# Chalf Image Basic

Chalf Image Basic is
- A set of development, build, testing best-practices to create VMs that can be reused by Environment imges, following [Chalf](w3.alfresco.com/confluence/display/ITS/Playground) principles
- A Chef Cookbook, containing
  - Installation recipes
  - Configuration recipes, that can be reused by Environment imges
- A VM definition provisioned with `img-basic` Chef Cookbook, that is built in different natures, currently:
  - An AMI, based on [CentOS 7 (x86_64) with Updates HVM](https://aws.amazon.com/marketplace/ordering?productId=b7ee8a69-ee97-4a49-9e68-afaee216db2e&ref_=dtl_psb_continue&region=us-east-1). Latest AMI: ami-928eadfa
  - A Vagrant Box (using VirtualBox as provider), based on [CentOS-7.0-1406-x86_64-Minimal.iso](http://centos.mirroring.pulsant.co.uk/7/isos/x86_64/). Latest box is [img-basic-0.0.1.box](https://s3.amazonaws.com/packer-vms/img-basic-0.0.1.box)

Configurations can be found in [attributes/default.rb](attributes/default.rb)

Test databags can be found in [test/integration/data_bags](test/integration/data_bags), whereas VM databags are fetched from [pcb-data_bags](https://github.com/Alfresco/pcb-data_bags) master branch (though, also tags can be configured, see [ami.env](ami.env) or [vagrantbox.env](vagrantbox.env))

Please refer to [TESTING.md](TESTING.md) to get started and runs some tests; after that, you may want to create an image following [IMAGES.md](IMAGES.md).

[Graph of cookbooks dependencies](http://berksgraph.tolleiv.de/grph?1453651904780#2016-01-24-b296e569ab17f2cd1d30804746d4bbd63e30fba0.js)

# Project Release

This project is released on Nexus; to deploy a SNAPSHOT release, type:

```
bundle exec rake dist deploy\[<next_version>\]
```

# Recipes

All recipes are attribute-driven, therefore they can always be used in 3 ways:

- From nodes.json files, kitchen.yml, Chef roles, using a JSON structure (preferred, as it doesnt need any additional Chef cookbook)
```
"yum" : {
  "repos" : {
    "third-party" : {
      "ip" : "54.243.196.20",
      "host" : "minislaven1"
    }
  }
}
```

- From a wrapping Chef attribute file, part of a Chef cookbook (for example, in chalf-env cookbooks); this is preferred over the next one, as it avoids Chef code
```
default['yum']['repos']['third-party']['ip'] = '10.0.0.1'
default['yum']['repos']['third-party']['host'] = 'minislaven1'
```

- From a wrapping Chef recipe, part of a Chef cookbook (for example, in chalf-env cookbooks); sometimes this approach is needed, in case of conditional declarations, that cannot be implemented in attribute files
```
include_recipe "img-basic::yum-repos"
node.set['yum']['repos']['third-party']['ip'] = '10.0.0.1'
node.set['yum']['repos']['third-party']['host'] = 'minislaven1'
```

Hereby the list of recipes provided by `img-basic` cookbook.

## Resolver - `img-basic::default`
To configure `/etc/resolv.conf`, follow [resolver community cookbook](https://github.com/opscode-cookbooks/resolver); for example:
```
default['resolver']['nameservers'] = ['8.8.8.8','8.8.4.4']
```

## Essentials - `img-basic::essentials`
- Adds `files/default/usr_local_bin` content into `/usr/local/bin`
- Installs and configures build-essential, openssh, openssl and ntp packages and services; for more info, check related cookbooks on [Chef Supermarket](https://supermarket.chef.io)
- Installs and configures logrotate, relying on `node['logrotate']['global']` configuration item; for more info, check [logrotate cookbook](https://supermarket.chef.io/cookbooks/logrotate/versions/0.8.1)

## Users - `img-basic::users`
- Creates users and groups
- Creates sudo entries

It relies on community [users cookbook](https://github.com/opscode-cookbooks/users) to create users, by defining `users` databag.

You can define groups and sudo entries via attributes:
```
default['basic']['groups']['sysadmin']['gid'] = 2300
default['basic']['groups']['bench']['gid'] = 2400
default['basic']['groups']['qa']['gid'] = 2500

default['basic']['sudo']['usernames'] = ["sysadmin","bench","qa"]
default['basic']['sudo']['usernames_nopasswd'] = []

default["authorization"]["sudo"]["include_sudoers_d"] = true
```

## Rsyslog - `img-basic::rsyslog-conf`
Installs and configures rsyslog client.

To define FileInput entries, you can override/extend the following attributes:
```
default['rsyslog']['file_inputs']['error.log']['file'] = '/var/log/nginx/error.log'
default['rsyslog']['file_inputs']['error.log']['severity'] = 'error'
default['rsyslog']['file_inputs']['access.log']['file'] = '/var/log/nginx/access.log'
# Other default values that can be overridden
# default['rsyslog']['file_inputs']['access.log']['priority'] = 99
# default['rsyslog']['file_inputs']['access.log']['severity'] = 'notice'
# default['rsyslog']['file_inputs']['access.log']['facility'] = 'local0'
```

To setup facility logs you can override/extend the following attributes:
```
default['rsyslog']['facility_logs'] => {
  '*.info;mail.none;authpriv.none;cron.none' => "/var/log/messages",
  'authpriv' => '/var/log/secure',
  'mail.*' => '-/var/log/maillog',
  '*.emerg' => '*'
}
```

The following attributes can be used (via nodes.json or Chef recipes) to add directives at the bottom of `/etc/rsyslog.conf`:
```
default['rsyslog']['additional_directives'][
'# drop all alfresco routed syslogs',
'if $syslogfacility-text == 'local1' then ~'
]
```
For more info, check [rsyslog community cookbook](https://github.com/opscode-cookbooks/rsyslog)

## Collectd - `img-basic::collectd` (WIP)

Installs and configured collectd, relying on [collectd community cookbook]().

To configure Graphite server endpoint, override the following Chef attributes:
```
["collectd"]["plugins"]["write_graphite"]["config"]["Host"] = "graphiten1"
["collectd"]["plugins"]["write_graphite"]["config"]["Port"] = "2003"
```

## Yum Repositories - `img-basic::yum-repos`
Yum repositories configuration is completely attribute-driven; you can create (for example) `third-party` yum repo configuration by defining the following attributes
```
node['yum']['repos']['third-party']['ip'] = '10.0.0.1'
node['yum']['repos']['third-party']['host'] = 'minislaven1'
```

To add basic HTTP authentication, you can define a `yum_repos` databag item, with the name of the repo, in this case `third-party.json`

```
{ "id": "third-party", "username": "user", "password": "pwd" }
```

To change the default `yum_repos` databag name, override `default['yum']['databag']`

Credentials are stored in [yum_repos databag](https://github.com/Alfresco/pcb-data_bags/tree/master/yum_repos)

## Hosts - `img-basic::hosts`
As Yum repositories, host entries are completely attribute-driven; you can create (for example) `hostname_example` host by setting `node['hosts']['hostname_example'] = '192.168.1.45'`

## Beaver - `img-basic::beaver` (DEPRECATED)
Installs beaver service (a replacement of lumberjack or logstash-shipper), that monitors log files and sends events to LogStash.

Also rsyslog can be used for the same goal; at the moment, rsyslog is used to populate syslog/minisyslog remote servers (for security purposes), but could also handle communication with Elasticsearch/Kibana (TODO, read more on https://blog.linuxnet.ch/logserver-with-elasticsearch-logstash-rsyslog-kibana-on-ubuntu-14-04/)

Configuration files can be defined overriding/extending the following defaults:
```
default['beaver']['files'] = [
  {
    'path' => '/var/log/my.log',
    'type' => 'my',
    'tags' => [ 'my'  ]
  },
  {
    'path' => '/var/log/chef.log',
    'type' => 'chef',
    'tags' => [ 'chef' ]
  },
  {
    'path' => '/var/tmp/cloud-init.log',
    'type' => 'cloud-init',
    'tags' => [ 'cloud-init' ]
  }]

```

## Snort - `img-basic::snort`
Installs Snort and Oinkmaster; the following attributes can be overridden

```
default['snort']['snort_url'] = "https://www.snort.org/downloads/snort/snort-2.9.7.2-1.centos7.x86_64.rpm"
default['snort']['daq_url'] = "https://www.snort.org/downloads/snort/daq-2.0.4.RH7.x86_64.rpm"

default['snort']['snort_checksum'] = "d84dbe9a3d7eeda702938c5f6658194fa2a971f54708e48f04bc8029fa94e0d7"
default['snort']['daq_checksum'] = "ee12d9da5bf3367ec93221fadc7fb6ba7d7bebe1268ecce11d1a66612ada9e1d"

default['snort']['rpm']['daq_version'] = '2.0.4.RH7'
default['snort']['rpm']['version'] = '2.9.7.2-1.centos7'
```

## Snort Config - `img-basic::snort`
Configures oinkmaster with rule archive urls and paths; archives are downloaded locally and oinkmaster points to `file://` locations

You can override/extend the following default values:

```
default['snort']['oinkmaster']['rules'] = [
  { 'path' => '/etc/snort/snortrules-snapshot-2990.tar.gz',
    'url' => 'http://download.lunar-linux.org/lunar/mirrors/snortrules-snapshot-2990.tar.gz'
  },
  {
    'path' => '/etc/snort/emerging.rules.tar.gz',
    'url' => 'http://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz'
  }
]

default['snort']['oinkmaster']['conf_entries'] = [
  "disablesid 1390   # 20111122 shell code false pos",
  "disablesid 17750  # 20111130 Noisy IIS rule",
  "disablesid 648    # 20111130 Noisy shellcode",
]
```

## Ohai - `img-basic::ohai`
Provides 2 plugins: `filedata` and `ec2data`; they basically extract data from files located in /etc/ohai-data folder (Kitchen uses `test/integration/ohai/` folder to keep/use mock files)

Edit those files if you want to check/edit Ohai data.

If you want to test, from the box, Ohai data, run the following:

```
export PATH=$PATH:/opt/chef/embedded/bin/

/opt/chef/embedded/lib/ruby/gems/2.1.0/gems/ohai-8.1.1/bin/ohai customdata -d /etc/chef/ohai_plugins/ -l debug
```

## Python Test

To run the python first install all the requirements:

`pip3 install -r test/unit/python/requirements.txt`

then run:

`python3 test/unit/python/TestAlfSolrCheck.py`

from the chalf-img-basic root folder
