forked from Controls/gitea-pages
"merged" admin-guide
This commit is contained in:
@@ -0,0 +1,33 @@
|
||||
Puppet client
|
||||
-------------
|
||||
|
||||
Puppet client run is executed once daily between 5AM and 8AM
|
||||
(``puppet_client::exec_time`` in hiera data).
|
||||
|
||||
The puppet client is executed via the ``pli-puppet-run`` system timer: ::
|
||||
|
||||
|
||||
[root@lxdev04 ~]# systemctl list-timers
|
||||
NEXT LEFT LAST PASSED UNIT ACTIVATES
|
||||
Wed 2017-10-25 15:55:54 CEST 6h left Tue 2017-10-24 15:55:54 CEST 17h ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
|
||||
Thu 2017-10-26 07:51:00 CEST 22h left Wed 2017-10-25 07:51:16 CEST 1h 5min ago pli-puppet-run.timer pli-puppet-run.service
|
||||
|
||||
2 timers listed.
|
||||
Pass --all to see loaded but inactive timers, too.
|
||||
|
||||
Puppet execution can be disabled for a certain amount of time with the
|
||||
``/opt/pli/libexec/pli-puppet-disable`` command: ::
|
||||
|
||||
[root@lxdev04 ~]# /opt/pli/libexec/pli-puppet-disable
|
||||
puppet currently not disabled
|
||||
[root@lxdev04 ~]# /opt/pli/libexec/pli-puppet-disable '1 week'
|
||||
[root@lxdev04 ~]# /opt/pli/libexec/pli-puppet-disable
|
||||
Puppet disabled until: Wed Nov 1 08:00:05 CET 2017
|
||||
[root@lxdev04 ~]# /opt/pli/libexec/pli-puppet-disable stop
|
||||
Stopping
|
||||
[root@lxdev04 ~]# /opt/pli/libexec/pli-puppet-disable
|
||||
puppet currently not disabled
|
||||
[root@lxdev04 ~]#
|
||||
|
||||
The disabling time has to be in the ``date`` format (see date(1)).
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
``grub2``
|
||||
=========
|
||||
|
||||
This module provides a defined type to configure kernel arguments in grub2.
|
||||
|
||||
|
||||
Defined Types
|
||||
-------------
|
||||
|
||||
|
||||
``grub2::kernel_arg``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Modify a kernel argument.
|
||||
|
||||
Parameters:
|
||||
|
||||
- ``action``: one of 'add' and 'remove'
|
||||
- ``value``: specifies the value for arguments of the form ``arg=value``, e.g.
|
||||
``crashkernel=auto``.
|
||||
@@ -0,0 +1,156 @@
|
||||
``logrotate``
|
||||
===========
|
||||
|
||||
This module configures ``logrotate``. Further information an examples can be
|
||||
found in the following link:
|
||||
|
||||
* https://git.psi.ch/linux-infra/voxpupuli-logrotate
|
||||
|
||||
Main class ``logrotate`` can be called, but usually calling just a rule ``logrotate::rule``
|
||||
should be enough to automatically configure ``logrotate`` in the host. It will use the
|
||||
default values for this class, which is placing all the default ``rules`` from the O.S.
|
||||
to the ``/etc/logrotate.d`` directory.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
All available parameters are::
|
||||
|
||||
namevar - The String name of the rule.
|
||||
path - The path String to the logfile(s) to be rotated.
|
||||
ensure - The desired state of the logrotate rule as a String. Valid
|
||||
values are 'absent' and 'present' (default: 'present').
|
||||
compress - A Boolean value specifying whether the rotated logs should
|
||||
be compressed (optional).
|
||||
compresscmd - The command String that should be executed to compress the
|
||||
rotated logs (optional).
|
||||
compressext - The extention String to be appended to the rotated log files
|
||||
after they have been compressed (optional).
|
||||
compressoptions - A String of command line options to be passed to the
|
||||
compression program specified in `compresscmd` (optional).
|
||||
copy - A Boolean specifying whether logrotate should just take a
|
||||
copy of the log file and not touch the original (optional).
|
||||
copytruncate - A Boolean specifying whether logrotate should truncate the
|
||||
original log file after taking a copy (optional).
|
||||
create - A Boolean specifying whether logrotate should create a new
|
||||
log file immediately after rotation (optional).
|
||||
create_mode - An octal mode String logrotate should apply to the newly
|
||||
created log file if create => true (optional).
|
||||
create_owner - A username String that logrotate should set the owner of the
|
||||
newly created log file to if create => true (optional).
|
||||
create_group - A String group name that logrotate should apply to the newly
|
||||
created log file if create => true (optional).
|
||||
dateext - A Boolean specifying whether rotated log files should be
|
||||
archived by adding a date extension rather just a number
|
||||
(optional).
|
||||
dateformat - The format String to be used for `dateext` (optional).
|
||||
Valid specifiers are '%Y', '%m', '%d' and '%s'.
|
||||
dateyesterday - A Boolean specifying whether to use yesterday's date instead
|
||||
of today's date to create the `dateext` extension (optional).
|
||||
delaycompress - A Boolean specifying whether compression of the rotated
|
||||
log file should be delayed until the next logrotate run
|
||||
(optional).
|
||||
extension - Log files with this extension String are allowed to keep it
|
||||
after rotation (optional).
|
||||
ifempty - A Boolean specifying whether the log file should be rotated
|
||||
even if it is empty (optional).
|
||||
mail - The email address String that logs that are about to be
|
||||
rotated out of existence are emailed to (optional).
|
||||
mailfirst - A Boolean that when used with `mail` has logrotate email the
|
||||
just rotated file rather than the about to expire file
|
||||
(optional).
|
||||
maillast - A Boolean that when used with `mail` has logrotate email the
|
||||
about to expire file rather than the just rotated file
|
||||
(optional).
|
||||
maxage - The Integer maximum number of days that a rotated log file
|
||||
can stay on the system (optional).
|
||||
minsize - The String minimum size a log file must be to be rotated,
|
||||
but not before the scheduled rotation time (optional).
|
||||
The default units are bytes, append k, M or G for kilobytes,
|
||||
megabytes and gigabytes respectively.
|
||||
maxsize - The String maximum size a log file may be to be rotated;
|
||||
When maxsize is used, both the size and timestamp of a log
|
||||
file are considered for rotation.
|
||||
The default units are bytes, append k, M or G for kilobytes,
|
||||
megabytes and gigabytes respectively.
|
||||
missingok - A Boolean specifying whether logrotate should ignore missing
|
||||
log files or issue an error (optional).
|
||||
olddir - A String path to a directory that rotated logs should be
|
||||
moved to (optional).
|
||||
postrotate - A command String that should be executed by /bin/sh after
|
||||
the log file is rotated (optional).
|
||||
prerotate - A command String that should be executed by /bin/sh before
|
||||
the log file is rotated and only if it will be rotated
|
||||
(optional).
|
||||
firstaction - A command String that should be executed by /bin/sh once
|
||||
before all log files that match the wildcard pattern are
|
||||
rotated (optional).
|
||||
lastaction - A command String that should be execute by /bin/sh once
|
||||
after all the log files that match the wildcard pattern are
|
||||
rotated (optional).
|
||||
rotate - The Integer number of rotated log files to keep on disk
|
||||
(optional).
|
||||
rotate_every - How often the log files should be rotated as a String.
|
||||
Valid values are 'hour', 'day', 'week', 'month' and 'year'
|
||||
(optional). Please note, older versions of logrotate do not
|
||||
support yearly log rotation.
|
||||
size - The String size a log file has to reach before it will be
|
||||
rotated (optional). The default units are bytes, append k,
|
||||
M or G for kilobytes, megabytes or gigabytes respectively.
|
||||
sharedscripts - A Boolean specifying whether logrotate should run the
|
||||
postrotate and prerotate scripts for each matching file or
|
||||
just once (optional).
|
||||
shred - A Boolean specifying whether logs should be deleted with
|
||||
shred instead of unlink (optional).
|
||||
shredcycles - The Integer number of times shred should overwrite log files
|
||||
before unlinking them (optional).
|
||||
start - The Integer number to be used as the base for the extensions
|
||||
appended to the rotated log files (optional).
|
||||
su_owner - A username String that logrotate should use to rotate a
|
||||
log file set instead of using the default if
|
||||
su => true (optional).
|
||||
su_group - A String group name that logrotate should use to rotate a
|
||||
log file set instead of using the default if
|
||||
su => true (optional).
|
||||
uncompresscmd - The String command to be used to uncompress log files
|
||||
(optional).
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
Configure ``logrotate.conf``::
|
||||
|
||||
logrotate::conf { '/etc/logrotate.conf':
|
||||
rotate => 10,
|
||||
rotate_every => 'week',
|
||||
ifempty => true,
|
||||
dateext => true,
|
||||
}
|
||||
|
||||
|
||||
Rule for rotating ``messages``::
|
||||
|
||||
logrotate::rule { 'messages':
|
||||
path => '/var/log/messages',
|
||||
rotate => 5,
|
||||
rotate_every => 'week',
|
||||
postrotate => '/usr/bin/killall -HUP syslogd',
|
||||
}
|
||||
|
||||
|
||||
Rule for rotating ``slurmd`` client::
|
||||
|
||||
logrotate::rule { 'slurmd':
|
||||
path => '/var/log/slurm/slurmd.log',
|
||||
rotate => $rotate,
|
||||
rotate_every => $rotate_every,
|
||||
compress => true,
|
||||
create => true,
|
||||
create_mode => '0600',
|
||||
create_owner => 'slurm',
|
||||
create_group => 'slurm',
|
||||
missingok => true,
|
||||
ifempty => false,
|
||||
sharedscripts => true,
|
||||
postrotate => '/bin/systemctl reload slurmd.service > /dev/null 2>/dev/null || true';
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
``selinux``
|
||||
===========
|
||||
|
||||
This module configures :doc:`/selinux`. It allows configuring the SELinux mode
|
||||
as well as setting SELinux booleans.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
``selinux_mode``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
Acceptable values are ``enforcing``, ``permissive``, and ``disabled``. The
|
||||
module configures this mode for the next reboot. It also sets it right away
|
||||
unless the mode to be configured is ``disabled`` or SELinux is currently
|
||||
disabled. In the former case the current mode is set to ``permissive``. In the
|
||||
latter case nothing is done before the next reboot.
|
||||
|
||||
|
||||
Defined Types
|
||||
-------------
|
||||
|
||||
``set_sebool``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
Sets the SELinux boolean specified as the resource title unless SELinux is
|
||||
disabled, in which case it does nothing.
|
||||
|
||||
Parameters:
|
||||
|
||||
- ``enable``
|
||||
|
||||
If true, the boolean is set to ``on``. If false, the boolean is set to
|
||||
``off``.
|
||||
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
Allow httpd to access user's home directories::
|
||||
|
||||
selinux::set_sebool {'httpd_enable_homedirs': enable => true }
|
||||
@@ -0,0 +1,24 @@
|
||||
``sudo``
|
||||
========
|
||||
|
||||
This module installs and configures ``sudo(8)``.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
|
||||
``allow_sudoers_d``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This boolean determines whether the files in ``/etc/sudoers.d/`` are included in
|
||||
the sudo configuration.
|
||||
|
||||
|
||||
Defined types
|
||||
-------------
|
||||
|
||||
``sudo::rules``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
This defined type accepts a parameter ``rules``, which is an array of strings to
|
||||
be added to ``/etc/sudoers``.
|
||||
@@ -0,0 +1,18 @@
|
||||
``sysctl``
|
||||
===========
|
||||
|
||||
This module configures ``sysctl``. Further information an examples can be
|
||||
found in the official page:
|
||||
|
||||
* https://forge.puppet.com/tpdownes/sysctl
|
||||
|
||||
The sysctl module is called automatically so is possible to do sysctl tuning
|
||||
by configuring properly hiera using the `sysctl::values` variable, eg.::
|
||||
|
||||
sysctl::values:
|
||||
net.ipv4.tcp_slow_start_after_idle:
|
||||
value: '0'
|
||||
net.core.rmem_max:
|
||||
value: '83886080'
|
||||
net.core.wmem_max:
|
||||
value: '83886080'
|
||||
@@ -0,0 +1,77 @@
|
||||
``systemd``
|
||||
===========
|
||||
|
||||
This module provides defined types to create systemd units. It automatically
|
||||
takes care of reloading systemd when necessary, automatically generates correct
|
||||
names for ``.mount`` units, etc.
|
||||
|
||||
The parameters of defined types are usually similar to the systemd option names
|
||||
that they represent. Camel case (as used by systemd) is transformed to the
|
||||
lowercase-with-underscore style usually used with Puppet, e.g. ``OnCalendar`` in
|
||||
systemd becomes ``on_calendar``.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
``default_target``
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The systemd default target, i.e. usually one of ``multi-user.target`` or
|
||||
``graphical.target``.
|
||||
|
||||
|
||||
Defined Types
|
||||
-------------
|
||||
|
||||
All units support the following parameters for the ``[Unit]`` or ``[Install]``
|
||||
sections:
|
||||
|
||||
- ``description``
|
||||
- ``wanted_by``
|
||||
|
||||
|
||||
``systemd::timer``
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Creates a timer unit.
|
||||
|
||||
Parameters:
|
||||
|
||||
- ``on_calendar``
|
||||
- ``unit``
|
||||
|
||||
|
||||
``systemd::mount``
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Creates a mount unit. The name of the unit file has to be (an encoded form of)
|
||||
the mountpoint, which is automatically generated. See ``systemd.mount(5)`` for
|
||||
details.
|
||||
|
||||
Parameters:
|
||||
|
||||
- ``what``
|
||||
- ``where``
|
||||
- ``options``
|
||||
|
||||
|
||||
``systemd.service``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
- ``type`` (default: ``simple``)
|
||||
- ``exec_start``
|
||||
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
Defining a timer unit
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Timer units integrate nicely with the remaining services. They can be managed
|
||||
through ``systemctl(1)`` and their log messages can easily be accessed through
|
||||
``journalctl -u xxxxx.timer``.
|
||||
|
||||
A timer unit needs a corresponding service unit which executes the actual
|
||||
command.
|
||||
@@ -0,0 +1,24 @@
|
||||
``updatedb``
|
||||
============
|
||||
|
||||
This module manages the configuration for ``mlocate`` aka ``updatedb(8)``.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
``enable``
|
||||
~~~~~~~~~~
|
||||
|
||||
A boolean indicating whether ``mlocate`` - ie the ``updatedb(8)`` cron job -
|
||||
should be enabled or not.
|
||||
|
||||
|
||||
Defined Types
|
||||
-------------
|
||||
|
||||
``updatedb::exclude``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Takes a list of directories and makes sure that ``updatedb(8)`` ignores them
|
||||
when indexing.
|
||||
@@ -0,0 +1,32 @@
|
||||
``utils``
|
||||
=========
|
||||
|
||||
This module contains a number of utility functions used at PSI. It is the
|
||||
PSI-specific analogue to Puppetlabs' ``stdlib``.
|
||||
|
||||
|
||||
Functions
|
||||
---------
|
||||
|
||||
|
||||
``check_os``
|
||||
~~~~~~~~~~~~
|
||||
|
||||
Accepts an arbitrary number of arguments, each of which is a string of the form
|
||||
``$osfamily $majorversion`` as reported by ``facter(8)``. If the facts of the
|
||||
client system **do not** match any of the arguments, the function aborts the
|
||||
Puppet run.
|
||||
|
||||
|
||||
``rand_time``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
This function takes a parameter specifying a time window and returns a specific
|
||||
time within this window based on the MD5 on the hostname. This allows scheduling
|
||||
cron jobs etc uniformly across a fleet of system within a given window, while
|
||||
keeping the time on each system predictable.
|
||||
|
||||
The format for the argument specifying the time window is ``HH:MM--HH:MM``. The
|
||||
window must not include midnight.
|
||||
|
||||
The format of the return value is ``HH:MM``.
|
||||
@@ -0,0 +1,52 @@
|
||||
Development Environments
|
||||
========================
|
||||
|
||||
The puppet server gives access to a limited set of users to the
|
||||
environment area, where prod and preprod environments are already
|
||||
present, to create environments that can be used for new puppet code
|
||||
development.
|
||||
|
||||
This area is accessible via sftp and can be mounted on users'
|
||||
workstations via sshfs.
|
||||
|
||||
The typical workflow would be:
|
||||
|
||||
#. user mounts the environment area (``puppet00:/envs`` on the puppet master) via sshfs on ``~/puppetenv``;
|
||||
#. user create a directory for the new environent (``mkdir ~/puppetenv/issue_x``);
|
||||
#. after a few seconds ``issue_x`` will be populated with a copy of the content of the the ``preprod`` environment with a proper git branch named ``issue_x``;
|
||||
#. user edits files in that directory;
|
||||
#. user run on some testing node the command ``puppet agent -t --environment=issue_x``;
|
||||
#. user iterates on steps number 4 and 5 until the code is ready;
|
||||
#. users makes the proper add/commit into the directory and finally pushes the code;
|
||||
#. from the git server web interface user triggers a merge request of the ``issue_x`` into the ``preprod`` branch.
|
||||
|
||||
Please note that ssh to the puppet server has to be done via ``wmgt`` nodes.
|
||||
|
||||
Environment names
|
||||
-----------------
|
||||
|
||||
The name of the environment:
|
||||
|
||||
- must be at least 4 characters long;
|
||||
- can include lower case letters, digits and the underscore character;
|
||||
- must start with a letter.
|
||||
|
||||
If the name is not compliant with these rules, the directory will be automatically removed.
|
||||
|
||||
SSHFS mount
|
||||
-----------
|
||||
|
||||
Generally refer to your operating system instructions on how to
|
||||
properly configure sshfs.
|
||||
|
||||
One caveat is that your local user can be different from the remote (puppet master)
|
||||
user. In this case a file mapping your local username to the remote user id should be passed to the sshfs client.
|
||||
The file should be in the form of::
|
||||
|
||||
<local username>:<remote uid>
|
||||
|
||||
And should then be passed in the command like::
|
||||
|
||||
sshfs -o idmap=file,uidfile=/Users/talamoig/uidmap,nomap=ignore talamo_i@puppet00:/ ~/puppetenvs
|
||||
|
||||
|
||||
@@ -0,0 +1,96 @@
|
||||
General
|
||||
=======
|
||||
|
||||
`Puppet <https://puppetlabs.com>`_ is the *configuration management system* used to configure the hosts.
|
||||
|
||||
Introduction
|
||||
------------
|
||||
|
||||
Puppet is used in master mode and the general idea is to make large
|
||||
use of indipendent and (relatively) small puppet
|
||||
modules and composing profiles and roles based on them to create
|
||||
classes that are assigned to the hosts. With indipendence
|
||||
of puppet modules we mean that each puppet module targets a single
|
||||
functionality (eg. `web server`, `afs client`) and this
|
||||
is choosen to keep the code of the single module smaller, more
|
||||
coherent and easier to debug.
|
||||
|
||||
Furthermore the system makes use of some puppet modules from the `puppet forge
|
||||
<https://forge.puppet.com>`_. These puppet modules are not accessed directly but
|
||||
through their PSI mirror, inside of the `Linux-infra group <https://git.psi.ch/linux-infra>`_.
|
||||
|
||||
Code and data are kept separated, using puppet modules
|
||||
for code and hiera for data. Secure data are safely managed
|
||||
inside hiera using `hiera eyaml <https://github.com/TomPoulton/hiera-eyaml>`_.
|
||||
|
||||
To each host the following element will determine how it will be configured:
|
||||
|
||||
- the puppet environment (that will determine the puppet role/profile code base)
|
||||
- the sysdb data environment (that will determine the hiera code base)
|
||||
- the puppet group (that will determine what files will be considered in the hiera code base)
|
||||
- the role
|
||||
|
||||
All these elements are configured inside sysdb as attributes and are accessed
|
||||
by the puppet master via the ENC.
|
||||
|
||||
Here you can get a general overview:
|
||||
|
||||
.. following image generated from https://docs.google.com/drawings/d/16AXZd5PF-HgW379Cxgvwzvc6MTl_34LVFHzP5Fi8RdQ/edit
|
||||
|
||||
.. image:: puppet_workflow.jpg
|
||||
|
||||
|
||||
|
||||
Environments
|
||||
------------
|
||||
|
||||
We use Puppet environments for two purposes:
|
||||
|
||||
- roll out changes to a small subset of all systems first
|
||||
- module development
|
||||
|
||||
|
||||
The following environments exist:
|
||||
|
||||
- ``prod``
|
||||
|
||||
The most stable, and most systems are attached to it. All changes to ``prod``
|
||||
have to go through ``preprod`` first.
|
||||
|
||||
- ``preprod``
|
||||
|
||||
- Development environments. These are private to a single developer,
|
||||
can have arbitrary names like ``ganglia-issue-21`` or
|
||||
``kaminski_k-log_client``, and are used for developing and testing
|
||||
changes. Generally, only individual systems are attached to these
|
||||
environments.
|
||||
|
||||
|
||||
|
||||
puppet master
|
||||
-------------
|
||||
|
||||
The puppet master will make use of the `ENC
|
||||
<https://docs.puppet.com/guides/external_nodes.html>`_ for getting
|
||||
two informations:
|
||||
|
||||
- the environment;
|
||||
- the role.
|
||||
|
||||
The environment is used to determine the directory location inside
|
||||
`/etc/puppetlabs/code/environments` where to look code for.
|
||||
|
||||
The role is a class-name inside the specific environment that will be
|
||||
used to generate the node catalog.
|
||||
|
||||
Assuming for example the following result from the ENC for a specific node: ::
|
||||
|
||||
---
|
||||
environment: production
|
||||
classes:
|
||||
- role::log_server
|
||||
|
||||
the puppet master will look for the a puppet class named
|
||||
``role::log_server`` in the file
|
||||
`/etc/puppetlabs/code/environments/productions/modules/psi/manifests/role/log_server.pp`.
|
||||
|
||||
@@ -0,0 +1,201 @@
|
||||
Hiera
|
||||
=====
|
||||
|
||||
Look `here <https://docs.puppet.com/hiera/3.1/>`_ for a general Hiera
|
||||
introduction.
|
||||
|
||||
The current hierarchy has four levels (first will be considered first
|
||||
during value lookup):
|
||||
|
||||
- nodes (FQDN)
|
||||
- group (``puppet_group`` attribute in sysdb)
|
||||
- sysdb environments
|
||||
- common
|
||||
|
||||
and values can be stored as classical YAML values or with `encrypted yaml
|
||||
<https://github.com/TomPoulton/hiera-eyaml>`_ for secrets.
|
||||
The filesystem structure is as follows::
|
||||
|
||||
1. ``%{::sysdb_env}/%{::group}/%{::fqdn}``
|
||||
2. ``%{::sysdb_env}/%{::group}``
|
||||
3. ``%{::sysdb_env}/%{::sysdb_env}``
|
||||
4. ``%{::environment}/data/common``
|
||||
|
||||
The ``%{variable}`` notation is hiera specific and each path represents a ``.yaml``
|
||||
file.
|
||||
|
||||
Hiera repositories
|
||||
------------------
|
||||
|
||||
Hiera data are organized in different repositories.
|
||||
|
||||
Sysdb environments data
|
||||
^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Each sysdb environment has a dedicated hiera repository, called ``data-<sydbenv>``,
|
||||
eg. `data-hpc <https://git.psi.ch/linux-infra/data-hpc>`_
|
||||
and `data-sls <https://git.psi.ch/linux-infra/data-sls>`_.
|
||||
The first three levels of the filesystem structure shown before are actually the
|
||||
files inside this kind of repositories.
|
||||
|
||||
Any change to the repo will automatically trigger a redeployment of the new version
|
||||
of its content on the puppet master within a few seconds from the push.
|
||||
|
||||
This choice has been made to allow groups to change their hiera data independently of
|
||||
the linux infrastructure admins. Furthermore there is no way to influence other sysdb
|
||||
environments data.
|
||||
|
||||
Common data
|
||||
^^^^^^^^^^^
|
||||
|
||||
The last element in the hierarchy (``common.yaml``) is instead defined inside the main puppet repository
|
||||
(the one containing also the real puppet code). It is important to notice that the version
|
||||
of the ``common.yaml`` used for a specific host will depend on the puppet environment it
|
||||
is running on, while for the sysdb environements data are the same, whatever the puppet
|
||||
environment of the host.
|
||||
|
||||
The common part is kept under the control of the linux infrastructure admins
|
||||
since a change on this can have an impact on a much larger set of hosts and all the changes
|
||||
on this file are discussed and approved through a longer process.
|
||||
|
||||
Example
|
||||
-------
|
||||
|
||||
Assuming two sysdb environments ``hpc`` and ``sls``, as well as:
|
||||
|
||||
- group ``merlin4`` in ``hpc`` with ``merlinc10`` and ``merlinc11`` in it;
|
||||
- group ``merlin5`` in ``hpc`` with ``merlin-c001`` and ``merlin-c002`` in it;
|
||||
- group ``mx`` in ``sls`` with ``mxcn-1`` and ``mxcn-2`` in it;
|
||||
- host ``xbl-gateway`` in no explicit group (will take the implicit ``default``)
|
||||
|
||||
the Hiera structure would look like this::
|
||||
|
||||
data/hpc/merlin4/merlinc10.psi.ch.yaml
|
||||
data/hpc/merlin4/merlinc11.psi.ch.yaml
|
||||
data/hpc/merlin4.yaml
|
||||
data/hpc/merlin5/merlin-c001.psi.ch.yaml
|
||||
data/hpc/merlin5/merlin-c002.psi.ch.yaml
|
||||
data/hpc/merlin5.yaml
|
||||
data/hpc.yaml
|
||||
data/sls/mx/mxcn-1.psi.ch.yaml
|
||||
data/sls/mx/mxcn-2.psi.ch.yaml
|
||||
data/sls/mx.yaml
|
||||
data/sls/default/xbl-gateway.psi.ch.yaml
|
||||
data/sls.yaml
|
||||
code/environments/{prod,preprod}/common.yaml
|
||||
|
||||
While the output of bob would be something like (some unneeded attributes have been removed)::
|
||||
|
||||
merlinc10.psi.ch hpc local puppet_group=merlin4
|
||||
merlinc11.psi.ch hpc local puppet_group=merlin4
|
||||
merlin-c001.psi.ch hpc local puppet_group=merlin5
|
||||
merlin-c002.psi.ch hpc local puppet_group=merlin5
|
||||
mxcn-1.psi.ch sls local puppet_group=mx
|
||||
mxcn-2.psi.ch sls local puppet_group=mx
|
||||
xbl-gateway.psi.ch sls local
|
||||
|
||||
Secret values
|
||||
-------------
|
||||
|
||||
Secrets and clear-text values can be mixed inside the same yaml file, eg.::
|
||||
|
||||
ntp_client::servers:
|
||||
- pstime1.psi.ch
|
||||
- pstime2.psi.ch
|
||||
- pstime3.psi.ch
|
||||
|
||||
secret_key: ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAY/9V1S0VAMrRX1B4V06AgsbHPHdONFCQ4RiWfTrhV02rL5gSL4LAdqOuvGPY8YZZv8Mp06/FARlvP1aOfEx7avqSBy11IoUGkeajKZFzJV3OJsfhso4wroQ4JmfBaVKICnQZwCdpke+PHPRkwTgHcjmY2FeBnhvOlrGiQMQU3JzCjLePOa7UvlIIin3xOU/TdetzhfvoNGRhsz7+XRPD+mTT8efJ+OslJmqU7hEqMbs9CmhPJWqsjsQUp8jsM10Dk2Rv4v+zYeJd1ZLRGK3Z56G4NrlLyYua+/yyPbUP4+1bEuisDg9bfQHp3R491/kN0W558oQ+85rsRVXCp1Hb6TBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB2x9awGQnxAJsxIHA9OiM2gCBFvgxIR4SJZPrrQ/UlhKU39yYSkEmuKE/ou+yeIe5AMA==]
|
||||
|
||||
|
||||
The encrypted values can be decrypted transparently from Hiera (on a host having the proper hiera key)::
|
||||
|
||||
[root]# hiera secret_key
|
||||
this is a secret value
|
||||
|
||||
You can edit secure data inside any yaml file with the command
|
||||
``/opt/puppetlabs/puppet/bin/eyaml edit common.yaml``. In this case secure data
|
||||
will appear in clear-text inside the editor.
|
||||
|
||||
|
||||
Encripting data with the public key
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
The eyaml public key is::
|
||||
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIC2TCCAcGgAwIBAgIBATANBgkqhkiG9w0BAQUFADAAMCAXDTE2MTAyNDE0NTY1
|
||||
N1oYDzIwNjYxMDEyMTQ1NjU3WjAAMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
|
||||
CgKCAQEA2eykSgS7VJEXrWYkQMV48ZkUVcHMbCEo2gZXD4vIJsOdJu77F7tA53Ay
|
||||
NxdKnJTftsj+R7yFP9Z2XllA9Our0Ypphj40rNstRg5O4IoSkAqitJchlfGL9jZ3
|
||||
CB4dJqFitzOkxxCWZjQpjBd3dMJc6U3us6IDWohCjYqyjMZIVwU5EflzJKV4haEy
|
||||
Y9qHkVt938RM9UohEvia5/1lZxuZQmDpYqCw9gmBK/dVKZ7abZGkujTKAg5cjD/X
|
||||
vuexLMCGrjnPdrsblwBh+yfu6cEo9nfvfj6EA0FxPHIvQ3fv1yJZ+90OA9eUJnqQ
|
||||
ED66OGPATAJIqhWlgb8a760xPQFQQQIDAQABo1wwWjAPBgNVHRMBAf8EBTADAQH/
|
||||
MB0GA1UdDgQWBBSF05r9TYDiAmkdguCVcDzmYR8Q6TAoBgNVHSMEITAfgBSF05r9
|
||||
TYDiAmkdguCVcDzmYR8Q6aEEpAIwAIIBATANBgkqhkiG9w0BAQUFAAOCAQEAWAER
|
||||
CTGsOFUkCfvqke75PmIkxKBp/2eJbavWzPkbA/mwAGS4lQc5oyS8FMkUFxATo1k/
|
||||
WIb2B3WJIMHfCzMNxTlQLjJiSyvWAlEBHDW4H2XekzKSbj96l+/nirmOq3QkEKTK
|
||||
omexF5zYSPkBVA/S2m2wae3g2kubH1p42+REKQUvt1+xaecHBYD6eXzBWChnMMnq
|
||||
FbXoayTibn0p9Roo8HClGGJpjPZUTMf+VGUqKWPfvaKl48Y0yrc/4BzZT6Sbzeou
|
||||
ZSiHwa62rTV7ia7m2SILZU5b65JUVkFH/2r6qkxCr0Ep+oaxSNXtAXLCbnXmdOeK
|
||||
B40J8ePbbmmGE24+zQ==
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
|
||||
Assuming the public key is saved in a file named ``/home/someone/eyaml_key.pub`` and that
|
||||
`hiera-eyaml <https://github.com/TomPoulton/hiera-eyaml>`_ is properly installed,
|
||||
a string can be encripted with::
|
||||
|
||||
eyaml encrypt --pkcs7-public-key=/home/someone/eyaml_key.pub -s secret_string
|
||||
|
||||
|
||||
While a complete file can be encripted with::
|
||||
|
||||
eyaml encrypt --pkcs7-public-key=/home/someone/eyaml_key.pub -f secret_file
|
||||
|
||||
Example: Encripting password
|
||||
----------------------------
|
||||
|
||||
Steps:
|
||||
|
||||
Install locally (local = server/desktop from where you will encrypt the password) hiera-eyaml (https://github.com/voxpupuli/hiera-eyaml/tree/command-refactor)
|
||||
|
||||
Create locally a *keys* directory::
|
||||
|
||||
#> mkdir -p ~/eyaml/keys
|
||||
|
||||
Copy *puppet00:/etc/puppetlabs/keys/eyaml/public_key.pkcs7.pem* to the above folder. Alternatively, you can copy the above public key, which should be the same::
|
||||
|
||||
#> scp root@puppet00:/etc/puppetlabs/keys/eyaml/public_key.pkcs7.pem ~/eyaml/keys
|
||||
|
||||
Go to the *eyaml* directory::
|
||||
|
||||
#> cd ~/eyaml
|
||||
|
||||
Hash your password using *openssl* as follows**. It will generate a hashed password::
|
||||
|
||||
#> openssl passwd -1
|
||||
Password: <input_password>
|
||||
Verifying - Password: <input_password>
|
||||
<output_hashed_password>
|
||||
|
||||
Encrypt your hashed password with *eyaml* and copy the exact output (either the string or the block) to your hiera (YAML) file::
|
||||
|
||||
#> eyaml encrypt -l 'root::password' -s '<output_hashed_password>'
|
||||
root::password: ENC[PKCS7,MIIBmxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||
|
||||
OR
|
||||
|
||||
root::password: >
|
||||
ENC[PKCS7,MIIBmxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||
xxx]
|
||||
@@ -0,0 +1,259 @@
|
||||
Modules
|
||||
=======
|
||||
|
||||
The repository for the Puppet role/profile module is
|
||||
`<https://git.psi.ch/linux-infra/puppet>`_.
|
||||
|
||||
The general roles structure is::
|
||||
|
||||
role::generic_server
|
||||
role::generic_desktop
|
||||
...
|
||||
role::daas::compute
|
||||
role::daas::login
|
||||
...
|
||||
role::sls::console
|
||||
role::sls::boot_server
|
||||
|
||||
So we have some roles that are generic PSI-wide (eg. ``generic_server``) while
|
||||
some roles that are specific to some projects and have a dedicated namespace.
|
||||
|
||||
For the profiles section we have the following::
|
||||
|
||||
profile::ssh_client
|
||||
profile::afs_client
|
||||
profile::log_client
|
||||
profile::mysql_server
|
||||
|
||||
For profiles maybe we will not need namespace areas dedicated to
|
||||
specific projects, since profiles should be generic enough to be
|
||||
reusable.
|
||||
|
||||
|
||||
How to write modules
|
||||
--------------------
|
||||
|
||||
The structure of a module depends on the type of module to some extent.
|
||||
Currently, we distinguish three kinds of modules:
|
||||
|
||||
- roles
|
||||
- profiles
|
||||
- components
|
||||
|
||||
|
||||
Parameter validation
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The first thing every module must do is parameter and environment validation. In
|
||||
particular, a module should check that
|
||||
|
||||
- its arguments have the correct type
|
||||
- it supports the OS of the client system
|
||||
|
||||
A typical module could start like this::
|
||||
|
||||
class profile::logging (
|
||||
$forward_to,
|
||||
$persistent_journal,
|
||||
)
|
||||
{
|
||||
validate_array($forward_to)
|
||||
validate_bool($target)
|
||||
|
||||
check_os('RedHat 7', 'RedHat 8')
|
||||
}
|
||||
|
||||
This would make sure that ``$forward_to`` is an array, ``$persistent_journal``
|
||||
is a boolean, and that the client runs RHEL 7 or (a hypothetical) RHEL 8.
|
||||
|
||||
Arguments should be checked first, in the order that they are passed.
|
||||
|
||||
Checking the OS will ease porting efforts to newer releases of RHEL, other
|
||||
distributions (e.g. Ubuntu), or other operating systems (e.g. BSD), should the
|
||||
need arise.
|
||||
|
||||
|
||||
Hiera queries
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
Only profiles and roles query Hiera. Components should take all their inputs as
|
||||
parameters or facts.
|
||||
|
||||
In profiles, Hiera queries must generally be done as default arguments to
|
||||
parameters, **not** inside the modules body::
|
||||
|
||||
class profile::logging (
|
||||
$forward_to=hiera('...'),
|
||||
$persistent_journal=hiera('...'),
|
||||
)
|
||||
{
|
||||
|
||||
The reason is that this allows a role to enforce certain parameters and disable
|
||||
the corresponding Hiera query.
|
||||
|
||||
|
||||
Layout
|
||||
~~~~~~
|
||||
|
||||
Roles and profiles are usually implemented in a single file, e.g.
|
||||
``psi/manifests/profile/logging.pp``. Components on the other hand follow the
|
||||
standard Puppet layout, i.e.
|
||||
``auditd/manifests/{init,install,config,service}.pp``.
|
||||
|
||||
Files and templates
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Every file or template should be used by only one class and its path inside the
|
||||
module should reflect this. Eg. if the template ``sshd_config.erb`` is used by
|
||||
the ``profile::ssh_server`` module, it will be places inside the
|
||||
``templates/profile/ssh_server`` directory.
|
||||
|
||||
Furthermore, on top of every file managed by puppet, a header like the
|
||||
following should be present: ::
|
||||
|
||||
########################################################################
|
||||
#
|
||||
# THIS FILE IS MANAGED BY PUPPET - DO NOT MODIFY!
|
||||
#
|
||||
# profile::ssh_server
|
||||
# sshd_config.erb
|
||||
#
|
||||
########################################################################
|
||||
|
||||
The last two lines should be:
|
||||
|
||||
- the puppet class using the file;
|
||||
- the name of the file/template.
