X-Git-Url: https://git.donarmstrong.com/?a=blobdiff_plain;f=modules%2Fapache2%2Fmanifests%2Finit.pp;h=67e6b8bad288a357e84d029bd998e569648a75a5;hb=2628e0868dfe51ea135788ce1c79184a74c1cac6;hp=1775bb2946d72aab0fda5a546d6997f45cdc8244;hpb=7b70c4fcc7827e7589d5b1c792714d36e6170b16;p=dsa-puppet.git diff --git a/modules/apache2/manifests/init.pp b/modules/apache2/manifests/init.pp index 1775bb29..67e6b8ba 100644 --- a/modules/apache2/manifests/init.pp +++ b/modules/apache2/manifests/init.pp @@ -1,241 +1,144 @@ +# = Class: apache2 +# +# Standard apache config debian.org hosts +# +# == Sample Usage: +# +# include apache2 +# class apache2 { - activate_munin_check { - "apache_accesses":; - "apache_processes":; - "apache_volume":; - "apache_servers":; - "ps_apache2": script => "ps_"; - } - - package { - "apache2": ensure => installed; - } - - case $php5 { - "true": { - package { - "php5-suhosin": ensure => installed; - } - - file { "/etc/php5/conf.d/suhosin.ini": - source => [ "puppet:///modules/apache2/per-host/$fqdn/etc/php5/conf.d/suhosin.ini", - "puppet:///modules/apache2/common/etc/php5/conf.d/suhosin.ini" ], - require => Package["apache2", "php5-suhosin"], - notify => Exec["force-reload-apache2"]; - } - } - } - - define activate_apache_site($ensure=present, $site=$name) { - case $site { - "": { $base = $name } - default: { $base = $site } - } - - case $ensure { - present: { - file { "/etc/apache2/sites-enabled/$name": - ensure => "/etc/apache2/sites-available/$base", - require => Package["apache2"], - notify => Exec["reload-apache2"]; - } - } - absent: { - file { "/etc/apache2/sites-enabled/$name": - ensure => $ensure, - notify => Exec["reload-apache2"]; - } - } - default: { err ( "Unknown ensure value: '$ensure'" ) } - } - } - - define enable_module($ensure=present) { - case $ensure { - present: { - exec { - "/usr/sbin/a2enmod $name": - unless => "/bin/sh -c '[ -L /etc/apache2/mods-enabled/${name}.load ]'", - notify => Exec["force-reload-apache2"], - } - } - absent: { - exec { - "/usr/sbin/a2dismod $name": - onlyif => "/bin/sh -c '[ -L /etc/apache2/mods-enabled/${name}.load ]'", - notify => Exec["force-reload-apache2"], - } - } - default: { err ( "Unknown ensure value: '$ensure'" ) } - } - } - - enable_module { - "info":; - "status":; - } - - activate_apache_site { - "00-default": site => "default-debian.org"; - "000-default": ensure => absent; - } - - file { - "/etc/apache2/conf.d/ressource-limits": - content => template("apache2/ressource-limits.erb"), - require => Package["apache2"], - notify => Exec["reload-apache2"]; - "/etc/apache2/conf.d/security": - source => [ "puppet:///modules/apache2/per-host/$fqdn/etc/apache2/conf.d/security", - "puppet:///modules/apache2/common/etc/apache2/conf.d/security" ], - require => Package["apache2"], - notify => Exec["reload-apache2"]; - "/etc/apache2/conf.d/local-serverinfo": - source => [ "puppet:///modules/apache2/per-host/$fqdn/etc/apache2/conf.d/local-serverinfo", - "puppet:///modules/apache2/common/etc/apache2/conf.d/local-serverinfo" ], - require => Package["apache2"], - notify => Exec["reload-apache2"]; - "/etc/apache2/conf.d/server-status": - source => [ "puppet:///modules/apache2/per-host/$fqdn/etc/apache2/conf.d/server-status", - "puppet:///modules/apache2/common/etc/apache2/conf.d/server-status" ], - require => Package["apache2"], - notify => Exec["reload-apache2"]; - - "/etc/apache2/sites-available/default-debian.org": - content => template("apache2/default-debian.org.erb"), - require => Package["apache2"], - notify => Exec["reload-apache2"]; - - "/etc/logrotate.d/apache2": - source => [ "puppet:///modules/apache2/per-host/$fqdn/etc/logrotate.d/apache2", - "puppet:///modules/apache2/common/etc/logrotate.d/apache2" ]; - - "/srv/www": - mode => 755, - ensure => directory; - "/srv/www/default.debian.org": - mode => 755, - ensure => directory; - "/srv/www/default.debian.org/htdocs": - mode => 755, - ensure => directory; - "/srv/www/default.debian.org/htdocs/index.html": - content => template("apache2/default-index.html"); - - # sometimes this is a symlink - #"/var/log/apache2": - # mode => 755, - # ensure => directory; - } - - exec { - "reload-apache2": - command => "/etc/init.d/apache2 reload", - refreshonly => true; - "force-reload-apache2": - command => "/etc/init.d/apache2 force-reload", - refreshonly => true; - } - case $hostname { - chopin,franck,morricone: { - package { - "libapache2-mod-macro": ensure => installed; - } - enable_module { - "macro":; - } - file { - "/etc/apache2/conf.d/puppet-builddlist": - content => template("apache2/conf-builddlist.erb"), - require => Package["apache2"], - notify => Exec["reload-apache2"]; - } - } - } - - case $hostname { - busoni,duarte,holter,lindberg,master,merkel,powell,rore: { - @ferm::rule { "dsa-http-limit": - prio => "20", - description => "limit HTTP DOS", - chain => 'http_limit', - rule => ' - mod limit limit-burst 60 limit 15/minute jump ACCEPT; - jump DROP; - ' - } - @ferm::rule { "dsa-http-soso": - prio => "21", - description => "slow soso spider", - chain => 'limit_sosospider', - rule => ' - mod connlimit connlimit-above 2 connlimit-mask 21 jump DROP; - jump http_limit; - ' - } - @ferm::rule { "dsa-http-yahoo": - prio => "21", - description => "slow yahoo spider", - chain => 'limit_yahoo', - rule => ' - mod connlimit connlimit-above 2 connlimit-mask 16 jump DROP; - jump http_limit; - ' - } - @ferm::rule { "dsa-http-google": - prio => "21", - description => "slow google spider", - chain => 'limit_google', - rule => ' - mod connlimit connlimit-above 2 connlimit-mask 19 jump DROP; - jump http_limit; - ' - } - @ferm::rule { "dsa-http-bing": - prio => "21", - description => "slow bing spider", - chain => 'limit_bing', - rule => ' - mod connlimit connlimit-above 2 connlimit-mask 16 jump DROP; - jump http_limit; - ' - } - @ferm::rule { "dsa-http-rules": - prio => "22", - description => "http subchain", - chain => 'http', - rule => ' - saddr ( 74.6.22.182 74.6.18.240 67.195.0.0/16 ) jump limit_yahoo; - saddr 124.115.0.0/21 jump limit_sosospider; - saddr (65.52.0.0/14 207.46.0.0/16) jump limit_bing; - saddr (66.249.64.0/19) jump limit_google; - - mod recent name HTTPDOS update seconds 1800 jump log_or_drop; - mod hashlimit hashlimit-name HTTPDOS hashlimit-mode srcip hashlimit-burst 600 hashlimit 30/minute jump ACCEPT; - mod recent name HTTPDOS set jump log_or_drop; - ' - } - @ferm::rule { "dsa-http": - prio => "23", - description => "Allow web access", - rule => "proto tcp dport (http https) jump http;" - } - } - default: { - @ferm::rule { "dsa-http": - prio => "23", - description => "Allow web access", - rule => "&SERVICE(tcp, (http https))" - } - } - } - @ferm::rule { "dsa-http-v6": - domain => "(ip6)", - prio => "23", - description => "Allow web access", - rule => "&SERVICE(tcp, (http https))" - } + package { 'apache2': + ensure => installed, + } + + service { 'apache2': + ensure => running, + require => Package['apache2'], + } + + apache2::module { 'info': } + apache2::module { 'status': } + apache2::module { 'headers': } + + package { 'libapache2-mod-macro': + ensure => installed + } + + apache2::module { 'macro': + require => Package['libapache2-mod-macro'] + } + + apache2::site { '00-default': + site => 'default-debian.org', + content => template('apache2/default-debian.org.erb'), + } + + apache2::site { '000-default': + ensure => absent, + } + + apache2::config { 'serve-cgi-bin': + ensure => absent, + } + + apache2::config { 'ressource-limits': + ensure => absent, + } + + if has_role('udd') { + $memlimit = 512 * 1024 * 1024 + } elsif has_role('sso') { + $memlimit = 512 * 1024 * 1024 + } elsif has_role('qamaster') { + $memlimit = 300 * 1024 * 1024 + } elsif has_role('snapshot_master') { + $memlimit = 300 * 1024 * 1024 + } else { + $memlimit = 192 * 1024 * 1024 + } + + apache2::config { 'resource-limits': + content => template('apache2/resource-limits.erb'), + } + + apache2::config { 'security': + source => 'puppet:///modules/apache2/security', + } + + apache2::config { 'logformat-privacy': + source => 'puppet:///modules/apache2/logformat-privacy', + } + + apache2::config { 'local-serverinfo': + source => 'puppet:///modules/apache2/local-serverinfo', + } + + apache2::config { 'server-status': + source => 'puppet:///modules/apache2/server-status', + } + + apache2::config { 'puppet-ssl-macros': + source => 'puppet:///modules/apache2/puppet-ssl-macros', + } + + apache2::config { 'puppet-config': + content => template('apache2/puppet-config.erb'), + } + + apache2::config { 'pratchett': + source => 'puppet:///modules/apache2/pratchett', + } + + if $::lsbmajdistrelease > 7 { + file { '/etc/apache2/mods-available/mpm_worker.conf': + content => template('apache2/mpm_worker.erb'), + } + } + + file { '/etc/apache2/sites-available/common-ssl.inc': + ensure => absent, + } + + file { '/etc/logrotate.d/apache2': + source => 'puppet:///modules/apache2/apache2.logrotate', + } + + file { [ '/srv/www', '/srv/www/default.debian.org', '/srv/www/default.debian.org/htdocs' ]: + ensure => directory, + mode => '0755', + } + + file { '/srv/www/default.debian.org/htdocs/index.html': + content => template('apache2/default-index.html'), + } + + file { '/var/log/apache2/.nobackup': + mode => '0644', + content => '', + } + + munin::check { 'apache_accesses': } + munin::check { 'apache_processes': } + munin::check { 'apache_volume': } + munin::check { 'apache_servers': } + munin::check { 'ps_apache2': + script => 'ps_', + } + + if $::hostname in [beach,buxtehude,picconi,pkgmirror-1and1] { + include apache2::dynamic + } else { + @ferm::rule { 'dsa-http': + prio => '23', + description => 'Allow web access', + rule => '&SERVICE(tcp, (http https))' + } + } + + @ferm::rule { 'dsa-http-v6': + domain => '(ip6)', + prio => '23', + description => 'Allow web access', + rule => '&SERVICE(tcp, (http https))' + } } -# vim:set et: -# vim:set sts=4 ts=4: -# vim:set shiftwidth=4: