modules/debian-org/manifests/init.pp

   1 define sysctl($key, $value, $ensure=present) {
   2     file { "/etc/sysctl.d/$name.conf":
   3         ensure  => $ensure,
   4         owner   => root,
   5         group   => root,
   6         mode    => 0644,
   7         content => "$key = $value\n",
   8         notify  => Exec["procps restart"],
   9     }
  10 }
  11
  12 define set_alternatives($linkto) {
  13         exec { "/usr/sbin/update-alternatives --set $name $linkto":
  14             unless => "/bin/sh -c '! [ -e $linkto ] || ! [ -e /etc/alternatives/$name ] || ([ -L /etc/alternatives/$name ] && [ /etc/alternatives/$name -ef $linkto ])'"
  15         }
  16 }
  17
  18
  19 class debian-org {
  20    package { "userdir-ldap": ensure => installed;
  21              "zsh": ensure => installed;
  22              "cron": ensure => installed;
  23              "apt-utils": ensure => installed;
  24              "tcsh": ensure => installed;
  25              "pdksh": ensure => installed;
  26              "ksh": ensure => installed;
  27              "csh": ensure => installed;
  28              "ntp": ensure => installed;
  29              "locales-all": ensure => installed;
  30              "libpam-pwdfile": ensure => installed;
  31              "vim": ensure => installed;
  32              "gnupg": ensure => installed;
  33              "bzip2": ensure => installed;
  34              "less": ensure => installed;
  35              "ed": ensure => installed;
  36              "puppet": ensure => installed;
  37              "mtr-tiny": ensure => installed;
  38              "nload": ensure => installed;
  39              "pciutils": ensure => installed;
  40              "dnsutils": ensure => installed;
  41              "bash-completion": ensure => installed;
  42              "libfilesystem-ruby1.8": ensure => installed;
  43              "syslog-ng": ensure => installed;
  44              "sysklogd": ensure => purged;
  45              "klogd": ensure => purged;
  46              "rsyslog": ensure => purged;
  47    }
  48    file {
  49       "/etc/apt/preferences":
  50              source => "puppet:///files/etc/apt/preferences";
  51       "/etc/apt/sources.list.d/backports.org.list":
  52              source => "puppet:///files/etc/apt/sources.list.d/backports.org.list",
  53              notify  => Exec["apt-get update"];
  54       "/etc/apt/sources.list.d/debian.org.list":
  55              source => "puppet:///files/etc/apt/sources.list.d/debian.org.list",
  56              notify  => Exec["apt-get update"];
  57       "/etc/apt/sources.list.d/security.list":
  58              source => "puppet:///files/etc/apt/sources.list.d/security.list",
  59              notify  => Exec["apt-get update"];
  60       "/etc/apt/sources.list.d/volatile.list":
  61              source => "puppet:///files/etc/apt/sources.list.d/volatile.list",
  62              notify  => Exec["apt-get update"];
  63       "/etc/apt/apt.conf.d/local-recommends":
  64              source => "puppet:///files/etc/apt/apt.conf.d/local-recommends";
  65       "/etc/apt/apt.conf.d/local-pdiffs":
  66              source => "puppet:///files/etc/apt/apt.conf.d/local-pdiffs";
  67       "/etc/timezone":
  68              source => "puppet:///files/etc/timezone",
  69              notify => Exec["dpkg-reconfigure tzdata -pcritical -fnoninteractive"];
  70       "/etc/puppet/puppet.conf":
  71              source => "puppet:///files/etc/puppet/puppet.conf"
  72              ;
  73       "/etc/default/puppet":
  74              source => "puppet:///files/etc/default/puppet"
  75              ;
  76
  77       "/etc/syslog-ng/syslog-ng.conf":
  78              source => "puppet:///files/etc/syslog-ng/syslog-ng.conf",
  79              notify  => Exec["syslog-ng reload"],
  80              ;
  81       "/etc/logrotate.d/syslog-ng":
  82              source => "puppet:///files/etc/logrotate.d/syslog-ng",
  83              ;
  84       "/etc/cron.d/dsa-puppet-stuff":
  85              source => "puppet:///files/etc/cron.d/dsa-puppet-stuff",
  86              require => Package["cron"]
  87              ;
  88       "/etc/ldap/ldap.conf":
  89              source => "puppet:///files/etc/ldap/ldap.conf",
  90              ;
  91       "/etc/pam.d/common-session":
  92              source => "puppet:///files/etc/pam.d/common-session",
  93              ;
  94    }
  95    case $hostname {
  96         handel: {
  97             file {
  98                "/etc/puppet/lib":
  99                       ensure  => directory,
 100                       source => "puppet:///files/etc/puppet/lib",
 101                       recurse => true,
 102                       notify  => Exec["puppetmaster restart"];
 103             }
 104         }
 105         default: {}
 106    }
 107
 108    # set mmap_min_addr to 4096 to mitigate
 109    # Linux NULL-pointer dereference exploits
 110    sysctl { "mmap_min_addr" :
 111              key         => "vm.mmap_min_addr",
 112              value       => 4096,
 113    }
 114
 115    set_alternatives { "editor":
 116            linkto => "/usr/bin/vim.basic",
 117    }
 118
 119    exec { "syslog-ng reload":
 120              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 121              refreshonly => true,
 122    }
 123    exec { "dpkg-reconfigure tzdata -pcritical -fnoninteractive":
 124            path        => "/usr/bin:/usr/sbin:/bin:/sbin",
 125            refreshonly => true,
 126    }
 127    exec { "apt-get update":
 128              command => 'apt-get update',
 129              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 130              refreshonly => true
 131    }
 132    exec { "puppetmaster restart":
 133              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 134              refreshonly => true,
 135    }
 136    exec { "procps restart":
 137              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 138              refreshonly => true,
 139    }
 140 }
 141
 142 class debian-proliant inherits debian-org {
 143    package {
 144       "hpacucli": ensure => installed;
 145       "cpqarrayd": ensure => installed;
 146       "arrayprobe": ensure => installed;
 147    }
 148    file {
 149       "/etc/apt/sources.list.d/debian.restricted.list":
 150              source => "puppet:///files/etc/apt/sources.list.d/debian.restricted.list",
 151              notify  => Exec["apt-get update"];
 152    }
 153 }