puppet/data/ubuntu/1604.yaml

---
classes:
  - apt
  - apt::update
  - base
  - git_asf
  - orthrus
  - postfix::server
  - python
  - subversionclient
  - unattended_upgrades

base::basepackages:
  - apt-transport-https
  - apt-file
  - bash
  - bc
  - ca-certificates
  - htop
  - iotop
  - libnet-snmp-perl
  - libpam-cap
  - libpam-systemd
  - libsnmp-perl
  - nload
  - screen
  - sockstat
  - software-properties-common
  - tcsh
  - zsh

base::purgedpackages:
  - 'collectd'
  - 'collectd-core'

apache::mod::geoip::enable: true
apache::mod::geoip::flag: 'MemoryCache'
apache::mod::geoip::db_file:
 - '/usr/share/GeoIP/GeoIP.dat'
 - '/usr/share/GeoIP/GeoIPCity.dat'

apache::mod::ssl::ssl_cipher: 'HIGH:MEDIUM:!aNULL:!MD5:!RC4'

apache::log_formats:
  combined: '<%%JSON:httpd_access%%> {
    \"time\": \"%%{HIERA}{%Y-%m-%dT%H:%M:%S%z}t\",
    \"clientip\": \"%a\",
    \"duration\": %D,
    \"status\": %>s,
    \"request\": \"%U%q\",
    \"uri\": \"%U\",
    \"remote_user\": \"%u\",
    \"query_string\": \"%q\",
    \"document\": \"%f\",
    \"bytes\": %B,
    \"request_method\": \"%m\",
    \"referer\": \"%%{HIERA}{Referer}i\",
    \"useragent\": \"%%{HIERA}{User-agent}i\",
    \"vhost\": \"%%{HIERA}{Host}i\",
    \"geo_country\": \"%%{HIERA}{GEOIP_COUNTRY_CODE}n\",
    \"geo_long\": \"%%{HIERA}{GEOIP_LONGITUDE}n\",
    \"geo_lat\": \"%%{HIERA}{GEOIP_LATITUDE}n\",
    \"geo_coords\": \"%%{HIERA}{GEOIP_LATITUDE}n,%%{HIERA}{GEOIP_LONGITUDE}n\",
    \"geo_city\": \"%%{HIERA}{GEOIP_CITY}n\",
    \"geo_combo\": \"%%{HIERA}{GEOIP_CITY}n, %%{HIERA}{GEOIP_COUNTRY_NAME}n\"
    }'

apache::trace_enable: Off

apt::sources:
  'asf_internal':
    location: 'https://packages.apache.org/asf_internal'
    release: 'xenial'
    repos: 'main'
    key:
      id: '390EF70BB1EA12B2773962950EE62FB37A00258D'
      server: 'pool.sks-keyservers.net'
    include:
      deb: true
      src: false
    notify_update: true
  'elasticsearch':
    location: 'https://packages.elastic.co/elasticsearch/2.x/debian'
    release: 'stable'
    repos: 'main'
    key:
      id: '46095ACC8548582C1A2699A9D27D666CD88E42B4'
      server: 'pool.sks-keyservers.net'
    include:
      deb: true
      src: false
    ensure: absent
  'elasticsearch-2.x':
    location: 'https://packages.elastic.co/elasticsearch/2.x/debian'
    release: 'stable'
    repos: 'main'
    key:
      id: '46095ACC8548582C1A2699A9D27D666CD88E42B4'
      server: 'pool.sks-keyservers.net'
    include:
      deb: true
      src: false
  'elasticsearch-5.x':
    location: 'https://artifacts.elastic.co/packages/5.x/apt'
    release: 'stable'
    repos: 'main'
    key:
      id: '46095ACC8548582C1A2699A9D27D666CD88E42B4'
      server: 'pool.sks-keyservers.net'
    include:
      deb: true
      src: false
  'docker-engine':
    location: 'https://apt.dockerproject.org/repo'
    release: 'ubuntu-xenial'
    repos: 'main'
    key:
      id: '58118E89F3A912897C070ADBF76221572C52609D'
      server: 'pool.sks-keyservers.net'
    include:
      deb: true
      src: false

apt::force:
  'orthrus':
    release: 'main'
    require: Apt::Source['asf_internal']

unattended_upgrades::update: 1
unattended_upgrades::download: 1
unattended_upgrades::upgrade: 1
unattended_upgrades::autoclean: 7
unattended_upgrades::origins:
  - '${distro_id} ${distro_codename}-security'
  - '${distro_id} ${distro_codename}-updates'

apt::always_apt_update: true

base::remove_os_install_user::osinstalluser:  'ubuntu'
base::remove_os_install_user::osinstallgroup: 'ubuntu'

fail2ban::service_status: true

fail2ban_asf::config::filters:
  sshd-asf999:
    filtername: 'sshd-asf999'
    filtersource: 'puppet:///modules/fail2ban_asf/fail2ban/conf/filter.d/sshd-asf999.conf'

fail2ban_asf::config::actions:
  asf999-log:
    actionname: 'asf999-log'
    actionsource: 'puppet:///modules/fail2ban_asf/fail2ban/conf/action.d/asf999-log.conf'

fail2ban_asf::config::jails:
  ssh:
    filter: sshd
    port: ssh
    action:
      - iptables-allports
    logpath: /var/log/auth.log
    findtime: 1800
    maxretry: 5
    enable: true

  ssh-ddos:
    filter: sshd-ddos
    action:
      - iptables-allports
    logpath: '/var/log/auth.log'
    maxretry: 6
    enable: true

  asf999:
    filter: 'sshd-asf999'
    action:
      - 'asf999-log[name=asf999, dest=root@apache.org, sender=fail2ban@apache.org]'
    logpath: '/var/log/auth.log'
    maxretry: 1
    bantime: 2
    enable: true

ldapclient::install::ubuntu::1604::tlscertpath:  '/etc/ldap/cacerts/ldap-client.pem'
ldapclient::install::ubuntu::1604::pamhostcheck: 'yes'

ldapclient::ldapclient_packages:
    - ldap-auth-client
    - ldap-utils
    - libldap-2.4-2
    - libpam-ldapd
    - libnss-ldapd
    - libpam-modules
    - nslcd

ldapclient::ldapclient_remove_packages:
    - nscd
    - libnss-ldap

ldapserver::install::ubuntu::1604::packages:
  - slapd
  - slapd-dbg

ntp::interfaces:
    - eth0
    - lo

postfix::server::myhostname:             "%{::fqdn}"
postfix::server::mydomain:               'apache.org'
postfix::server::mydestination:          "%{::fqdn}, localhost.%{::domain}, localhost"
postfix::server::inet_interfaces:        'localhost'
postfix::server::message_size_limit:     '15360000'
postfix::server::alias_maps:              'hash:/etc/aliases'
postfix::server::mail_name:              "ASF Mail Server at %{::fqdn}"
postfix::server::smtpd_sender_restrictions:
  -  'permit_mynetworks'
  -  'reject_unknown_sender_domain'
postfix::server::smtpd_recipient_restrictions:
  -  'permit_mynetworks'
  -  'reject_unauth_destination'
postfix::server::smtpd_tls_key_file:     '/etc/ssl/private/wildcard.apache.org.key'
postfix::server::smtpd_tls_cert_file:    '/etc/ssl/private/wildcard.apache.org-combined.crt'
postfix::server::ssl:                    'wildcard.apache.org'
postfix::server::submission:             'true'

puppet::puppetconf:                      '/etc/puppet/puppet.conf'

python::dev: true
python::pip: true
python::virtualenv: true

snmp:snmpd_options: '-Lsd -Lf /dev/null -u snmp -g snmp -p /var/run/snmpd.pid'

spamassassin::package_list:
  - spamassassin

spamassassin::spamc::haproxy_packagelist:
  - haproxy

spamassassin::sa_update: '/usr/bin/sa-update && /etc/init.d/spamassassin reload'

subversionclient::packages:
  - subversion
subversionclient::svn_conf_config:       '/etc/subversion/config'
subversionclient::svn_conf_servers:      '/etc/subversion/servers'

subversion_server::packages:
    - p7zip
    - python-svn
    - s3cmd
    - viewvc

ssh_asf::server_options:
    AuthorizedKeysCommandUser: 'root'

build_slaves::jenkins::jenkins_pub_key:  'AAAAB3NzaC1yc2EAAAABIwAAAIEAtxkcKDiPh1OaVzaVdc80daKq2sRy8aAgt8u2uEcLClzMrnv/g19db7XVggfT4+HPCqcbFbO3mtVnUnWWtuSEpDjqriWnEcSj2G1P53zsdKEu9qCGLmEFMgwcq8b5plv78PRdAQn09WCBI1QrNMypjxgCKhNNn45WqV4AD8Jp7/8='

build_slaves::jenkins::jenkins_packages:
  - asf-build-apache-ant-1.8.4
  - asf-build-apache-ant-1.9.4
  - asf-build-apache-ant-1.9.7
  - asf-build-apache-forrest-0.9
  - asf-build-apache-maven-2.2.1
  - asf-build-apache-maven-3.0.4
  - asf-build-apache-maven-3.0.5
  - asf-build-apache-maven-3.2.1
  - asf-build-apache-maven-3.2.5
  - asf-build-apache-maven-3.3.3
  - asf-build-apache-maven-3.3.9
  - asf-build-clover-ant-4.1.2
  - asf-build-findbugs-2.0.3
  - asf-build-findbugs-3.0.1
  - asf-build-ibm-java-x86-64-70
  - asf-build-ibm-java-x86-64-80
  - asf-build-j2sdk1.4.2-19
  - asf-build-jdk1.5.0-22-32
  - asf-build-jdk1.5.0-22-64
  - asf-build-jdk1.6.0-20-32-unlimited-security
  - asf-build-jdk1.6.0-45-64
  - asf-build-jdk1.7.0-79-unlimited-security
  - asf-build-jdk1.7.0-80
  - asf-build-jdk1.8.0-66-unlimited-security
  - asf-build-jdk1.8.0-92
  - asf-build-jdk1.8.0-102
  - asf-build-jdk9-ea-b128
  - asf-build-jdk9-ea-b132
  - asf-build-jdk9-ea-b139
  - asf-build-jigsaw-jdk9-ea-b142
  - asf-build-jira-cli-2.1.0

