aboutsummaryrefslogtreecommitdiff
path: root/manifests/subsystem
diff options
context:
space:
mode:
authorSilvio Rhatto <rhatto@riseup.net>2015-07-31 16:07:29 -0300
committerSilvio Rhatto <rhatto@riseup.net>2015-07-31 16:07:29 -0300
commit8a4fbfa8a071094e5727f4e49107c0cfe79e9c45 (patch)
treea793668c3a2be7538630976551be4d642c49cce0 /manifests/subsystem
parente55feae3bc42fb6c17b402eb1685d393ea94d573 (diff)
parentf057008d9c07f5f15de1b65ca9bd7c63d37c2db8 (diff)
downloadpuppet-nodo-8a4fbfa8a071094e5727f4e49107c0cfe79e9c45.tar.gz
puppet-nodo-8a4fbfa8a071094e5727f4e49107c0cfe79e9c45.tar.bz2
Merge branch 'master' into develop
Diffstat (limited to 'manifests/subsystem')
-rw-r--r--manifests/subsystem/sysctl.pp2
-rw-r--r--manifests/subsystem/sysctl/disable_ipv6.pp19
2 files changed, 21 insertions, 0 deletions
diff --git a/manifests/subsystem/sysctl.pp b/manifests/subsystem/sysctl.pp
index 03e1683..94fbae0 100644
--- a/manifests/subsystem/sysctl.pp
+++ b/manifests/subsystem/sysctl.pp
@@ -1,4 +1,6 @@
class nodo::subsystem::sysctl {
+ class { 'nodo::subsystem::sysctl::disable_ipv6': }
+
# Root exploit fix, see http://wiki.debian.org/mmap_min_addr
# Maybe this can be remove in the future or included in a sysctl puppet module
file { "/etc/sysctl.d/mmap_min_addr.conf":
diff --git a/manifests/subsystem/sysctl/disable_ipv6.pp b/manifests/subsystem/sysctl/disable_ipv6.pp
new file mode 100644
index 0000000..a6486a0
--- /dev/null
+++ b/manifests/subsystem/sysctl/disable_ipv6.pp
@@ -0,0 +1,19 @@
+# Do not enable ipv6 by default
+# See https://wiki.debian.org/DebianIPv6
+class nodo::subsystem::sysctl::disable_ipv6(
+ $ensure = hiera('nodo::sysctl::disable_ipv6', 'present'),
+) {
+ file { "/etc/sysctl.d/disable_ipv6.conf":
+ owner => "root",
+ group => "root",
+ mode => 0644,
+ ensure => $ensure,
+ source => "puppet:///modules/nodo/etc/sysctl.d/disable_ipv6.conf",
+ }
+
+ exec { "sysctl-disable-ipv6":
+ command => '/sbin/sysctl -p',
+ subscribe => File["/etc/sysctl.d/disable_ipv6.conf"],
+ refreshonly => true,
+ }
+}