Mercurial > repos > other > Puppet
annotate modules/website/manifests/init.pp @ 390:df5ad1612af7
Adapt configs to support Ubuntu
This is prep for running a VPS on a Mythic Beasts Raspberry Pi
* Switch paths where necessary
* Add optional modules that only apply on some OSes
* Change usernames and groups
* Don't do RPM-based stuff in Ubuntu
* Switch to using some of the new modules
author | IBBoard <dev@ibboard.co.uk> |
---|---|
date | Mon, 03 Jan 2022 18:37:16 +0000 |
parents | 05cad5ba9506 |
children | 575764c36e16 |
rev | line source |
---|---|
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
1 class website( |
277
13825cc1ec57
Replace deprecated validation methods
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
2 Pattern[/^(\/[^\/]+)*$/] $base_dir, |
13825cc1ec57
Replace deprecated validation methods
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
3 Pattern[/^(\/[^\/]+)*$/] $cert_dir = '/etc/pki/custom', |
279 | 4 Stdlib::IP::Address $primary_ip, |
288 | 5 Optional[Stdlib::IP::Address::V6] $proxy_4to6_ip_prefix = undef, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
6 Optional[Integer] $proxy_4to6_mask = undef, |
287
97e732f67770
Make upstream proxies optional to match undef default
IBBoard <dev@ibboard.co.uk>
parents:
286
diff
changeset
|
7 Optional[Array] $proxy_upstream = undef, |
277
13825cc1ec57
Replace deprecated validation methods
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
8 String $default_owner, |
13825cc1ec57
Replace deprecated validation methods
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
9 String $default_group, |
13825cc1ec57
Replace deprecated validation methods
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
10 String $default_tld = 'com', |
13825cc1ec57
Replace deprecated validation methods
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
11 Array $default_extra_tlds = [] |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
12 ){ |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
13 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
14 $basedir = $base_dir |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
15 $certdir = $cert_dir |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
16 $docroot_owner = $default_owner |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
17 $docroot_group = $default_group |
133
9337c9ce648a
Switch to using LetsEncrypt certs by default
IBBoard <dev@ibboard.co.uk>
parents:
119
diff
changeset
|
18 $ca_chain = "/etc/letsencrypt/live/${::fqdn}/chain.pem" |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
19 $tld = $default_tld |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
20 $extra_tlds = $default_extra_tlds |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
21 $htmlphpfragment = "Include conf.extra/html-php.conf" |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
22 $filterfragment = "Include conf.custom/filter.conf" |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
23 $cmsfragment = "Include conf.extra/cms_rewrites.conf" |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
24 |
236
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
25 $csp_base = {"frame-ancestors" => "'none'", "base-uri" => "'none'"} |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
26 $csp_report_base = { |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
27 "default-src" => "'none'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
28 "img-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
29 "script-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
30 "style-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
31 "font-src" => "'self'" |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
32 } |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
135
diff
changeset
|
33 |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
34 if $osfamily == 'RedHat' { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
35 $apache_base_dir = "/etc/httpd/" |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
36 $vhost_dir = "/etc/httpd/conf.d/vhosts" |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
37 $apache_user = 'apache' |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
38 $apache_group = $apache_user |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
39 $apache_log_group = $apache_user |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
40 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
41 elsif $osfamily == 'Debian' { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
42 $apache_base_dir = "/etc/apache2/" |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
43 $vhost_dir = "/etc/apache2/sites-available" |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
44 $apache_user = 'www-data' |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
45 $apache_group = $apache_user |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
46 $apache_log_group = $apache_user |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
47 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
48 |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
49 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
50 class { 'apache': |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
51 vhost_dir => $vhost_dir, |
359 | 52 protocols => ["h2", "http/1.1"], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
53 default_mods => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
54 default_vhost => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
55 mpm_module => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
56 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
57 class { 'apache::mod::dir': indexes => [ 'index.html' ] } |
354
aad5c00b0525
Switch to Apache "events" and PHP via FCGI
IBBoard <dev@ibboard.co.uk>
parents:
353
diff
changeset
|
58 class { 'apache::mod::event': } |
359 | 59 class { 'apache::mod::http2': } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
60 class { 'apache::mod::mime': mime_types_config => "${apache_base_dir}mime.types" } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
61 apache::mod { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
62 'rewrite':; |
254
5a903aa91469
Change header types and add module to fix NextCloud header checks
IBBoard <dev@ibboard.co.uk>
parents:
236
diff
changeset
|
63 'expires':; |
5a903aa91469
Change header types and add module to fix NextCloud header checks
IBBoard <dev@ibboard.co.uk>
parents:
236
diff
changeset
|
64 'env':; |
5a903aa91469
Change header types and add module to fix NextCloud header checks
IBBoard <dev@ibboard.co.uk>
parents:
236
diff
changeset
|
65 'setenvif':; |
5a903aa91469
Change header types and add module to fix NextCloud header checks
IBBoard <dev@ibboard.co.uk>
parents:
236
diff
changeset
|
66 'headers':; |
353 | 67 'allowmethods':; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
68 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
69 if $osfamily == 'RedHat' { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
70 # Ubuntu builds the "version" module in, but CentOS doesn't |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
71 apache::mod { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
72 'version':; |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
73 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
74 } |
119
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
75 |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
76 # Updating the httpd package puts back some configs that we |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
77 # don't load the relevant modules for, so we'll try to make |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
78 # them blank so that RPM/Yum makes ".rpmnew" files instead |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
79 $unused_default_mods = [ |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
80 "${::apache::mod_dir}/autoindex.conf", |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
81 "${::apache::mod_dir}/userdir.conf", |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
82 "${::apache::mod_dir}/welcome.conf", |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
83 ] |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
84 file { $unused_default_mods: |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
85 ensure => file, |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
86 content => '', |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
87 require => Class['apache'], |
119
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
88 } |
95502bafeaa3
Blank some Apache configs to prevent httpd update breaking the server
IBBoard <dev@ibboard.co.uk>
parents:
115
diff
changeset
|
89 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
90 file { $base_dir: |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
91 ensure => directory; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
92 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
93 file { '/var/log/apache': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
94 ensure => directory, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
95 mode => '0750', |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
96 group => $apache_log_group, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
97 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
98 file { "${apache_base_dir}conf.extra": |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
99 ensure => directory, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
100 recurse => true, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
101 source => "puppet:///modules/website/conf.extra", |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
102 require => Class['apache'], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
103 notify => Service['httpd']; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
104 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
105 file { "${apache_base_dir}mime.types": |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
106 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
107 source => "puppet:///modules/website/mime.types", |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
108 require => Class['apache'], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
109 notify => Service['httpd']; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
110 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
111 file { "${apache_base_dir}conf.d/zzz-custom.conf": |
115
b35a9df52965
Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents:
98
diff
changeset
|
112 ensure => absent, |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
113 require => Class['apache'], |
115
b35a9df52965
Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents:
98
diff
changeset
|
114 notify => Service['httpd']; |
b35a9df52965
Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents:
98
diff
changeset
|
115 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
116 file { "${apache_base_dir}conf.d/zzz-0-custom.conf": |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
117 ensure => present, |
115
b35a9df52965
Make sure that custom config comes before site configs
IBBoard <dev@ibboard.co.uk>
parents:
98
diff
changeset
|
118 source => "puppet:///modules/website/zzz-0-custom.conf", |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
119 require => Class['apache'], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
120 notify => Service['httpd']; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
121 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
122 file { "${apache_base_dir}conf.custom": |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
123 ensure => directory, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
124 recurse => true, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
125 source => "puppet:///private/apache/conf.custom", |
248
72deb9ebb15e
Make sure that web server files come after package creates dir
IBBoard <dev@ibboard.co.uk>
parents:
246
diff
changeset
|
126 require => Class['apache'], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
127 notify => Service['httpd']; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
128 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
129 file { $cert_dir: |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
130 ensure => directory; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
131 } |
279 | 132 firewall { '100 allow https and http': |
133 destination => $primary_ip, | |
134 dport => [80, 443], | |
135 proto => tcp, | |
136 action => accept, | |
137 } | |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
138 if ($proxy_4to6_ip_prefix != undef) and ($proxy_upstream != undef) { |
281
af7df930a670
Add 4-to-6 proxy and mod_remoteip setup
IBBoard <dev@ibboard.co.uk>
parents:
279
diff
changeset
|
139 apache::mod { "remoteip": } |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
140 $proxy_4to6_ip = "$proxy_4to6_ip_prefix:0000/$proxy_4to6_mask" |
281
af7df930a670
Add 4-to-6 proxy and mod_remoteip setup
IBBoard <dev@ibboard.co.uk>
parents:
279
diff
changeset
|
141 |
279 | 142 $proxy_upstream.each |String $upstream_addr| { |
143 firewall { "100 limit PROXY protocol to upstream $upstream_addr": | |
144 source => $upstream_addr, | |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
145 destination => $proxy_4to6_ip, |
279 | 146 dport => [80, 443], |
147 proto => tcp, | |
148 action => accept, | |
149 } | |
150 } | |
151 firewall { "101 block all other PROXY protocol access": | |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
152 destination => $proxy_4to6_ip, |
279 | 153 dport => [80, 443], |
154 proto => tcp, | |
155 action => reject, | |
156 } | |
157 } | |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
158 if $operatingsystem == 'CentOS' { |
48
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
159 exec { 'set_apache_defaults': |
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
160 command => 'semanage fcontext -a -t httpd_sys_content_t "/srv/sites(/.*)?"', |
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
161 path => '/bin:/usr/bin/:/sbin:/usr/sbin', |
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
162 require => Package['policycoreutils-python'], |
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
163 unless => 'semanage fcontext --list | grep "/srv/sites\\(/\\.\\*\\)\\?"', |
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
164 } |
298
61e90445c899
Merge CentOS8 and CentOS7 branches
IBBoard <dev@ibboard.co.uk>
parents:
288
diff
changeset
|
165 if versioncmp($operatingsystemrelease, '8') < 0 { |
278
a8bf3a400712
Make Certbot package version specific
IBBoard <dev@ibboard.co.uk>
parents:
277
diff
changeset
|
166 $certbot_pkg = 'python2-certbot-apache' |
a8bf3a400712
Make Certbot package version specific
IBBoard <dev@ibboard.co.uk>
parents:
277
diff
changeset
|
167 } else { |
a8bf3a400712
Make Certbot package version specific
IBBoard <dev@ibboard.co.uk>
parents:
277
diff
changeset
|
168 $certbot_pkg = 'python3-certbot-apache' |
a8bf3a400712
Make Certbot package version specific
IBBoard <dev@ibboard.co.uk>
parents:
277
diff
changeset
|
169 } |
390
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
170 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
171 elsif $operatingsystem == 'Ubuntu' { |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
172 $certbot_pkg = 'certbot' |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
173 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
174 cron { 'letsencrypt-renewal': |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
175 command => '/usr/bin/certbot renew --quiet', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
176 hour => '*/12', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
177 minute => '21', |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
178 } |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
179 package { $certbot_pkg: |
df5ad1612af7
Adapt configs to support Ubuntu
IBBoard <dev@ibboard.co.uk>
parents:
359
diff
changeset
|
180 ensure => installed, |
48
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
1
diff
changeset
|
181 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
182 } |