manifests/site.pp

   1 Package {
   2     require => File["/etc/apt/apt.conf.d/local-recommends"]
   3 }
   4
   5 File {
   6     owner   => root,
   7     group   => root,
   8     mode    => 444,
   9     ensure  => file,
  10 }
  11
  12 Exec {
  13     path => "/usr/bin:/usr/sbin:/bin:/sbin"
  14 }
  15
  16 node default {
  17     $localinfo = yamlinfo('*', "/etc/puppet/modules/debian-org/misc/local.yaml")
  18     $nodeinfo  = nodeinfo($fqdn, "/etc/puppet/modules/debian-org/misc/local.yaml")
  19     $hoster    = whohosts($nodeinfo, "/etc/puppet/modules/debian-org/misc/hoster.yaml")
  20     $keyinfo   = allnodeinfo("sshRSAHostKey", "ipHostNumber")
  21     notice("hoster for ${fqdn} is ${hoster}")
  22
  23     $mxinfo   = allnodeinfo("mXRecord")
  24
  25     include munin-node
  26     include sudo
  27     include ssh
  28     include debian-org
  29     include monit
  30     include apt-keys
  31     include ntp
  32     include ssl
  33
  34     include motd
  35
  36     case $hostname {
  37         finzi,fano,fasch,field:    { include kfreebsd }
  38     }
  39
  40     case $smartarraycontroller {
  41         "true":    { include debian-proliant }
  42     }
  43     case $kvmdomain {
  44         "true":    { package { acpid: ensure => installed } }
  45     }
  46     case $mptraid {
  47         "true":    { include "raidmpt" }
  48     }
  49
  50     case $mta {
  51         "exim4":   {
  52              case extractnodeinfo($nodeinfo, 'heavy_exim') {
  53                   'true':  { include exim::mx }
  54                   default: { include exim }
  55              }
  56         }
  57     }
  58
  59     case extractnodeinfo($nodeinfo, 'muninmaster') {
  60         true: { include munin-node::master }
  61     }
  62
  63     case extractnodeinfo($nodeinfo, 'nagiosmaster') {
  64         true:    { include nagios::server }
  65         default: { include nagios::client }
  66     }
  67
  68     case $apache2 {
  69          "true":  {
  70               case extractnodeinfo($nodeinfo, 'apache2_security_mirror') {
  71                      true:    { include apache2::security_mirror }
  72                      default: { include apache2 }
  73               }
  74          }
  75     }
  76
  77     case extractnodeinfo($nodeinfo, 'buildd') {
  78          'true':  {
  79              include buildd
  80              case $kernel {
  81                  Linux: {
  82                      include ferm
  83                  }
  84              }
  85          }
  86     }
  87
  88     case $hostname {
  89         klecker,ravel,senfl,orff: { include named::secondary }
  90         geo1,geo2,geo3:           { include named::geodns }
  91         bartok,schein,steffani,franck:   { include named::recursor }
  92     }
  93
  94     case $hostname {
  95         franck,powell,logtest01,geo1,geo2,geo3,bartok,senfl,beethoven,piatti,saens,villa,lobos,raff,gluck,schein,wieck,steffani,ball,handel,tchaikovsky,heininen,nielsen,kokkonen,kaufmann: { include ferm }
  96     }
  97
  98     case $hostname {
  99         agricola,albeniz,gabrielli,merulo,paer,pergolesi,pescetti,smetana,sperger,zee,zelenka: { include ferm }
 100     }
 101     case $hostname {
 102         orff,duarte,soler,lindberg: { include ferm }
 103     }
 104
 105     case $hostname {
 106         zandonai,zelenka: {
 107            @ferm::rule { "dsa-zivit-rrdcollect":
 108                description  => "port 6666 for rrdcollect for zivit",
 109                rule         => "&SERVICE_RANGE(tcp, 6666, ( 10.130.18.71 ))"
 110            }
 111            @ferm::rule { "dsa-zivit-zabbix":
 112                description  => "port 10050 for zabbix for zivit",
 113                rule         => "&SERVICE_RANGE(tcp, 10050, ( 10.130.18.76 ))"
 114            }
 115         }
 116         piatti: {
 117            @ferm::rule { "dsa-udd-stunnel":
 118                description  => "port 8080 for udd stunnel",
 119                rule         => "&SERVICE_RANGE(tcp, http-alt, ( 192.25.206.16 70.103.162.29 217.196.43.134 ))"
 120            }
 121         }
 122         senfl: {
 123            @ferm::rule { "dsa-rsync":
 124                     domain          => "(ip ip6)",
 125                     description     => "Allow rsync access",
 126                     rule            => "&SERVICE(tcp, 873)"
 127            }
 128         }
 129         saens,villa,lobos,raff,gluck,schein,wieck,steffani,franck: {
 130            @ferm::rule { "dsa-ftp":
 131                     domain          => "(ip ip6)",
 132                     description     => "Allow ftp access",
 133                     rule            => "&SERVICE(tcp, 21)"
 134            }
 135            @ferm::rule { "dsa-rsync":
 136                     domain          => "(ip ip6)",
 137                     description     => "Allow rsync access",
 138                     rule            => "&SERVICE(tcp, 873)"
 139            }
 140         }
 141         ancina,zelenka: {
 142            @ferm::rule { "dsa-time":
 143                     description     => "Allow time access",
 144                     rule            => "&SERVICE_RANGE(tcp, time, \$HOST_NAGIOS_V4)"
 145            }
 146         }
 147         handel: {
 148            @ferm::rule { "dsa-puppet":
 149                     description     => "Allow puppet access",
 150                     rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V4)"
 151            }
 152            @ferm::rule { "dsa-puppet-v6":
 153                     domain          => 'ip6',
 154                     description     => "Allow puppet access",
 155                     rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V6)"
 156            }
 157         }
 158         powell: {
 159            @ferm::rule { "dsa-powell-v6-tunnel":
 160                     description     => "Allow powell to use V6 tunnel broker",
 161                     rule            => "proto ipv6 saddr 212.227.117.6 jump ACCEPT"
 162            }
 163            @ferm::rule { "dsa-powell-btseed":
 164                     domain          => "(ip ip6)",
 165                     description     => "Allow powell to seed BT",
 166                     rule            => "proto tcp dport 8000:8100 jump ACCEPT"
 167            }
 168            @ferm::rule { "dsa-powell-rsync":
 169                     description     => "Hoster wants to sync from here, and why not",
 170                     rule            => "&SERVICE_RANGE(tcp, rsync, ( 195.20.242.90 192.25.206.33 82.195.75.106 206.12.19.118 ))"
 171            }
 172         }
 173         beethoven: {
 174            @ferm::rule { "dsa-merikanto-beethoven":
 175                     description     => "Allow merikanto",  # for nfs, and that uses all kind of ports by default.
 176                     rule            => "source 172.22.127.147 interface bond0 jump ACCEPT",
 177            }
 178         }
 179         heininen: {
 180            @ferm::rule { "dsa-syslog":
 181                     description     => "Allow syslog access",
 182                     rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V4)"
 183            }
 184            @ferm::rule { "dsa-syslog-v6":
 185                     domain          => 'ip6',
 186                     description     => "Allow syslog access",
 187                     rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V6)"
 188            }
 189         }
 190         kaufmann: {
 191            @ferm::rule { "dsa-hkp":
 192                     domain          => "(ip ip6)",
 193                     description     => "Allow hkp access",
 194                     rule            => "&SERVICE(tcp, 11371)"
 195            }
 196            @ferm::rule { "dsa-rsync":
 197                     domain          => "(ip ip6)",
 198                     description     => "Allow rsync access",
 199                     rule            => "&SERVICE(tcp, 873)"
 200            }
 201         }
 202     }
 203     case $brokenhosts {
 204         "true":    { include hosts }
 205     }
 206     case $hoster {
 207         "ubcece", "darmstadt", "ftcollins", "grnet":  { include resolv }
 208     }
 209     case $portforwarder_user_exists {
 210         "true":    { include portforwarder }
 211     }
 212     include samhain
 213 }