tools/salt-install/provision.sh

   1 #!/bin/bash -x
   2
   3 # Copyright (C) The Arvados Authors. All rights reserved.
   4 #
   5 # SPDX-License-Identifier: CC-BY-SA-3.0
   6
   7 # If you want to test arvados in a single host, you can run this script, which
   8 # will install it using salt masterless
   9 # This script is run by the Vagrant file when you run it with
  10 #
  11 # vagrant up
  12
  13 set -o pipefail
  14
  15 # capture the directory that the script is running from
  16 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
  17
  18 usage() {
  19   echo >&2
  20   echo >&2 "Usage: ${0} [-h] [-h]"
  21   echo >&2
  22   echo >&2 "${0} options:"
  23   echo >&2 "  -d, --debug                                 Run salt installation in debug mode"
  24   echo >&2 "  -p <N>, --ssl-port <N>                      SSL port to use for the web applications"
  25   echo >&2 "  -c <local.params>, --config <local.params>  Path to the local.params config file"
  26   echo >&2 "  -t, --test                                  Test installation running a CWL workflow"
  27   echo >&2 "  -r, --roles                                 List of Arvados roles to apply to the host, comma separated"
  28   echo >&2 "                                              Possible values are:"
  29   echo >&2 "                                                api"
  30   echo >&2 "                                                controller"
  31   echo >&2 "                                                keepstore"
  32   echo >&2 "                                                websocket"
  33   echo >&2 "                                                keepweb"
  34   echo >&2 "                                                workbench2"
  35   echo >&2 "                                                keepproxy"
  36   echo >&2 "                                                shell"
  37   echo >&2 "                                                workbench"
  38   echo >&2 "                                                dispatcher"
  39   echo >&2 "                                              Defaults to applying them all"
  40   echo >&2 "  -h, --help                                  Display this help and exit"
  41   echo >&2 "  -v, --vagrant                               Run in vagrant and use the /vagrant shared dir"
  42   echo >&2
  43 }
  44
  45 arguments() {
  46   # NOTE: This requires GNU getopt (part of the util-linux package on Debian-based distros).
  47   TEMP=$(getopt -o c:dhp:r:tv \
  48     --long config:,debug,help,ssl-port:,roles:,test,vagrant \
  49     -n "${0}" -- "${@}")
  50
  51   if [ ${?} != 0 ] ; then echo "GNU getopt missing? Use -h for help"; exit 1 ; fi
  52   # Note the quotes around `$TEMP': they are essential!
  53   eval set -- "$TEMP"
  54
  55   while [ ${#} -ge 1 ]; do
  56     case ${1} in
  57       -c | --config)
  58         CONFIG_FILE=${2}
  59         shift 2
  60         ;;
  61       -d | --debug)
  62         LOG_LEVEL="debug"
  63         shift
  64         ;;
  65       -p | --ssl-port)
  66         CONTROLLER_EXT_SSL_PORT=${2}
  67         shift 2
  68         ;;
  69       -r | --roles)
  70         for i in ${2//,/ }
  71           do
  72             # Verify the role exists
