Mercurial > repos > other > Puppet

annotate manifests/templates.pp @ 461:5c97adb07a0a

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fix IP addresses in Ubuntu Apparently that file was wrong and didn't work after reboot. Each Ubuntu LTS has a different way of configuring. Also added a "restart networking on change" command.
author IBBoard <dev@ibboard.co.uk>
date Sun, 17 Sep 2023 15:20:12 +0100
parents ce488cfb225a
children 117680ac22af
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
32
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
1 # Make sure packages come after their repos
382
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
2 File<| tag == 'repo-config' |>
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
3 -> anchor { 'Repo-config': }
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
4 -> YumRepo<| |>
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
5 -> Apt::Source<| |>
382
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
6 -> anchor { 'Repos': }
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
7 -> Package<| |>
32
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
8
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
9 # Make sure all files are in place before starting services
298
61e90445c899 Merge CentOS8 and CentOS7 branches
IBBoard <dev@ibboard.co.uk>
parents: 292 284
diff changeset
10 # FIXME: Title matches are to fix a dependency cycle
382
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
11 File<| tag != 'post-service' and title != '/etc/sysconfig/ip6tables' and title != '/etc/sysconfig/iptables' |>
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
12 -> anchor { 'Pre-Service Files': }
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
13 -> Service<| |>
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
14
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
15 # Set some shortcut variables
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
16 #$os = $operatingsystem
249
e9323ff8f451 Make EPEL work on multiple versions of CentOS
IBBoard <dev@ibboard.co.uk>
parents: 247
diff changeset
17 $osver = $operatingsystemmajrelease
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
18 $server = ''
32
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
19
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
20
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
21 class basenode {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
22 include sudo
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
23
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
24 include defaultusers
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
25 include logwatch
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
26
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
27 file { '/etc/puppet/hiera.yaml':
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
28 ensure => present,
264
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
29 content => "
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
30 # Let the system set defaults
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
31 version: 5
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
32 ",
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
33 }
458
d7ad78f128b1 Disable Puppet service
IBBoard <dev@ibboard.co.uk>
parents: 456
diff changeset
34 service { 'puppet':
d7ad78f128b1 Disable Puppet service
IBBoard <dev@ibboard.co.uk>
parents: 456
diff changeset
35 ensure => stopped,
d7ad78f128b1 Disable Puppet service
IBBoard <dev@ibboard.co.uk>
parents: 456
diff changeset
36 enable => false,
d7ad78f128b1 Disable Puppet service
IBBoard <dev@ibboard.co.uk>
parents: 456
diff changeset
37 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
38 if $operatingsystem == 'Ubuntu' {
447
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
39 package { 'locales':
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
40 ensure => present
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
41 } ->
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
42 file { '/etc/locale.gen':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
43 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
44 content => "en_GB.UTF-8 UTF-8",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
45 notify => Exec['Regen locales']
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
46 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
47 exec { 'Regen locales':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
48 command => 'locale-gen',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
49 refreshonly => true
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
50 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
51 # Don't waste space with Snap and do everything properly with system packages
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
52 [ 'lxd', 'core18', 'core20', 'snapd'].each |$snap| {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
53 exec { "remove $snap snap package":
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
54 command => "snap remove $snap",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
55 onlyif => "which snap && snap list $snap",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
56 tag => 'snap',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
57 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
58 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
59 Exec<| tag == 'snap' |> ->
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
60 package { 'snapd':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
61 ensure => purged,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
62 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
63 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
64 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
65
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
66 class basevpsnode (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
67 $primary_ip,
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
68 $gateway_ip = undef,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
69 $proxy_4to6_ip_prefix = undef,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
70 $proxy_upstream = undef,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
71 $nat64_ranges = [],
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
72 $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
73 $imapserver,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
74 $mailrelays = [],
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
75 $firewall_cmd = 'iptables',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
76 ) {
44
546dfa011f58 Remove "puppet" host name because we don't need it
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
77
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
78 if $firewall_cmd == 'iptables' {
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
79 class { 'vpsfirewall':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
80 fw_protocol => $primary_ip =~ Stdlib::IP::Address::V6 ? { true => 'IPv6', default => 'IPv4'},
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
81 }
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
82 }
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
83
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
84 #VPS is a self-mastered Puppet machine, so bodge a Hosts file
302
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
85 if $primary_ip =~ Stdlib::IP::Address::V6 {
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
86 $lo_ip = '::1'
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
87 } else {
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
88 $lo_ip = '127.0.0.1'
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
89 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
90 file { '/etc/hosts':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
91 ensure => present,
302
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
92 content => "${lo_ip} localhost\n${primary_ip} ${fqdn}",
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
93 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
94
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
95 if $proxy_4to6_ip_prefix != undef {
461
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
96 # …:1 to …:9 for websites, …:10 for mail
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
97 $ipv6_addresses = Integer[1, 10].map |$octet| { "$proxy_4to6_ip_prefix:$octet" }
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
98 if $operatingsystem == 'Ubuntu' {
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
99 # Ubuntu can't parse the existing file, so we need to brute-force it with a template
461
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
100 $ipv6_secondaries = join($ipv6_addresses, "\naddress=")
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
101 file { "/etc/systemd/network/50-ip-alias.network":
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
102 content => "[Network]\naddress=$ipv6_secondaries\n",
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
103 notify => Exec["restart_networking"],
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
104 }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
105 }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
106 else {
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
107 $ipv6_secondaries = join($ipv6_addresses, " ")
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
108
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
109 augeas {'IPv6 secondary addresses':
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
110 context => "/files/etc/sysconfig/network-scripts/ifcfg-eth0",
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
111 changes => "set IPV6ADDR_SECONDARIES '\"$ipv6_secondaries\"'",
461
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
112 notify => Exec["restart_networking"],
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
113 }
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
114 }
461
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
115
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
116 Exec { 'restart_networking':
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
117 command => 'systemctl restart networking',
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
118 refreshonly => true,
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
119 }
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
120 }
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
121
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
122 require repos
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
123 include basenode
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
124 include privat
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
125 include dnsresolver
396
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
126 include ::privat::params
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
127 class { '::ssh':
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
128 sshd_config_port => $::privat::params::ssh_port[$::fqdn]
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
129 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
130 include vcs::server
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
131 include vcs::client
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
132 class { 'webserver':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
133 primary_ip => $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
134 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
135 proxy_4to6_mask => 124,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
136 proxy_upstream => $proxy_upstream,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
137 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
138 include cronjobs
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
139 include logrotate
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
140 class { 'fail2ban':
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
141 firewall_cmd => $firewall_cmd,
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
142 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
143 include tools
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
144 class { 'email':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
145 mailserver => $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
146 imapserver => $imapserver,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
147 mailserver_ip => $primary_ip,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
148 proxy_ip => $proxy_4to6_ip_prefix != undef ? { true => "${proxy_4to6_ip_prefix}:10", default => undef },
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
149 proxy_upstream => $proxy_upstream,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
150 nat64_ranges => $nat64_ranges,
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
151 mailrelays => $mailrelays,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
152 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
153 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
154
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
155 ## Classes to allow facet behaviour using preconfigured setups of classes
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
156
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
157 class vpsfirewall ($fw_protocol) {
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
158 resources { "firewall":
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
159 purge => false,
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
160 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
161 class { "my_fw":
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
162 ip_version => $fw_protocol,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
163 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
164 # Control what does and doesn't get pruned in the main filter chain
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
165 firewallchain { "INPUT:filter:$fw_protocol":
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
166 purge => true,
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
167 ignore => [
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
168 '-j f2b-[^ ]+$',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
169 '^(:|-A )f2b-',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
170 '--comment "Great Firewall of China"',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
171 '--comment "Do not purge',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
172 ],
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
173 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
174 if ($fw_protocol != "IPv6") {
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
175 firewall { '010 Whitelist Googlebot':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
176 source => '66.249.64.0/19',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
177 dport => [80,443],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
178 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
179 action => accept,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
180 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
181 # Block a spammer hitting our contact forms (also on StopForumSpam list A LOT)
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
182 firewall { '099 Blacklist spammers 1':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
183 source => '107.181.78.172',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
184 dport => [80, 443],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
185 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
186 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
187 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
188 firewall { '099 Blacklist IODC bot':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
189 # IODC bot makes too many bad requests, and contact form is broken
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
190 # They don't publish a robots.txt name, so firewall it!
