################################################################################
#
# DO NOT EDIT THIS FILE. All policy files prefixed with CFE_ and update_bins.cf
# are maintained by CFEngine and its original state is required for internal
# operations of CFEngine. If the file has been modified CFEngine’s upgrades
# may require manual intervention. Contact CFEngine support if additional
# information and/or recommendation is needed.
#
################################################################################
#########################################################
#
# update_policy
# - Cfengine policy update (masterfiles -> inputs)
#
#########################################################

bundle agent cfe_internal_update_policy
{
  vars:
    !(cfengine_3_5||cfengine_3_4)::
      "inputs_dir"         string => translatepath("$(sys.inputdir)"),
      comment => "Directory containing CFEngine policies",
      handle => "cfe_internal_update_policy_vars_inputs_dir";

      "dir_bin"         string => translatepath("$(sys.bindir)"),
      comment => "Directory containing CFEngine binaries",
      handle => "cfe_internal_update_policy_vars_dir_bin";

    (cfengine_3_5||cfengine_3_4)::
      "inputs_dir"         string => translatepath("$(sys.workdir)/inputs"),
      comment => "Directory containing CFEngine policies",
      handle => "cfe_internal_update_policy_vars_inputs_dir_backport";

      "dir_bin"         string => translatepath("$(sys.workdir)/bin"),
      comment => "Directory containing CFEngine binaries",
      handle => "cfe_internal_update_policy_vars_dir_bin_backport";

    windows::

      "master_location"    string => "/var/cfengine/masterfiles",  # NB! NOT $(sys.workdir) on Windows !
      comment => "The master CFEngine policy directory on the policy host",
      handle => "cfe_internal_update_policy_vars_master_location_windows";

      "modules_dir"        string => "/var/cfengine/modules",      # NB! NOT $(sys.workdir) on Windows !
      comment => "Directory containing CFEngine modules",
      handle => "cfe_internal_update_policy_vars_modules_dir_windows";

      "plugins_dir"        string => "/var/cfengine/plugins",      # NB! NOT $(sys.workdir) on Windows !
      comment => "Directory containing CFEngine plugins",
      handle => "cfe_internal_update_policy_vars_plugins_dir_windows";

    !windows.!(cfengine_3_5||cfengine_3_4)::
      "master_location"    string => "$(sys.masterdir)",
      comment => "The master CFEngine policy directory on the policy host",
      handle => "cfe_internal_update_policy_vars_master_location";

    !windows.(cfengine_3_5||cfengine_3_4)::
      "master_location"    string => "$(sys.workdir)/masterfiles",
      comment => "The master CFEngine policy directory on the policy host",
      handle => "cfe_internal_update_policy_vars_master_location_backport";

    !windows::
      "modules_dir"        string => translatepath("$(sys.workdir)/modules"),
      comment => "Directory containing CFEngine modules",
      handle => "cfe_internal_update_policy_vars_modules_dir";

      "plugins_dir"        string => translatepath("$(sys.workdir)/plugins"),
      comment => "Directory containing CFEngine plugins",
      handle => "cfe_internal_update_policy_vars_plugins_dir";

    any::

      "file_check"         string => translatepath("$(inputs_dir)/promises.cf"),
      comment => "Path to a policy file",
      handle => "cfe_internal_update_vars_file_check";

      "ppkeys_file"        string => translatepath("$(sys.workdir)/ppkeys/localhost.pub"),
      comment => "Path to public key file",
      handle => "cfe_internal_update_policy_vars_ppkeys_file";

      "postgresdb_dir"        string => "$(sys.workdir)/state/pg/data",
      comment => "Directory where Postgres database files will be stored on hub -",
      handle => "cfe_internal_update_policy_postgresdb_dir";

      "postgresdb_log"        string => "/var/log/postgresql.log",
      comment => "File where Postgres database files will be logging -",
      handle => "cfe_internal_update_policy_postgresdb_log_file";

      "redis_conf_file"  string => translatepath("$(sys.workdir)/config/redis.conf"),
      comment => "Path to Redis configuration file",
      handle => "cfe_internal_update_policy_redis_conf_file";

      "agents" slist => {
			  "cf-agent",
			  "cf-execd",
			  "cf-key",
			  "cf-monitord",
			  "cf-promises",
			  "cf-runagent",
			  "cf-serverd",
      },
      comment => "List of CFEngine binaries",
      handle => "cfe_internal_update_policy_vars_agents";

      "optional_agents" slist => {
			           "cf-consumer",
			           "cf-hub",
      },
      comment => "List of optional CFEngine binaries",
      handle => "cfe_internal_update_policy_vars_optional_agents";
      #

  classes:

