class openstack_tasks::swift::proxy_storage {

  notice('MODULAR: swift/proxy_storage.pp')

  $network_scheme             = hiera_hash('network_scheme', {})
  $network_metadata           = hiera_hash('network_metadata', {})
  prepare_network_config($network_scheme)

  $swift_hash                 = hiera_hash('swift')
  $swift_master_role          = hiera('swift_master_role', 'primary-controller')
  $swift_nodes                = hiera_hash('swift_nodes', {})
  $swift_operator_roles       = pick($swift_hash['swift_operator_roles'], ['admin', 'SwiftOperator', '_member_'])
  $swift_host_ip_map          = get_node_to_ipaddr_map_by_network_role(hiera_hash('swift_proxies', {}), 'swift/api')
  $swift_proxies_addr_list    = sorted_hosts($swift_host_ip_map, 'ip', 'ip')
  $memcached_servers          = hiera('memcached_servers')
  $is_primary_swift_proxy     = hiera('is_primary_swift_proxy', false)
  $proxy_port                 = hiera('proxy_port', '8080')
  $storage_hash               = hiera_hash('storage')
  $management_vip             = hiera('management_vip')
  $public_ssl_hash            = hiera_hash('public_ssl')
  $swift_api_ipaddr           = get_network_role_property('swift/api', 'ipaddr')
  $swift_storage_ipaddr       = get_network_role_property('swift/replication', 'ipaddr')
  $debug                      = pick($swift_hash['debug'], hiera('debug', false))
  $verbose                    = pick($swift_hash['verbose'], hiera('verbose', false))
# NOTE(mattymo): Changing ring_part_power or part_hours on redeploy leads to data loss
  $ring_part_power            = pick($swift_hash['ring_part_power'], 10)
  $ring_min_part_hours        = hiera('swift_ring_min_part_hours', 1)
  $deploy_swift_proxy         = hiera('deploy_swift_proxy', true)
  $swift_realm1_key           = hiera('swift_realm1_key', 'realm1key')
#Keystone settings
  $keystone_user              = pick($swift_hash['user'], 'swift')
  $keystone_password          = pick($swift_hash['user_password'], 'passsword')
  $keystone_tenant            = pick($swift_hash['tenant'], 'services')
  $workers_max                = hiera('workers_max', $::os_workers)
  $service_workers            = pick($swift_hash['workers'], min(max($::processorcount, 2), $workers_max))
  $ssl_hash                   = hiera_hash('use_ssl', {})
  $rabbit_hash                = hiera_hash('rabbit')
  $transport_url              = hiera('transport_url','rabbit://guest:password@127.0.0.1:5672/')
#storage settings
  $mp_hash                    = hiera('mp')
  $deploy_swift_storage       = hiera('deploy_swift_storage', true)

  $internal_auth_protocol = get_ssl_property($ssl_hash, {}, 'keystone', 'internal', 'protocol', [pick($swift_hash['auth_protocol'], 'http')])
  $internal_auth_address  = get_ssl_property($ssl_hash, {}, 'keystone', 'internal', 'hostname', [hiera('service_endpoint', ''), $management_vip])
  $admin_auth_protocol    = get_ssl_property($ssl_hash, {}, 'keystone', 'admin', 'protocol', [pick($swift_hash['auth_protocol'], 'http')])
  $admin_auth_address     = get_ssl_property($ssl_hash, {}, 'keystone', 'admin', 'hostname', [hiera('service_endpoint', ''), $management_vip])

  $auth_uri     = "${internal_auth_protocol}://${internal_auth_address}:5000/"
  $identity_uri = "${admin_auth_protocol}://${admin_auth_address}:35357/"

  $swift_internal_protocol = get_ssl_property($ssl_hash, {}, 'swift', 'internal', 'protocol', 'http')
  $swift_internal_address  = get_ssl_property($ssl_hash, {}, 'swift', 'internal', 'hostname', [$swift_api_ipaddr, $management_vip])
  $swift_public_protocol   = get_ssl_property($ssl_hash, $public_ssl_hash, 'swift', 'public', 'protocol', 'http')
  $swift_public_address    = get_ssl_property($ssl_hash, $public_ssl_hash, 'swift', 'public', 'hostname', [hiera('public_vip')])

  $swift_url_base = "${swift_public_protocol}:"

  $swift_proxies_num = size(hiera('swift_proxies'))

# Use Swift if it isn't replaced by Ceph for BOTH images and objects
  $master_swift_proxy_nodes      = get_nodes_hash_by_roles($network_metadata, [$swift_master_role])
  $master_swift_proxy_nodes_list = values($master_swift_proxy_nodes)
  $master_swift_proxy_ip         = regsubst($master_swift_proxy_nodes_list[0]['network_roles']['swift/api'], '\/\d+$', '')
  $master_swift_replication_ip   = regsubst($master_swift_proxy_nodes_list[0]['network_roles']['swift/replication'], '\/\d+$', '')
  $swift_partition               = hiera('swift_partition', '/var/lib/glance/node')

  if $is_primary_swift_proxy {
    ring_devices {'all':
      storages => $swift_nodes,
      require  => Class['swift'],
    }
  }

  if ($swift_proxies_num < 2) {
    $ring_replicas = 2
  } else {
    $ring_replicas = 3
  }

