Giter Club home page Giter Club logo

puppet-nexus's Introduction

Sonatype Nexus Puppet module Build Status

Install and configure Sonatype Nexus.

!!! No Longer Maintained !!!

We are not actively using or maintaining this project and welcome the community to fork this repo.

Requires

  • maestrodev/wget
  • puppetlabs/stdlib

Usage

The following is a basic role class for building a nexus host. Adjust accordingly as needed.

NOTE: you must pass version to Class['nexus']. This is needed for the download link and determining the name of the nexus directory.

class role_nexus_server {

  # puppetlabs-java
  # NOTE: Nexus requires
  class{ '::java': }

  class{ '::nexus':
    version    => '2.8.0',
    revision   => '05',
    nexus_root => '/srv', # All directories and files will be relative to this
  }

  Class['::java'] ->
  Class['::nexus']
}

NOTE: If you wish to deploy a Nexus Pro server instead of Nexus OSS set deploy_pro => true

Usage(draft): Nexus 3 support

class role_nexus_server {

  class{ '::nexus':
    version               => '3.0.0',
    revision              => '03',
    download_site         => 'http://download.sonatype.com/nexus/3',
    nexus_type            => 'unix',
    nexus_work_dir_manage => false
  }

}

NOTE: If you wish to use Nexus 3, nexus_work_dir_manage need to be set to false because this module support only Nexus 3 installation

Nginx proxy

The following is setup for using the jfryman/puppet-nginx module. Nexus does not adequately support HTTP and HTTPS simultaneously. Below forces all connections to HTTPS. Be sure to login after the app is up and head to Administration -> Server. Change the base URL to "https" and check "Force Base URL". The application will be available at:

https://${::fqdn}/nexus/

  class{ '::nginx': }

  file { '/etc/nginx/conf.d/default.conf':
    ensure => absent,
    require => Class['::nginx::package'],
    notify => Class['::nginx::service']
  }

  nginx::resource::vhost { 'nexus':
    ensure            => present,
    www_root          => '/usr/share/nginx/html',
    rewrite_to_https  => true,
    ssl               => true,
    ssl_cert          => '/etc/pki/tls/certs/server.crt',
    ssl_key           => '/etc/pki/tls/private/server.key',
  }

  nginx::resource::location { 'nexus':
    ensure    => present,
    location  => '/nexus',
    vhost     => 'nexus',
    proxy     => "http://${nexus_host}:${nexus_port}/nexus",
    ssl       => true,
  }

TODO

  • Find a way to not require a version to be passed to Class['nexus']

Authors

Copyright

Hubspot, Inc.

puppet-nexus's People

Contributors

abraham1901 avatar albustax avatar bashou avatar chaoranxie avatar danie avatar dcrissman avatar gbloquel avatar kenbreeman avatar msutter avatar paulfurtado avatar petems avatar pranav avatar shail avatar sharkannon avatar timatooth avatar tmclaugh avatar tykeal avatar williamtsoi1 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

puppet-nexus's Issues

add checksum of downloaded file

When downloading software to install, always add the ability to verify the downloaded file using a checksum (preferably SHA1 or higher)

File limit is far too low for nexus 3.x installations

After startup of Nexus, you will be prompted with an error message regarding to increase the actual file limit:
tail -f /opt/sonatype-work/nexus3/log/nexus.log

2017-10-11 09:04:20,224+0200 INFO [FelixStartLevel] *SYSTEM org.sonatype.nexus.extender.NexusBundleTracker - ACTIVATING org.sonatype.nexus.core [197]
2017-10-11 09:04:20,598+0200 WARN [FelixStartLevel] *SYSTEM org.sonatype.nexus.internal.system.FileDescriptorServiceImpl - WARNING: ****************************************************************************
2017-10-11 09:04:20,598+0200 WARN [FelixStartLevel] *SYSTEM org.sonatype.nexus.internal.system.FileDescriptorServiceImpl - WARNING: The open file descriptor limit is 4096 which is below the minimum recommended value of 65536.
2017-10-11 09:04:20,599+0200 WARN [FelixStartLevel] *SYSTEM org.sonatype.nexus.internal.system.FileDescriptorServiceImpl - WARNING: Please see: http://links.sonatype.com/products/nexus/system-reqs#filehandles
2017-10-11 09:04:20,599+0200 WARN [FelixStartLevel] *SYSTEM org.sonatype.nexus.internal.system.FileDescriptorServiceImpl - WARNING: ****************************************************************************

This issue has already been fixed by (Andrew Grimberg => [email protected]), see Pull-Request:
#94

Latest working versions?

New to this module,

just trying to get it up and running.

