tools/salt-install/provision.sh

   1 #!/bin/bash -x
   2
   3 # Copyright (C) The Arvados Authors. All rights reserved.
   4 #
   5 # SPDX-License-Identifier: CC-BY-SA-3.0
   6
   7 # If you want to test arvados in a single host, you can run this script, which
   8 # will install it using salt masterless
   9 # This script is run by the Vagrant file when you run it with
  10 #
  11 # vagrant up
  12
  13 set -o pipefail
  14
  15 # capture the directory that the script is running from
  16 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
  17
  18 usage() {
  19   echo >&2
  20   echo >&2 "Usage: ${0} [-h] [-h]"
  21   echo >&2
  22   echo >&2 "${0} options:"
  23   echo >&2 "  -d, --debug                                 Run salt installation in debug mode"
  24   echo >&2 "  -p <N>, --ssl-port <N>                      SSL port to use for the web applications"
  25   echo >&2 "  -c <local.params>, --config <local.params>  Path to the local.params config file"
  26   echo >&2 "  -t, --test                                  Test installation running a CWL workflow"
  27   echo >&2 "  -r, --roles                                 List of Arvados roles to apply to the host, comma separated"
  28   echo >&2 "                                              Possible values are:"
  29   echo >&2 "                                                api"
  30   echo >&2 "                                                controller"
  31   echo >&2 "                                                keepstore"
  32   echo >&2 "                                                websocket"
  33   echo >&2 "                                                keepweb"
  34   echo >&2 "                                                workbench2"
  35   echo >&2 "                                                keepproxy"
  36   echo >&2 "                                                shell"
  37   echo >&2 "                                                workbench"
  38   echo >&2 "                                                dispatcher"
  39   echo >&2 "                                              Defaults to applying them all"
  40   echo >&2 "  -h, --help                                  Display this help and exit"
  41   echo >&2 "  -v, --vagrant                               Run in vagrant and use the /vagrant shared dir"
  42   echo >&2
  43 }
  44
  45 arguments() {
  46   # NOTE: This requires GNU getopt (part of the util-linux package on Debian-based distros).
  47   TEMP=$(getopt -o c:dhp:r:tv \
  48     --long config:,debug,help,ssl-port:,roles:,test,vagrant \
  49     -n "${0}" -- "${@}")
  50
  51   if [ ${?} != 0 ] ; then echo "GNU getopt missing? Use -h for help"; exit 1 ; fi
  52   # Note the quotes around `$TEMP': they are essential!
  53   eval set -- "$TEMP"
  54
  55   while [ ${#} -ge 1 ]; do
  56     case ${1} in
  57       -c | --config)
  58         CONFIG_FILE=${2}
  59         shift 2
  60         ;;
  61       -d | --debug)
  62         LOG_LEVEL="debug"
  63         shift
  64         ;;
  65       -p | --ssl-port)
  66         CONTROLLER_EXT_SSL_PORT=${2}
  67         shift 2
  68         ;;
