From 9ca03fcd19e243758b72698a80c7f1cfd951bc07 Mon Sep 17 00:00:00 2001 From: SamSu Date: Wed, 5 Mar 2014 13:51:49 -0800 Subject: [PATCH] if not any conf change, service will not restart Change-Id: I821ee220c4242dca427ce8ae05f51e23fdd6064e --- chef/cookbooks/iptables/CHANGELOG.md | 16 + chef/cookbooks/iptables/CONTRIBUTING | 29 ++ chef/cookbooks/iptables/LICENSE | 201 +++++++++++++ chef/cookbooks/iptables/README.md | 85 ++++++ .../iptables/definitions/iptables_rule.rb | 36 +++ .../iptables/files/default/rebuild-iptables | 284 ++++++++++++++++++ chef/cookbooks/iptables/metadata.json | 34 +++ chef/cookbooks/iptables/metadata.rb | 11 + chef/cookbooks/iptables/recipes/default.rb | 50 +++ chef/cookbooks/iptables/recipes/disabled.rb | 24 ++ .../templates/default/all_established.erb | 2 + .../iptables/templates/default/all_icmp.erb | 2 + .../templates/default/iptables_load.erb | 3 + chef/cookbooks/openssh/CHANGELOG.md | 56 ++++ chef/cookbooks/openssh/README.md | 186 ++++++++++++ chef/cookbooks/openssh/attributes/default.rb | 142 +++++++++ chef/cookbooks/openssh/metadata.json | 41 +++ chef/cookbooks/openssh/metadata.rb | 21 ++ chef/cookbooks/openssh/recipes/default.rb | 74 +++++ chef/cookbooks/openssh/recipes/iptables.rb | 22 ++ .../openssh/templates/default/port_ssh.erb | 2 + .../openssh/templates/default/ssh_config.erb | 17 ++ .../openssh/templates/default/sshd_config.erb | 26 ++ .../openssl/libraries/secure_password.rb | 4 +- chef/cookbooks/openssl/metadata.json | 30 ++ chef/cookbooks/openssl/metadata.rb | 2 +- .../attributes/default.rb | 2 +- .../openstack-compute/recipes/compute.rb | 7 + .../openstack-network/recipes/openvswitch.rb | 4 +- .../templates/default/quantum.conf.erb | 16 +- chef/cookbooks/yum/attributes/main.rb | 92 ++++++ chef/cookbooks/yum/libraries/matchers.rb | 27 ++ chef/cookbooks/yum/metadata.json | 33 ++ chef/cookbooks/yum/providers/globalconfig.rb | 37 +++ chef/cookbooks/yum/resources/globalconfig.rb | 104 +++++++ chef/cookbooks/yum/templates/default/main.erb | 248 +++++++++++++++ chef/roles/os-single-controller.rb | 6 +- 37 files changed, 1961 insertions(+), 15 deletions(-) create mode 100644 chef/cookbooks/iptables/CHANGELOG.md create mode 100644 chef/cookbooks/iptables/CONTRIBUTING create mode 100644 chef/cookbooks/iptables/LICENSE create mode 100644 chef/cookbooks/iptables/README.md create mode 100644 chef/cookbooks/iptables/definitions/iptables_rule.rb create mode 100644 chef/cookbooks/iptables/files/default/rebuild-iptables create mode 100644 chef/cookbooks/iptables/metadata.json create mode 100644 chef/cookbooks/iptables/metadata.rb create mode 100644 chef/cookbooks/iptables/recipes/default.rb create mode 100644 chef/cookbooks/iptables/recipes/disabled.rb create mode 100644 chef/cookbooks/iptables/templates/default/all_established.erb create mode 100644 chef/cookbooks/iptables/templates/default/all_icmp.erb create mode 100644 chef/cookbooks/iptables/templates/default/iptables_load.erb create mode 100644 chef/cookbooks/openssh/CHANGELOG.md create mode 100644 chef/cookbooks/openssh/README.md create mode 100644 chef/cookbooks/openssh/attributes/default.rb create mode 100644 chef/cookbooks/openssh/metadata.json create mode 100644 chef/cookbooks/openssh/metadata.rb create mode 100644 chef/cookbooks/openssh/recipes/default.rb create mode 100644 chef/cookbooks/openssh/recipes/iptables.rb create mode 100644 chef/cookbooks/openssh/templates/default/port_ssh.erb create mode 100644 chef/cookbooks/openssh/templates/default/ssh_config.erb create mode 100644 chef/cookbooks/openssh/templates/default/sshd_config.erb create mode 100644 chef/cookbooks/openssl/metadata.json create mode 100644 chef/cookbooks/yum/attributes/main.rb create mode 100644 chef/cookbooks/yum/libraries/matchers.rb create mode 100644 chef/cookbooks/yum/metadata.json create mode 100644 chef/cookbooks/yum/providers/globalconfig.rb create mode 100644 chef/cookbooks/yum/resources/globalconfig.rb create mode 100644 chef/cookbooks/yum/templates/default/main.erb diff --git a/chef/cookbooks/iptables/CHANGELOG.md b/chef/cookbooks/iptables/CHANGELOG.md new file mode 100644 index 0000000..9d3ff4b --- /dev/null +++ b/chef/cookbooks/iptables/CHANGELOG.md @@ -0,0 +1,16 @@ +## v0.12.0: + +* [COOK-2213] - iptables disabled recipe + +## v0.11.0: + +* [COOK-1883] - add perl package so rebuild script works + +## v0.10.0: + +* [COOK-641] - be able to save output on rhel-family +* [COOK-655] - use a template from other cookbooks + +## v0.9.3: + +* Current public release. diff --git a/chef/cookbooks/iptables/CONTRIBUTING b/chef/cookbooks/iptables/CONTRIBUTING new file mode 100644 index 0000000..89ac873 --- /dev/null +++ b/chef/cookbooks/iptables/CONTRIBUTING @@ -0,0 +1,29 @@ +If you would like to contribute, please open a ticket in JIRA: + +* http://tickets.opscode.com + +Create the ticket in the COOK project and use the cookbook name as the +component. + +For all code contributions, we ask that contributors sign a +contributor license agreement (CLA). Instructions may be found here: + +* http://wiki.opscode.com/display/chef/How+to+Contribute + +When contributing changes to individual cookbooks, please do not +modify the version number in the metadata.rb. Also please do not +update the CHANGELOG.md for a new version. Not all changes to a +cookbook may be merged and released in the same versions. Opscode will +handle the version updates during the release process. You are welcome +to correct typos or otherwise make updates to documentation in the +README. + +If a contribution adds new platforms or platform versions, indicate +such in the body of the commit message(s), and update the relevant +COOK ticket. When writing commit messages, it is helpful for others if +you indicate the COOK ticket. For example: + + git commit -m '[COOK-1041] Updated pool resource to correctly delete.' + +In the ticket itself, it is also helpful if you include log output of +a successful Chef run, but this is not absolutely required. diff --git a/chef/cookbooks/iptables/LICENSE b/chef/cookbooks/iptables/LICENSE new file mode 100644 index 0000000..11069ed --- /dev/null +++ b/chef/cookbooks/iptables/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + +TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + +1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + +2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + +3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + +4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + +5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + +6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + +7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + +8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + +9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + +END OF TERMS AND CONDITIONS + +APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + +Copyright [yyyy] [name of copyright owner] + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/chef/cookbooks/iptables/README.md b/chef/cookbooks/iptables/README.md new file mode 100644 index 0000000..b08a41d --- /dev/null +++ b/chef/cookbooks/iptables/README.md @@ -0,0 +1,85 @@ +Description +=========== + +Sets up iptables to use a script to maintain firewall rules. However +this cookbook may be deprecated or heavily modified in favor of the +general firewall cookbook, see __Roadmap__. + +Roadmap +------- + +* [COOK-652] - create a firewall cookbook +* [COOK-688] - create iptables providers for all resources + +Requirements +============ + +## Platform: + +* Ubuntu/Debian +* RHEL/CentOS + +Recipes +======= + +default +------- + +The default recipe will install iptables and provides a perl script +(installed in `/usr/sbin/rebuild-iptables`) to manage rebuilding +firewall rules from files dropped off in `/etc/iptables.d`. + +Definitions +=========== + +See __Roadmap__ for plans to replace the definition with LWRPs. + +iptables\_rule +-------------- + +The definition drops off a template in `/etc/iptables.d` after the +`name` parameter. The rule will get added to the local system firewall +through notifying the `rebuild-iptables` script. See __Examples__ below. + +Usage +===== + +Ensure that the system is set up to use the definition and rebuild +script with `recipe[iptables]`. Then create templates with the +firewall rules in the cookbook where the definition will be used. See +__Examples__. + +Examples +-------- + +To enable port 80, e.g. in an `httpd` cookbook, create the following +template: + + # Port 80 for http + -A FWR -p tcp -m tcp --dport 80 -j ACCEPT + +This would go in the cookbook, +`httpd/templates/default/port_http.erb`. Then to use it in +`recipe[httpd]`: + + iptables_rule "http" + +License and Author +================== + +Author:: Adam Jacob +Author:: Joshua Timberman + +Copyright:: 2008-2011, Opscode, Inc + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/chef/cookbooks/iptables/definitions/iptables_rule.rb b/chef/cookbooks/iptables/definitions/iptables_rule.rb new file mode 100644 index 0000000..fc33539 --- /dev/null +++ b/chef/cookbooks/iptables/definitions/iptables_rule.rb @@ -0,0 +1,36 @@ +# +# Cookbook Name:: iptables +# Definition:: iptables_rule +# +# Copyright 2008-2009, Opscode, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +define :iptables_rule, :enable => true, :source => nil, :variables => {}, :cookbook => nil do + template_source = params[:source] ? params[:source] : "#{params[:name]}.erb" + + template "/etc/iptables.d/#{params[:name]}" do + source template_source + mode 0644 + cookbook params[:cookbook] if params[:cookbook] + variables params[:variables] + backup false + notifies :run, resources(:execute => "rebuild-iptables") + if params[:enable] + action :create + else + action :delete + end + end +end diff --git a/chef/cookbooks/iptables/files/default/rebuild-iptables b/chef/cookbooks/iptables/files/default/rebuild-iptables new file mode 100644 index 0000000..6918537 --- /dev/null +++ b/chef/cookbooks/iptables/files/default/rebuild-iptables @@ -0,0 +1,284 @@ +#!/usr/bin/perl -w +our $ID = q$Id: rebuild-iptables 344 2006-10-04 02:48:30Z digant $; + +# +# rebuild-iptables -- Construct an iptables rules file from fragments. +# +# Written by Russ Allbery +# Adapted by Digant C Kasundra +# Adapted by Joe Williams (2011) +# Copyright 2005, 2006 Board of Trustees, Leland Stanford Jr. University +# +# Constructs an iptables rules file from the prefix, standard, and suffix +# files in the iptables configuration area, adding any additional modules +# specified in the command line, and prints the resulting iptables rules to +# standard output (suitable for saving into /var/lib/iptables or some other +# appropriate location on the system). + +############################################################################## +# Modules and declarations +############################################################################## + +require 5.006; +use strict; + +use Getopt::Long qw(GetOptions); + +# Path to the iptables template area. +our $TEMPLATE = '/etc/iptables.d'; + +############################################################################## +# Installation +############################################################################## + +# Return the prefix +sub prefix { + my $data; + ( $data = <<'END_OF_PREFIX' ) =~ s/^\s+//gm; + *filter + :INPUT ACCEPT + :FORWARD ACCEPT + :OUTPUT ACCEPT + :FWR - + -A INPUT -j FWR + -A FWR -i lo -j ACCEPT +END_OF_PREFIX + + return $data; +} + +# Return the suffix +sub suffix { + my $data; + ( $data = <<'END_OF_SUFFIX' ) =~ s/^\s+//gm; + # Rejects all remaining connections with port-unreachable errors. + + -A FWR -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable + -A FWR -p udp -j REJECT --reject-with icmp-port-unreachable + COMMIT +END_OF_SUFFIX + + return $data; +} + +sub snat { + my $data = ""; + if ( -f "/etc/iptables.snat" ) { + open( SNAT, "<", "/etc/iptables.snat" ) + or die "$0: cannot open /etc/iptables.snat: $!\n"; + while () { + $data = $data . $_; + } + close(SNAT); + } + return $data; +} + +# Read in a file, processing includes as required. Returns the contents of +# the file as an array. +sub read_iptables { + my ($file) = @_; + my @data; + $file = $TEMPLATE . '/' . $file unless $file =~ m%^\.?/%; + local *MODULE; + open( MODULE, '<', $file ) or die "$0: cannot open $file: $!\n"; + local $_; + while () { + if (/^\s*include\s+(\S+)$/) { + my $included = $1; + $included = $TEMPLATE . '/' . $included + unless $included =~ m%^\.?/%; + if ( $file eq $included ) { + die "$0: include loop in $file, line $.\n"; + } + push( @data, "\n" ); + push( @data, read_iptables($included) ); + push( @data, "\n" ); + } elsif (/^\s*include\s/) { + die "$0: malformed include line in $file, line $.\n"; + } else { + push( @data, $_ ); + } + } + close MODULE; + return @data; +} + +# Write a file carefully. +sub write_iptables { + my ( $file, @data ) = @_; + open( NEW, "> $file.new" ) or die "$0: cannot create $file.new: $!\n"; + print NEW @data or die "$0: cannot write to $file.new: $!\n"; + close NEW or die "$0: cannot flush $file.new: $!\n"; + rename( "$file.new", $file ) + or die "$0: cannot install new $file: $!\n"; +} + +# Install iptables on a Red Hat system. Takes the array containing the new +# iptables data. +sub install_redhat { + my (@data) = @_; + write_iptables( '/etc/sysconfig/iptables', @data ); + system( "/sbin/service", "iptables", "restart" ); +} + +# Install iptables on a Debian system. Take the array containing the new +# iptables data. +sub install_debian { + my (@data) = @_; + unless ( -d '/etc/iptables' ) { + mkdir( '/etc/iptables', 0755 ) + or die "$0: cannot mkdir /etc/iptables: $!\n"; + } + write_iptables( "/etc/iptables/general", @data ); + system("/sbin/iptables-restore < /etc/iptables/general") == 0 + or die "rebuild-iptables: iptables-restore failed! - $?" +} + +############################################################################## +# Main routine +############################################################################## + +# Fix things up for error reporting. +$| = 1; +my $fullpath = $0; +$0 =~ s%.*/%%; + +# Parse command-line options. +my ( $help, $version ); +Getopt::Long::config( 'bundling', 'no_ignore_case' ); +GetOptions( + 'h|help' => \$help, + 'v|version' => \$version +) or exit 1; +if ($help) { + print "Feeding myself to perldoc, please wait....\n"; + exec( 'perldoc', '-t', $fullpath ); +} elsif ($version) { + my $version = join( ' ', ( split( ' ', $ID ) )[ 1 .. 3 ] ); + $version =~ s/,v\b//; + $version =~ s/(\S+)$/($1)/; + $version =~ tr%/%-%; + print $version, "\n"; + exit; +} +my @modules; + +if ( -d '/etc/iptables.d' ) { + @modules = ; +} + +# Concatenate everything together. +my @data; +push( @data, prefix() ); +push( @data, "\n" ); +for my $module (@modules) { + push( @data, read_iptables($module) ); + push( @data, "\n" ); +} +push( @data, suffix() ); +push( @data, snat() ); + +if ( -f '/etc/debian_version' ) { + install_debian(@data); +} elsif ( -f '/etc/redhat-release' ) { + install_redhat(@data); +} else { + die "$0: cannot figure out whether this is Red Hat or Debian\n"; +} + +exit 0; +__END__ + +############################################################################## +# Documentation +############################################################################## + +=head1 NAME + +rebuild-iptables - Construct an iptables rules file from fragments + +=head1 SYNOPSIS + +rebuild-iptables [B<-hv>] + +=head1 DESCRIPTION + +B constructs an iptables configuration file by concatenating +various modules found in F. The resulting iptables +configuration file is written to the appropriate file for either Red Hat or +Debian (determined automatically) and iptables is restarted. + +Each module is just a text file located in the directory mentioned above that +contains one or more iptables configuration lines (basically the arguments to +an B invocation), possibly including comments. + +Along with the modules in the directory specified, a standard prefix and suffix +is added. + +Normally, the contents of each module are read in verbatim, but a module may +also contain the directive: + + include + +on a separate line, where is the path to another module to include, +specified the same way as modules given on the command line (hence, either a +file name relative to F or an +absolute path). Such a line will be replaced with the contents of the named +file. Be careful when using this directive to not create loops; files +including themselves will be detected, but more complex loops will not and +will result in infinite output. + +=head1 OPTIONS + +=over 4 + +=item B<-h>, B<--help> + +Print out this documentation (which is done simply by feeding the script to +C). + +=item B<-v>, B<--version> + +Print out the version of B and exit. + +=back + +=head1 FILES + +=over 4 + +=item F + +The default module location. + +=item F + +If this file exists, the system is assumed to be a Debian system for +determining the installation location when B<-i> is used. + +=item F + +The install location of the generated configuration file on Debian. + +=item F + +If this file exists, the system is assumed to be a Red Hat system for +determining the installation location when B<-i> is used. + +=item F + +The install location of the generated configuration file on Red Hat. + +=back + +=head1 AUTHOR + +Russ Allbery +Digant C Kasundra + +=head1 SEE ALSO + +iptables(8) + +=cut diff --git a/chef/cookbooks/iptables/metadata.json b/chef/cookbooks/iptables/metadata.json new file mode 100644 index 0000000..72582b7 --- /dev/null +++ b/chef/cookbooks/iptables/metadata.json @@ -0,0 +1,34 @@ +{ + "name": "iptables", + "description": "Sets up iptables to use a script to maintain rules", + "long_description": "", + "maintainer": "Opscode, Inc.", + "maintainer_email": "cookbooks@opscode.com", + "license": "Apache 2.0", + "platforms": { + "redhat": ">= 0.0.0", + "centos": ">= 0.0.0", + "debian": ">= 0.0.0", + "ubuntu": ">= 0.0.0" + }, + "dependencies": { + }, + "recommendations": { + }, + "suggestions": { + }, + "conflicting": { + }, + "providing": { + }, + "replacing": { + }, + "attributes": { + }, + "groupings": { + }, + "recipes": { + "iptables": "Installs iptables and sets up .d style config directory of iptables rules" + }, + "version": "0.12.0" +} \ No newline at end of file diff --git a/chef/cookbooks/iptables/metadata.rb b/chef/cookbooks/iptables/metadata.rb new file mode 100644 index 0000000..3fdfdf0 --- /dev/null +++ b/chef/cookbooks/iptables/metadata.rb @@ -0,0 +1,11 @@ +name "iptables" +maintainer "Opscode, Inc." +maintainer_email "cookbooks@opscode.com" +license "Apache 2.0" +description "Sets up iptables to use a script to maintain rules" +version "0.12.0" + +recipe "iptables", "Installs iptables and sets up .d style config directory of iptables rules" +%w{ redhat centos debian ubuntu}.each do |os| + supports os +end diff --git a/chef/cookbooks/iptables/recipes/default.rb b/chef/cookbooks/iptables/recipes/default.rb new file mode 100644 index 0000000..2b52790 --- /dev/null +++ b/chef/cookbooks/iptables/recipes/default.rb @@ -0,0 +1,50 @@ +# +# Cookbook Name:: iptables +# Recipe:: default +# +# Copyright 2008-2009, Opscode, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +package "iptables" +package "perl" + +execute "rebuild-iptables" do + command "/usr/sbin/rebuild-iptables" + action :nothing +end + +directory "/etc/iptables.d" do + action :create +end + +cookbook_file "/usr/sbin/rebuild-iptables" do + source "rebuild-iptables" + mode 0755 +end + +case node[:platform] +when "ubuntu", "debian" + iptables_save_file = "/etc/iptables/general" + + template "/etc/network/if-pre-up.d/iptables_load" do + source "iptables_load.erb" + mode 0755 + variables :iptables_save_file => iptables_save_file + end +end + + +iptables_rule "all_established" +iptables_rule "all_icmp" diff --git a/chef/cookbooks/iptables/recipes/disabled.rb b/chef/cookbooks/iptables/recipes/disabled.rb new file mode 100644 index 0000000..d9166a0 --- /dev/null +++ b/chef/cookbooks/iptables/recipes/disabled.rb @@ -0,0 +1,24 @@ +# +# Cookbook Name:: iptables +# Recipe:: default +# +# Copyright 2008-2009, Opscode, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +package "iptables" +service "iptables" do + action [ :disable, :stop ] + supports :status => true, :start => true, :stop => true, :restart => true +end diff --git a/chef/cookbooks/iptables/templates/default/all_established.erb b/chef/cookbooks/iptables/templates/default/all_established.erb new file mode 100644 index 0000000..c309b11 --- /dev/null +++ b/chef/cookbooks/iptables/templates/default/all_established.erb @@ -0,0 +1,2 @@ +# Any established connection is money +-A FWR -m state --state RELATED,ESTABLISHED -j ACCEPT diff --git a/chef/cookbooks/iptables/templates/default/all_icmp.erb b/chef/cookbooks/iptables/templates/default/all_icmp.erb new file mode 100644 index 0000000..e73aa49 --- /dev/null +++ b/chef/cookbooks/iptables/templates/default/all_icmp.erb @@ -0,0 +1,2 @@ +# ICMP +-A FWR -p icmp -j ACCEPT \ No newline at end of file diff --git a/chef/cookbooks/iptables/templates/default/iptables_load.erb b/chef/cookbooks/iptables/templates/default/iptables_load.erb new file mode 100644 index 0000000..d19862f --- /dev/null +++ b/chef/cookbooks/iptables/templates/default/iptables_load.erb @@ -0,0 +1,3 @@ +#!