From 548061112d2e2627317f9379d2f501fcf3f6ea54 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Wed, 30 Aug 2017 22:16:39 +0200 Subject: Add LDAP support --- modules/base_installation/manifests/init.pp | 11 ++++++ modules/base_installation/manifests/ldap.pp | 24 ++++++++++++ modules/base_installation/manifests/params.pp | 9 +++++ modules/base_installation/manifests/puppet.pp | 55 +++++++++++++++++++++++++++ 4 files changed, 99 insertions(+) create mode 100644 modules/base_installation/manifests/ldap.pp create mode 100644 modules/base_installation/manifests/puppet.pp (limited to 'modules/base_installation/manifests') diff --git a/modules/base_installation/manifests/init.pp b/modules/base_installation/manifests/init.pp index 65c5178..f9fdcd4 100644 --- a/modules/base_installation/manifests/init.pp +++ b/modules/base_installation/manifests/init.pp @@ -1,6 +1,15 @@ class base_installation ( Optional[String] $grub_device = $base_installation::params::grub_device, + Optional[String] $ldap_base = $base_installation::params::ldap_base, + Optional[String] $ldap_cert_path = $base_installation::params::ldap_cert_path, + Optional[String] $ldap_cn = $base_installation::params::ldap_cn, + Optional[String] $ldap_dn = $base_installation::params::ldap_dn, + Optional[String] $ldap_server = $base_installation::params::ldap_server, + Optional[String] $ldap_uri = $base_installation::params::ldap_uri, Optional[String] $puppet_code_path = $base_installation::params::puppet_code_path, + Optional[String] $puppet_conf_path = $base_installation::params::puppet_conf_path, + Optional[String] $puppet_pass_seed = $base_installation::params::puppet_pass_seed, + Optional[String] $puppet_ssl_path = $base_installation::params::puppet_ssl_path, Optional[String] $system_hostname = $base_installation::params::system_hostname, Optional[Array[String]] $system_locales = $base_installation::params::system_locales, Optional[String] $system_timezone = $base_installation::params::system_timezone, @@ -15,7 +24,9 @@ class base_installation ( contain ::base_installation::logs contain ::base_installation::cronie contain ::base_installation::ssh + contain ::base_installation::ldap contain ::base_installation::services contain ::base_installation::users contain ::base_installation::package_managers + contain ::base_installation::puppet } diff --git a/modules/base_installation/manifests/ldap.pp b/modules/base_installation/manifests/ldap.pp new file mode 100644 index 0000000..1825700 --- /dev/null +++ b/modules/base_installation/manifests/ldap.pp @@ -0,0 +1,24 @@ +class base_installation::ldap inherits base_installation { + ensure_packages(["openldap"]) + + File { + mode => "0644", + owner => "root", + group => "root", + } + + file { '/etc/openldap': + ensure => directory, + require => Package["openldap"], + recurse => true, + purge => true, + force => true, + } + + file { '/etc/openldap/ldap.conf': + ensure => present, + content => template("base_installation/ldap/ldap.conf.erb"), + require => File['/etc/openldap'], + } + +} diff --git a/modules/base_installation/manifests/params.pp b/modules/base_installation/manifests/params.pp index f09f01a..c03eb1e 100644 --- a/modules/base_installation/manifests/params.pp +++ b/modules/base_installation/manifests/params.pp @@ -1,6 +1,15 @@ class base_installation::params { $puppet_code_path = "/etc/puppetlabs/code" + $puppet_conf_path = "/etc/puppetlabs/puppet" + $puppet_pass_seed = "/etc/puppetlabs/puppet/password_seed" + $puppet_ssl_path = "/etc/puppetlabs/ssl" $grub_device = "/dev/sda" + $ldap_base = "dc=example,dc=com" + $ldap_cn = "node" + $ldap_dn = "cn=node,ou=hosts,dc=example,dc=com" + $ldap_cert_path = "/etc/ssl/certs/ca-certificates.crt" + $ldap_uri = "ldaps://ldap.example.com" + $ldap_server = "ldap.example.com" $system_hostname = "example.com" $system_locales = ["en_US.UTF-8"] $system_timezone = "UTC" diff --git a/modules/base_installation/manifests/puppet.pp b/modules/base_installation/manifests/puppet.pp new file mode 100644 index 0000000..cd5697a --- /dev/null +++ b/modules/base_installation/manifests/puppet.pp @@ -0,0 +1,55 @@ +class base_installation::puppet ( + $password_seed = $base_installation::puppet_pass_seed +) inherits base_installation { + File { + mode => "0600", + owner => "root", + group => "root", + } + + exec { 'generate_password_seed': + command => "/usr/bin/openssl rand -base64 -out $password_seed 256", + creates => $password_seed, + environment => "RANDFILE=/dev/null", + } + + unless empty(find_file($password_seed)) { + $ldap_password = generate_password(24, $password_seed, "ldap") + $ssha_ldap_seed = generate_password(5, $password_seed, "ldap_seed") + + package { 'gem:ruby-ldap': + name => "ruby-ldap", + ensure => present, + provider => "gem", + install_options => "--no-user-install" + } + + file { $password_seed: + mode => "0600", + } + + file { $base_installation::puppet_conf_path: + ensure => directory, + require => [Package["puppet"], Package["gem:ruby-ldap"]], + recurse => true, + purge => true, + force => true, + } + + file { "$base_installation::puppet_conf_path/puppet.conf": + content => template("base_installation/puppet/puppet.conf.erb"), + require => File[$base_installation::puppet_conf_path], + } + + file { "$base_installation::puppet_conf_path/host_ldap.info": + content => template("base_installation/puppet/host_ldap.info.erb"), + require => File[$base_installation::puppet_conf_path], + notify => Notify_refresh["notify-ldap-password"], + } + + notify_refresh { "notify-ldap-password": + message => template("base_installation/puppet/host_ldap.info.erb"), + refreshonly => true + } + } +} -- cgit v1.2.3