18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
|
# File 'manifests/server/host/base.pp', line 18
class ipa::server::host::base {
include ipa::server
include ipa::vardir
#$vardir = $::ipa::vardir::module_vardir # with trailing slash
$vardir = regsubst($::ipa::vardir::module_vardir, '\/$', '')
# we don't want to purge the freeipa entry, so we need to exclude it...
$valid_hostname = $ipa::server::valid_hostname
$valid_domain = $ipa::server::valid_domain
$host_always_ignore = ["${valid_hostname}.${valid_domain}"]
$host_excludes = $ipa::server::host_excludes
$valid_host_excludes = type($host_excludes) ? {
'string' => [$host_excludes],
'array' => $host_excludes,
'boolean' => $host_excludes ? {
# TODO: there's probably a better fqdn match expression
# this is an expression to prevent all fqdn deletion...
#true => ['^[a-zA-Z0-9\.\-]*$'],
true => ['^[[:alpha:]]{1}[[:alnum:]-.]*$'],
default => false,
},
default => false, # trigger error...
}
if type($valid_host_excludes) != 'array' {
fail('The $host_excludes must be an array.')
}
# directory of system tags which should exist (as managed by puppet)
file { "${vardir}/hosts/":
ensure => directory, # make sure this is a directory
recurse => true, # recursively manage directory
purge => true, # purge all unmanaged files
force => true, # also purge subdirs and links
owner => root, group => nobody, mode => 600, backup => false,
notify => Exec['ipa-clean-hosts'],
require => File["${vardir}/"],
}
# these are template variables for the clean.sh.erb script
$id_dir = 'hosts'
$ls_cmd = '/usr/bin/ipa host-find --pkey-only --raw | /usr/bin/tr -d " " | /bin/grep "^fqdn:" | /bin/cut -b 6-' # show ipa hosts
# TODO: i don't understand all the implications of the --updatedns arg!
# we should probably change the dns arg based on if dns is on or not...
$rm_cmd = $dns ? { # delete ipa hosts
true => '/usr/bin/ipa host-del --updatedns ',
default => '/usr/bin/ipa host-del ',
}
$fs_chr = ' '
$suffix = '.host'
$regexp = $valid_host_excludes
$ignore = $host_always_ignore
# build the clean script
file { "${vardir}/clean-hosts.sh":
content => template('ipa/clean.sh.erb'),
owner => root,
group => nobody,
mode => 700, # u=rwx
backup => false, # don't backup to filebucket
ensure => present,
require => File["${vardir}/"],
}
# run the cleanup
exec { "${vardir}/clean-hosts.sh":
logoutput => on_failure,
refreshonly => true,
require => [
Exec['ipa-server-kinit'],
File["${vardir}/clean-hosts.sh"],
],
alias => 'ipa-clean-hosts',
}
# NOTE: it doesn't cause a problem that this dir is inside the hosts dir
file { "${vardir}/hosts/passwords/":
ensure => directory, # make sure this is a directory
recurse => true, # recursively manage directory
purge => true, # purge all unmanaged files
force => true, # also purge subdirs and links
owner => root, group => nobody, mode => 600, backup => false,
require => File["${vardir}/hosts/"],
}
file { "${vardir}/hosts/sshpubkeys/":
ensure => directory, # make sure this is a directory
recurse => true, # recursively manage directory
purge => true, # purge all unmanaged files
force => true, # also purge subdirs and links
owner => root, group => nobody, mode => 600, backup => false,
require => File["${vardir}/hosts/"],
}
}
|