  73             if [[ ! "database,api,controller,keepstore,websocket,keepweb,workbench2,keepproxy,shell,workbench,dispatcher" == *"$i"* ]]; then
  74               echo "The role '${i}' is not a valid role"
  75               usage
  76               exit 1
  77             fi
  78             ROLES="${ROLES} ${i}"
  79           done
  80           shift 2
  81         ;;
  82       -t | --test)
  83         TEST="yes"
  84         shift
  85         ;;
  86       -v | --vagrant)
  87         VAGRANT="yes"
  88         shift
  89         ;;
  90       --)
  91         shift
  92         break
  93         ;;
  94       *)
  95         usage
  96         exit 1
  97         ;;
  98     esac
  99   done
 100 }
 101
 102 CONFIG_FILE="${SCRIPT_DIR}/local.params"
 103 CONFIG_DIR="local_config_dir"
 104 LOG_LEVEL="info"
 105 CONTROLLER_EXT_SSL_PORT=443
 106 TESTS_DIR="tests"
 107
 108 CLUSTER=""
 109 DOMAIN=""
 110
 111 # Hostnames/IPs used for single-host deploys
 112 HOSTNAME_EXT=""
 113 HOSTNAME_INT="127.0.1.1"
 114
 115 # Initial user setup
 116 INITIAL_USER=""
 117 INITIAL_USER_EMAIL=""
 118 INITIAL_USER_PASSWORD=""
 119
 120 CONTROLLER_EXT_SSL_PORT=8000
 121 KEEP_EXT_SSL_PORT=25101
 122 # Both for collections and downloads
 123 KEEPWEB_EXT_SSL_PORT=9002
 124 WEBSHELL_EXT_SSL_PORT=4202
 125 WEBSOCKET_EXT_SSL_PORT=8002
 126 WORKBENCH1_EXT_SSL_PORT=443
 127 WORKBENCH2_EXT_SSL_PORT=3001
 128
 129 RELEASE="production"
 130 VERSION="2.1.2-1"
 131
 132 # Formulas versions
 133 ARVADOS_TAG="master"
 134 POSTGRES_TAG="v0.41.6"
 135 NGINX_TAG="temp-fix-missing-statements-in-pillar"
 136 DOCKER_TAG="v1.0.0"
 137 LOCALE_TAG="v0.3.4"
 138 LETSENCRYPT_TAG="v2.1.0"
 139
 140 # Salt's dir
 141 ## states
 142 S_DIR="/srv/salt"
 143 ## formulas
 144 F_DIR="/srv/formulas"
 145 ##pillars
 146 P_DIR="/srv/pillars"
 147
 148 arguments ${@}
 149
 150 if [ -s ${CONFIG_FILE} ]; then
 151   source ${CONFIG_FILE}
 152 else
 153   echo >&2 "Please create a '${CONFIG_FILE}' file with initial values, as described in"
 154   echo >&2 "  * https://doc.arvados.org/install/salt-single-host.html#single_host, or"
 155   echo >&2 "  * https://doc.arvados.org/install/salt-multi-host.html#multi_host_multi_hostnames"
 156   exit 1
 157 fi
 158
 159 if [ ! -d ${CONFIG_DIR} ]; then
 160   echo >&2 "Please create a '${CONFIG_DIR}' with initial values, as described in"
 161   echo >&2 "  * https://doc.arvados.org/install/salt-single-host.html#single_host, or"
 162   echo >&2 "  * https://doc.arvados.org/install/salt-multi-host.html#multi_host_multi_hostnames"
 163   exit 1
 164 fi
 165
 166 if grep -q 'fixme_or_this_wont_work' ${CONFIG_FILE} ; then
 167   echo >&2 "The config file ${CONFIG_FILE} has some parameters that need to be modified."
 168   echo >&2 "Please, fix them and re-run the provision script."
 169   exit 1
 170 fi
 171
 172 if ! grep -E '^[[:alnum:]]{5}$' <<<${CLUSTER} ; then
 173   echo >&2 "ERROR: <CLUSTER> must be exactly 5 alphanumeric characters long"
 174   echo >&2 "Fix the cluster name in the 'local.params' file and re-run the provision script"
 175   exit 1
 176 fi
 177
 178 # Only used in single_host/single_name deploys
 179 if [ "x${HOSTNAME_EXT}" = "x" ] ; then
 180   HOSTNAME_EXT="${CLUSTER}.${DOMAIN}"
 181 fi
 182
 183 apt-get update
 184 apt-get install -y curl git jq
 185
 186 if which salt-call; then
 187   echo "Salt already installed"
 188 else
 189   curl -L https://bootstrap.saltstack.com -o /tmp/bootstrap_salt.sh
 190   sh /tmp/bootstrap_salt.sh -XdfP -x python3
 191   /bin/systemctl stop salt-minion.service
 192   /bin/systemctl disable salt-minion.service
 193 fi
 194
 195 # Set salt to masterless mode
 196 cat > /etc/salt/minion << EOFSM
 197 file_client: local
 198 file_roots:
 199   base:
 200     - ${S_DIR}
 201     - ${F_DIR}/*
 202
 203 pillar_roots:
 204   base:
 205     - ${P_DIR}
 206 EOFSM
 207
 208 mkdir -p ${S_DIR} ${F_DIR} ${P_DIR}
 209
 210 # Get the formula and dependencies
 211 cd ${F_DIR} || exit 1
 212 git clone --branch "${ARVADOS_TAG}"     https://github.com/arvados/arvados-formula.git
 213 git clone --branch "${DOCKER_TAG}"      https://github.com/saltstack-formulas/docker-formula.git
 214 git clone --branch "${LOCALE_TAG}"      https://github.com/saltstack-formulas/locale-formula.git
 215 # git clone --branch "${NGINX_TAG}"       https://github.com/saltstack-formulas/nginx-formula.git
 216 git clone --branch "${NGINX_TAG}"       https://github.com/netmanagers/nginx-formula.git
 217 git clone --branch "${POSTGRES_TAG}"    https://github.com/saltstack-formulas/postgres-formula.git
 218 git clone --branch "${LETSENCRYPT_TAG}" https://github.com/saltstack-formulas/letsencrypt-formula.git
 219
 220 # If we want to try a specific branch of the formula
 221 if [ "x${BRANCH}" != "x" ]; then
 222   cd ${F_DIR}/arvados-formula || exit 1
 223   git checkout -t origin/"${BRANCH}" -b "${BRANCH}"
 224   cd -
 225 fi
 226
 227 if [ "x${VAGRANT}" = "xyes" ]; then
 228   EXTRA_STATES_DIR="/home/vagrant/${CONFIG_DIR}/states"
 229   SOURCE_PILLARS_DIR="/home/vagrant/${CONFIG_DIR}/pillars"
 230   SOURCE_TESTS_DIR="/home/vagrant/${TESTS_DIR}"
 231 else
 232   EXTRA_STATES_DIR="${SCRIPT_DIR}/${CONFIG_DIR}/states"
 233   SOURCE_PILLARS_DIR="${SCRIPT_DIR}/${CONFIG_DIR}/pillars"
 234   SOURCE_TESTS_DIR="${SCRIPT_DIR}/${TESTS_DIR}"
 235 fi
 236
 237 SOURCE_STATES_DIR="${EXTRA_STATES_DIR}"
 238
 239 # Replace variables (cluster,  domain, etc) in the pillars, states and tests
 240 # to ease deployment for newcomers
 241 if [ ! -d "${SOURCE_PILLARS_DIR}" ]; then
 242   echo "${SOURCE_PILLARS_DIR} does not exist or is not a directory. Exiting."
 243   exit 1
 244 fi
 245 for f in $(ls "${SOURCE_PILLARS_DIR}"/*); do
 246   sed "s#__ANONYMOUS_USER_TOKEN__#${ANONYMOUS_USER_TOKEN}#g;
 247        s#__BLOB_SIGNING_KEY__#${BLOB_SIGNING_KEY}#g;
 248        s#__CONTROLLER_EXT_SSL_PORT__#${CONTROLLER_EXT_SSL_PORT}#g;
 249        s#__CLUSTER__#${CLUSTER}#g;
 250        s#__DOMAIN__#${DOMAIN}#g;
 251        s#__HOSTNAME_EXT__#${HOSTNAME_EXT}#g;
 252        s#__HOSTNAME_INT__#${HOSTNAME_INT}#g;
 253        s#__INITIAL_USER_EMAIL__#${INITIAL_USER_EMAIL}#g;
 254        s#__INITIAL_USER_PASSWORD__#${INITIAL_USER_PASSWORD}#g;
 255        s#__INITIAL_USER__#${INITIAL_USER}#g;
 256        s#__LE_AWS_REGION__#${LE_AWS_REGION}#g;
 257        s#__LE_AWS_SECRET_ACCESS_KEY__#${LE_AWS_SECRET_ACCESS_KEY}#g;
 258        s#__LE_AWS_ACCESS_KEY_ID__#${LE_AWS_ACCESS_KEY_ID}#g;
 259        s#__DATABASE_PASSWORD__#${DATABASE_PASSWORD}#g;
 260        s#__KEEPWEB_EXT_SSL_PORT__#${KEEPWEB_EXT_SSL_PORT}#g;
 261        s#__KEEP_EXT_SSL_PORT__#${KEEP_EXT_SSL_PORT}#g;
 262        s#__MANAGEMENT_TOKEN__#${MANAGEMENT_TOKEN}#g;
 263        s#__RELEASE__#${RELEASE}#g;
 264        s#__SYSTEM_ROOT_TOKEN__#${SYSTEM_ROOT_TOKEN}#g;
 265        s#__VERSION__#${VERSION}#g;
 266        s#__WEBSHELL_EXT_SSL_PORT__#${WEBSHELL_EXT_SSL_PORT}#g;
 267        s#__WEBSOCKET_EXT_SSL_PORT__#${WEBSOCKET_EXT_SSL_PORT}#g;
 268        s#__WORKBENCH1_EXT_SSL_PORT__#${WORKBENCH1_EXT_SSL_PORT}#g;
 269        s#__WORKBENCH2_EXT_SSL_PORT__#${WORKBENCH2_EXT_SSL_PORT}#g;
 270        s#__CLUSTER_INT_CIDR__#${CLUSTER_INT_CIDR}#g;
 271        s#__CONTROLLER_INT_IP__#${CONTROLLER_INT_IP}#g;
 272        s#__WEBSOCKET_INT_IP__#${WEBSOCKET_INT_IP}#g;
 273        s#__KEEP_INT_IP__#${KEEP_INT_IP}#g;
 274        s#__KEEPSTORE0_INT_IP__#${KEEPSTORE0_INT_IP}#g;
 275        s#__KEEPSTORE1_INT_IP__#${KEEPSTORE1_INT_IP}#g;
 276        s#__KEEPWEB_INT_IP__#${KEEPWEB_INT_IP}#g;
 277        s#__WEBSHELL_INT_IP__#${WEBSHELL_INT_IP}#g;
 278        s#__WORKBENCH1_INT_IP__#${WORKBENCH1_INT_IP}#g;
 279        s#__WORKBENCH2_INT_IP__#${WORKBENCH2_INT_IP}#g;
 280        s#__DATABASE_INT_IP__#${DATABASE_INT_IP}#g;
 281        s#__WORKBENCH_SECRET_KEY__#${WORKBENCH_SECRET_KEY}#g" \
 282   "${f}" > "${P_DIR}"/$(basename "${f}")
 283 done
 284
 285 if [ "x${TEST}" = "xyes" ] && [ ! -d "${SOURCE_TESTS_DIR}" ]; then
 286   echo "You requested to run tests, but ${SOURCE_TESTS_DIR} does not exist or is not a directory. Exiting."
 287   exit 1
 288 fi
 289 mkdir -p /tmp/cluster_tests
 290 # Replace cluster and domain name in the test files
 291 for f in $(ls "${SOURCE_TESTS_DIR}"/*); do
 292   sed "s#__CLUSTER__#${CLUSTER}#g;
 293        s#__CONTROLLER_EXT_SSL_PORT__#${CONTROLLER_EXT_SSL_PORT}#g;
 294        s#__DOMAIN__#${DOMAIN}#g;
 295        s#__HOSTNAME_INT__#${HOSTNAME_INT}#g;
 296        s#__INITIAL_USER_EMAIL__#${INITIAL_USER_EMAIL}#g;
 297        s#__INITIAL_USER_PASSWORD__#${INITIAL_USER_PASSWORD}#g
 298        s#__INITIAL_USER__#${INITIAL_USER}#g;
 299        s#__DATABASE_PASSWORD__#${DATABASE_PASSWORD}#g;
 300        s#__SYSTEM_ROOT_TOKEN__#${SYSTEM_ROOT_TOKEN}#g" \
 301   "${f}" > "/tmp/cluster_tests"/$(basename "${f}")
 302 done
 303 chmod 755 /tmp/cluster_tests/run-test.sh
 304
 305 # Replace helper state files that differ from the formula's examples
 306 if [ -d "${SOURCE_STATES_DIR}" ]; then
 307   mkdir -p "${F_DIR}"/extra/extra
 308
 309   for f in $(ls "${SOURCE_STATES_DIR}"/*); do
 310     sed "s#__ANONYMOUS_USER_TOKEN__#${ANONYMOUS_USER_TOKEN}#g;
 311          s#__CLUSTER__#${CLUSTER}#g;
 312          s#__BLOB_SIGNING_KEY__#${BLOB_SIGNING_KEY}#g;
 313          s#__CONTROLLER_EXT_SSL_PORT__#${CONTROLLER_EXT_SSL_PORT}#g;
 314          s#__DOMAIN__#${DOMAIN}#g;
 315          s#__HOSTNAME_EXT__#${HOSTNAME_EXT}#g;
 316          s#__HOSTNAME_INT__#${HOSTNAME_INT}#g;
 317          s#__INITIAL_USER_EMAIL__#${INITIAL_USER_EMAIL}#g;
 318          s#__INITIAL_USER_PASSWORD__#${INITIAL_USER_PASSWORD}#g;
 319          s#__INITIAL_USER__#${INITIAL_USER}#g;
 320          s#__DATABASE_PASSWORD__#${DATABASE_PASSWORD}#g;
 321          s#__KEEPWEB_EXT_SSL_PORT__#${KEEPWEB_EXT_SSL_PORT}#g;
 322          s#__KEEP_EXT_SSL_PORT__#${KEEP_EXT_SSL_PORT}#g;
 323          s#__MANAGEMENT_TOKEN__#${MANAGEMENT_TOKEN}#g;
 324          s#__RELEASE__#${RELEASE}#g;
 325          s#__SYSTEM_ROOT_TOKEN__#${SYSTEM_ROOT_TOKEN}#g;
 326          s#__VERSION__#${VERSION}#g;
