modules/debian-org/manifests/init.pp

   1 define sysctl($key, $value, $ensure=present) {
   2     file {
   3         "/etc/sysctl.d/$name.conf":
   4             ensure  => $ensure,
   5             owner   => root,
   6             group   => root,
   7             mode    => 0644,
   8             content => "$key = $value\n",
   9             notify  => Exec["procps restart"],
  10     }
  11 }
  12
  13 define set_alternatives($linkto) {
  14     exec {
  15         "/usr/sbin/update-alternatives --set $name $linkto":
  16             unless => "/bin/sh -c '! [ -e $linkto ] || ! [ -e /etc/alternatives/$name ] || ([ -L /etc/alternatives/$name ] && [ /etc/alternatives/$name -ef $linkto ])'"
  17         }
  18 }
  19
  20
  21 class debian-org {
  22     package {
  23         "apt-utils": ensure => installed;
  24         "bash-completion": ensure => installed;
  25         "bzip2": ensure => installed;
  26         "cron": ensure => installed;
  27         "csh": ensure => installed;
  28         "dnsutils": ensure => installed;
  29         "dsa-munin-plugins": ensure => installed;
  30         "ed": ensure => installed;
  31         "gnupg": ensure => installed;
  32         "klogd": ensure => purged;
  33         "ksh": ensure => installed;
  34         "less": ensure => installed;
  35         "libfilesystem-ruby1.8": ensure => installed;
  36         "libpam-pwdfile": ensure => installed;
  37         "locales-all": ensure => installed;
  38         "mtr-tiny": ensure => installed;
  39         "nload": ensure => installed;
  40         "pciutils": ensure => installed;
  41         "pdksh": ensure => installed;
  42         "puppet": ensure => installed;
  43         "rsyslog": ensure => purged;
  44         "sysklogd": ensure => purged;
  45         "syslog-ng": ensure => installed;
  46         "tcsh": ensure => installed;
  47         "userdir-ldap": ensure => installed;
  48         "vim": ensure => installed;
  49         "zsh": ensure => installed;
  50         "logrotate": ensure => installed;
  51     }
  52     file {
  53         "/etc/apt/preferences":
  54             source => "puppet:///files/etc/apt/preferences";
  55         "/etc/apt/sources.list.d/backports.org.list":
  56             content => template("debian-org/etc/apt/sources.list.d/backports.org.list.erb"),
  57             notify  => Exec["apt-get update"];
  58         "/etc/apt/sources.list.d/debian.org.list":
  59             content => template("debian-org/etc/apt/sources.list.d/debian.org.list.erb"),
  60             notify  => Exec["apt-get update"];
  61         "/etc/apt/sources.list.d/security.list":
  62             content => template("debian-org/etc/apt/sources.list.d/security.list.erb"),
  63             notify  => Exec["apt-get update"];
  64         "/etc/apt/sources.list.d/volatile.list":
  65             content => template("debian-org/etc/apt/sources.list.d/volatile.list.erb"),
  66             notify  => Exec["apt-get update"];
  67         "/etc/apt/apt.conf.d/local-recommends":
  68             source => "puppet:///files/etc/apt/apt.conf.d/local-recommends";
  69         "/etc/apt/apt.conf.d/local-pdiffs":
  70             source => "puppet:///files/etc/apt/apt.conf.d/local-pdiffs";
  71         "/etc/timezone":
  72             source => "puppet:///files/etc/timezone",
  73             notify => Exec["dpkg-reconfigure tzdata -pcritical -fnoninteractive"];
  74         "/etc/puppet/puppet.conf":
  75             require => Package["puppet"],
  76             source => "puppet:///files/etc/puppet/puppet.conf"
  77             ;
  78         "/etc/default/puppet":
  79             require => Package["puppet"],
  80             source => "puppet:///files/etc/default/puppet"
  81             ;
  82
  83         "/etc/syslog-ng/syslog-ng.conf":
  84             content => template("syslog-ng.conf.erb"),
  85             require => Package["syslog-ng"],
  86             notify  => Exec["syslog-ng reload"],
  87             ;
  88         "/etc/logrotate.d/syslog-ng":
  89             require => Package["syslog-ng"],
  90             source => "puppet:///files/etc/logrotate.d/syslog-ng",
  91             ;
  92         "/etc/cron.d/dsa-puppet-stuff":
  93             source => "puppet:///files/etc/cron.d/dsa-puppet-stuff",
  94             require => Package["cron"]
  95             ;
  96         "/etc/ldap/ldap.conf":
  97             require => Package["userdir-ldap"],
  98             source => "puppet:///files/etc/ldap/ldap.conf",
  99             ;
 100         "/etc/pam.d/common-session":
 101             require => Package["libpam-pwdfile"],
 102             source => "puppet:///files/etc/pam.d/common-session",
 103             ;
 104     }
 105     case $hostname {
 106         handel: {
 107             file {
 108                 "/etc/puppet/lib":
 109                     ensure  => directory,
 110                     source => "puppet:///files/etc/puppet/lib",
 111                     recurse => true,
 112                     notify  => Exec["puppetmaster restart"];
 113              }
 114          }
 115     }
 116
 117     # set mmap_min_addr to 4096 to mitigate
 118     # Linux NULL-pointer dereference exploits
 119     sysctl {
 120         "mmap_min_addr" :
 121             key         => "vm.mmap_min_addr",
 122             value       => 4096,
 123     }
 124
 125     set_alternatives {
 126         "editor":
 127             linkto => "/usr/bin/vim.basic",
 128     }
 129
 130     exec {
 131         "syslog-ng reload":
 132             path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 133             refreshonly => true;
 134         "dpkg-reconfigure tzdata -pcritical -fnoninteractive":
 135             path        => "/usr/bin:/usr/sbin:/bin:/sbin",
 136             refreshonly => true;
 137         "apt-get update":
 138             command => 'apt-get update',
 139             path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 140             refreshonly => true;
 141         "puppetmaster restart":
 142             path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 143             refreshonly => true;
 144         "procps restart":
 145             path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 146             refreshonly => true;
 147         "init q":
 148             refreshonly => true;
 149     }
 150 }
 151
 152 class debian-proliant inherits debian-org {
 153     package {
 154         "hpacucli": ensure => installed;
 155         "hp-health": ensure => installed;
 156         "cpqarrayd": ensure => installed;
 157         "arrayprobe": ensure => installed;
 158     }
 159     case $debarchitecture {
 160         "amd64": {
 161             package { "lib32gcc1": ensure => installed; }
 162         }
 163     }
 164     file {
 165         "/etc/apt/sources.list.d/debian.restricted.list":
 166             content => template("debian-org/etc/apt/sources.list.d/debian.restricted.list.erb"),
 167             notify  => Exec["apt-get update"];
 168     }
 169 }
 170 # vim:set et:
 171 # vim:set sts=4 ts=4:
 172 # vim:set shiftwidth=4: