aboutsummaryrefslogtreecommitdiff
path: root/manifests/nodo.pp
blob: edce74cfb9aa4bc8e2eb39cc69750df82b22b0d5 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
class nodo {
  include lsb
  include sudo
  include users::admin
  include motd
  include utils
  include cron
  include hosts
  include locales
  include tunnel
  include profile
  include domain
  include concat::setup

  if !defined('puppetd') {
    class { 'puppetd': }
  }

  #
  # Backup
  #
  class { 'backup': }

  $local_backup = hiera('nodo::backup::localhost', false)

  # Local encrypted backup
  case $local_backup {
    true,enabled,present: {
      backup::duplicity { "localhost":
        encryptkey => hiera('nodo::backup::encryptkey'),
        password   => hiera('nodo::backup::password'),
      }
    }
    absent: {
      backup::duplicity { "localhost":
        encryptkey => hiera('nodo::backup::encryptkey'),
        password   => hiera('nodo::backup::password'),
        ensure     => absent,
      }
    }
    default: { }
  }

  # Does not work well inside vservers
  class { 'runit': ensure => absent }

  # Email delivery configuration
  case hiera('nodo::mail_delivery', 'exim') {
    'tunnel': {              
      $mail_hostname = hiera('nodo::mail_hostname')
      tunnel::mail { "$mail_hostname":
        sshport   => hiera('nodo::mail_ssh_port'),
      }
    }
    'postfix': { }
    '','exim',default: { include exim::tls }
  }

  # Apt configuration
  if $use_apt != false {
    class { 'apt':
      include_src      => hiera('nodo::apt_include_src', false),
      use_next_release => hiera('nodo::apt_use_next_release', false),
    }

    include apt::unattended_upgrades

    apt::sources_list { "$domain.list":
      source => "puppet:///modules/site_apt/sources.list.d/$operatingsystem/$domain.list",
      ensure => $apt_domain_source ? {
        true    => present,
        default => absent,
      }
    }

    # Preferences file can't have dots in the filename
    $apt_domain_preferences = regsubst($domain, '\.', '-', 'G')

    file { "/etc/apt/preferences.d/$apt_domain_preferences":
      source => [ "puppet:///modules/site_apt/preferences.d/$operatingsystem/$domain",
                  "puppet:///modules/nodo/preferences.d/custom" ],
      ensure => $apt_domain_source ? {
        true    => present,
        default => absent,
      }
    }

    package { 'apt-transport-https':
      ensure => present,
    }
  }

  # SSH Server
  #
  # We need to restrict listen address by default so multiple
  # instances can live together in the same physical host.
  #
  class { 'sshd':
    listen_address          => hiera('nodo::sshd_listen_address',          [ "$ipaddress", '127.0.0.1' ]),
    password_authentication => hiera('nodo::sshd_password_authentication', 'yes'),
    shared_ip               => hiera('nodo::sshd_shared_ip',               'yes'),
    tcp_forwarding          => hiera('nodo::sshd_tcp_forwarding',          'yes'),
    hardened_ssl            => hiera('nodo::sshd_hardened_ssl',            'yes'),
    print_motd              => hiera('nodo::sshd_print_motd',              'yes'),
    ports                   => hiera('nodo::sshd_ports',                   [ 22 ]),
    use_pam                 => hiera('nodo::sshd_use_pam',                 'no'),
  }

  file { "/etc/hostname":
    owner   => "root",
    group   => "root",
    mode    => 0644,
    ensure  => present,
    content => "$fqdn\n",
  }

  file { "/etc/rc.local":
    source  => "puppet:///modules/nodo/etc/rc.local",
    owner   => "root",
    group   => "root",
    mode    => 0755,
    ensure  => present,
  }
}