I notice that it is not working for the latest version of nexus neither on 2.x or 3.x

I haven't looked in depth, but looks like:

in 3.x the config file has changed back to what it was in 2.x
in 2.x the package file nomemclature seems to have changed.

Has anybody noticed? or am I doing something wrong...

Beside fixing or reporting this issues. How can I know which are the latest working versions on each 2.x 3.x branch?

RHEL/CentOS systemd unit handling

For now there are no systemd unit handling in service.pp. If Nexus service is stopped, puppet agent sync can't start it.
I think if following code will be added to service.pp is should fix this.
elsif ($::operatingsystem == 'RedHat') or ($::operatingsystem == 'CentOS') { file { '/etc/systemd/system/nexus.service': mode => '0644', owner => 'root', group => 'root', content => template('nexus/nexus.systemd.erb'), } -> service { 'nexus': ensure => running, name => 'nexus', enable => true, } }

README is misleading?

The README states

NOTE:
If you wish to use Nexus 3, nexus_work_dir_manage need to be set to false because this module support only Nexus 3 installation

I think this no longer applies. nexus_work_dir_manage must be set to true otherwise the etc directory does not get created and the work dir uid/gid is not set correctly. Or am I missing something?

Deprecated dependency maestrodev/wget

" This module has been deprecated by its author since July 24, 2018.
The reason given was:
This module has been adopted by Vox Populi.
The author has suggested puppet-wget as its replacement."
But puppet-wget is deprecated too and you should use puppet-archive

Binding to 0.0.0.0 and use of HTTP without TLS

Greetings,

I am a security researcher, who is looking for security smells in Puppet scripts. I noticed instances of binding to 0.0.0.0. Binding an address to 0.0.0.0 indicates allowing connections from all IP addresses. I would like to draw attention to these instances. Binding to 0.0.0.0 may lead to denial of service attacks. Practitioners have reported how binding to 0.0.0.0 facilitated security issues for MySQL (https://serversforhackers.com/c/mysql-network-security), Memcached (https://news.ycombinator.com/item?id=16493480), and Kibana (https://www.elastic.co/guide/en/kibana/5.0/breaking-changes-5.0.html).

I suggest to use a dedicated IP address other than 0.0.0.0.

Any feedback is appreciated.

Source: https://github.com/hubspotdevops/puppet-nexus/blob/master/manifests/params.pp

Vast memory usage during routine use

We've observed high memory usage of puppet (> 1g) but only on nodes with Nexus and with a work folder consisting of artefacts. This was traced to the running of file ownership checks which puppet internally builds an object for each file found recursively.

Author email address bounces back

In the metadata.json the current author's email address bounces back. For a project I am working on I need a contact person to reach out to. Is there anyone that is available for this? Who is the current maintainer?

tons of file resources with nexus 3.0.x

We have the following setup (with Nexus 3.0.0):

  class{ '::nexus':
    version               => '3.0.0',
    revision              => '03',
    download_site         => 'http://download.sonatype.com/nexus/3',
    nexus_type            => 'unix',
    nexus_work_dir_manage => false,
  }

Despite nexus_work_dir_manage being set to false, since recurse is set to true in file{ $nexus_home_real:, with default settings, the work dir seems to be inside the main nexus home anyway, so Puppet creates a resource for each of those files. This is creating massive reports and long Puppet run times.

# grep -c "resource: File" /var/lib/puppet/state/last_run_report.yaml 
47371
      resource: File[/srv/nexus-3.0.0-03/data/blobs/default/content/vol-08/chap-38/9bfbb901-705f-4ed1-921e-82d4262e71ee.properties]

Is the goal to ensure permissions on the initial installation, or to preserve them?

You might also look into replacing wget + exec with the archive module?

Issues with Nexus 2.11.1-01

I tried to use use 2.11.1-01 as the version and received a number of errors.

Error: /Stage[main]/Nexus::Config/File_line[nexus-work]: Could not evaluate: No such file or directory - /usr/local/nexus/conf/nexus.properties
Error: /Stage[main]/Nexus::Config/File_line[nexus-appliction-host]: Could not evaluate: No such file or directory - /usr/local/nexus/conf/nexus.properties
Error: /Stage[main]/Nexus::Config/File_line[nexus-appliction-port]: Could not evaluate: No such file or directory - /usr/local/nexus/conf/nexus.properties
Error: /Stage[main]/Nexus::Config/File_line[nexus-webapp-context-path]: Could not evaluate: No such file or directory - /usr/local/nexus/conf/nexus.properties
Warning: /Stage[main]/Nexus::Service/File_line[nexus_NEXUS_HOME]: Skipping because of failed dependencies
Warning: /Stage[main]/Nexus::Service/File_line[nexus_RUN_AS_USER]: Skipping because of failed dependencies
Warning: /Stage[main]/Nexus::Service/File[/etc/init.d/nexus]: Skipping because of failed dependencies
Warning: /Stage[main]/Nexus::Service/Service[nexus]: Skipping because of failed dependencies
Error: /Stage[main]/Nexus::Service/Service[nexus]: Failed to call refresh: Could not find init script or upstart conf file for 'nexus'
Error: /Stage[main]/Nexus::Service/Service[nexus]: Could not find init script or upstart conf file for 'nexus'
Warning: /Stage[main]/Nexus/Anchor[nexus::end]: Skipping because of failed dependencies

Nexus Work Dir is static and cannot change it's path.

