From de9e31d2acb6d42e807b58996b72143798db28ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Samuli=20Sepp=C3=A4nen?= <samuli@openvpn.net>
Date: Thu, 2 Nov 2017 15:53:55 +0200
Subject: [PATCH 1/3] Split Vagrant provisioning tasks into separate scripts

This reduces redundancy as the same preparatory tasks (install puppet agent,
install puppet modules, prepare module path) do not have to be repeated for on
every Vagrant box. This also makes it easier to create custom Vagrantfiles, for
example if one wishes to use providers other than Virtualbox.
---
 Vagrantfile             | 117 +++-------------------------------------
 vagrant/common.sh       |  14 +++++
 vagrant/ipa-client-1.sh |  13 +++++
 vagrant/ipa-server-1.sh |  18 +++++++
 vagrant/ipa-server-2.sh |  24 +++++++++
 5 files changed, 76 insertions(+), 110 deletions(-)
 create mode 100644 vagrant/common.sh
 create mode 100644 vagrant/ipa-client-1.sh
 create mode 100644 vagrant/ipa-server-1.sh
 create mode 100644 vagrant/ipa-server-2.sh

diff --git a/Vagrantfile b/Vagrantfile
index 3b9d9723..a22a826e 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -17,40 +17,8 @@ Vagrant.configure("2") do |config|
         box.vm.network "private_network", ip: "192.168.44.35"
         box.vm.network "forwarded_port", guest: 8000, host: 8000
         box.vm.network "forwarded_port", guest: 8440, host: 8440
-
-        $script = <<SCRIPT
-echo I am provisioning...
-export FACTER_is_vagrant='true'
-rpm -ivh https://yum.puppetlabs.com/puppetlabs-release-pc1-el-7.noarch.rpm
-yum install -y puppet-agent
-export PATH=$PATH:/opt/puppetlabs/bin
-puppet module install puppetlabs-concat
-puppet module install puppetlabs-stdlib
-puppet module install crayfishx-firewalld
-puppet module install puppet-selinux
-if [ -d /tmp/modules/easy_ipa ]; then rm -rf /tmp/modules/easy_ipa; fi
-mkdir -p /tmp/modules/easy_ipa
-cp -r /vagrant/* /tmp/modules/easy_ipa
-puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "\
-  class {'::easy_ipa':\
-    ipa_role => 'master',\
-    domain => 'vagrant.example.lan',\
-    ipa_server_fqdn => 'ipa-server-1.vagrant.example.lan',\
-    admin_password => 'vagrant123',\
-    directory_services_password => 'vagrant123',\
-    install_ipa_server => true,\
-    ip_address => '192.168.44.35',\
-    enable_ip_address => true,\
-    enable_hostname => true,\
-    manage_host_entry => true,\
-    install_epel => true,\
-    webui_disable_kerberos => true,\
-    webui_enable_proxy => true,\
-    webui_force_https => true,\
-}"
-SCRIPT
-
-        box.vm.provision "shell", inline: $script
+        box.vm.provision "shell", path: "vagrant/common.sh"
+        box.vm.provision "shell", path: "vagrant/ipa-server-1.sh"
     end
 
     config.vm.define "ipa-server-2" do |box|
@@ -66,50 +34,8 @@ SCRIPT
             vb.customize ["modifyvm", :id, "--hpet", "on"]
         end
         box.vm.network "private_network", ip: "192.168.44.36"
-
-        $script = <<SCRIPT
-echo I am provisioning...
-export FACTER_is_vagrant='true'
-rpm -ivh https://yum.puppetlabs.com/puppetlabs-release-pc1-el-7.noarch.rpm
-yum install -y puppet-agent
-export PATH=$PATH:/opt/puppetlabs/bin
-puppet module install puppetlabs-concat
-puppet module install puppetlabs-stdlib
-puppet module install crayfishx-firewalld
-puppet module install puppet-selinux
-puppet module install saz-resolv_conf
-if [ -d /tmp/modules/easy_ipa ]; then rm -rf /tmp/modules/easy_ipa; fi
-mkdir -p /tmp/modules/easy_ipa
-cp -r /vagrant/* /tmp/modules/easy_ipa
-puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "\
-  class { 'resolv_conf':\
-    nameservers => ['192.168.44.35'],\
-  }"
-puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "\
-  host {'ipa-server-1.vagrant.example.lan':\
-    ensure => present,\
-    ip => '192.168.44.35',\
-  }"
-puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "\
-  class {'::easy_ipa':\
-    ipa_role => 'replica',\
-    domain => 'vagrant.example.lan',\
-    ipa_server_fqdn => 'ipa-server-2.vagrant.example.lan',\
-    domain_join_password => 'vagrant123',\
-    install_ipa_server => true,\
-    ip_address => '192.168.44.36',\
-    enable_ip_address => true,\
-    enable_hostname => true,\
-    manage_host_entry => true,\
-    install_epel => true,\
-    ipa_master_fqdn => 'ipa-server-1.vagrant.example.lan',\
-  }"
-
-SCRIPT
-
-#     admin_password => 'vagrant123',\
-
-        box.vm.provision "shell", inline: $script
+        box.vm.provision "shell", path: "vagrant/common.sh"
+        box.vm.provision "shell", path: "vagrant/ipa-server-2.sh"
     end
 
