Merge tag '0.8.0'

Release 0.8.0

30 files changed, 336 insertions, 118 deletions

diff --git a/puppet/modules/site_config/manifests/caching_resolver.pp b/puppet/modules/site_config/manifests/caching_resolver.pp
index cdebbad0..8bf465c1 100644
--- a/puppet/modules/site_config/manifests/caching_resolver.pp
+++ b/puppet/modules/site_config/manifests/caching_resolver.pp
@@ -1,14 +1,13 @@
+# deploy local caching resolver
 class site_config::caching_resolver {
   tag 'leap_base'
 
-  include site_apt::preferences::unbound
-
   class { 'unbound':
     root_hints => false,
     anchor     => false,
     ssl        => false,
     settings   => {
-      server       => {
+      server => {
         verbosity      => '1',
         interface      => [ '127.0.0.1', '::1' ],
         port           => '53',
diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index e69e4b7b..256de1a1 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -1,19 +1,11 @@
+# common things to set up on every node
 class site_config::default {
   tag 'leap_base'
 
-  # the logoutput exec parameter defaults to "on_error" in puppet 3,
-  # but to "false" in puppet 2.7, so we need to set this globally here
-  Exec<||> { logoutput => on_failure }
-
   $services    = hiera('services', [])
   $domain_hash = hiera('domain')
   include site_config::params
-
-  # make sure apt is updated before any packages are installed
-  include apt::update
-  Package { require => Exec['apt_updated'] }
-
-  include site_config::slow
+  include site_config::setup
 
   # default class, used by all hosts
 
@@ -29,7 +21,10 @@ class site_config::default {
   # i.e. openstack/aws nodes, vagrant nodes
 
   # fix dhclient from changing resolver information
-   if $::dhcp_enabled == 'true' {
+  # facter returns 'true' as string
+  # lint:ignore:quoted_booleans
+  if $::dhcp_enabled == 'true' {
+  # lint:endignore
     include site_config::dhclient
   }
 
@@ -46,7 +41,7 @@ class site_config::default {
   include haveged
 
   # install/remove base packages
-  include site_config::packages::base
+  include site_config::packages
 
   # include basic shorewall config
   include site_shorewall::defaults
@@ -58,7 +53,9 @@ class site_config::default {
 
   # set up core leap files and directories
   include site_config::files
-  include site_config::remove_files
+
+  # remove leftovers from previous deploys
+  include site_config::remove
 
   if ! member($services, 'mx') {
     include site_postfix::satellite
diff --git a/puppet/modules/site_config/manifests/dhclient.pp b/puppet/modules/site_config/manifests/dhclient.pp
index 7755413b..a1f87d41 100644
--- a/puppet/modules/site_config/manifests/dhclient.pp
+++ b/puppet/modules/site_config/manifests/dhclient.pp
@@ -1,10 +1,10 @@
+# Unfortunately, there does not seem to be a way to reload the dhclient.conf
+# config file, or a convenient way to disable the modifications to
+# /etc/resolv.conf. So the following makes the functions involved noops and
+# ships a script to kill and restart dhclient. See the debian bugs:
+# #681698, #712796
 class site_config::dhclient {
 
-  # Unfortunately, there does not seem to be a way to reload the dhclient.conf
-  # config file, or a convenient way to disable the modifications to
-  # /etc/resolv.conf. So the following makes the functions involved noops and
-  # ships a script to kill and restart dhclient. See the debian bugs:
-  # #681698, #712796
 
   include site_config::params
 
@@ -23,10 +23,10 @@ class site_config::dhclient {
   }
 
   file { '/etc/dhcp/dhclient-enter-hooks.d':
-    ensure  => directory,
-    mode    => '0755',
-    owner   => 'root',
-    group   => 'root',
+    ensure => directory,
+    mode   => '0755',
+    owner  => 'root',
+    group  => 'root',
   }
 
   file { '/etc/dhcp/dhclient-enter-hooks.d/disable_resolvconf':
diff --git a/puppet/modules/site_config/manifests/files.pp b/puppet/modules/site_config/manifests/files.pp
index 684d3ad0..d2ef8a98 100644
--- a/puppet/modules/site_config/manifests/files.pp
+++ b/puppet/modules/site_config/manifests/files.pp
@@ -1,3 +1,4 @@
+# set up core leap files and directories
 class site_config::files {
 
   file {
@@ -7,15 +8,15 @@ class site_config::files {
       group   => 'root',
       mode    => '0711';
 
-    '/var/lib/leap':
+    [ '/etc/leap', '/var/lib/leap']:
       ensure => directory,
-      owner  => root,
+      owner  => 'root',
       group  => 'root',
       mode   => '0755';
 
     '/var/log/leap':
       ensure => directory,
-      owner  => root,
+      owner  => 'root',
       group  => 'adm',
       mode   => '0750';
   }
diff --git a/puppet/modules/site_config/manifests/packages.pp b/puppet/modules/site_config/manifests/packages.pp
new file mode 100644
index 00000000..140189a4
--- /dev/null
+++ b/puppet/modules/site_config/manifests/packages.pp
@@ -0,0 +1,32 @@
+# install default packages and remove unwanted packages
+class site_config::packages {
+
+
+  # base set of packages that we want to have installed everywhere
+  package { [ 'etckeeper', 'screen', 'less', 'ntp' ]:
+    ensure => installed,
+  }
+
+  # base set of packages that we want to remove everywhere
+  package { [
+    'acpi', 'build-essential',
+    'cpp', 'cpp-4.6', 'cpp-4.7', 'cpp-4.8', 'cpp-4.9',
+    'eject', 'ftp',
+    'g++', 'g++-4.6', 'g++-4.7', 'g++-4.8', 'g++-4.9',
+    'gcc', 'gcc-4.6', 'gcc-4.7', 'gcc-4.8', 'gcc-4.9',
+    'laptop-detect', 'libc6-dev', 'libssl-dev', 'lpr', 'make',
+    'pppconfig', 'pppoe', 'pump', 'qstat',
+    'samba-common', 'samba-common-bin', 'smbclient',
+    'tcl8.5', 'tk8.5', 'os-prober', 'unzip', 'xauth', 'x11-common',
+    'x11-utils', 'xterm' ]:
+      ensure => purged;
+  }
+
+  # leave a few packages installed on local environments
+  # vagrant i.e. needs them for mounting shared folders
+    if $::site_config::params::environment != 'local' {
+    package { [ 'nfs-common', 'nfs-kernel-server', 'rpcbind', 'portmap' ]:
+      ensure => purged;
+    }
+  }
+}
diff --git a/puppet/modules/site_config/manifests/packages/base.pp b/puppet/modules/site_config/manifests/packages/base.pp
deleted file mode 100644
index c23495fc..00000000
--- a/puppet/modules/site_config/manifests/packages/base.pp
+++ /dev/null
@@ -1,19 +0,0 @@
-# install default packages and remove unwanted packages
-class site_config::packages::base {
-
-
-  # base set of packages that we want to have installed everywhere
-  package { [ 'etckeeper', 'screen', 'less', 'ntp' ]:
-    ensure => installed,
-  }
-
-  # base set of packages that we want to remove everywhere
-  package { [ 'acpi', 'eject', 'ftp',
-              'laptop-detect', 'lpr', 'nfs-common', 'nfs-kernel-server',
-              'portmap', 'pppconfig', 'pppoe', 'pump', 'qstat', 'rpcbind',
-              'samba-common', 'samba-common-bin', 'smbclient', 'tcl8.5',
-              'tk8.5', 'os-prober', 'unzip', 'xauth', 'x11-common',
-              'x11-utils', 'xterm' ]:
-    ensure => absent;
-  }
-}
diff --git a/puppet/modules/site_config/manifests/packages/build_essential.pp b/puppet/modules/site_config/manifests/packages/build_essential.pp
index 7dfb8b03..2b3e13b9 100644
--- a/puppet/modules/site_config/manifests/packages/build_essential.pp
+++ b/puppet/modules/site_config/manifests/packages/build_essential.pp
@@ -1,11 +1,28 @@
 #
 # include this whenever you want to ensure build-essential package and related compilers are installed.
 #
-class site_config::packages::build_essential {
-  if !defined(Package['build-essential']) {
-    package {
-      ['build-essential', 'g++', 'g++-4.7', 'gcc', 'gcc-4.6', 'gcc-4.7', 'cpp', 'cpp-4.6', 'cpp-4.7', 'libc6-dev']:
+class site_config::packages::build_essential inherits ::site_config::packages {
+
+  # NICKSERVER CODE NOTE: in order to support TLS, libssl-dev must be installed
+  # before EventMachine gem is built/installed.
+  Package[ 'gcc', 'make', 'g++', 'cpp', 'libssl-dev', 'libc6-dev' ] {
