Mercurial > repos > other > Puppet

annotate modules/website/manifests/init.pp @ 254:5a903aa91469

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Change header types and add module to fix NextCloud header checks We had SetEnvIf but not a standard Env "Header always set" and "Header set" are not the same and result in concatenated values
author IBBoard <dev@ibboard.co.uk>
date Sun, 29 Dec 2019 12:25:14 +0000
parents 4519b727cc4c
children 0ebd8efeef04
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1 class website(
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
2 $base_dir,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
3 $cert_dir = '/etc/pki/custom',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
4 $primary_ip,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
5 $secondary_ip,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
6 $default_owner,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
7 $default_group,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
8 $default_tld = 'com',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
9 $default_extra_tlds = []
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
10 ){
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
11
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
12 validate_re($base_dir, '^(/[^/]+)*$',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
13 "${base_dir} is invalid - base_dir must be a directory without trailing slash.")
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
14 validate_re($cert_dir, '^(/[^/]+)*$',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
15 "${cert_dir} is invalid - cert_dir must be a directory without trailing slash.")
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
16 validate_array($default_extra_tlds)
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
17
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
18 $basedir = $base_dir
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
19 $certdir = $cert_dir
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
20 $docroot_owner = $default_owner
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
21 $docroot_group = $default_group
133
9337c9ce648a Switch to using LetsEncrypt certs by default
IBBoard <dev@ibboard.co.uk>
parents: 119
diff changeset
22 $ca_chain = "/etc/letsencrypt/live/${::fqdn}/chain.pem"
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
23 $tld = $default_tld
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
24 $extra_tlds = $default_extra_tlds
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
25 $htmlphpfragment = "Include conf.extra/html-php.conf"
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
26 $filterfragment = "Include conf.custom/filter.conf"
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
27 $cmsfragment = "Include conf.extra/cms_rewrites.conf"
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
28
236
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 135
diff changeset
29 $csp_base = {"frame-ancestors" => "'none'", "base-uri" => "'none'"}
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 135
diff changeset
30 $csp_report_base = {
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 135
diff changeset
31 "default-src" => "'none'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 135
diff changeset
32 "img-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 135
diff changeset
33 "script-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 135
diff changeset
34 "style-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 135
diff changeset
35 "font-src" => "'self'"
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 135
diff changeset
36 }
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 135
diff changeset
37
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
38 class { 'apache':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
39 default_mods => false,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
40 default_vhost => false,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
41 mpm_module => false,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
42 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
43 class { 'apache::mod::dir': indexes => [ 'index.html' ] }
84
ae30d98f294f Drop the number of spare servers to save some memory when we normally only have a couple of processes at once
IBBoard <dev@ibboard.co.uk>
parents: 57
diff changeset
44 class { 'apache::mod::prefork':
ae30d98f294f Drop the number of spare servers to save some memory when we normally only have a couple of processes at once
IBBoard <dev@ibboard.co.uk>
parents: 57
diff changeset
45 serverlimit => 45,
ae30d98f294f Drop the number of spare servers to save some memory when we normally only have a couple of processes at once
IBBoard <dev@ibboard.co.uk>
parents: 57
diff changeset
46 maxclients => 45,
98
00453eecda4c Reduce the number of spare servers, because we're quiet and need spare memory
IBBoard <dev@ibboard.co.uk>
parents: 84
diff changeset
47 maxspareservers => 6,
84
ae30d98f294f Drop the number of spare servers to save some memory when we normally only have a couple of processes at once
IBBoard <dev@ibboard.co.uk>
parents: 57
diff changeset
48 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
49 apache::mod {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
50 'rewrite':;
254
5a903aa91469 Change header types and add module to fix NextCloud header checks
IBBoard <dev@ibboard.co.uk>
parents: 236
diff changeset
51 'expires':;
5a903aa91469 Change header types and add module to fix NextCloud header checks
IBBoard <dev@ibboard.co.uk>
parents: 236
diff changeset
52 'env':;
5a903aa91469 Change header types and add module to fix NextCloud header checks
IBBoard <dev@ibboard.co.uk>
parents: 236
diff changeset
53 'setenvif':;
5a903aa91469 Change header types and add module to fix NextCloud header checks
IBBoard <dev@ibboard.co.uk>
parents: 236
diff changeset
54 'headers':;
34
29d330d2056a Make sure that we have mod_version installed so that Apache config fragments that try to support 2.2 and 2.4 work properly
IBBoard <dev@ibboard.co.uk>
parents: 1
diff changeset
55 'version':;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
56 }
119
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
57
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
58 # Updating the httpd package puts back some configs that we
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
59 # don't load the relevant modules for, so we'll try to make
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
60 # them blank so that RPM/Yum makes ".rpmnew" files instead
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
61 $unused_default_mods = [
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
62 "${::apache::mod_dir}/autoindex.conf",
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
