357 lines
11 KiB
ReStructuredText
357 lines
11 KiB
ReStructuredText
``role::base``
|
|
==============
|
|
|
|
This role is special in that **it cannot be assigned to a system**. It is meant
|
|
to be included by all other roles and provide basic functionality that all roles
|
|
need anyway.
|
|
|
|
|
|
Parameters
|
|
----------
|
|
|
|
========================= ======== ====================================================
|
|
**Name** **Type** **Default**
|
|
------------------------- -------- ----------------------------------------------------
|
|
default_target string ``multi-user``
|
|
default_enable_afs bool undef
|
|
default_enable_pmodules bool undef
|
|
default_pmodules_when_afs bool false,
|
|
default_local_homes bool undef,
|
|
default_enable_mta bool undef,
|
|
enable_afs bool hiera('base::enable_afs')
|
|
enable_autofs bool hiera('base::enable_autofs')
|
|
enable_epics bool hiera('base::enable_epics')
|
|
enable_filecopy bool hiera('base::enable_filecopy')
|
|
enable_ganglia bool hiera('base::enable_ganglia')
|
|
enable_icinga bool hiera('base::enable_icinga')
|
|
enable_iommu bool hiera('base::enable_iommu')
|
|
enable_kdump_client bool hiera('base::enable_kdump_client')
|
|
enable_local_homes bool hiera('base::local_homes', undef),
|
|
enable_mta bool hiera('base::enable_mta', undef),
|
|
enable_multipath bool hiera('base::enable_multipath')
|
|
enable_nfs_server bool hiera('base::enable_nfs_server')
|
|
enable_nomachine bool hiera('base::enable_nomachine')
|
|
enable_platform bool hiera('base::enable_platform')
|
|
enable_pmodules bool hiera('base::enable_pmodules')
|
|
enable_print_client bool hiera('base::enable_print_client')
|
|
enable_rhgb bool hiera('base::enable_rhgb')
|
|
enable_ssh_client bool hiera('base::enable_ssh_client')
|
|
enable_telegraf bool hiera('base::enable_telegraf')
|
|
enable_updatedb bool hiera('base::enable_updatedb')
|
|
include_aaa bool true
|
|
include_log_client bool true
|
|
include_rpm_repos bool true
|
|
package_groups array hiera_array('base::package_groups', [])
|
|
package_excludes array hiera_array('base::package_exclude', [])
|
|
pkg_group::* array hiera_array('base::pkg_group::...', [])
|
|
selinux_mode string hiera('base::selinux_mode', 'enforcing')
|
|
update_interval enum hiera('base::automatic_updates::interval', 'weekly')
|
|
update_type enum hiera('base::automatic_updates::type', 'security')
|
|
update_exclude array hiera_array('base::automatic_updates::exclude', [])
|
|
update_kernel bool hiera('base::automatic_updates::kernel', false)
|
|
========================= ======== ====================================================
|
|
|
|
|
|
``default_target``
|
|
~~~~~~~~~~~~~~~~~~
|
|
|
|
Specifies the systemd default target to configure. This does not *isolate* the
|
|
target (see :manpage:`systemctl(1)`), but merely sets it so it will become
|
|
active after a reboot.
|
|
|
|
``default_enable_afs``
|
|
~~~~~~~~~~~~~~~~~~~~~~
|
|
Allows the role programmer to define if AFS should be enabled or not when there is no ``base::enable_afs`` Hiera setting and parameter ``enable_afs`` is undefined (default).
|
|
|
|
``default_enable_pmodules``
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
Allows the role programmer to define if pmodules should be enabled or not when there is no ``base::enable_pmodules`` Hiera setting and parameter ``enable_pmodules`` is undefined (default).
|
|
|
|
``default_pmodules_when_afs``
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
Allows the role programmer to define if pmodules should be automatically enabled together with AFS. should be enabled or not when there is no ``base::enable_pmodules`` Hiera setting and parameter ``enable_pmodules`` is undefined (default).
|
|
|
|
This requires the parameters ``default_enable_pmodules`` and ``enable_pmodules`` to be undefined (default) and that there is no ``base::enable_pmodules`` Hiera setting.
|
|
|
|
``default_local_homes``
|
|
~~~~~~~~~~~~~~~~~~~~~~~
|
|
Allows the role programmer to define if local homes should be used if not configured differently in Hiera. This is default on RHEL8.
|
|
|
|
``default_enable_mta``
|
|
~~~~~~~~~~~~~~~~~~~~~~
|
|
Allows the role programmer to define if postfix should be enabled or not when there is no ``base::enable_mta`` Hiera setting and parameter ``enable_mta`` is undefined (default).
|
|
|
|
``enable_afs``
|
|
~~~~~~~~~~~~~~
|
|
|
|
Determines whether to include the :doc:`afs_client <../profiles/afs_client>`
|
|
profile to enable AFS access.
|
|
For the ``softioc`` role this is ignored, respectively there is a separate ``softioc::enable_afs`` Hiera settings.
|
|
|
|
Puppet roles should not set this parameter as this overrides ``base::enable_afs`` from Hiera.
|
|
Please use ``default_enable_afs`` instead to define the role preference.
|
|
|
|
|
|
``enable_autofs``
|
|
~~~~~~~~~~~~~~~~~
|
|
|
|
Enable the ``autofs`` service. This is **not** needed for automounts! It is only
|
|
needed to support the ``-hosts`` map as documented in :manpage:`auto.master`.
|
|
The ``-hosts`` map is mounted on ``/net``.
|
|
|
|
|
|
``enable_epics``
|
|
~~~~~~~~~~~~~~~~~
|
|
|
|
Enables the ``EPICS``. TODO: more details...
|
|
|
|
|
|
``enable_filecopy``
|
|
~~~~~~~~~~~~~~~~~~~
|
|
|
|
Enable the ``filecopy`` profile, which allows deploying arbitrary files from
|
|
``git.psi.ch`` through Hiera.
|
|
|
|
|
|
``enable_ganglia``
|
|
~~~~~~~~~~~~~~~~~~
|
|
|
|
Determines whether to include the :doc:`ganglia_client
|
|
<../profiles/ganglia_client>`.
|
|
|
|
|
|
``enable_ssh_client``
|
|
~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Deploy global SSH client configuration, ie ``/etc/ssh/ssh_config``.
|
|
|
|
|
|
``enable_telegraf``
|
|
~~~~~~~~~~~~~~~~~~~
|
|
|
|
Enable the telegraf monitoring agent, which reports various system metrics to
|
|
InfluxDB servers.
|
|
|
|
|
|
``enable_icinga``
|
|
~~~~~~~~~~~~~~~~~
|
|
|
|
Determines whether to include the :doc:`icinga_client
|
|
<../profiles/icinga_client>` profile, which installs the client components
|
|
necessary for Icinga-based monitoring.
|
|
|
|
|
|
``enable_iommu``
|
|
~~~~~~~~~~~~~~~~~
|
|
|
|
It enables the IOMMU support in the kernel on boot. The node needs to be rebooted for this change to become active.
|
|
|
|
|
|
``enable_kdump_client``
|
|
~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Determines whether to include the :doc:`kdump_client <../profiles/kdump_client>`
|
|
profile.
|
|
|
|
``enable_local_homes``
|
|
~~~~~~~~~~~~~~~~~~~~~~
|
|
Configures local homes.
|
|
|
|
Puppet roles should not set this parameter as this overrides ``base::enable_local_homes`` from Hiera.
|
|
Please use ``default_local_homes`` instead to define the role preference.
|
|
|
|
``enable_mta``
|
|
~~~~~~~~~~~~~~
|
|
Enables postfix.
|
|
|
|
Puppet roles should not set this parameter as this overrides ``base::enable_mta`` from Hiera.
|
|
Please use ``default_enable_mta`` instead to define the role preference.
|
|
|
|
``enable_multipath``
|
|
~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Enable the ``multipath`` profile for basic multipath functionality.
|
|
|
|
|
|
``enable_nfs_server``
|
|
~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Enable the kernel NFS server and configure the :manpage:`exports(5)` file. See
|
|
the :doc:`nfs_server <../profiles/nfs_server>` profile for details.
|
|
|
|
|
|
``enable_nomachine``
|
|
~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Include the ``nomachine`` profile, which can install NoMachine NX in various
|
|
configurations.
|
|
|
|
|
|
``enable_platform``
|
|
~~~~~~~~~~~~~~~~~~~
|
|
|
|
Enable the ``platform`` profile, which installs and configures hardware-specific
|
|
tools and configurations.
|
|
|
|
|
|
``enable_pmodules``
|
|
~~~~~~~~~~~~~~~~~~~
|
|
|
|
Determines whether to enable the :doc:`pmodules <../profiles/pmodules>` profile.
|
|
When true, the necessary configuration is automatically sourced for all normal
|
|
users (ie UID >= 1000 and no ``-adm`` suffix) using :manpage:`bash(1)`.
|
|
|
|
Requires AFS to work, as the required configuration files are stored on AFS.
|
|
|
|
Puppet roles should not set this parameter as this overrides ``base::enable_pmodules`` from Hiera.
|
|
Please use ``default_enable_pmodules`` or even ``default_pmodules_when_afs`` instead to define the role preference.
|
|
|
|
|
|
``enable_print_client``
|
|
~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Enable and configure CUPS as a client. See the :doc:`print_client
|
|
<../profiles/print_client>` profile for details.
