X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fdebian-org%2Fmanifests%2Finit.pp;h=053b61ac380285cf44c17139a55610c3e345c783;hb=e653a754fc01e5496ed31e92ad3d1691264681ed;hp=5258dfbe6b54aa6e365806d432a77886d6405a77;hpb=2eaab21ba472e71a1ed50a45eec4a4bff7e48baa;p=mirror%2Fdsa-puppet.git diff --git a/modules/debian-org/manifests/init.pp b/modules/debian-org/manifests/init.pp index 5258dfbe6..053b61ac3 100644 --- a/modules/debian-org/manifests/init.pp +++ b/modules/debian-org/manifests/init.pp @@ -1,11 +1,26 @@ +# == Class: debian-org +# +# Stuff common to all debian.org servers +# class debian-org { + if getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') { + $mirror = getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') + } else { + $mirror = 'http://http.debian.net/debian/' + } + if $::lsbmajdistrelease < 7 { + $mirror_backports = 'http://backports.debian.org/debian-backports/' + } else { + $mirror_backports = $mirror + } $debianadmin = [ 'debian-archive-debian-samhain-reports@master.debian.org', 'debian-admin@ftbfs.de', 'weasel@debian.org', 'steve@lobefin.net', - 'paravoid@debian.org' + 'paravoid@debian.org', + 'zumbi@kos.to' ] package { [ @@ -20,11 +35,9 @@ class debian-org { 'dsa-munin-plugins', ]: ensure => installed, - require => [ - File['/etc/apt/sources.list.d/db.debian.org.list'], - Exec['apt-get update'] - ] + tag => extra_repo, } + package { [ 'apt-utils', 'bash-completion', @@ -39,6 +52,12 @@ class debian-org { ensure => installed, } + if $::lsbmajdistrelease >= 7 { + package { 'libfilesystem-ruby1.9.1': + ensure => installed, + } + } + munin::check { [ 'cpu', 'entropy', @@ -62,10 +81,7 @@ class debian-org { if getfromhash($site::nodeinfo, 'broken-rtc') { package { 'fake-hwclock': ensure => installed, - require => [ - File['/etc/apt/sources.list.d/db.debian.org.list'], - Exec['apt-get update'] - ] + tag => extra_repo, } } @@ -83,32 +99,41 @@ class debian-org { require => Package['molly-guard'], } - # This really means 'not wheezy' + file { '/etc/apt/trusted-keys.d': + ensure => absent, + force => true, + } - if $::debarchitecture != 'armhf' { - site::aptrepo { 'security': - url => 'http://security.debian.org/', - suite => "${::lsbdistcodename}/updates", - components => ['main','contrib','non-free'] - } + file { '/etc/apt/trusted.gpg': + mode => '0600', + content => "", + } - site::aptrepo { 'backports.debian.org': - url => 'http://backports.debian.org/debian-backports/', - suite => "${::lsbdistcodename}-backports", - components => ['main','contrib','non-free'] - } + site::aptrepo { 'security': + url => 'http://security.debian.org/', + suite => "${::lsbdistcodename}/updates", + components => ['main','contrib','non-free'] + } - site::aptrepo { 'volatile': - url => 'http://ftp.debian.org/debian', - suite => "${::lsbdistcodename}-updates", + site::aptrepo { 'backports.debian.org': + url => $mirror_backports, + suite => "${::lsbdistcodename}-backports", + components => ['main','contrib','non-free'] + } + + site::aptrepo { 'volatile': + url => $mirror, + suite => "${::lsbdistcodename}-updates", + components => ['main','contrib','non-free'] + } + + if $::hostname in [ball, corelli, eysler, lucatelli, mayer, mayr, rem] { + site::aptrepo { 'proposed-updates': + url => $mirror, + suite => "${::lsbdistcodename}-proposed-updates", components => ['main','contrib','non-free'] } } - site::aptrepo { 'backports.org': - ensure => absent, - keyid => '16BA136C', - key => 'puppet:///modules/debian-org/backports.org.asc', - } site::aptrepo { 'debian.org': ensure => absent, @@ -118,7 +143,25 @@ class debian-org { url => 'http://db.debian.org/debian-admin', suite => 'lenny', components => 'main', - key => 'puppet:///modules/debian-org/db.debian.org.asc', + key => 'puppet:///modules/debian-org/db.debian.org.gpg', + } + + augeas { 'inittab_replicate': + context => '/files/etc/inittab', + changes => [ + 'set ud/runlevels 2345', + 'set ud/action respawn', + 'set ud/process "/usr/bin/ud-replicated -d"', + ], + notify => Exec['init q'], + } + + if getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') { + site::aptrepo { 'debian': + url => getfromhash($site::nodeinfo, 'hoster', 'mirror-debian'), + suite => $::lsbdistcodename, + components => ['main','contrib','non-free'] + } } file { '/etc/facter': @@ -137,10 +180,6 @@ class debian-org { file { '/etc/apt/preferences': source => 'puppet:///modules/debian-org/apt.preferences', } - file { '/etc/apt/trusted-keys.d/': - ensure => directory, - purge => true, - } file { '/etc/apt/apt.conf.d/local-compression': source => 'puppet:///modules/debian-org/apt.conf.d/local-compression', } @@ -154,6 +193,10 @@ class debian-org { source => 'puppet:///modules/debian-org/timezone', notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'], } + if $::hostname == handel { + include puppetmaster::db + $dbpassword = $puppetmaster::db::password + } file { '/etc/puppet/puppet.conf': content => template('debian-org/puppet.conf.erb'), } @@ -161,12 +204,12 @@ class debian-org { source => 'puppet:///modules/debian-org/puppet.default', } file { '/etc/cron.d/dsa-puppet-stuff': - source => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron', + source => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron', require => Package['debian.org'], } file { '/etc/ldap/ldap.conf': require => Package['debian.org'], - source => 'puppet:///modules/debian-org/ldap.conf', + source => 'puppet:///modules/debian-org/ldap.conf', } file { '/etc/pam.d/common-session': require => Package['debian.org'], @@ -189,12 +232,19 @@ class debian-org { source => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron.ignore', require => Package['debian.org'] } + file { '/etc/nsswitch.conf': + mode => '0755', + source => 'puppet:///modules/debian-org/nsswitch.conf', + } # set mmap_min_addr to 4096 to mitigate # Linux NULL-pointer dereference exploits site::sysctl { 'mmap_min_addr': - key => 'vm.mmap_min_addr', - value => '4096', + ensure => absent + } + site::sysctl { 'perf_event_paranoid': + key => 'kernel.perf_event_paranoid', + value => '2', } site::alternative { 'editor': linkto => '/usr/bin/vim.basic', @@ -203,15 +253,24 @@ class debian-org { linkto => '/usr/bin/vim.basic', } mailalias { 'samhain-reports': - ensure => present, + ensure => present, recipient => $debianadmin, - require => Package['debian.org'] + require => Package['debian.org'] + } + + file { '/usr/local/bin/check_for_updates': + source => 'puppet:///modules/debian-org/check_for_updates', + mode => '0755', + owner => root, + group => root, } exec { 'apt-get update': - path => '/usr/bin:/usr/sbin:/bin:/sbin', - refreshonly => true, + path => '/usr/bin:/usr/sbin:/bin:/sbin', + onlyif => '/usr/local/bin/check_for_updates', + require => File['/usr/local/bin/check_for_updates'] } + Exec['apt-get update']->Package<| tag == extra_repo |> exec { 'dpkg-reconfigure tzdata -pcritical -fnoninteractive': path => '/usr/bin:/usr/sbin:/bin:/sbin', @@ -228,4 +287,12 @@ class debian-org { exec { 'init q': refreshonly => true } + + tidy { '/var/lib/puppet/clientbucket/': + age => '2w', + recurse => 9, + type => ctime, + matches => [ 'paths', 'contents' ], + schedule => weekly + } }