  if $deploy_swift_proxy {
    class { 'openstack_tasks::swift::parts::proxy':
      swift_user_password            => $swift_hash['user_password'],
      swift_operator_roles           => $swift_operator_roles,
      memcached_servers              => $memcached_servers,
      ring_part_power                => $ring_part_power,
      ring_replicas                  => $ring_replicas,
      primary_proxy                  => $is_primary_swift_proxy,
      swift_proxy_local_ipaddr       => $swift_api_ipaddr,
      swift_replication_local_ipaddr => $swift_storage_ipaddr,
      master_swift_proxy_ip          => $master_swift_proxy_ip,
      master_swift_replication_ip    => $master_swift_replication_ip,
      proxy_port                     => $proxy_port,
      proxy_workers                  => $service_workers,
      debug                          => $debug,
      verbose                        => $verbose,
      log_facility                   => 'LOG_SYSLOG',
      ceilometer                     => hiera('use_ceilometer',false),
      ring_min_part_hours            => $ring_min_part_hours,
      admin_user                     => $keystone_user,
      admin_tenant_name              => $keystone_tenant,
      admin_password                 => $keystone_password,
      auth_host                      => $internal_auth_address,
      auth_protocol                  => $internal_auth_protocol,
      auth_uri                       => $auth_uri,
      identity_uri                   => $identity_uri,
      transport_url                  => $transport_url,
      swift_url_base                 => $swift_url_base,
    }

    # Check swift proxy and internal VIP are from the same IP network. If no
    # then it's possible to get network failure, so proxy couldn't access
    # Keystone via VIP. In such cases swift health check returns OK, but all
    # requests forwarded from HAproxy fail, see LP#1459772 In order to detect
    # such bad swift backends we enable a service which checks Keystone
    # availability from swift node. HAProxy monitors that service to get
    # proper backend status.
    # NOTE: this is the same logic in the HAproxy configuration so if it's
    # updated there, this must be updated. See LP#1548275
    $swift_api_network = get_network_role_property('swift/api', 'network')
    $bind_to_one       = has_ip_in_network($management_vip, $swift_api_network)

    if !$bind_to_one {
      $storage_nets = get_routable_networks_for_network_role($network_scheme, 'swift/replication', ' ')
      $mgmt_nets = get_routable_networks_for_network_role($network_scheme, 'swift/api', ' ')

      class { 'openstack_tasks::swift::parts::status':
        endpoint    => "${swift_internal_protocol}://${swift_internal_address}:${proxy_port}",
        scan_target => "${internal_auth_address}:5000",
        only_from   => "127.0.0.1 240.0.0.2 ${storage_nets} ${mgmt_nets}",
        con_timeout => 5
      }

      Class['openstack_tasks::swift::parts::status'] -> Class['swift::dispersion']
    }

    class { 'swift::dispersion':
      auth_url     => "${internal_auth_protocol}://${internal_auth_address}:5000/v2.0/",
      auth_user    =>  $keystone_user,
      auth_tenant  =>  $keystone_tenant,
      auth_pass    =>  $keystone_password,
      auth_version =>  '2.0',
    }

    Class['openstack_tasks::swift::parts::proxy'] -> Class['swift::dispersion']
    Service<| tag == 'swift-service' |> -> Class['swift::dispersion']
  }

  if $deploy_swift_storage {
    if !defined(File['/var/lib/glance']) {
      file {'/var/lib/glance':
        ensure  => 'directory',
        group   => 'glance',
        require => Package['swift'],
      } -> Service <| tag == 'swift-service' |>
    } else {
      File['/var/lib/glance'] {
        ensure  => 'directory',
        group   => 'glance',
        require +> Package['swift'],
      }
      File['/var/lib/glance'] -> Service <| tag == 'swift-service' |>
    }

    class { 'openstack_tasks::swift::parts::storage_node':
      storage_type                => false,
      loopback_size               => '5243780',
      storage_mnt_base_dir        => $swift_partition,
      storage_devices             => filter_hash($mp_hash,'point'),
      swift_zone                  => $master_swift_proxy_nodes_list[0]['swift_zone'],
      swift_local_net_ip          => $swift_storage_ipaddr,
      master_swift_proxy_ip       => $master_swift_proxy_ip,
      master_swift_replication_ip => $master_swift_replication_ip,
      sync_rings                  => ! $is_primary_swift_proxy,
      debug                       => $debug,
      verbose                     => $verbose,
      log_facility                => 'LOG_SYSLOG',
    }

    # TODO(mmalchuk) remove this 'unless' workaround made for LP#1610947 after
    # corresponding Trusty packages in upstream backported from Xenial or even
    # the whole block with services when they would be controlled by the swift
    # puppet module (for example as in the LP#1554835) in Xenial or later
    unless ($::os_package_type == 'ubuntu' and $::operatingsystemrelease =~ /^14/) {
      service { 'swift-container-reconciler':
        ensure  => stopped,
        enable  => false,
        require => Package['swift-container'],
      }
      service { 'swift-object-reconstructor':
        ensure  => stopped,
        enable  => false,
        require => Package['swift-object'],
      }
    }
  }

  # We need this line for proper upgrade process LP#1619282
  User <| title == swift |> { groups +> ['glance'] }

  # swift_container_sync_realms file specifying
  # the allowable clusters and their information.
  # Changes in this file don't require restart services.
  # This config should be present on proxy and containers nodes.
  if $deploy_swift_storage or $deploy_swift_proxy {
    swift_container_sync_realms_config {
      'realm1/key':           value => $swift_realm1_key;
      'realm1/cluster_name1': value => "${swift_public_protocol}://${swift_public_address}:8080/v1";
    }
  }
}