     config.vm.define "ipa-client-1" do |box|
@@ -125,36 +51,7 @@ SCRIPT
             vb.customize ["modifyvm", :id, "--hpet", "on"]
         end
         box.vm.network "private_network", ip: "192.168.44.37"
-
-        $script = <<SCRIPT
-echo I am provisioning...
-export FACTER_is_vagrant='true'
-rpm -ivh https://yum.puppetlabs.com/puppetlabs-release-pc1-el-7.noarch.rpm
-yum install -y puppet-agent
-export PATH=$PATH:/opt/puppetlabs/bin
-puppet module install puppetlabs-concat
-puppet module install puppetlabs-stdlib
-puppet module install crayfishx-firewalld
-puppet module install puppet-selinux
-puppet module install saz-resolv_conf
-if [ -d /tmp/modules/easy_ipa ]; then rm -rf /tmp/modules/easy_ipa; fi
-mkdir -p /tmp/modules/easy_ipa
-cp -r /vagrant/* /tmp/modules/easy_ipa
-puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "\
-  class { 'resolv_conf':\
-    nameservers => ['192.168.44.35'],\
-  }"
-puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "\
-  class {'::easy_ipa':\
-    ipa_role => 'client',\
-    domain => 'vagrant.example.lan',\
-    domain_join_password => 'vagrant123',\
-    install_epel => true,\
-    ipa_master_fqdn => 'ipa-server-1.vagrant.example.lan',\
-  }"
-SCRIPT
-
-        box.vm.provision "shell", inline: $script
+        box.vm.provision "shell", path: "vagrant/common.sh"
+        box.vm.provision "shell", path: "vagrant/ipa-client-1.sh"
     end
-
-end
\ No newline at end of file
+end
diff --git a/vagrant/common.sh b/vagrant/common.sh
new file mode 100644
index 00000000..d99dbf29
--- /dev/null
+++ b/vagrant/common.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+echo I am provisioning...
+export FACTER_is_vagrant='true'
+rpm -ivh https://yum.puppetlabs.com/puppetlabs-release-pc1-el-7.noarch.rpm
+yum install -y puppet-agent
+export PATH=$PATH:/opt/puppetlabs/bin
+puppet module install puppetlabs-concat
+puppet module install puppetlabs-stdlib
+puppet module install crayfishx-firewalld
+puppet module install puppet-selinux
+puppet module install saz-resolv_conf
+if [ -d /tmp/modules/easy_ipa ]; then rm -rf /tmp/modules/easy_ipa; fi
+mkdir -p /tmp/modules/easy_ipa
+cp -r /vagrant/* /tmp/modules/easy_ipa
diff --git a/vagrant/ipa-client-1.sh b/vagrant/ipa-client-1.sh
new file mode 100644
index 00000000..4e03a8b7
--- /dev/null
+++ b/vagrant/ipa-client-1.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "\
+  class { 'resolv_conf':\
+    nameservers => ['192.168.44.35'],\
+  }"
+puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "\
+  class {'::easy_ipa':\
+    ipa_role => 'client',\
+    domain => 'vagrant.example.lan',\
+    domain_join_password => 'vagrant123',\
+    install_epel => true,\
+    ipa_master_fqdn => 'ipa-server-1.vagrant.example.lan',\
+  }"
diff --git a/vagrant/ipa-server-1.sh b/vagrant/ipa-server-1.sh
new file mode 100644
index 00000000..b07c4108
--- /dev/null
+++ b/vagrant/ipa-server-1.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "\
+  class {'::easy_ipa':\
+    ipa_role => 'master',\
+    domain => 'vagrant.example.lan',\
+    ipa_server_fqdn => 'ipa-server-1.vagrant.example.lan',\
+    admin_password => 'vagrant123',\
+    directory_services_password => 'vagrant123',\
+    install_ipa_server => true,\
+    ip_address => '192.168.44.35',\
+    enable_ip_address => true,\
+    enable_hostname => true,\
+    manage_host_entry => true,\
+    install_epel => true,\
+    webui_disable_kerberos => true,\
+    webui_enable_proxy => true,\
+    webui_force_https => true,\
+}"
diff --git a/vagrant/ipa-server-2.sh b/vagrant/ipa-server-2.sh
new file mode 100644
index 00000000..884f65a6
--- /dev/null
+++ b/vagrant/ipa-server-2.sh
@@ -0,0 +1,24 @@
+#/bin/sh
+puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "\
+  class { 'resolv_conf':\
+    nameservers => ['192.168.44.35'],\
+  }"
+puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "\
+  host {'ipa-server-1.vagrant.example.lan':\
+    ensure => present,\
+    ip => '192.168.44.35',\
+  }"
+puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "\
+  class {'::easy_ipa':\
+    ipa_role => 'replica',\
+    domain => 'vagrant.example.lan',\
+    ipa_server_fqdn => 'ipa-server-2.vagrant.example.lan',\
+    domain_join_password => 'vagrant123',\
+    install_ipa_server => true,\
+    ip_address => '192.168.44.36',\
+    enable_ip_address => true,\
+    enable_hostname => true,\
+    manage_host_entry => true,\
+    install_epel => true,\
+    ipa_master_fqdn => 'ipa-server-1.vagrant.example.lan',\
+  }"

