initial commit

26 files changed, 593 insertions, 0 deletions

diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..b0dfc82
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,13 @@
+Copyright (c) 2012 Martin Oppegaard <martin.oppegaard at gmail dot com>
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/Modulefile b/Modulefile
new file mode 100644
index 0000000..93c593a
--- /dev/null
+++ b/Modulefile
@@ -0,0 +1,10 @@
+name 'oppegaard-unbound'
+version '0.1.0'
+author 'Martin Oppegaard'
+license 'ISC'
+summary 'The unbound module manages unbound'
+description 'This module manages unbound, the reqursive caching DNS resolver.
+    It manages the package, service, configuration file, control keys and support
+    files.'
+dependency 'puppetlabs/stdlib', '>= 3.2.0'
+dependency 'oppegaard/openbsd', '>= 0.1.0'
diff --git a/README b/README
new file mode 100644
index 0000000..529f37f
--- /dev/null
+++ b/README
@@ -0,0 +1,79 @@
+== Class: unbound
+
+The unbound class manages unbound, the reqursive caching DNS resolver.
+It manages the package, service, configuration file, control keys and
+support files.
+
+Supported operating systems are OpenBSD, Debian and Ubuntu.  Tested on OpenBSD
+5.2 with Puppet 2.7.14 and Debian Sid with Puppet 2.7.18-2.
+
+The configuration file is concatenated from samples of server et. al.,
+stub-zone and forward-zone.  The latter two are created independently
+from the server settings, by defines which can be used by other classes
+and modules.
+
+Control keys can be created with the unbound-control-setup program,
+and is enabled by default.  These are neccessary to be able to control
+unbound (restart, reload etc) with the unbound-control program.
+
+The auto-trust-anchor-file 'root.key' can be created with the unbound-anchor
+program, and is enabled by default.
+
+The root-hints files named.cache can be managed, but have to be provided by
+the user.  See the documentation in manifests/root_hints.pp for how to proceede.
+This functionality is not enabled by default.
+
+=== Parameters
+
+[*settings*]
+Hash containing the settings as key value pairs.
+
+[*ssl*]
+Mange unbound-control certificates?  True or false, true by default.
+
+[*anchor*]
+Manage root.key? True or false, true by default.
+
+[*root_hints*]
+Manage named.cache?  True or false, false by default.
+
+=== Examples
+
+class { 'unbound':
+  root_hints => true,
+  settings => {
+    server => {
+      verbosity => '1',
+      interface => [
+        '127.0.0.1',
+        '::1',
+        $::ipaddress,
+      ],
+      outgoing-interface => $::ipaddress,
+      access-control => [
+        '127.0.0.0/8 allow',
+        '::1 allow',
+        '10.0.0.0/8 allow',
+      ],
+      root-hints => '"/var/unbound/etc/named.cache"',
+      private-address => [
+        '10.0.0.0/8',
+        '172.16.0.0/12',
+        '192.168.0.0/16',
+      ],
+      private-domain => "\"$::domain\"",
+      auto-trust-anchor-file => '"/var/unbound/etc/root.key"',
+    },
+    python => { },
+    remote-control => {
+      control-enable => 'yes',
+      control-interface => [
+        '127.0.0.1',
+        '::1',
+      ],
+    },
+  }
+}
+
+See manifests/stub.pp and manifests/forward.pp for examples on how to create
+sub zones and forward zones repectively.
diff --git a/manifests/anchor.pp b/manifests/anchor.pp
new file mode 100644
index 0000000..e890722
--- /dev/null
+++ b/manifests/anchor.pp
@@ -0,0 +1,26 @@
+# == Class: unbound::anchor
+#
+# The unbound::anchor class manages the "root.key" file, and creates it with
+# the unbound-anchor program.
+#
+# === Examples
+#
+# include unbound::anchor
+#
+class unbound::anchor {
+  include unbound::params
+
+  file { $unbound::params::anchor:
+    owner => $unbound::params::user,
+    group => $unbound::params::group,
+    mode => '0644',
+    require => Exec[$unbound::params::unbound_anchor],
+  }
+
+  exec { $unbound::params::unbound_anchor:
+    command => "${unbound::params::unbound_anchor} -a ${unbound::params::anchor}",
+    creates => $unbound::params::anchor,
+    returns => 1,
+    before => Class['unbound::service'],
+  }
+}
diff --git a/manifests/forward.pp b/manifests/forward.pp
new file mode 100644
index 0000000..740c004
--- /dev/null
+++ b/manifests/forward.pp
@@ -0,0 +1,32 @@
+# == Define: unbound::forward
+#
+# Creates a forward-zone.  $settings is a hash containing the settings.
+# The name of the resource is used as the 'name' of the zone.
+#
+# === Parameters
+#
+# [*settings*]
+# Hash containing the settings as key value pairs.
+#
+# === Examples
+#
+# unbound::forward { 'example.com':
+#   settings => {
+#     forward-addr => '10.0.0.1',
+#   },
+# }
+#
+define unbound::forward (
+  $settings,
+) {
+  include unbound
+
+  $zone_name = { name => "\"${title}\"" }
+  $real_settings = { forward-zone => merge($zone_name, $settings) }
+
+  concat::fragment { "unbound ${title}":
+    target => $unbound::params::config,
+    content => template('unbound/unbound.conf.erb'),
+    order => 3,
+  }
+}
diff --git a/manifests/init.pp b/manifests/init.pp
new file mode 100644
index 0000000..ecb7970
--- /dev/null
+++ b/manifests/init.pp
@@ -0,0 +1,117 @@
+# == Class: unbound
+#
+# The unbound class manages unbound, the reqursive caching dns resolver.
+# It manages the package, service, configuration file, control keys and
+# support files.
+#
+# The configuration file is concatenated from samples of server et. al.,
+# stub-zone and forward-zone.  The latter two are created independently
+# from the server settings, by defines which can be used by other classes
+# and modules.
+#
+# Control keys can be created with the unbound-control-setup program,
+# and is enabled by default.  These are neccessary to be able to control
+# unbound (restart, reload etc) with the unbound-control program.
+#
+# The auto-trust-anchor-file 'root.key' can be created with the unbound-anchor
+# program, and is enabled by default.
+#
+# The root-hints files named.cache can be managed, but have to be provided by
+# the user.  See the documentation in manifests/root_hints.pp for how to proceede.
+# This functionality is not enabled by default.
+#
+# === Parameters
+#
+# [*settings*]
+# Hash containing the settings as key value pairs.
+#
+# [*ssl*]
+# Mange unbound-control certificates?  True or false, true by default.
+#
+# [*anchor*]
+# Manage root.key? True or false, true by default.
+#
+# [*root_hints*]
+# Manage named.cache?  True or false, false by default.
+#
+# === Examples
+#
+# class { 'unbound':
+#   root_hints => true,
+#   settings => {
+#     server => {
+#       verbosity => '1',
+#       interface => [
+#         '127.0.0.1',
+#         '::1',
+#         $::ipaddress,
+#       ],
+#       outgoing-interface => $::ipaddress,
+#       access-control => [
+#         '127.0.0.0/8 allow',
+#         '::1 allow',
+#         '10.0.0.0/8 allow',
+#       ],
+#       root-hints => '"/var/unbound/etc/named.cache"',
+#       private-address => [
+#         '10.0.0.0/8',
+#         '172.16.0.0/12',
+#         '192.168.0.0/16',
+#       ],
+#       private-domain => "\"$::domain\"",
+#       auto-trust-anchor-file => '"/var/unbound/etc/root.key"',
+#     },
+#     python => { },
+#     remote-control => {
+#       control-enable => 'yes',
+#       control-interface => [
+#         '127.0.0.1',
+#         '::1',
+#       ],
+#     },
+#   }
+# }
+#
+# See manifests/stub.pp and manifests/forward.pp for examples on how to create
+# sub zones and forward zones repectively.
+#
+class unbound (
+  $settings,
+  $anchor = true,
+  $root_hints = false,
+  $ssl = true,
+) inherits unbound::params {
+
+  include concat::setup
+  include unbound::package
+  include unbound::service
+
+  validate_hash($settings)
+  validate_bool($anchor)
+  validate_bool($root_hints)
+  validate_bool($ssl)
+
+  if $anchor {
+    include unbound::anchor
+  }
+
+  if $root_hints {
+    include unbound::root_hints
+  }
+
+  if $ssl {
+    include unbound::ssl
+  }
+
+  $real_settings = $settings
+
+  concat { $unbound::params::config:
+    require => Class['unbound::package'],
+  }
+
+  concat::fragment { 'unbound server':
+    target => $unbound::params::config,
+    content => template('unbound/unbound.conf.erb'),
+    order => 1,
+  }
+}
diff --git a/manifests/package.pp b/manifests/package.pp
new file mode 100644
index 0000000..b9b44f1
--- /dev/null
+++ b/manifests/package.pp
@@ -0,0 +1,15 @@
+# == Class: unbound::package
+#
+# Manages the unbound package.
+#
+# === Examples
+#
+# include unbound::package
+#
+class unbound::package {
+  include unbound::params
+
+  package { $unbound::params::package:
+    ensure => installed,
+  }
+}
diff --git a/manifests/params.pp b/manifests/params.pp
new file mode 100644
index 0000000..ddeb8fd
--- /dev/null
+++ b/manifests/params.pp
@@ -0,0 +1,40 @@
+class unbound::params {
+  case $::osfamily {
+    'OpenBSD': {
+      $package = 'unbound'
+      $service = 'unbound'
+      $dir = '/var/unbound/etc'
+      $logfile = '/var/unbound/dev/log'
+      $control_setup = '/usr/local/sbin/unbound-control-setup'
+      $unbound_anchor = '/usr/local/sbin/unbound-anchor'
+      $extended_service = 'unbound::service::openbsd'
+      $unbound_flags = ''
+      $user = '_unbound'
+      $group = '_unbound'
+    }
+    'ubuntu', 'debian': {
+      $package = 'unbound'
+      $service = 'unbound'
+      $dir = '/etc/unbound'
+      $logfile = ''
+      $control_setup = '/usr/sbin/unbound-control-setup'
+      $unbound_anchor = '/usr/sbin/unbound-anchor'
+      $unbound_flags = ''
+      $user = 'unbound'
+      $group = 'unbound'
+    }
+    default: {
+      fail("Class[unbound] is not supported by your operating system: ${::operatingsystem}")
+    }
+  }
+
+  $config = "${dir}/unbound.conf"
+  $control_certs = [
+    "${dir}/unbound_control.key",
+    "${dir}/unbound_control.pem",
+    "${dir}/unbound_server.key",
+    "${dir}/unbound_server.pem",
+  ]
+  $anchor = "${dir}/root.key"
+  $root_hints = "${dir}/named.cache"
+}
diff --git a/manifests/root_hints.pp b/manifests/root_hints.pp
new file mode 100644
index 0000000..1259495
--- /dev/null
+++ b/manifests/root_hints.pp
@@ -0,0 +1,35 @@
+# == Class: unbound::root_hints
+#
+# The unbound::root_hints class manages the root-hints named.cache file.
+# The default mount point is /module_data, which should be installed
+# and populated with a the named.cache file before implementing this
+# class.  See unbound.conf(5) or the default configuration file for
+# how to retrieve such a file.
+#
+# === Parameters
+#
+# [*_mount*]
+#   Meta parameter for specifying an alternate mount path.
+#
+# === Examples
+#
+#  class { 'unbound::root_hints':
+#    $_mount = '/modules/unbound',
+#  }
+#
+#  include unbound::root_hints
+#
+class unbound::root_hints (
+    $_mount = "/module_data/unbound",
+) {
+  include unbound::params
+
+  file { $unbound::params::root_hints:
+    ensure => file,
+    owner => $unbound::params::user,
+    group => $unbound::params::group,
+    mode => '0644',
+    source => "puppet://${_mount}/named.cache",
+    before => Class['unbound::service'],
+  }
+}
diff --git a/manifests/service.pp b/manifests/service.pp
new file mode 100644
index 0000000..2556999
--- /dev/null
+++ b/manifests/service.pp
@@ -0,0 +1,21 @@
+# == Class: unbound::service
+#
+# Manages the unbound service.  If $unbound::params::extended_service
+# is true then OS specific service things are included.
+#
+# === Examples
+#
+# include unbound::service
+#
+class unbound::service {
+  include unbound::params
+
+  if $unbound::params::extended_service {
+    class { $unbound::params::extended_service: }
+  }
+
+  service { $unbound::params::service:
+    ensure => running,
+    subscribe => File[$unbound::params::config],
+  }
+}
diff --git a/manifests/service/openbsd.pp b/manifests/service/openbsd.pp
new file mode 100644
index 0000000..916a7ce
--- /dev/null
+++ b/manifests/service/openbsd.pp
@@ -0,0 +1,21 @@
+# == Class: unbound::service::openbsd
+#
+# Service things specific for OpenBSD.  Sets the unbound_flags variable in
+# /etc/rc.conf.local, and appends the path to the log device to syslogd_flags.
+#
+# === Examples
+#
+# include unbound::service::openbsd
+#
+class unbound::service::openbsd {
+  rcconf { 'unbound_flags':
+    value => $unbound::params::unbound_flags,
+  }
+
+  # syslogd_flags needs one -a dir per chrooted service.  Each can be a separate
+  # line, so don't use rcconf.
+  file_line { 'unbound syslogd_flags':
+      path => '/etc/rc.conf.local',
+      line => "syslogd_flags=\"\${syslogd_flags} -a ${unbound::params::logfile}\"";
+  }
+}
diff --git a/manifests/ssl.pp b/manifests/ssl.pp
new file mode 100644
index 0000000..e0cff17
--- /dev/null
+++ b/manifests/ssl.pp
@@ -0,0 +1,25 @@
+# == Class: unbound::ssl
+#
+# unbound::ssl creates ssl certificates for controlling unbound with unbound-control,
+# using the unbound-control-setup program.  Furthermore, the class manages the mode and user of the certificates themselves.
+#
+# === Examples
+#
+#  include unbound::ssl
+#
+class unbound::ssl {
+  include unbound::params
+
+  file { $unbound::params::control_certs:
+    owner => $unbound::params::user,
+    group => $unbound::params::gruop,
+    mode => '0440',
+    require => Exec[$unbound::params::control_setup],
+  }
+
+  exec { $unbound::params::control_setup:
+    command => "${unbound::params::control_setup} -d ${unbound::params::dir}",
+    creates => $unbound::params::control_certs,
+    before => Class['unbound::service'],
+  }
+}
diff --git a/manifests/stub.pp b/manifests/stub.pp
new file mode 100644
index 0000000..02797fd
--- /dev/null
+++ b/manifests/stub.pp
@@ -0,0 +1,32 @@
+# == Define: unbound::stub
+#
+# Creates a stub-zone.  $settings is a hash containing the settings.
+# The name of the resource is used as the 'name' of the zone.
+#
+# === Parameters
+#
+# [*settings*]
+# Hash containing the settings as key value pairs.
+#
+# === Examples
+#
+# unbound::stub { $::domain:
+#   settings => {
+#     stub-addr => '192.168.1.1',
+#   },
+# }
+#
+define unbound::stub (
+  $settings,
+) {
+  include unbound::params
+
+  $zone_name = { name => "\"${title}\"" }
+  $real_settings = { stub-zone => merge($zone_name, $settings) }
+
+  concat::fragment { "unbound ${title}":
+    target => $unbound::params::config,
+    content => template('unbound/unbound.conf.erb'),
+    order => 2,
+  }
+}
diff --git a/metadata.json b/metadata.json
new file mode 100644
index 0000000..3c20ad4
--- /dev/null
+++ b/metadata.json
@@ -0,0 +1,50 @@
+{
+  "source": "UNKNOWN",
+  "types": [
+
+  ],
+  "project_page": "UNKNOWN",
+  "checksums": {
+    "manifests/service.pp": "baf263d0a562d6543c7418acf1e79cc2",
+    "tests/anchor.pp": "c6d270f2a0f448d7cebb6aed28b60998",
+    "LICENSE": "f8a2562cac0b3859771886422f703d27",
+    "spec/spec_helper.rb": "a55d1e6483344f8ec6963fcb2c220372",
+    "tests/service/openbsd.pp": "624a9db21c7bf277eec24186c490f4a5",
+    "Modulefile": "f1f67d825f8ef998667be8164f18744c",
+    "manifests/package.pp": "53a9d2e732f5690967f31e90d4eaaa99",
+    "manifests/init.pp": "92245e6671f2c3aef459c766c3df522d",
+    "tests/ssl.pp": "25439a06abaef7b5a2d778719a3d8c95",
+    "tests/service.pp": "106da53de4dd52a3e24d61af51263c00",
+    "tests/root_hints.pp": "7c9a9faa7350d023a00538812b9e3383",
+    "manifests/service/openbsd.pp": "fec14ed74ccf3a4c9a9d39a9870b992e",
+    "manifests/params.pp": "b949b2ac149f62130b0462a268c2a3ea",
+    "README": "6b5a94def03194686b83121ee218debd",
+    "tests/forward.pp": "29b51124459bc4fa265681cb0873afb7",
+    "manifests/root_hints.pp": "8c6879c961c8684dae69dbd13cea5efe",
+    "tests/params.pp": "f8662ff6d212159f10aac3186d010605",
+    "manifests/ssl.pp": "cc6e32a92c843bebbe5c05d7dc530c9b",
+    "tests/stub.pp": "34ca449ff833e3b1719d23f2875385d8",
+    "tests/init.pp": "9105221e2b9c942579d7e88f41a89b10",
+    "manifests/forward.pp": "07b209d883cf9ce1888a8427357a367f",
+    "tests/package.pp": "e1236eb6d345f5368f054f0e847a6a76",
+    "templates/unbound.conf.erb": "f5ee6f6444ad705c8494b8ec04e21d5b",
+    "manifests/stub.pp": "a0421e88c96df10cca872715c808ad5a",
+    "manifests/anchor.pp": "4ddf763591743e0505bf62a859e11a2d"
+  },
+  "license": "ISC",
+  "dependencies": [
+    {
+      "version_requirement": ">= 3.2.0",
+      "name": "puppetlabs/stdlib"
+    },
+    {
+      "version_requirement": ">= 0.1.0",
+      "name": "oppegaard/openbsd"
+    }
+  ],
+  "version": "0.1.0",
+  "summary": "The unbound module manages unbound",
+  "description": "This module manages unbound, the reqursive caching DNS resolver.\n    It manages the package, service, configuration file, control keys and support\n    files.",
+  "author": "Martin Oppegaard",
+  "name": "oppegaard-unbound"
+}
\ No newline at end of file
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
new file mode 100644
index 0000000..5fda588
--- /dev/null
+++ b/spec/spec_helper.rb
@@ -0,0 +1,17 @@
+dir = File.expand_path(File.dirname(__FILE__))
+$LOAD_PATH.unshift File.join(dir, 'lib')
+
+require 'mocha'
+require 'puppet'
+require 'rspec'
+require 'spec/autorun'
+
+Spec::Runner.configure do |config|
+    config.mock_with :mocha
+end
+
+# We need this because the RAL uses 'should' as a method.  This
+# allows us the same behaviour but with a different method name.
+class Object
+    alias :must :should
+end
diff --git a/templates/unbound.conf.erb b/templates/unbound.conf.erb
new file mode 100644
index 0000000..e082ad6
--- /dev/null
+++ b/templates/unbound.conf.erb
@@ -0,0 +1,8 @@
+<% real_settings.sort.each do |section, settings|	-%>
+<%= 	"#{section}:"					 %>
+<% 	settings.sort.each do |key, val|		-%>
+<% 		val.each do |val|			-%>
+<%= 		"	#{key}: #{val}"			 %>	
+<%		 end					-%>
+<% 	end						 %>
+<% end 							-%>
diff --git a/tests/anchor.pp b/tests/anchor.pp
new file mode 100644
index 0000000..ce73902
--- /dev/null
+++ b/tests/anchor.pp
@@ -0,0 +1,2 @@
+include unbound::params
+include unbound::anchor
diff --git a/tests/forward.pp b/tests/forward.pp
new file mode 100644
index 0000000..0d245e6
--- /dev/null
+++ b/tests/forward.pp
@@ -0,0 +1,7 @@
+include concat::setup
+include unbound
+unbound::forward { 'example.com':
+  settings => {
+    forward-addr => '127.0.0.1',
+  },
+}
diff --git a/tests/init.pp b/tests/init.pp
new file mode 100644
index 0000000..89af177
--- /dev/null
+++ b/tests/init.pp
@@ -0,0 +1,26 @@
+# The baseline for module testing used by Puppet Labs is that each manifest
+# should have a corresponding test manifest that declares that class or defined
+# type.
+#
+# Tests are then run by using puppet apply --noop (to check for compilation errors
+# and view a log of events) or by fully applying the test in a virtual environment
+# (to compare the resulting system state to the desired state).
+#
+# Learn more about module testing here: http://docs.puppetlabs.com/guides/tests_smoke.html
+#
+include concat::setup
+include unbound::package
+include unbound::service
+include unbound::anchor
+include unbound::ssl
+
+class { 'unbound':
+  anchor => false,
+  root_hints => false,
+  ssl => false,
+  settings => {
+    server => { },
+    python => { },
+    remote-control => { },
+  },
+}
diff --git a/tests/package.pp b/tests/package.pp
new file mode 100644
index 0000000..0360b52
--- /dev/null
+++ b/tests/package.pp
@@ -0,0 +1,2 @@
+include unbound::params
+include unbound::package
diff --git a/tests/params.pp b/tests/params.pp
new file mode 100644
index 0000000..7cd72bd
--- /dev/null
+++ b/tests/params.pp
@@ -0,0 +1 @@
+include unbound::params
diff --git a/tests/root_hints.pp b/tests/root_hints.pp
new file mode 100644
index 0000000..3ce21ed
--- /dev/null
+++ b/tests/root_hints.pp
@@ -0,0 +1,2 @@
+include unbound::params
+include unbound::root_hints
diff --git a/tests/service.pp b/tests/service.pp
new file mode 100644
index 0000000..0fb73df
--- /dev/null
+++ b/tests/service.pp
@@ -0,0 +1,2 @@
+include unbound::params
+include unbound::service
diff --git a/tests/service/openbsd.pp b/tests/service/openbsd.pp
new file mode 100644
index 0000000..3e8696c
--- /dev/null
+++ b/tests/service/openbsd.pp
@@ -0,0 +1 @@
+include unbound::service::openbsd
diff --git a/tests/ssl.pp b/tests/ssl.pp
new file mode 100644
index 0000000..d711197
--- /dev/null
+++ b/tests/ssl.pp
@@ -0,0 +1,2 @@
+include unbound::params
+include unbound::ssl
diff --git a/tests/stub.pp b/tests/stub.pp
new file mode 100644
index 0000000..b1477f9
--- /dev/null
+++ b/tests/stub.pp
@@ -0,0 +1,7 @@
+include concat::setup
+include unbound::params
+unbound::stub { 'example.com':
+  settings => {
+    stub-addr => '127.0.0.1',
+  },
+}