add egd-management

We can now run hosts with a key in the host mode, so it will
provide entropy to other hosts. Furthermore we can define clients
that will collect entropy from such a host.

8 files changed, 80 insertions, 4 deletions

diff --git a/manifests/base.pp b/manifests/base.pp
index e4d572d..24494f4 100644
--- a/manifests/base.pp
+++ b/manifests/base.pp
@@ -4,15 +4,20 @@ class ekeyd::base {
     ensure => installed,
   }
 
+  file{'/etc/entropykey/ekeyd.conf':
+    source => 'puppet:///modules/ekeyd/ekeyd.conf',
+    require => Package['ekeyd'],
+    notify => Service['ekeyd'],
+    owner => root, group => 0, mode => 0644;
+  }
   service{'ekeyd':
     ensure => running,
     enable => true,
-    require => Package['ekeyd'],
   }
 
   exec{'configure_ekey_key':
-      command => "ekey-rekey `ekeydctl list | grep \"/dev/entropykey\" | awk -F, '{ print \$5}'` ${ekey_masterkey}",
-      unless => "ekeydctl list | grep -q 'Running OK'",
-      require => Service['ekeyd'],
+    command => "ekey-rekey `ekeydctl list | grep \"/dev/entropykey\" | awk -F, '{ print \$5}'` ${ekey_masterkey}",
+    unless => "ekeydctl list | grep -q 'Running OK'",
+    require => Service['ekeyd'],
   } 
 }
diff --git a/manifests/client.pp b/manifests/client.pp
new file mode 100644
index 0000000..89fd253
--- /dev/null
+++ b/manifests/client.pp
@@ -0,0 +1,13 @@
+class ekeyd::client {
+  if !$ekeyd_host { fail("\$ekeyd_host is not set for $fqdn") }
+  case $operatingsystem {
+    centos: { include ekeyd::client::centos }
+    default: { include ekeyd::client::base }
+  }
+
+  if $use_shorewall {
+    class{'shorewall::rules::out::ekeyd':
+      ekeyd_host => $ekeyd_host,
+    }
+  }
+}
diff --git a/manifests/client/base.pp b/manifests/client/base.pp
new file mode 100644
index 0000000..411b7ee
--- /dev/null
+++ b/manifests/client/base.pp
@@ -0,0 +1,3 @@
+class ekeyd::client::base {
+  include ekeyd::egd
+}
diff --git a/manifests/client/centos.pp b/manifests/client/centos.pp
new file mode 100644
index 0000000..b9328bb
--- /dev/null
+++ b/manifests/client/centos.pp
@@ -0,0 +1,7 @@
+class ekeyd::client::centos inherits ekeyd::client::base {
+  file{'/etc/sysconfig/egd-linux':
+    content => "DAEMON_HOST=${ekeyd_host}\n",
+    notify => Service['egd-linux'],
+    owner => root, group => 0, mode => 0644;
+  }
+}
diff --git a/manifests/egd.pp b/manifests/egd.pp
new file mode 100644
index 0000000..8a7da6f
--- /dev/null
+++ b/manifests/egd.pp
@@ -0,0 +1,17 @@
+class ekeyd::egd {
+  package{'ekeyd-egd-linux':
+    ensure => present,
+    before => Service['egd-linux'],
+  }
+
+  service{'egd-linux':
+    enable => true,
+    ensure => running,
+  }
+
+  if $use_shorewall {
+    Service['egd-linux']{
+      require => Service['shorewall'],
+    }
+  }
+}
diff --git a/manifests/host.pp b/manifests/host.pp
new file mode 100644
index 0000000..6b8dd1a
--- /dev/null
+++ b/manifests/host.pp
@@ -0,0 +1,10 @@
+class ekeyd::host inherits ekeyd {
+  case $operatingsystem {
+    centos: { include ekeyd::host::centos }
+    default: { include ekeyd::host::base }
+  }
+
+  if $use_shorewall {
+    include shorewall::rules::ekeyd
+  }
+}
diff --git a/manifests/host/base.pp b/manifests/host/base.pp
new file mode 100644
index 0000000..ec8525b
--- /dev/null
+++ b/manifests/host/base.pp
@@ -0,0 +1,15 @@
+class ekeyd::host::base inherits ekeyd::base {
+  sysctl::value{'kernel.random.write_wakeup_threshold':
+    value => 1024
+  }
+
+  File['/etc/entropykey/ekeyd.conf']{
+    source => 'puppet:///modules/ekeyd/ekeyd.conf.daemon',
+  }
+
+  Service['ekeyd']{
+    before => Service['egd-linux'],
+  }
+
+  include ekeyd::egd
+}
diff --git a/manifests/host/centos.pp b/manifests/host/centos.pp
new file mode 100644
index 0000000..d989d55
--- /dev/null
+++ b/manifests/host/centos.pp
@@ -0,0 +1,6 @@
+class ekeyd::host::centos inherits ekeyd::host::base {
+  file{'/etc/sysconfig/egd-linux':
+    ensure => 'absent',
+    notify => Service['egd-linux'],
+  }
+}