we probably want to logrotate these files

Signed-off-by: Stephen Gran <steve@lobefin.net>

diff --git a/modules/roles/files/backports_master/vsftpd.conf b/modules/roles/files/backports_master/vsftpd.conf
deleted file mode 100644 (file)
index 683b983..0000000
--- a/modules/roles/files/backports_master/vsftpd.conf
+++ /dev/null
@@ -1,19 +0,0 @@
-anonymous_enable=YES
-write_enable=YES
-anon_root=/srv/backports-upload
-anon_umask=027
-anon_upload_enable=YES
-chown_uploads=YES
-chown_username=dak
-
-xferlog_enable=YES
-xferlog_file=/var/log/ftp/vsftpd-backports-master.debian.org.log
-
-ftpd_banner=backports-master.debian.org FTP server
-secure_chroot_dir=/var/run/vsftpd
-pam_service_name=vsftpd
-setproctitle_enable=YES
-dirmessage_enable=YES
-ls_recurse_enable=NO
-connect_from_port_20=NO
-max_clients=100

diff --git a/modules/roles/files/ftp/vsftpd.conf b/modules/roles/files/ftp/vsftpd.conf
deleted file mode 100644 (file)
index d5c6bf2..0000000
--- a/modules/roles/files/ftp/vsftpd.conf
+++ /dev/null
@@ -1,15 +0,0 @@
-ftpd_banner=ftp.debian.org FTP server
-
-anonymous_enable=YES
-dirmessage_enable=YES
-connect_from_port_20=NO
-setproctitle_enable=YES
-ls_recurse_enable=NO
-xferlog_enable=YES
-xferlog_file=/var/log/ftp/vsftpd-ftp.debian.org.log
-
-secure_chroot_dir=/var/run/vsftpd
-pam_service_name=vsftpd
-
-anon_root=/srv/ftp.debian.org/ftp.root
-

diff --git a/modules/roles/files/ftp_upload/vsftpd.conf b/modules/roles/files/ftp_upload/vsftpd.conf
deleted file mode 100644 (file)
index a30f6fb..0000000
--- a/modules/roles/files/ftp_upload/vsftpd.conf
+++ /dev/null
@@ -1,22 +0,0 @@
-ftpd_banner=ftp.upload.debian.org FTP server
-
-max_clients=100
-
-anonymous_enable=YES
-dirmessage_enable=YES
-connect_from_port_20=NO
-setproctitle_enable=YES
-ls_recurse_enable=NO
-xferlog_enable=YES
-
-secure_chroot_dir=/var/run/vsftpd
-xferlog_file=/var/log/ftp/vsftpd-ftp.upload.debian.org.log
-pam_service_name=vsftpd
-
-anon_root=/srv/upload.debian.org/ftp
-write_enable=YES
-anon_umask=027
-anon_upload_enable=YES
-chown_uploads=YES
-chown_username=dak
-

diff --git a/modules/roles/files/security_mirror/vsftpd.conf b/modules/roles/files/security_mirror/vsftpd.conf
deleted file mode 100644 (file)
index e68fe19..0000000
--- a/modules/roles/files/security_mirror/vsftpd.conf
+++ /dev/null
@@ -1,12 +0,0 @@
-anonymous_enable=YES
-xferlog_enable=YES
-secure_chroot_dir=/var/run/vsftpd
-pam_service_name=vsftpd
-rsa_cert_file=/etc/ssl/certs/vsftpd.pem
-
-setproctitle_enable=YES
-dirmessage_enable=NO
-connect_from_port_20=NO
-xferlog_file=/var/log/ftp/vsftpd-security.debian.org.log
-ls_recurse_enable=YES
-ftpd_banner=security.debian.org FTP server (vsftpd)

diff --git a/modules/roles/manifests/backports_master.pp b/modules/roles/manifests/backports_master.pp
index 1e437250e5dcf17d0d2ad31fd66fb5d69491aaa2..68ac31404766e734a418107d7874d787cc62c790 100644 (file)
--- a/modules/roles/manifests/backports_master.pp
+++ b/modules/roles/manifests/backports_master.pp
@@ -11,14 +11,16 @@ class roles::backports_master {
        }
 
        vsftpd::site { 'backports':
-               source => 'puppet:///modules/roles/backports_master/vsftpd.conf',
-               bind   => $bind,
+               source  => 'puppet:///modules/roles/backports_master/vsftpd.conf',
+               logfile => '/var/log/ftp/vsftpd-backports-master.debian.org.log',
+               bind    => $bind,
        }
 
        if $bind6 {
                vsftpd::site { 'backports-v6':
-                       source => 'puppet:///modules/roles/security_mirror/vsftpd.conf',
-                       bind   => $bind6,
+                       source  => 'puppet:///modules/roles/security_mirror/vsftpd.conf',
+                       logfile => '/var/log/ftp/vsftpd-backports-master.debian.org.log',
+                       bind    => $bind6,
                }
        }
 

diff --git a/modules/roles/manifests/dakmaster.pp b/modules/roles/manifests/dakmaster.pp
index 08a148192c51810ca6901b2ad6b412e02c77f914..0cf923ad1fa6fe0496e73b82c87728645c158543 100644 (file)
--- a/modules/roles/manifests/dakmaster.pp
+++ b/modules/roles/manifests/dakmaster.pp
@@ -7,7 +7,7 @@ class roles::dakmaster {
        apache2::module { 'macro': }
 
        apache2::config { 'puppet-builddlist':
-               template => 'roles/conf-builddlist.erb',
+               template => 'roles/dakmaster/conf-builddlist.erb',
        }
 
 }

diff --git a/modules/roles/manifests/ftp.pp b/modules/roles/manifests/ftp.pp
index 41eecf084acd9d4ae06ae073fa7ab6623f5eec68..754b98edc41b3e23497c42ca8c9acc98f8b05f3e 100644 (file)
--- a/modules/roles/manifests/ftp.pp
+++ b/modules/roles/manifests/ftp.pp
@@ -13,14 +13,16 @@ class roles::ftp {
        }
 
        vsftpd::site { 'ftp':
-               source => 'puppet:///modules/roles/ftp/vsftpd.conf',
-               bind   => $bind,
+               source  => 'puppet:///modules/roles/ftp/vsftpd.conf',
+               logfile => '/var/log/ftp/vsftpd-ftp.debian.org.log',
+               bind    => $bind,
        }
 
        if $bind6 {
                vsftpd::site { 'ftp-v6':
-                       source => 'puppet:///modules/roles/security_mirror/vsftpd.conf',
-                       bind   => $bind6,
+                       source  => 'puppet:///modules/roles/security_mirror/vsftpd.conf',
+                       logfile => '/var/log/ftp/vsftpd-ftp.debian.org.log',
+                       bind    => $bind6,
                }
        }
 }

diff --git a/modules/roles/manifests/ftp_upload.pp b/modules/roles/manifests/ftp_upload.pp
index 326ff5b3dc83fbce6a96301a98251195569dd68b..abcc6bbd22082c62d9cea8c7f95ba1becf4d5d2b 100644 (file)
--- a/modules/roles/manifests/ftp_upload.pp
+++ b/modules/roles/manifests/ftp_upload.pp
@@ -9,14 +9,16 @@ class roles::ftp_upload {
        }
 
        vsftpd::site { 'ftp-upload':
-               source => 'puppet:///modules/roles/ftp_upload/vsftpd.conf',
-               bind   => $bind,
+               source  => 'puppet:///modules/roles/ftp_upload/vsftpd.conf',
+               logfile => '/var/log/ftp/vsftpd-ftp.upload.debian.org.log',
+               bind    => $bind,
        }
 
        if $bind6 {
                vsftpd::site { 'ftp-upload-v6':
-                       source => 'puppet:///modules/roles/security_mirror/vsftpd.conf',
-                       bind   => $bind6,
+                       source  => 'puppet:///modules/roles/security_mirror/vsftpd.conf',
+                       logfile => '/var/log/ftp/vsftpd-ftp.upload.debian.org.log',
+                       bind    => $bind6,
                }
        }
 }

