initial commit

.gitignore

@@ -0,0 +1,4 @@
+vendor
+*.swp
+.bundle/
+./nodes/

.rubocop-todo.yml

@@ -0,0 +1,14 @@
+MethodLength:
+  Enabled: false
+
+LineLength:
+  Enabled: false
+
+NumericLiterals:
+  Enabled: false
+
+AmbiguousRegexpLiteral:
+  Enabled: false
+
+AbcSize:
+  Enabled: false

.rubocop.yml

@@ -0,0 +1,16 @@
+inherit_from: .rubocop-todo.yml
+
+AllCops:
+  Exclude:
+    - 'cookbooks/**/*'
+    - 'tmp/**/*'
+    - 'vendor/bundle/**/*'
+    - 'site-cookbooks/sensu-custom/files/default/tw.rb'
+    - 'images/**/*'
+
+Style/CommandLiteral:
+  EnforcedStyle: mixed
+  AllowInnerBackticks: true
+
+Style/PerlBackrefs:
+  Enabled: false

.ruby-version

@@ -0,0 +1 @@
+2.4.1

Gemfile

@@ -0,0 +1,9 @@
+source 'https://rubygems.org'
+
+gem 'itamae'
+gem 'serverspec'
+
+gem 'itamae-plugin-resource-encrypted_remote_file'
+gem 'reversible_cryptography'
+
+gem 'rubocop'

Gemfile.lock

@@ -0,0 +1,81 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    ansi (1.5.0)
+    ast (2.4.0)
+    diff-lcs (1.3)
+    hashie (3.6.0)
+    itamae (1.10.1)
+      ansi
+      hashie
+      schash (~> 0.1.0)
+      specinfra (>= 2.64.0, < 3.0.0)
+      thor
+    itamae-plugin-resource-encrypted_remote_file (0.0.2)
+      itamae (>= 1.2)
+      reversible_cryptography
+    jaro_winkler (1.5.1)
+    multi_json (1.13.1)
+    net-scp (1.2.1)
+      net-ssh (>= 2.6.5)
+    net-ssh (5.0.2)
+    net-telnet (0.1.1)
+    parallel (1.12.1)
+    parser (2.5.3.0)
+      ast (~> 2.4.0)
+    powerpack (0.1.2)
+    rainbow (3.0.0)
+    reversible_cryptography (0.5.0)
+      thor
+    rspec (3.8.0)
+      rspec-core (~> 3.8.0)
+      rspec-expectations (~> 3.8.0)
+      rspec-mocks (~> 3.8.0)
+    rspec-core (3.8.0)
+      rspec-support (~> 3.8.0)
+    rspec-expectations (3.8.2)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.8.0)
+    rspec-its (1.2.0)
+      rspec-core (>= 3.0.0)
+      rspec-expectations (>= 3.0.0)
+    rspec-mocks (3.8.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.8.0)
+    rspec-support (3.8.0)
+    rubocop (0.61.1)
+      jaro_winkler (~> 1.5.1)
+      parallel (~> 1.10)
+      parser (>= 2.5, != 2.5.1.1)
+      powerpack (~> 0.1)
+      rainbow (>= 2.2.2, < 4.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (~> 1.4.0)
+    ruby-progressbar (1.10.0)
+    schash (0.1.2)
+    serverspec (2.41.3)
+      multi_json
+      rspec (~> 3.0)
+      rspec-its
+      specinfra (~> 2.72)
+    sfl (2.3)
+    specinfra (2.76.3)
+      net-scp
+      net-ssh (>= 2.7)
+      net-telnet (= 0.1.1)
+      sfl
+    thor (0.20.3)
+    unicode-display_width (1.4.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  itamae
+  itamae-plugin-resource-encrypted_remote_file
+  reversible_cryptography
+  rubocop
+  serverspec
+
+BUNDLED WITH
+   1.16.1

Rakefile

@@ -0,0 +1,3 @@
+#!/usr/bin/env rake
+
+Dir['tasks/**/*.rake'].each { |path| load path }

cookbooks/base/aws_ec2.rb

@@ -0,0 +1,27 @@
+# Make swap file:
+[
+  'dd if=/dev/zero of=/swap.img bs=1M count=2048 && chomod 600 /swap.img',
+  'mkswap /swap.img'
+].each do |cmd|
+  execute cmd do
+    user 'root'
+
+    only_if 'test ! -f /swap.img -a `cat /proc/swaps | wc -l` -eq 1'
+  end
+end
+
+# Add the fstab entry:
+file '/etc/fstab' do
+  action :edit
+
+  block do |content|
+    content << "/swap.img /dev/null swap defaults 0 2\n"
+  end
+
+  not_if 'grep swap.img /etc/fstab'
+end
+
+# Mount the swap file:
+execute 'swapon -ae' do
+  only_if 'test `cat /proc/swaps | wc -l` -eq 1'
+end

cookbooks/base/cron-apt.rb

@@ -0,0 +1,44 @@
+# Install `cron-apt`:
+package 'cron-apt'
+
+# From here, we are going to set up `cron-apt` to
+# install the important security updates every day.
+remote_file '/etc/cron-apt/config' do
+  user 'root'
+
+  owner 'root'
+  group 'root'
+  mode  '644'
+end
+
+remote_file '/etc/cron-apt/action.d/3-download' do
+  user 'root'
+
+  owner 'root'
+  group 'root'
+  mode '644'
+end
+
+execute 'grep security /etc/apt/sources.list > /etc/apt/security.sources.list' do
+  user 'root'
+
+  not_if 'test -e /etc/apt/security.sources.list'
+end
+
+file '/var/log/cron-apt/log' do
+  user 'root'
+
+  content 'foo\n'
+
+  owner 'root'
+  group 'root'
+  mode '666'
+
+  not_if 'test -e /var/log/cron-apt/log'
+end
+
+execute '/usr/sbin/logrotate -f /etc/logrotate.d/cron-apt' do
+  user 'root'
+
+  not_if 'test -e /var/log/cron-apt/log'
+end

cookbooks/base/default.rb

@@ -0,0 +1,74 @@
+[
+  # only install amd64 package
+  # http://d.hatena.ne.jp/ritchey/20121229
+  'dpkg --remove-architecture i386',
+
+  # Execute `apt update`
+  'apt update',
+].each do |cmd|
+  execute cmd do
+    user 'root'
+
+    only_if 'dpkg --print-architecture | grep i386'
+  end
+end
+
+# Create /etc/sudoers.d/
+directory '/etc/sudoers.d/' do
+  owner 'root'
+  group 'root'
+  mode '750'
+end
+
+# motd configurations:
+remote_file '/etc/motd.tail' do
+  owner 'root'
+  group 'root'
+  mode '644'
+end
+
+remote_file '/etc/update-motd.d/99-motd-update' do
+  owner 'root'
+  group 'root'
+  mode '755'
+end
+
+# Install the necessary packages:
+include_recipe './packages.rb'
+
+# Lang Setting:
+include_recipe './lang.rb'
+
+# `cron-apt` settings:
+include_recipe './cron-apt.rb'
+
+# `ufw` configurations:
+include_recipe './ufw.rb'
+
+# `sshd` configurations:
+include_recipe './ssh.rb'
+
+# `fortune` configurations:
+include_recipe './fortune.rb'
+
+# timezone configurations:
+include_recipe './timezone.rb'
+
+# ntp configurations:
+include_recipe './ntp.rb'
+
+# kernel configurations:
+include_recipe './kernel.rb'
+
+# Install mc command:
+include_recipe './mc.rb'
+
+# unnecessary configurations:
+if node['platform_version'].to_f == 16.04
+  include_recipe './unnecessary.rb'
+end
+
+# AWS EC2 Swap Setting:
+if node['is_ec2']
+  include_recipe './aws_ec2.rb'
+end

cookbooks/base/files/etc/cron-apt/action.d/3-download

@@ -0,0 +1,2 @@
+autoclean -y
+upgrade -y -o APT::Get::Show-Upgraded=true

cookbooks/base/files/etc/cron-apt/config

@@ -0,0 +1,11 @@
+# Configuration for cron-apt. For further information about the possible
+# configuration settings see the README file.
+
+SYSLOGON="always"
+DEBUG="verbose"
+
+MAILON=""
+
+APTCOMMAND=/usr/bin/apt
+
+OPTIONS="-o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list"

cookbooks/base/files/etc/motd.tail

@@ -0,0 +1,15 @@
+                                                                                                     
+                                                                                                     
+                                                                                                     
+                                                                                                     
+                                                                                                     
+                                                                                                     
+                                                                                                     
+                                                                                                     
+                                                                                                     
+                                                                                                     
+                                                                                                     
+                                                                                                     
+                                                                                                     
+                                                                                                     
+                                                                                                     

cookbooks/base/files/etc/ntp.conf

@@ -0,0 +1,66 @@
+# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
+
+driftfile /var/lib/ntp/ntp.drift
+
+# Enable this if you want statistics to be logged.
+#statsdir /var/log/ntpstats/
+
+statistics loopstats peerstats clockstats
+filegen loopstats file loopstats type day enable
+filegen peerstats file peerstats type day enable
+filegen clockstats file clockstats type day enable
+
+# Specify one or more NTP servers.
+
+# Use servers from the NTP Pool Project. Approved by Ubuntu Technical Board
+# on 2011-02-08 (LP: #104525). See http://www.pool.ntp.org/join.html for
+# more information.
+pool 0.ubuntu.pool.ntp.org iburst
+pool 1.ubuntu.pool.ntp.org iburst
+pool 2.ubuntu.pool.ntp.org iburst
+pool 3.ubuntu.pool.ntp.org iburst
+
+# Use Ubuntu's ntp server as a fallback.
+pool ntp.ubuntu.com
+
+# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
+# details.  The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>
+# might also be helpful.
+#
+# Note that "restrict" applies to both servers and clients, so a configuration
+# that might be intended to block requests from certain clients could also end
+# up blocking replies from your own upstream servers.
+
+# By default, exchange time with everybody, but don't allow configuration.
+restrict -4 default kod notrap nomodify nopeer noquery limited
+restrict -6 default kod notrap nomodify nopeer noquery limited
+
+# Local users may interrogate the ntp server more closely.
+restrict 127.0.0.1
+restrict ::1
+
+# Needed for adding pool entries
+restrict source notrap nomodify noquery
+
+# Clients from this (example!) subnet have unlimited access, but only if
+# cryptographically authenticated.
+#restrict 192.168.123.0 mask 255.255.255.0 notrust
+
+
+# If you want to provide time to your local subnet, change the next line.
+# (Again, the address is an example only.)
+#broadcast 192.168.123.255
+
+# If you want to listen to time broadcasts on your local subnet, de-comment the
+# next lines.  Please do this only if you trust everybody on the network!
+#disable auth
+#broadcastclient
+
+#Changes recquired to use pps synchonisation as explained in documentation:
+#http://www.ntp.org/ntpfaq/NTP-s-config-adv.htm#AEN3918
+
+#server 127.127.8.1 mode 135 prefer    # Meinberg GPS167 with PPS
+#fudge 127.127.8.1 time1 0.0042        # relative to PPS for my hardware
+
+#server 127.127.22.1                   # ATOM(PPS)
+#fudge 127.127.22.1 flag3 1            # enable PPS API

cookbooks/base/files/etc/ssh/sshd_config

@@ -0,0 +1,91 @@
+# Package generated configuration file
+# See the sshd_config(5) manpage for details
+
+# What ports, IPs and protocols we listen for
+Port 10022
+# Use these options to restrict which interfaces/protocols sshd will bind to
+#ListenAddress ::
+ListenAddress 0.0.0.0
+Protocol 2
+# HostKeys for protocol version 2
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_dsa_key
+HostKey /etc/ssh/ssh_host_ecdsa_key
+HostKey /etc/ssh/ssh_host_ed25519_key
+#Privilege Separation is turned on for security
+UsePrivilegeSeparation yes
+
+# Lifetime and size of ephemeral version 1 server key
+KeyRegenerationInterval 3600
+ServerKeyBits 1024
+
+# Logging
+SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+LoginGraceTime 120
+PermitRootLogin no
+StrictModes yes
+
+RSAAuthentication yes
+PubkeyAuthentication yes
+#AuthorizedKeysFile	%h/.ssh/authorized_keys
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts yes
+# For this to work you will also need host keys in /etc/ssh_known_hosts
+RhostsRSAAuthentication no
+# similar for protocol version 2
+HostbasedAuthentication no
+# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
+#IgnoreUserKnownHosts yes
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords no
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication no
+
+# Change to no to disable tunnelled clear text passwords
+PasswordAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosGetAFSToken no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+X11Forwarding yes
+X11DisplayOffset 10
+PrintMotd no
+PrintLastLog yes
+TCPKeepAlive yes
+#UseLogin no
+
+#MaxStartups 10:30:60
+#Banner /etc/issue.net
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+Subsystem sftp /usr/lib/openssh/sftp-server
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM yes
+
+# Do not use DNS:
+UseDNS no

cookbooks/base/files/etc/ssh/sshd_config.1804

@@ -0,0 +1,122 @@
+#	$OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+Port 10022
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin no
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+#PubkeyAuthentication yes
+
+# Expect .ssh/authorized_keys2 to be disregarded by default in future.
+#AuthorizedKeysFile	.ssh/authorized_keys .ssh/authorized_keys2
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication no
+#PermitEmptyPasswords no
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
+#GSSAPIKeyExchange no
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM yes
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+X11Forwarding yes
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+PrintMotd no
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+#PidFile /var/run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+# override default of no subsystems
+Subsystem	sftp	/usr/lib/openssh/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	PermitTTY no
+#	ForceCommand cvs server

cookbooks/base/files/etc/sysctl.d/90-vfs-cache-pressure.conf

@@ -0,0 +1,8 @@
+# `vfs_cache_pressure` configures how much the system will choose to cache inode
+# and dentry information over other data.
+#
+# Basically, this is access data about the filesystem.
+# This is generally very costly to look up and very frequently requested,
+# so it's an excellent thing for your system to cache.
+
+vm.vfs_cache_pressure = 50

