Skip to content
Snippets Groups Projects
Commit b118eab6 authored by Thomas Johansson's avatar Thomas Johansson
Browse files

Merge branch 'devel' into 'test' 

Devel

See merge request !36
parents 6e62919e eb17babc
No related branches found
No related tags found
3 merge requests!43Klaar36 production patch 83549,!37Test,!36Devel
Pipeline #101775 passed
Stage: puppet
Hide whitespace changes
Inline Side-by-side
Showing
with 145 additions and 7 deletions
README.md
+ 16
− 0
View file @ b118eab6
# aes
Repeated apply in puppet logs are the below
notice /Stage[main]/Aes::Aes_sw/Exec[script-repo-updated]/returns executed successfully (corrective)
notice /Stage[main]/Aes::Tal_cli/Exec[update-tal-repo]/returns executed successfully (corrective)
notice /Stage[main]/Aes::Opendsa/Exec[update-repo]/returns executed successfully (corrective)
notice /Stage[main]/Aes::Broker/Exec[update-broker-repo]/returns executed successfully (corrective)
notice /Stage[main]/Aes::Auth/Exec[update-auth-repo]/returns executed successfully (corrective)
notice /Stage[main]/Aes::Auth_keydb/Exec[update-keydb-repo]/returns executed successfully (corrective)
All use the same script "/opt/utils/update_repo.sh" to update local repo files
Should be possible to run with cron
Why is this required to run within puppet?
notice /Stage[main]/Aes/Exec[/usr/bin/touch /var/last_puppet_run]/returns executed successfully (corrective)
If a semaphore is required, use /opt/puppetlabs/puppet/public/last_run_summary.yaml
Please skip the touch exec!
\ No newline at end of file
data/common.yaml
+ 26
− 0
View file @ b118eab6
......@@ -26,6 +26,32 @@ aes::auth::keytab_devel: >
IcAIbgvoQbriFHLJiL9HIWl6GSe6I/jp9n5veEkhHdT3M0nEEc0hbKWBaELj
gTDWfQoET9V1Lrtv]
aes::auth::keytab_production_base64: >
ENC[PKCS7,MIIB6wYJKoZIhvcNAQcDoIIB3DCCAdgCAQAxggEhMIIBHQIBADAFMAACAQEw
DQYJKoZIhvcNAQEBBQAEggEAWDNqT2ab63HdYWzW2/9TZrsxEcdDvJBKl87f
vNVOQveZOoK2vBSaGb0Mzs5AQrY02ib2mBEZKsIgyI5JIPJRc+KAPVsjOOa1
vYx8N/VazTPWEIEtCMXG5wwR2P+ws/mzU9ztcDd4E1Hh5k8bRsu/krTGn783
QF1I+FEod9tYd1vMMpRkd1nkGq0GJtRHv9Xteb3DN6XJkdrdMaNpKw8Cemj/
N96wTtcL72LvogBpgzueQJ8+XdyFJCmWqk1lQV7pyllOIcnXrIcAz9E7TRXz
kCjq3Lr2MPnpptV8CDhoIUuEiNfGAQIWa3DQJIPzuz5gtug9Am1XDvbg9Bxx
VQ2FmjCBrQYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQAjUES6mKmlxRmzIZ
wu7L04CBgACGs/1vQi4G6v4Lz99FyonAjwsGU/texX/8Xgchp7emzkgLgqqz
BnDIXQukEIHBA5sBiBSYbvztTj99QQ2+hjS0fIyclQHa1xACtzeWJeGuf7Wh
/SVEJY3QpTspf98UwahjqrDLrGNK/my8Wc0U4ji4dozFhDl1WGcTyYUp5Zgn]
aes::auth::keytab_devel_base64: >
ENC[PKCS7,MIIB6wYJKoZIhvcNAQcDoIIB3DCCAdgCAQAxggEhMIIBHQIBADAFMAACAQEw
DQYJKoZIhvcNAQEBBQAEggEAIlqY2OywFv+nNU225WBoKCqDOoPLak73Di0u
Qm+zyFOroYQMYfzvCQ38U41wQanG3TdRaK9G9EoG3uX9qR/9AEYi9YWCq/YN
uhR7baNq4TEGsIkf/DoeMPh/LJGgQm8UGgRFj2cxTVERe/g1PC54LzuvmuHj
lk2KS1MYltGhnZoumczTFlk+1qGwzTzyGglSxt8EFbDJgLr5YEwWbgyhHQVg
C1HK53N5UeCUdJrRePDOoSfhXTq2TkzcmeuO6DMV+3pnb6IXdweBQTDikGnM
Bd5GSOx0U0njCVOeXqSmWAhDu2hCtryshbhhhiv+qL7cQ5yDulZIj6YaRb0X
CNCuXDCBrQYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQ1yi1qYaUepK4KbkL
YTGfO4CBgKPQ++rfV6Nw1M5qPgLS6gsvkOEAe+9FFiFWH1uTNqoZX9jSO4tZ
F0y5pwJ4OpjQS0oiInF+rxET2PTnND6yNtxeSkBncAWnNHA80Z2U7BOZG6Lw
BbBuhpmotOaWx2thqdb2sCNlj3yZMT1k62VXU8rBqzRA3Vj7jiRiXXxcSnnQ]
aes::tal_cli::credentials: >
ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBAD
AFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAii6nHpFM6+6aPuw1Qnawf77K7f
......
