X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fdebian-org%2Fmanifests%2Finit.pp;h=f6e98748ff28ca838d885753d0f7d857c165e453;hb=5f5114ced11a52ea7c11d54221cbbb249f41a78d;hp=912cfd616f9f2383133518be8571668e49f19a94;hpb=7abe65323c6bf5909c19fa7766af23048559c79d;p=mirror%2Fdsa-puppet.git diff --git a/modules/debian-org/manifests/init.pp b/modules/debian-org/manifests/init.pp index 912cfd616..f6e98748f 100644 --- a/modules/debian-org/manifests/init.pp +++ b/modules/debian-org/manifests/init.pp @@ -1,11 +1,22 @@ class debian-org { + if getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') { + $mirror = getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') + } else { + $mirror = 'http://http.debian.net/debian/' + } + if $::lsbmajdistrelease < 7 { + $mirror_backports = 'http://backports.debian.org/debian-backports/' + } else { + $mirror_backports = $mirror + } $debianadmin = [ 'debian-archive-debian-samhain-reports@master.debian.org', 'debian-admin@ftbfs.de', 'weasel@debian.org', 'steve@lobefin.net', - 'paravoid@debian.org' + 'paravoid@debian.org', + 'zumbi@kos.to' ] package { [ @@ -13,23 +24,34 @@ class debian-org { 'sysklogd', 'rsyslog', ]: - ensure => purged, + ensure => purged, } + package { [ + 'debian.org', + 'dsa-munin-plugins', + ]: + ensure => installed, + tag => extra_repo, + } + package { [ 'apt-utils', 'bash-completion', - 'debian.org', 'dnsutils', - 'dsa-munin-plugins', 'less', 'lsb-release', 'libfilesystem-ruby1.8', - 'molly-guard', 'mtr-tiny', 'nload', 'pciutils', ]: + ensure => installed, + } + + if $::lsbmajdistrelease >= 7 { + package { 'libfilesystem-ruby1.9.1': ensure => installed, + } } munin::check { [ @@ -54,27 +76,54 @@ class debian-org { if getfromhash($site::nodeinfo, 'broken-rtc') { package { 'fake-hwclock': - ensure => installed + ensure => installed, + tag => extra_repo, } } - # This really means 'not wheezy' + package { 'molly-guard': + ensure => installed, + } + file { '/etc/molly-guard/run.d/10-check-kvm': + mode => '0755', + source => 'puppet:///modules/debian-org/molly-guard/10-check-kvm', + require => Package['molly-guard'], + } + file { '/etc/molly-guard/run.d/15-acquire-reboot-lock': + mode => '0755', + source => 'puppet:///modules/debian-org/molly-guard/15-acquire-reboot-lock', + require => Package['molly-guard'], + } - if $::debarchitecture != 'armhf' { - site::aptrepo { 'security': - template => 'debian-org/etc/apt/sources.list.d/security.list.erb', - } - site::aptrepo { 'backports.debian.org': - template => 'debian-org/etc/apt/sources.list.d/backports.debian.org.list.erb', - } - site::aptrepo { 'volatile': - template => 'debian-org/etc/apt/sources.list.d/volatile.list.erb', - } + site::aptrepo { 'security': + url => 'http://security.debian.org/', + suite => "${::lsbdistcodename}/updates", + components => ['main','contrib','non-free'] + } + + site::aptrepo { 'backports.debian.org': + url => $mirror_backports, + suite => "${::lsbdistcodename}-backports", + components => ['main','contrib','non-free'] } site::aptrepo { 'backports.org': ensure => absent, - keyid => '16BA136C', - key => 'puppet:///modules/debian-org/backports.org.asc', + keyid => '16BA136C', + key => 'puppet:///modules/debian-org/backports.org.asc', + } + + site::aptrepo { 'volatile': + url => $mirror, + suite => "${::lsbdistcodename}-updates", + components => ['main','contrib','non-free'] + } + + if $::hostname in [ball, corelli, eysler, lucatelli, mayer, mayr, rem] { + site::aptrepo { 'proposed-updates': + url => $mirror, + suite => "${::lsbdistcodename}-proposed-updates", + components => ['main','contrib','non-free'] + } } site::aptrepo { 'debian.org': @@ -82,8 +131,18 @@ class debian-org { } site::aptrepo { 'db.debian.org': - template => 'debian-org/etc/apt/sources.list.d/debian.org.list.erb', - key => 'puppet:///modules/debian-org/db.debian.org.asc', + url => 'http://db.debian.org/debian-admin', + suite => 'lenny', + components => 'main', + key => 'puppet:///modules/debian-org/db.debian.org.asc', + } + + if getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') { + site::aptrepo { 'debian': + url => getfromhash($site::nodeinfo, 'hoster', 'mirror-debian'), + suite => $::lsbdistcodename, + components => ['main','contrib','non-free'] + } } file { '/etc/facter': @@ -119,19 +178,23 @@ class debian-org { source => 'puppet:///modules/debian-org/timezone', notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'], } + if $::hostname == handel { + include puppetmaster::db + $dbpassword = $puppetmaster::db::password + } file { '/etc/puppet/puppet.conf': - source => 'puppet:///modules/debian-org/puppet.conf', + content => template('debian-org/puppet.conf.erb'), } file { '/etc/default/puppet': source => 'puppet:///modules/debian-org/puppet.default', } file { '/etc/cron.d/dsa-puppet-stuff': - source => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron', + source => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron', require => Package['debian.org'], } file { '/etc/ldap/ldap.conf': require => Package['debian.org'], - source => 'puppet:///modules/debian-org/ldap.conf', + source => 'puppet:///modules/debian-org/ldap.conf', } file { '/etc/pam.d/common-session': require => Package['debian.org'], @@ -146,11 +209,6 @@ class debian-org { source => 'puppet:///modules/debian-org/rc.local', notify => Exec['rc.local start'], } - file { '/etc/molly-guard/run.d/15-acquire-reboot-lock': - mode => '0755', - source => 'puppet:///modules/debian-org/molly-guard-acquire-reboot-lock', - require => Package['molly-guard'], - } file { '/etc/dsa': ensure => directory, mode => '0755', @@ -159,12 +217,19 @@ class debian-org { source => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron.ignore', require => Package['debian.org'] } + file { '/etc/nsswitch.conf': + mode => '0755', + source => 'puppet:///modules/debian-org/nsswitch.conf', + } # set mmap_min_addr to 4096 to mitigate # Linux NULL-pointer dereference exploits site::sysctl { 'mmap_min_addr': - key => 'vm.mmap_min_addr', - value => '4096', + ensure => absent + } + site::sysctl { 'perf_event_paranoid': + key => 'kernel.perf_event_paranoid', + value => '2', } site::alternative { 'editor': linkto => '/usr/bin/vim.basic', @@ -173,14 +238,24 @@ class debian-org { linkto => '/usr/bin/vim.basic', } mailalias { 'samhain-reports': - ensure => present, + ensure => present, recipient => $debianadmin, + require => Package['debian.org'] + } + + file { '/usr/local/bin/check_for_updates': + source => 'puppet:///modules/debian-org/check_for_updates', + mode => '0755', + owner => root, + group => root, } exec { 'apt-get update': - path => '/usr/bin:/usr/sbin:/bin:/sbin', - refreshonly => true, + path => '/usr/bin:/usr/sbin:/bin:/sbin', + onlyif => '/usr/local/bin/check_for_updates', + require => File['/opt/bin/check_for_updates'] } + Exec['apt-get update']->Package<| tag == extra_repo |> exec { 'dpkg-reconfigure tzdata -pcritical -fnoninteractive': path => '/usr/bin:/usr/sbin:/bin:/sbin', @@ -197,4 +272,12 @@ class debian-org { exec { 'init q': refreshonly => true } + + tidy { '/var/lib/puppet/clientbucket/': + age => '2w', + recurse => 9, + type => ctime, + matches => [ 'paths', 'contents' ], + schedule => weekly + } }