63 "${::apache::mod_dir}/userdir.conf",
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
64 "${::apache::mod_dir}/welcome.conf",
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
65 ]
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
66 file { $unused_default_mods:
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
67 ensure => file,
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
68 content => '',
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
69 }
95502bafeaa3 Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents: 115
diff changeset
70
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
71 file { $base_dir:
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
72 ensure => directory;
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
73 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
74 file { '/var/log/apache':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
75 ensure => directory,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
76 mode => '0750',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
77 group => 'apache',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
78 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
79 file { '/etc/httpd/conf.extra':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
80 ensure => directory,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
81 recurse => true,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
82 source => "puppet:///modules/website/conf.extra",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
83 notify => Service['httpd'];
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
84 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
85 file { '/etc/httpd/conf/mime.types':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
86 ensure => present,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
87 source => "puppet:///modules/website/mime.types",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
88 notify => Service['httpd'];
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
89 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
90 file { '/etc/php.d/datetime.ini':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
91 ensure => present,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
92 source => "puppet:///modules/website/datetime.ini",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
93 notify => Service['httpd'];
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
94 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
95 file { '/etc/httpd/conf.d/zzz-custom.conf':
115
b35a9df52965 Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents: 98
diff changeset
96 ensure => absent,
b35a9df52965 Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents: 98
diff changeset
97 notify => Service['httpd'];
b35a9df52965 Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents: 98
diff changeset
98 }
b35a9df52965 Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents: 98
diff changeset
99 file { '/etc/httpd/conf.d/zzz-0-custom.conf':
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
100 ensure => present,
115
b35a9df52965 Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents: 98
diff changeset
101 source => "puppet:///modules/website/zzz-0-custom.conf",
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
102 notify => Service['httpd'];
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
103 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
104 file { '/etc/httpd/conf.d/php.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
105 ensure => present,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
106 source => "puppet:///modules/website/php.conf",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
107 notify => Service['httpd'];
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
108 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
109 file { '/etc/httpd/conf.custom':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
110 ensure => directory,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
111 recurse => true,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
112 source => "puppet:///private/apache/conf.custom",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
113 notify => Service['httpd'];
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
114 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
115 file { $cert_dir:
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
116 ensure => directory;
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
117 }
48
5cdc1c96c477 Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents: 1
diff changeset
118 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, 7) >= 0 {
5cdc1c96c477 Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents: 1
diff changeset
119 exec { 'set_apache_defaults':
5cdc1c96c477 Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents: 1
diff changeset
120 command => 'semanage fcontext -a -t httpd_sys_content_t "/srv/sites(/.*)?"',
5cdc1c96c477 Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents: 1
diff changeset
121 path => '/bin:/usr/bin/:/sbin:/usr/sbin',
5cdc1c96c477 Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents: 1
diff changeset
122 require => Package['policycoreutils-python'],
5cdc1c96c477 Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents: 1
diff changeset
123 unless => 'semanage fcontext --list | grep "/srv/sites\\(/\\.\\*\\)\\?"',
5cdc1c96c477 Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents: 1
diff changeset
124 }
133
9337c9ce648a Switch to using LetsEncrypt certs by default
IBBoard <dev@ibboard.co.uk>
parents: 119
diff changeset
125 cron { 'letsencrypt-renewal':
9337c9ce648a Switch to using LetsEncrypt certs by default
IBBoard <dev@ibboard.co.uk>
parents: 119
diff changeset
126 command => '/usr/bin/certbot renew --quiet',
9337c9ce648a Switch to using LetsEncrypt certs by default
IBBoard <dev@ibboard.co.uk>
parents: 119
diff changeset
127 hour => '*/12',
9337c9ce648a Switch to using LetsEncrypt certs by default
IBBoard <dev@ibboard.co.uk>
parents: 119
diff changeset
128 minute => '21',
9337c9ce648a Switch to using LetsEncrypt certs by default
IBBoard <dev@ibboard.co.uk>
parents: 119
diff changeset
129 }
135
b3f6c7a910d0 Add Certbot packages we depend on for commands and providing certs
IBBoard <dev@ibboard.co.uk>
parents: 133
diff changeset
130 package { 'python2-certbot-apache':
b3f6c7a910d0 Add Certbot packages we depend on for commands and providing certs
IBBoard <dev@ibboard.co.uk>
parents: 133
diff changeset
131 ensure => installed,
b3f6c7a910d0 Add Certbot packages we depend on for commands and providing certs
IBBoard <dev@ibboard.co.uk>
parents: 133
diff changeset
132 }
48
5cdc1c96c477 Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents: 1
diff changeset
133 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
134 }