Mercurial > repos > other > Puppet
annotate manifests/templates.pp @ 383:f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
author | IBBoard <dev@ibboard.co.uk> |
---|---|
date | Thu, 16 Dec 2021 20:37:58 +0000 |
parents | 308b4149bee5 |
children | 22e45bb5ea97 |
rev | line source |
---|---|
32
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
1 # Make sure packages come after their repos |
382
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
2 File<| tag == 'repo-config' |> |
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
3 -> anchor { 'Repo-config': } |
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
4 -> YumRepo<| |> |
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
5 -> anchor { 'Repos': } |
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
6 -> Package<| |> |
32
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
7 |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
8 # Make sure all files are in place before starting services |
298 | 9 # FIXME: Title matches are to fix a dependency cycle |
382
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
10 File<| tag != 'post-service' and title != '/etc/sysconfig/ip6tables' and title != '/etc/sysconfig/iptables' |> |
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
11 -> anchor { 'Pre-Service Files': } |
308b4149bee5
Add anchors to simplify dependencies
IBBoard <dev@ibboard.co.uk>
parents:
379
diff
changeset
|
12 -> Service<| |> |
246 | 13 |
14 # Set some shortcut variables | |
15 #$os = $operatingsystem | |
249
e9323ff8f451
Make EPEL work on multiple versions of CentOS
IBBoard <dev@ibboard.co.uk>
parents:
247
diff
changeset
|
16 $osver = $operatingsystemmajrelease |
246 | 17 $server = '' |
32
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
18 |
6bbc86f6cee5
Tidy up ordering and dependencies (including making sure we have a necessary file for Fail2Ban to start)
IBBoard <dev@ibboard.co.uk>
parents:
25
diff
changeset
|
19 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
20 class basenode { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
21 include sudo |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
22 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
23 include defaultusers |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
24 include logwatch |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
25 |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
26 file { '/etc/puppet/hiera.yaml': |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
27 ensure => present, |
264 | 28 content => " |
29 # Let the system set defaults | |
30 version: 5 | |
31 ", | |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
32 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
33 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
34 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
35 class basevpsnode ( |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
36 $primary_ip, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
37 $proxy_4to6_ip_prefix = undef, |
279 | 38 $proxy_upstream = undef, |
326 | 39 $nat64_ranges = [], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
40 $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
41 $imapserver, |
326 | 42 $mailrelays = [], |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
43 $firewall_cmd = 'iptables', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
44 ) { |
44
546dfa011f58
Remove "puppet" host name because we don't need it
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
45 |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
46 if $firewall_cmd == 'iptables' { |
279 | 47 class { 'vpsfirewall': |
48 fw_protocol => $primary_ip =~ Stdlib::IP::Address::V6 ? { true => 'IPv6', default => 'IPv4'}, | |
49 } | |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
50 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
51 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
52 #VPS is a self-mastered Puppet machine, so bodge a Hosts file |
302 | 53 if $primary_ip =~ Stdlib::IP::Address::V6 { |
54 $lo_ip = '::1' | |
55 } else { | |
56 $lo_ip = '127.0.0.1' | |
57 } | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
58 file { '/etc/hosts': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
59 ensure => present, |
302 | 60 content => "${lo_ip} localhost\n${primary_ip} ${fqdn}", |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
61 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
62 |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
63 if $proxy_4to6_ip_prefix != undef { |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
64 # …:1 to …:9 for websites, …:10 for mail |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
65 $ipv6_addresses = Integer[1, 10].map |$octet| { "$proxy_4to6_ip_prefix:$octet" } |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
66 |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
67 $ipv6_secondaries = join($ipv6_addresses, " ") |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
68 |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
69 augeas {'IPv6 secondary addresses': |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
70 context => "/files/etc/sysconfig/network-scripts/ifcfg-eth0", |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
71 changes => "set IPV6ADDR_SECONDARIES '\"$ipv6_secondaries\"'", |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
72 } |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
73 } |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
74 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
75 require repos |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
76 include basenode |
246 | 77 include privat |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
78 include dnsresolver |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
79 include ssh::server |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
80 include vcs::server |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
81 include vcs::client |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
82 class { 'webserver': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
83 primary_ip => $primary_ip, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
84 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
85 proxy_4to6_mask => 124, |
279 | 86 proxy_upstream => $proxy_upstream, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
87 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
88 include cronjobs |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
89 include logrotate |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
90 class { 'fail2ban': |
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
91 firewall_cmd => $firewall_cmd, |
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
92 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
93 include tools |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
94 class { 'email': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
95 mailserver => $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
96 imapserver => $imapserver, |
311
51d3748f8112
Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents:
310
diff
changeset
|
97 mailserver_ip => $primary_ip, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
98 proxy_ip => $proxy_4to6_ip_prefix != undef ? { true => "${proxy_4to6_ip_prefix}:10", default => undef }, |
311
51d3748f8112
Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents:
310
diff
changeset
|
99 proxy_upstream => $proxy_upstream, |
326 | 100 nat64_ranges => $nat64_ranges, |
101 mailrelays => $mailrelays, | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
102 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
103 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
104 |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
105 ## Classes to allow facet behaviour using preconfigured setups of classes |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
106 |
279 | 107 class vpsfirewall ($fw_protocol) { |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
108 resources { "firewall": |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
109 purge => false, |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
110 } |
279 | 111 class { "my_fw": |
112 ip_version => $fw_protocol, | |
113 } | |
114 # Control what does and doesn't get pruned in the main filter chain | |
115 firewallchain { "INPUT:filter:$fw_protocol": | |
116 purge => true, | |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
117 ignore => [ |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
118 '-j f2b-[^ ]+$', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
119 '^(:|-A )f2b-', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
120 '--comment "Great Firewall of China"', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
121 '--comment "Do not purge', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
122 ], |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
123 } |
279 | 124 if ($fw_protocol != "IPv6") { |
125 firewall { '010 Whitelist Googlebot': | |
126 source => '66.249.64.0/19', | |
127 dport => [80,443], | |
128 proto => tcp, | |
129 action => accept, | |
130 } | |
131 # Block a spammer hitting our contact forms (also on StopForumSpam list A LOT) | |
132 firewall { '099 Blacklist spammers 1': | |
133 source => '107.181.78.172', | |
134 dport => [80, 443], | |
135 proto => tcp, | |
136 action => 'reject', | |
137 } | |
138 firewall { '099 Blacklist IODC bot': | |
139 # IODC bot makes too many bad requests, and contact form is broken | |
140 # They don't publish a robots.txt name, so firewall it! | |
141 source => '86.153.145.149', | |
142 dport => [ 80, 443 ], | |
143 proto => tcp, | |
144 action => 'reject', | |
145 } | |
146 firewall { '099 Blacklist Baidu Brazil': | |
147 #Baidu got a Brazilian netblock and are hitting us hard | |
148 #Baidu doesn't honour "crawl-delay" in robots.txt | |
149 #Baidu gets firewalled | |
150 source => '131.161.8.0/22', | |
151 dport => [ 80, 443 ], | |
152 proto => tcp, | |
153 action => 'reject', | |
154 } | |
139
abaf384dc939
Block another annoying IP with a firewall rule
IBBoard <dev@ibboard.co.uk>
parents:
137
diff
changeset
|
155 } |
279 | 156 firewallchain { "GREATFIREWALLOFCHINA:filter:$fw_protocol": |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
157 ensure => present, |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
158 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
159 firewall { '050 Check our Great Firewall Against China': |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
160 chain => 'INPUT', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
161 jump => 'GREATFIREWALLOFCHINA', |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
162 } |
279 | 163 firewallchain { "Fail2Ban:filter:$fw_protocol": |
64
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
164 ensure => present, |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
165 } |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
166 firewall { '060 Check Fail2Ban': |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
167 chain => 'INPUT', |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
168 jump => 'Fail2Ban', |
3bb824dabaae
Make sure Fail2Ban rules are in right order (using separate chain) and whitelist Googlebot (which keeps hitting Script Kiddy targets for unknown reasons)
IBBoard <dev@ibboard.co.uk>
parents:
61
diff
changeset
|
169 } |
40
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
170 } |
222904296578
Add firewall handling when we run without APF
IBBoard <dev@ibboard.co.uk>
parents:
38
diff
changeset
|
171 |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
172 class dnsresolver { |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
173 package { 'unbound': |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
174 ensure => present, |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
175 } |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
176 package { 'named': |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
177 ensure => absent, |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
178 } |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
179 |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
180 service { 'named': |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
181 ensure => stopped, |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
182 enable => false, |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
183 } |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
184 service { 'unbound': |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
185 ensure => running, |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
186 enable => true, |
194
a08de3153548
Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents:
193
diff
changeset
|
187 } |
a08de3153548
Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents:
193
diff
changeset
|
188 |
a08de3153548
Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents:
193
diff
changeset
|
189 file { '/etc/named.conf': |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
190 ensure => absent, |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
191 } |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
192 file { '/etc/unbound/unbound.conf': |
194
a08de3153548
Add a named.conf file to control cache/memory size
IBBoard <dev@ibboard.co.uk>
parents:
193
diff
changeset
|
193 ensure => present, |
247 | 194 source => [ |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
195 "puppet:///common/unbound.conf-${::hostname}", |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
196 "puppet:///common/unbound.conf", |
247 | 197 ], |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
198 require => Package['unbound'], |
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
199 notify => Service['unbound'], |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
200 } |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
201 |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
202 file { '/etc/NetworkManager/conf.d/local-dns-resolver.conf': |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
203 ensure => present, |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
204 content => "[main] |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
205 dns=none", |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
206 } |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
207 |
101
a48b6011a084
Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents:
100
diff
changeset
|
208 file { '/etc/sysconfig/named': |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
209 ensure => absent, |
101
a48b6011a084
Stop Bind trying IPv6, as we only have a link-local IP
IBBoard <dev@ibboard.co.uk>
parents:
100
diff
changeset
|
210 } |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
211 file { '/etc/resolv.conf': |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
212 ensure => present, |
301
1bfc290270cc
Fix sa-update by using IPv6 for local DNS cache
IBBoard <dev@ibboard.co.uk>
parents:
298
diff
changeset
|
213 # "ipaddress" key only exists for machines with IPv4 addresses |
1bfc290270cc
Fix sa-update by using IPv6 for local DNS cache
IBBoard <dev@ibboard.co.uk>
parents:
298
diff
changeset
|
214 content => has_key($facts, 'ipaddress') ? { true => "nameserver 127.0.0.1", default => "nameserver ::1" }, |
290
1182a180085d
Swap from Bind to Named for light-weight DNS
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
215 require => Service['unbound'], |
246 | 216 tag => 'post-service', |
100
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
217 } |
fd3446c3b7b9
Set up a recursive localhost-only Bind server (assuming RH's safe and sane default configs)
IBBoard <dev@ibboard.co.uk>
parents:
99
diff
changeset
|
218 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
219 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
220 class repos { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
221 yumrepo { 'epel': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
222 mirrorlist => 'https://mirrors.fedoraproject.org/metalink?repo=epel-$releasever&arch=$basearch', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
223 descr => "Extra Packages for Enterprise Linux", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
224 enabled => 1, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
225 failovermethod => 'priority', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
226 gpgcheck => 1, |
249
e9323ff8f451
Make EPEL work on multiple versions of CentOS
IBBoard <dev@ibboard.co.uk>
parents:
247
diff
changeset
|
227 gpgkey => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver", |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
228 } |
249
e9323ff8f451
Make EPEL work on multiple versions of CentOS
IBBoard <dev@ibboard.co.uk>
parents:
247
diff
changeset
|
229 file { "/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$osver": |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
230 ensure => present, |
258 | 231 source => "puppet:///common/RPM-GPG-KEY-EPEL-$osver", |
232 tag => 'repo-config', | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
233 } |
258 | 234 yumrepo { 'ibboard': |
235 baseurl => 'https://download.opensuse.org/repositories/home:/IBBoard:/server/CentOS_$releasever/', | |
236 descr => 'Extra packages from IBBoard', | |
237 enabled => 1, | |
238 gpgcheck => 1, | |
239 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard', | |
240 } | |
241 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-ibboard': | |
242 ensure => present, | |
243 source => 'puppet:///common/RPM-GPG-KEY-ibboard', | |
244 tag => 'repo-config', | |
160
0d829df9cd39
Make the IBBoard repo config go away, rather than just leaving it undefined
IBBoard <dev@ibboard.co.uk>
parents:
159
diff
changeset
|
245 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
246 yumrepo { 'webtatic': |
238 | 247 ensure => absent, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
248 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
249 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-andy': |
108 | 250 ensure => absent, |
251 } | |
252 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-el7': | |
238 | 253 ensure => absent, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
254 } |
148 | 255 |
272
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
256 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 { |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
257 $python_ver = 'python3' |
383
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
258 |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
259 # The following may possibly work to ensure a CentOS Streams install. |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
260 # Or it might fail for inexplicable reasons. |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
261 # FIXME: Should be "centos-release-stream" to migrate (provides repos), but then that gets replaced by centos-stream-release, |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
262 # which Puppet doesn't recognise as the same and so keeps trying to re-install. May need an "unless" or maybe "allow_virtual" |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
263 package { 'centos-stream-release': |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
264 ensure => installed, |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
265 notify => Exec['migrate to streams']; |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
266 } |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
267 exec { 'migrate to streams': |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
268 command => '/usr/bin/dnf swap centos-linux-repos centos-stream-repos; /usr/bin/dnf distro-sync -y', |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
269 refreshonly => true |
f9a6f6ff8256
Attempt to migrate CentOS8 to Streams automatically
IBBoard <dev@ibboard.co.uk>
parents:
382
diff
changeset
|
270 } |
272
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
271 } else { |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
272 $python_ver = 'system' |
148 | 273 } |
272
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
274 |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
275 class { 'python': |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
276 ensure => 'present', |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
277 version => $python_ver, |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
278 pip => 'present', |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
279 virtualenv => 'present', |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
280 use_epel => false, |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
281 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
282 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
283 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
284 class tools { |
330
0cccb75d7639
Add rsync to tools so that backups work
IBBoard <dev@ibboard.co.uk>
parents:
326
diff
changeset
|
285 $packages = [ 'sqlite', 'bash-completion', 'nano', 'bzip2', 'mlocate', 'patch', 'tmux', 'wget', 'yum-utils', 'rsync' ] |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
286 package { $packages: |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
287 ensure => installed; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
288 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
289 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
290 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
291 class logrotate { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
292 package { 'logrotate': |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
293 ensure => installed; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
294 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
295 file { '/etc/logrotate.d/httpd': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
296 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
297 source => 'puppet:///common/logrotate-httpd', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
298 require => Package['logrotate'], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
299 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
300 file { '/etc/logrotate.d/trac': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
301 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
302 source => 'puppet:///common/logrotate-trac', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
303 require => Package['logrotate'], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
304 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
305 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
306 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
307 class logwatch { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
308 package { 'logwatch': |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
309 ensure => installed; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
310 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
311 File { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
312 ensure => present, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
313 require => Package['logwatch'], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
314 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
315 file { '/etc/cron.daily/0logwatch': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
316 source => 'puppet:///common/0logwatch'; |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
317 } |
332 | 318 $logwatch_dirs = [ |
319 '/etc/logwatch/', | |
320 '/etc/logwatch/conf/', | |
321 '/etc/logwatch/conf/logfiles/', | |
322 '/etc/logwatch/conf/services/', | |
345
bad68f1b6467
Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
342
diff
changeset
|
323 '/etc/logwatch/scripts/', |
bad68f1b6467
Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
342
diff
changeset
|
324 '/etc/logwatch/scripts/services/', |
332 | 325 ] |
326 file { $logwatch_dirs: | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
327 ensure => directory, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
328 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
329 file { '/etc/logwatch/conf/logwatch.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
330 content => 'Detail = Med', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
331 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
332 file { '/etc/logwatch/conf/logfiles/http.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
333 content => 'LogFile = apache/access_*.log', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
334 } |
332 | 335 file { '/etc/logwatch/conf/logfiles/http-error.conf': |
336 source => 'puppet:///common/logwatch/logfiles_http-error.conf', | |
126
8316d4e55e92
Fix Apache 2.4 Logwatch support
IBBoard <dev@ibboard.co.uk>
parents:
125
diff
changeset
|
337 } |
332 | 338 file { '/etc/logwatch/conf/logfiles/mysql.conf': |
339 source => 'puppet:///common/logwatch/logfiles_mysql.conf', | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
340 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
341 file { '/etc/logwatch/conf/logfiles/php.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
342 source => 'puppet:///common/logwatch/logfiles_php.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
343 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
344 file { '/etc/logwatch/conf/services/php.conf': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
345 source => 'puppet:///common/logwatch/services_php.conf', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
346 } |
379
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
347 file { '/etc/logwatch/conf/services/contact-form.conf': |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
348 source => 'puppet:///common/logwatch/services_contact-form.conf', |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
349 } |
345
bad68f1b6467
Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
342
diff
changeset
|
350 file { '/etc/logwatch/scripts/services/dovecot': |
bad68f1b6467
Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
342
diff
changeset
|
351 source => 'puppet:///common/logwatch/dovecot', |
bad68f1b6467
Add updated Dovecot script to Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
342
diff
changeset
|
352 } |
346
61be075c5a68
Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
345
diff
changeset
|
353 file { '/etc/logwatch/scripts/services/postfix': |
61be075c5a68
Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
345
diff
changeset
|
354 source => 'puppet:///common/logwatch/postfix', |
61be075c5a68
Ignore X-Comment "SPF whitelisted" messages in Logwatch
IBBoard <dev@ibboard.co.uk>
parents:
345
diff
changeset
|
355 } |
347
73d7b3ec6263
Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents:
346
diff
changeset
|
356 file { '/etc/logwatch/scripts/services/systemd': |
73d7b3ec6263
Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents:
346
diff
changeset
|
357 source => 'puppet:///common/logwatch/systemd', |
73d7b3ec6263
Ignore log entries from Cron tasks running in user mode
IBBoard <dev@ibboard.co.uk>
parents:
346
diff
changeset
|
358 } |
379
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
359 file { '/etc/logwatch/scripts/services/php': |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
360 source => 'puppet:///common/logwatch/php', |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
361 } |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
362 file { '/etc/logwatch/scripts/services/contact-form': |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
363 source => 'puppet:///common/logwatch/contact-form', |
63adae1a374a
Fix and expand PHP logwatch config
IBBoard <dev@ibboard.co.uk>
parents:
378
diff
changeset
|
364 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
365 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
366 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
367 #Our web server with our configs, not just a stock one |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
368 class webserver ( |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
369 $primary_ip, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
370 $proxy_4to6_ip_prefix = undef, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
371 $proxy_4to6_mask = undef, |
279 | 372 $proxy_upstream = undef, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
373 ) { |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
374 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
375 #Setup base website parameters |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
376 class { 'website': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
377 base_dir => '/srv/sites', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
378 primary_ip => $primary_ip, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
379 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
380 proxy_4to6_mask => $proxy_4to6_mask, |
279 | 381 proxy_upstream => $proxy_upstream, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
382 default_owner => $defaultusers::default_user, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
383 default_group => $defaultusers::default_user, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
384 default_tld => 'co.uk', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
385 default_extra_tlds => [ 'com' ], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
386 } |
110 | 387 |
238 | 388 $php_suffix = '' |
247 | 389 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 { |
390 yumrepo { 'remirepo-safe': | |
391 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/$basearch/mirror', | |
392 descr => "Extra CentOS packages from Remi", | |
393 enabled => 1, | |
394 failovermethod => 'priority', | |
395 gpgcheck => 1, | |
396 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi', | |
397 } | |
398 yumrepo { 'remirepo-php': | |
320 | 399 mirrorlist => 'http://cdn.remirepo.net/enterprise/8/modular/$basearch/mirror', |
400 descr => 'Remi\'s Modular repository for Enterprise Linux 8 - $basearch', | |
247 | 401 enabled => 1, |
402 failovermethod => 'priority', | |
403 gpgcheck => 1, | |
404 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi', | |
405 } | |
320 | 406 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi': |
407 ensure => present, | |
408 source => 'puppet:///common/RPM-GPG-KEY-remi.el8', | |
409 tag => 'repo-config', | |
410 } | |
247 | 411 } else { |
412 yumrepo { 'remirepo-safe': | |
413 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/safe/mirror', | |
414 descr => "Extra CentOS packages from Remi", | |
415 enabled => 1, | |
416 failovermethod => 'priority', | |
417 gpgcheck => 1, | |
418 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi', | |
419 } | |
420 yumrepo { 'remirepo-php': | |
335
aa9f570d6a9c
Switch to PHP 7.4 now that NextCloud has reached v18
IBBoard <dev@ibboard.co.uk>
parents:
334
diff
changeset
|
421 mirrorlist => 'http://cdn.remirepo.net/enterprise/$releasever/php74/mirror', |
aa9f570d6a9c
Switch to PHP 7.4 now that NextCloud has reached v18
IBBoard <dev@ibboard.co.uk>
parents:
334
diff
changeset
|
422 descr => "PHP7.4 for CentOS from Remi", |
247 | 423 enabled => 1, |
424 failovermethod => 'priority', | |
425 gpgcheck => 1, | |
426 gpgkey => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi', | |
427 } | |
320 | 428 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-remi': |
429 ensure => present, | |
430 source => 'puppet:///common/RPM-GPG-KEY-remi', | |
431 tag => 'repo-config', | |
432 } | |
238 | 433 } |
110 | 434 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
435 #Configure the PHP version to use |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
436 class { 'website::php': |
350
85d2c0079af9
Make opcache core and add APCu for object caching
IBBoard <dev@ibboard.co.uk>
parents:
347
diff
changeset
|
437 suffix => $php_suffix, |
335
aa9f570d6a9c
Switch to PHP 7.4 now that NextCloud has reached v18
IBBoard <dev@ibboard.co.uk>
parents:
334
diff
changeset
|
438 module => ($operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0) ? { true => 'remi-7.4', default => undef }, |
377
18765f598232
Add Enchant module for webmail spell checking
IBBoard <dev@ibboard.co.uk>
parents:
376
diff
changeset
|
439 extras => [ 'process', 'intl', 'pecl-imagick', 'bcmath', 'pecl-zip', 'json', 'pecl-apcu', 'gmp', 'enchant' ], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
440 } |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
441 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
442 #Setup MySQL, using (private) templates to make sure that we set non-std passwords and a default user |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
443 |
246 | 444 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '7') >= 0 { |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
445 $mysqlpackage = 'mariadb' |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
446 $mysqlsuffix = '' |
48
5cdc1c96c477
Add SELinux support for website content
IBBoard <dev@ibboard.co.uk>
parents:
45
diff
changeset
|
447 |
261
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
448 # Required for SELinux rule setting/status checks |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
449 if versioncmp($operatingsystemrelease, '8') >= 0 { |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
450 $semanage_package_name = 'policycoreutils-python-utils' |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
451 } else { |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
452 $semanage_package_name = 'policycoreutils-python' |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
453 } |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
454 |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
455 package { 'policycoreutils-python': |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
456 name => $semanage_package_name, |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
457 ensure => present, |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
458 } |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
459 |
74
c2e5027202e2
Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents:
72
diff
changeset
|
460 $extra_packages = [ |
78 | 461 'perl-Sys-Syslog', #Required for Perl SPF checking |
74
c2e5027202e2
Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents:
72
diff
changeset
|
462 ] |
c2e5027202e2
Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents:
72
diff
changeset
|
463 |
c2e5027202e2
Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents:
72
diff
changeset
|
464 package { $extra_packages: |
c2e5027202e2
Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents:
72
diff
changeset
|
465 ensure => installed |
c2e5027202e2
Add missing dependency for Trac Subversion support on CentOS 7
IBBoard <dev@ibboard.co.uk>
parents:
72
diff
changeset
|
466 } |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
467 } |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
468 else { |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
469 $mysqlpackage = 'mysql' |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
470 $mysqlsuffix = '55w' |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
471 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
472 class { 'website::mysql': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
473 mysqluser => template('defaultusers/mysql-user'), |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
474 mysqlpassword => template('defaultusers/mysql-password'), |
24
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
475 mysqlprefix => $mysqlpackage, |
204330fea19a
Use MariaDB on CentOS7 and manage hiera.yaml (to avoid warnings)
IBBoard <dev@ibboard.co.uk>
parents:
18
diff
changeset
|
476 mysqlsuffix => $mysqlsuffix, |
110 | 477 phpsuffix => $php_suffix, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
478 phpmysqlsuffix => 'nd' |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
479 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
480 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
481 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
482 class ibboardvpsnode ( |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
483 $primary_ip, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
484 $proxy_4to6_ip_prefix = undef, |
279 | 485 $proxy_upstream = undef, |
326 | 486 $nat64_ranges = [], |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
487 $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
488 $imapserver, |
326 | 489 $mailrelays = [], |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
490 $firewall_cmd = 'iptables', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
491 ){ |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
492 class { 'basevpsnode': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
493 primary_ip => $primary_ip, |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
494 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix, |
279 | 495 proxy_upstream => $proxy_upstream, |
326 | 496 nat64_ranges => $nat64_ranges, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
497 mailserver => $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
498 imapserver => $imapserver, |
326 | 499 mailrelays => $mailrelays, |
35
1bb941522ebf
Handle differences in firewalling between ASO (using APF) and most other hosts (using iptables)
IBBoard <dev@ibboard.co.uk>
parents:
32
diff
changeset
|
500 firewall_cmd => $firewall_cmd, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
501 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
502 |
267
edeedd13262c
Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
503 # Set timezone to something sensible |
edeedd13262c
Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
504 file { "/etc/localtime": |
edeedd13262c
Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
505 ensure => 'link', |
edeedd13262c
Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
506 target => '/usr/share/zoneinfo/Europe/London', |
edeedd13262c
Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
507 } |
edeedd13262c
Set a sensible default timezone for VPS
IBBoard <dev@ibboard.co.uk>
parents:
266
diff
changeset
|
508 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
509 # Common modules used by multiple sites (mod_auth_basic is safe because we HTTPS all the things) |
146
816e35f86a5d
Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents:
145
diff
changeset
|
510 $mods = [ 'auth_basic', |
816e35f86a5d
Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents:
145
diff
changeset
|
511 'authn_file', |
816e35f86a5d
Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents:
145
diff
changeset
|
512 'authz_user', |
816e35f86a5d
Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents:
145
diff
changeset
|
513 'deflate', |
816e35f86a5d
Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents:
145
diff
changeset
|
514 'xsendfile' |
816e35f86a5d
Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents:
145
diff
changeset
|
515 ] |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
516 apache::mod { |
146
816e35f86a5d
Remove mod_auth_token and replace with mod_xsendfile
IBBoard <dev@ibboard.co.uk>
parents:
145
diff
changeset
|
517 $mods:; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
518 } |
246 | 519 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '7') >= 0 { |
520 apache::mod { | |
25
13adb555a7e2
Use "<IfVersion>" to handle auth differences between 2.2 and 2.4
IBBoard <dev@ibboard.co.uk>
parents:
24
diff
changeset
|
521 'authn_core':; |
13adb555a7e2
Use "<IfVersion>" to handle auth differences between 2.2 and 2.4
IBBoard <dev@ibboard.co.uk>
parents:
24
diff
changeset
|
522 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
523 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
524 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
525 #Configure our sites, using templates for the custom fragments where the extra content is too long |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
526 class { "devsite": |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
527 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:01", default => undef } |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
528 } |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
529 class { "adminsite": |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
530 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:02", default => undef } |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
531 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
532 website::https::multitld { 'www.ibboard': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
533 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef }, |
246 | 534 custom_fragment => template("privat/apache/ibboard.fragment"), |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
535 letsencrypt_name => 'ibboard.co.uk', |
236
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
536 csp_override => { |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
537 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
538 "default-src" => "'none'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
539 "img-src" => "'self' https://live.staticflickr.com/", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
540 "script-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
541 "style-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
542 "font-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
543 "form-action" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
544 "connect-src" => "'self'", |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
545 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
546 } |
374
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
547 website::https::redir { 'mail.ibboard.co.uk': |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
548 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef }, |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
549 redir => 'https://ibboard.co.uk/', |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
550 docroot => "${website::basedir}/ibboard", |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
551 letsencrypt_name => 'ibboard.co.uk', |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
552 separate_log => true, |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
553 } |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
554 website::https::redir { 'imap.ibboard.co.uk': |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
555 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef }, |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
556 redir => 'https://ibboard.co.uk/', |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
557 docroot => "${website::basedir}/ibboard", |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
558 letsencrypt_name => 'ibboard.co.uk', |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
559 separate_log => true, |
5f4fc00f8189
Add mail and imap redirect websites
IBBoard <dev@ibboard.co.uk>
parents:
364
diff
changeset
|
560 } |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
561 class { "hiveworldterrasite": |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
562 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:04", default => undef } |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
563 } |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
564 class { "bdstrikesite": |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
565 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:05", default => undef } |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
566 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
567 website::https::multitld { 'www.abiknight': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
568 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:06", default => undef }, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
569 custom_fragment => "$website::htmlphpfragment |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
570 ErrorDocument 404 /error.php", |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
571 letsencrypt_name => 'abiknight.co.uk', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
572 } |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
573 website::https::multitld { 'www.warfoundry': |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
574 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:07", default => undef }, |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
575 letsencrypt_name => 'warfoundry.co.uk', |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
576 custom_fragment => template("privat/apache/warfoundry.fragment"), |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
577 } |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
578 class { "webmailpimsite": |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
579 proxy_4to6_ip_pim => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:08", default => undef }, |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
580 proxy_4to6_ip_webmail => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:09", default => undef }, |
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
581 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
582 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
583 |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
584 class adminsite ($proxy_4to6_ip) { |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
585 apache::mod { 'info':; 'status':; 'cgi':; } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
586 website::https::multitld { 'admin.ibboard': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
587 proxy_4to6_ip => $proxy_4to6_ip, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
588 force_no_index => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
589 ssl_ca_chain => '', |
246 | 590 custom_fragment => template("privat/apache/admin.fragment"), |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
591 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
592 cron { 'loadavg': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
593 command => '/usr/local/bin/run-loadavg-logger', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
594 user => apache, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
595 minute => '*/6' |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
596 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
597 cron { 'awstats': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
598 command => '/usr/local/bin/update-awstats > /srv/sites/admin/awstats.log', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
599 user => apache, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
600 hour => '*/6', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
601 minute => '0' |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
602 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
603 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
604 |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
605 class hiveworldterrasite ($proxy_4to6_ip) { |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
606 website::https::multitld { 'www.hiveworldterra': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
607 proxy_4to6_ip => $proxy_4to6_ip, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
608 force_no_www => false, |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
609 letsencrypt_name => 'hiveworldterra.co.uk', |
246 | 610 custom_fragment => template("privat/apache/hwt.fragment"), |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
611 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
612 website::https::multitld { 'forums.hiveworldterra': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
613 proxy_4to6_ip => $proxy_4to6_ip, |
331
f69e2d197302
Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents:
330
diff
changeset
|
614 letsencrypt_name => 'forums.hiveworldterra.co.uk', |
246 | 615 custom_fragment => template("privat/apache/forums.fragment"), |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
616 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
617 website::https::multitld { 'skins.hiveworldterra': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
618 proxy_4to6_ip => $proxy_4to6_ip, |
334 | 619 letsencrypt_name => 'skins.hiveworldterra.co.uk', |
246 | 620 custom_fragment => template("privat/apache/skins.fragment"), |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
621 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
622 website::https::redir { 'hiveworldterra.ibboard.co.uk': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
623 proxy_4to6_ip => $proxy_4to6_ip, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
624 redir => 'https://www.hiveworldterra.co.uk/', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
625 docroot => "${website::basedir}/hiveworldterra", |
334 | 626 letsencrypt_name => 'hiveworldterra.ibboard.co.uk', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
627 separate_log => true, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
628 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
629 } |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
630 class bdstrikesite ($proxy_4to6_ip) { |
331
f69e2d197302
Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents:
330
diff
changeset
|
631 website::https::multitld { 'www.bdstrike': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
632 proxy_4to6_ip => $proxy_4to6_ip, |
145 | 633 docroot_owner => $defaultusers::secondary_user, |
634 docroot_group => 'editors', | |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
635 letsencrypt_name => 'bdstrike.co.uk', |
246 | 636 custom_fragment => template("privat/apache/bdstrike.fragment"), |
236
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
637 csp_override => {"frame-ancestors" => "'self'"}, |
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
638 csp_report_override => { |
364
8224f42ee05b
Expand BDStrike CSP to allow more styling and fonts
IBBoard <dev@ibboard.co.uk>
parents:
362
diff
changeset
|
639 "font-src" => "'self' https://fonts.gstatic.com/ data:", |
236
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
640 "img-src" => "'self' https://secure.gravatar.com/", |
364
8224f42ee05b
Expand BDStrike CSP to allow more styling and fonts
IBBoard <dev@ibboard.co.uk>
parents:
362
diff
changeset
|
641 "style-src" => "'self' https://fonts.googleapis.com/ 'unsafe-inline'" |
236
4519b727cc4c
Make Content-Security-Policy cleaner and easier to set
IBBoard <dev@ibboard.co.uk>
parents:
235
diff
changeset
|
642 }, |
145 | 643 } |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
644 $aliases = [ |
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
645 'strikecreations.co.uk', |
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
646 'strikecreations.com', |
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
647 'www.strikecreations.com' ] |
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
648 |
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
649 website::https::redir { 'www.strikecreations.co.uk': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
650 proxy_4to6_ip => $proxy_4to6_ip, |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
651 redir => 'https://bdstrike.co.uk/', |
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
652 serveraliases => $aliases, |
145 | 653 docroot => "${website::basedir}/bdstrike", |
654 docroot_owner => $defaultusers::secondary_user, | |
655 docroot_group => 'editors', | |
331
f69e2d197302
Separate some certs to make migration easier
IBBoard <dev@ibboard.co.uk>
parents:
330
diff
changeset
|
656 letsencrypt_name => 'strikecreations.com', |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
657 separate_log => true, |
145 | 658 } |
235
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
659 cron { 'wordpress_cron': |
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
660 # Run "php -f wp-cron.php" on a schedule so that we can auto-update |
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
661 # without giving Apache full write access! |
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
662 command => "/usr/local/bin/bdstrike-cron", |
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
663 user => $defaultusers::default_user, |
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
664 minute => '*/15', |
e602c5f974ac
Make a cron job for updating Wordpress
IBBoard <dev@ibboard.co.uk>
parents:
200
diff
changeset
|
665 } |
145 | 666 } |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
667 class devsite ($proxy_4to6_ip) { |
261
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
668 if versioncmp($operatingsystemrelease, '8') >= 0 { |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
669 # Apache::Mod doesn't map this correctly for CentOS 8 yet |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
670 $mod_wsgi_lib = 'mod_wsgi_python3.so' |
342
445aaaf228cc
Handle "mod_wsgi" not existing as a package/provides in CentOS 8
IBBoard <dev@ibboard.co.uk>
parents:
335
diff
changeset
|
671 # And mod_wsgi doesn't exist as a "provides" any more |
445aaaf228cc
Handle "mod_wsgi" not existing as a package/provides in CentOS 8
IBBoard <dev@ibboard.co.uk>
parents:
335
diff
changeset
|
672 $mod_wsgi_package = 'python3-mod_wsgi' |
261
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
673 } else { |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
674 $mod_wsgi_lib = undef |
342
445aaaf228cc
Handle "mod_wsgi" not existing as a package/provides in CentOS 8
IBBoard <dev@ibboard.co.uk>
parents:
335
diff
changeset
|
675 $mod_wsgi_package = undef |
261
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
676 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
677 apache::mod { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
678 # mod_wsgi for Python support |
261
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
679 'wsgi': |
c3ecb1e58713
Fix more CentOS 7 vs 8 differences
IBBoard <dev@ibboard.co.uk>
parents:
258
diff
changeset
|
680 lib => $mod_wsgi_lib, |
342
445aaaf228cc
Handle "mod_wsgi" not existing as a package/provides in CentOS 8
IBBoard <dev@ibboard.co.uk>
parents:
335
diff
changeset
|
681 package => $mod_wsgi_package, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
682 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
683 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
684 # Create Python virtualenvs for the dev site apps |
272
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
685 file { |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
686 "/srv/rhodecode": |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
687 ensure => 'directory'; |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
688 "/srv/trac": |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
689 ensure => 'directory'; |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
690 } -> |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
691 python::virtualenv { |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
692 # Distribute is described as "simple compatibility layer that installs Setuptools 0.7+" |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
693 # and leads to 'module "importlib._bootstrap" has no attribute "SourceFileLoader"' |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
694 "/srv/rhodecode/virtualenv": |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
695 distribute => false, |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
696 version => '3'; |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
697 "/srv/trac/virtualenv": |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
698 distribute => false, |
c42fb28cff86
Update to a newer Python module
IBBoard <dev@ibboard.co.uk>
parents:
271
diff
changeset
|
699 version => '3'; |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
700 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
701 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
702 # Graphviz for Trac "master ticket" graphs |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
703 package { 'graphviz': |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
704 ensure => installed, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
705 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
706 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
707 website::https::multitld { 'dev.ibboard': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
708 proxy_4to6_ip => $proxy_4to6_ip, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
709 #Make sure we're the first one hit for the tiny fraction of "no support" cases we care about (potentially Python for Mercurial!) |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
710 # http://en.wikipedia.org/wiki/Server_Name_Indication#No_support |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
711 priority => 1, |
157
c6b1b42f3e4b
Move all sites to separate LetsEncrypt certs to make adding future domains easier
IBBoard <dev@ibboard.co.uk>
parents:
154
diff
changeset
|
712 letsencrypt_name => 'dev.ibboard.co.uk', |
246 | 713 custom_fragment => template("privat/apache/dev.fragment"), |
281
af7df930a670
Add 4-to-6 proxy and mod_remoteip setup
IBBoard <dev@ibboard.co.uk>
parents:
279
diff
changeset
|
714 proxy_fragment => template("privat/apache/dev-proxy.fragment"), |
52
be1e9773a12c
Mercurial repo versions index.php files etc, so removing index.php breaks things!
IBBoard <dev@ibboard.co.uk>
parents:
44
diff
changeset
|
715 force_no_index => false, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
716 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
717 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
718 |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
719 class webmailpimsite ($proxy_4to6_ip_pim, $proxy_4to6_ip_webmail) { |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
720 # Webmail and Personal Information Management (PIM) sites |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
721 website::https { 'webmail.ibboard.co.uk': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
722 proxy_4to6_ip => $proxy_4to6_ip_webmail, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
723 force_no_index => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
724 ssl_ca_chain => '', |
246 | 725 custom_fragment => template("privat/apache/webmail.fragment"), |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
726 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
727 website::https { 'pim.ibboard.co.uk': |
284
9431aec4d998
Switch to using IPv6 prefix and IP per site
IBBoard <dev@ibboard.co.uk>
parents:
281
diff
changeset
|
728 proxy_4to6_ip => $proxy_4to6_ip_pim, |
242
7d8e664ebcc9
Change owner/group on Nextcloud for easy upgrade
IBBoard <dev@ibboard.co.uk>
parents:
241
diff
changeset
|
729 docroot_owner => 'apache', |
7d8e664ebcc9
Change owner/group on Nextcloud for easy upgrade
IBBoard <dev@ibboard.co.uk>
parents:
241
diff
changeset
|
730 docroot_group => 'editors', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
731 force_no_index => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
732 lockdown_requests => false, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
733 ssl_ca_chain => '', |
265
bf2b8912c414
Make PIM site skip CSP headers - NextCloud manages them
IBBoard <dev@ibboard.co.uk>
parents:
264
diff
changeset
|
734 csp => false, |
bf2b8912c414
Make PIM site skip CSP headers - NextCloud manages them
IBBoard <dev@ibboard.co.uk>
parents:
264
diff
changeset
|
735 csp_report => false, |
246 | 736 custom_fragment => template("privat/apache/pim.fragment"), |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
737 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
738 cron { 'owncloudcron': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
739 command => "/usr/local/bin/owncloud-cron", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
740 user => 'apache', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
741 minute => '*/15', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
742 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
743 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
744 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
745 class email ( |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
746 $mailserver, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
747 $imapserver, |
311
51d3748f8112
Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents:
310
diff
changeset
|
748 $mailserver_ip, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
749 $proxy_ip = undef, |
311
51d3748f8112
Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents:
310
diff
changeset
|
750 $proxy_upstream = [], |
326 | 751 $nat64_ranges = [], |
752 $mailrelays = [], | |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
753 ){ |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
754 class { 'postfix': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
755 mailserver => $mailserver, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
756 mailserver_ip => $mailserver_ip, |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
757 mailserver_proxy => $proxy_ip, |
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
758 proxy_upstream => $proxy_upstream, |
326 | 759 mailrelays => $mailrelays, |
760 nat64_ranges => $nat64_ranges, | |
317
2a20a5b7f65a
Swap IPv6 Postfix to "all" protocols to support PROXY
IBBoard <dev@ibboard.co.uk>
parents:
313
diff
changeset
|
761 protocols => $mailserver_ip =~ Stdlib::IP::Address::V6 ? { true => 'all', default => 'ipv4' }, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
762 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
763 class { 'dovecot': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
764 imapserver => $imapserver, |
311
51d3748f8112
Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents:
310
diff
changeset
|
765 imapserver_ip => $mailserver_ip, |
313
49e66019faf7
Configure Postfix for IPv6 w/proxy
IBBoard <dev@ibboard.co.uk>
parents:
311
diff
changeset
|
766 imapserver_proxy => $proxy_ip, |
311
51d3748f8112
Configure Dovecot (IMAP) for PROXY protocol use
IBBoard <dev@ibboard.co.uk>
parents:
310
diff
changeset
|
767 proxy_upstream => $proxy_upstream, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
768 } |
177
1b605c38b375
Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents:
176
diff
changeset
|
769 # Unspecified SpamAssassin config dependencies that started |
1b605c38b375
Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents:
176
diff
changeset
|
770 # showing up as errors in our logs |
276
165ad12ea8ca
Remove Perl LZMA module because it's in beta
IBBoard <dev@ibboard.co.uk>
parents:
274
diff
changeset
|
771 package { ['perl-File-MimeInfo']: |
177
1b605c38b375
Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents:
176
diff
changeset
|
772 ensure => installed, |
1b605c38b375
Add missing dependencies for SpamAssassin rules
IBBoard <dev@ibboard.co.uk>
parents:
176
diff
changeset
|
773 } |
140
6eef7cec8658
Remove ClamAV from server config
IBBoard <dev@ibboard.co.uk>
parents:
139
diff
changeset
|
774 package { [ 'amavisd-new' ]: |
85 | 775 ensure => installed, |
776 tag => 'av', | |
777 } | |
86
4f59d2fcd521
Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents:
85
diff
changeset
|
778 service { 'amavisd': |
4f59d2fcd521
Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents:
85
diff
changeset
|
779 ensure => 'running', |
4f59d2fcd521
Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents:
85
diff
changeset
|
780 enable => 'true', |
4f59d2fcd521
Make sure that Amavis daemon is running so mail gets delivered after reboot!
IBBoard <dev@ibboard.co.uk>
parents:
85
diff
changeset
|
781 } |
270
481acc395876
Mask "clamav@amavisd" service to save memory
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
782 service { 'clamd@amavisd': |
481acc395876
Mask "clamav@amavisd" service to save memory
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
783 ensure => 'stopped', |
481acc395876
Mask "clamav@amavisd" service to save memory
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
784 enable=> 'mask', |
481acc395876
Mask "clamav@amavisd" service to save memory
IBBoard <dev@ibboard.co.uk>
parents:
268
diff
changeset
|
785 } |
85 | 786 file { '/etc/amavisd/amavisd.conf': |
787 ensure => present, | |
788 source => 'puppet:///private/postfix/amavisd.conf', | |
789 tag => 'av', | |
790 } | |
163
4e53d77fa586
Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents:
162
diff
changeset
|
791 file { '/etc/mail/spamassassin/local.cf': |
4e53d77fa586
Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents:
162
diff
changeset
|
792 ensure => present, |
4e53d77fa586
Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents:
162
diff
changeset
|
793 source => 'puppet:///private/postfix/spamassassin-local.cf', |
4e53d77fa586
Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents:
162
diff
changeset
|
794 tag => 'av', |
4e53d77fa586
Manage SpamAssassin local config
IBBoard <dev@ibboard.co.uk>
parents:
162
diff
changeset
|
795 } |
142
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
796 file { '/etc/mail/spamassassin/ole2macro.cf': |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
797 ensure => present, |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
798 source => 'puppet:///common/ole2macro.cf', |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
799 tag => 'av', |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
800 } |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
801 file { '/etc/mail/spamassassin/ole2macro.pm': |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
802 ensure => present, |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
803 source => 'puppet:///common/spamassassin-vba-macro-master/ole2macro.pm', |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
804 tag => 'av', |
dae1088dd218
Add OLE detection to SpamAssassin without ClamAV
IBBoard <dev@ibboard.co.uk>
parents:
141
diff
changeset
|
805 } |
85 | 806 Package<| tag == 'av' |> -> File<| tag == 'av' |> |
87
6be21a984126
Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents:
86
diff
changeset
|
807 File<| tag == 'av' |> { |
6be21a984126
Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents:
86
diff
changeset
|
808 notify => Service['amavisd'], |
6be21a984126
Make sure that config file changes for changes trigger a reload
IBBoard <dev@ibboard.co.uk>
parents:
86
diff
changeset
|
809 } |
125
ca711ab45f17
Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents:
122
diff
changeset
|
810 cron { 'Postwhite': |
129
16a931df5fd7
Filter what we see in Postwhite cron output
IBBoard <dev@ibboard.co.uk>
parents:
128
diff
changeset
|
811 command => "/usr/local/bin/postwhite 2>&1| grep -vE '^(Starting|Recursively|Getting|Querying|Removing|Sorting|$)'", |
125
ca711ab45f17
Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents:
122
diff
changeset
|
812 user => 'root', |
ca711ab45f17
Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents:
122
diff
changeset
|
813 weekday => 0, |
128
379089631403
Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents:
126
diff
changeset
|
814 hour => 2, |
379089631403
Fix rookie cron mistake - don't run Postwhite EVERY MINUTE!
IBBoard <dev@ibboard.co.uk>
parents:
126
diff
changeset
|
815 minute => 0, |
125
ca711ab45f17
Schedule Postwhite to run regularly
IBBoard <dev@ibboard.co.uk>
parents:
122
diff
changeset
|
816 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
817 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
818 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
819 class cronjobs { |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
820 # Add Mutt for scripts that send emails, but stop it clogging the disk by keeping copies of emails |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
821 package { 'mutt': |
131
0dd899a10ee1
Change all "latest" packages to "installed"
IBBoard <dev@ibboard.co.uk>
parents:
129
diff
changeset
|
822 ensure => installed, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
823 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
824 file { '/etc/Muttrc.local': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
825 content => 'set copy = no', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
826 require => Package['mutt'], |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
827 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
828 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
829 # General server-wide cron jobs |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
830 Cron { user => 'root' } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
831 cron { 'backupalldbs': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
832 command => "/usr/local/bin/backupalldbs", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
833 monthday => "*/2", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
834 hour => "4", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
835 minute => "9" |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
836 } |
323
002203790815
Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents:
322
diff
changeset
|
837 # Only run the Great Firewall Against China on IPv4 (since we don't have an IPv6 list |
002203790815
Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents:
322
diff
changeset
|
838 # and the PROXY forwards the IPs to services, but not at the network level) |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
839 cron { 'greatfirewallofchina': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
840 command => '/usr/local/bin/update-great-firewall-of-china', |
323
002203790815
Stop running Great Firewall Against China on IPv6 machines
IBBoard <dev@ibboard.co.uk>
parents:
322
diff
changeset
|
841 ensure => has_key($facts, 'ipaddress') ? { true => "present", default => "absent" }, |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
842 hour => 3, |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
843 minute => 30 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
844 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
845 cron { 'permissions': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
846 command => '/usr/local/bin/set-permissions', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
847 hour => 3, |
14
534e584f21ce
Tweak time on permission setting script so that it is less likely to clash with LoadAVG run every 6 minutes
IBBoard <dev@ibboard.co.uk>
parents:
13
diff
changeset
|
848 minute => 2 |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
849 } |
55
ce8eaaca6a34
Update firewalling so that we block the right ports when using iptables directly
IBBoard <dev@ibboard.co.uk>
parents:
54
diff
changeset
|
850 # Since we're only managing the local server, use our script that wraps "puppet apply" instead of PuppetMaster |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
851 cron { 'puppet': |
268
9f054191b9db
Filter new log line from puppet-apply output
IBBoard <dev@ibboard.co.uk>
parents:
267
diff
changeset
|
852 command => '/usr/local/bin/puppet-apply | grep -v "Compiled catalog for\|Finished catalog run in\|Applied catalog in"', |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
853 hour => '*/6', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
854 minute => 5 |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
855 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
856 cron { 'purgecaches': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
857 command => "/usr/local/bin/purge-caches", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
858 hour => '4', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
859 minute => '15', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
860 weekday => '1', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
861 } |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
862 # Notify of uncommitted files |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
863 cron { 'check-mercurial-committed': |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
864 command => "/usr/local/bin/check-hg-status", |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
865 hour => '4', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
866 minute => '20', |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
867 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning |
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
868 } |
93
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
869 # Notify of available updates |
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
870 cron { 'check-yum-updates': |
378
d539c21143bb
Get more specific with extracting Yum update list
IBBoard <dev@ibboard.co.uk>
parents:
377
diff
changeset
|
871 command => '/usr/bin/yum check-update | grep -E "^[^ ]+ +[0-9a-z_\.-]+ +[^ ]+$"', |
93
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
872 hour => '4', |
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
873 minute => '30', |
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
874 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning |
74678cd7a200
Run cron job to notify of available updates
IBBoard <dev@ibboard.co.uk>
parents:
91
diff
changeset
|
875 } |
97
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
876 # And check whether anything needs restarting |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
877 cron { 'check-needs-restarting': |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
878 command => '/usr/bin/needs-restarting|grep -v "/usr/lib/systemd\|/usr/sbin/lvmetad\|/usr/lib/polkit-1/polkitd"', |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
879 hour => '4', |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
880 minute => '45', |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
881 weekday => '0-6/3', #Sunday, Wednesday and Saturday morning |
b69e3f6708d6
Add another regular command to check that we've not got services requiring a restart
IBBoard <dev@ibboard.co.uk>
parents:
96
diff
changeset
|
882 } |
0
956e484adc12
Initial public release of Puppet configs
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
883 } |