 327          s#__CLUSTER_INT_CIDR__#${CLUSTER_INT_CIDR}#g;
 328          s#__CONTROLLER_INT_IP__#${CONTROLLER_INT_IP}#g;
 329          s#__WEBSOCKET_INT_IP__#${WEBSOCKET_INT_IP}#g;
 330          s#__KEEP_INT_IP__#${KEEP_INT_IP}#g;
 331          s#__KEEPSTORE0_INT_IP__#${KEEPSTORE0_INT_IP}#g;
 332          s#__KEEPSTORE1_INT_IP__#${KEEPSTORE1_INT_IP}#g;
 333          s#__KEEPWEB_INT_IP__#${KEEPWEB_INT_IP}#g;
 334          s#__WEBSHELL_INT_IP__#${WEBSHELL_INT_IP}#g;
 335          s#__WORKBENCH1_INT_IP__#${WORKBENCH1_INT_IP}#g;
 336          s#__WORKBENCH2_INT_IP__#${WORKBENCH2_INT_IP}#g;
 337          s#__DATABASE_INT_IP__#${DATABASE_INT_IP}#g;
 338          s#__WEBSHELL_EXT_SSL_PORT__#${WEBSHELL_EXT_SSL_PORT}#g;
 339          s#__WEBSOCKET_EXT_SSL_PORT__#${WEBSOCKET_EXT_SSL_PORT}#g;
 340          s#__WORKBENCH1_EXT_SSL_PORT__#${WORKBENCH1_EXT_SSL_PORT}#g;
 341          s#__WORKBENCH2_EXT_SSL_PORT__#${WORKBENCH2_EXT_SSL_PORT}#g;
 342          s#__WORKBENCH_SECRET_KEY__#${WORKBENCH_SECRET_KEY}#g" \
 343     "${f}" > "${F_DIR}/extra/extra"/$(basename "${f}")
 344   done
 345 fi
 346
 347 # Now, we build the SALT states/pillars trees
 348 # As we need to separate both states and pillars in case we want specific
 349 # roles, we iterate on both at the same time
 350
 351 # States
 352 cat > ${S_DIR}/top.sls << EOFTSLS
 353 base:
 354   '*':
 355     - locale
 356 EOFTSLS
 357
 358 # Pillars
 359 cat > ${P_DIR}/top.sls << EOFPSLS
 360 base:
 361   '*':
 362     - locale
 363     - arvados
 364 EOFPSLS
 365
 366 # States, extra states
 367 if [ -d "${F_DIR}"/extra/extra ]; then
 368   for f in $(ls "${F_DIR}"/extra/extra/*.sls); do
 369   echo "    - extra.$(basename ${f} | sed 's/.sls$//g')" >> ${S_DIR}/top.sls
 370   done
 371 fi
 372
 373 # If we want specific roles for a node, just add the desired states
 374 # and its dependencies
 375 if [ -z "${ROLES}" ]; then
 376   # States
 377   echo "    - nginx.passenger" >> ${S_DIR}/top.sls
 378   # Currently, only available on config_examples/multi_host/aws
 379   if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 380     grep -q "aws_credentials" ${S_DIR}/top.sls || echo "    - aws_credentials" >> ${S_DIR}/top.sls
 381     grep -q "letsencrypt"     ${S_DIR}/top.sls || echo "    - letsencrypt" >> ${S_DIR}/top.sls
 382   fi
 383   echo "    - postgres" >> ${S_DIR}/top.sls
 384   echo "    - docker.software" >> ${S_DIR}/top.sls
 385   echo "    - arvados" >> ${S_DIR}/top.sls
 386
 387   # Pillars
 388   echo "    - docker" >> ${P_DIR}/top.sls
 389   echo "    - nginx_api_configuration" >> ${P_DIR}/top.sls
 390   echo "    - nginx_controller_configuration" >> ${P_DIR}/top.sls
 391   echo "    - nginx_keepproxy_configuration" >> ${P_DIR}/top.sls
 392   echo "    - nginx_keepweb_configuration" >> ${P_DIR}/top.sls
 393   echo "    - nginx_passenger" >> ${P_DIR}/top.sls
 394   echo "    - nginx_websocket_configuration" >> ${P_DIR}/top.sls
 395   echo "    - nginx_webshell_configuration" >> ${P_DIR}/top.sls
 396   echo "    - nginx_workbench2_configuration" >> ${P_DIR}/top.sls
 397   echo "    - nginx_workbench_configuration" >> ${P_DIR}/top.sls
 398   echo "    - postgresql" >> ${P_DIR}/top.sls
 399   # Currently, only available on config_examples/multi_host/aws
 400   if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 401     grep -q "aws_credentials" ${P_DIR}/top.sls || echo "    - aws_credentials" >> ${P_DIR}/top.sls
 402     grep -q "letsencrypt"     ${P_DIR}/top.sls || echo "    - letsencrypt" >> ${P_DIR}/top.sls
 403   fi
 404 else
 405   # If we add individual roles, make sure we add the repo first
 406   echo "    - arvados.repo" >> ${S_DIR}/top.sls
 407   for R in ${ROLES}; do
 408     case "${R}" in
 409       "database")
 410         # States
 411         echo "    - postgres" >> ${S_DIR}/top.sls
 412         # Pillars
 413         echo '    - postgresql' >> ${P_DIR}/top.sls
 414       ;;
 415       "api")
 416         # States
 417         # FIXME: https://dev.arvados.org/issues/17352
 418         grep -q "postgres.client" ${S_DIR}/top.sls || echo "    - postgres.client" >> ${S_DIR}/top.sls
 419         grep -q "nginx.passenger" ${S_DIR}/top.sls || echo "    - nginx.passenger" >> ${S_DIR}/top.sls
 420         ### If we don't install and run LE before arvados-api-server, it fails and breaks everything
 421         ### after it so we add this here, as we are, after all, sharing the host for api and controller
 422         # Currently, only available on config_examples/multi_host/aws
 423         if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 424           grep -q "aws_credentials" ${S_DIR}/top.sls || echo "    - aws_credentials" >> ${S_DIR}/top.sls
 425           grep -q "letsencrypt"     ${S_DIR}/top.sls || echo "    - letsencrypt" >> ${S_DIR}/top.sls
 426         fi
 427         grep -q "arvados.${R}" ${S_DIR}/top.sls    || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 428         # Pillars
 429         grep -q "aws_credentials" ${P_DIR}/top.sls          || echo "    - aws_credentials" >> ${P_DIR}/top.sls
 430         grep -q "docker" ${P_DIR}/top.sls                   || echo "    - docker" >> ${P_DIR}/top.sls
 431         grep -q "postgresql" ${P_DIR}/top.sls               || echo "    - postgresql" >> ${P_DIR}/top.sls
 432         grep -q "nginx_passenger" ${P_DIR}/top.sls          || echo "    - nginx_passenger" >> ${P_DIR}/top.sls
 433         grep -q "nginx_${R}_configuration" ${P_DIR}/top.sls || echo "    - nginx_${R}_configuration" >> ${P_DIR}/top.sls
 434       ;;
 435       "controller" | "websocket" | "workbench" | "workbench2" | "keepweb" | "keepproxy")
 436         # States
 437         grep -q "nginx.passenger" ${S_DIR}/top.sls || echo "    - nginx.passenger" >> ${S_DIR}/top.sls
 438         # Currently, only available on config_examples/multi_host/aws
 439         if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 440           grep -q "aws_credentials" ${S_DIR}/top.sls || echo "    - aws_credentials" >> ${S_DIR}/top.sls
 441           grep -q "letsencrypt"     ${S_DIR}/top.sls || echo "    - letsencrypt" >> ${S_DIR}/top.sls
 442         fi
 443         grep -q "arvados.${R}" ${S_DIR}/top.sls    || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 444         # Pillars
 445         grep -q "nginx_passenger" ${P_DIR}/top.sls          || echo "    - nginx_passenger" >> ${P_DIR}/top.sls
 446         grep -q "nginx_${R}_configuration" ${P_DIR}/top.sls || echo "    - nginx_${R}_configuration" >> ${P_DIR}/top.sls
 447         # Currently, only available on config_examples/multi_host/aws
 448         if [ "x${USE_LETSENCRYPT}" = "xyes" ]; then
