X-Git-Url: https://git.donarmstrong.com/?a=blobdiff_plain;f=manifests%2Fsite.pp;h=895a84dd1f2d7c31165e7b1bec6990a8fe684d0f;hb=a07d3c87c702f358bd36d52f423c1f437307b015;hp=d64d5bd0fcb2ca808aa82bf3533401e03192efd1;hpb=dc355894c399a51dd66bcdfbc6311c709d627d08;p=dsa-puppet.git diff --git a/manifests/site.pp b/manifests/site.pp index d64d5bd0..895a84dd 100644 --- a/manifests/site.pp +++ b/manifests/site.pp @@ -16,13 +16,13 @@ Exec { node default { $localinfo = yamlinfo('*', "/etc/puppet/modules/debian-org/misc/local.yaml") $nodeinfo = nodeinfo($fqdn, "/etc/puppet/modules/debian-org/misc/local.yaml") - $hoster = whohosts($nodeinfo, "/etc/puppet/modules/debian-org/misc/hoster.yaml") - $keyinfo = allnodeinfo("sshRSAHostKey", "ipHostNumber") - notice("hoster for ${fqdn} is ${hoster}") - - $mxinfo = allnodeinfo("mXRecord") + $hosterinfo = whohosts($nodeinfo, "/etc/puppet/modules/debian-org/misc/hoster.yaml") + $keyinfo = allnodeinfo("sshRSAHostKey", "ipHostNumber", "purpose") + $mxinfo = allnodeinfo("mXRecord") + notice("hoster for ${fqdn} is ${getfromhash(hosterinfo, "name")}") include munin-node + include syslog-ng include sudo include ssh include debian-org @@ -41,7 +41,12 @@ node default { "true": { include debian-proliant } } case $kvmdomain { - "true": { package { acpid: ensure => installed } } + "true": { + package { acpid: ensure => installed } + case extractnodeinfo($nodeinfo, 'squeeze') { + true: { package { acpi-support-base: ensure => installed } } + } + } } case $mptraid { "true": { include "raidmpt" } @@ -50,12 +55,16 @@ node default { case $mta { "exim4": { case extractnodeinfo($nodeinfo, 'heavy_exim') { - 'true': { include exim::mx } + true: { include exim::mx } default: { include exim } } } } + case extractnodeinfo($nodeinfo, 'puppetmaster') { + true: { include puppetmaster } + } + case extractnodeinfo($nodeinfo, 'muninmaster') { true: { include munin-node::master } } @@ -69,145 +78,80 @@ node default { "true": { case extractnodeinfo($nodeinfo, 'apache2_security_mirror') { true: { include apache2::security_mirror } - default: { include apache2 } } + case extractnodeinfo($nodeinfo, 'apache2_www_mirror') { + true: { include apache2::www_mirror } + } + include apache2 } } - case extractnodeinfo($nodeinfo, 'buildd') { - 'true': { - include buildd - case $kernel { - Linux: { - include ferm - } - } - } + case $rsyncd { + "true": { include rsyncd-log } } - case $hostname { - klecker,ravel,senfl,orff: { include named::secondary } - geo1,geo2,geo3: { include named::geodns } - bartok,schein,steffani,franck: { include named::recursor } - } - case $hostname { - franck,powell,logtest01,geo1,geo2,geo3,bartok,senfl,beethoven,piatti,saens,villa,lobos,raff,gluck,schein,wieck,steffani,ball,handel,tchaikovsky,heininen,nielsen,kokkonen,kaufmann: { include ferm } + case extractnodeinfo($nodeinfo, 'buildd') { + true: { + include buildd + } } case $hostname { - agricola,albeniz,gabrielli,merulo,paer,pergolesi,pescetti,smetana,sperger,zee,zelenka: { include ferm } - } - case $hostname { - orff,duarte,soler,lindberg,morricone,respighi,scelsi,valente,vitry,vivaldi,wolkenstein: { include ferm } + klecker,ravel,senfl,orff,draghi: { include named::authoritative } + geo1,geo2,geo3: { include named::geodns } + franck,liszt,master,samosa,schein,spohr,steffani,widor: { include named::recursor } + } + + case $kernel { + Linux: { + include ferm + include ferm::per-host + case $rsyncd { + "true": { include ferm::rsync } + } + } } case $hostname { - zandonai,zelenka: { - @ferm::rule { "dsa-zivit-rrdcollect": - description => "port 6666 for rrdcollect for zivit", - rule => "&SERVICE_RANGE(tcp, 6666, ( 10.130.18.71 ))" - } - @ferm::rule { "dsa-zivit-zabbix": - description => "port 10050 for zabbix for zivit", - rule => "&SERVICE_RANGE(tcp, 10050, ( 10.130.18.76 ))" - } + beethoven,ravel,spohr,stabile: { + include nfs-server } - piatti: { - @ferm::rule { "dsa-udd-stunnel": - description => "port 8080 for udd stunnel", - rule => "&SERVICE_RANGE(tcp, http-alt, ( 192.25.206.16 70.103.162.29 217.196.43.134 ))" - } - } - senfl: { - @ferm::rule { "dsa-rsync": - domain => "(ip ip6)", - description => "Allow rsync access", - rule => "&SERVICE(tcp, 873)" - } - } - saens,villa,lobos,raff,gluck,schein,wieck,steffani,franck,morricone,valente: { - @ferm::rule { "dsa-ftp": - domain => "(ip ip6)", - description => "Allow ftp access", - rule => "&SERVICE(tcp, 21)" - } - @ferm::rule { "dsa-rsync": - domain => "(ip ip6)", - description => "Allow rsync access", - rule => "&SERVICE(tcp, 873)" - } - } - ancina,zelenka: { - @ferm::rule { "dsa-time": - description => "Allow time access", - rule => "&SERVICE_RANGE(tcp, time, \$HOST_NAGIOS_V4)" - } - } - handel: { - @ferm::rule { "dsa-puppet": - description => "Allow puppet access", - rule => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V4)" - } - @ferm::rule { "dsa-puppet-v6": - domain => 'ip6', - description => "Allow puppet access", - rule => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V6)" - } - } - powell: { - @ferm::rule { "dsa-powell-v6-tunnel": - description => "Allow powell to use V6 tunnel broker", - rule => "proto ipv6 saddr 212.227.117.6 jump ACCEPT" - } - @ferm::rule { "dsa-powell-btseed": - domain => "(ip ip6)", - description => "Allow powell to seed BT", - rule => "proto tcp dport 8000:8100 jump ACCEPT" - } - @ferm::rule { "dsa-powell-rsync": - description => "Hoster wants to sync from here, and why not", - rule => "&SERVICE_RANGE(tcp, rsync, ( 195.20.242.90 192.25.206.33 82.195.75.106 206.12.19.118 ))" - } - } - beethoven: { - @ferm::rule { "dsa-merikanto-beethoven": - description => "Allow merikanto", # for nfs, and that uses all kind of ports by default. - rule => "source 172.22.127.147 interface bond0 jump ACCEPT", - } - } - heininen: { - @ferm::rule { "dsa-syslog": - description => "Allow syslog access", - rule => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V4)" - } - @ferm::rule { "dsa-syslog-v6": - domain => 'ip6', - description => "Allow syslog access", - rule => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V6)" - } - } - kaufmann: { - @ferm::rule { "dsa-hkp": - domain => "(ip ip6)", - description => "Allow hkp access", - rule => "&SERVICE(tcp, 11371)" - } - @ferm::rule { "dsa-rsync": - domain => "(ip ip6)", - description => "Allow rsync access", - rule => "&SERVICE(tcp, 873)" - } - } } + case $brokenhosts { "true": { include hosts } } - case $hoster { + case getfromhash($hosterinfo, "name") { "ubcece", "darmstadt", "ftcollins", "grnet": { include resolv } } case $portforwarder_user_exists { "true": { include portforwarder } } + include samhain + + case $hostname { + byrd,schuetz,tchaikovsky: { + include krb + } + draghi,quantz: { + include krb + include afs + } + lamb,locke,rautavaara,rietz: { + include krb + include afs::server + } + } + + case $hostname { + chopin,geo3,soler,wieck: { + include debian-radvd + } + } } + +# vim:set et: +# vim:set sts=4 ts=4: +# vim:set shiftwidth=4: