Merge branch 'master' of ssh://handel.debian.org/srv/puppet.debian.org/git/dsa-puppet

* 'master' of ssh://handel.debian.org/srv/puppet.debian.org/git/dsa-puppet: (26 commits)
  Another file that may be changed by puppet to ignore
  Maybe we don't need the sleep
  eh, duh.  Need sudo for this.
  Try a longer wait?
  wait a moment after running reconfig, so that the reload works
  more accurate error message
  Move reject of localonly users to predata.  This allows callouts to
  We push this with a Makefile for now
  Correct the name to samhain ignore
  Move the config file snippet to the top
  Fix the posthooks
  Revert "we should also samhain ignore that file"
  Revert "And it's directory"
  Change path to geo file
  Add my key
  Some tightening up
  Rename the views so I don't have to make code changes
  Well, there's only one way to figure out if this will work
  And allow the postcommand
  Also autogenerate bind config snippets
  ...

diff --git a/modules/buildd/files/mount-defaults b/modules/buildd/files/mount-defaults
new file mode 100644 (file)
index 0000000..f3971e2
--- /dev/null
+++ b/modules/buildd/files/mount-defaults
@@ -0,0 +1,12 @@
+##
+## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
+## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
+##
+# mount.defaults: static file system information for chroots.
+# Note that the mount point will be prefixed by the chroot path
+# (CHROOT_PATH)
+#
+# <file system> <mount point>   <type>  <options>       <dump>  <pass>
+proc            /proc           proc    defaults        0       0
+/dev/pts        /dev/pts        none    rw,bind         0       0
+tmpfs           /dev/shm        tmpfs   defaults        0       0

diff --git a/modules/buildd/manifests/init.pp b/modules/buildd/manifests/init.pp
index 1d711b9fabcd7719f5601ac068d063f4aab0f695..7977b11ad80b2a9cbe1af839a8aced895beb43ed 100644 (file)
--- a/modules/buildd/manifests/init.pp
+++ b/modules/buildd/manifests/init.pp
@@ -14,10 +14,14 @@ class buildd {
              notify  => Exec["apt-get update"],
              ;
 
-        "/etc/apt/trusted-keys.d/buildd.debian.org.asc":
-          source  => "puppet:///buildd/buildd.debian.org.asc",
-          mode    => 664,
-          notify  => Exec["apt-keys-update"],
-          ;
+      "/etc/apt/trusted-keys.d/buildd.debian.org.asc":
+            source  => "puppet:///buildd/buildd.debian.org.asc",
+            mode    => 664,
+            notify  => Exec["apt-keys-update"],
+            ;
+      "/etc/schroot/mount-defaults":
+            source  => "puppet:///buildd/mount-defaults",
+            require => Package["sbuild"]
+            ;
    }
 }

diff --git a/modules/debian-org/misc/local.yaml b/modules/debian-org/misc/local.yaml
index 7323606842c76e51ba714951d2d250ef1bbf3833..8206d68a3d6741551fb5b4fc88e30e3916d1ee6b 100644 (file)
--- a/modules/debian-org/misc/local.yaml
+++ b/modules/debian-org/misc/local.yaml
@@ -1,7 +1,9 @@
 ---
 nameinfo:
   agnesi.debian.org: Maria Teresa Agnesi (October 17, 1720 - January 19, 1795)
+  agricola.debian.org: Alexander Agricola (1445 or 1446 - August 15, 1506)
   albeniz.debian.org: Isaac Manuel Francisco Albéniz i Pascual (May 29, 1860 - May 18, 1909)
+  allegri.debian.org: Gregorio Allegri (1582 - 7 February 1652)
   ancina.debian.org: Giovanni Giovenale Ancina (19 October 1545 - August 30, 1604)
   arcadelt.debian.org: Jacques Arcadelt (also Jacob Arcadelt) (?1507 - October 14, 1568)
   argento.debian.org: Dominick Argento (b. October 27, 1927)
@@ -20,6 +22,7 @@ nameinfo:
   klecker.debian.org: Dedicated to Joel 'Espy' Klecker (1979 - July 11, 2000)
   lafayette.debian.org: Eugenie Lafayette
   lebrun.debian.org: Francesca Lebrun (March 24, 1756 - May 14, 1791)
+  liszt.debian.org: Franz Liszt (October 22, 1811 - July 31, 1886)
   mahler.debian.org: Gustav Mahler (7 July 1860 - 18 May 1911)
   mayr.debian.org: Johann(es) Simon Mayr (June 14, 1763 - December 2, 1845)
   merkel.debian.org: Gustav (Adolf) Merkel (November 12, 1827 - October 30, 1885)
@@ -53,6 +56,7 @@ nameinfo:
   strauss.debian.org: Johann Baptist Strauß (October 25, 1825 - June 3, 1899)
   tartini.debian.org: Giuseppe Tartini (April 8, 1692 - February 26, 1770)
   unger.debian.org: Caroline Unger (October 28, 1803 - March 23, 1877)
+  valente.debian.org: Vincenzo Valente (February 21, 1855 - September 6, 1921)
   verdi.debian.org: Giuseppe Fortunino Francesco Verdi (October 9 or 10, 1813 - January 27, 1901)
   voltaire.debian.org: François-Marie Arouet (Voltaire) (21 November 1694 - 30 May 1778)
   wagner.debian.org: Wilhelm Richard Wagner (22 May 1813 - 13 February 1883)

diff --git a/modules/exim/files/common/callout_users b/modules/exim/files/common/callout_users
index d3c4d8e293bc1c84639b6527dbe2ffa5c1486f14..0ec22bd78a86f050033b922c54195e9dc2f2cdb2 100644 (file)
--- a/modules/exim/files/common/callout_users
+++ b/modules/exim/files/common/callout_users
@@ -14,7 +14,6 @@ ftpmaster
 gandi-discount
 hostmaster
 keyring-maint
-leader
 lintian-maint
 listarchives
 mailer-daemon

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index 98d608ce38a0cb9e87ed97409867211291e2b7bd..46f624e60efaec77ab2aea5896194bbc03673021 100644 (file)
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -108,6 +108,7 @@ if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty?
 end
 out
 %>
+acl_smtp_predata = acl_check_predata
 
 # accept domain literal syntax in e-mail addresses. To actually make use of
 # this a router is also required
@@ -280,6 +281,13 @@ RT_QUEUE_MAP = /srv/rt.debian.org/mail/rt_queue_map
 ######################################################################
 begin acl
 
+acl_localonly:
+  accept  local_parts   = +local_only_users
+          domains       = +local_domains
+          hosts         = !+debianhosts
+
+  deny
+
 check_helo:
 
   warn    set acl_c1    = 0
@@ -513,10 +521,22 @@ out
           condition     = ${if match_local_part {$sender_address_local_part}{${extract{directory}{VDOMAINDATA}{${value}/neversenders}}}{1}{0}}
          message       = no mail should ever come from <$sender_address>
 
-  deny    local_parts   = +local_only_users
-         domains       = +local_domains
-          hosts         = !+debianhosts
-         message       = mail for $local_part is only accepted internally
+  warn    condition     = ${if eq{$acl_m6}{}}
+          acl           = acl_localonly
+          set acl_m6    = localonly
+          set acl_m7    = ${if eq{$acl_m7}{}{$local_part@$domain}{$acl_m7, $local_part@$domain}}
+
+  warn    condition     = ${if eq{$acl_m6}{}}
+          !acl          = acl_localonly
+          set acl_m6    = normal
+
+  defer   condition     = ${if eq{$acl_m6}{localonly}}
+          !acl          = acl_localonly
+          log_message   = Only one profile at a time, please
+
+  defer   condition     = ${if eq{$acl_m6}{normal}}
+          acl           = acl_localonly
+          log_message   = Only one profile at a time, please
 
 <%=
 out=''
@@ -788,6 +808,13 @@ end
 out
 %>
 
+acl_check_predata:
+  deny   condition     = ${if eq{$acl_m6}{localonly}}
+         message       = mail for $acl_m7 is only accepted internally
+
+  accept
+
+
 #!!# ACL that is used after the DATA command
 check_message:
   require verify = header_syntax