cookbooks/base/files/etc/sysctl.d/90-vm-swappiness.conf

@@ -0,0 +1,9 @@
+# The swappiness parameter configures how often your system swaps data out of RAM to the swap space.
+# This is a value between 0 and 100 that represents a percentage.
+#
+# With values close to zero, the kernel will not swap data to the disk unless absolutely necessary.
+# Remember, interactions with the swap file are "expensive" in that they take a lot longer than
+# interactions with RAM and they can cause a significant reduction in performance.
+# Telling the system not to rely on the swap much will generally make your system faster.
+
+vm.swappiness = 10

cookbooks/base/files/etc/timezone

@@ -0,0 +1 @@
+Asia/Tokyo

cookbooks/base/files/etc/update-motd.d/99-motd-update

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+echo
+cat /etc/motd.tail

cookbooks/base/files/usr/share/git-core/templates/hooks/pre-commit

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+# if the commit is first one, then pass
+
+if [ -z "$(git branch)" ]; then
+  exit 0
+fi
+
+# Otherwise, check if the branch is master, and if it is, fail.
+
+branch="$(git symbolic-ref HEAD 2>/dev/null)" || \
+       "$(git describe --contains --all HEAD)"
+
+if [ "${branch##refs/heads/}" = "master" ]; then
+  echo "Do not commit on the master branch!"
+  exit 1
+fi

cookbooks/base/files/usr/share/git-core/templates/hooks/prepare-commit-msg

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+if [ "$2" = "" ]; then
+  mv $1 $1.tmp
+
+  ID=`git branch | grep ^\* | awk '{print $2}' | cut -f 2 -d "/"`
+
+  cat <<EOF > $1
+
+
+This commit refs/fixes #${ID}.
+#           ^^^^^^^^^^
+EOF
+
+  cat $1.tmp >> $1
+fi
+
+exit 0

cookbooks/base/fortune.rb

@@ -0,0 +1,21 @@
+# Install `fortune` package:
+package 'fortune' do
+  not_if 'test -e /usr/games/fortune'
+end
+
+URL='http://www.splitbrain.org/_media/projects/fortunes/fortune-starwars.tgz'
+TGZ='fortune-starwars.tgz'
+
+[
+  "wget #{URL} -O #{TGZ}",
+  "tar xf #{TGZ}",
+  'cp fortune-starwars/starwars.dat /usr/share/games/fortunes/',
+  'cp fortune-starwars/starwars /usr/share/games/fortunes/'
+].each do |cmd|
+  execute cmd do
+    user 'root'
+    cwd '/tmp/itamae_tmp/'
+
+    not_if 'test -e /usr/share/games/fortunes/starwars.dat'
+  end
+end

cookbooks/base/kernel.rb

@@ -0,0 +1,12 @@
+STORAGE = '/etc/sysctl.d'
+
+[
+  "#{STORAGE}/90-vm-swappiness.conf",
+  "#{STORAGE}/90-vfs-cache-pressure.conf"
+].each do |conf|
+  remote_file conf do
+    owner 'root'
+    group 'root'
+    mode '644'
+  end
+end

cookbooks/base/lang.rb

@@ -0,0 +1,20 @@
+# Language Settings:
+package 'language-pack-ja-base'
+
+execute 'locale-gen ja_JP.UTF-8' do
+  user 'root'
+
+  not_if 'locale -a | grep ja_JP.utf8'
+end
+
+execute 'dpkg-reconfigure --frontend=noninteractive locales' do
+  user 'root'
+
+  not_if 'locale -a | grep ja_JP.utf8'
+end
+
+execute 'update-locale LANG=ja_JP.UTF-8' do
+  user 'root'
+
+  not_if 'strings /etc/default/locale | grep ja_JP.UTF-8'
+end

cookbooks/base/mc.rb

@@ -0,0 +1,12 @@
+MC = 'https://dl.minio.io/client/mc/release/linux-amd64/mc'
+LOCATION = '/usr/local/bin/mc'
+
+execute "wget #{MC} -O #{LOCATION}" do
+  not_if "test -e #{LOCATION}"
+end
+
+file LOCATION do
+  mode '755'
+  user 'root'
+  group 'root'
+end

cookbooks/base/ntp.rb

@@ -0,0 +1,18 @@
+case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
+when "18.04"
+  # do nothing
+else
+  package 'ntp'
+
+  remote_file '/etc/ntp.conf' do
+    owner 'root'
+    group 'root'
+    mode '644'
+
+    notifies :restart, 'service[ntp]'
+  end
+
+  service 'ntp' do
+    action :nothing
+  end
+end

cookbooks/base/packages.rb

@@ -0,0 +1,64 @@
+# Execute `apt update`:
+execute 'apt update'
+
+# Install the necessary packages:
+%w[build-essential zsh vim-nox debian-keyring screen curl dstat].each do |pkg|
+  package pkg
+end
+
+# Install the extra kernel:
+unless node['is_ec2']
+  case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
+  when "18.04"
+    package 'linux-image-extra-virtual'
+  else
+    KERNEL = run_command("uname -r").stdout.chomp
+    package "linux-image-extra-#{KERNEL}"
+  end
+end
+
+### Here we are going to install git.
+# Constants:
+KEYSRV = 'hkp://keyserver.ubuntu.com:80'
+ID = 'E1DF1F24'
+
+GIT_PREPUSH = '/usr/share/git-core/templates/hooks/pre-push'
+PREPUSH = 'https://gist.github.com/kazu634/8267388/raw/e9202cd4c29a66723c88d2be05f3cd19413d2137/pre-push'
+
+# Retrieve the Ubuntu code:
+DIST = run_command('lsb_release -cs').stdout.chomp
+
+# Add the public key file to install `git`
+execute "apt-key adv --keyserver #{KEYSRV} --recv-keys #{ID}" do
+  not_if 'apt-key list | grep E1DF1F24'
+end
+
+# Deploy the `apt` sources:
+template '/etc/apt/sources.list.d/git.list' do
+  action :create
+  variables(distribution: DIST)
+end
+
+execute 'apt update' do
+  not_if 'LANG=C apt-cache policy git | grep Installed | grep ppa'
+end
+
+execute 'apt install git -y' do
+  not_if 'LANG=C apt-cache policy git | grep Installed | grep ppa'
+end
+
+execute "wget #{PREPUSH} -O #{GIT_PREPUSH}" do
+  not_if "test -e #{GIT_PREPUSH}"
+end
+
+[
+  '/usr/share/git-core/templates/hooks/pre-commit',
+  '/usr/share/git-core/templates/hooks/prepare-commit-msg',
+].each do |conf|
+  remote_file conf do
+    user 'root'
+    owner 'root'
+    group 'root'
+    mode '644'
+  end
+end

cookbooks/base/ssh.rb

@@ -0,0 +1,35 @@
+# ToDo: `iptables` setting must be here:
+execute 'ufw allow 10022' do
+  user 'root'
+
+  not_if 'LANG=c ufw status | grep 10022'
+
+  notifies :run, 'execute[ufw reload-or-enable]'
+end
+
+# Deploy the `sshd` configuration file:
+case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
+when "18.04"
+  remote_file '/etc/ssh/sshd_config' do
+    user 'root'
+    owner 'root'
+    group 'root'
+    mode '644'
+
+    source 'files/etc/ssh/sshd_config.1804'
+  end
+else
+  remote_file '/etc/ssh/sshd_config' do
+    user 'root'
+    owner 'root'
+    group 'root'
+    mode '644'
+  end
+end
+
+
+# Apply the changes:
+execute 'systemctl reload ssh.service ' do
+  action :nothing
+  subscribes :run, 'remote_file[/etc/ssh/sshd_config]'
+end

cookbooks/base/templates/etc/apt/sources.list.d/git.list

@@ -0,0 +1 @@
+deb      "http://ppa.launchpad.net/git-core/ppa/ubuntu" <%= @distribution %> main

cookbooks/base/timezone.rb

@@ -0,0 +1,23 @@
+case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
+when "18.04"
+  execute 'timedatectl set-timezone Asia/Tokyo' do
+    not_if 'timedatectl | grep Tokyo'
+  end
+else
+  remote_file '/etc/timezone' do
+    user 'root'
+    owner 'root'
+    group 'root'
+    mode '644'
+  end
+
+  [
+    'cp -f /usr/share/zoneinfo/Asia/Tokyo /etc/localtime'
+  ].each do |cmd|
+    execute cmd do
+      user 'root'
+
+      not_if 'diff /usr/share/zoneinfo/Asia/Tokyo /etc/localtime'
+    end
+  end
+end

cookbooks/base/ufw.rb

@@ -0,0 +1,6 @@
+execute 'ufw reload-or-enable' do
+  user 'root'
+  command 'LANG=C ufw reload | grep skipping && ufw --force enable || exit 0'
+
+  action :nothing
+end

cookbooks/base/unnecessary.rb

@@ -0,0 +1,5 @@
+%w( apparmor iscsid lxc lxcfs lxd-containers lxd open-iscsi ).each do |s|
+  service s do
+    action :disable
+  end
+end

cookbooks/blog/attributes.rb

@@ -0,0 +1,9 @@
+# -------------------------------------------
+# Specifying the default settings:
+# -------------------------------------------
+node.reverse_merge!({
+  'blog' => {
+    'FQDN' => 'blog.kazu634.com',
+    'production' => true
+  }
+})

cookbooks/blog/default.rb

@@ -0,0 +1,6 @@
+include_recipe './attributes.rb'
+
+if node['blog']['production']
+  include_recipe './ssl.rb'
+  include_recipe './nginx.rb'
+end

cookbooks/blog/files/etc/cron.d/blog

@@ -0,0 +1,2 @@
+@reboot webadm cp -pr /home/webadm/works/public/* /var/www/blog/
+12 3 * * * root openssl rand 48 > /etc/letsencrypt/live/blog.kazu634.com/ticket.key

cookbooks/blog/files/etc/letsencrypt/live/blog.kazu634.com/dhparams_4096.pem

@@ -0,0 +1,13 @@
+-----BEGIN DH PARAMETERS-----
+MIICCAKCAgEAqY1i3j1m5Udr7eJxrsxBDK3NqsXJbPgfj2tdH+RlY8Bb7NuTPl9Z
+e5KtZ2UQlPcth9sSPgulg/V+g4GQhge8xACSl1joAenDpPF8BGyBcv/o9QwNpdzj
+yP9o4X/TQkDxGKTJItpfKMHdmBPYC8Sxv0NpPlkKT27kfwOpSRuj17ZWAl+AnOjS
+TjLzSq85/Ao7C0rgAhJRG38iZ36DXGWYtrA7n/F6wTlmelRwkNCGEypF79GWSU8P
+xCpVLTY6MIhDq5NBO3mzkeYyl0M1M8c7dwUAPAMCK43Fl6nfQbbbwSIxlxQy8WIq
+48s5TaJEp1hU2CXTgTa+cmm1JQziFBlwOZNAeAAIi6JcJRHCFhpUrTVirqPRIoUc
+c99xUs91aELi/nZggt0vrGd4kyQ6eB5pxB6kAJwNfP3URMjucttcukyhuu/jzDMd
+GNg1J75dAF606yunta8ZohecrabpkACQz9ZR+VOM0z4IGbI39M+EohFcxL7+8gSU
+VP537jDrlAjU2DtbE2Dr+dotg1LfIE4P5AGFIAPfKYE+YXJ85SNin7POMttw8TP2
+WlMVFAG159CBjPvGPuXqInBv6U5QHWxINSevHL6vdD12d7L9LjUHQQNaAborPe2Z
+rN7fPDbDib5vnxUBAayHgic8qw1/eqWIhAXyBGRG/EOuwKgr2DU5U3sCAQI=
+-----END DH PARAMETERS-----

cookbooks/blog/files/etc/monit/conf.d/blog-log.conf

@@ -0,0 +1,2 @@
+check file nginx-blog with path /var/log/nginx/blog.access.log
+    if timestamp > 2 minutes for 5 cycles then exec "/bin/systemctl restart nginx"

cookbooks/blog/files/etc/nginx/sites-available/blog

@@ -0,0 +1,90 @@
+server {
+  # allow access from localhost
+  listen 80 reuseport backlog=1024;
+  listen 443 ssl http2 backlog=1024;
+  server_name blog.kazu634.com;
+
+  ssl_certificate /etc/letsencrypt/live/blog.kazu634.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/blog.kazu634.com/privkey.pem;
+  ssl_dhparam /etc/letsencrypt/live/blog.kazu634.com/dhparams_4096.pem;
+
+  ssl_session_cache   shared:SSL:3m;
+  ssl_buffer_size     4k;
+  ssl_session_timeout 10m;
+
+  ssl_session_tickets on;
+  ssl_session_ticket_key /etc/letsencrypt/live/blog.kazu634.com/ticket.key;
+
+  ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
+  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:DES-CBC3-SHA;
+  ssl_prefer_server_ciphers on;
+
+  ssl_stapling on;
+  ssl_stapling_verify on;
+  resolver 8.8.4.4 8.8.8.8 valid=300s;
+  resolver_timeout 10s;
+
+  # Enable HSTS (HTTP Strict Transport Security)
+  add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
+
+  root /var/www/blog;
+  index index.html index.htm;
+
+  access_log   /var/log/nginx/blog.access.log   ltsv;
+  error_log    /var/log/nginx/blog.error.log;
+
+  location / {
+    gzip on;
+    gunzip on;
+    gzip_vary on;
+
+    # http2 server push:
+    http2_push_preload on;
+
+    http2_push /css/sanitize.css;
+    http2_push /css/responsive.css;
+    http2_push /css/highlight_monokai.css;
+    http2_push /css/theme.css;
+    http2_push /css/custom.css;
+    http2_push /images/profile.png;
+    http2_push /js/highlight.pack.js;
+
+    if (-e "/tmp/maintenance") {
+      return 503;
+    }
+
+    location /feed {
+      return 301 http://blog.kazu634.com/index.xml;
+    }
+
+    location /wp-content {
+      return 404;
+    }
+
+    location ~* \.css {
+      gzip_static always;
+
+      expires max;
+    }
+
+    location ~* \.js {
+      gzip_static always;
+
+      expires max;
+    }
+
+    location /images {
+      gzip_static always;
+
+      expires max;
+    }
+
+    location = /favicon.ico {
+      access_log off;
+      empty_gif;
+      expires max;
+    }
+
+    try_files $uri $uri/ /index.html;
+  }
+}

cookbooks/blog/nginx.rb

@@ -0,0 +1,63 @@
+# Deploy the nginx configuration file:
+remote_file '/etc/nginx/sites-available/blog' do
+  owner 'root'
+  group 'root'
+  mode '644'
+end
+
+# Deploy cron tab configuration for nginx
+remote_file '/etc/cron.d/blog' do
+  owner 'root'
+  group 'root'
+  mode '644'
+end
+
+# Create link:
+link '/etc/nginx/sites-enabled/blog' do
+  user 'root'
+  to '/etc/nginx/sites-available/blog'
+
+  notifies :restart, 'service[nginx]'
+end
+
+service 'nginx' do
+  action :nothing
+end
+
+# Create the nginx directory:
+directory '/var/www/blog' do
+  owner 'www-data'
+  group 'webadm'
+  mode '770'
+end
+
+# Add the fstab entry:
+file '/etc/fstab' do
+  action :edit
+
+  block do |content|
+    content << "tmpfs /var/www/blog tmpfs size=250m,noatime 0 0\n"
+  end
+
+  not_if 'grep /var/www/blog /etc/fstab'
+
+  notifies :run, 'execute[fstab -a]'
+end
+
+execute 'mount -a' do
+  action :nothing
+end
+
+# Add monit configuration file for monitoring nginx logs:
+remote_file '/etc/monit/conf.d/blog-log.conf' do
+  owner 'root'
+  group 'root'
+  mode '644'
+
+  notifies :reload, 'service[monit]'
+end
+
+service 'monit' do
+  action :nothing
+end
+

cookbooks/blog/ssl.rb

@@ -0,0 +1,16 @@
+[
+  'rm -f /etc/nginx/sites-enabled/*',
+  'ln -f -s /etc/nginx/sites-available/maintenance /etc/nginx/sites-enabled/maintenance',
+  'systemctl reload nginx',
+  "test -e /etc/letsencrypt/live/#{node['blog']['FQDN']}/cert.pem || certbot certonly --webroot -d #{node['blog']['FQDN']} --webroot-path /usr/share/nginx/html/ --email simoom634@yahoo.co.jp --agree-tos -n",
+  '/home/webadm/bin/nginx-config.sh',
+].each do |cmd|
+  execute cmd
+end
+
+remote_file "/etc/letsencrypt/live/#{node['blog']['FQDN']}/dhparams_4096.pem" do
+  owner 'root'
+  group 'root'
+end
+
+execute "openssl rand 48 > /etc/letsencrypt/live/#{node['blog']['FQDN']}/ticket.key"

cookbooks/consul-template/attributes.rb

@@ -0,0 +1,10 @@
+# -------------------------------------------
+# Specifying the default settings:
+# -------------------------------------------
+node.reverse_merge!({
+  'consul-template' => {
+    'base_binary_url' => 'https://releases.hashicorp.com/consul-template/',
+    'arch' => node['kernel']['machine'] =~ /x86_64/ ? 'amd64' : '386',
+    'tmp_path' => '/tmp/itamae_tmp/consul-template.zip'
+  }
+})

cookbooks/consul-template/default.rb

@@ -0,0 +1,6 @@
+include_recipe './attributes.rb'
+
+include_recipe './prerequisites.rb'
+include_recipe './install.rb'
+
+include_recipe './setup.rb'

cookbooks/consul-template/install.rb

@@ -0,0 +1,47 @@
+# -------------------------------------------
+# Calculating the latest `consul-template` version:
+# -------------------------------------------
+download_url = ''
+
+begin
+  require 'net/http'
+
+  uri = URI.parse('https://releases.hashicorp.com/consul-template/')
+
+  Timeout.timeout(3) do
+    response = Net::HTTP.get_response(uri)
+
+    if response.body =~ /consul-template_(\d+\.\d+\.\d+)/
+      tag_version = $1
+      download_url = \
+        "#{node['consul-template']['base_binary_url']}#{tag_version}/consul-template_#{tag_version}_linux_#{node['consul-template']['arch']}.zip"
+    end
+  end
+rescue
+  # Abort the chef client process:
+  raise 'Cannot connect to https://releases.hashicorp.com/consul-template/'
+end
+
+# -------------------------------------------
+# Main Part
+# -------------------------------------------
+
+# Download:
+execute "wget #{download_url} -O #{node['consul-template']['tmp_path']}"
+
+# Unzip:
+execute "unzip -qo #{node['consul-template']['tmp_path']}" do
+  cwd '/opt/consul/bin/'
+end
+
+file '/opt/consul/bin/consul-template' do
+  owner 'root'
+  group 'root'
+  mode '755'
+end
+
+# Create link:
+link '/usr/local/bin/consul-template' do
+  user 'root'
+  to '/opt/consul/bin/consul-template'
+end

