Mercurial > repos > other > Puppet
annotate manifests/templates.pp @ 453:dc725b618258
Fix Amavis quarantine directory
author | IBBoard <dev@ibboard.co.uk> |
---|---|
date | Sun, 13 Aug 2023 15:25:01 +0100 |
parents | 4a6ad700cded |
children | d0e7979c7e8c |
rev | line source |
---|---|
32
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
1 # Make sure packages come after their repos |
382
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
2 File<| tag == 'repo-config' |> |
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
3 -> anchor { 'Repo-config': } |
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
4 -> YumRepo<| |> |
446
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
5 -> Apt::Source<| |> |
382
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
6 -> anchor { 'Repos': } |
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
7 -> Package<| |> |
32
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
8 |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
9 # Make sure all files are in place before starting services |
298 | 10 # FIXME: Title matches are to fix a dependency cycle |
382
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
11 File<| tag != 'post-service' and title != '/etc/sysconfig/ip6tables' and title != '/etc/sysconfig/iptables' |> |
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
12 -> anchor { 'Pre-Service Files': } |
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
13 -> Service<| |> |
246 | 14 |
15 # Set some shortcut variables | |
16 #$os = $operatingsystem | |
249
e9323ff8f451
Make EPEL work on multiple versions of CentOS
IBBoard <dev@ibboard.co.uk>
parents:
247
diff
changeset
|
17 $osver = $operatingsystemmajrelease |
246 | 18 $server = '' |
32
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
19 |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
20 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
21 class basenode { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
22 include sudo |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
23 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
24 include defaultusers |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
25 include logwatch |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
26 |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
27 file { '/etc/puppet/hiera.yaml': |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
28 ensure => present, |
264 | 29 content => " |
30 # Let the system set defaults | |
31 version: 5 | |
32 ", | |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
33 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
34 |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
35 if $operatingsystem == 'Ubuntu' { |
447
1a9de0661666
Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
446
diff
changeset
|
36 package { 'locales': |
1a9de0661666
Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
446
diff
changeset
|
37 ensure => present |
1a9de0661666
Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
446
diff
changeset
|
38 } -> |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
39 file { '/etc/locale.gen': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
40 ensure => present, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
41 content => "en_GB.UTF-8 UTF-8", |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
42 notify => Exec['Regen locales'] |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
43 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
44 exec { 'Regen locales': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
45 command => 'locale-gen', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
46 refreshonly => true |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
47 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
48 # Don't waste space with Snap and do everything properly with system packages |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
49 [ 'lxd', 'core18', 'core20', 'snapd'].each |$snap| { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
50 exec { "remove $snap snap package": |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
51 command => "snap remove $snap", |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
52 onlyif => "which snap && snap list $snap", |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
53 tag => 'snap', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
54 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
55 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
56 Exec<| tag == 'snap' |> -> |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
57 package { 'snapd': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
58 ensure => purged, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
59 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
60 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
61 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
62 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
63 class basevpsnode ( |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
64 $primary_ip, |
449
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
65 $gateway_ip = undef, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
66 $proxy_4to6_ip_prefix = undef, |
279 | 67 $proxy_upstream = undef, |
326 | 68 $nat64_ranges = [], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
69 $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
70 $imapserver, |
326 | 71 $mailrelays = [], |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
72 $firewall_cmd = 'iptables', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
73 ) { |
44
546dfa011f58
Remove "puppet" host name because we don't need it
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
74 |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
75 if $firewall_cmd == 'iptables' { |
279 | 76 class { 'vpsfirewall': |
77 fw_protocol => $primary_ip =~ Stdlib::IP::Address::V6 ? { true => 'IPv6', default => 'IPv4'}, | |
78 } | |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
79 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
80 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
81 #VPS is a self-mastered Puppet machine, so bodge a Hosts file |
302 | 82 if $primary_ip =~ Stdlib::IP::Address::V6 { |
83 $lo_ip = '::1' | |
84 } else { | |
85 $lo_ip = '127.0.0.1' | |
86 } | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
87 file { '/etc/hosts': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
88 ensure => present, |
302 | 89 content => "${lo_ip} localhost\n${primary_ip} ${fqdn}", |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
90 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
91 |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
92 if $proxy_4to6_ip_prefix != undef { |
449
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
93 if $operatingsystem == 'Ubuntu' { |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
94 # Ubuntu can't parse the existing file, so we need to brute-force it with a template |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
95 file { "/etc/network/interfaces.d/eth0": |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
96 content => epp('privat/eth0.epp', |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
97 { |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
98 default_address => $primary_ip, |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
99 gateway_address => $gateway_ip, |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
100 prefix_address => $proxy_4to6_ip_prefix, |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
101 } |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
102 ), |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
103 } |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
104 |
449
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
105 # # …:1 to …:9 for websites, …:10 for mail |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
106 # Integer[1, 10].each |$octet| { |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
107 # augeas { "IPv6 secondary address $octet": |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
108 # context => "/files/etc/network/interfaces.d/eth0", |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
109 # changes => [ |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
110 # "set auto[child::1 = 'eth0:$octet']/1 eth0:$octet", |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
111 # "set no-auto-down[child::1 = 'eth0:$octet']/1 eth0:$octet", |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
112 # "set iface[. = 'eth0:$octet'] eth0:$octet", |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
113 # "set iface[. = 'eth0:$octet']/family inet6", |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
114 # "set iface[. = 'eth0:$octet']/method static", |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
115 # "set iface[. = 'eth0:$octet']/address $proxy_4to6_ip_prefix:$octet", |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
116 # "set iface[. = 'eth0:$octet']/netmask 64", |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
117 # |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
118 # ], |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
119 # } |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
120 # } |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
121 } |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
122 else { |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
123 # …:1 to …:9 for websites, …:10 for mail |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
124 $ipv6_addresses = Integer[1, 10].map |$octet| { "$proxy_4to6_ip_prefix:$octet" } |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
125 $ipv6_secondaries = join($ipv6_addresses, " ") |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
126 |
449
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
127 augeas {'IPv6 secondary addresses': |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
128 context => "/files/etc/sysconfig/network-scripts/ifcfg-eth0", |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
129 changes => "set IPV6ADDR_SECONDARIES '\"$ipv6_secondaries\"'", |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
130 } |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
131 } |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
132 } |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
133 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
134 require repos |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
135 include basenode |
246 | 136 include privat |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
137 include dnsresolver |
396
e93588ec1ce3
Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents:
393
diff
changeset
|
138 include ::privat::params |
e93588ec1ce3
Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents:
393
diff
changeset
|
139 class { '::ssh': |
e93588ec1ce3
Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents:
393
diff
changeset
|
140 sshd_config_port => $::privat::params::ssh_port[$::fqdn] |
e93588ec1ce3
Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents:
393
diff
changeset
|
141 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
142 include vcs::server |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
143 include vcs::client |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
144 class { 'webserver': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
145 primary_ip => $primary_ip, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
146 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
147 proxy_4to6_mask => 124, |
279 | 148 proxy_upstream => $proxy_upstream, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
149 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