manifests/aes_sw.pp
+ 21
− 4
View file @ b118eab6
# @summary
# Describe what this class do!
#
# Detailed summary info if suitable
#
class aes::aes_sw {
$examadm_user = examadm
$examadm_group = $examadm_user
......@@ -34,24 +39,29 @@ class aes::aes_sw {
group => $examadm_group,
}
# lint:ignore:140chars
file { "${examadm_home}/.ssh/authorized_keys":
ensure => file,
mode => '0600',
owner => $examadm_user,
group => $examadm_group,
# lint:ignore:strict_indent heredoc failing...
content => @(SSHPUBKEY),
command="/home/examadm/tal-cli/source/scripts/tal-export.py --format ics --lookback 90 --lookahead 180",no-pty,no-user-rc,no-port-forwarding,no-agent-forwarding,no-X11-forwarding ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJW4LP0av20r7lPXNgsftF9oaAXK41AvHyuHwybciZC/QBfTcmYif83563cTg0OzR/p+OSobiDM0odaaFYtP/8xbuVRz87X5bGYm2m8yHHqPxobHkT5g/faMkl9Fef+Al4EsT5tiaYMOhG2lj8XRYuwAb7qjoz3FFbs8TEPE7Sv+4BUCCH94taCuNYLXSxN1EXvw7VW6Ld5QXRFP53l2QUeTqE9oSii3BVrXlqqrLvNV/7nwdwyse4uhff4QrM9o4oc9FaQr8PLlPGxdlbSfIQJMVzHGpeDu0WLw+NqtLO1hsdlvQm7GrT/v8N7GJNKlsvhwnwUuMhTrB0yPMbbub1 klaar36@upp
command="/home/examadm/tal-cli/source/scripts/tal-export.py --written --format ics --lookback 90 --lookahead 180",no-pty,no-user-rc,no-port-forwarding,no-agent-forwarding,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZ8aEAXw0tRcYrk1aqldepuC6tmdUYZuM270QdDF79o tal written exams to ics
| SSHPUBKEY
# lint:endignore:strict_indent
}
# lint:endignore:140chars
file { '/etc/systemd/system/aes_login.service':
ensure => file,
owner => root,
group => root,
mode => '0644',
# lint:ignore:strict_indent heredoc failing...
content => @(LOGINSERVICE),
[Unit]
[Unit]
Description=AES Login server
After=network.target
......@@ -64,6 +74,7 @@ class aes::aes_sw {
[Install]
WantedBy=multi-user.target
| LOGINSERVICE
# lint:endignore:strict_indent
}
# todo: logrotate
......@@ -77,8 +88,9 @@ class aes::aes_sw {
owner => root,
group => root,
mode => '0644',
# lint:ignore:strict_indent heredoc failing...
content => @(MSSERVICE),
[Unit]
[Unit]
Description=AES Exam server
After=network.target
......@@ -91,6 +103,7 @@ class aes::aes_sw {
[Install]
WantedBy=multi-user.target
| MSSERVICE
# lint:endignore:strict_indent
}
file { '/etc/cron.daily/aes_ms':
......@@ -98,10 +111,12 @@ class aes::aes_sw {
owner => root,
group => root,
mode => '0700',
# lint:ignore:strict_indent heredoc failing...
content => @(MSCRON),
#!/bin/sh
#!/bin/sh
/usr/bin/systemctl restart aes_ms
| MSCRON
# lint:endignore:strict_indent
}
file { '/etc/cron.daily/aes_login':
......@@ -109,10 +124,12 @@ class aes::aes_sw {
owner => root,
group => root,
mode => '0700',
# lint:ignore:strict_indent heredoc failing...
content => @(MSCRON),
#!/bin/sh
#!/bin/sh
/usr/bin/systemctl restart aes_login
| MSCRON
# lint:endignore:strict_indent
}
# todo: logrotate
......
manifests/auth.pp
+ 26
− 2
View file @ b118eab6
# @summary
# Describe what this class do!
#
# Detailed summary info if suitable
#
#
# @param keytab_production_base64
# Describe keytab_production_base64
#
# @param keytab_devel_base64
# Describe keytab_devel_base64
#
class aes::auth (
Optional[String] $keytab_production = undef,
Optional[String] $keytab_devel = undef
# Comment out old keytab params but
# keep temporay for comparison
#
# # Existing keytabs
# Optional[String] $keytab_production = undef,
# Optional[String] $keytab_devel = undef
#
# new base64+pkcs7 keytabs
Optional[String] $keytab_production_base64 = undef,
Optional[String] $keytab_devel_base64 = undef
) {
$auth_user = auth
$auth_group = $auth_user
$auth_home = "/srv/${auth_user}"
$auth_service = 'aes_auth'
# Decode base64 encoded keytabs
$keytab_production = Binary.new($keytab_production_base64, '%b')
$keytab_devel = Binary.new($keytab_devel_base64, '%b')
# Pick the right keytab for the current environment. We use the fqdn rather than
# $environment since the keys are tied to the domain name rather than what
# environment the machine is configured in.
......
manifests/auth_keydb.pp
+ 6
− 0
View file @ b118eab6
# @summary
# Describe what this class do!
#
# Detailed summary info if suitable
#
#
class aes::auth_keydb {
$keydb_user = auth_keydb
$keydb_group = $keydb_user
......
manifests/broker.pp
+ 6
− 0
View file @ b118eab6
# @summary
# Describe what this class do!
#
# Detailed summary info if suitable
#
#
class aes::broker {
$broker_user = broker
$broker_group = $broker_user
......
manifests/examfiles.pp
+ 6
− 0
View file @ b118eab6
# @summary
# Describe what this class do!
#
# Detailed summary info if suitable
#
#
class aes::examfiles {
include users::micis03
include users::jondy94
......
manifests/init.pp
+ 9
− 1
View file @ b118eab6
# @summary
# Describe what this class do!
#
# Detailed summary info if suitable
#
#
class aes {
include aes::examfiles
include aes::aes_sw
......@@ -107,8 +113,9 @@ class aes {
}
::server_firewall::rules_file { '45-permit_squid.rules':
# lint:ignore:strict_indent heredoc failing...
content => @(EOF),
service squid is tcp/3128
service squid is tcp/3128
service sclogin is tcp/23431
service aesmsi is tcp/23816
service aesmso is tcp/23817
......@@ -122,5 +129,6 @@ class aes {
accept service:aesbroker from class:liu-nets
end policy
|-EOF
# lint:endignore:strict_indent
}
}
manifests/latex.pp
+ 6
− 0
View file @ b118eab6
# @summary
# Describe what this class do!
#
# Detailed summary info if suitable
#
#
class aes::latex {
package {
[
......
manifests/opendsa.pp
+ 6
− 0
View file @ b118eab6
# @summary
# Describe what this class do!
#
# Detailed summary info if suitable
#
#
class aes::opendsa {
$opendsa_user = opendsa
$opendsa_group = $opendsa_user
......
manifests/squid_filter.pp
+ 6
− 0
View file @ b118eab6
# @summary
# Describe what this class do!
#
# Detailed summary info if suitable
#
#
class aes::squid_filter {
package { 'squid' :
ensure => 'present',
......
manifests/tal_cli.pp
+ 11
− 0
View file @ b118eab6
# @summary
# Describe what this class do!
#
# Detailed summary info if suitable
#
#
# @param credentials
# Describe credentials
#
class aes::tal_cli (
Optional[String] $credentials = undef
) {
......@@ -53,6 +62,7 @@ class aes::tal_cli (
owner => 'root',
group => 'root',
mode => '0700',
# lint:ignore:strict_indent heredoc failing...
content => @(END),
#!/bin/bash
if [ "$(hostname)" = "aes-devel.edu.liu.se" ]
......@@ -67,5 +77,6 @@ class aes::tal_cli (
sudo -u examadm /home/examadm/tal-cli/source/scripts/tal-remind.py --to ${TO} --computer-exam --send
fi
| END
# lint:endignore:strict_indent
}
}
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment