Mercurial > repos > other > Puppet

annotate manifests/templates.pp @ 471:65290cb0cec2

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Tidy up SSH firewall handling We can be generic while referencing private values for specific ports
author IBBoard <dev@ibboard.co.uk>
date Sun, 12 May 2024 19:51:53 +0100
parents e0147f345e65
children 9437c6ffa07c
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
32
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
1 # Make sure packages come after their repos
382
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
2 File<| tag == 'repo-config' |>
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
3 -> anchor { 'Repo-config': }
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
4 -> YumRepo<| |>
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
5 -> Apt::Source<| |>
382
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
6 -> anchor { 'Repos': }
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
7 -> Package<| |>
32
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
8
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
9 # Make sure all files are in place before starting services
298
61e90445c899 Merge CentOS8 and CentOS7 branches
IBBoard <dev@ibboard.co.uk>
parents: 292 284
diff changeset
10 # FIXME: Title matches are to fix a dependency cycle
382
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
11 File<| tag != 'post-service' and title != '/etc/sysconfig/ip6tables' and title != '/etc/sysconfig/iptables' |>
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
12 -> anchor { 'Pre-Service Files': }
308b4149bee5 Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents: 379
diff changeset
13 -> Service<| |>
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
14
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
15 # Set some shortcut variables
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
16 #$os = $operatingsystem
249
e9323ff8f451 Make EPEL work on multiple versions of CentOS
IBBoard <dev@ibboard.co.uk>
parents: 247
diff changeset
17 $osver = $operatingsystemmajrelease
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
18 $server = ''
32
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
19
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
20
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
21 class basenode {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
22 include sudo
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
23
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
24 include defaultusers
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
25 include logwatch
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
26
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
27 file { '/etc/puppet/hiera.yaml':
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
28 ensure => present,
264
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
29 content => "
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
30 # Let the system set defaults
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
31 version: 5
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
32 ",
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
33 }
458
d7ad78f128b1 Disable Puppet service
IBBoard <dev@ibboard.co.uk>
parents: 456
diff changeset
34 service { 'puppet':
d7ad78f128b1 Disable Puppet service
IBBoard <dev@ibboard.co.uk>
parents: 456
diff changeset
35 ensure => stopped,
d7ad78f128b1 Disable Puppet service
IBBoard <dev@ibboard.co.uk>
parents: 456
diff changeset
36 enable => false,
d7ad78f128b1 Disable Puppet service
IBBoard <dev@ibboard.co.uk>
parents: 456
diff changeset
37 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
38 if $operatingsystem == 'Ubuntu' {
447
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
39 package { 'locales':
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
40 ensure => present
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
41 } ->
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
42 file { '/etc/locale.gen':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
43 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
44 content => "en_GB.UTF-8 UTF-8",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
45 notify => Exec['Regen locales']
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
46 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
47 exec { 'Regen locales':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
48 command => 'locale-gen',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
49 refreshonly => true
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
50 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
51 # Don't waste space with Snap and do everything properly with system packages
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
52 [ 'lxd', 'core18', 'core20', 'snapd'].each |$snap| {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
53 exec { "remove $snap snap package":
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
54 command => "snap remove $snap",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
55 onlyif => "which snap && snap list $snap",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
56 tag => 'snap',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
57 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
58 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
59 Exec<| tag == 'snap' |> ->
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
60 package { 'snapd':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
61 ensure => purged,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
62 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
63 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
64 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
65
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
66 class basevpsnode (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
67 $primary_ip,
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
68 $gateway_ip = undef,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
69 $proxy_4to6_ip_prefix = undef,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
70 $proxy_upstream = undef,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
71 $nat64_ranges = [],
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
72 $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
73 $imapserver,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
74 $mailrelays = [],
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
75 $firewall_cmd = 'iptables',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
76 ) {
44
546dfa011f58 Remove "puppet" host name because we don't need it
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
77
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
78 if $firewall_cmd == 'iptables' {
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
79 class { 'vpsfirewall':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
80 fw_protocol => $primary_ip =~ Stdlib::IP::Address::V6 ? { true => 'IPv6', default => 'IPv4'},
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
81 }
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
82 }
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
83
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
84 #VPS is a self-mastered Puppet machine, so bodge a Hosts file
302
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
85 if $primary_ip =~ Stdlib::IP::Address::V6 {
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
86 $lo_ip = '::1'
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
87 } else {
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
88 $lo_ip = '127.0.0.1'
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
89 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
90 file { '/etc/hosts':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
91 ensure => present,
302
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
92 content => "${lo_ip} localhost\n${primary_ip} ${fqdn}",
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
93 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
94
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
95 if $proxy_4to6_ip_prefix != undef {
461
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
96 # …:1 to …:9 for websites, …:10 for mail
471
65290cb0cec2 Tidy up SSH firewall handling
IBBoard <dev@ibboard.co.uk>
parents: 469
diff changeset
97 # Note: IPv6 is hexadecimal and so 0x10 is not in a /124 netblock with 0x01 to 0x09!
461
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
98 $ipv6_addresses = Integer[1, 10].map |$octet| { "$proxy_4to6_ip_prefix:$octet" }
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
99 if $operatingsystem == 'Ubuntu' {
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
100 # Ubuntu can't parse the existing file, so we need to brute-force it with a template
468
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
101 file { "/etc/network/interfaces.d/eth0":
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
102 content => epp('privat/eth0.epp',
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
103 {
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
104 default_address => $primary_ip,
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
105 gateway_address => $gateway_ip,
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
106 }
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
107 ),
461
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
108 notify => Exec["restart_networking"],
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
109 }
468
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
110 # …:1 to …:9 for websites, …:10 for mail
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
111 Integer[1, 10].each |$octet| {
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
112 file { "/etc/network/interfaces.d/eth0:$octet":
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
113 content => epp('privat/eth0-alias.epp',
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
114 {
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
115 prefix_address => $proxy_4to6_ip_prefix,
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
116 octet => $octet,
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
117 }
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
118 ),
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
119 notify => Exec["restart_networking"],
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
120 }
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
121 }
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
122 }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
123 else {
468
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
124 # …:1 to …:9 for websites, …:10 for mail
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully)
IBBoard <dev@ibboard.co.uk>
parents: 467
diff changeset
125 $ipv6_addresses = Integer[1, 10].map |$octet| { "$proxy_4to6_ip_prefix:$octet" }
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
126 $ipv6_secondaries = join($ipv6_addresses, " ")
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
127
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
128 augeas {'IPv6 secondary addresses':
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
129 context => "/files/etc/sysconfig/network-scripts/ifcfg-eth0",
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
130 changes => "set IPV6ADDR_SECONDARIES '\"$ipv6_secondaries\"'",
461
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
131 notify => Exec["restart_networking"],
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
132 }
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
133 }
461
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
134
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
135 Exec { 'restart_networking':
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
136 command => 'systemctl restart networking',
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
137 refreshonly => true,
5c97adb07a0a Fix IP addresses in Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 460
diff changeset
138 }
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
139 }
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
140
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
141 require repos
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
142 include basenode
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
143 include privat
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
144 include dnsresolver
396
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
145 include ::privat::params
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
146 class { '::ssh':
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
147 sshd_config_port => $::privat::params::ssh_port[$::fqdn]
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
148 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
149 include vcs::server
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
150 include vcs::client
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
151 class { 'webserver':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
152 primary_ip => $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
153 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
154 proxy_4to6_mask => 124,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
155 proxy_upstream => $proxy_upstream,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
156 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
157 include cronjobs
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
158 include logrotate
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
159 class { 'fail2ban':
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
160 firewall_cmd => $firewall_cmd,
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
161 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
162 include tools
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
163 class { 'email':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
164 mailserver => $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
165 imapserver => $imapserver,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
166 mailserver_ip => $primary_ip,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
167 proxy_ip => $proxy_4to6_ip_prefix != undef ? { true => "${proxy_4to6_ip_prefix}:10", default => undef },
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
168 proxy_upstream => $proxy_upstream,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
169 nat64_ranges => $nat64_ranges,
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
170 mailrelays => $mailrelays,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
171 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
172 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
173
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
174 ## Classes to allow facet behaviour using preconfigured setups of classes
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
175
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
176 class vpsfirewall ($fw_protocol) {
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
177 resources { "firewall":
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
178 purge => false,
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
179 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
180 class { "my_fw":
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
181 ip_version => $fw_protocol,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
182 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
183 # Control what does and doesn't get pruned in the main filter chain
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
184 firewallchain { "INPUT:filter:$fw_protocol":
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
185 purge => true,
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
186 ignore => [
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
187 '-j f2b-[^ ]+$',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
188 '^(:|-A )f2b-',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
189 '--comment "Great Firewall of China"',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
190 '--comment "Do not purge',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
191 ],
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
192 }
471
65290cb0cec2 Tidy up SSH firewall handling
IBBoard <dev@ibboard.co.uk>
parents: 469
diff changeset
193 include privat::params
65290cb0cec2 Tidy up SSH firewall handling
IBBoard <dev@ibboard.co.uk>
parents: 469
diff changeset
194 $ssh_ports = $::privat::params::ssh_port[$::fqdn]
65290cb0cec2 Tidy up SSH firewall handling
IBBoard <dev@ibboard.co.uk>
parents: 469
diff changeset
195 firewall { '090 Allow SSH':
65290cb0cec2 Tidy up SSH firewall handling
IBBoard <dev@ibboard.co.uk>
parents: 469
diff changeset
196 dport => $ssh_ports - 22,
65290cb0cec2 Tidy up SSH firewall handling
IBBoard <dev@ibboard.co.uk>
parents: 469
diff changeset
197 proto => 'tcp',
65290cb0cec2 Tidy up SSH firewall handling
IBBoard <dev@ibboard.co.uk>
parents: 469
diff changeset
198 action => 'accept',
65290cb0cec2 Tidy up SSH firewall handling
IBBoard <dev@ibboard.co.uk>
parents: 469
diff changeset
199 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
200 if ($fw_protocol != "IPv6") {
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
201 firewall { '010 Whitelist Googlebot':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
202 source => '66.249.64.0/19',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
203 dport => [80,443],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
204 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
205 action => accept,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
206 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
207 # Block a spammer hitting our contact forms (also on StopForumSpam list A LOT)
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
208 firewall { '099 Blacklist spammers 1':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
209 source => '107.181.78.172',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
210 dport => [80, 443],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
211 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
212 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
213 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
214 firewall { '099 Blacklist IODC bot':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
215 # IODC bot makes too many bad requests, and contact form is broken
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
216 # They don't publish a robots.txt name, so firewall it!
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
217 source => '86.153.145.149',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
218 dport => [ 80, 443 ],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
219 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
220 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
221 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
222 firewall { '099 Blacklist Baidu Brazil':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
223 #Baidu got a Brazilian netblock and are hitting us hard
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
224 #Baidu doesn't honour "crawl-delay" in robots.txt
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
225 #Baidu gets firewalled
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
226 source => '131.161.8.0/22',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
227 dport => [ 80, 443 ],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
228 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
229 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
230 }
139
abaf384dc939 Block another annoying IP with a firewall rule
IBBoard <dev@ibboard.co.uk>
parents: 137
diff changeset
231 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
232 firewallchain { "GREATFIREWALLOFCHINA:filter:$fw_protocol":
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
233 ensure => present,
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
234 }
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
235 firewall { '050 Check our Great Firewall Against China':
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
236 chain => 'INPUT',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
237 jump => 'GREATFIREWALLOFCHINA',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
238 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
239 firewallchain { "Fail2Ban:filter:$fw_protocol":
64
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
240 ensure => present,
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
241 }
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
242 firewall { '060 Check Fail2Ban':
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
243 chain => 'INPUT',
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
244 jump => 'Fail2Ban',
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
245 }
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
246 }
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
247
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
248 class dnsresolver {
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
249 package { 'unbound':
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
250 ensure => present,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
251 }
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
252 package { 'named':
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
253 ensure => absent,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
254 }
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
255
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
256 service { 'named':
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
257 ensure => stopped,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
258 enable => false,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
259 }
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
260 service { 'unbound':
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
261 ensure => running,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
262 enable => true,
194
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
263 }
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
264
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
265 file { '/etc/named.conf':
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
266 ensure => absent,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
267 }
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
268 file { '/etc/unbound/unbound.conf':
194
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
269 ensure => present,
247
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
270 source => [
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
271 "puppet:///common/unbound.conf-${::hostname}",
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
272 "puppet:///common/unbound.conf",
247
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
273 ],
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
274 require => Package['unbound'],
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
275 notify => Service['unbound'],
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
276 }
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
277 file { ['/etc/NetworkManager', '/etc/NetworkManager/conf.d']:
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
278 ensure => directory
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
279 }
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
280 file { '/etc/NetworkManager/conf.d/local-dns-resolver.conf':
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
281 ensure => present,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
282 content => "[main]
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
283 dns=none",
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
284 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
285
101
a48b6011a084 Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents: 100
diff changeset
286 file { '/etc/sysconfig/named':
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
287 ensure => absent,
101
a48b6011a084 Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents: 100
diff changeset
288 }
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
289 file { '/etc/resolv.conf':
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
290 ensure => file,
301
1bfc290270cc Fix sa-update by using IPv6 for local DNS cache
IBBoard <dev@ibboard.co.uk>
parents: 298
diff changeset
291 # "ipaddress" key only exists for machines with IPv4 addresses
1bfc290270cc Fix sa-update by using IPv6 for local DNS cache
IBBoard <dev@ibboard.co.uk>
parents: 298
diff changeset
292 content => has_key($facts, 'ipaddress') ? { true => "nameserver 127.0.0.1", default => "nameserver ::1" },
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
293 require => Service['unbound'],
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
294 tag => 'post-service',
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
295 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
296 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
297
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
298 class repos {
439
e4de05e3a2f8 Ensure Python params are included
IBBoard <dev@ibboard.co.uk>
parents: 435
diff changeset
299 include ::python::params
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
300 if $operatingsystem == 'CentOS' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
301 yumrepo { 'epel':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
302 mirrorlist => 'https://mirrors.fedoraproject.org/metalink?repo=epel-$releasever&arch=$basearch',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
303 descr => "Extra Packages for Enterprise Linux",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
304 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
305 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
306 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
307 gpgkey => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
308 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
309 file { "/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver":
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
310 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
311 source => "puppet:///common/RPM-GPG-KEY-EPEL-$osver",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
312 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
313 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
314 yumrepo { 'ibboard':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
315 baseurl => 'https://download.opensuse.org/repositories/home:/IBBoard:/server/CentOS_$releasever/',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
316 descr => 'Extra packages from IBBoard',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
317 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
318 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
319 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
320 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
321 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
322 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
323 source => 'puppet:///common/RPM-GPG-KEY-ibboard',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
324 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
325 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
326 yumrepo { 'webtatic':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
327 ensure => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
328 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
329 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-andy':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
330 ensure => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
331 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
332 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-el7':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
333 ensure => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
334 }
409
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
335 # Python requires the `devel` package on CentOS, but by default the module tries to uninstall it
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
336 $dev = 'present'
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
337 }
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
338 else {
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
339 # Other distros can take the default devel status
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
340 $dev = $::python::params::dev
447
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
341 # CentOS-like distros have PKI by default. Others need it creating.
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
342 file { '/etc/pki/':
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
343 ensure => directory,
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
344 }
467
9ae251433074 Switch from legacy Apt GPG keys to keyrings
IBBoard <dev@ibboard.co.uk>
parents: 465
diff changeset
345 file { '/etc/apt/trusted.gpg.d/home_IBBoard_server.gpg':
9ae251433074 Switch from legacy Apt GPG keys to keyrings
IBBoard <dev@ibboard.co.uk>
parents: 465
diff changeset
346 # https://download.opensuse.org/repositories/home:/IBBoard:/server/xUbuntu_22.04/Release.key
9ae251433074 Switch from legacy Apt GPG keys to keyrings
IBBoard <dev@ibboard.co.uk>
parents: 465
diff changeset
347 # Then GPG exported with `cat Release.key | gpg --dearmour -o common/home_IBBoard_server.gpg
9ae251433074 Switch from legacy Apt GPG keys to keyrings
IBBoard <dev@ibboard.co.uk>
parents: 465
diff changeset
348 source => 'puppet:///common/home_IBBoard_server.gpg'
9ae251433074 Switch from legacy Apt GPG keys to keyrings
IBBoard <dev@ibboard.co.uk>
parents: 465
diff changeset
349 }
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
350
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
351 apt::source {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
352 'ibboard':
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
353 location => 'http://download.opensuse.org/repositories/home:/IBBoard:/server/xUbuntu_22.04/',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
354 release => '/',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
355 repos => '',
467
9ae251433074 Switch from legacy Apt GPG keys to keyrings
IBBoard <dev@ibboard.co.uk>
parents: 465
diff changeset
356 keyring => '/etc/apt/trusted.gpg.d/home_IBBoard_server.gpg',
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
357 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
358 }
148
d9fcabc75a1e Fix pip installations
IBBoard <dev@ibboard.co.uk>
parents: 147
diff changeset
359
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
360 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 {
383
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
361 # The following may possibly work to ensure a CentOS Streams install.
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
362 # Or it might fail for inexplicable reasons.
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
363 # FIXME: Should be "centos-release-stream" to migrate (provides repos), but then that gets replaced by centos-stream-release,
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
364 # which Puppet doesn't recognise as the same and so keeps trying to re-install. May need an "unless" or maybe "allow_virtual"
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
365 package { 'centos-stream-release':
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
366 ensure => installed,
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
367 notify => Exec['migrate to streams'];
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
368 }
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
369 exec { 'migrate to streams':
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
370 command => '/usr/bin/dnf swap centos-linux-repos centos-stream-repos; /usr/bin/dnf distro-sync -y',
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
371 refreshonly => true
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents: 382
diff changeset
372 }
148
d9fcabc75a1e Fix pip installations
IBBoard <dev@ibboard.co.uk>
parents: 147
diff changeset
373 }
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
374
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
375 class { 'python':
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
376 ensure => 'present',
401
f0ee7a16125d Switch to Python 3 on all platforms
IBBoard <dev@ibboard.co.uk>
parents: 399
diff changeset
377 version => 'python3',
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
378 pip => 'present',
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
379 use_epel => false,
409
621e78abf82c Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents: 408
diff changeset
380 dev => $dev,
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
381 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
382 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
383
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
384 class tools {
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
385 $packages = [ 'sqlite', 'bash-completion', 'nano', 'zip', 'bzip2', 'mlocate', 'patch', 'tmux', 'wget', 'rsync' ]
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
386 package { $packages:
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
387 ensure => installed;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
388 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
389 if $osfamily == 'RedHat' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
390 package { 'yum-utils':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
391 ensure => installed
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
392 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
393 }
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
394 elsif $osfamily == 'Debian' {
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
395 package { 'dnsutils':
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
396 ensure => installed
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
397 }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
398 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
399 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
400
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
401 class logrotate {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
402 package { 'logrotate':
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
403 ensure => installed;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
404 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
405 file { '/etc/logrotate.d/httpd':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
406 ensure => present,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
407 source => 'puppet:///common/logrotate-httpd',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
408 require => Package['logrotate'],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
409 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
410 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
411
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
412 class logwatch {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
413 package { 'logwatch':
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
414 ensure => installed;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
415 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
416 File {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
417 ensure => present,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
418 require => Package['logwatch'],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
419 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
420 file { '/etc/cron.daily/0logwatch':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
421 source => 'puppet:///common/0logwatch';
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
422 }
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
423 $logwatch_dirs = [
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
424 '/etc/logwatch/',
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
425 '/etc/logwatch/conf/',
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
426 '/etc/logwatch/conf/logfiles/',
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
427 '/etc/logwatch/conf/services/',
345
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
428 '/etc/logwatch/scripts/',
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
429 '/etc/logwatch/scripts/services/',
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
430 ]
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
431 file { $logwatch_dirs:
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
432 ensure => directory,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
433 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
434 file { '/etc/logwatch/conf/logwatch.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
435 content => 'Detail = Med',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
436 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
437 file { '/etc/logwatch/conf/logfiles/http.conf':
465
f6304a8e2adc Try to fix last day of month HTTP LogWatch
IBBoard <dev@ibboard.co.uk>
parents: 464
diff changeset
438 source => 'puppet:///common/logwatch/logfiles_http.conf',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
439 }
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
440 file { '/etc/logwatch/conf/logfiles/http-error.conf':
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
441 source => 'puppet:///common/logwatch/logfiles_http-error.conf',
126
8316d4e55e92 Fix Apache 2.4 Logwatch support
IBBoard <dev@ibboard.co.uk>
parents: 125
diff changeset
442 }
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
443 file { '/etc/logwatch/conf/logfiles/mysql.conf':
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
444 source => 'puppet:///common/logwatch/logfiles_mysql.conf',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
445 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
446 file { '/etc/logwatch/conf/logfiles/php.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
447 source => 'puppet:///common/logwatch/logfiles_php.conf',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
448 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
449 file { '/etc/logwatch/conf/services/php.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
450 source => 'puppet:///common/logwatch/services_php.conf',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
451 }
379
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
452 file { '/etc/logwatch/conf/services/contact-form.conf':
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
453 source => 'puppet:///common/logwatch/services_contact-form.conf',
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
454 }
345
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
455 file { '/etc/logwatch/scripts/services/dovecot':
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
456 source => 'puppet:///common/logwatch/dovecot',
bad68f1b6467 Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 342
diff changeset
457 }
346
61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 345
diff changeset
458 file { '/etc/logwatch/scripts/services/postfix':
61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 345
diff changeset
459 source => 'puppet:///common/logwatch/postfix',
61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents: 345
diff changeset
460 }
347
73d7b3ec6263 Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents: 346
diff changeset
461 file { '/etc/logwatch/scripts/services/systemd':
73d7b3ec6263 Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents: 346
diff changeset
462 source => 'puppet:///common/logwatch/systemd',
73d7b3ec6263 Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents: 346
diff changeset
463 }
379
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
464 file { '/etc/logwatch/scripts/services/php':
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
465 source => 'puppet:///common/logwatch/php',
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
466 }
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
467 file { '/etc/logwatch/scripts/services/contact-form':
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
468 source => 'puppet:///common/logwatch/contact-form',
63adae1a374a Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents: 378
diff changeset
469 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
470 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
471
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
472 #Our web server with our configs, not just a stock one
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
473 class webserver (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
474 $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
475 $proxy_4to6_ip_prefix = undef,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
476 $proxy_4to6_mask = undef,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
477 $proxy_upstream = undef,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
478 ) {
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
479
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
480 #Setup base website parameters
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
481 class { 'website':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
482 base_dir => '/srv/sites',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
483 primary_ip => $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
484 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
485 proxy_4to6_mask => $proxy_4to6_mask,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
486 proxy_upstream => $proxy_upstream,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
487 default_owner => $defaultusers::default_user,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
488 default_group => $defaultusers::default_user,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
489 default_tld => 'co.uk',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
490 default_extra_tlds => [ 'com' ],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
491 }
110
be2b30b17a4c Switch to PHP 7 from Webtatic
IBBoard <dev@ibboard.co.uk>
parents: 108
diff changeset
492
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
493 if $operatingsystem == 'CentOS' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
494 $php_suffix = ''
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
495 $ini_prefix_20 = '20-'
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
496 $ini_prefix_30 = '30-'
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
497 $ini_prefix_40 = '40-'
419
0c627ff3a7c3 Fix PHP setup on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 418
diff changeset
498 $variant_prefix = 'php-'
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
499 $extra_prefix = 'pecl-'
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
500 $extra_extras = {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
501 'posix' => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
502 ini_prefix => '20-',
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
503 },
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
504 # Sodium has been bundled since 7.2, but CentOS packages it separately
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
505 'sodium' => {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
506 ini_prefix => '20-',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
507 },
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
508 # JSON is integrated into PHP 8+ and so it's only a plugin in CentOS
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
509 'json' => {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
510 ini_prefix => '20-',
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
511 },
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
512 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
513 if versioncmp($operatingsystemrelease, '8') >= 0 {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
514 yumrepo { 'remirepo-safe':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
515 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/$basearch/mirror',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
516 descr => "Extra CentOS packages from Remi",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
517 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
518 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
519 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
520 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
521 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
522 yumrepo { 'remirepo-php':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
523 mirrorlist => 'http://cdn.remirepo.net/enterprise/8/modular/$basearch/mirror',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
524 descr => 'Remi\'s Modular repository for Enterprise Linux 8 - $basearch',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
525 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
526 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
527 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
528 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
529 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
530 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
531 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
532 source => 'puppet:///common/RPM-GPG-KEY-remi.el8',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
533 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
534 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
535 } else {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
536 yumrepo { 'remirepo-safe':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
537 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/mirror',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
538 descr => "Extra CentOS packages from Remi",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
539 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
540 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
541 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
542 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
543 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
544 yumrepo { 'remirepo-php':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
545 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/php74/mirror',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
546 descr => "PHP7.4 for CentOS from Remi",
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
547 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
548 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
549 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
550 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
551 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
552 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
553 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
554 source => 'puppet:///common/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
555 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
556 }
320
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
557 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
558 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
559 elsif $operatingsystem == 'Ubuntu' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
560 $php_suffix = ''
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
561 $ini_prefix_20 = ''
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
562 $ini_prefix_30 = ''
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
563 $ini_prefix_40 = ''
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
564 $variant_prefix = 'php-'
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
565 $extra_prefix = ''
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
566 # Work around constant re-install by enabling virtual packages
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
567 # https://github.com/voxpupuli/puppet-php/issues/387
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
568 Package {
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
569 allow_virtual => true
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
570 }
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
571 $extra_extras = {
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
572 'xdebug' => {
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
573 # Occasional profiling retained in case I want to dig into
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
574 # Wordpress page load inefficiencies any more
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
575 ensure => absent,
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
576 # settings => {
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
577 # "xdebug.mode" => "profile",
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
578 # "xdebug.start_with_request" => "trigger",
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
579 # }
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
580 }
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
581 }
238
6467e768e353 Switch to PHP 7.4 from Remi
IBBoard <dev@ibboard.co.uk>
parents: 236
diff changeset
582 }
110
be2b30b17a4c Switch to PHP 7 from Webtatic
IBBoard <dev@ibboard.co.uk>
parents: 108
diff changeset
583
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
584 #Configure the PHP version to use
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
585 class { 'website::php':
350
85d2c0079af9 Make opcache core and add APCu for object caching
IBBoard <dev@ibboard.co.uk>
parents: 347
diff changeset
586 suffix => $php_suffix,
335
aa9f570d6a9c Switch to PHP 7.4 now that NextCloud has reached v18
IBBoard <dev@ibboard.co.uk>
parents: 334
diff changeset
587 module => ($operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0) ? { true => 'remi-7.4', default => undef },
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
588 extras => {
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
589 'bcmath' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
590 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
591 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
592 'curl' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
593 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
594 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
595 'dom' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
596 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
597 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
598 'enchant' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
599 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
600 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
601 'exif' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
602 ini_prefix => $ini_prefix_20,
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
603 },
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
604 'fileinfo' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
605 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
606 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
607 'gmp' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
608 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
609 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
610 'intl' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
611 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
612 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
613 'mysqlnd' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
614 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
615 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
616 'pdo' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
617 ini_prefix => $ini_prefix_20,
419
0c627ff3a7c3 Fix PHP setup on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 418
diff changeset
618 },
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
619 'simplexml' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
620 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
621 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
622 'soap' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
623 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
624 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
625 'xmlwriter' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
626 ini_prefix => $ini_prefix_20,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
627 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
628 'mysqli' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
629 ini_prefix => $ini_prefix_30,
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
630 },
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
631 'pdo_mysql' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
632 ini_prefix => $ini_prefix_30,
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
633 # Provided by the php-mysql package in CentOS and declared with "Provides"
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
634 # And Ubuntu is the same but without the "Provides"
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
635 provider => "none",
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
636 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
637 'xmlreader' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
638 ini_prefix => $ini_prefix_30,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
639 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
640 'zip' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
641 ini_prefix => $ini_prefix_30,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
642 package_prefix => "${variant_prefix}${extra_prefix}"
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
643 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
644 'apcu' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
645 ini_prefix => $ini_prefix_40,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
646 package_prefix => "${variant_prefix}${extra_prefix}"
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
647 },
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
648 'imagick' => {
454
d0e7979c7e8c Update PHP configs for Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 453
diff changeset
649 ini_prefix => $ini_prefix_40,
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
650 package_prefix => "${variant_prefix}${extra_prefix}"
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
651 },
416
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents: 415
diff changeset
652 } + $extra_extras,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
653 }
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
654
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
655 #Setup MySQL, using (private) templates to make sure that we set non-std passwords and a default user
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
656 if $operatingsystem == 'CentOS' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
657 if versioncmp($operatingsystemrelease, '7') >= 0 {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
658 $mysqlpackage = 'mariadb'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
659 $mysqlsuffix = ''
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
660
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
661 # Required for SELinux rule setting/status checks
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
662 if versioncmp($operatingsystemrelease, '8') >= 0 {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
663 $semanage_package_name = 'policycoreutils-python-utils'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
664 } else {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
665 $semanage_package_name = 'policycoreutils-python'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
666 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
667
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
668 package { 'policycoreutils-python':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
669 name => $semanage_package_name,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
670 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
671 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
672
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
673 $extra_packages = [
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
674 'perl-Sys-Syslog', #Required for Perl SPF checking
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
675 ]
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
676
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
677 package { $extra_packages:
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
678 ensure => installed
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
679 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
680 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
681 else {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
682 $mysqlpackage = 'mysql'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
683 $mysqlsuffix = '55w'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
684 }
393
a948419a23b1 Fix MySQL package names on Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 390
diff changeset
685 $phpmysqlsuffix = 'nd'
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
686 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
687 elsif $operatingsystem == 'Ubuntu' {
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
688 $mysqlpackage = 'mariadb'
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
689 $mysqlsuffix = ''
393
a948419a23b1 Fix MySQL package names on Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 390
diff changeset
690 $phpmysqlsuffix = ''
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
691 }
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
692 else {
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
693 fail("No MySQL support for ${operatingsystem}")
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
694 }
402
76d18a918e7f Switch to more parameters
IBBoard <dev@ibboard.co.uk>
parents: 401
diff changeset
695 include ::defaultusers::params
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
696 class { 'website::mysql':
402
76d18a918e7f Switch to more parameters
IBBoard <dev@ibboard.co.uk>
parents: 401
diff changeset
697 mysqluser => $::defaultusers::params::mysql_user,
76d18a918e7f Switch to more parameters
IBBoard <dev@ibboard.co.uk>
parents: 401
diff changeset
698 mysqlpassword => $::defaultusers::params::mysql_password,
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
699 mysqlprefix => $mysqlpackage,
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
700 mysqlsuffix => $mysqlsuffix,
110
be2b30b17a4c Switch to PHP 7 from Webtatic
IBBoard <dev@ibboard.co.uk>
parents: 108
diff changeset
701 phpsuffix => $php_suffix,
393
a948419a23b1 Fix MySQL package names on Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 390
diff changeset
702 phpmysqlsuffix => $phpmysqlsuffix
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
703 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
704
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
705 # Additional supporting directories that aren't served as sites
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
706 file { [ '/srv/sites/errorhandling', '/srv/sites/private', '/srv/cms' ]:
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
707 ensure => directory,
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
708 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
709 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
710
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
711 class ibboardvpsnode (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
712 $primary_ip,
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
713 $gateway_ip = undef,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
714 $proxy_4to6_ip_prefix = undef,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
715 $proxy_upstream = undef,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
716 $nat64_ranges = [],
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
717 $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
718 $imapserver,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
719 $mailrelays = [],
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
720 $firewall_cmd = 'iptables',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
721 ){
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
722 class { 'basevpsnode':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
723 primary_ip => $primary_ip,
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
724 gateway_ip => $gateway_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
725 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
726 proxy_upstream => $proxy_upstream,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
727 nat64_ranges => $nat64_ranges,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
728 mailserver => $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
729 imapserver => $imapserver,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
730 mailrelays => $mailrelays,
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
731 firewall_cmd => $firewall_cmd,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
732 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
733
267
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
734 # Set timezone to something sensible
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
735 file { "/etc/localtime":
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
736 ensure => 'link',
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
737 target => '/usr/share/zoneinfo/Europe/London',
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
738 }
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
739
456
66e0e8f9e82a Ensure that at least a blank Great Firewall file exists
IBBoard <dev@ibboard.co.uk>
parents: 455
diff changeset
740 file { "${apache::conf_dir}/conf.d/greatfirewallagainstchina.conf":
66e0e8f9e82a Ensure that at least a blank Great Firewall file exists
IBBoard <dev@ibboard.co.uk>
parents: 455
diff changeset
741 ensure => file,
66e0e8f9e82a Ensure that at least a blank Great Firewall file exists
IBBoard <dev@ibboard.co.uk>
parents: 455
diff changeset
742 }
66e0e8f9e82a Ensure that at least a blank Great Firewall file exists
IBBoard <dev@ibboard.co.uk>
parents: 455
diff changeset
743
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
744 # Debian doesn't handle sensible depends like module names because of the underscore
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
745 # So we need to use the package name
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
746 package { "mod_cspnonce":
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
747 name => $osfamily == 'Debian' ? { true => "libapache2-mod-cspnonce", default => "mod_cspnonce" },
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
748 ensure => installed,
410
575764c36e16 Setup CSP Nonce on the server
IBBoard <dev@ibboard.co.uk>
parents: 409
diff changeset
749 }
575764c36e16 Setup CSP Nonce on the server
IBBoard <dev@ibboard.co.uk>
parents: 409
diff changeset
750
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
751 # Common modules used by multiple sites (mod_auth_basic is safe because we HTTPS all the things)
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
752 $mods = [
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
753 'auth_basic',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
754 'authn_core',
146
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
755 'authn_file',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
756 'authz_user',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
757 'deflate',
410
575764c36e16 Setup CSP Nonce on the server
IBBoard <dev@ibboard.co.uk>
parents: 409
diff changeset
758 'xsendfile',
575764c36e16 Setup CSP Nonce on the server
IBBoard <dev@ibboard.co.uk>
parents: 409
diff changeset
759 'cspnonce'
146
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
760 ]
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
761 apache::mod {
146
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
762 $mods:;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
763 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
764
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
765 #Configure our sites, using templates for the custom fragments where the extra content is too long
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
766 class { "devsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
767 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:01", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
768 }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
769 class { "adminsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
770 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:02", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
771 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
772 website::https::multitld { 'www.ibboard':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
773 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
774 custom_fragment => template("privat/apache/ibboard.fragment"),
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
775 letsencrypt_name => 'ibboard.co.uk',
236
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
776 csp_override => {
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
777 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
778 "default-src" => "'none'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
779 "img-src" => "'self' https://live.staticflickr.com/",
464
117680ac22af Amavis spool dir and add Tumblock to CSP headers
IBBoard <dev@ibboard.co.uk>
parents: 461
diff changeset
780 "script-src" => "'self' https://auth-server.herokuapp.com/proxy https://api.tumblr.com/",
236
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
781 "style-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
782 "font-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
783 "form-action" => "'self'",
464
117680ac22af Amavis spool dir and add Tumblock to CSP headers
IBBoard <dev@ibboard.co.uk>
parents: 461
diff changeset
784 "connect-src" => "'self' https://api.tumblr.com/",
236
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
785 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
786 }
374
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
787 website::https::redir { 'mail.ibboard.co.uk':
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
788 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
374
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
789 redir => 'https://ibboard.co.uk/',
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
790 docroot => "${website::basedir}/ibboard",
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
791 letsencrypt_name => 'ibboard.co.uk',
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
792 separate_log => true,
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
793 }
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
794 website::https::redir { 'imap.ibboard.co.uk':
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
795 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
374
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
796 redir => 'https://ibboard.co.uk/',
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
797 docroot => "${website::basedir}/ibboard",
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
798 letsencrypt_name => 'ibboard.co.uk',
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
799 separate_log => true,
5f4fc00f8189 Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents: 364
diff changeset
800 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
801 class { "hiveworldterrasite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
802 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:04", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
803 }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
804 class { "bdstrikesite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
805 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:05", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
806 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
807 website::https::multitld { 'www.abiknight':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
808 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:06", default => undef },
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
809 custom_fragment => "$website::htmlphpfragment
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
810 ErrorDocument 404 /error.php",
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
811 letsencrypt_name => 'abiknight.co.uk',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
812 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
813 class { "webmailpimsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
814 proxy_4to6_ip_pim => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:08", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
815 proxy_4to6_ip_webmail => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:09", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
816 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
817 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
818
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
819 class adminsite ($proxy_4to6_ip) {
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
820 apache::mod { 'info':; 'status':; 'cgi':; }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
821 website::https::multitld { 'admin.ibboard':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
822 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
823 force_no_index => false,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
824 ssl_ca_chain => '',
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
825 csp_override => {
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
826 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
827 "img-src" => "'self' data:",
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
828 },
426
1d6cf5d981be Try to resolve more CSP errors
IBBoard <dev@ibboard.co.uk>
parents: 422
diff changeset
829 csp_report_override => {
1d6cf5d981be Try to resolve more CSP errors
IBBoard <dev@ibboard.co.uk>
parents: 422
diff changeset
830 "img-src" => "'self' data:",
1d6cf5d981be Try to resolve more CSP errors
IBBoard <dev@ibboard.co.uk>
parents: 422
diff changeset
831 },
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
832 custom_fragment => template("privat/apache/admin.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
833 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
834 if $osfamily == 'RedHat' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
835 $cron_user = 'apache'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
836 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
837 elsif $osfamily == 'Debian' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
838 $cron_user = 'www-data'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
839 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
840 cron { 'loadavg':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
841 command => '/usr/local/bin/run-loadavg-logger',
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
842 user => $cron_user,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
843 minute => '*/6'
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
844 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
845 cron { 'awstats':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
846 command => '/usr/local/bin/update-awstats > /srv/sites/admin/awstats.log',
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
847 user => $cron_user,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
848 hour => '*/6',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
849 minute => '0'
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
850 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
851 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
852
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
853 class hiveworldterrasite ($proxy_4to6_ip) {
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
854 website::https::multitld { 'www.hiveworldterra':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
855 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
856 force_no_www => false,
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
857 letsencrypt_name => 'hiveworldterra.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
858 custom_fragment => template("privat/apache/hwt.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
859 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
860 website::https::multitld { 'forums.hiveworldterra':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
861 proxy_4to6_ip => $proxy_4to6_ip,
331
f69e2d197302 Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents: 330
diff changeset
862 letsencrypt_name => 'forums.hiveworldterra.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
863 custom_fragment => template("privat/apache/forums.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
864 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
865 website::https::multitld { 'skins.hiveworldterra':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
866 proxy_4to6_ip => $proxy_4to6_ip,
334
ee4760967d2f Separate LetsEncrypt certs
IBBoard <dev@ibboard.co.uk>
parents: 332
diff changeset
867 letsencrypt_name => 'skins.hiveworldterra.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
868 custom_fragment => template("privat/apache/skins.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
869 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
870 website::https::redir { 'hiveworldterra.ibboard.co.uk':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
871 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
872 redir => 'https://www.hiveworldterra.co.uk/',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
873 docroot => "${website::basedir}/hiveworldterra",
334
ee4760967d2f Separate LetsEncrypt certs
IBBoard <dev@ibboard.co.uk>
parents: 332
diff changeset
874 letsencrypt_name => 'hiveworldterra.ibboard.co.uk',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
875 separate_log => true,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
876 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
877 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
878 class bdstrikesite ($proxy_4to6_ip) {
331
f69e2d197302 Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents: 330
diff changeset
879 website::https::multitld { 'www.bdstrike':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
880 proxy_4to6_ip => $proxy_4to6_ip,
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
881 docroot_owner => $defaultusers::secondary_user,
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
882 docroot_group => 'editors',
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
883 letsencrypt_name => 'bdstrike.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
884 custom_fragment => template("privat/apache/bdstrike.fragment"),
411
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
885 csp_override => {
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
886 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
460
ce488cfb225a Fix CSP headers for WordPress admin panel
IBBoard <dev@ibboard.co.uk>
parents: 459
diff changeset
887 "font-src" => "'self' https://fonts.gstatic.com/ https://s0.wp.com/i/fonts/inter/ data:",
446
ba3c446d5a47 Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 439
diff changeset
888 "img-src" => "'self' https://secure.gravatar.com/ https://ps.w.org/ https://s.w.org/ data:",
411
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
889 "style-src" => "'self' https://fonts.googleapis.com/ 'unsafe-inline'",
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
890 "connect-src" => "'self' https://www.sandbox.paypal.com/ https://www.paypal.com/",
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
891 "frame-ancestors" => "'self'"
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
892 },
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
893 csp_report_override => {
422
8421eb25c329 Fix PHP extension loading
IBBoard <dev@ibboard.co.uk>
parents: 420
diff changeset
894 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/reportOnly",
460
ce488cfb225a Fix CSP headers for WordPress admin panel
IBBoard <dev@ibboard.co.uk>
parents: 459
diff changeset
895 "font-src" => "'self' https://fonts.gstatic.com/ https://s0.wp.com/i/fonts/inter/ data:", # TODO: What's generating it?
411
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
896 "img-src" => "'self' https://secure.gravatar.com/ data:",
460
ce488cfb225a Fix CSP headers for WordPress admin panel
IBBoard <dev@ibboard.co.uk>
parents: 459
diff changeset
897 "style-src" => "'self' https://fonts.googleapis.com/ https://ajax.googleapis.com/ajax/libs/jqueryui/ 'nonce-%{CSP_NONCE}e' 'unsafe-hashes' 'sha256-anQSeQoEnQnBulZOQkDOFf+e6xBIGmqh7M8YFT992co=' 'sha256-zJDyuABAg68wtWDFyIh+RRe+6Vm/r+BLwaNRCGNVyXI=' 'sha256-qMalr/MPLUDW4lX/rq/cGp1Eu/H0cu0Yg98pdu69Jxs=' 'sha256-mshqJ+hidJMRDeNLHknuDAeYLOPg2OTIIA3nZmHgi9U=' 'sha256-YnRUd/QjP/NuFgfjMHhNfMCqXh0RQIGdvQfMCOf6qkw=' 'sha256-EwdiFJgqhefinoeAymrWxOYW4kza2Ekos5MY0PlXYI0=' 'sha256-G4K9vh8e+37+l69S+lHTyX3CfcK95mQUgyxYPCb7uME=' 'sha256-t6oewASd7J1vBg5mQtX4hl8bg8FeegYFM3scKLIhYUc=' 'sha256-mAQYxa3mIYqoLBrm1zLu6sLajr8vUHVFLYNpl6dAakM=' 'sha256-A8foknjCsFBi1PlRehOrHq0pVySigUurqAUgZ2y2U8c=' 'sha256-biLFinpqYMtWHmXfkA1BPeCY0/fNt46SAZ+BBk5YUog=' 'sha256-WzSByVQ8yW/DKrr77TWVt7WEMzueRcfJZImOkjTBKmc=' 'sha256-efof3agGBAL/yN8TplyNbLEgDZ3wIGMK3UMYbe8slkA='",
ce488cfb225a Fix CSP headers for WordPress admin panel
IBBoard <dev@ibboard.co.uk>
parents: 459
diff changeset
898 "script-src" => "'self' 'nonce-%{CSP_NONCE}e' 'sha256-hPnbct+H2uwUiwoh3kect6TJt4waDlLPfj47TO58lXc=' 'sha256-80Mr5Xc2f6hVSJwvFRRcNjAI9RMcnuTVAIzr6pIQswI=' 'sha256-zwGmIUR+Z6gWKbwoJ2Z3yGxI/XLETLqDqCRIV0qt/WA='",
411
83f2e944a43f Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents: 410
diff changeset
899 "connect-src" => "'self' https://www.sandbox.paypal.com/ https://www.paypal.com/",
236
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
900 },
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
901 }
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
902
235
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
903 cron { 'wordpress_cron':
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
904 # Run "php -f wp-cron.php" on a schedule so that we can auto-update
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
905 # without giving Apache full write access!
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
906 command => "/usr/local/bin/bdstrike-cron",
459
d7af40e44502 Use Apache for BDStrike cron to fix post-update warnings
IBBoard <dev@ibboard.co.uk>
parents: 458
diff changeset
907 user => $website::apache_user,
235
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
908 minute => '*/15',
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
909 }
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
910 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
911 class devsite ($proxy_4to6_ip) {
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
912 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 {
418
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
913 $package_name = 'python3-mod_wsgi'
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
914 $mod_path = 'mod_wsgi_python3.so'
261
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
915 } else {
418
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
916 $package_name = undef
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
917 $mod_path = undef
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
918 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
919 class { 'apache::mod::wsgi':
418
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
920 package_name => $package_name,
dd12bb713260 Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents: 417
diff changeset
921 mod_path => $mod_path,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
922 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
923
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
924 website::https::multitld { 'dev.ibboard':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
925 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
926 #Make sure we're the first one hit for the tiny fraction of "no support" cases we care about (potentially Python for Mercurial!)
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
927 # http://en.wikipedia.org/wiki/Server_Name_Indication#No_support
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
928 priority => 1,
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
929 letsencrypt_name => 'dev.ibboard.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
930 custom_fragment => template("privat/apache/dev.fragment"),
469
e0147f345e65 Rework main vs proxy fragments and redirects
IBBoard <dev@ibboard.co.uk>
parents: 468
diff changeset
931 non_proxy_fragment => template("privat/apache/dev-nonproxy.fragment"),
52
be1e9773a12c Mercurial repo versions index.php files etc, so removing index.php breaks things!
IBBoard <dev@ibboard.co.uk>
parents: 44
diff changeset
932 force_no_index => false,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
933 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
934 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
935
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
936 class webmailpimsite ($proxy_4to6_ip_pim, $proxy_4to6_ip_webmail) {
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
937 # Webmail and Personal Information Management (PIM) sites
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
938 website::https { 'webmail.ibboard.co.uk':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
939 proxy_4to6_ip => $proxy_4to6_ip_webmail,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
940 force_no_index => false,
414
23eac935cffa Switch to LetsEncrypt on Webmail
IBBoard <dev@ibboard.co.uk>
parents: 413
diff changeset
941 letsencrypt_name => 'webmail.ibboard.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
942 custom_fragment => template("privat/apache/webmail.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
943 }
396
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
944 include ::apache::params
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
945 website::https { 'pim.ibboard.co.uk':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
946 proxy_4to6_ip => $proxy_4to6_ip_pim,
396
e93588ec1ce3 Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents: 393
diff changeset
947 docroot_owner => $apache::params::user,
242
7d8e664ebcc9 Change owner/group on Nextcloud for easy upgrade
IBBoard <dev@ibboard.co.uk>
parents: 241
diff changeset
948 docroot_group => 'editors',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
949 force_no_index => false,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
950 lockdown_requests => false,
429
fa3093f2dc8e Migrate NextCloud to LetsEncrypt
IBBoard <dev@ibboard.co.uk>
parents: 426
diff changeset
951 letsencrypt_name => 'pim.ibboard.co.uk',
265
bf2b8912c414 Make PIM site skip CSP headers - NextCloud manages them
IBBoard <dev@ibboard.co.uk>
parents: 264
diff changeset
952 csp => false,
bf2b8912c414 Make PIM site skip CSP headers - NextCloud manages them
IBBoard <dev@ibboard.co.uk>
parents: 264
diff changeset
953 csp_report => false,
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
954 custom_fragment => template("privat/apache/pim.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
955 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
956 cron { 'owncloudcron':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
957 command => "/usr/local/bin/owncloud-cron",
402
76d18a918e7f Switch to more parameters
IBBoard <dev@ibboard.co.uk>
parents: 401
diff changeset
958 user => $apache::params::user,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
959 minute => '*/15',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
960 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
961 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
962
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
963 class email (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
964 $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
965 $imapserver,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
966 $mailserver_ip,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
967 $proxy_ip = undef,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
968 $proxy_upstream = [],
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
969 $nat64_ranges = [],
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
970 $mailrelays = [],
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
971 ){
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
972 class { 'postfix':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
973 mailserver => $mailserver,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
974 mailserver_ip => $mailserver_ip,
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
975 mailserver_proxy => $proxy_ip,
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
976 proxy_upstream => $proxy_upstream,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
977 mailrelays => $mailrelays,
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
978 nat64_ranges => $nat64_ranges,
317
2a20a5b7f65a Swap IPv6 Postfix to "all" protocols to support PROXY
IBBoard <dev@ibboard.co.uk>
parents: 313
diff changeset
979 protocols => $mailserver_ip =~ Stdlib::IP::Address::V6 ? { true => 'all', default => 'ipv4' },
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
980 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
981 class { 'dovecot':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
982 imapserver => $imapserver,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
983 imapserver_ip => $mailserver_ip,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
984 imapserver_proxy => $proxy_ip,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
985 proxy_upstream => $proxy_upstream,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
986 }
177
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
987 # Unspecified SpamAssassin config dependencies that started
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
988 # showing up as errors in our logs
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
989 if $osfamily == 'RedHat' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
990 $spamassassin_deps = ['perl-File-MimeInfo']
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
991 $spamassassin_dir = '/etc/mail/spamassassin/'
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
992 $amavis_config = '/etc/amavisd/amavisd.conf'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
993 $amavis_rundir = '/var/run/amavisd'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
994 $amavis_spooldir = '/var/spool/amavisd'
464
117680ac22af Amavis spool dir and add Tumblock to CSP headers
IBBoard <dev@ibboard.co.uk>
parents: 461
diff changeset
995 $amavis_quarantinedir = '/var/spool/amavisd/quarantine'
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
996 $amavis_service = 'amavisd'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
997 # CentOS has a Clam service, but we call on demand (Ubuntu doesn't have a service)
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
998 service { 'clamd@amavisd':
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
999 ensure => 'stopped',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1000 enable=> 'mask',
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1001 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1002 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1003 elsif $osfamily == 'Debian' {
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1004 $spamassassin_deps = ['libfile-mimeinfo-perl']
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1005 $spamassassin_dir = '/etc/spamassassin/'
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1006 $amavis_config = '/etc/amavis/conf.d/60-puppeted'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1007 $amavis_rundir = '/var/run/amavis'
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1008 $amavis_spooldir = '/var/lib/amavis'
464
117680ac22af Amavis spool dir and add Tumblock to CSP headers
IBBoard <dev@ibboard.co.uk>
parents: 461
diff changeset
1009 $amavis_quarantinedir = '/var/spool/amavisd/quarantine'
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1010 $amavis_service = 'amavis'
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1011 }
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1012 package { $spamassassin_deps:
177
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
1013 ensure => installed,
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
1014 }
140
6eef7cec8658 Remove ClamAV from server config
IBBoard <dev@ibboard.co.uk>
parents: 139
diff changeset
1015 package { [ 'amavisd-new' ]:
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
1016 ensure => installed,
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
1017 tag => 'av',
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