+    ensure => present
+  }
+
+  case $::operatingsystemrelease {
+    /^8.*/: {
+      Package[ 'gcc-4.9','g++-4.9', 'cpp-4.9' ] {
+        ensure => present
+      }
+    }
+
+    /^7.*/: {
+      Package[ 'gcc-4.7','g++-4.7', 'cpp-4.7' ] {
         ensure => present
+      }
     }
+
+    default:  { }
   }
-}
\ No newline at end of file
+
+}
diff --git a/puppet/modules/site_config/manifests/packages/uninstall.pp b/puppet/modules/site_config/manifests/packages/uninstall.pp
deleted file mode 100644
index 12f527d9..00000000
--- a/puppet/modules/site_config/manifests/packages/uninstall.pp
+++ /dev/null
@@ -1,16 +0,0 @@
-#
-# Uninstall build-essential and compilers, unless they have been explicitly installed elsewhere.
-#
-class site_config::packages::uninstall {
-  tag 'leap_base'
-
-  # generally, dev packages are needed for installing ruby gems with native extensions.
-  # (nickserver, webapp, etc)
-
-  if !defined(Package['build-essential']) {
-    package {
-      ['build-essential', 'g++', 'g++-4.7', 'gcc', 'gcc-4.6', 'gcc-4.7', 'cpp', 'cpp-4.6', 'cpp-4.7', 'libc6-dev']:
-        ensure => purged
-    }
-  }
-}
\ No newline at end of file
diff --git a/puppet/modules/site_config/manifests/remove.pp b/puppet/modules/site_config/manifests/remove.pp
new file mode 100644
index 00000000..443df9c2
--- /dev/null
+++ b/puppet/modules/site_config/manifests/remove.pp
@@ -0,0 +1,11 @@
+# remove leftovers from previous deploys
+class site_config::remove {
+  include site_config::remove::files
+
+  case $::operatingsystemrelease {
+    /^8.*/: {
+      include site_config::remove::jessie
+    }
+    default:  { }
+  }
+}
diff --git a/puppet/modules/site_config/manifests/remove/bigcouch.pp b/puppet/modules/site_config/manifests/remove/bigcouch.pp
new file mode 100644
index 00000000..3535c3c1
--- /dev/null
+++ b/puppet/modules/site_config/manifests/remove/bigcouch.pp
@@ -0,0 +1,42 @@
+# remove bigcouch leftovers from previous installations
+class site_config::remove::bigcouch {
+
+  # Don't use check_mk logwatch to watch bigcouch logs anymore
+  # see https://leap.se/code/issues/7375 for more details
+  file { '/etc/check_mk/logwatch.d/bigcouch.cfg':
+    ensure => absent,
+    notify => [
+      Exec['remove_bigcouch_logwatch_stateline']
+    ]
+  }
+
+  exec { 'remove_bigcouch_logwatch_stateline':
+    command     => "sed -i '/bigcouch.log/d' /etc/check_mk/logwatch.state",
+    refreshonly => true,
+  }
+
+  cron { 'compact_all_shards':
+    ensure => absent
+  }
+
+
+  exec { 'kill_bigcouch_stunnel_procs':
+    refreshonly => true,
+    command     => '/usr/bin/pkill -f "/usr/bin/stunnel4 /etc/stunnel/(ednp|epmd)_server.conf"'
+  }
+
+  # 'tidy' doesn't notify other resources, so we need to use file here instead
+  # see https://tickets.puppetlabs.com/browse/PUP-6021
+  file {
+    [ '/etc/stunnel/ednp_server.conf', '/etc/stunnel/epmd_server.conf']:
+      ensure => absent,
+      # notifying Service[stunnel] doesn't work here because the config
+      # files contain the pid of the procs to stop/start.
+      # If we remove the config, and restart stunnel then it will only
+      # stop/start the procs for which config files are found and the stale
+      # service will continue to run.
+      # So we simply kill them.
+      notify => Exec['kill_bigcouch_stunnel_procs']
+  }
+
+}
diff --git a/puppet/modules/site_config/manifests/remove_files.pp b/puppet/modules/site_config/manifests/remove/files.pp
index b339e6af..41d6462e 100644
--- a/puppet/modules/site_config/manifests/remove_files.pp
+++ b/puppet/modules/site_config/manifests/remove/files.pp
@@ -9,7 +9,16 @@
 # release.
 #
 