  69       -r | --roles)
  70         for i in ${2//,/ }
  71           do
  72             # Verify the role exists
  73             if [[ ! "database,api,controller,keepstore,websocket,keepweb,workbench2,keepproxy,shell,workbench,dispatcher" == *"$i"* ]]; then
  74               echo "The role '${i}' is not a valid role"
  75               usage
  76               exit 1
  77             fi
  78             ROLES="${ROLES} ${i}"
  79           done
  80           shift 2
  81         ;;
  82       -t | --test)
  83         TEST="yes"
  84         shift
  85         ;;
  86       -v | --vagrant)
  87         VAGRANT="yes"
  88         shift
  89         ;;
  90       --)
  91         shift
  92         break
  93         ;;
  94       *)
  95         usage
  96         exit 1
  97         ;;
  98     esac
  99   done
 100 }
 101
 102 CONFIG_FILE="${SCRIPT_DIR}/local.params"
 103 CONFIG_DIR="local_config_dir"
 104 LOG_LEVEL="info"
 105 CONTROLLER_EXT_SSL_PORT=443
 106 TESTS_DIR="tests"
 107
 108 CLUSTER=""
 109 DOMAIN=""
 110
 111 # Hostnames/IPs used for single-host deploys
 112 HOSTNAME_EXT=""
 113 HOSTNAME_INT="127.0.1.1"
 114
 115 # Initial user setup
 116 INITIAL_USER=""
 117 INITIAL_USER_EMAIL=""
 118 INITIAL_USER_PASSWORD=""
 119
 120 CONTROLLER_EXT_SSL_PORT=8000
 121 KEEP_EXT_SSL_PORT=25101
 122 # Both for collections and downloads
 123 KEEPWEB_EXT_SSL_PORT=9002
 124 WEBSHELL_EXT_SSL_PORT=4202
 125 WEBSOCKET_EXT_SSL_PORT=8002
 126 WORKBENCH1_EXT_SSL_PORT=443
 127 WORKBENCH2_EXT_SSL_PORT=3001
 128
 129 RELEASE="production"
 130 VERSION="2.1.2-1"
 131
 132 # Formulas versions
 133 ARVADOS_TAG="master"
 134 POSTGRES_TAG="v0.41.6"
 135 NGINX_TAG="temp-fix-missing-statements-in-pillar"
 136 DOCKER_TAG="v1.0.0"
 137 LOCALE_TAG="v0.3.4"
 138 LETSENCRYPT_TAG="v2.1.0"
 139
 140 # Salt's dir
 141 ## states
 142 S_DIR="/srv/salt"
 143 ## formulas
 144 F_DIR="/srv/formulas"
 145 ##pillars
 146 P_DIR="/srv/pillars"
 147
 148 arguments ${@}
 149
 150 if [ -s ${CONFIG_FILE} ]; then
 151   source ${CONFIG_FILE}
 152 else
 153   echo >&2 "Please create a '${CONFIG_FILE}' file with initial values, as described in"
 154   echo >&2 "  * https://doc.arvados.org/install/salt-single-host.html#single_host, or"
 155   echo >&2 "  * https://doc.arvados.org/install/salt-multi-host.html#multi_host_multi_hostnames"
 156   exit 1
 157 fi
 158
 159 if [ ! -d ${CONFIG_DIR} ]; then
 160   echo >&2 "Please create a '${CONFIG_DIR}' with initial values, as described in"
 161   echo >&2 "  * https://doc.arvados.org/install/salt-single-host.html#single_host, or"
 162   echo >&2 "  * https://doc.arvados.org/install/salt-multi-host.html#multi_host_multi_hostnames"
 163   exit 1
 164 fi
 165
 166 if grep -q 'fixme_or_this_wont_work' ${CONFIG_FILE} ; then
 167   echo >&2 "The config file ${CONFIG_FILE} has some parameters that need to be modified."
 168   echo >&2 "Please, fix them and re-run the provision script."
 169   exit 1
 170 fi
 171
 172 if ! grep -E '^[[:alnum:]]{5}$' <<<${CLUSTER} ; then
 173   echo >&2 "ERROR: <CLUSTER> must be exactly 5 alphanumeric characters long"
 174   echo >&2 "Fix the cluster name in the 'local.params' file and re-run the provision script"
 175   exit 1
 176 fi
 177
 178 # Only used in single_host/single_name deploys
 179 if [ "x${HOSTNAME_EXT}" = "x" ] ; then
 180   HOSTNAME_EXT="${CLUSTER}.${DOMAIN}"
 181 fi
 182
 183 apt-get update
 184 apt-get install -y curl git jq
 185
 186 if which salt-call; then
 187   echo "Salt already installed"
 188 else
 189   curl -L https://bootstrap.saltstack.com -o /tmp/bootstrap_salt.sh
 190   sh /tmp/bootstrap_salt.sh -XdfP -x python3
 191   /bin/systemctl stop salt-minion.service
 192   /bin/systemctl disable salt-minion.service
 193 fi
 194
 195 # Set salt to masterless mode
 196 cat > /etc/salt/minion << EOFSM
 197 file_client: local
 198 file_roots:
 199   base:
 200     - ${S_DIR}
 201     - ${F_DIR}/*
 202
 203 pillar_roots:
 204   base:
 205     - ${P_DIR}
 206 EOFSM
 207
 208 mkdir -p ${S_DIR} ${F_DIR} ${P_DIR}
 209
 210 # Get the formula and dependencies
 211 cd ${F_DIR} || exit 1
 212 git clone --branch "${ARVADOS_TAG}"     https://github.com/arvados/arvados-formula.git
 213 git clone --branch "${DOCKER_TAG}"      https://github.com/saltstack-formulas/docker-formula.git
 214 git clone --branch "${LOCALE_TAG}"      https://github.com/saltstack-formulas/locale-formula.git
 215 # git clone --branch "${NGINX_TAG}"       https://github.com/saltstack-formulas/nginx-formula.git
 216 git clone --branch "${NGINX_TAG}"       https://github.com/netmanagers/nginx-formula.git
 217 git clone --branch "${POSTGRES_TAG}"    https://github.com/saltstack-formulas/postgres-formula.git
 218 git clone --branch "${LETSENCRYPT_TAG}" https://github.com/saltstack-formulas/letsencrypt-formula.git
 219
 220 # If we want to try a specific branch of the formula
 221 if [ "x${BRANCH}" != "x" ]; then
 222   cd ${F_DIR}/arvados-formula || exit 1
 223   git checkout -t origin/"${BRANCH}" -b "${BRANCH}"
 224   cd -
 225 fi
 226
 227 if [ "x${VAGRANT}" = "xyes" ]; then
 228   EXTRA_STATES_DIR="/home/vagrant/${CONFIG_DIR}/states"
 229   SOURCE_PILLARS_DIR="/home/vagrant/${CONFIG_DIR}/pillars"
 230   SOURCE_TESTS_DIR="/home/vagrant/${TESTS_DIR}"
 231 else
 232   EXTRA_STATES_DIR="${SCRIPT_DIR}/${CONFIG_DIR}/states"
 233   SOURCE_PILLARS_DIR="${SCRIPT_DIR}/${CONFIG_DIR}/pillars"
 234   SOURCE_TESTS_DIR="${SCRIPT_DIR}/${TESTS_DIR}"
 235 fi
 236
 237 SOURCE_STATES_DIR="${EXTRA_STATES_DIR}"
 238
 239 # Replace variables (cluster,  domain, etc) in the pillars, states and tests
 240 # to ease deployment for newcomers
 241 if [ ! -d "${SOURCE_PILLARS_DIR}" ]; then
 242   echo "${SOURCE_PILLARS_DIR} does not exist or is not a directory. Exiting."
 243   exit 1
 244 fi
 245 for f in $(ls "${SOURCE_PILLARS_DIR}"/*); do
 246   sed "s#__ANONYMOUS_USER_TOKEN__#${ANONYMOUS_USER_TOKEN}#g;
 247        s#__BLOB_SIGNING_KEY__#${BLOB_SIGNING_KEY}#g;
 248        s#__CONTROLLER_EXT_SSL_PORT__#${CONTROLLER_EXT_SSL_PORT}#g;
 249        s#__CLUSTER__#${CLUSTER}#g;
 250        s#__DOMAIN__#${DOMAIN}#g;
 251        s#__HOSTNAME_EXT__#${HOSTNAME_EXT}#g;
 252        s#__HOSTNAME_INT__#${HOSTNAME_INT}#g;
 253        s#__INITIAL_USER_EMAIL__#${INITIAL_USER_EMAIL}#g;
 254        s#__INITIAL_USER_PASSWORD__#${INITIAL_USER_PASSWORD}#g;
 255        s#__INITIAL_USER__#${INITIAL_USER}#g;
 256        s#__DATABASE_PASSWORD__#${DATABASE_PASSWORD}#g;
 257        s#__KEEPWEB_EXT_SSL_PORT__#${KEEPWEB_EXT_SSL_PORT}#g;
 258        s#__KEEP_EXT_SSL_PORT__#${KEEP_EXT_SSL_PORT}#g;
 259        s#__MANAGEMENT_TOKEN__#${MANAGEMENT_TOKEN}#g;
 260        s#__RELEASE__#${RELEASE}#g;
 261        s#__SYSTEM_ROOT_TOKEN__#${SYSTEM_ROOT_TOKEN}#g;
 262        s#__VERSION__#${VERSION}#g;
 263        s#__WEBSHELL_EXT_SSL_PORT__#${WEBSHELL_EXT_SSL_PORT}#g;
 264        s#__WEBSOCKET_EXT_SSL_PORT__#${WEBSOCKET_EXT_SSL_PORT}#g;
 265        s#__WORKBENCH1_EXT_SSL_PORT__#${WORKBENCH1_EXT_SSL_PORT}#g;
 266        s#__WORKBENCH2_EXT_SSL_PORT__#${WORKBENCH2_EXT_SSL_PORT}#g;
 267        s#__CLUSTER_INT_CIDR__#${CLUSTER_INT_CIDR}#g;
 268        s#__CONTROLLER_INT_IP__#${CONTROLLER_INT_IP}#g;
 269        s#__WEBSOCKET_INT_IP__#${WEBSOCKET_INT_IP}#g;
 270        s#__KEEP_INT_IP__#${KEEP_INT_IP}#g;
 271        s#__KEEPSTORE0_INT_IP__#${KEEPSTORE0_INT_IP}#g;
 272        s#__KEEPSTORE1_INT_IP__#${KEEPSTORE1_INT_IP}#g;
 273        s#__KEEPWEB_INT_IP__#${KEEPWEB_INT_IP}#g;
 274        s#__WEBSHELL_INT_IP__#${WEBSHELL_INT_IP}#g;
 275        s#__WORKBENCH1_INT_IP__#${WORKBENCH1_INT_IP}#g;
 276        s#__WORKBENCH2_INT_IP__#${WORKBENCH2_INT_IP}#g;
 277        s#__DATABASE_INT_IP__#${DATABASE_INT_IP}#g;
 278        s#__WORKBENCH_SECRET_KEY__#${WORKBENCH_SECRET_KEY}#g" \
 279   "${f}" > "${P_DIR}"/$(basename "${f}")
 280 done
 281
 282 if [ "x${TEST}" = "xyes" ] && [ ! -d "${SOURCE_TESTS_DIR}" ]; then
 283   echo "You requested to run tests, but ${SOURCE_TESTS_DIR} does not exist or is not a directory. Exiting."
 284   exit 1
 285 fi
 286 mkdir -p /tmp/cluster_tests
 287 # Replace cluster and domain name in the test files
 288 for f in $(ls "${SOURCE_TESTS_DIR}"/*); do
 289   sed "s#__CLUSTER__#${CLUSTER}#g;
 290        s#__CONTROLLER_EXT_SSL_PORT__#${CONTROLLER_EXT_SSL_PORT}#g;
 291        s#__DOMAIN__#${DOMAIN}#g;
 292        s#__HOSTNAME_INT__#${HOSTNAME_INT}#g;
 293        s#__INITIAL_USER_EMAIL__#${INITIAL_USER_EMAIL}#g;
 294        s#__INITIAL_USER_PASSWORD__#${INITIAL_USER_PASSWORD}#g
 295        s#__INITIAL_USER__#${INITIAL_USER}#g;
 296        s#__DATABASE_PASSWORD__#${DATABASE_PASSWORD}#g;
 297        s#__SYSTEM_ROOT_TOKEN__#${SYSTEM_ROOT_TOKEN}#g" \
 298   "${f}" > "/tmp/cluster_tests"/$(basename "${f}")
 299 done
 300 chmod 755 /tmp/cluster_tests/run-test.sh
 301
 302 # Replace helper state files that differ from the formula's examples
 303 if [ -d "${SOURCE_STATES_DIR}" ]; then
 304   mkdir -p "${F_DIR}"/extra/extra
 305
 306   for f in $(ls "${SOURCE_STATES_DIR}"/*); do
 307     sed "s#__ANONYMOUS_USER_TOKEN__#${ANONYMOUS_USER_TOKEN}#g;
 308          s#__CLUSTER__#${CLUSTER}#g;
 309          s#__BLOB_SIGNING_KEY__#${BLOB_SIGNING_KEY}#g;
 310          s#__CONTROLLER_EXT_SSL_PORT__#${CONTROLLER_EXT_SSL_PORT}#g;
 311          s#__DOMAIN__#${DOMAIN}#g;
 312          s#__HOSTNAME_EXT__#${HOSTNAME_EXT}#g;
 313          s#__HOSTNAME_INT__#${HOSTNAME_INT}#g;
 314          s#__INITIAL_USER_EMAIL__#${INITIAL_USER_EMAIL}#g;
 315          s#__INITIAL_USER_PASSWORD__#${INITIAL_USER_PASSWORD}#g;
 316          s#__INITIAL_USER__#${INITIAL_USER}#g;
 317          s#__DATABASE_PASSWORD__#${DATABASE_PASSWORD}#g;
 318          s#__KEEPWEB_EXT_SSL_PORT__#${KEEPWEB_EXT_SSL_PORT}#g;
 319          s#__KEEP_EXT_SSL_PORT__#${KEEP_EXT_SSL_PORT}#g;
 320          s#__MANAGEMENT_TOKEN__#${MANAGEMENT_TOKEN}#g;
 321          s#__RELEASE__#${RELEASE}#g;
 322          s#__SYSTEM_ROOT_TOKEN__#${SYSTEM_ROOT_TOKEN}#g;
 323          s#__VERSION__#${VERSION}#g;
 324          s#__CLUSTER_INT_CIDR__#${CLUSTER_INT_CIDR}#g;
 325          s#__CONTROLLER_INT_IP__#${CONTROLLER_INT_IP}#g;
 326          s#__WEBSOCKET_INT_IP__#${WEBSOCKET_INT_IP}#g;
 327          s#__KEEP_INT_IP__#${KEEP_INT_IP}#g;
 328          s#__KEEPSTORE0_INT_IP__#${KEEPSTORE0_INT_IP}#g;
 329          s#__KEEPSTORE1_INT_IP__#${KEEPSTORE1_INT_IP}#g;
 330          s#__KEEPWEB_INT_IP__#${KEEPWEB_INT_IP}#g;
 331          s#__WEBSHELL_INT_IP__#${WEBSHELL_INT_IP}#g;
 332          s#__WORKBENCH1_INT_IP__#${WORKBENCH1_INT_IP}#g;
 333          s#__WORKBENCH2_INT_IP__#${WORKBENCH2_INT_IP}#g;
 334          s#__DATABASE_INT_IP__#${DATABASE_INT_IP}#g;
 335          s#__WEBSHELL_EXT_SSL_PORT__#${WEBSHELL_EXT_SSL_PORT}#g;
 336          s#__WEBSOCKET_EXT_SSL_PORT__#${WEBSOCKET_EXT_SSL_PORT}#g;
 337          s#__WORKBENCH1_EXT_SSL_PORT__#${WORKBENCH1_EXT_SSL_PORT}#g;
 338          s#__WORKBENCH2_EXT_SSL_PORT__#${WORKBENCH2_EXT_SSL_PORT}#g;
 339          s#__WORKBENCH_SECRET_KEY__#${WORKBENCH_SECRET_KEY}#g" \
 340     "${f}" > "${F_DIR}/extra/extra"/$(basename "${f}")
 341   done
 342 fi
 343
 344 # Now, we build the SALT states/pillars trees
 345 # As we need to separate both states and pillars in case we want specific
 346 # roles, we iterate on both at the same time
 347
 348 # States
 349 cat > ${S_DIR}/top.sls << EOFTSLS
 350 base:
 351   '*':
 352     - locale
 353 EOFTSLS
 354
 355 # Pillars
 356 cat > ${P_DIR}/top.sls << EOFPSLS
 357 base:
 358   '*':
 359     - locale
 360     - arvados
 361 EOFPSLS
 362
 363 # States, extra states
 364 if [ -d "${F_DIR}"/extra/extra ]; then
 365   for f in $(ls "${F_DIR}"/extra/extra/*.sls); do
 366   echo "    - extra.$(basename ${f} | sed 's/.sls$//g')" >> ${S_DIR}/top.sls
 367   done
 368 fi
 369
 370 # If we want specific roles for a node, just add the desired states
 371 # and its dependencies
 372 if [ -z "${ROLES}" ]; then
 373   # States
 374   echo "    - nginx.passenger" >> ${S_DIR}/top.sls
 375   if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 376     grep -q "letsencrypt" ${S_DIR}/top.sls || echo "    - letsencrypt" >> ${S_DIR}/top.sls
 377   fi
 378   echo "    - postgres" >> ${S_DIR}/top.sls
 379   echo "    - docker.software" >> ${S_DIR}/top.sls
 380   echo "    - arvados" >> ${S_DIR}/top.sls
 381
 382   # Pillars
 383   echo "    - docker" >> ${P_DIR}/top.sls
 384   echo "    - nginx_api_configuration" >> ${P_DIR}/top.sls
 385   echo "    - nginx_controller_configuration" >> ${P_DIR}/top.sls
 386   echo "    - nginx_keepproxy_configuration" >> ${P_DIR}/top.sls
 387   echo "    - nginx_keepweb_configuration" >> ${P_DIR}/top.sls