|
||||
|
||||
Debugging templates
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You can use the ``erb`` tool to test the variable interpolation. One easy way is to prepare a file with the variable values and pipe it together with the template through erb. Define the variables in a file ``test-vars.erb`` like in this example::
|
||||
|
||||
<%
|
||||
@partitions = {'a' => 'aa', 'b' => 'bb', 'c' => 'cc'}
|
||||
@group_whitelist = ['groupA', 'groupB']
|
||||
@port = 8000
|
||||
%>
|
||||
|
||||
and then use a commmand line like the following to pipe it through ``erb``::
|
||||
|
||||
erb <(cat /tmp/test-vars.erb /tmp/my-template.erb)
|
||||
|
||||
The output will contain the variable substituted template. If you want to check your
|
||||
template for syntax errors, you can just use the following command::
|
||||
|
||||
erb -P -x -T '-' jupyterhub_config.py.erb | ruby -c
|
||||
|
||||
Roles
|
||||
-----
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
|
||||
roles/base
|
||||
roles/bootpc
|
||||
roles/console
|
||||
roles/daq_buffer
|
||||
roles/dcache_t3_pools
|
||||
roles/desktop
|
||||
roles/ganglia_server
|
||||
roles/grafana
|
||||
roles/hpc/ces
|
||||
roles/hpc/cn
|
||||
roles/hpc/database
|
||||
roles/hpc/ui
|
||||
roles/hpc/server
|
||||
roles/influxdb
|
||||
roles/jupyterserver
|
||||
roles/log_server
|
||||
roles/login_server
|
||||
roles/media_station
|
||||
roles/nomachine_proxy
|
||||
roles/reverse_proxy
|
||||
roles/server
|
||||
roles/slurm_client
|
||||
roles/slurm_compute
|
||||
roles/slurm_server
|
||||
roles/softioc
|
||||
roles/web_server
|
||||
roles/workstation
|
||||
roles/zookeeper
|
||||
|
||||
|
||||
Profiles
|
||||
--------
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
|
||||
profiles/aaa
|
||||
profiles/afs_client
|
||||
profiles/autofs
|
||||
profiles/custom_timers
|
||||
profiles/epics
|
||||
profiles/filecopy
|
||||
profiles/files
|
||||
profiles/ganglia_client
|
||||
profiles/ganglia_server
|
||||
profiles/gnome
|
||||
profiles/gpfs
|
||||
profiles/grafana
|
||||
profiles/icewm
|
||||
profiles/icinga/client
|
||||
profiles/icinga/nrpe
|
||||
profiles/icinga/checks/gpfs
|
||||
profiles/icinga/checks/nvidia
|
||||
profiles/icinga/checks/puppet_client
|
||||
profiles/icinga/checks/service
|
||||
profiles/icinga/checks/slurm
|
||||
profiles/icinga/checks/hp/smart_array
|
||||
profiles/infiniband
|
||||
profiles/jupyterhub
|
||||
profiles/kdump_client
|
||||
profiles/local_accounts
|
||||
profiles/log_client
|
||||
profiles/log_server
|
||||
profiles/mkresource/files
|
||||
profiles/mounter
|
||||
profiles/mta
|
||||
profiles/multipath
|
||||
profiles/nomachine
|
||||
profiles/nomachine/desktop
|
||||
profiles/nomachine/license
|
||||
profiles/nomachine/repository
|
||||
profiles/nomachine/service
|
||||
profiles/nomachine/terminal
|
||||
profiles/nomachine/workstation
|
||||
profiles/networking
|
||||
profiles/nfs_server
|
||||
profiles/ntp_client
|
||||
profiles/nvidia
|
||||
profiles/platform
|
||||
profiles/platform/hewlett_packard
|
||||
profiles/pmodules
|
||||
profiles/print_client
|
||||
profiles/puppet_client
|
||||
profiles/serial_console
|
||||
profiles/ssh_client
|
||||
profiles/ssh_server.rst
|
||||
profiles/sysinfo
|
||||
profiles/telegraf
|
||||
profiles/web_server
|
||||
profiles/yum_client
|
||||
|
||||
|
||||
Components
|
||||
----------
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
|
||||
components/grub2
|
||||
components/logrotate
|
||||
components/selinux
|
||||
components/sudo
|
||||
components/systemd
|
||||
components/sysctl
|
||||
components/updatedb
|
||||
components/utils
|
||||
@@ -0,0 +1,336 @@
|
||||
``profile::aaa``
|
||||
=====================
|
||||
|
||||
This module manages configuration related to authentication, authorization, and
|
||||
auditing. In particular, it
|
||||
|
||||
- performs the Active Directory join (optional)
|
||||
- configures login restrictions (e.g. :manpage:`pam_access(8)`)
|
||||
- adds sudo rules for administrators
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
admins list hiera_array('aaa::admins')
|
||||
allow_sudoers_d bool hiera('aaa::allow_sudoers_d')
|
||||
bastions list hiera('aaa::bastions')
|
||||
cache_creds bool hiera('aaa::cache_creds')
|
||||
create_homes bool hiera('aaa::create_homes')
|
||||
enable_ad bool hiera('aaa::enable_ad')
|
||||
enable_eaccounts bool hiera('aaa::enable_eaccounts')
|
||||
enable_slurm bool false
|
||||
enable_ssh_allow bool hiera('aaa::enable_ssh_allow')
|
||||
enable_tier3_ldap bool hiera('aaa::enable_tier3_ldap', false)
|
||||
ldap_enabled bool hiera('aaa::ldap_enabled')
|
||||
offline_creds_expiration string hiera('aaa::offline_creds_expiration')
|
||||
override_homedir string hiera('aaa::override_homedir', undef)
|
||||
ssh_authorized_keys hash hiera_hash('aaa::sshkeys', {})
|
||||
sssd_debuglevel int hiera('aaa::sssd_debuglevel')
|
||||
sudo_rules (Hiera only) list hiera_array('aaa::sudo_rules', [])
|
||||
support_afs bool hiera('aaa::support_afs'),
|
||||
use_bastions bool hiera('aaa::use_bastions', undef)
|
||||
users list hiera_array('aaa::users', [])
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``admins``
|
||||
~~~~~~~~~~
|
||||
|
||||
A list of user and/or group names. The users as well as the members of the groups
|
||||
can log in on the system and have full root privileges via sudo.
|
||||
|
||||
Group names must be prefixed with ``%``.
|
||||
|
||||
Example::
|
||||
|
||||
aaa::admins:
|
||||
- 'markushin'
|
||||
- 'gsell'
|
||||
- 'barabas'
|
||||
- '%unx-linux_support'
|
||||
|
||||
Also see `users`_.
|
||||
|
||||
|
||||
``allow_sudoers_d``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This boolean controls whether the files in ``/etc/sudoers.d`` are taken
|
||||
into account by sudo.
|
||||
|
||||
|
||||
``bastions``
|
||||
~~~~~~~~~~~~
|
||||
|
||||
A list of FQDNs. If `use_bastions`_ is true, then root logins are only allowed
|
||||
from the hosts on this list. *Note*: If the list is empty, login is unrestricted
|
||||
again!
|
||||
|
||||
Example::
|
||||
|
||||
aaa::bastions:
|
||||
- 'gpfs-node1.psi.ch'
|
||||
- 'gpfs-node2.psi.ch'
|
||||
- 'gpfs-node3.psi.ch'
|
||||
- 'wmgt01.psi.ch'
|
||||
- 'wmgt02.psi.ch'
|
||||
|
||||
``create_homes``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
This boolean controls whether home directories are created on login when
|
||||
necessary. This only works if the underlying filesystem allows it. In
|
||||
particular, it does not work on AFS.
|
||||
|
||||
Also see `override_homedir`_.
|
||||
|
||||
|
||||
``cache_creds``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This boolean controls whether sssd caches credentials.
|
||||
|
||||
Also see `offline_creds_expiration`_.
|
||||
|
||||
|
||||
``enable_ad``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
Determines whether the system will be configured for Active Directory
|
||||
authentication.
|
||||
|
||||
|
||||
``enable_eaccounts``
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Setting this to ``true`` enables the Active Directory OU containing the
|
||||
e-accounts.
|
||||
|
||||
|
||||
``enable_slurm``
|
||||
~~~~~~~~~~~~~~~~
|
||||
When set to ``true``, we allow slurm users to login on computing nodes in where
|
||||
their jobs are running. Otherwise, users are not allowed to login in the computing
|
||||
nodes.
|
||||
|
||||
To enable this behaviour, someone needs to call directly the ``profile::aaa`` class
|
||||
and enable this feature, but also needs to change the call of the ``role::base``
|
||||
class by setting ``include_aaa`` to ``false``. For example::
|
||||
|
||||
class {
|
||||
'role::base':
|
||||
include_aaa => false;
|
||||
'profile::aaa':
|
||||
support_afs => hiera('base::enable_afs'),
|
||||
enable_slurm => true;
|
||||
'slurm::compute':
|
||||
cluster => $cluster;
|
||||
}
|
||||
|
||||
|
||||
|
||||
``enable_ssh_allow``
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Allow users to manage access to the system bypassing Puppet by adding usernames
|
||||
to ``/etc/security/ssh.allow.user``. This file is never touched by Puppet.
|
||||
Documentation can be found in :manpage:`pam_listfile(8)` or
|
||||
``/etc/security/ssh.allow.README`` on the target system.
|
||||
|
||||
|
||||
``enable_tier3_ldap``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
When set to ``true``, sssd.conf is configured to support only OpenLDAP for
|
||||
the Tier3. Other domains (Active Directory D.PSI.CH and LDAP SLS.PSI.CH) are
|
||||
not included in the configuration file.
|
||||
|
||||
|
||||
``ldap_enabled``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
This boolean controls whether LDAP (AD) is used for user information and
|
||||
authentication.
|
||||
|
||||
In this case the following port have to be accessible from the host to the
|
||||
domain controllers:
|
||||
|
||||
- 389/TCP
|
||||
- 389/UDP
|
||||
- 88/TCP
|
||||
- 88/UDP
|
||||
- 464/UDP
|
||||
|
||||
|
||||
|
||||
``offline_creds_expiration``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This integer controls for how many days cached credentials are valid after the
|
||||
last successful online login. A value of 0 means that there is no limit.
|
||||
|
||||
Also see `cache_creds`_.
|
||||
|
||||
|
||||
``override_homedir``
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This string defines the home directory path to use as expected by sssd's
|
||||
``override_homedir`` option. See :manpage:`sssd.conf(5)` for details.
|
||||
|
||||
Example::
|
||||
|
||||
aaa::override_homedir: '/home/%u'
|
||||
|
||||
|
||||
``sshkeys``
|
||||
~~~~~~~~~~~
|
||||
|
||||
A hash of hashes, each of which contains the parameters as accepted by the
|
||||
`ssh_authorized_key
|
||||
<https://docs.puppet.com/puppet/latest/types/ssh_authorized_key.html>`_ resource
|
||||
type.
|
||||
|
||||
Example::
|
||||
|
||||
aaa::sshkeys:
|
||||
'root@ra':
|
||||
user: 'root'
|
||||
type: 'ssh-dss'
|
||||
key: 'AAAAB3Nz...'
|
||||
|
||||
Keep in mind that this only works if the user's home directory is accessible to
|
||||
root. In particular, it doesn't work if the home is on AFS.
|
||||
|
||||
|
||||
``sssd_debuglevel``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This integer configures sssd's ``debug_level`` option (see
|
||||
:manpage:`sssd.conf(5)`). It is rarely necessary to use this setting, as the
|
||||
debug level can be changed at runtime using :manpage:`sss_debuglevel(8)`.
|
||||
|
||||
|
||||
``sudo_rules``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
A list of strings taken from Hiera containing additional sudo rules.
|
||||
|
||||
|
||||
``support_afs``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Configure PAM and related tools which are necessary for running AFS.
|
||||
|
||||
|
||||
``use_bastions``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
This parameter determines whether root logins are only possible from the hosts
|
||||
listed in `bastions`_. Normally the value is taken from the network property of
|
||||
the same name, but this parameter allows overriding the network setting through
|
||||
Hiera or in Puppet manifests.
|
||||
|
||||
|
||||
``users``
|
||||
~~~~~~~~~
|
||||
|
||||
A list of user and/or group names. The users as well as the members of the
|
||||
groups can log in on the system.
|
||||
|
||||
Group names must be prefixed with ``%``.
|
||||
|
||||
Also see `admins`_.
|
||||
|
||||
|
||||
``ssh_authorized_key``
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
A hash containing SSH public keys as expected by the ``ssh_authorized_key``
|
||||
Puppet resource.
|
||||
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
The base role includes this profile by default. If you need to customize the
|
||||
profile, do it like this::
|
||||
|
||||
class role::some_role () {
|
||||
class {'role::base':
|
||||
include_aaa => false,
|
||||
...
|
||||
}
|
||||
|
||||
class {'profile::aaa':
|
||||
override_homedir => '/localhomes/%u',
|
||||
create_homes => true,
|
||||
...
|
||||
}
|
||||
...
|
||||
|
||||
|
||||
Implementation Notes
|
||||
--------------------
|
||||
|
||||
|
||||
User/Group Enumeration
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
User/group enumeration happens when using the ``{set,get,end}pwent`` and
|
||||
``{set,get,ent}grent`` APIs to enumerate all users or groups. These are used by
|
||||
``getent passwd`` and ``gentent group`` for example, when not providing a
|
||||
specific user or group to query.
|
||||
|
||||
Enumeration would potentially be very slow and put a high load on the AD domain
|
||||
controllers if it were to return all users/groups from AD. To prevent this, we
|
||||
disable enumeration for AD accounts using the ``enumerate`` setting in
|
||||
:manpage:`sssd.conf(5)`. This means that enumeration using the APIs/programs
|
||||
above only returns local users and groups.
|
||||
|
||||
|
||||
The ``min_id`` issue
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
There are Unix groups in AD at PSI with very low GIDs, the lowest being 101
|
||||
(``unx-fkt``). This leads to problems, because :manpage:`sssd(8)` ignores users
|
||||
and groups with GIDs lower than ``min_id`` (from :manpage:`sssd.conf(5)`), which
|
||||
has a value of 500 by default.
|
||||
|
||||
Therefore we set ``min_id`` to 100. One consequence is that there is overlap
|
||||
between the IDs considered by sssd when querying AD, and the ID range for system
|
||||
users and groups (``[SYS_]ID_{MIN,MAX}``) as defined in
|
||||
:manpage:`login.defs(5)`.
|
||||
|
||||
When creating system groups, :manpage:`groupadd` scans **all** GIDs from
|
||||
``SYS_GID_MAX`` to ``SYS_GID_MIN``. This causes a number of requests to AD,
|
||||
which is usually not a problem but can be, if those take a long time to
|
||||
complete. This used to happen without the ``ad_enabled_domains`` setting for
|
||||
example. ``sssd`` would query ``d.ethz.ch`` in addition to ``d.psi.ch``, which
|
||||
would time out after a few seconds.
|
||||
|
||||
|
||||
PAM details
|
||||
~~~~~~~~~~~
|
||||
|
||||
There have been discussions to move :manpage:`pam_access` to the ``auth``
|
||||
section (from the ``account`` section) to prevent information leakage for
|
||||
accounts that can't even log in: an attacker would get a different error message
|
||||
depending on whether the password was wrong or whether :manpage:`pam_access`
|
||||
didn't allow access.
|
||||
|
||||
The problem is that when using Kerberos authentication, sshd does not use PAM
|
||||
for authentication, circumventing :manpage:`pam_access`. Hence, just moving the
|
||||
latter from ``account`` to ``auth`` does not work.
|
||||
|
||||
|
||||
Kerberos ticket/AFS token renewal
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Kerberos tickets and AFS tokens are automatically renewed for as long as
|
||||
possible. This is done by running a :manpage:`krenew` for every session in the
|
||||
background.
|
||||
|
||||
@@ -0,0 +1,51 @@
|
||||
``profile::afs_client``
|
||||
============================
|
||||
|
||||
This module installs and configures the OpenAFS client.
|
||||
|
||||
On systems using AFS it is necessary to have the AFS kernel module for the
|
||||
running kernel installed. This module installs the AFS kernel module for
|
||||
**every** installed kernel (usually up to 3). Therefore it is recommended to run
|
||||
Puppet after (kernel) updates.
|
||||
|
||||
Note: Simply including this profile is usually **not** enough to enable AFS on a
|
||||
system. It is also necessary to enable AFS support when including
|
||||
``profile::aaa``. The latter makes sure that AD is used for authentication and
|
||||
configures PAM to automatically create and renew AFS tokens.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
enable_dynroot bool hiera('afs_client::enable_dynroot')
|
||||
min_cache_size int hiera('afs_client::min_cache_size')
|
||||
mountpoint string hiera('afs_client::mountpoint')
|
||||
root_volume string hiera('afs_client::root_volume')
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``enable_dynroot``
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
|
||||
``min_cache_size``
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The minimum size for the local AFS cache. If the cache is smaller than this,
|
||||
Puppet will try to resize the logical volume =lv_openafs=, otherwise Puppet will
|
||||
leave it alone.
|
||||
|
||||
|
||||
``mountpoint``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
Defines the mountpoint for the AFS filesystem.
|
||||
|
||||
|
||||
``root_volume``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
The name of the root volume to mount.
|
||||
@@ -0,0 +1,23 @@
|
||||
``profile::autofs``
|
||||
===================
|
||||
|
||||
This profile enables the ``autofs`` service. For normal automounts this is not
|
||||
necessary, as they can be implemented using systemd, but this module can enable
|
||||
the autofs ``-hosts`` map.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
install_auto_master bool hiera('autofs::install_auto_master', true)
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``autofs::install_auto_master``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
If this variable is true, the profile will create an ``/etc/auto.master`` file
|
||||
enabling the ``-hosts`` map on ``/net``.
|
||||
@@ -0,0 +1,40 @@
|
||||
``profile::custom_timers``
|
||||
==========================
|
||||
|
||||
This profile is a defined type to define systemd timers together with the corresponding service.
|
||||
|
||||
The resources are defined using the ``systemd::service`` and ``system::service``.
|
||||
The service is defined as type simple and it it has dependency (``Wants`` and ``After``) from
|
||||
the ``network-online.target``.
|
||||
|
||||
|
||||
The defined type is used from ``role::base`` to create the resources
|
||||
defined in the ``base::timers`` hiera hash.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
description String
|
||||
command String
|
||||
on_calendar String
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``description``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Human-oriented description of the service and timer.
|
||||
|
||||
``command``
|
||||
~~~~~~~~~~~
|
||||
|
||||
Path to the command to invoke into the service. It should be an absolute path
|
||||
and a check is performed against this.
|
||||
|
||||
``on_calendar``
|
||||
~~~~~~~~~~~~~~~
|
||||
The definition of the timer execution time. See `OnCalendar` on systemd.timer(5).
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
``profile::epics``
|
||||
==================
|
||||
|
||||
Install and configure Epics.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
============ ======== ===========
|
||||
**Name** **Type** **Default**
|
||||
------------ -------- -----------
|
||||
epics_func string -
|
||||
============ ======== ===========
|
||||
|
||||
|
||||
``epics_func``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
A command written to ``/etc/epics_func.conf``, followed by ``>/dev/null``.
|
||||
@@ -0,0 +1,37 @@
|
||||
``profile::filecopy``
|
||||
=====================
|
||||
|
||||
This module allows to copy file on the host using a git repository as
|
||||
the source.
|
||||
|
||||
The purpose of this module is to distribute files that are not
|
||||
created/configured with other modules, usually files very specific
|
||||
eg. scripts for very specific environments.
|
||||
|
||||
With this module is possible to specifiy only single files, so no
|
||||
directory or recursion is possible.
|
||||
|
||||
The source files are taken from the master branch of a git repo that
|
||||
should be accessible without authentication. Or anyway accessible from
|
||||
the host where the files have to be copied (eg. via a proper ssh key).
|
||||
|
||||
A section like the following in hiera will copy on file ``/tmp/test1``
|
||||
the content of
|
||||
``https://git.psi.ch/talamo_i/copy-file-test/raw/master/abc``::
|
||||
|
||||
filecopy::files:
|
||||
'/tmp/test1':
|
||||
repo: 'talamo_i/copy-file-test'
|
||||
path: 'abc'
|
||||
mode: '0600'
|
||||
owner: 'talamo_i'
|
||||
|
||||
You can additionally specify the group owner of the file:
|
||||
group: 'apache'
|
||||
|
||||
|
||||
This module is included by default and ``filecopy::files`` is empty by
|
||||
default.
|
||||
|
||||
To copy files just define properly the ``filecopy::files`` variable.
|
||||
|
||||
@@ -0,0 +1,27 @@
|
||||
``profile::files``
|
||||
==================
|
||||
|
||||
This profile creates symlinks.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
symlinks hash hiera('files::symlinks')
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``symlinks``
|
||||
~~~~~~~~~~~~
|
||||
|
||||
A hash specifying symlinks to be created. The keys of the hash are the absolute
|
||||
pathnames of the symlinks, the values of the hash are the corresponding symlink
|
||||
targets.
|
||||
|
||||
Example::
|
||||
|
||||
files::symlinks:
|
||||
'/opt/foo': '/var/lib/foo'
|
||||
@@ -0,0 +1,36 @@
|
||||
``profile::ganglia_client``
|
||||
============================
|
||||
|
||||
This module installs and configures Ganglia's gmond.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
grid string hiera('ganglia::grid')
|
||||
cluster string hiera('ganglia_client::cluster')
|
||||
n/a hash hiera('ganglia::grid_${GRID}')
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``grid``
|
||||
~~~~~~~~
|
||||
|
||||
The name of the Ganglia grid the client is a part of.
|
||||
|
||||
|
||||
``cluster``
|
||||
~~~~~~~~~~~
|
||||
|
||||
The name of the Ganglia cluster within the grid the client is a part of.
|
||||
|
||||
|
||||
``grid_${GRID}``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
The definition of the grid. See the :doc:`ganglia_server documentation
|
||||
<../profiles/ganglia_server>` for details.
|
||||
|
||||
@@ -0,0 +1,104 @@
|
||||
``profile::ganglia_server``
|
||||
===========================
|
||||
|
||||
This module configures the following Ganglia server components:
|
||||
|
||||
- the web interface (using Apache)
|
||||
- one gmond for each cluster to be monitored by this server
|
||||
|
||||
The latter is a little unusual. Normally, the gmonds collecting the data for
|
||||
each cluster, which are then queried by gmetad, are part of the cluster. The
|
||||
implementation chosen by this module makes it easier to deal with firewalls.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
grid string hiera('ganglia::grid')
|
||||
grid_${GRID} hash hiera('ganglia::grid_${GRID}')
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``grid``
|
||||
~~~~~~~~
|
||||
|
||||
This string identifies the grid (ie the collection of clusters) this server
|
||||
monitors. The definition of the grid is taken from the Hiera value
|
||||
``grid_${GRID}``.
|
||||
|
||||
|
||||
``grid_${GRID}``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
The definition of the Ganglia grid this server is responsible for. It is a hash
|
||||
containing the following keys:
|
||||
|
||||
|
||||
``name``
|
||||
,,,,,,,,
|
||||
|
||||
The name of the grid as used in the web interface.
|
||||
|
||||
|
||||
``ui``
|
||||
,,,,,,
|
||||
|
||||
The FQDN of the server hosting the web UI and collecting the data for the grid.
|
||||
A system with role ``ganglia_server`` will compare its own FQDN to this value
|
||||
and fail if they are not equal. Clients will need this value to know where they
|
||||
they should send their metrics.
|
||||
|
||||
|
||||
``clusters``
|
||||
,,,,,,,,,,,,
|
||||
|
||||
A hash of cluster definitions. The keys are the IDs of the clusters, ie. what a
|
||||
client expects to find in ``ganglia::cluster``. The values are hashes containing
|
||||
the following attributes:
|
||||
|
||||
``name``
|
||||
........
|
||||
|
||||
The user-friendly name of the cluster to be used in the web UI.
|
||||
|
||||
``port``
|
||||
........
|
||||
|
||||
The port used within the cluster. The first cluster should use 8649 (the Ganglia
|
||||
standard port), the next cluster should use 8650, and so on.
|
||||
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
Suppose we have a Ganglia grid for Swissfel (sysdb_env == swissfel).
|
||||
The we could put the following in Hiera.
|
||||
|
||||
In ``swissfel.yaml`` we would define grid, say ``sfel``, and set the grid for
|
||||
all systems in the ``swissfel`` environment to ``sfel``::
|
||||
|
||||
|
||||
ganglia::grid: 'sfel'
|
||||
|
||||
ganglia::grid_sfel:
|
||||
name: 'SwissFEL'
|
||||
ui: 'gmeta00.psi.ch'
|
||||
clusters:
|
||||
'sf-daqbuf':
|
||||
name: 'DAQ Buffers'
|
||||
port: 8649
|
||||
'sf-athos'
|
||||
name: 'Athos Beamline Systems'
|
||||
port: 8650
|
||||
|
||||
In the ``swissfel/daqbuf.yaml`` we would then set the cluster to ``sf-daqbuf``::
|
||||
|
||||
ganglia::cluster: 'sf-daqbuf'
|
||||
|
||||
In ``swissfel/athos.yaml`` on the other hand, we would set the cluster to
|
||||
``sf-athos``::
|
||||
|
||||
ganglia::cluster: 'sf-athos'
|
||||
@@ -0,0 +1,46 @@
|
||||
``profile::gnome``
|
||||
==================
|
||||
|
||||
This module installs and configures the Gnome desktop environment.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
banner_message string
|
||||
enable_update_notifications bool
|
||||
favorites list
|
||||
keyboard_layouts list
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``banner_message``
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The message displayed above the login prompt.
|
||||
|
||||
|
||||
``enable_update_notifications``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Whether or not ``gnome-software`` is started at the beginning of a session to
|
||||
notify the user about available updates.
|
||||
|
||||
|
||||
``favorites``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
The applications/directories/etc to be displayed in the *Favorites* menu and/or
|
||||
the Gnome dock. Each member of the list must be a string containing the full
|
||||
name (not path!) of the ``.desktop`` file, eg. ``gnome-terminal.desktop`` for
|
||||
the Gnome Terminal.
|
||||
|
||||
|
||||
``keyboard_layouts``
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
A list of the keyboard mappings which should be available on the login screen.
|
||||
The first mapping in the list is the default.
|
||||
@@ -0,0 +1,91 @@
|
||||
``profile::gpfs``
|
||||
=================
|
||||
|
||||
Install and configure the `GPFS parallel file system
|
||||
<https://en.wikipedia.org/wiki/IBM_General_Parallel_File_System>`_.
|
||||
|
||||
The installation also includes the configuration of the rpm repositories.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================= ========== ===========
|
||||
**Name** **Type** **Default**
|
||||
----------------- ---------- -----------
|
||||
version string
|
||||
repo_base_url string
|
||||
setup_repos bool true
|
||||
setup_pmsensors bool true
|
||||
setup_pmcollector bool false
|
||||
setup_ces bool false
|
||||
setup_gui bool false
|
||||
fs_opts hash empty hash
|
||||
================= ========== ===========
|
||||
|
||||
|
||||
``version``
|
||||
~~~~~~~~~~~
|
||||
|
||||
The version of GPFS to install.
|
||||
|
||||
|
||||
``repo_base_url``
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
The base URL of the GPFS repositories. Each version of GPFS comes in its own
|
||||
repositories, which are assumed to be located under
|
||||
``${repo_base_url}/${version}/``.
|
||||
|
||||
Repository configuration is subject to `setup_repos`_.
|
||||
|
||||
|
||||
``setup_repos``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Whether or not to configure the GPFS repositories.
|
||||
|
||||
|
||||
``setup_pmsensors``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Install packages needed to run the pmsensors service.
|
||||
|
||||
``setup_pmcollector``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Install packages needed to run the pmcollector service.
|
||||
|
||||
``setup_ces``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
|
||||
``setup_gui``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
Install packages needed to run the gpfsgui service.
|
||||
|
||||
``fs_opts``
|
||||
~~~~~~~~~~~
|
||||
|
||||
By default a GPFS filesystem will be mounted on all nodes of
|
||||
the cluster with the same option, eg. it will be read-write if
|
||||
the filesystem as been defined with read-write access (see ``mmfs``
|
||||
for the mount options).
|
||||
|
||||
It is possible to override these option on a host specific base
|
||||
configuring a file named ``/var/mmfs/etc/localMountOptions.<filesystem>``
|
||||
with one option per line.
|
||||
|
||||
Please note that even if the parameter is ``fs_opts`` in the code,
|
||||
the hiera variable is called ``fs_mount_opts``.
|
||||
|
||||
The following hiera code can be used to make the ``beamline`` filesystem
|
||||
mounted in read-only mode::
|
||||
|
||||
gpfs::fs_mount_opts:
|
||||
'beamline': ['ro']
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,65 @@
|
||||
``profile::grafana``
|
||||
============================
|
||||
|
||||
This module installs and configures Grafana server.
|
||||
It requires a SSL cert/key since the server will be provided over HTTPS.
|
||||
|
||||
The system uses AD authentication for users and allows anonymous user
|
||||
with view-only capabilities.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
vhost string hiera('grafana::vhost', FQDN)
|
||||
servers array hiera('grafana::influxdb_servers')
|
||||
admin_groups array hiera('grafana::admin_groups')
|
||||
editor_groups array hiera('grafana::editor_groups')
|
||||
admin_pw string hiera('grafana::admin_pw')
|
||||
cert string hiera('grafana::tls_cert')
|
||||
key string hiera('grafana::tls_key')
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``vhost``
|
||||
~~~~~~~~
|
||||
|
||||
The hostname through which the server will provide http/https service.
|
||||
By default it corresponds to the FQDN, but in case of aliases or Round-Robin DNS it can be different.
|
||||
|
||||
``servers``
|
||||
~~~~~~~~~~~
|
||||
|
||||
A list of influx db servers url to query for data.
|
||||
Each server should be specified with a URL like ``http://hostname:8086``.
|
||||
|
||||
The list of services will be queried to get the list of available databases and
|
||||
the corresponding data sources will be automatically created.
|
||||
The generation of the data sources happens when the list of server files or automatically every day.
|
||||
|
||||
``admin_groups``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
The list of unix groups that will have full (admin) rights when logging into the server.
|
||||
See `this <http://docs.grafana.org/installation/ldap/>`_ for further details.ls.
|
||||
|
||||
``editor_groups``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
The list of unix groups that will have editor rights when logging into the server.
|
||||
See `this <http://docs.grafana.org/installation/ldap/>`_ for further details.
|
||||
|
||||
``admin_pw``
|
||||
|
||||
Password of the ``admin`` user.
|
||||
|
||||
``cert``
|
||||
|
||||
SSL public certificate of the HTTPS server.
|
||||
|
||||
``key``
|
||||
|
||||
Private key matching with the SSL certificate.
|
||||
@@ -0,0 +1,15 @@
|
||||
``profile::icewm``
|
||||
==================
|
||||
|
||||
This profile installs and configures the IceWM window manager.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
toobar_apps hash hiera('icewm::toolbar::apps', {})
|
||||
menu_apps hash hiera('icewm::menu::apps', {})
|
||||
=============================== ======== ================================================
|
||||
@@ -0,0 +1,41 @@
|
||||
``profile::icinga::checks::gpfs``
|
||||
========================================
|
||||
|
||||
This profile is called when ``gpfs`` is being configured.
|
||||
|
||||
Setup specific checks for GPFS:
|
||||
* It will check that **GPFS** service is running correctly.
|
||||
* Also checks node status with ``mmhealth``.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=================== ========== =============================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------- ---------- -------------------------------------------------------------
|
||||
check_unhealth_only Boolean ``icinga::checks::options::gpfs::ignoretips:`` **``true``**
|
||||
check_ignore_tips Boolean ``icinga::checks::options::gpfs::unhealth:`` **``false``**
|
||||
=================== ========== =============================================================
|
||||
|
||||
``check_unhealth_only``
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
By default ``mmhealth`` is called with the option ``--unhealth``. This shows only **unhealthy** problems. This can be disabled
|
||||
by setting ``icinga::checks::options::gpfs::unhealth: false``, in this case ``mmhealth`` will also report about **healthy** checks.
|
||||
|
||||
|
||||
``check_ignore_tips``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
**TIPS** errors are considered ``[WARNING]`` by default. As these are configuration tips, some admins can consider that tips are ``[OK]``
|
||||
in their clusters. This behaviour can be changed by setting ``icinga::checks::options::gpfs::ignoretips: true``, which will consider **TIPS** as ``[OK]``.
|
||||
|
||||
Facts
|
||||
-----
|
||||
|
||||
When some specific facts are detected, it will trigger some actions.
|
||||
|
||||
===================================== =============== ==============================================
|
||||
**Fact** **Value(s)** **Action description**
|
||||
------------------------------------- --------------- ----------------------------------------------
|
||||
===================================== =============== ==============================================
|
||||
@@ -0,0 +1,29 @@
|
||||
``profile::icinga::checks::hp::smart_array``
|
||||
========================================
|
||||
|
||||
This profile is automatically called when a HP Smart Array is detected through facter from the
|
||||
``profile::platform::hewlett_packard`` class.
|
||||
|
||||
Setup checks for HP Smart Arrray.
|
||||
* Will setup a check executing ``ssacli`` in order to check the following components:
|
||||
* **Controller(s)** status, **Cache** status (when configured) & **Battery** status (when present)
|
||||
* **Logical Drive(s)** status
|
||||
* **Physical Drive(s)** status
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================= ========== =========================================================
|
||||
**Name** **Type** **Default**
|
||||
----------------- ---------- ---------------------------------------------------------
|
||||
================= ========== =========================================================
|
||||
|
||||
Facts
|
||||
-----
|
||||
|
||||
When some specific facts are detected, it will trigger some actions.
|
||||
|
||||
===================================== =============== ==============================================
|
||||
**Fact** **Value(s)** **Action description**
|
||||
------------------------------------- --------------- ----------------------------------------------
|
||||
===================================== =============== ==============================================
|
||||
@@ -0,0 +1,31 @@
|
||||
``profile::icinga::checks::nvidia``
|
||||
========================================
|
||||
|
||||
This profile is called when ``nvidia`` is being configured through ``cuda``
|
||||
|
||||
Setup specific checks for the Puppet Client:
|
||||
* It will check that ``nvidia-smi`` correctly responds with the NVIDIA GPU cards.
|
||||
When kernel is updated, it may cause to boot up with the NVIDIA drivers.
|
||||
|
||||
It will return OK and the list of GPUS when ``nvidia-smi`` correctly answers.
|
||||
It will return CRITICAL and the error message when ``nvidia-smi`` is unable to detect GPU cards.
|
||||
|
||||
Most probably in the future drivers will be directly checked.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================== ========== =============================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------ ---------- -------------------------------------------------------------
|
||||
================== ========== =============================================================
|
||||
|
||||
Facts
|
||||
-----
|
||||
|
||||
When some specific facts are detected, it will trigger some actions.
|
||||
|
||||
===================================== =============== ==============================================
|
||||
**Fact** **Value(s)** **Action description**
|
||||
------------------------------------- --------------- ----------------------------------------------
|
||||
===================================== =============== ==============================================
|
||||
@@ -0,0 +1,33 @@
|
||||
``profile::icinga::checks::puppet_client``
|
||||
========================================
|
||||
|
||||
This profile is called when ``puppet`` client is being configured.
|
||||
|
||||
Setup specific checks for the Puppet Client:
|
||||
* It will check that the current running environment is ``puppet_environment``.
|
||||
Otherwise it will return a **nagios** ``WARNING`` message and error.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================== ========== =============================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------ ---------- -------------------------------------------------------------
|
||||
puppet_environment String hiera('icinga::checks::options::puppet_environment',**prod**)
|
||||
================== ========== =============================================================
|
||||
|
||||
``puppet_environment``
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This setting defaults to the puppet environment ``prod``. Can be changed from YAML by setting
|
||||
``icinga::checks::options::puppet_environment`` to a different value.
|
||||
|
||||
Facts
|
||||
-----
|
||||
|
||||
When some specific facts are detected, it will trigger some actions.
|
||||
|
||||
===================================== =============== ==============================================
|
||||
**Fact** **Value(s)** **Action description**
|
||||
------------------------------------- --------------- ----------------------------------------------
|
||||
===================================== =============== ==============================================
|
||||
@@ -0,0 +1,35 @@
|
||||
``profile::icinga::checks::service``
|
||||
==========================================
|
||||
|
||||
This class will configure Nagios checks for one or more ``systemctl`` services. This can be done by setting
|
||||
a list of services with the ``icinga::checks::service::list`` *hiera* setting. ``check_service`` is the
|
||||
script that will be in charge for that, which is also used by other Nagios scripts (i.e. ``check_slurm`` &
|
||||
``check_gpfs``) to check specific services for these alarms.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
===================== ========== =========================================================================
|
||||
**Name** **Type** **Default**
|
||||
--------------------- ---------- -------------------------------------------------------------------------
|
||||
service_list Array ``'icinga::checks::service::list'``, defaults to ``'[]'``
|
||||
===================== ========== =========================================================================
|
||||
|
||||
``service_list``
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The default value is an empty ``Array`` (``'[]'``). Hence, no ``systemctl`` services are checked.
|
||||
This value can be overwritten with a list of services. In example::
|
||||
icinga::checks::service::list:
|
||||
- ntpd
|
||||
- postfix
|
||||
|
||||
Facts
|
||||
-----
|
||||
|
||||
When some specific facts are detected, it will trigger some actions.
|
||||
|
||||
===================================== =============== ==============================================
|
||||
**Fact** **Value(s)** **Action description**
|
||||
------------------------------------- --------------- ----------------------------------------------
|
||||
===================================== =============== ==============================================
|
||||
@@ -0,0 +1,87 @@
|
||||
``profile::icinga::checks::slurm``
|
||||
==========================================
|
||||
|
||||
This profile should be called when **Slurm** (server, cn, ui) is being configured.
|
||||
|
||||
Setup specific checks for Slurm nodes:
|
||||
* It can check ``slurmd`` service. This check makes sense on computing nodes running ``slurmd``.
|
||||
* It can check ``munge`` service. This check makes sense on any node with a configured **Slurm** client/server.
|
||||
* It can check ``slurmctld`` service. This check makes sense on server nodes, will disable ``slurmd`` check.
|
||||
* It can check ``slurmdbd`` service. This check makes sense on server nodes.
|
||||
* It can check ``sinfo`` status, detecting miss-behaving nodes.
|
||||
|
||||
By default, since the most common node in a **Slurm** cluster is a computing node, this check will report about
|
||||
``slurmd`` and ``munge`` status.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
===================== ========== =========================================================================
|
||||
**Name** **Type** **Default**
|
||||
--------------------- ---------- -------------------------------------------------------------------------
|
||||
skip_munge Boolean ``icinga::checks::options::slurm::skip_munge`` **``false``**
|
||||
skip_slurmd Boolean ``icinga::checks::options::slurm::skip_slurmd``: **``false``**
|
||||
check_slurmdbd Boolean ``icinga::checks::options::slurm::check_slurmdbd`` **``false``**
|
||||
check_slurmctld Boolean ``icinga::checks::options::slurm::check_slurmctld`` **``false``**
|
||||
ignore_draining Boolean ``icinga::checks::options::slurm::ignore_draining`` **``false``**
|
||||
ignore_drained Boolean ``icinga::checks::options::slurm::ignore_drained`` **``false``**
|
||||
check_nodes Boolean ``icinga::checks::options::slurm::check_nodes`` **``false``**
|
||||
no_reason Boolean ``icinga::checks::options::slurm::no_reason`` **``true``**
|
||||
no_timestamp Boolean ``icinga::checks::options::slurm::no_timestamp`` **``false``**
|
||||
===================== ========== =========================================================================
|
||||
|
||||
``skip_munge``
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
By default ``munge`` service is checked. Can be disabled by setting ``icinga::checks::options::slurm::skip_munge: false``.
|
||||
|
||||
``skip_slurmd``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
By default ``slurmd`` service is checked. Can be disabled by setting ``icinga::checks::options::slurm::skip_slurmd: false``.
|
||||
|
||||
|
||||
``check_slurmdbd``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
By default ``slurmdbd`` service is disabled. Can be enabled by setting ``icinga::checks::options::slurm::check_slurmdbd: true``.
|
||||
|
||||
``check_slurmctld``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
By default ``slurmctld`` service is disabled. Can be enabled by setting ``icinga::checks::options::slurm::check_slurmctld: true``, in this case ``icinga::checks::options::slurm::skip_slurmd``
|
||||
should be also set to ``true``.
|
||||
|
||||
`ignore_draining``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
By default nodes in ``draining`` state are checked and will be reported as ``[WARNING]``. This can be disabled by setting ``icinga::checks::options::slurm::ignore_draining: true``.
|
||||
When set to ``true``, ``draining`` nodes will be reported anyway but will be considered as ``[OK]``
|
||||
|
||||
``ignore_drained``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
By default nodes in ``drained`` state are checked and will be reported as ``[WARNING]``. This can be disabled by setting ``icinga::checks::options::slurm::ignore_drained: true``.
|
||||
When set to ``true``, ``drained`` nodes will be reported anyway but will be considered as ``[OK]``
|
||||
|
||||
``no_reason``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
By default **no** ``Reason`` is reported. This is because it will add extra text to the alarm output when nodes are ``drained``/``draining``/``down``/``failed``.
|
||||
Printing ``Reason`` can be turned on by setting ``icinga::checks::options::slurm::no_reason: false``.
|
||||
|
||||
``no_timestamp``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
By default ``Timestamp`` is being reported. Timestamp shows the date and time when a node was set ``drained``/``draining``/``down``/``failed``.
|
||||
As this setting adds extra text in the alarm, it can be disabled by setting ``icinga::checks::options::slurm::no_reason: true``.
|
||||
|
||||
Facts
|
||||
-----
|
||||
|
||||
When some specific facts are detected, it will trigger some actions.
|
||||
|
||||
===================================== =============== ==============================================
|
||||
**Fact** **Value(s)** **Action description**
|
||||
------------------------------------- --------------- ----------------------------------------------
|
||||
===================================== =============== ==============================================
|
||||
@@ -0,0 +1,56 @@
|
||||
``profile::icinga::client``
|
||||
==========================
|
||||
|
||||
This profile installs and configured the ``nrpe`` service:
|
||||
* Installs ``mod_gearman-static``, ``nrpe-selinux``, ``nrpe``
|
||||
* Instals Nagios plugins: ``nagios-plugins-disk``, ``nagios-plugins-load``
|
||||
* Manages the NRPE service and ensures that is ``running`` and ``enabled``
|
||||
* Allows to configure the ``nrpe.cfg`` file with the ``icinga::client::servers`` setting which defaults to ``[ 'emonma00.psi.ch','wmonag00.psi.ch','emonag00.psi.ch' ]`` (default value on fresh *nrpe* installations)
|
||||
* SELinux policy setup to allow ``nagios_run_sudo``.
|
||||
|
||||
Is strictly important to set up ``aaa::allow_sudoers_d`` to ``true``::
|
||||
``aaa::allow_sudoers_d: true``
|
||||
|
||||
By setting ``allow_sudoers_d`` to ``true``, we enable by default the
|
||||
use of the directory ``/etc/sudoers.d/``. This will required for some Nagios
|
||||
alarms.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================= ========== =========================================================
|
||||
**Name** **Type** **Default**
|
||||
----------------- ---------- ---------------------------------------------------------
|
||||
servers Array hiera('icinga::client::servers')
|
||||
blame Array hiera('icinga::client::dont_blame_nrpe', 0)
|
||||
================= ========== =========================================================
|
||||
|
||||
``servers``
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
The local parameter for ``icinga::client::servers`` is ``servers``. Defaults to ``[ 'emonma00.psi.ch','wmonag00.psi.ch','emonag00.psi.ch' ]``
|
||||
which is the default value in the ``nrpe.cfg`` file on fresh ``nrpe`` installations. Somebody can
|
||||
overwrite this value with a new ``Array`` of Icinga servers. This ``Array`` will be converted to ``String``
|
||||
afterwards::
|
||||
|
||||
...
|
||||
Array $servers = hiera('icinga::client::servers'),
|
||||
...
|
||||
$icinga_servers = join($servers,",")
|
||||
...
|
||||
|
||||
``blame``
|
||||
~~~~~~~~~
|
||||
|
||||
With this option, the NRPE will allow clients to specify arguments in the commands. By default this is ``disabled``: arguments must be
|
||||
specified in the NRPE daemon side and not from the client side. This option modifies the setting ``dont_blame_nrpe`` in the ``nrpe.cfg`` file.
|
||||
|
||||
Facts
|
||||
-----
|
||||
|
||||
When some specific facts are detected, it will trigger some actions.
|
||||
|
||||
===================================== =============== ==============================================
|
||||
**Fact** **Value(s)** **Action description**
|
||||
------------------------------------- --------------- ----------------------------------------------
|
||||
===================================== =============== ==============================================
|
||||
@@ -0,0 +1,55 @@
|
||||
``profile::icinga::nrpe``
|
||||
==========================
|
||||
|
||||
This profile is a function that configures ``nrpe`` and ``sudoers`` (whenever needed) for a specific command:
|
||||
* Will create a ``/etc/nrpe.d/<filename>.cfg`` file for ``nrpe``
|
||||
* Will create a ``/etc/sudoers.d/<filename>`` file for ``sudoers`` (if ``sudo`` is required)
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================= ========== =========================================================
|
||||
**Name** **Type** **Default**
|
||||
----------------- ---------- ---------------------------------------------------------
|
||||
command String
|
||||
sudo Boolean ``false``
|
||||
notifications_enabled Boolean ``true``
|
||||
================= ========== =========================================================
|
||||
|
||||
``command``
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
Full path for the command to be configured in the ``nrpe.d`` file. This will be translated
|
||||
in the ``nrpe.d`` as::
|
||||
|
||||
# sudo = true
|
||||
command[${title}]=/usr/bin/sudo ${command}
|
||||
|
||||
# sudo = false
|
||||
command[${title}]=${command}
|
||||
|
||||
``sudo``
|
||||
~~~~~~~~~
|
||||
|
||||
Whether ``sudo`` is required or not for that command. By default is ``false``.
|
||||
When set to ``true``, ``/usr/bin/sudo`` will be added to the ``nrpe`` command, and proper
|
||||
``sudoers`` file will be configured. Example::
|
||||
|
||||
Defaults:nrpe !requiretty
|
||||
nrpe ALL=(root) NOPASSWD: ${command}
|
||||
|
||||
``notifications_enables``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Currently this settings has no effect. Will be used when exporting Nagios resources to the PuppetDB.
|
||||
Please ignore it in the meantime.
|
||||
|
||||
Facts
|
||||
-----
|
||||
|
||||
When some specific facts are detected, it will trigger some actions.
|
||||
|
||||
===================================== =============== ==============================================
|
||||
**Fact** **Value(s)** **Action description**
|
||||
------------------------------------- --------------- ----------------------------------------------
|
||||
===================================== =============== ==============================================
|
||||
@@ -0,0 +1,53 @@
|
||||
``profile::infiniband``
|
||||
=======================
|
||||
|
||||
Installs and configures the Infiniband software stack.
|
||||
|
||||
* New service ``ib-online`` is being installed, which will wait until IB gets online. The script ``/opt/pli/libexec/ib-check-active-ports`` is used for that.
|
||||
* Setup of the ``/etc/sysconfig/network-scripts/ifcfg-${ib_ifname}`` files.
|
||||
* Installation of ``/usr/local/bin/mlxup`` which is useful for checking firmware version and upgrade Mellanox IB cards directly from Mellanox.
|
||||
* OFED repository + installation of the following packages: ``ibutils``, ``infiniband-diags``, ``mlnx-ofed-basic``, ``librdmacm-devel``, ``perftest``, ``infinipath-psm``
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
========== ========= ==========================
|
||||
**Name** **Type** **Default**
|
||||
---------- --------- --------------------------
|
||||
ib_ifname string *undef*
|
||||
ib_ip string *undef*
|
||||
ib_subnet string *undef*
|
||||
repo_tag String *yum_client::repo_tag*
|
||||
ofed_vers String *infiniband::ofed_version*
|
||||
========== ========= ==========================
|
||||
|
||||
|
||||
``ib_ifname``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
The name of the Infiniband interface.
|
||||
|
||||
|
||||
``ib_ip``
|
||||
~~~~~~~~~
|
||||
|
||||
The IP to be configured on the Infiniband interface.
|
||||
|
||||
|
||||
``ib_subnet``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
The subnet to be used on the Infiniband interface in CIDR notation.
|
||||
|
||||
|
||||
``repo_tag``
|
||||
~~~~~~~~~~~~
|
||||
|
||||
Which ``yum`` ``repo_tag`` should be used. In example, ``latest`` can be used.
|
||||
|
||||
|
||||
``ofed_vers``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
OFED version to be installed and configured. Format: ``X.Y-A.B.C.D``, where X.Y is the major OFED version and
|
||||
A.B.C.D is the subversion.
|
||||
@@ -0,0 +1,138 @@
|
||||
``profile::jupyterhub``
|
||||
=====================
|
||||
|
||||
This module configures the node for running a jupyterhub service
|
||||
able to spawn singleuser servers on cluster nodes via SLURM
|
||||
|
||||
The jupyterhub software itself will not be installed by this
|
||||
module. It is expected to be found in an existing environment
|
||||
usually installed separately by ``conda`` and centrally served on a
|
||||
distributed file system (There is a reference installation in the
|
||||
environment module ``anaconda/2019.03`` within the
|
||||
``jupyterhub_dev_py36`` conda environment)
|
||||
|
||||
Supported jupyterhub versions: jupyterhub-0.96 or the current
|
||||
(as of 2019-05) development version 1.0.0b1. The development version is preferred
|
||||
due to recent fixes that enable a clean shutdown on a batch cluster.
|
||||
|
||||
Optional customization of User selectable options
|
||||
-------------------------------------------------
|
||||
|
||||
This installation uses the `optionsSpawner <https://github.com/ResearchComputing/jupyterhub-options-spawner>`_ plugin to offer user selectable
|
||||
customizations on the spawning web page. By default, a simple dialog
|
||||
with selectable partitions and runtime is offered. If a more extended
|
||||
customization page is required, the administrator can create the file
|
||||
``/etc/jupyterhub/optionsspawner_config.py`` and put additional options inside.
|
||||
The jupyterhub main configuration file ``/etc/jupyterhub/jupyterhub_config.py``
|
||||
will check whether the file exists and load it. In this way we can
|
||||
keep the puppet module more generic.
|
||||
|
||||
Some adaptions may require deeper changes to the configuration file
|
||||
and adaption of the puppet code
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
admin_users Array hiera('jupyterhub\:\:admin_users')
|
||||
api_port Integer hiera('jupyterhub\:\:api_port', 8080)
|
||||
env_setup String hiera('jupyterhub\:\:env_setup')
|
||||
group_whitelist Array hiera('jupyterhub\:\:group_whitelist')
|
||||
hub_port Integer hiera('jupyterhub\:\:hub_port', 8000)
|
||||
hub_version String hiera('jupyterhub\:\:hub_version')
|
||||
partitions Hash hiera('jupyterhub\:\:partitions')
|
||||
tls_cert String hiera('jupyterhub\:\:tls_cert')
|
||||
tls_key String hiera('jupyterhub\:\:tls_key')
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
|
||||
``admin_users``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
A list of user names. These users will get access to the jupyterhub administration
|
||||
web pages.
|
||||
|
||||
Example:
|
||||
|
||||
::
|
||||
|
||||
jupyterhub::admin_users:
|
||||
- 'feichtinger'
|
||||
- 'caubet_m'
|
||||
- 'bliven_s'
|
||||
- 'loktionova_n'
|
||||
|
||||
``api_port``
|
||||
~~~~~~~~~~~~
|
||||
|
||||
Port number of the port on which the jupyterhub API will be listening (internally
|
||||
used by jupyterhub for control communications)
|
||||
|
||||
``env_setup``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
Lines to be inserted into the bash scripts for defining the
|
||||
jupyterhub environment for both the server and the spawned client
|
||||
sessions (it is important that the server and the singleserver
|
||||
client host both run the same jupyterhub and spawner codes)
|
||||
|
||||
Example:
|
||||
|
||||
.. code:: bash
|
||||
|
||||
export PMODULES_VERSION=1.0.0rc4
|
||||
source /opt/psi/config/profile.bash
|
||||
module use unstable &> /dev/null
|
||||
module load anaconda/2019.03 &> /dev/null
|
||||
conda activate jupyterhub_dev
|
||||
|
||||
``group_whitelist``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
A list of unix groups that will be granted access to this jupyterhub.
|
||||
|
||||
Example:
|
||||
|
||||
::
|
||||
|
||||
jupyterhub::group_whitelist:
|
||||
- 'svc-cluster_merlin5'
|
||||
|
||||
``hub_port``
|
||||
~~~~~~~~~~~~
|
||||
|
||||
The main port to which clients will connect.
|
||||
|
||||
``hub_version``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Version String of jupyterhub. Currently either '0.96' or '1.0.0b2' is
|
||||
supported. Recommended: '1.0.0b2'.
|
||||
|
||||
partitions
|
||||
~~~~~~~~~~
|
||||
|
||||
SLURM partitions to be offered in the default option selection. Should be
|
||||
a mapping of partition names to descriptive strings.
|
||||
|
||||
Example:
|
||||
|
||||
::
|
||||
|
||||
jupyterhub::partitions:
|
||||
'test' : 'Test nodes'
|
||||
'merlin' : 'merlin standard'
|
||||
'gpu' : 'GPU nodes'
|
||||
|
||||
tls_cert
|
||||
~~~~~~~~~
|
||||
|
||||
String (PEM Format) of the web server certificate
|
||||
|
||||
tls_key
|
||||
~~~~~~~~
|
||||
|
||||
Eyaml encoded string of the web server certificate key (PEM format)
|
||||
@@ -0,0 +1,42 @@
|
||||
``profile::kdump_client``
|
||||
=========================
|
||||
|
||||
This profile manages the ``kdump`` service. It automatically reserves memory for
|
||||
the crash kernel.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=========== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
----------- -------- ------------------------------------------------
|
||||
crashkernel string hiera('kdump_client::crashkernel')
|
||||
target string hiera('kdump_client::target')
|
||||
=========== ======== ================================================
|
||||
|
||||
|
||||
``crashkernel``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Configures the kernel parameter ``crashkernel``, which specifies the amount of
|
||||
memory to be reserved for the crash kernel. This can be ``auto`` or ``xxxM``.
|
||||
Further information is provided by `Red Hat
|
||||
<https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/s1-kdump-configuration.html>`_.
|
||||
|
||||
|
||||
``target``
|
||||
~~~~~~~~~~
|
||||
|
||||
The target for kernel dumps as documented in ``kdump.conf(5)``. Currently SSH
|
||||
targets do not work, as there is no way to specify an SSH key.
|
||||
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
Transfer kernel dumps to a remote server using NFS::
|
||||
|
||||
class {'kdump':
|
||||
target => 'nfs some-server.psi.ch/crashes/',
|
||||
}
|
||||
@@ -0,0 +1,99 @@
|
||||
``profile::local_accounts``
|
||||
===========================
|
||||
|
||||
This module helps managing local users and groups.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
group_defs hash hiera('local_accounts::group_defs')
|
||||
groups hash hiera('local_accounts::groups')
|
||||
user_defs hash hiera('local_accounts::user_defs')
|
||||
users list hiera('local_accounts:users')
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``group_defs``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
A hash containing the definitions of local groups. The keys are the group names,
|
||||
the values are the numeric group IDs.
|
||||
|
||||
|
||||
Example::
|
||||
|
||||
local_accounts::group_defs:
|
||||
'my_local_group': 673
|
||||
|
||||
Also see `groups`_.
|
||||
|
||||
|
||||
``groups``
|
||||
~~~~~~~~~~
|
||||
|
||||
A list containing the names of the local groups to be created. The definition
|
||||
for each group is taken from `group_defs`_.
|
||||
|
||||
|
||||
``user_defs``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
A hash containing the definitions of local users. The keys are the user names,
|
||||
the values are hashes containing the usual user properties, ie:
|
||||
|
||||
============ ==========================
|
||||
``password`` password hash (optional)
|
||||
``uid`` numeric UID (required)
|
||||
``gid`` numeric GID (required)
|
||||
``comment`` comment (optional)
|
||||
``home`` home directory (required)
|
||||
``shell`` shell (required)
|
||||
============ ==========================
|
||||
|
||||
|
||||
``users``
|
||||
~~~~~~~~~
|
||||
|
||||
A list of the users to be created. The definition of each user is taken from
|
||||
`user_defs`_.
|
||||
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
The following defines three users and one group, but only creates one each::
|
||||
|
||||
local_accounts::group_defs:
|
||||
'archadm': 503
|
||||
|
||||
local_accounts::user_defs:
|
||||
'ioc':
|
||||
'uid': 500
|
||||
'gid': 9102
|
||||
'home': '/home/ioc'
|
||||
'shell': '/bin/bash'
|
||||
'comment': 'IOC Account'
|
||||
|
||||
'slsop':
|
||||
'uid': 501
|
||||
'gid': 9102
|
||||
'home': '/home/slsop'
|
||||
'shell': '/bin/bash'
|
||||
'comment': 'SLS Operator'
|
||||
|
||||
'archadm':
|
||||
'uid': 503
|
||||
'gid': 503
|
||||
'home': '/home/archadm'
|
||||
'shell': '/bin/bash'
|
||||
'comment': ''
|
||||
|
||||
local_accounts::groups:
|
||||
- 'archadm'
|
||||
|
||||
local_accounts::users::
|
||||
- 'archadm'
|
||||
@@ -0,0 +1,91 @@
|
||||
``profile::log_client``
|
||||
=======================
|
||||
|
||||
This module manages the local logging-related configuration.
|
||||
|
||||
It can make the journal permanent, enable or disable legacy configuration files
|
||||
(e.g. ``/var/log/messages``), and configure log forwarding.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
============================ ======== ==================================================
|
||||
**Name** **Type** **Default**
|
||||
---------------------------- -------- --------------------------------------------------
|
||||
forward_to list hiera('log_client::forward_to', [])
|
||||
legacy_logs bool hiera('log_client::legacy_logs')
|
||||
persistent_journal bool hiera('log_client::persistent_journal')
|
||||
journal_system_keep_free string hiera('log_client::journal_system_keep_free')
|
||||
journal_system_max_file_size string hiera('log_client::journal_system_max_file_size')
|
||||
journal_system_max_use string hiera('log_client::journal_system_max_use')
|
||||
============================ ======== ==================================================
|
||||
|
||||
|
||||
``journal_system_keep_free``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
How much space :manpage:`systemd-journald(8)` should keep free for non-journal
|
||||
use in ``/var/log``. In addition to the syntax described in
|
||||
:manpage:`journald.conf(5)` we also support percentages, ie ``'25%'`` means that
|
||||
the journal will leave at least 25% of ``/var/log`` for other uses.
|
||||
|
||||
|
||||
``journal_system_max_file_size``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The maximum size of individual journal files.
|
||||
|
||||
|
||||
``journal_system_max_use``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The maximum amount of space that the journal is allowed to use. In addition to
|
||||
the syntax described in :manpage:`journald.conf(5)` we also support percentages,
|
||||
ie ``'50%'`` means that the journal can use at most 50% of ``/var/log``.
|
||||
|
||||
|
||||
``forward_to``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
An array of FQDNs, possibly prefixed with ``@`` for enabling TCP and followed by
|
||||
a port number. Log messages are forwarded to all entries in this list.
|
||||
|
||||
|
||||
``legacy_logs``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
A boolean controlling whether the legacy log files (``/var/log/messages`` etc)
|
||||
should be created (true) or not (false).
|
||||
|
||||
|
||||
``persistent_journal``
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
A boolean controlling whether the journal should be persistent (true) or not
|
||||
(false).
|
||||
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
This profile is included in the base role. To customize the log_client in a
|
||||
role, do this::
|
||||
|
||||
class role::some_role () {
|
||||
class {'role::base':
|
||||
include_log_client => false,
|
||||
...
|
||||
}
|
||||
|
||||
class {'profile::log_client':
|
||||
legacy_logs => false,
|
||||
persistent_journal => true,
|
||||
}
|
||||
|
||||
In Hiera, configure forwarding to ``log1`` using UDP on port 1514 and to
|
||||
``log2`` using TCP (on port 514)::
|
||||
|
||||
log_client::forward_to:
|
||||
- 'log1.psi.ch:1514'
|
||||
- '@log2.psi.ch'
|
||||
@@ -0,0 +1,25 @@
|
||||
``profile::log_server``
|
||||
=============================
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
======== ========= =================================
|
||||
**Name** **Type** **Default**
|
||||
-------- --------- ---------------------------------
|
||||
base_dir string hiera('log_server::base_log_dir')
|
||||
rules list hiera('log_server::rules')
|
||||
======== ========= =================================
|
||||
|
||||
|
||||
``base_dir``
|
||||
~~~~~~~~~~~~
|
||||
|
||||
This parameter designates the directory where the log data is stored.
|
||||
|
||||
|
||||
``rules``
|
||||
~~~~~~~~~
|
||||
|
||||
A list of rules to add to the end of ``/etc/rsyslog.conf``.
|
||||
@@ -0,0 +1,107 @@
|
||||
``profile::mkresource::files``
|
||||
==============================
|
||||
|
||||
``profile::mkresource::files`` is a puppet ``define`` (a.k.a. ``function``) which easily allows the creation of files
|
||||
through the puppet ``file`` resource (through the ``create_resources`` puppet function.
|
||||
|
||||
This ``define`` is intended to be called in a controlled way from a ``role`` or from another ``profile``, through an ``Array``
|
||||
list. However, it also allows the possibility to provide freedom by calling it through a ``Hash`` of files. Further information
|
||||
is explained below":
|
||||
|
||||
* ``Array``: In order to have more control on the files that are being created. In example::
|
||||
|
||||
# Begin: puppet class
|
||||
class role::hpc::ui (
|
||||
Array $scratch = hiera('base::scratch', []),
|
||||
...
|
||||
) {
|
||||
...
|
||||
profile::mkresource::files { "scratch":
|
||||
files => $scratch,
|
||||
defaults => { mode => '1777' };
|
||||
}
|
||||
...
|
||||
}
|
||||
# End: puppet class
|
||||
|
||||
# Begin: hiera call
|
||||
base::scratch:
|
||||
- '/scratch'
|
||||
- '/ssd-scratch'
|
||||
# End: hiera call
|
||||
|
||||
* ``Hash``: This will provide more flexibility from the user side. Only really strange cases will be allowed. Example::
|
||||
|
||||
# Begin: puppet class
|
||||
class role::hpc::ui (
|
||||
Array $scratch = hiera('base::scratch', {}),
|
||||
...
|
||||
) {
|
||||
...
|
||||
profile::mkresource::files { "scratch":
|
||||
files => $scratch;
|
||||
}
|
||||
...
|
||||
}
|
||||
# End: puppet class
|
||||
|
||||
# Begin: hiera call
|
||||
base::scratch:
|
||||
'/scratch':
|
||||
ensure: directory
|
||||
mode: '1777'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
'/ssd-scratch'
|
||||
ensure: directory
|
||||
mode: '1770'
|
||||
group: 'svc-cluster_merlin5'
|
||||
# End: hiera call
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
========== ==================== ==========================
|
||||
**Name** **Type** **Default**
|
||||
---------- -------------------- --------------------------
|
||||
$files Variant[Array, Hash] {}
|
||||
$defaults Hash {}
|
||||
========== ==================== ==========================
|
||||
|
||||
|
||||
``files``
|
||||
~~~~~~~~~~~~~
|
||||
Defaults to ``Hash`` type ``{}``. Whenever is an ``Array``, it will be converted to ``Hash`` as ``create_resources`` is used and
|
||||
it always expects a ``Hash``.
|
||||
|
||||
Two different call examples:
|
||||
|
||||
* ``Hash``::
|
||||
|
||||
base::scratch:
|
||||
'/scratch':
|
||||
ensure: directory
|
||||
mode: '1777'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
'/ssd-scratch'
|
||||
ensure: directory
|
||||
mode: '1770'
|
||||
group: 'svc-cluster_merlin5'
|
||||
|
||||
* ``Array``::
|
||||
|
||||
base::scratch:
|
||||
- '/scratch'
|
||||
- '/ssd-scratch'
|
||||
|
||||
``defaults``
|
||||
~~~~~~~~~
|
||||
|
||||
Defaults to empty ``Hash``. Should contain ``file`` resource parameters (in example, ``mode``, ``owner``, ``group``, ``ensure``, etc.)
|
||||
Example::
|
||||
|
||||
profile::mkresource::files { "scratch":
|
||||
files => [ '/scratch', '/ssd-scratch' ],
|
||||
defaults => { mode => '1777' };
|
||||
}
|
||||
@@ -0,0 +1,191 @@
|
||||
``profile::mounter``
|
||||
====================
|
||||
|
||||
This module manages mounts and installs filesystem-specific utilities.
|
||||
|
||||
Mounts are configured using the Puppet ``mount`` resource type, ie. they get
|
||||
added to ``/etc/fstab``. Auto-mounts are implemented by adding the
|
||||
``x-systemd.automount`` option.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
mounts Array []
|
||||
def::$NAME Hash None
|
||||
cifs_files Array []
|
||||
cifs::def::$NAME Hash None
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``mounter::def::$NAME``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
A hash defining a mount ``$NAME`` which can then be referenced by a module or
|
||||
through the Hiera variable ``mounter::mounts``.
|
||||
|
||||
The hash may contain the following keys:
|
||||
|
||||
- ensure
|
||||
|
||||
Is passed to the ``mount`` resource type unaltered with the following
|
||||
exception. If the value is ``running``, it is changed to ``mounted``. This
|
||||
ensures compatibility with an older version of this module.
|
||||
|
||||
- mountpoint
|
||||
|
||||
Will be created, if necessary.
|
||||
|
||||
- device
|
||||
- options
|
||||
- type
|
||||
|
||||
The filesystem type. Passed to the ``mount`` resource as ``fstype``.
|
||||
|
||||
- auto
|
||||
|
||||
Whether or not this mount should be automounted. Default: ``false``.
|
||||
|
||||
- updatedb
|
||||
|
||||
A boolean specifying whether :manpage:`updatedb(8)` should index the files
|
||||
below the mountpoint. See the :doc:`updatedb <../components/updatedb>`
|
||||
module for details.
|
||||
|
||||
|
||||
``mounter::mounts``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
An array of strings referring to mount definitions to be configured on the
|
||||
target system. Each string is the name of a mount defined through
|
||||
`mounter::def::$NAME`_.
|
||||
|
||||
``mounter::cifs::def::$NAME``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
A ``Hash`` containing information for creating an authentication file for CIFS
|
||||
mounts.
|
||||
|
||||
The ``Hash`` may contain the following keys:
|
||||
|
||||
- ensure
|
||||
|
||||
Is passwed to the ``profile::mounter::cifs`` resource, should contain any
|
||||
possible value for the attribut ``ensure`` in a ``File`` resource type.
|
||||
Usually, ``present`` will ensure that file is existing and updated will
|
||||
``absent`` will remove it.
|
||||
|
||||
- path
|
||||
|
||||
This is mandatory, should contain the path where the new credential file
|
||||
should be located. Usually, ``/etc/cifs-utils`` would be a good option.
|
||||
|
||||
- mode
|
||||
|
||||
Defaults to ``0400``. It can be changed.
|
||||
|
||||
- owner
|
||||
|
||||
Defaults to ``root`` user. It can be changed.
|
||||
|
||||
- group
|
||||
|
||||
Defaults to ``group`` user. It can be changed.
|
||||
|
||||
- cifs_username
|
||||
|
||||
Must be defined. Should contain the ``username`` of the user allowed to
|
||||
mount the CIFS mountpoint.
|
||||
|
||||
- cifs_password
|
||||
|
||||
Must be defined. Should contain the ``password`` of the user allowed to
|
||||
mount the CIFS mountpoint, defined with ``cifs_username``.
|
||||
|
||||
|
||||
``mounter::cifs``
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
This defined type takes the paremters accepted for CIFS definitions (see
|
||||
`mounter::cifs::de::$NAME`_).
|
||||
|
||||
|
||||
Defined Types
|
||||
-------------
|
||||
|
||||
``mount``
|
||||
~~~~~~~~~
|
||||
|
||||
This defined type takes the parameters accepted for mount definitions (see
|
||||
`mounter::def::$NAME`_).
|
||||
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
Local mount
|
||||
~~~~~~~~~~~
|
||||
|
||||
A local mount can be configured in the following way::
|
||||
|
||||
mounter::def::scratch:
|
||||
ensure: 'mounted'
|
||||
mountpoint: '/scratch'
|
||||
device: '/dev/vg_data/lv_scratch'
|
||||
type: 'xfs'
|
||||
|
||||
mounter::mounts:
|
||||
- 'scratch'
|
||||
|
||||
|
||||
To have the ``scratch`` mount from the previous example auto-mounted instead,
|
||||
add the ``auto`` parameter::
|
||||
|
||||
mounter::def::scratch:
|
||||
ensure: 'mounted'
|
||||
mountpoint: '/scratch'
|
||||
device: '/dev/vg_data/lv_scratch'
|
||||
type: 'xfs'
|
||||
auto: true
|
||||
|
||||
mounter::mounts:
|
||||
- 'scratch'
|
||||
|
||||
|
||||
Supposedly this is a scratch mount, so we exclude the whole mount both from
|
||||
backups and from updatedb.
|
||||
|
||||
Remote Mount
|
||||
~~~~~~~~~~~~
|
||||
|
||||
Remote CIFS mountpoint can be defined as follows::
|
||||
|
||||
mounter::cifs::def::cifs_mpc2375:
|
||||
ensure: 'present'
|
||||
path: '/etc/cifs-utils'
|
||||
cifs_username: 'allowedWindowsUser'
|
||||
cifs_password: 'ENC[PKCS7,MIIBeQYJKoZIhvc...]'
|
||||
|
||||
mounter::cifs::files:
|
||||
- 'cifs_mpc2375'
|
||||
|
||||
mounter::def::emf:
|
||||
ensure: 'running'
|
||||
enable: 'true'
|
||||
device: '//172.23.75.16/Users'
|
||||
mountpoint: '/emf/jeol2200fs/k2'
|
||||
type: 'cifs'
|
||||
options: 'credentials=/etc/cifs-utils/cifs_mpc2375,uid=35667,gid=35270,forcegid,file_mode=0660,dir_mode=0770'
|
||||
|
||||
mounter::mounts:
|
||||
- 'emf'
|
||||
|
||||
In the above example, we need to create a ``credentials`` file with `mounter::cifs::def::$NAME`_. This file will
|
||||
be called ``cifs_mpc2375`` and will be located in ``/etc/cifs-utils`` and will contain information about the
|
||||
username and password allowed to mount it.
|
||||
|
||||
On the other hand, a mount ``emf`` is defined. You should specify in options the location of ``credentials``.
|
||||
Other optional parameters are used. ``emf`` is mounted with type ``cifs``, which will automatically ensure that
|
||||
proper ``cifs-utils`` package is installed.
|
||||
@@ -0,0 +1,16 @@
|
||||
``profile::mta``
|
||||
================
|
||||
|
||||
This module manages configures the system's MTA, currently
|
||||
:manpage:`postfix(1)`. At the moment it only configures a relay host and
|
||||
restricts access to the loopback interface.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
|
||||
``relay``
|
||||
~~~~~~~~~
|
||||
|
||||
The FQDN of a host that all outgoing mail will be forwarded to for delivery.
|
||||
@@ -0,0 +1,147 @@
|
||||
``profile::multipath``
|
||||
=======================
|
||||
|
||||
This profile configures :manpage:`multipath.conf`.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
==================== ======== =============================================
|
||||
**Name** **Type** **Default**
|
||||
-------------------- -------- ---------------------------------------------
|
||||
wwid hash hiera_hash('multipath::wwid',{})
|
||||
blacklist_wwid hash hiera_hash('multipath::blacklist_wwid',{})
|
||||
devices array hiera_hash('multipath::devices',{})
|
||||
blacklist_devices array hiera_hash('multipath::blacklist_devices',{})
|
||||
blacklist_devnode array hiera_hash('multipath::blacklist_devnode',{})
|
||||
==================== ======== =============================================
|
||||
|
||||
|
||||
``wwid``
|
||||
~~~~~~~~
|
||||
|
||||
A hash containing the `allowed multipaths` by adding the `device alias` and its corresponding `'wwid'`.
|
||||
In example:
|
||||
|
||||
Hiera data::
|
||||
|
||||
profile::multipath::wwid:
|
||||
'vol1_a': '360080e50004315f40000087e5966df82'
|
||||
'vol1_b': '360080e5000431680000007c35966e03e'
|
||||
'vol1_c': '360080e50004315f4000008825966e1bf'
|
||||
|
||||
will generate the following lines in the `'/etc/multipath.conf'` file::
|
||||
|
||||
multipaths {
|
||||
multipath {
|
||||
alias vol1_a
|
||||
wwid "360080e50004315f40000087e5966df82"
|
||||
}
|
||||
multipath {
|
||||
alias vol1_b
|
||||
wwid "360080e5000431680000007c35966e03e"
|
||||
}
|
||||
multipath {
|
||||
alias vol1_c
|
||||
wwid "360080e50004315f4000008825966e1bf"
|
||||
}
|
||||
}
|
||||
|
||||
``blacklist_wwid``
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
An hash containing `blacklisted multipaths` by adding the `device alias` and its corresponding `wwid`. In example:
|
||||
|
||||
Hiera data::
|
||||
|
||||
profile::multipath::blacklist_wwid:
|
||||
'vol1_j': '360080e50004315f40000087e59aaaaaa'
|
||||
|
||||
will generate the following lines in the `'/etc/multipath.conf'` file::
|
||||
|
||||
blacklist {
|
||||
...
|
||||
multipath {
|
||||
alias vol1_j
|
||||
wwid "360080e50004315f40000087e59aaaaaa"
|
||||
}
|
||||
...
|
||||
}
|
||||
|
||||
|
||||
``devices``
|
||||
~~~~~~~~~~~
|
||||
|
||||
An array containing `allowed devices` in the `multipath.conf` configuration. In example:
|
||||
|
||||
Hiera data::
|
||||
|
||||
profile::multipath::devices:
|
||||
- vendor: "Supermicro"
|
||||
product: "Supermicro"
|
||||
|
||||
|
||||
will generate the following lines in the `'/etc/multipath.conf'` file::
|
||||
|
||||
devices {
|
||||
device {
|
||||
vendor "Supermicro"
|
||||
product "Supermicro"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
``blacklist_devices``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
An array containing `blacklisted devices` in the `multipath.conf` configuration. In example:
|
||||
|
||||
Hiera data::
|
||||
|
||||
profile::multipath::blacklist_devices:
|
||||
- vendor: "HP"
|
||||
product: "HP"
|
||||
- vendor: "HP"
|
||||
|
||||
will generate the following lines in the `'/etc/multipath.conf'` file::
|
||||
|
||||
blacklist {
|
||||
...
|
||||
device {
|
||||
vendor "HP"
|
||||
product "HP"
|
||||
}
|
||||
device {
|
||||
vendor "HP"
|
||||
}
|
||||
...
|
||||
}
|
||||
|
||||
|
||||
``blacklist_devnode``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
An array containing a list of `node devices` that will be `blacklisted` in `multipath.conf`.
|
||||
By default some `'devnodes'` are already included and fixed by default in the template file. These ones are the following::
|
||||
|
||||
devnode "^(ram|raw|loop|fd|md|dm-|sr|scd|st)[0-9]*"
|
||||
devnode "^(td|hd|vd)[a-z]"
|
||||
devnode "^(dcssblk)[0-9]*"
|
||||
|
||||
In example, hiera data::
|
||||
|
||||
profile::multipath::blacklist_devnode:
|
||||
- "sda"
|
||||
- "sdb"
|
||||
|
||||
will generate the following lines in the `'/etc/multipath.conf'` file::
|
||||
|
||||
blacklist {
|
||||
...
|
||||
devnode "sda"
|
||||
devnode "sdb"
|
||||
...
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,65 @@
|
||||
``profile::networking``
|
||||
============================
|
||||
|
||||
This module configures most network-related settings, in particular:
|
||||
|
||||
- DNS resolution (``/etc/resolv.conf``)
|
||||
- DNS caching (via :manpage:`nscd(8)`)
|
||||
- static host entries
|
||||
|
||||
Notable exceptions are the firewall and ``/etc/hosts.{allow,deny}``.
|
||||
|
||||
It also provides information about networks to other modules through the
|
||||
variables listed below:
|
||||
|
||||
- ``profile::networking::zone``
|
||||
|
||||
The name of network zone. This is used by the :doc:`ntp_client
|
||||
<../profiles/ntp_client>` profile, for example, to determine which NTP servers
|
||||
to use.
|
||||
|
||||
- ``profile::networking::use_bastions``
|
||||
|
||||
This boolean indicates to the :doc:`aaa <../profiles/aaa>` profile whether SSH
|
||||
access should be restricted to connections coming from the bastion hosts.
|
||||
|
||||
|
||||
Notes:
|
||||
|
||||
- the DNS cache is configured to be persistent, i.e. the cached data will
|
||||
survive restarts of ``nscd.service``. To clear the cache, run ``nscd -i
|
||||
hosts`` or ``systemctl reload nscd``.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
|
||||
``dns_servers``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
The list of DNS servers (IP addresses) to be configured. This is only effective
|
||||
if the client doesn't use DHCP (see `enable_dhcp`_).
|
||||
|
||||
|
||||
``enable_dhcp``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
If this is true, then settings that are typically configured through DHCP (e.g.
|
||||
DNS servers) are not touched by this module.
|
||||
|
||||
|
||||
``enable_dns_caching``
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This boolean determines whether DNS caching with nscd is enabled (``true``) or
|
||||
not (``false``). It is only effective if the client doesn't use DHCP (see
|
||||
`enable_dhcp`_).
|
||||
|
||||
|
||||
``static_host_entries``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
A hash representing static host entries. The keys are the IP addresses, the
|
||||
values are expected to be lists of aliases for the given IP address. Special IP
|
||||
addresses like 127.0.0.1 are not allowed.
|
||||
@@ -0,0 +1,68 @@
|
||||
``profile::nfs_server``
|
||||
=======================
|
||||
|
||||
This module manages the Linux kernel NFS server and configures the exports.
|
||||
|
||||
See `Implementation Notes`_ below for details.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
exports hash hiera('nfs_server::exports')
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``exports``
|
||||
~~~~~~~~~~~
|
||||
|
||||
A hash containing the NFS exports to be configured. The keys are the pathnames
|
||||
to be exported, the values are hashes with two attributes:
|
||||
|
||||
- ``options``: the default options for the export
|
||||
- ``clients``: a list of hashes describing the clients
|
||||
|
||||
The hashes describing the clients have two entries as well, the second one being
|
||||
optional:
|
||||
|
||||
- ``hosts``: a client specification as described in :manpage:`exports(5)`
|
||||
- ``options`` (optional): an option string specific to these clients
|
||||
|
||||
Example::
|
||||
|
||||
nfs_server::exports:
|
||||
# Make software available via NFS. Installation happens
|
||||
# on builder.psi.ch.
|
||||
'/exports/prog':
|
||||
options: 'ro,root_squash'
|
||||
clients:
|
||||
- hosts: '129.129.0.0/16'
|
||||
- hosts: 'builder.psi.ch'
|
||||
options: 'rw,no_root_squash'
|
||||
# Scratch directories for prod servers. Files on scratch
|
||||
# are cleaned up by a cron job on janitor.psi.ch.
|
||||
'/exports/scratch':
|
||||
options: 'rw,root_squash'
|
||||
clients:
|
||||
- hosts: '129.129.160.0/24'
|
||||
- hosts: '129.129.190.0/24'
|
||||
- hosts: 'janitor.psi.ch'
|
||||
options: 'no_root_squash'
|
||||
|
||||
|
||||
Implementation Notes
|
||||
--------------------
|
||||
|
||||
We pass ``--manage-gids`` to :manpage:`rpc.mountd(8)` to avoid the following
|
||||
problem. When not using Kerberos, the NFS client passes a list of groups (GIDs
|
||||
really) that the user is a member of, and the server consults this list when
|
||||
making access decisions. The client can pass at most 16 groups, which means that
|
||||
if a user is a member of more than 16 groups, they may be denied access even
|
||||
though they are a member of the necessary group.
|
||||
|
||||
One solution is to use Kerberos, the other is to have the server determine group
|
||||
membership itself, ignoring the client's list. The latter is what
|
||||
``--manage-gids`` does.
|
||||
@@ -0,0 +1,45 @@
|
||||
``profile::nomachine``
|
||||
=======================
|
||||
|
||||
Installs and configures a NoMachine server. i
|
||||
|
||||
|
||||
This is the main class. It will configure several settings (license, service), but also
|
||||
depending on the ``$nomachine_profile`` setting (defined from hiera with
|
||||
``hiera('nomachine::profile')``), it will trigger different configurations according to
|
||||
its profile type.
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
``profile::nomachine`` is invoked from the ``role::base``. In order to be able to install
|
||||
NoMachine, you must setup the following setting in hiera: ``base::enable_nomachine: true``
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================== =========================================== =============================
|
||||
**Name** **Type** **Default**
|
||||
------------------ ------------------------------------------- -----------------------------
|
||||
$nomachine_profile Enum['desktop', 'terminal', 'workstation' ] *No default. Must be defined*
|
||||
================== =========================================== =============================
|
||||
|
||||
``nomachine_profile``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This is the NoMachine profile type. Depending on the profile type, it will call a different
|
||||
sub-profile:
|
||||
|
||||
- ``desktop``:
|
||||
|
||||
profile::nomachine::desktop
|
||||
|
||||
- ``terminal``:
|
||||
|
||||
profile::nomachine::terminal
|
||||
|
||||
- ``workstation``:
|
||||
|
||||
profile::nomachine::workstation
|
||||
|
||||
Each type contains its own specific settings and packages.
|
||||
@@ -0,0 +1,55 @@
|
||||
``profile::nomachine::desktop``
|
||||
===============================
|
||||
|
||||
This is a sub-class for ``profile::nomachine``.
|
||||
|
||||
Installs and configures NoMachine with profile type ``desktop``.
