Mercurial > repos > other > Puppet

annotate manifests/templates.pp @ 332:7198cc4397d8

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Remove custom LogWatch scripts There's no point in maintaining them manually when the OS should (in theory) keep the scripts up-to-date with the services We were getting more errors on CentOS 8 for having out of date custom scripts than for having OS-supplied ones
author IBBoard <dev@ibboard.co.uk>
date Sun, 15 Mar 2020 16:51:11 +0000
parents f69e2d197302
children ee4760967d2f
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
32
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
1 # Make sure packages come after their repos
258
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
2 File<| tag == 'repo-config' |> -> YumRepo<| |> -> Package<| |>
32
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
3
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
4 # Make sure all files are in place before starting services
298
61e90445c899 Merge CentOS8 and CentOS7 branches
IBBoard <dev@ibboard.co.uk>
parents: 292 284
diff changeset
5 # FIXME: Title matches are to fix a dependency cycle
61e90445c899 Merge CentOS8 and CentOS7 branches
IBBoard <dev@ibboard.co.uk>
parents: 292 284
diff changeset
6 File<| tag != 'post-service' and title != '/etc/sysconfig/ip6tables' and title != '/etc/sysconfig/iptables' |> -> Service<| |>
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
7
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
8 # Set some shortcut variables
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
9 #$os = $operatingsystem
249
e9323ff8f451 Make EPEL work on multiple versions of CentOS
IBBoard <dev@ibboard.co.uk>
parents: 247
diff changeset
10 $osver = $operatingsystemmajrelease
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
11 $server = ''
32
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
12
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents: 25
diff changeset
13
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
14 class basenode {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
15 include sudo
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
16
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
17 include defaultusers
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
18 include logwatch
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
19
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
20 file { '/etc/puppet/hiera.yaml':
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
21 ensure => present,
264
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
22 content => "
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
23 # Let the system set defaults
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
24 version: 5
ea72ea1f7320 Update Hiera to fix warnings
IBBoard <dev@ibboard.co.uk>
parents: 262
diff changeset
25 ",
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
26 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
27 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
28
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
29 class basevpsnode (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
30 $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
31 $proxy_4to6_ip_prefix = undef,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
32 $proxy_upstream = undef,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
33 $nat64_ranges = [],
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
34 $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
35 $imapserver,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
36 $mailrelays = [],
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
37 $firewall_cmd = 'iptables',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
38 ) {
44
546dfa011f58 Remove "puppet" host name because we don't need it
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
39
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
40 if $firewall_cmd == 'iptables' {
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
41 class { 'vpsfirewall':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
42 fw_protocol => $primary_ip =~ Stdlib::IP::Address::V6 ? { true => 'IPv6', default => 'IPv4'},
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
43 }
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
44 }
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
45
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
46 #VPS is a self-mastered Puppet machine, so bodge a Hosts file
302
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
47 if $primary_ip =~ Stdlib::IP::Address::V6 {
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
48 $lo_ip = '::1'
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
49 } else {
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
50 $lo_ip = '127.0.0.1'
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
51 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
52 file { '/etc/hosts':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
53 ensure => present,
302
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings
IBBoard <dev@ibboard.co.uk>
parents: 301
diff changeset
54 content => "${lo_ip} localhost\n${primary_ip} ${fqdn}",
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
55 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
56
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
57 if $proxy_4to6_ip_prefix != undef {
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
58 # …:1 to …:9 for websites, …:10 for mail
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
59 $ipv6_addresses = Integer[1, 10].map |$octet| { "$proxy_4to6_ip_prefix:$octet" }
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
60
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
61 $ipv6_secondaries = join($ipv6_addresses, " ")
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
62
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
63 augeas {'IPv6 secondary addresses':
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
64 context => "/files/etc/sysconfig/network-scripts/ifcfg-eth0",
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
65 changes => "set IPV6ADDR_SECONDARIES '\"$ipv6_secondaries\"'",
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
66 }
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
67 }
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
68
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
69 require repos
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
70 include basenode
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
71 include privat
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
72 include dnsresolver
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
73 include ssh::server
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
74 include vcs::server
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
75 include vcs::client
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
76 class { 'webserver':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
77 primary_ip => $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
78 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
79 proxy_4to6_mask => 124,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
80 proxy_upstream => $proxy_upstream,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
81 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
82 include cronjobs
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
83 include logrotate
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
84 class { 'fail2ban':
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
85 firewall_cmd => $firewall_cmd,
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
86 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
87 include tools
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
88 class { 'email':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
89 mailserver => $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
90 imapserver => $imapserver,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
91 mailserver_ip => $primary_ip,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
92 proxy_ip => $proxy_4to6_ip_prefix != undef ? { true => "${proxy_4to6_ip_prefix}:10", default => undef },
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
93 proxy_upstream => $proxy_upstream,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
94 nat64_ranges => $nat64_ranges,
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
95 mailrelays => $mailrelays,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
96 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
97 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
98
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
99 ## Classes to allow facet behaviour using preconfigured setups of classes
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
100
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
101 class vpsfirewall ($fw_protocol) {
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
102 resources { "firewall":
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
103 purge => false,
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
104 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
105 class { "my_fw":
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
106 ip_version => $fw_protocol,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
107 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
108 # Control what does and doesn't get pruned in the main filter chain
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
109 firewallchain { "INPUT:filter:$fw_protocol":
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
110 purge => true,
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
111 ignore => [
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
112 '-j f2b-[^ ]+$',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
113 '^(:|-A )f2b-',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
114 '--comment "Great Firewall of China"',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
115 '--comment "Do not purge',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
116 ],
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
117 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
118 if ($fw_protocol != "IPv6") {
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
119 firewall { '010 Whitelist Googlebot':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
120 source => '66.249.64.0/19',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
121 dport => [80,443],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
122 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
123 action => accept,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
124 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
125 # Block a spammer hitting our contact forms (also on StopForumSpam list A LOT)
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
126 firewall { '099 Blacklist spammers 1':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
127 source => '107.181.78.172',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
128 dport => [80, 443],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
129 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
130 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
131 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
132 firewall { '099 Blacklist IODC bot':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
133 # IODC bot makes too many bad requests, and contact form is broken
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
134 # They don't publish a robots.txt name, so firewall it!