 388   echo "    - nginx_passenger" >> ${P_DIR}/top.sls
 389   echo "    - nginx_websocket_configuration" >> ${P_DIR}/top.sls
 390   echo "    - nginx_webshell_configuration" >> ${P_DIR}/top.sls
 391   echo "    - nginx_workbench2_configuration" >> ${P_DIR}/top.sls
 392   echo "    - nginx_workbench_configuration" >> ${P_DIR}/top.sls
 393   echo "    - postgresql" >> ${P_DIR}/top.sls
 394   if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 395     grep -q "letsencrypt" ${P_DIR}/top.sls || echo "    - letsencrypt" >> ${P_DIR}/top.sls
 396   fi
 397 else
 398   # If we add individual roles, make sure we add the repo first
 399   echo "    - arvados.repo" >> ${S_DIR}/top.sls
 400   for R in ${ROLES}; do
 401     case "${R}" in
 402       "database")
 403         # States
 404         echo "    - postgres" >> ${S_DIR}/top.sls
 405         # Pillars
 406         echo '    - postgresql' >> ${P_DIR}/top.sls
 407       ;;
 408       "api")
 409         # States
 410         # FIXME: https://dev.arvados.org/issues/17352
 411         grep -q "postgres.client" ${S_DIR}/top.sls || echo "    - postgres.client" >> ${S_DIR}/top.sls
 412         grep -q "nginx.passenger" ${S_DIR}/top.sls || echo "    - nginx.passenger" >> ${S_DIR}/top.sls
 413         ### If we don't install and run LE before arvados-api-server, it fails and breaks everything
 414         ### after it so we add this here, as we are, after all, sharing the host for api and controller
 415         if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 416           grep -q "letsencrypt" ${S_DIR}/top.sls || echo "    - letsencrypt" >> ${S_DIR}/top.sls
 417         fi
 418         grep -q "arvados.${R}" ${S_DIR}/top.sls    || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 419         # Pillars
 420         grep -q "docker" ${P_DIR}/top.sls                   || echo "    - docker" >> ${P_DIR}/top.sls
 421         grep -q "postgresql" ${P_DIR}/top.sls               || echo "    - postgresql" >> ${P_DIR}/top.sls
 422         grep -q "nginx_passenger" ${P_DIR}/top.sls          || echo "    - nginx_passenger" >> ${P_DIR}/top.sls
 423         grep -q "nginx_${R}_configuration" ${P_DIR}/top.sls || echo "    - nginx_${R}_configuration" >> ${P_DIR}/top.sls
 424       ;;
 425       "controller" | "websocket" | "workbench" | "workbench2" | "keepweb" | "keepproxy")
 426         # States
 427         grep -q "nginx.passenger" ${S_DIR}/top.sls || echo "    - nginx.passenger" >> ${S_DIR}/top.sls
 428         if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 429           grep -q "letsencrypt" ${S_DIR}/top.sls || echo "    - letsencrypt" >> ${S_DIR}/top.sls
 430         fi
 431         grep -q "arvados.${R}" ${S_DIR}/top.sls    || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 432         # Pillars
 433         grep -q "nginx_passenger" ${P_DIR}/top.sls          || echo "    - nginx_passenger" >> ${P_DIR}/top.sls
 434         grep -q "nginx_${R}_configuration" ${P_DIR}/top.sls || echo "    - nginx_${R}_configuration" >> ${P_DIR}/top.sls
 435         if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 436           grep -q "letsencrypt" ${P_DIR}/top.sls || echo "    - letsencrypt" >> ${P_DIR}/top.sls
