Squashed 'puppet/' changes from 26c7b4f..8f7043a

8f7043a Disable backup on puppet-bootstrap.example.org
ea035ff Hiera: change domain and location eval order
f418291 Adds default node
096b65a Removes darkice module
7663170 Updates TODO
d03a934 Deploy: cleanup
66bd115 Deploy: fixes
51b00aa Deploy: apply patches before deployment (2)
fc08d8d Deploy: apply patches before deployment
89cc9aa Typo
e0169de Masterless puppet is supported
a23b6a0 TODO: apply patches
49c4466 Patches, deployment code and TODO update
91477be Use settings::confdir on hiera datadir
381096e TODO cleanup
3d3eb59 Updates TODO
57c6940 Hiera fixes
5a2de12 New hiera scheme for secrets storage
4fc808f Get rid of environments, use git branches instead
47bc020 Updates mrconfig
0d32fa5 New canonical URL
08cd538 Updates TODO
4cfe7fb Site manifests
ff61a20 Updates TODO
20f7608 Adds git hooks for push-to-deploy
6759fe7 Another LAMP example
a461d98 Really remove bootstrap from mrconfig
1920fba Vagrant: apache user and group
f13cb8a Formatting
7425fad Adds puppet-bootstrap.example.org.yaml
4647b02 Vagrant: LAMP example
42ce487 Vagrantfile: example of forwarded port
328873a Fix default hostname
41c9d89 Vagrantfile: set fqdn
72f61db Switch to parametrized classes
fd90a64 Vagrant hostname
43816c7 Vagrantfile minor edit
1932d55 Updates mrconfig
39fa2d5 Fix hiera path
df5df0b Submodules: force
e0b4ebe Updates TODO
ee7491e Updates TODO
65746ac TODO: syslog-ng
fe79512 TODO: modules
60a3d68 TODO update
a7e3e4c Storeconfigs support for vagrant/jessie
0d6de38 Coding style
28bd7e2 Default empty keys.d folder
d33c587 Shell provisioner sudo fix
47c83e6 Vagrant provisioning fixes
6f0a560 Removes VIM modelines from Vagrantfile
c9e8e7a Call nodo as a parametrized class
3730114 More changes for puppet 3.x
106977f Remove import definitions (deprecated since puppet 3.x)
3c13239 TODO update
5491a52 Mock puppet.conf with environment config
133e36b Initial changes for jessie
67baef2 Git and cgit vhosts
097b8ec Nginx: dhparams

git-subtree-dir: puppet
git-subtree-split: 8f7043a8948b3236d3c2582c865b27af4613c632

diff --git a/.mrconfig b/.mrconfig
index 8731bee33ba7b1697da54557bdd2b166c47122ad..5c24dc7405fe31ac97daf99e8f9f31c38890b455 100644 (file)
--- a/.mrconfig
+++ b/.mrconfig
@@ -1,258 +1,255 @@
 
 [puppet/modules/apache]
-checkout = git clone git://git.sarava.org/puppet-apache.git apache
+checkout = git clone git://git.fluxo.info/puppet-apache.git apache
 
 [puppet/modules/apcupsd]
-checkout = git clone git://git.sarava.org/puppet-apcupsd.git apcupsd
+checkout = git clone git://git.fluxo.info/puppet-apcupsd.git apcupsd
 
 [puppet/modules/apparmor]
-checkout = git clone git://git.sarava.org/puppet-apparmor.git apparmor
+checkout = git clone git://git.fluxo.info/puppet-apparmor.git apparmor
 
 [puppet/modules/apt]
-checkout = git clone git://git.sarava.org/puppet-apt.git apt
+checkout = git clone git://git.fluxo.info/puppet-apt.git apt
 
 [puppet/modules/autofs]
-checkout = git clone git://git.sarava.org/puppet-autofs.git autofs
+checkout = git clone git://git.fluxo.info/puppet-autofs.git autofs
 
 [puppet/modules/autossh]
-checkout = git clone git://git.sarava.org/puppet-autossh.git autossh
+checkout = git clone git://git.fluxo.info/puppet-autossh.git autossh
 
 [puppet/modules/avahi]
-checkout = git clone git://git.sarava.org/puppet-avahi.git avahi
+checkout = git clone git://git.fluxo.info/puppet-avahi.git avahi
 
 [puppet/modules/backup]
-checkout = git clone git://git.sarava.org/puppet-backup.git backup
+checkout = git clone git://git.fluxo.info/puppet-backup.git backup
 
 [puppet/modules/backupninja]
-checkout = git clone git://git.sarava.org/puppet-backupninja.git backupninja
+checkout = git clone git://git.fluxo.info/puppet-backupninja.git backupninja
 
 [puppet/modules/bind]
-checkout = git clone git://git.sarava.org/puppet-bind.git bind
+checkout = git clone git://git.fluxo.info/puppet-bind.git bind
 
 [puppet/modules/bitcoind]
-checkout = git clone git://git.sarava.org/puppet-bitcoind.git bitcoind
-
-[puppet/modules/bootstrap]
-checkout = git clone git://git.sarava.org/puppet-bootstrap.git bootstrap
+checkout = git clone git://git.fluxo.info/puppet-bitcoind.git bitcoind
 
 [puppet/modules/common]
-checkout = git clone git://git.sarava.org/puppet-common.git common
+checkout = git clone git://git.fluxo.info/puppet-common.git common
 
 [puppet/modules/concat]
-checkout = git clone git://git.sarava.org/puppet-concat.git concat
+checkout = git clone git://git.fluxo.info/puppet-concat.git concat
 
 [puppet/modules/cron]
-checkout = git clone git://git.sarava.org/puppet-cron.git cron
+checkout = git clone git://git.fluxo.info/puppet-cron.git cron
 
 [puppet/modules/daap_server]
-checkout = git clone git://git.sarava.org/puppet-daap_server.git daap_server
-
-[puppet/modules/darkice]
-checkout = git clone git://git.sarava.org/puppet-darkice.git darkice
+checkout = git clone git://git.fluxo.info/puppet-daap_server.git daap_server
 
 [puppet/modules/database]
-checkout = git clone git://git.sarava.org/puppet-database.git database
+checkout = git clone git://git.fluxo.info/puppet-database.git database
 
 [puppet/modules/dhcp]
-checkout = git clone git://git.sarava.org/puppet-dhcp.git dhcp
+checkout = git clone git://git.fluxo.info/puppet-dhcp.git dhcp
 
 [puppet/modules/domain_check]
-checkout = git clone git://git.sarava.org/puppet-domain_check.git domain_check
+checkout = git clone git://git.fluxo.info/puppet-domain_check.git domain_check
 
 [puppet/modules/drupal]
-checkout = git clone git://git.sarava.org/puppet-drupal.git drupal
+checkout = git clone git://git.fluxo.info/puppet-drupal.git drupal
 
 [puppet/modules/dyndns]
-checkout = git clone git://git.sarava.org/puppet-dyndns.git dyndns
+checkout = git clone git://git.fluxo.info/puppet-dyndns.git dyndns
 
 [puppet/modules/ejabberd]
-checkout = git clone git://git.sarava.org/puppet-ejabberd.git ejabberd
+checkout = git clone git://git.fluxo.info/puppet-ejabberd.git ejabberd
 
 [puppet/modules/ekeyd]
-checkout = git clone git://git.sarava.org/puppet-ekeyd.git ekeyd
+checkout = git clone git://git.fluxo.info/puppet-ekeyd.git ekeyd
 
 [puppet/modules/etherpad]
-checkout = git clone git://git.sarava.org/puppet-etherpad.git etherpad
+checkout = git clone git://git.fluxo.info/puppet-etherpad.git etherpad
 
 [puppet/modules/exim]
-checkout = git clone git://git.sarava.org/puppet-exim.git exim
+checkout = git clone git://git.fluxo.info/puppet-exim.git exim
 
 [puppet/modules/firewall]
-checkout = git clone git://git.sarava.org/puppet-firewall.git firewall
+checkout = git clone git://git.fluxo.info/puppet-firewall.git firewall
 
 [puppet/modules/git]
-checkout = git clone git://git.sarava.org/puppet-git.git git
+checkout = git clone git://git.fluxo.info/puppet-git.git git
 
 [puppet/modules/hotglue]
-checkout = git clone git://git.sarava.org/puppet-hotglue.git hotglue
+checkout = git clone git://git.fluxo.info/puppet-hotglue.git hotglue
 
 [puppet/modules/hydra]
-checkout = git clone git://git.sarava.org/puppet-hydra.git hydra
+checkout = git clone git://git.fluxo.info/puppet-hydra.git hydra
 
 [puppet/modules/icecast]
-checkout = git clone git://git.sarava.org/puppet-icecast.git icecast
+checkout = git clone git://git.fluxo.info/puppet-icecast.git icecast
 
 [puppet/modules/ikiwiki]
-checkout = git clone git://git.sarava.org/puppet-ikiwiki.git ikiwiki
+checkout = git clone git://git.fluxo.info/puppet-ikiwiki.git ikiwiki
 
 [puppet/modules/inetd]
-checkout = git clone git://git.sarava.org/puppet-inetd.git inetd
+checkout = git clone git://git.fluxo.info/puppet-inetd.git inetd
 
 [puppet/modules/infinoted]
-checkout = git clone git://git.sarava.org/puppet-infinoted.git infinoted
+checkout = git clone git://git.fluxo.info/puppet-infinoted.git infinoted
 
 [puppet/modules/inifile]
-checkout = git clone git://git.sarava.org/puppet-inifile.git inifile
+checkout = git clone git://git.fluxo.info/puppet-inifile.git inifile
 
 [puppet/modules/lighttpd]
-checkout = git clone git://git.sarava.org/puppet-lighttpd.git lighttpd
+checkout = git clone git://git.fluxo.info/puppet-lighttpd.git lighttpd
 
 [puppet/modules/lsb]
-checkout = git clone git://git.sarava.org/puppet-lsb.git lsb
+checkout = git clone git://git.fluxo.info/puppet-lsb.git lsb
 
 [puppet/modules/mail]
-checkout = git clone git://git.sarava.org/puppet-mail.git mail
+checkout = git clone git://git.fluxo.info/puppet-mail.git mail
 
 [puppet/modules/minidlna]
-checkout = git clone git://git.sarava.org/puppet-minidlna.git minidlna
+checkout = git clone git://git.fluxo.info/puppet-minidlna.git minidlna
 
 [puppet/modules/moin]
-checkout = git clone git://git.sarava.org/puppet-moin.git moin
+checkout = git clone git://git.fluxo.info/puppet-moin.git moin
 
 [puppet/modules/monkeysphere]
-checkout = git clone git://git.sarava.org/puppet-monkeysphere.git monkeysphere
+checkout = git clone git://git.fluxo.info/puppet-monkeysphere.git monkeysphere
 
 [puppet/modules/motion]
-checkout = git clone git://git.sarava.org/puppet-motion.git motion
+checkout = git clone git://git.fluxo.info/puppet-motion.git motion
 
 [puppet/modules/mpd]
-checkout = git clone git://git.sarava.org/puppet-mpd.git mpd
+checkout = git clone git://git.fluxo.info/puppet-mpd.git mpd
 
 [puppet/modules/mumble]
-checkout = git clone git://git.sarava.org/puppet-mumble.git mumble
+checkout = git clone git://git.fluxo.info/puppet-mumble.git mumble
 
 [puppet/modules/munin]
-checkout = git clone git://git.sarava.org/puppet-munin.git munin
+checkout = git clone git://git.fluxo.info/puppet-munin.git munin
 
 [puppet/modules/mysql]
-checkout = git clone git://git.sarava.org/puppet-mysql.git mysql
+checkout = git clone git://git.fluxo.info/puppet-mysql.git mysql
 
 [puppet/modules/nagios]
-checkout = git clone git://git.sarava.org/puppet-nagios.git nagios
+checkout = git clone git://git.fluxo.info/puppet-nagios.git nagios
 
 [puppet/modules/nfs]
-checkout = git clone git://git.sarava.org/puppet-nfs.git nfs
+checkout = git clone git://git.fluxo.info/puppet-nfs.git nfs
 
 [puppet/modules/nginx]
-checkout = git clone git://git.sarava.org/puppet-nginx.git nginx
+checkout = git clone git://git.fluxo.info/puppet-nginx.git nginx
 
 [puppet/modules/nodo]
-checkout = git clone git://git.sarava.org/puppet-nodo.git nodo
+checkout = git clone git://git.fluxo.info/puppet-nodo.git nodo
 
 [puppet/modules/ntp]
-checkout = git clone git://git.sarava.org/puppet-ntp.git ntp
+checkout = git clone git://git.fluxo.info/puppet-ntp.git ntp
 
 [puppet/modules/onion]
-checkout = git clone git://git.sarava.org/puppet-onion.git onion
+checkout = git clone git://git.fluxo.info/puppet-onion.git onion
 
 [puppet/modules/pear]
-checkout = git clone git://git.sarava.org/puppet-pear.git pear
+checkout = git clone git://git.fluxo.info/puppet-pear.git pear
 
 [puppet/modules/php]
-checkout = git clone git://git.sarava.org/puppet-php.git php
+checkout = git clone git://git.fluxo.info/puppet-php.git php
 
 [puppet/modules/pmwiki]
-checkout = git clone git://git.sarava.org/puppet-pmwiki.git pmwiki
+checkout = git clone git://git.fluxo.info/puppet-pmwiki.git pmwiki
 
 [puppet/modules/postfix]
-checkout = git clone git://git.sarava.org/puppet-postfix.git postfix
+checkout = git clone git://git.fluxo.info/puppet-postfix.git postfix
 
 [puppet/modules/puppet]
-checkout = git clone git://git.sarava.org/puppet-puppet.git puppet
+checkout = git clone git://git.fluxo.info/puppet-puppet.git puppet
 
 [puppet/modules/pureftpd]
-checkout = git clone git://git.sarava.org/puppet-pureftpd.git pureftpd
+checkout = git clone git://git.fluxo.info/puppet-pureftpd.git pureftpd
 
 [puppet/modules/pyroscope]
-checkout = git clone git://git.sarava.org/puppet-pyroscope.git pyroscope
+checkout = git clone git://git.fluxo.info/puppet-pyroscope.git pyroscope
 
 [puppet/modules/qwebirc]
-checkout = git clone git://git.sarava.org/puppet-qwebirc.git qwebirc
+checkout = git clone git://git.fluxo.info/puppet-qwebirc.git qwebirc
 
 [puppet/modules/reprepro]
-checkout = git clone git://git.sarava.org/puppet-reprepro.git reprepro
+checkout = git clone git://git.fluxo.info/puppet-reprepro.git reprepro
 
 [puppet/modules/resolvconf]
-checkout = git clone git://git.sarava.org/puppet-resolvconf.git resolvconf
+checkout = git clone git://git.fluxo.info/puppet-resolvconf.git resolvconf
 
 [puppet/modules/rng-tools]
-checkout = git clone git://git.sarava.org/puppet-rng-tools.git rng-tools
+checkout = git clone git://git.fluxo.info/puppet-rng-tools.git rng-tools
 
 [puppet/modules/rsync]
-checkout = git clone git://git.sarava.org/puppet-rsync.git rsync
+checkout = git clone git://git.fluxo.info/puppet-rsync.git rsync
 
 [puppet/modules/runit]
-checkout = git clone git://git.sarava.org/puppet-runit.git runit
+checkout = git clone git://git.fluxo.info/puppet-runit.git runit
 
 [puppet/modules/samba]
-checkout = git clone git://git.sarava.org/puppet-samba.git samba
+checkout = git clone git://git.fluxo.info/puppet-samba.git samba
 
 [puppet/modules/schroot]
-checkout = git clone git://git.sarava.org/puppet-schroot.git schroot
+checkout = git clone git://git.fluxo.info/puppet-schroot.git schroot
 
 [puppet/modules/shorewall]
-checkout = git clone git://git.sarava.org/puppet-shorewall.git shorewall
+checkout = git clone git://git.fluxo.info/puppet-shorewall.git shorewall
 
 [puppet/modules/smartmonster]
-checkout = git clone git://git.sarava.org/puppet-smartmonster.git smartmonster
+checkout = git clone git://git.fluxo.info/puppet-smartmonster.git smartmonster
 
 [puppet/modules/smartmontools]
-checkout = git clone git://git.sarava.org/puppet-smartmontools.git smartmontools
+checkout = git clone git://git.fluxo.info/puppet-smartmontools.git smartmontools
 
 [puppet/modules/sshd]
-checkout = git clone git://git.sarava.org/puppet-sshd.git sshd
+checkout = git clone git://git.fluxo.info/puppet-sshd.git sshd
 
 [puppet/modules/ssl]
-checkout = git clone git://git.sarava.org/puppet-ssl.git ssl
+checkout = git clone git://git.fluxo.info/puppet-ssl.git ssl
+
+[puppet/modules/stdlib]
+checkout = git clone git://git.fluxo.info/puppet-stdlib.git stdlib
 
 [puppet/modules/supervisor]
-checkout = git clone git://git.sarava.org/puppet-supervisor.git supervisor
+checkout = git clone git://git.fluxo.info/puppet-supervisor.git supervisor
 
 [puppet/modules/supybot]
-checkout = git clone git://git.sarava.org/puppet-supybot.git supybot
+checkout = git clone git://git.fluxo.info/puppet-supybot.git supybot
 
 [puppet/modules/syslog-ng]
-checkout = git clone git://git.sarava.org/puppet-syslog-ng.git syslog-ng
+checkout = git clone git://git.fluxo.info/puppet-syslog-ng.git syslog-ng
 
 [puppet/modules/tftp]
-checkout = git clone git://git.sarava.org/puppet-tftp.git tftp
+checkout = git clone git://git.fluxo.info/puppet-tftp.git tftp
 
 [puppet/modules/tor]
-checkout = git clone git://git.sarava.org/puppet-tor.git tor
+checkout = git clone git://git.fluxo.info/puppet-tor.git tor
 
 [puppet/modules/trac]
-checkout = git clone git://git.sarava.org/puppet-trac.git trac
+checkout = git clone git://git.fluxo.info/puppet-trac.git trac
 
 [puppet/modules/tunnel]
-checkout = git clone git://git.sarava.org/puppet-tunnel.git tunnel
+checkout = git clone git://git.fluxo.info/puppet-tunnel.git tunnel
 
 [puppet/modules/user]
-checkout = git clone git://git.sarava.org/puppet-user.git user
+checkout = git clone git://git.fluxo.info/puppet-user.git user
 
 [puppet/modules/vcsrepo]
-checkout = git clone git://git.sarava.org/puppet-vcsrepo.git vcsrepo
+checkout = git clone git://git.fluxo.info/puppet-vcsrepo.git vcsrepo
 
 [puppet/modules/viewvc]
-checkout = git clone git://git.sarava.org/puppet-viewvc.git viewvc
+checkout = git clone git://git.fluxo.info/puppet-viewvc.git viewvc
 
 [puppet/modules/virtual]
-checkout = git clone git://git.sarava.org/puppet-virtual.git virtual
+checkout = git clone git://git.fluxo.info/puppet-virtual.git virtual
 
 [puppet/modules/websites]
-checkout = git clone git://git.sarava.org/puppet-websites.git websites
+checkout = git clone git://git.fluxo.info/puppet-websites.git websites
 
 [puppet/modules/websvn]
-checkout = git clone git://git.sarava.org/puppet-websvn.git websvn
+checkout = git clone git://git.fluxo.info/puppet-websvn.git websvn
 
 [puppet/modules/wordpress]
-checkout = git clone git://git.sarava.org/puppet-wordpress.git wordpress
+checkout = git clone git://git.fluxo.info/puppet-wordpress.git wordpress

diff --git a/Makefile b/Makefile
index 220927120d52b422c309c43b8f0da644eb021880..97c4a58c998b71fce59887516a6f350e3405526e 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -7,7 +7,7 @@
 #
 # This Makefile is distributed in the hope that it will be useful, but WITHOUT
 # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-# #  FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License along with
 # this program; if not, write to the Free Software Foundation, Inc., 59 Temple
@@ -15,7 +15,7 @@
 #
 
 CWD    = $(shell pwd)
-REPO   = git://git.sarava.org/puppet-bootstrap.git
+REPO   = git://git.fluxo.info/puppet-bootstrap.git
 PUPPET = FACTER_BOOTSTRAP_PATH="$(CWD)" puppet apply --confdir="$(CWD)" --modulepath=modules
 
 all: deps remote modules config
@@ -57,3 +57,11 @@ clean:
        rm -rf ssl
        rm -rf modules
        git checkout modules
+
+post_update:
+       git config receive.denyCurrentBranch ignore
+       cd .git/hooks && ln -sf ../../bin/post-update
+
+post_receive:
+       git config receive.denyCurrentBranch ignore
+       cd .git/hooks && ln -sf ../../bin/post-receive

diff --git a/README.md b/README.md
index 67dad5fd0b5ed9ef1affb3bb879a8448d05f6908..bb5375d38728eb8d52035e8406ea465e731cc966 100644 (file)
--- a/README.md
+++ b/README.md
@@ -5,14 +5,14 @@ This is a multi-purpose but very specific puppet module which can be used:
 
 * As the base repository for a puppet infrastructure.
 * As a standalone provisioner for boxes, with Vagrant support.
-* It can be optionally used together with the Hydra Suite from https://git.sarava.org/?p=hydra.git
+* It can be optionally used together with the Hydra Suite from https://git.fluxo.info/hydra.git
 
-Setting up a new puppetmaster repository
-----------------------------------------
+Setting up a new puppet repository
+----------------------------------
 
 You'll basically use the `bootstrap` repository as your `puppet` repository:
 
-    git clone git://git.sarava.org/puppet-bootstrap.git puppet
+    git clone git://git.fluxo.info/puppet-bootstrap.git puppet
     cd puppet && git tag -v # check integrity
     make deps               # install dependencies
     make submodules         # add all needed puppet module as as git submodules
@@ -24,7 +24,7 @@ Using as a standalone provisioner
 This will be a `Vagrant` example:
 
     cd your-project
-    git clone git://git.sarava.org/puppet-bootstrap.git puppet # use submodule or subtree as you please
+    git clone git://git.fluxo.info/puppet-bootstrap.git puppet # use submodule or subtree as you please
     ln -s puppet/Vagrantfile                                   # or copy if you want to customize
     ( cd puppet && make modules )                              # need the mr binary to download the submodules
     vagrant up web                                             # with no arguments, all defined VMs are started

diff --git a/TODO.md b/TODO.md
index c773654fbbac64502ca38c20cb5950f560239d1c..429bd4d42b04fdb9ff9393c70c5ebafa48fec245 100644 (file)
--- a/TODO.md
+++ b/TODO.md
@@ -1,7 +1,141 @@
 TODO
 ====
 
-* Minimal manifest for fast provisioning.
-* Update to new nodo style (hiera and nodo::role).
-* Support for recursive clones in `bin/mrconfig`.
-* Test!
+High priority
+-------------
+
+- puppet: masterless:
+  - keyringer/gpg integration.
+    - https://github.com/compete/hiera_yamlgpg
+    - https://github.com/crayfishx/hiera-gpg
+    - https://github.com/sihil/hiera-eyaml-gpg
+    - https://github.com/StackExchange/blackbox
+    - http://ww.telent.net/2014/2/10/keeping_secrets_in_public_with_puppet
+    - https://docs.puppetlabs.com/hiera/1/custom_backends.html
+    - https://puppetlabs.com/blog/encrypt-your-data-using-hiera-eyaml
+    - https://packages.debian.org/jessie/hiera-eyaml
+  - how to distribute keys outside the repo (i.e, avoiding all nodes to have all keys?):
+    - add a monkeysphere auth subkey to every openpgp key used for backups.
+    - make backupninja wrap around monkeysphere: http://web.monkeysphere.info/doc/user-ssh-advanced/
+  - http://current.workingdirectory.net/posts/2011/puppet-without-masters/
+  - http://andrewbunday.co.uk/2012/12/04/masterless-puppet-wrapper/
+  - http://semicomplete.com/presentations/puppet-at-loggly/puppet-at-loggly.pdf.html
+  - https://github.com/jordansissel/puppet-examples/tree/master/masterless
+- sshd:
+  - https://stribika.github.io/2015/01/04/secure-secure-shell.html
+  - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774711#60
+  - enable ecdsa key.
+  - ecdsa priority: alternatives:
+    - unsupport ecdsa in the server.
+    - export ecdsa pubkeys.
+    - manage client's /root/.ssh/config: `HostKeyAlgorithms ssh-rsa`.
+    - force option via rsync/rdiff handlers.
+- virtual: migrate to kvm/libvirt.
+- loginrecords: deploy module.
+- deploy https://github.com/wido/puppet-module-tcpwrappers
+- nodo:
+  - run stages.
+  - allow more resources to be declared via hiera.
+  - fix hiera default boolean value when true.
+  - easy way to toggle management of subsystems.
+
+Medium priority
+---------------
+
+- apt: raspbian support, including unnatended-upgrades.
+- backup:
+  - support for $dombr and $dobios on backupninja::sys for servers and physical machines.
+  - sync-backups support for rsyncing from kvms / snapshots.
+- nodo:
+  - cleanup and refactor.
+  - uniform variable names.
+  - use prompt.sh from bash-prompt as a submodule.
+- common: autoload.
+- general:
+  - rollback of commits about charset.
+  - switch to conf.d:
+    - php ("refactor" branch), remove E_STRICT from production's error_reporting.
+    - apache2.
+    - sudoers.
+- backup: `sync-media-iterate [volume]`.
+- mail:
+  - use ssl::dhparams, move to 2048 bit and use the standard file names and paths:
+    - [Feature #4012: postfix: ship 2048bit dh parameters - Platform - LEAP Issue Tracker](https://leap.se/code/issues/4012)
+
+Low priority
+------------
+
+- merge, review, pull requests for all modules.
+- bind: nsupdate / dynamic dns:
+  - http://linux.yyz.us/nsupdate/
+  - http://linux.yyz.us/dns/ddns-server.html
+  - http://caunter.ca/nsupdate.txt
+  - http://www.rtfm-sarl.ch/articles/using-nsupdate.html
+  - https://github.com/skx/dhcp.io/
+- munin: lvm monitoring.
+- pyroscope: torrent workflow: torrent-maker, magnet2torrent and torrent-reseed:
+  - http://wiki.rtorrent.org/MagnetUri
+  - http://dan.folkes.me/2012/04/19/converting-a-magnet-link-into-a-torrent/
+  - https://github.com/danfolkes/Magnet2Torrent
+  - http://code.google.com/p/pyroscope/wiki/CommandLineTools
+  - https://trac.transmissionbt.com/ticket/4176
+  - http://wiki.rtorrent.org/MagnetUri
+  - https://github.com/rakshasa/rtorrent/issues/212
+  - saving/restoring `.meta` and `~/rtorrent/.session` files.
+- support for http/https proxy inside web nodes:
+  - encrypted ssl keys: http://support.f5.com/kb/en-us/solutions/public/11000/400/sol11440.html
+  - make all apache sites listen to 8080.
+- git:
+  - gitolite: [monkeysphere integration](http://gitolite.com/gitolite/g2/monkeysphere.html).
+  - gitweb clean urls.
+  - email notifications.
+    - https://packages.debian.org/jessie/git-notifier
+    - https://github.com/mhagger/git-multimail
+    - using OpenPGP?
+- syslog-ng: use conf.d.
+- etherpad: `You need to set a sessionKey value in settings.json`.
+- knock integration via https://github.com/juasiepo/knockd
+- apache:
+  - try libapache2-modsecurity.
+  - deploy https://git.immerda.ch/csp-report/
+  - disable other_vhosts_access.log.
+- onion:
+  - support for existing hidden service key, generated with tools like https://github.com/katmagic/Shallot
+  - load balancing: http://archives.seul.org/tor/relays/Apr-2011/msg00022.html
+- nagios: snmp, nrpe, nsca
+  - http://nagios.sourceforge.net/docs/3_0/addons.html
+  - http://www.math.wisc.edu/~jheim/snmp/
+- ssh access restrictions:
+  - denyhosts, but we don't want to log IPs.
+  - using shorewall: http://www.debian-administration.org/articles/250#comment_16
+    - alowed users / groups.
+- websites: freewvs.
+- puppet: bug report: debian wheezy puppet-common: needs the following patch: http://projects.puppetlabs.com/issues/10963
+- mail:
+  - review dovecot recipient delimiter handling: to which mailbox messages should be sent?
+  - mlmmj:
+    - lists with hyphens are not working when mails are sent directly, but work when sent to an alias.
+    - `mail::mlmmj::domain` needs updating or additional domains should be added into `relay_domains`.
+- drupal/wordpress:
+  - cronjob/cli: switch to site user.
+  - drupal_update: Do you really want to continue with the update process? (y/n):
+    Do you really want to continue with the update process? (y/n): Aborting. [cancel],
+    possibly related to https://www.drupal.org/node/443392
+- php / wordpress / wp-cli: composer installation and dependencies:
+  - http://getcomposer.org/doc/00-intro.md#installation-nix
+  - https://github.com/wp-cli/wp-cli/wiki/Alternative-Install-Methods
+  - suhosin needs `suhosin.executor.include.whitelist = phar` on `/etc/php5/cli/conf.d/suhosin.ini`.
+- nodo: support for prosody:
+  - https://github.com/dgoulet/prosody-otr
+  - http://prosody.im/doc/creating_accounts#importing_from_ejabberd
+  - config with good score at https://xmpp.net/index.php
+- mail:
+  - support for [preventing SPAM connections with bird](http://www.debian-administration.org/article/715/Preventing_SPAM_connections_with_bird.).
+  - schleuder: manage `/etc/schleuder/schleuder.conf`, using `superadminaddr: root` or other recipient, to avoid mails.
+    sent as `root@localhost`.
+  - deploy https://git.autistici.org/ale/smtp-fp/tree/master
+           https://github.com/EFForg/starttls-everywhere
+  - deploy https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration#Configuration_server_at_ISP
+           https://git-ipuppet.immerda.ch/module-apache/commit/?id=058dbb366b96cae1f8fb0def65f73a698f1c375d
+           https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577616
+  - support for [preventing SPAM connections with bird](http://www.debian-administration.org/article/715/Preventing_SPAM_connections_with_bird.).

diff --git a/Vagrantfile b/Vagrantfile
index 8999cf010b9e987076ddbcfae39cb0c2046e7b2b..3ee05e68869306e69356cecfa023266ad09be809 100644 (file)
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -1,9 +1,12 @@
-# -*- mode: ruby -*-
-# vi: set ft=ruby :
+# Vagrantfile API/syntax version. Don't touch unless you know what you're doing!
+VAGRANTFILE_API_VERSION = "2"
 
-Vagrant::Config.run do |config|
+Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
   # Every Vagrant virtual environment requires a box to build off of.
-  config.vm.box = "wheezy"
+  config.vm.box = "jessie"
+
+  # Hostname
+  config.vm.hostname = "puppet-bootstrap.example.org"
 
   # Shell provisioner to setup basic environment.
   config.vm.provision :shell, :inline => "/vagrant/puppet/bin/provision"
@@ -13,49 +16,14 @@ Vagrant::Config.run do |config|
     puppet.manifest_file     = "bootstrap/vagrant.pp"
     puppet.manifests_path    = "puppet/manifests"
     puppet.module_path       = "puppet/modules"
+    puppet.hiera_config_path = "puppet/hiera.yaml"
     puppet.temp_dir          = "/etc/puppet"
     puppet.working_directory = "/etc/puppet"
   end
 
-  # Define a Host VM
-  config.vm.define :host do |host_config|
-    db_config.vm.box = "host"
-    web_config.vm.network :hostonly, "192.168.50.101"
-  end
-
-  # Define a Puppetmaster VM
-  config.vm.define :master do |master_config|
-    master_config.vm.box = "master"
-    master_config.vm.forward_port 8139, 8140
-    web_config.vm.network :hostonly, "192.168.50.102"
-  end
-
-  # Define a Proxy VM
-  config.vm.define :proxy do |proxy_config|
-    proxy_config.vm.box = "proxy"
-    proxy_config.vm.forward_port 8139, 8140
-    web_config.vm.network :hostonly, "192.168.50.103"
-  end
-
-  # Define a Web VM
-  config.vm.define :web do |web_config|
-    web_config.vm.box = "web"
-    web_config.vm.forward_port 80, 8080
-    web_config.vm.network :hostonly, "192.168.50.104"
-  end
-
-  # Define a Storage VM
-  config.vm.define :storage do |storage_config|
-    storage_config.vm.box = "storage"
-    storage_config.vm.network :hostonly, "192.168.50.105"
-  end
-
-  # Define a Test VM
-  config.vm.define :test do |test_config|
-    test_config.vm.box = "test"
-    test_config.vm.network :hostonly, "192.168.50.106"
-  end
-
   # Share hiera configuration.
-  config.vm.share_folder "hiera", "/etc/puppet/hiera", "puppet/hiera", create: true
+  config.vm.synced_folder "puppet/hiera", "/etc/puppet/hiera"
+
+  # Forwarded ports
+  #config.vm.network "forwarded_port", guest: 80, host: 8081
 end

diff --git a/bin/dependencies b/bin/dependencies
index 78ca659c08676ed61d4c5a89cfdae28552132932..507145ba4004518bf86aafc279138dc0a67b9f32 100755 (executable)
--- a/bin/dependencies
+++ b/bin/dependencies
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Simple shell provisioner for Vagrant instances.
+# Puppet bootstrap dependencies.
 #
 
 # Install a package, thanks to the Hydra Suite.
@@ -13,16 +13,16 @@ function provision_package {
 
   if [ "$?" == "1" ]; then
     echo "Installing package $1..."
-    DEBIAN_FRONTEND=noninteractive $sudo apt-get install $1 -y
+    DEBIAN_FRONTEND=noninteractive $SUDO apt-get install $1 -y
   fi
 }
 
 # Set sudo config
 if [ "`whoami`" != 'root' ]; then
-  sudo="sudo"
+  SUDO="sudo"
 fi
 
 # Ensure basic packages are installed.
-for package in puppet ruby-hiera-puppet mr whois; do
+for package in puppet git mr whois; do
   provision_package $package
 done

diff --git a/bin/deploy b/bin/deploy
new file mode 100755 (executable)
index 0000000..5d3361b
--- /dev/null
+++ b/bin/deploy
@@ -0,0 +1,58 @@
+#!/bin/bash
+#
+# Deploy configuration using puppet.
+#
+
+# Parameters
+DIRNAME="`dirname $0`"
+BASEDIR="$DIRNAME/.."
+DEPLOY_DEPENDENCIES="puppet ruby-sqlite3 ruby-activerecord ruby-activerecord-deprecated-finders"
+
+# Determine hostname
+if [ ! -z "$1" ]; then
+  FQDN="$1"
+else
+  FQDN="`cat /etc/hostname`"
+fi
+
+# Check for manifest
+PUPPET_MANIFEST="$BASEDIR/puppet/manifests/nodes/$FQDN.pp"
+if [ ! -e "$PUPPET_MANIFEST" ]; then
+  echo "file not found: $PUPPET_MANIFEST"
+  exit 1
+fi
+
+# Install dependencies
+source $DIRNAME/dependencies
+
+# Ensure additional dependencies are installed.
+for package in $DEPLOY_DEPENDENCIES; do
+  provision_package $package
+done
+
+# Parameters that needs dependencies installed
+DIST="`facter lsbdistcodename`"
+
+# Apply patches
+if [ -d "$BASEDIR/puppet/files/patches/$DIST" ]; then
+  (
+  # Patches should be generated relativelly to the root folder
+  cd /
+
+  # Only apply if needed
+  # Thanks https://unix.stackexchange.com/questions/55780/check-if-a-file-or-folder-has-been-patched-already
+  for patch in `ls $BASEDIR/puppet/files/patches/$DIST`; do
+    patch -p0 -N --dry-run --silent < $BASEDIR/puppet/files/patches/$DIST/$patch &> /dev/null
+    # If the patch has not been applied then the $? which is the exit status
+    # for last command would have a success status code = 0
+    if [ "$?" == "0" ]; then
+      # Apply the patch
+      patch -p0 -N < $BASEDIR/puppet/files/patches/$DIST/$patch
+    fi
+  done
+  )
+fi
+
+# Run puppet apply
+PUPPET_OPTS="--confdir=$BASEDIR/puppet --modulepath=$BASEDIR/puppet/modules"
+LC_ALL=C $SUDO puppet apply $PUPPET_OPTS $PUPPET_MANIFEST

diff --git a/bin/mrconfig b/bin/mrconfig
index f525db31d14e6e6eeeb1dcb863f9edb9845e5509..dc753acc83a902c199c5d7292d458fd68de5330f 100755 (executable)
--- a/bin/mrconfig
+++ b/bin/mrconfig
@@ -1,10 +1,10 @@
 #!/bin/bash
 #
 # Build a mrconfig for the needed modules.
-# 
+#
 
 # Parameters
-GIT="git.sarava.org"
+GIT="git.fluxo.info"
 URL="https://$GIT/?a=project_index"
 CWD="`pwd`"
 WORK="`dirname $0`/.."
@@ -18,8 +18,8 @@ touch .mrconfig
 curl --stderr - $URL | grep "^puppet-" | cut -d ' ' -f 1 | while read module; do
   folder="`echo $module | sed -e 's/^puppet-//'`"
   folder="`basename $folder .git`"
-  
-  if [ "$module" != "$bootstrap" ]; then
+
+  if [ "$folder" != "bootstrap" ]; then
     echo "Processing $folder..."
     mr config puppet/modules/$folder checkout="git clone git://$GIT/$module $folder"
   fi

diff --git a/bin/post-receive b/bin/post-receive
new file mode 100755 (executable)
index 0000000..996189d
--- /dev/null
+++ b/bin/post-receive
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+cd ..
+unset GIT_DIR
+
+git checkout -f
+git submodule update --init --recursive

diff --git a/bin/post-update b/bin/post-update
new file mode 100755 (executable)
index 0000000..48a6a16
--- /dev/null
+++ b/bin/post-update
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+cd ..
+unset GIT_DIR
+
+if [ -d ".git/annex" ]; then
+  git annex sync
+else
+  git reset HEAD
+  git checkout -f
+fi
+
+git submodule update --init --recursive
+
+cd -
+exec git update-server-info

diff --git a/bin/provision b/bin/provision
index e200e51558298226d4fbbe8e8a94ba9cc2683033..16f102f1e1ea8e7a0ea11815dbedfc41b24c2c23 100755 (executable)
--- a/bin/provision
+++ b/bin/provision
@@ -3,25 +3,33 @@
 # Simple shell provisioner for Vagrant instances.
 #
 
-# Ensure the system is updated.
-sudo apt-get update && DEBIAN_FRONTEND=noninteractive sudo apt-get dist-upgrade -y && sudo apt-get autoremove -y && sudo apt-get clean
+# Parameters
+DIRNAME="`dirname $0`"
+
+# Load dependencies
+source $DIRNAME/dependencies
 
-# Install dependencies
-source /vagrant/puppet/bin/dependencies
+# Ensure the system is updated.
+$SUDO apt-get update && DEBIAN_FRONTEND=noninteractive $SUDO apt-get dist-upgrade -y && $SUDO apt-get autoremove -y && $SUDO apt-get clean
 
 # Ensure additional dependencies are installed.
-for package in sqlite3 libsqlite3-ruby libactiverecord-ruby ruby-sqlite3 usbutils; do
+for package in usbutils; do
+  provision_package $package
+done
+
+# Storeconfigs support
+for package in ruby-sqlite3 ruby-activerecord ruby-activerecord-deprecated-finders; do
   provision_package $package
 done
 
-# Link hiera configuration.
+# Link hiera configuration if needed.
 if [ ! -h "/etc/puppet/hiera.yaml" ]; then
-  sudo rm -f /etc/puppet/hiera.yaml
-  sudo ln -s /vagrant/puppet/hiera/hiera.yaml /etc/puppet/hiera.yaml
+  $SUDO rm -f /etc/puppet/hiera.yaml
+  $SUDO ln -s $DIRNAME/../hiera/hiera.yaml /etc/puppet/hiera.yaml
 fi
 
-# Link puppet configuration.
+# Link puppet configuration if needed.
 if [ ! -h "/etc/puppet/puppet.conf" ]; then
-  sudo rm -f /etc/puppet/puppet.conf
-  sudo ln -s /vagrant/puppet/puppet.conf /etc/puppet/puppet.conf
+  $SUDO rm -f /etc/puppet/puppet.conf
+  $SUDO ln -s $DIRNAME/../puppet.conf /etc/puppet/puppet.conf
 fi

diff --git a/bin/submodules b/bin/submodules
index f79b6357a2eb351db868e2dd6fe8025c3855e884..3abc46d0064eae0c459fa332719cc70b58f8fe94 100755 (executable)
--- a/bin/submodules
+++ b/bin/submodules
@@ -20,7 +20,7 @@ for repo in $repos; do
   module="`basename $repo .git | sed -e s/^puppet-//`"
   if [ ! -d "modules/$module" ]; then
     echo "Processing puppet module $module..."
-    git submodule add $repo modules/$module
+    git submodule add -f $repo modules/$module
   elif [ -e "modules/$module/.git" ]; then
     # The puppet module exists and is a git submodule, so update it
     ( cd module/$module && git pull origin master )

diff --git a/files/patches/trusty/puppet-stack-level.md b/files/patches/trusty/puppet-stack-level.md
new file mode 100644 (file)
index 0000000..9a3f4d7
--- /dev/null
+++ b/files/patches/trusty/puppet-stack-level.md
@@ -0,0 +1,3 @@
+# Puppet stack level patch
+
+* [Puppet master fails with 'stack level too deep' error when storeconfigs = true](https://bugs.launchpad.net/ubuntu/+source/puppet/+bug/1313595).

diff --git a/files/patches/trusty/puppet-stack-level.patch b/files/patches/trusty/puppet-stack-level.patch
new file mode 100644 (file)
index 0000000..1d112f7
--- /dev/null
+++ b/files/patches/trusty/puppet-stack-level.patch
@@ -0,0 +1,15 @@
+--- /usr/lib/ruby/vendor_ruby/puppet/rails/resource.rb.orig     2015-10-19 17:19:13.500193213 -0200
++++ /usr/lib/ruby/vendor_ruby/puppet/rails/resource.rb  2015-10-19 17:19:58.972194943 -0200
+@@ -84,7 +84,11 @@
+   end
+ 
+   def [](param)
+-    super || parameter(param)
++    if param == 'id'
++      super
++    else
++      super || parameter(param)
++    end
+   end
+ 
+   # Make sure this resource is equivalent to the provided Parser resource.

diff --git a/hiera/common.yaml b/hiera/common.yaml
index d7e35a1102102c779d427f7a67b290e93cba55df..8a04a2625b94a98dff93938c700d92dcfd18cf12 100644 (file)
--- a/hiera/common.yaml
+++ b/hiera/common.yaml
@@ -48,3 +48,8 @@ ntp::servers:
 nodo::subsystem::resolver::nameservers:
   - '208.67.222.222'
   - '208.67.220.220'
+
+#
+# Puppet config
+#
+nodo::base::puppet_mode: 'apply'

diff --git a/hiera/hiera.yaml b/hiera/hiera.yaml
index 33acc9e4c0a25731961eabf40abc04193d963841..a8ae7921740bbbe3a899f64f813be8ffe90adbd8 100644 (file)
--- a/hiera/hiera.yaml
+++ b/hiera/hiera.yaml
@@ -8,14 +8,26 @@
   # reconsidered in the future.
   #
   # See http://docs.vagrantup.com/v2/provisioning/puppet_apply.html
-  :datadir: hiera
+  :datadir: '%{settings::confdir}/hiera'
 :hierarchy:
-  - '%{::environment}/domain/%{::domain}/node/%{::clientcert}'
-  - '%{::environment}/domain/%{::domain}/role/%{::role}'
-  - '%{::environment}/domain/%{::domain}/location/%{::location}'
-  - '%{::environment}/domain/%{::domain}/%{::domain}'
-  - '%{::environment}/location/%{::location}'
-  - '%{::environment}/virtual/%{::virtual}'
-  - '%{::environment}/role/%{::role}'
+  #
+  # Put in the secrets folder all sensitive information that
+  # wont be spread into every system if you're using the Hydra Suite.
+  #
+  # We also recommend to leave only encrypted data in your hiera config.
+  #
+  - 'secrets/node/%{::clientcert}'
+  - 'secrets/role/%{::nodo::role}'
+  - 'secrets/location/%{::nodo::location}'
+  - 'secrets/domain/%{::domain}'
+
+  #
+  # All other stuff goes in regular YAML files.
+  #
+  - 'node/%{::clientcert}'
+  - 'role/%{::nodo::role}'
+  - 'virtual/%{::virtual}'
+  - 'location/%{::nodo::location}'
+  - 'domain/%{::domain}'
   - bootstrap
   - common

diff --git a/hiera/node/puppet-bootstrap.example.org.yaml b/hiera/node/puppet-bootstrap.example.org.yaml
new file mode 100644 (file)
index 0000000..c108e7d
--- /dev/null
+++ b/hiera/node/puppet-bootstrap.example.org.yaml
@@ -0,0 +1,14 @@
+---
+#
+# MySQL
+#
+# The following password is public information and therefore
+# shall not be user on production.
+mysql::server::rootpw: '9pRfteNbSFFyrHhackme'
+
+#
+# Backup
+#
+nodo::subsystem::backup::localhost: false
+nodo::subsystem::backup::encryptkey: 'none'
+nodo::subsystem::backup::password: 'hacked'

diff --git a/manifests/bootstrap/configurator.pp b/manifests/bootstrap/configurator.pp
index d93a0ceef9af0100323a9533d9a4994e0fcbd180..edcbe92ab8109d4a326f398913a9928701cf0376 100644 (file)
--- a/manifests/bootstrap/configurator.pp
+++ b/manifests/bootstrap/configurator.pp
@@ -74,7 +74,7 @@ file { "$bootstrap_path/auth.conf":
 #
 # Basic users
 #
-file { "$bootstrap_path/manifests/classes/users.pp":
+file { "$bootstrap_path/modules/site_users/manifests/init.pp":
   ensure  => present,
   mode    => 0644,
   content => template("$templates/puppet/users.pp.erb"),

diff --git a/manifests/bootstrap/host.pp b/manifests/bootstrap/host.pp
index c1aead875b83a20612ee8b7bfc8b8f66b50cf285..5f9c23ac5d955bd8e793ba0910da74a99ada9d9b 100644 (file)
--- a/manifests/bootstrap/host.pp
+++ b/manifests/bootstrap/host.pp
@@ -4,11 +4,10 @@
 # virtual machine.
 #
 
-# Import site configuration
-import "../site.pp"
-
 # The server role
-include nodo::role::server
+class { 'nodo:
+  role => 'server',
+}
 
 # Creates vserver for administrative node
 nodo::vserver::instance { "$hostname-master":

diff --git a/manifests/bootstrap/master.pp b/manifests/bootstrap/master.pp
index 51167f30981fe01f671882fba02ee870013c4bee..5934d3eab327afac6d27954a9332cfe9b13a48c5 100644 (file)
--- a/manifests/bootstrap/master.pp
+++ b/manifests/bootstrap/master.pp
@@ -5,8 +5,7 @@
 # Once it's running it can setup all the other nodes.
 #
 
-# Import site configuration
-import "../site.pp"
-
 # Include the master node configuration
-include nodo::role::master
+class { 'nodo':
+  role => 'master',
+}

diff --git a/manifests/bootstrap/vagrant.pp b/manifests/bootstrap/vagrant.pp
index 9206db6eb0f01255d837bd6082c9ecfba1d7d316..47305dc5e1fa8e7166b2a1c478f5725925f52ec1 100644 (file)
--- a/manifests/bootstrap/vagrant.pp
+++ b/manifests/bootstrap/vagrant.pp
@@ -3,47 +3,36 @@
 # virtual machine.
 #
 
-# Import site configuration
-import "../site.pp"
-
-#
-# Stage definitions
-#
-
-stage { 'first':
-  before => Stage['main'],
-}
-
-stage { 'last': }
-Stage['main'] -> Stage['last']
-
 #
 # Class definitions
 #
 
 # Vagrant classes
-include nodo::role::vagrant
-
-class vagrant_config {
-  # Symlink to the mounted module folder
-  file { '/etc/puppet/modules':
-    ensure => '/etc/puppet/modules-0',
-    force  => true,
-  }
-
-  # Ensure a custom hiera configuration
-  file { '/etc/puppet/hiera.yaml':
-    owner  => root,
-    group  => root,
-    mode   => 0644,
-    force  => true,
-    ensure => '/etc/puppet/hiera/hiera.yaml',
-  }
+class { 'nodo':
+  role => 'vagrant',
 }
 
 #
-# Class instantiations
-#
-class { 'vagrant_config':
-  stage => first,
-}
+# LAMP example
+#
+#include database
+#
+#class { 'apache':
+#  default_folder => '/vagrant',
+#  default_user   => 'vagrant',
+#  default_group  => 'vagrant',
+#}
+#
+# If you want to manage another website
+#apache::site { "myapp":
+#  docroot        => "/vagrant/",
+#  server_alias   => 'myapp vagrant localhost',
+#  use            => [ "Site myapp" ],
+#  tag            => 'all',
+#  owner          => vagrant,
+#  group          => vagrant,
+#  mpm_user       => vagrant,
+#  mpm_group      => vagrant,
+#  password       => '$5$NZfZqcdyZ3Xt$.kfZejriEJP3fc6RU0gBGEzMPQ/c3XiowVImB6VDrtD',
+#  shell          => '/bin/bash',
+#}

diff --git a/manifests/modules.pp b/manifests/modules.pp
deleted file mode 100644 (file)
index 3df3fe3..0000000
--- a/manifests/modules.pp
+++ /dev/null
@@ -1,6 +0,0 @@
-#
-# Module definitions.
-#
-
-# Nodo automatically import all modules we need.
-import "nodo"

diff --git a/manifests/nodes.pp b/manifests/nodes.pp
deleted file mode 100644 (file)
index b90f04e..0000000
--- a/manifests/nodes.pp
+++ /dev/null
@@ -1,5 +0,0 @@
-#
-# Node definitions.
-#
-
-#import "nodes/example.pp"

diff --git a/manifests/nodes/default.pp b/manifests/nodes/default.pp
new file mode 100644 (file)
index 0000000..5ebbf90
--- /dev/null
+++ b/manifests/nodes/default.pp
@@ -0,0 +1,3 @@
+node default {
+  include nodo
+}

diff --git a/manifests/site.pp b/manifests/site.pp
deleted file mode 100644 (file)
index 6f3e5aa..0000000
--- a/manifests/site.pp
+++ /dev/null
@@ -1,8 +0,0 @@
-#
-# Puppet site configuration.
-#
-
-import "classes/users.pp"
-import "classes/websites.pp"
-import "modules.pp"
-import "nodes.pp"

diff --git a/modules/site_apt/files/keys.d/.empty b/modules/site_apt/files/keys.d/.empty
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/modules/site_bind/manifests/init.pp b/modules/site_bind/manifests/init.pp
new file mode 100644 (file)
index 0000000..7ee08d2
--- /dev/null
+++ b/modules/site_bind/manifests/init.pp
@@ -0,0 +1,16 @@
+class site_bind {
+  #
+  # See http://oreilly.com/pub/a/oreilly/networking/news/views_0501.html
+  #     http://www.debian-administration.org/articles/355
+
+  # This is needed so we can comment out the inclusion of
+  # /etc/bind/named.conf.default-zones
+  #file { '/etc/bind/named.conf':
+  #  ensure => present,
+  #  owner  => root,
+  #  group  => root,
+  #  mode   => 0644,
+  #  source => 'puppet:///modules/site_bind/named.conf',
+  #  notify => Service['bind9'],
+  #}
+}

diff --git a/modules/site_mail/files/aliases b/modules/site_mail/files/aliases
new file mode 100644 (file)
index 0000000..08a0723
--- /dev/null
+++ b/modules/site_mail/files/aliases
@@ -0,0 +1,14 @@
+# /etc/aliases
+mailer-daemon: postmaster
+postmaster: root
+nobody: root
+hostmaster: root
+usenet: root
+news: root
+webmaster: root
+www: root
+ftp: root
+abuse: root
+noc: root
+security: root
+reprepro: root

diff --git a/modules/site_users/manifests/admin.pp b/modules/site_users/manifests/admin.pp
new file mode 100644 (file)
index 0000000..14ad9da
--- /dev/null
+++ b/modules/site_users/manifests/admin.pp
@@ -0,0 +1,16 @@
+class site_users::admin inherits user {
+  # root user and password
+  #user::manage { "root":
+  #  tag      => "admin",
+  #  homedir  => '/root',
+  #  password => '$5$zpdXgIaLKMDckKx9$qTS9WbmS/zylFwPu1orq.779CNnAiA9VoGdFNU94jz/',
+  #}
+
+  # first user config
+  #user::manage { "user":
+  #  tag      => "admin",
+  #  groups   => [ "sudo", ],
+  #  password => '$5$D8kCEIo5/MNCA7Tz$VhGg2MNDs21JzX9HgxSWMupA5GD5MXnKwDuveMSdPH7',
+  #  sshkey   => [ "WRONG" ],
+  #}
+}

diff --git a/modules/site_users/manifests/backups.pp b/modules/site_users/manifests/backups.pp
new file mode 100644 (file)
index 0000000..aab00f9
--- /dev/null
+++ b/modules/site_users/manifests/backups.pp
@@ -0,0 +1,3 @@
+class site_users::backup inherits user {
+  # define third-party hosted backup users here
+}

diff --git a/modules/site_users/manifests/init.pp b/modules/site_users/manifests/init.pp
new file mode 100644 (file)
index 0000000..b3c656a
--- /dev/null
+++ b/modules/site_users/manifests/init.pp
@@ -0,0 +1,2 @@
+class site_users {
+}

diff --git a/modules/site_users/manifests/virtual.pp b/modules/site_users/manifests/virtual.pp
new file mode 100644 (file)
index 0000000..20aba01
--- /dev/null
+++ b/modules/site_users/manifests/virtual.pp
@@ -0,0 +1,3 @@
+class site_users::virtual inherits user {
+  # define custom users here
+}

diff --git a/manifests/classes/websites.pp b/modules/site_websites/manifests/admin.pp
similarity index 60%
rename from manifests/classes/websites.pp
rename to modules/site_websites/manifests/admin.pp
index 35f27c6a4f44b7ba796b6d16902aaf263fc64d04..0be3a94c841f140538a1c03f2951312682fe279b 100644 (file)
--- a/manifests/classes/websites.pp
+++ b/modules/site_websites/manifests/admin.pp
@@ -1,4 +1,4 @@
-class websites::admin inherits websites::hosting::admin {
+class site_websites::admin inherits websites::hosting::admin {
   # An administrative Trac instance
   #apache::site { "admin":
   #  docroot        => "${apache::sites_folder}/admin/trac/htdocs",
@@ -23,20 +23,3 @@ class websites::admin inherits websites::hosting::admin {
     tag            => 'all',
   }
 }
-
-class websites inherits websites::hosting {
-  # Website definitions: always use tagged resources
-
-  #apache::site { "site":
-  #  source         => true,
-  #  ticket         => '001',
-  #  docroot        => '/var/www/site',
-  #  tag            => 'all',
-  #}
-
-  #database::instance { "site":
-  #  password => 'xxx',
-  #  tag      => 'all',
-  #}  
-
-}

diff --git a/modules/site_websites/manifests/init.pp b/modules/site_websites/manifests/init.pp
new file mode 100644 (file)
index 0000000..c98ca7d
--- /dev/null
+++ b/modules/site_websites/manifests/init.pp
@@ -0,0 +1,21 @@
+class site_websites inherits websites::hosting {
+  # Website definitions: always use tagged resources
+  apache::site { "git":
+    source         => true,
+    docroot        => '/var/git/repositories',
+    mpm            => false,
+    tag            => 'all',
+  }
+
+  #apache::site { "site":
+  #  source         => true,
+  #  ticket         => '001',
+  #  docroot        => '/var/www/site',
+  #  tag            => 'all',
+  #}
+
+  #database::instance { "site":
+  #  password => 'xxx',
+  #  tag      => 'all',
+  #}
+}

diff --git a/puppet.conf b/puppet.conf
new file mode 100644 (file)
index 0000000..ea5ed0e
--- /dev/null
+++ b/puppet.conf
@@ -0,0 +1,4 @@
+[main]
+  thin_storeconfigs = true
+  storeconfigs      = true
+  dbadapter         = sqlite3

diff --git a/templates/apache/vhosts/cgit.erb b/templates/apache/vhosts/cgit.erb
new file mode 100644 (file)
index 0000000..d2d393d
--- /dev/null
+++ b/templates/apache/vhosts/cgit.erb
@@ -0,0 +1,30 @@
+# begin vhost for cgit
+<VirtualHost *:80>
+  ServerName git.<%= domain %>
+  ServerAlias gitweb.<%= domain %>
+
+  ServerSignature Off
+
+  Alias /cgit.css /var/www/htdocs/cgit/cgit.css
+  Alias /cgit.png /var/www/htdocs/cgit/cgit.png
+
+  ScriptAlias /cgi-bin/ /var/www/htdocs/cgit/
+
+  DocumentRoot /var/git/repositories
+  <Directory /var/git/repositories>
+    AllowOverride None
+    Options +ExecCGI
+    Order allow,deny
+    Allow from all
+
+    DirectoryIndex /cgi-bin/cgit.cgi
+
+    RewriteEngine on
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteRule ^.*$ /cgi-bin/cgit.cgi/$0 [L,PT]
+  </Directory>
+
+  ErrorLog  /var/log/apache2/cgit.openezx.org/error.log
+  CustomLog  /var/log/apache2/cgit.openezx.org/access.log common
+</VirtualHost>
+# end vhost for git

diff --git a/templates/apache/vhosts/git.erb b/templates/apache/vhosts/git.erb
index 25aecd1bf004cd0d9cfb26b40f3286625ef164fa..89173acd313ea1a5baafc0b8ba91d6a8bffb7a9b 100644 (file)
--- a/templates/apache/vhosts/git.erb
+++ b/templates/apache/vhosts/git.erb
@@ -3,6 +3,7 @@
     # Recipe based on http://josephspiros.com/2009/07/26/configuring-gitweb-for-apache-on-debian
 
     ServerName git.<%= domain %>
+    ServerAlias gitweb.<%= domain %>
     SetEnv GITWEB_CONFIG /etc/gitweb.conf
     HeaderName HEADER
     DocumentRoot /var/git/repositories

diff --git a/templates/etc/nginx/domain.erb b/templates/etc/nginx/domain.erb
index 4e9fa7dcf3e4024e00f2aaa7f1c09997f1218523..8beff14a9625878a45bf025ac6a58d5892e45ba5 100644 (file)
--- a/templates/etc/nginx/domain.erb
+++ b/templates/etc/nginx/domain.erb
@@ -111,6 +111,7 @@ server {
   ssl_protocols SSLv3 TLSv1;
   ssl_ciphers HIGH:MEDIUM:!aNULL:!SSLv2:!MD5:@STRENGTH;
   ssl_prefer_server_ciphers on;
+  ssl_dhparam /etc/ssl/dhparams/dhparams_2048.pem;
 
   # Set the max size for file uploads
   client_max_body_size 100M;

diff --git a/templates/puppet/users.pp.erb b/templates/puppet/users.pp.erb
index 55a27066c226f1fcb8a8a6f69902b5a1db3d99b6..3b7c857be61794c4ea7eb98288667ae5bad45d8a 100644 (file)
--- a/templates/puppet/users.pp.erb
+++ b/templates/puppet/users.pp.erb
@@ -7,14 +7,6 @@ class users::backup inherits user {
 }
 
 class users::admin inherits user {
-
-  # Reprepro group needed for web nodes
-  #if !defined(Group["reprepro"]) {
-  #  group { "reprepro":
-  #    ensure => present,
-  #  }
-  #}
-
   # root user and password
   user::manage { "root":
     tag      => "admin",