150 include cronjobs |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
151 include logrotate |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
152 class { 'fail2ban': |
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
153 firewall_cmd => $firewall_cmd, |
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
154 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
155 include tools |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
156 class { 'email': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
157 mailserver => $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
158 imapserver => $imapserver, |
311
51d3748f8112
Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents:
310
diff
changeset
|
159 mailserver_ip => $primary_ip, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
160 proxy_ip => $proxy_4to6_ip_prefix != undef ? { true => "${proxy_4to6_ip_prefix}:10", default => undef }, |
311
51d3748f8112
Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents:
310
diff
changeset
|
161 proxy_upstream => $proxy_upstream, |
326 | 162 nat64_ranges => $nat64_ranges, |
163 mailrelays => $mailrelays, | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
164 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
165 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
166 |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
167 ## Classes to allow facet behaviour using preconfigured setups of classes |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
168 |
279 | 169 class vpsfirewall ($fw_protocol) { |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
170 resources { "firewall": |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
171 purge => false, |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
172 } |
279 | 173 class { "my_fw": |
174 ip_version => $fw_protocol, | |
175 } | |
176 # Control what does and doesn't get pruned in the main filter chain | |
177 firewallchain { "INPUT:filter:$fw_protocol": | |
178 purge => true, | |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
179 ignore => [ |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
180 '-j f2b-[^ ]+$', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
181 '^(:|-A )f2b-', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
182 '--comment "Great Firewall of China"', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
183 '--comment "Do not purge', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
184 ], |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
185 } |
279 | 186 if ($fw_protocol != "IPv6") { |
187 firewall { '010 Whitelist Googlebot': | |
188 source => '66.249.64.0/19', | |
189 dport => [80,443], | |
190 proto => tcp, | |
191 action => accept, | |
192 } | |
193 # Block a spammer hitting our contact forms (also on StopForumSpam list A LOT) | |
194 firewall { '099 Blacklist spammers 1': | |
195 source => '107.181.78.172', | |
196 dport => [80, 443], | |
197 proto => tcp, | |
198 action => 'reject', | |
199 } | |
200 firewall { '099 Blacklist IODC bot': | |
201 # IODC bot makes too many bad requests, and contact form is broken | |
202 # They don't publish a robots.txt name, so firewall it! | |
203 source => '86.153.145.149', | |
204 dport => [ 80, 443 ], | |
205 proto => tcp, | |
206 action => 'reject', | |
207 } | |
208 firewall { '099 Blacklist Baidu Brazil': | |
209 #Baidu got a Brazilian netblock and are hitting us hard | |
210 #Baidu doesn't honour "crawl-delay" in robots.txt | |
211 #Baidu gets firewalled | |
212 source => '131.161.8.0/22', | |
213 dport => [ 80, 443 ], | |
214 proto => tcp, | |
215 action => 'reject', | |
216 } | |
139
abaf384dc939
Block another annoying IP with a firewall rule
IBBoard <dev@ibboard.co.uk>
parents:
137
diff
changeset
|
217 } |
279 | 218 firewallchain { "GREATFIREWALLOFCHINA:filter:$fw_protocol": |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
219 ensure => present, |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
220 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
221 firewall { '050 Check our Great Firewall Against China': |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
222 chain => 'INPUT', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
223 jump => 'GREATFIREWALLOFCHINA', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
224 } |
279 | 225 firewallchain { "Fail2Ban:filter:$fw_protocol": |
64
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
226 ensure => present, |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
227 } |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
228 firewall { '060 Check Fail2Ban': |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
229 chain => 'INPUT', |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
230 jump => 'Fail2Ban', |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
231 } |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
232 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
233 |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
234 class dnsresolver { |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
235 package { 'unbound': |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
236 ensure => present, |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
237 } |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
238 package { 'named': |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
239 ensure => absent, |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
240 } |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
241 |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
242 service { 'named': |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
243 ensure => stopped, |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
244 enable => false, |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
245 } |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
246 service { 'unbound': |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
247 ensure => running, |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
248 enable => true, |
194
a08de3153548
Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents:
193
diff
changeset
|
249 } |
a08de3153548
Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents:
193
diff
changeset
|
250 |
a08de3153548
Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents:
193
diff
changeset
|
251 file { '/etc/named.conf': |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
252 ensure => absent, |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
253 } |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
254 file { '/etc/unbound/unbound.conf': |
194
a08de3153548
Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents:
193
diff
changeset
|
255 ensure => present, |
247 | 256 source => [ |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
257 "puppet:///common/unbound.conf-${::hostname}", |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
258 "puppet:///common/unbound.conf", |
247 | 259 ], |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
260 require => Package['unbound'], |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
261 notify => Service['unbound'], |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
262 } |
449
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
263 file { ['/etc/NetworkManager', '/etc/NetworkManager/conf.d']: |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
264 ensure => directory |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
265 } |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
266 file { '/etc/NetworkManager/conf.d/local-dns-resolver.conf': |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
267 ensure => present, |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
268 content => "[main] |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
269 dns=none", |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
270 } |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
271 |
101
a48b6011a084
Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents:
100
diff
changeset
|
272 file { '/etc/sysconfig/named': |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
273 ensure => absent, |
101
a48b6011a084
Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents:
100
diff
changeset
|
274 } |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
275 file { '/etc/resolv.conf': |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
276 ensure => file, |
301
1bfc290270cc
Fix sa-update by using IPv6 for local DNS cache
IBBoard <dev@ibboard.co.uk>
parents:
298
diff
changeset
|
277 # "ipaddress" key only exists for machines with IPv4 addresses |
1bfc290270cc
Fix sa-update by using IPv6 for local DNS cache
IBBoard <dev@ibboard.co.uk>
parents:
298
diff
changeset
|
278 content => has_key($facts, 'ipaddress') ? { true => "nameserver 127.0.0.1", default => "nameserver ::1" }, |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
279 require => Service['unbound'], |
246 | 280 tag => 'post-service', |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
281 } |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
282 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
283 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
284 class repos { |
439
e4de05e3a2f8
Ensure Python params are included
IBBoard <dev@ibboard.co.uk>
parents:
435
diff
changeset
|
285 include ::python::params |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
286 if $operatingsystem == 'CentOS' { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
287 yumrepo { 'epel': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
288 mirrorlist => 'https://mirrors.fedoraproject.org/metalink?repo=epel-$releasever&arch=$basearch', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
289 descr => "Extra Packages for Enterprise Linux", |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
290 enabled => 1, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
291 failovermethod => absent, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
292 gpgcheck => 1, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
293 gpgkey => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver", |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
294 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
295 file { "/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver": |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
296 ensure => present, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
297 source => "puppet:///common/RPM-GPG-KEY-EPEL-$osver", |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
298 tag => 'repo-config', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
299 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
300 yumrepo { 'ibboard': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
301 baseurl => 'https://download.opensuse.org/repositories/home:/IBBoard:/server/CentOS_$releasever/', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
302 descr => 'Extra packages from IBBoard', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
303 enabled => 1, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
304 gpgcheck => 1, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
305 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
306 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
307 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
308 ensure => present, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
309 source => 'puppet:///common/RPM-GPG-KEY-ibboard', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
310 tag => 'repo-config', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
311 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
312 yumrepo { 'webtatic': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
313 ensure => absent, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
314 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
315 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-andy': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
316 ensure => absent, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
317 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
318 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-el7': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
319 ensure => absent, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
320 } |
409
621e78abf82c
Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents:
408
diff
changeset
|
321 # Python requires the `devel` package on CentOS, but by default the module tries to uninstall it |
621e78abf82c
Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents:
408
diff
changeset
|
322 $dev = 'present' |
621e78abf82c
Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents:
408
diff
changeset
|
323 } |
621e78abf82c
Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents:
408
diff
changeset
|
324 else { |
621e78abf82c
Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents:
408
diff
changeset
|
325 # Other distros can take the default devel status |
621e78abf82c
Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents:
408
diff
changeset
|
326 $dev = $::python::params::dev |
447
1a9de0661666
Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
446
diff
changeset
|
327 # CentOS-like distros have PKI by default. Others need it creating. |
1a9de0661666
Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
446
diff
changeset
|
328 file { '/etc/pki/': |
1a9de0661666
Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
446
diff
changeset
|
329 ensure => directory, |
1a9de0661666
Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
446
diff
changeset
|
330 } |
446
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
331 |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
332 apt::source { |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
333 'ibboard': |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
334 location => 'http://download.opensuse.org/repositories/home:/IBBoard:/server/xUbuntu_22.04/', |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
335 release => '/', |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
336 repos => '', |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
337 key => { |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
338 id => 'EDC682701D792970AD8645E7A7A55B845DCFCBE2', |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
339 source => "https://download.opensuse.org/repositories/home:IBBoard:server/xUbuntu_22.04/Release.key" |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
340 } |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
341 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
342 } |
148 | 343 |
272
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
344 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 { |
383
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
345 # The following may possibly work to ensure a CentOS Streams install. |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
346 # Or it might fail for inexplicable reasons. |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
347 # FIXME: Should be "centos-release-stream" to migrate (provides repos), but then that gets replaced by centos-stream-release, |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
348 # which Puppet doesn't recognise as the same and so keeps trying to re-install. May need an "unless" or maybe "allow_virtual" |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
349 package { 'centos-stream-release': |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
350 ensure => installed, |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
351 notify => Exec['migrate to streams']; |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
352 } |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
353 exec { 'migrate to streams': |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
354 command => '/usr/bin/dnf swap centos-linux-repos centos-stream-repos; /usr/bin/dnf distro-sync -y', |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
355 refreshonly => true |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
356 } |
148 | 357 } |
272
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
358 |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
359 class { 'python': |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
360 ensure => 'present', |
401
f0ee7a16125d
Switch to Python 3 on all platforms
IBBoard <dev@ibboard.co.uk>
parents:
399
diff
changeset
|
361 version => 'python3', |
272
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
362 pip => 'present', |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
363 use_epel => false, |
409
621e78abf82c
Fix `requires devel` problem with CentOS
IBBoard <dev@ibboard.co.uk>
parents:
408
diff
changeset
|
364 dev => $dev, |
272
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
365 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
366 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
367 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
368 class tools { |
446
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
369 $packages = [ 'sqlite', 'bash-completion', 'nano', 'zip', 'bzip2', 'mlocate', 'patch', 'tmux', 'wget', 'rsync' ] |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
370 package { $packages: |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
371 ensure => installed; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
372 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
373 if $osfamily == 'RedHat' { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
374 package { 'yum-utils': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
375 ensure => installed |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
376 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
377 } |
449
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
378 elsif $osfamily == 'Debian' { |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
379 package { 'dnsutils': |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
380 ensure => installed |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
381 } |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
382 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
383 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
384 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
385 class logrotate { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
386 package { 'logrotate': |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
387 ensure => installed; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
388 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
389 file { '/etc/logrotate.d/httpd': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
390 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
391 source => 'puppet:///common/logrotate-httpd', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
392 require => Package['logrotate'], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
393 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
394 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
395 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
396 class logwatch { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
397 package { 'logwatch': |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
398 ensure => installed; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
399 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
400 File { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
401 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
402 require => Package['logwatch'], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
403 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
404 file { '/etc/cron.daily/0logwatch': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
405 source => 'puppet:///common/0logwatch'; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
406 } |
332 | 407 $logwatch_dirs = [ |
408 '/etc/logwatch/', | |
409 '/etc/logwatch/conf/', | |
410 '/etc/logwatch/conf/logfiles/', | |
411 '/etc/logwatch/conf/services/', | |
345
bad68f1b6467
Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
342
diff
changeset
|
412 '/etc/logwatch/scripts/', |
bad68f1b6467
Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
342
diff
changeset
|
413 '/etc/logwatch/scripts/services/', |
332 | 414 ] |
415 file { $logwatch_dirs: | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
416 ensure => directory, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
417 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
418 file { '/etc/logwatch/conf/logwatch.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
419 content => 'Detail = Med', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
420 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
421 file { '/etc/logwatch/conf/logfiles/http.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
422 content => 'LogFile = apache/access_*.log', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
423 } |
332 | 424 file { '/etc/logwatch/conf/logfiles/http-error.conf': |
425 source => 'puppet:///common/logwatch/logfiles_http-error.conf', | |
126
8316d4e55e92
Fix Apache 2.4 Logwatch support
IBBoard <dev@ibboard.co.uk>
parents:
125
diff
changeset
|
426 } |
332 | 427 file { '/etc/logwatch/conf/logfiles/mysql.conf': |
428 source => 'puppet:///common/logwatch/logfiles_mysql.conf', | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
429 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
430 file { '/etc/logwatch/conf/logfiles/php.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
431 source => 'puppet:///common/logwatch/logfiles_php.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
432 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
433 file { '/etc/logwatch/conf/services/php.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
434 source => 'puppet:///common/logwatch/services_php.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
435 } |
379
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
436 file { '/etc/logwatch/conf/services/contact-form.conf': |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
437 source => 'puppet:///common/logwatch/services_contact-form.conf', |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
438 } |
345
bad68f1b6467
Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
342
diff
changeset
|
439 file { '/etc/logwatch/scripts/services/dovecot': |
bad68f1b6467
Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
342
diff
changeset
|
440 source => 'puppet:///common/logwatch/dovecot', |
bad68f1b6467
Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
342
diff
changeset
|
441 } |
346
61be075c5a68
Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
345
diff
changeset
|
442 file { '/etc/logwatch/scripts/services/postfix': |
61be075c5a68
Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
345
diff
changeset
|
443 source => 'puppet:///common/logwatch/postfix', |
61be075c5a68
Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
345
diff
changeset
|
444 } |
347
73d7b3ec6263
Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents:
346
diff
changeset
|
445 file { '/etc/logwatch/scripts/services/systemd': |
73d7b3ec6263
Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents:
346
diff
changeset
|
446 source => 'puppet:///common/logwatch/systemd', |
73d7b3ec6263
Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents:
346
diff
changeset
|
447 } |
379
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
448 file { '/etc/logwatch/scripts/services/php': |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
449 source => 'puppet:///common/logwatch/php', |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
450 } |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
451 file { '/etc/logwatch/scripts/services/contact-form': |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
452 source => 'puppet:///common/logwatch/contact-form', |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
453 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
454 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
455 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
456 #Our web server with our configs, not just a stock one |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
457 class webserver ( |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
458 $primary_ip, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
459 $proxy_4to6_ip_prefix = undef, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
460 $proxy_4to6_mask = undef, |
279 | 461 $proxy_upstream = undef, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
462 ) { |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
463 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
464 #Setup base website parameters |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
465 class { 'website': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
466 base_dir => '/srv/sites', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
467 primary_ip => $primary_ip, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
468 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
469 proxy_4to6_mask => $proxy_4to6_mask, |
279 | 470 proxy_upstream => $proxy_upstream, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
471 default_owner => $defaultusers::default_user, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
472 default_group => $defaultusers::default_user, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
473 default_tld => 'co.uk', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
474 default_extra_tlds => [ 'com' ], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
475 } |
110 | 476 |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
477 if $operatingsystem == 'CentOS' { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
478 $php_suffix = '' |
419 | 479 $variant_prefix = 'php-' |
416
b185498177ef
Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents:
415
diff
changeset
|
480 $extra_prefix = 'pecl-' |
422 | 481 $extra_extras = { |
482 'posix' => { | |
483 ini_prefix => '20-', | |
446
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
484 }, |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
485 # Sodium has been bundled since 7.2, but CentOS packages it separately |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
486 'sodium' => { |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
487 ini_prefix => '20-', |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
488 }, |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
489 # JSON is integrated into PHP 8+ and so it's only a plugin in CentOS |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
490 'json' => { |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
491 ini_prefix => '20-', |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
492 }, |
422 | 493 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
494 if versioncmp($operatingsystemrelease, '8') >= 0 { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
495 yumrepo { 'remirepo-safe': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
496 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/$basearch/mirror', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
497 descr => "Extra CentOS packages from Remi", |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
498 enabled => 1, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
499 failovermethod => absent, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
500 gpgcheck => 1, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
501 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
502 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
503 yumrepo { 'remirepo-php': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
504 mirrorlist => 'http://cdn.remirepo.net/enterprise/8/modular/$basearch/mirror', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
505 descr => 'Remi\'s Modular repository for Enterprise Linux 8 - $basearch', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
506 enabled => 1, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
507 failovermethod => absent, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
508 gpgcheck => 1, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
509 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
510 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
511 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
512 ensure => present, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
513 source => 'puppet:///common/RPM-GPG-KEY-remi.el8', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
514 tag => 'repo-config', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
515 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
516 } else { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
517 yumrepo { 'remirepo-safe': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
518 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/mirror', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
519 descr => "Extra CentOS packages from Remi", |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
520 enabled => 1, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
521 failovermethod => absent, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
522 gpgcheck => 1, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
523 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
524 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
525 yumrepo { 'remirepo-php': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
526 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/php74/mirror', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
527 descr => "PHP7.4 for CentOS from Remi", |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
528 enabled => 1, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
529 failovermethod => absent, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
530 gpgcheck => 1, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
531 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
532 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
533 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
534 ensure => present, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
535 source => 'puppet:///common/RPM-GPG-KEY-remi', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
536 tag => 'repo-config', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
537 } |
320 | 538 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
539 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
540 elsif $operatingsystem == 'Ubuntu' { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
541 $php_suffix = '' |
416
b185498177ef
Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents:
415
diff
changeset
|
542 $variant_prefix = 'php-' |
b185498177ef
Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents:
415
diff
changeset
|
543 $extra_prefix = '' |
446
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
544 # Work around constant re-install by enabling virtual packages |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
545 # https://github.com/voxpupuli/puppet-php/issues/387 |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
546 Package { |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
547 allow_virtual => true |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
548 } |
416
b185498177ef
Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents:
415
diff
changeset
|
549 $extra_extras = {} |
238 | 550 } |
110 | 551 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
552 #Configure the PHP version to use |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
553 class { 'website::php': |
350
85d2c0079af9
Make opcache core and add APCu for object caching
IBBoard <dev@ibboard.co.uk>
parents:
347
diff
changeset
|
554 suffix => $php_suffix, |
335
aa9f570d6a9c
Switch to PHP 7.4 now that NextCloud has reached v18
IBBoard <dev@ibboard.co.uk>
parents:
334
diff
changeset
|
555 module => ($operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0) ? { true => 'remi-7.4', default => undef }, |
416
b185498177ef
Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents:
415
diff
changeset
|
556 extras => { |
422 | 557 'bcmath' => { |
558 ini_prefix => '20-', | |
559 }, | |
560 'curl' => { | |
561 ini_prefix => '20-', | |
562 }, | |
563 'dom' => { | |
564 ini_prefix => '20-', | |
565 }, | |
566 'enchant' => { | |
567 ini_prefix => '20-', | |
568 }, | |
569 'exif' => { | |
570 ini_prefix => '20-', | |
416
b185498177ef
Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents:
415
diff
changeset
|
571 }, |
422 | 572 'fileinfo' => { |
573 ini_prefix => '20-', | |
574 }, | |
575 'gmp' => { | |
576 ini_prefix => '20-', | |
577 }, | |
578 'intl' => { | |
579 ini_prefix => '20-', | |
580 }, | |
581 'mysqlnd' => { | |
582 ini_prefix => '20-', | |
583 }, | |
584 'pdo' => { | |
585 ini_prefix => '20-', | |
419 | 586 }, |
422 | 587 'simplexml' => { |
588 ini_prefix => '20-', | |
589 }, | |
590 'soap' => { | |
591 ini_prefix => '20-', | |
592 }, | |
593 'xmlwriter' => { | |
594 ini_prefix => '20-', | |
595 }, | |
596 'mysqli' => { | |
597 ini_prefix => '30-', | |
416
b185498177ef
Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents:
415
diff
changeset
|
598 }, |
422 | 599 'pdo_mysql' => { |
600 ini_prefix => '30-', | |
446
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
601 # Provided by the php-mysql package in CentOS and declared with "Provides" |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
602 # And Ubuntu is the same but without the "Provides" |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
603 provider => "none", |
422 | 604 }, |
605 'xmlreader' => { | |
606 ini_prefix => '30-', | |
607 }, | |
608 'zip' => { | |
609 ini_prefix => '30-', | |
610 package_prefix => "${variant_prefix}${extra_prefix}" | |
611 }, | |
612 'apcu' => { | |
613 ini_prefix => '40-', | |
614 package_prefix => "${variant_prefix}${extra_prefix}" | |
615 }, | |
616 'imagick' => { | |
617 ini_prefix => '40-', | |
618 package_prefix => "${variant_prefix}${extra_prefix}" | |
619 }, | |
416
b185498177ef
Backed out changeset 6421c6f77eb8 - Add SOAP
IBBoard <dev@ibboard.co.uk>
parents:
415
diff
changeset
|
620 } + $extra_extras, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
621 } |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
622 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
623 #Setup MySQL, using (private) templates to make sure that we set non-std passwords and a default user |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
624 if $operatingsystem == 'CentOS' { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
625 if versioncmp($operatingsystemrelease, '7') >= 0 { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
626 $mysqlpackage = 'mariadb' |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
627 $mysqlsuffix = '' |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
628 |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
629 # Required for SELinux rule setting/status checks |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
630 if versioncmp($operatingsystemrelease, '8') >= 0 { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
631 $semanage_package_name = 'policycoreutils-python-utils' |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
632 } else { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
633 $semanage_package_name = 'policycoreutils-python' |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
634 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
635 |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
636 package { 'policycoreutils-python': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
637 name => $semanage_package_name, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
638 ensure => present, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
639 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
640 |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
641 $extra_packages = [ |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
642 'perl-Sys-Syslog', #Required for Perl SPF checking |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
643 ] |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
644 |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
645 package { $extra_packages: |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
646 ensure => installed |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
647 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
648 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
649 else { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
650 $mysqlpackage = 'mysql' |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
651 $mysqlsuffix = '55w' |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
652 } |
393
a948419a23b1
Fix MySQL package names on Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
390
diff
changeset
|
653 $phpmysqlsuffix = 'nd' |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
654 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
655 elsif $operatingsystem == 'Ubuntu' { |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
656 $mysqlpackage = 'mariadb' |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
657 $mysqlsuffix = '' |
393
a948419a23b1
Fix MySQL package names on Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
390
diff
changeset
|
658 $phpmysqlsuffix = '' |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
659 } |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
660 else { |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
661 fail("No MySQL support for ${operatingsystem}") |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
662 } |
402 | 663 include ::defaultusers::params |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
664 class { 'website::mysql': |
402 | 665 mysqluser => $::defaultusers::params::mysql_user, |
666 mysqlpassword => $::defaultusers::params::mysql_password, | |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
667 mysqlprefix => $mysqlpackage, |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
668 mysqlsuffix => $mysqlsuffix, |
110 | 669 phpsuffix => $php_suffix, |
393
a948419a23b1
Fix MySQL package names on Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
390
diff
changeset
|
670 phpmysqlsuffix => $phpmysqlsuffix |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
671 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
672 |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
673 # Additional supporting directories that aren't served as sites |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
674 file { [ '/srv/sites/errorhandling', '/srv/sites/private', '/srv/cms' ]: |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
675 ensure => directory, |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
676 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
677 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
678 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
679 class ibboardvpsnode ( |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
680 $primary_ip, |
449
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
681 $gateway_ip = undef, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
682 $proxy_4to6_ip_prefix = undef, |
279 | 683 $proxy_upstream = undef, |
326 | 684 $nat64_ranges = [], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
685 $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
686 $imapserver, |
326 | 687 $mailrelays = [], |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
688 $firewall_cmd = 'iptables', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
689 ){ |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
690 class { 'basevpsnode': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
691 primary_ip => $primary_ip, |
449
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
692 gateway_ip => $gateway_ip, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
693 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix, |
279 | 694 proxy_upstream => $proxy_upstream, |
326 | 695 nat64_ranges => $nat64_ranges, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
696 mailserver => $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
697 imapserver => $imapserver, |
326 | 698 mailrelays => $mailrelays, |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
699 firewall_cmd => $firewall_cmd, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
700 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
701 |
267
edeedd13262c
Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
702 # Set timezone to something sensible |
edeedd13262c
Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
703 file { "/etc/localtime": |
edeedd13262c
Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
704 ensure => 'link', |
edeedd13262c
Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
705 target => '/usr/share/zoneinfo/Europe/London', |
edeedd13262c
Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
706 } |
edeedd13262c
Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
707 |
446
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
708 # Debian doesn't handle sensible depends like module names because of the underscore |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
709 # So we need to use the package name |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
710 package { "mod_cspnonce": |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
711 name => $osfamily == 'Debian' ? { true => "libapache2-mod-cspnonce", default => "mod_cspnonce" }, |
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
712 ensure => installed, |
410 | 713 } |
714 | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
715 # Common modules used by multiple sites (mod_auth_basic is safe because we HTTPS all the things) |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
716 $mods = [ |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
717 'auth_basic', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
718 'authn_core', |
146
816e35f86a5d
Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents:
145
diff
changeset
|
719 'authn_file', |
816e35f86a5d
Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents:
145
diff
changeset
|
720 'authz_user', |
816e35f86a5d
Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents:
145
diff
changeset
|
721 'deflate', |
410 | 722 'xsendfile', |
723 'cspnonce' | |
146
816e35f86a5d
Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents:
145
diff
changeset
|
724 ] |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
725 apache::mod { |
146
816e35f86a5d
Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents:
145
diff
changeset
|
726 $mods:; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
727 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
728 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
729 #Configure our sites, using templates for the custom fragments where the extra content is too long |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
730 class { "devsite": |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
731 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:01", default => undef } |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
732 } |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
733 class { "adminsite": |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
734 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:02", default => undef } |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
735 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
736 website::https::multitld { 'www.ibboard': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
737 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef }, |
246 | 738 custom_fragment => template("privat/apache/ibboard.fragment"), |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
739 letsencrypt_name => 'ibboard.co.uk', |
236
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
740 csp_override => { |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
741 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
742 "default-src" => "'none'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
743 "img-src" => "'self' https://live.staticflickr.com/", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
744 "script-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
745 "style-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
746 "font-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
747 "form-action" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
748 "connect-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
749 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
750 } |
374
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
751 website::https::redir { 'mail.ibboard.co.uk': |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
752 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef }, |
374
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
753 redir => 'https://ibboard.co.uk/', |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
754 docroot => "${website::basedir}/ibboard", |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
755 letsencrypt_name => 'ibboard.co.uk', |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
756 separate_log => true, |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
757 } |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
758 website::https::redir { 'imap.ibboard.co.uk': |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
759 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef }, |
374
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
760 redir => 'https://ibboard.co.uk/', |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
761 docroot => "${website::basedir}/ibboard", |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
762 letsencrypt_name => 'ibboard.co.uk', |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
763 separate_log => true, |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
764 } |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
765 class { "hiveworldterrasite": |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
766 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:04", default => undef } |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
767 } |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
768 class { "bdstrikesite": |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
769 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:05", default => undef } |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
770 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
771 website::https::multitld { 'www.abiknight': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
772 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:06", default => undef }, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
773 custom_fragment => "$website::htmlphpfragment |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
774 ErrorDocument 404 /error.php", |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
775 letsencrypt_name => 'abiknight.co.uk', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
776 } |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
777 class { "webmailpimsite": |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
778 proxy_4to6_ip_pim => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:08", default => undef }, |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
779 proxy_4to6_ip_webmail => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:09", default => undef }, |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
780 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
781 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
782 |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
783 class adminsite ($proxy_4to6_ip) { |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
784 apache::mod { 'info':; 'status':; 'cgi':; } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
785 website::https::multitld { 'admin.ibboard': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
786 proxy_4to6_ip => $proxy_4to6_ip, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
787 force_no_index => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
788 ssl_ca_chain => '', |
422 | 789 csp_override => { |
790 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce", | |
791 "img-src" => "'self' data:", | |
792 }, | |
426 | 793 csp_report_override => { |
794 "img-src" => "'self' data:", | |
795 }, | |
246 | 796 custom_fragment => template("privat/apache/admin.fragment"), |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
797 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
798 if $osfamily == 'RedHat' { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
799 $cron_user = 'apache' |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
800 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
801 elsif $osfamily == 'Debian' { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
802 $cron_user = 'www-data' |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
803 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
804 cron { 'loadavg': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
805 command => '/usr/local/bin/run-loadavg-logger', |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
806 user => $cron_user, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
807 minute => '*/6' |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
808 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
809 cron { 'awstats': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
810 command => '/usr/local/bin/update-awstats > /srv/sites/admin/awstats.log', |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
811 user => $cron_user, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
812 hour => '*/6', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
813 minute => '0' |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
814 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
815 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
816 |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
817 class hiveworldterrasite ($proxy_4to6_ip) { |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
818 website::https::multitld { 'www.hiveworldterra': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
819 proxy_4to6_ip => $proxy_4to6_ip, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
820 force_no_www => false, |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
821 letsencrypt_name => 'hiveworldterra.co.uk', |
246 | 822 custom_fragment => template("privat/apache/hwt.fragment"), |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
823 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
824 website::https::multitld { 'forums.hiveworldterra': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
825 proxy_4to6_ip => $proxy_4to6_ip, |
331
f69e2d197302
Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents:
330
diff
changeset
|
826 letsencrypt_name => 'forums.hiveworldterra.co.uk', |
246 | 827 custom_fragment => template("privat/apache/forums.fragment"), |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
828 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
829 website::https::multitld { 'skins.hiveworldterra': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
830 proxy_4to6_ip => $proxy_4to6_ip, |
334 | 831 letsencrypt_name => 'skins.hiveworldterra.co.uk', |
246 | 832 custom_fragment => template("privat/apache/skins.fragment"), |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
833 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
834 website::https::redir { 'hiveworldterra.ibboard.co.uk': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
835 proxy_4to6_ip => $proxy_4to6_ip, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
836 redir => 'https://www.hiveworldterra.co.uk/', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
837 docroot => "${website::basedir}/hiveworldterra", |
334 | 838 letsencrypt_name => 'hiveworldterra.ibboard.co.uk', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
839 separate_log => true, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
840 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
841 } |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
842 class bdstrikesite ($proxy_4to6_ip) { |
331
f69e2d197302
Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents:
330
diff
changeset
|
843 website::https::multitld { 'www.bdstrike': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
844 proxy_4to6_ip => $proxy_4to6_ip, |
145 | 845 docroot_owner => $defaultusers::secondary_user, |
846 docroot_group => 'editors', | |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
847 letsencrypt_name => 'bdstrike.co.uk', |
246 | 848 custom_fragment => template("privat/apache/bdstrike.fragment"), |
411
83f2e944a43f
Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents:
410
diff
changeset
|
849 csp_override => { |
83f2e944a43f
Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents:
410
diff
changeset
|
850 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce", |
364
8224f42ee05b
Expand BDStrike CSP to allow more styling and fonts
IBBoard <dev@ibboard.co.uk>
parents:
362
diff
changeset
|
851 "font-src" => "'self' https://fonts.gstatic.com/ data:", |
446
ba3c446d5a47
Update config to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
439
diff
changeset
|
852 "img-src" => "'self' https://secure.gravatar.com/ https://ps.w.org/ https://s.w.org/ data:", |
411
83f2e944a43f
Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents:
410
diff
changeset
|
853 "style-src" => "'self' https://fonts.googleapis.com/ 'unsafe-inline'", |
83f2e944a43f
Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents:
410
diff
changeset
|
854 "connect-src" => "'self' https://www.sandbox.paypal.com/ https://www.paypal.com/", |
83f2e944a43f
Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents:
410
diff
changeset
|
855 "frame-ancestors" => "'self'" |
83f2e944a43f
Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents:
410
diff
changeset
|
856 }, |
83f2e944a43f
Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents:
410
diff
changeset
|
857 csp_report_override => { |
422 | 858 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/reportOnly", |
411
83f2e944a43f
Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents:
410
diff
changeset
|
859 "font-src" => "'self' https://fonts.gstatic.com/ data:", # TODO: What's generating it? |
83f2e944a43f
Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents:
410
diff
changeset
|
860 "img-src" => "'self' https://secure.gravatar.com/ data:", |
426 | 861 "style-src" => "'self' https://fonts.googleapis.com/ 'nonce-%{CSP_NONCE}e' 'unsafe-hashes' 'sha256-anQSeQoEnQnBulZOQkDOFf+e6xBIGmqh7M8YFT992co=' 'sha256-zJDyuABAg68wtWDFyIh+RRe+6Vm/r+BLwaNRCGNVyXI=' 'sha256-qMalr/MPLUDW4lX/rq/cGp1Eu/H0cu0Yg98pdu69Jxs=' 'sha256-mshqJ+hidJMRDeNLHknuDAeYLOPg2OTIIA3nZmHgi9U=' 'sha256-YnRUd/QjP/NuFgfjMHhNfMCqXh0RQIGdvQfMCOf6qkw=' 'sha256-EwdiFJgqhefinoeAymrWxOYW4kza2Ekos5MY0PlXYI0=' 'sha256-G4K9vh8e+37+l69S+lHTyX3CfcK95mQUgyxYPCb7uME=' 'sha256-t6oewASd7J1vBg5mQtX4hl8bg8FeegYFM3scKLIhYUc=' 'sha256-mAQYxa3mIYqoLBrm1zLu6sLajr8vUHVFLYNpl6dAakM=' 'sha256-A8foknjCsFBi1PlRehOrHq0pVySigUurqAUgZ2y2U8c=' 'sha256-biLFinpqYMtWHmXfkA1BPeCY0/fNt46SAZ+BBk5YUog=' 'sha256-WzSByVQ8yW/DKrr77TWVt7WEMzueRcfJZImOkjTBKmc=' 'sha256-efof3agGBAL/yN8TplyNbLEgDZ3wIGMK3UMYbe8slkA='", |
411
83f2e944a43f
Set security settings on BDStrike.co.uk
IBBoard <dev@ibboard.co.uk>
parents:
410
diff
changeset
|
862 "connect-src" => "'self' https://www.sandbox.paypal.com/ https://www.paypal.com/", |
236
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
863 }, |
145 | 864 } |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
865 |
235
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
866 cron { 'wordpress_cron': |
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
867 # Run "php -f wp-cron.php" on a schedule so that we can auto-update |
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
868 # without giving Apache full write access! |
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
869 command => "/usr/local/bin/bdstrike-cron", |
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
870 user => $defaultusers::default_user, |
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
871 minute => '*/15', |
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
872 } |
145 | 873 } |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
874 class devsite ($proxy_4to6_ip) { |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
875 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 { |
418
dd12bb713260
Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents:
417
diff
changeset
|
876 $package_name = 'python3-mod_wsgi' |
dd12bb713260
Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents:
417
diff
changeset
|
877 $mod_path = 'mod_wsgi_python3.so' |
261
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
878 } else { |
418
dd12bb713260
Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents:
417
diff
changeset
|
879 $package_name = undef |
dd12bb713260
Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents:
417
diff
changeset
|
880 $mod_path = undef |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
881 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
882 class { 'apache::mod::wsgi': |
418
dd12bb713260
Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents:
417
diff
changeset
|
883 package_name => $package_name, |
dd12bb713260
Fix mod_wsgi package install on CentOS
IBBoard <dev@ibboard.co.uk>
parents:
417
diff
changeset
|
884 mod_path => $mod_path, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
885 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
886 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
887 website::https::multitld { 'dev.ibboard': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
888 proxy_4to6_ip => $proxy_4to6_ip, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
889 #Make sure we're the first one hit for the tiny fraction of "no support" cases we care about (potentially Python for Mercurial!) |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
890 # http://en.wikipedia.org/wiki/Server_Name_Indication#No_support |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
891 priority => 1, |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
892 letsencrypt_name => 'dev.ibboard.co.uk', |
246 | 893 custom_fragment => template("privat/apache/dev.fragment"), |
281
af7df930a670
Add 4-to-6 proxy and mod_remoteip setup
IBBoard <dev@ibboard.co.uk>
parents:
279
diff
changeset
|
894 proxy_fragment => template("privat/apache/dev-proxy.fragment"), |
52
be1e9773a12c
Mercurial repo versions index.php files etc, so removing index.php breaks things!
IBBoard <dev@ibboard.co.uk>
parents:
44
diff
changeset
|
895 force_no_index => false, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
896 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
897 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
898 |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
899 class webmailpimsite ($proxy_4to6_ip_pim, $proxy_4to6_ip_webmail) { |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
900 # Webmail and Personal Information Management (PIM) sites |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
901 website::https { 'webmail.ibboard.co.uk': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
902 proxy_4to6_ip => $proxy_4to6_ip_webmail, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
903 force_no_index => false, |
414
23eac935cffa
Switch to LetsEncrypt on Webmail
IBBoard <dev@ibboard.co.uk>
parents:
413
diff
changeset
|
904 letsencrypt_name => 'webmail.ibboard.co.uk', |
246 | 905 custom_fragment => template("privat/apache/webmail.fragment"), |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
906 } |
396
e93588ec1ce3
Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents:
393
diff
changeset
|
907 include ::apache::params |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
908 website::https { 'pim.ibboard.co.uk': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
909 proxy_4to6_ip => $proxy_4to6_ip_pim, |
396
e93588ec1ce3
Use "param" variables for settings instead of conditions
IBBoard <dev@ibboard.co.uk>
parents:
393
diff
changeset
|
910 docroot_owner => $apache::params::user, |
242
7d8e664ebcc9
Change owner/group on Nextcloud for easy upgrade
IBBoard <dev@ibboard.co.uk>
parents:
241
diff
changeset
|
911 docroot_group => 'editors', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
912 force_no_index => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
913 lockdown_requests => false, |
429
fa3093f2dc8e
Migrate NextCloud to LetsEncrypt
IBBoard <dev@ibboard.co.uk>
parents:
426
diff
changeset
|
914 letsencrypt_name => 'pim.ibboard.co.uk', |
265
bf2b8912c414
Make PIM site skip CSP headers - NextCloud manages them
IBBoard <dev@ibboard.co.uk>
parents:
264
diff
changeset
|
915 csp => false, |
bf2b8912c414
Make PIM site skip CSP headers - NextCloud manages them
IBBoard <dev@ibboard.co.uk>
parents:
264
diff
changeset
|
916 csp_report => false, |
246 | 917 custom_fragment => template("privat/apache/pim.fragment"), |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
918 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
919 cron { 'owncloudcron': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
920 command => "/usr/local/bin/owncloud-cron", |
402 | 921 user => $apache::params::user, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
922 minute => '*/15', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
923 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
924 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
925 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
926 class email ( |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
927 $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
928 $imapserver, |
311
51d3748f8112
Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents:
310
diff
changeset
|
929 $mailserver_ip, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
930 $proxy_ip = undef, |
311
51d3748f8112
Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents:
310
diff
changeset
|
931 $proxy_upstream = [], |
326 | 932 $nat64_ranges = [], |
933 $mailrelays = [], | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
934 ){ |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
935 class { 'postfix': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
936 mailserver => $mailserver, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
937 mailserver_ip => $mailserver_ip, |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
938 mailserver_proxy => $proxy_ip, |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
939 proxy_upstream => $proxy_upstream, |
326 | 940 mailrelays => $mailrelays, |
941 nat64_ranges => $nat64_ranges, | |
317
2a20a5b7f65a
Swap IPv6 Postfix to "all" protocols to support PROXY
IBBoard <dev@ibboard.co.uk>
parents:
313
diff
changeset
|
942 protocols => $mailserver_ip =~ Stdlib::IP::Address::V6 ? { true => 'all', default => 'ipv4' }, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
943 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
944 class { 'dovecot': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
945 imapserver => $imapserver, |
311
51d3748f8112
Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents:
310
diff
changeset
|
946 imapserver_ip => $mailserver_ip, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
947 imapserver_proxy => $proxy_ip, |
311
51d3748f8112
Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents:
310
diff
changeset
|
948 proxy_upstream => $proxy_upstream, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
949 } |
177
1b605c38b375
Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents:
176
diff
changeset
|
950 # Unspecified SpamAssassin config dependencies that started |
1b605c38b375
Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents:
176
diff
changeset
|
951 # showing up as errors in our logs |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
952 if $osfamily == 'RedHat' { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
953 $spamassassin_deps = ['perl-File-MimeInfo'] |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
954 $spamassassin_dir = '/etc/mail/spamassassin/' |
449
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
955 $amavis_config = '/etc/amavisd/amavisd.conf' |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
956 $amavis_rundir = '/var/run/amavisd' |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
957 $amavis_spooldir = '/var/spool/amavisd' |
453
dc725b618258
Fix Amavis quarantine directory
IBBoard <dev@ibboard.co.uk>
parents:
449
diff
changeset
|
958 $amavis_quarantinedir = '$MYHOME/quarantine' |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
959 $amavis_service = 'amavisd' |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
960 # CentOS has a Clam service, but we call on demand (Ubuntu doesn't have a service) |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
961 service { 'clamd@amavisd': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
962 ensure => 'stopped', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
963 enable=> 'mask', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
964 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
965 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
966 elsif $osfamily == 'Debian' { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
967 $spamassassin_deps = ['libfile-mimeinfo-perl'] |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
968 $spamassassin_dir = '/etc/spamassassin/' |
449
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
969 $amavis_config = '/etc/amavis/conf.d/60-puppeted' |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
970 $amavis_rundir = '/var/run/amavis' |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
971 $amavis_spooldir = '/var/lib/amavis' |
453
dc725b618258
Fix Amavis quarantine directory
IBBoard <dev@ibboard.co.uk>
parents:
449
diff
changeset
|
972 $amavis_quarantinedir = '$MYHOME/virusmails' |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
973 $amavis_service = 'amavis' |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
974 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
975 package { $spamassassin_deps: |
177
1b605c38b375
Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents:
176
diff
changeset
|
976 ensure => installed, |
1b605c38b375
Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents:
176
diff
changeset
|
977 } |
140
6eef7cec8658
Remove ClamAV from server config
IBBoard <dev@ibboard.co.uk>
parents:
139
diff
changeset
|
978 package { [ 'amavisd-new' ]: |
85 | 979 ensure => installed, |
980 tag => 'av', | |
981 } | |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
982 service { $amavis_service: |
86
4f59d2fcd521
Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents:
85
diff
changeset
|
983 ensure => 'running', |
4f59d2fcd521
Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents:
85
diff
changeset
|
984 enable => 'true', |
4f59d2fcd521
Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents:
85
diff
changeset
|
985 } |
449
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
986 file { $amavis_config: |
85 | 987 ensure => present, |
449
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
988 content => epp('privat/postfix/amavis.conf.epp', |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
989 { |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
990 fqdn => $::fqdn, |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
991 rundir => $amavis_rundir, |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
992 spooldir => $amavis_spooldir, |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
993 quarantinedir => $amavis_quarantinedir, |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
994 } |
4a6ad700cded
Update config for real Raspberry Pi host
IBBoard <dev@ibboard.co.uk>
parents:
448
diff
changeset
|
995 ), |
85 | 996 tag => 'av', |
997 } | |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
998 file { "${spamassassin_dir}local.cf": |
163
4e53d77fa586
Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents:
162
diff
changeset
|
999 ensure => present, |
4e53d77fa586
Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents:
162
diff
changeset
|
1000 source => 'puppet:///private/postfix/spamassassin-local.cf', |
4e53d77fa586
Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents:
162
diff
changeset
|
1001 tag => 'av', |
4e53d77fa586
Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents:
162
diff
changeset
|
1002 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
1003 file { "${spamassassin_dir}ole2macro.cf": |
142
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
1004 ensure => present, |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
1005 source => 'puppet:///common/ole2macro.cf', |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
1006 tag => 'av', |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
1007 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
1008 file { "${spamassassin_dir}ole2macro.pm": |
142
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
1009 ensure => present, |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
1010 source => 'puppet:///common/spamassassin-vba-macro-master/ole2macro.pm', |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
1011 tag => 'av', |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
1012 } |
85 | 1013 Package<| tag == 'av' |> -> File<| tag == 'av' |> |
87
6be21a984126
Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents:
86
diff
changeset
|
1014 File<| tag == 'av' |> { |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
385
diff
changeset
|
1015 notify => Service[$amavis_service], |
87
6be21a984126
Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents:
86
diff
changeset
|
1016 } |
125
ca711ab45f17
Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents:
122
diff
changeset
|
1017 cron { 'Postwhite': |
129
16a931df5fd7
Filter what we see in Postwhite cron output
IBBoard <dev@ibboard.co.uk>
parents:
128
diff
changeset
|
1018 command => "/usr/local/bin/postwhite 2>&1| grep -vE '^(Starting|Recursively|Getting|Querying|Removing|Sorting|$)'", |
125
ca711ab45f17
Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents:
122
diff
changeset
|
1019 user => 'root', |
ca711ab45f17
Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents:
122
diff
changeset
|
1020 weekday => 0, |
128
379089631403
Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents:
126
diff
changeset
|
1021 hour => 2, |
379089631403
Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents:
126
diff
changeset
|
1022 minute => 0, |
125
ca711ab45f17
Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents:
122
diff
changeset
|
1023 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1024 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1025 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1026 class cronjobs { |
447
1a9de0661666
Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
446
diff
changeset
|
1027 package { 'cron': |
1a9de0661666
Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
446
diff
changeset
|
1028 ensure => installed, |
1a9de0661666
Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
446
diff
changeset
|
1029 name => $operatingsystem == 'Ubuntu' ? { true => 'cron', default => 'cronie' } |
1a9de0661666
Add missing package/dir for minimal Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
446
diff
changeset
|
1030 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1031 # Add Mutt for scripts that send emails, but stop it clogging the disk by keeping copies of emails |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1032 package { 'mutt': |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
1033 ensure => installed, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1034 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1035 file { '/etc/Muttrc.local': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1036 content => 'set copy = no', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1037 require => Package['mutt'], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1038 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1039 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1040 # General server-wide cron jobs |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1041 Cron { user => 'root' } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1042 cron { 'backupalldbs': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1043 command => "/usr/local/bin/backupalldbs", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1044 monthday => "*/2", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1045 hour => "4", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1046 minute => "9" |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1047 } |
323
002203790815
Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents:
322
diff
changeset
|
1048 # Only run the Great Firewall Against China on IPv4 (since we don't have an IPv6 list |
002203790815
Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents:
322
diff
changeset
|
1049 # and the PROXY forwards the IPs to services, but not at the network level) |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1050 cron { 'greatfirewallofchina': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1051 command => '/usr/local/bin/update-great-firewall-of-china', |
323
002203790815
Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents:
322
diff
changeset
|
1052 ensure => has_key($facts, 'ipaddress') ? { true => "present", default => "absent" }, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1053 hour => 3, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1054 minute => 30 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1055 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1056 cron { 'permissions': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1057 command => '/usr/local/bin/set-permissions', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1058 hour => 3, |
14
534e584f21ce
Tweak time on permission setting script so that it is less likely to clash with LoadAVG run every 6 minutes
IBBoard <dev@ibboard.co.uk>
parents:
13
diff
changeset
|
1059 minute => 2 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1060 } |
55
ce8eaaca6a34
Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents:
54
diff
changeset
|
1061 # Since we're only managing the local server, use our script that wraps "puppet apply" instead of PuppetMaster |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1062 cron { 'puppet': |
268
9f054191b9db
Filter new log line from puppet-apply output
IBBoard <dev@ibboard.co.uk>
parents:
267
diff
changeset
|
1063 command => '/usr/local/bin/puppet-apply | grep -v "Compiled catalog for\|Finished catalog run in\|Applied catalog in"', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1064 hour => '*/6', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1065 minute => 5 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1066 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1067 cron { 'purgecaches': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1068 command => "/usr/local/bin/purge-caches", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1069 hour => '4', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1070 minute => '15', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1071 weekday => '1', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1072 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1073 # Notify of uncommitted files |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1074 cron { 'check-mercurial-committed': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1075 command => "/usr/local/bin/check-hg-status", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1076 hour => '4', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1077 minute => '20', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1078 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1079 } |
93
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
1080 # Notify of available updates |
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
1081 cron { 'check-yum-updates': |
415 | 1082 command => '/usr/bin/yum check-update | grep -E "^[^ ]+ +[0-9a-z:_\.-]+ +[^ ]+\s*\$"', |
93
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
1083 hour => '4', |
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
1084 minute => '30', |
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
1085 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning |
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
1086 } |
97
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
1087 # And check whether anything needs restarting |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
1088 cron { 'check-needs-restarting': |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
1089 command => '/usr/bin/needs-restarting|grep -v "/usr/lib/systemd\|/usr/sbin/lvmetad\|/usr/lib/polkit-1/polkitd"', |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
1090 hour => '4', |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
1091 minute => '45', |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
1092 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
1093 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1094 } |