modules/debian_org/manifests/init.pp

   1 # == Class: debian_org
   2 #
   3 # Stuff common to all debian.org servers
   4 #
   5 class debian_org {
   6         include debian_org::apt
   7
   8         if $systemd {
   9                 include systemd
  10                 $servicefiles = 'present'
  11         } else {
  12                 $servicefiles = 'absent'
  13         }
  14
  15         # the virtual facter needs virt-what on jessie to work
  16         if versioncmp($::lsbmajdistrelease, '9') < 0 {
  17                 package { 'virt-what': ensure => installed }
  18         } else {
  19                 package { 'virt-what': ensure => purged }
  20         }
  21
  22         $samhain_recipients = hiera('samhain_recipients')
  23
  24         package { [
  25                         'klogd',
  26                         'sysklogd',
  27                         'rsyslog',
  28                         'os-prober',
  29                         'apt-listchanges',
  30                         'mlocate',
  31                 ]:
  32                 ensure => purged,
  33         }
  34         package { [
  35                         'debian.org',
  36                         'debian.org-recommended',
  37                         'dsa-munin-plugins',
  38                         'userdir-ldap',
  39                 ]:
  40                 ensure => installed,
  41                 tag    => extra_repo,
  42         }
  43         file { '/etc/ssh/ssh_known_hosts':
  44                 ensure  => present,
  45                 replace => false,
  46                 mode    => '0644',
  47                 source  => 'puppet:///modules/debian_org/basic-ssh_known_hosts'
  48         }
  49
  50         if versioncmp($::lsbmajdistrelease, '8') >= 0 {
  51                 $rubyfs_package = 'ruby-filesystem'
  52         } else {
  53                 $rubyfs_package = 'libfilesystem-ruby1.9'
  54         }
  55         package { [
  56                         'apt-utils',
  57                         'bash-completion',
  58                         'dnsutils',
  59                         'less',
  60                         'lsb-release',
  61                         $rubyfs_package,
  62                         'mtr-tiny',
  63                         'nload',
  64                         'pciutils',
  65                         'lldpd',
  66                 ]:
  67                 ensure => installed,
  68         }
  69
  70         munin::check { [
  71                         'cpu',
  72                         'entropy',
  73                         'forks',
  74                         'interrupts',
  75                         'iostat',
  76                         'irqstats',
  77                         'load',
  78                         'memory',
  79                         'open_files',
  80                         'open_inodes',
  81                         'processes',
  82                         'swap',
  83                         'uptime',
  84                         'vmstat',
  85                 ]:
  86         }
  87
  88         if getfromhash($site::nodeinfo, 'broken-rtc') {
  89                 package { 'fake-hwclock':
  90                         ensure => installed,
  91                         tag    => extra_repo,
  92                 }
  93         }
  94
  95         package { 'molly-guard':
  96                 ensure => installed,
  97         }
  98         file { '/etc/molly-guard/run.d/10-check-kvm':
  99                 mode    => '0755',
 100                 source  => 'puppet:///modules/debian_org/molly-guard/10-check-kvm',
 101                 require => Package['molly-guard'],
 102         }
 103         file { '/etc/molly-guard/run.d/15-acquire-reboot-lock':
 104                 mode    => '0755',
 105                 source  => 'puppet:///modules/debian_org/molly-guard/15-acquire-reboot-lock',
 106                 require => Package['molly-guard'],
 107         }
 108
 109         augeas { 'inittab_replicate':
 110                 context => '/files/etc/inittab',
 111                 changes => [
 112                         'set ud/runlevels 2345',
 113                         'set ud/action respawn',
 114                         'set ud/process "/usr/bin/ud-replicated -d"',
 115                 ],
 116                 notify  => Exec['init q'],
 117         }
 118
 119
 120         file { '/etc/facter':
 121                 ensure  => directory,
 122                 purge   => true,
 123                 force   => true,
 124                 recurse => true,
 125                 source  => 'puppet:///files/empty/',
 126         }
 127         file { '/etc/facter/facts.d':
 128                 ensure => directory,
 129         }
 130         file { '/etc/facter/facts.d/debian_facts.yaml':
 131                 content => template('debian_org/debian_facts.yaml.erb')
 132         }
 133         file { '/etc/timezone':
 134                 source => 'puppet:///modules/debian_org/timezone',
 135                 notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'],
 136         }
 137         if $::hostname == handel {
 138                 include puppetmaster::db
 139                 $dbpassword = $puppetmaster::db::password
 140         }
 141         file { '/etc/puppet/puppet.conf':
 142                 content => template('debian_org/puppet.conf.erb'),
 143                 mode => '0440',
 144                 group => 'puppet',
 145         }
 146         file { '/etc/default/puppet':
 147                 source => 'puppet:///modules/debian_org/puppet.default',
 148         }
 149         file { '/etc/systemd':
 150                 ensure  => directory,
 151                 mode => '0755',
 152         }
 153         file { '/etc/systemd/system':
 154                 ensure  => directory,
 155                 mode => '0755',
 156         }
 157         file { '/etc/systemd/system/ud-replicated.service':
 158                 ensure => $servicefiles,
 159                 source => 'puppet:///modules/debian_org/ud-replicated.service',
 160                 notify => Exec['systemctl daemon-reload'],
 161         }
 162         if $systemd {
 163                 file { '/etc/systemd/system/multi-user.target.wants/ud-replicated.service':
 164                         ensure => 'link',
