other/Puppet: manifests/templates.pp annotate

annotate manifests/templates.pp @ 476:b0531370e183

Avoid fully controllable rewrite prefix Apache doesn't guarantee that rewrites are URLs or paths within the prefix and will process them rather than error, so close a fully controllable rewrite prefix: https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1

author	IBBoard <dev@ibboard.co.uk>
date	Sun, 11 Aug 2024 13:29:59 +0100
parents	9437c6ffa07c
children	2c3e745be8d2

rev	line source
32 6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start) IBBoard <dev@ibboard.co.uk> parents: 25 diff changeset	1 # Make sure packages come after their repos
382 308b4149bee5 Add anchors to simplify dependencies IBBoard <dev@ibboard.co.uk> parents: 379 diff changeset	2 File<\| tag == 'repo-config' \|>
308b4149bee5 Add anchors to simplify dependencies IBBoard <dev@ibboard.co.uk> parents: 379 diff changeset	3 -> anchor { 'Repo-config': }
308b4149bee5 Add anchors to simplify dependencies IBBoard <dev@ibboard.co.uk> parents: 379 diff changeset	4 -> YumRepo<\| \|>
446 ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	5 -> Apt::Source<\| \|>
382 308b4149bee5 Add anchors to simplify dependencies IBBoard <dev@ibboard.co.uk> parents: 379 diff changeset	6 -> anchor { 'Repos': }
308b4149bee5 Add anchors to simplify dependencies IBBoard <dev@ibboard.co.uk> parents: 379 diff changeset	7 -> Package<\| \|>
32 6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start) IBBoard <dev@ibboard.co.uk> parents: 25 diff changeset	8
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start) IBBoard <dev@ibboard.co.uk> parents: 25 diff changeset	9 # Make sure all files are in place before starting services
298 61e90445c899 Merge CentOS8 and CentOS7 branches IBBoard <dev@ibboard.co.uk> parents: 292 284 diff changeset	10 # FIXME: Title matches are to fix a dependency cycle
382 308b4149bee5 Add anchors to simplify dependencies IBBoard <dev@ibboard.co.uk> parents: 379 diff changeset	11 File<\| tag != 'post-service' and title != '/etc/sysconfig/ip6tables' and title != '/etc/sysconfig/iptables' \|>
308b4149bee5 Add anchors to simplify dependencies IBBoard <dev@ibboard.co.uk> parents: 379 diff changeset	12 -> anchor { 'Pre-Service Files': }
308b4149bee5 Add anchors to simplify dependencies IBBoard <dev@ibboard.co.uk> parents: 379 diff changeset	13 -> Service<\| \|>
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	14
c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	15 # Set some shortcut variables
c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	16 #$os = $operatingsystem
249 e9323ff8f451 Make EPEL work on multiple versions of CentOS IBBoard <dev@ibboard.co.uk> parents: 247 diff changeset	17 $osver = $operatingsystemmajrelease
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	18 $server = ''
32 6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start) IBBoard <dev@ibboard.co.uk> parents: 25 diff changeset	19
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start) IBBoard <dev@ibboard.co.uk> parents: 25 diff changeset	20
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	21 class basenode {
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	22 include sudo
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	23
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	24 include defaultusers
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	25 include logwatch
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	26
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	27 file { '/etc/puppet/hiera.yaml':
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	28 ensure => present,
264 ea72ea1f7320 Update Hiera to fix warnings IBBoard <dev@ibboard.co.uk> parents: 262 diff changeset	29 content => "
ea72ea1f7320 Update Hiera to fix warnings IBBoard <dev@ibboard.co.uk> parents: 262 diff changeset	30 # Let the system set defaults
ea72ea1f7320 Update Hiera to fix warnings IBBoard <dev@ibboard.co.uk> parents: 262 diff changeset	31 version: 5
ea72ea1f7320 Update Hiera to fix warnings IBBoard <dev@ibboard.co.uk> parents: 262 diff changeset	32 ",
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	33 }
458 d7ad78f128b1 Disable Puppet service IBBoard <dev@ibboard.co.uk> parents: 456 diff changeset	34 service { 'puppet':
d7ad78f128b1 Disable Puppet service IBBoard <dev@ibboard.co.uk> parents: 456 diff changeset	35 ensure => stopped,
d7ad78f128b1 Disable Puppet service IBBoard <dev@ibboard.co.uk> parents: 456 diff changeset	36 enable => false,
d7ad78f128b1 Disable Puppet service IBBoard <dev@ibboard.co.uk> parents: 456 diff changeset	37 }
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	38 if $operatingsystem == 'Ubuntu' {
447 1a9de0661666 Add missing package/dir for minimal Ubuntu IBBoard <dev@ibboard.co.uk> parents: 446 diff changeset	39 package { 'locales':
1a9de0661666 Add missing package/dir for minimal Ubuntu IBBoard <dev@ibboard.co.uk> parents: 446 diff changeset	40 ensure => present
1a9de0661666 Add missing package/dir for minimal Ubuntu IBBoard <dev@ibboard.co.uk> parents: 446 diff changeset	41 } ->
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	42 file { '/etc/locale.gen':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	43 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	44 content => "en_GB.UTF-8 UTF-8",
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	45 notify => Exec['Regen locales']
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	46 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	47 exec { 'Regen locales':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	48 command => 'locale-gen',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	49 refreshonly => true
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	50 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	51 # Don't waste space with Snap and do everything properly with system packages
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	52 [ 'lxd', 'core18', 'core20', 'snapd'].each \|$snap\| {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	53 exec { "remove $snap snap package":
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	54 command => "snap remove $snap",
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	55 onlyif => "which snap && snap list $snap",
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	56 tag => 'snap',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	57 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	58 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	59 Exec<\| tag == 'snap' \|> ->
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	60 package { 'snapd':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	61 ensure => purged,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	62 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	63 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	64 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	65
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	66 class basevpsnode (
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	67 $primary_ip,
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	68 $gateway_ip = undef,
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	69 $proxy_4to6_ip_prefix = undef,
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	70 $proxy_upstream = undef,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	71 $nat64_ranges = [],
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	72 $mailserver,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	73 $imapserver,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	74 $mailrelays = [],
35 1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables) IBBoard <dev@ibboard.co.uk> parents: 32 diff changeset	75 $firewall_cmd = 'iptables',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	76 ) {
44 546dfa011f58 Remove "puppet" host name because we don't need it IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	77
40 222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	78 if $firewall_cmd == 'iptables' {
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	79 class { 'vpsfirewall':
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	80 fw_protocol => $primary_ip =~ Stdlib::IP::Address::V6 ? { true => 'IPv6', default => 'IPv4'},
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	81 }
40 222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	82 }
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	83
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	84 #VPS is a self-mastered Puppet machine, so bodge a Hosts file
302 01d1b0f6dbaf Fix more IPv4 vs IPv6 settings IBBoard <dev@ibboard.co.uk> parents: 301 diff changeset	85 if $primary_ip =~ Stdlib::IP::Address::V6 {
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings IBBoard <dev@ibboard.co.uk> parents: 301 diff changeset	86 $lo_ip = '::1'
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings IBBoard <dev@ibboard.co.uk> parents: 301 diff changeset	87 } else {
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings IBBoard <dev@ibboard.co.uk> parents: 301 diff changeset	88 $lo_ip = '127.0.0.1'
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings IBBoard <dev@ibboard.co.uk> parents: 301 diff changeset	89 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	90 file { '/etc/hosts':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	91 ensure => present,
302 01d1b0f6dbaf Fix more IPv4 vs IPv6 settings IBBoard <dev@ibboard.co.uk> parents: 301 diff changeset	92 content => "${lo_ip} localhost\n${primary_ip} ${fqdn}",
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	93 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	94
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	95 if $proxy_4to6_ip_prefix != undef {
461 5c97adb07a0a Fix IP addresses in Ubuntu IBBoard <dev@ibboard.co.uk> parents: 460 diff changeset	96 # …:1 to …:9 for websites, …:10 for mail
471 65290cb0cec2 Tidy up SSH firewall handling IBBoard <dev@ibboard.co.uk> parents: 469 diff changeset	97 # Note: IPv6 is hexadecimal and so 0x10 is not in a /124 netblock with 0x01 to 0x09!
461 5c97adb07a0a Fix IP addresses in Ubuntu IBBoard <dev@ibboard.co.uk> parents: 460 diff changeset	98 $ipv6_addresses = Integer[1, 10].map \|$octet\| { "$proxy_4to6_ip_prefix:$octet" }
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	99 if $operatingsystem == 'Ubuntu' {
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	100 # Ubuntu can't parse the existing file, so we need to brute-force it with a template
468 8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	101 file { "/etc/network/interfaces.d/eth0":
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	102 content => epp('privat/eth0.epp',
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	103 {
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	104 default_address => $primary_ip,
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	105 gateway_address => $gateway_ip,
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	106 }
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	107 ),
461 5c97adb07a0a Fix IP addresses in Ubuntu IBBoard <dev@ibboard.co.uk> parents: 460 diff changeset	108 notify => Exec["restart_networking"],
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	109 }
468 8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	110 # …:1 to …:9 for websites, …:10 for mail
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	111 Integer[1, 10].each \|$octet\| {
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	112 file { "/etc/network/interfaces.d/eth0:$octet":
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	113 content => epp('privat/eth0-alias.epp',
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	114 {
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	115 prefix_address => $proxy_4to6_ip_prefix,
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	116 octet => $octet,
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	117 }
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	118 ),
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	119 notify => Exec["restart_networking"],
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	120 }
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	121 }
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	122 }
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	123 else {
468 8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	124 # …:1 to …:9 for websites, …:10 for mail
8a3c3eb60fdd Fix IPs on Ubuntu again )hopefully) IBBoard <dev@ibboard.co.uk> parents: 467 diff changeset	125 $ipv6_addresses = Integer[1, 10].map \|$octet\| { "$proxy_4to6_ip_prefix:$octet" }
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	126 $ipv6_secondaries = join($ipv6_addresses, " ")
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	127
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	128 augeas {'IPv6 secondary addresses':
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	129 context => "/files/etc/sysconfig/network-scripts/ifcfg-eth0",
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	130 changes => "set IPV6ADDR_SECONDARIES '\"$ipv6_secondaries\"'",
461 5c97adb07a0a Fix IP addresses in Ubuntu IBBoard <dev@ibboard.co.uk> parents: 460 diff changeset	131 notify => Exec["restart_networking"],
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	132 }
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	133 }
461 5c97adb07a0a Fix IP addresses in Ubuntu IBBoard <dev@ibboard.co.uk> parents: 460 diff changeset	134
5c97adb07a0a Fix IP addresses in Ubuntu IBBoard <dev@ibboard.co.uk> parents: 460 diff changeset	135 Exec { 'restart_networking':
5c97adb07a0a Fix IP addresses in Ubuntu IBBoard <dev@ibboard.co.uk> parents: 460 diff changeset	136 command => 'systemctl restart networking',
5c97adb07a0a Fix IP addresses in Ubuntu IBBoard <dev@ibboard.co.uk> parents: 460 diff changeset	137 refreshonly => true,
5c97adb07a0a Fix IP addresses in Ubuntu IBBoard <dev@ibboard.co.uk> parents: 460 diff changeset	138 }
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	139 }
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	140
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	141 require repos
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	142 include basenode
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	143 include privat
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	144 include dnsresolver
396 e93588ec1ce3 Use "param" variables for settings instead of conditions IBBoard <dev@ibboard.co.uk> parents: 393 diff changeset	145 include ::privat::params
e93588ec1ce3 Use "param" variables for settings instead of conditions IBBoard <dev@ibboard.co.uk> parents: 393 diff changeset	146 class { '::ssh':
e93588ec1ce3 Use "param" variables for settings instead of conditions IBBoard <dev@ibboard.co.uk> parents: 393 diff changeset	147 sshd_config_port => $::privat::params::ssh_port[$::fqdn]
e93588ec1ce3 Use "param" variables for settings instead of conditions IBBoard <dev@ibboard.co.uk> parents: 393 diff changeset	148 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	149 include vcs::server
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	150 include vcs::client
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	151 class { 'webserver':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	152 primary_ip => $primary_ip,
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	153 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	154 proxy_4to6_mask => 124,
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	155 proxy_upstream => $proxy_upstream,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	156 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	157 include cronjobs
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	158 include logrotate
35 1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables) IBBoard <dev@ibboard.co.uk> parents: 32 diff changeset	159 class { 'fail2ban':
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables) IBBoard <dev@ibboard.co.uk> parents: 32 diff changeset	160 firewall_cmd => $firewall_cmd,
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables) IBBoard <dev@ibboard.co.uk> parents: 32 diff changeset	161 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	162 include tools
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	163 class { 'email':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	164 mailserver => $mailserver,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	165 imapserver => $imapserver,
311 51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use IBBoard <dev@ibboard.co.uk> parents: 310 diff changeset	166 mailserver_ip => $primary_ip,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	167 proxy_ip => $proxy_4to6_ip_prefix != undef ? { true => "${proxy_4to6_ip_prefix}:10", default => undef },
311 51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use IBBoard <dev@ibboard.co.uk> parents: 310 diff changeset	168 proxy_upstream => $proxy_upstream,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	169 nat64_ranges => $nat64_ranges,
63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	170 mailrelays => $mailrelays,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	171 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	172 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	173
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	174 ## Classes to allow facet behaviour using preconfigured setups of classes
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	175
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	176 class vpsfirewall ($fw_protocol) {
40 222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	177 resources { "firewall":
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	178 purge => false,
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	179 }
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	180 class { "my_fw":
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	181 ip_version => $fw_protocol,
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	182 }
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	183 # Control what does and doesn't get pruned in the main filter chain
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	184 firewallchain { "INPUT:filter:$fw_protocol":
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	185 purge => true,
40 222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	186 ignore => [
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	187 '-j f2b-[^ ]+$',
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	188 '^(:\|-A )f2b-',
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	189 '--comment "Great Firewall of China"',
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	190 '--comment "Do not purge',
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	191 ],
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	192 }
471 65290cb0cec2 Tidy up SSH firewall handling IBBoard <dev@ibboard.co.uk> parents: 469 diff changeset	193 include privat::params
65290cb0cec2 Tidy up SSH firewall handling IBBoard <dev@ibboard.co.uk> parents: 469 diff changeset	194 $ssh_ports = $::privat::params::ssh_port[$::fqdn]
65290cb0cec2 Tidy up SSH firewall handling IBBoard <dev@ibboard.co.uk> parents: 469 diff changeset	195 firewall { '090 Allow SSH':
65290cb0cec2 Tidy up SSH firewall handling IBBoard <dev@ibboard.co.uk> parents: 469 diff changeset	196 dport => $ssh_ports - 22,
65290cb0cec2 Tidy up SSH firewall handling IBBoard <dev@ibboard.co.uk> parents: 469 diff changeset	197 proto => 'tcp',
65290cb0cec2 Tidy up SSH firewall handling IBBoard <dev@ibboard.co.uk> parents: 469 diff changeset	198 action => 'accept',
65290cb0cec2 Tidy up SSH firewall handling IBBoard <dev@ibboard.co.uk> parents: 469 diff changeset	199 }
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	200 if ($fw_protocol != "IPv6") {
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	201 firewall { '010 Whitelist Googlebot':
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	202 source => '66.249.64.0/19',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	203 dport => [80,443],
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	204 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	205 action => accept,
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	206 }
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	207 # Block a spammer hitting our contact forms (also on StopForumSpam list A LOT)
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	208 firewall { '099 Blacklist spammers 1':
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	209 source => '107.181.78.172',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	210 dport => [80, 443],
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	211 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	212 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	213 }
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	214 firewall { '099 Blacklist IODC bot':
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	215 # IODC bot makes too many bad requests, and contact form is broken
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	216 # They don't publish a robots.txt name, so firewall it!
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	217 source => '86.153.145.149',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	218 dport => [ 80, 443 ],
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	219 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	220 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	221 }
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	222 firewall { '099 Blacklist Baidu Brazil':
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	223 #Baidu got a Brazilian netblock and are hitting us hard
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	224 #Baidu doesn't honour "crawl-delay" in robots.txt
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	225 #Baidu gets firewalled
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	226 source => '131.161.8.0/22',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	227 dport => [ 80, 443 ],
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	228 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	229 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	230 }
139 abaf384dc939 Block another annoying IP with a firewall rule IBBoard <dev@ibboard.co.uk> parents: 137 diff changeset	231 }
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	232 firewallchain { "GREATFIREWALLOFCHINA:filter:$fw_protocol":
40 222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	233 ensure => present,
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	234 }
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	235 firewall { '050 Check our Great Firewall Against China':
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	236 chain => 'INPUT',
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	237 jump => 'GREATFIREWALLOFCHINA',
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	238 }
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	239 firewallchain { "Fail2Ban:filter:$fw_protocol":
64 3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons) IBBoard <dev@ibboard.co.uk> parents: 61 diff changeset	240 ensure => present,
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons) IBBoard <dev@ibboard.co.uk> parents: 61 diff changeset	241 }
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons) IBBoard <dev@ibboard.co.uk> parents: 61 diff changeset	242 firewall { '060 Check Fail2Ban':
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons) IBBoard <dev@ibboard.co.uk> parents: 61 diff changeset	243 chain => 'INPUT',
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons) IBBoard <dev@ibboard.co.uk> parents: 61 diff changeset	244 jump => 'Fail2Ban',
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons) IBBoard <dev@ibboard.co.uk> parents: 61 diff changeset	245 }
40 222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	246 }
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	247
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	248 class dnsresolver {
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	249 package { 'unbound':
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	250 ensure => present,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	251 }
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	252 package { 'named':
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	253 ensure => absent,
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	254 }
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	255
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	256 service { 'named':
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	257 ensure => stopped,
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	258 enable => false,
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	259 }
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	260 service { 'unbound':
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	261 ensure => running,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	262 enable => true,
194 a08de3153548 Add a named.conf file to control cache/memory size IBBoard <dev@ibboard.co.uk> parents: 193 diff changeset	263 }
a08de3153548 Add a named.conf file to control cache/memory size IBBoard <dev@ibboard.co.uk> parents: 193 diff changeset	264
a08de3153548 Add a named.conf file to control cache/memory size IBBoard <dev@ibboard.co.uk> parents: 193 diff changeset	265 file { '/etc/named.conf':
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	266 ensure => absent,
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	267 }
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	268 file { '/etc/unbound/unbound.conf':
194 a08de3153548 Add a named.conf file to control cache/memory size IBBoard <dev@ibboard.co.uk> parents: 193 diff changeset	269 ensure => present,
247 308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	270 source => [
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	271 "puppet:///common/unbound.conf-${::hostname}",
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	272 "puppet:///common/unbound.conf",
247 308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	273 ],
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	274 require => Package['unbound'],
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	275 notify => Service['unbound'],
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	276 }
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	277 file { ['/etc/NetworkManager', '/etc/NetworkManager/conf.d']:
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	278 ensure => directory
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	279 }
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	280 file { '/etc/NetworkManager/conf.d/local-dns-resolver.conf':
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	281 ensure => present,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	282 content => "[main]
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	283 dns=none",
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	284 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	285
101 a48b6011a084 Stop Bind trying IPv6, as we only have a link-local IP IBBoard <dev@ibboard.co.uk> parents: 100 diff changeset	286 file { '/etc/sysconfig/named':
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	287 ensure => absent,
101 a48b6011a084 Stop Bind trying IPv6, as we only have a link-local IP IBBoard <dev@ibboard.co.uk> parents: 100 diff changeset	288 }
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	289 file { '/etc/resolv.conf':
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	290 ensure => file,
301 1bfc290270cc Fix sa-update by using IPv6 for local DNS cache IBBoard <dev@ibboard.co.uk> parents: 298 diff changeset	291 # "ipaddress" key only exists for machines with IPv4 addresses
1bfc290270cc Fix sa-update by using IPv6 for local DNS cache IBBoard <dev@ibboard.co.uk> parents: 298 diff changeset	292 content => has_key($facts, 'ipaddress') ? { true => "nameserver 127.0.0.1", default => "nameserver ::1" },
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	293 require => Service['unbound'],
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	294 tag => 'post-service',
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	295 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	296 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	297
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	298 class repos {
439 e4de05e3a2f8 Ensure Python params are included IBBoard <dev@ibboard.co.uk> parents: 435 diff changeset	299 include ::python::params
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	300 if $operatingsystem == 'CentOS' {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	301 yumrepo { 'epel':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	302 mirrorlist => 'https://mirrors.fedoraproject.org/metalink?repo=epel-$releasever&arch=$basearch',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	303 descr => "Extra Packages for Enterprise Linux",
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	304 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	305 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	306 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	307 gpgkey => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver",
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	308 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	309 file { "/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver":
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	310 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	311 source => "puppet:///common/RPM-GPG-KEY-EPEL-$osver",
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	312 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	313 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	314 yumrepo { 'ibboard':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	315 baseurl => 'https://download.opensuse.org/repositories/home:/IBBoard:/server/CentOS_$releasever/',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	316 descr => 'Extra packages from IBBoard',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	317 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	318 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	319 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	320 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	321 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	322 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	323 source => 'puppet:///common/RPM-GPG-KEY-ibboard',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	324 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	325 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	326 yumrepo { 'webtatic':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	327 ensure => absent,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	328 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	329 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-andy':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	330 ensure => absent,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	331 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	332 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-el7':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	333 ensure => absent,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	334 }
409 621e78abf82c Fix `requires devel` problem with CentOS IBBoard <dev@ibboard.co.uk> parents: 408 diff changeset	335 # Python requires the `devel` package on CentOS, but by default the module tries to uninstall it
621e78abf82c Fix `requires devel` problem with CentOS IBBoard <dev@ibboard.co.uk> parents: 408 diff changeset	336 $dev = 'present'
621e78abf82c Fix `requires devel` problem with CentOS IBBoard <dev@ibboard.co.uk> parents: 408 diff changeset	337 }
621e78abf82c Fix `requires devel` problem with CentOS IBBoard <dev@ibboard.co.uk> parents: 408 diff changeset	338 else {
621e78abf82c Fix `requires devel` problem with CentOS IBBoard <dev@ibboard.co.uk> parents: 408 diff changeset	339 # Other distros can take the default devel status
621e78abf82c Fix `requires devel` problem with CentOS IBBoard <dev@ibboard.co.uk> parents: 408 diff changeset	340 $dev = $::python::params::dev
447 1a9de0661666 Add missing package/dir for minimal Ubuntu IBBoard <dev@ibboard.co.uk> parents: 446 diff changeset	341 # CentOS-like distros have PKI by default. Others need it creating.
