summaryrefslogtreecommitdiff
path: root/puppet/modules/site_config
AgeCommit message (Collapse)Author
2014-05-17change rsyslog pin from leaps debian repo to backports (fixes #5533)kwadronaut
2014-05-06Change the initial firewall to subscribe to the rule file to be able toMicah Anderson
trigger changes, make the default ipv6 firewall subscribe to shorewall6, if it exists, and finally reject all outgoing IPv6 packets. All of this will complete the platform-side of route IPv6 through OpenVPN gateway, and block it. (Feature #4163) Change-Id: Icf6d582063ed01d304658b740a565057ee4e6810
2014-04-24initial firewall: allow port 22 by default. This is the most common portMicah Anderson
that sshd will be listening to in a default setup. This needs to be allowed so that you can have a different port configured in the hiera and not get locked out during deployment (#5119) Change-Id: Ie101eaaf440415ddb276621c369da7f67f409c2b
2014-04-15fix concat::setup (#5503)varac
2014-04-10Merge branch '0.6' into developvarac
2014-04-05better system for optionally uninstalling build-essential package. closes ↵elijah
https://leap.se/code/issues/5426
2014-04-04Merge branch '2993_setup_subclass' into 0.6varac
2014-03-31Merge branch 'feature/static_site' of https://github.com/elijh/leap_platform ↵kwadronaut
into elijh-feature/static_site Conflicts: puppet/modules/site_config/manifests/packages/base.pp
2014-03-25Move setup.pp to a subclass (site_config::setup) (Feature #2993)varac
2014-03-25couch node: same packages removed on every (second ?) puppetrun (Feature #5018)varac
2014-03-23modules/site_static: part 1 - amberelijah
2014-02-27include "127.0.1.1 @domain_public @api['domain']" in /etc/hosts for nagios ↵varac
webapp log check
2014-02-12renamed site_check_mk::client to site_check_mk::agentvarac
2014-02-12moved check_mk server and client class to site_check_mk modulevarac
2014-02-05include site_nagios::client by defaultvarac
2014-01-24swiss privacy foundation changed their nameserver IPs: ↵varac
http://www.privacyfoundation.ch/de/service/server.html
2014-01-06install ntp on all platform nodes (Feature #4913)varac
2013-12-18Fix for openvpn/unbound not starting at boot (#4506)Micah Anderson
This change sets the sysctl net.ipv4.ip_nonlocal_bind to allow applications to bind to an address, even when the link is down. This is necessary because applications like unbound and openvpn fail to start on boot in some situations because interfaces are not fully up (due to a combination of non-deterministic booting because of the likely potential setting of allow-hotplug in the interfaces file and the LSB boot dependency on $network not being sufficient. The only down-side to setting this is a daemon could bind to an incorrect ip and we wouldn't get an error, but this would be a configuration mistake, rather than a fatal condition. Change-Id: I5c03083e8c20bb25afad85a1230f4555808d341c
2013-11-27setup some common leap system directories: /var/lib/leap and /var/log/leapMicah Anderson
Change-Id: I18aa0ee635d7166676e4bb4384e2b517784a68b0
2013-11-25fix bug when 'environment' is nil in hiera.yamlelijah
2013-10-20Possibility to include local puppet recipes (Feature #3976)varac
2013-10-17syslog: fix apt_preferences snippet to glob on both rsyslog and rsyslog-relp ↵Micah Anderson
(#4161) Change-Id: I7eaa35897da3b24833be3b2c14db99cd66b547c0
2013-10-16fix for rsyslog-relp being installed first, resulting in dependency errors ↵Micah Anderson
(#4161) Change-Id: I2f0bcc5b4cb5effae57051f04251aeb8b09a4c6d
2013-10-16syslog: add rsyslog::snippet to anonymize logsMicah Anderson
it is necessary to install the fixed package from the leap.se repository until it is available in wheezy-backports, so install the apt preferences to pull it from there, and add its necessary library dependency from wheezy-backports Change-Id: I379ff2ceaac1a978143715d3a7ced0011ca0d747
2013-10-16rsyslog: setup default local config that gets us the same config as default ↵Micah Anderson
from debian Change-Id: If07ee200e2ae0d9cfaf8e405d6354c80d77330ca
2013-10-16vagrant: support other providers besides virtualbox (Bug #4158)varac
2013-10-15new fallback nameservers (#4113)varac
* the german privacy foundation has dissolved itself and shut down their public nameserver. we are now using the public nameserver by Digitalcourage, a german privacy organisation (https://en.wikipedia.org/wiki/Digitalcourage) * the IP for the server of the swiss privacy foundation has changed (http://www.privacyfoundation.ch/de/service/server.html)
2013-10-11fixed issues from https://review.leap.se/r/98/varac
2013-10-11install ruby-dev for nickserver/webapp (#4079 + #4080)varac
2013-10-11don't remove dev-packages on webapp nodevarac
they are needed for building gems
2013-10-11deploy postfix satellites on all nodes (Bug #1683)varac
2013-10-03fix name of base class fileMicah Anderson
Change-Id: I844970f1c8f895d5a460d5082bfa1a2a88b32ecd
2013-09-26create a site_config::packages directory, move site_config::base_packages to ↵Micah Anderson
site_config::packages::base add site_config::packages::gnutls for inclusion (#3955) Change-Id: I9599eb26844503613c16f57ee17d6ea7bd0cf6fb
2013-09-24added site_config::x509::client_ca::cert and ↵varac
site_config::x509::client_ca::key for client_ca deployment (#3917)
2013-09-24move commercial x509 deployment to site_x509 (Feature #3889)varac
2013-09-24seperate cert and key deployment (#3918)varac
2013-09-20Merge branch 'feature/3782_Discuss_run_stages_on_deploy' into developvarac
2013-09-20move all resources that are applied on every node into site_config::default ↵varac
(#3782) in commit 338833, we established a relationship between all resources that have a leap_service tag, that are called in site.pp. But we had some resources as default on every node in site.pp (apt::update, Package { require => Exec['apt_updated'] }, site_config::slow and stdlib), that were still lacking any relationship to the leap_service tag. By moving them into default.pp they automatically are executed before resources with a leap_service tag.
2013-09-19webapp: Depend services on deployment of default key, cert and ca (Feature ↵varac
#3838)
2013-09-19tidy openvpn x509 definitions (#3831)varac
2013-09-19only deploy x509 stuff for nodes if it existes in hiera (Feature #3875)varac
2013-09-18deploy client_ca (#3833)varac
2013-09-18openvpn should use /usr/local/share/ca-certificates/leap_ca.crt (Feature #3831)varac
2013-09-17shorewall: #2399 blocks uplink (Bug #2866)varac
2013-09-17site_config::params::interface should contain eth1 for vagrant cause it's ↵varac
the main interface we use (#2399, #2401)
2013-09-17Merge branch 'bug/3757' into developMicah Anderson
2013-09-14ensure site_config::caching_resolver runs with tag leap_base (#3757)Micah Anderson
Change-Id: I593602ff9d3486dee39227673147e137045c55c5
2013-09-13Deploy default x509 cert + key that services can use (Feature #3836)varac
2013-09-13deploy default x509::ca leap_ca in site_config::default (#3817)varac
2013-09-04fix initial firewall to allow outgoing lo traffic and outgoing port 443 (#3736)Micah Anderson
this allows nameserver queries to the local resolver to work and clones to the leap https repository to work Change-Id: I575d08405a0c28e12c8d201a8dbc79585a5a9a48