modules/ferm/manifests/init.pp

   1 # = Class: ferm
   2 #
   3 # This class installs ferm and sets up rules
   4 #
   5 # == Sample Usage:
   6 #
   7 #   include ferm
   8 #
   9 class ferm {
  10         include stdlib
  11
  12         # realize (i.e. enable) all @ferm::rule virtual resources
  13         Ferm::Rule <| |>
  14         Ferm::Conf <| |>
  15
  16         File { mode => '0400' }
  17
  18         package { 'ferm':
  19                 ensure => installed
  20         }
  21         package { 'ulogd2':
  22                 ensure => installed
  23         }
  24         package { 'ulogd':
  25                 # Remove instead of purge ulogd because it deletes log files on purge.
  26                 ensure => absent
  27         }
  28
  29         service { 'ferm':
  30                 hasstatus   => false,
  31                 status      => '/bin/true',
  32         }
  33
  34         $munin_ips = unique(getfromhash($site::nodeinfo, 'misc', 'v4addrs'))
  35                 .map |$addr| { "ip_${addr}" }
  36
  37         munin::check { $munin_ips: script => 'ip_', }
  38
  39         $munin6_ips = getfromhash($site::nodeinfo, 'misc', 'v6addrs')
  40                 .map |$addr| { "ip_${addr}" }
  41         munin::ipv6check { $munin6_ips: }
  42
  43         file { '/etc/ferm':
  44                 ensure  => directory,
  45                 notify  => Service['ferm'],
  46                 require => Package['ferm'],
  47                 mode    => '0755'
  48         }
  49         file { '/etc/ferm/dsa.d':
  50                 ensure => directory,
  51                 mode   => '0555',
  52                 purge   => true,
  53                 force   => true,
  54                 recurse => true,
  55                 source  => 'puppet:///files/empty/',
  56         }
  57         file { '/etc/ferm/conf.d':
  58                 ensure => directory,
  59                 mode   => '0555',
  60                 purge   => true,
  61                 force   => true,
  62                 recurse => true,
  63                 source  => 'puppet:///files/empty/',
  64         }
  65         file { '/etc/default/ferm':
  66                 source  => 'puppet:///modules/ferm/ferm.default',
  67                 require => Package['ferm'],
  68                 notify  => Service['ferm'],
  69                 mode    => '0444',
  70         }
  71         file { '/etc/ferm/ferm.conf':
  72                 content => template('ferm/ferm.conf.erb'),
  73                 notify  => Service['ferm'],
  74         }
  75         file { '/etc/ferm/conf.d/00-init.conf':
  76                 content => template('ferm/00-init.conf.erb'),
  77                 notify  => Service['ferm'],
  78         }
  79         file { '/etc/ferm/conf.d/me.conf':
  80                 content => template('ferm/me.conf.erb'),
  81                 notify  => Service['ferm'],
  82         }
  83         file { '/etc/ferm/conf.d/defs.conf':
  84                 content => template('ferm/defs.conf.erb'),
  85                 notify  => Service['ferm'],
  86         }
  87
  88         file { '/etc/ferm/conf.d/50-munin-interfaces.conf':
  89                 content => template('ferm/conf.d-munin-interfaces.conf.erb'),
  90                 notify  => Service['ferm'],
  91         }
  92         @ferm::rule { 'dsa-munin-interfaces-in':
  93                 prio        => '001',
  94                 description => 'munin accounting',
  95                 chain       => 'INPUT',
  96                 domain      => '(ip ip6)',
  97                 rule        => 'daddr ($MUNIN_IPS) NOP'
  98         }
  99         @ferm::rule { 'dsa-munin-interfaces-out':
 100                 prio        => '001',
 101                 description => 'munin accounting',
 102                 chain       => 'OUTPUT',
 103                 domain      => '(ip ip6)',
 104                 rule        => 'saddr ($MUNIN_IPS) NOP'
 105         }
 106
 107         file { '/etc/ferm/dsa.d/010-base.conf':
 108                 content => template('ferm/dsa.d-010-base.conf.erb'),
 109                 notify  => Service['ferm'],
 110         }
 111
 112         augeas { 'logrotate_ulogd2':
 113                 context => '/files/etc/logrotate.d/ulogd2',
 114                 changes => [
 115                         'set rule/schedule daily',
 116                         'set rule/delaycompress delaycompress',
 117                         'set rule/rotate 10',
 118                         'set rule/ifempty notifempty',
 119                 ],
 120         }
 121         file { '/etc/logrotate.d/ulogd':
 122                 ensure  => absent,
 123         }
 124         file { '/etc/logrotate.d/ulogd.dpkg-bak':
 125                 ensure  => absent,
 126         }
 127         file { '/etc/logrotate.d/ulogd.dpkg-dist':
 128                 ensure  => absent,
 129         }
 130
 131 }