The work dir is static to sonatype-work in the same folder that nexus is installed (${nexus_root}). This shouldn't always be the case (Though maybe it's the default). My sonatype-work dir exists on a different mount point as it takes up a LOT of disk space.

Make $version and $revison unnecessary

When realizing the nexus class a version and revision parameter must be passed. Those values are used to construct the download URL and determine the name of the directory the application was extracted to. This means that the Nexus module does not work OOB and requires configuration and heading to the Nexus website on the first try to figure out the version and revision. Additionally, that information is found on the download archive page and not the main page.

I'd like to instead default version and revision to 'latest'. When version is set to latest it will download from the following URL:
http://download.sonatype.com/nexus/oss/nexus-latest-bundle.tar.gz

If version is set to a version and revision is still latest it will download from the following URL:
http://download.sonatype.com/nexus/oss/nexus-${version}-bundle.tar.gz

If both version and revision are set it will download from the following URL:
http://download.sonatype.com/nexus/oss/nexus-${version}-${revision}-bundle.tar.gz

An inline function will then determine the version that was downloaded and set $full_version in nexus::package appropriately.

Thoughts @Saheba and @sstarcher?

Document upgrades

Given I'm left wondering this myself, the README does not state whether this module lets you simply upgrade the version of Nexus in-place or whether there is some procedure expected of you.

Often software documentation details upgrade procedures such as updating of symlinks but when puppet is used, questions are raised mentally as to what's going to happen.

Does it support the latest version of Nexus OSS?

Hi there,

I am trying to install 3.3.2 02 and seeing the below issues. Please could you confirm what will be the latest version does this module supports? 3.0.0 03 seems working ok.

Errors
Error: /Stage[main]/Nexus::Config/File_line[nexus-work]: Could not evaluate: No such file or directory - /opt/nexus/etc/org.sonatype.nexus.cfg
Error: /Stage[main]/Nexus::Config/File_line[nexus-application-host]: Could not evaluate: No such file or directory - /opt/nexus/etc/org.sonatype.nexus.cfg
Error: /Stage[main]/Nexus::Config/File_line[nexus-webapp-context-path]: Could not evaluate: No such file or directory - /opt/nexus/etc/org.sonatype.nexus.cfg
Error: /Stage[main]/Nexus::Config/File_line[nexus-application-port]: Could not evaluate: No such file or directory - /opt/nexus/etc/org.sonatype.nexus.cfg

Is there any fix available?

Certificate download (wget) issues

Last friday, 5/22/2015, certificate download issues:

Notice: /Stage[main]/Nexus::Package/Wget::Fetch[nexus-2.11.2-bundle.tar.gz]/Exec[wget-nexus-2.11.2-bundle.tar.gz]/returns: ERROR: certificate common name “a.ssl.fastly.net” doesn’t match requested host name “sonatype-download.global.ssl.fastly.net

Notice: /Stage[main]/Nexus::Package/Wget::Fetch[nexus-2.11.2-bundle.tar.gz]/Exec[wget-nexus-2.11.2-bundle.tar.gz]/returns: To connect to sonatype-download.global.ssl.fastly.net insecurely, use ‘--no-check-certificate’.

recommend adding option to the wget section to allow unvalidated/unsecure downloads for --no-check-certificate pass-thru.

Cannot set work directory

There's an error in line 56 of manifests/init.pp where the work directory is detected and set, it reads:
$real_nexus_work_dirc = $nexus_work_dir
I think it should read:
$real_nexus_work_dir = $nexus_work_dir

When I pass in a work dir it leaves the value undef because it references $real_nexus_work_dir as a variable, looks like a typo with the ending 'c' to that variable setting. I have checked this locally and patched and it works...

