modules/apache2/manifests/init.pp

   1 class apache2 {
   2     activate_munin_check {
   3         "apache_accesses":;
   4         "apache_processes":;
   5         "apache_volume":;
   6         "apache_servers":;
   7         "ps_apache2": script => "ps_";
   8     }
   9
  10     package {
  11         "apache2": ensure => installed;
  12     }
  13
  14     case $php5 {
  15         "true": {
  16             package {
  17                 "php5-suhosin": ensure => installed;
  18             }
  19
  20             file { "/etc/php5/conf.d/suhosin.ini":
  21                 source  => [ "puppet:///modules/apache2/per-host/$fqdn/etc/php5/conf.d/suhosin.ini",
  22                              "puppet:///modules/apache2/common/etc/php5/conf.d/suhosin.ini" ],
  23                 require => Package["apache2", "php5-suhosin"],
  24                 notify  => Exec["force-reload-apache2"];
  25             }
  26         }
  27     }
  28
  29     define activate_apache_site($ensure=present, $site=$name) {
  30         case $site {
  31             "": { $base = $name }
  32             default: { $base = $site }
  33         }
  34
  35         case $ensure {
  36             present: {
  37                     file { "/etc/apache2/sites-enabled/$name":
  38                              ensure => "/etc/apache2/sites-available/$base",
  39                              require => Package["apache2"],
  40                              notify => Exec["reload-apache2"];
  41                     }
  42             }
  43             absent: {
  44                     file { "/etc/apache2/sites-enabled/$name":
  45                              ensure => $ensure,
  46                              notify => Exec["reload-apache2"];
  47                     }
  48             }
  49             default: { err ( "Unknown ensure value: '$ensure'" ) }
  50         }
  51     }
  52
  53     define enable_module($ensure=present) {
  54         case $ensure {
  55             present: {
  56                 exec {
  57                       "/usr/sbin/a2enmod $name":
  58                         unless => "/bin/sh -c '[ -L /etc/apache2/mods-enabled/${name}.load ]'",
  59                         notify => Exec["force-reload-apache2"],
  60                 }
  61             }
  62             absent: {
  63                 exec {
  64                       "/usr/sbin/a2dismod $name":
  65                         onlyif => "/bin/sh -c '[ -L /etc/apache2/mods-enabled/${name}.load ]'",
  66                         notify => Exec["force-reload-apache2"],
  67                 }
  68             }
  69             default: { err ( "Unknown ensure value: '$ensure'" ) }
  70         }
  71     }
  72
  73     enable_module {
  74         "info":;
  75         "status":;
  76     }
  77
  78     activate_apache_site {
  79         "00-default": site => "default-debian.org";
  80         "000-default": ensure => absent;
  81     }
  82
  83     file {
  84         "/etc/apache2/conf.d/ressource-limits":
  85             content => template("apache2/ressource-limits.erb"),
  86             require => Package["apache2"],
  87                         notify  => Exec["reload-apache2"];
  88         "/etc/apache2/conf.d/security":
  89             source  => [ "puppet:///modules/apache2/per-host/$fqdn/etc/apache2/conf.d/security",
  90                          "puppet:///modules/apache2/common/etc/apache2/conf.d/security" ],
  91             require => Package["apache2"],
  92             notify  => Exec["reload-apache2"];
  93         "/etc/apache2/conf.d/local-serverinfo":
  94             source  => [ "puppet:///modules/apache2/per-host/$fqdn/etc/apache2/conf.d/local-serverinfo",
  95                          "puppet:///modules/apache2/common/etc/apache2/conf.d/local-serverinfo" ],
  96             require => Package["apache2"],
  97             notify  => Exec["reload-apache2"];
  98         "/etc/apache2/conf.d/server-status":
  99             source  => [ "puppet:///modules/apache2/per-host/$fqdn/etc/apache2/conf.d/server-status",
 100                          "puppet:///modules/apache2/common/etc/apache2/conf.d/server-status" ],
 101             require => Package["apache2"],
 102             notify  => Exec["reload-apache2"];
 103
 104         "/etc/apache2/sites-available/default-debian.org":
 105             content => template("apache2/default-debian.org.erb"),
 106             require => Package["apache2"],
 107             notify  => Exec["reload-apache2"];
 108
 109         "/etc/apache2/sites-available/common-ssl.inc":
 110             source  => [ "puppet:///modules/apache2/per-host/$fqdn//etc/apache2/sites-available/common-ssl.inc",
 111                          "puppet:///modules/apache2/common/etc/apache2/sites-available/common-ssl.inc" ],
 112             require => Package["apache2"],
 113             notify  => Exec["reload-apache2"];
 114
 115         "/etc/logrotate.d/apache2":
 116             source  => [ "puppet:///modules/apache2/per-host/$fqdn/etc/logrotate.d/apache2",
 117                          "puppet:///modules/apache2/common/etc/logrotate.d/apache2" ];
 118
 119         "/srv/www":
 120             mode    => 755,
 121             ensure  => directory;
 122         "/srv/www/default.debian.org":
 123             mode    => 755,
 124             ensure  => directory;
 125         "/srv/www/default.debian.org/htdocs":
 126             mode    => 755,
 127             ensure  => directory;
 128         "/srv/www/default.debian.org/htdocs/index.html":
 129             content => template("apache2/default-index.html");
 130
 131         # sometimes this is a symlink