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
This is part of the ``profile::nomachine``.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
==================================== ========= ========================================================================================================================================================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------------ --------- ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
$nomachine_version String ``hiera('nomachine::desktop::version')``
|
||||
$server_EnableUPnP String ``hiera('nomachine::desktop::server::EnableUPnP', 'NX')``
|
||||
$server_ConnectionsLimit Integer ``hiera('nomachine::desktop::server::ConnectionsLimit', 20)``
|
||||
$server_ConnectionsUserLimit Integer ``hiera('nomachine::desktop::server::ConnectionsUserLimit', 20)``
|
||||
$server_VirtualDesktopMode Integer ``hiera('nomachine::desktop::server::VirtualDesktopMode', 2)``
|
||||
$server_VirtualDesktopsLimit Integer ``hiera('nomachine::desktop::server::VirtualDesktopsLimit', 20)``
|
||||
$server_VirtualDesktopsUserLimit Integer ``hiera('nomachine::desktop::server::VirtualDesktopsUserLimit', 20)``
|
||||
$server_SSHAuthorizedKeys String ``hiera('nomachine::desktop::server::SSHAuthorizedKeys', 'authorized_keys')``
|
||||
$server_PhysicalDesktopAuthorization Integer ``hiera('nomachine::desktop::server::PhysicalDesktopAuthorization', 0)``
|
||||
$server_PhysicalDesktopMode Integer ``hiera('nomachine::desktop::server::PhysicalDesktopMode', 1)``
|
||||
$server_PhysicalDesktopSharing Integer ``hiera('nomachine::desktop::server::PhysicalDesktopSharing', 1)``
|
||||
$server_EnableNetworkBroadcast Integer ``hiera('nomachine::desktop::server::EnableNetworkBroadcast', 1)``
|
||||
$server_AvailableSessionTypes String ``hiera('nomachine::desktop::server::AvailableSessionTypes', 'physical-desktop,shadow')``
|
||||
$node_DefaultDesktopCommand String ``hiera('nomachine::desktop::node::DefaultDesktopCommand', '"/etc/X11/xinit/Xsession \'gnome-session --session=gnome\'"')``
|
||||
$node_AvailableSessionTypes String ``hiera('nomachine::desktop::node::AvailableSessionTypes', 'unix-remote,unix-console,unix-default,unix-application,physical-desktop,shadow,unix-xsession-default,unix-gnome,unix-xdm')``
|
||||
$node_EnableSmartcardSharing Integer ``hiera('nomachine::desktop::node::EnableSmartcardSharing', 1)``
|
||||
$node_AudioInterface String ``hiera('nomachine::desktop::node::AudioInterface', 'disabled')``
|
||||
$node_EnableCUPSSupport Integer ``hiera('nomachine::desktop::node::EnableCUPSSupport', 1)``
|
||||
$node_ClientConnectionMethods String ``hiera('nomachine::desktop::node::ClientConnectionMethods', 'NX,SSH')``
|
||||
$node_DisplayServerThreads String ``hiera('nomachine::desktop::node::DisplayServerThreads', 'auto')``
|
||||
$node_DisplayEncoderThreads String ``hiera('nomachine::desktop::node::DisplayEncoderThreads', 'auto')``
|
||||
==================================== ========= ========================================================================================================================================================================================
|
||||
|
||||
``nomachine_version``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This parameters must be defined. Please see ``common.yaml`` for checking the default value.
|
||||
|
||||
``server_*``
|
||||
~~~~~~~~~~~~
|
||||
|
||||
``$server_*`` paremeters are customizable settings for the NoMachine ``server.cfg`` configuration file. Please refer to NoMachine official documentation for more information.
|
||||
|
||||
``node_*``
|
||||
~~~~~~~~~~
|
||||
|
||||
``$node_*`` paremeters are customizable settings for the NoMachine ``node.cfg`` configuration file. Please refer to NoMachine official documentation for more information.
|
||||
@@ -0,0 +1,45 @@
|
||||
``profile::nomachine::license``
|
||||
===============================
|
||||
|
||||
This is a sub-class for ``profile::nomachine``.
|
||||
|
||||
Installs and configures NoMachine server and node licenses to a specific directory (default ``/etc/NX``).
|
||||
When licenses are updated, it triggers the activation of the new NoMachine licenses and it deploys them in ``/usr/NX/etc``.
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
This is part of the ``profile::nomachine``.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=========================== ========== ================================================================================================
|
||||
**Name** **Type** **Default**
|
||||
--------------------------- ---------- ------------------------------------------------------------------------------------------------
|
||||
$nomachine_license_location String ``hiera('nomachine::license::location', '/etc/NX')``. Defaults to ``/etc/NX``
|
||||
$nomachine_license_server String ``hiera("nomachine::license::server::$hostname")``. Must be defined and encrypyed with ``eyaml``
|
||||
$nomachine_license_node String ``hiera("nomachine::license::node::$hostname")``. Must be defined and encrypyed with ``eyaml``
|
||||
=========================== ========== ================================================================================================
|
||||
|
||||
``nomachine_license_location``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Defaults to ``/etc/NX``. Will be a temporary location for ``node.lic`` and ``server.lic``. **You must avoid to setup ``/usr/NX/etc``**
|
||||
as the ``nomachine_license_location``. Can be defined in Hiera as ``nomachine::license::location``.
|
||||
|
||||
``nomachine_license_server``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
``eyaml`` encrypted ``server.lic``. Must be defined in hiera as ``nomachine::license::server::$hostname``, where ``$hostname`` is the
|
||||
host shortname of the NoMachine server (equivalent to run ``hostname -s`` from command line).
|
||||
|
||||
For more information about encryption with ``eyaml``, please refer to http://linux-infra.gitpages.psi.ch/admin-guide/puppet/hiera.html#secret-values
|
||||
|
||||
``nomachine_license_node``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
``eyaml`` encrypted ``node.lic``. Must be defined in hiera as ``nomachine::license::node::$hostname``, where ``$hostname`` is the
|
||||
host shortname of the NoMachine server (equivalent to run ``hostname -s`` from command line).
|
||||
|
||||
For more information about encryption with ``eyaml``, please refer to http://linux-infra.gitpages.psi.ch/admin-guide/puppet/hiera.html#secret-values
|
||||
@@ -0,0 +1,20 @@
|
||||
``profile::nomachine::repository``
|
||||
==================================
|
||||
|
||||
This is a sub-class for ``profile::nomachine``.
|
||||
|
||||
This class just installs and configures a NoMachine repository. Is a very basic class with
|
||||
no configurable options.
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
This is part of the ``profile::nomachine``.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================== =========================================== =============================
|
||||
**Name** **Type** **Default**
|
||||
------------------ ------------------------------------------- -----------------------------
|
||||
================== =========================================== =============================
|
||||
@@ -0,0 +1,20 @@
|
||||
``profile::nomachine::service``
|
||||
===============================
|
||||
|
||||
This is a sub-class for ``profile::nomachine``.
|
||||
|
||||
This class just installs and configures a NoMachine service. Is a very basic class with
|
||||
no configurable options.
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
This is part of the ``profile::nomachine``.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================== =========================================== =============================
|
||||
**Name** **Type** **Default**
|
||||
------------------ ------------------------------------------- -----------------------------
|
||||
================== =========================================== =============================
|
||||
@@ -0,0 +1,56 @@
|
||||
``profile::nomachine::terminal``
|
||||
================================
|
||||
|
||||
This is a sub-class for ``profile::nomachine``.
|
||||
|
||||
Installs and configures NoMachine with profile type ``terminal``.
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
This is part of the ``profile::nomachine``.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
==================================== ========= ===========================================================================================================================================================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------------ --------- -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
$nomachine_version String ``hiera('nomachine::terminal::version')``. This is mandatory. See ``common.yaml`` for default value.
|
||||
$server_EnableUPnP String ``hiera('nomachine::terminal::server::EnableUPnP', 'none')``
|
||||
$server_ConnectionsLimit Integer ``hiera('nomachine::terminal::server::ConnectionsLimit', 200)``
|
||||
$server_ConnectionsUserLimit Integer ``hiera('nomachine::terminal::server::ConnectionsUserLimit', 2)``
|
||||
$server_DisconnectedSessionExpiry Integer ``hiera('nomachine::terminal::server::DisconnectedSessionExpiry', 0)``
|
||||
$server_VirtualDesktopMode Integer ``hiera('nomachine::terminal::server::VirtualDesktopMode', 0)``
|
||||
$server_VirtualDesktopsLimit Integer ``hiera('nomachine::terminal::server::VirtualDesktopsLimit', 300)``
|
||||
$server_VirtualDesktopsUserLimit Integer ``hiera('nomachine::terminal::server::VirtualDesktopsUserLimit', 2)``
|
||||
$server_SSHAuthorizedKeys String ``hiera('nomachine::terminal::server::SSHAuthorizedKeys', 'authorized_keys')``
|
||||
$server_PhysicalDesktopAuthorization Integer ``hiera('nomachine::terminal::server::PhysicalDesktopAuthorization', 1)``
|
||||
$server_PhysicalDesktopMode Integer ``hiera('nomachine::terminal::server::PhysicalDesktopMode', 2)``
|
||||
$server_PhysicalDesktopSharing Integer ``hiera('nomachine::terminal::server::PhysicalDesktopSharing', 0)``
|
||||
$server_EnableNetworkBroadcast Integer ``hiera('nomachine::terminal::server::EnableNetworkBroadcast', 0)``
|
||||
$server_AvailableSessionTypes String ``hiera('nomachine::terminal::server::AvailableSessionTypes', 'unix-remote,unix-console,unix-default,unix-application,physical-desktop,shadow,unix-xsession-default,unix-gnome,unix-xdm')``
|
||||
$node_DefaultDesktopCommand String ``hiera('nomachine::terminal::node::DefaultDesktopCommand', '"/etc/X11/xinit/Xsession \'gnome-session --session=gnome\'"')``
|
||||
$node_AvailableSessionTypes String ``hiera('nomachine::terminal::node::AvailableSessionTypes', 'unix-remote,unix-console,unix-default,unix-application,physical-desktop,shadow,unix-xsession-default,unix-gnome,unix-xdm')``
|
||||
$node_EnableSmartcardSharing Integer ``hiera('nomachine::terminal::node::EnableSmartcardSharing', 1)``
|
||||
$node_AudioInterface String ``hiera('nomachine::terminal::node::AudioInterface', 'disabled')``
|
||||
$node_EnableCUPSSupport Integer ``hiera('nomachine::terminal::node::EnableCUPSSupport', 1)``
|
||||
$node_ClientConnectionMethods String ``hiera('nomachine::terminal::node::ClientConnectionMethods', 'NX,SSH')``
|
||||
$node_DisplayServerThreads String ``hiera('nomachine::terminal::node::DisplayServerThreads', 'auto')``
|
||||
$node_DisplayEncoderThreads String ``hiera('nomachine::terminal::node::DisplayEncoderThreads', 'auto')``
|
||||
==================================== ========= ===========================================================================================================================================================================================
|
||||
|
||||
``nomachine_version``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This parameters must be defined. Please see ``common.yaml`` for checking the default value.
|
||||
|
||||
``server_*``
|
||||
~~~~~~~~~~~~
|
||||
|
||||
``$server_*`` paremeters are customizable settings for the NoMachine ``server.cfg`` configuration file. Please refer to NoMachine official documentation for more information.
|
||||
|
||||
``node_*``
|
||||
~~~~~~~~~~
|
||||
|
||||
``$node_*`` paremeters are customizable settings for the NoMachine ``node.cfg`` configuration file. Please refer to NoMachine official documentation for more information.
|
||||
@@ -0,0 +1,56 @@
|
||||
``profile::nomachine::workstation``
|
||||
===================================
|
||||
|
||||
This is a sub-class for ``profile::nomachine``.
|
||||
|
||||
Installs and configures NoMachine with profile type ``workstation``.
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
This is part of the ``profile::nomachine``.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
==================================== ========= ===============================================================================================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------------ --------- -------------------------------------------------------------------------------------------------------------------------------
|
||||
$nomachine_version String ``hiera('nomachine::workstation::version')``
|
||||
$server_EnableUPnP String ``hiera('nomachine::workstation::server::EnableUPnP', 'NX')``
|
||||
$server_ConnectionsLimit Integer ``hiera('nomachine::workstation::server::ConnectionsLimit', 20)``
|
||||
$server_ConnectionsUserLimit Integer ``hiera('nomachine::workstation::server::ConnectionsUserLimit', 20)``
|
||||
$server_VirtualDesktopMode Integer ``hiera('nomachine::workstation::server::VirtualDesktopMode', 2)``
|
||||
$server_VirtualDesktopsLimit Integer ``hiera('nomachine::workstation::server::VirtualDesktopsLimit', 20)``
|
||||
$server_VirtualDesktopsUserLimit Integer ``hiera('nomachine::workstation::server::VirtualDesktopsUserLimit', 20)``
|
||||
$server_SSHAuthorizedKeys String ``hiera('nomachine::workstation::server::SSHAuthorizedKeys', 'authorized_keys')``
|
||||
$server_PhysicalDesktopAuthorization Integer ``hiera('nomachine::workstation::server::PhysicalDesktopAuthorization', 0)``
|
||||
$server_PhysicalDesktopMode Integer ``hiera('nomachine::workstation::server::PhysicalDesktopMode', 1)``
|
||||
$server_PhysicalDesktopSharing Integer ``hiera('nomachine::workstation::server::PhysicalDesktopSharing', 2)``
|
||||
$server_EnableNetworkBroadcast Integer ``hiera('nomachine::workstation::server::EnableNetworkBroadcast', 1)``
|
||||
$server_AvailableSessionTypes String ``hiera('nomachine::workstation::server::AvailableSessionTypes', 'shadow,unix-xsession-default')``
|
||||
$node_DefaultDesktopCommand String ``hiera('nomachine::workstation::node::DefaultDesktopCommand', '"/etc/X11/xinit/Xsession \'gnome-session --session=gnome\'"')``
|
||||
$node_AvailableSessionTypes String ``hiera('nomachine::workstation::node::AvailableSessionTypes', 'shadow,unix-xsession-default')``
|
||||
$node_EnableSmartcardSharing Integer ``hiera('nomachine::workstation::node::EnableSmartcardSharing', 1)``
|
||||
$node_AudioInterface String ``hiera('nomachine::workstation::node::AudioInterface', 'disabled')``
|
||||
$node_EnableCUPSSupport Integer ``hiera('nomachine::workstation::node::EnableCUPSSupport', 1)``
|
||||
$node_ClientConnectionMethods String ``hiera('nomachine::workstation::node::ClientConnectionMethods', 'NX,SSH')``
|
||||
$node_DisplayServerThreads String ``hiera('nomachine::workstation::node::DisplayServerThreads', 'auto')``
|
||||
$node_DisplayEncoderThreads String ``hiera('nomachine::workstation::node::DisplayEncoderThreads', 'auto')``
|
||||
==================================== ========= ===============================================================================================================================
|
||||
|
||||
``nomachine_version``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This parameters must be defined. Please see ``common.yaml`` for checking the default value.
|
||||
|
||||
|
||||
``server_*``
|
||||
~~~~~~~~~~~~
|
||||
|
||||
``$server_*`` paremeters are customizable settings for the NoMachine ``server.cfg`` configuration file. Please refer to NoMachine official documentation for more information.
|
||||
|
||||
``node_*``
|
||||
~~~~~~~~~~
|
||||
|
||||
``$node_*`` paremeters are customizable settings for the NoMachine ``node.cfg`` configuration file. Please refer to NoMachine official documentation for more information.
|
||||
@@ -0,0 +1,32 @@
|
||||
``profile::ntp_client``
|
||||
=======================
|
||||
|
||||
This module configures the NTP client to synchronize the local system time with
|
||||
a number of time servers. Queries by other systems are disabled for security
|
||||
reasons.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
servers hash hiera_hash('ntp_client::servers')
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``servers``
|
||||
~~~~~~~~~~~
|
||||
|
||||
A hash containing the list of NTP servers for each :doc:`network zone
|
||||
<../profiles/networking>`, eg.::
|
||||
|
||||
ntp_client::servers:
|
||||
'default':
|
||||
- 'pstime1.psi.ch'
|
||||
- 'pstime2.psi.ch'
|
||||
- 'pstime3.psi.ch'
|
||||
'dmz':
|
||||
- 'dmztime1.psi.ch'
|
||||
- 'dmztime2.psi.ch'
|
||||
@@ -0,0 +1,40 @@
|
||||
``profile::nvidia``
|
||||
===================
|
||||
|
||||
The purpose of this module is to install the NVIDIA drivers. If NVIDIA GPU cards are
|
||||
detected with the facter ``pci_devices.gpu.nvidia``, automatically the ``profile::nvidia``
|
||||
class will be called. The ``class profile::platform`` is responsible for calling this profile::
|
||||
|
||||
if ( $facts['pci_devices']['gpu']['nvidia'].size > 0 ) {
|
||||
class { 'profile::nvidia':; }
|
||||
}
|
||||
|
||||
Current profile only installs drivers using the CUDA installation. Other NVIDIA installations
|
||||
(i.e. just NVIDIA drivers for Desktops without CUDA) are still not implemented.
|
||||
|
||||
To enable CUDA installation ``nvidia::cuda::enable`` must be set to ``true`` (default
|
||||
is ``false``). When this setting is set to ``false`` (default), NVIDIA installation without
|
||||
CUDA should be performed (as already specified, this is not implemented yet)
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================= ========== ===========
|
||||
**Name** **Type** **Default**
|
||||
----------------- ---------- -----------
|
||||
cuda_version string 8-0
|
||||
cuda_enable bool false
|
||||
================= ========== ===========
|
||||
|
||||
|
||||
``cuda_version``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
By default ``8-0`` is the version for the CUDA metapackage. To make installation possible,
|
||||
``cuda_enable`` must be also set up.
|
||||
|
||||
``cuda_enable``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
By default is ``false``. Set to ``true`` if you want to install CUDA and NVIDIA drivers from
|
||||
the CUDA repositories.
|
||||
@@ -0,0 +1,47 @@
|
||||
``profile::platform``
|
||||
=====================
|
||||
|
||||
The purpose of this ``profile`` is to install specific components depending on the hardware components
|
||||
and hardware/platform type.
|
||||
|
||||
Currently, for ``vmware`` machines no actions are performed. For ``physical`` machines some actions will
|
||||
be performed depending on the parameter settings (see below).
|
||||
|
||||
Also, according to the facter ``manufacturer``, some specific actions can be triggered. Currently only
|
||||
``HP``/``HPE`` hardware is considered.
|
||||
|
||||
Other options such like NVIDIA or Infiniband card detection are possible. Whenever detected, it will call
|
||||
the corresponding class and will perform required actions.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================= ========== ===========
|
||||
**Name** **Type** **Default**
|
||||
----------------- ---------- -----------
|
||||
enable_rasdaemon bool
|
||||
enable_smartd bool
|
||||
================= ========== ===========
|
||||
|
||||
``enable_rasdaemon``
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
When set to ``true``, will install and enable the ``rasdaemon`` service.
|
||||
|
||||
``enable_smartd``
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
When set to ``true``, will install and enable the ``smartmontools`` (``smartd``) service.
|
||||
|
||||
Facts
|
||||
-----
|
||||
|
||||
When some specific facts are detected, it will trigger some actions.