diff --git a/modules/geodns/files/common/authorized_keys b/modules/geodns/files/common/authorized_keys
index afba8d0e92b6caa353086e0b9a4249e7409b6d57..646c710d4e9011a4e112bd3e9c98e2c073e40051 100644 (file)
--- a/modules/geodns/files/common/authorized_keys
+++ b/modules/geodns/files/common/authorized_keys
@@ -3,3 +3,4 @@
 # USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
 #
 from="82.195.75.106,2001:41b8:202:deb:216:36ff:fe40:3906",command="/etc/bind/geodns/recvconf /etc/bind/geodns/recvconf.files",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA2cJCkmggW6TD0UPJP9lelDno8qbYGXPeYE4+QmkqJv8mslcHxmx5tA2TvpJ9qbAUMPOdZf9ihomwPmFzz9UNZH4eDA8F126UUP5DXsh7FC7yVGSBUNdJdYS7m2wtVs8ddhrVdI+8c39D7NVGGjtUCJCWA/3fE65O183Gm+vER65SYR6LfHlEiC2FBROs6qwnjQ0yw194MnU7Jxl/GsTdZ72ArkmcPjuWsVHWtkSTt0hPfgBOyL4vSfBgl2p2eQBXCEPOaPTa1Yr5qfur1+Cj+iwadEmPfRap6rBO3wfIjbXt/KncM2uFrCXuF1TOqQxrs5LSe8dz16vf9Ckf9Ae5wQ== geodnssync@draghi (20090527)
+from="91.103.132.25,2001:4b10:100b::dead:f00d",command="/etc/bind/geodns/recvconf /etc/bind/geodns/recvconf.files",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApBLc4ZoGTtXDJ1UhgA7NEPdwqibg5BSXZfKPgfM9wn0mZooAlYzVYwNfe08UmDwrGkSjeNphmzpiDFQA27WGLCgAw8SIjunojWKvJwJcDwx2W4OPLByZaVg/wcEivC2h0+xlRc9jFqKL5cOsTnKBuD4nC7r8qnNcWxyeEEJGP4PVb2zgrGhf8UK3bAqYPuQp0pBFo4EPdorxsgThshEWg9eqB94ph7s+YXoccoWh4NlH2TaO9QdjtsWCId6uhfpcrxjhwKRkqdjofKiOhBB3vqHE+Cpe95nKHZAP5JDgqFH/L+pzyOiRqfTeYh2ivaEBl6m5F7C/QlDBOFrOZkEtXQ== geodnssync key for sgran

diff --git a/modules/geodns/files/common/named.conf.acl b/modules/geodns/files/common/named.conf.acl
index 7ee6711fbc75311792dda9c810519d179b302056..b0877d81753edfce7c755b85b4468902c4f8c162 100644 (file)
--- a/modules/geodns/files/common/named.conf.acl
+++ b/modules/geodns/files/common/named.conf.acl
@@ -8,7 +8,7 @@ acl Nagios {
 };
 
 // Africa
-acl Africa {
+acl AF {
        country_AO;
        country_BF;
        country_BI;
@@ -69,7 +69,7 @@ acl Africa {
 };
 
 // Asia
-acl Asia {
+acl AS {
        country_AE;
        country_AF;
        country_AM;
@@ -127,7 +127,7 @@ acl Asia {
 };
 
 // Europe
-acl Europe {
+acl EU {
        country_AD;
        country_AL;
        country_AT;
@@ -182,7 +182,7 @@ acl Europe {
 };
 
 // North America
-acl NorthAmerica {
+acl NA {
        country_AG;
        country_AI;
        country_AN;
@@ -225,7 +225,7 @@ acl NorthAmerica {
 };
 
 // South America
-acl SouthAmerica {
+acl SA {
        country_AR;
        country_BO;
        country_BR;
@@ -243,7 +243,7 @@ acl SouthAmerica {
 };
 
 // Oceania
-acl Oceania {
+acl OC {
        country_AS;
        country_AU;
        country_CK;
@@ -273,7 +273,7 @@ acl Oceania {
 };
 
 // Antarctica
-acl Antarctica {
+acl AN {
        country_AQ;
        country_BV;
        country_GS;

diff --git a/modules/geodns/files/common/named.conf.geo b/modules/geodns/files/common/named.conf.geo
deleted file mode 100644 (file)
index 8c21bb6..0000000
--- a/modules/geodns/files/common/named.conf.geo
+++ /dev/null
@@ -1,126 +0,0 @@
-//
-// THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
-// USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
-//
-
-view "Africa" {
-       match-clients {
-               Africa;
-        };
-        zone "security.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.AF";
-               notify no;
-        };
-        zone "security.geo.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.AF";
-               notify no;
-        };
-};
-
-view "Asia" {
-       match-clients {
-               Asia;
-        };
-        zone "security.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.AS";
-               notify no;
-        };
-        zone "security.geo.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.AS";
-               notify no;
-        };
-};
-
-view "Europe" {
-       match-clients { 
-               Europe; 
-       };
-        zone "security.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.EU";
-               notify no;
-        };
-        zone "security.geo.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.EU";
-               notify no;
-        };
-};
-
-view "NorthAmerica" {
-       match-clients {
-               NorthAmerica;
-        };
-        zone "security.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.NA";
-               notify no;
-        };
-        zone "security.geo.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.NA";
-               notify no;
-        };
-};
-view "SouthAmerica" {
-       match-clients {
-               SouthAmerica;
-        };
-        zone "security.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.SA";
-               notify no;
-        };
-        zone "security.geo.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.SA";
-               notify no;
-        };
-};
-view "Oceania" {
-       match-clients {
-               Oceania;
-        };
-        zone "security.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.OC";
-               notify no;
-        };
-        zone "security.geo.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.OC";
-               notify no;
-        };
-};
-view "Antarctica" {
-       match-clients {
-               Antarctica;
-        };
-        zone "security.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.AN";
-               notify no;
-        };
-        zone "security.geo.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org.AN";
-               notify no;
-        };
-};
-view "other" {
-        match-clients { any; };
-        zone "security.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org";
-               notify no;
-        };
-        zone "security.geo.debian.org" {
-                type master;
-                file "/etc/bind/db.security.debian.org";
-               notify no;
-        };
-};