-class site_config::remove_files {
+class site_config::remove::files {
+
+  # Platform 0.8 removals
+  tidy {
+    '/etc/default/leap_mx':;
+    '/etc/logrotate.d/mx':;
+    '/etc/rsyslog.d/50-mx.conf':;
+    '/etc/apt/preferences.d/openvpn':;
+    '/etc/apt/sources.list.d/secondary.list.disabled.list':;
+  }
 
   #
   # Platform 0.7 removals
@@ -17,24 +26,22 @@ class site_config::remove_files {
 
   tidy {
     '/etc/rsyslog.d/99-tapicero.conf':;
-    '/etc/rsyslog.d/99-leap-mx.conf':;
     '/etc/rsyslog.d/01-webapp.conf':;
     '/etc/rsyslog.d/50-stunnel.conf':;
-    '/etc/logrotate.d/mx':;
     '/etc/logrotate.d/stunnel':;
     '/var/log/stunnel4/stunnel.log':;
     'leap_mx':
       path => '/var/log/',
       recurse => true,
-      matches => 'leap_mx*';
-    'leap_mx_rotate':
-      path => '/var/log/leap/',
-      recurse => true,
-      matches => [ 'mx.log.[0-9]', 'mx.log.[0-9]?', 'mx.log.[6-9]?gz'];
+      matches => ['leap_mx*', 'mx.log.[1-5]', 'mx.log.[6-9](.gz)?',
+                  'mx.log.[0-9][0-9](.gz)?'];
     '/srv/leap/webapp/public/provider.json':;
     '/srv/leap/couchdb/designs/tmp_users':
       recurse => true,
       rmdirs => true;
+    '/etc/leap/soledad-server.conf':;
+    '/var/log/leap/openvpn.log':;
+    '/etc/rsyslog.d/50-openvpn.conf':;
   }
 
   # leax-mx logged to /var/log/leap_mx.log in the past
@@ -46,5 +53,4 @@ class site_config::remove_files {
       onlyif  => "/bin/grep -qe 'leap_mx.log' /etc/check_mk/logwatch.state"
   }
 
-
 }
diff --git a/puppet/modules/site_config/manifests/remove/jessie.pp b/puppet/modules/site_config/manifests/remove/jessie.pp
new file mode 100644
index 00000000..e9497baf
--- /dev/null
+++ b/puppet/modules/site_config/manifests/remove/jessie.pp
@@ -0,0 +1,14 @@
+# remove possible leftovers after upgrading from wheezy to jessie
+class site_config::remove::jessie {
+
+  tidy {
+    '/etc/apt/preferences.d/rsyslog_anon_depends':
+      notify => Exec['apt_updated'];
+  }
+
+  apt::preferences_snippet {
+    [ 'facter', 'obfsproxy', 'python-twisted', 'unbound' ]:
+      ensure => absent;
+  }
+
+}
diff --git a/puppet/modules/site_config/manifests/remove/monitoring.pp b/puppet/modules/site_config/manifests/remove/monitoring.pp
new file mode 100644
index 00000000..18e2949b
--- /dev/null
+++ b/puppet/modules/site_config/manifests/remove/monitoring.pp
@@ -0,0 +1,13 @@
+# remove leftovers on monitoring nodes
+class site_config::remove::monitoring {
+
+  # Remove check_mk loggwatch spoolfiles for
+  # tapicero and bigcouch
+  tidy {
+    'remove_logwatch_spoolfiles':
+      path    => '/var/lib/check_mk/logwatch',
+      recurse => true,
+      matches => [ '*tapicero.log', '*bigcouch.log'];
+  }
+
+}
diff --git a/puppet/modules/site_config/manifests/remove/tapicero.pp b/puppet/modules/site_config/manifests/remove/tapicero.pp
new file mode 100644
index 00000000..07c3c6c6
--- /dev/null
+++ b/puppet/modules/site_config/manifests/remove/tapicero.pp
@@ -0,0 +1,72 @@
+# remove tapicero leftovers from previous deploys on couchdb nodes
+class site_config::remove::tapicero {
+
+  ensure_packages('curl')
+
+  # remove tapicero couchdb user
+  $couchdb_config = hiera('couch')
+  $couchdb_mode   = $couchdb_config['mode']
+
+  if $couchdb_mode == 'multimaster'
+  {
+    $port = 5986
+  } else {
+    $port = 5984
+  }
+
+  exec { 'remove_couchdb_user':
+    onlyif  => "/usr/bin/curl -s 127.0.0.1:${port}/_users/org.couchdb.user:tapicero | grep -qv 'not_found'",
+    command => "/usr/local/bin/couch-doc-update --host 127.0.0.1:${port} --db _users --id org.couchdb.user:tapicero --delete",
+    require => Package['curl']
+  }
+
+
+  exec { 'kill_tapicero':
+    onlyif  => '/usr/bin/test -s /var/run/tapicero.pid',
+    command => '/usr/bin/pkill --pidfile /var/run/tapicero.pid'
+  }
+
+  user { 'tapicero':
+    ensure  => absent;
+  }
+
+  group { 'tapicero':
+    ensure => absent,
+    require => User['tapicero'];
+  }
+
+  tidy {
+    '/srv/leap/tapicero':
+      recurse => true,
+      require   => [ Exec['kill_tapicero'] ];
+    '/var/lib/leap/tapicero':
+      require   => [ Exec['kill_tapicero'] ];
+    '/var/run/tapicero':
+      require   => [ Exec['kill_tapicero'] ];
+    '/etc/leap/tapicero.yaml':
+      require   => [ Exec['kill_tapicero'] ];
+    '/etc/init.d/tapicero':
+      require   => [ Exec['kill_tapicero'] ];
+    'tapicero_logs':
+      path    => '/var/log/leap',
+      recurse => true,
+      matches => 'tapicero*',
+      require   => [ Exec['kill_tapicero'] ];
+    '/etc/check_mk/logwatch.d/tapicero.cfg':;
+  }
+
+  # remove local nagios plugin checks via mrpe
+  augeas {
+    'Tapicero_Procs':
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => 'rm /files/etc/check_mk/mrpe.cfg/Tapicero_Procs',
+      require => File['/etc/check_mk/mrpe.cfg'];
+    'Tapicero_Heartbeat':
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => 'rm Tapicero_Heartbeat',
+      require => File['/etc/check_mk/mrpe.cfg'];
+  }
+
+}
diff --git a/puppet/modules/site_config/manifests/remove/webapp.pp b/puppet/modules/site_config/manifests/remove/webapp.pp
new file mode 100644
index 00000000..58f59815
--- /dev/null
+++ b/puppet/modules/site_config/manifests/remove/webapp.pp
@@ -0,0 +1,7 @@
+# remove leftovers on webapp nodes
+class site_config::remove::webapp {
+  tidy {
+    '/etc/apache/sites-enabled/leap_webapp.conf':
+      notify => Service['apache'];
+  }
+}
diff --git a/puppet/modules/site_config/manifests/resolvconf.pp b/puppet/modules/site_config/manifests/resolvconf.pp
index 05990c67..09f0b405 100644
--- a/puppet/modules/site_config/manifests/resolvconf.pp
+++ b/puppet/modules/site_config/manifests/resolvconf.pp
@@ -8,7 +8,7 @@ class site_config::resolvconf {
     nameservers => [
       '127.0.0.1      # local caching-only, unbound',
       '85.214.20.141  # Digitalcourage, a german privacy organisation: (https://en.wikipedia.org/wiki/Digitalcourage)',
-      '77.109.138.45  # Swiss privacy Foundation (http://www.privacyfoundation.ch/de/service/server.html)'
+      '172.81.176.146 # OpenNIC (https://servers.opennicproject.org/edit.php?srv=ns1.tor.ca.dns.opennic.glue)'
     ]
   }
 }
diff --git a/puppet/modules/site_config/manifests/ruby.pp b/puppet/modules/site_config/manifests/ruby.pp
index 2a720114..5c13233d 100644
--- a/puppet/modules/site_config/manifests/ruby.pp
+++ b/puppet/modules/site_config/manifests/ruby.pp
@@ -1,14 +1,8 @@
+# install ruby, rubygems and bundler
+# configure ruby settings common to all servers
 class site_config::ruby {
   Class[Ruby] -> Class[rubygems] -> Class[bundler::install]
-  class { '::ruby': ruby_version => '1.9.3' }
+  class { '::ruby': }
   class { 'bundler::install': install_method => 'package' }
   include rubygems
 }
-
-
-#
-# Ruby settings common to all servers
-#
-# Why this way? So that other classes can do 'include site_ruby' without creating redeclaration errors.
-# See https://puppetlabs.com/blog/modeling-class-composition-with-parameterized-classes/
-#
diff --git a/puppet/modules/site_config/manifests/ruby/dev.pp b/puppet/modules/site_config/manifests/ruby/dev.pp
index 3ea6ca96..2b0b106d 100644
--- a/puppet/modules/site_config/manifests/ruby/dev.pp
+++ b/puppet/modules/site_config/manifests/ruby/dev.pp
@@ -1,8 +1,8 @@
-class site_config::ruby::dev inherits site_config::ruby {
-  Class['::ruby'] {
-    ruby_version => '1.9.3',
-    install_dev  => true
-  }
+# install ruby dev packages needed for building some gems
+class site_config::ruby::dev {
+  include site_config::ruby
+  include ::ruby::devel
+
   # building gems locally probably requires build-essential and gcc:
   include site_config::packages::build_essential
 }
diff --git a/puppet/modules/site_config/manifests/setup.pp b/puppet/modules/site_config/manifests/setup.pp
index b09d0413..82dfe76d 100644
--- a/puppet/modules/site_config/manifests/setup.pp
+++ b/puppet/modules/site_config/manifests/setup.pp
@@ -1,3 +1,7 @@
+# common things to set up on every node
+# leftover from the past, where we did two puppetruns
+# after another. We should consolidate this into site_config::default
+# in the future.
 class site_config::setup {
   tag 'leap_base'
 