cookbooks/consul-template/prerequisites.rb

@@ -0,0 +1,14 @@
+# Ensure that `unzip` and `dnsmasq` are available:
+%w( unzip ).each do |p|
+  package p do
+    action :install
+  end
+end
+
+%w( /opt/consul/bin ).each do |d|
+  directory d do
+    owner 'root'
+    group 'root'
+    mode '755'
+  end
+end

cookbooks/consul-template/setup.rb

@@ -0,0 +1,9 @@
+# `consul-template`-related paths:
+%w( /etc/consul-template.d ).each do |d|
+  directory d do
+    owner 'root'
+    group 'root'
+
+    mode '755'
+  end
+end

cookbooks/consul/attributes.rb

@@ -0,0 +1,21 @@
+# -------------------------------------------
+# Specifying the default settings:
+# -------------------------------------------
+case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
+when "18.04"
+  cmd = 'LANG=C /sbin/ifconfig | grep "inet " | grep -v 127.0.0.1 | cut -d" " -f10'
+else
+  cmd = 'LANG=C /sbin/ifconfig | grep "inet addr" | grep -v 127.0.0.1 | awk "{print $2;}" | cut -d: -f2 | cut -f 1 -d " " | tail -1'
+end
+ipaddr = run_command(cmd).stdout.chomp
+
+node.reverse_merge!({
+  'consul' => {
+    'base_binary_url' => 'https://releases.hashicorp.com/consul/',
+    'arch' => node['kernel']['machine'] =~ /x86_64/ ? 'amd64' : '386',
+    'tmp_path' => '/tmp/itamae_tmp/consul.zip',
+    'manager' => true,
+    'manager_hosts' => '["192.168.10.110", "192.168.10.101", "192.168.10.111", "192.168.10.115"]',
+    'ipaddr' => ipaddr
+  }
+})

cookbooks/consul/default.rb

@@ -0,0 +1,11 @@
+include_recipe './attributes.rb'
+
+include_recipe './prerequisites.rb'
+
+include_recipe './install.rb'
+
+include_recipe './setup.rb'
+
+include_recipe './dnsmasq.rb'
+
+include_recipe './monitoring.rb'

cookbooks/consul/dnsmasq.rb

@@ -0,0 +1,47 @@
+%w(dnsmasq resolvconf systemd-resolved).each do |s|
+  service s do
+    action :nothing
+  end
+end
+
+case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
+when "18.04"
+  remote_file '/etc/dnsmasq.conf' do
+    owner 'root'
+    group 'root'
+    mode '644'
+
+    source 'files/etc/dnsmasq.conf.1804'
+
+    notifies :reload, 'service[dnsmasq]'
+  end
+else
+  remote_file '/etc/dnsmasq.conf' do
+    owner 'root'
+    group 'root'
+    mode '644'
+
+    source 'files/etc/dnsmasq.conf.1804'
+
+    notifies :reload, 'service[dnsmasq]'
+  end
+end
+
+case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
+when "18.04"
+  remote_file '/etc/systemd/resolved.conf' do
+    owner 'root'
+    group 'root'
+    mode '644'
+
+    notifies :restart, 'service[systemd-resolved]'
+  end
+else
+  remote_file '/etc/resolvconf/resolv.conf.d/head' do
+    owner 'root'
+    group 'root'
+    mode '644'
+
+    notifies :restart, 'service[resolvconf]'
+  end
+end

cookbooks/consul/files/etc/consul.d/check-disk.json

@@ -0,0 +1,9 @@
+{
+  "check": {
+    "id": "disk-capacity",
+    "name": "Check for Disk Capacity",
+    "args": ["/usr/lib/nagios/plugins/check_disk", "-w", "25%", "-c", "10%", "-p", "/"],
+    "interval": "3600s",
+    "timeout": "10s"
+  }
+}

cookbooks/consul/files/etc/consul.d/check-load.json

@@ -0,0 +1,9 @@
+{
+  "check": {
+    "id": "load-average",
+    "name": "Check for Load Average",
+    "args": ["/usr/lib/nagios/plugins/check_load", "-r", "--warning=1,1,1", "--critical=2,2,2"],
+    "interval": "60s",
+    "timeout": "10s"
+  }
+}

cookbooks/consul/files/etc/consul.d/check-memory.json

@@ -0,0 +1,9 @@
+{
+  "check": {
+    "id": "memory",
+    "name": "Check for Memory",
+    "args": ["/usr/lib/nagios/plugins/check_memory"],
+    "interval": "60s",
+    "timeout": "10s"
+  }
+}

cookbooks/consul/files/etc/consul.d/check-reboot-required.json

@@ -0,0 +1,9 @@