node default {
$boxap_ssid = "AndroidAP4481"
$boxap_psk = "1234567890"
$wlan0_ip = $ipaddress_wlan0
case $macaddress_eth0 {
"b8:27:eb:ae:12:1d": {
$hostn = "palette"
$domainn = "ppprod.biz"
$other_domainn = "ppprod2.biz"
$arpa_domainn = "192.168.2"
$other_arpa_domainn = "192.168.3"
$invers_arpa_domainn = "2.168.192"
$other_invers_arpa_domainn = "3.168.192"
$eth0_ip = "192.168.2.1"
$tor_nickname = "6cfdb97abb21"
$site = "stm"
$vpn_ip = "10.4.0.2"
$vpn_other = "10.4.0.1"
$vpn_other_host_fqdn = "experience.vpn"
$vpn_other_host = "experience"
}
"b8:27:eb:ac:9f:fc": {
$hostn = "experience"
$domainn = "ppprod2.biz"
$other_domainn = "ppprod.biz"
$arpa_domainn = "192.168.3"
$other_arpa_domainn = "192.168.2"
$invers_arpa_domainn = "3.168.192"
$other_invers_arpa_domainn = "2.168.192"
$eth0_ip = "192.168.3.1"
$tor_nickname = "6cfdb97abb9a"
$site = "tln"
$vpn_ip = "10.4.0.1"
$vpn_other = "10.4.0.2"
$vpn_other_host_fqdn = "palette.vpn"
$vpn_other_host = "palette"
}
}
service { "reboot":
ensure => running,
hasrestart => false,
start => "/bin/true",
hasstatus => false,
status => "/bin/true",
require => Service["monit"],
}
exec { "hostname ${hostn}":
command => "/bin/hostname ${hostn}",
}
file { "/etc/hostname":
content => $hostn,
require => Exec["hostname ${hostn}"],
}
host { localhost:
ensure => present,
ip => "127.0.0.1",
host_aliases => $hostn,
require => File["/etc/hostname"],
}
host { "${vpn_other_host_fqdn}":
ensure => present,
ip => "${vpn_other}",
host_aliases => "${vpn_other_host}",
require => File["/etc/hostname"],
}
cron { "puppet apply":
command => "mount | grep ':puppet_rpi on /etc/puppet type fuse.glusterfs (rw,' 1>/dev/null || mount /etc/puppet ; cd /etc/puppet && find . -name '*~' -delete ; /usr/bin/puppet apply /etc/puppet/manifests/site.pp",
user => root,
hour => '1-23/2',
minute => 0,
require => Mount["/etc/puppet"],
}
cron { "apt-get update":
command => "/usr/bin/apt-get update",
user => root,
hour => '12',
minute => 0,
weekday => 1,
}
cron { "apt-get full update":
command => "apt-get update && apt-get -y upgrade && apt-get -y autoremove && apt-get -y dist-upgrade && rpi-update && reboot",
user => root,
hour => 0,
minute => 0,
monthday => 1,
}
exec { "openvpn between rpi":
command => "/bin/bash -c 'test -f /var/run/vpn.rpi.pid -a -n \"$( ps -e | grep openvpn | grep $( cat /var/run/vpn.rpi.pid ) )\" || /data/glusterfs/.local/scripts/vpn.rpi start'",
}
package { [glusterfs-server,glusterfs-client,monit]:
ensure => latest,
}
service { "glusterfs-server":
ensure => running,
enable => true,
require => [ Package[glusterfs-server,glusterfs-client], Exec["openvpn between rpi"] ],
before => Service["monit"],
}
mount { "/etc/puppet":
atboot => false,
device => "${vpn_ip}:puppet_rpi",
ensure => mounted,
fstype => glusterfs,
require => Service["glusterfs-server"],
before => Service["monit"],
}
mount { "/usr/local/bin":
atboot => false,
ensure => mounted,
device => "/etc/puppet/scripts",
fstype => "none",
options => "bind",
require => Mount["/etc/puppet"],
before => Service["monit"],
}
file { "/etc/puppet/scripts/vpn.rpi.${site}.monit":
content => template("scripts/vpn.rpi.monit.erb"),
require => Mount["/etc/puppet"]
}
file { "/etc/monit/conf.d/vpn.rpi.monit":
ensure => "/data/glusterfs/.local/scripts/vpn.rpi.${site}.monit",
require => [ Package[monit], File["/etc/puppet/scripts/vpn.rpi.${site}.monit"] ],
notify => Service["monit"],
}
file { "/etc/monit/monitrc":
source => "file:///etc/puppet/modules/common/files/monitrc",
mode => 0600,
require => [ Package[monit], File["/etc/monit/conf.d/vpn.rpi.monit"] ],
notify => Service["monit"],
}
service { "monit":
ensure => running,
enable => true,
require => [ Package[monit], File["/etc/puppet/scripts/vpn.rpi.${site}.monit" ] ],
}
file { "/etc/rc.local":
source => "file:///etc/puppet/modules/common/files/rc.local",
mode => 0755,
}
file { "/etc/network/interfaces":
content => template("network/interfaces.erb"),
}
# notify => Service[reboot],
}
node common inherits default {
exec { "ping rpi vpn":
command => "/bin/ping -qc 1 ${vpn_ip}",
require => Exec["openvpn between rpi"],
}
package { [bind9,squid3,privoxy,tor,tor-arm,dnsproxy,iptables]:
ensure => latest,
}
file { "/root/iptables":
content => template("common/iptables.erb"),
}
$anonymous_id = 1000
$anonymous_user = "anonymous"
exec { ["/usr/local/bin/gidmod.sh ${anonymous_id} ${anonymous_user}","/usr/local/bin/uidmod.sh ${anonymous_id} ${anonymous_user}"]:
require => Mount["/usr/local/bin"],
}
group { "${anonymous_user}":
ensure => present,
gid => "${anonymous_id}",
require => Exec["/usr/local/bin/gidmod.sh ${anonymous_id} ${anonymous_user}"],
}
user { "${anonymous_user}":
ensure => present,
uid => "${anonymous_id}",
gid => "${anonymous_user}",
home => "/tmp",
require => [ Exec["/usr/local/bin/uidmod.sh ${anonymous_id} ${anonymous_user}"], Group["${anonymous_user}"] ],
before => Exec["do iptables"],
}
exec { "do iptables":
command => "/sbin/iptables-restore
require => File["/root/iptables"],
}
$bind_id = 116
$bind_user = bind
exec { ["/usr/local/bin/gidmod.sh ${bind_id} ${bind_user}","/usr/local/bin/uidmod.sh ${bind_id} ${bind_user}"]:
require => [ Mount["/usr/local/bin"], Package[bind9] ],
}
group { "${bind_user}":
ensure => present,
gid => "${bind_id}",
require => Exec["/usr/local/bin/gidmod.sh ${bind_id} ${bind_user}"],
}
user { "${bind_user}":
ensure => present,
uid => "${bind_id}",
gid => "${bind_user}",
require => [ Exec["/usr/local/bin/uidmod.sh ${bind_id} ${bind_user}"], Group["${bind_user}"] ],
before => Service["bind9"],
}
file { "/etc/bind/zones.rfc1918":
content => template("common/zones.rfc1918.erb"),
notify => Service["bind9"],
require => [ Package[bind9], Exec["ping rpi vpn"] ],
}
file { "/etc/bind/named.conf.options":
content => template("common/named.conf.options.erb"),
notify => Service["bind9"],
require => [ Package[bind9], File["/etc/bind/zones.rfc1918"] ],
}
file { "/etc/bind/db.${domainn}":
content => template("common/db.domainn.erb"),
}
file { "/etc/bind/db.${arpa_domainn}":
content => template("common/db.arpa_domainn.erb"),
}
File["/etc/bind/db.${domainn}","/etc/bind/db.${arpa_domainn}"] {
ensure => present,
notify => Service["bind9"],
require => File["/etc/bind/named.conf.options"],
}
file { "/etc/bind/named.conf.local":
content => template("common/named.conf.local.erb"),
notify => Service["bind9"],
require => [ Package[bind9], Exec["ping rpi vpn"],
File["/etc/bind/named.conf.options",
"/etc/bind/db.${domainn}",
"/etc/bind/db.${arpa_domainn}"] ],
}
file { "/etc/bind":
mode => "g+rws",
group => "${bind_user}",
require => Group["${bind_user}"],
}
file { "/etc/default/bind9":
source => "file:///etc/puppet/modules/common/files/bind9.default",
require => File["/etc/bind"],
notify => Service["bind9"],
}
service { "bind9":
ensure => running,
enable => true,
require => File["/etc/default/bind9"],
}
file { "/etc/dnsproxy.conf":
source => "file:///etc/puppet/modules/common/files/dnsproxy.conf",
notify => Service["dnsproxy"],
}
service { "dnsproxy":
ensure => running,
enable => true,
require => File["/etc/dnsproxy.conf"],
}
file { "/etc/resolv.conf":
source => "file:///etc/puppet/modules/common/files/resolv.conf",
require => Service["bind9"],
}
$privoxy_id = 109
$privoxy_user = privoxy
exec { "/usr/local/bin/uidmod.sh ${privoxy_id} ${privoxy_user}":
require => [ Mount["/usr/local/bin"], Package[privoxy] ],
}
user { "${privoxy_user}":
ensure => present,
uid => "${privoxy_id}",
require => Exec["/usr/local/bin/uidmod.sh ${privoxy_id} ${privoxy_user}"],
before => [ Service["privoxy"], Exec["do iptables"] ],
}
file { "/var/log/privoxy":
owner => "${privoxy_user}",
recurse => true,
require => [ Package[privoxy], User["${privoxy_user}"] ],
before => Service["privoxy"],
notify => Service["privoxy"],
}
file { "/etc/privoxy/config":
content => template("common/privoxy.config.erb"),
require => [ Package[privoxy], File["/etc/resolv.conf"] ],
notify => Service["privoxy"],
}
file { "/etc/privoxy/trust":
content => template("common/privoxy.trust.erb"),
require => [ Package[privoxy], File["/etc/resolv.conf"] ],
notify => Service["privoxy"],
}
service { "privoxy":
ensure => running,
enable => true,
require => [ File["/etc/privoxy/config","/etc/privoxy/trust"], Exec["do iptables"] ],
}
file { "/etc/monit/conf.d/privoxy":
content => template("common/monit.privoxy.erb"),
require => Service["privoxy"],
notify => Service["monit"],
}
$squid_id = 13
$squid_user = "proxy"
exec { ["/usr/local/bin/gidmod.sh ${squid_id} ${squid_user}","/usr/local/bin/uidmod.sh ${squid_id} ${squid_user}"]:
require => [ Mount["/usr/local/bin"], Package[squid3] ],
}
group { "${squid_user}":
ensure => present,
gid => "${squid_id}",
require => Exec["/usr/local/bin/gidmod.sh ${squid_id} ${squid_user}"],
}
user { "${squid_user}":
ensure => present,
uid => "${squid_id}",
gid => "${squid_user}",
require => [ Exec["/usr/local/bin/uidmod.sh ${squid_id} ${squid_user}"], Group["${squid_user}"] ],
before => [ Service["squid3"], Exec["do iptables"] ],
}
mount { "/var/squid":
device => "LABEL=DATA-squid",
fstype => ext4,
options => "defaults",
pass => 2,
atboot => true,
ensure => mounted,
}
mount { "/etc/squid3":
device => "/var/squid/etc",
}
mount { "/var/log/squid3":
device => "/var/squid/log",
}
mount { "/var/spool/squid3":
device => "/var/squid/cache",
}
Mount["/etc/squid3","/var/log/squid3","/var/spool/squid3"] {
fstype => none,
options => bind,
require => Mount["/var/squid"],
before => Package[squid3],
atboot => true,
ensure => mounted,
}
file { "/etc/squid3/squid.conf":
content => template("common/squid.conf.erb"),
require => [ Package[squid3], Service["privoxy"], Mount["/etc/squid3"] ],
notify => Service["squid3"],
}
service { "squid3":
ensure => running,
enable => true,
require => [ File["/etc/squid3/squid.conf"], Mount["/etc/squid3","/var/log/squid3","/var/spool/squid3"], User["${squid_user}"], Exec["do iptables"] ],
}
$tor_id = 117
$tor_user = "debian-tor"
exec { ["/usr/local/bin/gidmod.sh ${tor_id} ${tor_user}","/usr/local/bin/uidmod.sh ${tor_id} ${tor_user}"]:
require => [ Mount["/usr/local/bin"], Package[tor] ],
}
group { "${tor_user}":
ensure => present,
gid => "${tor_id}",
require => Exec["/usr/local/bin/gidmod.sh ${tor_id} ${tor_user}"],
}
user { "${tor_user}":
ensure => present,
uid => "${tor_id}",
gid => "${tor_user}",
require => [ Exec["/usr/local/bin/uidmod.sh ${tor_id} ${tor_user}"], Group["${tor_user}"] ],
before => [ Service["tor"], Exec["do iptables"] ],
}
file { "/etc/default/tor":
source => "file:///etc/puppet/modules/common/files/tor.default",
}
file { "/etc/tor/torrc" :
content => template("common/torrc.erb"),
}
File["/etc/default/tor","/etc/tor/torrc"] {
require => [ Package[tor], Service["squid3"] ],
before => Service["tor"],
notify => Service["tor"],
}
service { "tor":
ensure => running,
enable => true,
require => [ File["/etc/default/tor", "/etc/tor/torrc"],
Exec["do iptables"],
User["${tor_user}"] ],
}
package { [rpcbind, nfs-common]:
ensure => latest,
}
Package[nfs-common] {
require => Package[rpcbind],
}
file { "/etc/exports":
content => template("common/nfs.exports.erb"),
before => Service["nfs-common"],
notify => Service["nfs-common"],
}
service { "rpcbind":
ensure => running,
enable => true,
require => Exec["do iptables"],
}
service { "nfs-common":
ensure => running,
enable => true,
require => [ File["/etc/exports"],
Service["rpcbind"] ],
}
package { [apt-cacher-ng]:
ensure => latest,
}
$acng_id = 112
$acng_user = "apt-cacher-ng"
exec { ["/usr/local/bin/gidmod.sh ${acng_id} ${acng_user}","/usr/local/bin/uidmod.sh ${acng_id} ${acng_user}"]:
require => [ Mount["/usr/local/bin"], Package[apt-cacher-ng] ],
before => Service["apt-cacher-ng"],
}
group { "${acng_user}":
ensure => present,
gid => "${acng_id}",
require => Exec["/usr/local/bin/gidmod.sh ${acng_id} ${acng_user}"],
}
user { "${acng_user}":
ensure => present,
uid => "${acng_id}",
gid => "${acng_user}",
require => [ Exec["/usr/local/bin/uidmod.sh ${acng_id} ${acng_user}"], Group["${acng_user}"] ],
before => Service["apt-cacher-ng"],
}
file { ["/etc/apt-cacher-ng/security.conf","/var/log/apt-cacher-ng"]:
group => "${acng_user}",
owner => "${acng_user}",
recurse => true,
require => [ Package[apt-cacher-ng], User["${acng_user}"], Group["${acng_user}"] ],
before => Service["apt-cacher-ng"],
notify => Service["apt-cacher-ng"],
}
file { "/etc/apt-cacher-ng/acng.conf":
content => template("common/acng.conf.erb"),
}
file { "/etc/apt/apt.conf" :
content => template("common/apt.conf.erb"),
}
File["/etc/apt-cacher-ng/acng.conf","/etc/apt/apt.conf"] {
require => [ Package[apt-cacher-ng], User["${acng_user}"], Group["${acng_user}"] ],
before => Service["apt-cacher-ng"],
notify => Service["apt-cacher-ng"],
}
service { "apt-cacher-ng":
ensure => running,
enable => true,
require => [ Package[apt-cacher-ng],
File["/etc/apt-cacher-ng/acng.conf","/etc/apt/apt.conf"],
Mount["/var/cache/apt-cacher-ng"] ],
}
}
node palette inherits common {
mount { "/var/cache/apt-cacher-ng":
ensure => mounted,
device => "${vpn_other_host_fqdn}:/var/apt-cacher-ng/cache",
fstype => "nfs",
options => "defaults",
pass => 0,
dump => 0,
require => [ Exec["ping rpi vpn"], Host["${vpn_other_host_fqdn}"] ],
}
}
node experience inherits common {
mount { "/var/cache/apt-cacher-ng":
ensure => mounted,
device => "/var/apt-cacher-ng/cache",
fstype => "none",
options => "bind",
pass => 0,
dump => 0,
}
package { [samba4,dnsmasq]:
ensure => latest,
}
file { "/etc/default/dnsmasq":
source => "file:///etc/puppet/modules/common/files/dnsmasq.default",
}
file { "/etc/dnsmasq.conf" :
content => template("common/dnsmasq.conf.erb"),
}
File["/etc/default/dnsmasq","/etc/dnsmasq.conf"] {
require => Package[dnsmasq],
before => Service["dnsmasq"],
notify => Service["dnsmasq"],
}
service { "dnsmasq":
ensure => running,
enable => true,
require => [ Package[dnsmasq], File["/etc/default/dnsmasq","/etc/dnsmasq.conf"] ],
}
}
