aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--manifests/install_ovh.pp54
-rw-r--r--manifests/install_ovh_from_scratch.pp18
-rw-r--r--modules/aur/manifests/aura.pp16
-rw-r--r--modules/aur/manifests/init.pp2
-rw-r--r--modules/aur/manifests/package.pp (renamed from modules/aur/manifests/install.pp)6
-rw-r--r--modules/base_configuration/manifests/init.pp209
-rw-r--r--modules/base_installation/files/cronie/puppet-post-merge (renamed from modules/cron_puppet/files/post-merge)0
-rw-r--r--modules/base_installation/files/kernel_modules/pcspkr_no_autoload.conf (renamed from modules/base_configuration/files/pcspkr_no_autoload.conf)0
-rw-r--r--modules/base_installation/files/package_managers/mirrorlist (renamed from modules/base_configuration/files/mirrorlist)0
-rw-r--r--modules/base_installation/files/services/en-dhcp.network (renamed from modules/base_configuration/files/en-dhcp.network)0
-rw-r--r--modules/base_installation/files/services/getty_conf_override.conf (renamed from modules/base_configuration/files/getty_conf_override.conf)0
-rw-r--r--modules/base_installation/manifests/cronie.pp21
-rw-r--r--modules/base_installation/manifests/firewall.pp20
-rw-r--r--modules/base_installation/manifests/grub.pp (renamed from modules/grub_install/manifests/init.pp)17
-rw-r--r--modules/base_installation/manifests/init.pp21
-rw-r--r--modules/base_installation/manifests/kernel_modules.pp11
-rw-r--r--modules/base_installation/manifests/locales.pp37
-rw-r--r--modules/base_installation/manifests/logs.pp36
-rw-r--r--modules/base_installation/manifests/package_managers.pp25
-rw-r--r--modules/base_installation/manifests/packages.pp10
-rw-r--r--modules/base_installation/manifests/params.pp21
-rw-r--r--modules/base_installation/manifests/services.pp50
-rw-r--r--modules/base_installation/manifests/ssh.pp14
-rw-r--r--modules/base_installation/manifests/system_config.pp21
-rw-r--r--modules/base_installation/manifests/users.pp49
-rw-r--r--modules/base_packages/manifests/init.pp11
-rw-r--r--modules/cron_puppet/manifests/init.pp26
-rw-r--r--modules/grub_install/files/config47
-rw-r--r--modules/locales/manifests/init.pp12
-rw-r--r--modules/locales/manifests/locale.pp7
-rw-r--r--modules/ovh_cleanup/manifests/init.pp75
31 files changed, 354 insertions, 482 deletions
diff --git a/manifests/install_ovh.pp b/manifests/install_ovh.pp
deleted file mode 100644
index a5adf44..0000000
--- a/manifests/install_ovh.pp
+++ /dev/null
@@ -1,54 +0,0 @@
1node default {
2 include stdlib
3
4 stage { 'base_configuration':
5 before => Stage['main']
6 }
7 stage { 'base_installation':
8 before => Stage['base_configuration']
9 }
10 stage { 'preparation':
11 before => Stage['base_installation']
12 }
13
14 class { 'etckeeper':
15 stage => 'preparation'
16 }
17 class { 'ovh_cleanup':
18 stage => 'preparation'
19 }
20 etckeeper::run { 'post_preparation_stage':
21 reason => "Post puppet preparation stage",
22 stages => [Stage['preparation']]
23 }
24
25 class { 'base_packages':
26 stage => "base_installation"
27 }
28 etckeeper::run { 'post_base_installation_stage':
29 reason => "Post puppet base installation stage",
30 stages => [Stage['base_installation']]
31 }
32
33 class { 'locales':
34 stage => "base_configuration"
35 }
36 class { 'cron_puppet':
37 stage => "base_configuration"
38 }
39 class { 'base_configuration':
40 stage => "base_configuration",
41 hostname => 'new.immae.eu'
42 }
43 etckeeper::run { 'post_base_configuration_stage':
44 reason => "Post puppet base configuration stage",
45 stages => [Stage['base_configuration']]
46 }
47
48 class { 'aur': }
49
50 reboot { 'after_run':
51 apply => 'finished',
52 timeout => 0
53 }
54}
diff --git a/manifests/install_ovh_from_scratch.pp b/manifests/install_ovh_from_scratch.pp
index 4888cfc..f5224fa 100644
--- a/manifests/install_ovh_from_scratch.pp
+++ b/manifests/install_ovh_from_scratch.pp
@@ -1,20 +1,8 @@
1node default { 1node default {
2 include stdlib 2 include stdlib
3 3
4 stage { 'base_configuration': } 4 class { 'base_installation':
5 stage { 'base_packages': } 5 stage => "setup",
6 Stage["setup"] 6 grub_device => "/dev/sdb",
7 -> Stage['base_packages']
8 -> Stage['base_configuration']
9 -> Stage['main']
10
11 class { 'base_packages':
12 stage => "base_packages"
13 }
14 class { 'base_configuration':
15 stage => "base_configuration",
16 code_path => "/etc/puppetlabs/code",
17 device => "/dev/sdb",
18 hostname => 'new.immae.eu',
19 } 7 }
20} 8}
diff --git a/modules/aur/manifests/aura.pp b/modules/aur/manifests/aura.pp
index 2dbcf39..1683cf8 100644
--- a/modules/aur/manifests/aura.pp
+++ b/modules/aur/manifests/aura.pp
@@ -6,12 +6,7 @@ class aur::aura(
6 ensure => "present" 6 ensure => "present"
7 } 7 }
8 8
9 exec { 'pacman-base-devel': 9 ensure_packages(['base-devel'], { 'install_options' => '--needed' })
10 command => '/usr/bin/pacman -Sy base-devel --needed --noconfirm',
11 unless => '/usr/bin/pacman -Qo aura',
12 logoutput => 'on_failure',
13 }
14
15 ensure_packages(['gmp', 'pcre'], { 'install_options' => '--asdeps' }) 10 ensure_packages(['gmp', 'pcre'], { 'install_options' => '--asdeps' })
16 11
17 exec { 'aur::aura': 12 exec { 'aur::aura':
@@ -20,14 +15,15 @@ class aur::aura(
20 command => 'curl -o /tmp/aur.sh aur.sh && chmod +x /tmp/aur.sh && /tmp/aur.sh aura-bin && mv /tmp/aura-bin/aura-bin-*-x86_64.pkg.tar.xz /tmp/aura-bin-x86_64.pkg.tar.xz && rm /tmp/aur.sh && rm -rf /tmp/aura-bin', 15 command => 'curl -o /tmp/aur.sh aur.sh && chmod +x /tmp/aur.sh && /tmp/aur.sh aura-bin && mv /tmp/aura-bin/aura-bin-*-x86_64.pkg.tar.xz /tmp/aura-bin-x86_64.pkg.tar.xz && rm /tmp/aur.sh && rm -rf /tmp/aura-bin',
21 user => "aur-builder", 16 user => "aur-builder",
22 unless => '/usr/bin/pacman -Qo aura', 17 unless => '/usr/bin/pacman -Qo aura',
23 require => Exec['pacman-base-devel'], 18 require => Package['base-devel'],
24 logoutput => 'on_failure', 19 logoutput => 'on_failure',
25 } 20 }
26 21
27 package { 'aura-bin': 22 package { 'aura-bin':
28 ensure => "present", 23 ensure => "present",
29 source => "/tmp/aura-bin-x86_64.pkg.tar.xz", 24 source => "/tmp/aura-bin-x86_64.pkg.tar.xz",
30 notify => Exec['aur::aura::cleanup'] 25 require => Exec['aur::aura'],
26 notify => Exec['aur::aura::cleanup']
31 } 27 }
32 28
33 exec { 'aur::aura::cleanup': 29 exec { 'aur::aura::cleanup':
diff --git a/modules/aur/manifests/init.pp b/modules/aur/manifests/init.pp
index cdf9929..8c3faa1 100644
--- a/modules/aur/manifests/init.pp
+++ b/modules/aur/manifests/init.pp
@@ -1,4 +1,4 @@
1class aur { 1class aur {
2 class { 'aur::aura': } 2 contain 'aur::aura'
3} 3}
4 4
diff --git a/modules/aur/manifests/install.pp b/modules/aur/manifests/package.pp
index 074088e..2fd346e 100644
--- a/modules/aur/manifests/install.pp
+++ b/modules/aur/manifests/package.pp
@@ -1,12 +1,14 @@
1define aur::install ( 1define aur::package (
2 $ensure = 'present', 2 $ensure = 'present',
3) { 3) {
4 4
5 case $ensure { 5 case $ensure {
6 'present': { 6 'present': {
7 exec { "pacman::aur::install::${name}": 7 exec { "pacman::aur::install::${name}":
8 cwd => "/tmp",
8 require => Class[aur::aura], 9 require => Class[aur::aura],
9 command => "/usr/bin/aura -A ${name}", 10 command => "/usr/bin/aura -A ${name}",
11 user => "aur-builder",
10 unless => "/usr/bin/aura -Qk ${name}", 12 unless => "/usr/bin/aura -Qk ${name}",
11 logoutput => 'on_failure', 13 logoutput => 'on_failure',
12 timeout => 1800, 14 timeout => 1800,
@@ -14,8 +16,10 @@ define aur::install (
14 } 16 }
15 'absent': { 17 'absent': {
16 exec { "pacman::aur::remove::${name}": 18 exec { "pacman::aur::remove::${name}":
19 cwd => "/tmp",
17 require => Class[aur::aura], 20 require => Class[aur::aura],
18 command => "/usr/bin/aura -Rs ${name}", 21 command => "/usr/bin/aura -Rs ${name}",
22 user => "aur-builder",
19 onlyif => "/usr/bin/aura -Qi ${name}", 23 onlyif => "/usr/bin/aura -Qi ${name}",
20 logoutput => 'on_failure', 24 logoutput => 'on_failure',
21 } 25 }
diff --git a/modules/base_configuration/manifests/init.pp b/modules/base_configuration/manifests/init.pp
deleted file mode 100644
index 8b2ce4c..0000000
--- a/modules/base_configuration/manifests/init.pp
+++ /dev/null
@@ -1,209 +0,0 @@
1class base_configuration (
2 $hostname = undef,
3 $username = "immae",
4 $userid = 1000,
5 $code_path = undef,
6 $device = undef,
7) {
8 unless empty($device) {
9 class { 'grub_install':
10 device => $device,
11 }
12 }
13
14 class { 'locales': }
15
16 unless empty($code_path) {
17 class { 'cron_puppet':
18 code_path => $code_path,
19 }
20 }
21
22 service { "sshd":
23 #ensure => "running",
24 enable => true,
25 }
26 service { "systemd-networkd":
27 #ensure => "running",
28 enable => true,
29 }
30 service { "systemd-resolved":
31 #ensure => "running",
32 enable => true,
33 }
34
35 file { "/etc/localtime":
36 ensure => "link",
37 target => "../usr/share/zoneinfo/Europe/Paris"
38 }
39
40 exec { "set_locale":
41 command => "/usr/bin/systemd-firstboot --locale=fr_FR.UTF-8",
42 creates => "/etc/locale.conf",
43 }
44
45 unless empty($hostname) {
46 exec { "set_hostname":
47 command => "/usr/bin/systemd-firstboot --hostname=$hostname",
48 creates => "/etc/hostname",
49 }
50 }
51
52 file { "/etc/vconsole.conf":
53 ensure => "link",
54 target => "/dev/null",
55 }
56
57 user { "${username}:${userid}":
58 name => $username,
59 uid => $userid,
60 ensure => "present",
61 groups => "wheel",
62 managehome => true,
63 notify => Exec["remove_password"]
64 }
65
66 exec { "remove_password":
67 command => "/usr/bin/chage -d 0 $username && /usr/bin/passwd -d $username",
68 refreshonly => true
69 }
70
71 ssh_authorized_key { $username:
72 name => "immae@immae.eu",
73 user => $username,
74 type => "ssh-rsa",
75 key => "AAAAB3NzaC1yc2EAAAADAQABAAABAQDi5PgLBwMRyRwzJPnSgUyRAuB9AAxMijsw1pR/t/wmxQne1O5fIPOleHx+D8dyZbwm+XkzlcJpgT0Qy3qC9J8BPhshJvO/tA/8CI/oS/FE0uWsyACH1DMO2dk4gRRZGSE9IuzDMRPlnfZ3n0tdsPzzv3GH4It/oPIgsvkTowKztGLQ7Xmjr5BxzAhXcIQymqA0U3XWHSdWvnSRDaOFG0PDoVMS85IdwlviVKLnV5Sstb4NC/P28LFfgvW8DO/XrOqujgDomqTmR41dK/AyrGGOb2cQUMO4l8Oa+74aOyKaB61rr/rJkr+wCbEttkTvgFa6zZygSk3edfiWE2rgn4+v"
76 }
77
78 class { 'sudo':
79 config_file_replace => false,
80 # Missing in the sudo package, should no be mandatory
81 package_ldap => false
82 }
83
84 sudo::conf { 'wheel':
85 priority => 10,
86 content => "%wheel ALL=(ALL) ALL"
87 }
88
89 class { 'ssh::server':
90 storeconfigs_enabled => false,
91 options => {
92 'AcceptEnv' => undef,
93 'X11Forwarding' => 'yes',
94 'PrintMotd' => 'no',
95 'ChallengeResponseAuthentication' => 'no',
96 'Subsystem' => 'sftp /usr/lib/openssh/sftp-server',
97 }
98 }
99
100 ensure_packages('ruby-shadow')
101 user { 'root':
102 password => '!'
103 }
104
105 file { '/etc/modprobe.d/pcspkr_no_autoload.conf':
106 ensure => "present",
107 path => "/etc/modprobe.d/pcspkr_no_autoload.conf",
108 source => 'puppet:///modules/base_configuration/pcspkr_no_autoload.conf',
109 mode => "0644",
110 owner => "root",
111 group => "root"
112 }
113
114 file { '/etc/systemd/system/getty@tty1.service.d/':
115 ensure => "directory",
116 path => "/etc/systemd/system/getty@tty1.service.d/",
117 mode => "0755",
118 owner => "root",
119 group => "root"
120 }
121
122 file { '/etc/systemd/system/getty@tty1.service.d/noclear.conf':
123 ensure => "present",
124 path => "/etc/systemd/system/getty@tty1.service.d/noclear.conf",
125 source => 'puppet:///modules/base_configuration/getty_conf_override.conf',
126 recurse => true,
127 mode => "0644",
128 owner => "root",
129 group => "root"
130 }
131
132 file { '/etc/systemd/network/en-dhcp.network':
133 ensure => "present",
134 path => "/etc/systemd/network/en-dhcp.network",
135 source => 'puppet:///modules/base_configuration/en-dhcp.network',
136 mode => "0644",
137 owner => "root",
138 group => "root"
139 }
140
141 file { '/etc/pacman.d/mirrorlist':
142 ensure => "present",
143 path => "/etc/pacman.d/mirrorlist",
144 source => 'puppet:///modules/base_configuration/mirrorlist',
145 mode => "0644",
146 owner => "root",
147 group => "root"
148 }
149
150 class { 'pacman':
151 color => true,
152 usesyslog => true,
153 }
154
155 pacman::repo { 'multilib':
156 order => 15,
157 include => '/etc/pacman.d/mirrorlist'
158 }
159
160 class { '::logrotate':
161 manage_cron_daily => false,
162 config => {
163 rotate_every => 'week',
164 rotate => 4,
165 create => true,
166 compress => true,
167 olddir => '/var/log/old',
168 tabooext => "+ .pacorig .pacnew .pacsave",
169 }
170 }
171
172 logrotate::rule { 'wtmp':
173 path => '/var/log/wtmp',
174 rotate_every => 'month',
175 create => true,
176 create_mode => '0664',
177 create_owner => 'root',
178 create_group => 'utmp',
179 rotate => 1,
180 minsize => '1M',
181 }
182 logrotate::rule { 'btmp':
183 path => '/var/log/btmp',
184 missingok => true,
185 rotate_every => 'month',
186 create => true,
187 create_mode => '0600',
188 create_owner => 'root',
189 create_group => 'utmp',
190 rotate => 1,
191 }
192
193 ensure_packages(["whois"], { 'install_options' => '--asdeps' })
194 class { 'fail2ban':
195 logtarget => 'SYSLOG',
196 backend => 'systemd'
197 }
198 fail2ban::jail { 'sshd':
199 backend => 'systemd',
200 port => 'ssh',
201 filter => 'sshd',
202 maxretry => 10,
203 bantime => 86400,
204 logpath => '',
205 order => 10
206 }
207
208 class { 'aur': }
209}
diff --git a/modules/cron_puppet/files/post-merge b/modules/base_installation/files/cronie/puppet-post-merge
index ac5e3ff..ac5e3ff 100644
--- a/modules/cron_puppet/files/post-merge
+++ b/modules/base_installation/files/cronie/puppet-post-merge
diff --git a/modules/base_configuration/files/pcspkr_no_autoload.conf b/modules/base_installation/files/kernel_modules/pcspkr_no_autoload.conf
index b46792e..b46792e 100644
--- a/modules/base_configuration/files/pcspkr_no_autoload.conf
+++ b/modules/base_installation/files/kernel_modules/pcspkr_no_autoload.conf
diff --git a/modules/base_configuration/files/mirrorlist b/modules/base_installation/files/package_managers/mirrorlist
index 2ffca7c..2ffca7c 100644
--- a/modules/base_configuration/files/mirrorlist
+++ b/modules/base_installation/files/package_managers/mirrorlist
diff --git a/modules/base_configuration/files/en-dhcp.network b/modules/base_installation/files/services/en-dhcp.network
index 6eef0e9..6eef0e9 100644
--- a/modules/base_configuration/files/en-dhcp.network
+++ b/modules/base_installation/files/services/en-dhcp.network
diff --git a/modules/base_configuration/files/getty_conf_override.conf b/modules/base_installation/files/services/getty_conf_override.conf
index 52671c7..52671c7 100644
--- a/modules/base_configuration/files/getty_conf_override.conf
+++ b/modules/base_installation/files/services/getty_conf_override.conf
diff --git a/modules/base_installation/manifests/cronie.pp b/modules/base_installation/manifests/cronie.pp
new file mode 100644
index 0000000..bcdd9a7
--- /dev/null
+++ b/modules/base_installation/manifests/cronie.pp
@@ -0,0 +1,21 @@
1class base_installation::cronie inherits base_installation {
2 ensure_packages(['cronie'])
3
4 unless empty($base_installation::puppet_code_path) {
5 file { 'post-hook':
6 ensure => file,
7 path => "$base_installation::puppet_code_path/.git/hooks/post-merge",
8 source => 'puppet:///modules/base_installation/cronie/puppet-post-merge',
9 mode => '0755',
10 owner => root,
11 group => root,
12 }
13 cron { 'puppet-apply':
14 ensure => present,
15 command => "cd $base_installation::puppet_code_path ; /usr/bin/git pull",
16 user => root,
17 minute => '*/30',
18 require => File['post-hook'],
19 }
20 }
21}
diff --git a/modules/base_installation/manifests/firewall.pp b/modules/base_installation/manifests/firewall.pp
new file mode 100644
index 0000000..12eeac2
--- /dev/null
+++ b/modules/base_installation/manifests/firewall.pp
@@ -0,0 +1,20 @@
1class base_installation::firewall inherits base_installation {
2 ensure_packages(["whois"], { 'install_options' => '--asdeps' })
3
4 class { 'fail2ban':
5 logtarget => 'SYSLOG',
6 backend => 'systemd'
7 }
8
9 fail2ban::jail { 'sshd':
10 backend => 'systemd',
11 port => 'ssh',
12 filter => 'sshd',
13 maxretry => 10,
14 bantime => 86400,
15 logpath => '',
16 order => 10
17 }
18
19 contain "fail2ban"
20}
diff --git a/modules/grub_install/manifests/init.pp b/modules/base_installation/manifests/grub.pp
index 172cf4b..0a96aa7 100644
--- a/modules/grub_install/manifests/init.pp
+++ b/modules/base_installation/manifests/grub.pp
@@ -1,11 +1,9 @@
1class grub_install ( 1class base_installation::grub inherits base_installation {
2 $device = undef
3) {
4 ensure_packages(['grub']) 2 ensure_packages(['grub'])
5 3
6 # unless empty($device) { 4 # unless empty($base_installation::grub_device) {
7 # exec { 'install GRUB': 5 # exec { 'install GRUB':
8 # command => "/usr/bin/grub-install --target=i386-pc $device", 6 # command => "/usr/bin/grub-install --target=i386-pc $base_installation::device",
9 # subscribe => Package["grub"], 7 # subscribe => Package["grub"],
10 # } 8 # }
11 # } 9 # }
@@ -15,15 +13,6 @@ class grub_install (
15 line => 'GRUB_CMDLINE_LINUX=" console=tty0 console=ttyS0,115200"', 13 line => 'GRUB_CMDLINE_LINUX=" console=tty0 console=ttyS0,115200"',
16 match => '^GRUB_CMDLINE_LINUX=' 14 match => '^GRUB_CMDLINE_LINUX='
17 } 15 }
18 # file { "/etc/default/grub":
19 # ensure => "present",
20 # path => "/etc/default/grub",
21 # source => 'puppet:///modules/grub_install/config',
22 # mode => "0644",
23 # owner => "root",
24 # group => "root",
25 # # notify => [Exec["install GRUB"], Exec["update GRUB config"]]
26 # }
27 16
28 # exec { 'update GRUB config': 17 # exec { 'update GRUB config':
29 # command => "/usr/bin/grub-mkconfig -o /boot/grub/grub.cfg", 18 # command => "/usr/bin/grub-mkconfig -o /boot/grub/grub.cfg",
diff --git a/modules/base_installation/manifests/init.pp b/modules/base_installation/manifests/init.pp
new file mode 100644
index 0000000..65c5178
--- /dev/null
+++ b/modules/base_installation/manifests/init.pp
@@ -0,0 +1,21 @@
1class base_installation (
2 Optional[String] $grub_device = $base_installation::params::grub_device,
3 Optional[String] $puppet_code_path = $base_installation::params::puppet_code_path,
4 Optional[String] $system_hostname = $base_installation::params::system_hostname,
5 Optional[Array[String]] $system_locales = $base_installation::params::system_locales,
6 Optional[String] $system_timezone = $base_installation::params::system_timezone,
7 Optional[Array[Hash]] $system_users = $base_installation::params::system_users,
8) inherits base_installation::params {
9 contain ::base_installation::packages
10 contain ::base_installation::locales
11 contain ::base_installation::system_config
12 contain ::base_installation::kernel_modules
13 contain ::base_installation::grub
14 contain ::base_installation::firewall
15 contain ::base_installation::logs
16 contain ::base_installation::cronie
17 contain ::base_installation::ssh
18 contain ::base_installation::services
19 contain ::base_installation::users
20 contain ::base_installation::package_managers
21}
diff --git a/modules/base_installation/manifests/kernel_modules.pp b/modules/base_installation/manifests/kernel_modules.pp
new file mode 100644
index 0000000..afeb30c
--- /dev/null
+++ b/modules/base_installation/manifests/kernel_modules.pp
@@ -0,0 +1,11 @@
1class base_installation::kernel_modules inherits base_installation {
2 file { '/etc/modprobe.d/pcspkr_no_autoload.conf':
3 ensure => "present",
4 path => "/etc/modprobe.d/pcspkr_no_autoload.conf",
5 source => 'puppet:///modules/base_installation/kernel_modules/pcspkr_no_autoload.conf',
6 mode => "0644",
7 owner => "root",
8 group => "root"
9 }
10
11}
diff --git a/modules/base_installation/manifests/locales.pp b/modules/base_installation/manifests/locales.pp
new file mode 100644
index 0000000..0f31e0b
--- /dev/null
+++ b/modules/base_installation/manifests/locales.pp
@@ -0,0 +1,37 @@
1class base_installation::locales inherits base_installation {
2 # Note: we don't care about other lines, they are not handled in
3 # Puppet
4 define locale_line ($locale, $charmap = 'UTF-8') {
5 file_line { "/etc/locale.gen#$locale":
6 path => '/etc/locale.gen',
7 line => "$locale $charmap ",
8 match => "#?$locale $charmap +$",
9 notify => Exec["/usr/bin/locale-gen"],
10 }
11 }
12
13 unless empty($base_installation::system_locales) {
14 $base_installation::system_locales.each |$locale| {
15 base_installation::locales::locale_line { "/etc/locale.gen#$locale":
16 locale => $locale
17 }
18 }
19
20 $main_locale = $base_installation::system_locales[0]
21 exec { "set_main_locale":
22 command => "/usr/bin/systemd-firstboot --locale=$main_locale",
23 creates => "/etc/locale.conf",
24 }
25 }
26
27 exec { '/usr/bin/locale-gen':
28 refreshonly => true,
29 }
30
31
32 file { "/etc/vconsole.conf":
33 ensure => "link",
34 target => "/dev/null",
35 }
36
37}
diff --git a/modules/base_installation/manifests/logs.pp b/modules/base_installation/manifests/logs.pp
new file mode 100644
index 0000000..558182f
--- /dev/null
+++ b/modules/base_installation/manifests/logs.pp
@@ -0,0 +1,36 @@
1class base_installation::logs inherits base_installation {
2 class { '::logrotate':
3 manage_cron_daily => false,
4 config => {
5 rotate_every => 'week',
6 rotate => 4,
7 create => true,
8 compress => true,
9 olddir => '/var/log/old',
10 tabooext => "+ .pacorig .pacnew .pacsave",
11 }
12 }
13
14 logrotate::rule { 'wtmp':
15 path => '/var/log/wtmp',
16 rotate_every => 'month',
17 create => true,
18 create_mode => '0664',
19 create_owner => 'root',
20 create_group => 'utmp',
21 rotate => 1,
22 minsize => '1M',
23 }
24 logrotate::rule { 'btmp':
25 path => '/var/log/btmp',
26 missingok => true,
27 rotate_every => 'month',
28 create => true,
29 create_mode => '0600',
30 create_owner => 'root',
31 create_group => 'utmp',
32 rotate => 1,
33 }
34
35 contain "::logrotate"
36}
diff --git a/modules/base_installation/manifests/package_managers.pp b/modules/base_installation/manifests/package_managers.pp
new file mode 100644
index 0000000..c5c8485
--- /dev/null
+++ b/modules/base_installation/manifests/package_managers.pp
@@ -0,0 +1,25 @@
1class base_installation::package_managers inherits base_installation {
2 file { '/etc/pacman.d/mirrorlist':
3 ensure => "present",
4 path => "/etc/pacman.d/mirrorlist",
5 source => 'puppet:///modules/base_installation/package_managers/mirrorlist',
6 mode => "0644",
7 owner => "root",
8 group => "root"
9 }
10
11 class { 'pacman':
12 color => true,
13 usesyslog => true,
14 }
15
16 pacman::repo { 'multilib':
17 order => 15,
18 include => '/etc/pacman.d/mirrorlist'
19 }
20
21 class { 'aur': }
22
23 contain "pacman"
24 contain "aur"
25}
diff --git a/modules/base_installation/manifests/packages.pp b/modules/base_installation/manifests/packages.pp
new file mode 100644
index 0000000..b0824ad
--- /dev/null
+++ b/modules/base_installation/manifests/packages.pp
@@ -0,0 +1,10 @@
1class base_installation::packages inherits base_installation {
2 # Preinstalled
3 ensure_packages(['base'])
4
5 # Critical packages
6 ensure_packages(['openssh', 'grub', 'sudo'])
7
8 # Puppet dependencies
9 ensure_packages(['git', 'puppet'])
10}
diff --git a/modules/base_installation/manifests/params.pp b/modules/base_installation/manifests/params.pp
new file mode 100644
index 0000000..5f2e298
--- /dev/null
+++ b/modules/base_installation/manifests/params.pp
@@ -0,0 +1,21 @@
1class base_installation::params {
2 $puppet_code_path = "/etc/puppetlabs/code"
3 $grub_device = "/dev/sda"
4 $system_hostname = "new.immae.eu"
5 $system_locales = ["fr_FR.UTF-8", "en_US.UTF-8"]
6 $system_timezone = "Europe/Paris"
7 $system_users = [
8 {
9 userid => 1000,
10 username => "immae",
11 groups => ["wheel"],
12 keys => [
13 {
14 host => "immae.eu",
15 key => "AAAAB3NzaC1yc2EAAAADAQABAAABAQDi5PgLBwMRyRwzJPnSgUyRAuB9AAxMijsw1pR/t/wmxQne1O5fIPOleHx+D8dyZbwm+XkzlcJpgT0Qy3qC9J8BPhshJvO/tA/8CI/oS/FE0uWsyACH1DMO2dk4gRRZGSE9IuzDMRPlnfZ3n0tdsPzzv3GH4It/oPIgsvkTowKztGLQ7Xmjr5BxzAhXcIQymqA0U3XWHSdWvnSRDaOFG0PDoVMS85IdwlviVKLnV5Sstb4NC/P28LFfgvW8DO/XrOqujgDomqTmR41dK/AyrGGOb2cQUMO4l8Oa+74aOyKaB61rr/rJkr+wCbEttkTvgFa6zZygSk3edfiWE2rgn4+v",
16 key_type => "ssh-rsa"
17 }
18 ]
19 }
20 ]
21}
diff --git a/modules/base_installation/manifests/services.pp b/modules/base_installation/manifests/services.pp
new file mode 100644
index 0000000..b48c3b5
--- /dev/null
+++ b/modules/base_installation/manifests/services.pp
@@ -0,0 +1,50 @@
1class base_installation::services inherits base_installation {
2
3 service { "sshd":
4 #ensure => "running",
5 enable => true,
6 }
7
8 service { "systemd-networkd":
9 #ensure => "running",
10 enable => true,
11 }
12
13 service { "systemd-resolved":
14 #ensure => "running",
15 enable => true,
16 }
17
18 service { "cronie":
19 #ensure => "running",
20 enable => true,
21 }
22
23 file { '/etc/systemd/system/getty@tty1.service.d/':
24 ensure => "directory",
25 path => "/etc/systemd/system/getty@tty1.service.d/",
26 mode => "0755",
27 owner => "root",
28 group => "root"
29 }
30
31 file { '/etc/systemd/system/getty@tty1.service.d/noclear.conf':
32 ensure => "present",
33 path => "/etc/systemd/system/getty@tty1.service.d/noclear.conf",
34 source => 'puppet:///modules/base_installation/services/getty_conf_override.conf',
35 recurse => true,
36 mode => "0644",
37 owner => "root",
38 group => "root"
39 }
40
41 file { '/etc/systemd/network/en-dhcp.network':
42 ensure => "present",
43 path => "/etc/systemd/network/en-dhcp.network",
44 source => 'puppet:///modules/base_installation/services/en-dhcp.network',
45 mode => "0644",
46 owner => "root",
47 group => "root"
48 }
49
50}
diff --git a/modules/base_installation/manifests/ssh.pp b/modules/base_installation/manifests/ssh.pp
new file mode 100644
index 0000000..43769e9
--- /dev/null
+++ b/modules/base_installation/manifests/ssh.pp
@@ -0,0 +1,14 @@
1class base_installation::ssh inherits base_installation {
2 class { 'ssh::server':
3 storeconfigs_enabled => false,
4 options => {
5 'AcceptEnv' => undef,
6 'X11Forwarding' => 'yes',
7 'PrintMotd' => 'no',
8 'ChallengeResponseAuthentication' => 'no',
9 'Subsystem' => 'sftp /usr/lib/openssh/sftp-server',
10 }
11 }
12
13 contain "ssh::server"
14}
diff --git a/modules/base_installation/manifests/system_config.pp b/modules/base_installation/manifests/system_config.pp
new file mode 100644
index 0000000..f3325f4
--- /dev/null
+++ b/modules/base_installation/manifests/system_config.pp
@@ -0,0 +1,21 @@
1class base_installation::system_config inherits base_installation {
2 unless empty($base_installation::system_timezone) {
3 file { "/etc/localtime":
4 ensure => "link",
5 target => "../usr/share/zoneinfo/$base_installation::system_timezone"
6 }
7 }
8
9 unless empty($base_installation::system_hostname) {
10 file { '/etc/hostname':
11 content => "$base_installation::system_hostname\n",
12 }
13
14 # TODO: find a way to ensure that /etc/hostname doesn't change
15 # exec { "set_hostname":
16 # command => "/usr/bin/systemd-firstboot --hostname=$base_installation::system_hostname",
17 # creates => "/etc/hostname",
18 # }
19 }
20
21}
diff --git a/modules/base_installation/manifests/users.pp b/modules/base_installation/manifests/users.pp
new file mode 100644
index 0000000..766c0f0
--- /dev/null
+++ b/modules/base_installation/manifests/users.pp
@@ -0,0 +1,49 @@
1class base_installation::users (
2 $users = $base_installation::system_users,
3) inherits base_installation {
4 ensure_packages('ruby-shadow')
5 user { 'root':
6 password => '!'
7 }
8
9 class { 'sudo':
10 config_file_replace => false,
11 # Missing in the sudo package, should no be mandatory
12 package_ldap => false
13 }
14
15 sudo::conf { 'wheel':
16 priority => 10,
17 content => "%wheel ALL=(ALL) ALL"
18 }
19
20 contain "sudo"
21
22 $users.each |$user| {
23 user { "${user[username]}:${user[userid]}":
24 name => $user[username],
25 uid => $user[userid],
26 ensure => "present",
27 groups => $user[groups],
28 managehome => true,
29 home => "/home/${user[username]}",
30 notify => Exec["remove_password"],
31 purge_ssh_keys => true
32 }
33
34 exec { "remove_password":
35 command => "/usr/bin/chage -d 0 ${user[username]} && /usr/bin/passwd -d ${user[username]}",
36 refreshonly => true
37 }
38
39 $user[keys].each |$key| {
40 ssh_authorized_key { "${user[username]}@${key[host]}":
41 name => "${user[username]}@${key[host]}",
42 user => $user[username],
43 type => $key[key_type],
44 key => $key[key],
45 }
46 }
47 }
48
49}
diff --git a/modules/base_packages/manifests/init.pp b/modules/base_packages/manifests/init.pp
deleted file mode 100644
index c4bbec9..0000000
--- a/modules/base_packages/manifests/init.pp
+++ /dev/null
@@ -1,11 +0,0 @@
1class base_packages {
2 # Preinstalled
3 ensure_packages(['base'])
4
5 # Critical packages
6 ensure_packages(['openssh', 'grub', 'sudo'])
7
8 # Puppet dependencies
9 ensure_packages(['git', 'puppet'])
10}
11
diff --git a/modules/cron_puppet/manifests/init.pp b/modules/cron_puppet/manifests/init.pp
deleted file mode 100644
index c9d5a51..0000000
--- a/modules/cron_puppet/manifests/init.pp
+++ /dev/null
@@ -1,26 +0,0 @@
1class cron_puppet (
2 $code_path = "/etc/puppetlabs/code"
3) {
4 file { 'post-hook':
5 ensure => file,
6 path => "$code_path/.git/hooks/post-merge",
7 source => 'puppet:///modules/cron_puppet/post-merge',
8 mode => '0755',
9 owner => root,
10 group => root,
11 }
12 package { 'cronie':
13 ensure => 'present',
14 }
15 cron { 'puppet-apply':
16 ensure => present,
17 command => "cd $code_path ; /usr/bin/git pull",
18 user => root,
19 minute => '*/30',
20 require => File['post-hook'],
21 }
22 service { 'cronie':
23 ensure => 'running',
24 enable => true
25 }
26}
diff --git a/modules/grub_install/files/config b/modules/grub_install/files/config
deleted file mode 100644
index 0a2ef57..0000000
--- a/modules/grub_install/files/config
+++ /dev/null
@@ -1,47 +0,0 @@
1GRUB_DEFAULT=0
2GRUB_TIMEOUT=5
3GRUB_DISTRIBUTOR="Arch"
4GRUB_CMDLINE_LINUX_DEFAULT="quiet"
5GRUB_CMDLINE_LINUX=" console=tty0 console=ttyS0,115200"
6
7# Preload both GPT and MBR modules so that they are not missed
8GRUB_PRELOAD_MODULES="part_gpt part_msdos"
9
10# Uncomment to enable Hidden Menu, and optionally hide the timeout count
11#GRUB_HIDDEN_TIMEOUT=5
12#GRUB_HIDDEN_TIMEOUT_QUIET=true
13
14# Uncomment to use basic console
15GRUB_TERMINAL_INPUT=console
16
17# Uncomment to disable graphical terminal
18#GRUB_TERMINAL_OUTPUT=console
19
20# The resolution used on graphical terminal
21# note that you can use only modes which your graphic card supports via VBE
22# you can see them in real GRUB with the command `vbeinfo'
23GRUB_GFXMODE=auto
24
25# Uncomment to allow the kernel use the same resolution used by grub
26GRUB_GFXPAYLOAD_LINUX=keep
27
28# Uncomment if you want GRUB to pass to the Linux kernel the old parameter
29# format "root=/dev/xxx" instead of "root=/dev/disk/by-uuid/xxx"
30#GRUB_DISABLE_LINUX_UUID=true
31
32# Uncomment to disable generation of recovery mode menu entries
33GRUB_DISABLE_RECOVERY=true
34
35# Uncomment and set to the desired menu colors. Used by normal and wallpaper
36# modes only. Entries specified as foreground/background.
