zulip/puppet/zulip_ops/manifests/base.pp

class zulip_ops::base {
  include zulip::base
  include zulip::apt_repository

  $org_base_packages = [# Management for our systems
                        "openssh-server",
                        "mosh",
                        # package management
                        "aptitude",
                        # SSL Certificates
                        "letsencrypt",
                        # Monitoring
                        "munin-node",
                        "munin-plugins-extra" ,
                        # Security
                        "iptables-persistent",
                        # For managing our current Debian packages
                        "debian-goodies",
                        # Needed for zulip-ec2-configure-network-interfaces
                        'dhcpcd5',
                        "python3-six",
                        "python-six",
                        # "python3-boto", # missing on trusty
                        "python-boto", # needed for postgres_common too
                        "python3-netifaces",
                        "python-netifaces",
                        # Popular editors
                        "vim",
                        "emacs-nox",
                        "puppet-el",
                        # Prevent accidental reboots
                        "molly-guard",
                        # Useful tools in a production environment
                        "screen",
                        "strace",
                        "host",
                        "git",
                        "nagios-plugins-contrib",
                         ]
  package { $org_base_packages: ensure => "installed" }

  # Add system users here
  $users = []

  # Add hosts to monitor here
  $hosts = []

  file { '/etc/apt/apt.conf.d/02periodic':
    ensure     => file,
    mode       => '0644',
    source     => 'puppet:///modules/zulip_ops/apt/apt.conf.d/02periodic',
  }

  file { '/etc/apt/apt.conf.d/50unattended-upgrades':
    ensure     => file,
    mode       => '0644',
    source     => 'puppet:///modules/zulip_ops/apt/apt.conf.d/50unattended-upgrades',
  }

  file { '/home/zulip/.ssh':
    ensure     => directory,
    require    => User['zulip'],
    owner      => "zulip",
    group      => "zulip",
    mode       => '0600',
  }

  # Clear /etc/update-motd.d, to fix load problems with Nagios
  # caused by Ubuntu's default MOTD tools for things like "checking
  # for the next release" being super slow.
  file { '/etc/update-motd.d':
    ensure     => directory,
    recurse    => true,
    purge      => true,
  }

  file { '/etc/pam.d/common-session':
    ensure     => file,
    require    => Package['openssh-server'],
    source     => 'puppet:///modules/zulip_ops/common-session',
    owner      => 'root',
    group      => 'root',
    mode       => '0644',
  }

  service { 'ssh':
    ensure     => running,
  }

  if $zulip::base::release_name == "xenial" {
    # Our custom sshd_config uses options that don't exist on trusty.
    file { '/etc/ssh/sshd_config':
      ensure     => file,
      require    => Package['openssh-server'],
      source     => 'puppet:///modules/zulip_ops/sshd_config',
      owner      => 'root',
      group      => 'root',
      mode       => '0644',
      notify     => Service['ssh'],
    }
  }

  file { '/root/.emacs':
    ensure     => file,
    mode       => '0600',
    owner      => "root",
    group      => "root",
    source     => 'puppet:///modules/zulip_ops/dot_emacs.el',
  }

  file { '/home/zulip/.emacs':
    ensure     => file,
    mode       => '0600',
    owner      => "zulip",
    group      => "zulip",
    source     => 'puppet:///modules/zulip_ops/dot_emacs.el',
    require    => User['zulip'],
  }

  if $zulip::base::release_name == "xenial" {
    # TODO: Change this condition to something more coherent.
    file { '/root/.ssh/authorized_keys':
      ensure     => file,
      mode       => '0600',
      owner      => "root",
      group      => "root",
      source     => 'puppet:///modules/zulip_ops/root_authorized_keys',
    }
    file { '/home/zulip/.ssh/authorized_keys':
      ensure     => file,
      require    => File['/home/zulip/.ssh'],
      mode       => '0600',
      owner      => "zulip",
      group      => "zulip",
      source     => 'puppet:///modules/zulip_ops/authorized_keys',
    }
    file { '/var/lib/nagios/.ssh/authorized_keys':
      ensure     => file,
      require    => File['/var/lib/nagios/.ssh'],
      mode       => '0600',
      owner      => "nagios",
      group      => "nagios",
      source     => 'puppet:///modules/zulip_ops/nagios_authorized_keys',
    }
  }

  if $zulip::base::release_name == "xenial" {
    # This is a proxy for the fact that our xenial machines are the
    # ones in EC2.
    file { '/usr/local/sbin/zulip-ec2-configure-interfaces':
      ensure     => file,
      mode       => '0755',
      source     => 'puppet:///modules/zulip_ops/zulip-ec2-configure-interfaces',
    }

    file { '/etc/network/if-up.d/zulip-ec2-configure-interfaces_if-up.d.sh':
      ensure     => file,
      mode       => '0755',
      source     => 'puppet:///modules/zulip_ops/zulip-ec2-configure-interfaces_if-up.d.sh',
    }
  }

  group { 'nagios':
    ensure     => present,
    gid => '1050',
  }
  user { 'nagios':
    ensure     => present,
    uid        => '1050',
    gid        => '1050',
    shell      => '/bin/bash',
    home       => '/var/lib/nagios',
    managehome => true,
  }
  file { '/var/lib/nagios/':
    ensure     => directory,
    require    => User['nagios'],
    owner      => "nagios",
    group      => "nagios",
    mode       => '0600',
  }
  file { '/var/lib/nagios/.ssh':
    ensure     => directory,
    require    => File['/var/lib/nagios/'],
    owner      => "nagios",
    group      => "nagios",
    mode       => '0600',
  }
  file { '/home/nagios':
    ensure => absent,
    force => true,
    recurse => true,
  }
  if $zulip::base::release_name == "xenial" {
    # Trusty's puppet doesn't support the include? rule used in rules.v4.
    file { '/etc/iptables/rules.v4':
      ensure     => file,
      mode       => '0600',
      content    => template('zulip_ops/iptables/rules.v4.erb'),
      require    => Package['iptables-persistent'],
    }
    service { 'netfilter-persistent':
      ensure     => running,

      # Because there is no running process for this service, the normal status
      # checks fail.  Because puppet then thinks the service has been manually
      # stopped, it won't restart it.  This fake status command will trick puppet
      # into thinking the service is *always* running (which in a way it is, as
      # iptables is part of the kernel.)
      hasstatus => true,
      status => "/bin/true",

      # Under Debian, the "restart" parameter does not reload the rules, so tell
      # Puppet to fall back to stop/start, which does work.
      hasrestart => false,

      require    => Package['iptables-persistent'],
      subscribe  => File['/etc/iptables/rules.v4'],
    }
  }
}