1018 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1019 service { $amavis_service:
86
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents: 85
diff changeset
1020 ensure => 'running',
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents: 85
diff changeset
1021 enable => 'true',
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents: 85
diff changeset
1022 }
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1023 file { $amavis_config:
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
1024 ensure => present,
449
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1025 content => epp('privat/postfix/amavis.conf.epp',
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1026 {
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1027 fqdn => $::fqdn,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1028 rundir => $amavis_rundir,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1029 spooldir => $amavis_spooldir,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1030 quarantinedir => $amavis_quarantinedir,
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1031 }
4a6ad700cded Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents: 448
diff changeset
1032 ),
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
1033 tag => 'av',
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
1034 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1035 file { "${spamassassin_dir}local.cf":
163
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
1036 ensure => present,
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
1037 source => 'puppet:///private/postfix/spamassassin-local.cf',
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
1038 tag => 'av',
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
1039 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1040 file { "${spamassassin_dir}ole2macro.cf":
142
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1041 ensure => present,
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1042 source => 'puppet:///common/ole2macro.cf',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1043 tag => 'av',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1044 }
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1045 file { "${spamassassin_dir}ole2macro.pm":
142
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1046 ensure => present,
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1047 source => 'puppet:///common/spamassassin-vba-macro-master/ole2macro.pm',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1048 tag => 'av',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
1049 }
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
1050 Package<| tag == 'av' |> -> File<| tag == 'av' |>
87
6be21a984126 Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents: 86
diff changeset
1051 File<| tag == 'av' |> {
390
df5ad1612af7 Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 385
diff changeset
1052 notify => Service[$amavis_service],
87
6be21a984126 Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents: 86
diff changeset
1053 }
125
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
1054 cron { 'Postwhite':
129
16a931df5fd7 Filter what we see in Postwhite cron output
IBBoard <dev@ibboard.co.uk>
parents: 128
diff changeset
1055 command => "/usr/local/bin/postwhite 2>&1| grep -vE '^(Starting|Recursively|Getting|Querying|Removing|Sorting|$)'",
125
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
1056 user => 'root',
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
1057 weekday => 0,
128
379089631403 Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents: 126
diff changeset
1058 hour => 2,
379089631403 Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents: 126
diff changeset
1059 minute => 0,
125
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
1060 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1061 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1062
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1063 class cronjobs {
447
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
1064 package { 'cron':
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
1065 ensure => installed,
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
1066 name => $operatingsystem == 'Ubuntu' ? { true => 'cron', default => 'cronie' }
1a9de0661666 Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents: 446
diff changeset
1067 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1068 # Add Mutt for scripts that send emails, but stop it clogging the disk by keeping copies of emails
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1069 package { 'mutt':
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
1070 ensure => installed,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1071 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1072 file { '/etc/Muttrc.local':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1073 content => 'set copy = no',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1074 require => Package['mutt'],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1075 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1076
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1077 # General server-wide cron jobs
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1078 Cron { user => 'root' }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1079 cron { 'backupalldbs':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1080 command => "/usr/local/bin/backupalldbs",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1081 monthday => "*/2",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1082 hour => "4",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1083 minute => "9"
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1084 }
323
002203790815 Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents: 322
diff changeset
1085 # Only run the Great Firewall Against China on IPv4 (since we don't have an IPv6 list
002203790815 Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents: 322
diff changeset
1086 # and the PROXY forwards the IPs to services, but not at the network level)
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1087 cron { 'greatfirewallofchina':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1088 command => '/usr/local/bin/update-great-firewall-of-china',
323
002203790815 Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents: 322
diff changeset
1089 ensure => has_key($facts, 'ipaddress') ? { true => "present", default => "absent" },
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1090 hour => 3,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1091 minute => 30
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1092 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1093 cron { 'permissions':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1094 command => '/usr/local/bin/set-permissions',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1095 hour => 3,
14
534e584f21ce Tweak time on permission setting script so that it is less likely to clash with LoadAVG run every 6 minutes
IBBoard <dev@ibboard.co.uk>
parents: 13
diff changeset
1096 minute => 2
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1097 }
55
ce8eaaca6a34 Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents: 54
diff changeset
1098 # Since we're only managing the local server, use our script that wraps "puppet apply" instead of PuppetMaster
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1099 cron { 'puppet':
268
9f054191b9db Filter new log line from puppet-apply output
IBBoard <dev@ibboard.co.uk>
parents: 267
diff changeset
1100 command => '/usr/local/bin/puppet-apply | grep -v "Compiled catalog for\|Finished catalog run in\|Applied catalog in"',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1101 hour => '*/6',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1102 minute => 5
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1103 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1104 cron { 'purgecaches':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1105 command => "/usr/local/bin/purge-caches",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1106 hour => '4',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1107 minute => '15',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1108 weekday => '1',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1109 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1110 # Notify of uncommitted files
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1111 cron { 'check-mercurial-committed':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1112 command => "/usr/local/bin/check-hg-status",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1113 hour => '4',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1114 minute => '20',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1115 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1116 }
93
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1117 # Notify of available updates
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1118 cron { 'check-yum-updates':
455
a32771c91043 Switch updates available/restart required to script
IBBoard <dev@ibboard.co.uk>
parents: 454
diff changeset
1119 ensure => absent,
a32771c91043 Switch updates available/restart required to script
IBBoard <dev@ibboard.co.uk>
parents: 454
diff changeset
1120 }
a32771c91043 Switch updates available/restart required to script
IBBoard <dev@ibboard.co.uk>
parents: 454
diff changeset
1121 cron { 'check-for-updates':
a32771c91043 Switch updates available/restart required to script
IBBoard <dev@ibboard.co.uk>
parents: 454
diff changeset
1122 command => '/usr/local/bin/check-updates',
93
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1123 hour => '4',
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1124 minute => '30',
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1125 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
1126 }
97
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1127 # And check whether anything needs restarting
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1128 cron { 'check-needs-restarting':
455
a32771c91043 Switch updates available/restart required to script
IBBoard <dev@ibboard.co.uk>
parents: 454
diff changeset
1129 command => '/usr/local/bin/needs-restarting',
97
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1130 hour => '4',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1131 minute => '45',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1132 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
1133 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1134 }