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
135 source => '86.153.145.149',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
136 dport => [ 80, 443 ],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
137 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
138 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
139 }
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
140 firewall { '099 Blacklist Baidu Brazil':
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
141 #Baidu got a Brazilian netblock and are hitting us hard
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
142 #Baidu doesn't honour "crawl-delay" in robots.txt
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
143 #Baidu gets firewalled
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
144 source => '131.161.8.0/22',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
145 dport => [ 80, 443 ],
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
146 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
147 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
148 }
139
abaf384dc939 Block another annoying IP with a firewall rule
IBBoard <dev@ibboard.co.uk>
parents: 137
diff changeset
149 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
150 firewallchain { "GREATFIREWALLOFCHINA:filter:$fw_protocol":
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
151 ensure => present,
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
152 }
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
153 firewall { '050 Check our Great Firewall Against China':
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
154 chain => 'INPUT',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
155 jump => 'GREATFIREWALLOFCHINA',
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
156 }
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
157 firewallchain { "Fail2Ban:filter:$fw_protocol":
64
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
158 ensure => present,
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
159 }
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
160 firewall { '060 Check Fail2Ban':
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
161 chain => 'INPUT',
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
162 jump => 'Fail2Ban',
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents: 61
diff changeset
163 }
40
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
164 }
222904296578 Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents: 38
diff changeset
165
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
166 class dnsresolver {
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
167 package { 'unbound':
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
168 ensure => present,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
169 }
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
170 package { 'named':
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
171 ensure => absent,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
172 }
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
173
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
174 service { 'named':
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
175 ensure => stopped,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
176 enable => false,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
177 }
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
178 service { 'unbound':
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
179 ensure => running,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
180 enable => true,
194
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
181 }
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
182
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
183 file { '/etc/named.conf':
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
184 ensure => absent,
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
185 }
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
186 file { '/etc/unbound/unbound.conf':
194
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
187 ensure => present,
247
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
188 source => [
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
189 "puppet:///common/unbound.conf-${::hostname}",
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
190 "puppet:///common/unbound.conf",
247
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
191 ],
194
a08de3153548 Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents: 193
diff changeset
192 group => 'named',
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
193 require => Package['unbound'],
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
194 notify => Service['unbound'],
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
195 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
196
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
197 file { '/etc/NetworkManager/conf.d/local-dns-resolver.conf':
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
198 ensure => present,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
199 content => "[main]
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
200 dns=none",
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
201 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
202
101
a48b6011a084 Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents: 100
diff changeset
203 file { '/etc/sysconfig/named':
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
204 ensure => absent,
101
a48b6011a084 Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents: 100
diff changeset
205 }
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
206 file { '/etc/resolv.conf':
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
207 ensure => present,
301
1bfc290270cc Fix sa-update by using IPv6 for local DNS cache
IBBoard <dev@ibboard.co.uk>
parents: 298
diff changeset
208 # "ipaddress" key only exists for machines with IPv4 addresses
1bfc290270cc Fix sa-update by using IPv6 for local DNS cache
IBBoard <dev@ibboard.co.uk>
parents: 298
diff changeset
209 content => has_key($facts, 'ipaddress') ? { true => "nameserver 127.0.0.1", default => "nameserver ::1" },
290
1182a180085d Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
210 require => Service['unbound'],
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
211 tag => 'post-service',
100
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
212 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents: 99
diff changeset
213 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
214
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
215 class repos {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
216 yumrepo { 'epel':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
217 mirrorlist => 'https://mirrors.fedoraproject.org/metalink?repo=epel-$releasever&arch=$basearch',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
218 descr => "Extra Packages for Enterprise Linux",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
219 enabled => 1,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
220 failovermethod => 'priority',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
221 gpgcheck => 1,
249
e9323ff8f451 Make EPEL work on multiple versions of CentOS
IBBoard <dev@ibboard.co.uk>
parents: 247
diff changeset
222 gpgkey => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver",
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
223 }
249
e9323ff8f451 Make EPEL work on multiple versions of CentOS
IBBoard <dev@ibboard.co.uk>
parents: 247
diff changeset
224 file { "/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver":
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
225 ensure => present,
258
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
226 source => "puppet:///common/RPM-GPG-KEY-EPEL-$osver",
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
227 tag => 'repo-config',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
228 }
258
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
229 yumrepo { 'ibboard':
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
230 baseurl => 'https://download.opensuse.org/repositories/home:/IBBoard:/server/CentOS_$releasever/',
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
231 descr => 'Extra packages from IBBoard',
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
232 enabled => 1,
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
233 gpgcheck => 1,
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
234 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard',
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
235 }
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
236 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard':
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
237 ensure => present,
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
238 source => 'puppet:///common/RPM-GPG-KEY-ibboard',
b173842cabbf Update repo handling
IBBoard <dev@ibboard.co.uk>
parents: 250
diff changeset
239 tag => 'repo-config',
160
0d829df9cd39 Make the IBBoard repo config go away, rather than just leaving it undefined
IBBoard <dev@ibboard.co.uk>
parents: 159
diff changeset
240 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
241 yumrepo { 'webtatic':
238
6467e768e353 Switch to PHP 7.4 from Remi
IBBoard <dev@ibboard.co.uk>
parents: 236
diff changeset
242 ensure => absent,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
243 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
244 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-andy':
108
5c6edfab92d6 Swap Webtatic to new GPG key
IBBoard <dev@ibboard.co.uk>
parents: 103
diff changeset
245 ensure => absent,
5c6edfab92d6 Swap Webtatic to new GPG key
IBBoard <dev@ibboard.co.uk>
parents: 103
diff changeset
246 }
5c6edfab92d6 Swap Webtatic to new GPG key
IBBoard <dev@ibboard.co.uk>
parents: 103
diff changeset
247 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-el7':
238
6467e768e353 Switch to PHP 7.4 from Remi
IBBoard <dev@ibboard.co.uk>
parents: 236
diff changeset
248 ensure => absent,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
249 }
148
d9fcabc75a1e Fix pip installations
IBBoard <dev@ibboard.co.uk>
parents: 147
diff changeset
250
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
251 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 {
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
252 $python_ver = 'python3'
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
253 } else {
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
254 $python_ver = 'system'
148
d9fcabc75a1e Fix pip installations
IBBoard <dev@ibboard.co.uk>
parents: 147
diff changeset
255 }
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
256
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
257 class { 'python':
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
258 ensure => 'present',
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
259 version => $python_ver,
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
260 pip => 'present',
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
261 virtualenv => 'present',
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
262 use_epel => false,
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
263 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
264 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
265
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
266 class tools {
330
0cccb75d7639 Add rsync to tools so that backups work
IBBoard <dev@ibboard.co.uk>
parents: 326
diff changeset
267 $packages = [ 'sqlite', 'bash-completion', 'nano', 'bzip2', 'mlocate', 'patch', 'tmux', 'wget', 'yum-utils', 'rsync' ]
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
268 package { $packages:
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
269 ensure => installed;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
270 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
271 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
272
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
273 class logrotate {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
274 package { 'logrotate':
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
275 ensure => installed;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
276 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
277 file { '/etc/logrotate.d/httpd':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
278 ensure => present,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
279 source => 'puppet:///common/logrotate-httpd',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
280 require => Package['logrotate'],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
281 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
282 file { '/etc/logrotate.d/trac':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
283 ensure => present,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
284 source => 'puppet:///common/logrotate-trac',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
285 require => Package['logrotate'],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
286 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
287 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
288
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
289 class logwatch {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
290 package { 'logwatch':
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
291 ensure => installed;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
292 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
293 File {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
294 ensure => present,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
295 require => Package['logwatch'],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
296 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
297 file { '/etc/cron.daily/0logwatch':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
298 source => 'puppet:///common/0logwatch';
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
299 }
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
300 $logwatch_dirs = [
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
301 '/etc/logwatch/',
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
302 '/etc/logwatch/conf/',
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
303 '/etc/logwatch/conf/logfiles/',
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
304 '/etc/logwatch/conf/services/',
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
305 ]
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
306 file { $logwatch_dirs:
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
307 ensure => directory,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
308 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
309 file { '/etc/logwatch/conf/logwatch.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
310 content => 'Detail = Med',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
311 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
312 file { '/etc/logwatch/conf/logfiles/http.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
313 content => 'LogFile = apache/access_*.log',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
314 }
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
315 file { '/etc/logwatch/conf/logfiles/http-error.conf':
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
316 source => 'puppet:///common/logwatch/logfiles_http-error.conf',
126
8316d4e55e92 Fix Apache 2.4 Logwatch support
IBBoard <dev@ibboard.co.uk>
parents: 125
diff changeset
317 }
332
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
318 file { '/etc/logwatch/conf/logfiles/mysql.conf':
7198cc4397d8 Remove custom LogWatch scripts
IBBoard <dev@ibboard.co.uk>
parents: 331
diff changeset
319 source => 'puppet:///common/logwatch/logfiles_mysql.conf',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
320 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
321 file { '/etc/logwatch/conf/logfiles/php.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
322 source => 'puppet:///common/logwatch/logfiles_php.conf',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
323 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
324 file { '/etc/logwatch/conf/services/php.conf':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
325 source => 'puppet:///common/logwatch/services_php.conf',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
326 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
327 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
328
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
329 #Our web server with our configs, not just a stock one
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
330 class webserver (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
331 $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
332 $proxy_4to6_ip_prefix = undef,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
333 $proxy_4to6_mask = undef,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
334 $proxy_upstream = undef,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
335 ) {
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
336
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
337 #Setup base website parameters
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
338 class { 'website':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
339 base_dir => '/srv/sites',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
340 primary_ip => $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
341 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
342 proxy_4to6_mask => $proxy_4to6_mask,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
343 proxy_upstream => $proxy_upstream,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
344 default_owner => $defaultusers::default_user,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
345 default_group => $defaultusers::default_user,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
346 default_tld => 'co.uk',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
347 default_extra_tlds => [ 'com' ],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
348 }
110
be2b30b17a4c Switch to PHP 7 from Webtatic
IBBoard <dev@ibboard.co.uk>
parents: 108
diff changeset
349
241
1901eea3befe Downgrade to PHP7.3
IBBoard <dev@ibboard.co.uk>
parents: 239
diff changeset
350 # Use Remi's PHP 7.3 for now - 7.4 is still VERY new
238
6467e768e353 Switch to PHP 7.4 from Remi
IBBoard <dev@ibboard.co.uk>
parents: 236
diff changeset
351 $php_suffix = ''
247
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
352 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 {
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
353 yumrepo { 'remirepo-safe':
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
354 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/$basearch/mirror',
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
355 descr => "Extra CentOS packages from Remi",
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
356 enabled => 1,
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
357 failovermethod => 'priority',
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
358 gpgcheck => 1,
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
359 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
360 }
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
361 yumrepo { 'remirepo-php':
320
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
362 mirrorlist => 'http://cdn.remirepo.net/enterprise/8/modular/$basearch/mirror',
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
363 descr => 'Remi\'s Modular repository for Enterprise Linux 8 - $basearch',
247
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
364 enabled => 1,
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
365 failovermethod => 'priority',
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
366 gpgcheck => 1,
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
367 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
368 }
320
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
369 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi':
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
370 ensure => present,
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
371 source => 'puppet:///common/RPM-GPG-KEY-remi.el8',
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
372 tag => 'repo-config',
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
373 }
247
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
374 } else {
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
375 yumrepo { 'remirepo-safe':
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
376 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/mirror',
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
377 descr => "Extra CentOS packages from Remi",
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
378 enabled => 1,
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
379 failovermethod => 'priority',
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
380 gpgcheck => 1,
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
381 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
382 }
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
383 yumrepo { 'remirepo-php':
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
384 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/php73/mirror',
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
385 descr => "PHP7.3 for CentOS from Remi",
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
386 enabled => 1,
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
387 failovermethod => 'priority',
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
388 gpgcheck => 1,
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
389 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
308f69ca988c Add config for new server
IBBoard <dev@ibboard.co.uk>
parents: 246
diff changeset
390 }
320
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
391 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi':
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
392 ensure => present,
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
393 source => 'puppet:///common/RPM-GPG-KEY-remi',
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
394 tag => 'repo-config',
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
395 }
238
6467e768e353 Switch to PHP 7.4 from Remi
IBBoard <dev@ibboard.co.uk>
parents: 236
diff changeset
396 }
110
be2b30b17a4c Switch to PHP 7 from Webtatic
IBBoard <dev@ibboard.co.uk>
parents: 108
diff changeset
397
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
398 #Configure the PHP version to use
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
399 class { 'website::php':
110
be2b30b17a4c Switch to PHP 7 from Webtatic
IBBoard <dev@ibboard.co.uk>
parents: 108
diff changeset
400 suffix => $php_suffix,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
401 opcache => 'opcache',
320
99e3ca448d55 Fix Remi PHP on CentOS 8
IBBoard <dev@ibboard.co.uk>
parents: 317
diff changeset
402 module => ($operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0) ? { true => 'remi-7.3', default => undef },
322
06a401d3ef45 Add PHP JSON package, which phpMyAdmin requires
IBBoard <dev@ibboard.co.uk>
parents: 320
diff changeset
403 extras => [ 'process', 'intl', 'pecl-imagick', 'bcmath', 'pecl-zip', 'json' ],
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
404 }
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
405
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
406 #Setup MySQL, using (private) templates to make sure that we set non-std passwords and a default user
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
407
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
408 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '7') >= 0 {
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
409 $mysqlpackage = 'mariadb'
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
410 $mysqlsuffix = ''
48
5cdc1c96c477 Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents: 45
diff changeset
411
261
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
412 # Required for SELinux rule setting/status checks
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
413 if versioncmp($operatingsystemrelease, '8') >= 0 {
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
414 $semanage_package_name = 'policycoreutils-python-utils'
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
415 } else {
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
416 $semanage_package_name = 'policycoreutils-python'
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
417 }
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
418
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
419 package { 'policycoreutils-python':
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
420 name => $semanage_package_name,
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
421 ensure => present,
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
422 }
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
423
74
c2e5027202e2 Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents: 72
diff changeset
424 $extra_packages = [
78
cbe27a97bcd1 Fix typo (missing single quote)
IBBoard <dev@ibboard.co.uk>
parents: 77
diff changeset
425 'perl-Sys-Syslog', #Required for Perl SPF checking
74
c2e5027202e2 Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents: 72
diff changeset
426 ]
c2e5027202e2 Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents: 72
diff changeset
427
c2e5027202e2 Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents: 72
diff changeset
428 package { $extra_packages:
c2e5027202e2 Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents: 72
diff changeset
429 ensure => installed
c2e5027202e2 Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents: 72
diff changeset
430 }
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
431 }
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
432 else {
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
433 $mysqlpackage = 'mysql'
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
434 $mysqlsuffix = '55w'
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
435 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
436 class { 'website::mysql':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
437 mysqluser => template('defaultusers/mysql-user'),
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
438 mysqlpassword => template('defaultusers/mysql-password'),
24
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
439 mysqlprefix => $mysqlpackage,
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents: 18
diff changeset
440 mysqlsuffix => $mysqlsuffix,
110
be2b30b17a4c Switch to PHP 7 from Webtatic
IBBoard <dev@ibboard.co.uk>
parents: 108
diff changeset
441 phpsuffix => $php_suffix,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
442 phpmysqlsuffix => 'nd'
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
443 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
444 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
445
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
446 class ibboardvpsnode (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
447 $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
448 $proxy_4to6_ip_prefix = undef,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
449 $proxy_upstream = undef,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
450 $nat64_ranges = [],
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
451 $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
452 $imapserver,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
453 $mailrelays = [],
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
454 $firewall_cmd = 'iptables',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
455 ){
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
456 class { 'basevpsnode':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
457 primary_ip => $primary_ip,
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
458 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
279
e36b7f4f85f2 Start to support IPv6 servers
IBBoard <dev@ibboard.co.uk>
parents: 276
diff changeset
459 proxy_upstream => $proxy_upstream,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
460 nat64_ranges => $nat64_ranges,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
461 mailserver => $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
462 imapserver => $imapserver,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
463 mailrelays => $mailrelays,
35
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents: 32
diff changeset
464 firewall_cmd => $firewall_cmd,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
465 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
466
267
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
467 # Set timezone to something sensible
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
468 file { "/etc/localtime":
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
469 ensure => 'link',
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
470 target => '/usr/share/zoneinfo/Europe/London',
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
471 }
edeedd13262c Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents: 266
diff changeset
472
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
473 # Common modules used by multiple sites (mod_auth_basic is safe because we HTTPS all the things)
146
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
474 $mods = [ 'auth_basic',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
475 'authn_file',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
476 'authz_user',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
477 'deflate',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
478 'xsendfile'
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
479 ]
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
480 apache::mod {
146
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents: 145
diff changeset
481 $mods:;
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
482 }
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
483 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '7') >= 0 {
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
484 apache::mod {
25
13adb555a7e2 Use "<IfVersion>" to handle auth differences between 2.2 and 2.4
IBBoard <dev@ibboard.co.uk>
parents: 24
diff changeset
485 'authn_core':;
13adb555a7e2 Use "<IfVersion>" to handle auth differences between 2.2 and 2.4
IBBoard <dev@ibboard.co.uk>
parents: 24
diff changeset
486 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
487 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
488
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
489 #Configure our sites, using templates for the custom fragments where the extra content is too long
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
490 class { "devsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
491 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:01", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
492 }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
493 class { "adminsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
494 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:02", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
495 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
496 website::https::multitld { 'www.ibboard':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
497 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
498 custom_fragment => template("privat/apache/ibboard.fragment"),
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
499 letsencrypt_name => 'ibboard.co.uk',
236
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
500 csp_override => {
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
501 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
502 "default-src" => "'none'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
503 "img-src" => "'self' https://live.staticflickr.com/",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
504 "script-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
505 "style-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
506 "font-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
507 "form-action" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
508 "connect-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
509 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
510 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
511 class { "hiveworldterrasite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
512 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:04", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
513 }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
514 class { "bdstrikesite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
515 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:05", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
516 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
517 website::https::multitld { 'www.abiknight':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
518 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:06", default => undef },
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
519 custom_fragment => "$website::htmlphpfragment
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
520 ErrorDocument 404 /error.php",
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
521 letsencrypt_name => 'abiknight.co.uk',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
522 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
523 website::https::multitld { 'www.warfoundry':
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
524 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:07", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
525 letsencrypt_name => 'warfoundry.co.uk',
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
526 custom_fragment => template("privat/apache/warfoundry.fragment"),
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
527 }
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
528 class { "webmailpimsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
529 proxy_4to6_ip_pim => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:08", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
530 proxy_4to6_ip_webmail => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:09", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
531 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
532 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
533
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
534 class adminsite ($proxy_4to6_ip) {
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
535 apache::mod { 'info':; 'status':; 'cgi':; }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
536 website::https::multitld { 'admin.ibboard':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
537 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
538 force_no_index => false,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
539 ssl_ca_chain => '',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
540 custom_fragment => template("privat/apache/admin.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
541 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
542 cron { 'loadavg':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
543 command => '/usr/local/bin/run-loadavg-logger',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
544 user => apache,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
545 minute => '*/6'
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
546 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
547 cron { 'awstats':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
548 command => '/usr/local/bin/update-awstats > /srv/sites/admin/awstats.log',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
549 user => apache,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
550 hour => '*/6',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
551 minute => '0'
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
552 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
553 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
554
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
555 class hiveworldterrasite ($proxy_4to6_ip) {
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
556 website::https::multitld { 'www.hiveworldterra':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
557 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
558 force_no_www => false,
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
559 letsencrypt_name => 'hiveworldterra.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
560 custom_fragment => template("privat/apache/hwt.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
561 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
562 website::https::multitld { 'forums.hiveworldterra':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
563 proxy_4to6_ip => $proxy_4to6_ip,
331
f69e2d197302 Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents: 330
diff changeset
564 letsencrypt_name => 'forums.hiveworldterra.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
565 custom_fragment => template("privat/apache/forums.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
566 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
567 website::https::multitld { 'skins.hiveworldterra':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
568 proxy_4to6_ip => $proxy_4to6_ip,
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
569 letsencrypt_name => 'hiveworldterra.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
570 custom_fragment => template("privat/apache/skins.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
571 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
572 website::https::redir { 'hiveworldterra.ibboard.co.uk':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
573 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
574 redir => 'https://www.hiveworldterra.co.uk/',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
575 docroot => "${website::basedir}/hiveworldterra",
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
576 letsencrypt_name => 'hiveworldterra.co.uk',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
577 separate_log => true,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
578 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
579 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
580 class bdstrikesite ($proxy_4to6_ip) {
331
f69e2d197302 Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents: 330
diff changeset
581 website::https::multitld { 'www.bdstrike':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
582 proxy_4to6_ip => $proxy_4to6_ip,
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
583 docroot_owner => $defaultusers::secondary_user,
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
584 docroot_group => 'editors',
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
585 letsencrypt_name => 'bdstrike.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
586 custom_fragment => template("privat/apache/bdstrike.fragment"),
236
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
587 csp_override => {"frame-ancestors" => "'self'"},
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
588 csp_report_override => {
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
589 "font-src" => "'self' https://fonts.gstatic.com/",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
590 "img-src" => "'self' https://secure.gravatar.com/",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
591 "style-src" => "'self' https://fonts.googleapis.com/"
4519b727cc4c Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents: 235
diff changeset
592 },
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
593 }
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
594 $aliases = [
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
595 'strikecreations.co.uk',
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
596 'strikecreations.com',
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
597 'www.strikecreations.com' ]
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
598
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
599 website::https::redir { 'www.strikecreations.co.uk':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
600 proxy_4to6_ip => $proxy_4to6_ip,
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
601 redir => 'https://bdstrike.co.uk/',
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
602 serveraliases => $aliases,
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
603 docroot => "${website::basedir}/bdstrike",
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
604 docroot_owner => $defaultusers::secondary_user,
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
605 docroot_group => 'editors',
331
f69e2d197302 Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents: 330
diff changeset
606 letsencrypt_name => 'strikecreations.com',
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
607 separate_log => true,
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
608 }
235
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
609 cron { 'wordpress_cron':
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
610 # Run "php -f wp-cron.php" on a schedule so that we can auto-update
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
611 # without giving Apache full write access!
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
612 command => "/usr/local/bin/bdstrike-cron",
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
613 user => $defaultusers::default_user,
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
614 minute => '*/15',
e602c5f974ac Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents: 200
diff changeset
615 }
145
88f38ef7359f Add BDStrike domains
IBBoard <dev@ibboard.co.uk>
parents: 142
diff changeset
616 }
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
617 class devsite ($proxy_4to6_ip) {
261
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
618 if versioncmp($operatingsystemrelease, '8') >= 0 {
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
619 # Apache::Mod doesn't map this correctly for CentOS 8 yet
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
620 $mod_wsgi_lib = 'mod_wsgi_python3.so'
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
621 } else {
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
622 $mod_wsgi_lib = undef
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
623 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
624 apache::mod {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
625 # mod_wsgi for Python support
261
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
626 'wsgi':
c3ecb1e58713 Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents: 258
diff changeset
627 lib => $mod_wsgi_lib,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
628 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
629
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
630 # Create Python virtualenvs for the dev site apps
272
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
631 file {
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
632 "/srv/rhodecode":
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
633 ensure => 'directory';
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
634 "/srv/trac":
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
635 ensure => 'directory';
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
636 } ->
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
637 python::virtualenv {
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
638 # Distribute is described as "simple compatibility layer that installs Setuptools 0.7+"
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
639 # and leads to 'module "importlib._bootstrap" has no attribute "SourceFileLoader"'
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
640 "/srv/rhodecode/virtualenv":
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
641 distribute => false,
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
642 version => '3';
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
643 "/srv/trac/virtualenv":
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
644 distribute => false,
c42fb28cff86 Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents: 271
diff changeset
645 version => '3';
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
646 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
647
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
648 # Graphviz for Trac "master ticket" graphs
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
649 package { 'graphviz':
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
650 ensure => installed,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
651 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
652
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
653 website::https::multitld { 'dev.ibboard':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
654 proxy_4to6_ip => $proxy_4to6_ip,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
655 #Make sure we're the first one hit for the tiny fraction of "no support" cases we care about (potentially Python for Mercurial!)
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
656 # http://en.wikipedia.org/wiki/Server_Name_Indication#No_support
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
657 priority => 1,
157
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents: 154
diff changeset
658 letsencrypt_name => 'dev.ibboard.co.uk',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
659 custom_fragment => template("privat/apache/dev.fragment"),
281
af7df930a670 Add 4-to-6 proxy and mod_remoteip setup
IBBoard <dev@ibboard.co.uk>
parents: 279
diff changeset
660 proxy_fragment => template("privat/apache/dev-proxy.fragment"),
52
be1e9773a12c Mercurial repo versions index.php files etc, so removing index.php breaks things!
IBBoard <dev@ibboard.co.uk>
parents: 44
diff changeset
661 force_no_index => false,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
662 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
663 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
664
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
665 class webmailpimsite ($proxy_4to6_ip_pim, $proxy_4to6_ip_webmail) {
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
666 # Webmail and Personal Information Management (PIM) sites
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
667 website::https { 'webmail.ibboard.co.uk':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
668 proxy_4to6_ip => $proxy_4to6_ip_webmail,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
669 force_no_index => false,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
670 ssl_ca_chain => '',
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
671 custom_fragment => template("privat/apache/webmail.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
672 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
673 website::https { 'pim.ibboard.co.uk':
284
9431aec4d998 Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents: 281
diff changeset
674 proxy_4to6_ip => $proxy_4to6_ip_pim,
242
7d8e664ebcc9 Change owner/group on Nextcloud for easy upgrade
IBBoard <dev@ibboard.co.uk>
parents: 241
diff changeset
675 docroot_owner => 'apache',
7d8e664ebcc9 Change owner/group on Nextcloud for easy upgrade
IBBoard <dev@ibboard.co.uk>
parents: 241
diff changeset
676 docroot_group => 'editors',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
677 force_no_index => false,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
678 lockdown_requests => false,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
679 ssl_ca_chain => '',
265
bf2b8912c414 Make PIM site skip CSP headers - NextCloud manages them
IBBoard <dev@ibboard.co.uk>
parents: 264
diff changeset
680 csp => false,
bf2b8912c414 Make PIM site skip CSP headers - NextCloud manages them
IBBoard <dev@ibboard.co.uk>
parents: 264
diff changeset
681 csp_report => false,
246
c3fa3d65aa83 Update configs for Puppet 6
IBBoard <dev@ibboard.co.uk>
parents: 242
diff changeset
682 custom_fragment => template("privat/apache/pim.fragment"),
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
683 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
684 cron { 'owncloudcron':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
685 command => "/usr/local/bin/owncloud-cron",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
686 user => 'apache',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
687 minute => '*/15',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
688 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
689 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
690
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
691 class email (
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
692 $mailserver,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
693 $imapserver,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
694 $mailserver_ip,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
695 $proxy_ip = undef,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
696 $proxy_upstream = [],
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
697 $nat64_ranges = [],
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
698 $mailrelays = [],
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
699 ){
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
700 class { 'postfix':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
701 mailserver => $mailserver,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
702 mailserver_ip => $mailserver_ip,
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
703 mailserver_proxy => $proxy_ip,
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
704 proxy_upstream => $proxy_upstream,
326
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
705 mailrelays => $mailrelays,
63e0b5149cfb Add fallback relays to Postfix
IBBoard <dev@ibboard.co.uk>
parents: 323
diff changeset
706 nat64_ranges => $nat64_ranges,
317
2a20a5b7f65a Swap IPv6 Postfix to "all" protocols to support PROXY
IBBoard <dev@ibboard.co.uk>
parents: 313
diff changeset
707 protocols => $mailserver_ip =~ Stdlib::IP::Address::V6 ? { true => 'all', default => 'ipv4' },
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
708 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
709 class { 'dovecot':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
710 imapserver => $imapserver,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
711 imapserver_ip => $mailserver_ip,
313
49e66019faf7 Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents: 311
diff changeset
712 imapserver_proxy => $proxy_ip,
311
51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents: 310
diff changeset
713 proxy_upstream => $proxy_upstream,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
714 }
177
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
715 # Unspecified SpamAssassin config dependencies that started
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
716 # showing up as errors in our logs
276
165ad12ea8ca Remove Perl LZMA module because it's in beta
IBBoard <dev@ibboard.co.uk>
parents: 274
diff changeset
717 package { ['perl-File-MimeInfo']:
177
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
718 ensure => installed,
1b605c38b375 Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents: 176
diff changeset
719 }
140
6eef7cec8658 Remove ClamAV from server config
IBBoard <dev@ibboard.co.uk>
parents: 139
diff changeset
720 package { [ 'amavisd-new' ]:
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
721 ensure => installed,
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
722 tag => 'av',
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
723 }
86
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents: 85
diff changeset
724 service { 'amavisd':
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents: 85
diff changeset
725 ensure => 'running',
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents: 85
diff changeset
726 enable => 'true',
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents: 85
diff changeset
727 }
270
481acc395876 Mask "clamav@amavisd" service to save memory
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
728 service { 'clamd@amavisd':
481acc395876 Mask "clamav@amavisd" service to save memory
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
729 ensure => 'stopped',
481acc395876 Mask "clamav@amavisd" service to save memory
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
730 enable=> 'mask',
481acc395876 Mask "clamav@amavisd" service to save memory
IBBoard <dev@ibboard.co.uk>
parents: 268
diff changeset
731 }
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
732 file { '/etc/amavisd/amavisd.conf':
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
733 ensure => present,
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
734 source => 'puppet:///private/postfix/amavisd.conf',
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
735 tag => 'av',
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
736 }
163
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
737 file { '/etc/mail/spamassassin/local.cf':
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
738 ensure => present,
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
739 source => 'puppet:///private/postfix/spamassassin-local.cf',
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
740 tag => 'av',
4e53d77fa586 Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents: 162
diff changeset
741 }
142
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
742 file { '/etc/mail/spamassassin/ole2macro.cf':
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
743 ensure => present,
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
744 source => 'puppet:///common/ole2macro.cf',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
745 tag => 'av',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
746 }
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
747 file { '/etc/mail/spamassassin/ole2macro.pm':
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
748 ensure => present,
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
749 source => 'puppet:///common/spamassassin-vba-macro-master/ole2macro.pm',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
750 tag => 'av',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents: 141
diff changeset
751 }
85
50dd78dbf3db Fight back against spam
IBBoard <dev@ibboard.co.uk>
parents: 83
diff changeset
752 Package<| tag == 'av' |> -> File<| tag == 'av' |>
87
6be21a984126 Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents: 86
diff changeset
753 File<| tag == 'av' |> {
6be21a984126 Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents: 86
diff changeset
754 notify => Service['amavisd'],
6be21a984126 Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents: 86
diff changeset
755 }
125
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
756 cron { 'Postwhite':
129
16a931df5fd7 Filter what we see in Postwhite cron output
IBBoard <dev@ibboard.co.uk>
parents: 128
diff changeset
757 command => "/usr/local/bin/postwhite 2>&1| grep -vE '^(Starting|Recursively|Getting|Querying|Removing|Sorting|$)'",
125
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
758 user => 'root',
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
759 weekday => 0,
128
379089631403 Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents: 126
diff changeset
760 hour => 2,
379089631403 Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents: 126
diff changeset
761 minute => 0,
125
ca711ab45f17 Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents: 122
diff changeset
762 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
763 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
764
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
765 class cronjobs {
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
766 # Add Mutt for scripts that send emails, but stop it clogging the disk by keeping copies of emails
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
767 package { 'mutt':
131
0dd899a10ee1 Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents: 129
diff changeset
768 ensure => installed,
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
769 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
770 file { '/etc/Muttrc.local':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
771 content => 'set copy = no',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
772 require => Package['mutt'],
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
773 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
774
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
775 # General server-wide cron jobs
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
776 Cron { user => 'root' }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
777 cron { 'backupalldbs':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
778 command => "/usr/local/bin/backupalldbs",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
779 monthday => "*/2",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
780 hour => "4",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
781 minute => "9"
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
782 }
323
002203790815 Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents: 322
diff changeset
783 # Only run the Great Firewall Against China on IPv4 (since we don't have an IPv6 list
002203790815 Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents: 322
diff changeset
784 # and the PROXY forwards the IPs to services, but not at the network level)
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
785 cron { 'greatfirewallofchina':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
786 command => '/usr/local/bin/update-great-firewall-of-china',
323
002203790815 Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents: 322
diff changeset
787 ensure => has_key($facts, 'ipaddress') ? { true => "present", default => "absent" },
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
788 hour => 3,
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
789 minute => 30
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
790 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
791 cron { 'permissions':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
792 command => '/usr/local/bin/set-permissions',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
793 hour => 3,
14
534e584f21ce Tweak time on permission setting script so that it is less likely to clash with LoadAVG run every 6 minutes
IBBoard <dev@ibboard.co.uk>
parents: 13
diff changeset
794 minute => 2
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
795 }
55
ce8eaaca6a34 Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents: 54
diff changeset
796 # Since we're only managing the local server, use our script that wraps "puppet apply" instead of PuppetMaster
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
797 cron { 'puppet':
268
9f054191b9db Filter new log line from puppet-apply output
IBBoard <dev@ibboard.co.uk>
parents: 267
diff changeset
798 command => '/usr/local/bin/puppet-apply | grep -v "Compiled catalog for\|Finished catalog run in\|Applied catalog in"',
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
799 hour => '*/6',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
800 minute => 5
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
801 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
802 cron { 'purgecaches':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
803 command => "/usr/local/bin/purge-caches",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
804 hour => '4',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
805 minute => '15',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
806 weekday => '1',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
807 }
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
808 # Notify of uncommitted files
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
809 cron { 'check-mercurial-committed':
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
810 command => "/usr/local/bin/check-hg-status",
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
811 hour => '4',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
812 minute => '20',
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
813 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
814 }
93
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
815 # Notify of available updates
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
816 cron { 'check-yum-updates':
309
7fa5e230fc94 Fix type in Yum update checking
IBBoard <dev@ibboard.co.uk>
parents: 302
diff changeset
817 command => '/usr/bin/yum check-update | tail -2 | grep -Ev "^ \* [[:alnum:]-]+: [[:alnum:]\.]+$"',
93
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
818 hour => '4',
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
819 minute => '30',
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
820 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
74678cd7a200 Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents: 91
diff changeset
821 }
97
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
822 # And check whether anything needs restarting
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
823 cron { 'check-needs-restarting':
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
824 command => '/usr/bin/needs-restarting|grep -v "/usr/lib/systemd\|/usr/sbin/lvmetad\|/usr/lib/polkit-1/polkitd"',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
825 hour => '4',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
826 minute => '45',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
827 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents: 96
diff changeset
828 }
0
956e484adc12 Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
829 }