diff --git a/modules/geodns/files/common/named.conf.local b/modules/geodns/files/common/named.conf.local
index 094022e062f11e30ef9b5148f8ffb8bb02912c29..ba4ae0ba6e5ebf15269a4ce85beb0070f0665823 100644 (file)
--- a/modules/geodns/files/common/named.conf.local
+++ b/modules/geodns/files/common/named.conf.local
@@ -4,4 +4,4 @@
 //
 
 include "/etc/bind/named.conf.acl";
-include "/etc/bind/named.conf.geo";
+include "/etc/bind/geodns/named.conf.geo.security.debian.org";

diff --git a/modules/geodns/files/common/named.conf.options b/modules/geodns/files/common/named.conf.options
index 7a90e66f88ebcfb43d739b05d4fc84b7dcea34fd..aa593440d369de401749026bf50d8dfc4cf7991b 100644 (file)
--- a/modules/geodns/files/common/named.conf.options
+++ b/modules/geodns/files/common/named.conf.options
@@ -21,6 +21,9 @@ options {
 
         auth-nxdomain no;    # conform to RFC1035
         listen-on-v6 { any; };
+        allow-query { any; };
+        allow-update { none; };
+        allow-transfer { none; };
         allow-recursion { Nagios; };
 };
 

diff --git a/modules/geodns/files/common/recvconf.files b/modules/geodns/files/common/recvconf.files
index 5e29bb297beef43bf6a6baa13a419b3dc09d2aa1..b80f335325d262c7607d823de3ec9f688e34d875 100644 (file)
--- a/modules/geodns/files/common/recvconf.files
+++ b/modules/geodns/files/common/recvconf.files
@@ -3,43 +3,56 @@
 # USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
 #
 
+file etc/bind/geodns/named.conf.geo.security.debian.org
+    perms 0644
+    user geodnssync
+    group geodnssync
+    postcommand /usr/sbin/named-checkconf /etc/bind/named.conf && sudo /usr/sbin/rndc reconfig
 file etc/bind/geodns/db.security.debian.org
     perms 0644
     user geodnssync
     group geodnssync
-    postcommand /etc/init.d/bind9 reload
+    precommand /usr/sbin/named-checkzone -q -k fail -n fail -S fail -i full -m fail -M fail security.debian.org etc/bind/geodns/db.security.debian.org
+    postcommand sudo /etc/init.d/bind9 reload
 file etc/bind/geodns/db.security.debian.org.AF
     perms 0644
     user geodnssync
     group geodnssync
-    postcommand /etc/init.d/bind9 reload
+    precommand /usr/sbin/named-checkzone -q -k fail -n fail -S fail -i full -m fail -M fail security.debian.org etc/bind/geodns/db.security.debian.org.AF
+    postcommand sudo /etc/init.d/bind9 reload
 file etc/bind/geodns/db.security.debian.org.AN
     perms 0644
     user geodnssync
     group geodnssync
-    postcommand /etc/init.d/bind9 reload
+    precommand /usr/sbin/named-checkzone -q -k fail -n fail -S fail -i full -m fail -M fail security.debian.org etc/bind/geodns/db.security.debian.org.AN
+    postcommand sudo /etc/init.d/bind9 reload
 file etc/bind/geodns/db.security.debian.org.AS
     perms 0644
     user geodnssync
     group geodnssync
-    postcommand /etc/init.d/bind9 reload
+    precommand /usr/sbin/named-checkzone -q -k fail -n fail -S fail -i full -m fail -M fail security.debian.org etc/bind/geodns/db.security.debian.org.AS
+    postcommand sudo /etc/init.d/bind9 reload
 file etc/bind/geodns/db.security.debian.org.EU
     perms 0644
     user geodnssync
     group geodnssync
-    postcommand /etc/init.d/bind9 reload
+    precommand /usr/sbin/named-checkzone -q -k fail -n fail -S fail -i full -m fail -M fail security.debian.org etc/bind/geodns/db.security.debian.org.EU
+    postcommand sudo /etc/init.d/bind9 reload
 file etc/bind/geodns/db.security.debian.org.NA
     perms 0644
     user geodnssync
     group geodnssync
-    postcommand /etc/init.d/bind9 reload
+    precommand /usr/sbin/named-checkzone -q -k fail -n fail -S fail -i full -m fail -M fail security.debian.org etc/bind/geodns/db.security.debian.org.NA
+    postcommand sudo /etc/init.d/bind9 reload
 file etc/bind/geodns/db.security.debian.org.OC
     perms 0644
     user geodnssync
     group geodnssync
-    postcommand /etc/init.d/bind9 reload
+    precommand /usr/sbin/named-checkzone -q -k fail -n fail -S fail -i full -m fail -M fail security.debian.org etc/bind/geodns/db.security.debian.org.OC
+    postcommand sudo /etc/init.d/bind9 reload
 file etc/bind/geodns/db.security.debian.org.SA
     perms 0644
     user geodnssync
     group geodnssync
-    postcommand /etc/init.d/bind9 reload
+    precommand /usr/sbin/named-checkzone -q -k fail -n fail -S fail -i full -m fail -M fail security.debian.org etc/bind/geodns/db.security.debian.org.SA
+    postcommand sudo /etc/init.d/bind9 reload

diff --git a/modules/geodns/manifests/init.pp b/modules/geodns/manifests/init.pp
index a0397d07ee9c59aec1dd87117095b707f00f17db..27d236593b46dfcfad0819b4577c14000b53aa5f 100644 (file)
--- a/modules/geodns/manifests/init.pp
+++ b/modules/geodns/manifests/init.pp
@@ -17,14 +17,6 @@ class geodns {
                         owner   => root,
                         group   => root,
                         ;
-                "/etc/bind/named.conf.geo":
-                        source  => [ "puppet:///geodns/per-host/$fqdn/named.conf.geo",
-                                      "puppet:///geodns/common/named.conf.geo" ],
-                        require => Package["bind9"],
-                        notify  => Exec["bind9 restart"],
-                        owner   => root,
-                        group   => root,
-                        ;
                 "/etc/bind/named.conf.acl":
                         source  => [ "puppet:///geodns/per-host/$fqdn/named.conf.acl",
                                      "puppet:///geodns/common/named.conf.acl" ],

diff --git a/modules/samhain/templates/samhainrc.erb b/modules/samhain/templates/samhainrc.erb
index 50518143d6f884f24405458aab08a1d94a02ed97..861e75a80b5e01477427a26e603780f49d8e6c34 100644 (file)
--- a/modules/samhain/templates/samhainrc.erb
+++ b/modules/samhain/templates/samhainrc.erb
@@ -90,9 +90,10 @@ file=/var/state/samhain/samhain_file
 file=/etc/bind/zones/db.debian.net
 file=/etc/exim4/bsmtp
 <% if hostname == "geo1" || hostname == "geo2" || hostname == "geo3" -%>
-file=/etc/bind/named.conf.geo
 file=/etc/bind/named.conf.acl
 file=/etc/bind/named.conf.options
+file=/etc/bind/geodns/named.conf.geo.security.debian.org
+file=/etc/bind/geodns/recvconf.files
 file=/etc/bind/geodns/db.security.debian.org.SA
 file=/etc/bind/geodns/db.security.debian.org.OC
 file=/etc/bind/geodns/db.security.debian.org.NA

diff --git a/modules/sudo/files/common/sudoers b/modules/sudo/files/common/sudoers
index 57ec4903adefb9c4117d00d6640be053a199ffe8..5debc1e34207b5ab0a4c4c7102a7f3a85ff42f9e 100644 (file)
--- a/modules/sudo/files/common/sudoers
+++ b/modules/sudo/files/common/sudoers
@@ -117,3 +117,4 @@ debwww              klecker=(archvsync)     NOPASSWD: /home/archvsync/webmirrors/runmirrors
 %list          liszt=(amavis)          ALL
 # geodns may reload bind
 geodnssync     geo1,geo2,geo3=(root)   NOPASSWD: /etc/init.d/bind9 reload
+geodnssync     geo1,geo2,geo3=(root)   NOPASSWD: /usr/sbin/rndc reconfig