Complete all features to release version 0.2.3

[BUG #4] The mariadb root password is now fully managed by this recipe
[ENH #7] It's possible to activate/deactivate remote root access via this recipe
- Add multiples serverspec/kitchen tests to avoid regression
- Complete Documentation (ChangeLog and ReadMe)

.kitchen.yml

@@ -24,6 +24,7 @@ suites:
       - recipe[mariadb::default]
     attributes:
       mariadb:
+        server_root_password: gsql
         use_default_repository: true
         mysqld:
           port: 3307

CHANGELOG.md

@@ -2,44 +2,58 @@ mariadb CHANGELOG
 =================
 
 This file is used to list changes made in each version of the mariadb cookbook.
+0.2.3
+-----
+- [BUG #4] - Add a real management of mysql root password
+- [ENH #5] - Now restart mysql service when port is changed
+- [ENH #7] - Remove or add root remote access via attribute
+- [DOCS] - Complete documentations
+- [TEST] - Add a lot of chefspec and kitchen/serverspec tests
+
+0.2.2
+-----
+- [sinfomicien] - Correct repository install under debian family
+- [sinfomicien] - Correct client install to add dev files
+- [sinfomicien] - Correct and add multiples tests
+
 0.2.1
 -----
-- [nicolas.blanc] - Use stove to package (remove PaxHeaders.*)
+- [sinfomicien] - Use stove to package (remove PaxHeaders.*)
 
 0.2.0
 -----
-- [nicolas.blanc] -  Add rpm/yum management
-- [nicolas.blanc] -  Refactor the whole recipes list and management to ease it
-- [nicolas.blanc] -  Correct the Documentation
-- [nicolas.blanc] -  Rename the provider (from extraconf to configuration), and add matchers to it
-- [nicolas.blanc] -  Add a recipe to manage client only installation
-- [nicolas.blanc] -  Refactor all tests to manage new platform (centos/redhat/fedora)
+- [sinfomicien] -  Add rpm/yum management
+- [sinfomicien] -  Refactor the whole recipes list and management to ease it
+- [sinfomicien] -  Correct the Documentation
+- [sinfomicien] -  Rename the provider (from extraconf to configuration), and add matchers to it
+- [sinfomicien] -  Add a recipe to manage client only installation
+- [sinfomicien] -  Refactor all tests to manage new platform (centos/redhat/fedora)
 
 0.1.8
 -----
-- [nicolas.blanc] -  Add ignore-failure to debian grants correct, as it can break on initial setup
+- [sinfomicien] -  Add ignore-failure to debian grants correct, as it can break on initial setup
 
 0.1.7
 -----
-- [nicolas.blanc] -  Correct a typo (unnecessary call to run_command)
+- [sinfomicien] -  Correct a typo (unnecessary call to run_command)
 
 0.1.6
 -----
-- [nicolas.blanc] -  improve Galera configuration management
-- [nicolas.blanc] -  Add new rspec tests
-- [nicolas.blanc] -  Create Kitchen test suite
+- [sinfomicien] -  improve Galera configuration management
+- [sinfomicien] -  Add new rspec tests
+- [sinfomicien] -  Create Kitchen test suite
 
 0.1.5
 -----
-- [nicolas.blanc] -  improve attributes management
+- [sinfomicien] -  improve attributes management
 
 0.1.4
 -----
-- [nicolas.blanc] - adapt galera55 recipe to use a generic galera recipe
-- [nicolas.blanc] - use a generic galera recipe to create the galera10 recipe
-- [nicolas.blanc] - Improve documentation 
+- [sinfomicien] - adapt galera55 recipe to use a generic galera recipe
+- [sinfomicien] - use a generic galera recipe to create the galera10 recipe
+- [sinfomicien] - Improve documentation 
 
 
 0.1.0
 -----
-- [nicolas.blanc] - Initial release of mariadb
+- [sinfomicien] - Initial release of mariadb

README.md

@@ -19,6 +19,7 @@ Requirements
 - `percona-xtrabackup` - if you want to use the xtrabckup SST Auth for galera cluster.
 - `socat` - if you want to use the xtrabckup SST Auth for galera cluster.
 - `rsync` - if you want to use the rsync SST Auth for galera cluster.
+- `debconf-utils` - if you use debian platform family.
 
 #### operating system
 - `debian` - this cookbook is fully tested on debian
@@ -48,6 +49,24 @@ Attributes
     <td>Wether to install MariaDB default repository or not. If you don't have a local repo containing packages, put it to true</td>
     <td><tt>false</tt></td>
   </tr>
+  <tr>
+    <td><tt>['mariadb']['server_root_password']</tt></td>
+    <td>String</td>
+    <td>local root password</td>
+    <td><tt></tt></td>
+  </tr>
+  <tr>
+    <td><tt>['mariadb']['forbid_remote_root']</tt></td>
+    <td>Boolean</td>
+    <td>Wether to activate root remote access</td>
+    <td><tt>true</tt></td>
+  </tr>
+  <tr>
+    <td><tt>['mariadb']['allow_root_pass_change']</tt></td>
+    <td>Boolean</td>
+    <td>Wether to allow the recipe to change root password after the first install</td>
+    <td><tt>false</tt></td>
+  </tr>
 </table>
 
 Usage
@@ -62,7 +81,7 @@ List of availables recipes:
 - mariadb::galera
 - mariadb::client
 
-Please be ware that by default, the root password is empty! If you want have changed it use the `node['mariadb']['server_root_password']` attribute to put a correct value
+Please be ware that by default, the root password is empty! If you want have changed it use the `node['mariadb']['server_root_password']` attribute to put a correct value. And by default the remote root access is not activated. Use `node['mariadb']['forbid_remote_root']` attribute to change it.
 
 #### mariadb::galera
 

attributes/default.rb

@@ -18,7 +18,9 @@
 #
 # mysqld default configuration
 #
+default['mariadb']['forbid_remote_root']                = true
 default['mariadb']['server_root_password']		= ''
+default['mariadb']['allow_root_pass_change']            = false
 default['mariadb']['mysqld']['user']                    = 'mysql'
 default['mariadb']['mysqld']['port']                    = '3306'
 default['mariadb']['mysqld']['basedir']                 = '/usr'

recipes/_debian_server.rb

@@ -0,0 +1,49 @@
+#
+# Cookbook Name:: mariadb
+# Recipe:: _debian_server
+#
+# Copyright 2014, blablacar.com
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# To be sure that debconf is installed
+package 'debconf-utils' do
+  action :install
+end
+
+# Preseed Debian Packages
+directory '/var/cache/local/preseeding' do
+  owner 'root'
+  group 'root'
+  mode '0755'
+  recursive true
+end
+
+template '/var/cache/local/preseeding/mariadb-server.seed' do
+  source 'mariadb-server.seed.erb'
+  owner 'root'
+  group 'root'
+  mode '0600'
+  notifies :run, 'execute[preseed mariadb-server]', :immediately
+end
+
+execute 'preseed mariadb-server' do
+  command '/usr/bin/debconf-set-selections ' \
+          '/var/cache/local/preseeding/mariadb-server.seed'
+  action :nothing
+end
+
+package "mariadb-server-#{node['mariadb']['install']['version']}" do
+  action :install
+end

recipes/_redhat_server.rb

@@ -0,0 +1,37 @@
+#
+# Cookbook Name:: mariadb
+# Recipe:: _redhat_server
+#
+# Copyright 2014, blablacar.com
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+package 'MariaDB-server' do
+  action :install
+  notifies :run, 'execute[change first install root password]', :immediately
+end
+
+directory '/var/log/mysql' do
+  action :create
+  user 'mysql'
+  group 'mysql'
+  mode '0755'
+end
+
+execute 'change first install root password' do
+  command '/etc/init.d/mysql start ; ' \
+          '/usr/bin/mysqladmin -u root password \'' + \
+          node['mariadb']['server_root_password'] + '\''
+  action :nothing
+  not_if { node['mariadb']['server_root_password'].empty? }
+end

recipes/server.rb

@@ -23,20 +23,9 @@
 
   case node['platform']
   when 'debian', 'ubuntu'
-    package "mariadb-server-#{node['mariadb']['install']['version']}" do
-      action :install
-    end
+    include_recipe "#{cookbook_name}::_debian_server"
   when 'redhat', 'centos', 'fedora'
-    package 'MariaDB-server' do
-      action :install
-    end
-
-    directory '/var/log/mysql' do
-      action :create
-      user 'mysql'
-      group 'mysql'
-      mode '0755'
-    end
+    include_recipe "#{cookbook_name}::_redhat_server"
   end
 when 'from_source'
   # To be filled as soon as possible
@@ -57,3 +46,37 @@
     )
   end
 end
+
+if node['mariadb']['allow_root_pass_change']
+  # Used to change root password after first install
+  # Still experimental
+  if node['mariadb']['server_root_password'].empty?
+    md5 = Digest::MD5.hexdigest('empty')
+  else
+    md5 = Digest::MD5.hexdigest(node['mariadb']['server_root_password'])
+  end
+
+  file '/etc/mysql_root_change' do
+    content md5
+    action :create
+    notifies :run, 'execute[install-grants]', :immediately
+  end
+end
+
+if  node['mariadb']['allow_root_pass_change'] ||
+    node['mariadb']['forbid_remote_root']
+  execute 'install-grants' do
+    command '/bin/bash /etc/mariadb_grants \'' + \
+            node['mariadb']['server_root_password'] + '\''
+    only_if { File.exists?('/etc/mariadb_grants') }
+    action :nothing
+  end
+
+  template '/etc/mariadb_grants' do
+    source 'mariadb_grants.erb'
+    owner 'root'
+    group 'root'
+    mode '0600'
+    notifies :run, 'execute[install-grants]', :immediately
+  end
+end

spec/centos_spec.rb

@@ -51,6 +51,10 @@
   it 'Configure Replication' do
     expect(chef_run).to add_mariadb_configuration('replication')
   end
+
+  it 'Don t execute root password change at install' do
+    expect(chef_run).to_not run_execute('change first install root password')
+  end
 end
 
 describe 'centos::mariadb::client' do

spec/debian_spec.rb

@@ -32,6 +32,10 @@
     expect(chef_run).to install_package('mariadb-server-10.0')
   end
 
+  it 'Installs debconf-utils package' do
+    expect(chef_run).to install_package('debconf-utils')
+  end
+
   it 'Configure InnoDB with attributes' do
     expect(chef_run).to add_mariadb_configuration('innodb')
     expect(chef_run).to render_file('/etc/mysql/conf.d/innodb.cnf')
@@ -49,10 +53,30 @@
     expect(chef_run).to create_template('/etc/mysql/conf.d/replication.cnf')
   end
 
+  it 'Configure Preseeding' do
+    expect(chef_run).to create_directory('/var/cache/local/preseeding')
+    expect(chef_run).to create_template('/var/cache/local/' \
+                                        'preseeding/mariadb-server.seed')
+  end
+
+  it 'execute preseeding load' do
+    execute = chef_run.execute('preseed mariadb-server')
+    expect(execute).to do_nothing
+  end
+
   it 'restart mysql service' do
     expect(chef_run).to_not restart_service('mysql')
   end
 
+  it 'Create Grants file' do
+    expect(chef_run).to create_template('/etc/mariadb_grants')
+  end
+
+  it 'execute grants file' do
+    execute = chef_run.execute('install-grants')
+    expect(execute).to do_nothing
+  end
+
 end
 
 describe 'debian::mariadb::client' do

templates/default/mariadb-server.seed.erb

@@ -0,0 +1,24 @@
+<%
+# Value obtained via the debconf-get-selections tool on debian wheezy
+  case node['mariadb']['install']['version']
+  when '5.5' -%>
+mariadb-server-5.5     mysql-server/root_password_again        select  <%= node['mariadb']['server_root_password'] %>
+mariadb-server-5.5     mysql-server/root_password      select  <%= node['mariadb']['server_root_password'] %>
+mariadb-server-5.5     mysql-server/error_setting_password     error
+mariadb-server-5.5     mysql-server-5.1/nis_warning    note
+mariadb-server-5.5     mysql-server-5.1/start_on_boot  boolean true
+mariadb-server-5.5     mariadb-server-5.5/really_downgrade    boolean false
+mariadb-server-5.5     mysql-server-5.1/postrm_remove_databases        boolean false
+mariadb-server-5.5     mysql-server/password_mismatch  error
+mariadb-server-5.5     mysql-server/no_upgrade_when_using_ndb  error
+<% else -%>
+mariadb-server-10.0	mysql-server/root_password_again	select	<%= node['mariadb']['server_root_password'] %>
+mariadb-server-10.0	mysql-server/root_password	select	<%= node['mariadb']['server_root_password'] %>
+mariadb-server-10.0	mysql-server/error_setting_password	boolean	false
+mariadb-server-10.0	mysql-server-5.1/nis_warning	note	
+mariadb-server-10.0	mysql-server-5.1/start_on_boot	boolean	true
+mariadb-server-10.0	mariadb-server-10.0/really_downgrade	boolean	false
+mariadb-server-10.0	mysql-server-5.1/postrm_remove_databases	boolean	false
+mariadb-server-10.0	mysql-server/password_mismatch	boolean	false
+mariadb-server-10.0	mysql-server/no_upgrade_when_using_ndb	boolean	true
+<% end -%>

templates/default/mariadb_grants.erb

@@ -0,0 +1,25 @@
+#!/bin/bash
+# Generated by CHEF
+# Local modification will be overriden
+
+<% if node['mariadb']['allow_root_pass_change'] -%>
+<% if node['mariadb']['server_root_password'].empty? -%>
+/usr/bin/mysqladmin -u root password "$1"
+<% else -%>
+/usr/bin/mysqladmin -u root -p'<%= node['mariadb']['server_root_password'] %>' password "$1"
+<% end -%>
+
+<% end -%>
+password_flag=""
+if [ "$1" ]; then
+  password_flag="-p'$1'"
+fi
+
+<% if node['mariadb']['forbid_remote_root'] -%>
+user_exist=`/usr/bin/mysql -u root ${password_flag} -D mysql -r -B -N -e "SELECT user from user where user = 'root' and host = '%'"`
+if [ $user_exist == 'root' ]; then
+  /bin/echo "DROP USER 'root'@'%';" | /usr/bin/mysql -u root ${password_flag}
+fi
+<% else -%>
+/bin/echo "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '<%= node['mariadb']['server_root_password'] %>' WITH GRANT OPTION;" | /usr/bin/mysql -u root ${password_flag}
+<% end -%>

test/integration/port_changed/serverspec/mysql_spec.rb

@@ -64,3 +64,8 @@
     end
   end
 end
+
+describe command('/usr/bin/mysql -u root -pgsql' \
+                 ' -D mysql -r -B -N -e "SELECT 1"') do
+  it { should return_stdout '1' }
+end