 437           grep -q "letsencrypt_${R}_configuration" ${P_DIR}/top.sls || echo "    - letsencrypt_${R}_configuration" >> ${P_DIR}/top.sls
 438         fi
 439       ;;
 440       "shell")
 441         # States
 442         grep -q "docker" ${S_DIR}/top.sls       || echo "    - docker.software" >> ${S_DIR}/top.sls
 443         grep -q "arvados.${R}" ${S_DIR}/top.sls || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 444         # Pillars
 445         grep -q "" ${P_DIR}/top.sls                             || echo "    - docker" >> ${P_DIR}/top.sls
 446         grep -q "nginx_webshell_configuration" ${P_DIR}/top.sls || echo "    - nginx_webshell_configuration" >> ${P_DIR}/top.sls
 447       ;;
 448       "dispatcher")
 449         # States
 450         grep -q "docker" ${S_DIR}/top.sls       || echo "    - docker.software" >> ${S_DIR}/top.sls
 451         grep -q "arvados.${R}" ${S_DIR}/top.sls || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 452         # Pillars
 453         # ATM, no specific pillar needed
 454       ;;
 455       "keepstore")
 456         # States
 457         grep -q "arvados.${R}" ${S_DIR}/top.sls || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 458         # Pillars
 459         # ATM, no specific pillar needed
 460       ;;
 461       *)
 462         echo "Unknown role ${R}"
 463         exit 1
 464       ;;
 465     esac
 466   done
 467 fi
 468
 469 # FIXME! #16992 Temporary fix for psql call in arvados-api-server
 470 if [ -e /root/.psqlrc ]; then
 471   if ! ( grep 'pset pager off' /root/.psqlrc ); then
 472     RESTORE_PSQL="yes"
 473     cp /root/.psqlrc /root/.psqlrc.provision.backup
 474   fi
 475 else
 476   DELETE_PSQL="yes"
 477 fi
 478
 479 echo '\pset pager off' >> /root/.psqlrc
 480 # END FIXME! #16992 Temporary fix for psql call in arvados-api-server
 481
 482 # Now run the install
 483 salt-call --local state.apply -l ${LOG_LEVEL}
 484
 485 # FIXME! #16992 Temporary fix for psql call in arvados-api-server
 486 if [ "x${DELETE_PSQL}" = "xyes" ]; then
 487   echo "Removing .psql file"
 488   rm /root/.psqlrc
 489 fi
 490
 491 if [ "x${RESTORE_PSQL}" = "xyes" ]; then
 492   echo "Restoring .psql file"
 493   mv -v /root/.psqlrc.provision.backup /root/.psqlrc
 494 fi
 495 # END FIXME! #16992 Temporary fix for psql call in arvados-api-server
 496
 497 # Leave a copy of the Arvados CA so the user can copy it where it's required
 498 echo "Copying the Arvados CA certificate to the installer dir, so you can import it"
 499 # If running in a vagrant VM, also add default user to docker group
 500 if [ "x${VAGRANT}" = "xyes" ]; then
 501   cp /etc/ssl/certs/arvados-snakeoil-ca.pem /vagrant/${CLUSTER}.${DOMAIN}-arvados-snakeoil-ca.pem
 502
 503   echo "Adding the vagrant user to the docker group"
 504   usermod -a -G docker vagrant
 505 else
 506   cp /etc/ssl/certs/arvados-snakeoil-ca.pem ${SCRIPT_DIR}/${CLUSTER}.${DOMAIN}-arvados-snakeoil-ca.pem
 507 fi
 508
 509 # Test that the installation finished correctly
 510 if [ "x${TEST}" = "xyes" ]; then
 511   cd /tmp/cluster_tests
 512   ./run-test.sh
 513 fi