debian_org::apt: remove jessie support
[mirror/dsa-puppet.git] / modules / debian_org / manifests / init.pp
1 # == Class: debian_org
2 #
3 # Stuff common to all debian.org servers
4 #
5 class debian_org {
6         include debian_org::apt
7
8         if $systemd {
9                 include dsa_systemd
10                 $servicefiles = 'present'
11         } else {
12                 $servicefiles = 'absent'
13         }
14
15         # the virtual facter needs virt-what on jessie to work
16         if versioncmp($::lsbmajdistrelease, '9') < 0 {
17                 package { 'virt-what': ensure => installed }
18         } else {
19                 package { 'virt-what': ensure => purged }
20         }
21
22         $samhain_recipients = hiera('samhain_recipients')
23         $root_mail_alias = hiera('root_mail_alias')
24
25         package { [
26                         'klogd',
27                         'sysklogd',
28                         'rsyslog',
29                         'os-prober',
30                         'apt-listchanges',
31                         'mlocate',
32                 ]:
33                 ensure => purged,
34         }
35         package { [
36                         'debian.org',
37                         'debian.org-recommended',
38                         'dsa-munin-plugins',
39                         'userdir-ldap',
40                 ]:
41                 ensure => installed,
42                 tag    => extra_repo,
43         }
44
45         package { [
46                         'apt-utils',
47                         'bash-completion',
48                         'dnsutils',
49                         'less',
50                         'lsb-release',
51                         'ruby-filesystem',
52                         'mtr-tiny',
53                         'nload',
54                         'pciutils',
55                         'lldpd',
56                         'ncurses-term',
57                 ]:
58                 ensure => installed,
59         }
60
61         munin::check { [
62                         'cpu',
63                         'entropy',
64                         'forks',
65                         'interrupts',
66                         'iostat',
67                         'irqstats',
68                         'load',
69                         'memory',
70                         'open_files',
71                         'open_inodes',
72                         'processes',
73                         'swap',
74                         'uptime',
75                         'vmstat',
76                 ]:
77         }
78
79         package { 'molly-guard':
80                 ensure => installed,
81         }
82         file { '/etc/molly-guard/run.d/10-check-kvm':
83                 mode    => '0755',
84                 source  => 'puppet:///modules/debian_org/molly-guard/10-check-kvm',
85                 require => Package['molly-guard'],
86         }
87         file { '/etc/molly-guard/run.d/15-acquire-reboot-lock':
88                 mode    => '0755',
89                 source  => 'puppet:///modules/debian_org/molly-guard/15-acquire-reboot-lock',
90                 require => Package['molly-guard'],
91         }
92
93         augeas { 'inittab_replicate':
94                 context => '/files/etc/inittab',
95                 changes => [
96                         'set ud/runlevels 2345',
97                         'set ud/action respawn',
98                         'set ud/process "/usr/bin/ud-replicated -d"',
99                 ],
100                 notify  => Exec['init q'],
101         }
102
103
104         file { '/etc/facter':
105                 ensure  => directory,
106                 purge   => true,
107                 force   => true,
108                 recurse => true,
109                 source  => 'puppet:///files/empty/',
110         }
111         file { '/etc/facter/facts.d':
112                 ensure => directory,
113         }
114         file { '/etc/facter/facts.d/debian_facts.yaml':
115                 content => template('debian_org/debian_facts.yaml.erb')
116         }
117         file { '/etc/timezone':
118                 content => "Etc/UTC\n",
119                 notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'],
120         }
121         if versioncmp($::lsbmajdistrelease, '9') >= 0 { # jessie has a regular file there, for instance
122                 file { '/etc/localtime':
123                         ensure => 'link',
124                         target => '/usr/share/zoneinfo/Etc/UTC',
125                         notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'],
126                 }
127         }
128         file { '/etc/puppet/puppet.conf':
129                 content => template('debian_org/puppet.conf.erb'),
130                 mode => '0440',
131                 group => 'puppet',
132         }
133         file { '/etc/default/puppet':
134                 source => 'puppet:///modules/debian_org/puppet.default',
135         }
136         file { '/etc/systemd':
137                 ensure  => directory,
138                 mode => '0755',
139         }
140         file { '/etc/systemd/system':
141                 ensure  => directory,
142                 mode => '0755',
143         }
144         file { '/etc/systemd/system/ud-replicated.service':
145                 ensure => $servicefiles,
146                 source => 'puppet:///modules/debian_org/ud-replicated.service',
147                 notify => Exec['systemctl daemon-reload'],
148         }
149         if $systemd {
150                 file { '/etc/systemd/system/multi-user.target.wants/ud-replicated.service':
151                         ensure => 'link',
152                         target => '../ud-replicated.service',
153                         notify => Exec['systemctl daemon-reload'],
154                 }
155         }
156         file { '/etc/systemd/system/puppet.service':
157                 ensure => 'link',
158                 target => '/dev/null',
159                 notify => Exec['systemctl daemon-reload'],
160         }
161         file { '/etc/systemd/system/proc-sys-fs-binfmt_misc.automount':
162                 ensure => 'link',
163                 target => '/dev/null',
164                 notify => Exec['systemctl daemon-reload'],
165         }
166
167         concat { '/etc/cron.d/dsa-puppet-stuff': }
168         concat::fragment { 'dsa-puppet-stuff---header':
169                 target => '/etc/cron.d/dsa-puppet-stuff',
170                 order  => '000',
171                 content  => @(EOF)
172                         ## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
173                         SHELL=/bin/bash
174                         MAILTO=root
175                         PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/nagios/plugins
176                         | EOF
177         }
178         concat::fragment { 'dsa-puppet-stuff---all':
179                 target => '/etc/cron.d/dsa-puppet-stuff',
180                 order  => '010',
181                 content => template('debian_org/dsa-puppet-stuff.cron.erb'),
182                 require => Package['debian.org'],
183         }
184         file { '/etc/ldap/ldap.conf':
185                 require => Package['debian.org'],
186                 content  => template('debian_org/ldap.conf.erb'),
187         }
188         file { '/etc/pam.d/common-session':
189                 require => Package['debian.org'],
190                 content => template('debian_org/pam.common-session.erb'),
191         }
192         file { '/etc/pam.d/common-session-noninteractive':
193                 require => Package['debian.org'],
194                 content => template('debian_org/pam.common-session-noninteractive.erb'),
195         }
196         file { '/etc/rc.local':
197                 mode   => '0755',
198                 content => template('debian_org/rc.local.erb'),
199                 notify => Exec['service rc.local restart'],
200         }
201         file { '/etc/dsa':
202                 ensure => directory,
203                 mode   => '0755',
204         }
205         file { '/etc/dsa/cron.ignore.dsa-puppet-stuff':
206                 source  => 'puppet:///modules/debian_org/dsa-puppet-stuff.cron.ignore',
207                 require => Package['debian.org']
208         }
209         file { '/etc/nsswitch.conf':
210                 mode   => '0444',
211                 source => 'puppet:///modules/debian_org/nsswitch.conf',
212         }
213
214         file { '/etc/profile.d/timeout.sh':
215                 mode   => '0555',
216                 source => 'puppet:///modules/debian_org/etc.profile.d/timeout.sh',
217         }
218         file { '/etc/zsh':
219                 ensure => directory,
220         }
221         file { '/etc/zsh/zprofile':
222                 mode   => '0444',
223                 source => 'puppet:///modules/debian_org/etc.zsh/zprofile',
224         }
225         file { '/etc/environment':
226                 content => "",
227                 mode => '0440',
228         }
229         file { '/etc/default/locale':
230                 content => "",
231                 mode => '0444',
232         }
233
234         # set mmap_min_addr to 4096 to mitigate
235         # Linux NULL-pointer dereference exploits
236         base::sysctl { 'mmap_min_addr':
237                 ensure => absent
238         }
239         base::sysctl { 'perf_event_paranoid':
240                 key   => 'kernel.perf_event_paranoid',
241                 value => '2',
242         }
243         base::sysctl { 'puppet-vfs_cache_pressure':
244                 key   => 'vm.vfs_cache_pressure',
245                 value => '10',
246         }
247         base::alternative { 'editor':
248                 linkto => '/usr/bin/vim.basic',
249         }
250         base::alternative { 'view':
251                 linkto => '/usr/bin/vim.basic',
252         }
253         mailalias { 'samhain-reports':
254                 ensure    => present,
255                 recipient => $samhain_recipients,
256                 require   => Package['debian.org']
257         }
258         mailalias { 'root':
259                 ensure    => present,
260                 recipient => $root_mail_alias,
261                 require   => Package['debian.org']
262         }
263
264         file { '/usr/local/bin/check_for_updates':
265                 source => 'puppet:///modules/debian_org/check_for_updates',
266                 mode   => '0755',
267                 owner  => root,
268                 group  => root,
269         }
270         file { '/usr/local/bin/dsa-is-shutdown-scheduled':
271                 source  => 'puppet:///modules/debian_org/dsa-is-shutdown-scheduled',
272                 mode    => '0555',
273         }
274
275         exec { 'dpkg-reconfigure tzdata -pcritical -fnoninteractive':
276                 path        => '/usr/bin:/usr/sbin:/bin:/sbin',
277                 refreshonly => true
278         }
279         exec { 'service puppetmaster restart':
280                 refreshonly => true
281         }
282         exec { 'service rc.local restart':
283                 refreshonly => true
284         }
285         exec { 'init q':
286                 refreshonly => true
287         }
288
289         exec { 'systemctl daemon-reload':
290                 refreshonly => true,
291                 onlyif  => "test -x /bin/systemctl"
292         }
293
294         exec { 'systemd-tmpfiles --create --exclude-prefix=/dev':
295                 refreshonly => true,
296                 onlyif  => "test -x /bin/systemd-tmpfiles"
297         }
298
299         tidy { '/var/lib/puppet/clientbucket/':
300                 age      => '2w',
301                 recurse  => 9,
302                 type     => ctime,
303                 matches  => [ 'paths', 'contents' ],
304                 schedule => weekly
305         }
306
307         file { '/root/.bashrc':
308                 source => 'puppet:///modules/debian_org/root-dotfiles/bashrc',
309         }
310         file { '/root/.profile':
311                 source => 'puppet:///modules/debian_org/root-dotfiles/profile',
312         }
313         file { '/root/.selected_editor':
314                 source => 'puppet:///modules/debian_org/root-dotfiles/selected_editor',
315         }
316         file { '/root/.screenrc':
317                 source => 'puppet:///modules/debian_org/root-dotfiles/screenrc',
318         }
319         file { '/root/.tmux.conf':
320                 source => 'puppet:///modules/debian_org/root-dotfiles/tmux.conf',
321         }
322         file { '/root/.vimrc':
323                 source => 'puppet:///modules/debian_org/root-dotfiles/vimrc',
324         }
325
326         if versioncmp($::lsbmajdistrelease, '9') == 0 { # older puppets do facts as strings.
327                 if $::processorcount > 1 {
328                         package { 'irqbalance': ensure => installed }
329                 }
330         } else {
331                 # 926967 drops the recommendation on irqbalance in Buster
332                 package { 'irqbalance': ensure => purged }
333         }
334
335
336         # https://www.decadent.org.uk/ben/blog/bpf-security-issues-in-debian.html
337         base::sysctl { 'unprivileged_bpf_disabled':
338                 key   => 'kernel.unprivileged_bpf_disabled',
339                 value => '1',
340         }
341
342         # Disable kpartx udev rules
343         file { '/etc/udev/rules.d/60-kpartx.rules':
344                 ensure => $has_lib_udev_rules_d_60_kpartx_rules ? { true  => 'present', default => 'absent' },
345                 content => "",
346                 mode => '0444',
347         }
348
349         # this is only to avoid warnings, else puppet will complain that we
350         # have a symlink there, even if we're not replacing it anyhow.
351         if ! $has_etc_ssh_ssh_known_hosts {
352                 file { '/etc/ssh/ssh_known_hosts':
353                         ensure  => 'present',
354                         replace => 'no',
355                         content => inline_template('<%= open("/etc/ssh/ssh_known_hosts").read() %>'),
356                         notify  => Exec['ud-replicate'],
357                 }
358         }
359
360         exec { 'ud-replicate':
361                 path => '/usr/bin:/usr/sbin:/bin:/sbin',
362                 command => '/usr/bin/ud-replicate',
363                 refreshonly => true,
364                 require => Package['userdir-ldap']
365         }
366
367         # some changes require rebuilding the initramfs.  Have the common exec here.
368         exec { 'update-initramfs -u':
369                 path        => '/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin',
370                 refreshonly => true;
371         }
372 }