diff --git a/puppet/README.txt b/puppet/README.txt new file mode 100644 index 0000000..5620431 --- /dev/null +++ b/puppet/README.txt @@ -0,0 +1,38 @@ +This file is how to use Oded Simon puppet module for: +REA site performance pre-interview task puppet module + +Assumptions: +1. The new server have one of the followings OSs RedHat, CentOS or Ubuntu +2. The new server get it IP and DNS setting from DHCP. +3. The new server can connect to the puppet master server. +4. The new server have access to the internet for downloading required packages and ruby gems. + +How to use this module +1. Install puppet agent using the script install_puppet_agent.sh from this repo. +2. Add the server to puppet master server. +3. Configure the new server to receive this module by adding the following to the node config: + node 'server name' { + include rea + } +4. run the puppet agent on the new server. + +This module will do the following: +1. Will create the group rea-admin, and will set it to have full sudo permissions. +2. Will create the user radmin, and add it to rea-admin group. +3. Will disable selinux on RedHat/CentOS servers. +4. Will set the iptables firewall to start at boot with the following settings: +4.1. INPUT, FORWARD chain policy is DROP. +4.2. OUTPUT chain policy is ACCEPT. +4.3. Allow tcp connection on port 22 (management via SSH), 80 (HTTP). +4.4. Allow all ICMP connections. +5. Install Apache and mod_passenger via RPM/DEB packages. +6. Pull the simple-sinatra-app from github, install require ruby gems and configure Apache server to server it on port 80. + + +What can be improved: +1. This module can be smarter by allowing the pull of the application to be variable, and as result it will be able to install additional ruby on rails application. +2. The passenger module can be enhance to use NameVirtualHost option for Apache server. + +Tested on: +CentOS 6.5 x64 +Ubuntu 12.04 LTS x64 diff --git a/puppet/install_puppet_agent.sh b/puppet/install_puppet_agent.sh new file mode 100755 index 0000000..1892cfc --- /dev/null +++ b/puppet/install_puppet_agent.sh @@ -0,0 +1,116 @@ +#/bin/bash + +usage () { + echo "This script install puppet agent and configure the agent" + echo "Usage:" + echo "$0 -s " + exit 3 +} +if [[ $# != 2 ]] +then + usage +fi + +#read the args +while getopts ":s:h" opt; do + case $opt in + s) + MASTER=$OPTARG + ;; + h) + usage + ;; + *) + usage + ;; + esac +done + +#is puppet configured +if [ -f /etc/puppet/puppet.conf ] +then + CHECKMASTER=`grep "server" /etc/puppet/puppet.conf |awk -F'=' '{print $2}'` + echo "puppet agent is already install and configure with" + echo "confiugre master server is $CHECKMASTER" + exit 0 +fi +if [ -z $MASTER ] +then + echo "ERROR: puppet master is not provided." + usage +fi + +#Check the server OS +if [ ! -f /etc/redhat-release ] && [ ! -f /etc/lsb-release ] +then + echo "Error: can not detect the OS" + exit 1 +fi +if [ -f /etc/redhat-release ] +then + VER5=`grep 5\.[0-9] /etc/redhat-release` + VER6=`grep 6\.[0-9] /etc/redhat-release` + PROC=`uname -p` + if [ -z "$VER6" ] && [ -z "$VER5" ] + then + echo "Error: could not detect the RedHat/CentOS version" + exit 1 + fi + #add puppet repo + if [ "$PROC" == "x86_64" ] + then + if [ ! -z "$VER6" ] && [ -z "$VER5" ] + then + sudo rpm -ivh https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-7.noarch.rpm + fi + if [ -z "$VER6" ] && [ ! -z "$VER5" ] + then + sudo rpm -ivh https://yum.puppetlabs.com/el/5/products/x86_64/puppetlabs-release-5-7.noarch.rpm + fi + else + if [ ! -z "$VER6" ] && [ -z "$VER5" ] + then + sudo rpm -ivh https://yum.puppetlabs.com/el/6/products/i386/puppetlabs-release-6-7.noarch.rpm + fi + if [ -z "$VER6" ] && [ ! -z "$VER5" ] + then + sudo rpm -ivh https://yum.puppetlabs.com/el/5/products/i386/puppetlabs-release-5-7.noarch.rpm + fi + fi + #install the agent + sudo yum -y install puppet + #add the service to startup + /sbin/chkconfig puppet on +fi +if [ -f /etc/lsb-release ] && [ ! -f /etc/redhat-release ] +then + VER=`grep DISTRIB_CODENAME /etc/lsb-release| awk -F'=' '{print $2}'` + wget https://apt.puppetlabs.com/puppetlabs-release-${VER}.deb + sudo dpkg -i puppetlabs-release-${VER}.deb + sudo apt-get update + sudo apt-get -y install puppet +fi +if [ -f /etc/puppet/puppet.conf ] +then + #edit the puppet.conf file + mv /etc/puppet/puppet.conf /etc/puppet/puppet.orig + echo "[main]" >>/etc/puppet/puppet.conf + echo " server=${MASTER}" >>/etc/puppet/puppet.conf + echo " pluginsync=true" >>/etc/puppet/puppet.conf + echo " logdir=/var/log/puppet" >>/etc/puppet/puppet.conf + echo " vardir=/var/lib/puppet" >>/etc/puppet/puppet.conf + echo " ssldir=/var/lib/puppet/ssl" >>/etc/puppet/puppet.conf + echo " rundir=/var/run/puppet" >>/etc/puppet/puppet.conf + echo " factpath=$vardir/lib/facter" >>/etc/puppet/puppet.conf + echo " templatedir=$confdir/templates" >>/etc/puppet/puppet.conf + echo "" >>/etc/puppet/puppet.conf + echo "[agent]" >>/etc/puppet/puppet.conf + echo " report = true" >>/etc/puppet/puppet.conf + echo " show_diff = true" >>/etc/puppet/puppet.conf + echo " runinterval = 3600" >>/etc/puppet/puppet.conf + #run the agent for the first time + sudo puppet agent --noop --test + #echo to add the node to the puppet master + echo "Please add the new server certificat to the puppet master and re run the agent" + exit 0 +fi diff --git a/puppet/rea/files/firewall/iptables.redhat b/puppet/rea/files/firewall/iptables.redhat new file mode 100644 index 0000000..6b3a3e5 --- /dev/null +++ b/puppet/rea/files/firewall/iptables.redhat @@ -0,0 +1,10 @@ +*filter +:INPUT DROP [13:2613] +:FORWARD DROP [0:0] +:OUTPUT ACCEPT [49:5900] +-A INPUT -i lo -j ACCEPT +-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT +-A INPUT -p icmp -j ACCEPT +-A INPUT -p tcp -m tcp -m state --state NEW --dport 22 -j LOG +-A INPUT -p tcp -m tcp -m multiport --dports 22,80 -j ACCEPT +COMMIT diff --git a/puppet/rea/files/firewall/iptables.ubuntu b/puppet/rea/files/firewall/iptables.ubuntu new file mode 100644 index 0000000..c5eb34e --- /dev/null +++ b/puppet/rea/files/firewall/iptables.ubuntu @@ -0,0 +1,14 @@ +#!/bin/bash + +iptables -F INPUT +iptables -F OUTPUT +iptables -F FORWARD +iptables -P INPUT DROP +iptables -P OUTPUT ACCEPT +iptables -P FORWARD DROP + +iptables -A INPUT -i lo -j ACCEPT +iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT +iptables -A INPUT -p icmp -j ACCEPT +iptables -A INPUT -p tcp -m tcp -m state --state NEW --dport 22 -j LOG +iptables -A INPUT -p tcp -m tcp -m multiport --dports 22,80 -j ACCEPT diff --git a/puppet/rea/files/firewall/iptablesload.ubuntu b/puppet/rea/files/firewall/iptablesload.ubuntu new file mode 100644 index 0000000..6fb1ab0 --- /dev/null +++ b/puppet/rea/files/firewall/iptablesload.ubuntu @@ -0,0 +1,3 @@ +#!/bin/sh +iptables-restore < /etc/iptables.rules +exit 0 diff --git a/puppet/rea/files/firewall/iptablessave.ubuntu b/puppet/rea/files/firewall/iptablessave.ubuntu new file mode 100644 index 0000000..c74ee17 --- /dev/null +++ b/puppet/rea/files/firewall/iptablessave.ubuntu @@ -0,0 +1,6 @@ +#!/bin/sh +iptables-save -c > /etc/iptables.rules +if [ -f /etc/iptables.downrules ]; then + iptables-restore < /etc/iptables.downrules +fi +exit 0 diff --git a/puppet/rea/files/selinux/config b/puppet/rea/files/selinux/config new file mode 100644 index 0000000..a8f59ba --- /dev/null +++ b/puppet/rea/files/selinux/config @@ -0,0 +1,10 @@ +# This file controls the state of SELinux on the system. +# SELINUX= can take one of these three values: +# enforcing - SELinux security policy is enforced. +# permissive - SELinux prints warnings instead of enforcing. +# disabled - No SELinux policy is loaded. +SELINUX=disabled +# SELINUXTYPE= can take one of these two values: +# targeted - Targeted processes are protected, +# mls - Multi Level Security protection. +SELINUXTYPE=targeted diff --git a/puppet/rea/files/sshd/sshd_config.redhat b/puppet/rea/files/sshd/sshd_config.redhat new file mode 100644 index 0000000..52a9186 --- /dev/null +++ b/puppet/rea/files/sshd/sshd_config.redhat @@ -0,0 +1,137 @@ +# $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options change a +# default value. + +Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +# Disable legacy (protocol version 1) support in the server for new +# installations. In future the default will change to require explicit +# activation of protocol 1 +Protocol 2 + +# HostKey for protocol version 1 +#HostKey /etc/ssh/ssh_host_key +# HostKeys for protocol version 2 +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_dsa_key + +# Lifetime and size of ephemeral version 1 server key +#KeyRegenerationInterval 1h +#ServerKeyBits 1024 + +# Logging +# obsoletes QuietMode and FascistLogging +#SyslogFacility AUTH +SyslogFacility AUTHPRIV +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +PermitRootLogin no +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#RSAAuthentication yes +#PubkeyAuthentication yes +#AuthorizedKeysFile .ssh/authorized_keys +#AuthorizedKeysCommand none +#AuthorizedKeysCommandRunAs nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#RhostsRSAAuthentication no +# similar for protocol version 2 +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# RhostsRSAAuthentication and HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to no to disable s/key passwords +#ChallengeResponseAuthentication yes +ChallengeResponseAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no +#KerberosUseKuserok yes + +# GSSAPI options +#GSSAPIAuthentication no +GSSAPIAuthentication yes +#GSSAPICleanupCredentials yes +GSSAPICleanupCredentials yes +#GSSAPIStrictAcceptorCheck yes +#GSSAPIKeyExchange no + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +#UsePAM no +UsePAM yes + +# Accept locale-related environment variables +AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES +AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT +AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE +AcceptEnv XMODIFIERS + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +#X11Forwarding no +X11Forwarding yes +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#UseLogin no +#UsePrivilegeSeparation yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#ShowPatchLevel no +#UseDNS yes +#PidFile /var/run/sshd.pid +#MaxStartups 10 +#PermitTunnel no +#ChrootDirectory none + +# no default banner path +#Banner none + +# override default of no subsystems +Subsystem sftp /usr/libexec/openssh/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# ForceCommand cvs server diff --git a/puppet/rea/files/sshd/sshd_config.ubuntu b/puppet/rea/files/sshd/sshd_config.ubuntu new file mode 100644 index 0000000..36689f8 --- /dev/null +++ b/puppet/rea/files/sshd/sshd_config.ubuntu @@ -0,0 +1,87 @@ +# Package generated configuration file +# See the sshd_config(5) manpage for details + +# What ports, IPs and protocols we listen for +Port 22 +# Use these options to restrict which interfaces/protocols sshd will bind to +#ListenAddress :: +#ListenAddress 0.0.0.0 +Protocol 2 +# HostKeys for protocol version 2 +HostKey /etc/ssh/ssh_host_rsa_key +HostKey /etc/ssh/ssh_host_dsa_key +HostKey /etc/ssh/ssh_host_ecdsa_key +#Privilege Separation is turned on for security +UsePrivilegeSeparation yes + +# Lifetime and size of ephemeral version 1 server key +KeyRegenerationInterval 3600 +ServerKeyBits 768 + +# Logging +SyslogFacility AUTH +LogLevel INFO + +# Authentication: +LoginGraceTime 120 +PermitRootLogin no +StrictModes yes + +RSAAuthentication yes +PubkeyAuthentication yes +#AuthorizedKeysFile %h/.ssh/authorized_keys + +# Don't read the user's ~/.rhosts and ~/.shosts files +IgnoreRhosts yes +# For this to work you will also need host keys in /etc/ssh_known_hosts +RhostsRSAAuthentication no +# similar for protocol version 2 +HostbasedAuthentication no +# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication +#IgnoreUserKnownHosts yes + +# To enable empty passwords, change to yes (NOT RECOMMENDED) +PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +ChallengeResponseAuthentication no + +# Change to no to disable tunnelled clear text passwords +PasswordAuthentication yes + +# Kerberos options +#KerberosAuthentication no +#KerberosGetAFSToken no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +X11Forwarding yes +X11DisplayOffset 10 +PrintMotd no +PrintLastLog yes +TCPKeepAlive yes +#UseLogin no + +#MaxStartups 10:30:60 +#Banner /etc/issue.net + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* + +Subsystem sftp /usr/lib/openssh/sftp-server + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +UsePAM yes diff --git a/puppet/rea/files/sudo/admin b/puppet/rea/files/sudo/admin new file mode 100644 index 0000000..893cf4c --- /dev/null +++ b/puppet/rea/files/sudo/admin @@ -0,0 +1 @@ +%rea-admin ALL=(ALL) NOPASSWD: ALL diff --git a/puppet/rea/manifests/firewall.pp b/puppet/rea/manifests/firewall.pp new file mode 100644 index 0000000..da7495e --- /dev/null +++ b/puppet/rea/manifests/firewall.pp @@ -0,0 +1,52 @@ +#class rea::firewall +#This class will configure the firewall for the server + +class rea::firewall { + FILE { + owner => 'root', + group => 'root', + } + case $::operatingsystem { + 'CentOS', 'RedHat': { + file { + '/etc/sysconfig/iptables': + ensure => present, + mode => '0600', + source => 'puppet:///modules/rea/firewall/iptables.redhat', + notify => Service['iptables']; + } + service { + 'iptables': + ensure => running, + hasrestart => true; + } + } + 'Ubuntu': { + exec { + 'fix_rule': + command => 'sh -x /etc/iptables', + refreshonly => true, + notify => Exec['save_rules']; + 'save_rules': + command => 'sh -c "iptables-save > /etc/iptables.rules"', + refreshonly => true; + } + file { + '/etc/iptables': + ensure => present, + mode => '0600', + source => 'puppet:///modules/rea/firewall/iptables.ubuntu', + notify => Exec['fix_rule']; + '/etc/network/if-pre-up.d/iptablesload': + ensure => present, + mode => '0755', + source => 'puppet:///modules/rea/firewall/iptablesload.ubuntu'; + '/etc/network/if-post-down.d/iptablessave': + ensure => present, + mode => '0755', + source => 'puppet:///modules/rea/firewall/iptablessave.ubuntu'; + } + } + default: { fail('Unrecognized operating system') } + } +} diff --git a/puppet/rea/manifests/init.pp b/puppet/rea/manifests/init.pp new file mode 100644 index 0000000..81aa150 --- /dev/null +++ b/puppet/rea/manifests/init.pp @@ -0,0 +1,13 @@ +# Class: rea +# This module is installing test ruby app from rea test + +class rea { + #call the parts + include rea::users + include rea::sudo + include rea::sshd + include rea::selinux + include rea::firewall + include rea::passanger + include rea::simple-sinatra-app +} diff --git a/puppet/rea/manifests/passanger.pp b/puppet/rea/manifests/passanger.pp new file mode 100644 index 0000000..7f73939 --- /dev/null +++ b/puppet/rea/manifests/passanger.pp @@ -0,0 +1,90 @@ +#class rea::passanger +#Install the passanger and it needed packages + +class rea::passanger { + FILE { + owner => 'root', + group => 'root', + } + + case $::operatingsystem { + 'CentOS', 'RedHat': { + $webserver = 'httpd' + exec { + 'import_stealthy_monkeys_gpg_key': + command => '/bin/rpm --import http://passenger.stealthymonkeys.com/RPM-GPG-KEY-stealthymonkeys.asc', + creates => '/etc/yum.repos.d/stealthymonkeys.puppet', + refreshonly => true; + 'install_stealthymonkeys_repo': + command => '/usr/bin/yum install http://passenger.stealthymonkeys.com/rhel/6/passenger-release.noarch.rpm', + refreshonly => true, + creates => '/etc/yum.repos.d/passenger.repo', + require => Exec['import_stealthy_monkeys_gpg_key']; + 'add_httpd_to_startup': + command => '/sbin/chkconfig httpd on', + refreshonly => true; + } + package { + "$webserver": + ensure => latest, + notify => Exec['add_httpd_to_startup']; + ['git', 'ruby', 'rubygems', 'ruby-devel', 'gcc-c++', 'libcurl-devel', 'openssl-devel', 'zlib-devel', 'httpd-devel', 'apr-devel', 'apr-util-devel']: + ensure => latest; + 'mod_passenger': + ensure => latest, + require => Exec['install_stealthymonkeys_repo']; + 'bundle': + ensure => latest, + require => Package['rubygems'], + provider => 'gem'; + } + service { + 'httpd': + ensure => running, + require => Package["$webserver"]; + } + } + 'Ubuntu': { + $webserver = 'apache2.2-common' + exec { + 'import_stealthy_monkeys_gpg_key': + command => '/usr/bin/apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 561F9B9CAC40B2F7', + creates => '/etc/apt/sources.list.d/stealthymonkeys.puppet', + refreshonly => true, + notify => Exec['refresh_package_list']; + 'refresh_package_list': + command => '/usr/bin/apt-get update', + refreshonly => true, + require => File['/etc/apt/sources.list.d/passenger.list']; + } + file { + '/etc/apt/sources.list.d/passenger.list': + ensure => present, + mode => '0644', + content => "deb https://oss-binaries.phusionpassenger.com/apt/passenger ${::lsbdistcodename} main", + notify => Exec['import_stealthy_monkeys_gpg_key']; + } + package { + ["$webserver", 'apache2-utils', 'apache2.2-bin']: + ensure => latest, + notify => Service['apache2']; + ['ruby', 'ruby-dev', 'rubygems', 'git', 'apt-transport-https', 'ca-certificates']: + ensure => latest; + 'libapache2-mod-passenger': + ensure => latest, + require => File['/etc/apt/sources.list.d/passenger.list'], + notify => Service['apache2']; + 'bundle': + ensure => latest, + require => Package['rubygems'], + provider => 'gem'; + } + service { + 'apache2': + ensure => running, + require => Package["$webserver"]; + } + } + default: { fail('Unrecognized operating system') } + } +} diff --git a/puppet/rea/manifests/selinux.pp b/puppet/rea/manifests/selinux.pp new file mode 100644 index 0000000..30b4a54 --- /dev/null +++ b/puppet/rea/manifests/selinux.pp @@ -0,0 +1,24 @@ +#class rea::selinux +#this class is disabling the selinux + +class rea::selinux { + case $::operatingsystem { + 'CentOS', 'RedHat': { + exec { + 'disable_selinux' : + command => '/usr/sbin/setenforce 0', + creates => '/etc/selinux/puppet.disable'; + } + file { + '/etc/selinux/config': + ensure => present, + owner => 'root', + group => 'root', + mode => '0644', + source => 'puppet:///modules/rea/selinux/config'; + } + } + 'Ubuntu': {} + default: { fail('Unrecognized operating system') } + } +} diff --git a/puppet/rea/manifests/simple-sinatra-app.pp b/puppet/rea/manifests/simple-sinatra-app.pp new file mode 100644 index 0000000..0a0ec0f --- /dev/null +++ b/puppet/rea/manifests/simple-sinatra-app.pp @@ -0,0 +1,64 @@ +#class rea::simple-sinatra-app +#download and install simple-sinatra-app from rea + +class rea::simple-sinatra-app { + FILE { + owner => 'root', + group => 'root', + } + include rea::passanger + exec { + 'clone_rea': + command => '/usr/bin/git clone https://github.com/tnh/simple-sinatra-app.git /opt/simple-sinatra-app', + refreshonly => true, + require => Package['git'], + notify => Exec['install_rea']; + 'install_rea': + command => 'bundle install --gemfile /opt/simple-sinatra-app/Gemfile', + refreshonly => true, + require => [Package['bundle'],Exec['clone_rea']]; + } + file { + '/var/www/simple-sinatra-app': + ensure => directory, + mode => '0755', + require => Package["$rea::passanger::webserver"]; + '/var/www/simple-sinatra-app/public': + ensure => symlink, + target => '/opt/simple-sinatra-app/', + require => File['/var/www/simple-sinatra-app'], + notify => Exec['clone_rea']; + } + case $::operatingsystem { + 'CentOS', 'RedHat': { + file { + '/etc/httpd/conf.d/rea.conf': + ensure => present, + mode => '0644', + require => [Package['httpd'],File['/var/www/simple-sinatra-app/public']], + content => template('rea/httpd/rea.erb'), + notify => Service['httpd']; + } + } + 'Ubuntu':{ + file { + '/etc/apache2/sites-enabled/000-default': + #remove the ubuntu default site + ensure => absent, + notify => Service['apache2']; + '/etc/apache2/sites-available/rea.conf': + ensure => present, + mode => '0644', + require => [Package['apache2.2-common'],File['/var/www/simple-sinatra-app/public']], + notify => File['/etc/apache2/sites-enabled/000-default'], + content => template('rea/httpd/rea.erb'); + '/etc/apache2/sites-enabled/rea.conf': + ensure => symlink, + target => '/etc/apache2/sites-available/rea.conf', + require => File['/etc/apache2/sites-available/rea.conf'], + notify => Service['apache2']; + } + } + default: { fail('Unrecognized operating system') } + } +} diff --git a/puppet/rea/manifests/sshd.pp b/puppet/rea/manifests/sshd.pp new file mode 100644 index 0000000..7f36f39 --- /dev/null +++ b/puppet/rea/manifests/sshd.pp @@ -0,0 +1,30 @@ +#class rea::sshd +#this will change the default sshd.conf file to one that disable root ssh access + +class rea::sshd { + case $::operatingsystem { + 'CentOS', 'RedHat': { + $service_name = 'sshd' + $source_file = 'sshd_config.redhat' + } + 'Ubuntu': { + $service_name = 'ssh' + $source_file = 'sshd_config.ubuntu' + } + default: { fail('Unrecognized operating system') } + } + file { + '/etc/ssh/sshd_config': + ensure => present, + owner => 'root', + group => 'root', + mode => '0644', + source => "puppet:///modules/rea/sshd/${source_file}", + notify => Service["${service_name}"]; + } + service { + "${service_name}" : + ensure => running, + hasrestart => true; + } +} diff --git a/puppet/rea/manifests/sudo.pp b/puppet/rea/manifests/sudo.pp new file mode 100644 index 0000000..a4d7c75 --- /dev/null +++ b/puppet/rea/manifests/sudo.pp @@ -0,0 +1,15 @@ +#class rea::sudo +#add sudo prmission for rea server + +class rea::sudo { + include rea::users + file { + '/etc/sudoers.d/admin': + ensure => present, + owner => 'root', + group => 'root', + mode => '0644', + require => Group['rea-admin'], + source => 'puppet:///modules/rea/sudo/admin'; + } +} diff --git a/puppet/rea/manifests/users.pp b/puppet/rea/manifests/users.pp new file mode 100644 index 0000000..6be424f --- /dev/null +++ b/puppet/rea/manifests/users.pp @@ -0,0 +1,19 @@ +#class rea::users +#create the needed users and groups of managing the server +#default password: 7yhnmju87yhnmju8 + +class rea::users { + group { + 'rea-admin': + ensure => present, + gid => '3000'; + } + user { + 'radmin': + ensure => present, + uid => '4000', + groups => 'rea-admin', + password => '$6$TtvtDcX2$ktTNxIvL7b3Rv7X5JUb5zj9VnOXOUWYZ2fBf3148G.TqsY18GwH7VzIK..cu7FaAv4lK/5Fc9jw.xmYEPU/xF0', + comment => 'REA admin user'; + } +} diff --git a/puppet/rea/templates/httpd/rea.erb b/puppet/rea/templates/httpd/rea.erb new file mode 100644 index 0000000..9eb9420 --- /dev/null +++ b/puppet/rea/templates/httpd/rea.erb @@ -0,0 +1,9 @@ +PassengerAppRoot /var/www/simple-sinatra-app/public + + ServerName <%= @fqdn %> + DocumentRoot /var/www/simple-sinatra-app/public + + AllowOverride all + Options -MultiViews + +