/bin/sh +/sbin/iptables-restore < <%= @iptables_save_file %> +exit 0 diff --git a/chef/cookbooks/openssh/CHANGELOG.md b/chef/cookbooks/openssh/CHANGELOG.md new file mode 100644 index 0000000..b475a2b --- /dev/null +++ b/chef/cookbooks/openssh/CHANGELOG.md @@ -0,0 +1,56 @@ +openssh Cookbook CHANGELOG +========================== +This file is used to list changes made in each version of the openssh cookbook. + + +v1.3.2 +------ +### Bug +- **[COOK-3995](https://tickets.opscode.com/browse/COOK-3995)** - sshd_config template needs ordering +- **[COOK-3910](https://tickets.opscode.com/browse/COOK-3910)** - ssh fails to start in Ubuntu 13.10 +- **[COOK-2073](https://tickets.opscode.com/browse/COOK-2073)** - Add support for Match block + + +v1.3.0 +------ +### Improvement +- **[COOK-3644](https://tickets.opscode.com/browse/COOK-3644)** - Add FreeBSD support +- **[COOK-2517](https://tickets.opscode.com/browse/COOK-2517)** - Add hash support +- **[COOK-2000](https://tickets.opscode.com/browse/COOK-2000)** - Make mode of sshd_config a configurable option + +### Bug +- **[COOK-3558](https://tickets.opscode.com/browse/COOK-3558)** - Fix RSA Server Config Options +- **[COOK-3557](https://tickets.opscode.com/browse/COOK-3557)** - Fix PubkeyAuthentication option + + +v1.2.2 +------ +### Bug +- **[COOK-3304](https://tickets.opscode.com/browse/COOK-3304)** - Fix error setting Dynamic `ListenAddresses` + +v1.2.0 +------ +### Improvement +- [COOK-2647]: `port_ssh` iptables template has no corresponding recipe + +v1.1.4 +------ +- [COOK-2225] - Add platform_family suse + +v1.1.2 +------ +- [COOK-1954] - Fix attribute camel case to match `man sshd_config` +- [COOK-1889] - SSH restarting on each chef run due to template changes + +v1.1.0 +------ +- [COOK-1663] - Configurable ListenAddress based off list of interface names +- [COOK-1685] - Make default sshd_config value more robust + +v1.0.0 +------ +- [COOK-1014] - Templates for ssh(d).conf files. + +v0.8.1 +------ +- Current public release diff --git a/chef/cookbooks/openssh/README.md b/chef/cookbooks/openssh/README.md new file mode 100644 index 0000000..3111974 --- /dev/null +++ b/chef/cookbooks/openssh/README.md @@ -0,0 +1,186 @@ +openssh Cookbook +================ +[![Build Status](https://secure.travis-ci.org/opscode-cookbooks/openssh.png?branch=master)](http://travis-ci.org/opscode-cookbooks/openssh) + +Installs openssh. + + +Requirements +------------ +### Platform +- Debian/Ubuntu +- RHEL/CentOS/Scientific +- Fedora +- ArchLinux +- FreeBSD + + +Recipes +------- +### default +Selects the packages to install by package name and manages the sshd service. + +### iptables +Set up an iptables firewall rule to allow inbound SSH connections. + + +Usage +----- +Ensure that the openssh packages are installed and the service is managed with `recipe[openssh]`. + + +Attributes List +--------------- +The attributes list is dynamically generated, and lines up with the default openssh configs. + +This means anything located in [sshd_config](http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config&sektion=5) or [ssh_config](http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config&sektion=5) can be used in your node attributes. + +* If the option can be entered more then once, use an _Array_, otherwise, use a _String_. If the option is host-specific use a `Hash` (please see below for more details). +* Each attribute is stored as ruby case, and converted to camel case for the config file on the fly. +* The current default attributes match the stock `ssh_config` and `sshd_config` provided by openssh. +* The namespace for `sshd_config` is `node['openssh']['server']`. +* Likewise, the namespace for `ssh_config` is `node['openssh']['client']`. +* An attribute can be an `Array`, a `Hash` or a `String`. +* If it is an `Array`, each item in the array will get it's own line in the config file. +* `Hash` attributes are meant to used with `ssh_config` namespace to create host-specific configurations. The keys of the `Hash` will be used as the `Host` entries and their associated entries as the configuration values. +* All the values in openssh are commented out in the `attributes/default.rb` file for a base starting point. +* There is one special attribute name, which is `match`. This is not included in the default template like the others. `node['openssh']['server']['match']` must be a Hash, where the key is the match pattern criteria and the value should be a Hash of normal keywords and values. The same transformations listed above apply to these keywords. See examples below. + + +Dynamic ListenAddress +--------------------- +Pass in a `Hash` of interface names, and IP address type(s) to bind sshd to. This will expand to a list of IP addresses which override the default `node['openssh']['server']['listen_address']` value. + + +Examples and Common usage +------------------------- +These can be mixed and matched in roles and attributes. Please note, it is possible to get sshd into a state that it will not run. If this is the case, you will need to login via an alternate method and debug sshd like normal. + +#### No Password logins + +This requires use of identity files to connect + +```json +"openssh": { + "server": { + "password_authentication": "no" + } +} +``` + +#### Match + +```json +"openssh": { + "server": { + "match": { + "Address 192.168.1.0/24": { + "password_authentication": "yes" + }, + "Group admins": { + "permit_tunnel": "yes", + "max_sessions": "20" + } + } + } +} +``` + +#### Enable X Forwarding + +```json +"openssh": { + "server": { + "x11_forwarding": "yes" + } +} +``` + +#### Bind to a specific set of address (this example actually binds to all). + +Not to be used with `node['openssh']['listen_interfaces']`. + +```json +"openssh": { + "server": { + "address_family": "any", + "listen_address": [ "192.168.0.1", "::" ] + } + } +} +``` + +### Bind to the addresses tied to a set of interfaces. + +```json +"openssh": { + "listen_interfaces": { + "eth0": "inet", + "eth1": "inet6" + } +} +``` + +### Host-specific configurations with hashes. +You can use a `Hash` with `node['openssh']['client']` to configure different values for different hosts. + +```json +"client": { + "*": { + "g_s_s_a_p_i_authentication": "yes", + "send_env": "LANG LC_*", + "hash_known_hosts": "yes" + }, + "localhost": { + "user_known_hosts_file": "/dev/null", + "strict_host_key_checking": "no" + }, + "127.0.0.1": { + "user_known_hosts_file": "/dev/null", + "strict_host_key_checking": "no" + }, + "other*": { + "user_known_hosts_file": "/dev/null", + "strict_host_key_checking": "no" + } +} +``` + +The keys are used as values with the `Host` entries. So, the configuration fragment shown above generates: + +```text +Host * +SendEnv LANG LC_* +HashKnownHosts yes +GSSAPIAuthentication yes +Host localhost +StrictHostKeyChecking no +UserKnownHostsFile /dev/null +Host 127.0.0.1 +StrictHostKeyChecking no +UserKnownHostsFile /dev/null +Host other* +StrictHostKeyChecking no +UserKnownHostsFile /dev/null +``` + + +License & Authors +----------------- +- Author:: Adam Jacob + +```text +Copyright:: 2008-2009, Opscode, Inc + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +``` diff --git a/chef/cookbooks/openssh/attributes/default.rb b/chef/cookbooks/openssh/attributes/default.rb new file mode 100644 index 0000000..9fca9b4 --- /dev/null +++ b/chef/cookbooks/openssh/attributes/default.rb @@ -0,0 +1,142 @@ +# +# Cookbook Name:: openssh +# Attributes:: default +# +# Author:: Ernie Brodeur +# Copyright 2008-2013, Opscode, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Attributes are commented out using the default config file values. +# Uncomment the ones you need, or set attributes in a role. +# + +default['openssh']['package_name'] = case node['platform_family'] + when 'rhel', 'fedora' + %w[openssh-clients openssh] + when 'arch', 'suse' + %w[openssh] + when 'freebsd' + %w[] + else + %w[openssh-client openssh-server] + end + +default['openssh']['service_name'] = case node['platform_family'] + when 'rhel', 'fedora', 'suse', 'freebsd' + 'sshd' + else + 'ssh' + end + +default['openssh']['config_mode'] = case node['platform_family'] + when 'rhel', 'fedora' + '0600' + else + '0644' + end + +default['openssh']['rootgroup'] = case node['platform_family'] + when 'freebsd' + 'wheel' + else + 'root' + end + +# ssh config group +default['openssh']['client']['host'] = '*' +# default['openssh']['client']['forward_agent'] = 'no' +# default['openssh']['client']['forward_x11'] = 'no' +# default['openssh']['client']['rhosts_rsa_authentication'] = 'no' +# default['openssh']['client']['rsa_authentication'] = 'yes' +# default['openssh']['client']['password_authentication'] = 'yes' +# default['openssh']['client']['host_based_authentication'] = 'no' +# default['openssh']['client']['gssapi_authentication'] = 'no' +# default['openssh']['client']['gssapi_delegate_credentials'] = 'no' +# default['openssh']['client']['batch_mode'] = 'no' +# default['openssh']['client']['check_host_ip'] = 'yes' +# default['openssh']['client']['address_family'] = 'any' +# default['openssh']['client']['connect_timeout'] = '0' +# default['openssh']['client']['strict_host_key_checking'] = 'ask' +# default['openssh']['client']['identity_file'] = '~/.ssh/identity' +# default['openssh']['client']['identity_file_rsa'] = '~/.ssh/id_rsa' +# default['openssh']['client']['identity_file_dsa'] = '~/.ssh/id_dsa' +# default['openssh']['client']['port'] = '22' +# default['openssh']['client']['protocol'] = [ '2 1' ] +# default['openssh']['client']['cipher'] = '3des' +# default['openssh']['client']['ciphers'] = [ 'aes128-ctr aes192-ctr aes256-ctr arcfour256 arcfour128 aes128-cbc 3des-cbc' ] +# default['openssh']['client']['macs'] = [ 'hmac-md5 hmac-sha1 umac-64@openssh.com hmac-ripemd160' ] +# default['openssh']['client']['escape_char'] = '~' +# default['openssh']['client']['tunnel'] = 'no' +# default['openssh']['client']['tunnel_device'] = 'any:any' +# default['openssh']['client']['permit_local_command'] = 'no' +# default['openssh']['client']['visual_host_key'] = 'no' +# default['openssh']['client']['proxy_command'] = 'ssh -q -W %h:%p gateway.example.com' +# sshd config group +# default['openssh']['server']['port'] = '22' +# default['openssh']['server']['address_family'] = 'any' +# default['openssh']['server']['listen_address'] = [ '0.0.0.0 ::' ] +# default['openssh']['server']['protocol'] = '2' +# default['openssh']['server']['host_key_v1'] = '/etc/ssh/ssh_host_key' +# default['openssh']['server']['host_key_rsa'] = '/etc/ssh/ssh_host_rsa_key' +# default['openssh']['server']['host_key_dsa'] = '/etc/ssh/ssh_host_dsa_key' +# default['openssh']['server']['host_key_ecdsa'] = '/etc/ssh/ssh_host_ecdsa_key' +# default['openssh']['server']['key_regeneration_interval'] = '1h' +# default['openssh']['server']['server_key_bits'] = '1024' +# default['openssh']['server']['syslog_facility'] = 'AUTH' +# default['openssh']['server']['log_level'] = 'INFO' +# default['openssh']['server']['login_grace_time'] = '2m' +# default['openssh']['server']['permit_root_login'] = 'yes' +# default['openssh']['server']['strict_modes'] = 'yes' +# default['openssh']['server']['max_auth_tries'] = '6' +# default['openssh']['server']['max_sessions'] = '10' +# default['openssh']['server']['r_s_a_authentication'] = 'yes' +# default['openssh']['server']['pubkey_authentication'] = 'yes' +default['openssh']['server']['authorized_keys_file'] = '%h/.ssh/authorized_keys' +# default['openssh']['server']['rhosts_r_s_a_authentication'] = 'no' +# default['openssh']['server']['host_based_authentication'] = 'no' +# default['openssh']['server']['ignore_user_known_hosts'] = 'no' +# default['openssh']['server']['ignore_rhosts'] = 'yes' +# default['openssh']['server']['password_authentication'] = 'yes' +# default['openssh']['server']['permit_empty_passwords'] = 'no' +default['openssh']['server']['challenge_response_authentication'] = 'no' +# default['openssh']['server']['kerberos_authentication'] = 'no' +# default['openssh']['server']['kerberos_or_localpasswd'] = 'yes' +# default['openssh']['server']['kerberos_ticket_cleanup'] = 'yes' +# default['openssh']['server']['kerberos_get_afs_token'] = 'no' +# default['openssh']['server']['gssapi_authentication'] = 'no' +# default['openssh']['server']['gssapi_clean_up_credentials'] = 'yes' +default['openssh']['server']['use_p_a_m'] = 'yes' +# default['openssh']['server']['allow_agent_forwarding'] = 'yes' +# default['openssh']['server']['allow_tcp_forwarding'] = 'yes' +# default['openssh']['server']['gateway_ports'] = 'no' +# default['openssh']['server']['x11_forwarding'] = 'no' +# default['openssh']['server']['x11_display_offset'] = '10' +# default['openssh']['server']['x11_use_localhost'] = 'yes' +# default['openssh']['server']['print_motd'] = 'yes' +# default['openssh']['server']['print_lastlog'] = 'yes' +# default['openssh']['server']['t_c_p_keep_alive'] = 'yes' +# default['openssh']['server']['use_login'] = 'no' +# default['openssh']['server']['use_privilege_separation'] = 'yes' +# default['openssh']['server']['permit_user_environment'] = 'no' +# default['openssh']['server']['compression'] = 'delayed' +# default['openssh']['server']['client_alive_interval'] = '0' +# default['openssh']['server']['client_alive_count_max'] = '3' +# default['openssh']['server']['use_dns'] = 'yes' +# default['openssh']['server']['pid_file'] = '/var/run/sshd.pid' +# default['openssh']['server']['max_startups'] = '10' +# default['openssh']['server']['permit_tunnel'] = 'no' +# default['openssh']['server']['chroot_directory'] = 'none' +# default['openssh']['server']['banner'] = 'none' +# default['openssh']['server']['subsystem'] = 'sftp /usr/libexec/sftp-server' +default['openssh']['server']['match'] = {} diff --git a/chef/cookbooks/openssh/metadata.json b/chef/cookbooks/openssh/metadata.json new file mode 100644 index 0000000..b3c8cd3 --- /dev/null +++ b/chef/cookbooks/openssh/metadata.json @@ -0,0 +1,41 @@ +{ + "name": "openssh", + "version": "1.3.2", + "description": "Installs openssh", + "long_description": "", + "maintainer": "Opscode, Inc.", + "maintainer_email": "cookbooks@opscode.com", + "license": "Apache 2.0", + "platforms": { + "arch": ">= 0.0.0", + "centos": ">= 0.0.0", + "debian": ">= 0.0.0", + "fedora": ">= 0.0.0", + "freebsd": ">= 0.0.0", + "redhat": ">= 0.0.0", + "scientific": ">= 0.0.0", + "suse": ">= 0.0.0", + "ubuntu": ">= 0.0.0" + }, + "dependencies": { + "iptables": ">= 0.0.0" + }, + "recommendations": { + }, + "suggestions": { + }, + "conflicting": { + }, + "providing": { + }, + "replacing": { + }, + "attributes": { + }, + "groupings": { + }, + "recipes": { + "openssh": "Installs openssh", + "openssh::iptables": "Set up iptables to allow SSH inbound" + } +} \ No newline at end of file diff --git a/chef/cookbooks/openssh/metadata.rb b/chef/cookbooks/openssh/metadata.rb new file mode 100644 index 0000000..6717041 --- /dev/null +++ b/chef/cookbooks/openssh/metadata.rb @@ -0,0 +1,21 @@ +name 'openssh' +maintainer 'Opscode, Inc.' +maintainer_email 'cookbooks@opscode.com' +license 'Apache 2.0' +description 'Installs openssh' +version '1.3.2' + +recipe 'openssh', 'Installs openssh' +recipe 'openssh::iptables', 'Set up iptables to allow SSH inbound' + +supports 'arch' +supports 'centos' +supports 'debian' +supports 'fedora' +supports 'freebsd' +supports 'redhat' +supports 'scientific' +supports 'suse' +supports 'ubuntu' + +depends 'iptables' diff --git a/chef/cookbooks/openssh/recipes/default.rb b/chef/cookbooks/openssh/recipes/default.rb new file mode 100644 index 0000000..5d8b5d5 --- /dev/null +++ b/chef/cookbooks/openssh/recipes/default.rb @@ -0,0 +1,74 @@ +# +# Cookbook Name:: openssh +# Recipe:: default +# +# Copyright 2008-2013 Opscode, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +def listen_addr_for(interface, type) + interface_node = node['network']['interfaces'][interface]['addresses'] + interface_node.select { |address, data| data['family'] == type }.keys[0] +end + +node['openssh']['package_name'].each do |name| + package name +end + +service_provider = Chef::Provider::Service::Upstart if 'ubuntu' == node['platform'] && + Chef::VersionConstraint.new('>= 13.10').include?(node['platform_version']) + +service 'ssh' do + provider service_provider + service_name node['openssh']['service_name'] + supports value_for_platform( + 'debian' => { 'default' => [:restart, :reload, :status] }, + 'ubuntu' => { + '8.04' => [:restart, :reload], + 'default' => [:restart, :reload, :status] + }, + 'centos' => { 'default' => [:restart, :reload, :status] }, + 'redhat' => { 'default' => [:restart, :reload, :status] }, + 'fedora' => { 'default' => [:restart, :reload, :status] }, + 'scientific' => { 'default' => [:restart, :reload, :status] }, + 'arch' => { 'default' => [:restart] }, + 'default' => { 'default' => [:restart, :reload] } + ) + action [:enable, :start] +end + +template '/etc/ssh/ssh_config' do + source 'ssh_config.erb' + mode '0644' + owner 'root' + group node['openssh']['rootgroup'] +end + +if node['openssh']['listen_interfaces'] + listen_addresses = Array.new.tap do |a| + node['openssh']['listen_interfaces'].each_pair do |interface, type| + a << listen_addr_for(interface, type) + end + end + + node.set['openssh']['server']['listen_address'] = listen_addresses +end + +template '/etc/ssh/sshd_config' do + source 'sshd_config.erb' + mode node['openssh']['config_mode'] + owner 'root' + group node['openssh']['rootgroup'] + notifies :restart, 'service[ssh]' +end diff --git a/chef/cookbooks/openssh/recipes/iptables.rb b/chef/cookbooks/openssh/recipes/iptables.rb new file mode 100644 index 0000000..6c2d967 --- /dev/null +++ b/chef/cookbooks/openssh/recipes/iptables.rb @@ -0,0 +1,22 @@ +# +# Cookbook Name:: openssh +# Recipe:: iptables +# +# Copyright 2013, Opscode, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +include_recipe 'iptables::default' + +iptables_rule 'port_ssh' diff --git a/chef/cookbooks/openssh/templates/default/port_ssh.erb b/chef/cookbooks/openssh/templates/default/port_ssh.erb new file mode 100644 index 0000000..355f6e5 --- /dev/null +++ b/chef/cookbooks/openssh/templates/default/port_ssh.erb @@ -0,0 +1,2 @@ +# SSH +-A FWR -p tcp -m tcp --dport 22 -j ACCEPT diff --git a/chef/cookbooks/openssh/templates/default/ssh_config.erb b/chef/cookbooks/openssh/templates/default/ssh_config.erb new file mode 100644 index 0000000..df4941d --- /dev/null +++ b/chef/cookbooks/openssh/templates/default/ssh_config.erb @@ -0,0 +1,17 @@ +# This file was generated by Chef for <%= node['fqdn'] %> +# Do NOT modify this file by hand! + +<% node['openssh']['client'].each do |key, value| -%> +<% if value.kind_of? Array -%> +<% value.each do |item| -%> +<%= "#{key.split("_").map { |w| w.capitalize}.join} #{item}" %> +<% end -%> +<% elsif value.kind_of? Hash -%> +<%= "Host #{key}"%> +<% value.each do |host_key, host_value| -%> +<%= "#{host_key.split("_").map { |w| w.capitalize}.join} #{host_value}" %> +<% end -%> +<% else -%> +<%= "#{key.split("_").map { |w| w.capitalize}.join} #{value}"%> +<% end -%> +<% end -%> diff --git a/chef/cookbooks/openssh/templates/default/sshd_config.erb b/chef/cookbooks/openssh/templates/default/sshd_config.erb new file mode 100644 index 0000000..7bd4dc7 --- /dev/null +++ b/chef/cookbooks/openssh/templates/default/sshd_config.erb @@ -0,0 +1,26 @@ +# This file was generated by Chef for <%= node['fqdn'] %> +# Do NOT modify this file by hand! + +<% node['openssh']['server'].dup.reject{|k,v| k=='match'}.map do |key, value| -%> +<% if value.kind_of? Array -%> +<% value.each do |item| -%> +<%= "#{key.split("_").map { |w| w.capitalize}.join} #{item}" %> +<% end -%> +<% else -%> +<%= "#{key.split("_").map { |w| w.capitalize}.join} #{value}"%> +<% end -%> +<% end -%> + +<% node['openssh']['server']['match'].sort.map do |match_key, match_items| -%> +Match <%= match_key %> +<% match_items.sort.map do |key, value| -%> +<% if value.kind_of? Array -%> +<% value.each do |item| -%> +<%= " #{key.split("_").map { |w| w.capitalize}.join} #{item}" %> +<% end -%> +<% else -%> +<%= " #{key.split("_").map { |w| w.capitalize}.join} #{value}"%> +<% end -%> +<% end -%> + +<% end -%> diff --git a/chef/cookbooks/openssl/libraries/secure_password.rb b/chef/cookbooks/openssl/libraries/secure_password.rb index 37dd53e..9513fa3 100644 --- a/chef/cookbooks/openssl/libraries/secure_password.rb +++ b/chef/cookbooks/openssl/libraries/secure_password.rb @@ -25,9 +25,11 @@ module Opscode module Password def secure_password(length = 20) pw = String.new + while pw.length < length - pw << ::OpenSSL::Random.random_bytes(1).gsub(/\W/, '') + pw << ::OpenSSL::Random.random_bytes(1).gsub(/\W/, '') end + pw end end diff --git a/chef/cookbooks/openssl/metadata.json b/chef/cookbooks/openssl/metadata.json new file mode 100644 index 0000000..a25599e --- /dev/null +++ b/chef/cookbooks/openssl/metadata.json @@ -0,0 +1,30 @@ +{ + "name": "openssl", + "version": "1.1.0", + "description": "Provides a library with a method for generating secure random passwords.", + "long_description": "openssl Cookbook\n================\nProvide a library method to generate secure random passwords in recipes.\n\nRequirements\n------------\nWorks on any platform with OpenSSL Ruby bindings installed, which are a requirement for Chef anyway.\n\n\nUsage\n-----\nMost often this will be used to generate a secure password for an attribute.\n\n```ruby\ninclude Opscode::OpenSSL::Password\nset_unless[:my_password] = secure_password\n```\n\n\nLicense & Authors\n-----------------\n- Author:: Joshua Timberman ()\n\n```text\nCopyright:: 2009-2011, Opscode, Inc\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n```\n", + "maintainer": "Opscode, Inc.", + "maintainer_email": "cookbooks@opscode.com", + "license": "Apache 2.0", + "platforms": { + }, + "dependencies": { + }, + "recommendations": { + }, + "suggestions": { + }, + "conflicting": { + }, + "providing": { + }, + "replacing": { + }, + "attributes": { + }, + "groupings": { + }, + "recipes": { + "openssl": "Empty, this cookbook provides a library, see README.md" + } +} \ No newline at end of file diff --git a/chef/cookbooks/openssl/metadata.rb b/chef/cookbooks/openssl/metadata.rb index 8696a07..1a0c22e 100644 --- a/chef/cookbooks/openssl/metadata.rb +++ b/chef/cookbooks/openssl/metadata.rb @@ -4,6 +4,6 @@ maintainer_email "cookbooks@opscode.com" license "Apache 2.0" description "Provides a library with a method for generating secure random passwords." long_description IO.read(File.join(File.dirname(__FILE__), 'README.md')) -version "1.1.1" +version "1.1.0" recipe "openssl", "Empty, this cookbook provides a library, see README.md" diff --git a/chef/cookbooks/openstack-block-storage/attributes/default.rb b/chef/cookbooks/openstack-block-storage/attributes/default.rb index d07aee3..69ebd9e 100644 --- a/chef/cookbooks/openstack-block-storage/attributes/default.rb +++ b/chef/cookbooks/openstack-block-storage/attributes/default.rb @@ -112,7 +112,7 @@ default["openstack"]["block-storage"]["volume"]["state_path"] = "/var/lib/cinder default["openstack"]["block-storage"]["volume"]["driver"] = "cinder.volume.drivers.lvm.LVMISCSIDriver" default["openstack"]["block-storage"]["volume"]["volume_group"] = "cinder-volumes" default["openstack"]["block-storage"]["volume"]["iscsi_helper"] = "tgtadm" -default["openstack"]["volume"]["mode"] = "loopfile" +#default["openstack"]["volume"]["mode"] = "loopfile" default["openstack"]["volume"]["disk"] = "/dev/sdb" diff --git a/chef/cookbooks/openstack-compute/recipes/compute.rb b/chef/cookbooks/openstack-compute/recipes/compute.rb index 6ecdfc3..a5973f1 100644 --- a/chef/cookbooks/openstack-compute/recipes/compute.rb +++ b/chef/cookbooks/openstack-compute/recipes/compute.rb @@ -67,6 +67,13 @@ platform_options["nfs_packages"].each do |pkg| end end +directory "/var/lock/nova" do + owner node["openstack"]["compute"]["user"] + group node["openstack"]["compute"]["group"] + mode 00700 + action :create +end + cookbook_file "/etc/nova/nova-compute.conf" do source "nova-compute.conf" mode 00644 diff --git a/chef/cookbooks/openstack-network/recipes/openvswitch.rb b/chef/cookbooks/openstack-network/recipes/openvswitch.rb index bc70cef..08a7dbc 100644 --- a/chef/cookbooks/openstack-network/recipes/openvswitch.rb +++ b/chef/cookbooks/openstack-network/recipes/openvswitch.rb @@ -85,7 +85,7 @@ end service "quantum-openvswitch-switch" do service_name platform_options["quantum_openvswitch_service"] supports :status => true, :restart => true - action :restart + action :enable end @@ -106,7 +106,7 @@ end service "quantum-plugin-openvswitch-agent" do service_name platform_options["quantum_openvswitch_agent_service"] supports :status => true, :restart => true - action [ :enable, :restart ] + action :nothing end execute "chkconfig openvswitch on" do diff --git a/chef/cookbooks/openstack-network/templates/default/quantum.conf.erb b/chef/cookbooks/openstack-network/templates/default/quantum.conf.erb index 40463a5..09a703c 100644 --- a/chef/cookbooks/openstack-network/templates/default/quantum.conf.erb +++ b/chef/cookbooks/openstack-network/templates/default/quantum.conf.erb @@ -42,11 +42,6 @@ bind_host = <%= node['openstack']['endpoints']['network-api']['host'] %> # Port the bind the API server to bind_port = <%= @bind_port %> -sql_max_pool_size=50 -sqlalchemy_pool_size = 40 - -agent_down_time=10 - # Path to the extensions. Note that this can be a colon-separated list of # paths. For example: # api_extensions_path = extensions:/path/to/more/extensions:/even/more/extensions @@ -137,7 +132,7 @@ allow_overlapping_ips = <%= node["openstack"]["network"]["allow_overlapping_ips" ##### RABBITMQ ##### rabbit_userid=<%= node["openstack"]["network"]["rabbit"]["username"] %> rabbit_password=<%= @rabbit_pass %> -rabbit_virtual_host=<%= node["openstack"]["network"]["rabbit"]["vhost"] %> +# rabbit_virtual_host=<%= node["openstack"]["network"]["rabbit"]["vhost"] %> <% if node["openstack"]["network"]["rabbit"]["ha"] -%> # Use HA queues in RabbitMQ (x-ha-policy: all).You need to # wipe RabbitMQ database when changing this option. (boolean value) @@ -225,7 +220,8 @@ notification_topics = notifications # =========== items for agent management extension ============= # Seconds to regard the agent as down. -# agent_down_time = 5 +agent_down_time = 10 + # =========== end of items for agent management extension ===== # =========== items for agent scheduler extension ============= @@ -297,6 +293,7 @@ notification_topics = notifications # default driver to use for quota checks # quota_driver = quantum.quota.ConfDriver +quota_driver = quantum.db.quota_db.DbQuotaDriver [DEFAULT_SERVICETYPE] # Description of the default service type (optional) @@ -330,3 +327,8 @@ admin_password = <%= @service_pass %> signing_dir = <%= node["openstack"]["network"]["api"]["agent"]["signing_dir"] %> # =========== end of items for agent management extension ===== + +[database] +sql_max_pool_size=30 + +#sqlalchemy_pool_size = 30 diff --git a/chef/cookbooks/yum/attributes/main.rb b/chef/cookbooks/yum/attributes/main.rb new file mode 100644 index 0000000..8ee84a3 --- /dev/null +++ b/chef/cookbooks/yum/attributes/main.rb @@ -0,0 +1,92 @@ +# http://linux.die.net/man/5/yum.conf +case node['platform_version'].to_i +when 5 + default['yum']['main']['cachedir'] = '/var/cache/yum' +else + default['yum']['main']['cachedir'] = '/var/cache/yum/$basearch/$releasever' +end + +case node['platform'] +when 'amazon' + default['yum']['main']['distroverpkg'] = 'system-release' +else + default['yum']['main']['distroverpkg'] = "#{node['platform']}-release" +end + +default['yum']['main']['alwaysprompt'] = nil # [TrueClass, FalseClass] +default['yum']['main']['assumeyes'] = nil # [TrueClass, FalseClass] +default['yum']['main']['bandwidth'] = nil # /^\d+$/ +default['yum']['main']['bugtracker_url'] = nil # /.*/ +default['yum']['main']['clean_requirements_on_remove'] = nil # [TrueClass, FalseClass] +default['yum']['main']['color'] = nil # %w{ always never } +default['yum']['main']['color_list_available_downgrade'] = nil # /.*/ +default['yum']['main']['color_list_available_install'] = nil # /.*/ +default['yum']['main']['color_list_available_reinstall'] = nil # /.*/ +default['yum']['main']['color_list_available_upgrade'] = nil # /.*/ +default['yum']['main']['color_list_installed_extra'] = nil # /.*/ +default['yum']['main']['color_list_installed_newer'] = nil # /.*/ +default['yum']['main']['color_list_installed_older'] = nil # /.*/ +default['yum']['main']['color_list_installed_reinstall'] = nil # /.*/ +default['yum']['main']['color_search_match'] = nil # /.*/ +default['yum']['main']['color_update_installed'] = nil # /.*/ +default['yum']['main']['color_update_local'] = nil # /.*/ +default['yum']['main']['color_update_remote'] = nil # /.*/ +default['yum']['main']['commands'] = nil # /.*/ +default['yum']['main']['debuglevel'] = nil # /^\d+$/ +default['yum']['main']['diskspacecheck'] = nil # [TrueClass, FalseClass] +default['yum']['main']['enable_group_conditionals'] = nil # [TrueClass, FalseClass] +default['yum']['main']['errorlevel'] = nil # /^\d+$/ +default['yum']['main']['exactarch'] = nil # [TrueClass, FalseClass] +default['yum']['main']['exclude'] = nil # /.*/ +default['yum']['main']['gpgcheck'] = true # [TrueClass, FalseClass] +default['yum']['main']['group_package_types'] = nil # /.*/ +default['yum']['main']['groupremove_leaf_only'] = nil # [TrueClass, FalseClass] +default['yum']['main']['history_list_view'] = nil # /.*/ +default['yum']['main']['history_record'] = nil # [TrueClass, FalseClass] +default['yum']['main']['history_record_packages'] = nil # /.*/ +default['yum']['main']['http_caching'] = nil # %w{ packages all none } +default['yum']['main']['installonly_limit'] = nil # /\d+/, /keep/ +default['yum']['main']['installonlypkgs'] = nil # /.*/ +default['yum']['main']['installroot'] = nil # /.*/ +default['yum']['main']['keepalive'] = nil # [TrueClass, FalseClass] +default['yum']['main']['keepcache'] = false # [TrueClass, FalseClass] +default['yum']['main']['kernelpkgnames'] = nil # /.*/ +default['yum']['main']['localpkg_gpgcheck'] = nil # [TrueClass,# FalseClass] +default['yum']['main']['logfile'] = '/var/log/yum.log' # /.*/ +default['yum']['main']['max_retries'] = nil # /^\d+$/ +default['yum']['main']['mdpolicy'] = nil # %w{ packages all none } +default['yum']['main']['metadata_expire'] = nil # /^\d+$/ +default['yum']['main']['mirrorlist_expire'] = nil # /^\d+$/ +default['yum']['main']['multilib_policy'] = nil # %w{ all best } +default['yum']['main']['obsoletes'] = nil # [TrueClass, FalseClass] +default['yum']['main']['overwrite_groups'] = nil # [TrueClass, FalseClass] +default['yum']['main']['password'] = nil # /.*/ +default['yum']['main']['path'] = '/etc/yum.conf' # /.*/ +default['yum']['main']['persistdir'] = nil # /.*/ +default['yum']['main']['pluginconfpath'] = nil # /.*/ +default['yum']['main']['pluginpath'] = nil # /.*/ +default['yum']['main']['plugins'] = nil # [TrueClass, FalseClass] +default['yum']['main']['protected_multilib'] = nil # /.*/ +default['yum']['main']['protected_packages'] = nil # /.*/ +default['yum']['main']['proxy'] = nil # /.*/ +default['yum']['main']['proxy_password'] = nil # /.*/ +default['yum']['main']['proxy_username'] = nil # /.*/ +default['yum']['main']['recent'] = nil # /^\d+$/ +default['yum']['main']['repo_gpgcheck'] = nil # [TrueClass, FalseClass] +default['yum']['main']['reset_nice'] = nil # [TrueClass, FalseClass] +default['yum']['main']['rpmverbosity'] = nil # %w{ info critical# emergency error warn debug } +default['yum']['main']['showdupesfromrepos'] = nil # [TrueClass, FalseClass] +default['yum']['main']['skip_broken'] = nil # [TrueClass, FalseClass] +default['yum']['main']['ssl_check_cert_permissions'] = nil # [TrueClass, FalseClass] +default['yum']['main']['sslcacert'] = nil # /.*/ +default['yum']['main']['sslclientcert'] = nil # /.*/ +default['yum']['main']['sslclientkey'] = nil # /.*/ +default['yum']['main']['sslverify'] = nil # [TrueClass, FalseClass] +default['yum']['main']['syslog_device'] = nil # /.*/ +default['yum']['main']['syslog_facility'] = nil # /.*/ +default['yum']['main']['syslog_ident'] = nil # /.*/ +default['yum']['main']['throttle'] = nil # [/\d+k/, /\d+M/, /\d+G/] +default['yum']['main']['timeout'] = nil # /\d+/ +default['yum']['main']['tolerant'] = false +default['yum']['main']['tsflags'] = nil # /.*/ +default['yum']['main']['username'] = nil # /.*/ diff --git a/chef/cookbooks/yum/libraries/matchers.rb b/chef/cookbooks/yum/libraries/matchers.rb new file mode 100644 index 0000000..433347b --- /dev/null +++ b/chef/cookbooks/yum/libraries/matchers.rb @@ -0,0 +1,27 @@ +# Matchers for chefspec 3 + +if defined?(ChefSpec) + def create_yum_repository(resource_name) + ChefSpec::Matchers::ResourceMatcher.new(:yum_repository, :create, resource_name) + end + + def add_yum_repository(resource_name) + ChefSpec::Matchers::ResourceMatcher.new(:yum_repository, :add, resource_name) + end + + def delete_yum_repository(resource_name) + ChefSpec::Matchers::ResourceMatcher.new(:yum_repository, :delete, resource_name) + end + + def remove_yum_repository(resource_name) + ChefSpec::Matchers::ResourceMatcher.new(:yum_repository, :remove, resource_name) + end + + def create_yum_globalconfig(resource_name) + ChefSpec::Matchers::ResourceMatcher.new(:yum_globalconfig, :create, resource_name) + end + + def delete_yum_globalconfig(resource_name) + ChefSpec::Matchers::ResourceMatcher.new(:yum_globalconfig, :delete, resource_name) + end +end diff --git a/chef/cookbooks/yum/metadata.json b/chef/cookbooks/yum/metadata.json new file mode 100644 index 0000000..45467df --- /dev/null +++ b/chef/cookbooks/yum/metadata.json @@ -0,0 +1,33 @@ +{ + "name": "yum", + "version": "3.0.6", + "description": "Configures various yum components on Red Hat-like systems", + "long_description": "yum Cookbook\n============\n\nThe Yum cookbook exposes the `yum_globalconfig` and `yum_repository`\nresources that allows a user to both control global behavior and make\nindividual Yum repositories available for use. These resources aim to\nallow the user to configure all options listed in the `yum.conf` man\npage, found at http://linux.die.net/man/5/yum.conf\n\nNOTES\n-----\nWARNING: Yum cookbook version 3.0.0 and above contain non-backwards\ncompatible breaking changes and will not work with cookbooks written\nagainst the 2.x and 1.x series. Changes have been made to the\nyum_repository resource, and the yum_key resource has been eliminated\nentirely. Recipes have been eliminated and moved into their own\ncookbooks. Please lock yum to the 2.x series in your Chef environments\nuntil all dependent cookbooks have been ported.\n\nRequirements\n------------\n* Chef 11 or higher\n* Ruby 1.9 (preferably from the Chef full-stack installer)\n* RHEL5, RHEL6, or other platforms within the family\n\nResources/Providers\n-------------------\n### yum_repository\nThis resource manages a yum repository configuration file at\n/etc/yum.repos.d/`repositoryid`.repo. When the file needs to be\nrepaired, it calls yum-makecache so packages in the repo become\navailable to the next resource.\n\n#### Example\n``` ruby\n# add the Zenoss repository\nyum_repository 'zenoss' do\n description \"Zenoss Stable repo\"\n baseurl \"http://dev.zenoss.com/yum/stable/\"\n gpgkey 'http://dev.zenoss.com/yum/RPM-GPG-KEY-zenoss'\n action :create\nend\n\n# add the EPEL repo\nyum_repository 'epel' do\n description 'Extra Packages for Enterprise Linux'\n mirrorlist 'http://mirrors.fedoraproject.org/mirrorlist?repo=epel-6&arch=$basearch'\n gpgkey 'http://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-6'\n action :create\nend\n```\n\n``` ruby\n# delete CentOS-Media repo\nyum_repository 'CentOS-Media' do\n action :delete\nend\n```\n\n#### Actions\n- `:create` - creates a repository file and builds the repository listing\n- `:delete` - deletes the repository file\n\n#### Parameters\n* `baseurl` - Must be a URL to the directory where the yum repository's\n 'repodata' directory lives. Can be an http://, ftp:// or file://\n URL. You can specify multiple URLs in one baseurl statement.\n* `cost` - relative cost of accessing this repository. Useful for\n weighing one repo's packages as greater/less than any other.\n defaults to 1000\n* `description` - Maps to the 'name' parameter in a repository .conf.\n Descriptive name for the repository channel. This directive must be\n specified.\n* `enabled` - Either `true` or `false`. This tells yum whether or not use this repository.\n* `enablegroups` - Either `true` or `false`. Determines whether yum\n will allow the use of package groups for this repository. Default is\n `true` (package groups are allowed).\n* `exclude` - List of packages to exclude from updates or installs. This\n should be a space separated list in a single string. Shell globs using wildcards (eg. *\n and ?) are allowed.\n* `failovermethod` - Either 'roundrobin' or 'priority'.\n* `fastestmirror_enabled` - Either `true` or `false`\n* `gpgcheck` - Either `true` or `false`. This tells yum whether or not\n it should perform a GPG signature check on packages. When this is\n set in the [main] section it sets the default for all repositories.\n The default is `true`.\n* `gpgkey` - A URL pointing to the ASCII-armored GPG key file for the\n repository. This option is used if yum needs a public key to verify\n a package and the required key hasn't been imported into the RPM\n database. If this option is set, yum will automatically import the\n key from the specified URL.\n* `http_caching` - Either 'all', 'packages', or 'none'. Determines how\n upstream HTTP caches are instructed to handle any HTTP downloads\n that Yum does. Defaults to 'all'\n* `includepkgs` - Inverse of exclude. This is a list of packages you\n want to use from a repository. If this option lists only one package\n then that is all yum will ever see from the repository. Defaults to\n an empty list.\n* `keepalive` - Either `true` or `false`. This tells yum whether or not\n HTTP/1.1 keepalive should be used with this repository. \n* `max_retries` - Set the number of times any attempt to retrieve a file\n should retry before returning an error. Setting this to '0' makes\n yum try forever. Default is '10'.\n* `metadata_expire` - Time (in seconds) after which the metadata will\n expire. So that if the current metadata downloaded is less than this\n many seconds old then yum will not update the metadata against the\n repository. If you find that yum is not downloading information on\n updates as often as you would like lower the value of this option.\n You can also change from the default of using seconds to using days,\n hours or minutes by appending a d, h or m respectively. The default\n is 6 hours, to compliment yum-updatesd running once an hour. It's\n also possible to use the word \"never\", meaning that the metadata\n will never expire. Note that when using a metalink file the metalink\n must always be newer than the metadata for the repository, due to\n the validation, so this timeout also applies to the metalink file.\n* `mirrorlist` - Specifies a URL to a file containing a list of\n baseurls. This can be used instead of or with the baseurl option.\n Substitution variables, described below, can be used with this\n option. As a special hack is the mirrorlist URL contains the word\n \"metalink\" then the value of mirrorlist is copied to metalink (if\n metalink is not set)\n* `mirror_expire` - Time (in seconds) after which the mirrorlist locally\n cached will expire. If the current mirrorlist is less than this many\n seconds old then yum will not download another copy of the\n mirrorlist, it has the same extra format as metadata_expire. If you\n find that yum is not downloading the mirrorlists as often as you\n would like lower the value of this option.\n* `mirrorlist_expire` - alias for mirror_expire\n* `priority` - When the yum-priorities plug-in is enabled, you set\n priorities on repository entries, where N is an integer from 1 to 99. The\n default priority for repositories is 99.\n* `proxy` - URL to the proxy server that yum should use.\n* `proxy_username` - username to use for proxy\n* `proxy_password` - password for this proxy\n* `report_instanceid` - Report instance ID when using Amazon Linux AMIs\n and repositories\n* `repositoryid` - Must be a unique name for each repository, one word.\n Defaults to name attribute.\n* `sslcacert` - Path to the directory containing the databases of the\n certificate authorities yum should use to verify SSL certificates.\n Defaults to none - uses system default\n* `sslclientcert` - Path to the SSL client certificate yum should use to\n connect to repos/remote sites Defaults to none. \n* `sslclientkey` - Path to the SSL client key yum should use to connect\n to repos/remote sites Defaults to none.\n* `sslverify` - Either `true` or `false`. Determines if yum will verify SSL certificates/hosts. Defaults to `true`\n* `timeout` - Number of seconds to wait for a connection before timing\n out. Defaults to 30 seconds. This may be too short of a time for\n extremely overloaded sites.\n\n### yum_globalconfig\nThis renders a template with global yum configuration parameters. The\ndefault recipe uses it to render `/etc/yum.conf`. It is flexible\nenough to be used in other scenarios, such as building RPMs in\nisolation by modifying `installroot`. \n\n#### Example\n``` ruby\nyum_globalconfig '/my/chroot/etc/yum.conf' do\n cachedir '/my/chroot/etc/yum.conf'\n keepcache 'yes'\n debuglevel '2'\n installroot '/my/chroot'\n action :create\nend\n```\n\n#### Parameters\n`yum_globalconfig` can take most of the same parameters as a\n`yum_repository`, plus more, too numerous to describe here. Below are\na few of the more commonly used ones. For a complete list, please\nconsult the `yum.conf` man page, found here:\nhttp://linux.die.net/man/5/yum.conf\n\n* `cachedir` - Directory where yum should store its cache and db\n files. The default is '/var/cache/yum'. \n* `keepcache` - Either `true` or `false`. Determines whether or not\n yum keeps the cache of headers and packages after successful\n installation. Default is `true` (keep files)\n* `debuglevel` - Debug message output level. Practical range is 0-10.\n Default is '2'. \n* `exclude` - List of packages to exclude from updates or installs.\n This should be a space separated list. Shell globs using wildcards\n (eg. * and ?) are allowed. \n* `installonlypkgs` = List of package provides that should only ever\n be installed, never updated. Kernels in particular fall into this\n category. Defaults to kernel, kernel-bigmem, kernel-enterprise,\n kernel-smp, kernel-debug, kernel-unsupported, kernel-source,\n kernel-devel, kernel-PAE, kernel-PAE-debug.\n* `logfile` - Full directory and file name for where yum should write\n its log file.\n* `exactarch` - Either `true` or `false`. Set to `true` to make 'yum update' only\n update the architectures of packages that you have installed. ie:\n with this enabled yum will not install an i686 package to update an\n x86_64 package. Default is `true`\n* `gpgcheck` - Either `true` or `false`. This tells yum whether or not\n it should perform a GPG signature check on the packages gotten from\n this repository.\n \nRecipes\n-------\n* `default` - Configures `yum_globalconfig[/etc/yum.conf]` with values\n found in node attributes at `node['yum']['main']`\n\nAttributes\n----------\nThe following attributes are set by default\n\n``` ruby\ndefault['yum']['main']['cachedir'] = '/var/cache/yum/$basearch/$releasever'\ndefault['yum']['main']['keepcache'] = false\ndefault['yum']['main']['debuglevel'] = nil\ndefault['yum']['main']['exclude'] = nil\ndefault['yum']['main']['logfile'] = '/var/log/yum.log'\ndefault['yum']['main']['exactarch'] = nil\ndefault['yum']['main']['obsoletes'] = nil\ndefault['yum']['main']['installonly_limit'] = nil\ndefault['yum']['main']['installonlypkgs'] = nil\ndefault['yum']['main']['installroot'] = nil\n```\n\nRelated Cookbooks\n-----------------\nRecipes from older versions of this cookbook have been moved\nindividual cookbooks. Recipes for managing platform yum configurations\nand installing specific repositories can be found in one (or more!) of\nthe following cookbook.\n\n* yum-centos\n* yum-fedora\n* yum-amazon\n* yum-epel\n* yum-elrepo\n* yum-repoforge\n* yum-ius\n* yum-percona\n* yum-pgdg\n\nUsage\n-----\nPut `depends 'yum'` in your metadata.rb to gain access to the\nyum_repository resource.\n\nLicense & Authors\n-----------------\n- Author:: Eric G. Wolfe\n- Author:: Matt Ray ()\n- Author:: Joshua Timberman ()\n- Author:: Sean OMeara ()\n\n```text\nCopyright:: 2011 Eric G. Wolfe\nCopyright:: 2013 Chef\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n```\n", + "maintainer": "Chef", + "maintainer_email": "cookbooks@getchef.com", + "license": "Apache 2.0", + "platforms": { + "redhat": ">= 0.0.0", + "centos": ">= 0.0.0", + "amazon": ">= 0.0.0", + "fedora": ">= 0.0.0" + }, + "dependencies": { + }, + "recommendations": { + }, + "suggestions": { + }, + "conflicting": { + }, + "providing": { + }, + "replacing": { + }, + "attributes": { + }, + "groupings": { + }, + "recipes": { + } +} \ No newline at end of file diff --git a/chef/cookbooks/yum/providers/globalconfig.rb b/chef/cookbooks/yum/providers/globalconfig.rb new file mode 100644 index 0000000..84354e1 --- /dev/null +++ b/chef/cookbooks/yum/providers/globalconfig.rb @@ -0,0 +1,37 @@ +# +# Cookbook Name:: yum +# Provider:: repository +# +# Author:: Sean OMeara +# Copyright 2013, Chef +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# Allow for Chef 10 support +use_inline_resources if defined?(use_inline_resources) + +action :create do + template new_resource.path do + source 'main.erb' + cookbook 'yum' + mode '0644' + variables(:config => new_resource) + end +end + +action :delete do + file new_resource.path do + action :delete + end +end diff --git a/chef/cookbooks/yum/resources/globalconfig.rb b/chef/cookbooks/yum/resources/globalconfig.rb new file mode 100644 index 0000000..6a909ef --- /dev/null +++ b/chef/cookbooks/yum/resources/globalconfig.rb @@ -0,0 +1,104 @@ +# +# Cookbook Name:: yum +# Resource:: repository +# +# Author:: Sean OMeara +# Copyright 2013, Chef +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +actions :create, :delete + +default_action :create + +# http://linux.die.net/man/5/yum.conf +attribute :alwaysprompt, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :assumeyes, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :bandwidth, :kind_of => String, :regex => /^\d+/, :default => nil +attribute :bugtracker_url, :kind_of => String, :regex => /.*/, :default => nil +attribute :clean_requirements_on_remove, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :cachedir, :kind_of => String, :regex => /.*/, :default => '/var/cache/yum/$basearch/$releasever' +attribute :color, :kind_of => String, :equal_to => %w{ always never }, :default => nil +attribute :color_list_available_downgrade, :kind_of => String, :regex => /.*/, :default => nil +attribute :color_list_available_install, :kind_of => String, :regex => /.*/, :default => nil +attribute :color_list_available_reinstall, :kind_of => String, :regex => /.*/, :default => nil +attribute :color_list_available_upgrade, :kind_of => String, :regex => /.*/, :default => nil +attribute :color_list_installed_extra, :kind_of => String, :regex => /.*/, :default => nil +attribute :color_list_installed_newer, :kind_of => String, :regex => /.*/, :default => nil +attribute :color_list_installed_older, :kind_of => String, :regex => /.*/, :default => nil +attribute :color_list_installed_reinstall, :kind_of => String, :regex => /.*/, :default => nil +attribute :color_search_match, :kind_of => String, :regex => /.*/, :default => nil +attribute :color_update_installed, :kind_of => String, :regex => /.*/, :default => nil +attribute :color_update_local, :kind_of => String, :regex => /.*/, :default => nil +attribute :color_update_remote, :kind_of => String, :regex => /.*/, :default => nil +attribute :commands, :kind_of => String, :regex => /.*/, :default => nil +attribute :debuglevel, :kind_of => String, :regex => /^\d+$/, :default => '2' +attribute :diskspacecheck, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :distroverpkg, :kind_of => String, :regex => /.*/, :default => nil +attribute :enable_group_conditionals, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :errorlevel, :kind_of => String, :regex => /^\d+$/, :default => nil +attribute :exactarch, :kind_of => [TrueClass, FalseClass], :default => true +attribute :exclude, :kind_of => String, :regex => /.*/, :default => nil +attribute :gpgcheck, :kind_of => [TrueClass, FalseClass], :default => true +attribute :group_package_types, :kind_of => String, :regex => /.*/, :default => nil +attribute :groupremove_leaf_only, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :history_list_view, :kind_of => String, :equal_to => %w{ users commands single-user-commands }, :default => nil +attribute :history_record, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :history_record_packages, :kind_of => String, :regex => /.*/, :default => nil +attribute :http_caching, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :installonly_limit, :kind_of => String, :regex => [/^\d+/, /keep/], :default => '3' +attribute :installonlypkgs, :kind_of => String, :regex => /.*/, :default => nil +attribute :installroot, :kind_of => String, :regex => /.*/, :default => nil +attribute :keepalive, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :keepcache, :kind_of => [TrueClass, FalseClass], :default => false +attribute :kernelpkgnames, :kind_of => String, :regex => /.*/, :default => nil +attribute :localpkg_gpgcheck, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :logfile, :kind_of => String, :regex => /.*/, :default => '/var/log/yum.log' +attribute :max_retries, :kind_of => String, :regex => /^\d+$/, :default => nil +attribute :mdpolicy, :kind_of => String, :equal_to => %w{ instant group:primary group:small group:main group:all }, :default => nil +attribute :metadata_expire, :kind_of => String, :regex => /^\d+$/, :default => nil +attribute :mirrorlist_expire, :kind_of => String, :regex => /^\d+$/, :default => nil +attribute :multilib_policy, :kind_of => String, :equal_to => %w{ all best }, :default => nil +attribute :obsoletes, :kind_of => [TrueClass, FalseClass], :default => '1' +attribute :overwrite_groups, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :password, :kind_of => String, :regex => /.*/, :default => nil +attribute :path, :kind_of => String, :regex => /.*/, :default => nil, :name_attribute => true +attribute :persistdir, :kind_of => String, :regex => /.*/, :default => nil +attribute :pluginconfpath, :kind_of => String, :regex => /.*/, :default => nil +attribute :pluginpath, :kind_of => String, :regex => /.*/, :default => nil +attribute :plugins, :kind_of => [TrueClass, FalseClass], :default => '1' +attribute :protected_multilib, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :protected_packages, :kind_of => String, :regex => /.*/, :default => nil +attribute :proxy, :kind_of => String, :regex => /.*/, :default => nil +attribute :proxy_password, :kind_of => String, :regex => /.*/, :default => nil +attribute :proxy_username, :kind_of => String, :regex => /.*/, :default => nil +attribute :recent, :kind_of => String, :regex => /^\d+$/, :default => nil +attribute :repo_gpgcheck, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :reset_nice, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :rpmverbosity, :kind_of => String, :equal_to => %w{ info critical emergency error warn debug }, :default => nil +attribute :showdupesfromrepos, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :skip_broken, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :ssl_check_cert_permissions, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :sslcacert, :kind_of => String, :regex => /.*/, :default => nil +attribute :sslclientcert, :kind_of => String, :regex => /.*/, :default => nil +attribute :sslclientkey, :kind_of => String, :regex => /.*/, :default => nil +attribute :sslverify, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :syslog_device, :kind_of => String, :regex => /.*/, :default => nil +attribute :syslog_facility, :kind_of => String, :regex => /.*/, :default => nil +attribute :syslog_ident, :kind_of => String, :regex => /.*/, :default => nil +attribute :throttle, :kind_of => String, :regex => [/\d+k/, /\d+M/, /\d+G/], :default => nil +attribute :timeout, :kind_of => String, :regex => /^\d+$/, :default => nil +attribute :tolerant, :kind_of => [TrueClass, FalseClass], :default => nil +attribute :tsflags, :kind_of => String, :regex => /.*/, :default => nil +attribute :username, :kind_of => String, :regex => /.*/, :default => nil diff --git a/chef/cookbooks/yum/templates/default/main.erb b/chef/cookbooks/yum/templates/default/main.erb new file mode 100644 index 0000000..c948228 --- /dev/null +++ b/chef/cookbooks/yum/templates/default/main.erb @@ -0,0 +1,248 @@ +# This file was generated by Chef for <%= node.name %> +# Do NOT modify this file by hand. + +[main] +<% if @config.alwaysprompt %> +alwaysprompt=<%= @config.alwaysprompt %> +<% end %> +<% if @config.assumeyes %> +assumeyes=<%= @config.assumeyes %> +<% end %> +<% if @config.bandwidth %> +bandwidth=<%= @config.bandwidth %> +<% end %> +<% if @config.bugtracker_url %> +bugtracker_url=<%= @config.bugtracker_url %> +<% end %> +<% if @config.cachedir %> +cachedir=<%= @config.cachedir %> +<% end %> +<% if @config.clean_requirements_on_remove %> +clean_requirements_on_remove=<%= @config.clean_requirements_on_remove %> +<% end %> +<% if @config.color %> +color=<%= @config.color %> +<% end %> +<% if @config.color_list_available_downgrade %> +color_list_available_downgrade=<%= @config.color_list_available_downgrade %> +<% end %> +<% if @config.color_list_available_install %> +color_list_available_install=<%= @config.color_list_available_install %> +<% end %> +<% if @config.color_list_available_reinstall %> +color_list_available_reinstall=<%= @config.color_list_available_reinstall %> +<% end %> +<% if @config.color_list_available_upgrade %> +color_list_available_upgrade=<%= @config.color_list_available_upgrade %> +<% end %> +<% if @config.color_list_installed_extra %> +color_list_installed_extra=<%= @config.color_list_installed_extra %> +<% end %> +<% if @config.color_list_installed_newer %> +color_list_installed_newer=<%= @config.color_list_installed_newer %> +<% end %> +<% if @config.color_list_installed_older %> +color_list_installed_older=<%= @config.color_list_installed_older %> +<% end %> +<% if @config.color_list_installed_reinstall %> +color_list_installed_reinstall=<%= @config.color_list_installed_reinstall %> +<% end %> +<% if @config.color_search_match %> +color_search_match=<%= @config.color_search_match %> +<% end %> +<% if @config.color_update_installed %> +color_update_installed=<%= @config.color_update_installed %> +<% end %> +<% if @config.color_update_local %> +color_update_local=<%= @config.color_update_local %> +<% end %> +<% if @config.color_update_remote %> +color_update_remote=<%= @config.color_update_remote %> +<% end %> +<% if @config.commands %> +commands=<%= @config.commands %> +<% end %> +<% if @config.debuglevel %> +debuglevel=<%= @config.debuglevel %> +<% end %> +<% if @config.diskspacecheck %> +diskspacecheck=<%= @config.diskspacecheck %> +<% end %> +<% if @config.distroverpkg %> +distroverpkg=<%= @config.distroverpkg %> +<% end %> +<% if @config.enable_group_conditionals %> +enable_group_conditionals=1 +<% end %> +<% if @config.errorlevel %> +errorlevel=<%= @config.errorlevel %> +<% end %> +<% if @config.exactarch %> +exactarch=1 +<% else %> +exactarch=0 +<% end %> +<% if @config.exclude %> +exclude=<%= @config.exclude %> +<% end %> +<% if @config.gpgcheck %> +gpgcheck=1 +<% else %> +gpgcheck=0 +<% end %> +<% if @config.group_package_types %> +group_package_types=<%= @config.group_package_types %> +<% end %> +<% if @config.groupremove_leaf_only %> +groupremove_leaf_only=<%= @config.groupremove_leaf_only %> +<% end %> +<% if @config.history_list_view %> +history_list_view=<%= @config.history_list_view %> +<% end %> +<% if @config.history_record %> +history_record=<%= @config.history_record %> +<% end %> +<% if @config.history_record_packages %> +history_record_packages=<%= @config.history_record_packages %> +<% end %> +<% if @config.http_caching %> +http_caching=<%= @config.http_caching %> +<% end %> +<% if @config.installonly_limit %> +installonly_limit=<%= @config.installonly_limit %> +<% end %> +<% if @config.installonlypkgs %> +installonlypkgs=<%= @config.installonlypkgs %> +<% end %> +<% if @config.installroot %> +installroot=<%= @config.installroot %> +<% end %> +<% if @config.keepalive %> +keepalive=<%= @config.keepalive %> +<% end %> +<% if @config.keepcache %> +keepcache=1 +<% else %> +keepcache=0 +<% end %> +<% if @config.kernelpkgnames %> +kernelpkgnames=<%= @config.kernelpkgnames %> +<% end %> +<% if @config.localpkg_gpgcheck %> +localpkg_gpgcheck=<%= @config.localpkg_gpgcheck %> +<% end %> +<% if @config.logfile %> +logfile=<%= @config.logfile %> +<% end %> +<% if @config.max_retries %> +max_retries=<%= @config.max_retries %> +<% end %> +<% if @config.mdpolicy %> +mdpolicy=<%= @config.mdpolicy %> +<% end %> +<% if @config.metadata_expire %> +metadata_expire=<%= @config.metadata_expire %> +<% end %> +<% if @config.mirrorlist_expire %> +mirrorlist_expire=<%= @config.mirrorlist_expire %> +<% end %> +<% if @config.multilib_policy %> +multilib_policy=<%= @config.multilib_policy %> +<% end %> +<% if @config.obsoletes %> +obsoletes=1 +<% else %> +obsoletes=0 +<% end %> +<% if @config.overwrite_groups %> +overwrite_groups=<%= @config.overwrite_groups %> +<% end %> +<% if @config.password %> +password=<%= @config.password %> +<% end %> +<% if @config.persistdir %> +persistdir=<%= @config.persistdir %> +<% end %> +<% if @config.pluginconfpath %> +pluginconfpath=<%= @config.pluginconfpath %> +<% end %> +<% if @config.pluginpath %> +pluginpath=<%= @config.pluginpath %> +<% end %> +<% if @config.plugins %> +plugins=1 +<% else %> +plugins=0 +<% end %> +<% if @config.protected_multilib %> +protected_multilib=<%= @config.protected_multilib %> +<% end %> +<% if @config.protected_packages %> +protected_packages=<%= @config.protected_packages %> +<% end %> +<% if @config.proxy %> +proxy=<%= @config.proxy %> +<% end %> +<% if @config.proxy_password %> +proxy_password=<%= @config.proxy_password %> +<% end %> +<% if @config.proxy_username %> +proxy_username=<%= @config.proxy_username %> +<% end %> +<% if @config.recent %> +recent=<%= @config.recent %> +<% end %> +<% if @config.repo_gpgcheck %> +repo_gpgcheck=<%= @config.repo_gpgcheck %> +<% end %> +<% if @config.reset_nice %> +reset_nice=<%= @config.reset_nice %> +<% end %> +<% if @config.rpmverbosity %> +rpmverbosity=<%= @config.rpmverbosity %> +<% end %> +<% if @config.showdupesfromrepos %> +showdupesfromrepos=<%= @config.showdupesfromrepos %> +<% end %> +<% if @config.skip_broken %> +skip_broken=<%= @config.skip_broken %> +<% end %> +<% if @config.ssl_check_cert_permissions %> +ssl_check_cert_permissions=<%= @config.ssl_check_cert_permissions %> +<% end %> +<% if @config.sslcacert %> +sslcacert=<%= @config.sslcacert %> +<% end %> +<% if @config.sslclientcert %> +sslclientcert=<%= @config.sslclientcert %> +<% end %> +<% if @config.sslclientkey %> +sslclientkey=<%= @config.sslclientkey %> +<% end %> +<% if @config.sslverify %> +sslverify=<%= @config.sslverify %> +<% end %> +<% if @config.syslog_device %> +syslog_device=<%= @config.syslog_device %> +<% end %> +<% if @config.syslog_facility %> +syslog_facility=<%= @config.syslog_facility %> +<% end %> +<% if @config.syslog_ident %> +syslog_ident=<%= @config.syslog_ident %> +<% end %> +<% if @config.throttle %> +throttle=<%= @config.throttle %> +<% end %> +<% if @config.timeout %> +timeout=<%= @config.timeout %> +<% end %> +<% if @config.tolerant %> +tolerant=<%= @config.tolerant %> +<% end %> +<% if @config.tsflags %> +tsflags=<%= @config.tsflags %> +<% end %> +<% if @config.username %> +username=<%= @config.username %> +<% end %> diff --git a/chef/roles/os-single-controller.rb b/chef/roles/os-single-controller.rb index b133e4e..88ad74f 100644 --- a/chef/roles/os-single-controller.rb +++ b/chef/roles/os-single-controller.rb @@ -2,10 +2,10 @@ name "os-single-controller" description "Roll-up role for all of the OpenStack Compute services on a single, non-HA controller." run_list( "role[os-base]", -# "role[os-ops-database]", -# "role[os-ops-messaging]", + "role[os-ops-database]", + "role[os-ops-messaging]", "role[os-identity]", -# "role[os-image]", + "role[os-image]", "role[os-network-server]", "role[os-block-storage]", "role[os-compute-scheduler]",