 449           grep -q "aws_credentials" ${P_DIR}/top.sls || echo "    - aws_credentials" >> ${P_DIR}/top.sls
 450           grep -q "letsencrypt"     ${P_DIR}/top.sls || echo "    - letsencrypt" >> ${P_DIR}/top.sls
 451           grep -q "letsencrypt_${R}_configuration" ${P_DIR}/top.sls || echo "    - letsencrypt_${R}_configuration" >> ${P_DIR}/top.sls
 452         fi
 453       ;;
 454       "shell")
 455         # States
 456         grep -q "docker" ${S_DIR}/top.sls       || echo "    - docker.software" >> ${S_DIR}/top.sls
 457         grep -q "arvados.${R}" ${S_DIR}/top.sls || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 458         # Pillars
 459         grep -q "" ${P_DIR}/top.sls                             || echo "    - docker" >> ${P_DIR}/top.sls
 460         grep -q "nginx_webshell_configuration" ${P_DIR}/top.sls || echo "    - nginx_webshell_configuration" >> ${P_DIR}/top.sls
 461       ;;
 462       "dispatcher")
 463         # States
 464         grep -q "docker" ${S_DIR}/top.sls       || echo "    - docker.software" >> ${S_DIR}/top.sls
 465         grep -q "arvados.${R}" ${S_DIR}/top.sls || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 466         # Pillars
 467         # ATM, no specific pillar needed
 468       ;;
 469       "keepstore")
 470         # States
 471         grep -q "arvados.${R}" ${S_DIR}/top.sls || echo "    - arvados.${R}" >> ${S_DIR}/top.sls
 472         # Pillars
 473         # ATM, no specific pillar needed
 474       ;;
 475       *)
 476         echo "Unknown role ${R}"
 477         exit 1
 478       ;;
 479     esac
 480   done
 481 fi
 482
 483 # FIXME! #16992 Temporary fix for psql call in arvados-api-server
 484 if [ -e /root/.psqlrc ]; then
 485   if ! ( grep 'pset pager off' /root/.psqlrc ); then
 486     RESTORE_PSQL="yes"
 487     cp /root/.psqlrc /root/.psqlrc.provision.backup
 488   fi
 489 else
 490   DELETE_PSQL="yes"
 491 fi
 492
 493 echo '\pset pager off' >> /root/.psqlrc
 494 # END FIXME! #16992 Temporary fix for psql call in arvados-api-server
 495
 496 # Now run the install
 497 salt-call --local state.apply -l ${LOG_LEVEL}
 498
 499 # FIXME! #16992 Temporary fix for psql call in arvados-api-server
 500 if [ "x${DELETE_PSQL}" = "xyes" ]; then
 501   echo "Removing .psql file"
 502   rm /root/.psqlrc
 503 fi
 504
 505 if [ "x${RESTORE_PSQL}" = "xyes" ]; then
 506   echo "Restoring .psql file"
 507   mv -v /root/.psqlrc.provision.backup /root/.psqlrc
 508 fi
 509 # END FIXME! #16992 Temporary fix for psql call in arvados-api-server
 510
 511 # Leave a copy of the Arvados CA so the user can copy it where it's required
 512 echo "Copying the Arvados CA certificate to the installer dir, so you can import it"
 513 # If running in a vagrant VM, also add default user to docker group
 514 if [ "x${VAGRANT}" = "xyes" ]; then
 515   cp /etc/ssl/certs/arvados-snakeoil-ca.pem /vagrant/${CLUSTER}.${DOMAIN}-arvados-snakeoil-ca.pem
 516
 517   echo "Adding the vagrant user to the docker group"
 518   usermod -a -G docker vagrant
 519 else
 520   cp /etc/ssl/certs/arvados-snakeoil-ca.pem ${SCRIPT_DIR}/${CLUSTER}.${DOMAIN}-arvados-snakeoil-ca.pem
 521 fi
 522
 523 # Test that the installation finished correctly
 524 if [ "x${TEST}" = "xyes" ]; then
 525   cd /tmp/cluster_tests
 526   ./run-test.sh
 527 fi