aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--auth.conf124
-rw-r--r--hiera.yaml0
-rw-r--r--manifests/install_ovh_from_scratch.pp20
-rw-r--r--modules/base_configuration/files/en-dhcp.network8
-rw-r--r--modules/base_configuration/files/getty_conf_override.conf2
-rw-r--r--modules/base_configuration/files/pcspkr_no_autoload.conf1
-rw-r--r--modules/base_configuration/manifests/init.pp94
-rw-r--r--modules/base_packages/manifests/init.pp5
-rw-r--r--modules/cron_puppet/files/post-merge4
-rw-r--r--modules/cron_puppet/manifests/init.pp8
-rw-r--r--modules/etckeeper/manifests/run.pp7
m---------modules/fail2ban0
-rw-r--r--modules/grub_install/files/config47
-rw-r--r--modules/grub_install/manifests/init.pp32
-rw-r--r--modules/locales/manifests/init.pp4
-rw-r--r--puppet.conf6
16 files changed, 208 insertions, 154 deletions
diff --git a/auth.conf b/auth.conf
deleted file mode 100644
index bf327a2..0000000
--- a/auth.conf
+++ /dev/null
@@ -1,124 +0,0 @@
1# This is the default auth.conf file, which implements the default rules
2# used by the puppet master. (That is, the rules below will still apply
3# even if this file is deleted.)
4#
5# The ACLs are evaluated in top-down order. More specific stanzas should
6# be towards the top of the file and more general ones at the bottom;
7# otherwise, the general rules may "steal" requests that should be
8# governed by the specific rules.
9#
10# See https://docs.puppetlabs.com/puppet/latest/reference/config_file_auth.html
11# for a more complete description of auth.conf's behavior.
12#
13# Supported syntax:
14# Each stanza in auth.conf starts with a path to match, followed
15# by optional modifiers, and finally, a series of allow or deny
16# directives.
17#
18# Example Stanza
19# ---------------------------------
20# path /path/to/resource # simple prefix match
21# # path ~ regex # alternately, regex match
22# [environment envlist]
23# [method methodlist]
24# [auth[enthicated] {yes|no|on|off|any}]
25# allow [host|backreference|*|regex]
26# deny [host|backreference|*|regex]
27# allow_ip [ip|cidr|ip_wildcard|*]
28# deny_ip [ip|cidr|ip_wildcard|*]
29#
30# The path match can either be a simple prefix match or a regular
31# expression. `path /file` would match both `/file_metadata` and
32# `/file_content`. Regex matches allow the use of backreferences
33# in the allow/deny directives.
34#
35# The regex syntax is the same as for Ruby regex, and captures backreferences
36# for use in the `allow` and `deny` lines of that stanza
37#
38# Examples:
39#
40# path ~ ^/puppet/v3/path/to/resource # Equivalent to `path /puppet/v3/path/to/resource`.
41# allow * # Allow all authenticated nodes (since auth
42# # defaults to `yes`).
43#
44# path ~ ^/puppet/v3/catalog/([^/]+)$ # Permit nodes to access their own catalog (by
45# allow $1 # certname), but not any other node's catalog.
46#
47# path ~ ^/puppet/v3/file_(metadata|content)/extra_files/ # Only allow certain nodes to
48# auth yes # access the "extra_files"
49# allow /^(.+)\.example\.com$/ # mount point; note this must
50# allow_ip 192.168.100.0/24 # go ABOVE the "/file" rule,
51# # since it is more specific.
52#
53# environment:: restrict an ACL to a comma-separated list of environments
54# method:: restrict an ACL to a comma-separated list of HTTP methods
55# auth:: restrict an ACL to an authenticated or unauthenticated request
56# the default when unspecified is to restrict the ACL to authenticated requests
57# (ie exactly as if auth yes was present).
58#
59
60### Authenticated ACLs - these rules apply only when the client
61### has a valid certificate and is thus authenticated
62
63path /puppet/v3/environments
64method find
65allow *
66
67# allow nodes to retrieve their own catalog
68path ~ ^/puppet/v3/catalog/([^/]+)$
69method find
70allow $1
71
72# allow nodes to retrieve their own node definition
73path ~ ^/puppet/v3/node/([^/]+)$
74method find
75allow $1
76
77# allow all nodes to store their own reports
78path ~ ^/puppet/v3/report/([^/]+)$
79method save
80allow $1
81
82# Allow all nodes to access all file services; this is necessary for
83# pluginsync, file serving from modules, and file serving from custom
84# mount points (see fileserver.conf). Note that the `/file` prefix matches
85# requests to both the file_metadata and file_content paths. See "Examples"
86# above if you need more granular access control for custom mount points.