      "have_bindir_$(optional_agents)" expression => fileexists("$(dir_bin)/$(optional_agents)");

    any::

      "have_ppkeys"   expression => fileexists("$(ppkeys_file)"),
      comment => "Check for /var/cfengine/ppkeys/localhost.pub",
      handle => "cfe_internal_update_policy_classes_have_ppkeys";

      "local_files_ok" expression => fileexists("$(file_check)"),
      comment => "Check for $(sys.masterdir)/promises.cf",
      handle => "cfe_internal_update_classes_files_ok";

      # create a global files_ok class
      "cfe_internal_trigger" expression => "local_files_ok",
      classes => u_if_else("files_ok", "files_ok");

      #

  commands:

    !have_ppkeys::

      "$(sys.cf_key)"
      comment => "Generate cfengine encryption keys if necessary",
      classes => u_kept_successful_command,
      handle => "cfe_internal_update_policy_commands_generate_keys";

    am_policy_hub.update_report::

      "$(sys.cf_promises) -r"
         contain => u_in_shell_and_silent,
         comment => "Generate config knowledge format after update",
         classes => u_kept_successful_command,
         handle => "cfe_internal_update_policy_commands_run_cf_promises_r";

      #

  files:

    !am_policy_hub::  # policy hub should not alter inputs/ uneccessary

      "$(inputs_dir)/cf_promises_validated"
      comment => "Check whether a validation stamp is available for a new policy update to reduce the distributed load",
      handle => "cfe_internal_update_policy_check_valid_update",
      copy_from => u_rcp("$(master_location)/cf_promises_validated", @(update_def.policy_servers)),
      action => u_immediate,
      classes => u_if_repaired("validated_updates_ready");

    !am_policy_hub.!windows::

      "$(modules_dir)"
      comment => "Always update modules files on client side",
      handle => "cfe_internal_update_policy_files_update_modules",
      copy_from => u_rcp("$(modules_dir)", @(update_def.policy_servers)),
      depth_search => u_recurse("inf"),
      perms => u_m("755"),
      action => u_immediate;

      "$(plugins_dir)"
      comment => "Always update plugins files on client side",
      handle => "cfe_internal_update_policy_files_update_plugins",
      copy_from => u_rcp("$(plugins_dir)", @(update_def.policy_servers)),
      depth_search => u_recurse("inf"),
      perms => u_m("755"),
      action => u_immediate;

    !am_policy_hub.windows::

      "$(sys.workdir)\modules"
      comment => "Always update modules files on client side (Windows)",
      handle => "cfe_internal_update_policy_files_update_modules_windows",
      copy_from => u_rcp("$(modules_dir)", @(update_def.policy_servers)),
      depth_search => u_recurse("inf"),
      perms => u_m("755"),
      action => u_immediate;

      "$(sys.workdir)\plugins"
      comment => "Always update plugins files on client side (Windows)",
      handle => "cfe_internal_update_policy_files_update_plugins_windows",
      copy_from => u_rcp("$(plugins_dir)", @(update_def.policy_servers)),
      depth_search => u_recurse("inf"),
      perms => u_m("755"),
      action => u_immediate;

    am_policy_hub|validated_updates_ready::  # policy hub should always put masterfiles in inputs in order to check new policy

      "$(inputs_dir)"
      comment => "Copy policy updates from master source on policy server if a new validation was acquired",
      handle => "cfe_internal_update_policy_files_inputs_dir",
      copy_from => u_rcp("$(master_location)", @(update_def.policy_servers)),
      depth_search => u_recurse("inf"),
      file_select  => u_input_files,
      action => u_immediate,
      classes => u_if_repaired("update_report");

    !policy_server.ha_enabled::
      "$(sys.workdir)/policy_server.dat"
      comment => "Copy policy_server.dat file from server",
      handle => "cfe_internal_update_ha_policy_server",
      copy_from => u_rcp("$(sys.workdir)/state/master_hub.dat", @(update_def.policy_servers)),
      action => u_immediate,
      classes => u_if_repaired("replica_failover");  # not needed ?

    !windows::

      "$(dir_bin)/$(agents)"
      comment => "Make sure cfengine binaries have right file permissions",
      handle => "cfe_internal_update_policy_files_dir_bin_agents",
      perms => u_m("755"),
      action => u_immediate;

      "$(dir_bin)/$(optional_agents)"
      comment => "Make sure the optional cfengine binaries have right file permissions",
      handle => "cfe_internal_update_policy_files_sys_workdir_bin_optional",
      perms => u_m("755"),
      action => u_immediate,
      ifvarclass => canonify("have_bindir_$(optional_agents)");

      "$(sys.workdir)/bin"
      comment => "Make sure cfengine binaries have right file permissions",
      handle => "cfe_internal_update_policy_files_sys_workdir_bin",
      perms => u_m("755"),
      depth_search => u_recurse_basedir("inf"),
      ifvarclass => and(strcmp($(sys.workdir), "/var/cfengine")),
      action => u_immediate;

      "$(sys.workdir)/lib"
      comment => "Make sure cfengine libraries have right file permissions",
      handle => "cfe_internal_update_policy_files_sys_workdir_lib",
      perms => u_shared_lib_perms,
      depth_search => u_recurse_basedir("inf"),
      action => u_immediate;

      "/usr/local/sbin/$(agents)"
      comment => "Create symlinks of CFE binaries in /usr/local/sbin",
      handle => canonify("cfe_internal_update_policy_files_sbin_$(agents)"),
      move_obstructions => "true",
      link_from => u_ln_s("$(sys.workdir)/bin/$(agents)");

      "/usr/local/sbin/$(agents).cfsaved"
      comment => "Remove all .cfsaved file extension",
      handle => canonify("cfe_internal_update_policy_files_remove_$(agent)_cfsaved"),
      delete => u_tidy;

    am_policy_hub::

      "$(master_location)/."
      comment => "Make sure masterfiles folder has right file permissions",
      handle => "cfe_internal_update_policy_files_sys_workdir_masterfiles",
      perms => u_m($(update_def.masterfiles_perms_mode)),
      depth_search => u_recurse_basedir("inf"),
      action => u_immediate;

}

#########################################################
# Self-contained bodies from the lib to avoid dependencies
#########################################################

body perms u_m(p)
{
      mode  => "$(p)";
}

#########################################################

body perms u_mo(p,o)
{
      mode   => "$(p)";
      owners => {"$(o)"};
}

#########################################################

body perms u_shared_lib_perms
{
    !hpux::
      mode => "0644";
    hpux::
      mode => "0755"; # Mantis 1114, Redmine 1179
}

#########################################################

body file_select u_cf3_files
{
      leaf_name => { "cf-.*" };
      file_result => "leaf_name";
}

#########################################################

body file_select u_input_files
{
      leaf_name => { @(update_def.input_name_patterns) };
      file_result => "leaf_name";
}

#########################################################

body copy_from u_rcp(from,server)
{
      source      => "$(from)";
      compare     => "digest";
      trustkey    => "false";

    !am_policy_hub::

      servers => { "$(server)" };

    cfengine_internal_encrypt_transfers::
      encrypt => "true";

    cfengine_internal_purge_policies::
      purge => "true";
}

#########################################################

body copy_from u_cp(from)
{
      source  => "$(from)";
      compare => "digest";
}

#########################################################

body copy_from u_cp_nobck(from)
{
      source      => "$(from)";
      compare     => "digest";
      copy_backup => "false";
}

#########################################################

body action u_immediate
{
      ifelapsed => "0";
}

#########################################################

body depth_search u_recurse(d)
{
      depth => "$(d)";
      exclude_dirs => { "\.svn", "\.git", "git-core" };
}

#########################################################

body depth_search u_recurse_basedir(d)
{
      include_basedir => "true";
      depth => "$(d)";
      exclude_dirs => { "\.svn", "\.git", "git-core" };
}

#########################################################

body classes u_if_repaired(x)
{
      promise_repaired => { "$(x)" };
}

#########################################################

body classes u_if_repaired_then_cancel(y)
{
      cancel_repaired => { "$(y)" };
}

#########################################################

body classes u_if_else(yes,no)
{
#      promise_kept     => { "$(yes)" };
      promise_repaired => { "$(yes)" };
      repair_failed    => { "$(no)" };
      repair_denied    => { "$(no)" };
      repair_timeout   => { "$(no)" };
}

#########################################################

body contain u_in_shell
{
      useshell => "true";
}

#########################################################

body contain u_in_shell_and_silent
{
      useshell => "true";
      no_output => "true";
}

########################################################""

body contain u_postgres
{
  useshell   => "useshell";
  exec_owner => "cfpostgres";
  chdir      => "/tmp";
  no_output  => "true";
}

#########################################################

body action u_ifwin_bg
{
    windows::
      background => "true";
}

#########################################################

body service_method u_bootstart
{
      service_autostart_policy => "boot_time";
}

#########################################################

body contain u_silent_in_dir(s)
{
      chdir => "$(s)";
      no_output => "true";
}

#########################################################

body link_from u_ln_s(x)
{
      link_type => "symlink";
      source => "$(x)";
      when_no_source => "force";
}

#########################################################

body delete u_tidy
{
      dirlinks => "delete";
      rmdirs   => "true";
}

#########################################################