diff --git a/manifests/base.pp b/manifests/base.pp new file mode 100644 index 0000000000000000000000000000000000000000..28633d9ea1e2b1db551608d29301325ca968b526 --- /dev/null +++ b/manifests/base.pp @@ -0,0 +1,40 @@ +# Copyright (C) 2014-2020 Thomas Bellman. +# Licensed under the GNU LGPL v3+; see the README file for more information. + + +/* + * Basic installation of the Apache web server. + * + * This disables the reading of all everything in the conf.d directory, + * which the standard Apache configuration file in RedHat:is OS:es + * does, instead forcing users to explicitly load only those files + * they need. It will also remove all unmanaged files from that + * directory. + */ +class apache::base +{ + include apache + include apache::service + + package { + 'httpd': + ensure => installed; + } + file { + # Keep the conf.d directory clean from all config files except for + # the ones explicitly managed from Puppet. + $apache::configdir: + ensure => directory, + recurse => true, purge => true, force => true, backup => false, + require => Package['httpd'], notify => Class[apache::service]; + } + # We do not want to blindly include things in the conf.d directory. + regexp_replace_lines { + 'apache::base::no_include_all': + file => $apache::configfile, + pattern => '^\s*Include[A-Za-z]*\s+conf\.d/.*\*.*$', + replacement => '## DISABLED: \&', + require => Package['httpd'], + notify => Class[apache::service]; + } +} diff --git a/manifests/daily_restart.pp b/manifests/daily_restart.pp new file mode 100644 index 0000000000000000000000000000000000000000..032dfbe70e2c827d4da64c81cf017a9b13ec563d --- /dev/null +++ b/manifests/daily_restart.pp @@ -0,0 +1,42 @@ +# Copyright (C) 2014-2020 Thomas Bellman. +# Licensed under the GNU LGPL v3+; see the README file for more information. + + +/* + * Cause the Apache httpd to be restarted daily. + * + * One case when this is needed, is when using authentication using client + * certificates. Apache is unable to re-read certificate revokation lists + * while running. The only way to avoid the loaded CRLs expiring, thus + * causing client certificates to be declared invalid, seem to be to + * restart Apache. + */ +class apache::daily_restart +{ + $gracefulcmd = 'o=`/usr/sbin/apachectl graceful 2>&1`' + case $::initsystem + { + 'sysvinit', 'upstart': { + $statuscmd = '/sbin/service httpd status >/dev/null 2>&1' + $extrastatus = 'echo "$o" >&2' + } + 'systemd': { + $statuscmd = '/bin/systemctl status httpd.service >/dev/null 2>&1' + $extrastatus = '/bin/systemctl status -l httpd.service >&2' + } + default: { + fail("${name}: Init system ${::initsystem} not supported") + } + } + # This tries to only generate output (mailed to root by Cron) if + # the restart fails. And it will not try to start Apache if it is + # not running. + $restart = "${statuscmd} && (${gracefulcmd} || ${extrastatus})" + + cron { + 'apache::daily_restart': + command => $restart, + month => '*', monthday => '*', weekday => '*', + hour => '5', minute => '30'; + } +} diff --git a/manifests/include_file.pp b/manifests/include_file.pp new file mode 100644 index 0000000000000000000000000000000000000000..3b4b94e23f1c60fb6ffb85d6a4f7b77a5a0f723c --- /dev/null +++ b/manifests/include_file.pp @@ -0,0 +1,73 @@ +# Copyright (C) 2014-2020 Thomas Bellman. +# Licensed under the GNU LGPL v3+; see the README file for more information. + + +/* + * Manage an Apache config file in conf.d. + * + * This will manage a config file in the Apache configuration directory, + * and the needed Include directive in the main httpd.conf file. This + * can be used e.g. for managing global configuration for Apache modules + * (LoadModule directives being a good candidate), and/or virtual host + * declarations. + * + * The parameters 'content' and 'source' have the same meaning as in + * the file type. Exactly one of them must be specified when the + * 'ensure' parameter is set to 'present' (the default). + */ + +define apache::include_file($content=undef, $source=undef, $ensure='present') +{ + include apache + + $includefile = "${apache::configdir}/${name}.conf" + + case $ensure + { + 'present': { + # Put the included file into place before the Include directive; + # in case the machine reboots in the middle, we do not want to + # needlessly hose up the Apache service. + file { + $includefile: + ensure => file, + owner => 'root', group => 'root', mode => 0444, + content => $content, source => $source, + notify => Class[apache::service]; + } + ensure_line { + "apache::include_file::include::${name}": + file => $apache::configfile, + line => "Include conf.d/${name}.conf", + addhow => append, + require => [ + Regexp_replace_lines['apache::base::no_include_all'], + File[$includefile] + ], + notify => Class[apache::service]; + } + } + + 'absent': { + # Remove the Include directive before the included file; in case + # the machine reboots in the middle, we do not want to needlessly + # hose up the Apache service. + delete_lines { + "apache::include_file::include::${name}": + file => $apache::configfile, + pattern => "\s*Include\s+conf\\.d/${name}\\.conf\s*$", + before => File[$includefile], + notify => Class[apache::service]; + } + file { + $includefile: + ensure => absent, notify => Class[apache::service]; + } + } + + default: { + fail("Apache::Include_file[${title}]: ", + "Bad parameter ensure: ${ensure}") + } + } +} diff --git a/manifests/init.pp b/manifests/init.pp index 7a03d51fe4e7d34bd6be4329cb766609c72908c9..4c28eb33013abbe27fe7b38f8c81432fdb30cde7 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -1,10 +1,7 @@ -# Copyright (C) 2014 Thomas Bellman. +# Copyright (C) 2014-2020 Thomas Bellman. # Licensed under the GNU LGPL v3+; see the README file for more information. -import "nsc-puppet-utils" - - /* * Various Apache httpd constants. * Mostly expected to be used internally by the classes and definitions @@ -33,250 +30,3 @@ class apache } } } - - - -/* - * Basic installation of the Apache web server. - * - * This disables the reading of all everything in the conf.d directory, - * which the standard Apache configuration file in RedHat:is OS:es - * does, instead forcing users to explicitly load only those files - * they need. It will also remove all unmanaged files from that - * directory. - */ -class apache::base -{ - include apache - include apache::service - - package { - 'httpd': - ensure => installed; - } - file { - # Keep the conf.d directory clean from all config files except for - # the ones explicitly managed from Puppet. - $apache::configdir: - ensure => directory, - recurse => true, purge => true, force => true, backup => false, - require => Package['httpd'], notify => Class[apache::service]; - } - # We do not want to blindly include things in the conf.d directory. - regexp_replace_lines { - 'apache::base::no_include_all': - file => $apache::configfile, - pattern => '^\s*Include[A-Za-z]*\s+conf\.d/.*\*.*$', - replacement => '## DISABLED: \&', - require => Package['httpd'], - notify => Class[apache::service]; - } -} - - - -/* - * Cause the Apache httpd to be restarted daily. - * - * One case when this is needed, is when using authentication using client - * certificates. Apache is unable to re-read certificate revokation lists - * while running. The only way to avoid the loaded CRLs expiring, thus - * causing client certificates to be declared invalid, seem to be to - * restart Apache. - */ -class apache::daily_restart -{ - $gracefulcmd = 'o=`/usr/sbin/apachectl graceful 2>&1`' - case $::initsystem - { - 'sysvinit', 'upstart': { - $statuscmd = '/sbin/service httpd status >/dev/null 2>&1' - $extrastatus = 'echo "$o" >&2' - } - 'systemd': { - $statuscmd = '/bin/systemctl status httpd.service >/dev/null 2>&1' - $extrastatus = '/bin/systemctl status -l httpd.service >&2' - } - default: { - fail("${name}: Init system ${::initsystem} not supported") - } - } - # This tries to only generate output (mailed to root by Cron) if - # the restart fails. And it will not try to start Apache if it is - # not running. - $restart = "${statuscmd} && (${gracefulcmd} || ${extrastatus})" - - cron { - 'apache::daily_restart': - command => $restart, - month => '*', monthday => '*', weekday => '*', - hour => '5', minute => '30'; - } -} - - - -/* - * Helper class for abstracting dependencies on the Apache service. - * This is so others can do e.g. notify => Class[apache::service] instead - * of having to do notify => Service['httpd']. - */ -class apache::service -{ - service { - 'httpd': - enable => true, ensure => running, - hasstatus => true, hasrestart => true; - } -} - - - -/* - * Manage the Apache log directory. - * This is mostly intended for those that don't want the defaults. - * By default, it sets ownership and permissions to the same as the - * RedHat packages do. - * To save a little bit of execution time, this is not included by the - * apache::base class, so users need to include it themselves. - */ - -class apache::logdir($owner='root', $group='root', $mode=0700) -{ - include apache - - file { - $apache::logdir: - ensure => directory, - owner => $owner, group => $group, mode => $mode, - require => Package['httpd'], before => Class[apache::service]; - } -} - - - -/* - * Manage an Apache config file in conf.d. - * - * This will manage a config file in the Apache configuration directory, - * and the needed Include directive in the main httpd.conf file. This - * can be used e.g. for managing global configuration for Apache modules - * (LoadModule directives being a good candidate), and/or virtual host - * declarations. - * - * The parameters 'content' and 'source' have the same meaning as in - * the file type. Exactly one of them must be specified when the - * 'ensure' parameter is set to 'present' (the default). - */ - -define apache::include_file($content=undef, $source=undef, $ensure='present') -{ - include apache - - $includefile = "${apache::configdir}/${name}.conf" - - case $ensure - { - 'present': { - # Put the included file into place before the Include directive; - # in case the machine reboots in the middle, we do not want to - # needlessly hose up the Apache service. - file { - $includefile: - ensure => file, - owner => 'root', group => 'root', mode => 0444, - content => $content, source => $source, - notify => Class[apache::service]; - } - ensure_line { - "apache::include_file::include::${name}": - file => $apache::configfile, - line => "Include conf.d/${name}.conf", - addhow => append, - require => [ - Regexp_replace_lines['apache::base::no_include_all'], - File[$includefile] - ], - notify => Class[apache::service]; - } - } - - 'absent': { - # Remove the Include directive before the included file; in case - # the machine reboots in the middle, we do not want to needlessly - # hose up the Apache service. - delete_lines { - "apache::include_file::include::${name}": - file => $apache::configfile, - pattern => "\s*Include\s+conf\\.d/${name}\\.conf\s*$", - before => File[$includefile], - notify => Class[apache::service]; - } - file { - $includefile: - ensure => absent, notify => Class[apache::service]; - } - } - - default: { - fail("Apache::Include_file[${title}]: ", - "Bad parameter ensure: ${ensure}") - } - } -} - - - -/* - * Define global configuration for an Apache module. - * - * To be used by classes installing and configuring Apache modules. - * Such classes should use this definition to set some reasonable - * default configuration. Users wanting a different configuration - * should inherit that class and override this resource. - * - * Configuration will be written to an "include file" in $apache::configdir, - * and an Include directive will be added to the main Apache - * httpd.conf file loading that specific file. (Therefore, there - * must not be any wildcard Include directive in httpd.conf; the - * apache::base class ensures this.) - * - * Parameters: - * - * - name: - * The name of the config file in /etc/httpd/conf.d that will be - * written. The suffix ".conf" will be automatically added. - * - * - loadmodule: - * Parameters to the LoadModule directive. - * - * - directives: - * List of directive lines. Users should usually use the 'defaultoptions' - * and 'options' parameters, but since some directives can occur multiple - * times, a way of specifying those is needed, thus this parameter. - * - * - defaultoptions, options: - * Hashes of directive names and parameters to them. These two hashes - * will be joined, and settings in the latter will override settings in - * the former. The intent is that a class for an Apache module will set - * 'defaultoptions' to some reasonable defaults, and users wanting to - * add to or override those will set 'options'. - * Setting the value of a specific option to false will exclude it - * from the config file. - * - * - ensure: - * One of 'present' or 'absent'. Setting to 'absent' will remove the - * module configuration file, and remove the Include directive for it - * from the main Apache httpd.conf file. - */ - -define apache::module::globalconfig( - $loadmodule, $directives=[], $defaultoptions, $options={}, - $ensure='present') -{ - apache::include_file { - $name: - ensure => $ensure, - content => template('apache/module.conf.erb'); - } -} diff --git a/manifests/listen.pp b/manifests/listen.pp index 95d0283e3a64c07e0410a270d5f01585a082cba8..28285c5ffa9bcc0a1d931a525d8e30503b9acc1f 100644 --- a/manifests/listen.pp +++ b/manifests/listen.pp @@ -2,9 +2,6 @@ # Licensed under the GNU LGPL v3+; see the README file for more information. -import "nsc-puppet-utils" - - /* * Configure Apache to listen on a set of addresses/ports/protocols. * diff --git a/manifests/logdir.pp b/manifests/logdir.pp new file mode 100644 index 0000000000000000000000000000000000000000..924d2c7e56536d32c12f9aa0e2e34739e66e96ee --- /dev/null +++ b/manifests/logdir.pp @@ -0,0 +1,24 @@ +# Copyright (C) 2014-2020 Thomas Bellman. +# Licensed under the GNU LGPL v3+; see the README file for more information. + + +/* + * Manage the Apache log directory. + * This is mostly intended for those that don't want the defaults. + * By default, it sets ownership and permissions to the same as the + * RedHat packages do. + * To save a little bit of execution time, this is not included by the + * apache::base class, so users need to include it themselves. + */ + +class apache::logdir($owner='root', $group='root', $mode=0700) +{ + include apache + + file { + $apache::logdir: + ensure => directory, + owner => $owner, group => $group, mode => $mode, + require => Package['httpd'], before => Class[apache::service]; + } +} diff --git a/manifests/mod_perl.pp b/manifests/mod_perl.pp index f9989c9070dc67427f12c270f9d8b2a034102239..7759edf865f44db9cc4eb8482ccd693ced56992d 100644 --- a/manifests/mod_perl.pp +++ b/manifests/mod_perl.pp @@ -1,10 +1,7 @@ -# Copyright (C) 2014 Thomas Bellman. +# Copyright (C) 2014-2020 Thomas Bellman. # Licensed under the GNU LGPL v3+; see the README file for more information. -import "apache" - - /* * Install the Apache mod_perl module. */ @@ -32,32 +29,3 @@ class apache::mod_perl require => Package['mod_perl']; } } - - -/* - * As apache::mod_perl, but do not run Perl in taint mode. - */ -class apache::mod_perl::notaint - inherits apache::mod_perl -{ - Apache::Module::Globalconfig['perl'] { - defaultoptions => { }, - } -} - - -class apache::mod_perl::absent - inherits apache::mod_perl -{ - # Remove the configuration referencing the module before the actual - # module, in case the machine reboots in the middle. - Package['mod_perl'] { - ensure => absent, - before => [], - } - Apache::Module::Globalconfig['perl'] { - ensure => absent, - require => [], - before => Package['mod_perl'], - } -} diff --git a/manifests/mod_perl/absent.pp b/manifests/mod_perl/absent.pp new file mode 100644 index 0000000000000000000000000000000000000000..6208466baf98c9eeffe7ebd27309a2968c0df34b --- /dev/null +++ b/manifests/mod_perl/absent.pp @@ -0,0 +1,19 @@ +# Copyright (C) 2014-2020 Thomas Bellman. +# Licensed under the GNU LGPL v3+; see the README file for more information. + + +class apache::mod_perl::absent + inherits apache::mod_perl +{ + # Remove the configuration referencing the module before the actual + # module, in case the machine reboots in the middle. + Package['mod_perl'] { + ensure => absent, + before => [], + } + Apache::Module::Globalconfig['perl'] { + ensure => absent, + require => [], + before => Package['mod_perl'], + } +} diff --git a/manifests/mod_perl/notaint.pp b/manifests/mod_perl/notaint.pp new file mode 100644 index 0000000000000000000000000000000000000000..9177a8612f5e1e62dd7fbe4468cd38c49c2e2c70 --- /dev/null +++ b/manifests/mod_perl/notaint.pp @@ -0,0 +1,14 @@ +# Copyright (C) 2014-2020 Thomas Bellman. +# Licensed under the GNU LGPL v3+; see the README file for more information. + + +/* + * As apache::mod_perl, but do not run Perl in taint mode. + */ +class apache::mod_perl::notaint + inherits apache::mod_perl +{ + Apache::Module::Globalconfig['perl'] { + defaultoptions => { }, + } +} diff --git a/manifests/mod_ssl.pp b/manifests/mod_ssl.pp index efd79703ff12b70b0dff33cb680fc66d94d2888e..2f337deda4d99c4e6aca4358139a04ae0766b2fb 100644 --- a/manifests/mod_ssl.pp +++ b/manifests/mod_ssl.pp @@ -2,9 +2,6 @@ # Licensed under the GNU LGPL v3+; see the README file for more information. -import "apache" - - /* * Install the Apache mod_ssl module. * Note that unlike the ssl.conf that comes with the normal mod_ssl @@ -42,20 +39,3 @@ class apache::mod_ssl require => Package['mod_ssl']; } } - - -class apache::mod_ssl::absent - inherits apache::mod_ssl -{ - # Remove the configuration referencing the module before the actual - # module, in case the machine reboots in the middle. - Package['mod_ssl'] { - ensure => absent, - before => [], - } - Apache::Module::Globalconfig['ssl'] { - ensure => absent, - require => [], - before => Package['mod_ssl'], - } -} diff --git a/manifests/mod_ssl/absent.pp b/manifests/mod_ssl/absent.pp new file mode 100644 index 0000000000000000000000000000000000000000..ba7a4685ac332063f66a084247d911387795468c --- /dev/null +++ b/manifests/mod_ssl/absent.pp @@ -0,0 +1,19 @@ +# Copyright (C) 2014 Thomas Bellman. +# Licensed under the GNU LGPL v3+; see the README file for more information. + + +class apache::mod_ssl::absent + inherits apache::mod_ssl +{ + # Remove the configuration referencing the module before the actual + # module, in case the machine reboots in the middle. + Package['mod_ssl'] { + ensure => absent, + before => [], + } + Apache::Module::Globalconfig['ssl'] { + ensure => absent, + require => [], + before => Package['mod_ssl'], + } +} diff --git a/manifests/mod_wsgi.pp b/manifests/mod_wsgi.pp index 6172ff93da0b3d775832c917883211a09d530005..020c28cc86387d7b91ccc1440971cfb587382ef6 100644 --- a/manifests/mod_wsgi.pp +++ b/manifests/mod_wsgi.pp @@ -28,20 +28,3 @@ class apache::mod_wsgi require => Package['mod_wsgi']; } } - - -class apache::mod_wsgi::absent - inherits apache::mod_wsgi -{ - # Remove the configuration referencing the module before the actual - # module, in case the machine reboots in the middle. - Package['mod_wsgi'] { - ensure => absent, - before => [], - } - Apache::Module::Globalconfig['wsgi'] { - ensure => absent, - require => [], - before => Package['mod_wsgi'], - } -} diff --git a/manifests/mod_wsgi/absent.pp b/manifests/mod_wsgi/absent.pp new file mode 100644 index 0000000000000000000000000000000000000000..4e4adeffee7b6513c5a7a7cfe59c0c22b1b0f155 --- /dev/null +++ b/manifests/mod_wsgi/absent.pp @@ -0,0 +1,19 @@ +# Copyright (C) 2014 Kent Engström, Thomas Bellman. +# Licensed under the GNU LGPL v3+; see the README file for more information. + + +class apache::mod_wsgi::absent + inherits apache::mod_wsgi +{ + # Remove the configuration referencing the module before the actual + # module, in case the machine reboots in the middle. + Package['mod_wsgi'] { + ensure => absent, + before => [], + } + Apache::Module::Globalconfig['wsgi'] { + ensure => absent, + require => [], + before => Package['mod_wsgi'], + } +} diff --git a/manifests/module/globalconfig.pp b/manifests/module/globalconfig.pp new file mode 100644 index 0000000000000000000000000000000000000000..3a8426a49f53dd4e7c9c6e598ea421974a944b2e --- /dev/null +++ b/manifests/module/globalconfig.pp @@ -0,0 +1,57 @@ +# Copyright (C) 2014-2020 Thomas Bellman. +# Licensed under the GNU LGPL v3+; see the README file for more information. + + +/* + * Define global configuration for an Apache module. + * + * To be used by classes installing and configuring Apache modules. + * Such classes should use this definition to set some reasonable + * default configuration. Users wanting a different configuration + * should inherit that class and override this resource. + * + * Configuration will be written to an "include file" in $apache::configdir, + * and an Include directive will be added to the main Apache + * httpd.conf file loading that specific file. (Therefore, there + * must not be any wildcard Include directive in httpd.conf; the + * apache::base class ensures this.) + * + * Parameters: + * + * - name: + * The name of the config file in /etc/httpd/conf.d that will be + * written. The suffix ".conf" will be automatically added. + * + * - loadmodule: + * Parameters to the LoadModule directive. + * + * - directives: + * List of directive lines. Users should usually use the 'defaultoptions' + * and 'options' parameters, but since some directives can occur multiple + * times, a way of specifying those is needed, thus this parameter. + * + * - defaultoptions, options: + * Hashes of directive names and parameters to them. These two hashes + * will be joined, and settings in the latter will override settings in + * the former. The intent is that a class for an Apache module will set + * 'defaultoptions' to some reasonable defaults, and users wanting to + * add to or override those will set 'options'. + * Setting the value of a specific option to false will exclude it + * from the config file. + * + * - ensure: + * One of 'present' or 'absent'. Setting to 'absent' will remove the + * module configuration file, and remove the Include directive for it + * from the main Apache httpd.conf file. + */ + +define apache::module::globalconfig( + $loadmodule, $directives=[], $defaultoptions, $options={}, + $ensure='present') +{ + apache::include_file { + $name: + ensure => $ensure, + content => template('apache/module.conf.erb'); + } +} diff --git a/manifests/named_vhost.pp b/manifests/named_vhost.pp index fce812fcc62858931d7a5aa11d748b9f7af6320f..ae40fe90e6111ed1264541695ca4050f626674e0 100644 --- a/manifests/named_vhost.pp +++ b/manifests/named_vhost.pp @@ -2,9 +2,6 @@ # Licensed under the GNU LGPL v3+; see the README file for more information. -import "nsc-puppet-utils" - - /* * Configure a named virtual host in Apache httpd. * diff --git a/manifests/service.pp b/manifests/service.pp new file mode 100644 index 0000000000000000000000000000000000000000..364267e323e03b5fe95764f9a3385eef7df4850b --- /dev/null +++ b/manifests/service.pp @@ -0,0 +1,17 @@ +# Copyright (C) 2014-2020 Thomas Bellman. +# Licensed under the GNU LGPL v3+; see the README file for more information. + + +/* + * Helper class for abstracting dependencies on the Apache service. + * This is so others can do e.g. notify => Class[apache::service] instead + * of having to do notify => Service['httpd']. + */ +class apache::service +{ + service { + 'httpd': + enable => true, ensure => running, + hasstatus => true, hasrestart => true; + } +}