|
|
|
|
|
|
``enable_rhgb``
|
|
~~~~~~~~~~~~~~~
|
|
|
|
Determines whether the graphical boot screen is enabled.
|
|
|
|
|
|
``enable_updatedb``
|
|
~~~~~~~~~~~~~~~~~~~
|
|
|
|
Determines whether or not :manpage:`updatedb(8)` (aka :manpage:`locate(1)`) is
|
|
enabled or not. When enabled, it is still possible to exclude certain
|
|
directories for indexing. This is also supported directly by the mounter module.
|
|
|
|
|
|
``include_aaa``
|
|
~~~~~~~~~~~~~~~
|
|
|
|
Determines whether to include the :doc:`aaa <../profiles/aaa>` profile, which
|
|
configures authentication, authorization, and (partly) auditing.
|
|
|
|
|
|
``include_log_client``
|
|
~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Include the :doc:`log_client <../profiles/log_client>` profile. This is only
|
|
meant to allow roles customization of the :doc:`log_client
|
|
<../profiles/log_client>` profile.
|
|
|
|
|
|
``include_rpm_repos``
|
|
~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Determines whether to install the default RPM package repositories.
|
|
|
|
|
|
``package_groups``
|
|
~~~~~~~~~~~~~~~~~~
|
|
|
|
The list of package groups to install. Package groups are defined in Hiera using
|
|
``base::pkg_group::NAME``.
|
|
|
|
|
|
``pkg_group::NAME``
|
|
~~~~~~~~~~~~~~~~~~~
|
|
|
|
An array defining the package group ``NAME``. It contains the package name with optionally
|
|
one or more tags, separated by ``:``. Following tags are allowed:
|
|
|
|
========== =====================================================
|
|
Tag Description
|
|
---------- -----------------------------------------------------
|
|
latest ensure the latest version of the package is installed
|
|
absent ensure the package is not installed
|
|
os=redhat7 install it only on this OS
|
|
os!redhat7 install on any OS except this one
|
|
========== =====================================================
|
|
|
|
|
|
``package_excludes``
|
|
~~~~~~~~~~~~~~~~~~~~
|
|
|
|
An array with packages which are not made available on the system.
|
|
|
|
|
|
``selinux_mode``
|
|
~~~~~~~~~~~~~~~~
|
|
|
|
The SELinux mode to use, one of ``enforcing``, ``permissive``, and ``disabled``.
|
|
The *configured* SELinux mode (ie the setting in ``/etc/sysconfig/selinux``) is
|
|
changed immediately. The runtime mode is changed as follows, as certain
|
|
transitions are impossible without a reboot:
|
|
|
|
========== ========== ===========
|
|
Current Setting New runtime
|
|
---------- ---------- -----------
|
|
Enforcing Disabled Permissive
|
|
Enforcing Permissive Permissive
|
|
Permissive Enforcing Enforcing
|
|
Permissive Disabled Permissive
|
|
Disabled Permissive Disabled
|
|
Disabled Enforcing Disabled
|
|
========== ========== ===========
|
|
|
|
|
|
``update_interval``
|
|
~~~~~~~~~~~~~~~~~~~
|
|
How often should the automatic updates be installed. Valid options are ``never``, ``daily`` and ``weekly``.
|
|
|
|
|
|
``update_type``
|
|
~~~~~~~~~~~~~~~
|
|
What type of package updates should be installed automatically, either ``security`` for only security updates or ``all`` for all updates.
|
|
|
|
|
|
``update_exclude``
|
|
~~~~~~~~~~~~~~~~~~
|
|
List of packages which shall not be updated automatically. Wildcards like * are allowed. The kernel is excluded by default.
|
|
|
|
``update_kernel``
|
|
~~~~~~~~~~~~~~~~~
|
|
Marks if also the kernel package should be automatically updated. Note that the necessary reboot to run the new kernel needs to be done manually.
|
|
|
|
|
|
Examples
|
|
--------
|
|
|
|
The most basic usage is::
|
|
|
|
class role::some_role () {
|
|
|
|
include role::base
|
|
|
|
...
|
|
}
|
|
|
|
Most profiles that are included can be excluded when necessary::
|
|
|
|
class role::some_role () {
|
|
|
|
class {'role::base':
|
|
include_icinga => false,
|
|
}
|
|
|
|
...
|
|
}
|
|
|
|
This can be used to customize some of the basic profiles::
|
|
|
|
class role::base () {
|
|
|
|
class {'role::base':
|
|
include_aaa => false,
|
|
}
|
|
|
|
class {'profile::aaa':
|
|
allow_sudoers_d => true,
|
|
}
|
|
|
|
...
|
|
}
|