87path /puppet/v3/file
88allow *
89
90path /puppet/v3/status
91method find
92allow *
93
94# allow all nodes to access the certificates services
95path /puppet-ca/v1/certificate_revocation_list/ca
96method find
97allow *
98
99### Unauthenticated ACLs, for clients without valid certificates; authenticated
100### clients can also access these paths, though they rarely need to.
101
102# allow access to the CA certificate; unauthenticated nodes need this
103# in order to validate the puppet master's certificate
104path /puppet-ca/v1/certificate/ca
105auth any
106method find
107allow *
108
109# allow nodes to retrieve the certificate they requested earlier
110path /puppet-ca/v1/certificate/
111auth any
112method find
113allow *
114
115# allow nodes to request a new certificate
116path /puppet-ca/v1/certificate_request
117auth any
118method find, save
119allow *
120
121# deny everything else; this ACL is not strictly necessary, but
122# illustrates the default policy.
123path /
124auth any
diff --git a/hiera.yaml b/hiera.yaml
deleted file mode 100644
index e69de29..0000000
--- a/hiera.yaml
+++ /dev/null
diff --git a/manifests/install_ovh_from_scratch.pp b/manifests/install_ovh_from_scratch.pp
new file mode 100644
index 0000000..4888cfc
--- /dev/null
+++ b/manifests/install_ovh_from_scratch.pp
@@ -0,0 +1,20 @@
1node default {
2 include stdlib
3
4 stage { 'base_configuration': }
5 stage { 'base_packages': }
6 Stage["setup"]
7 -> Stage['base_packages']
8 -> Stage['base_configuration']
9 -> Stage['main']
10
11 class { 'base_packages':
12 stage => "base_packages"
13 }
14 class { 'base_configuration':
15 stage => "base_configuration",
16 code_path => "/etc/puppetlabs/code",
17 device => "/dev/sdb",
18 hostname => 'new.immae.eu',
19 }
20}
diff --git a/modules/base_configuration/files/en-dhcp.network b/modules/base_configuration/files/en-dhcp.network
new file mode 100644
index 0000000..6eef0e9
--- /dev/null
+++ b/modules/base_configuration/files/en-dhcp.network
@@ -0,0 +1,8 @@
1[Match]
2Name=en*
3
4[Network]
5DHCP=yes
6
7[DHCP]
8UseMTU=true
diff --git a/modules/base_configuration/files/getty_conf_override.conf b/modules/base_configuration/files/getty_conf_override.conf
new file mode 100644
index 0000000..52671c7
--- /dev/null
+++ b/modules/base_configuration/files/getty_conf_override.conf
@@ -0,0 +1,2 @@
1[Service]
2TTYVTDisallocate=no
diff --git a/modules/base_configuration/files/pcspkr_no_autoload.conf b/modules/base_configuration/files/pcspkr_no_autoload.conf
new file mode 100644
index 0000000..b46792e
--- /dev/null
+++ b/modules/base_configuration/files/pcspkr_no_autoload.conf
@@ -0,0 +1 @@
blacklist pcspkr
diff --git a/modules/base_configuration/manifests/init.pp b/modules/base_configuration/manifests/init.pp
index a46dd8b..8b2ce4c 100644
--- a/modules/base_configuration/manifests/init.pp
+++ b/modules/base_configuration/manifests/init.pp
@@ -1,27 +1,59 @@
1class base_configuration ( 1class base_configuration (
2 $hostname = undef, 2 $hostname = undef,
3 $username = "immae", 3 $username = "immae",
4 $userid = 1000 4 $userid = 1000,
5 $code_path = undef,
6 $device = undef,
5) { 7) {
8 unless empty($device) {
9 class { 'grub_install':
10 device => $device,
11 }
12 }
13
14 class { 'locales': }
15
16 unless empty($code_path) {
17 class { 'cron_puppet':
18 code_path => $code_path,
19 }
20 }
21
6 service { "sshd": 22 service { "sshd":
7 ensure => "running", 23 #ensure => "running",
8 enable => true, 24 enable => true,
9 } 25 }
10 service { "systemd-networkd.socket": 26 service { "systemd-networkd":
11 ensure => "running", 27 #ensure => "running",
12 enable => true, 28 enable => true,
13 } 29 }
14 service { "systemd-networkd": 30 service { "systemd-resolved":
15 ensure => "running", 31 #ensure => "running",
16 enable => true, 32 enable => true,
17 } 33 }
18 34
35 file { "/etc/localtime":
36 ensure => "link",
37 target => "../usr/share/zoneinfo/Europe/Paris"
38 }
39
40 exec { "set_locale":
41 command => "/usr/bin/systemd-firstboot --locale=fr_FR.UTF-8",
42 creates => "/etc/locale.conf",
43 }
44
19 unless empty($hostname) { 45 unless empty($hostname) {
20 class { 'systemd::hostname': 46 exec { "set_hostname":
21 hostname => $hostname 47 command => "/usr/bin/systemd-firstboot --hostname=$hostname",
48 creates => "/etc/hostname",
22 } 49 }
23 } 50 }
24 51
52 file { "/etc/vconsole.conf":
53 ensure => "link",
54 target => "/dev/null",
55 }
56
25 user { "${username}:${userid}": 57 user { "${username}:${userid}":
26 name => $username, 58 name => $username,
27 uid => $userid, 59 uid => $userid,
@@ -70,6 +102,42 @@ class base_configuration (
70 password => '!' 102 password => '!'
71 } 103 }
72 104
105 file { '/etc/modprobe.d/pcspkr_no_autoload.conf':
106 ensure => "present",
107 path => "/etc/modprobe.d/pcspkr_no_autoload.conf",
108 source => 'puppet:///modules/base_configuration/pcspkr_no_autoload.conf',
109 mode => "0644",
110 owner => "root",
111 group => "root"
112 }
113
114 file { '/etc/systemd/system/getty@tty1.service.d/':
115 ensure => "directory",
116 path => "/etc/systemd/system/getty@tty1.service.d/",
117 mode => "0755",
118 owner => "root",
119 group => "root"
120 }
121
122 file { '/etc/systemd/system/getty@tty1.service.d/noclear.conf':
123 ensure => "present",
124 path => "/etc/systemd/system/getty@tty1.service.d/noclear.conf",
125 source => 'puppet:///modules/base_configuration/getty_conf_override.conf',
126 recurse => true,
127 mode => "0644",
128 owner => "root",
129 group => "root"
130 }
131
132 file { '/etc/systemd/network/en-dhcp.network':
133 ensure => "present",
134 path => "/etc/systemd/network/en-dhcp.network",
135 source => 'puppet:///modules/base_configuration/en-dhcp.network',
136 mode => "0644",
137 owner => "root",
138 group => "root"
139 }
140
73 file { '/etc/pacman.d/mirrorlist': 141 file { '/etc/pacman.d/mirrorlist':
74 ensure => "present", 142 ensure => "present",
75 path => "/etc/pacman.d/mirrorlist", 143 path => "/etc/pacman.d/mirrorlist",
@@ -108,7 +176,7 @@ class base_configuration (
108 create_mode => '0664', 176 create_mode => '0664',
109 create_owner => 'root', 177 create_owner => 'root',
110 create_group => 'utmp', 178 create_group => 'utmp',
111 rotate => '1', 179 rotate => 1,
112 minsize => '1M', 180 minsize => '1M',
113 } 181 }
114 logrotate::rule { 'btmp': 182 logrotate::rule { 'btmp':
@@ -119,7 +187,7 @@ class base_configuration (
119 create_mode => '0600', 187 create_mode => '0600',
120 create_owner => 'root', 188 create_owner => 'root',
121 create_group => 'utmp', 189 create_group => 'utmp',
122 rotate => '1', 190 rotate => 1,
123 } 191 }
124 192
125 ensure_packages(["whois"], { 'install_options' => '--asdeps' }) 193 ensure_packages(["whois"], { 'install_options' => '--asdeps' })
@@ -136,4 +204,6 @@ class base_configuration (
136 logpath => '', 204 logpath => '',
137 order => 10 205 order => 10
138 } 206 }
207
208 class { 'aur': }
139} 209}
diff --git a/modules/base_packages/manifests/init.pp b/modules/base_packages/manifests/init.pp
index 269ca58..c4bbec9 100644
--- a/modules/base_packages/manifests/init.pp
+++ b/modules/base_packages/manifests/init.pp
@@ -1,6 +1,9 @@
1class base_packages { 1class base_packages {
2 # Preinstalled 2 # Preinstalled
3 ensure_packages(['base', 'openssh', 'grub', 'sudo']) 3 ensure_packages(['base'])
4
5 # Critical packages
6 ensure_packages(['openssh', 'grub', 'sudo'])
4 7
5 # Puppet dependencies 8 # Puppet dependencies
6 ensure_packages(['git', 'puppet']) 9 ensure_packages(['git', 'puppet'])
diff --git a/modules/cron_puppet/files/post-merge b/modules/cron_puppet/files/post-merge
index 1ba08fb..ac5e3ff 100644
--- a/modules/cron_puppet/files/post-merge
+++ b/modules/cron_puppet/files/post-merge
@@ -1,7 +1,7 @@
1#!/bin/bash -e 1#!/bin/bash
2## Run Puppet locally using puppet apply 2## Run Puppet locally using puppet apply
3git submodule update --init 3git submodule update --init
4/usr/bin/puppet apply --modulepath=/etc/puppetlabs/puppet/modules /etc/puppetlabs/puppet/manifests/site.pp 4/usr/bin/puppet apply `pwd`/manifests/site.pp
5 5
6## Log status of the Puppet run 6## Log status of the Puppet run
7if [ $? -eq 0 ] 7if [ $? -eq 0 ]
diff --git a/modules/cron_puppet/manifests/init.pp b/modules/cron_puppet/manifests/init.pp
index 1756a06..c9d5a51 100644
--- a/modules/cron_puppet/manifests/init.pp
+++ b/modules/cron_puppet/manifests/init.pp
@@ -1,7 +1,9 @@
1class cron_puppet { 1class cron_puppet (
2 $code_path = "/etc/puppetlabs/code"
3) {
2 file { 'post-hook': 4 file { 'post-hook':
3 ensure => file, 5 ensure => file,
4 path => '/etc/puppetlabs/puppet/.git/hooks/post-merge', 6 path => "$code_path/.git/hooks/post-merge",
5 source => 'puppet:///modules/cron_puppet/post-merge', 7 source => 'puppet:///modules/cron_puppet/post-merge',
6 mode => '0755', 8 mode => '0755',
7 owner => root, 9 owner => root,
@@ -12,7 +14,7 @@ class cron_puppet {
12 } 14 }
13 cron { 'puppet-apply': 15 cron { 'puppet-apply':
14 ensure => present, 16 ensure => present,
15 command => "cd /etc/puppetlabs/puppet ; /usr/bin/git pull", 17 command => "cd $code_path ; /usr/bin/git pull",
16 user => root, 18 user => root,
17 minute => '*/30', 19 minute => '*/30',
18 require => File['post-hook'], 20 require => File['post-hook'],
diff --git a/modules/etckeeper/manifests/run.pp b/modules/etckeeper/manifests/run.pp
index ddbb4e1..8ff4bbf 100644
--- a/modules/etckeeper/manifests/run.pp
+++ b/modules/etckeeper/manifests/run.pp
@@ -1,7 +1,10 @@
1define etckeeper::run ($stages = [Stage['main']], $refreshonly = true, $reason = 'puppet run') { 1define etckeeper::run (
2 $refreshonly = true,
3 $reason = 'puppet run'
4) {
5
2 exec { "etckeeper::run::${name}": 6 exec { "etckeeper::run::${name}":
3 refreshonly => $refreshonly, 7 refreshonly => $refreshonly,
4 command => "/usr/bin/etckeeper commit '${reason}' || true", 8 command => "/usr/bin/etckeeper commit '${reason}' || true",
5 subscribe => $stages
6 } 9 }
7} 10}
diff --git a/modules/fail2ban b/modules/fail2ban
Subproject c1495a2c2de075863775e4ad191e0f0407fc259 Subproject c4f816ded7245641ab70d553dc27f635f07614f
diff --git a/modules/grub_install/files/config b/modules/grub_install/files/config
new file mode 100644
index 0000000..0a2ef57
--- /dev/null
+++ b/modules/grub_install/files/config
@@ -0,0 +1,47 @@
1GRUB_DEFAULT=0
2GRUB_TIMEOUT=5
3GRUB_DISTRIBUTOR="Arch"
4GRUB_CMDLINE_LINUX_DEFAULT="quiet"
5GRUB_CMDLINE_LINUX=" console=tty0 console=ttyS0,115200"
6
7# Preload both GPT and MBR modules so that they are not missed
8GRUB_PRELOAD_MODULES="part_gpt part_msdos"
9
10# Uncomment to enable Hidden Menu, and optionally hide the timeout count
11#GRUB_HIDDEN_TIMEOUT=5
12#GRUB_HIDDEN_TIMEOUT_QUIET=true
13
14# Uncomment to use basic console
15GRUB_TERMINAL_INPUT=console
16
17# Uncomment to disable graphical terminal
18#GRUB_TERMINAL_OUTPUT=console
19
20# The resolution used on graphical terminal
21# note that you can use only modes which your graphic card supports via VBE
22# you can see them in real GRUB with the command `vbeinfo'
23GRUB_GFXMODE=auto
24
25# Uncomment to allow the kernel use the same resolution used by grub
26GRUB_GFXPAYLOAD_LINUX=keep
27
28# Uncomment if you want GRUB to pass to the Linux kernel the old parameter
29# format "root=/dev/xxx" instead of "root=/dev/disk/by-uuid/xxx"
30#GRUB_DISABLE_LINUX_UUID=true
31
32# Uncomment to disable generation of recovery mode menu entries
33GRUB_DISABLE_RECOVERY=true
34
35# Uncomment and set to the desired menu colors. Used by normal and wallpaper
36# modes only. Entries specified as foreground/background.
