class pantin::potatofs(
	$s3_endpoint,
	$s3_bucket,
	$s3_region = 'auto',
	Sensitive $s3_access_key_id,
	Sensitive $s3_secret_access_key,
	$backend_bytes,
	Integer $cache_part_size_mb = 2*1024,
	Integer $slab_max_age_seconds = 300,
	Integer $max_preload_per_hint = 50,
) {
	# We choose ext4 because historically XFS has relied on the underlying
	# hardware to properly implement write barriers. Since we run in the
	# cloud, we can make no assumptions on how hardware/power is handled
	# and thus pick the safest option (ext4).
	package { [ 'potatofs', 'potatofs-backend-s3', 'awscli' ]:
		ensure => present,
	} ->
	file { '/etc/fuse.conf':
		mode => '0644',
		owner => 'root',
		group => 'root',
		content => "user_allow_other\n",
	} ->
	exec { 'lvm-potatofs':
		command => "lvcreate -L${cache_part_size_mb}m -y -n potatofs sys && mkfs.ext4 /dev/sys/potatofs",
		creates => '/dev/sys/potatofs',
	} ->
	group { 'potatofs':
		system => true,
	} ->
	user { 'potatofs':
		gid => 'potatofs',
		system => true,
		shell => '/usr/sbin/nologin',
		home => '/var/potatofs',
	} ->
	file { '/var/potatofs':
		mode => '0700',
		owner => 'potatofs',
		group => 'potatofs',
		ensure => directory,
	} ->
	mount { '/var/potatofs':
		ensure => 'mounted',
		device => '/dev/sys/potatofs',
		fstype => 'ext4',
		options => 'defaults,noatime',
		remounts => true,
	} ->
	exec { 'fix-var-potatofs-perms':
		command => 'chown potatofs:potatofs /var/potatofs && chmod 700 /var/potatofs',
		onlyif => '[ "`stat -c %U /var/potatofs`" != "potatofs" ]',
	} ->
	file { '/var/potatofs/.aws':
		mode => '0700',
		owner => 'potatofs',
		group => 'potatofs',
		ensure => directory,
	} ->
	file { '/mnt/potatofs':
		mode => '0755',
		owner => 'potatofs',
		group => 'potatofs',
		ensure => directory,
	} ->
	file { '/etc/potatofs':
		mode => '0755',
		owner => 'root',
		group => 'root',
		ensure => directory,
	} ->
	exec { 'potatofs-backend-secret':
		command => 'dd if=/dev/random of=/etc/potatofs/backend.secret bs=1 count=32',
		umask => '0077',
		creates => '/etc/potatofs/backend.secret',
	} ->
	file { '/etc/potatofs/backend.secret':
		mode => '0640',
		owner => 'root',
		group => 'potatofs',
		ensure => present,
	} ->
	file { '/etc/potatofs/potatofs.conf':
		mode => '0644',
		owner => 'root',
		group => 'root',
		content => template('pantin/etc/potatofs/potatofs.conf.erb'),
	} ->
	file { '/etc/potatofs.conf':
		target => '/etc/potatofs/potatofs.conf',
		ensure => 'link',
	} ->
	file { '/etc/potatofs/backend_s3.conf':
		mode => '0640',
		owner => 'root',
		group => 'potatofs',
		content => Sensitive(template('pantin/etc/potatofs/backend_s3.conf.erb')),
	} ->
	file { '/var/potatofs/.aws/credentials':
		mode => '0600',
		owner => 'potatofs',
		group => 'potatofs',
		content => Sensitive(template('pantin/var/potatofs/dotaws/credentials.erb')),
	} ->
	file { '/var/potatofs/.aws/config':
		mode => '0644',
		owner => 'potatofs',
		group => 'potatofs',
		content => Sensitive(template('pantin/var/potatofs/dotaws/config.erb')),
	} ->
	exec { 'potatofs-check-bucket':
		# We don't want to proceed with the next steps if we can't
		# head the bucket
		user => 'potatofs',
		command => "aws s3api head-bucket --bucket $s3_bucket && touch /var/potatofs/.aws/.ok",
		creates => '/var/potatofs/.aws/.ok',
	} ->
	file { "/etc/init.d/umount-potatofs":
		mode => '0755',
		content => file('pantin/etc/init.d/umount-potatofs'),
	} ->
	service { 'umount-potatofs':
		enable => true,
		subscribe => File['/etc/init.d/umount-potatofs'],
	} ->
	mount { '/mnt/potatofs':
		ensure => 'mounted',
		device => '/usr/bin/potatofs',
		fstype => 'fuse',
		options => 'nofail,_netdev,user,setuid=potatofs,allow_other,cfg_path=/etc/potatofs/potatofs.conf',
		remounts => false,
	}
}
