Merge branch 'master' of git+ssh://puppet.debian.org/srv/puppet.debian.org/git/dsa...

* 'master' of git+ssh://puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet:
  add sallinen
  Enable authentication for buildd-keyrings rsync module
  Use archvsync managed secrets files for rsyncd on syncproxy
  Cannot depend on Package[xinetd] without it being defined
  only pull in xinetd if we do not try to remove files
  Enable rsync-ssl on keyring.debian.org
  Unify rsyncd module comments
  Extract default rsyncd module parameter
  De-list all rsync shares on ftp/ports/security-master
  Enable rsync-ssl on keyring.debian.org
  setup-all-dchroots: use the 2017 key for debian-ports

diff --git a/modules/debian-org/misc/local.yaml b/modules/debian-org/misc/local.yaml
index 95044d4..4e17905 100644 (file)
--- a/modules/debian-org/misc/local.yaml
+++ b/modules/debian-org/misc/local.yaml
@@ -88,6 +88,7 @@ nameinfo:
   rapoport.debian.org: Eda Rothstein Rapoport (December 25th, 1890 - May 9th, 1968)
   reger.debian.org: Johann Baptist Joseph Maximilian Reger (March 19th, 1873 - May 11th, 1916)
   respighi.debian.org: Elsa Respighi (née Olivieri-Sangiacomo) (March 24th, 1894 - March 17th, 1996)
+  sallinen.debian.org: Aulis Sallinen (born April 9, 1935)
   santoro.debian.org: Cláudio Santoro (November 23rd, 1919 - March 27th, 1989)
   schumann.debian.org: Robert Alexander Schumann (June 8th, 1810 - July 29th, 1856)
   sechter.debian.org: Simon Sechter (October 11th, 1788 - September 10th, 1867)

diff --git a/modules/roles/files/dakmaster/rsyncd.conf b/modules/roles/files/dakmaster/rsyncd.conf
index 47b9c8a..46d4f60 100644 (file)
--- a/modules/roles/files/dakmaster/rsyncd.conf
+++ b/modules/roles/files/dakmaster/rsyncd.conf
@@ -6,42 +6,32 @@ socket options = SO_KEEPALIVE
 timeout = 7200
 log file = /var/log/rsyncd/rsyncd.log
 
+list = no
+read only = true
+ignore nonreadable = true
+strict modes = false
+
 [indices]
   path = /srv/ftp-master.debian.org/mirror/ftp-master/indices
-  comment = index files
   auth users = *
-  read only = true
   secrets file = /etc/rsyncd/indices.secrets
 
 [debian]
   path = /srv/ftp-master.debian.org/mirror/ftp-master
-  comment = Full Debian FTP Archive (huge and growing)
   auth users = *
-  read only = true
   secrets file = /home/archvsync/rsyncd/debian.secrets
-  strict modes = false
 
 [debian-debug]
   path = /srv/ftp-master.debian.org/mirror/debian-debug
-  comment = Debug packages.  Probably large.  Starting mid 2015.
   auth users = *
-  read only = true
   secrets file = /home/archvsync/rsyncd/debian-debug.secrets
-  strict modes = false
-  list = no
 
 [buildd-keyrings]
   path = /srv/ftp-master.debian.org/scripts/builddkeyrings/keyrings
-  comment = buildd keys for archive uploads
-  read only = true
-  list = no
-  hosts allow = 82.195.75.106, 2001:41b8:202:deb:216:36ff:fe40:3906
+  auth users = *
+  secrets file = /home/archvsync/rsyncd/buildd-keyrings.secrets
 
 [debian-buildd-dists]
   path = /srv/static.debian.org/master/incoming.debian.org-current-live/debian-buildd/dists
-  comment = buildd archive
-  read only = true
-  list = no
   auth users = *
   secrets file = /home/archvsync/rsyncd/debian-buildd-dists.secrets
-  strict modes = false

diff --git a/modules/roles/files/ports_master/rsyncd.conf b/modules/roles/files/ports_master/rsyncd.conf
index 90b56e8..699f928 100644 (file)
--- a/modules/roles/files/ports_master/rsyncd.conf
+++ b/modules/roles/files/ports_master/rsyncd.conf
@@ -7,19 +7,17 @@ reverse lookup = false
 timeout = 7200
 log file = /var/log/rsyncd/rsyncd-ports-master.log
 
+list = no
+read only = true
+ignore nonreadable = true
+strict modes = false
+
 [debian-ports]
   path = /srv/ports-master.debian.org/ftp/debian-ports
-  comment = debian-ports tree - see https://www.ports.debian.org/
   auth users = *
-  read only = true
-  ignore nonreadable = true
   secrets file = /home/archvsync/rsyncd/debian-ports.secrets
-  strict modes = false
 
 [debian-ports-cd]
   path = /srv/ports-master.debian.org/ftp/debian-ports-cd
-  comment = debian-ports-cd tree - see https://www.ports.debian.org/
   auth users = *
-  read only = true
   secrets file = /home/archvsync/rsyncd/debian-ports-cd.secrets
-  strict modes = false

diff --git a/modules/roles/files/security_master/rsyncd.conf b/modules/roles/files/security_master/rsyncd.conf
index 8cf2f8f..c944fd1 100644 (file)
--- a/modules/roles/files/security_master/rsyncd.conf
+++ b/modules/roles/files/security_master/rsyncd.conf
@@ -6,29 +6,22 @@ socket options = SO_KEEPALIVE
 timeout = 7200
 log file = /var/log/rsyncd/rsyncd.log
 
+list = no
+read only = true
+ignore nonreadable = true
+strict modes = false
+
 [debian-security]
   path = /srv/security.debian.org/archive/debian-security/
-  comment = Debian security archive
   auth users = *
-  read only = true
   secrets file = /home/archvsync/rsyncd/debian-security.secrets
-  strict modes = false
-  list = no
 
 [debian-security-buildd-dists]
   path = /srv/security-master.debian.org/buildd/debian-security-buildd/dists
-  comment = buildd archive
-  read only = true
-  list = no
   auth users = *
   secrets file = /home/archvsync/rsyncd/debian-security-buildd-dists.secrets
-  strict modes = false
 
 [debian-security-buildd-pool]
   path = /srv/security-master.debian.org/buildd/debian-security-buildd/pool
-  comment = buildd pool
-  read only = true
-  list = no
   auth users = *
   secrets file = /home/archvsync/rsyncd/debian-security-buildd-pool.secrets
-  strict modes = false

diff --git a/modules/roles/files/security_mirror/rsyncd.conf b/modules/roles/files/security_mirror/rsyncd.conf
index 353f359..47f1f1c 100644 (file)
--- a/modules/roles/files/security_mirror/rsyncd.conf
+++ b/modules/roles/files/security_mirror/rsyncd.conf
@@ -8,8 +8,10 @@ timeout = 1200
 # weasel 2007-11-19
 log file =  /var/log/rsyncd/rsyncd-security.log
 
+read only = true
+ignore nonreadable = true
+strict modes = false
+
 [debian-security]
   path = /srv/ftp.root/debian-security
   comment = Debian security archive
-  read only = true
-

diff --git a/modules/roles/manifests/keyring.pp b/modules/roles/manifests/keyring.pp
index 379fae2..74b3c1f 100644 (file)
--- a/modules/roles/manifests/keyring.pp
+++ b/modules/roles/manifests/keyring.pp
@@ -1,10 +1,12 @@
 class roles::keyring {
-       rsync::site { 'keyring':
-               source => 'puppet:///modules/roles/keyring/rsyncd.conf',
+       rsync::site_systemd { 'keyring':
+               source  => 'puppet:///modules/roles/keyring/rsyncd.conf',
+               sslname => 'keyring.debian.org',
        }
 
        ssl::service { 'keyring.debian.org':
-               notify  => Exec['service apache2 reload'],
-               key => true,
+               notify   => Exec['service apache2 reload'],
+               key      => true,
+               tlsaport => [443, 1873],
        }
 }

diff --git a/modules/roles/templates/syncproxy/rsyncd.conf.erb b/modules/roles/templates/syncproxy/rsyncd.conf.erb
index 39673a7..f9381f1 100644 (file)
--- a/modules/roles/templates/syncproxy/rsyncd.conf.erb
+++ b/modules/roles/templates/syncproxy/rsyncd.conf.erb
@@ -8,43 +8,43 @@ timeout = 7200
 # weasel 2007-11-19
 log file =  /var/log/rsyncd/rsyncd-syncproxy.log
 
+read only = true
+ignore nonreadable = true
+strict modes = false
+
 [debian]
   path = /srv/mirrors/debian/
 <%- unless has_variable?("has_srv_mirrors_debian") && has_srv_mirrors_debian == "true" -%>
   list = no
 <%- end -%>
-  comment = Full Debian FTP Archive (contact mirrors@debian.org for access; see https://www.debian.org/mirror/size for size)
+  comment = Debian archive (contact mirrors@debian.org for access; see https://www.debian.org/mirror/size for size)
   auth users = *
-  read only = true
-  secrets file = /etc/rsyncd/debian.secrets
+  secrets file = /home/archvsync/rsyncd/debian.secrets
 
 [debian-debug]
   path = /srv/mirrors/debian-debug/
 <%- unless has_variable?("has_srv_mirrors_debian_debug") && has_srv_mirrors_debian_debug == "true" -%>
   list = no
 <%- end -%>
-  comment = Debug packages.  Probably large.  Starting end of 2015.
+  comment = Debug packages for Debian archive (contact mirrors@debian.org for access)
   auth users = *
-  read only = true
-  secrets file = /etc/rsyncd/debian.secrets
+  secrets file = /home/archvsync/rsyncd/debian-debug.secrets
 
 [debian-ports]
   path = /srv/mirrors/debian-ports/
 <%- unless has_variable?("has_srv_mirrors_debian_debug") && has_srv_mirrors_debian_debug == "true" -%>
   list = no
 <%- end -%>
-  comment = debian-ports tree - see https://www.ports.debian.org/
+  comment = Debian ports archive (contact mirrors@debian.org for access)
   auth users = *
-  read only = true
-  secrets file = /etc/rsyncd/debian.secrets
+  secrets file = /home/archvsync/rsyncd/debian-ports.secrets
 
 [debian-security]
   path = /srv/mirrors/debian-security/
 <%- unless has_variable?("has_srv_mirrors_debian_security") && has_srv_mirrors_debian_security == "true" -%>
   list = no
 <%- end -%>
-  comment = Debian security archive (~100 GB; contact mirrors@debian.org for access)
+  comment = Debian security archive (contact mirrors@debian.org for access)
   auth users = *
-  read only = true
-  secrets file = /etc/rsyncd/debian.secrets
+  secrets file = /home/archvsync/rsyncd/debian-security.secrets
 

diff --git a/modules/schroot/files/setup-all-dchroots b/modules/schroot/files/setup-all-dchroots
index 48601a1..92e5e59 100755 (executable)
--- a/modules/schroot/files/setup-all-dchroots
+++ b/modules/schroot/files/setup-all-dchroots
@@ -72,7 +72,7 @@ case `hostname` in
     pizzetti)
         archs="ppc64"
         extra="$extra -m http://ftp.de.debian.org/debian-ports"
-        extra="$extra -k /root/debian-ports-archive-2016.gpg"
+        extra="$extra -k /root/debian-ports-archive-2017.gpg"
         extra="$extra -I debian-ports-archive-keyring"
         ;;
     *)

diff --git a/modules/xinetd/manifests/service.pp b/modules/xinetd/manifests/service.pp
index c348579..1aee3b9 100644 (file)
--- a/modules/xinetd/manifests/service.pp
+++ b/modules/xinetd/manifests/service.pp
@@ -19,10 +19,21 @@ define xinetd::service (
        $ensure=present,
        $ferm=true
 ) {
-       include xinetd
-
        case $ensure {
-               present,absent,file: {}
+               present,file: {
+                       include xinetd
+                       file { "/etc/xinetd.d/${name}":
+                               ensure  => $ensure,
+                               content => template('xinetd/service.erb'),
+                               notify  => Service['xinetd'],
+                               require => Package['xinetd'],
+                       }
+               }
+               absent: {
+                       file { "/etc/xinetd.d/${name}":
+                               ensure  => $ensure,
+                       }
+               }
                default: { fail("Invalid ensure for '$name'") }
        }
 
@@ -37,11 +48,4 @@ define xinetd::service (
                        rule        => "&SERVICE(${protocol}, ${fermport})"
                }
        }
-
-       file { "/etc/xinetd.d/${name}":
-               ensure  => $ensure,
-               content => template('xinetd/service.erb'),
-               notify  => Service['xinetd'],
-               require => Package['xinetd'],
-       }
 }