37#GRUB_COLOR_NORMAL="light-blue/black"
38#GRUB_COLOR_HIGHLIGHT="light-cyan/blue"
39
40# Uncomment one of them for the gfx desired, a image background or a gfxtheme
41#GRUB_BACKGROUND="/path/to/wallpaper"
42#GRUB_THEME="/path/to/gfxtheme"
43
44# Uncomment to get a beep at GRUB start
45#GRUB_INIT_TUNE="480 440 1"
46
47#GRUB_SAVEDEFAULT="true"
diff --git a/modules/grub_install/manifests/init.pp b/modules/grub_install/manifests/init.pp
new file mode 100644
index 0000000..172cf4b
--- /dev/null
+++ b/modules/grub_install/manifests/init.pp
@@ -0,0 +1,32 @@
1class grub_install (
2 $device = undef
3) {
4 ensure_packages(['grub'])
5
6 # unless empty($device) {
7 # exec { 'install GRUB':
8 # command => "/usr/bin/grub-install --target=i386-pc $device",
9 # subscribe => Package["grub"],
10 # }
11 # }
12
13 file_line { "/etc/default/grub#GRUB_CMDLINE_LINUX":
14 path => "/etc/default/grub",
15 line => 'GRUB_CMDLINE_LINUX=" console=tty0 console=ttyS0,115200"',
16 match => '^GRUB_CMDLINE_LINUX='
17 }
18 # file { "/etc/default/grub":
19 # ensure => "present",
20 # path => "/etc/default/grub",
21 # source => 'puppet:///modules/grub_install/config',
22 # mode => "0644",
23 # owner => "root",
24 # group => "root",
25 # # notify => [Exec["install GRUB"], Exec["update GRUB config"]]
26 # }
27
28 # exec { 'update GRUB config':
29 # command => "/usr/bin/grub-mkconfig -o /boot/grub/grub.cfg",
30 # refreshonly => true
31 # }
32}
diff --git a/modules/locales/manifests/init.pp b/modules/locales/manifests/init.pp
index 982b48e..1923f26 100644
--- a/modules/locales/manifests/init.pp
+++ b/modules/locales/manifests/init.pp
@@ -9,8 +9,4 @@ class locales {
9 subscribe => File_line['/etc/locale.gen#fr_FR.UTF-8', '/etc/locale.gen#en_US.UTF-8'], 9 subscribe => File_line['/etc/locale.gen#fr_FR.UTF-8', '/etc/locale.gen#en_US.UTF-8'],
10 refreshonly => true, 10 refreshonly => true,
11 } 11 }
12 exec { '/usr/bin/localectl set-locale LANG=fr_FR.UTF-8':
13 subscribe => File_line['/etc/locale.gen#fr_FR.UTF-8'],
14 refreshonly => true,
15 }
16} 12}
diff --git a/puppet.conf b/puppet.conf
deleted file mode 100644
index bf48823..0000000
--- a/puppet.conf
+++ /dev/null
@@ -1,6 +0,0 @@
1# This file can be used to override the default puppet settings.
2# See the following links for more details on what settings are available:
3# - https://docs.puppetlabs.com/puppet/latest/reference/config_important_settings.html
4# - https://docs.puppetlabs.com/puppet/latest/reference/config_about_settings.html
5# - https://docs.puppetlabs.com/puppet/latest/reference/config_file_main.html
6# - https://docs.puppetlabs.com/puppet/latest/reference/configuration.html
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-01 15:40:35 +0000