@@ -13,17 +17,14 @@ class site_config::setup {
   include stdlib
 
   # configure /etc/hosts
-  class { 'site_config::hosts':
-    stage => setup,
-  }
+  class { 'site_config::hosts': }
 
   include site_config::initial_firewall
 
   include site_apt
 
   package { 'facter':
-    ensure  => latest,
-    require => Exec['refresh_apt']
+    ensure  => latest
   }
 
   # if squid_deb_proxy_client is set to true, install and configure
diff --git a/puppet/modules/site_config/manifests/slow.pp b/puppet/modules/site_config/manifests/slow.pp
index 94bac88d..8e9b7035 100644
--- a/puppet/modules/site_config/manifests/slow.pp
+++ b/puppet/modules/site_config/manifests/slow.pp
@@ -1,6 +1,10 @@
+# this class is run by default, but can be excluded
+# for testing purposes by calling "leap deploy" with
+# the "--fast" parameter
 class site_config::slow {
   tag 'leap_slow'
-  class { 'site_apt::dist_upgrade':
-    stage => setup,
-  }
+
+  include site_config::default
+  include apt::update
+  class { 'site_apt::dist_upgrade': }
 }
diff --git a/puppet/modules/site_config/manifests/syslog.pp b/puppet/modules/site_config/manifests/syslog.pp
index 83b49c8e..591e0601 100644
--- a/puppet/modules/site_config/manifests/syslog.pp
+++ b/puppet/modules/site_config/manifests/syslog.pp
@@ -1,10 +1,31 @@
+# configure rsyslog on all nodes
 class site_config::syslog {
 
-  include site_apt::preferences::rsyslog
+  # only pin rsyslog packages to backports on wheezy
+  case $::operatingsystemrelease {
+    /^7.*/: {
+      include ::site_apt::preferences::rsyslog
+    }
+    # on jessie+ systems, systemd and journald are enabled,
+    # and journald logs IP addresses, so we need to disable
+    # it until a solution is found, (#7863):
+    # https://github.com/systemd/systemd/issues/2447
+    default: {
+      include ::journald
+      augeas {
+        'disable_journald':
+          incl    => '/etc/systemd/journald.conf',
+          lens    => 'Puppet.lns',
+          changes => 'set /files/etc/systemd/journald.conf/Journal/Storage \'none\'',
+          notify  => Service['systemd-journald'];
+      }
+    }
+  }
 
-  class { 'rsyslog::client':
-    log_remote => false,
-    log_local  => true
+  class { '::rsyslog::client':
+    log_remote    => false,
+    log_local     => true,
+    custom_config => 'site_rsyslog/client.conf.erb'
   }
 
   rsyslog::snippet { '00-anonymize_logs':
@@ -15,12 +36,13 @@ action(type="mmanon" ipv4.bits="32" mode="rewrite")'
   augeas {
     'logrotate_leap_deploy':
       context => '/files/etc/logrotate.d/leap_deploy/rule',
-      changes => [ 'set file /var/log/leap/deploy.log',
-                   'set rotate 5',
-                   'set size 1M',
-                   'set compress compress',
-                   'set missingok missingok',
-                   'set copytruncate copytruncate' ];
+      changes => [
+        'set file /var/log/leap/deploy.log',
+        'set rotate 5',
+        'set size 1M',
+        'set compress compress',
+        'set missingok missingok',
+        'set copytruncate copytruncate' ];
 
     # NOTE:
     # the puppet_command script requires the option delaycompress
@@ -28,12 +50,13 @@ action(type="mmanon" ipv4.bits="32" mode="rewrite")'
 
     'logrotate_leap_deploy_summary':
       context => '/files/etc/logrotate.d/leap_deploy_summary/rule',
-      changes => [ 'set file /var/log/leap/deploy-summary.log',
-                   'set rotate 5',
-                   'set size 100k',
-                   'set delaycompress delaycompress',
-                   'set compress compress',
-                   'set missingok missingok',
-                   'set copytruncate copytruncate' ]
+      changes => [
+        'set file /var/log/leap/deploy-summary.log',
+        'set rotate 5',
+        'set size 100k',
+        'set delaycompress delaycompress',
+        'set compress compress',
+        'set missingok missingok',
+        'set copytruncate copytruncate' ]
   }
 }
diff --git a/puppet/modules/site_config/manifests/x509/ca.pp b/puppet/modules/site_config/manifests/x509/ca.pp
index b16d0eeb..2880ecaf 100644
--- a/puppet/modules/site_config/manifests/x509/ca.pp
+++ b/puppet/modules/site_config/manifests/x509/ca.pp
@@ -1,5 +1,7 @@
 class site_config::x509::ca {
 
+  include ::site_config::params
+
   $x509      = hiera('x509')
   $ca        = $x509['ca_cert']
 
diff --git a/puppet/modules/site_config/manifests/x509/ca_bundle.pp b/puppet/modules/site_config/manifests/x509/ca_bundle.pp
index 4cbe574a..5808e29e 100644
--- a/puppet/modules/site_config/manifests/x509/ca_bundle.pp
+++ b/puppet/modules/site_config/manifests/x509/ca_bundle.pp
@@ -5,6 +5,7 @@ class site_config::x509::ca_bundle {
   # we will want to be able to smoothly phase out one CA and phase in another.
   # I tried "--capath" for this, but it did not work.
 
+  include ::site_config::params
 
   $x509      = hiera('x509')
   $ca        = $x509['ca_cert']
diff --git a/puppet/modules/site_config/manifests/x509/cert.pp b/puppet/modules/site_config/manifests/x509/cert.pp
index 7ed42959..7e5a36b9 100644
--- a/puppet/modules/site_config/manifests/x509/cert.pp
+++ b/puppet/modules/site_config/manifests/x509/cert.pp
@@ -1,5 +1,7 @@
 class site_config::x509::cert {
 
+  include ::site_config::params
+
   $x509      = hiera('x509')
   $cert      = $x509['cert']
 
diff --git a/puppet/modules/site_config/manifests/x509/client_ca/ca.pp b/puppet/modules/site_config/manifests/x509/client_ca/ca.pp
index 0f313898..3fbafa98 100644
--- a/puppet/modules/site_config/manifests/x509/client_ca/ca.pp
+++ b/puppet/modules/site_config/manifests/x509/client_ca/ca.pp
@@ -5,6 +5,8 @@ class site_config::x509::client_ca::ca {
   ## client certificates by the webapp.
   ##
 
+  include ::site_config::params
+
   $x509 = hiera('x509')
   $cert = $x509['client_ca_cert']
 
diff --git a/puppet/modules/site_config/manifests/x509/client_ca/key.pp b/puppet/modules/site_config/manifests/x509/client_ca/key.pp
index f9ef3f52..0b537e76 100644
--- a/puppet/modules/site_config/manifests/x509/client_ca/key.pp
+++ b/puppet/modules/site_config/manifests/x509/client_ca/key.pp
@@ -5,6 +5,8 @@ class site_config::x509::client_ca::key {
   ## client certificates by the webapp.
   ##
 
+  include ::site_config::params
+
   $x509 = hiera('x509')
   $key  = $x509['client_ca_key']
 
diff --git a/puppet/modules/site_config/manifests/x509/commercial/ca.pp b/puppet/modules/site_config/manifests/x509/commercial/ca.pp
index 8f35759f..c76a9dbb 100644
--- a/puppet/modules/site_config/manifests/x509/commercial/ca.pp
+++ b/puppet/modules/site_config/manifests/x509/commercial/ca.pp
@@ -1,5 +1,7 @@
 class site_config::x509::commercial::ca {
 
+  include ::site_config::params
+
   $x509      = hiera('x509')
   $ca        = $x509['commercial_ca_cert']
 
diff --git a/puppet/modules/site_config/manifests/x509/commercial/cert.pp b/puppet/modules/site_config/manifests/x509/commercial/cert.pp
index 0c71a705..9dd6ffcd 100644
--- a/puppet/modules/site_config/manifests/x509/commercial/cert.pp
+++ b/puppet/modules/site_config/manifests/x509/commercial/cert.pp
@@ -1,10 +1,15 @@
 class site_config::x509::commercial::cert {
 
+  include ::site_config::params
+
   $x509      = hiera('x509')
   $cert      = $x509['commercial_cert']
+  $ca        = $x509['commercial_ca_cert']
+
+  $cafile = "${cert}\n${ca}"
 
   x509::cert { $site_config::params::commercial_cert_name:
-    content => $cert
+    content => $cafile
   }
 
 }
diff --git a/puppet/modules/site_config/manifests/x509/commercial/key.pp b/puppet/modules/site_config/manifests/x509/commercial/key.pp
index d32e85ef..2be439fd 100644
--- a/puppet/modules/site_config/manifests/x509/commercial/key.pp
+++ b/puppet/modules/site_config/manifests/x509/commercial/key.pp
@@ -1,5 +1,7 @@
 class site_config::x509::commercial::key {
 
+  include ::site_config::params
+
   $x509      = hiera('x509')
   $key       = $x509['commercial_key']
 
diff --git a/puppet/modules/site_config/manifests/x509/key.pp b/puppet/modules/site_config/manifests/x509/key.pp
index 32b59726..448dc6a6 100644
--- a/puppet/modules/site_config/manifests/x509/key.pp
+++ b/puppet/modules/site_config/manifests/x509/key.pp
@@ -1,5 +1,7 @@
 class site_config::x509::key {
 
+  include ::site_config::params
+
   $x509      = hiera('x509')
   $key       = $x509['key']