other/Puppet: manifests/templates.pp annotate

annotate manifests/templates.pp @ 378:d539c21143bb

Get more specific with extracting Yum update list The regex would still return some additional values or blank lines. The new regex has been checked against both "yum check-update" and "yum list" and matches all currently installed version strings (including weird Git ones)

author	IBBoard <dev@ibboard.co.uk>
date	Wed, 29 Sep 2021 20:25:44 +0100
parents	18765f598232
children	63adae1a374a

rev	line source
32 6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start) IBBoard <dev@ibboard.co.uk> parents: 25 diff changeset	1 # Make sure packages come after their repos
258 b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	2 File<\| tag == 'repo-config' \|> -> YumRepo<\| \|> -> Package<\| \|>
32 6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start) IBBoard <dev@ibboard.co.uk> parents: 25 diff changeset	3
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start) IBBoard <dev@ibboard.co.uk> parents: 25 diff changeset	4 # Make sure all files are in place before starting services
298 61e90445c899 Merge CentOS8 and CentOS7 branches IBBoard <dev@ibboard.co.uk> parents: 292 284 diff changeset	5 # FIXME: Title matches are to fix a dependency cycle
61e90445c899 Merge CentOS8 and CentOS7 branches IBBoard <dev@ibboard.co.uk> parents: 292 284 diff changeset	6 File<\| tag != 'post-service' and title != '/etc/sysconfig/ip6tables' and title != '/etc/sysconfig/iptables' \|> -> Service<\| \|>
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	7
c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	8 # Set some shortcut variables
c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	9 #$os = $operatingsystem
249 e9323ff8f451 Make EPEL work on multiple versions of CentOS IBBoard <dev@ibboard.co.uk> parents: 247 diff changeset	10 $osver = $operatingsystemmajrelease
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	11 $server = ''
32 6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start) IBBoard <dev@ibboard.co.uk> parents: 25 diff changeset	12
6bbc86f6cee5 Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start) IBBoard <dev@ibboard.co.uk> parents: 25 diff changeset	13
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	14 class basenode {
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	15 include sudo
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	16
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	17 include defaultusers
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	18 include logwatch
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	19
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	20 file { '/etc/puppet/hiera.yaml':
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	21 ensure => present,
264 ea72ea1f7320 Update Hiera to fix warnings IBBoard <dev@ibboard.co.uk> parents: 262 diff changeset	22 content => "
ea72ea1f7320 Update Hiera to fix warnings IBBoard <dev@ibboard.co.uk> parents: 262 diff changeset	23 # Let the system set defaults
ea72ea1f7320 Update Hiera to fix warnings IBBoard <dev@ibboard.co.uk> parents: 262 diff changeset	24 version: 5
ea72ea1f7320 Update Hiera to fix warnings IBBoard <dev@ibboard.co.uk> parents: 262 diff changeset	25 ",
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	26 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	27 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	28
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	29 class basevpsnode (
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	30 $primary_ip,
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	31 $proxy_4to6_ip_prefix = undef,
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	32 $proxy_upstream = undef,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	33 $nat64_ranges = [],
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	34 $mailserver,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	35 $imapserver,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	36 $mailrelays = [],
35 1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables) IBBoard <dev@ibboard.co.uk> parents: 32 diff changeset	37 $firewall_cmd = 'iptables',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	38 ) {
44 546dfa011f58 Remove "puppet" host name because we don't need it IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	39
40 222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	40 if $firewall_cmd == 'iptables' {
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	41 class { 'vpsfirewall':
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	42 fw_protocol => $primary_ip =~ Stdlib::IP::Address::V6 ? { true => 'IPv6', default => 'IPv4'},
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	43 }
40 222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	44 }
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	45
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	46 #VPS is a self-mastered Puppet machine, so bodge a Hosts file
302 01d1b0f6dbaf Fix more IPv4 vs IPv6 settings IBBoard <dev@ibboard.co.uk> parents: 301 diff changeset	47 if $primary_ip =~ Stdlib::IP::Address::V6 {
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings IBBoard <dev@ibboard.co.uk> parents: 301 diff changeset	48 $lo_ip = '::1'
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings IBBoard <dev@ibboard.co.uk> parents: 301 diff changeset	49 } else {
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings IBBoard <dev@ibboard.co.uk> parents: 301 diff changeset	50 $lo_ip = '127.0.0.1'
01d1b0f6dbaf Fix more IPv4 vs IPv6 settings IBBoard <dev@ibboard.co.uk> parents: 301 diff changeset	51 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	52 file { '/etc/hosts':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	53 ensure => present,
302 01d1b0f6dbaf Fix more IPv4 vs IPv6 settings IBBoard <dev@ibboard.co.uk> parents: 301 diff changeset	54 content => "${lo_ip} localhost\n${primary_ip} ${fqdn}",
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	55 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	56
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	57 if $proxy_4to6_ip_prefix != undef {
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	58 # …:1 to …:9 for websites, …:10 for mail
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	59 $ipv6_addresses = Integer[1, 10].map \|$octet\| { "$proxy_4to6_ip_prefix:$octet" }
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	60
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	61 $ipv6_secondaries = join($ipv6_addresses, " ")
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	62
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	63 augeas {'IPv6 secondary addresses':
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	64 context => "/files/etc/sysconfig/network-scripts/ifcfg-eth0",
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	65 changes => "set IPV6ADDR_SECONDARIES '\"$ipv6_secondaries\"'",
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	66 }
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	67 }
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	68
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	69 require repos
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	70 include basenode
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	71 include privat
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	72 include dnsresolver
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	73 include ssh::server
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	74 include vcs::server
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	75 include vcs::client
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	76 class { 'webserver':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	77 primary_ip => $primary_ip,
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	78 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	79 proxy_4to6_mask => 124,
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	80 proxy_upstream => $proxy_upstream,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	81 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	82 include cronjobs
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	83 include logrotate
35 1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables) IBBoard <dev@ibboard.co.uk> parents: 32 diff changeset	84 class { 'fail2ban':
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables) IBBoard <dev@ibboard.co.uk> parents: 32 diff changeset	85 firewall_cmd => $firewall_cmd,
1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables) IBBoard <dev@ibboard.co.uk> parents: 32 diff changeset	86 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	87 include tools
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	88 class { 'email':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	89 mailserver => $mailserver,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	90 imapserver => $imapserver,
311 51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use IBBoard <dev@ibboard.co.uk> parents: 310 diff changeset	91 mailserver_ip => $primary_ip,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	92 proxy_ip => $proxy_4to6_ip_prefix != undef ? { true => "${proxy_4to6_ip_prefix}:10", default => undef },
311 51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use IBBoard <dev@ibboard.co.uk> parents: 310 diff changeset	93 proxy_upstream => $proxy_upstream,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	94 nat64_ranges => $nat64_ranges,
63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	95 mailrelays => $mailrelays,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	96 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	97 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	98
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	99 ## Classes to allow facet behaviour using preconfigured setups of classes
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	100
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	101 class vpsfirewall ($fw_protocol) {
40 222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	102 resources { "firewall":
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	103 purge => false,
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	104 }
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	105 class { "my_fw":
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	106 ip_version => $fw_protocol,
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	107 }
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	108 # Control what does and doesn't get pruned in the main filter chain
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	109 firewallchain { "INPUT:filter:$fw_protocol":
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	110 purge => true,
40 222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	111 ignore => [
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	112 '-j f2b-[^ ]+$',
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	113 '^(:\|-A )f2b-',
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	114 '--comment "Great Firewall of China"',
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	115 '--comment "Do not purge',
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	116 ],
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	117 }
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	118 if ($fw_protocol != "IPv6") {
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	119 firewall { '010 Whitelist Googlebot':
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	120 source => '66.249.64.0/19',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	121 dport => [80,443],
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	122 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	123 action => accept,
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	124 }
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	125 # Block a spammer hitting our contact forms (also on StopForumSpam list A LOT)
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	126 firewall { '099 Blacklist spammers 1':
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	127 source => '107.181.78.172',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	128 dport => [80, 443],
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	129 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	130 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	131 }
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	132 firewall { '099 Blacklist IODC bot':
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	133 # IODC bot makes too many bad requests, and contact form is broken
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	134 # They don't publish a robots.txt name, so firewall it!
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	135 source => '86.153.145.149',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	136 dport => [ 80, 443 ],
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	137 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	138 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	139 }
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	140 firewall { '099 Blacklist Baidu Brazil':
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	141 #Baidu got a Brazilian netblock and are hitting us hard
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	142 #Baidu doesn't honour "crawl-delay" in robots.txt
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	143 #Baidu gets firewalled
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	144 source => '131.161.8.0/22',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	145 dport => [ 80, 443 ],
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	146 proto => tcp,
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	147 action => 'reject',
e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	148 }
139 abaf384dc939 Block another annoying IP with a firewall rule IBBoard <dev@ibboard.co.uk> parents: 137 diff changeset	149 }
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	150 firewallchain { "GREATFIREWALLOFCHINA:filter:$fw_protocol":
40 222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	151 ensure => present,
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	152 }
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	153 firewall { '050 Check our Great Firewall Against China':
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	154 chain => 'INPUT',
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	155 jump => 'GREATFIREWALLOFCHINA',
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	156 }
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	157 firewallchain { "Fail2Ban:filter:$fw_protocol":
64 3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons) IBBoard <dev@ibboard.co.uk> parents: 61 diff changeset	158 ensure => present,
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons) IBBoard <dev@ibboard.co.uk> parents: 61 diff changeset	159 }
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons) IBBoard <dev@ibboard.co.uk> parents: 61 diff changeset	160 firewall { '060 Check Fail2Ban':
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons) IBBoard <dev@ibboard.co.uk> parents: 61 diff changeset	161 chain => 'INPUT',
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons) IBBoard <dev@ibboard.co.uk> parents: 61 diff changeset	162 jump => 'Fail2Ban',
3bb824dabaae Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons) IBBoard <dev@ibboard.co.uk> parents: 61 diff changeset	163 }
40 222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	164 }
222904296578 Add firewall handling when we run without APF IBBoard <dev@ibboard.co.uk> parents: 38 diff changeset	165
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	166 class dnsresolver {
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	167 package { 'unbound':
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	168 ensure => present,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	169 }
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	170 package { 'named':
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	171 ensure => absent,
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	172 }
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	173
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	174 service { 'named':
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	175 ensure => stopped,
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	176 enable => false,
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	177 }
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	178 service { 'unbound':
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	179 ensure => running,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	180 enable => true,
194 a08de3153548 Add a named.conf file to control cache/memory size IBBoard <dev@ibboard.co.uk> parents: 193 diff changeset	181 }
a08de3153548 Add a named.conf file to control cache/memory size IBBoard <dev@ibboard.co.uk> parents: 193 diff changeset	182
a08de3153548 Add a named.conf file to control cache/memory size IBBoard <dev@ibboard.co.uk> parents: 193 diff changeset	183 file { '/etc/named.conf':
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	184 ensure => absent,
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	185 }
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	186 file { '/etc/unbound/unbound.conf':
194 a08de3153548 Add a named.conf file to control cache/memory size IBBoard <dev@ibboard.co.uk> parents: 193 diff changeset	187 ensure => present,
247 308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	188 source => [
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	189 "puppet:///common/unbound.conf-${::hostname}",
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	190 "puppet:///common/unbound.conf",
247 308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	191 ],
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	192 require => Package['unbound'],
1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	193 notify => Service['unbound'],
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	194 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	195
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	196 file { '/etc/NetworkManager/conf.d/local-dns-resolver.conf':
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	197 ensure => present,
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	198 content => "[main]
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	199 dns=none",
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	200 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	201
101 a48b6011a084 Stop Bind trying IPv6, as we only have a link-local IP IBBoard <dev@ibboard.co.uk> parents: 100 diff changeset	202 file { '/etc/sysconfig/named':
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	203 ensure => absent,
101 a48b6011a084 Stop Bind trying IPv6, as we only have a link-local IP IBBoard <dev@ibboard.co.uk> parents: 100 diff changeset	204 }
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	205 file { '/etc/resolv.conf':
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	206 ensure => present,
301 1bfc290270cc Fix sa-update by using IPv6 for local DNS cache IBBoard <dev@ibboard.co.uk> parents: 298 diff changeset	207 # "ipaddress" key only exists for machines with IPv4 addresses
1bfc290270cc Fix sa-update by using IPv6 for local DNS cache IBBoard <dev@ibboard.co.uk> parents: 298 diff changeset	208 content => has_key($facts, 'ipaddress') ? { true => "nameserver 127.0.0.1", default => "nameserver ::1" },
290 1182a180085d Swap from Bind to Named for light-weight DNS IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	209 require => Service['unbound'],
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	210 tag => 'post-service',
100 fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	211 }
fd3446c3b7b9 Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs) IBBoard <dev@ibboard.co.uk> parents: 99 diff changeset	212 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	213
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	214 class repos {
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	215 yumrepo { 'epel':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	216 mirrorlist => 'https://mirrors.fedoraproject.org/metalink?repo=epel-$releasever&arch=$basearch',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	217 descr => "Extra Packages for Enterprise Linux",
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	218 enabled => 1,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	219 failovermethod => 'priority',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	220 gpgcheck => 1,
249 e9323ff8f451 Make EPEL work on multiple versions of CentOS IBBoard <dev@ibboard.co.uk> parents: 247 diff changeset	221 gpgkey => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver",
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	222 }
249 e9323ff8f451 Make EPEL work on multiple versions of CentOS IBBoard <dev@ibboard.co.uk> parents: 247 diff changeset	223 file { "/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver":
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	224 ensure => present,
258 b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	225 source => "puppet:///common/RPM-GPG-KEY-EPEL-$osver",
b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	226 tag => 'repo-config',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	227 }
258 b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	228 yumrepo { 'ibboard':
b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	229 baseurl => 'https://download.opensuse.org/repositories/home:/IBBoard:/server/CentOS_$releasever/',
b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	230 descr => 'Extra packages from IBBoard',
b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	231 enabled => 1,
b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	232 gpgcheck => 1,
b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	233 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard',
b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	234 }
b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	235 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard':
b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	236 ensure => present,
b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	237 source => 'puppet:///common/RPM-GPG-KEY-ibboard',
b173842cabbf Update repo handling IBBoard <dev@ibboard.co.uk> parents: 250 diff changeset	238 tag => 'repo-config',
160 0d829df9cd39 Make the IBBoard repo config go away, rather than just leaving it undefined IBBoard <dev@ibboard.co.uk> parents: 159 diff changeset	239 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	240 yumrepo { 'webtatic':
238 6467e768e353 Switch to PHP 7.4 from Remi IBBoard <dev@ibboard.co.uk> parents: 236 diff changeset	241 ensure => absent,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	242 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	243 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-andy':
108 5c6edfab92d6 Swap Webtatic to new GPG key IBBoard <dev@ibboard.co.uk> parents: 103 diff changeset	244 ensure => absent,
5c6edfab92d6 Swap Webtatic to new GPG key IBBoard <dev@ibboard.co.uk> parents: 103 diff changeset	245 }
5c6edfab92d6 Swap Webtatic to new GPG key IBBoard <dev@ibboard.co.uk> parents: 103 diff changeset	246 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-el7':
238 6467e768e353 Switch to PHP 7.4 from Remi IBBoard <dev@ibboard.co.uk> parents: 236 diff changeset	247 ensure => absent,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	248 }
148 d9fcabc75a1e Fix pip installations IBBoard <dev@ibboard.co.uk> parents: 147 diff changeset	249
272 c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	250 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 {
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	251 $python_ver = 'python3'
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	252 } else {
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	253 $python_ver = 'system'
148 d9fcabc75a1e Fix pip installations IBBoard <dev@ibboard.co.uk> parents: 147 diff changeset	254 }
272 c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	255
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	256 class { 'python':
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	257 ensure => 'present',
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	258 version => $python_ver,
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	259 pip => 'present',
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	260 virtualenv => 'present',
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	261 use_epel => false,
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	262 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	263 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	264
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	265 class tools {
330 0cccb75d7639 Add rsync to tools so that backups work IBBoard <dev@ibboard.co.uk> parents: 326 diff changeset	266 $packages = [ 'sqlite', 'bash-completion', 'nano', 'bzip2', 'mlocate', 'patch', 'tmux', 'wget', 'yum-utils', 'rsync' ]
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	267 package { $packages:
131 0dd899a10ee1 Change all "latest" packages to "installed" IBBoard <dev@ibboard.co.uk> parents: 129 diff changeset	268 ensure => installed;
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	269 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	270 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	271
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	272 class logrotate {
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	273 package { 'logrotate':
131 0dd899a10ee1 Change all "latest" packages to "installed" IBBoard <dev@ibboard.co.uk> parents: 129 diff changeset	274 ensure => installed;
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	275 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	276 file { '/etc/logrotate.d/httpd':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	277 ensure => present,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	278 source => 'puppet:///common/logrotate-httpd',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	279 require => Package['logrotate'],
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	280 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	281 file { '/etc/logrotate.d/trac':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	282 ensure => present,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	283 source => 'puppet:///common/logrotate-trac',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	284 require => Package['logrotate'],
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	285 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	286 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	287
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	288 class logwatch {
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	289 package { 'logwatch':
131 0dd899a10ee1 Change all "latest" packages to "installed" IBBoard <dev@ibboard.co.uk> parents: 129 diff changeset	290 ensure => installed;
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	291 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	292 File {
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	293 ensure => present,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	294 require => Package['logwatch'],
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	295 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	296 file { '/etc/cron.daily/0logwatch':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	297 source => 'puppet:///common/0logwatch';
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	298 }
332 7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	299 $logwatch_dirs = [
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	300 '/etc/logwatch/',
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	301 '/etc/logwatch/conf/',
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	302 '/etc/logwatch/conf/logfiles/',
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	303 '/etc/logwatch/conf/services/',
345 bad68f1b6467 Add updated Dovecot script to Logwatch IBBoard <dev@ibboard.co.uk> parents: 342 diff changeset	304 '/etc/logwatch/scripts/',
bad68f1b6467 Add updated Dovecot script to Logwatch IBBoard <dev@ibboard.co.uk> parents: 342 diff changeset	305 '/etc/logwatch/scripts/services/',
332 7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	306 ]
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	307 file { $logwatch_dirs:
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	308 ensure => directory,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	309 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	310 file { '/etc/logwatch/conf/logwatch.conf':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	311 content => 'Detail = Med',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	312 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	313 file { '/etc/logwatch/conf/logfiles/http.conf':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	314 content => 'LogFile = apache/access_*.log',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	315 }
332 7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	316 file { '/etc/logwatch/conf/logfiles/http-error.conf':
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	317 source => 'puppet:///common/logwatch/logfiles_http-error.conf',
126 8316d4e55e92 Fix Apache 2.4 Logwatch support IBBoard <dev@ibboard.co.uk> parents: 125 diff changeset	318 }
332 7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	319 file { '/etc/logwatch/conf/logfiles/mysql.conf':
7198cc4397d8 Remove custom LogWatch scripts IBBoard <dev@ibboard.co.uk> parents: 331 diff changeset	320 source => 'puppet:///common/logwatch/logfiles_mysql.conf',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	321 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	322 file { '/etc/logwatch/conf/logfiles/php.conf':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	323 source => 'puppet:///common/logwatch/logfiles_php.conf',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	324 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	325 file { '/etc/logwatch/conf/services/php.conf':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	326 source => 'puppet:///common/logwatch/services_php.conf',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	327 }
345 bad68f1b6467 Add updated Dovecot script to Logwatch IBBoard <dev@ibboard.co.uk> parents: 342 diff changeset	328 file { '/etc/logwatch/scripts/services/dovecot':
bad68f1b6467 Add updated Dovecot script to Logwatch IBBoard <dev@ibboard.co.uk> parents: 342 diff changeset	329 source => 'puppet:///common/logwatch/dovecot',
bad68f1b6467 Add updated Dovecot script to Logwatch IBBoard <dev@ibboard.co.uk> parents: 342 diff changeset	330 }
346 61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch IBBoard <dev@ibboard.co.uk> parents: 345 diff changeset	331 file { '/etc/logwatch/scripts/services/postfix':
61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch IBBoard <dev@ibboard.co.uk> parents: 345 diff changeset	332 source => 'puppet:///common/logwatch/postfix',
61be075c5a68 Ignore X-Comment "SPF whitelisted" messages in Logwatch IBBoard <dev@ibboard.co.uk> parents: 345 diff changeset	333 }
347 73d7b3ec6263 Ignore log entries from Cron tasks running in user mode IBBoard <dev@ibboard.co.uk> parents: 346 diff changeset	334 file { '/etc/logwatch/scripts/services/systemd':
73d7b3ec6263 Ignore log entries from Cron tasks running in user mode IBBoard <dev@ibboard.co.uk> parents: 346 diff changeset	335 source => 'puppet:///common/logwatch/systemd',
73d7b3ec6263 Ignore log entries from Cron tasks running in user mode IBBoard <dev@ibboard.co.uk> parents: 346 diff changeset	336 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	337 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	338
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	339 #Our web server with our configs, not just a stock one
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	340 class webserver (
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	341 $primary_ip,
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	342 $proxy_4to6_ip_prefix = undef,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	343 $proxy_4to6_mask = undef,
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	344 $proxy_upstream = undef,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	345 ) {
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	346
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	347 #Setup base website parameters
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	348 class { 'website':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	349 base_dir => '/srv/sites',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	350 primary_ip => $primary_ip,
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	351 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	352 proxy_4to6_mask => $proxy_4to6_mask,
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	353 proxy_upstream => $proxy_upstream,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	354 default_owner => $defaultusers::default_user,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	355 default_group => $defaultusers::default_user,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	356 default_tld => 'co.uk',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	357 default_extra_tlds => [ 'com' ],
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	358 }
110 be2b30b17a4c Switch to PHP 7 from Webtatic IBBoard <dev@ibboard.co.uk> parents: 108 diff changeset	359
238 6467e768e353 Switch to PHP 7.4 from Remi IBBoard <dev@ibboard.co.uk> parents: 236 diff changeset	360 $php_suffix = ''
247 308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	361 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 {
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	362 yumrepo { 'remirepo-safe':
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	363 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/$basearch/mirror',
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	364 descr => "Extra CentOS packages from Remi",
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	365 enabled => 1,
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	366 failovermethod => 'priority',
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	367 gpgcheck => 1,
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	368 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	369 }
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	370 yumrepo { 'remirepo-php':
320 99e3ca448d55 Fix Remi PHP on CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 317 diff changeset	371 mirrorlist => 'http://cdn.remirepo.net/enterprise/8/modular/$basearch/mirror',
99e3ca448d55 Fix Remi PHP on CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 317 diff changeset	372 descr => 'Remi\'s Modular repository for Enterprise Linux 8 - $basearch',
247 308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	373 enabled => 1,
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	374 failovermethod => 'priority',
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	375 gpgcheck => 1,
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	376 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	377 }
320 99e3ca448d55 Fix Remi PHP on CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 317 diff changeset	378 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi':
99e3ca448d55 Fix Remi PHP on CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 317 diff changeset	379 ensure => present,
99e3ca448d55 Fix Remi PHP on CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 317 diff changeset	380 source => 'puppet:///common/RPM-GPG-KEY-remi.el8',
99e3ca448d55 Fix Remi PHP on CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 317 diff changeset	381 tag => 'repo-config',
99e3ca448d55 Fix Remi PHP on CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 317 diff changeset	382 }
247 308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	383 } else {
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	384 yumrepo { 'remirepo-safe':
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	385 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/mirror',
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	386 descr => "Extra CentOS packages from Remi",
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	387 enabled => 1,
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	388 failovermethod => 'priority',
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	389 gpgcheck => 1,
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	390 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	391 }
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	392 yumrepo { 'remirepo-php':
335 aa9f570d6a9c Switch to PHP 7.4 now that NextCloud has reached v18 IBBoard <dev@ibboard.co.uk> parents: 334 diff changeset	393 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/php74/mirror',
aa9f570d6a9c Switch to PHP 7.4 now that NextCloud has reached v18 IBBoard <dev@ibboard.co.uk> parents: 334 diff changeset	394 descr => "PHP7.4 for CentOS from Remi",
247 308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	395 enabled => 1,
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	396 failovermethod => 'priority',
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	397 gpgcheck => 1,
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	398 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi',
308f69ca988c Add config for new server IBBoard <dev@ibboard.co.uk> parents: 246 diff changeset	399 }
320 99e3ca448d55 Fix Remi PHP on CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 317 diff changeset	400 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi':
99e3ca448d55 Fix Remi PHP on CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 317 diff changeset	401 ensure => present,
99e3ca448d55 Fix Remi PHP on CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 317 diff changeset	402 source => 'puppet:///common/RPM-GPG-KEY-remi',
99e3ca448d55 Fix Remi PHP on CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 317 diff changeset	403 tag => 'repo-config',
99e3ca448d55 Fix Remi PHP on CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 317 diff changeset	404 }
238 6467e768e353 Switch to PHP 7.4 from Remi IBBoard <dev@ibboard.co.uk> parents: 236 diff changeset	405 }
110 be2b30b17a4c Switch to PHP 7 from Webtatic IBBoard <dev@ibboard.co.uk> parents: 108 diff changeset	406
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	407 #Configure the PHP version to use
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	408 class { 'website::php':
350 85d2c0079af9 Make opcache core and add APCu for object caching IBBoard <dev@ibboard.co.uk> parents: 347 diff changeset	409 suffix => $php_suffix,
335 aa9f570d6a9c Switch to PHP 7.4 now that NextCloud has reached v18 IBBoard <dev@ibboard.co.uk> parents: 334 diff changeset	410 module => ($operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0) ? { true => 'remi-7.4', default => undef },
377 18765f598232 Add Enchant module for webmail spell checking IBBoard <dev@ibboard.co.uk> parents: 376 diff changeset	411 extras => [ 'process', 'intl', 'pecl-imagick', 'bcmath', 'pecl-zip', 'json', 'pecl-apcu', 'gmp', 'enchant' ],
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	412 }
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	413
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	414 #Setup MySQL, using (private) templates to make sure that we set non-std passwords and a default user
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	415
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	416 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '7') >= 0 {
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	417 $mysqlpackage = 'mariadb'
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	418 $mysqlsuffix = ''
48 5cdc1c96c477 Add SELinux support for website content IBBoard <dev@ibboard.co.uk> parents: 45 diff changeset	419
261 c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	420 # Required for SELinux rule setting/status checks
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	421 if versioncmp($operatingsystemrelease, '8') >= 0 {
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	422 $semanage_package_name = 'policycoreutils-python-utils'
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	423 } else {
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	424 $semanage_package_name = 'policycoreutils-python'
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	425 }
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	426
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	427 package { 'policycoreutils-python':
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	428 name => $semanage_package_name,
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	429 ensure => present,
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	430 }
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	431
74 c2e5027202e2 Add missing dependency for Trac Subversion support on CentOS 7 IBBoard <dev@ibboard.co.uk> parents: 72 diff changeset	432 $extra_packages = [
78 cbe27a97bcd1 Fix typo (missing single quote) IBBoard <dev@ibboard.co.uk> parents: 77 diff changeset	433 'perl-Sys-Syslog', #Required for Perl SPF checking
74 c2e5027202e2 Add missing dependency for Trac Subversion support on CentOS 7 IBBoard <dev@ibboard.co.uk> parents: 72 diff changeset	434 ]
c2e5027202e2 Add missing dependency for Trac Subversion support on CentOS 7 IBBoard <dev@ibboard.co.uk> parents: 72 diff changeset	435
c2e5027202e2 Add missing dependency for Trac Subversion support on CentOS 7 IBBoard <dev@ibboard.co.uk> parents: 72 diff changeset	436 package { $extra_packages:
c2e5027202e2 Add missing dependency for Trac Subversion support on CentOS 7 IBBoard <dev@ibboard.co.uk> parents: 72 diff changeset	437 ensure => installed
c2e5027202e2 Add missing dependency for Trac Subversion support on CentOS 7 IBBoard <dev@ibboard.co.uk> parents: 72 diff changeset	438 }
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	439 }
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	440 else {
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	441 $mysqlpackage = 'mysql'
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	442 $mysqlsuffix = '55w'
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	443 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	444 class { 'website::mysql':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	445 mysqluser => template('defaultusers/mysql-user'),
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	446 mysqlpassword => template('defaultusers/mysql-password'),
24 204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	447 mysqlprefix => $mysqlpackage,
204330fea19a Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings) IBBoard <dev@ibboard.co.uk> parents: 18 diff changeset	448 mysqlsuffix => $mysqlsuffix,
110 be2b30b17a4c Switch to PHP 7 from Webtatic IBBoard <dev@ibboard.co.uk> parents: 108 diff changeset	449 phpsuffix => $php_suffix,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	450 phpmysqlsuffix => 'nd'
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	451 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	452 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	453
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	454 class ibboardvpsnode (
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	455 $primary_ip,
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	456 $proxy_4to6_ip_prefix = undef,
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	457 $proxy_upstream = undef,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	458 $nat64_ranges = [],
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	459 $mailserver,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	460 $imapserver,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	461 $mailrelays = [],
35 1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables) IBBoard <dev@ibboard.co.uk> parents: 32 diff changeset	462 $firewall_cmd = 'iptables',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	463 ){
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	464 class { 'basevpsnode':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	465 primary_ip => $primary_ip,
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	466 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
279 e36b7f4f85f2 Start to support IPv6 servers IBBoard <dev@ibboard.co.uk> parents: 276 diff changeset	467 proxy_upstream => $proxy_upstream,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	468 nat64_ranges => $nat64_ranges,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	469 mailserver => $mailserver,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	470 imapserver => $imapserver,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	471 mailrelays => $mailrelays,
35 1bb941522ebf Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables) IBBoard <dev@ibboard.co.uk> parents: 32 diff changeset	472 firewall_cmd => $firewall_cmd,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	473 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	474
267 edeedd13262c Set a sensible default timezone for VPS IBBoard <dev@ibboard.co.uk> parents: 266 diff changeset	475 # Set timezone to something sensible
edeedd13262c Set a sensible default timezone for VPS IBBoard <dev@ibboard.co.uk> parents: 266 diff changeset	476 file { "/etc/localtime":
edeedd13262c Set a sensible default timezone for VPS IBBoard <dev@ibboard.co.uk> parents: 266 diff changeset	477 ensure => 'link',
edeedd13262c Set a sensible default timezone for VPS IBBoard <dev@ibboard.co.uk> parents: 266 diff changeset	478 target => '/usr/share/zoneinfo/Europe/London',
edeedd13262c Set a sensible default timezone for VPS IBBoard <dev@ibboard.co.uk> parents: 266 diff changeset	479 }
edeedd13262c Set a sensible default timezone for VPS IBBoard <dev@ibboard.co.uk> parents: 266 diff changeset	480
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	481 # Common modules used by multiple sites (mod_auth_basic is safe because we HTTPS all the things)
146 816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile IBBoard <dev@ibboard.co.uk> parents: 145 diff changeset	482 $mods = [ 'auth_basic',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile IBBoard <dev@ibboard.co.uk> parents: 145 diff changeset	483 'authn_file',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile IBBoard <dev@ibboard.co.uk> parents: 145 diff changeset	484 'authz_user',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile IBBoard <dev@ibboard.co.uk> parents: 145 diff changeset	485 'deflate',
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile IBBoard <dev@ibboard.co.uk> parents: 145 diff changeset	486 'xsendfile'
816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile IBBoard <dev@ibboard.co.uk> parents: 145 diff changeset	487 ]
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	488 apache::mod {
146 816e35f86a5d Remove mod_auth_token and replace with mod_xsendfile IBBoard <dev@ibboard.co.uk> parents: 145 diff changeset	489 $mods:;
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	490 }
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	491 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '7') >= 0 {
c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	492 apache::mod {
25 13adb555a7e2 Use "<IfVersion>" to handle auth differences between 2.2 and 2.4 IBBoard <dev@ibboard.co.uk> parents: 24 diff changeset	493 'authn_core':;
13adb555a7e2 Use "<IfVersion>" to handle auth differences between 2.2 and 2.4 IBBoard <dev@ibboard.co.uk> parents: 24 diff changeset	494 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	495 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	496
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	497 #Configure our sites, using templates for the custom fragments where the extra content is too long
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	498 class { "devsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	499 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:01", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	500 }
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	501 class { "adminsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	502 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:02", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	503 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	504 website::https::multitld { 'www.ibboard':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	505 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	506 custom_fragment => template("privat/apache/ibboard.fragment"),
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	507 letsencrypt_name => 'ibboard.co.uk',
236 4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	508 csp_override => {
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	509 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	510 "default-src" => "'none'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	511 "img-src" => "'self' https://live.staticflickr.com/",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	512 "script-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	513 "style-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	514 "font-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	515 "form-action" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	516 "connect-src" => "'self'",
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	517 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	518 }
374 5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	519 website::https::redir { 'mail.ibboard.co.uk':
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	520 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	521 redir => 'https://ibboard.co.uk/',
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	522 docroot => "${website::basedir}/ibboard",
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	523 letsencrypt_name => 'ibboard.co.uk',
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	524 separate_log => true,
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	525 }
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	526 website::https::redir { 'imap.ibboard.co.uk':
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	527 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	528 redir => 'https://ibboard.co.uk/',
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	529 docroot => "${website::basedir}/ibboard",
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	530 letsencrypt_name => 'ibboard.co.uk',
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	531 separate_log => true,
5f4fc00f8189 Add mail and imap redirect websites IBBoard <dev@ibboard.co.uk> parents: 364 diff changeset	532 }
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	533 class { "hiveworldterrasite":
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	534 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:04", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	535 }
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	536 class { "bdstrikesite":
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	537 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:05", default => undef }
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	538 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	539 website::https::multitld { 'www.abiknight':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	540 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:06", default => undef },
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	541 custom_fragment => "$website::htmlphpfragment
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	542 ErrorDocument 404 /error.php",
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	543 letsencrypt_name => 'abiknight.co.uk',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	544 }
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	545 website::https::multitld { 'www.warfoundry':
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	546 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:07", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	547 letsencrypt_name => 'warfoundry.co.uk',
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	548 custom_fragment => template("privat/apache/warfoundry.fragment"),
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	549 }
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	550 class { "webmailpimsite":
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	551 proxy_4to6_ip_pim => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:08", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	552 proxy_4to6_ip_webmail => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:09", default => undef },
9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	553 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	554 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	555
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	556 class adminsite ($proxy_4to6_ip) {
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	557 apache::mod { 'info':; 'status':; 'cgi':; }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	558 website::https::multitld { 'admin.ibboard':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	559 proxy_4to6_ip => $proxy_4to6_ip,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	560 force_no_index => false,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	561 ssl_ca_chain => '',
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	562 custom_fragment => template("privat/apache/admin.fragment"),
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	563 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	564 cron { 'loadavg':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	565 command => '/usr/local/bin/run-loadavg-logger',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	566 user => apache,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	567 minute => '*/6'
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	568 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	569 cron { 'awstats':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	570 command => '/usr/local/bin/update-awstats > /srv/sites/admin/awstats.log',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	571 user => apache,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	572 hour => '*/6',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	573 minute => '0'
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	574 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	575 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	576
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	577 class hiveworldterrasite ($proxy_4to6_ip) {
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	578 website::https::multitld { 'www.hiveworldterra':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	579 proxy_4to6_ip => $proxy_4to6_ip,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	580 force_no_www => false,
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	581 letsencrypt_name => 'hiveworldterra.co.uk',
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	582 custom_fragment => template("privat/apache/hwt.fragment"),
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	583 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	584 website::https::multitld { 'forums.hiveworldterra':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	585 proxy_4to6_ip => $proxy_4to6_ip,
331 f69e2d197302 Separate some certs to make migration easier IBBoard <dev@ibboard.co.uk> parents: 330 diff changeset	586 letsencrypt_name => 'forums.hiveworldterra.co.uk',
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	587 custom_fragment => template("privat/apache/forums.fragment"),
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	588 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	589 website::https::multitld { 'skins.hiveworldterra':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	590 proxy_4to6_ip => $proxy_4to6_ip,
334 ee4760967d2f Separate LetsEncrypt certs IBBoard <dev@ibboard.co.uk> parents: 332 diff changeset	591 letsencrypt_name => 'skins.hiveworldterra.co.uk',
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	592 custom_fragment => template("privat/apache/skins.fragment"),
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	593 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	594 website::https::redir { 'hiveworldterra.ibboard.co.uk':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	595 proxy_4to6_ip => $proxy_4to6_ip,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	596 redir => 'https://www.hiveworldterra.co.uk/',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	597 docroot => "${website::basedir}/hiveworldterra",
334 ee4760967d2f Separate LetsEncrypt certs IBBoard <dev@ibboard.co.uk> parents: 332 diff changeset	598 letsencrypt_name => 'hiveworldterra.ibboard.co.uk',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	599 separate_log => true,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	600 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	601 }
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	602 class bdstrikesite ($proxy_4to6_ip) {
331 f69e2d197302 Separate some certs to make migration easier IBBoard <dev@ibboard.co.uk> parents: 330 diff changeset	603 website::https::multitld { 'www.bdstrike':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	604 proxy_4to6_ip => $proxy_4to6_ip,
145 88f38ef7359f Add BDStrike domains IBBoard <dev@ibboard.co.uk> parents: 142 diff changeset	605 docroot_owner => $defaultusers::secondary_user,
88f38ef7359f Add BDStrike domains IBBoard <dev@ibboard.co.uk> parents: 142 diff changeset	606 docroot_group => 'editors',
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	607 letsencrypt_name => 'bdstrike.co.uk',
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	608 custom_fragment => template("privat/apache/bdstrike.fragment"),
236 4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	609 csp_override => {"frame-ancestors" => "'self'"},
4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	610 csp_report_override => {
364 8224f42ee05b Expand BDStrike CSP to allow more styling and fonts IBBoard <dev@ibboard.co.uk> parents: 362 diff changeset	611 "font-src" => "'self' https://fonts.gstatic.com/ data:",
236 4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	612 "img-src" => "'self' https://secure.gravatar.com/",
364 8224f42ee05b Expand BDStrike CSP to allow more styling and fonts IBBoard <dev@ibboard.co.uk> parents: 362 diff changeset	613 "style-src" => "'self' https://fonts.googleapis.com/ 'unsafe-inline'"
236 4519b727cc4c Make Content-Security-Policy cleaner and easier to set IBBoard <dev@ibboard.co.uk> parents: 235 diff changeset	614 },
145 88f38ef7359f Add BDStrike domains IBBoard <dev@ibboard.co.uk> parents: 142 diff changeset	615 }
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	616 $aliases = [
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	617 'strikecreations.co.uk',
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	618 'strikecreations.com',
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	619 'www.strikecreations.com' ]
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	620
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	621 website::https::redir { 'www.strikecreations.co.uk':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	622 proxy_4to6_ip => $proxy_4to6_ip,
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	623 redir => 'https://bdstrike.co.uk/',
c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	624 serveraliases => $aliases,
145 88f38ef7359f Add BDStrike domains IBBoard <dev@ibboard.co.uk> parents: 142 diff changeset	625 docroot => "${website::basedir}/bdstrike",
88f38ef7359f Add BDStrike domains IBBoard <dev@ibboard.co.uk> parents: 142 diff changeset	626 docroot_owner => $defaultusers::secondary_user,
88f38ef7359f Add BDStrike domains IBBoard <dev@ibboard.co.uk> parents: 142 diff changeset	627 docroot_group => 'editors',
331 f69e2d197302 Separate some certs to make migration easier IBBoard <dev@ibboard.co.uk> parents: 330 diff changeset	628 letsencrypt_name => 'strikecreations.com',
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	629 separate_log => true,
145 88f38ef7359f Add BDStrike domains IBBoard <dev@ibboard.co.uk> parents: 142 diff changeset	630 }
235 e602c5f974ac Make a cron job for updating Wordpress IBBoard <dev@ibboard.co.uk> parents: 200 diff changeset	631 cron { 'wordpress_cron':
e602c5f974ac Make a cron job for updating Wordpress IBBoard <dev@ibboard.co.uk> parents: 200 diff changeset	632 # Run "php -f wp-cron.php" on a schedule so that we can auto-update
e602c5f974ac Make a cron job for updating Wordpress IBBoard <dev@ibboard.co.uk> parents: 200 diff changeset	633 # without giving Apache full write access!
e602c5f974ac Make a cron job for updating Wordpress IBBoard <dev@ibboard.co.uk> parents: 200 diff changeset	634 command => "/usr/local/bin/bdstrike-cron",
e602c5f974ac Make a cron job for updating Wordpress IBBoard <dev@ibboard.co.uk> parents: 200 diff changeset	635 user => $defaultusers::default_user,
e602c5f974ac Make a cron job for updating Wordpress IBBoard <dev@ibboard.co.uk> parents: 200 diff changeset	636 minute => '*/15',
e602c5f974ac Make a cron job for updating Wordpress IBBoard <dev@ibboard.co.uk> parents: 200 diff changeset	637 }
145 88f38ef7359f Add BDStrike domains IBBoard <dev@ibboard.co.uk> parents: 142 diff changeset	638 }
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	639 class devsite ($proxy_4to6_ip) {
261 c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	640 if versioncmp($operatingsystemrelease, '8') >= 0 {
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	641 # Apache::Mod doesn't map this correctly for CentOS 8 yet
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	642 $mod_wsgi_lib = 'mod_wsgi_python3.so'
342 445aaaf228cc Handle "mod_wsgi" not existing as a package/provides in CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 335 diff changeset	643 # And mod_wsgi doesn't exist as a "provides" any more
445aaaf228cc Handle "mod_wsgi" not existing as a package/provides in CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 335 diff changeset	644 $mod_wsgi_package = 'python3-mod_wsgi'
261 c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	645 } else {
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	646 $mod_wsgi_lib = undef
342 445aaaf228cc Handle "mod_wsgi" not existing as a package/provides in CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 335 diff changeset	647 $mod_wsgi_package = undef
261 c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	648 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	649 apache::mod {
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	650 # mod_wsgi for Python support
261 c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	651 'wsgi':
c3ecb1e58713 Fix more CentOS 7 vs 8 differences IBBoard <dev@ibboard.co.uk> parents: 258 diff changeset	652 lib => $mod_wsgi_lib,
342 445aaaf228cc Handle "mod_wsgi" not existing as a package/provides in CentOS 8 IBBoard <dev@ibboard.co.uk> parents: 335 diff changeset	653 package => $mod_wsgi_package,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	654 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	655
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	656 # Create Python virtualenvs for the dev site apps
272 c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	657 file {
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	658 "/srv/rhodecode":
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	659 ensure => 'directory';
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	660 "/srv/trac":
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	661 ensure => 'directory';
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	662 } ->
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	663 python::virtualenv {
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	664 # Distribute is described as "simple compatibility layer that installs Setuptools 0.7+"
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	665 # and leads to 'module "importlib._bootstrap" has no attribute "SourceFileLoader"'
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	666 "/srv/rhodecode/virtualenv":
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	667 distribute => false,
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	668 version => '3';
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	669 "/srv/trac/virtualenv":
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	670 distribute => false,
c42fb28cff86 Update to a newer Python module IBBoard <dev@ibboard.co.uk> parents: 271 diff changeset	671 version => '3';
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	672 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	673
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	674 # Graphviz for Trac "master ticket" graphs
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	675 package { 'graphviz':
131 0dd899a10ee1 Change all "latest" packages to "installed" IBBoard <dev@ibboard.co.uk> parents: 129 diff changeset	676 ensure => installed,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	677 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	678
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	679 website::https::multitld { 'dev.ibboard':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	680 proxy_4to6_ip => $proxy_4to6_ip,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	681 #Make sure we're the first one hit for the tiny fraction of "no support" cases we care about (potentially Python for Mercurial!)
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	682 # http://en.wikipedia.org/wiki/Server_Name_Indication#No_support
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	683 priority => 1,
157 c6b1b42f3e4b Move all sites to separate LetsEncrypt certs to make adding future domains easier IBBoard <dev@ibboard.co.uk> parents: 154 diff changeset	684 letsencrypt_name => 'dev.ibboard.co.uk',
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	685 custom_fragment => template("privat/apache/dev.fragment"),
281 af7df930a670 Add 4-to-6 proxy and mod_remoteip setup IBBoard <dev@ibboard.co.uk> parents: 279 diff changeset	686 proxy_fragment => template("privat/apache/dev-proxy.fragment"),
52 be1e9773a12c Mercurial repo versions index.php files etc, so removing index.php breaks things! IBBoard <dev@ibboard.co.uk> parents: 44 diff changeset	687 force_no_index => false,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	688 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	689 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	690
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	691 class webmailpimsite ($proxy_4to6_ip_pim, $proxy_4to6_ip_webmail) {
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	692 # Webmail and Personal Information Management (PIM) sites
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	693 website::https { 'webmail.ibboard.co.uk':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	694 proxy_4to6_ip => $proxy_4to6_ip_webmail,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	695 force_no_index => false,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	696 ssl_ca_chain => '',
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	697 custom_fragment => template("privat/apache/webmail.fragment"),
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	698 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	699 website::https { 'pim.ibboard.co.uk':
284 9431aec4d998 Switch to using IPv6 prefix and IP per site IBBoard <dev@ibboard.co.uk> parents: 281 diff changeset	700 proxy_4to6_ip => $proxy_4to6_ip_pim,
242 7d8e664ebcc9 Change owner/group on Nextcloud for easy upgrade IBBoard <dev@ibboard.co.uk> parents: 241 diff changeset	701 docroot_owner => 'apache',
7d8e664ebcc9 Change owner/group on Nextcloud for easy upgrade IBBoard <dev@ibboard.co.uk> parents: 241 diff changeset	702 docroot_group => 'editors',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	703 force_no_index => false,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	704 lockdown_requests => false,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	705 ssl_ca_chain => '',
265 bf2b8912c414 Make PIM site skip CSP headers - NextCloud manages them IBBoard <dev@ibboard.co.uk> parents: 264 diff changeset	706 csp => false,
bf2b8912c414 Make PIM site skip CSP headers - NextCloud manages them IBBoard <dev@ibboard.co.uk> parents: 264 diff changeset	707 csp_report => false,
246 c3fa3d65aa83 Update configs for Puppet 6 IBBoard <dev@ibboard.co.uk> parents: 242 diff changeset	708 custom_fragment => template("privat/apache/pim.fragment"),
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	709 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	710 cron { 'owncloudcron':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	711 command => "/usr/local/bin/owncloud-cron",
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	712 user => 'apache',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	713 minute => '*/15',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	714 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	715 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	716
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	717 class email (
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	718 $mailserver,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	719 $imapserver,
311 51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use IBBoard <dev@ibboard.co.uk> parents: 310 diff changeset	720 $mailserver_ip,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	721 $proxy_ip = undef,
311 51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use IBBoard <dev@ibboard.co.uk> parents: 310 diff changeset	722 $proxy_upstream = [],
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	723 $nat64_ranges = [],
63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	724 $mailrelays = [],
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	725 ){
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	726 class { 'postfix':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	727 mailserver => $mailserver,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	728 mailserver_ip => $mailserver_ip,
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	729 mailserver_proxy => $proxy_ip,
49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	730 proxy_upstream => $proxy_upstream,
326 63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	731 mailrelays => $mailrelays,
63e0b5149cfb Add fallback relays to Postfix IBBoard <dev@ibboard.co.uk> parents: 323 diff changeset	732 nat64_ranges => $nat64_ranges,
317 2a20a5b7f65a Swap IPv6 Postfix to "all" protocols to support PROXY IBBoard <dev@ibboard.co.uk> parents: 313 diff changeset	733 protocols => $mailserver_ip =~ Stdlib::IP::Address::V6 ? { true => 'all', default => 'ipv4' },
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	734 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	735 class { 'dovecot':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	736 imapserver => $imapserver,
311 51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use IBBoard <dev@ibboard.co.uk> parents: 310 diff changeset	737 imapserver_ip => $mailserver_ip,
313 49e66019faf7 Configure Postfix for IPv6 w/proxy IBBoard <dev@ibboard.co.uk> parents: 311 diff changeset	738 imapserver_proxy => $proxy_ip,
311 51d3748f8112 Configure Dovecot (IMAP) for PROXY protocol use IBBoard <dev@ibboard.co.uk> parents: 310 diff changeset	739 proxy_upstream => $proxy_upstream,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	740 }
177 1b605c38b375 Add missing dependencies for SpamAssassin rules IBBoard <dev@ibboard.co.uk> parents: 176 diff changeset	741 # Unspecified SpamAssassin config dependencies that started
1b605c38b375 Add missing dependencies for SpamAssassin rules IBBoard <dev@ibboard.co.uk> parents: 176 diff changeset	742 # showing up as errors in our logs
276 165ad12ea8ca Remove Perl LZMA module because it's in beta IBBoard <dev@ibboard.co.uk> parents: 274 diff changeset	743 package { ['perl-File-MimeInfo']:
177 1b605c38b375 Add missing dependencies for SpamAssassin rules IBBoard <dev@ibboard.co.uk> parents: 176 diff changeset	744 ensure => installed,
1b605c38b375 Add missing dependencies for SpamAssassin rules IBBoard <dev@ibboard.co.uk> parents: 176 diff changeset	745 }
140 6eef7cec8658 Remove ClamAV from server config IBBoard <dev@ibboard.co.uk> parents: 139 diff changeset	746 package { [ 'amavisd-new' ]:
85 50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	747 ensure => installed,
50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	748 tag => 'av',
50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	749 }
86 4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot! IBBoard <dev@ibboard.co.uk> parents: 85 diff changeset	750 service { 'amavisd':
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot! IBBoard <dev@ibboard.co.uk> parents: 85 diff changeset	751 ensure => 'running',
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot! IBBoard <dev@ibboard.co.uk> parents: 85 diff changeset	752 enable => 'true',
4f59d2fcd521 Make sure that Amavis daemon is running so mail gets delivered after reboot! IBBoard <dev@ibboard.co.uk> parents: 85 diff changeset	753 }
270 481acc395876 Mask "clamav@amavisd" service to save memory IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	754 service { 'clamd@amavisd':
481acc395876 Mask "clamav@amavisd" service to save memory IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	755 ensure => 'stopped',
481acc395876 Mask "clamav@amavisd" service to save memory IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	756 enable=> 'mask',
481acc395876 Mask "clamav@amavisd" service to save memory IBBoard <dev@ibboard.co.uk> parents: 268 diff changeset	757 }
85 50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	758 file { '/etc/amavisd/amavisd.conf':
50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	759 ensure => present,
50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	760 source => 'puppet:///private/postfix/amavisd.conf',
50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	761 tag => 'av',
50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	762 }
163 4e53d77fa586 Manage SpamAssassin local config IBBoard <dev@ibboard.co.uk> parents: 162 diff changeset	763 file { '/etc/mail/spamassassin/local.cf':
4e53d77fa586 Manage SpamAssassin local config IBBoard <dev@ibboard.co.uk> parents: 162 diff changeset	764 ensure => present,
4e53d77fa586 Manage SpamAssassin local config IBBoard <dev@ibboard.co.uk> parents: 162 diff changeset	765 source => 'puppet:///private/postfix/spamassassin-local.cf',
4e53d77fa586 Manage SpamAssassin local config IBBoard <dev@ibboard.co.uk> parents: 162 diff changeset	766 tag => 'av',
4e53d77fa586 Manage SpamAssassin local config IBBoard <dev@ibboard.co.uk> parents: 162 diff changeset	767 }
142 dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	768 file { '/etc/mail/spamassassin/ole2macro.cf':
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	769 ensure => present,
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	770 source => 'puppet:///common/ole2macro.cf',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	771 tag => 'av',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	772 }
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	773 file { '/etc/mail/spamassassin/ole2macro.pm':
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	774 ensure => present,
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	775 source => 'puppet:///common/spamassassin-vba-macro-master/ole2macro.pm',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	776 tag => 'av',
dae1088dd218 Add OLE detection to SpamAssassin without ClamAV IBBoard <dev@ibboard.co.uk> parents: 141 diff changeset	777 }
85 50dd78dbf3db Fight back against spam IBBoard <dev@ibboard.co.uk> parents: 83 diff changeset	778 Package<\| tag == 'av' \|> -> File<\| tag == 'av' \|>
87 6be21a984126 Make sure that config file changes for changes trigger a reload IBBoard <dev@ibboard.co.uk> parents: 86 diff changeset	779 File<\| tag == 'av' \|> {
6be21a984126 Make sure that config file changes for changes trigger a reload IBBoard <dev@ibboard.co.uk> parents: 86 diff changeset	780 notify => Service['amavisd'],
6be21a984126 Make sure that config file changes for changes trigger a reload IBBoard <dev@ibboard.co.uk> parents: 86 diff changeset	781 }
125 ca711ab45f17 Schedule Postwhite to run regularly IBBoard <dev@ibboard.co.uk> parents: 122 diff changeset	782 cron { 'Postwhite':
129 16a931df5fd7 Filter what we see in Postwhite cron output IBBoard <dev@ibboard.co.uk> parents: 128 diff changeset	783 command => "/usr/local/bin/postwhite 2>&1\| grep -vE '^(Starting\|Recursively\|Getting\|Querying\|Removing\|Sorting\|$)'",
125 ca711ab45f17 Schedule Postwhite to run regularly IBBoard <dev@ibboard.co.uk> parents: 122 diff changeset	784 user => 'root',
ca711ab45f17 Schedule Postwhite to run regularly IBBoard <dev@ibboard.co.uk> parents: 122 diff changeset	785 weekday => 0,
128 379089631403 Fix rookie cron mistake - don't run Postwhite EVERY MINUTE! IBBoard <dev@ibboard.co.uk> parents: 126 diff changeset	786 hour => 2,
379089631403 Fix rookie cron mistake - don't run Postwhite EVERY MINUTE! IBBoard <dev@ibboard.co.uk> parents: 126 diff changeset	787 minute => 0,
125 ca711ab45f17 Schedule Postwhite to run regularly IBBoard <dev@ibboard.co.uk> parents: 122 diff changeset	788 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	789 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	790
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	791 class cronjobs {
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	792 # Add Mutt for scripts that send emails, but stop it clogging the disk by keeping copies of emails
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	793 package { 'mutt':
131 0dd899a10ee1 Change all "latest" packages to "installed" IBBoard <dev@ibboard.co.uk> parents: 129 diff changeset	794 ensure => installed,
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	795 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	796 file { '/etc/Muttrc.local':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	797 content => 'set copy = no',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	798 require => Package['mutt'],
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	799 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	800
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	801 # General server-wide cron jobs
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	802 Cron { user => 'root' }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	803 cron { 'backupalldbs':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	804 command => "/usr/local/bin/backupalldbs",
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	805 monthday => "*/2",
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	806 hour => "4",
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	807 minute => "9"
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	808 }
323 002203790815 Stop running Great Firewall Against China on IPv6 machines IBBoard <dev@ibboard.co.uk> parents: 322 diff changeset	809 # Only run the Great Firewall Against China on IPv4 (since we don't have an IPv6 list
002203790815 Stop running Great Firewall Against China on IPv6 machines IBBoard <dev@ibboard.co.uk> parents: 322 diff changeset	810 # and the PROXY forwards the IPs to services, but not at the network level)
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	811 cron { 'greatfirewallofchina':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	812 command => '/usr/local/bin/update-great-firewall-of-china',
323 002203790815 Stop running Great Firewall Against China on IPv6 machines IBBoard <dev@ibboard.co.uk> parents: 322 diff changeset	813 ensure => has_key($facts, 'ipaddress') ? { true => "present", default => "absent" },
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	814 hour => 3,
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	815 minute => 30
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	816 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	817 cron { 'permissions':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	818 command => '/usr/local/bin/set-permissions',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	819 hour => 3,
14 534e584f21ce Tweak time on permission setting script so that it is less likely to clash with LoadAVG run every 6 minutes IBBoard <dev@ibboard.co.uk> parents: 13 diff changeset	820 minute => 2
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	821 }
55 ce8eaaca6a34 Update firewalling so that we block the right ports when using iptables directly IBBoard <dev@ibboard.co.uk> parents: 54 diff changeset	822 # Since we're only managing the local server, use our script that wraps "puppet apply" instead of PuppetMaster
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	823 cron { 'puppet':
268 9f054191b9db Filter new log line from puppet-apply output IBBoard <dev@ibboard.co.uk> parents: 267 diff changeset	824 command => '/usr/local/bin/puppet-apply \| grep -v "Compiled catalog for\\|Finished catalog run in\\|Applied catalog in"',
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	825 hour => '*/6',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	826 minute => 5
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	827 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	828 cron { 'purgecaches':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	829 command => "/usr/local/bin/purge-caches",
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	830 hour => '4',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	831 minute => '15',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	832 weekday => '1',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	833 }
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	834 # Notify of uncommitted files
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	835 cron { 'check-mercurial-committed':
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	836 command => "/usr/local/bin/check-hg-status",
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	837 hour => '4',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	838 minute => '20',
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	839 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	840 }
93 74678cd7a200 Run cron job to notify of available updates IBBoard <dev@ibboard.co.uk> parents: 91 diff changeset	841 # Notify of available updates
74678cd7a200 Run cron job to notify of available updates IBBoard <dev@ibboard.co.uk> parents: 91 diff changeset	842 cron { 'check-yum-updates':
378 d539c21143bb Get more specific with extracting Yum update list IBBoard <dev@ibboard.co.uk> parents: 377 diff changeset	843 command => '/usr/bin/yum check-update \| grep -E "^[^ ]+ +[0-9a-z_\.-]+ +[^ ]+$"',
93 74678cd7a200 Run cron job to notify of available updates IBBoard <dev@ibboard.co.uk> parents: 91 diff changeset	844 hour => '4',
74678cd7a200 Run cron job to notify of available updates IBBoard <dev@ibboard.co.uk> parents: 91 diff changeset	845 minute => '30',
74678cd7a200 Run cron job to notify of available updates IBBoard <dev@ibboard.co.uk> parents: 91 diff changeset	846 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
74678cd7a200 Run cron job to notify of available updates IBBoard <dev@ibboard.co.uk> parents: 91 diff changeset	847 }
97 b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart IBBoard <dev@ibboard.co.uk> parents: 96 diff changeset	848 # And check whether anything needs restarting
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart IBBoard <dev@ibboard.co.uk> parents: 96 diff changeset	849 cron { 'check-needs-restarting':
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart IBBoard <dev@ibboard.co.uk> parents: 96 diff changeset	850 command => '/usr/bin/needs-restarting\|grep -v "/usr/lib/systemd\\|/usr/sbin/lvmetad\\|/usr/lib/polkit-1/polkitd"',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart IBBoard <dev@ibboard.co.uk> parents: 96 diff changeset	851 hour => '4',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart IBBoard <dev@ibboard.co.uk> parents: 96 diff changeset	852 minute => '45',
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart IBBoard <dev@ibboard.co.uk> parents: 96 diff changeset	853 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning
b69e3f6708d6 Add another regular command to check that we've not got services requiring a restart IBBoard <dev@ibboard.co.uk> parents: 96 diff changeset	854 }
0 956e484adc12 Initial public release of Puppet configs IBBoard <dev@ibboard.co.uk> parents: diff changeset	855 }

Mercurial > repos > other > Puppet

annotate manifests/templates.pp @ 378:d539c21143bb