# Not all build slaves. This is just for Jenkins slaves.
build_slaves::distro_packages:
  - ant
  - asciidoc
  - autoconf
  - automake
  - bison
  - build-essential
  - cabal-install
  - cmake
  - cppcheck
  - curl
  - debhelper
  - devscripts
  - dh-make
  - emacs24-nox
  - erlang-base
  - erlang-dev
  - erlang-eunit
  - flex
  - g++
  - g++-4.8-multilib
  - g++-multilib
  - gcc-multilib
  - ghc
  - git-core
  - lib32ncurses5
  - lib32z1
  - libapr1-dev
  - libbit-vector-perl
  - libboost-dev
  - libboost-filesystem-dev
  - libboost-program-options-dev
  - libboost-system-dev
  - libboost-test-dev
  - libc6-dev-i386
  - libclass-accessor-class-perl
  - libcppunit-dev
  - libcurl4-openssl-dev
  - libevent-dev
  - libfuse-dev
  - libghc-binary-dev
  - libghc-hashable-dev
  - libghc-http-dev
  - libghc-network-dev
  - libghc-unordered-containers-dev
  - libghc-vector-dev
  - libglib2.0-dev
  - libjpeg8-dev
  - liblzo2-dev
  - liblua5.2-dev
  - libmono-system-web4.0-cil
  - libperl-dev
  - libqt4-dev
  - libsasl2-dev
  - libsnappy-dev
  - libssl-dev
  - libstdc++-4.8-dev
  - libsvn-dev
  - libswt-gtk-3-java
  - libswt-gtk-3-jni
  - libtool
  - libxml-xpath-perl
  - libz-dev
  - linux-headers-4.4.0-34
  - linux-headers-4.4.0-34-generic
  - linux-image-4.4.0-34-generic
  - linux-image-4.4.0-34-lowlatency
  - lua5.2
  - docker-engine
  - mingw-w64
  - binutils-mingw-w64
  - mingw-w64-tools
  - mingw-w64-common
  - mono-devel
  - mono-complete
  - nodejs
  - nsis
  - php-pear
  - php-dev
  - php7.0-cli
  - pkg-config
  - protobuf-compiler
  - python-all
  - python-all-dbg
  - python-all-dev
  - python-boto
  - python-setuptools
  - re2c
  - ruby
  - ruby-dev
  - sharutils
  - shellcheck
  - sloccount
  - swig
  - tmux
  - unzip
  - virtualenvwrapper
  - xvfb

buildbot_slave::buildbot::buildbot_packages:
  - asf-build-apache-ant-1.8.4
  - asf-build-apache-ant-1.9.4
  - asf-build-apache-ant-1.9.7
  - asf-build-apache-maven-2.2.1
  - asf-build-apache-maven-3.0.4
  - asf-build-apache-maven-3.0.5
  - asf-build-apache-maven-3.2.1
  - asf-build-apache-maven-3.2.5
  - asf-build-apache-maven-3.3.3
  - asf-build-apache-maven-3.3.9
  - asf-build-ibm-java-x86-64-80
  - asf-build-jdk1.5.0-22-32
  - asf-build-jdk1.5.0-22-64
  - asf-build-jdk1.6.0-45-64
  - asf-build-jdk1.7.0-64
  - asf-build-jdk1.7.0-79-unlimited-security
  - asf-build-jdk1.7.0-80
  - asf-build-jdk1.8.0
  - asf-build-jdk1.8.0-66-unlimited-security
  - asf-build-jdk1.8.0-92
  - asf-build-jdk1.8.0-102
  - asf-build-jdk9-ea-b132
  - asf-build-jdk9-ea-b139
  - asf-build-jigsaw-jdk9-ea-b142

buildbot_slave::bb_basepackages:
  - ant
  - apache2-dev
  - autoconf
  - automake
  - buildbot-slave
  - cmake
  - doxygen
  - junit4
  - libapr1
  - libapr1-dev
  - libaprutil1
  - libaprutil1-dev
  - libpam0g-dev
  - libserf-1-1
  - libserf-dev
  - libsqlite3-0
  - libsqlite3-dev
  - maven
  - pkg-config
  - python3-dev
  - python3-markdown
  - python3-pip
  - rake
  - ruby-dev
  - unzip
  - virtualenvwrapper
  - zip


logrotate::rule:
  apache2:
    name: 'apache2'
    path: '/var/log/apache2/*.log'
    ensure: 'absent'
    compress: true
    compressoptions: '-9'
    rotate: 7
    create_owner: 'root'
    create_group: 'adm'
    rotate_every: 'day'
    create_mode: '0644'
    missingok: true
    dateext: true
    delaycompress: false
    ifempty: false
    create: true
    sharedscripts: true
    postrotate:
      - 'if /etc/init.d/apache2 status > /dev/null ; then /etc/init.d/apache2 reload > /dev/null; fi;'
    prerotate:
      - 'if [ -d /etc/logrotate.d/httpd-prerotate ]; then run-parts /etc/logrotate.d/httpd-prerotate; fi;'