Mercurial > repos > other > Puppet
annotate manifests/templates.pp @ 141:ce6aafd0880b puppet-3.6
Make GG DB backup less frequent now that site is closing
author | IBBoard <dev@ibboard.co.uk> |
---|---|
date | Wed, 18 Jan 2017 21:13:20 +0000 |
parents | 6eef7cec8658 |
children | dae1088dd218 |
rev | line source |
---|---|
32
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
1 # Make sure packages come after their repos |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
2 YumRepo<| |> -> Package<| |> |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
3 |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
4 # Make sure all files are in place before starting services |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
5 File<| |> -> Service<| |> |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
6 |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
7 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
8 class basenode { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
9 $os = $operatingsystem |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
10 $osver = "v${operatingsystemrelease}" |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
11 include sudo |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
12 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
13 include defaultusers |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
14 include logwatch |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
15 |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
16 file { '/etc/puppet/hiera.yaml': |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
17 ensure => present, |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
18 content => "--- |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
19 :backends: yaml |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
20 :yaml: |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
21 :datadir: /var/lib/hiera |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
22 :hierarchy: common |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
23 :logger: console", |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
24 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
25 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
26 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
27 class basevpsnode ( |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
28 $primary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
29 $secondary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
30 $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
31 $imapserver, |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
32 $firewall_cmd = 'iptables', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
33 ) { |
44
546dfa011f58
Remove "puppet" host name because we don't need it
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
34 |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
35 if $firewall_cmd == 'iptables' { |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
36 include vpsfirewall |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
37 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
38 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
39 #VPS is a self-mastered Puppet machine, so bodge a Hosts file |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
40 file { '/etc/hosts': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
41 ensure => present, |
44
546dfa011f58
Remove "puppet" host name because we don't need it
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
42 content => "127.0.0.1 localhost |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
43 $primary_ip ${fqdn}", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
44 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
45 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
46 require repos |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
47 include basenode |
41
765bf01c2044
Load custom "private" rules/config
IBBoard <dev@ibboard.co.uk>
parents:
40
diff
changeset
|
48 include private |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
49 include dnsresolver |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
50 include ssh::server |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
51 include vcs::server |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
52 include vcs::client |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
53 class { 'webserver': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
54 primary_ip => $primary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
55 secondary_ip => $secondary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
56 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
57 include cronjobs |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
58 include logrotate |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
59 class { 'fail2ban': |
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
60 firewall_cmd => $firewall_cmd, |
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
61 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
62 include tools |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
63 class { 'email': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
64 mailserver => $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
65 imapserver => $imapserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
66 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
67 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
68 |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
69 ## Classes to allow facet behaviour using preconfigured setups of classes |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
70 |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
71 class vpsfirewall { |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
72 resources { "firewall": |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
73 purge => false, |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
74 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
75 firewallchain { 'INPUT:filter:IPv4': |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
76 purge => true, |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
77 ignore => [ |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
78 '-j f2b-[^ ]+$', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
79 '^(:|-A )f2b-', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
80 '--comment "Great Firewall of China"', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
81 '--comment "Do not purge', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
82 ], |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
83 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
84 Firewall { |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
85 before => Class['my_fw::post'], |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
86 require => Class['my_fw::pre'], |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
87 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
88 class { ['my_fw::pre', 'my_fw::post']: } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
89 class { 'firewall': } |
64
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
90 firewall { '010 Whitelist Googlebot': |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
91 source => '66.249.64.0/19', |
91
61a79ae833cb
Follow the documentation properly and specify dport, not just port
IBBoard <dev@ibboard.co.uk>
parents:
87
diff
changeset
|
92 dport => [80,443], |
64
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
93 proto => tcp, |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
94 action => accept, |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
95 } |
122
033282abfc28
Blacklist more spamming IPs (with a ######.info domain)
IBBoard <dev@ibboard.co.uk>
parents:
118
diff
changeset
|
96 firewall { '099 Blacklist spammers 1': |
91
61a79ae833cb
Follow the documentation properly and specify dport, not just port
IBBoard <dev@ibboard.co.uk>
parents:
87
diff
changeset
|
97 source => '146.0.229.80/28', |
61a79ae833cb
Follow the documentation properly and specify dport, not just port
IBBoard <dev@ibboard.co.uk>
parents:
87
diff
changeset
|
98 dport => [465, 25], |
61a79ae833cb
Follow the documentation properly and specify dport, not just port
IBBoard <dev@ibboard.co.uk>
parents:
87
diff
changeset
|
99 proto => tcp, |
61a79ae833cb
Follow the documentation properly and specify dport, not just port
IBBoard <dev@ibboard.co.uk>
parents:
87
diff
changeset
|
100 action => 'reject', |
61a79ae833cb
Follow the documentation properly and specify dport, not just port
IBBoard <dev@ibboard.co.uk>
parents:
87
diff
changeset
|
101 } |
122
033282abfc28
Blacklist more spamming IPs (with a ######.info domain)
IBBoard <dev@ibboard.co.uk>
parents:
118
diff
changeset
|
102 firewall { '099 Blacklist spammers 2': |
033282abfc28
Blacklist more spamming IPs (with a ######.info domain)
IBBoard <dev@ibboard.co.uk>
parents:
118
diff
changeset
|
103 source => '89.43.62.0/24', |
033282abfc28
Blacklist more spamming IPs (with a ######.info domain)
IBBoard <dev@ibboard.co.uk>
parents:
118
diff
changeset
|
104 dport => [465, 25], |
033282abfc28
Blacklist more spamming IPs (with a ######.info domain)
IBBoard <dev@ibboard.co.uk>
parents:
118
diff
changeset
|
105 proto => tcp, |
033282abfc28
Blacklist more spamming IPs (with a ######.info domain)
IBBoard <dev@ibboard.co.uk>
parents:
118
diff
changeset
|
106 action => 'reject', |
033282abfc28
Blacklist more spamming IPs (with a ######.info domain)
IBBoard <dev@ibboard.co.uk>
parents:
118
diff
changeset
|
107 } |
139
abaf384dc939
Block another annoying IP with a firewall rule
IBBoard <dev@ibboard.co.uk>
parents:
137
diff
changeset
|
108 # German server that did 5000+ HEAD requests in <10 days to "/" on one site |
abaf384dc939
Block another annoying IP with a firewall rule
IBBoard <dev@ibboard.co.uk>
parents:
137
diff
changeset
|
109 firewall { '099 Blacklist spammers 3': |
abaf384dc939
Block another annoying IP with a firewall rule
IBBoard <dev@ibboard.co.uk>
parents:
137
diff
changeset
|
110 source => '78.47.182.152', |
abaf384dc939
Block another annoying IP with a firewall rule
IBBoard <dev@ibboard.co.uk>
parents:
137
diff
changeset
|
111 dport => [465, 25], |
abaf384dc939
Block another annoying IP with a firewall rule
IBBoard <dev@ibboard.co.uk>
parents:
137
diff
changeset
|
112 proto => tcp, |
abaf384dc939
Block another annoying IP with a firewall rule
IBBoard <dev@ibboard.co.uk>
parents:
137
diff
changeset
|
113 action => 'reject', |
abaf384dc939
Block another annoying IP with a firewall rule
IBBoard <dev@ibboard.co.uk>
parents:
137
diff
changeset
|
114 } |
118
f0a86e36d33f
Ban IODC bot, because they can't behave and don't have robots.txt instructions
IBBoard <dev@ibboard.co.uk>
parents:
110
diff
changeset
|
115 firewall { '099 Blacklist IODC bot': |
f0a86e36d33f
Ban IODC bot, because they can't behave and don't have robots.txt instructions
IBBoard <dev@ibboard.co.uk>
parents:
110
diff
changeset
|
116 # IODC bot makes too many bad requests, and contact form is broken |
f0a86e36d33f
Ban IODC bot, because they can't behave and don't have robots.txt instructions
IBBoard <dev@ibboard.co.uk>
parents:
110
diff
changeset
|
117 # They don't publish a robots.txt name, so firewall it! |
f0a86e36d33f
Ban IODC bot, because they can't behave and don't have robots.txt instructions
IBBoard <dev@ibboard.co.uk>
parents:
110
diff
changeset
|
118 source => '86.153.145.149', |
f0a86e36d33f
Ban IODC bot, because they can't behave and don't have robots.txt instructions
IBBoard <dev@ibboard.co.uk>
parents:
110
diff
changeset
|
119 dport => [ 80, 443 ], |
f0a86e36d33f
Ban IODC bot, because they can't behave and don't have robots.txt instructions
IBBoard <dev@ibboard.co.uk>
parents:
110
diff
changeset
|
120 proto => tcp, |
f0a86e36d33f
Ban IODC bot, because they can't behave and don't have robots.txt instructions
IBBoard <dev@ibboard.co.uk>
parents:
110
diff
changeset
|
121 action => 'reject', |
137
4f9bc88a426a
Firewall Baidu's new Brazillian IP range for being to agressive
IBBoard <dev@ibboard.co.uk>
parents:
134
diff
changeset
|
122 } |
4f9bc88a426a
Firewall Baidu's new Brazillian IP range for being to agressive
IBBoard <dev@ibboard.co.uk>
parents:
134
diff
changeset
|
123 firewall { '099 Blacklist Baidu Brazil': |
4f9bc88a426a
Firewall Baidu's new Brazillian IP range for being to agressive
IBBoard <dev@ibboard.co.uk>
parents:
134
diff
changeset
|
124 #Baidu got a Brazilian netblock and are hitting us hard |
4f9bc88a426a
Firewall Baidu's new Brazillian IP range for being to agressive
IBBoard <dev@ibboard.co.uk>
parents:
134
diff
changeset
|
125 #Baidu doesn't honour "crawl-delay" in robots.txt |
4f9bc88a426a
Firewall Baidu's new Brazillian IP range for being to agressive
IBBoard <dev@ibboard.co.uk>
parents:
134
diff
changeset
|
126 #Baidu gets firewalled |
4f9bc88a426a
Firewall Baidu's new Brazillian IP range for being to agressive
IBBoard <dev@ibboard.co.uk>
parents:
134
diff
changeset
|
127 source => '131.161.8.0/22', |
4f9bc88a426a
Firewall Baidu's new Brazillian IP range for being to agressive
IBBoard <dev@ibboard.co.uk>
parents:
134
diff
changeset
|
128 dport => [ 80, 443 ], |
4f9bc88a426a
Firewall Baidu's new Brazillian IP range for being to agressive
IBBoard <dev@ibboard.co.uk>
parents:
134
diff
changeset
|
129 proto => tcp, |
4f9bc88a426a
Firewall Baidu's new Brazillian IP range for being to agressive
IBBoard <dev@ibboard.co.uk>
parents:
134
diff
changeset
|
130 action => 'reject', |
4f9bc88a426a
Firewall Baidu's new Brazillian IP range for being to agressive
IBBoard <dev@ibboard.co.uk>
parents:
134
diff
changeset
|
131 } |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
132 firewallchain { 'GREATFIREWALLOFCHINA:filter:IPv4': |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
133 ensure => present, |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
134 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
135 firewall { '050 Check our Great Firewall Against China': |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
136 chain => 'INPUT', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
137 jump => 'GREATFIREWALLOFCHINA', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
138 } |
64
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
139 firewallchain { 'Fail2Ban:filter:IPv4': |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
140 ensure => present, |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
141 } |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
142 firewall { '060 Check Fail2Ban': |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
143 chain => 'INPUT', |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
144 jump => 'Fail2Ban', |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
145 } |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
146 firewall { '100 allow https and http': |
91
61a79ae833cb
Follow the documentation properly and specify dport, not just port
IBBoard <dev@ibboard.co.uk>
parents:
87
diff
changeset
|
147 dport => [80, 443], |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
148 proto => tcp, |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
149 action => accept, |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
150 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
151 firewall { '101 allow SMTP': |
91
61a79ae833cb
Follow the documentation properly and specify dport, not just port
IBBoard <dev@ibboard.co.uk>
parents:
87
diff
changeset
|
152 dport => [25, 465], |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
153 proto => tcp, |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
154 action => accept, |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
155 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
156 firewall { '102 allow IMAPS': |
91
61a79ae833cb
Follow the documentation properly and specify dport, not just port
IBBoard <dev@ibboard.co.uk>
parents:
87
diff
changeset
|
157 dport => 993, |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
158 proto => tcp, |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
159 action => accept, |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
160 } |
45 | 161 # Note: SSH port will be managed separately as we |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
162 # put it on a different port to hide from script kiddy noise |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
163 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
164 |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
165 class dnsresolver { |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
166 package { 'bind': |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
167 ensure => present, |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
168 } |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
169 |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
170 service { 'named': |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
171 ensure => running, |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
172 enable => true, |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
173 } |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
174 |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
175 file { '/etc/NetworkManager/conf.d/local-dns-resolver.conf': |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
176 ensure => present, |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
177 content => "[main] |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
178 dns=none", |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
179 } |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
180 |
101
a48b6011a084
Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents:
100
diff
changeset
|
181 file { '/etc/sysconfig/named': |
a48b6011a084
Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents:
100
diff
changeset
|
182 ensure => present, |
a48b6011a084
Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents:
100
diff
changeset
|
183 content => 'OPTIONS="-4"', |
a48b6011a084
Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents:
100
diff
changeset
|
184 } |
a48b6011a084
Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents:
100
diff
changeset
|
185 |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
186 file { '/etc/resolv.conf': |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
187 ensure => present, |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
188 content => "nameserver 127.0.0.1" |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
189 } |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
190 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
191 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
192 class repos { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
193 yumrepo { 'epel': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
194 mirrorlist => 'https://mirrors.fedoraproject.org/metalink?repo=epel-$releasever&arch=$basearch', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
195 descr => "Extra Packages for Enterprise Linux", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
196 enabled => 1, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
197 failovermethod => 'priority', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
198 gpgcheck => 1, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
199 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
200 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
201 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
202 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
203 source => 'puppet:///common/RPM-GPG-KEY-EPEL-6' |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
204 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
205 yumrepo { 'ibboard': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
206 baseurl => 'http://download.opensuse.org/repositories/home:/IBBoard:/server/CentOS_CentOS-$releasever/', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
207 descr => 'IBBoard Server', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
208 enabled => 1, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
209 gpgcheck => 1, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
210 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-IBBoard-OBS', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
211 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
212 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-IBBoard-OBS': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
213 ensure => present, |
32
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
214 source => 'puppet:///common/RPM-GPG-KEY-IBBoard-OBS', |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
215 before => YumRepo['ibboard'], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
216 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
217 yumrepo { 'webtatic': |
54
30f56d6f9d33
Make Webtatic distro-specific using built-in Yum variable
IBBoard <dev@ibboard.co.uk>
parents:
48
diff
changeset
|
218 mirrorlist => 'http://mirror.webtatic.com/yum/el$releasever/$basearch/mirrorlist', |
110 | 219 descr => "Webtatic Packages for Enterprise Linux", |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
220 enabled => 1, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
221 failovermethod => 'priority', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
222 gpgcheck => 1, |
108 | 223 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-el7', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
224 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
225 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-andy': |
108 | 226 ensure => absent, |
227 } | |
228 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-el7': | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
229 ensure => present, |
108 | 230 source => 'puppet:///common/RPM-GPG-KEY-webtatic-el7', |
32
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
231 before => YumRepo['webtatic'], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
232 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
233 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
234 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
235 class tools { |
99
a0b9a810cf7d
Patch isn't a standard package on a minimal install. Make sure we have it.
IBBoard <dev@ibboard.co.uk>
parents:
97
diff
changeset
|
236 $packages = [ 'sqlite', 'bash-completion', 'nano', 'bzip2', 'mlocate', 'patch' ] |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
237 package { $packages: |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
238 ensure => installed; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
239 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
240 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
241 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
242 class logrotate { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
243 package { 'logrotate': |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
244 ensure => installed; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
245 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
246 file { '/etc/logrotate.d/httpd': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
247 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
248 source => 'puppet:///common/logrotate-httpd', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
249 require => Package['logrotate'], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
250 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
251 file { '/etc/logrotate.d/trac': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
252 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
253 source => 'puppet:///common/logrotate-trac', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
254 require => Package['logrotate'], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
255 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
256 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
257 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
258 class logwatch { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
259 package { 'logwatch': |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
260 ensure => installed; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
261 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
262 File { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
263 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
264 require => Package['logwatch'], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
265 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
266 file { '/etc/cron.daily/0logwatch': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
267 source => 'puppet:///common/0logwatch'; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
268 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
269 file { '/etc/logwatch/scripts/shared/': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
270 ensure => directory, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
271 } |
66
e424cd208b99
Update/fix Fail2Ban parsing in Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
59
diff
changeset
|
272 file { '/etc/logwatch/scripts/services/fail2ban': |
e424cd208b99
Update/fix Fail2Ban parsing in Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
59
diff
changeset
|
273 source => 'puppet:///common/logwatch/services-fail2ban', |
e424cd208b99
Update/fix Fail2Ban parsing in Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
59
diff
changeset
|
274 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
275 file { '/etc/logwatch/scripts/services/http-error': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
276 source => 'puppet:///common/logwatch/http-error', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
277 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
278 file { '/etc/logwatch/scripts/services/php': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
279 source => 'puppet:///common/logwatch/scripts_php', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
280 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
281 file { '/etc/logwatch/scripts/services/mysql': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
282 source => 'puppet:///common/logwatch/scripts_mysql', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
283 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
284 file { '/etc/logwatch/scripts/services/dovecot': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
285 source => 'puppet:///common/logwatch/dovecot', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
286 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
287 file { '/etc/logwatch/scripts/services/postfix': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
288 source => 'puppet:///common/logwatch/postfix', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
289 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
290 file { '/etc/logwatch/scripts/shared/applyhttperrordate': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
291 source => 'puppet:///common/logwatch/applyhttperrordate', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
292 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
293 file { '/etc/logwatch/conf/logwatch.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
294 content => 'Detail = Med', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
295 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
296 file { '/etc/logwatch/conf/logfiles/http.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
297 content => 'LogFile = apache/access_*.log', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
298 } |
126
8316d4e55e92
Fix Apache 2.4 Logwatch support
IBBoard <dev@ibboard.co.uk>
parents:
125
diff
changeset
|
299 file { '/etc/logwatch/conf/logfiles/http-error-24.conf': |
8316d4e55e92
Fix Apache 2.4 Logwatch support
IBBoard <dev@ibboard.co.uk>
parents:
125
diff
changeset
|
300 source => 'puppet:///common/logwatch/log-http-error.conf', |
8316d4e55e92
Fix Apache 2.4 Logwatch support
IBBoard <dev@ibboard.co.uk>
parents:
125
diff
changeset
|
301 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
302 file { '/etc/logwatch/conf/logfiles/http-error.conf': |
126
8316d4e55e92
Fix Apache 2.4 Logwatch support
IBBoard <dev@ibboard.co.uk>
parents:
125
diff
changeset
|
303 ensure=> absent, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
304 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
305 file { '/etc/logwatch/conf/services/http-error.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
306 source => 'puppet:///common/logwatch/services-http-error.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
307 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
308 file { '/etc/logwatch/conf/logfiles/php.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
309 source => 'puppet:///common/logwatch/logfiles_php.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
310 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
311 file { '/etc/logwatch/conf/services/php.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
312 source => 'puppet:///common/logwatch/services_php.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
313 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
314 file { '/etc/logwatch/conf/logfiles/mysql.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
315 source => 'puppet:///common/logwatch/logfiles_mysql.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
316 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
317 file { '/etc/logwatch/conf/services/mysql.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
318 source => 'puppet:///common/logwatch/services_mysql.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
319 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
320 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
321 |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
322 class fail2ban ( |
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
323 $firewall_cmd, |
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
324 ) { |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
325 package { 'fail2ban': |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
326 ensure => installed, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
327 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
328 service { 'fail2ban': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
329 ensure => running, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
330 enable => true |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
331 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
332 File { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
333 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
334 require => Package['fail2ban'], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
335 notify => Service['fail2ban'], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
336 } |
67
4be7f49debc2
"Already Banned" is actually at NOTICE
IBBoard <dev@ibboard.co.uk>
parents:
66
diff
changeset
|
337 file { '/etc/fail2ban/fail2ban.local': |
4be7f49debc2
"Already Banned" is actually at NOTICE
IBBoard <dev@ibboard.co.uk>
parents:
66
diff
changeset
|
338 source => 'puppet:///common/fail2ban/fail2ban.local', |
4be7f49debc2
"Already Banned" is actually at NOTICE
IBBoard <dev@ibboard.co.uk>
parents:
66
diff
changeset
|
339 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
340 file { '/etc/fail2ban/jail.local': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
341 source => 'puppet:///common/fail2ban/jail.local', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
342 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
343 file { '/etc/fail2ban/action.d/apf.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
344 source => 'puppet:///common/fail2ban/apf.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
345 } |
55
ce8eaaca6a34
Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents:
54
diff
changeset
|
346 |
ce8eaaca6a34
Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents:
54
diff
changeset
|
347 if $firewall_cmd == 'iptables' { |
ce8eaaca6a34
Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents:
54
diff
changeset
|
348 $firewall_ban_cmd = 'iptables-multiport' |
ce8eaaca6a34
Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents:
54
diff
changeset
|
349 } else { |
ce8eaaca6a34
Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents:
54
diff
changeset
|
350 $firewall_ban_cmd = $firewall_cmd |
ce8eaaca6a34
Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents:
54
diff
changeset
|
351 } |
ce8eaaca6a34
Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents:
54
diff
changeset
|
352 |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
353 file { '/etc/fail2ban/action.d/firewall-ban.conf': |
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
354 ensure => link, |
55
ce8eaaca6a34
Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents:
54
diff
changeset
|
355 target => "/etc/fail2ban/action.d/${firewall_ban_cmd}.conf", |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
356 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
357 file { '/etc/fail2ban/filter.d/ibb-apache-exploits-instaban.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
358 source => 'puppet:///common/fail2ban/ibb-apache-exploits-instaban.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
359 } |
6
b7c30595c97a
Add "Shellshock" exploit Fail2ban rule
IBBoard <dev@ibboard.co.uk>
parents:
0
diff
changeset
|
360 file { '/etc/fail2ban/filter.d/ibb-apache-shellshock.conf': |
b7c30595c97a
Add "Shellshock" exploit Fail2ban rule
IBBoard <dev@ibboard.co.uk>
parents:
0
diff
changeset
|
361 source => 'puppet:///common/fail2ban/ibb-apache-shellshock.conf', |
b7c30595c97a
Add "Shellshock" exploit Fail2ban rule
IBBoard <dev@ibboard.co.uk>
parents:
0
diff
changeset
|
362 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
363 file { '/etc/fail2ban/filter.d/ibb-repeat-offender.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
364 source => 'puppet:///common/fail2ban/ibb-repeat-offender.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
365 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
366 file { '/etc/fail2ban/filter.d/ibb-postfix-spammers.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
367 source => 'puppet:///common/fail2ban/ibb-postfix-spammers.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
368 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
369 file { '/etc/fail2ban/filter.d/ibb-postfix-malicious.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
370 source => 'puppet:///common/fail2ban/ibb-postfix-malicious.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
371 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
372 file { '/etc/fail2ban/filter.d/ibb-postfix.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
373 source => 'puppet:///common/fail2ban/ibb-postfix.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
374 } |
32
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
375 # Because one of our rules checks fail2ban's log, but the service dies without the file |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
376 file { '/var/log/fail2ban.log': |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
377 ensure => present, |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
378 owner => 'root', |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
379 group => 'root', |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
380 mode => '0600', |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
381 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
382 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
383 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
384 #Our web server with our configs, not just a stock one |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
385 class webserver ( |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
386 $primary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
387 $secondary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
388 ) { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
389 #Setup base website parameters |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
390 class { 'website': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
391 base_dir => '/srv/sites', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
392 primary_ip => $primary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
393 secondary_ip => $secondary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
394 default_owner => $defaultusers::default_user, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
395 default_group => $defaultusers::default_user, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
396 default_tld => 'co.uk', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
397 default_extra_tlds => [ 'com' ], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
398 } |
110 | 399 |
400 # Use Webtatic's PHP 7 | |
401 $php_suffix = '70w' | |
402 | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
403 #Configure the PHP version to use |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
404 class { 'website::php': |
110 | 405 suffix => $php_suffix, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
406 opcache => 'opcache', |
69
565b788f7ac1
Allow for specifying extra PHP packages (e.g. to enable Posix)
IBBoard <dev@ibboard.co.uk>
parents:
67
diff
changeset
|
407 extras => [ 'process' ], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
408 } |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
409 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
410 #Setup MySQL, using (private) templates to make sure that we set non-std passwords and a default user |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
411 |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
412 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, 7) >= 0 { |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
413 $mysqlpackage = 'mariadb' |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
414 $mysqlsuffix = '' |
48
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
45
diff
changeset
|
415 |
74
c2e5027202e2
Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents:
72
diff
changeset
|
416 $extra_packages = [ |
c2e5027202e2
Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents:
72
diff
changeset
|
417 'policycoreutils-python', # Required for SELinux |
77
eea672621e7f
Add required package for email SPF checking
IBBoard <dev@ibboard.co.uk>
parents:
76
diff
changeset
|
418 'subversion-python', #Required for Trac |
78 | 419 'perl-Sys-Syslog', #Required for Perl SPF checking |
74
c2e5027202e2
Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents:
72
diff
changeset
|
420 ] |
c2e5027202e2
Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents:
72
diff
changeset
|
421 |
c2e5027202e2
Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents:
72
diff
changeset
|
422 package { $extra_packages: |
c2e5027202e2
Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents:
72
diff
changeset
|
423 ensure => installed |
c2e5027202e2
Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents:
72
diff
changeset
|
424 } |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
425 } |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
426 else { |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
427 $mysqlpackage = 'mysql' |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
428 $mysqlsuffix = '55w' |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
429 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
430 class { 'website::mysql': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
431 mysqluser => template('defaultusers/mysql-user'), |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
432 mysqlpassword => template('defaultusers/mysql-password'), |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
433 mysqlprefix => $mysqlpackage, |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
434 mysqlsuffix => $mysqlsuffix, |
110 | 435 phpsuffix => $php_suffix, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
436 phpmysqlsuffix => 'nd' |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
437 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
438 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
439 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
440 class ibboardvpsnode ( |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
441 $primary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
442 $secondary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
443 $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
444 $imapserver, |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
445 $firewall_cmd = 'iptables', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
446 ){ |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
447 class { 'basevpsnode': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
448 primary_ip => $primary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
449 secondary_ip => $secondary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
450 mailserver => $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
451 imapserver => $imapserver, |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
452 firewall_cmd => $firewall_cmd, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
453 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
454 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
455 # Common modules used by multiple sites (mod_auth_basic is safe because we HTTPS all the things) |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
456 apache::mod { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
457 'auth_basic':; 'authn_file':; 'authz_user':; 'auth_token':;'deflate':; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
458 } |
25
13adb555a7e2
Use "<IfVersion>" to handle auth differences between 2.2 and 2.4
IBBoard <dev@ibboard.co.uk>
parents:
24
diff
changeset
|
459 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, 7) >= 0 { |
13adb555a7e2
Use "<IfVersion>" to handle auth differences between 2.2 and 2.4
IBBoard <dev@ibboard.co.uk>
parents:
24
diff
changeset
|
460 apache::mod { |
13adb555a7e2
Use "<IfVersion>" to handle auth differences between 2.2 and 2.4
IBBoard <dev@ibboard.co.uk>
parents:
24
diff
changeset
|
461 'authn_core':; |
13adb555a7e2
Use "<IfVersion>" to handle auth differences between 2.2 and 2.4
IBBoard <dev@ibboard.co.uk>
parents:
24
diff
changeset
|
462 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
463 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
464 $apache_packages = [ 'mod_auth_token' ] |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
465 package { $apache_packages: |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
466 ensure => present; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
467 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
468 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
469 #Configure our sites, using templates for the custom fragments where the extra content is too long |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
470 include adminsite |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
471 website::https::multitld { 'www.ibboard': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
472 custom_fragment => template("private/apache/ibboard.fragment"), |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
473 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
474 include hiveworldterrasite |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
475 include glittergothsite |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
476 include devsite |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
477 website::https::multitld { 'www.abiknight': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
478 custom_fragment => "$website::htmlphpfragment |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
479 ErrorDocument 404 /error.php", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
480 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
481 website::https::multitld { 'www.gracebertram': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
482 main_tld => 'com', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
483 extra_tlds => [ 'co.uk' ], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
484 docroot_owner => $defaultusers::secondary_user, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
485 docroot_group => 'editors', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
486 custom_fragment => template("private/apache/gracebertram.fragment"), |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
487 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
488 website::https { 'www.realmrunner.com': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
489 docroot => "${website::basedir}/gracebertram", # Don't give it a separate docroot because it is a redirect via the fragment |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
490 docroot_owner => $defaultusers::secondary_user, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
491 docroot_group => 'editors', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
492 serveraliases => 'realmrunner.com', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
493 custom_fragment => template("private/apache/realmrunner.fragment"), |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
494 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
495 include webmailpimsite |
13 | 496 website::http { 'lktutoring.co.uk': |
497 docroot_owner => $defaultusers::secondary_user, | |
498 docroot_group => 'editors', | |
499 serveraliases => [ 'www.lktutoring.co.uk', 'lktutoring.com', 'www.lktutoring.com' ], | |
500 ensure => 'present', | |
501 custom_fragment => 'Include conf.extra/no-index.conf | |
502 Include conf.custom/filter-core.conf | |
503 Include conf.extra/no-www.conf | |
504 Include conf.extra/no-com.conf | |
505 Include conf.extra/html-php.conf | |
506 #Additional custom fragment | |
507 ErrorDocument 404 /error.php', | |
508 } | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
509 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
510 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
511 class adminsite{ |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
512 apache::mod { 'info':; 'status':; 'cgi':; } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
513 website::https::multitld { 'admin.ibboard': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
514 force_no_index => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
515 ssl_ca_chain => '', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
516 custom_fragment => template("private/apache/admin.fragment"), |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
517 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
518 cron { 'loadavg': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
519 command => '/usr/local/bin/run-loadavg-logger', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
520 user => apache, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
521 minute => '*/6' |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
522 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
523 cron { 'awstats': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
524 command => '/usr/local/bin/update-awstats > /srv/sites/admin/awstats.log', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
525 user => apache, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
526 hour => '*/6', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
527 minute => '0' |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
528 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
529 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
530 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
531 class hiveworldterrasite { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
532 website::https::multitld { 'www.hiveworldterra': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
533 force_no_www => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
534 custom_fragment => template("private/apache/hwt.fragment"), |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
535 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
536 website::https::multitld { 'forums.hiveworldterra': |
59
851f7fa888eb
Add more complex fragment for Forums to stop hotlinking
IBBoard <dev@ibboard.co.uk>
parents:
52
diff
changeset
|
537 custom_fragment => template("private/apache/forums.fragment"), |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
538 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
539 website::https::multitld { 'skins.hiveworldterra': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
540 custom_fragment => template("private/apache/skins.fragment"), |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
541 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
542 website::https::redir { 'hiveworldterra.ibboard.co.uk': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
543 redir => 'https://www.hiveworldterra.co.uk/', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
544 docroot => "${website::basedir}/hiveworldterra", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
545 separate_log => true, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
546 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
547 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
548 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
549 class devsite { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
550 apache::mod { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
551 # mod_wsgi for Python support |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
552 'wsgi':; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
553 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
554 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
555 include python::venv |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
556 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
557 # Create Python virtualenvs for the dev site apps |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
558 python::venv::isolate { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
559 "/srv/rhodecode/virtualenv":; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
560 "/srv/trac/virtualenv":; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
561 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
562 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
563 # Graphviz for Trac "master ticket" graphs |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
564 package { 'graphviz': |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
565 ensure => installed, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
566 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
567 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
568 website::https::multitld { 'www.warfoundry': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
569 custom_fragment => template("private/apache/warfoundry.fragment"), |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
570 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
571 website::https::multitld { 'dev.ibboard': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
572 #Make sure we're the first one hit for the tiny fraction of "no support" cases we care about (potentially Python for Mercurial!) |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
573 # http://en.wikipedia.org/wiki/Server_Name_Indication#No_support |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
574 priority => 1, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
575 custom_fragment => template("private/apache/dev.fragment"), |
52
be1e9773a12c
Mercurial repo versions index.php files etc, so removing index.php breaks things!
IBBoard <dev@ibboard.co.uk>
parents:
44
diff
changeset
|
576 force_no_index => false, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
577 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
578 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
579 class glittergothsite { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
580 website::https::multitld { 'www.glittergoth': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
581 ip => $website::secondary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
582 priority => 1, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
583 ssl_ca_chain => 'glittergoth.ca-bundle', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
584 docroot_owner => $defaultusers::secondary_user, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
585 docroot_group => 'editors', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
586 force_no_index => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
587 custom_fragment => template("private/apache/glittergoth.fragment"), |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
588 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
589 website::https { 'test.glittergoth.co.uk': |
134
b1815d10eb91
Do not supply incorrect CA chain for GG Test site
IBBoard <dev@ibboard.co.uk>
parents:
131
diff
changeset
|
590 ssl_ca_chain => '', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
591 docroot => "${website::basedir}/glittergoth-test", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
592 docroot_owner => $defaultusers::secondary_user, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
593 docroot_group => 'editors', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
594 ip => $website::secondary_ip, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
595 force_no_index => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
596 custom_fragment => template("private/apache/glittergoth-test.fragment"), |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
597 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
598 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
599 # Website specific cron jobs |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
600 cron { 'backupopencart': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
601 command => "/usr/local/bin/backupdb opencart", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
602 user => 'root', |
141
ce6aafd0880b
Make GG DB backup less frequent now that site is closing
IBBoard <dev@ibboard.co.uk>
parents:
140
diff
changeset
|
603 monthday => "*/2", |
ce6aafd0880b
Make GG DB backup less frequent now that site is closing
IBBoard <dev@ibboard.co.uk>
parents:
140
diff
changeset
|
604 hour => "4", |
ce6aafd0880b
Make GG DB backup less frequent now that site is closing
IBBoard <dev@ibboard.co.uk>
parents:
140
diff
changeset
|
605 minute => "39" |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
606 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
607 cron { 'requestreviews': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
608 command => '/usr/local/bin/request-reviews 2> /srv/sites/admin/request-reviews.log', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
609 user => 'apache', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
610 hour => 4, |
103
ba526e874db0
Remove review email, as GG is shutting down
IBBoard <dev@ibboard.co.uk>
parents:
101
diff
changeset
|
611 minute => 5, |
ba526e874db0
Remove review email, as GG is shutting down
IBBoard <dev@ibboard.co.uk>
parents:
101
diff
changeset
|
612 ensure => absent, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
613 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
614 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
615 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
616 class webmailpimsite { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
617 # Webmail and Personal Information Management (PIM) sites |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
618 website::https { 'webmail.ibboard.co.uk': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
619 force_no_index => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
620 ssl_ca_chain => '', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
621 custom_fragment => template("private/apache/webmail.fragment"), |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
622 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
623 website::https { 'pim.ibboard.co.uk': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
624 force_no_index => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
625 lockdown_requests => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
626 ssl_ca_chain => '', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
627 custom_fragment => template("private/apache/pim.fragment"), |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
628 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
629 cron { 'owncloudcron': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
630 command => "/usr/local/bin/owncloud-cron", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
631 user => 'apache', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
