trust anchorsct-ops-2015-03-22-v02

4 files changed, 129 insertions, 0 deletions

diff --git a/global/overlay/etc/puppet/modules/sunet/manifests/docker_run.pp b/global/overlay/etc/puppet/modules/sunet/manifests/docker_run.pp
new file mode 100644
index 0000000..8df416b
--- /dev/null
+++ b/global/overlay/etc/puppet/modules/sunet/manifests/docker_run.pp
@@ -0,0 +1,42 @@
+# Common use of docker::run
+define sunet::docker_run(
+  $image,
+  $imagetag            = hiera('sunet_docker_default_tag', 'latest'),
+  $volumes             = [],
+  $ports               = [],
+  $env                 = [],
+  $net                 = 'bridge',
+  $extra_parameters    = [],
+) {
+
+  # Make container use unbound resolver on dockerhost
+  # If docker was just installed, facter will not know the IP of docker0. Thus the pick.
+  $dns = $net ? {
+    'host'  => [],  # docker refuses --dns with --net host
+    default => [pick($::ipaddress_docker0, '172.17.42.1')],
+  }
+
+  $image_tag = "${image}:${imagetag}"
+  docker::image { $image_tag : } ->
+
+  docker::run {$name :
+    use_name           => true,
+    image              => $image_tag,
+    volumes            => flatten([$volumes,
+                           '/etc/passwd:/etc/passwd:ro',  # uid consistency
+                           '/etc/group:/etc/group:ro',    # gid consistency
+                           ]),
+    ports              => $ports,
+    env                => $env,
+    net                => $net,
+    extra_parameters   => flatten([$extra_parameters,
+                                   '--rm',
+                                   ]),
+    dns                => $dns,
+    verify_checksum    => false,    # Rely on registry security for now. eduID risk #31.
+    pre_start          => 'run-parts /usr/local/etc/docker.d',
+    post_start         => 'run-parts /usr/local/etc/docker.d',
+    pre_stop           => 'run-parts /usr/local/etc/docker.d',
+  }
+
+}
diff --git a/global/overlay/etc/puppet/modules/sunet/manifests/dockerhost.pp b/global/overlay/etc/puppet/modules/sunet/manifests/dockerhost.pp
new file mode 100644
index 0000000..67f75f9
--- /dev/null
+++ b/global/overlay/etc/puppet/modules/sunet/manifests/dockerhost.pp
@@ -0,0 +1,56 @@
+# Install docker from https://get.docker.com/ubuntu
+class sunet::dockerhost {
+  apt::source {'docker_official':
+     location           => 'https://get.docker.com/ubuntu',
+     release            => 'docker',
+     repos              => 'main',
+     key                => 'A88D21E9',
+     include_src        => false
+  }
+  package {'lxc-docker':
+     ensure             => latest,
+  }
+
+  class {'docker':
+     manage_package     => false,
+  }
+
+  package { 'unbound': ensure => 'latest' }
+  service { 'unbound': ensure => 'running' }
+
+  file { '/usr/local/etc/docker.d/20unbound':
+    ensure  => file,
+    path    => '/usr/local/etc/docker.d/20unbound',
+    mode    => '0755',
+    content => template('sunet/dockerhost/20unbound.erb'),
+  }
+
+  file { '/etc/logrotate.d/docker-containers':
+    ensure  => file,
+    path    => '/etc/logrotate.d/docker-containers',
+    mode    => '0644',
+    content => template('sunet/dockerhost/logrotate_docker-containers.erb'),
+  }
+
+  file { '/etc/unbound/unbound.conf.d/docker.conf':
+    ensure  => file,
+    path    => '/etc/unbound/unbound.conf.d/docker.conf',
+    mode    => '0644',
+    content => template('sunet/dockerhost/unbound_docker.conf.erb'),
+    notify  => Service['unbound'],
+  }
+
+  ufw::allow { 'allow-docker-resolving_udp':
+    port  => '53',
+    ip    => $::ipaddress_docker0,    # both IPv4 and IPv6
+    from  => '172.16.0.0/12',
+    proto => 'udp',
+  }
+  ufw::allow { 'allow-docker-resolving_tcp':
+    port  => '53',
+    ip    => $::ipaddress_docker0,    # both IPv4 and IPv6
+    from  => '172.16.0.0/12',
+    proto => 'tcp',
+  }
+
+}
diff --git a/global/overlay/etc/puppet/modules/sunet/manifests/encrypted_swap.pp b/global/overlay/etc/puppet/modules/sunet/manifests/encrypted_swap.pp
new file mode 100644
index 0000000..9956e00
--- /dev/null
+++ b/global/overlay/etc/puppet/modules/sunet/manifests/encrypted_swap.pp
@@ -0,0 +1,12 @@
+define sunet::encrypted_swap() {
+
+  package { 'ecryptfs-utils':
+    ensure => 'installed'
+  } ->
+
+  exec {'sunet_ecryptfs_setup_swap':
+    command => '/usr/bin/ecryptfs-setup-swap -f',
+    onlyif  => 'grep swap /etc/fstab | grep -ve ^# -e cryptswap | grep -q swap',
+  }
+
+}
diff --git a/global/overlay/etc/puppet/modules/sunet/manifests/ethernet_bonding.pp b/global/overlay/etc/puppet/modules/sunet/manifests/ethernet_bonding.pp
new file mode 100644
index 0000000..8ff7325
--- /dev/null
+++ b/global/overlay/etc/puppet/modules/sunet/manifests/ethernet_bonding.pp
@@ -0,0 +1,19 @@
+define sunet::ethernet_bonding() {
+  # Set up prerequisites for Ethernet LACP bonding of eth0 and eth1,
+  # for all physical hosts that are running Ubuntu.
+  #
+  # Bonding requires setup in /etc/network/interfaces as well.
+  #
+  if $::is_virtual == 'false' and $::operatingsystem == 'Ubuntu' {
+    if $::operatingsystemrelease <= '12.04' {
+      package {'ifenslave': ensure => 'present' }
+    } else {
+      package {'ifenslave-2.6': ensure => 'present' }
+    }
+
+    file_line { 'load_module_at_boot':
+      path => '/etc/modules',
+      line => 'bonding',
+    }
+  }
+}