modules/debian-org/manifests/init.pp

   1 # == Class: debian-org
   2 #
   3 # Stuff common to all debian.org servers
   4 #
   5 class debian-org {
   6         if getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') {
   7                 $mirror = getfromhash($site::nodeinfo, 'hoster', 'mirror-debian')
   8         } else {
   9                 $mirror = 'http://http.debian.net/debian/'
  10         }
  11         if $::lsbmajdistrelease != "testing/unstable" and $::lsbmajdistrelease < 7 {
  12                 $mirror_backports = 'http://backports.debian.org/debian-backports/'
  13         } else {
  14                 $mirror_backports = $mirror
  15         }
  16
  17         $debianadmin = [
  18                 'debian-archive-debian-samhain-reports@master.debian.org',
  19                 'debian-admin@ftbfs.de',
  20                 'weasel@debian.org',
  21                 'steve@lobefin.net',
  22                 'paravoid@debian.org',
  23                 'zumbi@kos.to'
  24         ]
  25
  26         package { [
  27                         'klogd',
  28                         'sysklogd',
  29                         'rsyslog',
  30                         'os-prober',
  31                         'apt-listchanges',
  32                 ]:
  33                 ensure => purged,
  34         }
  35         package { [
  36                         'debian.org',
  37                         'dsa-munin-plugins',
  38                 ]:
  39                 ensure => installed,
  40                 tag    => extra_repo,
  41         }
  42         file { '/etc/ssh/ssh_known_hosts':
  43                 ensure  => present,
  44                 replace => false,
  45                 mode    => '0644',
  46                 source  => 'puppet:///modules/debian-org/basic-ssh_known_hosts'
  47         }
  48
  49         package { [
  50                         'apt-utils',
  51                         'bash-completion',
  52                         'dnsutils',
  53                         'less',
  54                         'lsb-release',
  55                         'libfilesystem-ruby1.8',
  56                         'mtr-tiny',
  57                         'nload',
  58                         'pciutils',
  59                 ]:
  60                 ensure => installed,
  61         }
  62
  63         if $::lsbmajdistrelease == "testing/unstable" or $::lsbmajdistrelease >= 7 {
  64                 package { 'libfilesystem-ruby1.9.1':
  65                         ensure => installed,
  66                 }
  67         }
  68
  69         munin::check { [
  70                         'cpu',
  71                         'entropy',
  72                         'forks',
  73                         'interrupts',
  74                         'iostat',
  75                         'irqstats',
  76                         'load',
  77                         'memory',
  78                         'ntp_offset',
  79                         'ntp_states',
  80                         'open_files',
  81                         'open_inodes',
  82                         'processes',
  83                         'swap',
  84                         'uptime',
  85                         'vmstat',
  86                 ]:
  87         }
  88
  89         if getfromhash($site::nodeinfo, 'broken-rtc') {
  90                 package { 'fake-hwclock':
  91                         ensure => installed,
  92                         tag    => extra_repo,
  93                 }
  94         }
  95
  96         package { 'molly-guard':
  97                 ensure => installed,
  98         }
  99         file { '/etc/molly-guard/run.d/10-check-kvm':
 100                 mode    => '0755',
 101                 source  => 'puppet:///modules/debian-org/molly-guard/10-check-kvm',
 102                 require => Package['molly-guard'],
 103         }
 104         file { '/etc/molly-guard/run.d/15-acquire-reboot-lock':
 105                 mode    => '0755',
 106                 source  => 'puppet:///modules/debian-org/molly-guard/15-acquire-reboot-lock',
 107                 require => Package['molly-guard'],
 108         }
 109
 110         file { '/etc/apt/trusted-keys.d':
 111                 ensure => absent,
 112                 force  => true,
 113         }
 114
 115         file { '/etc/apt/trusted.gpg':
 116                 mode    => '0600',
 117                 content => "",
 118         }
 119
 120         site::aptrepo { 'security':
 121                 url        => 'http://security.debian.org/',
 122                 suite      => "${::lsbdistcodename}/updates",
 123                 components => ['main','contrib','non-free']
