X-Git-Url: https://git.donarmstrong.com/?a=blobdiff_plain;f=modules%2Fdebian-org%2Fmanifests%2Finit.pp;h=a8e50bcedaf35359639b67f23cfd775bc5fcd8a2;hb=3a8ea253416bbc3db8f4e9b8194dd2e888880745;hp=60ccd7aa02d44275fd9479757d8736e45a0c115a;hpb=98466a8ceeb950a3141b5f74deaeae504f202b99;p=dsa-puppet.git diff --git a/modules/debian-org/manifests/init.pp b/modules/debian-org/manifests/init.pp index 60ccd7aa..a8e50bce 100644 --- a/modules/debian-org/manifests/init.pp +++ b/modules/debian-org/manifests/init.pp @@ -1,184 +1,322 @@ -define sysctl($key, $value, $ensure=present) { - file { - "/etc/sysctl.d/$name.conf": - ensure => $ensure, - owner => root, - group => root, - mode => 0644, - content => "$key = $value\n", - notify => Exec["procps restart"], - } -} +# == Class: debian-org +# +# Stuff common to all debian.org servers +# +class debian-org { + if getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') { + $mirror = getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') + } else { + $mirror = 'http://http.debian.net/debian/' + } + if $::lsbmajdistrelease < 7 { + $mirror_backports = 'http://backports.debian.org/debian-backports/' + } else { + $mirror_backports = $mirror + } -define set_alternatives($linkto) { - exec { - "/usr/sbin/update-alternatives --set $name $linkto": - unless => "/bin/sh -c '! [ -e $linkto ] || ! [ -e /etc/alternatives/$name ] || ([ -L /etc/alternatives/$name ] && [ /etc/alternatives/$name -ef $linkto ])'" - } -} + $debianadmin = [ + 'debian-archive-debian-samhain-reports@master.debian.org', + 'debian-admin@ftbfs.de', + 'weasel@debian.org', + 'steve@lobefin.net', + 'paravoid@debian.org', + 'zumbi@kos.to' + ] -define linux_module ($ensure) { - case $ensure { - present: { - exec { "append_module_${name}": - command => "echo '${name}' >> /etc/modules", - unless => "grep -q -F -x '${name}' /etc/modules", - } - } - absent: { - exec { "remove_module_${name}": - command => "sed -i -e'/^${name}\$/d' /etc/modules", - onlyif => "grep -q -F -x '${name}' /etc/modules", - } - } - default: { - err("invalid ensure value ${ensure}") - } - } -} + package { [ + 'klogd', + 'sysklogd', + 'rsyslog', + ]: + ensure => purged, + } + package { [ + 'debian.org', + 'dsa-munin-plugins', + ]: + ensure => installed, + tag => extra_repo, + } + package { [ + 'apt-utils', + 'bash-completion', + 'dnsutils', + 'less', + 'lsb-release', + 'libfilesystem-ruby1.8', + 'mtr-tiny', + 'nload', + 'pciutils', + ]: + ensure => installed, + } -class debian-org { - package { - "apt-utils": ensure => installed; - "bash-completion": ensure => installed; - "debian.org": ensure => installed; - "dnsutils": ensure => installed; - "dsa-munin-plugins": ensure => installed; - "klogd": ensure => purged; - "less": ensure => installed; - "logrotate": ensure => installed; - "libfilesystem-ruby1.8": ensure => installed; - "mtr-tiny": ensure => installed; - "nload": ensure => installed; - "pciutils": ensure => installed; - "rsyslog": ensure => purged; - "sysklogd": ensure => purged; - "userdir-ldap": ensure => installed; - } - file { - "/etc/apt/preferences": - source => "puppet:///modules/debian-org/apt.preferences"; - "/etc/apt/sources.list.d/backports.org.list": - content => template("debian-org/etc/apt/sources.list.d/backports.org.list.erb"), - notify => Exec["apt-get update"]; - "/etc/apt/sources.list.d/debian.org.list": - content => template("debian-org/etc/apt/sources.list.d/debian.org.list.erb"), - notify => Exec["apt-get update"]; - "/etc/apt/sources.list.d/security.list": - content => template("debian-org/etc/apt/sources.list.d/security.list.erb"), - notify => Exec["apt-get update"]; - "/etc/apt/sources.list.d/volatile.list": - content => template("debian-org/etc/apt/sources.list.d/volatile.list.erb"), - notify => Exec["apt-get update"]; - "/etc/apt/apt.conf.d/local-recommends": - source => "puppet:///modules/debian-org/apt.conf.d/local-recommends"; - "/etc/apt/apt.conf.d/local-pdiffs": - source => "puppet:///modules/debian-org/apt.conf.d/local-pdiffs"; - "/etc/timezone": - source => "puppet:///modules/debian-org/timezone", - notify => Exec["dpkg-reconfigure tzdata -pcritical -fnoninteractive"]; - "/etc/puppet/puppet.conf": - # require => Package["puppet"], - source => "puppet:///modules/debian-org/puppet.conf" - ; - "/etc/default/puppet": - # require => Package["puppet"], - source => "puppet:///modules/debian-org/puppet.default" - ; - - "/etc/cron.d/dsa-puppet-stuff": - source => "puppet:///modules/debian-org/dsa-puppet-stuff.cron", - require => Package["cron"] - ; - "/etc/ldap/ldap.conf": - require => Package["userdir-ldap"], - source => "puppet:///modules/debian-org/ldap.conf", - ; - "/etc/pam.d/common-session": - require => Package["libpam-pwdfile"], - content => template("debian-org/pam.common-session.erb"), - ; - "/etc/rc.local": - mode => 0755, - source => "puppet:///modules/debian-org/rc.local", - notify => Exec["rc.local start"], - ; - } - - # set mmap_min_addr to 4096 to mitigate - # Linux NULL-pointer dereference exploits - sysctl { - "mmap_min_addr" : - key => "vm.mmap_min_addr", - value => 4096, - } - - set_alternatives { - "editor": - linkto => "/usr/bin/vim.basic", - } - - exec { - "dpkg-reconfigure tzdata -pcritical -fnoninteractive": - path => "/usr/bin:/usr/sbin:/bin:/sbin", - refreshonly => true; - "apt-get update": - command => 'apt-get update', - path => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin", - refreshonly => true; - "puppetmaster restart": - path => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin", - refreshonly => true; - "rc.local start": - path => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin", - refreshonly => true; - "procps restart": - path => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin", - refreshonly => true; - "init q": - refreshonly => true; - } -} + if $::lsbmajdistrelease >= 7 { + package { 'libfilesystem-ruby1.9.1': + ensure => installed, + } + } -class debian-proliant inherits debian-org { - package { - "hpacucli": ensure => installed; - "hp-health": ensure => installed; - "arrayprobe": ensure => installed; - } - case getfromhash($nodeinfo, 'squeeze') { - true: {} - default: { - package { - "cpqarrayd": ensure => installed; - } - } - } - case $debarchitecture { - "amd64": { - package { "lib32gcc1": ensure => installed; } - } - } - file { - "/etc/apt/sources.list.d/debian.restricted.list": - content => template("debian-org/etc/apt/sources.list.d/debian.restricted.list.erb"), - notify => Exec["apt-get update"]; - } -} + munin::check { [ + 'cpu', + 'entropy', + 'forks', + 'interrupts', + 'iostat', + 'irqstats', + 'load', + 'memory', + 'ntp_offset', + 'ntp_states', + 'open_files', + 'open_inodes', + 'processes', + 'swap', + 'uptime', + 'vmstat', + ]: + } + + if getfromhash($site::nodeinfo, 'broken-rtc') { + package { 'fake-hwclock': + ensure => installed, + tag => extra_repo, + } + } + + package { 'molly-guard': + ensure => installed, + } + file { '/etc/molly-guard/run.d/10-check-kvm': + mode => '0755', + source => 'puppet:///modules/debian-org/molly-guard/10-check-kvm', + require => Package['molly-guard'], + } + file { '/etc/molly-guard/run.d/15-acquire-reboot-lock': + mode => '0755', + source => 'puppet:///modules/debian-org/molly-guard/15-acquire-reboot-lock', + require => Package['molly-guard'], + } + + file { '/etc/apt/trusted-keys.d': + ensure => absent, + force => true, + } + + file { '/etc/apt/trusted.gpg': + mode => '0600', + content => "", + } + + site::aptrepo { 'security': + url => 'http://security.debian.org/', + suite => "${::lsbdistcodename}/updates", + components => ['main','contrib','non-free'] + } + if $::lsbmajdistrelease < 7 { + site::aptrepo { 'debian-lts': + url => $mirror, + suite => "${::lsbdistcodename}-lts", + components => ['main','contrib','non-free'] + } + } else { + site::aptrepo { 'debian-lts': + ensure => absent, + } + } + + site::aptrepo { 'backports.debian.org': + url => $mirror_backports, + suite => "${::lsbdistcodename}-backports", + components => ['main','contrib','non-free'] + } + + site::aptrepo { 'volatile': + url => $mirror, + suite => "${::lsbdistcodename}-updates", + components => ['main','contrib','non-free'] + } + + if $::hostname in [ball, corelli, eysler, lucatelli, mayer, mayr, rem] { + site::aptrepo { 'proposed-updates': + url => $mirror, + suite => "${::lsbdistcodename}-proposed-updates", + components => ['main','contrib','non-free'] + } + } + + site::aptrepo { 'debian.org': + ensure => absent, + } + + site::aptrepo { 'db.debian.org': + url => 'http://db.debian.org/debian-admin', + suite => 'lenny', + components => 'main', + key => 'puppet:///modules/debian-org/db.debian.org.gpg', + } + + augeas { 'inittab_replicate': + context => '/files/etc/inittab', + changes => [ + 'set ud/runlevels 2345', + 'set ud/action respawn', + 'set ud/process "/usr/bin/ud-replicated -d"', + ], + notify => Exec['init q'], + } + + if getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') { + site::aptrepo { 'debian': + url => getfromhash($site::nodeinfo, 'hoster', 'mirror-debian'), + suite => $::lsbdistcodename, + components => ['main','contrib','non-free'] + } + } + + file { '/etc/facter': + ensure => directory, + purge => true, + force => true, + recurse => true, + source => 'puppet:///files/empty/', + } + file { '/etc/facter/facts.d': + ensure => directory, + } + file { '/etc/facter/facts.d/debian_facts.yaml': + content => template('debian-org/debian_facts.yaml.erb') + } + file { '/etc/apt/preferences': + source => 'puppet:///modules/debian-org/apt.preferences', + } + file { '/etc/apt/apt.conf.d/local-compression': + source => 'puppet:///modules/debian-org/apt.conf.d/local-compression', + } + file { '/etc/apt/apt.conf.d/local-recommends': + source => 'puppet:///modules/debian-org/apt.conf.d/local-recommends', + } + file { '/etc/apt/apt.conf.d/local-pdiffs': + source => 'puppet:///modules/debian-org/apt.conf.d/local-pdiffs', + } + file { '/etc/timezone': + source => 'puppet:///modules/debian-org/timezone', + notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'], + } + if $::hostname == handel { + include puppetmaster::db + $dbpassword = $puppetmaster::db::password + } + file { '/etc/puppet/puppet.conf': + content => template('debian-org/puppet.conf.erb'), + } + file { '/etc/default/puppet': + source => 'puppet:///modules/debian-org/puppet.default', + } + file { '/etc/cron.d/dsa-puppet-stuff': + source => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron', + require => Package['debian.org'], + } + file { '/etc/ldap/ldap.conf': + require => Package['debian.org'], + source => 'puppet:///modules/debian-org/ldap.conf', + } + file { '/etc/pam.d/common-session': + require => Package['debian.org'], + content => template('debian-org/pam.common-session.erb'), + } + file { '/etc/pam.d/common-session-noninteractive': + require => Package['debian.org'], + content => template('debian-org/pam.common-session-noninteractive.erb'), + } + file { '/etc/rc.local': + mode => '0755', + source => 'puppet:///modules/debian-org/rc.local', + notify => Exec['rc.local start'], + } + file { '/etc/dsa': + ensure => directory, + mode => '0755', + } + file { '/etc/dsa/cron.ignore.dsa-puppet-stuff': + source => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron.ignore', + require => Package['debian.org'] + } + file { '/etc/nsswitch.conf': + mode => '0755', + source => 'puppet:///modules/debian-org/nsswitch.conf', + } + + # set mmap_min_addr to 4096 to mitigate + # Linux NULL-pointer dereference exploits + site::sysctl { 'mmap_min_addr': + ensure => absent + } + site::sysctl { 'perf_event_paranoid': + key => 'kernel.perf_event_paranoid', + value => '2', + } + site::alternative { 'editor': + linkto => '/usr/bin/vim.basic', + } + site::alternative { 'view': + linkto => '/usr/bin/vim.basic', + } + mailalias { 'samhain-reports': + ensure => present, + recipient => $debianadmin, + require => Package['debian.org'] + } + + file { '/usr/local/bin/check_for_updates': + source => 'puppet:///modules/debian-org/check_for_updates', + mode => '0755', + owner => root, + group => root, + } + + exec { 'apt-get update': + path => '/usr/bin:/usr/sbin:/bin:/sbin', + onlyif => '/usr/local/bin/check_for_updates', + require => File['/usr/local/bin/check_for_updates'] + } + Exec['apt-get update']->Package<| tag == extra_repo |> + + exec { 'dpkg-reconfigure tzdata -pcritical -fnoninteractive': + path => '/usr/bin:/usr/sbin:/bin:/sbin', + refreshonly => true + } + exec { 'puppetmaster restart': + path => '/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin', + refreshonly => true + } + exec { 'rc.local start': + path => '/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin', + refreshonly => true + } + exec { 'init q': + refreshonly => true + } + + tidy { '/var/lib/puppet/clientbucket/': + age => '2w', + recurse => 9, + type => ctime, + matches => [ 'paths', 'contents' ], + schedule => weekly + } -class debian-radvd inherits debian-org { - sysctl { - "dsa-accept-ra-default" : - key => "net.ipv6.conf.default.accept_ra", - value => 0, - } - sysctl { - "dsa-accept-ra-all" : - key => "net.ipv6.conf.all.accept_ra", - value => 0, - } + file { '/root/.bashrc': + source => 'puppet:///modules/debian-org/root-dotfiles/bashrc', + } + file { '/root/.profile': + source => 'puppet:///modules/debian-org/root-dotfiles/profile', + } + file { '/root/.screenrc': + source => 'puppet:///modules/debian-org/root-dotfiles/screenrc', + } + file { '/root/.vimrc': + source => 'puppet:///modules/debian-org/root-dotfiles/vimrc', + } } -# vim:set et: -# vim:set sts=4 ts=4: -# vim:set shiftwidth=4: