLER_INT_IP__#${CONTROLLER_INT_IP}#g;
 270        s#__WEBSOCKET_INT_IP__#${WEBSOCKET_INT_IP}#g;
 271        s#__KEEP_INT_IP__#${KEEP_INT_IP}#g;
 272        s#__KEEPSTORE0_INT_IP__#${KEEPSTORE0_INT_IP}#g;
 273        s#__KEEPSTORE1_INT_IP__#${KEEPSTORE1_INT_IP}#g;
 274        s#__KEEPWEB_INT_IP__#${KEEPWEB_INT_IP}#g;
 275        s#__WEBSHELL_INT_IP__#${WEBSHELL_INT_IP}#g;
 276        s#__WORKBENCH1_INT_IP__#${WORKBENCH1_INT_IP}#g;
 277        s#__WORKBENCH2_INT_IP__#${WORKBENCH2_INT_IP}#g;
 278        s#__DATABASE_INT_IP__#${DATABASE_INT_IP}#g;
 279        s#__WORKBENCH_SECRET_KEY__#${WORKBENCH_SECRET_KEY}#g" \
 280   "${f}" > "${P_DIR}"/$(basename "${f}")
 281 done
 282
 283 if [ "x${TEST}" = "xyes" ] && [ ! -d "${SOURCE_TESTS_DIR}" ]; then
 284   echo "You requested to run tests, but ${SOURCE_TESTS_DIR} does not exist or is not a directory. Exiting."
 285   exit 1
 286 fi
 287 mkdir -p /tmp/cluster_tests
 288 # Replace cluster and domain name in the test files
 289 for f in $(ls "${SOURCE_TESTS_DIR}"/*); do
 290   sed "s#__CLUSTER__#${CLUSTER}#g;
 291        s#__CONTROLLER_EXT_SSL_PORT__#${CONTROLLER_EXT_SSL_PORT}#g;
 292        s#__DOMAIN__#${DOMAIN}#g;
 293        s#__HOSTNAME_INT__#${HOSTNAME_INT}#g;
 294        s#__INITIAL_USER_EMAIL__#${INITIAL_USER_EMAIL}#g;
 295        s#__INITIAL_USER_PASSWORD__#${INITIAL_USER_PASSWORD}#g
 296        s#__INITIAL_USER__#${INITIAL_USER}#g;
 297        s#__DATABASE_PASSWORD__#${DATABASE_PASSWORD}#g;
 298        s#__SYSTEM_ROOT_TOKEN__#${SYSTEM_ROOT_TOKEN}#g" \
 299   "${f}" > "/tmp/cluster_tests"/$(basename "${f}")
 300 done
 301 chmod 755 /tmp/cluster_tests/run-test.sh
 302
 303 # Replace helper state files that differ from the formula's examples
 304 if [ -d "${SOURCE_STATES_DIR}" ]; then
 305   mkdir -p "${F_DIR}"/extra/extra
 306
 307   for f in $(ls "${SOURCE_STATES_DIR}"/*); do
 308     sed "s#__ANONYMOUS_USER_TOKEN__#${ANONYMOUS_USER_TOKEN}#g;
 309          s#__CLUSTER__#${CLUSTER}#g;
 310          s#__BLOB_SIGNING_KEY__#${BLOB_SIGNING_KEY}#g;
 311          s#__CONTROLLER_EXT_SSL_PORT__#${CONTROLLER_EXT_SSL_PORT}#g;
 312          s#__DOMAIN__#${DOMAIN}#g;
 313          s#__HOSTNAME_EXT__#${HOSTNAME_EXT}#g;
 314          s#__HOSTNAME_INT__#${HOSTNAME_INT}#g;
 315          s#__INITIAL_USER_EMAIL__#${INITIAL_USER_EMAIL}#g;
 316          s#__INITIAL_USER_PASSWORD__#${INITIAL_USER_PASSWORD}#g;
 317          s#__INITIAL_USER__#${INITIAL_USER}#g;
 318          s#__DATABASE_PASSWORD__#${DATABASE_PASSWORD}#g;
 319          s#__KEEPWEB_EXT_SSL_PORT__#${KEEPWEB_EXT_SSL_PORT}#g;
 320          s#__KEEP_EXT_SSL_PORT__#${KEEP_EXT_SSL_PORT}#g;
 321          s#__MANAGEMENT_TOKEN__#${MANAGEMENT_TOKEN}#g;
 322          s#__RELEASE__#${RELEASE}#g;
 323          s#__SYSTEM_ROOT_TOKEN__#${SYSTEM_ROOT_TOKEN}#g;
 324          s#__VERSION__#${VERSION}#g;
 325          s#__CLUSTER_INT_CIDR__#${CLUSTER_INT_CIDR}#g;
 326          s#__CONTROLLER_INT_IP__#${CONTROLLER_INT_IP}#g;
 327          s#__WEBSOCKET_INT_IP__#${WEBSOCKET_INT_IP}#g;
 328          s#__KEEP_INT_IP__#${KEEP_INT_IP}#g;
 329          s#__KEEPSTORE0_INT_IP__#${KEEPSTORE0_INT_IP}#g;
 330          s#__KEEPSTORE1_INT_IP__#${KEEPSTORE1_INT_IP}#g;
 331          s#__KEEPWEB_INT_IP__#${KEEPWEB_INT_IP}#g;
 332          s#__WEBSHELL_INT_IP__#${WEBSHELL_INT_IP}#g;
 333          s#__WORKBENCH1_INT_IP__#${WORKBENCH1_INT_IP}#g;
 334          s#__WORKBENCH2_INT_IP__#${WORKBENCH2_INT_IP}#g;
 335          s#__DATABASE_INT_IP__#${DATABASE_INT_IP}#g;
 336          s#__WEBSHELL_EXT_SSL_PORT__#${WEBSHELL_EXT_SSL_PORT}#g;
 337          s#__WEBSOCKET_EXT_SSL_PORT__#${WEBSOCKET_EXT_SSL_PORT}#g;
 338          s#__WORKBENCH1_EXT_SSL_PORT__#${WORKBENCH1_EXT_SSL_PORT}#g;
 339          s#__WORKBENCH2_EXT_SSL_PORT__#${WORKBENCH2_EXT_SSL_PORT}#g;
 340          s#__WORKBENCH_SECRET_KEY__#${WORKBENCH_SECRET_KEY}#g" \
 341     "${f}" > "${F_DIR}/extra/extra"/$(basename "${f}")
 342   done
 343 fi
 344
 345 # Now, we build the SALT states/pillars trees
 346 # As we need to separate both states and pillars in case we want specific
 347 # roles, we iterate on both at the same time
 348
 349 # States
 350 cat > ${S_DIR}/top.sls << EOFTSLS
 351 base:
 352   '*':
 353     - locale
 354 EOFTSLS
 355
 356 # Pillars
 357 cat > ${P_DIR}/top.sls << EOFPSLS
 358 base:
 359   '*':
 360     - locale
 361     - arvados
 362 EOFPSLS
 363
 364 # States, extra states
 365 if [ -d "${F_DIR}"/extra/extra ]; then
 366   for f in $(ls "${F_DIR}"/extra/extra/*.sls); do
 367   echo "    - extra.$(basename ${f} | sed 's/.sls$//g')" >> ${S_DIR}/top.sls
 368   done
 369 fi
 370
 371 # If we want specific roles for a node, just add the desired states
 372 # and its dependencies
 373 if [ -z "${ROLES}" ]; then
 374   # States
 375   echo "    - nginx.passenger" >> ${S_DIR}/top.sls
 376   if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 377     grep -q "letsencrypt" ${S_DIR}/top.sls || echo "    - letsencrypt" >> ${S_DIR}/top.sls
 378   fi
 379   echo "    - postgres" >> ${S_DIR}/top.sls
 380   echo "    - docker.software" >> ${S_DIR}/top.sls
 381   echo "    - arvados" >> ${S_DIR}/top.sls
 382
 383   # Pillars
 384   echo "    - docker" >> ${P_DIR}/top.sls
 385   echo "    - nginx_api_configuration" >> ${P_DIR}/top.sls
 386   echo "    - nginx_controller_configuration" >> ${P_DIR}/top.sls
 387   echo "    - nginx_keepproxy_configuration" >> ${P_DIR}/top.sls
 388   echo "    - nginx_keepweb_configuration" >> ${P_DIR}/top.sls
 389   echo "    - nginx_passenger" >> ${P_DIR}/top.sls
 390   echo "    - nginx_websocket_configuration" >> ${P_DIR}/top.sls
 391   echo "    - nginx_webshell_configuration" >> ${P_DIR}/top.sls
 392   echo "    - nginx_workbench2_configuration" >> ${P_DIR}/top.sls
 393   echo "    - nginx_workbench_configuration" >> ${P_DIR}/top.sls
 394   echo "    - postgresql" >> ${P_DIR}/top.sls
 395   if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 396     grep -q "letsencrypt" ${P_DIR}/top.sls || echo "    - letsencrypt" >> ${P_DIR}/top.sls
 397   fi
 398 else
 399   # If we add individual roles, make sure we add the repo first
 400   echo "    - arvados.repo" >> ${S_DIR}/top.sls
 401   for R in ${ROLES}; do
 402     case "${R}" in
 403       "database")
 404         # States
 405         echo "    - postgres" >> ${S_DIR}/top.sls
 406         # Pillars
 407         echo '    - postgresql' >> ${P_DIR}/top.sls
 408       ;;
 409       "api")
 410         # States
 411         # FIXME: https://dev.arvados.org/issues/17352
 412         grep -q "postgres.client" ${S_DIR}/top.sls || echo "    - postgres.client" >> ${S_DIR}/top.sls
 413         grep -q "nginx.passenger" ${S_DIR}/top.sls || echo "    - nginx.passenger" >> ${S_DIR}/top.sls
 414         ### If we don't install and run LE before arvados-api-server, it fails and breaks everything
 415         ### after it so we add this here, as we are, after all, sharing the host for api and controller
 416         if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 417           grep -q "letsencrypt" ${S_DIR}/top.sls || echo "    - letsencrypt" >> ${S_DIR}/top.sls
 418         fi
 419         grep -q "arvados.${R}" ${S_DIR}/top.sls    || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 420         # Pillars
 421         grep -q "docker" ${P_DIR}/top.sls                   || echo "    - docker" >> ${P_DIR}/top.sls
 422         grep -q "postgresql" ${P_DIR}/top.sls               || echo "    - postgresql" >> ${P_DIR}/top.sls
 423         grep -q "nginx_passenger" ${P_DIR}/top.sls          || echo "    - nginx_passenger" >> ${P_DIR}/top.sls
 424         grep -q "nginx_${R}_configuration" ${P_DIR}/top.sls || echo "    - nginx_${R}_configuration" >> ${P_DIR}/top.sls
 425       ;;
 426       "controller" | "websocket" | "workbench" | "workbench2" | "webshell" | "keepweb" | "keepproxy")
 427         # States
 428         grep -q "nginx.passenger" ${S_DIR}/top.sls || echo "    - nginx.passenger" >> ${S_DIR}/top.sls
 429         if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 430           grep -q "letsencrypt" ${S_DIR}/top.sls || echo "    - letsencrypt" >> ${S_DIR}/top.sls
 431         fi
 432         grep -q "arvados.${R}" ${S_DIR}/top.sls    || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 433         # Pillars
 434         grep -q "nginx_passenger" ${P_DIR}/top.sls          || echo "    - nginx_passenger" >> ${P_DIR}/top.sls
 435         grep -q "nginx_${R}_configuration" ${P_DIR}/top.sls || echo "    - nginx_${R}_configuration" >> ${P_DIR}/top.sls
 436         if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 437           grep -q "letsencrypt" ${P_DIR}/top.sls || echo "    - letsencrypt" >> ${P_DIR}/top.sls
 438           grep -q "letsencrypt_${R}_configuration" ${P_DIR}/top.sls || echo "    - letsencrypt_${R}_configuration" >> ${P_DIR}/top.sls
 439         fi
 440       ;;
 441       "shell")
 442         # States
 443         grep -q "docker" ${S_DIR}/top.sls       || echo "    - docker.software" >> ${S_DIR}/top.sls
 444         grep -q "arvados.${R}" ${S_DIR}/top.sls || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 445         # Pillars
 446         grep -q "" ${P_DIR}/top.sls                             || echo "    - docker" >> ${P_DIR}/top.sls
 447       ;;
 448       "dispatcher")
 449         # States
 450         grep -q "docker" ${S_DIR}/top.sls       || echo "    - docker.software" >> ${S_DIR}/top.sls
 451         grep -q "arvados.${R}" ${S_DIR}/top.sls || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 452         # Pillars
 453         # ATM, no specific pillar needed
 454       ;;
 455       "keepstore")
 456         # States
 457         grep -q "arvados.${R}" ${S_DIR}/top.sls || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 458         # Pillars
 459         # ATM, no specific pillar needed
 460       ;;
 461       *)
 462         echo "Unknown role ${R}"
 463         exit 1
 464       ;;
 465     esac
 466   done
 467 fi
 468
 469 # FIXME! #16992 Temporary fix for psql call in arvados-api-server
 470 if [ -e /root/.psqlrc ]; then
 471   if ! ( grep 'pset pager off' /root/.psqlrc ); then
 472     RESTORE_PSQL="yes"
 473     cp /root/.psqlrc /root/.psqlrc.provision.backup
 474   fi
 475 else
 476   DELETE_PSQL="yes"
 477 fi
 478
 479 echo '\pset pager off' >> /root/.psqlrc
 480 # END FIXME! #16992 Temporary fix for psql call in arvados-api-server
 481
 482 # Now run the install
 483 salt-call --local state.apply -l ${LOG_LEVEL}
 484
 485 # FIXME! #16992 Temporary fix for psql call in arvados-api-server
 486 if [ "x${DELETE_PSQL}" = "xyes" ]; then
 487   echo "Removing .psql file"
 488   rm /root/.psqlrc
 489 fi
 490
 491 if [ "x${RESTORE_PSQL}" = "xyes" ]; then
 492   echo "Restoring .psql file"
 493   mv -v /root/.psqlrc.provision.backup /root/.psqlrc
 494 fi
 495 # END FIXME! #16992 Temporary fix for psql call in arvados-api-server
 496
 497 # Leave a copy of the Arvados CA so the user can copy it where it's required
 498 echo "Copying the Arvados CA certificate to the installer dir, so you can import it"
 499 # If running in a vagrant VM, also add default user to docker group
 500 if [ "x${VAGRANT}" = "xyes" ]; then
 501   cp /etc/ssl/certs/arvados-snakeoil-ca.pem /vagrant/${CLUSTER}.${DOMAIN}-arvados-snakeoil-ca.pem
 502
 503   echo "Adding the vagrant user to the docker group"
 504   usermod -a -G docker vagrant
 505 else
 506   cp /etc/ssl/certs/arvados-snakeoil-ca.pem ${SCRIPT_DIR}/${CLUSTER}.${DOMAIN}-arvados-snakeoil-ca.pem
 507 fi
 508
 509 # Test that the installation finished correctly
 510 if [ "x${TEST}" = "xyes" ]; then
 511   cd /tmp/cluster_tests
 512   ./run-test.sh
 513 fi