 124         }
 125         if $::lsbmajdistrelease != "testing/unstable" and $::lsbmajdistrelease < 7 {
 126                 site::aptrepo { 'debian-lts':
 127                         url        => $mirror,
 128                         suite      => "${::lsbdistcodename}-lts",
 129                         components => ['main','contrib','non-free']
 130                 }
 131         } else {
 132                 site::aptrepo { 'debian-lts':
 133                         ensure => absent,
 134                 }
 135         }
 136
 137         site::aptrepo { 'backports.debian.org':
 138                 url        => $mirror_backports,
 139                 suite      => "${::lsbdistcodename}-backports",
 140                 components => ['main','contrib','non-free']
 141         }
 142
 143         site::aptrepo { 'volatile':
 144                 url        => $mirror,
 145                 suite      => "${::lsbdistcodename}-updates",
 146                 components => ['main','contrib','non-free']
 147         }
 148
 149         #if ($::hostname in [ball, corelli, eysler, lucatelli, mayer, mayr, pettersson]) or
 150         #   ($::hoster and ($::hoster in [bytemark, man-da, brown])) {
 151         #       site::aptrepo { 'proposed-updates':
 152         #               url        => $mirror,
 153         #               suite      => "${::lsbdistcodename}-proposed-updates",
 154         #               components => ['main','contrib','non-free']
 155         #       }
 156         #} else {
 157                 site::aptrepo { 'proposed-updates':
 158                         ensure => absent,
 159                 }
 160         #}
 161
 162         site::aptrepo { 'debian.org':
 163                 ensure => absent,
 164         }
 165
 166         site::aptrepo { 'db.debian.org':
 167                 url        => 'http://db.debian.org/debian-admin',
 168                 suite      => 'debian-all',
 169                 components => 'main',
 170                 key        => 'puppet:///modules/debian-org/db.debian.org.gpg',
 171         }
 172         site::aptrepo { 'db.debian.org-suite':
 173                 url        => 'http://db.debian.org/debian-admin',
 174                 suite      => $::lsbdistcodename,
 175                 components => 'main',
 176         }
 177
 178         augeas { 'inittab_replicate':
 179                 context => '/files/etc/inittab',
 180                 changes => [
 181                         'set ud/runlevels 2345',
 182                         'set ud/action respawn',
 183                         'set ud/process "/usr/bin/ud-replicated -d"',
 184                 ],
 185                 notify  => Exec['init q'],
 186         }
 187
 188         if getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') {
 189                 site::aptrepo { 'debian':
 190                         url        => getfromhash($site::nodeinfo, 'hoster', 'mirror-debian'),
 191                         suite      => $::lsbdistcodename,
 192                         components => ['main','contrib','non-free']
 193                 }
 194         }
 195
 196         file { '/etc/facter':
 197                 ensure  => directory,
 198                 purge   => true,
 199                 force   => true,
 200                 recurse => true,
 201                 source  => 'puppet:///files/empty/',
 202         }
 203         file { '/etc/facter/facts.d':
 204                 ensure => directory,
 205         }
 206         file { '/etc/facter/facts.d/debian_facts.yaml':
 207                 content => template('debian-org/debian_facts.yaml.erb')
 208         }
 209         file { '/etc/apt/preferences':
 210                 source => 'puppet:///modules/debian-org/apt.preferences',
 211         }
 212         file { '/etc/apt/apt.conf.d/local-compression':
 213                 source => 'puppet:///modules/debian-org/apt.conf.d/local-compression',
 214         }
 215         file { '/etc/apt/apt.conf.d/local-recommends':
 216                 source => 'puppet:///modules/debian-org/apt.conf.d/local-recommends',
 217         }
 218         file { '/etc/apt/apt.conf.d/local-pdiffs':
 219                 source => 'puppet:///modules/debian-org/apt.conf.d/local-pdiffs',
 220         }
 221         file { '/etc/timezone':
 222                 source => 'puppet:///modules/debian-org/timezone',
 223                 notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'],
 224         }
 225         if $::hostname == handel {
 226                 include puppetmaster::db
 227                 $dbpassword = $puppetmaster::db::password
 228         }
 229         file { '/etc/puppet/puppet.conf':
 230                 content => template('debian-org/puppet.conf.erb'),
 231         }
 232         file { '/etc/default/puppet':
 233                 source => 'puppet:///modules/debian-org/puppet.default',
 234         }
 235         file { '/etc/cron.d/dsa-puppet-stuff':
 236                 source  => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron',
 237                 require => Package['debian.org'],
 238         }
 239         file { '/etc/ldap/ldap.conf':
 240                 require => Package['debian.org'],
 241                 source  => 'puppet:///modules/debian-org/ldap.conf',
 242         }
 243         file { '/etc/pam.d/common-session':
 244                 require => Package['debian.org'],
 245                 content => template('debian-org/pam.common-session.erb'),
 246         }
 247         file { '/etc/pam.d/common-session-noninteractive':
 248                 require => Package['debian.org'],
 249                 content => template('debian-org/pam.common-session-noninteractive.erb'),
 250         }
 251         file { '/etc/rc.local':
 252                 mode   => '0755',
 253                 source => 'puppet:///modules/debian-org/rc.local',
 254                 notify => Exec['rc.local start'],
 255         }
 256         file { '/etc/dsa':
 257                 ensure => directory,
 258                 mode   => '0755',
 259         }
 260         file { '/etc/dsa/cron.ignore.dsa-puppet-stuff':
 261                 source  => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron.ignore',
 262                 require => Package['debian.org']
 263         }
 264         file { '/etc/nsswitch.conf':
 265                 mode   => '0755',
 266                 source => 'puppet:///modules/debian-org/nsswitch.conf',
 267         }
 268
 269         # set mmap_min_addr to 4096 to mitigate
 270         # Linux NULL-pointer dereference exploits
 271         site::sysctl { 'mmap_min_addr':
 272                 ensure => absent
 273         }
 274         site::sysctl { 'perf_event_paranoid':
 275                 key   => 'kernel.perf_event_paranoid',
 276                 value => '2',
 277         }
 278         site::alternative { 'editor':
 279                 linkto => '/usr/bin/vim.basic',
 280         }
 281         site::alternative { 'view':
 282                 linkto => '/usr/bin/vim.basic',
 283         }
 284         mailalias { 'samhain-reports':
 285                 ensure    => present,
 286                 recipient => $debianadmin,
 287                 require   => Package['debian.org']
 288         }
 289
 290         file { '/usr/local/bin/check_for_updates':
 291                 source => 'puppet:///modules/debian-org/check_for_updates',
 292                 mode   => '0755',
 293                 owner  => root,
 294                 group  => root,
 295         }
 296
 297         exec { 'apt-get update':
 298                 path    => '/usr/bin:/usr/sbin:/bin:/sbin',
 299                 onlyif  => '/usr/local/bin/check_for_updates',
 300                 require => File['/usr/local/bin/check_for_updates']
 301         }
 302         Exec['apt-get update']->Package<| tag == extra_repo |>
 303
 304         exec { 'dpkg-reconfigure tzdata -pcritical -fnoninteractive':
 305                 path        => '/usr/bin:/usr/sbin:/bin:/sbin',
 306                 refreshonly => true
 307         }
 308         exec { 'puppetmaster restart':
 309                 path        => '/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin',
 310                 refreshonly => true
 311         }
 312         exec { 'rc.local start':
 313                 path        => '/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin',
 314                 refreshonly => true
 315         }
 316         exec { 'init q':
 317                 refreshonly => true
 318         }
 319
 320         tidy { '/var/lib/puppet/clientbucket/':
 321                 age      => '2w',
 322                 recurse  => 9,
 323                 type     => ctime,
 324                 matches  => [ 'paths', 'contents' ],
 325                 schedule => weekly
 326         }
 327
 328         file { '/root/.bashrc':
 329                 source => 'puppet:///modules/debian-org/root-dotfiles/bashrc',
 330         }
 331         file { '/root/.profile':
 332                 source => 'puppet:///modules/debian-org/root-dotfiles/profile',
 333         }
 334         file { '/root/.screenrc':
 335                 source => 'puppet:///modules/debian-org/root-dotfiles/screenrc',
 336         }
 337         file { '/root/.vimrc':
 338                 source => 'puppet:///modules/debian-org/root-dotfiles/vimrc',
 339         }
 340 }