Mercurial > repos > other > Puppet
annotate modules/website/manifests/init.pp @ 313:49e66019faf7
Configure Postfix for IPv6 w/proxy
Also centralised and standardised some IP settings
Currently untested on IPv4 - Postfix might not like the
"[ip.add.re.ss]" format, *but* we can't pass the brackets as
part of the parameter because then it doesn't validate as IPv6!
author | IBBoard <dev@ibboard.co.uk> |
---|---|
date | Mon, 24 Feb 2020 20:49:51 +0000 |
parents | 61e90445c899 |
children | e046606cf218 |
rev | line source |
---|---|
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1 class website( |
277
13825cc1ec57
Replace deprecated validation methods
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
2 Pattern[/^(\/[^\/]+)*$/] $base_dir, |
13825cc1ec57
Replace deprecated validation methods
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
3 Pattern[/^(\/[^\/]+)*$/] $cert_dir = '/etc/pki/custom', |
279 | 4 Stdlib::IP::Address $primary_ip, |
288 | 5 Optional[Stdlib::IP::Address::V6] $proxy_4to6_ip_prefix = undef, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
6 Optional[Integer] $proxy_4to6_mask = undef, |
287
97e732f67770
Make upstream proxies optional to match undef default
IBBoard <dev@ibboard.co.uk>
parents:
286
diff
changeset
|
7 Optional[Array] $proxy_upstream = undef, |
277
13825cc1ec57
Replace deprecated validation methods
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
8 String $default_owner, |
13825cc1ec57
Replace deprecated validation methods
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
9 String $default_group, |
13825cc1ec57
Replace deprecated validation methods
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
10 String $default_tld = 'com', |
13825cc1ec57
Replace deprecated validation methods
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
11 Array $default_extra_tlds = [] |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
12 ){ |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
13 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
14 $basedir = $base_dir |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
15 $certdir = $cert_dir |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
16 $docroot_owner = $default_owner |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
17 $docroot_group = $default_group |
133
9337c9ce648a
Switch to using LetsEncrypt certs by default
IBBoard <dev@ibboard.co.uk>
parents:
119
diff
changeset
|
18 $ca_chain = "/etc/letsencrypt/live/${::fqdn}/chain.pem" |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
19 $tld = $default_tld |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
20 $extra_tlds = $default_extra_tlds |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
21 $htmlphpfragment = "Include conf.extra/html-php.conf" |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
22 $filterfragment = "Include conf.custom/filter.conf" |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
23 $cmsfragment = "Include conf.extra/cms_rewrites.conf" |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
24 |
236
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
25 $csp_base = {"frame-ancestors" => "'none'", "base-uri" => "'none'"} |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
26 $csp_report_base = { |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
27 "default-src" => "'none'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
28 "img-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
29 "script-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
30 "style-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
31 "font-src" => "'self'" |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
32 } |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
33 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
34 class { 'apache': |
261
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
252
diff
changeset
|
35 vhost_dir => "/etc/httpd/conf.d/vhosts", |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
36 default_mods => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
37 default_vhost => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
38 mpm_module => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
39 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
40 class { 'apache::mod::dir': indexes => [ 'index.html' ] } |
84
ae30d98f294f
Drop the number of spare servers to save some memory when we normally only have a couple of processes at once
IBBoard <dev@ibboard.co.uk>
parents:
57
diff
changeset
|
41 class { 'apache::mod::prefork': |
ae30d98f294f
Drop the number of spare servers to save some memory when we normally only have a couple of processes at once
IBBoard <dev@ibboard.co.uk>
parents:
57
diff
changeset
|
42 serverlimit => 45, |
ae30d98f294f
Drop the number of spare servers to save some memory when we normally only have a couple of processes at once
IBBoard <dev@ibboard.co.uk>
parents:
57
diff
changeset
|
43 maxclients => 45, |
98
00453eecda4c
Reduce the number of spare servers, because we're quiet and need spare memory
IBBoard <dev@ibboard.co.uk>
parents:
84
diff
changeset
|
44 maxspareservers => 6, |
84
ae30d98f294f
Drop the number of spare servers to save some memory when we normally only have a couple of processes at once
IBBoard <dev@ibboard.co.uk>
parents:
57
diff
changeset
|
45 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
46 apache::mod { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
47 'rewrite':; |
254
5a903aa91469
Change header types and add module to fix NextCloud header checks
IBBoard <dev@ibboard.co.uk>
parents:
236
diff
changeset
|
48 'expires':; |
5a903aa91469
Change header types and add module to fix NextCloud header checks
IBBoard <dev@ibboard.co.uk>
parents:
236
diff
changeset
|
49 'env':; |
5a903aa91469
Change header types and add module to fix NextCloud header checks
IBBoard <dev@ibboard.co.uk>
parents:
236
diff
changeset
|
50 'setenvif':; |
5a903aa91469
Change header types and add module to fix NextCloud header checks
IBBoard <dev@ibboard.co.uk>
parents:
236
diff
changeset
|
51 'headers':; |
34
29d330d2056a
Make sure that we have mod_version installed so that Apache config fragments that try to support 2.2 and 2.4 work properly
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
52 'version':; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
53 } |
119
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
54 |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
55 # Updating the httpd package puts back some configs that we |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
56 # don't load the relevant modules for, so we'll try to make |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
57 # them blank so that RPM/Yum makes ".rpmnew" files instead |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
58 $unused_default_mods = [ |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
59 "${::apache::mod_dir}/autoindex.conf", |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
60 "${::apache::mod_dir}/userdir.conf", |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
61 "${::apache::mod_dir}/welcome.conf", |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
62 ] |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
63 file { $unused_default_mods: |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
64 ensure => file, |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
65 content => '', |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
66 require => Class['apache'], |
119
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
67 } |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
68 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
69 file { $base_dir: |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
70 ensure => directory; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
71 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
72 file { '/var/log/apache': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
73 ensure => directory, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
74 mode => '0750', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
75 group => 'apache', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
76 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
77 file { '/etc/httpd/conf.extra': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
78 ensure => directory, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
79 recurse => true, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
80 source => "puppet:///modules/website/conf.extra", |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
81 require => Class['apache'], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
82 notify => Service['httpd']; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
83 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
84 file { '/etc/httpd/conf/mime.types': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
85 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
86 source => "puppet:///modules/website/mime.types", |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
87 require => Class['apache'], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
88 notify => Service['httpd']; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
89 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
90 file { '/etc/php.d/datetime.ini': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
91 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
92 source => "puppet:///modules/website/datetime.ini", |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
93 require => Class['apache'], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
94 notify => Service['httpd']; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
95 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
96 file { '/etc/httpd/conf.d/zzz-custom.conf': |
115
b35a9df52965
Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents:
98
diff
changeset
|
97 ensure => absent, |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
98 require => Class['apache'], |
115
b35a9df52965
Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents:
98
diff
changeset
|
99 notify => Service['httpd']; |
b35a9df52965
Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents:
98
diff
changeset
|
100 } |
b35a9df52965
Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents:
98
diff
changeset
|
101 file { '/etc/httpd/conf.d/zzz-0-custom.conf': |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
102 ensure => present, |
115
b35a9df52965
Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents:
98
diff
changeset
|
103 source => "puppet:///modules/website/zzz-0-custom.conf", |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
104 require => Class['apache'], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
105 notify => Service['httpd']; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
106 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
107 file { '/etc/httpd/conf.d/php.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
108 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
109 source => "puppet:///modules/website/php.conf", |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
110 require => Class['apache'], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
111 notify => Service['httpd']; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
112 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
113 file { '/etc/httpd/conf.custom': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
114 ensure => directory, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
115 recurse => true, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
116 source => "puppet:///private/apache/conf.custom", |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
117 require => Class['apache'], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
118 notify => Service['httpd']; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
119 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
120 file { $cert_dir: |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
121 ensure => directory; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
122 } |
279 | 123 firewall { '100 allow https and http': |
124 destination => $primary_ip, | |
125 dport => [80, 443], | |
126 proto => tcp, | |
127 action => accept, | |
128 } | |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
129 if ($proxy_4to6_ip_prefix != undef) and ($proxy_upstream != undef) { |
281
af7df930a670
Add 4-to-6 proxy and mod_remoteip setup
IBBoard <dev@ibboard.co.uk>
parents:
279
diff
changeset
|
130 apache::mod { "remoteip": } |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
131 $proxy_4to6_ip = "$proxy_4to6_ip_prefix:0000/$proxy_4to6_mask" |
281
af7df930a670
Add 4-to-6 proxy and mod_remoteip setup
IBBoard <dev@ibboard.co.uk>
parents:
279
diff
changeset
|
132 |
279 | 133 $proxy_upstream.each |String $upstream_addr| { |
134 firewall { "100 limit PROXY protocol to upstream $upstream_addr": | |
135 source => $upstream_addr, | |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
136 destination => $proxy_4to6_ip, |
279 | 137 dport => [80, 443], |
138 proto => tcp, | |
139 action => accept, | |
140 } | |
141 } | |
142 firewall { "101 block all other PROXY protocol access": | |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
143 destination => $proxy_4to6_ip, |
279 | 144 dport => [80, 443], |
145 proto => tcp, | |
146 action => reject, | |
147 } | |
148 } | |
246 | 149 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '7') >= 0 { |
48
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
150 exec { 'set_apache_defaults': |
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
151 command => 'semanage fcontext -a -t httpd_sys_content_t "/srv/sites(/.*)?"', |
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
152 path => '/bin:/usr/bin/:/sbin:/usr/sbin', |
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
153 require => Package['policycoreutils-python'], |
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
154 unless => 'semanage fcontext --list | grep "/srv/sites\\(/\\.\\*\\)\\?"', |
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
155 } |
133
9337c9ce648a
Switch to using LetsEncrypt certs by default
IBBoard <dev@ibboard.co.uk>
parents:
119
diff
changeset
|
156 cron { 'letsencrypt-renewal': |
9337c9ce648a
Switch to using LetsEncrypt certs by default
IBBoard <dev@ibboard.co.uk>
parents:
119
diff
changeset
|
157 command => '/usr/bin/certbot renew --quiet', |
9337c9ce648a
Switch to using LetsEncrypt certs by default
IBBoard <dev@ibboard.co.uk>
parents:
119
diff
changeset
|
158 hour => '*/12', |
9337c9ce648a
Switch to using LetsEncrypt certs by default
IBBoard <dev@ibboard.co.uk>
parents:
119
diff
changeset
|
159 minute => '21', |
9337c9ce648a
Switch to using LetsEncrypt certs by default
IBBoard <dev@ibboard.co.uk>
parents:
119
diff
changeset
|
160 } |
298
61e90445c899
Merge CentOS8 and CentOS7 branches
IBBoard <dev@ibboard.co.uk>
parents:
288
diff
changeset
|
161 if versioncmp($operatingsystemrelease, '8') < 0 { |
278
a8bf3a400712
Make Certbot package version specific
IBBoard <dev@ibboard.co.uk>
parents:
277
diff
changeset
|
162 $certbot_pkg = 'python2-certbot-apache' |
a8bf3a400712
Make Certbot package version specific
IBBoard <dev@ibboard.co.uk>
parents:
277
diff
changeset
|
163 } else { |
a8bf3a400712
Make Certbot package version specific
IBBoard <dev@ibboard.co.uk>
parents:
277
diff
changeset
|
164 $certbot_pkg = 'python3-certbot-apache' |
a8bf3a400712
Make Certbot package version specific
IBBoard <dev@ibboard.co.uk>
parents:
277
diff
changeset
|
165 } |
a8bf3a400712
Make Certbot package version specific
IBBoard <dev@ibboard.co.uk>
parents:
277
diff
changeset
|
166 package { $certbot_pkg: |
135
b3f6c7a910d0
Add Certbot packages we depend on for commands and providing certs
IBBoard <dev@ibboard.co.uk>
parents:
133
diff
changeset
|
167 ensure => installed, |
b3f6c7a910d0
Add Certbot packages we depend on for commands and providing certs
IBBoard <dev@ibboard.co.uk>
parents:
133
diff
changeset
|
168 } |
48
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
169 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
170 } |