Mercurial > repos > other > Puppet

comparison manifests/templates.pp @ 298:61e90445c899

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Merge CentOS8 and CentOS7 branches Also includes some fixes to get it working on CentOS7
author IBBoard <dev@ibboard.co.uk>
date Mon, 17 Feb 2020 16:08:20 +0000
parents 3e04f35dd0af 9431aec4d998
children 1bfc290270cc
comparison
equal deleted inserted replaced
297:4f7315d7e869 298:61e90445c899
1 # Make sure packages come after their repos 1 # Make sure packages come after their repos
2 File<| tag == 'repo-config' |> -> YumRepo<| |> -> Package<| |> 2 File<| tag == 'repo-config' |> -> YumRepo<| |> -> Package<| |>
3 3
4 # Make sure all files are in place before starting services 4 # Make sure all files are in place before starting services
5 File<| tag != 'post-service' |> -> Service<| |> 5 # FIXME: Title matches are to fix a dependency cycle
6 File<| tag != 'post-service' and title != '/etc/sysconfig/ip6tables' and title != '/etc/sysconfig/iptables' |> -> Service<| |>
6 7
7 # Set some shortcut variables 8 # Set some shortcut variables
8 #$os = $operatingsystem 9 #$os = $operatingsystem
9 $osver = $operatingsystemmajrelease 10 $osver = $operatingsystemmajrelease
10 $server = '' 11 $server = ''
25 } 26 }
26 } 27 }
27 28
28 class basevpsnode ( 29 class basevpsnode (
29 $primary_ip, 30 $primary_ip,
30 $secondary_ip, 31 $proxy_4to6_ip_prefix = undef,
32 $proxy_upstream = undef,
31 $mailserver, 33 $mailserver,
32 $imapserver, 34 $imapserver,
33 $firewall_cmd = 'iptables', 35 $firewall_cmd = 'iptables',
34 ) { 36 ) {
35 37
36 if $firewall_cmd == 'iptables' { 38 if $firewall_cmd == 'iptables' {
37 include vpsfirewall 39 class { 'vpsfirewall':
40 fw_protocol => $primary_ip =~ Stdlib::IP::Address::V6 ? { true => 'IPv6', default => 'IPv4'},
41 }
38 } 42 }
39 43
40 #VPS is a self-mastered Puppet machine, so bodge a Hosts file 44 #VPS is a self-mastered Puppet machine, so bodge a Hosts file
41 file { '/etc/hosts': 45 file { '/etc/hosts':
42 ensure => present, 46 ensure => present,
51 include ssh::server 55 include ssh::server
52 include vcs::server 56 include vcs::server
53 include vcs::client 57 include vcs::client
54 class { 'webserver': 58 class { 'webserver':
55 primary_ip => $primary_ip, 59 primary_ip => $primary_ip,
56 secondary_ip => $secondary_ip, 60 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
61 proxy_upstream => $proxy_upstream,
57 } 62 }
58 include cronjobs 63 include cronjobs
59 include logrotate 64 include logrotate
60 class { 'fail2ban': 65 class { 'fail2ban':
61 firewall_cmd => $firewall_cmd, 66 firewall_cmd => $firewall_cmd,
67 } 72 }
68 } 73 }
69 74
70 ## Classes to allow facet behaviour using preconfigured setups of classes 75 ## Classes to allow facet behaviour using preconfigured setups of classes
71 76
72 class vpsfirewall { 77 class vpsfirewall ($fw_protocol) {
73 resources { "firewall": 78 resources { "firewall":
74 purge => false, 79 purge => false,
75 } 80 }
76 firewallchain { 'INPUT:filter:IPv4': 81 class { "my_fw":
77 purge => true, 82 ip_version => $fw_protocol,
83 }
84 # Control what does and doesn't get pruned in the main filter chain
85 firewallchain { "INPUT:filter:$fw_protocol":
86 purge => true,
78 ignore => [ 87 ignore => [
79 '-j f2b-[^ ]+$', 88 '-j f2b-[^ ]+$',
80 '^(:|-A )f2b-', 89 '^(:|-A )f2b-',
81 '--comment "Great Firewall of China"', 90 '--comment "Great Firewall of China"',
82 '--comment "Do not purge', 91 '--comment "Do not purge',
83 ], 92 ],
84 } 93 }
85 Firewall { 94 if ($fw_protocol != "IPv6") {
86 before => Class['my_fw::post'], 95 firewall { '010 Whitelist Googlebot':
87 require => Class['my_fw::pre'], 96 source => '66.249.64.0/19',
88 } 97 dport => [80,443],
89 class { ['my_fw::pre', 'my_fw::post']: } 98 proto => tcp,
90 class { 'firewall': } 99 action => accept,
91 firewall { '010 Whitelist Googlebot': 100 }
92 source => '66.249.64.0/19', 101 # Block a spammer hitting our contact forms (also on StopForumSpam list A LOT)
93 dport => [80,443], 102 firewall { '099 Blacklist spammers 1':
94 proto => tcp, 103 source => '107.181.78.172',
95 action => accept, 104 dport => [80, 443],
96 } 105 proto => tcp,
97 # Block a spammer hitting our contact forms (also on StopForumSpam list A LOT) 106 action => 'reject',
98 firewall { '099 Blacklist spammers 1': 107 }
99 source => '107.181.78.172', 108 firewall { '099 Blacklist IODC bot':
100 dport => [80, 443], 109 # IODC bot makes too many bad requests, and contact form is broken
101 proto => tcp, 110 # They don't publish a robots.txt name, so firewall it!
102 action => 'reject', 111 source => '86.153.145.149',
103 } 112 dport => [ 80, 443 ],
104 firewall { '099 Blacklist IODC bot': 113 proto => tcp,
105 # IODC bot makes too many bad requests, and contact form is broken 114 action => 'reject',
106 # They don't publish a robots.txt name, so firewall it! 115 }
107 source => '86.153.145.149', 116 firewall { '099 Blacklist Baidu Brazil':
108 dport => [ 80, 443 ], 117 #Baidu got a Brazilian netblock and are hitting us hard
109 proto => tcp, 118 #Baidu doesn't honour "crawl-delay" in robots.txt
110 action => 'reject', 119 #Baidu gets firewalled
111 } 120 source => '131.161.8.0/22',
112 firewall { '099 Blacklist Baidu Brazil': 121 dport => [ 80, 443 ],
113 #Baidu got a Brazilian netblock and are hitting us hard 122 proto => tcp,
114 #Baidu doesn't honour "crawl-delay" in robots.txt 123 action => 'reject',
115 #Baidu gets firewalled 124 }
116 source => '131.161.8.0/22', 125 }
117 dport => [ 80, 443 ], 126 firewallchain { "GREATFIREWALLOFCHINA:filter:$fw_protocol":
118 proto => tcp,
119 action => 'reject',
120 }
121 firewallchain { 'GREATFIREWALLOFCHINA:filter:IPv4':
122 ensure => present, 127 ensure => present,
123 } 128 }
124 firewall { '050 Check our Great Firewall Against China': 129 firewall { '050 Check our Great Firewall Against China':
125 chain => 'INPUT', 130 chain => 'INPUT',
126 jump => 'GREATFIREWALLOFCHINA', 131 jump => 'GREATFIREWALLOFCHINA',
127 } 132 }
128 firewallchain { 'Fail2Ban:filter:IPv4': 133 firewallchain { "Fail2Ban:filter:$fw_protocol":
129 ensure => present, 134 ensure => present,
130 } 135 }
131 firewall { '060 Check Fail2Ban': 136 firewall { '060 Check Fail2Ban':
132 chain => 'INPUT', 137 chain => 'INPUT',
133 jump => 'Fail2Ban', 138 jump => 'Fail2Ban',
134 }
135 firewall { '100 allow https and http':
136 dport => [80, 443],
137 proto => tcp,
138 action => accept,
139 } 139 }
140 firewall { '101 allow SMTP': 140 firewall { '101 allow SMTP':
141 dport => [25, 465], 141 dport => [25, 465],
142 proto => tcp, 142 proto => tcp,
143 action => accept, 143 action => accept,
234 } 234 }
235 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-el7': 235 file { '/etc/pki/rpm-gpg/RPM-GPG-KEY-webtatic-el7':
236 ensure => absent, 236 ensure => absent,
237 } 237 }
238 238
239 # Install Pip and symlink it so we can use it as a package provider 239 if $operatingsystem == 'CentOS' and versioncmp($operatingsystemrelease, '8') >= 0 {
240 package { 'python2-pip': 240 $python_ver = 'python3'
241 ensure => installed; 241 } else {
242 } 242 $python_ver = 'system'
243 -> 243 }
244 file { '/usr/bin/pip-python': 244
245 ensure => link, 245 class { 'python':
246 target => '/usr/bin/pip', 246 ensure => 'present',
247 } -> Package <| provider == 'pip' |> 247 version => $python_ver,
248 pip => 'present',
249 virtualenv => 'present',
250 use_epel => false,
251 }
248 } 252 }
249 253
250 class tools { 254 class tools {
251 $packages = [ 'sqlite', 'bash-completion', 'nano', 'bzip2', 'mlocate', 'patch', 'tmux' ] 255 $packages = [ 'sqlite', 'bash-completion', 'nano', 'bzip2', 'mlocate', 'patch', 'tmux', 'wget' ]
252 package { $packages: 256 package { $packages:
253 ensure => installed; 257 ensure => installed;
254 } 258 }
255 } 259 }
256 260
338 } 342 }
339 343
340 #Our web server with our configs, not just a stock one 344 #Our web server with our configs, not just a stock one
341 class webserver ( 345 class webserver (
342 $primary_ip, 346 $primary_ip,
343 $secondary_ip, 347 $proxy_4to6_ip_prefix = undef,
348 $proxy_upstream = undef,
344 ) { 349 ) {
350
351 if $proxy_4to6_ip_prefix == undef {
352 $ipv6_addresses = []
353 }
354 else {
355 $ipv6_addresses = [1, 2, 3, 4, 5, 6, 7, 8, 9].map |$octet| { "$proxy_4to6_ip_prefix:$octet" }
356 }
357
345 #Setup base website parameters 358 #Setup base website parameters
346 class { 'website': 359 class { 'website':
347 base_dir => '/srv/sites', 360 base_dir => '/srv/sites',
348 primary_ip => $primary_ip, 361 primary_ip => $primary_ip,
349 secondary_ip => $secondary_ip, 362 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
363 proxy_4to6_mask => 124,
364 proxy_4to6_addresses => $ipv6_addresses,
365 proxy_upstream => $proxy_upstream,
350 default_owner => $defaultusers::default_user, 366 default_owner => $defaultusers::default_user,
351 default_group => $defaultusers::default_user, 367 default_group => $defaultusers::default_user,
352 default_tld => 'co.uk', 368 default_tld => 'co.uk',
353 default_extra_tlds => [ 'com' ], 369 default_extra_tlds => [ 'com' ],
354 } 370 }
420 name => $semanage_package_name, 436 name => $semanage_package_name,
421 ensure => present, 437 ensure => present,
422 } 438 }
423 439
424 $extra_packages = [ 440 $extra_packages = [
425 'subversion-python', #Required for Trac
426 'perl-Sys-Syslog', #Required for Perl SPF checking 441 'perl-Sys-Syslog', #Required for Perl SPF checking
427 ] 442 ]
428 443
429 package { $extra_packages: 444 package { $extra_packages:
430 ensure => installed 445 ensure => installed
444 } 459 }
445 } 460 }
446 461
447 class ibboardvpsnode ( 462 class ibboardvpsnode (
448 $primary_ip, 463 $primary_ip,
449 $secondary_ip = $primary_ip, 464 $proxy_4to6_ip_prefix = undef,
465 $proxy_upstream = undef,
450 $mailserver, 466 $mailserver,
451 $imapserver, 467 $imapserver,
452 $firewall_cmd = 'iptables', 468 $firewall_cmd = 'iptables',
453 ){ 469 ){
454 class { 'basevpsnode': 470 class { 'basevpsnode':
455 primary_ip => $primary_ip, 471 primary_ip => $primary_ip,
456 secondary_ip => $secondary_ip, 472 proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
473 proxy_upstream => $proxy_upstream,
457 mailserver => $mailserver, 474 mailserver => $mailserver,
458 imapserver => $imapserver, 475 imapserver => $imapserver,
459 firewall_cmd => $firewall_cmd, 476 firewall_cmd => $firewall_cmd,
460 } 477 }
461 478
480 'authn_core':; 497 'authn_core':;
481 } 498 }
482 } 499 }
483 500
484 #Configure our sites, using templates for the custom fragments where the extra content is too long 501 #Configure our sites, using templates for the custom fragments where the extra content is too long
485 include adminsite 502 class { "devsite":
503 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:01", default => undef }
504 }
505 class { "adminsite":
506 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:02", default => undef }
507 }
486 website::https::multitld { 'www.ibboard': 508 website::https::multitld { 'www.ibboard':
509 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:03", default => undef },
487 custom_fragment => template("privat/apache/ibboard.fragment"), 510 custom_fragment => template("privat/apache/ibboard.fragment"),
488 letsencrypt_name => 'ibboard.co.uk', 511 letsencrypt_name => 'ibboard.co.uk',
489 csp_override => { 512 csp_override => {
490 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce", 513 "report-uri" => "https://ibboard.report-uri.com/r/d/csp/enforce",
491 "default-src" => "'none'", 514 "default-src" => "'none'",
495 "font-src" => "'self'", 518 "font-src" => "'self'",
496 "form-action" => "'self'", 519 "form-action" => "'self'",
497 "connect-src" => "'self'", 520 "connect-src" => "'self'",
498 } 521 }
499 } 522 }
500 include hiveworldterrasite 523 class { "hiveworldterrasite":
501 include bdstrikesite 524 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:04", default => undef }
502 include devsite 525 }
526 class { "bdstrikesite":
527 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:05", default => undef }
528 }
503 website::https::multitld { 'www.abiknight': 529 website::https::multitld { 'www.abiknight':
530 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:06", default => undef },
504 custom_fragment => "$website::htmlphpfragment 531 custom_fragment => "$website::htmlphpfragment
505 ErrorDocument 404 /error.php", 532 ErrorDocument 404 /error.php",
506 letsencrypt_name => 'abiknight.co.uk', 533 letsencrypt_name => 'abiknight.co.uk',
507 } 534 }
508 include webmailpimsite 535 website::https::multitld { 'www.warfoundry':
509 } 536 proxy_4to6_ip => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:07", default => undef },
510 537 letsencrypt_name => 'warfoundry.co.uk',
511 class adminsite{ 538 custom_fragment => template("privat/apache/warfoundry.fragment"),
539 }
540 class { "webmailpimsite":
541 proxy_4to6_ip_pim => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:08", default => undef },
542 proxy_4to6_ip_webmail => $proxy_4to6_ip_prefix != undef ? { true => "$proxy_4to6_ip_prefix:09", default => undef },
543 }
544 }
545
546 class adminsite ($proxy_4to6_ip) {
512 apache::mod { 'info':; 'status':; 'cgi':; } 547 apache::mod { 'info':; 'status':; 'cgi':; }
513 website::https::multitld { 'admin.ibboard': 548 website::https::multitld { 'admin.ibboard':
549 proxy_4to6_ip => $proxy_4to6_ip,
514 force_no_index => false, 550 force_no_index => false,
515 ssl_ca_chain => '', 551 ssl_ca_chain => '',
516 custom_fragment => template("privat/apache/admin.fragment"), 552 custom_fragment => template("privat/apache/admin.fragment"),
517 } 553 }
518 cron { 'loadavg': 554 cron { 'loadavg':
526 hour => '*/6', 562 hour => '*/6',
527 minute => '0' 563 minute => '0'
528 } 564 }
529 } 565 }
530 566
531 class hiveworldterrasite { 567 class hiveworldterrasite ($proxy_4to6_ip) {
532 website::https::multitld { 'www.hiveworldterra': 568 website::https::multitld { 'www.hiveworldterra':
569 proxy_4to6_ip => $proxy_4to6_ip,
533 force_no_www => false, 570 force_no_www => false,
534 letsencrypt_name => 'hiveworldterra.co.uk', 571 letsencrypt_name => 'hiveworldterra.co.uk',
535 custom_fragment => template("privat/apache/hwt.fragment"), 572 custom_fragment => template("privat/apache/hwt.fragment"),
536 } 573 }
537 website::https::multitld { 'forums.hiveworldterra': 574 website::https::multitld { 'forums.hiveworldterra':
575 proxy_4to6_ip => $proxy_4to6_ip,
538 letsencrypt_name => 'hiveworldterra.co.uk', 576 letsencrypt_name => 'hiveworldterra.co.uk',
539 custom_fragment => template("privat/apache/forums.fragment"), 577 custom_fragment => template("privat/apache/forums.fragment"),
540 } 578 }
541 website::https::multitld { 'skins.hiveworldterra': 579 website::https::multitld { 'skins.hiveworldterra':
580 proxy_4to6_ip => $proxy_4to6_ip,
542 letsencrypt_name => 'hiveworldterra.co.uk', 581 letsencrypt_name => 'hiveworldterra.co.uk',
543 custom_fragment => template("privat/apache/skins.fragment"), 582 custom_fragment => template("privat/apache/skins.fragment"),
544 } 583 }
545 website::https::redir { 'hiveworldterra.ibboard.co.uk': 584 website::https::redir { 'hiveworldterra.ibboard.co.uk':
585 proxy_4to6_ip => $proxy_4to6_ip,
546 redir => 'https://www.hiveworldterra.co.uk/', 586 redir => 'https://www.hiveworldterra.co.uk/',
547 docroot => "${website::basedir}/hiveworldterra", 587 docroot => "${website::basedir}/hiveworldterra",
548 letsencrypt_name => 'hiveworldterra.co.uk', 588 letsencrypt_name => 'hiveworldterra.co.uk',
549 separate_log => true, 589 separate_log => true,
550 } 590 }
551 } 591 }
552 class bdstrikesite { 592 class bdstrikesite ($proxy_4to6_ip) {
553 website::https::multitld { 'www.bdstrike': 593 website::https::multitld { 'www.bdstrike':
594 proxy_4to6_ip => $proxy_4to6_ip,
554 docroot_owner => $defaultusers::secondary_user, 595 docroot_owner => $defaultusers::secondary_user,
555 docroot_group => 'editors', 596 docroot_group => 'editors',
556 letsencrypt_name => 'bdstrike.co.uk', 597 letsencrypt_name => 'bdstrike.co.uk',
557 custom_fragment => template("privat/apache/bdstrike.fragment"), 598 custom_fragment => template("privat/apache/bdstrike.fragment"),
558 csp_override => {"frame-ancestors" => "'self'"}, 599 csp_override => {"frame-ancestors" => "'self'"},
566 'strikecreations.co.uk', 607 'strikecreations.co.uk',
567 'strikecreations.com', 608 'strikecreations.com',
568 'www.strikecreations.com' ] 609 'www.strikecreations.com' ]
569 610
570 website::https::redir { 'www.strikecreations.co.uk': 611 website::https::redir { 'www.strikecreations.co.uk':
612 proxy_4to6_ip => $proxy_4to6_ip,
571 redir => 'https://bdstrike.co.uk/', 613 redir => 'https://bdstrike.co.uk/',
572 serveraliases => $aliases, 614 serveraliases => $aliases,
573 docroot => "${website::basedir}/bdstrike", 615 docroot => "${website::basedir}/bdstrike",
574 docroot_owner => $defaultusers::secondary_user, 616 docroot_owner => $defaultusers::secondary_user,
575 docroot_group => 'editors', 617 docroot_group => 'editors',
582 command => "/usr/local/bin/bdstrike-cron", 624 command => "/usr/local/bin/bdstrike-cron",
583 user => $defaultusers::default_user, 625 user => $defaultusers::default_user,
584 minute => '*/15', 626 minute => '*/15',
585 } 627 }
586 } 628 }
587 class devsite { 629 class devsite ($proxy_4to6_ip) {
588 if versioncmp($operatingsystemrelease, '8') >= 0 { 630 if versioncmp($operatingsystemrelease, '8') >= 0 {
589 # Apache::Mod doesn't map this correctly for CentOS 8 yet 631 # Apache::Mod doesn't map this correctly for CentOS 8 yet
590 $mod_wsgi_lib = 'mod_wsgi_python3.so' 632 $mod_wsgi_lib = 'mod_wsgi_python3.so'
591 } else { 633 } else {
592 $mod_wsgi_lib = undef 634 $mod_wsgi_lib = undef
595 # mod_wsgi for Python support 637 # mod_wsgi for Python support
596 'wsgi': 638 'wsgi':
597 lib => $mod_wsgi_lib, 639 lib => $mod_wsgi_lib,
598 } 640 }
599 641
600 include python::venv
601
602 # Create Python virtualenvs for the dev site apps 642 # Create Python virtualenvs for the dev site apps
603 python::venv::isolate { 643 file {
604 "/srv/rhodecode/virtualenv":; 644 "/srv/rhodecode":
605 "/srv/trac/virtualenv":; 645 ensure => 'directory';
646 "/srv/trac":
647 ensure => 'directory';
648 } ->
649 python::virtualenv {
650 # Distribute is described as "simple compatibility layer that installs Setuptools 0.7+"
651 # and leads to 'module "importlib._bootstrap" has no attribute "SourceFileLoader"'
652 "/srv/rhodecode/virtualenv":
653 distribute => false,
654 version => '3';
655 "/srv/trac/virtualenv":
656 distribute => false,
657 version => '3';
606 } 658 }
607 659
608 # Graphviz for Trac "master ticket" graphs 660 # Graphviz for Trac "master ticket" graphs
609 package { 'graphviz': 661 package { 'graphviz':
610 ensure => installed, 662 ensure => installed,
611 } 663 }
612 664
613 website::https::multitld { 'www.warfoundry':
614 letsencrypt_name => 'warfoundry.co.uk',
615 custom_fragment => template("privat/apache/warfoundry.fragment"),
616 }
617 website::https::multitld { 'dev.ibboard': 665 website::https::multitld { 'dev.ibboard':
666 proxy_4to6_ip => $proxy_4to6_ip,
618 #Make sure we're the first one hit for the tiny fraction of "no support" cases we care about (potentially Python for Mercurial!) 667 #Make sure we're the first one hit for the tiny fraction of "no support" cases we care about (potentially Python for Mercurial!)
619 # http://en.wikipedia.org/wiki/Server_Name_Indication#No_support 668 # http://en.wikipedia.org/wiki/Server_Name_Indication#No_support
620 priority => 1, 669 priority => 1,
621 letsencrypt_name => 'dev.ibboard.co.uk', 670 letsencrypt_name => 'dev.ibboard.co.uk',
622 custom_fragment => template("privat/apache/dev.fragment"), 671 custom_fragment => template("privat/apache/dev.fragment"),
672 proxy_fragment => template("privat/apache/dev-proxy.fragment"),
623 force_no_index => false, 673 force_no_index => false,
624 } 674 }
625 } 675 }
626 676
627 class webmailpimsite { 677 class webmailpimsite ($proxy_4to6_ip_pim, $proxy_4to6_ip_webmail) {
628 # Webmail and Personal Information Management (PIM) sites 678 # Webmail and Personal Information Management (PIM) sites
629 website::https { 'webmail.ibboard.co.uk': 679 website::https { 'webmail.ibboard.co.uk':
680 proxy_4to6_ip => $proxy_4to6_ip_webmail,
630 force_no_index => false, 681 force_no_index => false,
631 ssl_ca_chain => '', 682 ssl_ca_chain => '',
632 custom_fragment => template("privat/apache/webmail.fragment"), 683 custom_fragment => template("privat/apache/webmail.fragment"),
633 } 684 }
634 website::https { 'pim.ibboard.co.uk': 685 website::https { 'pim.ibboard.co.uk':
686 proxy_4to6_ip => $proxy_4to6_ip_pim,
635 docroot_owner => 'apache', 687 docroot_owner => 'apache',
636 docroot_group => 'editors', 688 docroot_group => 'editors',
637 force_no_index => false, 689 force_no_index => false,
638 lockdown_requests => false, 690 lockdown_requests => false,
639 ssl_ca_chain => '', 691 ssl_ca_chain => '',
659 class { 'dovecot': 711 class { 'dovecot':
660 imapserver => $imapserver, 712 imapserver => $imapserver,
661 } 713 }
662 # Unspecified SpamAssassin config dependencies that started 714 # Unspecified SpamAssassin config dependencies that started
663 # showing up as errors in our logs 715 # showing up as errors in our logs
664 package { ['perl-File-MimeInfo', 'perl-IO-Compress-Lzma']: 716 package { ['perl-File-MimeInfo']:
665 ensure => installed, 717 ensure => installed,
666 } 718 }
667 package { [ 'amavisd-new' ]: 719 package { [ 'amavisd-new' ]:
668 ensure => installed, 720 ensure => installed,
669 tag => 'av', 721 tag => 'av',
670 } 722 }
671 service { 'amavisd': 723 service { 'amavisd':
672 ensure => 'running', 724 ensure => 'running',
673 enable => 'true', 725 enable => 'true',
726 }
727 service { 'clamd@amavisd':
728 ensure => 'stopped',
729 enable=> 'mask',
674 } 730 }
675 file { '/etc/amavisd/amavisd.conf': 731 file { '/etc/amavisd/amavisd.conf':
676 ensure => present, 732 ensure => present,
677 source => 'puppet:///private/postfix/amavisd.conf', 733 source => 'puppet:///private/postfix/amavisd.conf',
678 tag => 'av', 734 tag => 'av',