aboutsummaryrefslogtreecommitdiff
path: root/manifests/subsystem
diff options
context:
space:
mode:
authorSilvio Rhatto <rhatto@riseup.net>2015-07-31 16:05:20 -0300
committerSilvio Rhatto <rhatto@riseup.net>2015-07-31 16:05:20 -0300
commitf057008d9c07f5f15de1b65ca9bd7c63d37c2db8 (patch)
tree8e0fec94d58ed0da6af30c3c105b31634b20465d /manifests/subsystem
parent7f857de9d2e5ca739cd71b5c571e1f6fa01d4457 (diff)
downloadpuppet-nodo-f057008d9c07f5f15de1b65ca9bd7c63d37c2db8.tar.gz
puppet-nodo-f057008d9c07f5f15de1b65ca9bd7c63d37c2db8.tar.bz2
Adds nodo::subsystem::sysctl::disable_ipv6
Diffstat (limited to 'manifests/subsystem')
-rw-r--r--manifests/subsystem/sysctl.pp2
-rw-r--r--manifests/subsystem/sysctl/disable_ipv6.pp19
2 files changed, 21 insertions, 0 deletions
diff --git a/manifests/subsystem/sysctl.pp b/manifests/subsystem/sysctl.pp
index 03e1683..94fbae0 100644
--- a/manifests/subsystem/sysctl.pp
+++ b/manifests/subsystem/sysctl.pp
@@ -1,4 +1,6 @@
class nodo::subsystem::sysctl {
+ class { 'nodo::subsystem::sysctl::disable_ipv6': }
+
# Root exploit fix, see http://wiki.debian.org/mmap_min_addr
# Maybe this can be remove in the future or included in a sysctl puppet module
file { "/etc/sysctl.d/mmap_min_addr.conf":
diff --git a/manifests/subsystem/sysctl/disable_ipv6.pp b/manifests/subsystem/sysctl/disable_ipv6.pp
new file mode 100644
index 0000000..a6486a0
--- /dev/null
+++ b/manifests/subsystem/sysctl/disable_ipv6.pp
@@ -0,0 +1,19 @@
+# Do not enable ipv6 by default
+# See https://wiki.debian.org/DebianIPv6
+class nodo::subsystem::sysctl::disable_ipv6(
+ $ensure = hiera('nodo::sysctl::disable_ipv6', 'present'),
+) {
+ file { "/etc/sysctl.d/disable_ipv6.conf":
+ owner => "root",
+ group => "root",
+ mode => 0644,
+ ensure => $ensure,
+ source => "puppet:///modules/nodo/etc/sysctl.d/disable_ipv6.conf",
+ }
+
+ exec { "sysctl-disable-ipv6":
+ command => '/sbin/sysctl -p',
+ subscribe => File["/etc/sysctl.d/disable_ipv6.conf"],
+ refreshonly => true,
+ }
+}