18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
# File 'manifests/server/service/base.pp', line 18
class ipa::server::service::base {
include ipa::server
include ipa::vardir
#$vardir = $::ipa::vardir::module_vardir # with trailing slash
$vardir = regsubst($::ipa::vardir::module_vardir, '\/$', '')
# by default, the following services get installed with freeipa:
# DNS/ipa.example.com@EXAMPLE.COM
# dogtagldap/ipa.example.com@EXAMPLE.COM
# HTTP/ipa.example.com@EXAMPLE.COM
# ldap/ipa.example.com@EXAMPLE.COM
# since we don't want to purge them, we need to exclude them...
$prefix = ['DNS', 'dogtagldap', 'HTTP', 'ldap']
$valid_hostname = $ipa::server::valid_hostname
$valid_domain = $ipa::server::valid_domain
$valid_realm = $ipa::server::valid_realm
$append = "/${valid_hostname}.${valid_domain}@${valid_realm}"
$service_always_ignore = suffix($prefix, $append)
$service_excludes = $ipa::server::service_excludes
$valid_service_excludes = type($service_excludes) ? {
'string' => [$service_excludes],
'array' => $service_excludes,
'boolean' => $service_excludes ? {
# TODO: there's probably a better fqdn match expression
# this is an expression to prevent all fqdn deletion...
#true => ['^[a-zA-Z0-9\.\-]*$'],
true => ['^[[:alpha:]]{1}[[:alnum:]-.]*$'],
default => false,
},
default => false, # trigger error...
}
if type($valid_service_excludes) != 'array' {
fail('The $service_excludes must be an array.')
}
# directory of system tags which should exist (as managed by puppet)
file { "${vardir}/services/":
ensure => directory, # make sure this is a directory
recurse => true, # recursively manage directory
purge => true, # purge all unmanaged files
force => true, # also purge subdirs and links
owner => root, group => nobody, mode => 600, backup => false,
notify => Exec['ipa-clean-services'],
require => File["${vardir}/"],
}
# these are template variables for the clean.sh.erb script
$id_dir = 'services'
$ls_cmd = '/usr/bin/ipa service-find --pkey-only --raw | /usr/bin/tr -d " " | /bin/grep "^krbprincipalname:" | /bin/cut -b 18-' # show ipa services
$rm_cmd = '/usr/bin/ipa service-del ' # delete ipa services
$fs_chr = ' '
$suffix = '.service'
$regexp = $valid_service_excludes
$ignore = $service_always_ignore
# build the clean script
file { "${vardir}/clean-services.sh":
content => template('ipa/clean.sh.erb'),
owner => root,
group => nobody,
mode => 700, # u=rwx
backup => false, # don't backup to filebucket
ensure => present,
require => File["${vardir}/"],
}
# run the cleanup
exec { "${vardir}/clean-services.sh":
logoutput => on_failure,
refreshonly => true,
require => [
Exec['ipa-server-kinit'],
File["${vardir}/clean-services.sh"],
],
alias => 'ipa-clean-services',
}
}
|