class pantin::request_tracker(
	Sensitive $web_root_password,
	Array[String] $db_admins = [],
) {
	package { [ 'rt5-fcgi', 'rt5-apache2', 'libapache2-mod-fcgid' ]:
		ensure => purged,
	}

	package { [ 'request-tracker5',
		'rt5-db-postgresql',
		'rt5-doc-html',
		'libio-socket-ssl-perl',
		'spawn-fcgi',
		'w3m',
		]:
		ensure => present,
	} ->
	group { 'rt':
		system => true,
	} ->
	user { 'rt':
		gid => 'rt',
		home => '/var/lib/request-tracker5',
		system => true,
	} ->
	augeas { "rt-membership-www-data":
		context => "/files/etc/group/rt",
		changes => [
			# Set the value to $member at index where $member
			# is (therefore not adding dupes)
			"set user[.='www-data'] www-data",
		],
	} ->
	exec { 'fix-rt-cache-owner':
		command => 'find /var/cache/request-tracker5 -user www-data | xargs chown rt',
		onlyif => '[ ! -z "`find /var/cache/request-tracker5 -user www-data`" ]',
	} ->
	exec { 'fix-rt-cache-group':
		command => 'find /var/cache/request-tracker5 -group www-data | xargs chgrp rt',
		onlyif => '[ ! -z "`find /var/cache/request-tracker5 -group www-data`" ]',
	} ->
	exec { 'fix-rt-lib-owner':
		command => 'find /var/lib/request-tracker5 -user www-data | xargs chown rt',
		onlyif => '[ ! -z "`find /var/lib/request-tracker5 -user www-data`" ]',
	} ->
	exec { 'fix-rt-lib-group':
		command => 'find /var/lib/request-tracker5 -group www-data | xargs chgrp rt',
		onlyif => '[ ! -z "`find /var/lib/request-tracker5 -group www-data`" ]',
	} ->
	file { '/etc/request-tracker5/rt.conf':
		mode => '0644',
		content => template('pantin/etc/request-tracker5/rt.conf.erb'),
	} ->
	file { '/etc/request-tracker5/.root_initial_pw':
		mode => '0640',
		owner => 'root',
		group => 'rt',
		content => lookup('pantin::request_tracker::web_root_password'),
	} ->
	file { '/etc/request-tracker5/RT_SiteConfig.pm':
		mode => '0660',
		owner => 'root',
		group => 'rt',
		ensure => present,
	} ->
	file { '/etc/request-tracker5/RT_SiteConfig.d/50-debconf.pm':
		mode => '0640',
		owner => 'root',
		group => 'rt',
		content => template('pantin/etc/request-tracker5/RT_SiteConfig.d/50-debconf.pm.erb'),
	} ->
	file { '/etc/request-tracker5/RT_SiteConfig.d/60-logging.pm':
		mode => '0644',
		content => "Set(\$LogToSyslog, 'notice');\n",
	} ->
	file { '/etc/request-tracker5/RT_SiteConfig.d/80-appearance.pm':
		mode => '0644',
		content => "Set(\$WebDefaultStylesheet, 'elevator-dark');\n",
	} ->
	file { '/etc/request-tracker5/RT_SiteConfig.d/51-dbconfig-common.pm':
		mode => '0640',
		owner => 'root',
		group => 'rt',
		content => template('pantin/etc/request-tracker5/RT_SiteConfig.d/51-dbconfig-common.pm.erb'),
	} ->
	file { '/etc/request-tracker5/RT_SiteConfig.d/60-external-fields.pm':
		mode => '0644',
		content => template('pantin/etc/request-tracker5/RT_SiteConfig.d/60-external-fields.pm.erb'),
	} ->
	file { '/usr/share/request-tracker5/lib/RT/CustomFieldValues/MinMaxisteClientId.pm':
		mode => '0644',
		content => file('pantin/usr/share/request-tracker5/lib/RT/CustomFieldValues/MinMaxisteClientId.pm'),
	} ->
	pantin::postgresql::hba_user{ 'rt':
		ensure => present,
		type => 'local',
		database => 'rt',
		method => 'peer',
	} ->
	exec { 'create-pgsql-rt-user':
		user => 'postgres',
		command => 'createuser -d -w rt',
		onlyif => '[ -z "`psql -tXAc "SELECT 1 FROM pg_roles WHERE rolname=\'rt\'"`" ]',
	} ->
	exec { 'create-pgsql-rt-db':
		user => 'postgres',
		command => 'createdb -O rt rt',
		unless => 'psql -tXAc \'\l\' | grep -q \'^rt|\'',
	} ->
	exec { 'init-rt-db':
		user => 'rt',
		command => '/usr/sbin/rt-setup-database-5 --action init --skip-create --root-password-file /etc/request-tracker5/.root_initial_pw',
		onlyif => '[ -z "`psql -tXAc \'\d\' rt`" ]',
	} ->
	exec { 'init-rt-fulltext-indexes':
		user => 'rt',
		command => '/usr/sbin/rt-setup-fulltext-index-5 --dba rt',
		unless => 'psql -tXAc \'\d\' rt | grep -q \'^public|attachmentsindex|\'',
	} ->
	file { "/etc/init.d/rt-fcgi":
		mode => '0755',
		content => file('pantin/etc/init.d/rt-fcgi'),
	}

	service { 'rt-fcgi':
		ensure => 'running',
		enable => true,
		subscribe => [
			File['/etc/init.d/rt-fcgi'],
			File['/etc/request-tracker5/RT_SiteConfig.d/50-debconf.pm'],
			File['/etc/request-tracker5/RT_SiteConfig.d/51-dbconfig-common.pm'],
			File['/etc/request-tracker5/RT_SiteConfig.d/60-logging.pm'],
			File['/etc/request-tracker5/RT_SiteConfig.d/60-external-fields.pm'],
			File['/etc/request-tracker5/RT_SiteConfig.d/80-appearance.pm'],
		],
	} ->
	file { '/etc/cron.d/request-tracker5':
		mode => '0755',
		content => template('pantin/etc/cron.d/request-tracker5.erb'),
	}

	pantin::apache_http_server::mod { 'proxy_fcgi':
		ensure => present,
	} ->
	pantin::apache_http_server::www{ 'rt.minmaxiste.com':
		ensure => present,
		template => 'rt',
		docroot => '/var/www/rt',
		require => Service['rt-fcgi'],
	}

	# TODO: eventually enforce client SSL certs instead of ualpn.
	# The REMOTE_USER will be the cert's CN, using mod_ssl's SSLUserName
	# directive, with SSL_CLIENT_S_DN_CN

	mailalias { 'rt':
		ensure => present,
		recipient => '|/usr/bin/rt-mailgate --queue Support --action correspond --url https://rt.minmaxiste.com',
		notify => Exec['refresh-aliases'],
	}
	mailalias { 'rt-comment':
		ensure => present,
		recipient => '|/usr/bin/rt-mailgate --queue Support --action comment --url https://rt.minmaxiste.com',
		notify => Exec['refresh-aliases'],
	}

	pantin::postgresql::hba_user{ 'plalonde-rt':
		ensure => present,
		username => 'plalonde',
		type => 'local',
		database => 'rt',
		method => 'peer',
	}
	pantin::postgresql::hba_user{ 'plalonde-minmaxiste':
		ensure => present,
		username => 'plalonde',
		type => 'local',
		database => 'minmaxiste',
		method => 'peer',
	}
}