From c03974e3ddde1f2be4f34ac08e7b7b21033099f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Samuli=20Sepp=C3=A4nen?= <samuli.seppanen@gmail.com>
Date: Fri, 3 Nov 2017 12:59:52 +0200
Subject: [PATCH 2/3] Vagrant: allow puppetlabs yum repository to be
 non-responsive

Puppetlabs yum repository fails quite often. If this happens yum will refuse to
install any packages, leaving the provisioned Vagrant VM into an inconsistent
state. With this commit Puppetlabs repo failures are treated as non-fatal.
---
 vagrant/common.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/vagrant/common.sh b/vagrant/common.sh
index d99dbf29..a9e8be8b 100644
--- a/vagrant/common.sh
+++ b/vagrant/common.sh
@@ -2,7 +2,8 @@
 echo I am provisioning...
 export FACTER_is_vagrant='true'
 rpm -ivh https://yum.puppetlabs.com/puppetlabs-release-pc1-el-7.noarch.rpm
-yum install -y puppet-agent
+yum install -y puppet-agent yum-utils
+yum-config-manager --save --setopt=puppetlabs-pc1.skip_if_unavailable=true
 export PATH=$PATH:/opt/puppetlabs/bin
 puppet module install puppetlabs-concat
 puppet module install puppetlabs-stdlib

From 2692e54c39e34c4e904109dbd435d2d951843234 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Samuli=20Sepp=C3=A4nen?= <samuli@openvpn.net>
Date: Fri, 3 Nov 2017 14:36:25 +0200
Subject: [PATCH 3/3] Vagrant: Use static idstart value to ensure consistency
 between replicas

By default the idstat value is randomly generated if not defined. This means
that the value will be different between ipa-server-1 and ipa-server-2, because
the installer will get different values on each. This caused /home/admin on the
ipa-server-2 to have wrong UID and GID, which caused puppet run failures and
left the node into inconsistent state.
---
 vagrant/ipa-server-1.sh | 1 +
 vagrant/ipa-server-2.sh | 1 +
 2 files changed, 2 insertions(+)

diff --git a/vagrant/ipa-server-1.sh b/vagrant/ipa-server-1.sh
index b07c4108..0a293f46 100644
--- a/vagrant/ipa-server-1.sh
+++ b/vagrant/ipa-server-1.sh
@@ -15,4 +15,5 @@ puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/produc
     webui_disable_kerberos => true,\
     webui_enable_proxy => true,\
     webui_force_https => true,\
+    idstart => 14341,\
 }"
diff --git a/vagrant/ipa-server-2.sh b/vagrant/ipa-server-2.sh
index 884f65a6..b41cffc9 100644
--- a/vagrant/ipa-server-2.sh
+++ b/vagrant/ipa-server-2.sh
@@ -21,4 +21,5 @@ puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/produc
     manage_host_entry => true,\
     install_epel => true,\
     ipa_master_fqdn => 'ipa-server-1.vagrant.example.lan',\
+    idstart => 14341,\
   }"