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
191 source => '86.153.145.149',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
192 dport => [ 80, 443 ],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
193 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
194 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
195 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
196 firewall { '099 Blacklist Baidu Brazil':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
197 #Baidu got a Brazilian netblock and are hitting us hard
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
198 #Baidu doesn't honour "crawl-delay" in robots.txt
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
199 #Baidu gets firewalled
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
200 source => '131.161.8.0/22',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
201 dport => [ 80, 443 ],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
202 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
203 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
204 }
139
abaf384dc939 Block another annoying IP with a firewall rule
IBBoard <dev@ibboard.co.uk>
parents: 137
diff changeset
205 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
206 firewallchain { "GREATFIREWALLOFCHINA:filter:$fw_protocol":
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
207 ensure => present,
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
208 }
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
209 firewall { '050 Check our Great Firewall Against China':
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
210 chain => 'INPUT',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
211 jump => 'GREATFIREWALLOFCHINA',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
212 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
213 firewallchain { "Fail2Ban:filter:$fw_protocol":
64
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
214 ensure => present,
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
215 }
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
216 firewall { '060 Check Fail2Ban':
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
217 chain => 'INPUT',
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
218 jump => 'Fail2Ban',
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
219 }
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
220 }
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
221
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
222 class dnsresolver {
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
223 package { 'unbound':
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
224 ensure => present,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
225 }
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
226 package { 'named':
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
227 ensure => absent,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
228 }
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
229
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
230 service { 'named':
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
231 ensure => stopped,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
232 enable => false,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
233 }
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
234 service { 'unbound':
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
235 ensure => running,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
236 enable => true,
194
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
237 }
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
238
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
239 file { '/etc/named.conf':
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
240 ensure => absent,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
241 }
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
242 file { '/etc/unbound/unbound.conf':
194
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
243 ensure => present,
247
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
244 source => [
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
245 "puppet:///common/unbound.conf-${::hostname}",
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
246 "puppet:///common/unbound.conf",
247
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
247 ],
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
248 require => Package['unbound'],
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
249 notify => Service['unbound'],
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
250 }
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
251 file { ['/etc/NetworkManager', '/etc/NetworkManager/conf.d']:
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
252 ensure => directory
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
253 }
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
254 file { '/etc/NetworkManager/conf.d/local-dns-resolver.conf':
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
255 ensure => present,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
256 content => "[main]
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
257 dns=none",
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
258 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
259
101
a48b6011a084 Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents: 100
diff changeset
260 file { '/etc/sysconfig/named':
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
261 ensure => absent,
101
a48b6011a084 Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents: 100
diff changeset
262 }
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
263 file { '/etc/resolv.conf':
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
264 ensure => file,
301
1bfc290270cc Fix sa-update by using IPv6 for local DNS cache
IBBoard <dev@ibboard.co.uk>
parents: 298
diff changeset
265 # "ipaddress" key only exists for machines with IPv4 addresses
1bfc290270cc Fix sa-update by using IPv6 for local DNS cache
IBBoard <dev@ibboard.co.uk>
parents: 298
diff changeset
266 content => has_key($facts, 'ipaddress') ? { true => "nameserver 127.0.0.1", default => "nameserver ::1" },
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
267 require => Service['unbound'],
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
268 tag => 'post-service',
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
269 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
270 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
271
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
272 class repos {
439
e4de05e3a2f8 Ensure Python params are included
IBBoard <dev@ibboard.co.uk>
parents: 435
diff changeset
273 include ::python::params
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
274 if $operatingsystem == 'CentOS' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
275 yumrepo { 'epel':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
276 mirrorlist => 'https://mirrors.fedoraproject.org/metalink?repo=epel-$releasever&arch=$basearch',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
277 descr => "Extra Packages for Enterprise Linux",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
278 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
279 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
280 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
281 gpgkey => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
282 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
283 file { "/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver":
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
284 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
285 source => "puppet:///common/RPM-GPG-KEY-EPEL-$osver",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
286 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
287 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
288 yumrepo { 'ibboard':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
289 baseurl => 'https://download.opensuse.org/repositories/home:/IBBoard:/server/CentOS_$releasever/',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
290 descr => 'Extra packages from IBBoard',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
291 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
292 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
293 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
294 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
295 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
296 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
297 source => 'puppet:///common/RPM-GPG-KEY-ibboard',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
298 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
299 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
300 yumrepo { 'webtatic':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
301 ensure => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
302 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
303 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-andy':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
304 ensure => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
305 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
306 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-el7':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
307 ensure => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
308 }
409
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
309 # Python requires the `devel` package on CentOS, but by default the module tries to uninstall it
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
310 $dev = 'present'
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
311 }
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
312 else {
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
313 # Other distros can take the default devel status
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
314 $dev = $::python::params::dev
447
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
315 # CentOS-like distros have PKI by default. Others need it creating.
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
316 file { '/etc/pki/':
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
317 ensure => directory,
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
318 }
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
319
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
320 apt::source {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
321 'ibboard':
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
322 location => 'http://download.opensuse.org/repositories/home:/IBBoard:/server/xUbuntu_22.04/',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
323 release => '/',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
324 repos => '',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
325 key => {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
326 id => 'EDC682701D792970AD8645E7A7A55B845DCFCBE2',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
327 source => "https://download.opensuse.org/repositories/home:IBBoard:server/xUbuntu_22.04/Release.key"
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
328 }
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
329 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
330 }
148
d9fcabc75a1e Fix pip installations
IBBoard <dev@ibboard.co.uk>
parents: 147
diff changeset
331
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
332 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 {
383
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
333 # The following may possibly work to ensure a CentOS Streams install.
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
334 # Or it might fail for inexplicable reasons.
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
335 # FIXME: Should be "centos-release-stream" to migrate (provides repos), but then that gets replaced by centos-stream-release,
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
336 # which Puppet doesn't recognise as the same and so keeps trying to re-install. May need an "unless" or maybe "allow_virtual"
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
337 package { 'centos-stream-release':
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
338 ensure => installed,
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
339 notify => Exec['migrate to streams'];
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
340 }
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
341 exec { 'migrate to streams':
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
342 command => '/usr/bin/dnf swap centos-linux-repos centos-stream-repos; /usr/bin/dnf distro-sync -y',
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
343 refreshonly => true
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
344 }
148
d9fcabc75a1e Fix pip installations
IBBoard <dev@ibboard.co.uk>
parents: 147
diff changeset
345 }
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
346
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
347 class { 'python':
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
348 ensure => 'present',
401
f0ee7a16125d Switch to Python 3 on all platforms
IBBoard <dev@ibboard.co.uk>
parents: 399
diff changeset
349 version => 'python3',
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
350 pip => 'present',
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
351 use_epel => false,
409
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
352 dev => $dev,
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
353 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
354 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
355
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
356 class tools {
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
357 $packages = [ 'sqlite', 'bash-completion', 'nano', 'zip', 'bzip2', 'mlocate', 'patch', 'tmux', 'wget', 'rsync' ]
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
358 package { $packages:
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
359 ensure => installed;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
360 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
361 if $osfamily == 'RedHat' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
362 package { 'yum-utils':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
363 ensure => installed
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
364 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
365 }
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
366 elsif $osfamily == 'Debian' {
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
367 package { 'dnsutils':
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
368 ensure => installed
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
369 }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
370 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
371 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
372
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
373 class logrotate {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
374 package { 'logrotate':
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
375 ensure => installed;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
376 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
377 file { '/etc/logrotate.d/httpd':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
378 ensure => present,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
379 source => 'puppet:///common/logrotate-httpd',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
380 require => Package['logrotate'],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
381 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
382 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
383
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
384 class logwatch {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
385 package { 'logwatch':
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
386 ensure => installed;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
387 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
388 File {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
389 ensure => present,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
390 require => Package['logwatch'],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
391 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
392 file { '/etc/cron.daily/0logwatch':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
393 source => 'puppet:///common/0logwatch';
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
394 }
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
395 $logwatch_dirs = [
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
396 '/etc/logwatch/',
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
397 '/etc/logwatch/conf/',
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
398 '/etc/logwatch/conf/logfiles/',
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
399 '/etc/logwatch/conf/services/',
345
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
400 '/etc/logwatch/scripts/',
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
401 '/etc/logwatch/scripts/services/',
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
402 ]
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
403 file { $logwatch_dirs:
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
404 ensure => directory,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
405 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
406 file { '/etc/logwatch/conf/logwatch.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
407 content => 'Detail = Med',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
408 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
409 file { '/etc/logwatch/conf/logfiles/http.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
410 content => 'LogFile = apache/access_*.log',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
411 }
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
412 file { '/etc/logwatch/conf/logfiles/http-error.conf':
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
413 source => 'puppet:///common/logwatch/logfiles_http-error.conf',
126
8316d4e55e92 Fix Apache 2.4 Logwatch support
IBBoard <dev@ibboard.co.uk>
parents: 125
diff changeset
414 }
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
415 file { '/etc/logwatch/conf/logfiles/mysql.conf':
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
416 source => 'puppet:///common/logwatch/logfiles_mysql.conf',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
417 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
418 file { '/etc/logwatch/conf/logfiles/php.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
419 source => 'puppet:///common/logwatch/logfiles_php.conf',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
420 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
421 file { '/etc/logwatch/conf/services/php.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
422 source => 'puppet:///common/logwatch/services_php.conf',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
423 }
379
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
424 file { '/etc/logwatch/conf/services/contact-form.conf':
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
425 source => 'puppet:///common/logwatch/services_contact-form.conf',
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
426 }
345
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
427 file { '/etc/logwatch/scripts/services/dovecot':
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
428 source => 'puppet:///common/logwatch/dovecot',
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
429 }
346
61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 345
diff changeset
430 file { '/etc/logwatch/scripts/services/postfix':
61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 345
diff changeset
431 source => 'puppet:///common/logwatch/postfix',
61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 345
diff changeset
432 }
347
73d7b3ec6263 Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents: 346
diff changeset
433 file { '/etc/logwatch/scripts/services/systemd':
73d7b3ec6263 Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents: 346
diff changeset
434 source => 'puppet:///common/logwatch/systemd',
73d7b3ec6263 Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents: 346
diff changeset
435 }
379
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
436 file { '/etc/logwatch/scripts/services/php':
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
437 source => 'puppet:///common/logwatch/php',
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
438 }
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
439 file { '/etc/logwatch/scripts/services/contact-form':
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
440 source => 'puppet:///common/logwatch/contact-form',
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
441 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
442 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
443
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
444 #Our web server with our configs, not just a stock one
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
445 class webserver (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
446 $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
447 $proxy_4to6_ip_prefix = undef,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
448 $proxy_4to6_mask = undef,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
449 $proxy_upstream = undef,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
450 ) {
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
451
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
452 #Setup base website parameters
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
453 class { 'website':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
454 base_dir => '/srv/sites',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
455 primary_ip => $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
456 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
457 proxy_4to6_mask => $proxy_4to6_mask,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
458 proxy_upstream => $proxy_upstream,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
459 default_owner => $defaultusers::default_user,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
460 default_group => $defaultusers::default_user,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
461 default_tld => 'co.uk',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
462 default_extra_tlds => [ 'com' ],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
463 }
110
be2b30b17a4c Switch to PHP 7 from Webtatic
IBBoard <dev@ibboard.co.uk>
parents: 108
diff changeset
464
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
465 if $operatingsystem == 'CentOS' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
466 $php_suffix = ''
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
467 $ini_prefix_20 = '20-'
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
468 $ini_prefix_30 = '30-'
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
469 $ini_prefix_40 = '40-'
419
0c627ff3a7c3 Fix PHP setup on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 418
diff changeset
470 $variant_prefix = 'php-'
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
471 $extra_prefix = 'pecl-'
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
472 $extra_extras = {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
473 'posix' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
474 ini_prefix => '20-',
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
475 },
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
476 # Sodium has been bundled since 7.2, but CentOS packages it separately
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
477 'sodium' => {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
478 ini_prefix => '20-',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
479 },
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
480 # JSON is integrated into PHP 8+ and so it's only a plugin in CentOS
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
481 'json' => {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
482 ini_prefix => '20-',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
483 },
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
484 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
485 if versioncmp($operatingsystemrelease, '8') >= 0 {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
486 yumrepo { 'remirepo-safe':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
487 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/$basearch/mirror',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
488 descr => "Extra CentOS packages from Remi",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
489 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
490 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
491 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
492 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
493 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
494 yumrepo { 'remirepo-php':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
495 mirrorlist => 'http://cdn.remirepo.net/enterprise/8/modular/$basearch/mirror',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
496 descr => 'Remi\'s Modular repository for Enterprise Linux 8 - $basearch',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
497 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
498 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
499 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
500 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
501 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
502 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
503 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
504 source => 'puppet:///common/RPM-GPG-KEY-remi.el8',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
505 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
506 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
507 } else {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
508 yumrepo { 'remirepo-safe':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
509 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/mirror',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
510 descr => "Extra CentOS packages from Remi",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
511 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
512 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
513 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
514 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
515 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
516 yumrepo { 'remirepo-php':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
517 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/php74/mirror',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
518 descr => "PHP7.4 for CentOS from Remi",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
519 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
520 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
521 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
522 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
523 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
524 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
525 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
526 source => 'puppet:///common/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
527 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
528 }
320
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
529 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
530 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
531 elsif $operatingsystem == 'Ubuntu' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
532 $php_suffix = ''
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
533 $ini_prefix_20 = ''
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
534 $ini_prefix_30 = ''
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
535 $ini_prefix_40 = ''
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
536 $variant_prefix = 'php-'
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
537 $extra_prefix = ''
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
538 # Work around constant re-install by enabling virtual packages
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
539 # https://github.com/voxpupuli/puppet-php/issues/387
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
540 Package {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
541 allow_virtual => true
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
542 }
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
543 $extra_extras = {
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
544 'xdebug' => {
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
545 # Occasional profiling retained in case I want to dig into
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
546 # Wordpress page load inefficiencies any more
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
547 ensure => absent,
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
548 # settings => {
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
549 # "xdebug.mode" => "profile",
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
550 # "xdebug.start_with_request" => "trigger",
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
551 # }
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
552 }
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
553 }
238
6467e768e353 Switch to PHP 7.4 from Remi
IBBoard <dev@ibboard.co.uk>
parents: 236
diff changeset
554 }
110
be2b30b17a4c Switch to PHP 7 from Webtatic
IBBoard <dev@ibboard.co.uk>
parents: 108
diff changeset
555
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
556 #Configure the PHP version to use
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
557 class { 'website::php':
350
85d2c0079af9 Make opcache core and add APCu for object caching
IBBoard <dev@ibboard.co.uk>
parents: 347
diff changeset
558 suffix => $php_suffix,
335
aa9f570d6a9c Switch to PHP 7.4 now that NextCloud has reached v18
IBBoard <dev@ibboard.co.uk>
parents: 334
diff changeset
559 module => ($operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0) ? { true => 'remi-7.4', default => undef },
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
560 extras => {
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
561 'bcmath' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
562 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
563 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
564 'curl' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
565 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
566 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
567 'dom' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
568 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
569 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
570 'enchant' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
571 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
572 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
573 'exif' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
574 ini_prefix => $ini_prefix_20,
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
575 },
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
576 'fileinfo' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
577 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
578 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
579 'gmp' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
580 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
581 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
582 'intl' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
583 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
584 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
585 'mysqlnd' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
586 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
587 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
588 'pdo' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
589 ini_prefix => $ini_prefix_20,
419
0c627ff3a7c3 Fix PHP setup on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 418
diff changeset
590 },
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
591 'simplexml' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
592 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
593 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
594 'soap' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
595 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
596 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
597 'xmlwriter' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
598 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
599 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
600 'mysqli' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
601 ini_prefix => $ini_prefix_30,
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
602 },
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
603 'pdo_mysql' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
604 ini_prefix => $ini_prefix_30,
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
605 # Provided by the php-mysql package in CentOS and declared with "Provides"
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
606 # And Ubuntu is the same but without the "Provides"
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
607 provider => "none",
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
608 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
609 'xmlreader' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
610 ini_prefix => $ini_prefix_30,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
611 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
612 'zip' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
613 ini_prefix => $ini_prefix_30,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
614 package_prefix => "${variant_prefix}${extra_prefix}"
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
615 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
616 'apcu' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
617 ini_prefix => $ini_prefix_40,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
618 package_prefix => "${variant_prefix}${extra_prefix}"
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
619 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
620 'imagick' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
621 ini_prefix => $ini_prefix_40,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
622 package_prefix => "${variant_prefix}${extra_prefix}"
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
623 },
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
624 } + $extra_extras,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
625 }
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
626
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
627 #Setup MySQL, using (private) templates to make sure that we set non-std passwords and a default user
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
628 if $operatingsystem == 'CentOS' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
629 if versioncmp($operatingsystemrelease, '7') >= 0 {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
630 $mysqlpackage = 'mariadb'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
631 $mysqlsuffix = ''
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
632
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
633 # Required for SELinux rule setting/status checks
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
634 if versioncmp($operatingsystemrelease, '8') >= 0 {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
635 $semanage_package_name = 'policycoreutils-python-utils'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
636 } else {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
637 $semanage_package_name = 'policycoreutils-python'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
638 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
639
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
640 package { 'policycoreutils-python':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
641 name => $semanage_package_name,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
642 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
643 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
644
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
645 $extra_packages = [
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
646 'perl-Sys-Syslog', #Required for Perl SPF checking
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
647 ]
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
648
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
649 package { $extra_packages:
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
650 ensure => installed
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
651 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
652 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
653 else {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
654 $mysqlpackage = 'mysql'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
655 $mysqlsuffix = '55w'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
656 }
393
a948419a23b1 Fix MySQL package names on Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 390
diff changeset
657 $phpmysqlsuffix = 'nd'
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
658 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
659 elsif $operatingsystem == 'Ubuntu' {
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
660 $mysqlpackage = 'mariadb'
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
661 $mysqlsuffix = ''
393
a948419a23b1 Fix MySQL package names on Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 390
diff changeset
662 $phpmysqlsuffix = ''
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
663 }
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
664 else {
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
665 fail("No MySQL support for ${operatingsystem}")
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
666 }
402
76d18a918e7f Switch to more parameters
IBBoard <dev@ibboard.co.uk>
parents: 401
diff changeset
667 include ::defaultusers::params
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
668 class { 'website::mysql':
402
76d18a918e7f Switch to more parameters
IBBoard <dev@ibboard.co.uk>
parents: 401
diff changeset
669 mysqluser => $::defaultusers::params::mysql_user,
76d18a918e7f Switch to more parameters
IBBoard <dev@ibboard.co.uk>
parents: 401
diff changeset
670 mysqlpassword => $::defaultusers::params::mysql_password,
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
671 mysqlprefix => $mysqlpackage,
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
672 mysqlsuffix => $mysqlsuffix,
110
be2b30b17a4c Switch to PHP 7 from Webtatic
IBBoard <dev@ibboard.co.uk>
parents: 108
diff changeset
673 phpsuffix => $php_suffix,
393
a948419a23b1 Fix MySQL package names on Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 390
diff changeset
674 phpmysqlsuffix => $phpmysqlsuffix
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
675 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
676
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
677 # Additional supporting directories that aren't served as sites
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
678 file { [ '/srv/sites/errorhandling', '/srv/sites/private', '/srv/cms' ]:
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
679 ensure => directory,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
680 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
681 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
682
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
683 class ibboardvpsnode (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
684 $primary_ip,
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
685 $gateway_ip = undef,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
686 $proxy_4to6_ip_prefix = undef,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
687 $proxy_upstream = undef,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
688 $nat64_ranges = [],
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
689 $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
690 $imapserver,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
691 $mailrelays = [],
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
692 $firewall_cmd = 'iptables',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
693 ){
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
694 class { 'basevpsnode':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
695 primary_ip => $primary_ip,
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
696 gateway_ip => $gateway_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
697 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
698 proxy_upstream => $proxy_upstream,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
699 nat64_ranges => $nat64_ranges,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
700 mailserver => $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
701 imapserver => $imapserver,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
702 mailrelays => $mailrelays,
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
703 firewall_cmd => $firewall_cmd,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
704 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
705
267
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
706 # Set timezone to something sensible
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
707 file { "/etc/localtime":
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
708 ensure => 'link',
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
709 target => '/usr/share/zoneinfo/Europe/London',
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
710 }
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
711
456
66e0e8f9e82a Ensure that at least a blank Great Firewall file exists
IBBoard <dev@ibboard.co.uk>
parents: 455
diff changeset
712 file { "${apache::conf_dir}/conf.d/greatfirewallagainstchina.conf":
66e0e8f9e82a Ensure that at least a blank Great Firewall file exists
IBBoard <dev@ibboard.co.uk>
parents: 455
diff changeset
713 ensure => file,
66e0e8f9e82a Ensure that at least a blank Great Firewall file exists
IBBoard <dev@ibboard.co.uk>
parents: 455
diff changeset
714 }
66e0e8f9e82a Ensure that at least a blank Great Firewall file exists
IBBoard <dev@ibboard.co.uk>
parents: 455
diff changeset
715
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
716 # Debian doesn't handle sensible depends like module names because of the underscore
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
717 # So we need to use the package name
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
718 package { "mod_cspnonce":
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
719 name => $osfamily == 'Debian' ? { true => "libapache2-mod-cspnonce", default => "mod_cspnonce" },
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
720 ensure => installed,
410
575764c36e16 Setup CSP Nonce on the server
IBBoard <dev@ibboard.co.uk>
parents: 409
diff changeset
721 }
575764c36e16 Setup CSP Nonce on the server
IBBoard <dev@ibboard.co.uk>
parents: 409
diff changeset
722
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
723 # Common modules used by multiple sites (mod_auth_basic is safe because we HTTPS all the things)
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
724 $mods = [
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
725 'auth_basic',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
726 'authn_core',
146
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
727 'authn_file',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
728 'authz_user',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
729 'deflate',
410
575764c36e16 Setup CSP Nonce on the server
IBBoard <dev@ibboard.co.uk>
parents: 409
diff changeset
730 'xsendfile',
575764c36e16 Setup CSP Nonce on the server
IBBoard <dev@ibboard.co.uk>
parents: 409
diff changeset
731 'cspnonce'
146
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
732 ]
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
733 apache::mod {
146
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
734 $mods:;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
735 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
736
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
737 #Configure our sites, using templates for the custom fragments where the extra content is too long
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
738 class { "devsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
739 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:01", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
740 }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
741 class { "adminsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
742 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:02", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
743 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
744 website::https::multitld { 'www.ibboard':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
745 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
746 custom_fragment => template("privat/apache/ibboard.fragment"),
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
747 letsencrypt_name => 'ibboard.co.uk',
236
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
748 csp_override => {
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
749 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
750 "default-src" => "'none'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
751 "img-src" => "'self' https://live.staticflickr.com/",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
752 "script-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
753 "style-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
754 "font-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
755 "form-action" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
756 "connect-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
757 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
758 }
374
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
759 website::https::redir { 'mail.ibboard.co.uk':
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
760 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
374
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
761 redir => 'https://ibboard.co.uk/',
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
762 docroot => "${website::basedir}/ibboard",
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
763 letsencrypt_name => 'ibboard.co.uk',
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
764 separate_log => true,
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
765 }
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
766 website::https::redir { 'imap.ibboard.co.uk':
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
767 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
374
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
768 redir => 'https://ibboard.co.uk/',
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
769 docroot => "${website::basedir}/ibboard",
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
770 letsencrypt_name => 'ibboard.co.uk',
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
771 separate_log => true,
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
772 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
773 class { "hiveworldterrasite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
774 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:04", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
775 }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
776 class { "bdstrikesite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
777 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:05", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
778 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
779 website::https::multitld { 'www.abiknight':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
780 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:06", default => undef },
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
781 custom_fragment => "$website::htmlphpfragment
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
782 ErrorDocument 404 /error.php",
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
783 letsencrypt_name => 'abiknight.co.uk',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
784 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
785 class { "webmailpimsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
786 proxy_4to6_ip_pim => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:08", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
787 proxy_4to6_ip_webmail => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:09", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
788 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
789 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
790
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
791 class adminsite ($proxy_4to6_ip) {
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
792 apache::mod { 'info':; 'status':; 'cgi':; }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
793 website::https::multitld { 'admin.ibboard':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
794 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
795 force_no_index => false,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
796 ssl_ca_chain => '',
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
797 csp_override => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
798 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
799 "img-src" => "'self' data:",
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
800 },
426
1d6cf5d981be Try to resolve more CSP errors
IBBoard <dev@ibboard.co.uk>
parents: 422
diff changeset
801 csp_report_override => {
1d6cf5d981be Try to resolve more CSP errors
IBBoard <dev@ibboard.co.uk>
parents: 422
diff changeset
802 "img-src" => "'self' data:",
1d6cf5d981be Try to resolve more CSP errors
IBBoard <dev@ibboard.co.uk>
parents: 422
diff changeset
803 },
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
804 custom_fragment => template("privat/apache/admin.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
805 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
806 if $osfamily == 'RedHat' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
807 $cron_user = 'apache'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
808 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
809 elsif $osfamily == 'Debian' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
810 $cron_user = 'www-data'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
811 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
812 cron { 'loadavg':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
813 command => '/usr/local/bin/run-loadavg-logger',
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
814 user => $cron_user,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
815 minute => '*/6'
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
816 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
817 cron { 'awstats':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
818 command => '/usr/local/bin/update-awstats > /srv/sites/admin/awstats.log',
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
819 user => $cron_user,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
820 hour => '*/6',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
821 minute => '0'
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
822 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
823 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
824
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
825 class hiveworldterrasite ($proxy_4to6_ip) {
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
826 website::https::multitld { 'www.hiveworldterra':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
827 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
828 force_no_www => false,
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
829 letsencrypt_name => 'hiveworldterra.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
830 custom_fragment => template("privat/apache/hwt.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
831 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
832 website::https::multitld { 'forums.hiveworldterra':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
833 proxy_4to6_ip => $proxy_4to6_ip,
331
f69e2d197302 Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents: 330
diff changeset
834 letsencrypt_name => 'forums.hiveworldterra.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
835 custom_fragment => template("privat/apache/forums.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
836 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
837 website::https::multitld { 'skins.hiveworldterra':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
838 proxy_4to6_ip => $proxy_4to6_ip,
334
ee4760967d2f Separate LetsEncrypt certs
IBBoard <dev@ibboard.co.uk>
parents: 332
diff changeset
839 letsencrypt_name => 'skins.hiveworldterra.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
840 custom_fragment => template("privat/apache/skins.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
841 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
842 website::https::redir { 'hiveworldterra.ibboard.co.uk':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
843 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
844 redir => 'https://www.hiveworldterra.co.uk/',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
845 docroot => "${website::basedir}/hiveworldterra",
334
ee4760967d2f Separate LetsEncrypt certs
IBBoard <dev@ibboard.co.uk>
parents: 332
diff changeset
846 letsencrypt_name => 'hiveworldterra.ibboard.co.uk',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
847 separate_log => true,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
848 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
849 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
850 class bdstrikesite ($proxy_4to6_ip) {
331
f69e2d197302 Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents: 330
diff changeset
851 website::https::multitld { 'www.bdstrike':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
852 proxy_4to6_ip => $proxy_4to6_ip,
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
853 docroot_owner => $defaultusers::secondary_user,
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
854 docroot_group => 'editors',
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
855 letsencrypt_name => 'bdstrike.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
856 custom_fragment => template("privat/apache/bdstrike.fragment"),
411
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
857 csp_override => {
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
858 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
460
ce488cfb225a Fix CSP headers for WordPress admin panel
IBBoard <dev@ibboard.co.uk>
parents: 459
diff changeset
859 "font-src" => "'self' https://fonts.gstatic.com/ https://s0.wp.com/i/fonts/inter/ data:",
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
860 "img-src" => "'self' https://secure.gravatar.com/ https://ps.w.org/ https://s.w.org/ data:",
411
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
861 "style-src" => "'self' https://fonts.googleapis.com/ 'unsafe-inline'",
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
862 "connect-src" => "'self' https://www.sandbox.paypal.com/ https://www.paypal.com/",
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
863 "frame-ancestors" => "'self'"
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
864 },
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
865 csp_report_override => {
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
866 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/reportOnly",
460
ce488cfb225a Fix CSP headers for WordPress admin panel
IBBoard <dev@ibboard.co.uk>
parents: 459
diff changeset
867 "font-src" => "'self' https://fonts.gstatic.com/ https://s0.wp.com/i/fonts/inter/ data:", # TODO: What's generating it?
411
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
868 "img-src" => "'self' https://secure.gravatar.com/ data:",
460
ce488cfb225a Fix CSP headers for WordPress admin panel
IBBoard <dev@ibboard.co.uk>
parents: 459
diff changeset
869 "style-src" => "'self' https://fonts.googleapis.com/ https://ajax.googleapis.com/ajax/libs/jqueryui/ 'nonce-%{CSP_NONCE}e' 'unsafe-hashes' 'sha256-anQSeQoEnQnBulZOQkDOFf+e6xBIGmqh7M8YFT992co=' 'sha256-zJDyuABAg68wtWDFyIh+RRe+6Vm/r+BLwaNRCGNVyXI=' 'sha256-qMalr/MPLUDW4lX/rq/cGp1Eu/H0cu0Yg98pdu69Jxs=' 'sha256-mshqJ+hidJMRDeNLHknuDAeYLOPg2OTIIA3nZmHgi9U=' 'sha256-YnRUd/QjP/NuFgfjMHhNfMCqXh0RQIGdvQfMCOf6qkw=' 'sha256-EwdiFJgqhefinoeAymrWxOYW4kza2Ekos5MY0PlXYI0=' 'sha256-G4K9vh8e+37+l69S+lHTyX3CfcK95mQUgyxYPCb7uME=' 'sha256-t6oewASd7J1vBg5mQtX4hl8bg8FeegYFM3scKLIhYUc=' 'sha256-mAQYxa3mIYqoLBrm1zLu6sLajr8vUHVFLYNpl6dAakM=' 'sha256-A8foknjCsFBi1PlRehOrHq0pVySigUurqAUgZ2y2U8c=' 'sha256-biLFinpqYMtWHmXfkA1BPeCY0/fNt46SAZ+BBk5YUog=' 'sha256-WzSByVQ8yW/DKrr77TWVt7WEMzueRcfJZImOkjTBKmc=' 'sha256-efof3agGBAL/yN8TplyNbLEgDZ3wIGMK3UMYbe8slkA='",
ce488cfb225a Fix CSP headers for WordPress admin panel
IBBoard <dev@ibboard.co.uk>
parents: 459
diff changeset
870 "script-src" => "'self' 'nonce-%{CSP_NONCE}e' 'sha256-hPnbct+H2uwUiwoh3kect6TJt4waDlLPfj47TO58lXc=' 'sha256-80Mr5Xc2f6hVSJwvFRRcNjAI9RMcnuTVAIzr6pIQswI=' 'sha256-zwGmIUR+Z6gWKbwoJ2Z3yGxI/XLETLqDqCRIV0qt/WA='",
411
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
871 "connect-src" => "'self' https://www.sandbox.paypal.com/ https://www.paypal.com/",
236
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
872 },
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
873 }
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
874
235
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
875 cron { 'wordpress_cron':
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
876 # Run "php -f wp-cron.php" on a schedule so that we can auto-update
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
877 # without giving Apache full write access!
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
878 command => "/usr/local/bin/bdstrike-cron",
459
d7af40e44502 Use Apache for BDStrike cron to fix post-update warnings
IBBoard <dev@ibboard.co.uk>
parents: 458
diff changeset
879 user => $website::apache_user,
235
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
880 minute => '*/15',
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
881 }
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
882 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
883 class devsite ($proxy_4to6_ip) {
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
884 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 {
418
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
885 $package_name = 'python3-mod_wsgi'
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
886 $mod_path = 'mod_wsgi_python3.so'
261
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
887 } else {
418
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
888 $package_name = undef
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
889 $mod_path = undef
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
890 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
891 class { 'apache::mod::wsgi':
418
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
892 package_name => $package_name,
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
893 mod_path => $mod_path,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
894 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
895
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
896 website::https::multitld { 'dev.ibboard':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
897 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
898 #Make sure we're the first one hit for the tiny fraction of "no support" cases we care about (potentially Python for Mercurial!)
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
899 # http://en.wikipedia.org/wiki/Server_Name_Indication#No_support
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
900 priority => 1,
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
901 letsencrypt_name => 'dev.ibboard.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
902 custom_fragment => template("privat/apache/dev.fragment"),
281
af7df930a670 Add 4-to-6 proxy and mod_remoteip setup
IBBoard <dev@ibboard.co.uk>
parents: 279
diff changeset
903 proxy_fragment => template("privat/apache/dev-proxy.fragment"),
52
be1e9773a12c Mercurial repo versions index.php files etc, so removing index.php breaks things!
IBBoard <dev@ibboard.co.uk>
parents: 44
diff changeset
904 force_no_index => false,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
905 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
906 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
907
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
908 class webmailpimsite ($proxy_4to6_ip_pim, $proxy_4to6_ip_webmail) {
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
909 # Webmail and Personal Information Management (PIM) sites
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
910 website::https { 'webmail.ibboard.co.uk':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
911 proxy_4to6_ip => $proxy_4to6_ip_webmail,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
912 force_no_index => false,
414
23eac935cffa Switch to LetsEncrypt on Webmail
IBBoard <dev@ibboard.co.uk>
parents: 413
diff changeset
913 letsencrypt_name => 'webmail.ibboard.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
914 custom_fragment => template("privat/apache/webmail.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
915 }
396
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
916 include ::apache::params
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
917 website::https { 'pim.ibboard.co.uk':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
918 proxy_4to6_ip => $proxy_4to6_ip_pim,
396
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
919 docroot_owner => $apache::params::user,
242
7d8e664ebcc9 Change owner/group on Nextcloud for easy upgrade
IBBoard <dev@ibboard.co.uk>
parents: 241
diff changeset
920 docroot_group => 'editors',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
921 force_no_index => false,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
922 lockdown_requests => false,
429
fa3093f2dc8e Migrate NextCloud to LetsEncrypt
IBBoard <dev@ibboard.co.uk>
parents: 426
diff changeset
923 letsencrypt_name => 'pim.ibboard.co.uk',
265
bf2b8912c414 Make PIM site skip CSP headers - NextCloud manages them
IBBoard <dev@ibboard.co.uk>
parents: 264
diff changeset
924 csp => false,
bf2b8912c414 Make PIM site skip CSP headers - NextCloud manages them
IBBoard <dev@ibboard.co.uk>
parents: 264
diff changeset
925 csp_report => false,
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
926 custom_fragment => template("privat/apache/pim.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
927 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
928 cron { 'owncloudcron':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
929 command => "/usr/local/bin/owncloud-cron",
402
76d18a918e7f Switch to more parameters
IBBoard <dev@ibboard.co.uk>
parents: 401
diff changeset
930 user => $apache::params::user,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
931 minute => '*/15',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
932 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
933 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
934
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
935 class email (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
936 $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
937 $imapserver,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
938 $mailserver_ip,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
939 $proxy_ip = undef,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
940 $proxy_upstream = [],
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
941 $nat64_ranges = [],
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
942 $mailrelays = [],
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
943 ){
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
944 class { 'postfix':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
945 mailserver => $mailserver,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
946 mailserver_ip => $mailserver_ip,
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
947 mailserver_proxy => $proxy_ip,
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
948 proxy_upstream => $proxy_upstream,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
949 mailrelays => $mailrelays,
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
950 nat64_ranges => $nat64_ranges,
317
2a20a5b7f65a Swap IPv6 Postfix to "all" protocols to support PROXY
IBBoard <dev@ibboard.co.uk>
parents: 313
diff changeset
951 protocols => $mailserver_ip =~ Stdlib::IP::Address::V6 ? { true => 'all', default => 'ipv4' },
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
952 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
953 class { 'dovecot':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
954 imapserver => $imapserver,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
955 imapserver_ip => $mailserver_ip,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
956 imapserver_proxy => $proxy_ip,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
957 proxy_upstream => $proxy_upstream,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
958 }
177
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
959 # Unspecified SpamAssassin config dependencies that started
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
960 # showing up as errors in our logs
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
961 if $osfamily == 'RedHat' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
962 $spamassassin_deps = ['perl-File-MimeInfo']
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
963 $spamassassin_dir = '/etc/mail/spamassassin/'
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
964 $amavis_config = '/etc/amavisd/amavisd.conf'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
965 $amavis_rundir = '/var/run/amavisd'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
966 $amavis_spooldir = '/var/spool/amavisd'
453
dc725b618258 Fix Amavis quarantine directory
IBBoard <dev@ibboard.co.uk>
parents: 449
diff changeset
967 $amavis_quarantinedir = '$MYHOME/quarantine'
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
968 $amavis_service = 'amavisd'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
969 # CentOS has a Clam service, but we call on demand (Ubuntu doesn't have a service)
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
970 service { 'clamd@amavisd':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
971 ensure => 'stopped',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
972 enable=> 'mask',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
973 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
974 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
975 elsif $osfamily == 'Debian' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
976 $spamassassin_deps = ['libfile-mimeinfo-perl']
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
977 $spamassassin_dir = '/etc/spamassassin/'
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
978 $amavis_config = '/etc/amavis/conf.d/60-puppeted'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
979 $amavis_rundir = '/var/run/amavis'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
980 $amavis_spooldir = '/var/lib/amavis'
453
dc725b618258 Fix Amavis quarantine directory
IBBoard <dev@ibboard.co.uk>
parents: 449
diff changeset
981 $amavis_quarantinedir = '$MYHOME/virusmails'
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
982 $amavis_service = 'amavis'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
983 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
984 package { $spamassassin_deps:
177
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
985 ensure => installed,
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
986 }
140
6eef7cec8658 Remove ClamAV from server config
IBBoard <dev@ibboard.co.uk>
parents: 139
diff changeset
987 package { [ 'amavisd-new' ]:
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
988 ensure => installed,
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
989 tag => 'av',
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
990 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
991 service { $amavis_service:
86
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents: 85
diff changeset
992 ensure => 'running',
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents: 85
diff changeset
993 enable => 'true',
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents: 85
diff changeset
994 }
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
995 file { $amavis_config:
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
996 ensure => present,
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
997 content => epp('privat/postfix/amavis.conf.epp',
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
998 {
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
999 fqdn => $::fqdn,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1000 rundir => $amavis_rundir,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1001 spooldir => $amavis_spooldir,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1002 quarantinedir => $amavis_quarantinedir,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1003 }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1004 ),
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
1005 tag => 'av',
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
1006 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1007 file { "${spamassassin_dir}local.cf":
163
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
1008 ensure => present,
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
1009 source => 'puppet:///private/postfix/spamassassin-local.cf',
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
1010 tag => 'av',
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
1011 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1012 file { "${spamassassin_dir}ole2macro.cf":
142
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1013 ensure => present,
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1014 source => 'puppet:///common/ole2macro.cf',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1015 tag => 'av',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1016 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1017 file { "${spamassassin_dir}ole2macro.pm":
142
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1018 ensure => present,
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1019 source => 'puppet:///common/spamassassin-vba-macro-master/ole2macro.pm',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1020 tag => 'av',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1021 }
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
1022 Package<| tag == 'av' |> -> File<| tag == 'av' |>
87
6be21a984126 Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents: 86
diff changeset
1023 File<| tag == 'av' |> {
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1024 notify => Service[$amavis_service],
87
6be21a984126 Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents: 86
diff changeset
1025 }
125
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
1026 cron { 'Postwhite':
129
16a931df5fd7 Filter what we see in Postwhite cron output
IBBoard <dev@ibboard.co.uk>
parents: 128
diff changeset
1027 command => "/usr/local/bin/postwhite 2>&1| grep -vE '^(Starting|Recursively|Getting|Querying|Removing|Sorting|$)'",
125
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
1028 user => 'root',
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
1029 weekday => 0,
128
379089631403 Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents: 126
diff changeset
1030 hour => 2,
379089631403 Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents: 126
diff changeset
1031 minute => 0,
125
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
1032 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1033 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1034
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1035 class cronjobs {
447
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
1036 package { 'cron':
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
1037 ensure => installed,
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
1038 name => $operatingsystem == 'Ubuntu' ? { true => 'cron', default => 'cronie' }
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
1039 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1040 # Add Mutt for scripts that send emails, but stop it clogging the disk by keeping copies of emails
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1041 package { 'mutt':
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
1042 ensure => installed,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1043 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1044 file { '/etc/Muttrc.local':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1045 content => 'set copy = no',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1046 require => Package['mutt'],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1047 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1048
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1049 # General server-wide cron jobs
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1050 Cron { user => 'root' }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1051 cron { 'backupalldbs':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1052 command => "/usr/local/bin/backupalldbs",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1053 monthday => "*/2",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1054 hour => "4",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1055 minute => "9"
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1056 }
323
002203790815 Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents: 322
diff changeset
1057 # Only run the Great Firewall Against China on IPv4 (since we don't have an IPv6 list
002203790815 Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents: 322
diff changeset
1058 # and the PROXY forwards the IPs to services, but not at the network level)
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1059 cron { 'greatfirewallofchina':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1060 command => '/usr/local/bin/update-great-firewall-of-china',
323
002203790815 Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents: 322
diff changeset
1061 ensure => has_key($facts, 'ipaddress') ? { true => "present", default => "absent" },
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1062 hour => 3,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1063 minute => 30
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1064 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1065 cron { 'permissions':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1066 command => '/usr/local/bin/set-permissions',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1067 hour => 3,
14
534e584f21ce Tweak time on permission setting script so that it is less likely to clash with LoadAVG run every 6 minutes
IBBoard <dev@ibboard.co.uk>
parents: 13
diff changeset
1068 minute => 2
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1069 }
55
ce8eaaca6a34 Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents: 54
diff changeset
1070 # Since we're only managing the local server, use our script that wraps "puppet apply" instead of PuppetMaster
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1071 cron { 'puppet':
268
9f054191b9db Filter new log line from puppet-apply output
IBBoard <dev@ibboard.co.uk>
parents: 267
diff changeset
1072 command => '/usr/local/bin/puppet-apply | grep -v "Compiled catalog for\|Finished catalog run in\|Applied catalog in"',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1073 hour => '*/6',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1074 minute => 5
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1075 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1076 cron { 'purgecaches':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1077 command => "/usr/local/bin/purge-caches",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1078 hour => '4',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1079 minute => '15',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1080 weekday => '1',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1081 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1082 # Notify of uncommitted files
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1083 cron { 'check-mercurial-committed':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1084 command => "/usr/local/bin/check-hg-status",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1085 hour => '4',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1086 minute => '20',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1087 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1088 }
93
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1089 # Notify of available updates
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1090 cron { 'check-yum-updates':
455
a32771c91043 Switch updates available/restart required to script
IBBoard <dev@ibboard.co.uk>
parents: 454
diff changeset
1091 ensure => absent,
a32771c91043 Switch updates available/restart required to script
IBBoard <dev@ibboard.co.uk>
parents: 454
diff changeset
1092 }
a32771c91043 Switch updates available/restart required to script
IBBoard <dev@ibboard.co.uk>
parents: 454
diff changeset
1093 cron { 'check-for-updates':
a32771c91043 Switch updates available/restart required to script
IBBoard <dev@ibboard.co.uk>
parents: 454
diff changeset
1094 command => '/usr/local/bin/check-updates',
93
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1095 hour => '4',
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1096 minute => '30',
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1097 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1098 }
97
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1099 # And check whether anything needs restarting
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1100 cron { 'check-needs-restarting':
455
a32771c91043 Switch updates available/restart required to script
IBBoard <dev@ibboard.co.uk>
parents: 454
diff changeset
1101 command => '/usr/local/bin/needs-restarting',
97
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1102 hour => '4',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1103 minute => '45',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1104 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1105 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1106 }