1a9de0661666 Add missing package/dir for minimal Ubuntu IBBoard <dev@ibboard.co.uk> parents: 446 diff changeset	342 file { '/etc/pki/':
1a9de0661666 Add missing package/dir for minimal Ubuntu IBBoard <dev@ibboard.co.uk> parents: 446 diff changeset	343 ensure => directory,
1a9de0661666 Add missing package/dir for minimal Ubuntu IBBoard <dev@ibboard.co.uk> parents: 446 diff changeset	344 }
467 9ae251433074 Switch from legacy Apt GPG keys to keyrings IBBoard <dev@ibboard.co.uk> parents: 465 diff changeset	345 file { '/etc/apt/trusted.gpg.d/home_IBBoard_server.gpg':
9ae251433074 Switch from legacy Apt GPG keys to keyrings IBBoard <dev@ibboard.co.uk> parents: 465 diff changeset	346 # https://download.opensuse.org/repositories/home:/IBBoard:/server/xUbuntu_22.04/Release.key
9ae251433074 Switch from legacy Apt GPG keys to keyrings IBBoard <dev@ibboard.co.uk> parents: 465 diff changeset	347 # Then GPG exported with `cat Release.key \| gpg --dearmour -o common/home_IBBoard_server.gpg
9ae251433074 Switch from legacy Apt GPG keys to keyrings IBBoard <dev@ibboard.co.uk> parents: 465 diff changeset	348 source => 'puppet:///common/home_IBBoard_server.gpg'
9ae251433074 Switch from legacy Apt GPG keys to keyrings IBBoard <dev@ibboard.co.uk> parents: 465 diff changeset	349 }
446 ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	350
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	351 apt::source {
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	352 'ibboard':
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	353 location => 'http://download.opensuse.org/repositories/home:/IBBoard:/server/xUbuntu_22.04/',
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	354 release => '/',
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	355 repos => '',
467 9ae251433074 Switch from legacy Apt GPG keys to keyrings IBBoard <dev@ibboard.co.uk> parents: 465 diff changeset	356 keyring => '/etc/apt/trusted.gpg.d/home_IBBoard_server.gpg',
446 ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	357 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	358 }
148 d9fcabc75a1e Fix pip installations IBBoard <dev@ibboard.co.uk> parents: 147 diff changeset	359
272 c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	360 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 {
383 f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically IBBoard <dev@ibboard.co.uk> parents: 382 diff changeset	361 # The following may possibly work to ensure a CentOS Streams install.
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically IBBoard <dev@ibboard.co.uk> parents: 382 diff changeset	362 # Or it might fail for inexplicable reasons.
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically IBBoard <dev@ibboard.co.uk> parents: 382 diff changeset	363 # FIXME: Should be "centos-release-stream" to migrate (provides repos), but then that gets replaced by centos-stream-release,
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically IBBoard <dev@ibboard.co.uk> parents: 382 diff changeset	364 # which Puppet doesn't recognise as the same and so keeps trying to re-install. May need an "unless" or maybe "allow_virtual"
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically IBBoard <dev@ibboard.co.uk> parents: 382 diff changeset	365 package { 'centos-stream-release':
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically IBBoard <dev@ibboard.co.uk> parents: 382 diff changeset	366 ensure => installed,
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically IBBoard <dev@ibboard.co.uk> parents: 382 diff changeset	367 notify => Exec['migrate to streams'];
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically IBBoard <dev@ibboard.co.uk> parents: 382 diff changeset	368 }
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically IBBoard <dev@ibboard.co.uk> parents: 382 diff changeset	369 exec { 'migrate to streams':
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically IBBoard <dev@ibboard.co.uk> parents: 382 diff changeset	370 command => '/usr/bin/dnf swap centos-linux-repos centos-stream-repos; /usr/bin/dnf distro-sync -y',
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically IBBoard <dev@ibboard.co.uk> parents: 382 diff changeset	371 refreshonly => true
f9a6f6ff8256 Attempt to migrate CentOS8 to Streams automatically IBBoard <dev@ibboard.co.uk> parents: 382 diff changeset	372 }
148 d9fcabc75a1e Fix pip installations IBBoard <dev@ibboard.co.uk> parents: 147 diff changeset	373 }
272 c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	374
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	375 class { 'python':
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	376 ensure => 'present',
401 f0ee7a16125d Switch to Python 3 on all platforms IBBoard <dev@ibboard.co.uk> parents: 399 diff changeset	377 version => 'python3',
272 c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	378 pip => 'present',
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	379 use_epel => false,
409 621e78abf82c Fix `requires devel` problem with CentOS IBBoard <dev@ibboard.co.uk> parents: 408 diff changeset	380 dev => $dev,
272 c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	381 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	382 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	383
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	384 class tools {
446 ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	385 $packages = [ 'sqlite', 'bash-completion', 'nano', 'zip', 'bzip2', 'mlocate', 'patch', 'tmux', 'wget', 'rsync' ]
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	386 package { $packages:
131 0dd899a10ee1 Change all "latest" packages to "installed" IBBoard <dev@ibboard.co.uk> parents: 129 diff changeset	387 ensure => installed;
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	388 }
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	389 if $osfamily == 'RedHat' {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	390 package { 'yum-utils':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	391 ensure => installed
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	392 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	393 }
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	394 elsif $osfamily == 'Debian' {
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	395 package { 'dnsutils':
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	396 ensure => installed
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	397 }
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	398 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	399 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	400
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	401 class logrotate {
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	402 package { 'logrotate':
131 0dd899a10ee1 Change all "latest" packages to "installed" IBBoard <dev@ibboard.co.uk> parents: 129 diff changeset	403 ensure => installed;
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	404 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	405 file { '/etc/logrotate.d/httpd':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	406 ensure => present,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	407 source => 'puppet:///common/logrotate-httpd',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	408 require => Package['logrotate'],
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	409 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	410 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	411
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	412 class logwatch {
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	413 package { 'logwatch':
131 0dd899a10ee1 Change all "latest" packages to "installed" IBBoard <dev@ibboard.co.uk> parents: 129 diff changeset	414 ensure => installed;
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	415 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	416 File {
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	417 ensure => present,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	418 require => Package['logwatch'],
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	419 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	420 file { '/etc/cron.daily/0logwatch':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	421 source => 'puppet:///common/0logwatch';
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	422 }
332 7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	423 $logwatch_dirs = [
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	424 '/etc/logwatch/',
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	425 '/etc/logwatch/conf/',
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	426 '/etc/logwatch/conf/logfiles/',
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	427 '/etc/logwatch/conf/services/',
345 bad68f1b6467 Add updated Dovecot script to Logwatch IBBoard <dev@ibboard.co.uk> parents: 342 diff changeset	428 '/etc/logwatch/scripts/',
bad68f1b6467 Add updated Dovecot script to Logwatch IBBoard <dev@ibboard.co.uk> parents: 342 diff changeset	429 '/etc/logwatch/scripts/services/',
332 7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	430 ]
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	431 file { $logwatch_dirs:
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	432 ensure => directory,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	433 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	434 file { '/etc/logwatch/conf/logwatch.conf':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	435 content => 'Detail = Med',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	436 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	437 file { '/etc/logwatch/conf/logfiles/http.conf':
465 f6304a8e2adc Try to fix last day of month HTTP LogWatch IBBoard <dev@ibboard.co.uk> parents: 464 diff changeset	438 source => 'puppet:///common/logwatch/logfiles_http.conf',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	439 }
332 7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	440 file { '/etc/logwatch/conf/logfiles/http-error.conf':
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	441 source => 'puppet:///common/logwatch/logfiles_http-error.conf',
126 8316d4e55e92 Fix Apache 2.4 Logwatch support IBBoard <dev@ibboard.co.uk> parents: 125 diff changeset	442 }
332 7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	443 file { '/etc/logwatch/conf/logfiles/mysql.conf':
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	444 source => 'puppet:///common/logwatch/logfiles_mysql.conf',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	445 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	446 file { '/etc/logwatch/conf/logfiles/php.conf':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	447 source => 'puppet:///common/logwatch/logfiles_php.conf',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	448 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	449 file { '/etc/logwatch/conf/services/php.conf':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	450 source => 'puppet:///common/logwatch/services_php.conf',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	451 }
379 63adae1a374a Fix and expand PHP logwatch config IBBoard <dev@ibboard.co.uk> parents: 378 diff changeset	452 file { '/etc/logwatch/conf/services/contact-form.conf':
63adae1a374a Fix and expand PHP logwatch config IBBoard <dev@ibboard.co.uk> parents: 378 diff changeset	453 source => 'puppet:///common/logwatch/services_contact-form.conf',
63adae1a374a Fix and expand PHP logwatch config IBBoard <dev@ibboard.co.uk> parents: 378 diff changeset	454 }
345 bad68f1b6467 Add updated Dovecot script to Logwatch IBBoard <dev@ibboard.co.uk> parents: 342 diff changeset	455 file { '/etc/logwatch/scripts/services/dovecot':
bad68f1b6467 Add updated Dovecot script to Logwatch IBBoard <dev@ibboard.co.uk> parents: 342 diff changeset	456 source => 'puppet:///common/logwatch/dovecot',
bad68f1b6467 Add updated Dovecot script to Logwatch IBBoard <dev@ibboard.co.uk> parents: 342 diff changeset	457 }
346 61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch IBBoard <dev@ibboard.co.uk> parents: 345 diff changeset	458 file { '/etc/logwatch/scripts/services/postfix':
61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch IBBoard <dev@ibboard.co.uk> parents: 345 diff changeset	459 source => 'puppet:///common/logwatch/postfix',
61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch IBBoard <dev@ibboard.co.uk> parents: 345 diff changeset	460 }
347 73d7b3ec6263 Ignore log entries from Cron tasks running in user mode IBBoard <dev@ibboard.co.uk> parents: 346 diff changeset	461 file { '/etc/logwatch/scripts/services/systemd':
73d7b3ec6263 Ignore log entries from Cron tasks running in user mode IBBoard <dev@ibboard.co.uk> parents: 346 diff changeset	462 source => 'puppet:///common/logwatch/systemd',
73d7b3ec6263 Ignore log entries from Cron tasks running in user mode IBBoard <dev@ibboard.co.uk> parents: 346 diff changeset	463 }
379 63adae1a374a Fix and expand PHP logwatch config IBBoard <dev@ibboard.co.uk> parents: 378 diff changeset	464 file { '/etc/logwatch/scripts/services/php':
63adae1a374a Fix and expand PHP logwatch config IBBoard <dev@ibboard.co.uk> parents: 378 diff changeset	465 source => 'puppet:///common/logwatch/php',
63adae1a374a Fix and expand PHP logwatch config IBBoard <dev@ibboard.co.uk> parents: 378 diff changeset	466 }
63adae1a374a Fix and expand PHP logwatch config IBBoard <dev@ibboard.co.uk> parents: 378 diff changeset	467 file { '/etc/logwatch/scripts/services/contact-form':
63adae1a374a Fix and expand PHP logwatch config IBBoard <dev@ibboard.co.uk> parents: 378 diff changeset	468 source => 'puppet:///common/logwatch/contact-form',
63adae1a374a Fix and expand PHP logwatch config IBBoard <dev@ibboard.co.uk> parents: 378 diff changeset	469 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	470 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	471
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	472 #Our web server with our configs, not just a stock one
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	473 class webserver (
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	474 $primary_ip,
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	475 $proxy_4to6_ip_prefix = undef,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	476 $proxy_4to6_mask = undef,
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	477 $proxy_upstream = undef,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	478 ) {
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	479
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	480 #Setup base website parameters
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	481 class { 'website':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	482 base_dir => '/srv/sites',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	483 primary_ip => $primary_ip,
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	484 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	485 proxy_4to6_mask => $proxy_4to6_mask,
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	486 proxy_upstream => $proxy_upstream,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	487 default_owner => $defaultusers::default_user,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	488 default_group => $defaultusers::default_user,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	489 default_tld => 'co.uk',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	490 default_extra_tlds => [ 'com' ],
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	491 }
110 be2b30b17a4c Switch to PHP 7 from Webtatic IBBoard <dev@ibboard.co.uk> parents: 108 diff changeset	492
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	493 if $operatingsystem == 'CentOS' {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	494 $php_suffix = ''
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	495 $ini_prefix_20 = '20-'
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	496 $ini_prefix_30 = '30-'
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	497 $ini_prefix_40 = '40-'
419 0c627ff3a7c3 Fix PHP setup on CentOS IBBoard <dev@ibboard.co.uk> parents: 418 diff changeset	498 $variant_prefix = 'php-'
416 b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP IBBoard <dev@ibboard.co.uk> parents: 415 diff changeset	499 $extra_prefix = 'pecl-'
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	500 $extra_extras = {
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	501 'posix' => {
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	502 ini_prefix => '20-',
446 ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	503 },
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	504 # Sodium has been bundled since 7.2, but CentOS packages it separately
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	505 'sodium' => {
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	506 ini_prefix => '20-',
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	507 },
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	508 # JSON is integrated into PHP 8+ and so it's only a plugin in CentOS
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	509 'json' => {
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	510 ini_prefix => '20-',
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	511 },
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	512 }
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	513 if versioncmp($operatingsystemrelease, '8') >= 0 {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	514 yumrepo { 'remirepo-safe':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	515 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/$basearch/mirror',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	516 descr => "Extra CentOS packages from Remi",
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	517 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	518 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	519 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	520 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	521 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	522 yumrepo { 'remirepo-php':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	523 mirrorlist => 'http://cdn.remirepo.net/enterprise/8/modular/$basearch/mirror',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	524 descr => 'Remi\'s Modular repository for Enterprise Linux 8 - $basearch',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	525 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	526 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	527 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	528 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	529 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	530 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	531 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	532 source => 'puppet:///common/RPM-GPG-KEY-remi.el8',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	533 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	534 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	535 } else {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	536 yumrepo { 'remirepo-safe':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	537 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/mirror',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	538 descr => "Extra CentOS packages from Remi",
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	539 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	540 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	541 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	542 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	543 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	544 yumrepo { 'remirepo-php':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	545 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/php74/mirror',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	546 descr => "PHP7.4 for CentOS from Remi",
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	547 enabled => 1,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	548 failovermethod => absent,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	549 gpgcheck => 1,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	550 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	551 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	552 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	553 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	554 source => 'puppet:///common/RPM-GPG-KEY-remi',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	555 tag => 'repo-config',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	556 }
320 99e3ca448d55 Fix Remi PHP on CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 317 diff changeset	557 }
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	558 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	559 elsif $operatingsystem == 'Ubuntu' {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	560 $php_suffix = ''
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	561 $ini_prefix_20 = ''
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	562 $ini_prefix_30 = ''
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	563 $ini_prefix_40 = ''
416 b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP IBBoard <dev@ibboard.co.uk> parents: 415 diff changeset	564 $variant_prefix = 'php-'
b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP IBBoard <dev@ibboard.co.uk> parents: 415 diff changeset	565 $extra_prefix = ''
446 ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	566 # Work around constant re-install by enabling virtual packages
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	567 # https://github.com/voxpupuli/puppet-php/issues/387
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	568 Package {
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	569 allow_virtual => true
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	570 }
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	571 $extra_extras = {
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	572 'xdebug' => {
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	573 # Occasional profiling retained in case I want to dig into
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	574 # Wordpress page load inefficiencies any more
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	575 ensure => absent,
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	576 # settings => {
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	577 # "xdebug.mode" => "profile",
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	578 # "xdebug.start_with_request" => "trigger",
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	579 # }
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	580 }
d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	581 }
238 6467e768e353 Switch to PHP 7.4 from Remi IBBoard <dev@ibboard.co.uk> parents: 236 diff changeset	582 }
110 be2b30b17a4c Switch to PHP 7 from Webtatic IBBoard <dev@ibboard.co.uk> parents: 108 diff changeset	583
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	584 #Configure the PHP version to use
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	585 class { 'website::php':
350 85d2c0079af9 Make opcache core and add APCu for object caching IBBoard <dev@ibboard.co.uk> parents: 347 diff changeset	586 suffix => $php_suffix,
335 aa9f570d6a9c Switch to PHP 7.4 now that NextCloud has reached v18 IBBoard <dev@ibboard.co.uk> parents: 334 diff changeset	587 module => ($operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0) ? { true => 'remi-7.4', default => undef },
416 b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP IBBoard <dev@ibboard.co.uk> parents: 415 diff changeset	588 extras => {
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	589 'bcmath' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	590 ini_prefix => $ini_prefix_20,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	591 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	592 'curl' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	593 ini_prefix => $ini_prefix_20,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	594 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	595 'dom' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	596 ini_prefix => $ini_prefix_20,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	597 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	598 'enchant' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	599 ini_prefix => $ini_prefix_20,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	600 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	601 'exif' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	602 ini_prefix => $ini_prefix_20,
416 b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP IBBoard <dev@ibboard.co.uk> parents: 415 diff changeset	603 },
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	604 'fileinfo' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	605 ini_prefix => $ini_prefix_20,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	606 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	607 'gmp' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	608 ini_prefix => $ini_prefix_20,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	609 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	610 'intl' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	611 ini_prefix => $ini_prefix_20,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	612 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	613 'mysqlnd' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	614 ini_prefix => $ini_prefix_20,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	615 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	616 'pdo' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	617 ini_prefix => $ini_prefix_20,
419 0c627ff3a7c3 Fix PHP setup on CentOS IBBoard <dev@ibboard.co.uk> parents: 418 diff changeset	618 },
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	619 'simplexml' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	620 ini_prefix => $ini_prefix_20,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	621 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	622 'soap' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	623 ini_prefix => $ini_prefix_20,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	624 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	625 'xmlwriter' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	626 ini_prefix => $ini_prefix_20,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	627 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	628 'mysqli' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	629 ini_prefix => $ini_prefix_30,
416 b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP IBBoard <dev@ibboard.co.uk> parents: 415 diff changeset	630 },
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	631 'pdo_mysql' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	632 ini_prefix => $ini_prefix_30,
446 ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	633 # Provided by the php-mysql package in CentOS and declared with "Provides"
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	634 # And Ubuntu is the same but without the "Provides"
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	635 provider => "none",
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	636 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	637 'xmlreader' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	638 ini_prefix => $ini_prefix_30,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	639 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	640 'zip' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	641 ini_prefix => $ini_prefix_30,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	642 package_prefix => "${variant_prefix}${extra_prefix}"
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	643 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	644 'apcu' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	645 ini_prefix => $ini_prefix_40,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	646 package_prefix => "${variant_prefix}${extra_prefix}"
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	647 },
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	648 'imagick' => {
454 d0e7979c7e8c Update PHP configs for Ubuntu IBBoard <dev@ibboard.co.uk> parents: 453 diff changeset	649 ini_prefix => $ini_prefix_40,
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	650 package_prefix => "${variant_prefix}${extra_prefix}"
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	651 },
416 b185498177ef Backed out changeset 6421c6f77eb8 - Add SOAP IBBoard <dev@ibboard.co.uk> parents: 415 diff changeset	652 } + $extra_extras,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	653 }
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	654
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	655 #Setup MySQL, using (private) templates to make sure that we set non-std passwords and a default user
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	656 if $operatingsystem == 'CentOS' {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	657 if versioncmp($operatingsystemrelease, '7') >= 0 {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	658 $mysqlpackage = 'mariadb'
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	659 $mysqlsuffix = ''
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	660
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	661 # Required for SELinux rule setting/status checks
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	662 if versioncmp($operatingsystemrelease, '8') >= 0 {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	663 $semanage_package_name = 'policycoreutils-python-utils'
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	664 } else {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	665 $semanage_package_name = 'policycoreutils-python'
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	666 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	667
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	668 package { 'policycoreutils-python':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	669 name => $semanage_package_name,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	670 ensure => present,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	671 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	672
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	673 $extra_packages = [
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	674 'perl-Sys-Syslog', #Required for Perl SPF checking
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	675 ]
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	676
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	677 package { $extra_packages:
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	678 ensure => installed
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	679 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	680 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	681 else {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	682 $mysqlpackage = 'mysql'
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	683 $mysqlsuffix = '55w'
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	684 }
393 a948419a23b1 Fix MySQL package names on Ubuntu IBBoard <dev@ibboard.co.uk> parents: 390 diff changeset	685 $phpmysqlsuffix = 'nd'
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	686 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	687 elsif $operatingsystem == 'Ubuntu' {
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	688 $mysqlpackage = 'mariadb'
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	689 $mysqlsuffix = ''
393 a948419a23b1 Fix MySQL package names on Ubuntu IBBoard <dev@ibboard.co.uk> parents: 390 diff changeset	690 $phpmysqlsuffix = ''
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	691 }
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	692 else {
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	693 fail("No MySQL support for ${operatingsystem}")
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	694 }
402 76d18a918e7f Switch to more parameters IBBoard <dev@ibboard.co.uk> parents: 401 diff changeset	695 include ::defaultusers::params
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	696 class { 'website::mysql':
402 76d18a918e7f Switch to more parameters IBBoard <dev@ibboard.co.uk> parents: 401 diff changeset	697 mysqluser => $::defaultusers::params::mysql_user,
76d18a918e7f Switch to more parameters IBBoard <dev@ibboard.co.uk> parents: 401 diff changeset	698 mysqlpassword => $::defaultusers::params::mysql_password,
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	699 mysqlprefix => $mysqlpackage,
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	700 mysqlsuffix => $mysqlsuffix,
110 be2b30b17a4c Switch to PHP 7 from Webtatic IBBoard <dev@ibboard.co.uk> parents: 108 diff changeset	701 phpsuffix => $php_suffix,
393 a948419a23b1 Fix MySQL package names on Ubuntu IBBoard <dev@ibboard.co.uk> parents: 390 diff changeset	702 phpmysqlsuffix => $phpmysqlsuffix
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	703 }
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	704
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	705 # Additional supporting directories that aren't served as sites
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	706 file { [ '/srv/sites/errorhandling', '/srv/sites/private', '/srv/cms' ]:
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	707 ensure => directory,
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	708 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	709 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	710
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	711 class ibboardvpsnode (
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	712 $primary_ip,
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	713 $gateway_ip = undef,
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	714 $proxy_4to6_ip_prefix = undef,
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	715 $proxy_upstream = undef,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	716 $nat64_ranges = [],
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	717 $mailserver,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	718 $imapserver,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	719 $mailrelays = [],
35 1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables) IBBoard <dev@ibboard.co.uk> parents: 32 diff changeset	720 $firewall_cmd = 'iptables',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	721 ){
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	722 class { 'basevpsnode':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	723 primary_ip => $primary_ip,
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	724 gateway_ip => $gateway_ip,
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	725 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	726 proxy_upstream => $proxy_upstream,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	727 nat64_ranges => $nat64_ranges,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	728 mailserver => $mailserver,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	729 imapserver => $imapserver,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	730 mailrelays => $mailrelays,
35 1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables) IBBoard <dev@ibboard.co.uk> parents: 32 diff changeset	731 firewall_cmd => $firewall_cmd,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	732 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	733
267 edeedd13262c Set a sensible default timezone for VPS IBBoard <dev@ibboard.co.uk> parents: 266 diff changeset	734 # Set timezone to something sensible
edeedd13262c Set a sensible default timezone for VPS IBBoard <dev@ibboard.co.uk> parents: 266 diff changeset	735 file { "/etc/localtime":
edeedd13262c Set a sensible default timezone for VPS IBBoard <dev@ibboard.co.uk> parents: 266 diff changeset	736 ensure => 'link',
edeedd13262c Set a sensible default timezone for VPS IBBoard <dev@ibboard.co.uk> parents: 266 diff changeset	737 target => '/usr/share/zoneinfo/Europe/London',
edeedd13262c Set a sensible default timezone for VPS IBBoard <dev@ibboard.co.uk> parents: 266 diff changeset	738 }
edeedd13262c Set a sensible default timezone for VPS IBBoard <dev@ibboard.co.uk> parents: 266 diff changeset	739
456 66e0e8f9e82a Ensure that at least a blank Great Firewall file exists IBBoard <dev@ibboard.co.uk> parents: 455 diff changeset	740 file { "${apache::conf_dir}/conf.d/greatfirewallagainstchina.conf":
66e0e8f9e82a Ensure that at least a blank Great Firewall file exists IBBoard <dev@ibboard.co.uk> parents: 455 diff changeset	741 ensure => file,
66e0e8f9e82a Ensure that at least a blank Great Firewall file exists IBBoard <dev@ibboard.co.uk> parents: 455 diff changeset	742 }
66e0e8f9e82a Ensure that at least a blank Great Firewall file exists IBBoard <dev@ibboard.co.uk> parents: 455 diff changeset	743
446 ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	744 # Debian doesn't handle sensible depends like module names because of the underscore
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	745 # So we need to use the package name
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	746 package { "mod_cspnonce":
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	747 name => $osfamily == 'Debian' ? { true => "libapache2-mod-cspnonce", default => "mod_cspnonce" },
ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	748 ensure => installed,
410 575764c36e16 Setup CSP Nonce on the server IBBoard <dev@ibboard.co.uk> parents: 409 diff changeset	749 }
575764c36e16 Setup CSP Nonce on the server IBBoard <dev@ibboard.co.uk> parents: 409 diff changeset	750
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	751 # Common modules used by multiple sites (mod_auth_basic is safe because we HTTPS all the things)
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	752 $mods = [
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	753 'auth_basic',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	754 'authn_core',
146 816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile IBBoard <dev@ibboard.co.uk> parents: 145 diff changeset	755 'authn_file',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile IBBoard <dev@ibboard.co.uk> parents: 145 diff changeset	756 'authz_user',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile IBBoard <dev@ibboard.co.uk> parents: 145 diff changeset	757 'deflate',
410 575764c36e16 Setup CSP Nonce on the server IBBoard <dev@ibboard.co.uk> parents: 409 diff changeset	758 'xsendfile',
575764c36e16 Setup CSP Nonce on the server IBBoard <dev@ibboard.co.uk> parents: 409 diff changeset	759 'cspnonce'
146 816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile IBBoard <dev@ibboard.co.uk> parents: 145 diff changeset	760 ]
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	761 apache::mod {
146 816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile IBBoard <dev@ibboard.co.uk> parents: 145 diff changeset	762 $mods:;
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	763 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	764
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	765 #Configure our sites, using templates for the custom fragments where the extra content is too long
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	766 class { "devsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	767 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:01", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	768 }
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	769 class { "adminsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	770 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:02", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	771 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	772 website::https::multitld { 'www.ibboard':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	773 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	774 custom_fragment => template("privat/apache/ibboard.fragment"),
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	775 letsencrypt_name => 'ibboard.co.uk',
236 4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	776 csp_override => {
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	777 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	778 "default-src" => "'none'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	779 "img-src" => "'self' https://live.staticflickr.com/",
464 117680ac22af Amavis spool dir and add Tumblock to CSP headers IBBoard <dev@ibboard.co.uk> parents: 461 diff changeset	780 "script-src" => "'self' https://auth-server.herokuapp.com/proxy https://api.tumblr.com/",
236 4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	781 "style-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	782 "font-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	783 "form-action" => "'self'",
464 117680ac22af Amavis spool dir and add Tumblock to CSP headers IBBoard <dev@ibboard.co.uk> parents: 461 diff changeset	784 "connect-src" => "'self' https://api.tumblr.com/",
236 4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	785 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	786 }
374 5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	787 website::https::redir { 'mail.ibboard.co.uk':
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	788 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
374 5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	789 redir => 'https://ibboard.co.uk/',
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	790 docroot => "${website::basedir}/ibboard",
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	791 letsencrypt_name => 'ibboard.co.uk',
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	792 separate_log => true,
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	793 }
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	794 website::https::redir { 'imap.ibboard.co.uk':
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	795 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
374 5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	796 redir => 'https://ibboard.co.uk/',
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	797 docroot => "${website::basedir}/ibboard",
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	798 letsencrypt_name => 'ibboard.co.uk',
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	799 separate_log => true,
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	800 }
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	801 class { "hiveworldterrasite":
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	802 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:04", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	803 }
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	804 class { "bdstrikesite":
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	805 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:05", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	806 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	807 website::https::multitld { 'www.abiknight':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	808 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:06", default => undef },
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	809 custom_fragment => "$website::htmlphpfragment
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	810 ErrorDocument 404 /error.php",
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	811 letsencrypt_name => 'abiknight.co.uk',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	812 }
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	813 class { "webmailpimsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	814 proxy_4to6_ip_pim => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:08", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	815 proxy_4to6_ip_webmail => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:09", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	816 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	817 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	818
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	819 class adminsite ($proxy_4to6_ip) {
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	820 apache::mod { 'info':; 'status':; 'cgi':; }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	821 website::https::multitld { 'admin.ibboard':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	822 proxy_4to6_ip => $proxy_4to6_ip,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	823 force_no_index => false,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	824 ssl_ca_chain => '',
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	825 csp_override => {
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	826 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	827 "img-src" => "'self' data:",
8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	828 },
426 1d6cf5d981be Try to resolve more CSP errors IBBoard <dev@ibboard.co.uk> parents: 422 diff changeset	829 csp_report_override => {
1d6cf5d981be Try to resolve more CSP errors IBBoard <dev@ibboard.co.uk> parents: 422 diff changeset	830 "img-src" => "'self' data:",
1d6cf5d981be Try to resolve more CSP errors IBBoard <dev@ibboard.co.uk> parents: 422 diff changeset	831 },
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	832 custom_fragment => template("privat/apache/admin.fragment"),
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	833 }
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	834 if $osfamily == 'RedHat' {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	835 $cron_user = 'apache'
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	836 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	837 elsif $osfamily == 'Debian' {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	838 $cron_user = 'www-data'
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	839 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	840 cron { 'loadavg':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	841 command => '/usr/local/bin/run-loadavg-logger',
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	842 user => $cron_user,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	843 minute => '*/6'
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	844 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	845 cron { 'awstats':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	846 command => '/usr/local/bin/update-awstats > /srv/sites/admin/awstats.log',
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	847 user => $cron_user,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	848 hour => '*/6',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	849 minute => '0'
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	850 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	851 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	852
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	853 class hiveworldterrasite ($proxy_4to6_ip) {
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	854 website::https::multitld { 'www.hiveworldterra':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	855 proxy_4to6_ip => $proxy_4to6_ip,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	856 force_no_www => false,
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	857 letsencrypt_name => 'hiveworldterra.co.uk',
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	858 custom_fragment => template("privat/apache/hwt.fragment"),
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	859 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	860 website::https::multitld { 'forums.hiveworldterra':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	861 proxy_4to6_ip => $proxy_4to6_ip,
331 f69e2d197302 Separate some certs to make migration easier IBBoard <dev@ibboard.co.uk> parents: 330 diff changeset	862 letsencrypt_name => 'forums.hiveworldterra.co.uk',
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	863 custom_fragment => template("privat/apache/forums.fragment"),
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	864 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	865 website::https::multitld { 'skins.hiveworldterra':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	866 proxy_4to6_ip => $proxy_4to6_ip,
334 ee4760967d2f Separate LetsEncrypt certs IBBoard <dev@ibboard.co.uk> parents: 332 diff changeset	867 letsencrypt_name => 'skins.hiveworldterra.co.uk',
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	868 custom_fragment => template("privat/apache/skins.fragment"),
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	869 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	870 website::https::redir { 'hiveworldterra.ibboard.co.uk':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	871 proxy_4to6_ip => $proxy_4to6_ip,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	872 redir => 'https://www.hiveworldterra.co.uk/',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	873 docroot => "${website::basedir}/hiveworldterra",
334 ee4760967d2f Separate LetsEncrypt certs IBBoard <dev@ibboard.co.uk> parents: 332 diff changeset	874 letsencrypt_name => 'hiveworldterra.ibboard.co.uk',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	875 separate_log => true,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	876 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	877 }
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	878 class bdstrikesite ($proxy_4to6_ip) {
331 f69e2d197302 Separate some certs to make migration easier IBBoard <dev@ibboard.co.uk> parents: 330 diff changeset	879 website::https::multitld { 'www.bdstrike':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	880 proxy_4to6_ip => $proxy_4to6_ip,
145 88f38ef7359f Add BDStrike domains IBBoard <dev@ibboard.co.uk> parents: 142 diff changeset	881 docroot_owner => $defaultusers::secondary_user,
88f38ef7359f Add BDStrike domains IBBoard <dev@ibboard.co.uk> parents: 142 diff changeset	882 docroot_group => 'editors',
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	883 letsencrypt_name => 'bdstrike.co.uk',
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	884 custom_fragment => template("privat/apache/bdstrike.fragment"),
411 83f2e944a43f Set security settings on BDStrike.co.uk IBBoard <dev@ibboard.co.uk> parents: 410 diff changeset	885 csp_override => {
83f2e944a43f Set security settings on BDStrike.co.uk IBBoard <dev@ibboard.co.uk> parents: 410 diff changeset	886 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
460 ce488cfb225a Fix CSP headers for WordPress admin panel IBBoard <dev@ibboard.co.uk> parents: 459 diff changeset	887 "font-src" => "'self' https://fonts.gstatic.com/ https://s0.wp.com/i/fonts/inter/ data:",
446 ba3c446d5a47 Update config to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 439 diff changeset	888 "img-src" => "'self' https://secure.gravatar.com/ https://ps.w.org/ https://s.w.org/ data:",
411 83f2e944a43f Set security settings on BDStrike.co.uk IBBoard <dev@ibboard.co.uk> parents: 410 diff changeset	889 "style-src" => "'self' https://fonts.googleapis.com/ 'unsafe-inline'",
83f2e944a43f Set security settings on BDStrike.co.uk IBBoard <dev@ibboard.co.uk> parents: 410 diff changeset	890 "connect-src" => "'self' https://www.sandbox.paypal.com/ https://www.paypal.com/",
83f2e944a43f Set security settings on BDStrike.co.uk IBBoard <dev@ibboard.co.uk> parents: 410 diff changeset	891 "frame-ancestors" => "'self'"
83f2e944a43f Set security settings on BDStrike.co.uk IBBoard <dev@ibboard.co.uk> parents: 410 diff changeset	892 },
83f2e944a43f Set security settings on BDStrike.co.uk IBBoard <dev@ibboard.co.uk> parents: 410 diff changeset	893 csp_report_override => {
422 8421eb25c329 Fix PHP extension loading IBBoard <dev@ibboard.co.uk> parents: 420 diff changeset	894 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/reportOnly",
460 ce488cfb225a Fix CSP headers for WordPress admin panel IBBoard <dev@ibboard.co.uk> parents: 459 diff changeset	895 "font-src" => "'self' https://fonts.gstatic.com/ https://s0.wp.com/i/fonts/inter/ data:", # TODO: What's generating it?
411 83f2e944a43f Set security settings on BDStrike.co.uk IBBoard <dev@ibboard.co.uk> parents: 410 diff changeset	896 "img-src" => "'self' https://secure.gravatar.com/ data:",
460 ce488cfb225a Fix CSP headers for WordPress admin panel IBBoard <dev@ibboard.co.uk> parents: 459 diff changeset	897 "style-src" => "'self' https://fonts.googleapis.com/ https://ajax.googleapis.com/ajax/libs/jqueryui/ 'nonce-%{CSP_NONCE}e' 'unsafe-hashes' 'sha256-anQSeQoEnQnBulZOQkDOFf+e6xBIGmqh7M8YFT992co=' 'sha256-zJDyuABAg68wtWDFyIh+RRe+6Vm/r+BLwaNRCGNVyXI=' 'sha256-qMalr/MPLUDW4lX/rq/cGp1Eu/H0cu0Yg98pdu69Jxs=' 'sha256-mshqJ+hidJMRDeNLHknuDAeYLOPg2OTIIA3nZmHgi9U=' 'sha256-YnRUd/QjP/NuFgfjMHhNfMCqXh0RQIGdvQfMCOf6qkw=' 'sha256-EwdiFJgqhefinoeAymrWxOYW4kza2Ekos5MY0PlXYI0=' 'sha256-G4K9vh8e+37+l69S+lHTyX3CfcK95mQUgyxYPCb7uME=' 'sha256-t6oewASd7J1vBg5mQtX4hl8bg8FeegYFM3scKLIhYUc=' 'sha256-mAQYxa3mIYqoLBrm1zLu6sLajr8vUHVFLYNpl6dAakM=' 'sha256-A8foknjCsFBi1PlRehOrHq0pVySigUurqAUgZ2y2U8c=' 'sha256-biLFinpqYMtWHmXfkA1BPeCY0/fNt46SAZ+BBk5YUog=' 'sha256-WzSByVQ8yW/DKrr77TWVt7WEMzueRcfJZImOkjTBKmc=' 'sha256-efof3agGBAL/yN8TplyNbLEgDZ3wIGMK3UMYbe8slkA='",
ce488cfb225a Fix CSP headers for WordPress admin panel IBBoard <dev@ibboard.co.uk> parents: 459 diff changeset	898 "script-src" => "'self' 'nonce-%{CSP_NONCE}e' 'sha256-hPnbct+H2uwUiwoh3kect6TJt4waDlLPfj47TO58lXc=' 'sha256-80Mr5Xc2f6hVSJwvFRRcNjAI9RMcnuTVAIzr6pIQswI=' 'sha256-zwGmIUR+Z6gWKbwoJ2Z3yGxI/XLETLqDqCRIV0qt/WA='",
411 83f2e944a43f Set security settings on BDStrike.co.uk IBBoard <dev@ibboard.co.uk> parents: 410 diff changeset	899 "connect-src" => "'self' https://www.sandbox.paypal.com/ https://www.paypal.com/",
236 4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	900 },
145 88f38ef7359f Add BDStrike domains IBBoard <dev@ibboard.co.uk> parents: 142 diff changeset	901 }
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	902
235 e602c5f974ac Make a cron job for updating Wordpress IBBoard <dev@ibboard.co.uk> parents: 200 diff changeset	903 cron { 'wordpress_cron':
e602c5f974ac Make a cron job for updating Wordpress IBBoard <dev@ibboard.co.uk> parents: 200 diff changeset	904 # Run "php -f wp-cron.php" on a schedule so that we can auto-update
e602c5f974ac Make a cron job for updating Wordpress IBBoard <dev@ibboard.co.uk> parents: 200 diff changeset	905 # without giving Apache full write access!
e602c5f974ac Make a cron job for updating Wordpress IBBoard <dev@ibboard.co.uk> parents: 200 diff changeset	906 command => "/usr/local/bin/bdstrike-cron",
459 d7af40e44502 Use Apache for BDStrike cron to fix post-update warnings IBBoard <dev@ibboard.co.uk> parents: 458 diff changeset	907 user => $website::apache_user,
235 e602c5f974ac Make a cron job for updating Wordpress IBBoard <dev@ibboard.co.uk> parents: 200 diff changeset	908 minute => '*/15',
e602c5f974ac Make a cron job for updating Wordpress IBBoard <dev@ibboard.co.uk> parents: 200 diff changeset	909 }
145 88f38ef7359f Add BDStrike domains IBBoard <dev@ibboard.co.uk> parents: 142 diff changeset	910 }
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	911 class devsite ($proxy_4to6_ip) {
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	912 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 {
418 dd12bb713260 Fix mod_wsgi package install on CentOS IBBoard <dev@ibboard.co.uk> parents: 417 diff changeset	913 $package_name = 'python3-mod_wsgi'
dd12bb713260 Fix mod_wsgi package install on CentOS IBBoard <dev@ibboard.co.uk> parents: 417 diff changeset	914 $mod_path = 'mod_wsgi_python3.so'
261 c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	915 } else {
418 dd12bb713260 Fix mod_wsgi package install on CentOS IBBoard <dev@ibboard.co.uk> parents: 417 diff changeset	916 $package_name = undef
dd12bb713260 Fix mod_wsgi package install on CentOS IBBoard <dev@ibboard.co.uk> parents: 417 diff changeset	917 $mod_path = undef
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	918 }
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	919 class { 'apache::mod::wsgi':
418 dd12bb713260 Fix mod_wsgi package install on CentOS IBBoard <dev@ibboard.co.uk> parents: 417 diff changeset	920 package_name => $package_name,
dd12bb713260 Fix mod_wsgi package install on CentOS IBBoard <dev@ibboard.co.uk> parents: 417 diff changeset	921 mod_path => $mod_path,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	922 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	923
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	924 website::https::multitld { 'dev.ibboard':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	925 proxy_4to6_ip => $proxy_4to6_ip,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	926 #Make sure we're the first one hit for the tiny fraction of "no support" cases we care about (potentially Python for Mercurial!)
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	927 # http://en.wikipedia.org/wiki/Server_Name_Indication#No_support
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	928 priority => 1,
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	929 letsencrypt_name => 'dev.ibboard.co.uk',
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	930 custom_fragment => template("privat/apache/dev.fragment"),
469 e0147f345e65 Rework main vs proxy fragments and redirects IBBoard <dev@ibboard.co.uk> parents: 468 diff changeset	931 non_proxy_fragment => template("privat/apache/dev-nonproxy.fragment"),
52 be1e9773a12c Mercurial repo versions index.php files etc, so removing index.php breaks things! IBBoard <dev@ibboard.co.uk> parents: 44 diff changeset	932 force_no_index => false,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	933 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	934 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	935
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	936 class webmailpimsite ($proxy_4to6_ip_pim, $proxy_4to6_ip_webmail) {
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	937 # Webmail and Personal Information Management (PIM) sites
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	938 website::https { 'webmail.ibboard.co.uk':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	939 proxy_4to6_ip => $proxy_4to6_ip_webmail,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	940 force_no_index => false,
414 23eac935cffa Switch to LetsEncrypt on Webmail IBBoard <dev@ibboard.co.uk> parents: 413 diff changeset	941 letsencrypt_name => 'webmail.ibboard.co.uk',
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	942 custom_fragment => template("privat/apache/webmail.fragment"),
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	943 }
396 e93588ec1ce3 Use "param" variables for settings instead of conditions IBBoard <dev@ibboard.co.uk> parents: 393 diff changeset	944 include ::apache::params
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	945 website::https { 'pim.ibboard.co.uk':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	946 proxy_4to6_ip => $proxy_4to6_ip_pim,
396 e93588ec1ce3 Use "param" variables for settings instead of conditions IBBoard <dev@ibboard.co.uk> parents: 393 diff changeset	947 docroot_owner => $apache::params::user,
242 7d8e664ebcc9 Change owner/group on Nextcloud for easy upgrade IBBoard <dev@ibboard.co.uk> parents: 241 diff changeset	948 docroot_group => 'editors',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	949 force_no_index => false,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	950 lockdown_requests => false,
429 fa3093f2dc8e Migrate NextCloud to LetsEncrypt IBBoard <dev@ibboard.co.uk> parents: 426 diff changeset	951 letsencrypt_name => 'pim.ibboard.co.uk',
265 bf2b8912c414 Make PIM site skip CSP headers - NextCloud manages them IBBoard <dev@ibboard.co.uk> parents: 264 diff changeset	952 csp => false,
bf2b8912c414 Make PIM site skip CSP headers - NextCloud manages them IBBoard <dev@ibboard.co.uk> parents: 264 diff changeset	953 csp_report => false,
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	954 custom_fragment => template("privat/apache/pim.fragment"),
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	955 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	956 cron { 'owncloudcron':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	957 command => "/usr/local/bin/owncloud-cron",
402 76d18a918e7f Switch to more parameters IBBoard <dev@ibboard.co.uk> parents: 401 diff changeset	958 user => $apache::params::user,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	959 minute => '*/15',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	960 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	961 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	962
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	963 class email (
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	964 $mailserver,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	965 $imapserver,
311 51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use IBBoard <dev@ibboard.co.uk> parents: 310 diff changeset	966 $mailserver_ip,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	967 $proxy_ip = undef,
311 51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use IBBoard <dev@ibboard.co.uk> parents: 310 diff changeset	968 $proxy_upstream = [],
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	969 $nat64_ranges = [],
63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	970 $mailrelays = [],
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	971 ){
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	972 class { 'postfix':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	973 mailserver => $mailserver,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	974 mailserver_ip => $mailserver_ip,
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	975 mailserver_proxy => $proxy_ip,
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	976 proxy_upstream => $proxy_upstream,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	977 mailrelays => $mailrelays,
63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	978 nat64_ranges => $nat64_ranges,
317 2a20a5b7f65a Swap IPv6 Postfix to "all" protocols to support PROXY IBBoard <dev@ibboard.co.uk> parents: 313 diff changeset	979 protocols => $mailserver_ip =~ Stdlib::IP::Address::V6 ? { true => 'all', default => 'ipv4' },
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	980 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	981 class { 'dovecot':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	982 imapserver => $imapserver,
311 51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use IBBoard <dev@ibboard.co.uk> parents: 310 diff changeset	983 imapserver_ip => $mailserver_ip,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	984 imapserver_proxy => $proxy_ip,
311 51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use IBBoard <dev@ibboard.co.uk> parents: 310 diff changeset	985 proxy_upstream => $proxy_upstream,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	986 }
177 1b605c38b375 Add missing dependencies for SpamAssassin rules IBBoard <dev@ibboard.co.uk> parents: 176 diff changeset	987 # Unspecified SpamAssassin config dependencies that started
1b605c38b375 Add missing dependencies for SpamAssassin rules IBBoard <dev@ibboard.co.uk> parents: 176 diff changeset	988 # showing up as errors in our logs
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	989 if $osfamily == 'RedHat' {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	990 $spamassassin_deps = ['perl-File-MimeInfo']
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	991 $spamassassin_dir = '/etc/mail/spamassassin/'
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	992 $amavis_config = '/etc/amavisd/amavisd.conf'
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	993 $amavis_rundir = '/var/run/amavisd'
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	994 $amavis_spooldir = '/var/spool/amavisd'
464 117680ac22af Amavis spool dir and add Tumblock to CSP headers IBBoard <dev@ibboard.co.uk> parents: 461 diff changeset	995 $amavis_quarantinedir = '/var/spool/amavisd/quarantine'
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	996 $amavis_service = 'amavisd'
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	997 # CentOS has a Clam service, but we call on demand (Ubuntu doesn't have a service)
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	998 service { 'clamd@amavisd':
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	999 ensure => 'stopped',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1000 enable=> 'mask',
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1001 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1002 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1003 elsif $osfamily == 'Debian' {
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1004 $spamassassin_deps = ['libfile-mimeinfo-perl']
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1005 $spamassassin_dir = '/etc/spamassassin/'
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	1006 $amavis_config = '/etc/amavis/conf.d/60-puppeted'
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	1007 $amavis_rundir = '/var/run/amavis'
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	1008 $amavis_spooldir = '/var/lib/amavis'
464 117680ac22af Amavis spool dir and add Tumblock to CSP headers IBBoard <dev@ibboard.co.uk> parents: 461 diff changeset	1009 $amavis_quarantinedir = '/var/spool/amavisd/quarantine'
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1010 $amavis_service = 'amavis'
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1011 }
df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1012 package { $spamassassin_deps:
177 1b605c38b375 Add missing dependencies for SpamAssassin rules IBBoard <dev@ibboard.co.uk> parents: 176 diff changeset	1013 ensure => installed,
1b605c38b375 Add missing dependencies for SpamAssassin rules IBBoard <dev@ibboard.co.uk> parents: 176 diff changeset	1014 }
140 6eef7cec8658 Remove ClamAV from server config IBBoard <dev@ibboard.co.uk> parents: 139 diff changeset	1015 package { [ 'amavisd-new' ]:
85 50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	1016 ensure => installed,
50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	1017 tag => 'av',
50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	1018 }
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1019 service { $amavis_service:
86 4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot! IBBoard <dev@ibboard.co.uk> parents: 85 diff changeset	1020 ensure => 'running',
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot! IBBoard <dev@ibboard.co.uk> parents: 85 diff changeset	1021 enable => 'true',
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot! IBBoard <dev@ibboard.co.uk> parents: 85 diff changeset	1022 }
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	1023 file { $amavis_config:
85 50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	1024 ensure => present,
449 4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	1025 content => epp('privat/postfix/amavis.conf.epp',
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	1026 {
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	1027 fqdn => $::fqdn,
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	1028 rundir => $amavis_rundir,
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	1029 spooldir => $amavis_spooldir,
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	1030 quarantinedir => $amavis_quarantinedir,
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	1031 }
4a6ad700cded Update config for real Raspberry Pi host IBBoard <dev@ibboard.co.uk> parents: 448 diff changeset	1032 ),
85 50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	1033 tag => 'av',
50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	1034 }
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1035 file { "${spamassassin_dir}local.cf":
163 4e53d77fa586 Manage SpamAssassin local config IBBoard <dev@ibboard.co.uk> parents: 162 diff changeset	1036 ensure => present,
4e53d77fa586 Manage SpamAssassin local config IBBoard <dev@ibboard.co.uk> parents: 162 diff changeset	1037 source => 'puppet:///private/postfix/spamassassin-local.cf',
4e53d77fa586 Manage SpamAssassin local config IBBoard <dev@ibboard.co.uk> parents: 162 diff changeset	1038 tag => 'av',
4e53d77fa586 Manage SpamAssassin local config IBBoard <dev@ibboard.co.uk> parents: 162 diff changeset	1039 }
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1040 file { "${spamassassin_dir}ole2macro.cf":
142 dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	1041 ensure => present,
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	1042 source => 'puppet:///common/ole2macro.cf',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	1043 tag => 'av',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	1044 }
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1045 file { "${spamassassin_dir}ole2macro.pm":
142 dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	1046 ensure => present,
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	1047 source => 'puppet:///common/spamassassin-vba-macro-master/ole2macro.pm',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	1048 tag => 'av',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	1049 }
85 50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	1050 Package<\| tag == 'av' \|> -> File<\| tag == 'av' \|>
87 6be21a984126 Make sure that config file changes for changes trigger a reload IBBoard <dev@ibboard.co.uk> parents: 86 diff changeset	1051 File<\| tag == 'av' \|> {
390 df5ad1612af7 Adapt configs to support Ubuntu IBBoard <dev@ibboard.co.uk> parents: 385 diff changeset	1052 notify => Service[$amavis_service],
87 6be21a984126 Make sure that config file changes for changes trigger a reload IBBoard <dev@ibboard.co.uk> parents: 86 diff changeset	1053 }
125 ca711ab45f17 Schedule Postwhite to run regularly IBBoard <dev@ibboard.co.uk> parents: 122 diff changeset	1054 cron { 'Postwhite':
129 16a931df5fd7 Filter what we see in Postwhite cron output IBBoard <dev@ibboard.co.uk> parents: 128 diff changeset	1055 command => "/usr/local/bin/postwhite 2>&1\| grep -vE '^(Starting\|Recursively\|Getting\|Querying\|Removing\|Sorting\|$)'",
125 ca711ab45f17 Schedule Postwhite to run regularly IBBoard <dev@ibboard.co.uk> parents: 122 diff changeset	1056 user => 'root',
ca711ab45f17 Schedule Postwhite to run regularly IBBoard <dev@ibboard.co.uk> parents: 122 diff changeset	1057 weekday => 0,
128 379089631403 Fix rookie cron mistake - don't run Postwhite EVERY MINUTE! IBBoard <dev@ibboard.co.uk> parents: 126 diff changeset	1058 hour => 2,
379089631403 Fix rookie cron mistake - don't run Postwhite EVERY MINUTE! IBBoard <dev@ibboard.co.uk> parents: 126 diff changeset	1059 minute => 0,
125 ca711ab45f17 Schedule Postwhite to run regularly IBBoard <dev@ibboard.co.uk> parents: 122 diff changeset	1060 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1061 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1062
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1063 class cronjobs {
447 1a9de0661666 Add missing package/dir for minimal Ubuntu IBBoard <dev@ibboard.co.uk> parents: 446 diff changeset	1064 package { 'cron':
1a9de0661666 Add missing package/dir for minimal Ubuntu IBBoard <dev@ibboard.co.uk> parents: 446 diff changeset	1065 ensure => installed,
1a9de0661666 Add missing package/dir for minimal Ubuntu IBBoard <dev@ibboard.co.uk> parents: 446 diff changeset	1066 name => $operatingsystem == 'Ubuntu' ? { true => 'cron', default => 'cronie' }
1a9de0661666 Add missing package/dir for minimal Ubuntu IBBoard <dev@ibboard.co.uk> parents: 446 diff changeset	1067 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1068 # Add Mutt for scripts that send emails, but stop it clogging the disk by keeping copies of emails
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1069 package { 'mutt':
131 0dd899a10ee1 Change all "latest" packages to "installed" IBBoard <dev@ibboard.co.uk> parents: 129 diff changeset	1070 ensure => installed,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1071 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1072 file { '/etc/Muttrc.local':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1073 content => 'set copy = no',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1074 require => Package['mutt'],
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1075 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1076
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1077 # General server-wide cron jobs
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1078 Cron { user => 'root' }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1079 cron { 'backupalldbs':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1080 command => "/usr/local/bin/backupalldbs",
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1081 monthday => "*/2",
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1082 hour => "4",
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1083 minute => "9"
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1084 }
323 002203790815 Stop running Great Firewall Against China on IPv6 machines IBBoard <dev@ibboard.co.uk> parents: 322 diff changeset	1085 # Only run the Great Firewall Against China on IPv4 (since we don't have an IPv6 list
002203790815 Stop running Great Firewall Against China on IPv6 machines IBBoard <dev@ibboard.co.uk> parents: 322 diff changeset	1086 # and the PROXY forwards the IPs to services, but not at the network level)
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1087 cron { 'greatfirewallofchina':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1088 command => '/usr/local/bin/update-great-firewall-of-china',
323 002203790815 Stop running Great Firewall Against China on IPv6 machines IBBoard <dev@ibboard.co.uk> parents: 322 diff changeset	1089 ensure => has_key($facts, 'ipaddress') ? { true => "present", default => "absent" },
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1090 hour => 3,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1091 minute => 30
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1092 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1093 cron { 'permissions':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1094 command => '/usr/local/bin/set-permissions',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1095 hour => 3,
14 534e584f21ce Tweak time on permission setting script so that it is less likely to clash with LoadAVG run every 6 minutes IBBoard <dev@ibboard.co.uk> parents: 13 diff changeset	1096 minute => 2
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1097 }
55 ce8eaaca6a34 Update firewalling so that we block the right ports when using iptables directly IBBoard <dev@ibboard.co.uk> parents: 54 diff changeset	1098 # Since we're only managing the local server, use our script that wraps "puppet apply" instead of PuppetMaster
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1099 cron { 'puppet':
268 9f054191b9db Filter new log line from puppet-apply output IBBoard <dev@ibboard.co.uk> parents: 267 diff changeset	1100 command => '/usr/local/bin/puppet-apply \| grep -v "Compiled catalog for\\|Finished catalog run in\\|Applied catalog in"',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1101 hour => '*/6',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1102 minute => 5
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1103 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1104 cron { 'purgecaches':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1105 command => "/usr/local/bin/purge-caches",
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1106 hour => '4',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1107 minute => '15',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1108 weekday => '1',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1109 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1110 # Notify of uncommitted files
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1111 cron { 'check-mercurial-committed':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1112 command => "/usr/local/bin/check-hg-status",
473 9437c6ffa07c Fix hg dirstate change by changing cron user IBBoard <dev@ibboard.co.uk> parents: 471 diff changeset	1113 user => $defaultusers::default_user,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1114 hour => '4',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1115 minute => '20',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1116 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1117 }
93 74678cd7a200 Run cron job to notify of available updates IBBoard <dev@ibboard.co.uk> parents: 91 diff changeset	1118 # Notify of available updates
74678cd7a200 Run cron job to notify of available updates IBBoard <dev@ibboard.co.uk> parents: 91 diff changeset	1119 cron { 'check-yum-updates':
455 a32771c91043 Switch updates available/restart required to script IBBoard <dev@ibboard.co.uk> parents: 454 diff changeset	1120 ensure => absent,
a32771c91043 Switch updates available/restart required to script IBBoard <dev@ibboard.co.uk> parents: 454 diff changeset	1121 }
a32771c91043 Switch updates available/restart required to script IBBoard <dev@ibboard.co.uk> parents: 454 diff changeset	1122 cron { 'check-for-updates':
a32771c91043 Switch updates available/restart required to script IBBoard <dev@ibboard.co.uk> parents: 454 diff changeset	1123 command => '/usr/local/bin/check-updates',
93 74678cd7a200 Run cron job to notify of available updates IBBoard <dev@ibboard.co.uk> parents: 91 diff changeset	1124 hour => '4',
74678cd7a200 Run cron job to notify of available updates IBBoard <dev@ibboard.co.uk> parents: 91 diff changeset	1125 minute => '30',
74678cd7a200 Run cron job to notify of available updates IBBoard <dev@ibboard.co.uk> parents: 91 diff changeset	1126 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
74678cd7a200 Run cron job to notify of available updates IBBoard <dev@ibboard.co.uk> parents: 91 diff changeset	1127 }
97 b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart IBBoard <dev@ibboard.co.uk> parents: 96 diff changeset	1128 # And check whether anything needs restarting
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart IBBoard <dev@ibboard.co.uk> parents: 96 diff changeset	1129 cron { 'check-needs-restarting':
455 a32771c91043 Switch updates available/restart required to script IBBoard <dev@ibboard.co.uk> parents: 454 diff changeset	1130 command => '/usr/local/bin/needs-restarting',
97 b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart IBBoard <dev@ibboard.co.uk> parents: 96 diff changeset	1131 hour => '4',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart IBBoard <dev@ibboard.co.uk> parents: 96 diff changeset	1132 minute => '45',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart IBBoard <dev@ibboard.co.uk> parents: 96 diff changeset	1133 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart IBBoard <dev@ibboard.co.uk> parents: 96 diff changeset	1134 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	1135 }

Mercurial > repos > other > Puppet

annotate manifests/templates.pp @ 476:b0531370e183