diff options
| -rwxr-xr-x | edit-secrets | 4 | ||||
| -rw-r--r-- | global/overlay/etc/cosmos/keys/leifj-0AD478D6.pub | 57 | ||||
| -rw-r--r-- | global/overlay/etc/puppet/cosmos-rules.yaml | 2 | ||||
| -rw-r--r-- | global/overlay/etc/puppet/manifests/cosmos-site.pp | 6 | ||||
| -rw-r--r-- | global/overlay/etc/puppet/puppet.conf | 1 | ||||
| -rwxr-xr-x | global/post-tasks.d/018packages | 98 | ||||
| l--------- | sto-tug-kvm-lab1.swamid.se/README (renamed from sto-tug-kvm2.swamid.se/README) | 0 | ||||
| l--------- | sto-tug-kvm-lab2.swamid.se/README | 1 | ||||
| -rw-r--r-- | wp.sunet.se/overlay/etc/hiera/data/secrets.yaml.asc | 23 |
9 files changed, 178 insertions, 14 deletions
diff --git a/edit-secrets b/edit-secrets index 08ec257..2c05197 100755 --- a/edit-secrets +++ b/edit-secrets @@ -32,8 +32,8 @@ if [ "x$1" != "x-l" ]; then trap "rm -f $TMPFILE $TMPFILE2" EXIT - ssh -t $host /var/cache/cosmos/repo/edit-secrets -l - scp -q $host:$LAST_OUTPUT_FILENAME $TMPFILE + ssh -t root@$host /var/cache/cosmos/repo/edit-secrets -l + scp -q root@$host:$LAST_OUTPUT_FILENAME $TMPFILE if grep ^"STATUS=UPDATED" $TMPFILE > /dev/null; then # extract the path of the file that should be updated in the Cosmos repo diff --git a/global/overlay/etc/cosmos/keys/leifj-0AD478D6.pub b/global/overlay/etc/cosmos/keys/leifj-0AD478D6.pub new file mode 100644 index 0000000..de47bd1 --- /dev/null +++ b/global/overlay/etc/cosmos/keys/leifj-0AD478D6.pub @@ -0,0 +1,57 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.14 (GNU/Linux) + +mQENBFJK9qIBCACypED81H1N4YmhMJrb4uOtTDzo+lFZDVVOcK11+NhTFl+AZZFn +WH/7UPn+q5ZZBd/IhONfb5QGw5FzTyBWHsbAteXgCvHAIyumwhQzhZnow6myyC6/ +MwDhomT5rb3MkCKCyQMNfj/yMgL6ZRsXVhlGOLMmOekRfKe2wiC5BhRaQQwPZPwg +FS5D0Tro8Xfxjk98u8rNpQXi9walRAffRY+byhkPiBj0sVA2RXK9Dx2DL3EY0xx0 +7r6Qhs2XkbXNDDCHRuChhHSHwWC16VS9x7Nhfg2EwKqmMGRNREikjwzDl/aHKz+F +XTLONdmc83sRyklqgH90f3na6s/RT5XTb08xABEBAAG0H0xlaWYgSm9oYW5zc29u +IDxsZWlmakBzdW5ldC5zZT6JAT4EEwECACgFAlJK9qICGwMFCQHhM4AGCwkIBwMC +BhUIAgkKCwQWAgMBAh4BAheAAAoJENc61kMK1HjW90oH/2nDzWNZruMFnRSOf95D +TBBiZ8u82nl9weMQhS2ZxRa1V5bBGctv6XBlRFEhjms2bHcjCJAvROAfDfLvYHIN +7f83o7iXK1IqlYDWu19L/wS9zojlYS+h3fDpww7W8/Go2NRkILaAu9unr0tQsWsw +3tNQFMjHWqZNPh15ntRdSDf9Gx6naU9A8vYbPYmnAf9yRPRY+U+hOnX58qWgMjGx +NxYzejDbV/HZhC5ddM631mMQNL42JR5Gs0SYqL24fIyg54hl9buLcvQ2SeVdsCLJ +ythVObWvT+5JBKvjqMGNrueoxVuvQ5rACDPDMGZYMg0ZDJ3Qj3MVH8VaYlHGbtPc +Z6S0IExlaWYgSm9oYW5zc29uIDxsZWlmakBub3JkdS5uZXQ+iQE9BBMBAgAoBQJS +SvdGAhsDBQkB4TOABgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRDXOtZDCtR4 +1swpB/Yj2OSeX7xA7f5oR0AiM8QVGqL6KK2sQ+w7jDM2AdVKyT4sNkpnZwrei2iN +twUIomunsAeAE+/Ryywag6gTWN3Y2fKadL+qx7G/Ydw3PGvqP0XZXZiCpquvdVep +0JYTva0W0Zq6VtmZM50bQ0nI2tQvYH1S43/noImlQ4YqqE3wG8+SQ1F7mwwEZUda +Q7ixR43m42U/pL3tGQ+U1iYSNXEodcBEBrUodd0BVzvfJXoDg5cGA5ORRbmafjbD +4Aj+2wbdSQXvQ0qz6uji9g2crofnJbd91KKgdpq+gyi59iSYKsFDqO/I9x6y0ZDb +XT56plOWHko8GlsGa1/W6yXW/UG0HUxlaWYgSm9oYW5zc29uIDxsZWlmakBtbnQu +c2U+iQE+BBMBAgAoBQJSSvdSAhsDBQkB4TOABgsJCAcDAgYVCAIJCgsEFgIDAQIe +AQIXgAAKCRDXOtZDCtR41qzhB/0QievHhsE3U9ZVdahQvpvQ52c7w9AuKBrMT49O +fz4IJSryycYRgl0k0YRP2W1YbFCevKhLUhUFPLpYORmsaxb7POnZY1sJWIC9e1ZZ +hsVrHTjVK1l0Zw63DQSQhzG7NVSt6XfvFF02HNi4/tNCPR3Qa6p1MsHNr8wKan0B +iHihriYlhmMZMBcbLhw9BHQP30GgLPwEEKP8t6msppZw0BpT38/CFg/8Bjy6hqLN +LPAN80dMH7ZremLzkdSenFgv8MhfH6Bchx5VCIUY+RNkCWr6Pbll9h5TmbwR7dge +gFtphOErGjIdNmE3f2WI0yI4ojqRo9YsmZid62ZIGqTBFfh8uQENBFJK9qIBCAC+ +k1tFOeDS4gMxEgRkfiVLHFemwJWQiGZHYhtDgjh6w6mB8G3WZ+/gD2CMp5DgHFRC +1sW2iMj3gOzrfyxzd9AmWbhXYceR6EFkTc6OVsaIb+eHH/Zo3DKyB1Dq9CA5fjjn +EQzti+KKSZYWzB0Fkt7qrfOS6YM1zMjEUxUUwsl1qirx5DuByWLDX7ULU7H/xmPV +hHUVZO8XEaFV2m+ICx8Y6B98KMeJ0Qz8b8wp2g7vWEkwS2R6IjF0kMrRxnxUvwA6 +EUiZuFphhuY/lWCJusLl1olgOE+BKMEUStJWEi0s+pd8FL1vOLeNKbIUFro0+oZr +9byABpkPNjMxKV36uj1dABEBAAGJASUEGAECAA8FAlJK9qICGwwFCQHhM4AACgkQ +1zrWQwrUeNbxiAgAjE7DGYlxtgPKCgcbkAs/ogoSTTXeXGu+rv/HAbRV8oOpzuMo +NjiPjZ+kDNoGAed2aay9Qfa1/VN+eBHap3zMEMDGEWpVl0SC+TwqpO/iPIG2dQBa +mf7kDUaH4WNJB2pPKh6dXivmTOFb4My+Xj964Rpi3BbD65YEpM1uex8YFAsB/E00 +3BRFEmtNVsuTf2s1qMDhAOjGei6O6sygbl3W9OCNMU749AnwK8wTmoTENSsO1SfM +ZisdUwnLTv4rTQ73Ps0vdNz37VLThem1fDmLOwDwTVaDJeHDbFwoyWlqUFXRl0BA +oaICnSL53b5u4IgPE44qdzecLqk8zLvLQ/MaY7kBDQRSSvdtAQgA1bweIHSehFkZ +sfMVEsa4aFDZ1sRH/GcAKocwtfu1wWP4Unf3GxKLSwfYMYKrdAi1uelVOBTy08PL +Jw/LYLMmTeih9Q2u1F56PKDJPLSXcC0DNBoMd2lrs7SLZA3wXNy376uU9O2H6Yai +Tu63Ehm0uEEHX5V7jjPSS4ujUrVWqNImuGhOk4+vKVVW9/vl2L6r21OjbRCAr5E8 +RGPd2KZ0Un3gIuuIbG2qkkzeJKXpbc6Eg9UYpM9mkBbRVxNN2QuPB7RhoXTBQPwH +XuilgQ2l8RxgEVUPf1HHH4Wkdl0o1cUmfBQTTszbB+JPXECG9p3ZBDl2V54xeWY3 +SOGVNBfrewARAQABiQElBBgBAgAPBQJSSvdtAhsgBQkB4TOAAAoJENc61kMK1HjW +dF0H/1LeKrJKrshMoGhFJcS7MRuFZ0IpiX4jQfQO1OZs3EqO4RNc5E0kM0SVRJOL +RRtEfFLxCiKbalL7od9vx+MMhgEc7u9GEG3Y8zSDyXVw1tN+g81XmVPJBcPhvkYp +gRLNz5kGPouXkP2H4Ychrmuh0WsvyUz79dQLm+HApQjdXNT4E1iE7DSUk1RPX2+g +dwQZJMSZWK75MJOacXyXaOY3VMXdcktd5+b8qJpGPIALW4FcCYxQ2OMGZLqzOcvn +KYujFdpbqYn7d+K0sBqWff7vV+sBvtpkt1mmU4sqlKEMDyUmFGkeVXV2JQgKO3xw +AgNCtRmgSc3HQWINbIE2pLpurfU= +=P2xq +-----END PGP PUBLIC KEY BLOCK----- diff --git a/global/overlay/etc/puppet/cosmos-rules.yaml b/global/overlay/etc/puppet/cosmos-rules.yaml index 2244c7a..137bd28 100644 --- a/global/overlay/etc/puppet/cosmos-rules.yaml +++ b/global/overlay/etc/puppet/cosmos-rules.yaml @@ -4,3 +4,5 @@ '^cdr\d+\.sunet\.se$': sunet-cdr: sunet: +'\.swamid\.se$': + swamid: diff --git a/global/overlay/etc/puppet/manifests/cosmos-site.pp b/global/overlay/etc/puppet/manifests/cosmos-site.pp index 1e4e857..8b161a2 100644 --- a/global/overlay/etc/puppet/manifests/cosmos-site.pp +++ b/global/overlay/etc/puppet/manifests/cosmos-site.pp @@ -13,7 +13,7 @@ Exec { #include cosmos::preseed include ufw include apt -include cosmos +#include cosmos # you need a default node @@ -275,3 +275,7 @@ class sunet-cdr { class { 'sunet-dhcp-hosts': } } + +class swamid { + sunet::server { 'sunet_server': } +} diff --git a/global/overlay/etc/puppet/puppet.conf b/global/overlay/etc/puppet/puppet.conf index 0ba85f4..a269892 100644 --- a/global/overlay/etc/puppet/puppet.conf +++ b/global/overlay/etc/puppet/puppet.conf @@ -7,6 +7,7 @@ factpath=$vardir/lib/facter templatedir=$confdir/templates node_terminus = exec external_nodes = /etc/puppet/cosmos_enc.py +modulepath = /etc/puppet/modules:/etc/puppet/cosmos-modules:/usr/share/puppet/modules [master] # These are needed when the puppetmaster is run by passenger diff --git a/global/post-tasks.d/018packages b/global/post-tasks.d/018packages index 9e25e69..57dff1a 100755 --- a/global/post-tasks.d/018packages +++ b/global/post-tasks.d/018packages @@ -1,16 +1,92 @@ -#!/bin/sh +#!/bin/bash + +CONFIG=${CONFIG:=/etc/puppet/cosmos-modules.conf} +CACHE_DIR=/var/cache/puppet-modules +MODULES_DIR=${MODULES_DIR:=/etc/puppet/cosmos-modules} +GIT_TAG_PATTERN=${COSMOS_UPDATE_VERIFY_GIT_TAG_PATTERN:-multiverse*} +export GNUPGHOME=/etc/cosmos/gnupg python -c "import yaml" 2>/dev/null || apt-get -y install python-yaml -if [ -f /etc/puppet/cosmos-modules.conf ]; then - grep -E -v "^#" /etc/puppet/cosmos-modules.conf | ( - cd /etc/puppet/modules && while read module src update; do - if [ ! -d /etc/puppet/modules/$module ]; then - echo $src | grep -q "://" && git clone $src $module || puppet module install $src - else - if [ "x$update" = "xyes" ]; then - echo $src | grep -q "://" && (cd /etc/puppet/modules/$module && git pull -q) || puppet module upgrade $src + +stage_module() { + rm -rf $CACHE_DIR/staging/$1 + git archive --format=tar --prefix=$1/ $2 | (cd $CACHE_DIR/staging/ && tar xf -) +} + +if [ -f $CONFIG ]; then + if [ ! -d $MODULES_DIR ]; then + mkdir -p $MODULES_DIR + fi + if [ ! -d $CACHE_DIR ]; then + mkdir -p $CACHE_DIR/{scm,staging} + fi + + # First pass to clone any new modules, and update those marked for updating. + grep -E -v "^#" $CONFIG | ( + while read module src update; do + # We only support git:// urls atm + if [ "${src:0:6}" = "git://" ]; then + if [ ! -d $CACHE_DIR/scm/$module ]; then + git clone -q $src $CACHE_DIR/scm/$module + elif [ -d $CACHE_DIR/scm/$module/.git ]; then + if [ "$update" = "yes" ]; then + cd $CACHE_DIR/scm/$module + git pull -q + else + continue fi - fi - done) + else + echo "ERROR: Ignoring non-git repository" + continue + fi + fi + done + ) + + # Second pass to verify the signatures on all modules and stage those that + # have good signatures. + grep -E -v "^#" $CONFIG | ( + while read module src update; do + # We only support git:// urls atm + if [ "${src:0:6}" = "git://" ]; then + # Verify git tag + cd $CACHE_DIR/scm/$module + TAG=$(git tag -l $GIT_TAG_PATTERN | sort | tail -1) + if [ "$COSMOS_VERBOSE" = "y" ]; then + echo "" + echo "Checking signature on tag ${TAG} for puppet-module $module" + fi + if [ -z "$TAG" ]; then + echo "ERROR: No git tag found for pattern '$GIT_TAG_PATTERN' on puppet-module $module" + continue + fi + fail=1 + git tag -v $TAG > /dev/null 2>&1 && fail=0 + if [ $fail == 0 ]; then + if [ "$COSMOS_VERBOSE" = "y" ]; then + # short output on good signature + git tag -v $TAG 2>&1 | grep "gpg: Good signature" + fi + # Put archive in staging since tag verified OK + stage_module $module $TAG + else + echo "################################################################" + echo "FAILED signature check on puppet-module $module" + echo "################################################################" + git tag -v $TAG + fi + fi + done + ) + + # Cleanup removed puppet modules from CACHE_DIR + for MODULE in $(ls -1 $CACHE_DIR/staging/); do + if ! grep -E -q "^$MODULE\s+" $CONFIG; then + rm -rf $CACHE_DIR/{scm,staging}/$MODULE + fi + done + + # Installing verified puppet modules + rsync --archive --delete $CACHE_DIR/staging/ $MODULES_DIR/ fi diff --git a/sto-tug-kvm2.swamid.se/README b/sto-tug-kvm-lab1.swamid.se/README index 59a23c4..59a23c4 120000 --- a/sto-tug-kvm2.swamid.se/README +++ b/sto-tug-kvm-lab1.swamid.se/README diff --git a/sto-tug-kvm-lab2.swamid.se/README b/sto-tug-kvm-lab2.swamid.se/README new file mode 120000 index 0000000..59a23c4 --- /dev/null +++ b/sto-tug-kvm-lab2.swamid.se/README @@ -0,0 +1 @@ +../README
\ No newline at end of file diff --git a/wp.sunet.se/overlay/etc/hiera/data/secrets.yaml.asc b/wp.sunet.se/overlay/etc/hiera/data/secrets.yaml.asc new file mode 100644 index 0000000..bc1cd32 --- /dev/null +++ b/wp.sunet.se/overlay/etc/hiera/data/secrets.yaml.asc @@ -0,0 +1,23 @@ +STATUS=UPDATED +SAVE_TO=wp.sunet.se/overlay/etc/hiera/data/secrets.yaml.asc + +-----BEGIN PGP MESSAGE----- +Version: GnuPG v2.0.17 (GNU/Linux) + +hQEMA7b3Nek3pHIdAQgApiUkD9OMKxX16Y0XofZxcHBoOsSguobKO1oCbOeLGRbG +0CjEbV1BvmPE+tr7oq4XnwIayNPZulgUsk1uTVMeZxPTMaCH+m4b4Mz7bJfWYpyi +wVebwON89rQ8NnCZtPE6Ul6tnoS8QvgUMCRW5slPtu4teSEPD1rR1/WdxuWz8CwP +cnUCEWGfFd4zE2WAdFmWo/VilQTFPqjjvLqPeMl3fpo+cWfzPBDYaNA3bIixAAmb +0LPaN4PbrXIDuUWXP6UPotqhoRVxM4d4lwAFT3TtYylnR9LeMi4mkV9/BbgPuv/Z +7LDGRQQwANeBoSoQI8pGf3Py8r66Fb75MWLhydRKmNLA3wHvvWc7Rk7+B4I+eWZC +NwontFMaLgcmKx6OSz8QU6/DiEKigZjxzzgaInmamJFXngChzlYqqi+OMii+7ZhQ +iXiWnoBItffVNsdVlekTI5aB8ccq2Wek41p3Bs6BRRndfnGyR9Bm99lf9ic9yvpr +wfvMK2DqGv0K7H8T/3344yfuHIHKxr0iwDTNwJ2BdabP0RtyAetrowGG1u0vLtnT +cfb1r5Bk1f+szLKsCt347Yw89ymFnlHvkSV8vdGJHLWukxyw8LPsNEYcjL3TRZHW +w/amIxEssgfu5Kc+/amE4JDByFKPoaIb8X+5h5tccwCWMWTe4vIc83WrUrisUSAp +snB/2erGP3ijcp8GyTZBs4MNxX0MJzW70f6RIO7N5ou1RzwqaOCckj4S7jS3VzIx +lG+Ilfal9nneoSyjLiEby9VpvcCWvaOB+gS5gFXZ0Vt6yuq5sZWFG3svmk1D5O1z +myGkmklo0vUzd/2jIBizwv1TXE1r7SQNasTRyBBoxYXU8EL3j4lR2kcugbbYCdQ+ +NLZOzcYv/rSlyv1oKfF51KI= +=wN6y +-----END PGP MESSAGE----- |