switch to sunet modulect-ops-2015-05-09-v01

8 files changed, 2 insertions, 219 deletions

diff --git a/global/overlay/etc/puppet/cosmos-modules.conf b/global/overlay/etc/puppet/cosmos-modules.conf
index 20c6106..f27a90b 100644
--- a/global/overlay/etc/puppet/cosmos-modules.conf
+++ b/global/overlay/etc/puppet/cosmos-modules.conf
@@ -14,6 +14,8 @@ xinetd          git://github.com/SUNET/puppetlabs-xinetd.git yes sunet-*
 hiera-gpg       git://github.com/SUNET/hiera-gpg.git yes sunet-*
 augeas 		git://github.com/SUNET/puppet-augeas.git yes sunet-*
 docker          git://github.com/SUNET/garethr-docker.git yes sunet_dev-*
+sunet 		git://github.com/SUNET/puppet-sunet.git yes sunet-*
+
 #
 # Alternate sources you might or might not want to use:
 #concat          puppetlabs/concat no
diff --git a/global/overlay/etc/puppet/modules/sunet/manifests/docker_run.pp b/global/overlay/etc/puppet/modules/sunet/manifests/docker_run.pp
deleted file mode 100644
index 8df416b..0000000
--- a/global/overlay/etc/puppet/modules/sunet/manifests/docker_run.pp
+++ /dev/null
@@ -1,42 +0,0 @@
-# Common use of docker::run
-define sunet::docker_run(
-  $image,
-  $imagetag            = hiera('sunet_docker_default_tag', 'latest'),
-  $volumes             = [],
-  $ports               = [],
-  $env                 = [],
-  $net                 = 'bridge',
-  $extra_parameters    = [],
-) {
-
-  # Make container use unbound resolver on dockerhost
-  # If docker was just installed, facter will not know the IP of docker0. Thus the pick.
-  $dns = $net ? {
-    'host'  => [],  # docker refuses --dns with --net host
-    default => [pick($::ipaddress_docker0, '172.17.42.1')],
-  }
-
-  $image_tag = "${image}:${imagetag}"
-  docker::image { $image_tag : } ->
-
-  docker::run {$name :
-    use_name           => true,
-    image              => $image_tag,
-    volumes            => flatten([$volumes,
-                           '/etc/passwd:/etc/passwd:ro',  # uid consistency
-                           '/etc/group:/etc/group:ro',    # gid consistency
-                           ]),
-    ports              => $ports,
-    env                => $env,
-    net                => $net,
-    extra_parameters   => flatten([$extra_parameters,
-                                   '--rm',
-                                   ]),
-    dns                => $dns,
-    verify_checksum    => false,    # Rely on registry security for now. eduID risk #31.
-    pre_start          => 'run-parts /usr/local/etc/docker.d',
-    post_start         => 'run-parts /usr/local/etc/docker.d',
-    pre_stop           => 'run-parts /usr/local/etc/docker.d',
-  }
-
-}
diff --git a/global/overlay/etc/puppet/modules/sunet/manifests/dockerhost.pp b/global/overlay/etc/puppet/modules/sunet/manifests/dockerhost.pp
deleted file mode 100644
index 67f75f9..0000000
--- a/global/overlay/etc/puppet/modules/sunet/manifests/dockerhost.pp
+++ /dev/null
@@ -1,56 +0,0 @@
-# Install docker from https://get.docker.com/ubuntu
-class sunet::dockerhost {
-  apt::source {'docker_official':
-     location           => 'https://get.docker.com/ubuntu',
-     release            => 'docker',
-     repos              => 'main',
-     key                => 'A88D21E9',
-     include_src        => false
-  }
-  package {'lxc-docker':
-     ensure             => latest,
-  }
-
-  class {'docker':
-     manage_package     => false,
-  }
-
-  package { 'unbound': ensure => 'latest' }
-  service { 'unbound': ensure => 'running' }
-
-  file { '/usr/local/etc/docker.d/20unbound':
-    ensure  => file,
-    path    => '/usr/local/etc/docker.d/20unbound',
-    mode    => '0755',
-    content => template('sunet/dockerhost/20unbound.erb'),
-  }
-
-  file { '/etc/logrotate.d/docker-containers':
-    ensure  => file,
-    path    => '/etc/logrotate.d/docker-containers',
-    mode    => '0644',
-    content => template('sunet/dockerhost/logrotate_docker-containers.erb'),
-  }
-
-  file { '/etc/unbound/unbound.conf.d/docker.conf':
-    ensure  => file,
-    path    => '/etc/unbound/unbound.conf.d/docker.conf',
-    mode    => '0644',
-    content => template('sunet/dockerhost/unbound_docker.conf.erb'),
-    notify  => Service['unbound'],
-  }
-
-  ufw::allow { 'allow-docker-resolving_udp':
-    port  => '53',
-    ip    => $::ipaddress_docker0,    # both IPv4 and IPv6
-    from  => '172.16.0.0/12',
-    proto => 'udp',
-  }
-  ufw::allow { 'allow-docker-resolving_tcp':
-    port  => '53',
-    ip    => $::ipaddress_docker0,    # both IPv4 and IPv6
-    from  => '172.16.0.0/12',
-    proto => 'tcp',
-  }
-
-}
diff --git a/global/overlay/etc/puppet/modules/sunet/manifests/encrypted_swap.pp b/global/overlay/etc/puppet/modules/sunet/manifests/encrypted_swap.pp
deleted file mode 100644
index 9956e00..0000000
--- a/global/overlay/etc/puppet/modules/sunet/manifests/encrypted_swap.pp
+++ /dev/null
@@ -1,12 +0,0 @@
-define sunet::encrypted_swap() {
-
-  package { 'ecryptfs-utils':
-    ensure => 'installed'
-  } ->
-
-  exec {'sunet_ecryptfs_setup_swap':
-    command => '/usr/bin/ecryptfs-setup-swap -f',
-    onlyif  => 'grep swap /etc/fstab | grep -ve ^# -e cryptswap | grep -q swap',
-  }
-
-}
diff --git a/global/overlay/etc/puppet/modules/sunet/manifests/ethernet_bonding.pp b/global/overlay/etc/puppet/modules/sunet/manifests/ethernet_bonding.pp
deleted file mode 100644
index 8ff7325..0000000
--- a/global/overlay/etc/puppet/modules/sunet/manifests/ethernet_bonding.pp
+++ /dev/null
@@ -1,19 +0,0 @@
-define sunet::ethernet_bonding() {
-  # Set up prerequisites for Ethernet LACP bonding of eth0 and eth1,
-  # for all physical hosts that are running Ubuntu.
-  #
-  # Bonding requires setup in /etc/network/interfaces as well.
-  #
-  if $::is_virtual == 'false' and $::operatingsystem == 'Ubuntu' {
-    if $::operatingsystemrelease <= '12.04' {
-      package {'ifenslave': ensure => 'present' }
-    } else {
-      package {'ifenslave-2.6': ensure => 'present' }
-    }
-
-    file_line { 'load_module_at_boot':
-      path => '/etc/modules',
-      line => 'bonding',
-    }
-  }
-}
diff --git a/global/overlay/etc/puppet/modules/sunet/templates/dockerhost/20unbound.erb b/global/overlay/etc/puppet/modules/sunet/templates/dockerhost/20unbound.erb
deleted file mode 100755
index 204e97c..0000000
--- a/global/overlay/etc/puppet/modules/sunet/templates/dockerhost/20unbound.erb
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/bin/bash
-#
-# This script registers/removes docker containers IP addresses
-# from the local unbound resolver in the post-start / pre-stop actions.
-#
-# For action pre-start, it checks if there is a CID file that needs to be
-# cleaned away to not prevent the new container from starting.
-#
-
-# sunet_docker_pre-post: CID d05a0842ce1700ee3328d42ccf5c2f29cc3d71fa6dcc6a72f994f8d032453be7
-# sunet_docker_pre-post: ACTION pre-stop
-# sunet_docker_pre-post: IMAGE docker.sunet.se/eduid/eduid-mm-service
-# sunet_docker_pre-post: NAME eduid-mm-service
-#for e in "CID" "ACTION" "IMAGE" "NAME"; do
-#    logger -t sunet_docker_pre-post "$e `printenv $e`"
-#done
-
-logtag="sunet_docker_pre-post[$ACTION]"
-logger -t "${logtag}" "$NAME ($IMAGE), CID: '$CID'"
-
-if [ "x$ACTION" = "xpre-start" ]; then
-    if [ -f "${CIDFILE}" ]; then
-        # Clean away the CID file in pre-start if the container is in fact not running
-	docker inspect "${CID}" 2>/dev/null || (
-	    logger -t "${logtag}" "Removing left-over CID file '${CIDFILE}' (CID ${CID})";
-	    rm -f "${CIDFILE}"
-	  )
-    fi
-
-    # Remove any stopped container with this name to prevent the docker start script
-    # from just restarting that one (instead of starting the currently tagged image,
-    # which might be newer than the one used by the old container)
-    docker inspect "${NAME}" && docker rm "${NAME}"
-    exit 0
-fi
-
-if [ "x${CID}" = "x" ]; then
-    CID=$(docker inspect --format '{{ .Id }}' "${NAME}" 2>/dev/null)
-
-    if [ "x${CID}" = "x" ]; then
-	# sometimes containers start slow...
-	for retry in 1 2 3 4 5; do
-	    sleep 1
-	    logger -t "${logtag}" "Retrying CID lookup for ${NAME}"
-	    CID=$(docker inspect --format '{{ .Id }}' "${NAME}" 2>/dev/null)
-	    if [ "x${CID}" != "x" ]; then
-		break
-	    fi
-	done
-    fi
-
-    if [ "x${CID}" = "x" ]; then
-	logger -t "${logtag}" "No CID provided or found! Aborting."
-	exit 0
-    fi
-
-    logger -t "${logtag}" "Found CID ${CID} using docker inspect on '${NAME}'"
-fi
-
-# Remove registered name.
-# XXX this does NOT handle multiple instances of the same image running on
-# a single Docker host!
-logger -t "${logtag}" "Un-registering ${NAME}.docker"
-unbound-control local_data_remove "${NAME}.docker." > /dev/null
-
-# If it is a container starting up, register it's IP address
-if [ "x$ACTION" = "xpost-start" ]; then
-    ip=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' "${CID}" 2>/dev/null)
-    if [ "x${ip}" = "x" ]; then
-	logger -t "${logtag}" "Failed to get IP from CID ${CID}. Aborting."
-	exit 0
-    fi
-    unbound-control local_data "${NAME}.docker. 60 IN A ${ip}" > /dev/null
-    # Register reverse pointer - there is no local_data_ptr command unfortunately
-    ptr=$(echo "${ip}" | awk -F . '{print $4"."$3"."$2"."$1".in-addr.arpa."}')
-    unbound-control local_data "${ptr} 60 IN PTR ${NAME}.docker."
-    logger -t "${logtag}" "Registered ${NAME}.docker at ${ip}"
-fi
diff --git a/global/overlay/etc/puppet/modules/sunet/templates/dockerhost/logrotate_docker-containers.erb b/global/overlay/etc/puppet/modules/sunet/templates/dockerhost/logrotate_docker-containers.erb
deleted file mode 100644
index 6cf5fe9..0000000
--- a/global/overlay/etc/puppet/modules/sunet/templates/dockerhost/logrotate_docker-containers.erb
+++ /dev/null
@@ -1,7 +0,0 @@
-/var/lib/docker/containers/*/*.log {
-  rotate 7
-  daily
-  compress
-  delaycompress
-  copytruncate
-}
diff --git a/global/overlay/etc/puppet/modules/sunet/templates/dockerhost/unbound_docker.conf.erb b/global/overlay/etc/puppet/modules/sunet/templates/dockerhost/unbound_docker.conf.erb
deleted file mode 100644
index f6bb382..0000000
--- a/global/overlay/etc/puppet/modules/sunet/templates/dockerhost/unbound_docker.conf.erb
+++ /dev/null
@@ -1,5 +0,0 @@
-server:
-	local-zone: docker. static
-	interface: 127.0.0.1
-	interface: 172.17.42.1
-	access-control: 172.16.0.0/12 allow