 165                         target => '../ud-replicated.service',
 166                         notify => Exec['systemctl daemon-reload'],
 167                 }
 168         }
 169         file { '/etc/systemd/system/puppet.service':
 170                 ensure => 'link',
 171                 target => '/dev/null',
 172                 notify => Exec['systemctl daemon-reload'],
 173         }
 174         file { '/etc/systemd/system/proc-sys-fs-binfmt_misc.automount':
 175                 ensure => 'link',
 176                 target => '/dev/null',
 177                 notify => Exec['systemctl daemon-reload'],
 178         }
 179
 180         file { '/etc/cron.d/dsa-puppet-stuff':
 181                 content => template('debian_org/dsa-puppet-stuff.cron.erb'),
 182                 require => Package['debian.org'],
 183         }
 184         file { '/etc/ldap/ldap.conf':
 185                 require => Package['debian.org'],
 186                 content  => template('debian_org/ldap.conf.erb'),
 187         }
 188         file { '/etc/pam.d/common-session':
 189                 require => Package['debian.org'],
 190                 content => template('debian_org/pam.common-session.erb'),
 191         }
 192         file { '/etc/pam.d/common-session-noninteractive':
 193                 require => Package['debian.org'],
 194                 content => template('debian_org/pam.common-session-noninteractive.erb'),
 195         }
 196         file { '/etc/rc.local':
 197                 mode   => '0755',
 198                 content => template('debian_org/rc.local.erb'),
 199                 notify => Exec['service rc.local restart'],
 200         }
 201         file { '/etc/dsa':
 202                 ensure => directory,
 203                 mode   => '0755',
 204         }
 205         file { '/etc/dsa/cron.ignore.dsa-puppet-stuff':
 206                 source  => 'puppet:///modules/debian_org/dsa-puppet-stuff.cron.ignore',
 207                 require => Package['debian.org']
 208         }
 209         file { '/etc/nsswitch.conf':
 210                 mode   => '0755',
 211                 source => 'puppet:///modules/debian_org/nsswitch.conf',
 212         }
 213
 214         file { '/etc/profile.d/timeout.sh':
 215                 mode   => '0555',
 216                 source => 'puppet:///modules/debian_org/etc.profile.d/timeout.sh',
 217         }
 218         file { '/etc/zsh':
 219                 ensure => directory,
 220         }
 221         file { '/etc/zsh/zprofile':
 222                 mode   => '0444',
 223                 source => 'puppet:///modules/debian_org/etc.zsh/zprofile',
 224         }
 225
 226         # set mmap_min_addr to 4096 to mitigate
 227         # Linux NULL-pointer dereference exploits
 228         site::sysctl { 'mmap_min_addr':
 229                 ensure => absent
 230         }
 231         site::sysctl { 'perf_event_paranoid':
 232                 key   => 'kernel.perf_event_paranoid',
 233                 value => '2',
 234         }
 235         site::sysctl { 'puppet-vfs_cache_pressure':
 236                 key   => 'vm.vfs_cache_pressure',
 237                 value => '10',
 238         }
 239         site::alternative { 'editor':
 240                 linkto => '/usr/bin/vim.basic',
 241         }
 242         site::alternative { 'view':
 243                 linkto => '/usr/bin/vim.basic',
 244         }
 245         mailalias { 'samhain-reports':
 246                 ensure    => present,
 247                 recipient => $samhain_recipients,
 248                 require   => Package['debian.org']
 249         }
 250
 251         file { '/usr/local/bin/check_for_updates':
 252                 source => 'puppet:///modules/debian_org/check_for_updates',
 253                 mode   => '0755',
 254                 owner  => root,
 255                 group  => root,
 256         }
 257         file { '/usr/local/bin/dsa-is-shutdown-scheduled':
 258                 source  => 'puppet:///modules/debian_org/dsa-is-shutdown-scheduled',
 259                 mode    => '0555',
 260         }
 261
 262         exec { 'dpkg-reconfigure tzdata -pcritical -fnoninteractive':
 263                 path        => '/usr/bin:/usr/sbin:/bin:/sbin',
 264                 refreshonly => true
 265         }
 266         exec { 'service puppetmaster restart':
 267                 refreshonly => true
 268         }
 269         exec { 'service rc.local restart':
 270                 refreshonly => true
 271         }
 272         exec { 'init q':
 273                 refreshonly => true
 274         }
 275
 276         exec { 'systemctl daemon-reload':
 277                 refreshonly => true,
 278                 onlyif  => "test -x /bin/systemctl"
 279         }
 280
 281         exec { 'systemd-tmpfiles --create --exclude-prefix=/dev':
 282                 refreshonly => true,
 283                 onlyif  => "test -x /bin/systemd-tmpfiles"
 284         }
 285
 286         tidy { '/var/lib/puppet/clientbucket/':
 287                 age      => '2w',
 288                 recurse  => 9,
 289                 type     => ctime,
 290                 matches  => [ 'paths', 'contents' ],
 291                 schedule => weekly
 292         }
 293
 294         file { '/root/.bashrc':
 295                 source => 'puppet:///modules/debian_org/root-dotfiles/bashrc',
 296         }
 297         file { '/root/.profile':
 298                 source => 'puppet:///modules/debian_org/root-dotfiles/profile',
 299         }
 300         file { '/root/.selected_editor':
 301                 source => 'puppet:///modules/debian_org/root-dotfiles/selected_editor',
 302         }
 303         file { '/root/.screenrc':
 304                 source => 'puppet:///modules/debian_org/root-dotfiles/screenrc',
 305         }
 306         file { '/root/.tmux.conf':
 307                 source => 'puppet:///modules/debian_org/root-dotfiles/tmux.conf',
 308         }
 309         file { '/root/.vimrc':
 310                 source => 'puppet:///modules/debian_org/root-dotfiles/vimrc',
 311         }
 312
 313         if versioncmp($::lsbmajdistrelease, '9') >= 0 { # older puppets do facts as strings.
 314                 if $::processorcount > 1 {
 315                         package { 'irqbalance': ensure => installed }
 316                 }
 317         }
 318 }