modules/debian-org/manifests/init.pp

   1 class debian-org {
   2
   3         $debianadmin = [
   4                 'debian-archive-debian-samhain-reports@master.debian.org',
   5                 'debian-admin@ftbfs.de',
   6                 'weasel@debian.org',
   7                 'steve@lobefin.net',
   8                 'paravoid@debian.org'
   9         ]
  10
  11         package { [
  12                         'klogd',
  13                         'sysklogd',
  14                         'rsyslog',
  15                 ]:
  16                 ensure => purged,
  17         }
  18         package { [
  19                         'debian.org',
  20                         'dsa-munin-plugins',
  21                 ]:
  22                 ensure => installed,
  23                 require => [
  24                         File['/etc/apt/sources.list.d/db.debian.org.list'],
  25                         Exec['apt-get update']
  26                 ]
  27         }
  28         package { [
  29                         'apt-utils',
  30                         'bash-completion',
  31                         'dnsutils',
  32                         'less',
  33                         'lsb-release',
  34                         'libfilesystem-ruby1.8',
  35                         'mtr-tiny',
  36                         'nload',
  37                         'pciutils',
  38                 ]:
  39                 ensure => installed,
  40         }
  41
  42         if $::lsbmajdistrelease >= 7 {
  43                 package { 'libfilesystem-ruby1.9':
  44                         ensure => installed,
  45                 }
  46         }
  47
  48         munin::check { [
  49                         'cpu',
  50                         'entropy',
  51                         'forks',
  52                         'interrupts',
  53                         'iostat',
  54                         'irqstats',
  55                         'load',
  56                         'memory',
  57                         'ntp_offset',
  58                         'ntp_states',
  59                         'open_files',
  60                         'open_inodes',
  61                         'processes',
  62                         'swap',
  63                         'uptime',
  64                         'vmstat',
  65                 ]:
  66         }
  67
  68         if getfromhash($site::nodeinfo, 'broken-rtc') {
  69                 package { 'fake-hwclock':
  70                         ensure => installed,
  71                         require => [
  72                                 File['/etc/apt/sources.list.d/db.debian.org.list'],
  73                                 Exec['apt-get update']
  74                         ]
  75                 }
  76         }
  77
  78         package { 'molly-guard':
  79                 ensure => installed,
  80         }
  81         file { '/etc/molly-guard/run.d/10-check-kvm':
  82                 mode    => '0755',
  83                 source  => 'puppet:///modules/debian-org/molly-guard/10-check-kvm',
  84                 require => Package['molly-guard'],
  85         }
  86         file { '/etc/molly-guard/run.d/15-acquire-reboot-lock':
  87                 mode    => '0755',
  88                 source  => 'puppet:///modules/debian-org/molly-guard/15-acquire-reboot-lock',
  89                 require => Package['molly-guard'],
  90         }
  91
  92         site::aptrepo { 'security':
  93                 url        => 'http://security.debian.org/',
  94                 suite      => "${::lsbdistcodename}/updates",
  95                 components => ['main','contrib','non-free']
  96         }
  97
  98         if $::lsbdistcodename != 'wheezy' {
  99                 site::aptrepo { 'backports.debian.org':
 100                         url        => 'http://backports.debian.org/debian-backports/',
 101                         suite      => "${::lsbdistcodename}-backports",
 102                         components => ['main','contrib','non-free']
 103                 }
 104
 105                 if getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') {
 106                         site::aptrepo { 'volatile':
 107                                 url        => getfromhash($site::nodeinfo, 'hoster', 'mirror-debian'),
 108                                 suite      => "${::lsbdistcodename}-updates",
 109                                 components => ['main','contrib','non-free']
 110                         }
 111                 } else {
 112                         site::aptrepo { 'volatile':
 113                                 url        => 'http://ftp.debian.org/debian',
 114                                 suite      => "${::lsbdistcodename}-updates",
 115                                 components => ['main','contrib','non-free']
 116                         }
 117                 }
 118         }
 119         site::aptrepo { 'backports.org':
 120                 ensure => absent,
 121                 keyid => '16BA136C',
 122                 key => 'puppet:///modules/debian-org/backports.org.asc',
 123         }
 124
 125         site::aptrepo { 'debian.org':
 126                 ensure => absent,
 127         }
 128
 129         site::aptrepo { 'db.debian.org':
 130                 url        => 'http://db.debian.org/debian-admin',
 131                 suite      => 'lenny',
 132                 components => 'main',
 133                 key        => 'puppet:///modules/debian-org/db.debian.org.asc',
 134         }
 135
 136         if getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') {
 137                 site::aptrepo { 'debian':
 138                         url        => getfromhash($site::nodeinfo, 'hoster', 'mirror-debian'),
 139                         suite      => $::lsbdistcodename,
 140                         components => ['main','contrib','non-free']
 141                 }
 142         }
 143
 144         file { '/etc/facter':
 145                 ensure  => directory,
 146                 purge   => true,
 147                 force   => true,
 148                 recurse => true,
 149                 source  => 'puppet:///files/empty/',
 150         }
 151         file { '/etc/facter/facts.d':
 152                 ensure => directory,
 153         }
 154         file { '/etc/facter/facts.d/debian_facts.yaml':
 155                 content => template('debian-org/debian_facts.yaml.erb')
 156         }
 157         file { '/etc/apt/preferences':
 158                 source => 'puppet:///modules/debian-org/apt.preferences',
 159         }
 160         file { '/etc/apt/trusted-keys.d/':
 161                 ensure => directory,
 162                 purge  => true,
 163         }
 164         file { '/etc/apt/apt.conf.d/local-compression':
 165                 source => 'puppet:///modules/debian-org/apt.conf.d/local-compression',
 166         }
 167         file { '/etc/apt/apt.conf.d/local-recommends':
 168                 source => 'puppet:///modules/debian-org/apt.conf.d/local-recommends',
 169         }
 170         file { '/etc/apt/apt.conf.d/local-pdiffs':
 171                 source => 'puppet:///modules/debian-org/apt.conf.d/local-pdiffs',
 172         }
 173         file { '/etc/timezone':
 174                 source => 'puppet:///modules/debian-org/timezone',
 175                 notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'],
 176         }
 177         if $::hostname == handel {
 178                 include puppetmaster::db
 179                 $dbpassword = $puppetmaster::db::password
 180         }
 181         file { '/etc/puppet/puppet.conf':
 182                 content => template('debian-org/puppet.conf.erb'),
 183         }
 184         file { '/etc/default/puppet':
 185                 source => 'puppet:///modules/debian-org/puppet.default',
 186         }
 187         file { '/etc/cron.d/dsa-puppet-stuff':
 188                 source => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron',
 189                 require => Package['debian.org'],
 190         }
 191         file { '/etc/ldap/ldap.conf':
 192                 require => Package['debian.org'],
 193                 source => 'puppet:///modules/debian-org/ldap.conf',
 194         }
 195         file { '/etc/pam.d/common-session':
 196                 require => Package['debian.org'],
 197                 content => template('debian-org/pam.common-session.erb'),
 198         }
 199         file { '/etc/pam.d/common-session-noninteractive':
 200                 require => Package['debian.org'],
 201                 content => template('debian-org/pam.common-session-noninteractive.erb'),
 202         }
 203         file { '/etc/rc.local':
 204                 mode   => '0755',
 205                 source => 'puppet:///modules/debian-org/rc.local',
 206                 notify => Exec['rc.local start'],
 207         }
 208         file { '/etc/dsa':
 209                 ensure => directory,
 210                 mode   => '0755',
 211         }
 212         file { '/etc/dsa/cron.ignore.dsa-puppet-stuff':
 213                 source  => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron.ignore',
 214                 require => Package['debian.org']
 215         }
 216
 217         # set mmap_min_addr to 4096 to mitigate
 218         # Linux NULL-pointer dereference exploits
 219         site::sysctl { 'mmap_min_addr':
 220                 key   => 'vm.mmap_min_addr',
 221                 value => '4096',
 222         }
 223         site::alternative { 'editor':
 224                 linkto => '/usr/bin/vim.basic',
 225         }
 226         site::alternative { 'view':
 227                 linkto => '/usr/bin/vim.basic',
 228         }
 229         mailalias { 'samhain-reports':
 230                 ensure => present,
 231                 recipient => $debianadmin,
 232                 require => Package['debian.org']
 233         }
 234
 235         exec { 'apt-get update':
 236                 path        => '/usr/bin:/usr/sbin:/bin:/sbin',
 237                 refreshonly => true,
 238         }
 239
 240         exec { 'dpkg-reconfigure tzdata -pcritical -fnoninteractive':
 241                 path        => '/usr/bin:/usr/sbin:/bin:/sbin',
 242                 refreshonly => true
 243         }
 244         exec { 'puppetmaster restart':
 245                 path        => '/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin',
 246                 refreshonly => true
 247         }
 248         exec { 'rc.local start':
 249                 path        => '/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin',
 250                 refreshonly => true
 251         }
 252         exec { 'init q':
 253                 refreshonly => true
 254         }
 255 }