modules/debian_org/manifests/init.pp

   1 # == Class: debian_org
   2 #
   3 # Stuff common to all debian.org servers
   4 #
   5 class debian_org {
   6         include debian_org::apt
   7
   8         if $systemd {
   9                 include systemd
  10                 $servicefiles = 'present'
  11         } else {
  12                 $servicefiles = 'absent'
  13         }
  14
  15         # the virtual facter needs virt-what on jessie to work
  16         if versioncmp($::lsbmajdistrelease, '9') < 0 {
  17                 package { 'virt-what': ensure => installed }
  18         } else {
  19                 package { 'virt-what': ensure => purged }
  20         }
  21
  22         $debianadmin = [
  23                 'debian-archive-debian-samhain-reports@master.debian.org',
  24                 'debian-admin@ftbfs.de',
  25                 'weasel@debian.org',
  26                 'steve@lobefin.net',
  27                 'zumbi@oron.es'
  28         ]
  29
  30         package { [
  31                         'klogd',
  32                         'sysklogd',
  33                         'rsyslog',
  34                         'os-prober',
  35                         'apt-listchanges',
  36                         'mlocate',
  37                 ]:
  38                 ensure => purged,
  39         }
  40         package { [
  41                         'debian.org',
  42                         'debian.org-recommended',
  43                         'dsa-munin-plugins',
  44                 ]:
  45                 ensure => installed,
  46                 tag    => extra_repo,
  47         }
  48         file { '/etc/ssh/ssh_known_hosts':
  49                 ensure  => present,
  50                 replace => false,
  51                 mode    => '0644',
  52                 source  => 'puppet:///modules/debian_org/basic-ssh_known_hosts'
  53         }
  54
  55         if versioncmp($::lsbmajdistrelease, '8') >= 0 {
  56                 $rubyfs_package = 'ruby-filesystem'
  57         } else {
  58                 $rubyfs_package = 'libfilesystem-ruby1.9'
  59         }
  60         package { [
  61                         'apt-utils',
  62                         'bash-completion',
  63                         'dnsutils',
  64                         'less',
  65                         'lsb-release',
  66                         $rubyfs_package,
  67                         'mtr-tiny',
  68                         'nload',
  69                         'pciutils',
  70                         'lldpd',
  71                 ]:
  72                 ensure => installed,
  73         }
  74
  75         munin::check { [
  76                         'cpu',
  77                         'entropy',
  78                         'forks',
  79                         'interrupts',
  80                         'iostat',
  81                         'irqstats',
  82                         'load',
  83                         'memory',
  84                         'open_files',
  85                         'open_inodes',
  86                         'processes',
  87                         'swap',
  88                         'uptime',
  89                         'vmstat',
  90                 ]:
  91         }
  92
  93         if getfromhash($site::nodeinfo, 'broken-rtc') {
  94                 package { 'fake-hwclock':
  95                         ensure => installed,
  96                         tag    => extra_repo,
  97                 }
  98         }
  99
 100         package { 'molly-guard':
 101                 ensure => installed,
 102         }
 103         file { '/etc/molly-guard/run.d/10-check-kvm':
 104                 mode    => '0755',
 105                 source  => 'puppet:///modules/debian_org/molly-guard/10-check-kvm',
 106                 require => Package['molly-guard'],
 107         }
 108         file { '/etc/molly-guard/run.d/15-acquire-reboot-lock':
 109                 mode    => '0755',
 110                 source  => 'puppet:///modules/debian_org/molly-guard/15-acquire-reboot-lock',
 111                 require => Package['molly-guard'],
 112         }
 113
 114         augeas { 'inittab_replicate':
 115                 context => '/files/etc/inittab',
 116                 changes => [
 117                         'set ud/runlevels 2345',
 118                         'set ud/action respawn',
 119                         'set ud/process "/usr/bin/ud-replicated -d"',
 120                 ],
 121                 notify  => Exec['init q'],
 122         }
 123
 124
 125         file { '/etc/facter':
 126                 ensure  => directory,
 127                 purge   => true,
 128                 force   => true,
 129                 recurse => true,
 130                 source  => 'puppet:///files/empty/',
 131         }
 132         file { '/etc/facter/facts.d':
 133                 ensure => directory,
 134         }
 135         file { '/etc/facter/facts.d/debian_facts.yaml':
 136                 content => template('debian_org/debian_facts.yaml.erb')
 137         }
 138         file { '/etc/timezone':
 139                 source => 'puppet:///modules/debian_org/timezone',
 140                 notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'],
 141         }
 142         if $::hostname == handel {
 143                 include puppetmaster::db
 144                 $dbpassword = $puppetmaster::db::password
 145         }
 146         file { '/etc/puppet/puppet.conf':
 147                 content => template('debian_org/puppet.conf.erb'),
 148                 mode => '0440',
 149                 group => 'puppet',
 150         }
 151         file { '/etc/default/puppet':
 152                 source => 'puppet:///modules/debian_org/puppet.default',
 153         }
 154         file { '/etc/systemd':
 155                 ensure  => directory,
 156                 mode => '0755',
 157         }
 158         file { '/etc/systemd/system':
 159                 ensure  => directory,
 160                 mode => '0755',
 161         }
 162         file { '/etc/systemd/system/ud-replicated.service':
 163                 ensure => $servicefiles,
 164                 source => 'puppet:///modules/debian_org/ud-replicated.service',
 165                 notify => Exec['systemctl daemon-reload'],
 166         }
 167         if $systemd {
 168                 file { '/etc/systemd/system/multi-user.target.wants/ud-replicated.service':
 169                         ensure => 'link',
 170                         target => '../ud-replicated.service',
 171                         notify => Exec['systemctl daemon-reload'],
 172                 }
 173         }
 174         file { '/etc/systemd/system/puppet.service':
 175                 ensure => 'link',
 176                 target => '/dev/null',
 177                 notify => Exec['systemctl daemon-reload'],
 178         }
 179         file { '/etc/systemd/system/proc-sys-fs-binfmt_misc.automount':
 180                 ensure => 'link',
 181                 target => '/dev/null',
 182                 notify => Exec['systemctl daemon-reload'],
 183         }
 184
 185         file { '/etc/cron.d/dsa-puppet-stuff':
 186                 content => template('debian_org/dsa-puppet-stuff.cron.erb'),
 187                 require => Package['debian.org'],
 188         }
 189         file { '/etc/ldap/ldap.conf':
 190                 require => Package['debian.org'],
 191                 content  => template('debian_org/ldap.conf.erb'),
 192         }
 193         file { '/etc/pam.d/common-session':
 194                 require => Package['debian.org'],
 195                 content => template('debian_org/pam.common-session.erb'),
 196         }
 197         file { '/etc/pam.d/common-session-noninteractive':
 198                 require => Package['debian.org'],
 199                 content => template('debian_org/pam.common-session-noninteractive.erb'),
 200         }
 201         file { '/etc/rc.local':
 202                 mode   => '0755',
 203                 content => template('debian_org/rc.local.erb'),
 204                 notify => Exec['service rc.local restart'],
 205         }
 206         file { '/etc/dsa':
 207                 ensure => directory,
 208                 mode   => '0755',
 209         }
 210         file { '/etc/dsa/cron.ignore.dsa-puppet-stuff':
 211                 source  => 'puppet:///modules/debian_org/dsa-puppet-stuff.cron.ignore',
 212                 require => Package['debian.org']
 213         }
 214         file { '/etc/nsswitch.conf':
 215                 mode   => '0755',
 216                 source => 'puppet:///modules/debian_org/nsswitch.conf',
 217         }
 218
 219         file { '/etc/profile.d/timeout.sh':
 220                 mode   => '0555',
 221                 source => 'puppet:///modules/debian_org/etc.profile.d/timeout.sh',
 222         }
 223         file { '/etc/zsh':
 224                 ensure => directory,
 225         }
 226         file { '/etc/zsh/zprofile':
 227                 mode   => '0444',
 228                 source => 'puppet:///modules/debian_org/etc.zsh/zprofile',
 229         }
 230
 231         # set mmap_min_addr to 4096 to mitigate
 232         # Linux NULL-pointer dereference exploits
 233         site::sysctl { 'mmap_min_addr':
 234                 ensure => absent
 235         }
 236         site::sysctl { 'perf_event_paranoid':
 237                 key   => 'kernel.perf_event_paranoid',
 238                 value => '2',
 239         }
 240         site::sysctl { 'puppet-vfs_cache_pressure':
 241                 key   => 'vm.vfs_cache_pressure',
 242                 value => '10',
 243         }
 244         site::alternative { 'editor':
 245                 linkto => '/usr/bin/vim.basic',
 246         }
 247         site::alternative { 'view':
 248                 linkto => '/usr/bin/vim.basic',
 249         }
 250         mailalias { 'samhain-reports':
 251                 ensure    => present,
 252                 recipient => $debianadmin,
 253                 require   => Package['debian.org']
 254         }
 255
 256         file { '/usr/local/bin/check_for_updates':
 257                 source => 'puppet:///modules/debian_org/check_for_updates',
 258                 mode   => '0755',
 259                 owner  => root,
 260                 group  => root,
 261         }
 262         file { '/usr/local/bin/dsa-is-shutdown-scheduled':
 263                 source  => 'puppet:///modules/debian_org/dsa-is-shutdown-scheduled',
 264                 mode    => '0555',
 265         }
 266
 267         exec { 'dpkg-reconfigure tzdata -pcritical -fnoninteractive':
 268                 path        => '/usr/bin:/usr/sbin:/bin:/sbin',
 269                 refreshonly => true
 270         }
 271         exec { 'service puppetmaster restart':
 272                 refreshonly => true
 273         }
 274         exec { 'service rc.local restart':
 275                 refreshonly => true
 276         }
 277         exec { 'init q':
 278                 refreshonly => true
 279         }
 280
 281         exec { 'systemctl daemon-reload':
 282                 refreshonly => true,
 283                 onlyif  => "test -x /bin/systemctl"
 284         }
 285
 286         exec { 'systemd-tmpfiles --create --exclude-prefix=/dev':
 287                 refreshonly => true,
 288                 onlyif  => "test -x /bin/systemd-tmpfiles"
 289         }
 290
 291         tidy { '/var/lib/puppet/clientbucket/':
 292                 age      => '2w',
 293                 recurse  => 9,
 294                 type     => ctime,
 295                 matches  => [ 'paths', 'contents' ],
 296                 schedule => weekly
 297         }
 298
 299         file { '/root/.bashrc':
 300                 source => 'puppet:///modules/debian_org/root-dotfiles/bashrc',
 301         }
 302         file { '/root/.profile':
 303                 source => 'puppet:///modules/debian_org/root-dotfiles/profile',
 304         }
 305         file { '/root/.selected_editor':
 306                 source => 'puppet:///modules/debian_org/root-dotfiles/selected_editor',
 307         }
 308         file { '/root/.screenrc':
 309                 source => 'puppet:///modules/debian_org/root-dotfiles/screenrc',
 310         }
 311         file { '/root/.tmux.conf':
 312                 source => 'puppet:///modules/debian_org/root-dotfiles/tmux.conf',
 313         }
 314         file { '/root/.vimrc':
 315                 source => 'puppet:///modules/debian_org/root-dotfiles/vimrc',
 316         }
 317
 318         if versioncmp($::lsbmajdistrelease, '9') >= 0 { # older puppets do facts as strings.
 319                 if $::processorcount > 1 {
 320                         package { 'irqbalance': ensure => installed }
 321                 }
 322         }
 323 }