modules/debian_org/manifests/init.pp

   1 # == Class: debian_org
   2 #
   3 # Stuff common to all debian.org servers
   4 #
   5 class debian_org {
   6         include debian_org::apt
   7
   8         if $systemd {
   9                 include systemd
  10                 $servicefiles = 'present'
  11         } else {
  12                 $servicefiles = 'absent'
  13         }
  14
  15         # the virtual facter needs virt-what on jessie to work
  16         if versioncmp($::lsbmajdistrelease, '9') < 0 {
  17                 package { 'virt-what': ensure => installed }
  18         } else {
  19                 package { 'virt-what': ensure => purged }
  20         }
  21
  22         $debianadmin = [
  23                 'debian-archive-debian-samhain-reports@master.debian.org',
  24                 'debian-admin@ftbfs.de',
  25                 'weasel@debian.org',
  26                 'steve@lobefin.net',
  27                 'zumbi@oron.es'
  28         ]
  29
  30         package { [
  31                         'klogd',
  32                         'sysklogd',
  33                         'rsyslog',
  34                         'os-prober',
  35                         'apt-listchanges',
  36                         'mlocate',
  37                 ]:
  38                 ensure => purged,
  39         }
  40         package { [
  41                         'debian.org',
  42                         'dsa-munin-plugins',
  43                 ]:
  44                 ensure => installed,
  45                 tag    => extra_repo,
  46         }
  47         file { '/etc/ssh/ssh_known_hosts':
  48                 ensure  => present,
  49                 replace => false,
  50                 mode    => '0644',
  51                 source  => 'puppet:///modules/debian_org/basic-ssh_known_hosts'
  52         }
  53
  54         if versioncmp($::lsbmajdistrelease, '8') >= 0 {
  55                 $rubyfs_package = 'ruby-filesystem'
  56         } else {
  57                 $rubyfs_package = 'libfilesystem-ruby1.9'
  58         }
  59         package { [
  60                         'apt-utils',
  61                         'bash-completion',
  62                         'dnsutils',
  63                         'less',
  64                         'lsb-release',
  65                         $rubyfs_package,
  66                         'mtr-tiny',
  67                         'nload',
  68                         'pciutils',
  69                         'lldpd',
  70                 ]:
  71                 ensure => installed,
  72         }
  73
  74         munin::check { [
  75                         'cpu',
  76                         'entropy',
  77                         'forks',
  78                         'interrupts',
  79                         'iostat',
  80                         'irqstats',
  81                         'load',
  82                         'memory',
  83                         'open_files',
  84                         'open_inodes',
  85                         'processes',
  86                         'swap',
  87                         'uptime',
  88                         'vmstat',
  89                 ]:
  90         }
  91
  92         if getfromhash($site::nodeinfo, 'broken-rtc') {
  93                 package { 'fake-hwclock':
  94                         ensure => installed,
  95                         tag    => extra_repo,
  96                 }
  97         }
  98
  99         package { 'molly-guard':
 100                 ensure => installed,
 101         }
 102         file { '/etc/molly-guard/run.d/10-check-kvm':
 103                 mode    => '0755',
 104                 source  => 'puppet:///modules/debian_org/molly-guard/10-check-kvm',
 105                 require => Package['molly-guard'],
 106         }
 107         file { '/etc/molly-guard/run.d/15-acquire-reboot-lock':
 108                 mode    => '0755',
 109                 source  => 'puppet:///modules/debian_org/molly-guard/15-acquire-reboot-lock',
 110                 require => Package['molly-guard'],
 111         }
 112
 113         augeas { 'inittab_replicate':
 114                 context => '/files/etc/inittab',
 115                 changes => [
 116                         'set ud/runlevels 2345',
 117                         'set ud/action respawn',
 118                         'set ud/process "/usr/bin/ud-replicated -d"',
 119                 ],
 120                 notify  => Exec['init q'],
 121         }
 122
 123
 124         file { '/etc/facter':
 125                 ensure  => directory,
 126                 purge   => true,
 127                 force   => true,
 128                 recurse => true,
 129                 source  => 'puppet:///files/empty/',
 130         }
 131         file { '/etc/facter/facts.d':
 132                 ensure => directory,
 133         }
 134         file { '/etc/facter/facts.d/debian_facts.yaml':
 135                 content => template('debian_org/debian_facts.yaml.erb')
 136         }
 137         file { '/etc/timezone':
 138                 source => 'puppet:///modules/debian_org/timezone',
 139                 notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'],
 140         }
 141         if $::hostname == handel {
 142                 include puppetmaster::db
 143                 $dbpassword = $puppetmaster::db::password
 144         }
 145         file { '/etc/puppet/puppet.conf':
 146                 content => template('debian_org/puppet.conf.erb'),
 147                 mode => '0440',
 148                 group => 'puppet',
 149         }
 150         file { '/etc/default/puppet':
 151                 source => 'puppet:///modules/debian_org/puppet.default',
 152         }
 153         file { '/etc/systemd':
 154                 ensure  => directory,
 155                 mode => '0755',
 156         }
 157         file { '/etc/systemd/system':
 158                 ensure  => directory,
 159                 mode => '0755',
 160         }
 161         file { '/etc/systemd/system/ud-replicated.service':
 162                 ensure => $servicefiles,
 163                 source => 'puppet:///modules/debian_org/ud-replicated.service',
 164                 notify => Exec['systemctl daemon-reload'],
 165         }
 166         if $systemd {
 167                 file { '/etc/systemd/system/multi-user.target.wants/ud-replicated.service':
 168                         ensure => 'link',
 169                         target => '../ud-replicated.service',
 170                         notify => Exec['systemctl daemon-reload'],
 171                 }
 172         }
 173         file { '/etc/systemd/system/puppet.service':
 174                 ensure => 'link',
 175                 target => '/dev/null',
 176                 notify => Exec['systemctl daemon-reload'],
 177         }
 178         file { '/etc/systemd/system/proc-sys-fs-binfmt_misc.automount':
 179                 ensure => 'link',
 180                 target => '/dev/null',
 181                 notify => Exec['systemctl daemon-reload'],
 182         }
 183
 184         file { '/etc/cron.d/dsa-puppet-stuff':
 185                 content => template('debian_org/dsa-puppet-stuff.cron.erb'),
 186                 require => Package['debian.org'],
 187         }
 188         file { '/etc/ldap/ldap.conf':
 189                 require => Package['debian.org'],
 190                 content  => template('debian_org/ldap.conf.erb'),
 191         }
 192         file { '/etc/pam.d/common-session':
 193                 require => Package['debian.org'],
 194                 content => template('debian_org/pam.common-session.erb'),
 195         }
 196         file { '/etc/pam.d/common-session-noninteractive':
 197                 require => Package['debian.org'],
 198                 content => template('debian_org/pam.common-session-noninteractive.erb'),
 199         }
 200         file { '/etc/rc.local':
 201                 mode   => '0755',
 202                 content => template('debian_org/rc.local.erb'),
 203                 notify => Exec['service rc.local restart'],
 204         }
 205         file { '/etc/dsa':
 206                 ensure => directory,
 207                 mode   => '0755',
 208         }
 209         file { '/etc/dsa/cron.ignore.dsa-puppet-stuff':
 210                 source  => 'puppet:///modules/debian_org/dsa-puppet-stuff.cron.ignore',
 211                 require => Package['debian.org']
 212         }
 213         file { '/etc/nsswitch.conf':
 214                 mode   => '0755',
 215                 source => 'puppet:///modules/debian_org/nsswitch.conf',
 216         }
 217
 218         file { '/etc/profile.d/timeout.sh':
 219                 mode   => '0555',
 220                 source => 'puppet:///modules/debian_org/etc.profile.d/timeout.sh',
 221         }
 222         file { '/etc/zsh':
 223                 ensure => directory,
 224         }
 225         file { '/etc/zsh/zprofile':
 226                 mode   => '0444',
 227                 source => 'puppet:///modules/debian_org/etc.zsh/zprofile',
 228         }
 229
 230         # set mmap_min_addr to 4096 to mitigate
 231         # Linux NULL-pointer dereference exploits
 232         site::sysctl { 'mmap_min_addr':
 233                 ensure => absent
 234         }
 235         site::sysctl { 'perf_event_paranoid':
 236                 key   => 'kernel.perf_event_paranoid',
 237                 value => '2',
 238         }
 239         site::sysctl { 'puppet-vfs_cache_pressure':
 240                 key   => 'vm.vfs_cache_pressure',
 241                 value => '10',
 242         }
 243         site::alternative { 'editor':
 244                 linkto => '/usr/bin/vim.basic',
 245         }
 246         site::alternative { 'view':
 247                 linkto => '/usr/bin/vim.basic',
 248         }
 249         mailalias { 'samhain-reports':
 250                 ensure    => present,
 251                 recipient => $debianadmin,
 252                 require   => Package['debian.org']
 253         }
 254
 255         file { '/usr/local/bin/check_for_updates':
 256                 source => 'puppet:///modules/debian_org/check_for_updates',
 257                 mode   => '0755',
 258                 owner  => root,
 259                 group  => root,
 260         }
 261         file { '/usr/local/bin/dsa-is-shutdown-scheduled':
 262                 source  => 'puppet:///modules/debian_org/dsa-is-shutdown-scheduled',
 263                 mode    => '0555',
 264         }
 265
 266         exec { 'dpkg-reconfigure tzdata -pcritical -fnoninteractive':
 267                 path        => '/usr/bin:/usr/sbin:/bin:/sbin',
 268                 refreshonly => true
 269         }
 270         exec { 'service puppetmaster restart':
 271                 refreshonly => true
 272         }
 273         exec { 'service rc.local restart':
 274                 refreshonly => true
 275         }
 276         exec { 'init q':
 277                 refreshonly => true
 278         }
 279
 280         exec { 'systemctl daemon-reload':
 281                 refreshonly => true,
 282                 onlyif  => "test -x /bin/systemctl"
 283         }
 284
 285         exec { 'systemd-tmpfiles --create --exclude-prefix=/dev':
 286                 refreshonly => true,
 287                 onlyif  => "test -x /bin/systemd-tmpfiles"
 288         }
 289
 290         tidy { '/var/lib/puppet/clientbucket/':
 291                 age      => '2w',
 292                 recurse  => 9,
 293                 type     => ctime,
 294                 matches  => [ 'paths', 'contents' ],
 295                 schedule => weekly
 296         }
 297
 298         file { '/root/.bashrc':
 299                 source => 'puppet:///modules/debian_org/root-dotfiles/bashrc',
 300         }
 301         file { '/root/.profile':
 302                 source => 'puppet:///modules/debian_org/root-dotfiles/profile',
 303         }
 304         file { '/root/.selected_editor':
 305                 source => 'puppet:///modules/debian_org/root-dotfiles/selected_editor',
 306         }
 307         file { '/root/.screenrc':
 308                 source => 'puppet:///modules/debian_org/root-dotfiles/screenrc',
 309         }
 310         file { '/root/.tmux.conf':
 311                 source => 'puppet:///modules/debian_org/root-dotfiles/tmux.conf',
 312         }
 313         file { '/root/.vimrc':
 314                 source => 'puppet:///modules/debian_org/root-dotfiles/vimrc',
 315         }
 316
 317         if versioncmp($::lsbmajdistrelease, '9') >= 0 { # older puppets do facts as strings.
 318                 if $::processorcount > 1 {
 319                         package { 'irqbalance': ensure => installed }
 320                 }
 321         }
 322 }