5 files changed, 137 insertions, 0 deletions
diff --git a/modules/mga-advisories/manifests/init.pp b/modules/mga-advisories/manifests/init.pp
new file mode 100644
index 00000000..1937bb62
--- /dev/null
+++ b/modules/mga-advisories/manifests/init.pp
@@ -0,0 +1,98 @@
+class mga-advisories(
+  $advisories_svn = "svn://svn.${::domain}/svn/advisories",
+  $vhost
+){
+  $mgaadv_login = 'mga-advisories'
+  $mgaadv_homedir = "/var/lib/${mgaadv_login}"
+  $vhostdir = "${mgaadv_homedir}/vhost"
+  $advisories_dir = "${mgaadv_homedir}/advisories"
+  $status_dir = "${mgaadv_homedir}/status"
+  $update_script = '/usr/local/bin/update_mga-advisories'
+  $move_script = '/root/tmp/mgatools-new/mga-move-pkg'
+  $move_wrapper_script = '/usr/local/bin/mga-adv-move-pkg'
+
+  group { $mgaadv_login:
+    ensure => present,
+  }
+
+  user { $mgaadv_login:
+    ensure     => present,
+    home       => $mgaadv_homedir,
+    managehome => true,
+    gid        => $mgaadv_login,
+  }
+
+  package { 'mga-advisories':
+    ensure => installed,
+  }
+
+  file {'/etc/mga-advisories.conf':
+    ensure  => present,
+    owner   => root,
+    group   => root,
+    mode    => '0644',
+    content => template('mga-advisories/mga-advisories.conf'),
+    require => Package['mga-advisories'],
+  }
+
+  file { [ $vhostdir, $status_dir ]:
+    ensure => directory,
+    owner  => $mgaadv_login,
+    group  => $mgaadv_login,
+    mode   => '0755',
+  }
+
+  $vhost_aliases = {
+    "/static" => '/usr/share/mga-advisories/static',
+  }
+  apache::vhost::base { $vhost:
+    location => $vhostdir,
+    aliases  => $vhost_aliases,
+    require  => File[$vhostdir],
+  }
+
+  apache::vhost::base { "ssl_${vhost}":
+    use_ssl  => true,
+    vhost    => $vhost,
+    aliases  => $vhost_aliases,
+    location => $vhostdir,
+    require  => File[$vhostdir],
+  }
+
+  subversion::snapshot { $advisories_dir:
+    source  => $advisories_svn,
+    user    => $mgaadv_login,
+    refresh => '0',
+    require => User[$mgaadv_login],
+  }
+
+  file { $update_script:
+    ensure  => present,
+    owner   => root,
+    group   => root,
+    mode    => '0755',
+    content => template('mga-advisories/update_script'),
+  }
+
+  file { $move_wrapper_script:
+    ensure  => present,
+    owner   => root,
+    group   => root,
+    mode    => '0755',
+    content => template('mga-advisories/adv-move-pkg'),
+  }
+
+  sudo::sudoers_config { 'mga-adv-move-pkg':
+    content => template('mga-advisories/sudoers.adv-move-pkg')
+  }
+
+  # Disable for now... we may re-instate once it's been a little more tested.
+  #cron { $update_script:
+  #  command => $update_script,
+  #  user    => $mgaadv_login,
+  #  hour    => '*',
+  #  minute  => '10',
+  #  require => Subversion::Snapshot[$advisories_dir],
+  #}
+}
+# vim: sw=2
diff --git a/modules/mga-advisories/templates/adv-move-pkg b/modules/mga-advisories/templates/adv-move-pkg
new file mode 100644
index 00000000..71e1880e
--- /dev/null
+++ b/modules/mga-advisories/templates/adv-move-pkg
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+if [ "$USER" != "<%= @mgaadv_login %>" ]; then
+        echo "This script must be run as the <%= @mgaadv_login %> user." >&2
+        exit 1
+fi
+
+exec sudo <%= @move_script %> "$@"
diff --git a/modules/mga-advisories/templates/mga-advisories.conf b/modules/mga-advisories/templates/mga-advisories.conf
new file mode 100644
index 00000000..4dab1543
--- /dev/null
+++ b/modules/mga-advisories/templates/mga-advisories.conf
@@ -0,0 +1,14 @@
+mode: site
+send_adv_mail: yes
+move_pkg_cmd: <%= @move_wrapper_script %>
+send_report_mail: yes
+out_dir: <%= @vhostdir %>
+advisories_dir: <%= @advisories_dir %>
+status_dir: <%= @status_dir %>
+adv_mail_to: updates-announce@ml.mageia.org
+adv_mail_from: Mageia Updates <buildsystem-daemon@mageia.org>
+report_mail_to: qa-reports@ml.mageia.org
+report_mail_from: Mageia Advisories <buildsystem-daemon@mageia.org>
+bugzilla_url: https://bugs.mageia.org/
+bugzilla_login: bot
+bugzilla_password: file:///var/lib/git/.gitzilla-password
diff --git a/modules/mga-advisories/templates/sudoers.adv-move-pkg b/modules/mga-advisories/templates/sudoers.adv-move-pkg
new file mode 100644
index 00000000..5d9618a9
--- /dev/null
+++ b/modules/mga-advisories/templates/sudoers.adv-move-pkg
@@ -0,0 +1 @@
+<%= @mgaadv_login %> ALL=(root) NOPASSWD:<%= @move_script %> *
diff --git a/modules/mga-advisories/templates/update_script b/modules/mga-advisories/templates/update_script
new file mode 100644
index 00000000..71d8d1d4
--- /dev/null
+++ b/modules/mga-advisories/templates/update_script
@@ -0,0 +1,16 @@
+#!/bin/sh
+set -e
+
+if [ "$UID" = "0" ]; then
+	echo "Re-running as '<%= @mgaadv_login %>' user." >&2
+	exec /bin/su -c <%= @update_script %> - <%= @mgaadv_login %>
+fi
+
+if [ "$USER" != "<%= @mgaadv_login %>" ]; then
+	echo "This script must be run as the <%= @mgaadv_login %> user." >&2
+	exit 1
+fi
+
+cd <%= @advisories_dir %>
+svn up
+exec /usr/bin/mgaadv process