provizioning 0.1.2 → 0.4.0

data/puppet/modules/rvm/manifests/classes/passenger.pp

@@ -0,0 +1,166 @@
+class rvm::ruby($ruby_version, $rvm_prefix) {
+    $binpath = "${rvm_prefix}bin/"
+    
+    exec { 
+        "rvm-install-ruby":
+            command => "${binpath}rvm install ${ruby_version}",
+            creates => "${rvm_prefix}rvm/rubies/${ruby_version}",
+            logoutput => 'on_failure',
+            timeout => "-1",
+            require => [Class["rvm::system"], Exec["system-rvm"]];
+    }
+}
+
+class rvm::passenger($ruby_version, $version, $rvm_prefix) {
+    $gempath = "${rvm_prefix}rvm/gems/${ruby_version}/gems"
+    $binpath = "${rvm_prefix}rvm/rubies/${ruby_version}/bin"
+    
+    exec {
+        "passenger-gem":
+            command => "${rvm_prefix}rvm/rubies/${ruby_version}/bin/gem install passenger --no-ri --no-rdoc",
+            creates => "${binpath}/passenger",
+            require => Exec["rvm-install-ruby"];
+    }
+}
+
+class rvm::passenger::apache(
+    $ruby_version = 'ruby-1.9.2-p290',
+    $version = '3.0.8',
+    $rvm_prefix = '/usr/local/',
+    $mininstances = '1',
+    $maxpoolsize = '6',
+    $poolidletime = '300',
+    $maxinstancesperapp = '0',
+    $spawnmethod = 'smart-lv2'
+) {
+
+    # TODO: How can we get the gempath automatically using the ruby version
+    # Can we read the output of a command into a variable?
+    # e.g. $gempath = `usr/local/bin/rvm ${ruby_version} exec rvm gemdir`
+    $gempath = "${rvm_prefix}rvm/gems/${ruby_version}/gems"
+    $binpath = $rvm_prefix ? {
+        '/usr/local/' => '/usr/local/bin/',
+        default => "${rvm_prefix}rvm/bin/"
+    }
+
+    # TODO: How to inherit this from above?
+    class { 'rvm::ruby': ruby_version => $ruby_version, rvm_prefix => $rvm_prefix }
+    class { 'rvm::passenger': ruby_version => $ruby_version, version => $version, rvm_prefix => $rvm_prefix }
+    include apache    
+
+    # Dependencies
+    if ! defined(Package['build-essential'])      { package { build-essential:      ensure => installed } }
+    if ! defined(Package['apache2-prefork-dev'])  { package { apache2-prefork-dev:  ensure => installed } }
+    if ! defined(Package['libapr1-dev'])          { package { libapr1-dev:          ensure => installed, alias => 'libapr-dev' } }
+    if ! defined(Package['libaprutil1-dev'])      { package { libaprutil1-dev:      ensure => installed, alias => 'libaprutil-dev' } }
+    if ! defined(Package['libcurl4-openssl-dev']) { package { libcurl4-openssl-dev: ensure => installed } }
+
+    exec {
+        'passenger-install-apache2-module':
+            command => "${binpath}rvm ${ruby_version} exec passenger-install-apache2-module -a",
+            creates => "${gempath}/passenger-${version}/ext/apache2/mod_passenger.so",
+            logoutput => 'on_failure',
+            require => [
+                Class['rvm::system'],
+                Exec['system-rvm'],
+                Exec['rvm-install-ruby'],
+                Exec['passenger-gem'],
+                Package[
+                    'apache2',
+                    'build-essential',
+                    'apache2-prefork-dev',
+                    'libapr-dev',
+                    'libaprutil-dev',
+                    'libcurl4-openssl-dev'
+                ]
+            ];
+    }
+
+    file {
+        '/etc/apache2/mods-available/passenger.load':
+            content => "LoadModule passenger_module ${gempath}/passenger-${version}/ext/apache2/mod_passenger.so",
+            ensure => file,
+            require => Exec['passenger-install-apache2-module'];
+
+        '/etc/apache2/mods-available/passenger.conf':
+            content => template('rvm/passenger-apache.conf.erb'),
+            ensure => file,
+            require => Exec['passenger-install-apache2-module'];
+
+        '/etc/apache2/mods-enabled/passenger.load':
+            ensure => 'link',
+            target => '../mods-available/passenger.load',
+            require => File['/etc/apache2/mods-available/passenger.load'];
+
+        '/etc/apache2/mods-enabled/passenger.conf':
+            ensure => 'link',
+            target => '../mods-available/passenger.conf',
+            require => File['/etc/apache2/mods-available/passenger.conf'];
+    }
+
+    # Add Apache restart hooks
+    File['/etc/apache2/mods-available/passenger.load'] ~> Service['apache']
+    File['/etc/apache2/mods-available/passenger.conf'] ~> Service['apache']
+    File['/etc/apache2/mods-enabled/passenger.load']   ~> Service['apache']
+    File['/etc/apache2/mods-enabled/passenger.conf']   ~> Service['apache']
+}
+
+class ruby::passenger::apache::disable {
+
+    file {
+        '/etc/apache2/mods-enabled/passenger.load':
+            ensure => 'absent';
+        '/etc/apache2/mods-enabled/passenger.conf':
+            ensure => 'absent';
+    }
+
+    # Add Apache restart hooks
+    if defined(Service['apache']) { File['/etc/apache2/mods-enabled/passenger.load']   ~> Service['apache'] }
+    if defined(Service['apache']) { File['/etc/apache2/mods-enabled/passenger.conf']   ~> Service['apache'] }
+}
+
+class rvm::passenger::nginx(
+    $ruby_version = 'ruby-1.9.2-p290',
+    $version = '3.0.8',
+    $rvm_prefix = '/usr/local/',
+    $mininstances = '1',
+    $maxpoolsize = '6',
+    $poolidletime = '300',
+    $maxinstancesperapp = '0',
+    $spawnmethod = 'smart-lv2'
+) {
+
+    # TODO: How can we get the gempath automatically using the ruby version
+    # Can we read the output of a command into a variable?
+    # e.g. $gempath = `usr/local/bin/rvm ${ruby_version} exec rvm gemdir`
+    $gempath = "${rvm_prefix}rvm/gems/${ruby_version}/gems"
+    $binpath = $rvm_prefix ? {
+        '/usr/local/' => '/usr/local/bin/',
+        default => "${rvm_prefix}rvm/bin/"
+    }
+
+    # TODO: How to inherit this from above?
+    class { 'rvm::ruby': ruby_version => $ruby_version, rvm_prefix => $rvm_prefix }
+    class { 'rvm::passenger': ruby_version => $ruby_version, version => $version, rvm_prefix => $rvm_prefix }   
+
+    # Dependencies
+    if ! defined(Package['build-essential'])      { package { build-essential:      ensure => installed } }
+    if ! defined(Package['libcurl4-openssl-dev']) { package { libcurl4-openssl-dev: ensure => installed } }
+
+    exec {
+        'passenger-install-nginx-module':
+            command => "${binpath}rvm ${ruby_version} exec passenger-install-nginx-module --auto --auto-download",
+            creates => "${gempath}/passenger-${version}/ext/nginx/mod_passenger.so",
+            logoutput => 'on_failure',
+            require => [
+                Class['rvm::system'],
+                Exec['system-rvm'],
+                Exec['rvm-install-ruby'],
+                Exec['passenger-gem'],
+                Package[
+                    'build-essential',
+                    'libcurl4-openssl-dev'
+                ]
+            ];
+    }
+}

data/puppet/modules/rvm/manifests/classes/system.pp

@@ -0,0 +1,33 @@
+class rvm::system {
+
+  include rvm::dependencies
+
+  file {'install-system-rvm':
+    ensure => 'present',
+    path => '/root/install-system-rvm',
+    owner => 'root', group => 'root', mode => '0774',
+    source => 'puppet:///modules/rvm/install-system-rvm';
+  }
+
+  exec { 'system-rvm':
+    command => '/root/install-system-rvm',
+    require => [
+      File['install-system-rvm'],
+      Package['curl', 'git-core'],
+      Class['rvm::dependencies'],
+    ],
+    creates => '/usr/local/rvm';
+  }
+  
+  exec { 'rvm-get-head':
+    command => '/usr/local/rvm/bin/rvm get head',
+    require => [
+      Exec['system-rvm'],
+      File['install-system-rvm'],
+      Package['curl', 'git-core'],
+      Class['rvm::dependencies'],
+    ],
+    creates => '/usr/local/bin/rvm';
+  }
+
+}

data/puppet/modules/rvm/manifests/definitions/system_user.pp

@@ -0,0 +1,13 @@
+
+define rvm::system_user () {
+
+    $username = $title
+    $group = $operatingsystem ? {
+        default => 'rvm',
+    }
+
+    exec { "/usr/sbin/usermod -a -G $group $username":
+        unless => "cat /etc/group | grep $group | grep $username",
+        require => [User[$username], Exec['system-rvm']];
+    }
+}

data/puppet/modules/rvm/manifests/init.pp

@@ -0,0 +1,2 @@
+import "classes/*.pp"
+import "definitions/*.pp"

data/puppet/modules/rvm/templates/passenger-apache.conf.erb

@@ -0,0 +1,9 @@
+<IfModule passenger_module>
+    PassengerRoot <%= gempath %>/passenger-<%= version %>
+    PassengerRuby <%= rvm_prefix %>rvm/wrappers/<%= ruby_version %>/ruby
+    PassengerMaxPoolSize <%= maxpoolsize %>
+    PassengerPoolIdleTime <%= poolidletime %>
+    PassengerMinInstances <%= mininstances %>
+    PassengerMaxInstancesPerApp <%= maxinstancesperapp %>
+    PassengerSpawnMethod <%= spawnmethod %>
+</IfModule>

data/puppet/modules/ssh/README

@@ -0,0 +1,4 @@
+# Lab42 Puppet Infrastructure #
+# PROVIDED 'AS IS'
+
+

data/puppet/modules/ssh/manifests/auth.pp

@@ -0,0 +1,39 @@
+# Fake null class 
+
+class ssh::auth {
+
+define key ($ensure = "present", $filename = "", $force = false, $group = "puppet", $home = "", $keytype = "rsa", $length = 2048, $maxdays = "", $mindate = "", $options = "", $user = "") {
+
+} 
+
+
+class keymaster {
+} # class keymaster
+
+
+define client ($ensure = "", $filename = "", $group = "", $home = "", $user = "") {
+} # define client
+
+
+define server ($ensure = "", $group = "", $home = "", $options = "", $user = "") {
+} # define server
+
+} # class ssh::auth
+
+
+define ssh_auth_key_master ($ensure, $force, $keytype, $length, $maxdays, $mindate) {
+
+} # define ssh_auth_key_master
+
+define ssh_auth_key_client ($ensure, $filename, $group, $home, $user) {
+
+} # define ssh_auth_key_client
+
+define ssh_auth_key_server ($ensure, $group, $home, $options, $user) {
+
+} # define ssh_auth_key_server
+
+
+define ssh_auth_key_namecheck ($parm, $value) {
+} # define namecheck
+

data/puppet/modules/ssh/manifests/auth.pp.good

@@ -0,0 +1,340 @@
+# This class has been written by Andrew E. Schulman 
+# It has been imported in Example42 under the terms of GPL3  
+#
+# =========
+# ssh::auth
+# =========
+#
+# The latest official release and documentation for ssh::auth can always
+# be found at http://reductivelabs.com/trac/puppet/wiki/Recipes/ModuleSSHAuth .
+#
+# Version:          0.3.2
+# Release date:     2009-12-29
+
+class ssh::auth {
+
+$keymaster_storage = "/var/lib/keys" 
+
+Exec { path => "/usr/bin:/usr/sbin:/bin:/sbin" }
+Notify { withpath => false }
+
+
+##########################################################################
+
+
+# ssh::auth::key 
+
+# Declare keys.  The approach here is just to define a bunch of
+# virtual resources, representing key files on the keymaster, client,
+# and server.  The virtual keys are then realized by
+# ssh::auth::{keymaster,client,server}, respectively.  The reason for
+# doing things that way is that it makes ssh::auth::key into a "one
+# stop shop" where users can declare their keys with all of their
+# parameters, whether those parameters apply to the keymaster, server,
+# or client.  The real work of creating, installing, and removing keys
+# is done in the private definitions called by the virtual resources:
+# ssh_auth_key_{master,server,client}.
+
+define key ($ensure = "present", $filename = "", $force = false, $group = "puppet", $home = "", $keytype = "rsa", $length = 2048, $maxdays = "", $mindate = "", $options = "", $user = "") {
+
+  ssh_auth_key_namecheck { "${title}-title": parm => "title", value => $title }
+
+  # apply defaults
+  $_filename = $filename ? { "" => "id_${keytype}", default => $filename }
+  $_length = $keytype ? { "rsa" => $length, "dsa" => 1024 }
+  $_user = $user ? {
+    ""      => regsubst($title, '^([^@]*)@?.*$', '\1'),
+    default => $user,
+  }
+  $_home = $home ? { "" => "/home/$_user",  default => $home }
+
+  ssh_auth_key_namecheck { "${title}-filename": parm => "filename", value => $_filename }
+
+  @ssh_auth_key_master { $title:
+    ensure  => $ensure,
+    force   => $force,
+    keytype => $keytype,
+    length  => $_length,
+    maxdays => $maxdays,
+    mindate => $mindate,
+  }
+  @ssh_auth_key_client { $title:
+    ensure   => $ensure,
+    filename => $_filename,
+    group    => $group,
+    home     => $_home,
+    user     => $_user,
+  }
+  @ssh_auth_key_server { $title:
+    ensure  => $ensure,
+    group   => $group,
+    home    => $_home,
+    options => $options,
+    user    => $_user,
+  }
+}
+
+
+##########################################################################
+
+
+# ssh::auth::keymaster
+#
+# Keymaster host:
+# Create key storage; create, regenerate, and remove key pairs
+
+class keymaster {
+
+  # Set up key storage
+
+  file { $ssh::auth::keymaster_storage:
+    ensure => directory,
+    owner  => puppet,
+    group  => puppet,
+    mode   => 644,
+  }
+  
+  # Realize all virtual master keys
+  Ssh_auth_key_master <| |>
+
+} # class keymaster
+
+
+##########################################################################
+
+
+# ssh::auth::client
+#
+# Install generated key pairs onto clients
+
+define client ($ensure = "", $filename = "", $group = "", $home = "", $user = "") {
+
+  # Realize the virtual client keys.
+  # Override the defaults set in ssh::auth::key, as needed.
+  if $ensure   { Ssh_auth_key_client <| title == $title |> { ensure   => $ensure   } }
+  if $filename { Ssh_auth_key_client <| title == $title |> { filename => $filename } }
+  if $group    { Ssh_auth_key_client <| title == $title |> { group    => $group    } }
+
+  if $user { Ssh_auth_key_client <| title == $title |> { user => $user, home => "/home/$user" } }
+  if $home { Ssh_auth_key_client <| title == $title |> { home => $home } }
+
+  realize Ssh_auth_key_client[$title]
+
+} # define client
+
+
+##########################################################################
+
+
+# ssh::auth::server
+#
+# Install public keys onto clients
+
+define server ($ensure = "", $group = "", $home = "", $options = "", $user = "") {
+
+  # Realize the virtual server keys.
+  # Override the defaults set in ssh::auth::key, as needed.
+  if $ensure  { Ssh_auth_key_server <| title == $title |> { ensure  => $ensure  } }
+  if $group   { Ssh_auth_key_server <| title == $title |> { group   => $group   } }
+  if $options { Ssh_auth_key_server <| title == $title |> { options => $options } }
+
+  if $user { Ssh_auth_key_server <| title == $title |> { user => $user, home => "/home/$user" } }
+  if $home { Ssh_auth_key_server <| title == $title |> { home => $home } }
+
+  realize Ssh_auth_key_server[$title]
+
+} # define server
+
+} # class ssh::auth
+
+
+##########################################################################
+
+
+# ssh_auth_key_master
+#
+# Create/regenerate/remove a key pair on the keymaster.
+# This definition is private, i.e. it is not intended to be called directly by users.
+# ssh::auth::key calls it to create virtual keys, which are realized in ssh::auth::keymaster.
+
+define ssh_auth_key_master ($ensure, $force, $keytype, $length, $maxdays, $mindate) {
+
+  Exec { path => "/usr/bin:/usr/sbin:/bin:/sbin" }
+  File {
+    owner => puppet,
+    group => puppet,
+    mode  => 600,
+  }
+
+  $keydir = "${ssh::auth::keymaster_storage}/${title}"
+  $keyfile = "${keydir}/key"
+
+  file { 
+    "$keydir":
+      ensure => directory,
+      mode   => 644;
+    "$keyfile":
+      ensure => $ensure;
+    "${keyfile}.pub":
+      ensure => $ensure,
+      mode   => 644;
+  }
+
+  if $ensure == "present" {
+
+    # Remove the existing key pair, if
+    # * $force is true, or
+    # * $maxdays or $mindate criteria aren't met, or
+    # * $keytype or $length have changed
+
+    $keycontent = file("${keyfile}.pub", "/dev/null")
+    if $keycontent {
+
+      if $force {
+        $reason = "force=true"
+      }
+      if !$reason and $mindate and generate("/usr/bin/find", $keyfile, "!", "-newermt", "${mindate}") {
+        $reason = "created before ${mindate}"
+      }
+      if !$reason and $maxdays and generate("/usr/bin/find", $keyfile, "-mtime", "+${maxdays}") {
+        $reason = "older than ${maxdays} days"
+      }
+      if !$reason and $keycontent =~ /^ssh-... [^ ]+ (...) (\d+)$/ {
+        if       $keytype != $1 { $reason = "keytype changed: $1 -> $keytype" }
+        else { if $length != $2 { $reason = "length changed: $2 -> $length" } }
+      }
+      if $reason {
+        exec { "Revoke previous key ${title}: ${reason}":
+          command => "rm $keyfile ${keyfile}.pub",
+          before  => Exec["Create key $title: $keytype, $length bits"],
+        }
+      }
+    }
+
+    # Create the key pair.
+    # We "repurpose" the comment field in public keys on the keymaster to
+    # store data about the key, i.e. $keytype and $length.  This avoids
+    # having to rerun ssh-keygen -l on every key at every run to determine
+    # the key length.
+    exec { "Create key $title: $keytype, $length bits":
+      command => "ssh-keygen -t ${keytype} -b ${length} -f ${keyfile} -C \"${keytype} ${length}\" -N \"\"",
+      user    => "puppet",
+      group   => "puppet",
+      creates => $keyfile,
+      require => File[$keydir],
+      before  => File[$keyfile, "${keyfile}.pub"],
+    }
+
+  } # if $ensure  == "present"
+
+} # define ssh_auth_key_master
+
+
+##########################################################################
+
+
+# ssh_auth_key_client
+#
+# Install a key pair into a user's account.
+# This definition is private, i.e. it is not intended to be called directly by users.
+
+define ssh_auth_key_client ($ensure, $filename, $group, $home, $user) {
+
+  File {
+    owner   => $user,
+    group   => $group,
+    mode    => 600,
+    require => User[$user],
+  }
+
+  $key_src_file = "${ssh::auth::keymaster_storage}/${title}/key" # on the keymaster
+  $key_tgt_file = "${home}/.ssh/${filename}" # on the client
+
+  $key_src_content_pub = file("${key_src_file}.pub", "/dev/null")
+  if $ensure == "absent" or $key_src_content_pub =~ /^(ssh-...) ([^ ]+)/ {
+    $keytype = $1
+    $modulus = $2
+    file {
+      $key_tgt_file:
+        ensure  => $ensure,
+        content => file($key_src_file, "/dev/null");
+      "${key_tgt_file}.pub":
+        ensure  => $ensure,
+        content => "$keytype $modulus $title\n",
+        mode    => 644;
+    }
+  } else {
+    notify { "Private key file $key_src_file for key $title not found on keymaster; skipping ensure => present": }
+  }
+
+} # define ssh_auth_key_client
+
+
+##########################################################################
+
+
+# ssh_auth_key_server
+#
+# Install a public key into a server user's authorized_keys(5) file.
+# This definition is private, i.e. it is not intended to be called directly by users.
+
+define ssh_auth_key_server ($ensure, $group, $home, $options, $user) {
+
+  # on the keymaster:
+  $key_src_dir = "${ssh::auth::keymaster_storage}/${title}"
+  $key_src_file = "${key_src_dir}/key.pub"
+  # on the server:
+  $key_tgt_file = "${home}/.ssh/authorized_keys"
+  
+  File {
+    owner   => $user,
+    group   => $group,
+    require => User[$user],
+    mode    => 600,
+  }
+  Ssh_authorized_key {
+    user   => $user,
+    target => $key_tgt_file,
+  }
+
+  if $ensure == "absent" {
+    ssh_authorized_key { $title: ensure => "absent" }
+  }
+  else {
+    $key_src_content = file($key_src_file, "/dev/null")
+    if ! $key_src_content {
+      notify { "Public key file $key_src_file for key $title not found on keymaster; skipping ensure => present": }
+    } else { if $ensure == "present" and $key_src_content !~ /^(ssh-...) ([^ ]*)/ {
+      err("Can't parse public key file $key_src_file")
+      notify { "Can't parse public key file $key_src_file for key $title on the keymaster: skipping ensure => $ensure": }
+    } else {
+      $keytype = $1
+      $modulus = $2
+      ssh_authorized_key { $title:
+        ensure  => "present",
+        type    => $keytype,
+        key     => $modulus,
+        options => $options ? { "" => undef, default => $options },
+      }
+    }} # if ... else ... else
+  } # if ... else
+
+} # define ssh_auth_key_server
+
+
+##########################################################################
+
+
+# ssh_auth_key_namecheck
+#
+# Check a name (e.g. key title or filename) for the allowed form
+
+define ssh_auth_key_namecheck ($parm, $value) {
+  if $value !~ /^[A-Za-z0-9]/ {
+    fail("ssh::auth::key: $parm '$value' not allowed: must begin with a letter or digit")
+  }
+  if $value !~ /^[A-Za-z0-9_.:@-]+$/ {
+    fail("ssh::auth::key: $parm '$value' not allowed: may only contain the characters A-Za-z0-9_.:@-")
+  }
+} # define namecheck
+

data/puppet/modules/ssh/manifests/eal4.pp

@@ -0,0 +1,69 @@
+class ssh::eal4 {
+
+    # Cripto settings
+    ssh::config { Protocol:
+        value => "2",
+    }
+
+    ssh::config { Ciphers:
+        value => "3des-cbc",
+    }
+
+    # X11 forwarding (You MAY allow)
+    ssh::config { X11Forwarding:
+        value => "no",
+    }
+
+
+    # Login settings
+    ssh::config { UsePAM:
+        value => "yes",
+    }
+
+    ssh::config { PermitRootLogin:
+        value => "no",
+    }
+
+    ssh::config { PermitEmptyPasswords:
+        value => "no",
+    }
+
+    ssh::config { PasswordAuthentication:
+        value => "no",
+    }
+
+    ssh::config { ChallengeResponseAuthentication:
+        value => "yes",
+    }
+
+    # Disables other authentication methods (you MAY want to change some of these settings)
+
+    ssh::config { IgnoreRhosts:
+        value => "yes",
+    }
+
+    ssh::config { HostbasedAuthentication:
+        value => "no",
+    }
+
+    ssh::config { PubkeyAuthentication:
+        value => "no",
+    }
+
+    ssh::config { RhostsRSAAuthentication:
+        value => "no",
+    }
+
+    ssh::config { RSAAuthentication:
+        value => "no",
+    }
+
+    ssh::config { KerberosAuthentication:
+        value => "no",
+    }
+
+    ssh::config { GSSAPIAuthentication:
+        value => "no",
+    }
+
+}