diff --git a/modules/roles/manifests/security_mirror.pp b/modules/roles/manifests/security_mirror.pp
index 5f59d26b1146fc1ccf16f9794732b00e36453b75..5e3ee78fbfb0203c4518ef7b69fc4a8521f4bcbf 100644 (file)
--- a/modules/roles/manifests/security_mirror.pp
+++ b/modules/roles/manifests/security_mirror.pp
@@ -14,14 +14,16 @@ class roles::security_mirror {
        }
 
        vsftpd::site { 'security':
-               source => 'puppet:///modules/roles/security_mirror/vsftpd.conf',
-               bind   => $bind,
+               source  => 'puppet:///modules/roles/security_mirror/vsftpd.conf',
+               logfile => '/var/log/ftp/vsftpd-security.debian.org.log',
+               bind    => $bind,
        }
 
        if $bind6 {
                vsftpd::site { 'security-v6':
-                       source => 'puppet:///modules/roles/security_mirror/vsftpd.conf',
-                       bind   => $bind6,
+                       source  => 'puppet:///modules/roles/security_mirror/vsftpd.conf',
+                       logfile => '/var/log/ftp/vsftpd-security.debian.org.log',
+                       bind    => $bind6,
                }
        }
 

diff --git a/modules/roles/templates/backports_master/vsftpd.conf b/modules/roles/templates/backports_master/vsftpd.conf
new file mode 100644 (file)
index 0000000..02979ed
--- /dev/null
+++ b/modules/roles/templates/backports_master/vsftpd.conf
@@ -0,0 +1,19 @@
+anonymous_enable=YES
+write_enable=YES
+anon_root=/srv/backports-upload
+anon_umask=027
+anon_upload_enable=YES
+chown_uploads=YES
+chown_username=dak
+
+xferlog_enable=YES
+xferlog_file=<%= scope.lookupvar('logfile') %>
+
+ftpd_banner=backports-master.debian.org FTP server
+secure_chroot_dir=/var/run/vsftpd
+pam_service_name=vsftpd
+setproctitle_enable=YES
+dirmessage_enable=YES
+ls_recurse_enable=NO
+connect_from_port_20=NO
+max_clients=100

diff --git a/modules/roles/templates/conf-builddlist.erb b/modules/roles/templates/conf-builddlist.erb
deleted file mode 100644 (file)
index d216cdc..0000000
--- a/modules/roles/templates/conf-builddlist.erb
+++ /dev/null
@@ -1,26 +0,0 @@
-##
-## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
-## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
-##
-
-<Macro DebianBuilddHostList>
-
-<%=
-  lines = []
-
-  scope.lookupvar('site::allnodeinfo').keys.sort.each do |node|
-    next unless scope.lookupvar('site::allnodeinfo')[node]['purpose']
-    if scope.lookupvar('site::allnodeinfo')[node]['purpose'].include?('buildd')
-      lines << "  # #{scope.lookupvar('site::allnodeinfo')[node]['hostname'].to_s}"
-      scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |addr|
-        lines << "  allow from #{addr}"
-      end
-    end
-  end
-
-  lines.join("\n")
-# vim:set et:
-# vim:set sts=2 ts=2:
-# vim:set shiftwidth=2:
-%>
-</Macro>

diff --git a/modules/roles/templates/ftp/vsftpd.conf b/modules/roles/templates/ftp/vsftpd.conf
new file mode 100644 (file)
index 0000000..60ac366
--- /dev/null
+++ b/modules/roles/templates/ftp/vsftpd.conf
@@ -0,0 +1,15 @@
+ftpd_banner=ftp.debian.org FTP server
+
+anonymous_enable=YES
+dirmessage_enable=YES
+connect_from_port_20=NO
+setproctitle_enable=YES
+ls_recurse_enable=NO
+xferlog_enable=YES
+xferlog_file=<%= scope.lookupvar('logfile') %>
+
+secure_chroot_dir=/var/run/vsftpd
+pam_service_name=vsftpd
+
+anon_root=/srv/ftp.debian.org/ftp.root
+

diff --git a/modules/roles/templates/ftp_upload/vsftpd.conf b/modules/roles/templates/ftp_upload/vsftpd.conf
new file mode 100644 (file)
index 0000000..30612b0
--- /dev/null
+++ b/modules/roles/templates/ftp_upload/vsftpd.conf
@@ -0,0 +1,22 @@
+ftpd_banner=ftp.upload.debian.org FTP server
+
+max_clients=100
+
+anonymous_enable=YES
+dirmessage_enable=YES
+connect_from_port_20=NO
+setproctitle_enable=YES
+ls_recurse_enable=NO
+xferlog_enable=YES
+
+secure_chroot_dir=/var/run/vsftpd
+xferlog_file=<%= scope.lookupvar('logfile') %>
+pam_service_name=vsftpd
+
+anon_root=/srv/upload.debian.org/ftp
+write_enable=YES
+anon_umask=027
+anon_upload_enable=YES
+chown_uploads=YES
+chown_username=dak
+

diff --git a/modules/roles/templates/security_mirror/.vsftpd.conf.swp b/modules/roles/templates/security_mirror/.vsftpd.conf.swp
new file mode 100644 (file)
index 0000000..bf1c1d3
Binary files /dev/null and b/modules/roles/templates/security_mirror/.vsftpd.conf.swp differ

diff --git a/modules/roles/templates/security_mirror/vsftpd.conf b/modules/roles/templates/security_mirror/vsftpd.conf
new file mode 100644 (file)
index 0000000..e68fe19
--- /dev/null
+++ b/modules/roles/templates/security_mirror/vsftpd.conf
@@ -0,0 +1,12 @@
+anonymous_enable=YES
+xferlog_enable=YES
+secure_chroot_dir=/var/run/vsftpd
+pam_service_name=vsftpd
+rsa_cert_file=/etc/ssl/certs/vsftpd.pem
+
+setproctitle_enable=YES
+dirmessage_enable=NO
+connect_from_port_20=NO
+xferlog_file=/var/log/ftp/vsftpd-security.debian.org.log
+ls_recurse_enable=YES
+ftpd_banner=security.debian.org FTP server (vsftpd)

diff --git a/modules/vsftpd/manifests/site.pp b/modules/vsftpd/manifests/site.pp
index 3d61e7b3283361269dbca9413a791fa586ab6561..a2ca6cb29e2c3f91ad643853fa325af83c70897f 100644 (file)
--- a/modules/vsftpd/manifests/site.pp
+++ b/modules/vsftpd/manifests/site.pp
@@ -2,6 +2,7 @@ define vsftpd::site (
        $source='',
        $content='',
        $bind='',
+       $logfile="/var/log/ftp/vsftpd-${name}.debian.org.log",
        $ensure=present
 ){
 
@@ -52,6 +53,11 @@ define vsftpd::site (
                fail ( "Need one of source or content for $name" )
        }
 
+       file { "/etc/logrotate.d/vsftpd-${name}":
+               ensure  => $ensure,
+               content => template('vsftpd/logrotate.erb')
+       }
+
        # We don't need a firewall rule because it's added in vsftp.pp
        xinetd::service { "vsftpd-${name}":
                bind        => $bind,

diff --git a/modules/vsftpd/templates/logrotate.erb b/modules/vsftpd/templates/logrotate.erb
new file mode 100644 (file)
index 0000000..8222237
--- /dev/null
+++ b/modules/vsftpd/templates/logrotate.erb
@@ -0,0 +1,10 @@
+<%= scope.lookupvar('logfile') %>
+{
+       create 640 root adm
+
+       # ftpd doesn't handle SIGHUP properly
+       missingok
+       notifempty
+       rotate 4
+       weekly
+}