modules/debian-org/manifests/init.pp

   1 define sysctl($key, $value, $ensure=present) {
   2     file { "/etc/sysctl.d/$name.conf":
   3         ensure  => $ensure,
   4         owner   => root,
   5         group   => root,
   6         mode    => 0644,
   7         content => "$key = $value\n",
   8         notify  => Exec["procps restart"],
   9     }
  10 }
  11
  12 define set_alternatives($linkto) {
  13         exec { "/usr/sbin/update-alternatives --set $name $linkto":
  14             unless => "/bin/sh -c '! [ -e $linkto ] || ! [ -e /etc/alternatives/$name ] || ([ -L /etc/alternatives/$name ] && [ /etc/alternatives/$name -ef $linkto ])'"
  15         }
  16 }
  17
  18
  19 class debian-org {
  20    package { "userdir-ldap": ensure => installed;
  21              "zsh": ensure => installed;
  22              "cron": ensure => installed;
  23              "apt-utils": ensure => installed;
  24              "tcsh": ensure => installed;
  25              "pdksh": ensure => installed;
  26              "ksh": ensure => installed;
  27              "csh": ensure => installed;
  28              "locales-all": ensure => installed;
  29              "libpam-pwdfile": ensure => installed;
  30              "vim": ensure => installed;
  31              "gnupg": ensure => installed;
  32              "bzip2": ensure => installed;
  33              "less": ensure => installed;
  34              "ed": ensure => installed;
  35              "puppet": ensure => installed;
  36              "mtr-tiny": ensure => installed;
  37              "nload": ensure => installed;
  38              "pciutils": ensure => installed;
  39              "dnsutils": ensure => installed;
  40              "bash-completion": ensure => installed;
  41              "libfilesystem-ruby1.8": ensure => installed;
  42              "syslog-ng": ensure => installed;
  43              "sysklogd": ensure => purged;
  44              "klogd": ensure => purged;
  45              "rsyslog": ensure => purged;
  46    }
  47    file {
  48       "/etc/apt/preferences":
  49              source => "puppet:///files/etc/apt/preferences";
  50       "/etc/apt/sources.list.d/backports.org.list":
  51              content => template("debian-org/etc/apt/sources.list.d/backports.org.list.erb"),
  52              notify  => Exec["apt-get update"];
  53       "/etc/apt/sources.list.d/debian.org.list":
  54              content => template("debian-org/etc/apt/sources.list.d/debian.org.list.erb"),
  55              notify  => Exec["apt-get update"];
  56       "/etc/apt/sources.list.d/security.list":
  57              content => template("debian-org/etc/apt/sources.list.d/security.list.erb"),
  58              notify  => Exec["apt-get update"];
  59       "/etc/apt/sources.list.d/volatile.list":
  60              content => template("debian-org/etc/apt/sources.list.d/volatile.list.erb"),
  61              notify  => Exec["apt-get update"];
  62       "/etc/apt/apt.conf.d/local-recommends":
  63              source => "puppet:///files/etc/apt/apt.conf.d/local-recommends";
  64       "/etc/apt/apt.conf.d/local-pdiffs":
  65              source => "puppet:///files/etc/apt/apt.conf.d/local-pdiffs";
  66       "/etc/timezone":
  67              source => "puppet:///files/etc/timezone",
  68              notify => Exec["dpkg-reconfigure tzdata -pcritical -fnoninteractive"];
  69       "/etc/puppet/puppet.conf":
  70              require => Package["puppet"],
  71              source => "puppet:///files/etc/puppet/puppet.conf"
  72              ;
  73       "/etc/default/puppet":
  74              require => Package["puppet"],
  75              source => "puppet:///files/etc/default/puppet"
  76              ;
  77
  78       "/etc/syslog-ng/syslog-ng.conf":
  79              content => template("syslog-ng.conf.erb"),
  80              require => Package["syslog-ng"],
  81              notify  => Exec["syslog-ng reload"],
  82              ;
  83       "/etc/logrotate.d/syslog-ng":
  84              require => Package["syslog-ng"],
  85              source => "puppet:///files/etc/logrotate.d/syslog-ng",
  86              ;
  87       "/etc/cron.d/dsa-puppet-stuff":
  88              source => "puppet:///files/etc/cron.d/dsa-puppet-stuff",
  89              require => Package["cron"]
  90              ;
  91       "/etc/ldap/ldap.conf":
  92              require => Package["userdir-ldap"],
  93              source => "puppet:///files/etc/ldap/ldap.conf",
  94              ;
  95       "/etc/pam.d/common-session":
  96              require => Package["libpam-pwdfile"],
  97              source => "puppet:///files/etc/pam.d/common-session",
  98              ;
  99    }
 100    case $hostname {
 101         handel: {
 102             file {
 103                "/etc/puppet/lib":
 104                       ensure  => directory,
 105                       source => "puppet:///files/etc/puppet/lib",
 106                       recurse => true,
 107                       notify  => Exec["puppetmaster restart"];
 108             }
 109         }
 110         default: {}
 111    }
 112
 113    # set mmap_min_addr to 4096 to mitigate
 114    # Linux NULL-pointer dereference exploits
 115    sysctl { "mmap_min_addr" :
 116              key         => "vm.mmap_min_addr",
 117              value       => 4096,
 118    }
 119
 120    set_alternatives { "editor":
 121            linkto => "/usr/bin/vim.basic",
 122    }
 123
 124    exec { "syslog-ng reload":
 125              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 126              refreshonly => true,
 127    }
 128    exec { "dpkg-reconfigure tzdata -pcritical -fnoninteractive":
 129            path        => "/usr/bin:/usr/sbin:/bin:/sbin",
 130            refreshonly => true,
 131    }
 132    exec { "apt-get update":
 133              command => 'apt-get update',
 134              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 135              refreshonly => true
 136    }
 137    exec { "puppetmaster restart":
 138              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 139              refreshonly => true,
 140    }
 141    exec { "procps restart":
 142              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 143              refreshonly => true,
 144    }
 145 }
 146
 147 class debian-proliant inherits debian-org {
 148    package {
 149       "hpacucli": ensure => installed;
 150       "hp-health": ensure => installed;
 151       "cpqarrayd": ensure => installed;
 152       "arrayprobe": ensure => installed;
 153    }
 154    case $debarchitecture {
 155       "amd64": {
 156          package { "lib32gcc1": ensure => installed; }
 157       }
 158    }
 159    file {
 160       "/etc/apt/sources.list.d/debian.restricted.list":
 161              content => template("debian-org/etc/apt/sources.list.d/debian.restricted.list.erb"),
 162              notify  => Exec["apt-get update"];
 163    }
 164 }