37#GRUB_COLOR_NORMAL="light-blue/black"
38#GRUB_COLOR_HIGHLIGHT="light-cyan/blue"
39
40# Uncomment one of them for the gfx desired, a image background or a gfxtheme
41#GRUB_BACKGROUND="/path/to/wallpaper"
42#GRUB_THEME="/path/to/gfxtheme"
43
44# Uncomment to get a beep at GRUB start
45#GRUB_INIT_TUNE="480 440 1"
46
47#GRUB_SAVEDEFAULT="true"
diff --git a/modules/locales/manifests/init.pp b/modules/locales/manifests/init.pp
deleted file mode 100644
index 1923f26..0000000
--- a/modules/locales/manifests/init.pp
+++ /dev/null
@@ -1,12 +0,0 @@
1class locales {
2 locales::locale { '/etc/locale.gen#fr_FR.UTF-8':
3 locale => 'fr_FR.UTF-8'
4 }
5 locales::locale { '/etc/locale.gen#en_US.UTF-8':
6 locale => 'en_US.UTF-8'
7 }
8 exec { '/usr/bin/locale-gen':
9 subscribe => File_line['/etc/locale.gen#fr_FR.UTF-8', '/etc/locale.gen#en_US.UTF-8'],
10 refreshonly => true,
11 }
12}
diff --git a/modules/locales/manifests/locale.pp b/modules/locales/manifests/locale.pp
deleted file mode 100644
index 1eb14be..0000000
--- a/modules/locales/manifests/locale.pp
+++ /dev/null
@@ -1,7 +0,0 @@
1define locales::locale ($locale, $charmap = 'UTF-8') {
2 file_line { "/etc/locale.gen#$locale":
3 path => '/etc/locale.gen',
4 line => "$locale $charmap ",
5 match => "#?$locale $charmap +$",
6 }
7}
diff --git a/modules/ovh_cleanup/manifests/init.pp b/modules/ovh_cleanup/manifests/init.pp
deleted file mode 100644
index fc1b84b..0000000
--- a/modules/ovh_cleanup/manifests/init.pp
+++ /dev/null
@@ -1,75 +0,0 @@
1class ovh_cleanup {
2 exec { 'bash -c "comm -23 <(find /etc /opt /usr | sort) <(pacman -Qlq | sed \"s|/$||\" | sort) > /root/disowned_files_before_cleanup.txt"':
3 path => '/usr/bin',
4 creates => '/root/disowned_files_before_cleanup.txt'
5 }
6 exec { 'bash -c "comm -23 <(pacman -Qq | sort) <(pacman -Qgq base | while read i; do pactree -u \$i; done | sort | uniq) > /root/packages_not_in_base_group.txt"':
7 path => '/usr/bin',
8 creates => '/root/packages_not_in_base_group.txt'
9 }
10 file { '/etc/apt':
11 ensure => 'absent',
12 force => true,
13 }
14 file { '/etc/default/keyboard':
15 ensure => 'absent',
16 }
17 file { '/etc/default/locale':
18 ensure => 'absent',
19 }
20 file { '/etc/timezone':
21 ensure => 'absent',
22 }
23 file { '/etc/pacman.d/mirrorlist.pacnew':
24 ensure => 'absent',
25 }
26 exec { '/usr/bin/reanimate-pacman':
27 creates => '/etc/pacman.d/gnupg',
28 }
29 file { '/etc/pacman.d/gnupg':
30 ensure => 'present',
31 }
32 file { '/usr/bin/growpart':
33 ensure => 'absent',
34 }
35 file { '/usr/bin/reanimate-pacman':
36 ensure => 'absent',
37 require => File['/etc/pacman.d/gnupg'],
38 }
39 file { '/etc/systemd/system/pacman-reanimation.service':
40 ensure => 'absent',
41 require => File['/etc/pacman.d/gnupg'],
42 }
43 file { '/etc/systemd/system/multi-user.target.wants/pacman-reanimation.service':
44 ensure => 'absent',
45 require => File['/etc/pacman.d/gnupg'],
46 }
47 exec { '/usr/bin/mv /etc/lvm/lvmlocal.conf.pacnew /etc/lvm/lvmlocal.conf':
48 onlyif => '/usr/bin/test -f /etc/lvm/lvmlocal.conf.pacnew'
49 }
50 file { '/etc/resolv.conf.pacorig':
51 ensure => 'absent'
52 }
53 package { 'haveged':
54 ensure => 'absent',
55 uninstall_options => [ '-s', '-c']
56 }
57 package { 'parted':
58 ensure => 'absent',
59 uninstall_options => [ '-s', '-c']
60 }
61
62
63 file { '/etc/udev/rules.d/80-net-setup-link.rules':
64 ensure => 'absent',
65 }
66 exec { '/usr/bin/sed -i -e "s/Name=eth0/Name=en*/" /etc/systemd/network/eth0-dhcp.network':
67 subscribe => File['/etc/udev/rules.d/80-net-setup-link.rules'],
68 refreshonly => true
69 }
70 exec { '/usr/bin/mv /etc/systemd/network/eth0-dhcp.network /etc/systemd/network/en-dhcp.network':
71 subscribe => Exec['/usr/bin/sed -i -e "s/Name=eth0/Name=en*/" /etc/systemd/network/eth0-dhcp.network'],
72 notify => Reboot['after_run'],
73 refreshonly => true,
74 }
75}
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-08 22:01:23 +0000