More detail:
When specified like this:
class { 'nexus':
version => '2.10.0',
revision => '02',
nexus_user => 'nexus',
nexus_root => '/opt',
nexus_work_dir => '/var/lib/nexus/work'
}

It yields in puppet:
2014-10-28 12:09:16 +0000 Puppet (err): Parameter path failed on File[undef]: File paths must be fully qualified, not 'undef' at /etc/puppet/modules/nexus/manifests/package.pp:94
Wrapped exception:
File paths must be fully qualified, not 'undef'

Concerns about readme and https

https://github.com/hubspotdevops/puppet-nexus/blame/master/README.md#L35

Readme contains this paragraph:

Nexus does not adequately support HTTP and HTTPS simultaneously.  Below forces all connections to HTTPS.  Be sure to login after the app is up and head to Administration -> Server.  Change the base URL to "https" and check "Force Base URL". 

In Nexus 2.8x, you will hopefully find this statement not true. Provided you have a keystore jetty can use and ./conf/jetty-https.xml is configured to use it, then:

  1. Edit nexus.properties, add application-port-ssl=8443
  2. Edit bin/jsw/conf/wrapper.conf, add wrapper.app.parameter.3=./conf/jetty-https.xml

Start Nexus. http on port 8081/ https on port 8443

If you want to always force redirection from http to https, then additionally

  1. Edit bin/jsw/conf/wrapper.conf, add wrapper.app.parameter.4=./conf/jetty-http-redirect-to-https.xml

Performance

At each call of puppet master, the processing of puppet catalog takes 90% CPU for 10 min.

After investigation, it seems that the recurse parameter causes problem.

  # NOTE: $nexus_work_dir in later releases was moved to a directory not
  # under the application.  This is why we do not make recursing optional
  # for this resource but do for $nexus_work_dir.
  file{ $nexus_home_real:
    ensure                  => directory,
    owner                   => $nexus_user,
    group                   => $nexus_group,
    recurse                 => true,
    selinux_ignore_defaults => $nexus_selinux_ignore_defaults,
    require                 => Exec[ 'nexus-untar']
}

My platform is centos 7.2. My nexus data folder has nearly 70000 files.

How to fix this problem ?
Does this step is mandatory ?

Nexus 3.x.x download URL is not working

The default URL from where to download Nexus 3.x.x sources does not work. This is what is happening during a Puppet run:

Notice: /Stage[main]/Nexus::Package/Wget::Fetch[nexus-3.1.0-04-bundle.tar.gz]/Exec[wget-nexus-3.1.0-04-bundle.tar.gz]/returns: https://sonatype-download.global.ssl.fastly.net/nexus/oss/nexus-3.1.0-04-bundle.tar.gz:
Notice: /Stage[main]/Nexus::Package/Wget::Fetch[nexus-3.1.0-04-bundle.tar.gz]/Exec[wget-nexus-3.1.0-04-bundle.tar.gz]/returns: 2016-11-04 07:46:53 ERROR 404: Not Found.
Error: wget --no-verbose --output-document="/srv/nexus-3.1.0-04-bundle.tar.gz" "http://download.sonatype.com/nexus/oss/nexus-3.1.0-04-bundle.tar.gz" returned 8 instead of one of [0]
Error: /Stage[main]/Nexus::Package/Wget::Fetch[nexus-3.1.0-04-bundle.tar.gz]/Exec[wget-nexus-3.1.0-04-bundle.tar.gz]/returns: change from notrun to 0 failed: wget --no-verbose --output-document="/srv/nexus-3.1.0-04-bundle.tar.gz" "http://download.sonatype.com/nexus/oss/nexus-3.1.0-04-bundle.tar.gz" returned 8 instead of one of [0]

nexus won't start: Couldn't get file lock

When using home directory aside from /home/ you will be prompted with the following error message:
tail -f /srv/sonatype-work/nexus3/log/nexus.log

Couldn't flush user prefs: java.util.prefs.BackingStoreException: Couldn't get file lock.

Nexus 3.1 wouln't start up because of file locking issues.

Configuration file "nexus.properties" not created during deployment

Nexus won't start in case of a missing nexus configuration, because there is no default configuration in place after deployment:
/srv/sonatype-work/nexus3/etc/nexus.properties

We should provide a default configuration with (at least) the following definitions:

## DO NOT EDIT - PUPPET MAINTAINS THIS FILE
##
# Jetty section
application-port=8081
application-host=0.0.0.0
nexus-args=${jetty.etc}/jetty.xml,${jetty.etc}/jetty-http.xml,${jetty.etc}/jetty-requestlog.xml

# Nexus section
nexus-edition=nexus-pro-edition
nexus-features=\
 nexus-pro-feature

Service keeps starting on each run

Looks like the "status" on the nexus service is using the root user instead of ${nexus_user} so it's not detecting that the actual service is running.

Release v1.3.2 to forge?

I see the metadata.json was updated to version 1.3.2 after all the updates I submitted got merged. That was nearly a month ago now. Is this going to be released to the forge anytime soon?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.