632 minute => '*/15', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
633 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
634 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
635 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
636 class email ( |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
637 $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
638 $imapserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
639 ){ |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
640 class { 'postfix': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
641 mailserver => $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
642 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
643 class { 'dovecot': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
644 imapserver => $imapserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
645 } |
140
6eef7cec8658
Remove ClamAV from server config
IBBoard <dev@ibboard.co.uk>
parents:
139
diff
changeset
|
646 package { [ 'amavisd-new' ]: |
85 | 647 ensure => installed, |
648 tag => 'av', | |
649 } | |
86
4f59d2fcd521
Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents:
85
diff
changeset
|
650 service { 'amavisd': |
4f59d2fcd521
Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents:
85
diff
changeset
|
651 ensure => 'running', |
4f59d2fcd521
Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents:
85
diff
changeset
|
652 enable => 'true', |
4f59d2fcd521
Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents:
85
diff
changeset
|
653 } |
85 | 654 file { '/etc/amavisd/amavisd.conf': |
655 ensure => present, | |
656 source => 'puppet:///private/postfix/amavisd.conf', | |
657 tag => 'av', | |
658 } | |
659 Package<| tag == 'av' |> -> File<| tag == 'av' |> | |
87
6be21a984126
Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents:
86
diff
changeset
|
660 File<| tag == 'av' |> { |
6be21a984126
Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents:
86
diff
changeset
|
661 notify => Service['amavisd'], |
6be21a984126
Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents:
86
diff
changeset
|
662 } |
125
ca711ab45f17
Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents:
122
diff
changeset
|
663 cron { 'Postwhite': |
129
16a931df5fd7
Filter what we see in Postwhite cron output
IBBoard <dev@ibboard.co.uk>
parents:
128
diff
changeset
|
664 command => "/usr/local/bin/postwhite 2>&1| grep -vE '^(Starting|Recursively|Getting|Querying|Removing|Sorting|$)'", |
125
ca711ab45f17
Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents:
122
diff
changeset
|
665 user => 'root', |
ca711ab45f17
Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents:
122
diff
changeset
|
666 weekday => 0, |
128
379089631403
Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents:
126
diff
changeset
|
667 hour => 2, |
379089631403
Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents:
126
diff
changeset
|
668 minute => 0, |
125
ca711ab45f17
Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents:
122
diff
changeset
|
669 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
670 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
671 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
672 class cronjobs { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
673 # Add Mutt for scripts that send emails, but stop it clogging the disk by keeping copies of emails |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
674 package { 'mutt': |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
675 ensure => installed, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
676 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
677 file { '/etc/Muttrc.local': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
678 content => 'set copy = no', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
679 require => Package['mutt'], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
680 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
681 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
682 # General server-wide cron jobs |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
683 Cron { user => 'root' } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
684 cron { 'backupalldbs': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
685 command => "/usr/local/bin/backupalldbs", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
686 monthday => "*/2", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
687 hour => "4", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
688 minute => "9" |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
689 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
690 cron { 'greatfirewallofchina': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
691 command => '/usr/local/bin/update-great-firewall-of-china', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
692 hour => 3, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
693 minute => 30 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
694 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
695 cron { 'permissions': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
696 command => '/usr/local/bin/set-permissions', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
697 hour => 3, |
14
534e584f21ce
Tweak time on permission setting script so that it is less likely to clash with LoadAVG run every 6 minutes
IBBoard <dev@ibboard.co.uk>
parents:
13
diff
changeset
|
698 minute => 2 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
699 } |
55
ce8eaaca6a34
Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents:
54
diff
changeset
|
700 # Since we're only managing the local server, use our script that wraps "puppet apply" instead of PuppetMaster |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
701 cron { 'puppet': |
79
edd0e9f8af24
Hide extra output from Puppet cron job that later Puppet generates
IBBoard <dev@ibboard.co.uk>
parents:
78
diff
changeset
|
702 command => '/usr/local/bin/puppet-apply | grep -v "Compiled catalog for\|Finished catalog run in"', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
703 hour => '*/6', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
704 minute => 5 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
705 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
706 cron { 'purgecaches': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
707 command => "/usr/local/bin/purge-caches", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
708 hour => '4', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
709 minute => '15', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
710 weekday => '1', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
711 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
712 # Notify of uncommitted files |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
713 cron { 'check-mercurial-committed': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
714 command => "/usr/local/bin/check-hg-status", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
715 hour => '4', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
716 minute => '20', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
717 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
718 } |
93
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
719 # Notify of available updates |
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
720 cron { 'check-yum-updates': |
96
009a7a75ddfd
Remove repo checking cruft from potential Yum Check Update cron job output
IBBoard <dev@ibboard.co.uk>
parents:
95
diff
changeset
|
721 command => '/usr/bin/yum check-updates | tail -2 | grep -Ev "^ \* \w+: \w+"', |
93
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
722 hour => '4', |
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
723 minute => '30', |
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
724 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning |
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
725 } |
97
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
726 # And check whether anything needs restarting |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
727 cron { 'check-needs-restarting': |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
728 command => '/usr/bin/needs-restarting|grep -v "/usr/lib/systemd\|/usr/sbin/lvmetad\|/usr/lib/polkit-1/polkitd"', |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
729 hour => '4', |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
730 minute => '45', |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
731 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
732 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
733 } |