modules/debian-org/manifests/init.pp

   1 define sysctl($key, $value, $ensure=present) {
   2     file { "/etc/sysctl.d/$name.conf":
   3         ensure  => $ensure,
   4         owner   => root,
   5         group   => root,
   6         mode    => 0644,
   7         content => "$key = $value\n",
   8         notify  => Exec["procps restart"],
   9     }
  10 }
  11
  12 define set_alternatives($linkto) {
  13         exec { "/usr/sbin/update-alternatives --set $name $linkto":
  14             unless => "/bin/sh -c '! [ -e $linkto ] || ! [ -e /etc/alternatives/$name ] || ([ -L /etc/alternatives/$name ] && [ /etc/alternatives/$name -ef $linkto ])'"
  15         }
  16 }
  17
  18
  19 class debian-org {
  20
  21    package { "userdir-ldap": ensure => installed;
  22              "zsh": ensure => installed;
  23              "cron": ensure => installed;
  24              "apt-utils": ensure => installed;
  25              "tcsh": ensure => installed;
  26              "pdksh": ensure => installed;
  27              "ksh": ensure => installed;
  28              "csh": ensure => installed;
  29              "locales-all": ensure => installed;
  30              "libpam-pwdfile": ensure => installed;
  31              "vim": ensure => installed;
  32              "gnupg": ensure => installed;
  33              "bzip2": ensure => installed;
  34              "less": ensure => installed;
  35              "ed": ensure => installed;
  36              "puppet": ensure => installed;
  37              "mtr-tiny": ensure => installed;
  38              "nload": ensure => installed;
  39              "pciutils": ensure => installed;
  40              "dnsutils": ensure => installed;
  41              "bash-completion": ensure => installed;
  42              "libfilesystem-ruby1.8": ensure => installed;
  43              "syslog-ng": ensure => installed;
  44              "sysklogd": ensure => purged;
  45              "klogd": ensure => purged;
  46              "rsyslog": ensure => purged;
  47    }
  48    file {
  49       "/etc/apt/preferences":
  50              source => "puppet:///files/etc/apt/preferences";
  51       "/etc/apt/sources.list.d/backports.org.list":
  52              content => template("debian-org/etc/apt/sources.list.d/backports.org.list.erb"),
  53              notify  => Exec["apt-get update"];
  54       "/etc/apt/sources.list.d/debian.org.list":
  55              content => template("debian-org/etc/apt/sources.list.d/debian.org.list.erb"),
  56              notify  => Exec["apt-get update"];
  57       "/etc/apt/sources.list.d/security.list":
  58              content => template("debian-org/etc/apt/sources.list.d/security.list.erb"),
  59              notify  => Exec["apt-get update"];
  60       "/etc/apt/sources.list.d/volatile.list":
  61              content => template("debian-org/etc/apt/sources.list.d/volatile.list.erb"),
  62              notify  => Exec["apt-get update"];
  63       "/etc/apt/apt.conf.d/local-recommends":
  64              source => "puppet:///files/etc/apt/apt.conf.d/local-recommends";
  65       "/etc/apt/apt.conf.d/local-pdiffs":
  66              source => "puppet:///files/etc/apt/apt.conf.d/local-pdiffs";
  67       "/etc/timezone":
  68              source => "puppet:///files/etc/timezone",
  69              notify => Exec["dpkg-reconfigure tzdata -pcritical -fnoninteractive"];
  70       "/etc/puppet/puppet.conf":
  71              require => Package["puppet"],
  72              source => "puppet:///files/etc/puppet/puppet.conf"
  73              ;
  74       "/etc/default/puppet":
  75              require => Package["puppet"],
  76              source => "puppet:///files/etc/default/puppet"
  77              ;
  78
  79       "/etc/syslog-ng/syslog-ng.conf":
  80              content => template("syslog-ng.conf.erb"),
  81              require => Package["syslog-ng"],
  82              notify  => Exec["syslog-ng reload"],
  83              ;
  84       "/etc/logrotate.d/syslog-ng":
  85              require => Package["syslog-ng"],
  86              source => "puppet:///files/etc/logrotate.d/syslog-ng",
  87              ;
  88       "/etc/cron.d/dsa-puppet-stuff":
  89              source => "puppet:///files/etc/cron.d/dsa-puppet-stuff",
  90              require => Package["cron"]
  91              ;
  92       "/etc/ldap/ldap.conf":
  93              require => Package["userdir-ldap"],
  94              source => "puppet:///files/etc/ldap/ldap.conf",
  95              ;
  96       "/etc/pam.d/common-session":
  97              require => Package["libpam-pwdfile"],
  98              source => "puppet:///files/etc/pam.d/common-session",
  99              ;
 100    }
 101    case $hostname {
 102         handel: {
 103             file {
 104                "/etc/puppet/lib":
 105                       ensure  => directory,
 106                       source => "puppet:///files/etc/puppet/lib",
 107                       recurse => true,
 108                       notify  => Exec["puppetmaster restart"];
 109             }
 110         }
 111         default: {}
 112    }
 113
 114    # set mmap_min_addr to 4096 to mitigate
 115    # Linux NULL-pointer dereference exploits
 116    sysctl { "mmap_min_addr" :
 117              key         => "vm.mmap_min_addr",
 118              value       => 4096,
 119    }
 120
 121    set_alternatives { "editor":
 122            linkto => "/usr/bin/vim.basic",
 123    }
 124
 125    exec { "syslog-ng reload":
 126              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 127              refreshonly => true,
 128    }
 129    exec { "dpkg-reconfigure tzdata -pcritical -fnoninteractive":
 130            path        => "/usr/bin:/usr/sbin:/bin:/sbin",
 131            refreshonly => true,
 132    }
 133    exec { "apt-get update":
 134              command => 'apt-get update',
 135              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 136              refreshonly => true
 137    }
 138    exec { "puppetmaster restart":
 139              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 140              refreshonly => true,
 141    }
 142    exec { "procps restart":
 143              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 144              refreshonly => true,
 145    }
 146 }
 147
 148 class debian-proliant inherits debian-org {
 149    package {
 150       "hpacucli": ensure => installed;
 151       "hp-health": ensure => installed;
 152       "cpqarrayd": ensure => installed;
 153       "arrayprobe": ensure => installed;
 154    }
 155    case $debarchitecture {
 156       "amd64": {
 157          package { "lib32gcc1": ensure => installed; }
 158       }
 159    }
 160    file {
 161       "/etc/apt/sources.list.d/debian.restricted.list":
 162              content => template("debian-org/etc/apt/sources.list.d/debian.restricted.list.erb"),
 163              notify  => Exec["apt-get update"];
 164    }
 165 }