wordpress_installer.cf

#!/var/cfengine/bin/cf-agent -KIf

#Install WordPress:
#	1. Install Infrastructure:
#		1.1. Install httpd and mod_php and PHP MySQL client.
#		1.2. Install MySQL server.
#			1.2.1. Create WordPress User in MySQL.
#			1.2.2. Create WordPress Database in MySQL.
#		1.3. Make sure httpd and MySQL servers are running.
#	2. Install the PHP application (WordPress)
#		2.1. Download tarball with the latest version of WordPress PHP application.
#		2.2. Extract it into the httpd document root where it can be run by the Web server.
#		2.3. Create WordPress config file wp-config.php from wp-config-sample.php that's shipped with WordPress.
#		2.4. Tweak wp-config.php to put in the data needed to establish database connection (db name, db username and password).
#	


body common control
{

bundlesequence => {
			"packages_installed",
			"services_up",
			"wordpress_tarball_is_present",
                        "wordpress_tarball_is_unrolled", 
			"configuration_of_mysql_db_for_wordpress", 
			"wpconfig_exists",
			"wpconfig_is_properly_configured",
			"allow_http_inbound",
		  };


inputs =>	  { "cfengine_stdlib.cf" };

}

#############################################

bundle agent packages_installed
{
vars: "desired_package" slist => { 
                                     "httpd", 
                                     "php",
                                     "php-mysql",
                                     "mysql-server",
                                 };

packages: "$(desired_package)"
             package_policy => "add",
             package_method => yum,
             classes => if_repaired("packages_added");

commands: 

  packages_added::

    "/sbin/service httpd graceful" 

             comment => "Restarting httpd so it can pick up new modules.";

}

#############################################

bundle agent services_up {

processes:
    "^mysqld" restart_class => "start_mysqld";
    "^httpd"  restart_class => "start_httpd";

commands:
	start_mysqld::
		"/etc/init.d/mysqld start";

	start_httpd::
		 "/etc/init.d/httpd start";
}


#############################################

bundle agent wordpress_tarball_is_present
{

classes:
	"wordpress_tarball_is_present" expression => fileexists("/root/wordpress-latest.tar.gz");
            


reports:
        wordpress_tarball_is_present::
		"WordPress tarball is on disk.";


commands:

	!wordpress_tarball_is_present::

		"/usr/bin/wget -q -O /root/wordpress-latest.tar.gz http://wordpress.org/latest.tar.gz"
			comment => "Downloading latest version of WordPress.";

}



#############################################

bundle agent wordpress_tarball_is_unrolled
{

classes:
	"wordpress_directory_is_present" expression => fileexists("/var/www/html/wordpress/");
            


reports:
        wordpress_directory_is_present::
		"WordPress directory is present.";


commands:

	!wordpress_directory_is_present::

		"/bin/tar -C /var/www/html -xvzf /root/wordpress-latest.tar.gz"

			comment => "Unrolling wordpress tarball to /var/www/html/.";

}


#############################################


bundle agent configuration_of_mysql_db_for_wordpress
{

commands:
        "/usr/bin/mysql -u root -e \"
                                        CREATE DATABASE wordpress;
                                        GRANT ALL PRIVILEGES ON wordpress.*
                                            TO 'wordpress'@localhost
                                            IDENTIFIED BY 'lopsa10linux';
                                        FLUSH PRIVILEGES;
                                   \"
        ";

}



#############################################

bundle agent wpconfig_exists
{

classes:
	"wordpress_config_file_exists" expression =>
		fileexists("/var/www/html/wordpress/wp-config.php");
            


reports:
        wordpress_config_file_exists::
		"WordPress config file /var/www/html/wordpress/wp-config.php is present";

        !wordpress_config_file_exists::
		"WordPress config file /var/www/html/wordpress/wp-config.php is not present";

commands:

	!wordpress_config_file_exists::

		"/bin/cp -p /var/www/html/wordpress/wp-config-sample.php \
                     /var/www/html/wordpress/wp-config.php";

}


#############################################

bundle agent wpconfig_is_properly_configured
{
files:
	"/var/www/html/wordpress/wp-config.php"
		edit_line => replace_default_wordpress_config_with_ours;
}
            
bundle edit_line replace_default_wordpress_config_with_ours
{
  replace_patterns:
    "database_name_here" replace_with => value("wordpress");

  replace_patterns:
    "username_here" replace_with => value("wordpress");

  replace_patterns:
    "password_here" replace_with => value("lopsa10linux");
}



#############################################



bundle agent allow_http_inbound
{
files:
  redhat:: # tested on RHEL only, file location may vary based on Linux distro or OS
      "/etc/sysconfig/iptables"
       edit_line => insert_HTTP_allow_rule_before_the_accept_established_tcp_conns_rule,
       comment => "insert HTTP allow rule into /etc/sysconfig/iptables",
       classes => if_repaired("iptables_edited");

commands: 
	iptables_edited::
		"/sbin/service iptables restart"
			comment => "Restarting iptables to load new config";

}


    bundle edit_line insert_HTTP_allow_rule_before_the_accept_established_tcp_conns_rule
    {
      vars:
          "http_rule" string => "-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT";
  
  
      insert_lines: "$(http_rule)",
          location => before_the_accept_established_tcp_conns_rule;
    }

        body location before_the_accept_established_tcp_conns_rule

        {
        before_after => "before";
        first_last => "first";
        select_line_matching => "^-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT.*";
        }





# Todo:
#
#
# MySQL:
# - submit a patch to the MySQL folks to add a non-interactive version of /usr/bin/mysql_secure_installation
# - secure mysql instance with a non-interactive version of /usr/bin/mysql_secure_installation once it is available
# - change the root password using /usr/bin/mysqladmin -u root password 'new-password'
# - secure mysql instance by: removing the test databases and anonymous user created by default
#
# httpd:
# - instead of hardcoding "/var/www/html", derive httpd document root on the fly from /etc/httpd/conf/httpd.conf
#   DocumentRoot using Function readstringlist