 132         #"/var/log/apache2":
 133         #    mode    => 755,
 134         #    ensure  => directory;
 135     }
 136
 137     exec {
 138         "reload-apache2":
 139             command => "/etc/init.d/apache2 reload",
 140             refreshonly => true;
 141         "force-reload-apache2":
 142             command => "/etc/init.d/apache2 force-reload",
 143             refreshonly => true;
 144     }
 145     case $hostname {
 146         chopin,franck,morricone,bizet: {
 147             package {
 148                 "libapache2-mod-macro": ensure => installed;
 149             }
 150             enable_module {
 151                 "macro":;
 152             }
 153             file {
 154                 "/etc/apache2/conf.d/puppet-builddlist":
 155                     content => template("apache2/conf-builddlist.erb"),
 156                     require => Package["apache2"],
 157                     notify  => Exec["reload-apache2"];
 158             }
 159         }
 160     }
 161
 162     case $hostname {
 163         busoni,duarte,holter,lindberg,master,powell,rore: {
 164             @ferm::rule { "dsa-http-limit":
 165                 prio            => "20",
 166                 description     => "limit HTTP DOS",
 167                 chain           => 'http_limit',
 168                 rule            => '
 169                                     mod limit limit-burst 60 limit 15/minute jump ACCEPT;
 170                                     jump DROP'
 171             }
 172             @ferm::rule { "dsa-http-soso":
 173                 prio            => "21",
 174                 description     => "slow soso spider",
 175                 chain           => 'limit_sosospider',
 176                 rule            => '
 177                                     mod connlimit connlimit-above 2 connlimit-mask 21 jump DROP;
 178                                     jump http_limit'
 179             }
 180             @ferm::rule { "dsa-http-yahoo":
 181                 prio            => "21",
 182                 description     => "slow yahoo spider",
 183                 chain           => 'limit_yahoo',
 184                 rule            => '
 185                                     mod connlimit connlimit-above 2 connlimit-mask 16 jump DROP;
 186                                     jump http_limit'
 187             }
 188             @ferm::rule { "dsa-http-google":
 189                 prio            => "21",
 190                 description     => "slow google spider",
 191                 chain           => 'limit_google',
 192                 rule            => '
 193                                     mod connlimit connlimit-above 2 connlimit-mask 19 jump DROP;
 194                                     jump http_limit'
 195             }
 196             @ferm::rule { "dsa-http-bing":
 197                 prio            => "21",
 198                 description     => "slow bing spider",
 199                 chain           => 'limit_bing',
 200                 rule            => '
 201                                     mod connlimit connlimit-above 2 connlimit-mask 16 jump DROP;
 202                                     jump http_limit'
 203             }
 204             @ferm::rule { "dsa-http-baidu":
 205                 prio            => "21",
 206                 description     => "slow baidu spider",
 207                 chain           => 'limit_baidu',
 208                 rule            => '
 209                                     mod connlimit connlimit-above 2 connlimit-mask 16 jump DROP;
 210                                     jump http_limit'
 211             }
 212             @ferm::rule { "dsa-http-rules":
 213                 prio            => "22",
 214                 description     => "http subchain",
 215                 chain           => 'http',
 216                 rule            => '
 217                                     saddr ( 74.6.22.182 74.6.18.240 67.195.0.0/16 ) jump limit_yahoo;
 218                                     saddr 124.115.0.0/21 jump limit_sosospider;
 219                                     saddr (65.52.0.0/14 207.46.0.0/16) jump limit_bing;
 220                                     saddr (66.249.64.0/19) jump limit_google;
 221                                     saddr (123.125.71.0/24 119.63.192.0/21 180.76.0.0/16) jump limit_baidu;
 222
 223                                     mod recent name HTTPDOS update seconds 1800 jump log_or_drop;
 224                                     mod hashlimit hashlimit-name HTTPDOS hashlimit-mode srcip hashlimit-burst 600 hashlimit 30/minute jump ACCEPT;
 225                                     mod recent name HTTPDOS set jump log_or_drop'
 226             }
 227             @ferm::rule { "dsa-http":
 228                 prio            => "23",
 229                 description     => "Allow web access",
 230                 rule            => "proto tcp dport (http https) jump http"
 231             }
 232         }
 233         default: {
 234             @ferm::rule { "dsa-http":
 235                 prio            => "23",
 236                 description     => "Allow web access",
 237                 rule            => "&SERVICE(tcp, (http https))"
 238             }
 239         }
 240     }
 241     @ferm::rule { "dsa-http-v6":
 242         domain          => "(ip6)",
 243         prio            => "23",
 244         description     => "Allow web access",
 245         rule            => "&SERVICE(tcp, (http https))"
 246     }
 247 }
 248 # vim:set et:
 249 # vim:set sts=4 ts=4:
 250 # vim:set shiftwidth=4: