Mercurial > repos > other > Puppet

annotate manifests/templates.pp @ 449:4a6ad700cded

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Update config for real Raspberry Pi host * Add node config * Change Amavis setup because of Ubuntu differences * Change secondary IP address setup because Ubuntu still uses older networking approach * Make Postfix config more flexible
author IBBoard <dev@ibboard.co.uk>
date Wed, 26 Jul 2023 15:30:19 +0100
parents 460bf6514bd8
children dc725b618258
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
32
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
1 # Make sure packages come after their repos
382
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
2 File<| tag == 'repo-config' |>
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
3 -> anchor { 'Repo-config': }
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
4 -> YumRepo<| |>
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
5 -> Apt::Source<| |>
382
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
6 -> anchor { 'Repos': }
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
7 -> Package<| |>
32
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
8
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
9 # Make sure all files are in place before starting services
298
61e90445c899 Merge CentOS8 and CentOS7 branches
IBBoard <dev@ibboard.co.uk>
parents: 292 284
diff changeset
10 # FIXME: Title matches are to fix a dependency cycle
382
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
11 File<| tag != 'post-service' and title != '/etc/sysconfig/ip6tables' and title != '/etc/sysconfig/iptables' |>
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
12 -> anchor { 'Pre-Service Files': }
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
13 -> Service<| |>
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
14
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
15 # Set some shortcut variables
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
16 #$os = $operatingsystem
249
e9323ff8f451 Make EPEL work on multiple versions of CentOS
IBBoard <dev@ibboard.co.uk>
parents: 247
diff changeset
17 $osver = $operatingsystemmajrelease
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
18 $server = ''
32
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
19
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
20
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
21 class basenode {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
22 include sudo
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
23
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
24 include defaultusers
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
25 include logwatch
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
26
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
27 file { '/etc/puppet/hiera.yaml':
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
28 ensure => present,
264
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
29 content => "
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
30 # Let the system set defaults
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
31 version: 5
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
32 ",
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
33 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
34
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
35 if $operatingsystem == 'Ubuntu' {
447
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
36 package { 'locales':
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
37 ensure => present
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
38 } ->
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
39 file { '/etc/locale.gen':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
40 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
41 content => "en_GB.UTF-8 UTF-8",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
42 notify => Exec['Regen locales']
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
43 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
44 exec { 'Regen locales':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
45 command => 'locale-gen',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
46 refreshonly => true
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
47 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
48 # Don't waste space with Snap and do everything properly with system packages
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
49 [ 'lxd', 'core18', 'core20', 'snapd'].each |$snap| {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
50 exec { "remove $snap snap package":
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
51 command => "snap remove $snap",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
52 onlyif => "which snap && snap list $snap",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
53 tag => 'snap',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
54 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
55 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
56 Exec<| tag == 'snap' |> ->
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
57 package { 'snapd':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
58 ensure => purged,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
59 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
60 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
61 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
62
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
63 class basevpsnode (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
64 $primary_ip,
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
65 $gateway_ip = undef,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
66 $proxy_4to6_ip_prefix = undef,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
67 $proxy_upstream = undef,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
68 $nat64_ranges = [],
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
69 $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
70 $imapserver,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
71 $mailrelays = [],
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
72 $firewall_cmd = 'iptables',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
73 ) {
44
546dfa011f58 Remove "puppet" host name because we don't need it
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
74
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
75 if $firewall_cmd == 'iptables' {
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
76 class { 'vpsfirewall':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
77 fw_protocol => $primary_ip =~ Stdlib::IP::Address::V6 ? { true => 'IPv6', default => 'IPv4'},
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
78 }
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
79 }
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
80
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
81 #VPS is a self-mastered Puppet machine, so bodge a Hosts file
302
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
82 if $primary_ip =~ Stdlib::IP::Address::V6 {
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
83 $lo_ip = '::1'
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
84 } else {
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
85 $lo_ip = '127.0.0.1'
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
86 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
87 file { '/etc/hosts':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
88 ensure => present,
302
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
89 content => "${lo_ip} localhost\n${primary_ip} ${fqdn}",
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
90 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
91
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
92 if $proxy_4to6_ip_prefix != undef {
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
93 if $operatingsystem == 'Ubuntu' {
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
94 # Ubuntu can't parse the existing file, so we need to brute-force it with a template
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
95 file { "/etc/network/interfaces.d/eth0":
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
96 content => epp('privat/eth0.epp',
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
97 {
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
98 default_address => $primary_ip,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
99 gateway_address => $gateway_ip,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
100 prefix_address => $proxy_4to6_ip_prefix,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
101 }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
102 ),
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
103 }
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
104
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
105 # # …:1 to …:9 for websites, …:10 for mail
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
106 # Integer[1, 10].each |$octet| {
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
107 # augeas { "IPv6 secondary address $octet":
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
108 # context => "/files/etc/network/interfaces.d/eth0",
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
109 # changes => [
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
110 # "set auto[child::1 = 'eth0:$octet']/1 eth0:$octet",
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
111 # "set no-auto-down[child::1 = 'eth0:$octet']/1 eth0:$octet",
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
112 # "set iface[. = 'eth0:$octet'] eth0:$octet",
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
113 # "set iface[. = 'eth0:$octet']/family inet6",
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
114 # "set iface[. = 'eth0:$octet']/method static",
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
115 # "set iface[. = 'eth0:$octet']/address $proxy_4to6_ip_prefix:$octet",
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
116 # "set iface[. = 'eth0:$octet']/netmask 64",
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
117 #
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
118 # ],
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
119 # }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
120 # }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
121 }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
122 else {
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
123 # …:1 to …:9 for websites, …:10 for mail
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
124 $ipv6_addresses = Integer[1, 10].map |$octet| { "$proxy_4to6_ip_prefix:$octet" }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
125 $ipv6_secondaries = join($ipv6_addresses, " ")
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
126
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
127 augeas {'IPv6 secondary addresses':
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
128 context => "/files/etc/sysconfig/network-scripts/ifcfg-eth0",
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
129 changes => "set IPV6ADDR_SECONDARIES '\"$ipv6_secondaries\"'",
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
130 }
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
131 }
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
132 }
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
133
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
134 require repos
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
135 include basenode
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
136 include privat
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
137 include dnsresolver
396
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
138 include ::privat::params
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
139 class { '::ssh':
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
140 sshd_config_port => $::privat::params::ssh_port[$::fqdn]
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
141 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
142 include vcs::server
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
143 include vcs::client
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
144 class { 'webserver':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
145 primary_ip => $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
146 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
147 proxy_4to6_mask => 124,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
148 proxy_upstream => $proxy_upstream,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
149 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
150 include cronjobs
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
151 include logrotate
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
152 class { 'fail2ban':
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
153 firewall_cmd => $firewall_cmd,
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
154 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
155 include tools
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
156 class { 'email':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
157 mailserver => $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
158 imapserver => $imapserver,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
159 mailserver_ip => $primary_ip,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
160 proxy_ip => $proxy_4to6_ip_prefix != undef ? { true => "${proxy_4to6_ip_prefix}:10", default => undef },
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
161 proxy_upstream => $proxy_upstream,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
162 nat64_ranges => $nat64_ranges,
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
163 mailrelays => $mailrelays,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
164 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
165 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
166
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
167 ## Classes to allow facet behaviour using preconfigured setups of classes
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
168
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
169 class vpsfirewall ($fw_protocol) {
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
170 resources { "firewall":
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
171 purge => false,
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
172 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
173 class { "my_fw":
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
174 ip_version => $fw_protocol,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
175 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
176 # Control what does and doesn't get pruned in the main filter chain
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
177 firewallchain { "INPUT:filter:$fw_protocol":
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
178 purge => true,
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
179 ignore => [
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
180 '-j f2b-[^ ]+$',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
181 '^(:|-A )f2b-',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
182 '--comment "Great Firewall of China"',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
183 '--comment "Do not purge',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
184 ],
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
185 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
186 if ($fw_protocol != "IPv6") {
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
187 firewall { '010 Whitelist Googlebot':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
188 source => '66.249.64.0/19',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
189 dport => [80,443],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
190 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
191 action => accept,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
192 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
193 # Block a spammer hitting our contact forms (also on StopForumSpam list A LOT)
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
194 firewall { '099 Blacklist spammers 1':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
195 source => '107.181.78.172',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
196 dport => [80, 443],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
197 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
198 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
199 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
200 firewall { '099 Blacklist IODC bot':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
201 # IODC bot makes too many bad requests, and contact form is broken
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
202 # They don't publish a robots.txt name, so firewall it!
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
203 source => '86.153.145.149',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
204 dport => [ 80, 443 ],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
205 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
206 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
207 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
208 firewall { '099 Blacklist Baidu Brazil':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
209 #Baidu got a Brazilian netblock and are hitting us hard
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
210 #Baidu doesn't honour "crawl-delay" in robots.txt
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
211 #Baidu gets firewalled
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
212 source => '131.161.8.0/22',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
213 dport => [ 80, 443 ],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
214 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
215 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
216 }
139
abaf384dc939 Block another annoying IP with a firewall rule
IBBoard <dev@ibboard.co.uk>
parents: 137
diff changeset
217 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
218 firewallchain { "GREATFIREWALLOFCHINA:filter:$fw_protocol":
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
219 ensure => present,
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
220 }
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
221 firewall { '050 Check our Great Firewall Against China':
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
222 chain => 'INPUT',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
223 jump => 'GREATFIREWALLOFCHINA',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
224 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
225 firewallchain { "Fail2Ban:filter:$fw_protocol":
64
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
226 ensure => present,
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
227 }
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
228 firewall { '060 Check Fail2Ban':
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
229 chain => 'INPUT',
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
230 jump => 'Fail2Ban',
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
231 }
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
232 }
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
233
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
234 class dnsresolver {
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
235 package { 'unbound':
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
236 ensure => present,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
237 }
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
238 package { 'named':
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
239 ensure => absent,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
240 }
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
241
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
242 service { 'named':
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
243 ensure => stopped,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
244 enable => false,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
245 }
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
246 service { 'unbound':
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
247 ensure => running,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
248 enable => true,
194
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
249 }
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
250
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
251 file { '/etc/named.conf':
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
252 ensure => absent,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
253 }
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
254 file { '/etc/unbound/unbound.conf':
194
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
255 ensure => present,
247
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
256 source => [
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
257 "puppet:///common/unbound.conf-${::hostname}",
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
258 "puppet:///common/unbound.conf",
247
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
259 ],
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
260 require => Package['unbound'],
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
261 notify => Service['unbound'],
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
262 }
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
263 file { ['/etc/NetworkManager', '/etc/NetworkManager/conf.d']:
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
264 ensure => directory
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
265 }
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
266 file { '/etc/NetworkManager/conf.d/local-dns-resolver.conf':
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
267 ensure => present,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
268 content => "[main]
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
269 dns=none",
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
270 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
271
101
a48b6011a084 Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents: 100
diff changeset
272 file { '/etc/sysconfig/named':
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
273 ensure => absent,
101
a48b6011a084 Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents: 100
diff changeset
274 }
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
275 file { '/etc/resolv.conf':
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
276 ensure => file,
301
1bfc290270cc Fix sa-update by using IPv6 for local DNS cache
IBBoard <dev@ibboard.co.uk>
parents: 298
diff changeset
277 # "ipaddress" key only exists for machines with IPv4 addresses
1bfc290270cc Fix sa-update by using IPv6 for local DNS cache
IBBoard <dev@ibboard.co.uk>
parents: 298
diff changeset
278 content => has_key($facts, 'ipaddress') ? { true => "nameserver 127.0.0.1", default => "nameserver ::1" },
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
279 require => Service['unbound'],
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
280 tag => 'post-service',
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
281 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
282 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
283
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
284 class repos {
439
e4de05e3a2f8 Ensure Python params are included
IBBoard <dev@ibboard.co.uk>
parents: 435
diff changeset
285 include ::python::params
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
286 if $operatingsystem == 'CentOS' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
287 yumrepo { 'epel':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
288 mirrorlist => 'https://mirrors.fedoraproject.org/metalink?repo=epel-$releasever&arch=$basearch',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
289 descr => "Extra Packages for Enterprise Linux",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
290 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
291 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
292 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
293 gpgkey => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
294 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
295 file { "/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver":
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
296 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
297 source => "puppet:///common/RPM-GPG-KEY-EPEL-$osver",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
298 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
299 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
300 yumrepo { 'ibboard':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
301 baseurl => 'https://download.opensuse.org/repositories/home:/IBBoard:/server/CentOS_$releasever/',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
302 descr => 'Extra packages from IBBoard',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
303 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
304 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
305 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
306 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
307 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
308 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
309 source => 'puppet:///common/RPM-GPG-KEY-ibboard',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
310 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
311 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
312 yumrepo { 'webtatic':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
313 ensure => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
314 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
315 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-andy':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
316 ensure => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
317 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
318 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-el7':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
319 ensure => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
320 }
409
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
321 # Python requires the `devel` package on CentOS, but by default the module tries to uninstall it
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
322 $dev = 'present'
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
323 }
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
324 else {
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
325 # Other distros can take the default devel status
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
326 $dev = $::python::params::dev
447
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
327 # CentOS-like distros have PKI by default. Others need it creating.
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
328 file { '/etc/pki/':
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
329 ensure => directory,
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
330 }
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
331
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
332 apt::source {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
333 'ibboard':
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
334 location => 'http://download.opensuse.org/repositories/home:/IBBoard:/server/xUbuntu_22.04/',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
335 release => '/',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
336 repos => '',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
337 key => {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
338 id => 'EDC682701D792970AD8645E7A7A55B845DCFCBE2',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
339 source => "https://download.opensuse.org/repositories/home:IBBoard:server/xUbuntu_22.04/Release.key"
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
340 }
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
341 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
342 }
148
d9fcabc75a1e Fix pip installations
IBBoard <dev@ibboard.co.uk>
parents: 147
diff changeset
343
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
344 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 {
383
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
345 # The following may possibly work to ensure a CentOS Streams install.
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
346 # Or it might fail for inexplicable reasons.
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
347 # FIXME: Should be "centos-release-stream" to migrate (provides repos), but then that gets replaced by centos-stream-release,
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
348 # which Puppet doesn't recognise as the same and so keeps trying to re-install. May need an "unless" or maybe "allow_virtual"
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
349 package { 'centos-stream-release':
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
350 ensure => installed,
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
351 notify => Exec['migrate to streams'];
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
352 }
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
353 exec { 'migrate to streams':
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
354 command => '/usr/bin/dnf swap centos-linux-repos centos-stream-repos; /usr/bin/dnf distro-sync -y',
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
355 refreshonly => true
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
356 }
148
d9fcabc75a1e Fix pip installations
IBBoard <dev@ibboard.co.uk>
parents: 147
diff changeset
357 }
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
358
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
359 class { 'python':
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
360 ensure => 'present',
401
f0ee7a16125d Switch to Python 3 on all platforms
IBBoard <dev@ibboard.co.uk>
parents: 399
diff changeset
361 version => 'python3',
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
362 pip => 'present',
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
363 use_epel => false,
409
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
364 dev => $dev,
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
365 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
366 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
367
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
368 class tools {
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
369 $packages = [ 'sqlite', 'bash-completion', 'nano', 'zip', 'bzip2', 'mlocate', 'patch', 'tmux', 'wget', 'rsync' ]
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
370 package { $packages:
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
371 ensure => installed;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
372 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
373 if $osfamily == 'RedHat' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
374 package { 'yum-utils':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
375 ensure => installed
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
376 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
377 }
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
378 elsif $osfamily == 'Debian' {
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
379 package { 'dnsutils':
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
380 ensure => installed
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
381 }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
382 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
383 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
384
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
385 class logrotate {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
386 package { 'logrotate':
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
387 ensure => installed;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
388 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
389 file { '/etc/logrotate.d/httpd':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
390 ensure => present,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
391 source => 'puppet:///common/logrotate-httpd',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
392 require => Package['logrotate'],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
393 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
394 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
395
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
396 class logwatch {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
397 package { 'logwatch':
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
398 ensure => installed;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
399 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
400 File {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
401 ensure => present,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
402 require => Package['logwatch'],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
403 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
404 file { '/etc/cron.daily/0logwatch':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
405 source => 'puppet:///common/0logwatch';
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
406 }
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
407 $logwatch_dirs = [
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
408 '/etc/logwatch/',
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
409 '/etc/logwatch/conf/',
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
410 '/etc/logwatch/conf/logfiles/',
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
411 '/etc/logwatch/conf/services/',
345
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
412 '/etc/logwatch/scripts/',
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
413 '/etc/logwatch/scripts/services/',
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
414 ]
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
415 file { $logwatch_dirs:
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
416 ensure => directory,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
417 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
418 file { '/etc/logwatch/conf/logwatch.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
419 content => 'Detail = Med',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
420 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
421 file { '/etc/logwatch/conf/logfiles/http.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
422 content => 'LogFile = apache/access_*.log',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
423 }
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
424 file { '/etc/logwatch/conf/logfiles/http-error.conf':
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
425 source => 'puppet:///common/logwatch/logfiles_http-error.conf',
126
8316d4e55e92 Fix Apache 2.4 Logwatch support
IBBoard <dev@ibboard.co.uk>
parents: 125
diff changeset
426 }
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
427 file { '/etc/logwatch/conf/logfiles/mysql.conf':
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
428 source => 'puppet:///common/logwatch/logfiles_mysql.conf',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
429 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
430 file { '/etc/logwatch/conf/logfiles/php.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
431 source => 'puppet:///common/logwatch/logfiles_php.conf',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
432 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
433 file { '/etc/logwatch/conf/services/php.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
434 source => 'puppet:///common/logwatch/services_php.conf',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
435 }
379
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
436 file { '/etc/logwatch/conf/services/contact-form.conf':
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
437 source => 'puppet:///common/logwatch/services_contact-form.conf',
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
438 }
345
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
439 file { '/etc/logwatch/scripts/services/dovecot':
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
440 source => 'puppet:///common/logwatch/dovecot',
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
441 }
346
61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 345
diff changeset
442 file { '/etc/logwatch/scripts/services/postfix':
61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 345
diff changeset
443 source => 'puppet:///common/logwatch/postfix',
61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 345
diff changeset
444 }
347
73d7b3ec6263 Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents: 346
diff changeset
445 file { '/etc/logwatch/scripts/services/systemd':
73d7b3ec6263 Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents: 346
diff changeset
446 source => 'puppet:///common/logwatch/systemd',
73d7b3ec6263 Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents: 346
diff changeset
447 }
379
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
448 file { '/etc/logwatch/scripts/services/php':
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
449 source => 'puppet:///common/logwatch/php',
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
450 }
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
451 file { '/etc/logwatch/scripts/services/contact-form':
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
452 source => 'puppet:///common/logwatch/contact-form',
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
453 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
454 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
455
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
456 #Our web server with our configs, not just a stock one
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
457 class webserver (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
458 $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
459 $proxy_4to6_ip_prefix = undef,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
460 $proxy_4to6_mask = undef,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
461 $proxy_upstream = undef,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
462 ) {
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
463
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
464 #Setup base website parameters
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
465 class { 'website':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
466 base_dir => '/srv/sites',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
467 primary_ip => $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
468 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
469 proxy_4to6_mask => $proxy_4to6_mask,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
470 proxy_upstream => $proxy_upstream,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
471 default_owner => $defaultusers::default_user,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
472 default_group => $defaultusers::default_user,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
473 default_tld => 'co.uk',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
474 default_extra_tlds => [ 'com' ],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
475 }
110
be2b30b17a4c Switch to PHP 7 from Webtatic
IBBoard <dev@ibboard.co.uk>
parents: 108
diff changeset
476
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
477 if $operatingsystem == 'CentOS' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
478 $php_suffix = ''
419
0c627ff3a7c3 Fix PHP setup on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 418
diff changeset
479 $variant_prefix = 'php-'
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
480 $extra_prefix = 'pecl-'
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
481 $extra_extras = {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
482 'posix' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
483 ini_prefix => '20-',
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
484 },
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
485 # Sodium has been bundled since 7.2, but CentOS packages it separately
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
486 'sodium' => {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
487 ini_prefix => '20-',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
488 },
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
489 # JSON is integrated into PHP 8+ and so it's only a plugin in CentOS
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
490 'json' => {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
491 ini_prefix => '20-',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
492 },
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
493 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
494 if versioncmp($operatingsystemrelease, '8') >= 0 {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
495 yumrepo { 'remirepo-safe':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
496 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/$basearch/mirror',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
497 descr => "Extra CentOS packages from Remi",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
498 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
499 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
500 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
501 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
502 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
503 yumrepo { 'remirepo-php':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
504 mirrorlist => 'http://cdn.remirepo.net/enterprise/8/modular/$basearch/mirror',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
505 descr => 'Remi\'s Modular repository for Enterprise Linux 8 - $basearch',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
506 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
507 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
508 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
509 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
510 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
511 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
512 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
513 source => 'puppet:///common/RPM-GPG-KEY-remi.el8',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
514 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
515 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
516 } else {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
517 yumrepo { 'remirepo-safe':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
518 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/mirror',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
519 descr => "Extra CentOS packages from Remi",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
520 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
521 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
522 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
523 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
524 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
525 yumrepo { 'remirepo-php':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
526 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/php74/mirror',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
527 descr => "PHP7.4 for CentOS from Remi",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
528 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
529 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
530 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
531 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
532 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
533 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
534 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
535 source => 'puppet:///common/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
536 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
537 }
320
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
538 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
539 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
540 elsif $operatingsystem == 'Ubuntu' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
541 $php_suffix = ''
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
542 $variant_prefix = 'php-'
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
543 $extra_prefix = ''
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
544 # Work around constant re-install by enabling virtual packages
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
545 # https://github.com/voxpupuli/puppet-php/issues/387
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
546 Package {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
547 allow_virtual => true
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
548 }
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
549 $extra_extras = {}
238
6467e768e353 Switch to PHP 7.4 from Remi
IBBoard <dev@ibboard.co.uk>
parents: 236
diff changeset
550 }
110
be2b30b17a4c Switch to PHP 7 from Webtatic
IBBoard <dev@ibboard.co.uk>
parents: 108
diff changeset
551
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
552 #Configure the PHP version to use
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
553 class { 'website::php':
350
85d2c0079af9 Make opcache core and add APCu for object caching
IBBoard <dev@ibboard.co.uk>
parents: 347
diff changeset
554 suffix => $php_suffix,
335
aa9f570d6a9c Switch to PHP 7.4 now that NextCloud has reached v18
IBBoard <dev@ibboard.co.uk>
parents: 334
diff changeset
555 module => ($operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0) ? { true => 'remi-7.4', default => undef },
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
556 extras => {
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
557 'bcmath' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
558 ini_prefix => '20-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
559 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
560 'curl' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
561 ini_prefix => '20-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
562 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
563 'dom' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
564 ini_prefix => '20-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
565 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
566 'enchant' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
567 ini_prefix => '20-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
568 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
569 'exif' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
570 ini_prefix => '20-',
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
571 },
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
572 'fileinfo' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
573 ini_prefix => '20-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
574 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
575 'gmp' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
576 ini_prefix => '20-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
577 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
578 'intl' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
579 ini_prefix => '20-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
580 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
581 'mysqlnd' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
582 ini_prefix => '20-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
583 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
584 'pdo' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
585 ini_prefix => '20-',
419
0c627ff3a7c3 Fix PHP setup on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 418
diff changeset
586 },
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
587 'simplexml' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
588 ini_prefix => '20-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
589 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
590 'soap' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
591 ini_prefix => '20-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
592 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
593 'xmlwriter' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
594 ini_prefix => '20-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
595 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
596 'mysqli' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
597 ini_prefix => '30-',
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
598 },
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
599 'pdo_mysql' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
600 ini_prefix => '30-',
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
601 # Provided by the php-mysql package in CentOS and declared with "Provides"
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
602 # And Ubuntu is the same but without the "Provides"
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
603 provider => "none",
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
604 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
605 'xmlreader' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
606 ini_prefix => '30-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
607 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
608 'zip' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
609 ini_prefix => '30-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
610 package_prefix => "${variant_prefix}${extra_prefix}"
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
611 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
612 'apcu' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
613 ini_prefix => '40-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
614 package_prefix => "${variant_prefix}${extra_prefix}"
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
615 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
616 'imagick' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
617 ini_prefix => '40-',
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
618 package_prefix => "${variant_prefix}${extra_prefix}"
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
619 },
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
620 } + $extra_extras,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
621 }
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
622
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
623 #Setup MySQL, using (private) templates to make sure that we set non-std passwords and a default user
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
624 if $operatingsystem == 'CentOS' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
625 if versioncmp($operatingsystemrelease, '7') >= 0 {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
626 $mysqlpackage = 'mariadb'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
627 $mysqlsuffix = ''
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
628
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
629 # Required for SELinux rule setting/status checks
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
630 if versioncmp($operatingsystemrelease, '8') >= 0 {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
631 $semanage_package_name = 'policycoreutils-python-utils'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
632 } else {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
633 $semanage_package_name = 'policycoreutils-python'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
634 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
635
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
636 package { 'policycoreutils-python':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
637 name => $semanage_package_name,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
638 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
639 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
640
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
641 $extra_packages = [
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
642 'perl-Sys-Syslog', #Required for Perl SPF checking
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
643 ]
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
644
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
645 package { $extra_packages:
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
646 ensure => installed
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
647 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
648 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
649 else {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
650 $mysqlpackage = 'mysql'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
651 $mysqlsuffix = '55w'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
652 }
393
a948419a23b1 Fix MySQL package names on Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 390
diff changeset
653 $phpmysqlsuffix = 'nd'
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
654 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
655 elsif $operatingsystem == 'Ubuntu' {
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
656 $mysqlpackage = 'mariadb'
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
657 $mysqlsuffix = ''
393
a948419a23b1 Fix MySQL package names on Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 390
diff changeset
658 $phpmysqlsuffix = ''
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
659 }
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
660 else {
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
661 fail("No MySQL support for ${operatingsystem}")
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
662 }
402
76d18a918e7f Switch to more parameters
IBBoard <dev@ibboard.co.uk>
parents: 401
diff changeset
663 include ::defaultusers::params
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
664 class { 'website::mysql':
402
76d18a918e7f Switch to more parameters
IBBoard <dev@ibboard.co.uk>
parents: 401
diff changeset
665 mysqluser => $::defaultusers::params::mysql_user,
76d18a918e7f Switch to more parameters
IBBoard <dev@ibboard.co.uk>
parents: 401
diff changeset
666 mysqlpassword => $::defaultusers::params::mysql_password,
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
667 mysqlprefix => $mysqlpackage,
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
668 mysqlsuffix => $mysqlsuffix,
110
be2b30b17a4c Switch to PHP 7 from Webtatic
IBBoard <dev@ibboard.co.uk>
parents: 108
diff changeset
669 phpsuffix => $php_suffix,
393
a948419a23b1 Fix MySQL package names on Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 390
diff changeset
670 phpmysqlsuffix => $phpmysqlsuffix
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
671 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
672
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
673 # Additional supporting directories that aren't served as sites
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
674 file { [ '/srv/sites/errorhandling', '/srv/sites/private', '/srv/cms' ]:
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
675 ensure => directory,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
676 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
677 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
678
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
679 class ibboardvpsnode (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
680 $primary_ip,
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
681 $gateway_ip = undef,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
682 $proxy_4to6_ip_prefix = undef,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
683 $proxy_upstream = undef,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
684 $nat64_ranges = [],
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
685 $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
686 $imapserver,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
687 $mailrelays = [],
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
688 $firewall_cmd = 'iptables',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
689 ){
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
690 class { 'basevpsnode':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
691 primary_ip => $primary_ip,
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
692 gateway_ip => $gateway_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
693 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
694 proxy_upstream => $proxy_upstream,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
695 nat64_ranges => $nat64_ranges,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
696 mailserver => $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
697 imapserver => $imapserver,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
698 mailrelays => $mailrelays,
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
699 firewall_cmd => $firewall_cmd,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
700 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
701
267
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
702 # Set timezone to something sensible
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
703 file { "/etc/localtime":
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
704 ensure => 'link',
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
705 target => '/usr/share/zoneinfo/Europe/London',
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
706 }
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
707
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
708 # Debian doesn't handle sensible depends like module names because of the underscore
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
709 # So we need to use the package name
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
710 package { "mod_cspnonce":
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
711 name => $osfamily == 'Debian' ? { true => "libapache2-mod-cspnonce", default => "mod_cspnonce" },
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
712 ensure => installed,
410
575764c36e16 Setup CSP Nonce on the server
IBBoard <dev@ibboard.co.uk>
parents: 409
diff changeset
713 }
575764c36e16 Setup CSP Nonce on the server
IBBoard <dev@ibboard.co.uk>
parents: 409
diff changeset
714
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
715 # Common modules used by multiple sites (mod_auth_basic is safe because we HTTPS all the things)
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
716 $mods = [
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
717 'auth_basic',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
718 'authn_core',
146
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
719 'authn_file',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
720 'authz_user',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
721 'deflate',
410
575764c36e16 Setup CSP Nonce on the server
IBBoard <dev@ibboard.co.uk>
parents: 409
diff changeset
722 'xsendfile',
575764c36e16 Setup CSP Nonce on the server
IBBoard <dev@ibboard.co.uk>
parents: 409
diff changeset
723 'cspnonce'
146
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
724 ]
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
725 apache::mod {
146
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
726 $mods:;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
727 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
728
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
729 #Configure our sites, using templates for the custom fragments where the extra content is too long
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
730 class { "devsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
731 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:01", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
732 }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
733 class { "adminsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
734 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:02", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
735 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
736 website::https::multitld { 'www.ibboard':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
737 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
738 custom_fragment => template("privat/apache/ibboard.fragment"),
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
739 letsencrypt_name => 'ibboard.co.uk',
236
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
740 csp_override => {
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
741 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
742 "default-src" => "'none'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
743 "img-src" => "'self' https://live.staticflickr.com/",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
744 "script-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
745 "style-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
746 "font-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
747 "form-action" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
748 "connect-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
749 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
750 }
374
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
751 website::https::redir { 'mail.ibboard.co.uk':
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
752 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
374
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
753 redir => 'https://ibboard.co.uk/',
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
754 docroot => "${website::basedir}/ibboard",
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
755 letsencrypt_name => 'ibboard.co.uk',
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
756 separate_log => true,
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
757 }
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
758 website::https::redir { 'imap.ibboard.co.uk':
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
759 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
374
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
760 redir => 'https://ibboard.co.uk/',
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
761 docroot => "${website::basedir}/ibboard",
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
762 letsencrypt_name => 'ibboard.co.uk',
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
763 separate_log => true,
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
764 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
765 class { "hiveworldterrasite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
766 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:04", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
767 }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
768 class { "bdstrikesite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
769 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:05", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
770 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
771 website::https::multitld { 'www.abiknight':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
772 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:06", default => undef },
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
773 custom_fragment => "$website::htmlphpfragment
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
774 ErrorDocument 404 /error.php",
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
775 letsencrypt_name => 'abiknight.co.uk',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
776 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
777 class { "webmailpimsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
778 proxy_4to6_ip_pim => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:08", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
779 proxy_4to6_ip_webmail => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:09", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
780 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
781 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
782
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
783 class adminsite ($proxy_4to6_ip) {
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
784 apache::mod { 'info':; 'status':; 'cgi':; }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
785 website::https::multitld { 'admin.ibboard':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
786 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
787 force_no_index => false,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
788 ssl_ca_chain => '',
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
789 csp_override => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
790 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
791 "img-src" => "'self' data:",
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
792 },
426
1d6cf5d981be Try to resolve more CSP errors
IBBoard <dev@ibboard.co.uk>
parents: 422
diff changeset
793 csp_report_override => {
1d6cf5d981be Try to resolve more CSP errors
IBBoard <dev@ibboard.co.uk>
parents: 422
diff changeset
794 "img-src" => "'self' data:",
1d6cf5d981be Try to resolve more CSP errors
IBBoard <dev@ibboard.co.uk>
parents: 422
diff changeset
795 },
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
796 custom_fragment => template("privat/apache/admin.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
797 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
798 if $osfamily == 'RedHat' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
799 $cron_user = 'apache'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
800 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
801 elsif $osfamily == 'Debian' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
802 $cron_user = 'www-data'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
803 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
804 cron { 'loadavg':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
805 command => '/usr/local/bin/run-loadavg-logger',
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
806 user => $cron_user,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
807 minute => '*/6'
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
808 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
809 cron { 'awstats':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
810 command => '/usr/local/bin/update-awstats > /srv/sites/admin/awstats.log',
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
811 user => $cron_user,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
812 hour => '*/6',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
813 minute => '0'
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
814 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
815 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
816
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
817 class hiveworldterrasite ($proxy_4to6_ip) {
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
818 website::https::multitld { 'www.hiveworldterra':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
819 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
820 force_no_www => false,
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
821 letsencrypt_name => 'hiveworldterra.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
822 custom_fragment => template("privat/apache/hwt.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
823 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
824 website::https::multitld { 'forums.hiveworldterra':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
825 proxy_4to6_ip => $proxy_4to6_ip,
331
f69e2d197302 Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents: 330
diff changeset
826 letsencrypt_name => 'forums.hiveworldterra.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
827 custom_fragment => template("privat/apache/forums.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
828 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
829 website::https::multitld { 'skins.hiveworldterra':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
830 proxy_4to6_ip => $proxy_4to6_ip,
334
ee4760967d2f Separate LetsEncrypt certs
IBBoard <dev@ibboard.co.uk>
parents: 332
diff changeset
831 letsencrypt_name => 'skins.hiveworldterra.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
832 custom_fragment => template("privat/apache/skins.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
833 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
834 website::https::redir { 'hiveworldterra.ibboard.co.uk':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
835 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
836 redir => 'https://www.hiveworldterra.co.uk/',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
837 docroot => "${website::basedir}/hiveworldterra",
334
ee4760967d2f Separate LetsEncrypt certs
IBBoard <dev@ibboard.co.uk>
parents: 332
diff changeset
838 letsencrypt_name => 'hiveworldterra.ibboard.co.uk',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
839 separate_log => true,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
840 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
841 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
842 class bdstrikesite ($proxy_4to6_ip) {
331
f69e2d197302 Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents: 330
diff changeset
843 website::https::multitld { 'www.bdstrike':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
844 proxy_4to6_ip => $proxy_4to6_ip,
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
845 docroot_owner => $defaultusers::secondary_user,
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
846 docroot_group => 'editors',
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
847 letsencrypt_name => 'bdstrike.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
848 custom_fragment => template("privat/apache/bdstrike.fragment"),
411
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
849 csp_override => {
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
850 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
364
8224f42ee05b Expand BDStrike CSP to allow more styling and fonts
IBBoard <dev@ibboard.co.uk>
parents: 362
diff changeset
851 "font-src" => "'self' https://fonts.gstatic.com/ data:",
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
852 "img-src" => "'self' https://secure.gravatar.com/ https://ps.w.org/ https://s.w.org/ data:",
411
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
853 "style-src" => "'self' https://fonts.googleapis.com/ 'unsafe-inline'",
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
854 "connect-src" => "'self' https://www.sandbox.paypal.com/ https://www.paypal.com/",
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
855 "frame-ancestors" => "'self'"
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
856 },
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
857 csp_report_override => {
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
858 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/reportOnly",
411
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
859 "font-src" => "'self' https://fonts.gstatic.com/ data:", # TODO: What's generating it?
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
860 "img-src" => "'self' https://secure.gravatar.com/ data:",
426
1d6cf5d981be Try to resolve more CSP errors
IBBoard <dev@ibboard.co.uk>
parents: 422
diff changeset
861 "style-src" => "'self' https://fonts.googleapis.com/ 'nonce-%{CSP_NONCE}e' 'unsafe-hashes' 'sha256-anQSeQoEnQnBulZOQkDOFf+e6xBIGmqh7M8YFT992co=' 'sha256-zJDyuABAg68wtWDFyIh+RRe+6Vm/r+BLwaNRCGNVyXI=' 'sha256-qMalr/MPLUDW4lX/rq/cGp1Eu/H0cu0Yg98pdu69Jxs=' 'sha256-mshqJ+hidJMRDeNLHknuDAeYLOPg2OTIIA3nZmHgi9U=' 'sha256-YnRUd/QjP/NuFgfjMHhNfMCqXh0RQIGdvQfMCOf6qkw=' 'sha256-EwdiFJgqhefinoeAymrWxOYW4kza2Ekos5MY0PlXYI0=' 'sha256-G4K9vh8e+37+l69S+lHTyX3CfcK95mQUgyxYPCb7uME=' 'sha256-t6oewASd7J1vBg5mQtX4hl8bg8FeegYFM3scKLIhYUc=' 'sha256-mAQYxa3mIYqoLBrm1zLu6sLajr8vUHVFLYNpl6dAakM=' 'sha256-A8foknjCsFBi1PlRehOrHq0pVySigUurqAUgZ2y2U8c=' 'sha256-biLFinpqYMtWHmXfkA1BPeCY0/fNt46SAZ+BBk5YUog=' 'sha256-WzSByVQ8yW/DKrr77TWVt7WEMzueRcfJZImOkjTBKmc=' 'sha256-efof3agGBAL/yN8TplyNbLEgDZ3wIGMK3UMYbe8slkA='",
411
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
862 "connect-src" => "'self' https://www.sandbox.paypal.com/ https://www.paypal.com/",
236
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
863 },
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
864 }
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
865
235
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
866 cron { 'wordpress_cron':
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
867 # Run "php -f wp-cron.php" on a schedule so that we can auto-update
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
868 # without giving Apache full write access!
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
869 command => "/usr/local/bin/bdstrike-cron",
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
870 user => $defaultusers::default_user,
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
871 minute => '*/15',
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
872 }
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
873 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
874 class devsite ($proxy_4to6_ip) {
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
875 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 {
418
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
876 $package_name = 'python3-mod_wsgi'
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
877 $mod_path = 'mod_wsgi_python3.so'
261
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
878 } else {
418
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
879 $package_name = undef
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
880 $mod_path = undef
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
881 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
882 class { 'apache::mod::wsgi':
418
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
883 package_name => $package_name,
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
884 mod_path => $mod_path,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
885 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
886
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
887 website::https::multitld { 'dev.ibboard':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
888 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
889 #Make sure we're the first one hit for the tiny fraction of "no support" cases we care about (potentially Python for Mercurial!)
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
890 # http://en.wikipedia.org/wiki/Server_Name_Indication#No_support
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
891 priority => 1,
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
892 letsencrypt_name => 'dev.ibboard.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
893 custom_fragment => template("privat/apache/dev.fragment"),
281
af7df930a670 Add 4-to-6 proxy and mod_remoteip setup
IBBoard <dev@ibboard.co.uk>
parents: 279
diff changeset
894 proxy_fragment => template("privat/apache/dev-proxy.fragment"),
52
be1e9773a12c Mercurial repo versions index.php files etc, so removing index.php breaks things!
IBBoard <dev@ibboard.co.uk>
parents: 44
diff changeset
895 force_no_index => false,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
896 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
897 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
898
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
899 class webmailpimsite ($proxy_4to6_ip_pim, $proxy_4to6_ip_webmail) {
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
900 # Webmail and Personal Information Management (PIM) sites
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
901 website::https { 'webmail.ibboard.co.uk':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
902 proxy_4to6_ip => $proxy_4to6_ip_webmail,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
903 force_no_index => false,
414
23eac935cffa Switch to LetsEncrypt on Webmail
IBBoard <dev@ibboard.co.uk>
parents: 413
diff changeset
904 letsencrypt_name => 'webmail.ibboard.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
905 custom_fragment => template("privat/apache/webmail.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
906 }
396
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
907 include ::apache::params
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
908 website::https { 'pim.ibboard.co.uk':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
909 proxy_4to6_ip => $proxy_4to6_ip_pim,
396
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
910 docroot_owner => $apache::params::user,
242
7d8e664ebcc9 Change owner/group on Nextcloud for easy upgrade
IBBoard <dev@ibboard.co.uk>
parents: 241
diff changeset
911 docroot_group => 'editors',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
912 force_no_index => false,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
913 lockdown_requests => false,
429
fa3093f2dc8e Migrate NextCloud to LetsEncrypt
IBBoard <dev@ibboard.co.uk>
parents: 426
diff changeset
914 letsencrypt_name => 'pim.ibboard.co.uk',
265
bf2b8912c414 Make PIM site skip CSP headers - NextCloud manages them
IBBoard <dev@ibboard.co.uk>
parents: 264
diff changeset
915 csp => false,
bf2b8912c414 Make PIM site skip CSP headers - NextCloud manages them
IBBoard <dev@ibboard.co.uk>
parents: 264
diff changeset
916 csp_report => false,
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
917 custom_fragment => template("privat/apache/pim.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
918 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
919 cron { 'owncloudcron':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
920 command => "/usr/local/bin/owncloud-cron",
402
76d18a918e7f Switch to more parameters
IBBoard <dev@ibboard.co.uk>
parents: 401
diff changeset
921 user => $apache::params::user,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
922 minute => '*/15',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
923 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
924 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
925
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
926 class email (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
927 $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
928 $imapserver,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
929 $mailserver_ip,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
930 $proxy_ip = undef,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
931 $proxy_upstream = [],
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
932 $nat64_ranges = [],
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
933 $mailrelays = [],
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
934 ){
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
935 class { 'postfix':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
936 mailserver => $mailserver,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
937 mailserver_ip => $mailserver_ip,
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
938 mailserver_proxy => $proxy_ip,
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
939 proxy_upstream => $proxy_upstream,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
940 mailrelays => $mailrelays,
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
941 nat64_ranges => $nat64_ranges,
317
2a20a5b7f65a Swap IPv6 Postfix to "all" protocols to support PROXY
IBBoard <dev@ibboard.co.uk>
parents: 313
diff changeset
942 protocols => $mailserver_ip =~ Stdlib::IP::Address::V6 ? { true => 'all', default => 'ipv4' },
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
943 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
944 class { 'dovecot':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
945 imapserver => $imapserver,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
946 imapserver_ip => $mailserver_ip,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
947 imapserver_proxy => $proxy_ip,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
948 proxy_upstream => $proxy_upstream,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
949 }
177
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
950 # Unspecified SpamAssassin config dependencies that started
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
951 # showing up as errors in our logs
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
952 if $osfamily == 'RedHat' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
953 $spamassassin_deps = ['perl-File-MimeInfo']
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
954 $spamassassin_dir = '/etc/mail/spamassassin/'
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
955 $amavis_config = '/etc/amavisd/amavisd.conf'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
956 $amavis_rundir = '/var/run/amavisd'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
957 $amavis_spooldir = '/var/spool/amavisd'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
958 $amavis_quarantinedir = '$HOME_DIR/quarantine'
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
959 $amavis_service = 'amavisd'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
960 # CentOS has a Clam service, but we call on demand (Ubuntu doesn't have a service)
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
961 service { 'clamd@amavisd':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
962 ensure => 'stopped',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
963 enable=> 'mask',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
964 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
965 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
966 elsif $osfamily == 'Debian' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
967 $spamassassin_deps = ['libfile-mimeinfo-perl']
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
968 $spamassassin_dir = '/etc/spamassassin/'
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
969 $amavis_config = '/etc/amavis/conf.d/60-puppeted'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
970 $amavis_rundir = '/var/run/amavis'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
971 $amavis_spooldir = '/var/lib/amavis'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
972 $amavis_quarantinedir = '$HOME_DIR/virusmails'
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
973 $amavis_service = 'amavis'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
974 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
975 package { $spamassassin_deps:
177
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
976 ensure => installed,
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
977 }
140
6eef7cec8658 Remove ClamAV from server config
IBBoard <dev@ibboard.co.uk>
parents: 139
diff changeset
978 package { [ 'amavisd-new' ]:
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
979 ensure => installed,
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
980 tag => 'av',
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
981 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
982 service { $amavis_service:
86
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents: 85
diff changeset
983 ensure => 'running',
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents: 85
diff changeset
984 enable => 'true',
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents: 85
diff changeset
985 }
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
986 file { $amavis_config:
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
987 ensure => present,
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
988 content => epp('privat/postfix/amavis.conf.epp',
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
989 {
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
990 fqdn => $::fqdn,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
991 rundir => $amavis_rundir,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
992 spooldir => $amavis_spooldir,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
993 quarantinedir => $amavis_quarantinedir,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
994 }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
995 ),
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
996 tag => 'av',
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
997 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
998 file { "${spamassassin_dir}local.cf":
163
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
999 ensure => present,
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
1000 source => 'puppet:///private/postfix/spamassassin-local.cf',
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
1001 tag => 'av',
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
1002 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1003 file { "${spamassassin_dir}ole2macro.cf":
142
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1004 ensure => present,
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1005 source => 'puppet:///common/ole2macro.cf',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1006 tag => 'av',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1007 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1008 file { "${spamassassin_dir}ole2macro.pm":
142
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1009 ensure => present,
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1010 source => 'puppet:///common/spamassassin-vba-macro-master/ole2macro.pm',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1011 tag => 'av',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1012 }
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
1013 Package<| tag == 'av' |> -> File<| tag == 'av' |>
87
6be21a984126 Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents: 86
diff changeset
1014 File<| tag == 'av' |> {
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1015 notify => Service[$amavis_service],
87
6be21a984126 Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents: 86
diff changeset
1016 }
125
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
1017 cron { 'Postwhite':
129
16a931df5fd7 Filter what we see in Postwhite cron output
IBBoard <dev@ibboard.co.uk>
parents: 128
diff changeset
1018 command => "/usr/local/bin/postwhite 2>&1| grep -vE '^(Starting|Recursively|Getting|Querying|Removing|Sorting|$)'",
125
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
1019 user => 'root',
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
1020 weekday => 0,
128
379089631403 Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents: 126
diff changeset
1021 hour => 2,
379089631403 Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents: 126
diff changeset
1022 minute => 0,
125
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
1023 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1024 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1025
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1026 class cronjobs {
447
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
1027 package { 'cron':
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
1028 ensure => installed,
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
1029 name => $operatingsystem == 'Ubuntu' ? { true => 'cron', default => 'cronie' }
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
1030 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1031 # Add Mutt for scripts that send emails, but stop it clogging the disk by keeping copies of emails
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1032 package { 'mutt':
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
1033 ensure => installed,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1034 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1035 file { '/etc/Muttrc.local':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1036 content => 'set copy = no',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1037 require => Package['mutt'],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1038 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1039
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1040 # General server-wide cron jobs
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1041 Cron { user => 'root' }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1042 cron { 'backupalldbs':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1043 command => "/usr/local/bin/backupalldbs",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1044 monthday => "*/2",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1045 hour => "4",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1046 minute => "9"
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1047 }
323
002203790815 Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents: 322
diff changeset
1048 # Only run the Great Firewall Against China on IPv4 (since we don't have an IPv6 list
002203790815 Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents: 322
diff changeset
1049 # and the PROXY forwards the IPs to services, but not at the network level)
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1050 cron { 'greatfirewallofchina':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1051 command => '/usr/local/bin/update-great-firewall-of-china',
323
002203790815 Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents: 322
diff changeset
1052 ensure => has_key($facts, 'ipaddress') ? { true => "present", default => "absent" },
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1053 hour => 3,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1054 minute => 30
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1055 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1056 cron { 'permissions':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1057 command => '/usr/local/bin/set-permissions',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1058 hour => 3,
14
534e584f21ce Tweak time on permission setting script so that it is less likely to clash with LoadAVG run every 6 minutes
IBBoard <dev@ibboard.co.uk>
parents: 13
diff changeset
1059 minute => 2
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1060 }
55
ce8eaaca6a34 Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents: 54
diff changeset
1061 # Since we're only managing the local server, use our script that wraps "puppet apply" instead of PuppetMaster
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1062 cron { 'puppet':
268
9f054191b9db Filter new log line from puppet-apply output
IBBoard <dev@ibboard.co.uk>
parents: 267
diff changeset
1063 command => '/usr/local/bin/puppet-apply | grep -v "Compiled catalog for\|Finished catalog run in\|Applied catalog in"',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1064 hour => '*/6',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1065 minute => 5
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1066 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1067 cron { 'purgecaches':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1068 command => "/usr/local/bin/purge-caches",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1069 hour => '4',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1070 minute => '15',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1071 weekday => '1',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1072 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1073 # Notify of uncommitted files
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1074 cron { 'check-mercurial-committed':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1075 command => "/usr/local/bin/check-hg-status",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1076 hour => '4',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1077 minute => '20',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1078 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1079 }
93
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1080 # Notify of available updates
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1081 cron { 'check-yum-updates':
415
de6f43c2df66 Fix the "needs updating" regex
IBBoard <dev@ibboard.co.uk>
parents: 414
diff changeset
1082 command => '/usr/bin/yum check-update | grep -E "^[^ ]+ +[0-9a-z:_\.-]+ +[^ ]+\s*\$"',
93
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1083 hour => '4',
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1084 minute => '30',
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1085 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1086 }
97
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1087 # And check whether anything needs restarting
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1088 cron { 'check-needs-restarting':
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1089 command => '/usr/bin/needs-restarting|grep -v "/usr/lib/systemd\|/usr/sbin/lvmetad\|/usr/lib/polkit-1/polkitd"',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1090 hour => '4',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1091 minute => '45',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1092 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1093 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1094 }