modules/base_configuration/manifests/init.pp

   1 class base_configuration (
   2   $hostname = undef,
   3   $username = "immae",
   4   $userid   = 1000
   5 ) {
   6   service { "sshd":
   7     ensure => "running",
   8     enable => true,
   9   }
  10   service { "systemd-networkd.socket":
  11     ensure => "running",
  12     enable => true,
  13   }
  14   service { "systemd-networkd":
  15     ensure => "running",
  16     enable => true,
  17   }
  18
  19   unless empty($hostname) {
  20     class { 'systemd::hostname':
  21       hostname => $hostname
  22     }
  23   }
  24
  25   user { "${username}:${userid}":
  26     name       => $username,
  27     uid        => $userid,
  28     ensure     => "present",
  29     groups     => "wheel",
  30     managehome => true,
  31     notify     => Exec["remove_password"]
  32   }
  33
  34   exec { "remove_password":
  35     command     => "/usr/bin/chage -d 0 $username && /usr/bin/passwd -d $username",
  36     refreshonly => true
  37   }
  38
  39   ssh_authorized_key { $username:
  40     name => "immae@immae.eu",
  41     user => $username,
  42     type => "ssh-rsa",
  43     key  => "AAAAB3NzaC1yc2EAAAADAQABAAABAQDi5PgLBwMRyRwzJPnSgUyRAuB9AAxMijsw1pR/t/wmxQne1O5fIPOleHx+D8dyZbwm+XkzlcJpgT0Qy3qC9J8BPhshJvO/tA/8CI/oS/FE0uWsyACH1DMO2dk4gRRZGSE9IuzDMRPlnfZ3n0tdsPzzv3GH4It/oPIgsvkTowKztGLQ7Xmjr5BxzAhXcIQymqA0U3XWHSdWvnSRDaOFG0PDoVMS85IdwlviVKLnV5Sstb4NC/P28LFfgvW8DO/XrOqujgDomqTmR41dK/AyrGGOb2cQUMO4l8Oa+74aOyKaB61rr/rJkr+wCbEttkTvgFa6zZygSk3edfiWE2rgn4+v"
  44   }
  45
  46   class { 'sudo':
  47     config_file_replace => false
  48   }
  49
  50   sudo::conf { 'wheel':
  51     priority => 10,
  52     content  => "%wheel ALL=(ALL) ALL"
  53   }
  54
  55   class { 'ssh::server':
  56      storeconfigs_enabled => false,
  57      options => {
  58         'AcceptEnv'                       => undef,
  59         'X11Forwarding'                   => 'yes',
  60         'PrintMotd'                       => 'no',
  61         'ChallengeResponseAuthentication' => 'no',
  62         'Subsystem'                       => 'sftp /usr/lib/openssh/sftp-server',
  63      }
  64   }
  65
  66   ensure_packages('ruby-shadow')
  67   user { 'root':
  68     password => '!'
  69   }
  70
  71   file { '/etc/pacman.d/mirrorlist':
  72      ensure  => "present",
  73      path    => "/etc/pacman.d/mirrorlist",
  74      source  => 'puppet:///modules/base_configuration/mirrorlist',
  75      mode    => "0644",
  76      owner   => "root",
  77      group   => "root"
  78   }
  79
  80   class { 'pacman':
  81     color     => true,
  82     usesyslog => true,
  83   }
  84
  85   pacman::repo { 'multilib':
  86     order   => 15,
  87     include => '/etc/pacman.d/mirrorlist'
  88   }
  89
  90   class { '::logrotate':
  91     manage_cron_daily => false,
  92     config => {
  93       rotate_every => 'week',
  94       rotate       => 4,
  95       create       => true,
  96       compress     => true,
  97       olddir       => '/var/log/old',
  98       tabooext     => "+ .pacorig .pacnew .pacsave",
  99     }
 100   }
 101
 102   logrotate::rule { 'wtmp':
 103     path         => '/var/log/wtmp',
 104     rotate_every => 'month',
 105     create       => true,
 106     create_mode  => '0664',
 107     create_owner => 'root',
 108     create_group => 'utmp',
 109     rotate       => '1',
 110     minsize      => '1M',
 111   }
 112   logrotate::rule { 'btmp':
 113     path         => '/var/log/btmp',
 114     missingok    => true,
 115     rotate_every => 'month',
 116     create       => true,
 117     create_mode  => '0600',
 118     create_owner => 'root',
 119     create_group => 'utmp',
 120     rotate       => '1',
 121   }
 122
 123   ensure_packages(["whois"], { 'install_options' => '--asdeps' })
 124   class { 'fail2ban':
 125     logtarget => 'SYSLOG',
 126     backend   => 'systemd'
 127   }
 128   fail2ban::jail { 'sshd':
 129     backend  => 'systemd',
 130     port     => 'ssh',
 131     filter   => 'sshd',
 132     maxretry => 10,
 133     bantime  => 86400,
 134     logpath  => '',
 135     order    => 10
 136   }
 137 }