|
||||
|
||||
===================================== =============== ==============================================
|
||||
**Fact** **Value(s)** **Action description**
|
||||
------------------------------------- --------------- ----------------------------------------------
|
||||
``manufacturer`` ``HP``|``HPE`` ``include profile::platform::hewlett_packard``
|
||||
``['pci_devices']['gpu']['nvidia']`` count > 0 ``include profile::nvidia``
|
||||
``['pci_devices']['ib']['mellanox']`` count > 0 ``include profile::infiniband``
|
||||
===================================== =============== ==============================================
|
||||
@@ -0,0 +1,24 @@
|
||||
``profile::platform::hewlett_packard``
|
||||
======================================
|
||||
|
||||
When ``profile::platform::hewlett_packard`` is called (usually from the ``profile::platform`` through
|
||||
the facter ``manufacturer``, by auto-detecting an HP platform) some actions will be triggered.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================= ========== ===========
|
||||
**Name** **Type** **Default**
|
||||
----------------- ---------- -----------
|
||||
================= ========== ===========
|
||||
|
||||
Facts
|
||||
-----
|
||||
|
||||
When some specific facts are detected, it will trigger some actions.
|
||||
|
||||
==================================== ================= =======================================================
|
||||
**Fact** **Value(s)** **Action description**
|
||||
------------------------------------ ----------------- -------------------------------------------------------
|
||||
``productname`` ``/^ProLiant.*/`` Install ``hpssacli`` for HP Array Management/Monitoring
|
||||
==================================== ================= =======================================================
|
||||
@@ -0,0 +1,54 @@
|
||||
``profile::pmodules``
|
||||
=====================
|
||||
|
||||
This module manages the `AIT Pmodules
|
||||
<https://amas.psi.ch/Pmodules/wiki/Pmodules>`_.
|
||||
|
||||
It automatically enables Pmodules for all users with
|
||||
|
||||
1. a UID >= 1000
|
||||
2. a username **not** ending in ``-adm``
|
||||
|
||||
This makes sure that local service accounts, root, and administrator accounts do
|
||||
not use Pmodules automatically.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================== ======== ==============================
|
||||
**Name** **Type** **Default**
|
||||
------------------ -------- ------------------------------
|
||||
basedir string hiera('pmodules::basedir')
|
||||
================== ======== ==============================
|
||||
|
||||
|
||||
``basedir``
|
||||
~~~~~~~~~~~
|
||||
|
||||
The subdirectory of ``/afs/psi.ch/sys/`` where the modules can be found, e.g.
|
||||
``psi.x86_64_slp6`` or ``psi.ra``.
|
||||
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
This profile is included in the base role, but disabled. To enable Pmodules
|
||||
simply pass ``enable_pmodules => true`` when including the base role::
|
||||
|
||||
class role::some_role () {
|
||||
class {'role::base':
|
||||
enable_pmodules => true,
|
||||
...
|
||||
}
|
||||
...
|
||||
|
||||
To customize the base directory, include ``pmodules`` separately::
|
||||
|
||||
class role::some_role () {
|
||||
include role::base
|
||||
|
||||
class {'profile::pmodules':
|
||||
basedir => 'psi.ra',
|
||||
}
|
||||
...
|
||||
@@ -0,0 +1,29 @@
|
||||
``profile::print_client``
|
||||
=========================
|
||||
|
||||
This module configures printing to the PSI print server.
|
||||
|
||||
Currently, CUPS is used.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== =======================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ---------------------------------------
|
||||
default_printer string hiera('print_client::default_printer')
|
||||
print_server string hiera('print_client::server')
|
||||
=============================== ======== =======================================
|
||||
|
||||
|
||||
``default_printer``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The default printer to be configured in the PRINTER environment variable.
|
||||
|
||||
|
||||
``print_server``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
The FQDN of the CUPS print server to use.
|
||||
@@ -0,0 +1,23 @@
|
||||
``profile::puppet_client``
|
||||
==========================
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
========== ========= =========================
|
||||
**Name** **Type** **Default**
|
||||
---------- --------- -------------------------
|
||||
exec_time string ``05:00:00 -- 08:00:00``
|
||||
========== ========= =========================
|
||||
|
||||
|
||||
``exec_time``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
Defines a time window during which Puppet will run every day. The exact time
|
||||
depends on the FQDN of the system (see below), ensuring that on each system the
|
||||
timing is consistent and predictable, but across a group of systems using the
|
||||
same time window the exact times are distributed uniformly.
|
||||
|
||||
The syntax is ``HH:MM:SS -- HH:MM:SS``.
|
||||
@@ -0,0 +1,27 @@
|
||||
``profile::serial_console``
|
||||
===========================
|
||||
|
||||
Configures the serial console on physical systems.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
========= ========= ============
|
||||
**Name** **Type** **Default**
|
||||
--------- --------- ------------
|
||||
device string ``ttyS0``
|
||||
rate integer 115200
|
||||
========= ========= ============
|
||||
|
||||
|
||||
``device``
|
||||
~~~~~~~~~~
|
||||
|
||||
The device to configure as a console.
|
||||
|
||||
|
||||
``rate``
|
||||
~~~~~~~~
|
||||
|
||||
The rate to use for the serial console.
|
||||
@@ -0,0 +1,38 @@
|
||||
``profile::ssh_client``
|
||||
=======================
|
||||
|
||||
This profile configures '/etc/ssh/ssh_known_hosts' :manpage:`sshd(8)`.
|
||||
PSI CA key is added to the 'ssh_known_hosts', in this manner we allow
|
||||
PSI servers to SSH to this host.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
====================== ======== =============================================
|
||||
**Name** **Type** **Default**
|
||||
---------------------- -------- ---------------------------------------------
|
||||
allowed_hosts string '\*.psi.ch'
|
||||
canonicalize_hostname bool false
|
||||
forward_x11 bool
|
||||
====================== ======== =============================================
|
||||
|
||||
|
||||
``allowed_hosts``
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
A string specifying which hosts are allowed to SSH to this machine. By default,
|
||||
all PSI hosts will be able to connect.
|
||||
|
||||
|
||||
``canonicalize_hostname``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Determines whether or not hostnames are canonicalized for ``psi.ch``. See
|
||||
:manpage:`ssh_config(5)` for details.
|
||||
|
||||
|
||||
``foward_x11``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
Determines whether ``ForwardX11`` and ``ForwardX11Trusted`` should be enabled.
|
||||
@@ -0,0 +1,42 @@
|
||||
``profile::ssh_server``
|
||||
=======================
|
||||
|
||||
This profile configures :manpage:`sshd(8)`.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
==================== ======== =============================================
|
||||
**Name** **Type** **Default**
|
||||
-------------------- -------- ---------------------------------------------
|
||||
enable_gssapi bool hiera('ssh_server::enable_gssapi')
|
||||
permit_root_login string hiera('ssh_server::permit_root_login')
|
||||
trusted_user_ca_keys list hiera('ssh_server::trusted_user_ca_keys', [])
|
||||
user_ca_keys hash hiera('ssh_server::user_ca_keys', {})
|
||||
==================== ======== =============================================
|
||||
|
||||
|
||||
``enable_gssapi``
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
A boolean determining whether GSSAPI authentication is enabled or not.
|
||||
|
||||
|
||||
``permit_root_login``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Sets ``PermitRootLogin`` in the sshd configuration file.
|
||||
|
||||
|
||||
``trusted_user_ca_keys``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
An array containing the user CA keys that will be accepted (as understood by the
|
||||
``TrustedUserCAKeys`` directive in :manpage:`sshd_config(5)`).
|
||||
|
||||
|
||||
``user_ca_keys``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
A hash containing the actual keys to be referenced by `trusted_user_ca_keys`_.
|
||||
@@ -0,0 +1,10 @@
|
||||
``profile::sysinfo``
|
||||
====================
|
||||
|
||||
Stores certain information about the system in ``/etc/sysconfig/pli-info`` for
|
||||
the use of other programs and scripts. Currently, the following values are
|
||||
stored:
|
||||
|
||||
- ``SYSDB_ENV``: the system's sysdb environment
|
||||
- ``PUPPET_GROUP``: the system's ``puppet_group`` value from sysdb
|
||||
- ``PUPPET_ROLE``: the system's ``puppet_role`` value from sysdb
|
||||
@@ -0,0 +1,58 @@
|
||||
``profile::telegraf``
|
||||
=====================
|
||||
|
||||
This profile configures the `telegraf
|
||||
<https://www.influxdata.com/time-series-platform/telegraf/>`_ metrics collection
|
||||
agent.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ------------------------------------------------
|
||||
enable_service bool
|
||||
agent hash hiera_hash('telegraf::agent')
|
||||
metrics hash lookup('telegraf::metrics', {merge => 'deep'})
|
||||
=============================== ======== ================================================
|
||||
|
||||
|
||||
``enable_service``
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Determines whether or not Puppet will start or stop the service.
|
||||
|
||||
|
||||
``agent``
|
||||
~~~~~~~~~
|
||||
|
||||
This hash can be used to set the following configuration options in
|
||||
``/etc/telegraf/telegraf.conf``:
|
||||
|
||||
- ``metric_buffer_limit``
|
||||
- ``collection_jitter``
|
||||
- ``flush_interval``
|
||||
- ``flush_jitter``
|
||||
- ``urls``
|
||||
|
||||
|
||||
``metrics``
|
||||
~~~~~~~~~~~
|
||||
|
||||
This hash defines the metrics which the telegraf agent will collect. The keys
|
||||
are the names of the metrics and the values are hashes describing the metric.
|
||||
Every key/value pair in these hashes will be added to the configuration files
|
||||
directly without any checks.
|
||||
|
||||
Examples::
|
||||
|
||||
'cpu':
|
||||
enable: true
|
||||
'disk':
|
||||
enable: true
|
||||
interval: '30m'
|
||||
ignore_fs:
|
||||
- 'aufs'
|
||||
- 'auristorfs'
|
||||
- 'devfs'
|
||||
@@ -0,0 +1,49 @@
|
||||
``profile::web_server``
|
||||
=======================
|
||||
|
||||
Install and configure Apache to make local files available through HTTP/HTTPS.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
========== ========= ============
|
||||
**Name** **Type** **Default**
|
||||
---------- --------- ------------
|
||||
tls_cert string
|
||||
tls_chain string
|
||||
tls_key string
|
||||
vhost string
|
||||
url_map hash
|
||||
========== ========= ============
|
||||
|
||||
``tls_cert``
|
||||
~~~~~~~~~~~~
|
||||
|
||||
The TLS certificate (PEM).
|
||||
|
||||
|
||||
``tls_chain``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
The TLS certificate chain, ie. the intermediate certificate concatenated with
|
||||
the host's certificate.
|
||||
|
||||
|
||||
``tls_key``
|
||||
~~~~~~~~~~~
|
||||
|
||||
The TLS key (PEM). **Must be encrypted**!
|
||||
|
||||
|
||||
``vhost``
|
||||
~~~~~~~~~
|
||||
|
||||
The name of the Apache virtual host, eg. ``linux.web.psi.ch``.
|
||||
|
||||
|
||||
``url_map``
|
||||
~~~~~~~~~~~
|
||||
|
||||
A hash describing the mapping between URLs and files. The keys are the URLs
|
||||
relative to the `vhost`_, the values are the corresponding paths.
|
||||
@@ -0,0 +1,55 @@
|
||||
``profile::yum_client``
|
||||
=======================
|
||||
|
||||
This module configures :manpage:`yum(8)`.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=============================== ======== =============================================
|
||||
**Name** **Type** **Default**
|
||||
------------------------------- -------- ---------------------------------------------
|
||||
exclude list hiera('yum_client::exclude', [])
|
||||
package_groups list hiera_array('yum_client::package_groups', [])
|
||||
purge_repositories bool hiera('yum_client::purge_repositories')
|
||||
repos list hiera_array('yum_client::repositories')
|
||||
=============================== ======== =============================================
|
||||
|
||||
|
||||
``exclude``
|
||||
~~~~~~~~~~~
|
||||
|
||||
An array containing entries suitable for the ``exclude`` option in
|
||||
:manpage:`yum.conf(5)`.
|
||||
|
||||
|
||||
``package_group``
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
A list containing the names of the package groups to be installed on the
|
||||
systems. The package groups have to be defined through `pkg_group::$NAME`_ and
|
||||
are completely independent of Yum (environment) groups.
|
||||
|
||||
|
||||
``pkg_group::$NAME``
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The list of packages that comprise the package group ``$NAME``.
|
||||
|
||||
|
||||
``purge_repositories``
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
A boolean controlling whether files that were not created by Puppet should be
|
||||
removed from ``/etc/yum.repos.d``. This is useful to prevent repositories to be
|
||||
configured through other means (e.g. manually).
|
||||
|
||||
|
||||
``repos``
|
||||
~~~~~~~~~
|
||||
|
||||
A list of names designating the repositories that are to be configured (not
|
||||
necessarily enabled) on the system. If ``<name>`` is the name of the repository,
|
||||
then its definition is determined by searching Hiera for the
|
||||
``yum_client::repo_<name>`` key.
|
||||
@@ -0,0 +1,37 @@
|
||||
Puppet Master
|
||||
=============
|
||||
|
||||
Installation
|
||||
------------
|
||||
|
||||
Installation of a puppet master is in some way more difficult than all
|
||||
the other system, since no pre-existant infrastructure is supposed to
|
||||
be present. It comes natural that the Puppet master is the first
|
||||
server to be deployed in the current infrastructure.
|
||||
|
||||
This `Git repository <https://git.psi.ch/linux-infra/bootstrap>`_
|
||||
contains the code to deploy a new puppet master.
|
||||
|
||||
The procedure to install it are the following steps:
|
||||
|
||||
1. install the server, using ``puppet master`` as profile. See `this <http://boh.dont.know>`_ for more informations;
|
||||
|
||||
2. after the server reboot, you are be able to login with your `authorized ssh key <http://dont.know>`_;
|
||||
|
||||
3. copy the ssh root key to the right location with the right
|
||||
permissions, so that the server is able to authenticate itself
|
||||
against the git repository: ::
|
||||
|
||||
PUPPETMMASTER=puppetmaster.psi.ch
|
||||
scp ssh_rsa_key* root@$PUPPETMASTER:/root/.ssh
|
||||
ssh root@$PUPPETMASTER
|
||||
chmod 400 /etc/ssh/ssh_rsa_key
|
||||
chmod 444 /etc/ssh/ssh_rsa_key.pub
|
||||
|
||||
4. You can now deploy the puppet server with the following code: ::
|
||||
|
||||
git clone https://git.psi.ch/linux-infra/bootstrap
|
||||
cd bootstrap/instcode
|
||||
./puppetmaster.sh
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
@@ -0,0 +1,264 @@
|
||||
``role::base``
|
||||
==============
|
||||
|
||||
This role is special in that **it cannot be assigned to a system**. It is meant
|
||||
to be included by all other roles and provide basic functionality that all roles
|
||||
need anyway.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
====================== ======== ================================================
|
||||
**Name** **Type** **Default**
|
||||
---------------------- -------- ------------------------------------------------
|
||||
default_target string ``multi-user``
|
||||
enable_afs bool false
|
||||
enable_autofs bool false
|
||||
enable_filecopy bool hiera('base::enable_filecopy')
|
||||
enable_ganglia bool false
|
||||
enable_icinga bool true
|
||||
enable_kdump_client bool true
|
||||
enable_multipath bool hiera('base::enable_multipath')
|
||||
enable_nfs_server bool false
|
||||
enable_nomachine bool hiera('base::enable_nomachine')
|
||||
enable_platform bool hiera('base::enable_platform')
|
||||
enable_pmodules bool false
|
||||
enable_print_client bool false
|
||||
enable_rhgb bool false
|
||||
enable_sensu bool hiera('base::enable_sensu')
|
||||
enable_ssh_client bool hiera('base::enable_ssh_client')
|
||||
enable_telegraf bool hiera('base::enable_telegraf')
|
||||
enable_updatedb bool true
|
||||
include_aaa bool true
|
||||
include_log_client bool true
|
||||
include_yum_client bool true
|
||||
package_groups array []
|
||||
pkg_group::* array -
|
||||
selinux_mode string ``enforcing``
|
||||
====================== ======== ================================================
|
||||
|
||||
|
||||
``default_target``
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Specifies the systemd default target to configure. This does not *isolate* the
|
||||
target (see :manpage:`systemctl(1)`), but merely sets it so it will become
|
||||
active after a reboot.
|
||||
|
||||
|
||||
``enable_afs``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
Determines whether to include the :doc:`afs_client <../profiles/afs_client>`
|
||||
profile.
|
||||
|
||||
|
||||
``enable_autofs``
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
Enable the ``autofs`` service. This is **not** needed for automounts! It is only
|
||||
needed to support the ``-hosts`` map as documented in :manpage:`auto.master`.
|
||||
The ``-hosts`` map is mounted on ``/net``.
|
||||
|
||||
|
||||
``enable_filecopy``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Enable the ``filecopy`` profile, which allows deploying arbitrary files from
|
||||
``git.psi.ch`` through Hiera.
|
||||
|
||||
|
||||
``enable_ganglia``
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Determines whether to include the :doc:`ganglia_client
|
||||
<../profiles/ganglia_client>`.
|
||||
|
||||
|
||||
|
||||
``enable_sensu``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
Enable the Sensu client and checks.
|
||||
|
||||
|
||||
``enable_ssh_client``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Deploy global SSH client configuration, ie ``/etc/ssh/ssh_config``.
|
||||
|
||||
|
||||
``enable_telegraf``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Enable the telegraf monitoring agent, which reports various system metrics to
|
||||
InfluxDB servers.
|
||||
|
||||
|
||||
``enable_icinga``
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
Determines whether to include the :doc:`icinga_client
|
||||
<../profiles/icinga_client>` profile, which installs the client components
|
||||
necessary for Icinga-based monitoring.
|
||||
|
||||
|
||||
``enable_kdump_client``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Determines whether to include the :doc:`kdump_client <../profiles/kdump_client>`
|
||||
profile.
|
||||
|
||||
|
||||
``enable_multipath``
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Enable the ``multipath`` profile for basic multipath functionality.
|
||||
|
||||
|
||||
``enable_nfs_server``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Enable the kernel NFS server and configure the :manpage:`exports(5)` file. See
|
||||
the :doc:`nfs_server <../profiles/nfs_server>` profile for details.
|
||||
|
||||
|
||||
``enable_nomachine``
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Include the ``nomachine`` profile, which can install NoMachine NX in various
|
||||
configurations.
|
||||
|
||||
|
||||
``enable_platform``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Enable the ``platform`` profile, which installs and configures hardware-specific
|
||||
tools and configurations.
|
||||
|
||||
|
||||
``enable_pmodules``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Determines whether to enable the :doc:`pmodules <../profiles/pmodules>` profile.
|
||||
When true, the necessary configuration is automatically sourced for all normal
|
||||
users (ie UID >= 1000 and no ``-adm`` suffix) using :manpage:`bash(1)`.
|
||||
|
||||
Requires AFS to work, as the required configuration files are stored on AFS.
|
||||
|
||||
|
||||
``enable_print_client``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Enable and configure CUPS as a client. See the :doc:`print_client
|
||||
<../profiles/print_client>` profile for details.
|
||||
|
||||
|
||||
``enable_rhgb``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Determines whether the graphical boot screen is enabled.
|
||||
|
||||
|
||||
``enable_updatedb``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Determines whether or not :manpage:`updatedb(8)` (aka :manpage:`locate(1)`) is
|
||||
enabled or not. When enabled, it is still possible to exclude certain
|
||||
directories for indexing. This is also supported directly by the mounter module.
|
||||
|
||||
|
||||
``include_aaa``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Determines whether to include the :doc:`aaa <../profiles/aaa>` profile, which
|
||||
configures authentication, authorization, and (partly) auditing.
|
||||
|
||||
|
||||
``include_log_client``
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Include the :doc:`log_client <../profiles/log_client>` profile. This is only
|
||||
meant to allow roles customization of the :doc:`log_client
|
||||
<../profiles/log_client>` profile.
|
||||
|
||||
|
||||
``include_yum_client``
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Determines whether to include the :doc:`yum_client <../profiles/yum_client>`
|
||||
profile.
|
||||
|
||||
|
||||
``package_groups``
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The list of package groups to install. Package groups are defined using
|
||||
`pkg_group::NAME`_.
|
||||
|
||||
|
||||
``pkg_group::NAME``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
An array defining the package group ``NAME``. Package groups are installed using
|
||||
the `package_groups`_ parameter.
|
||||
|
||||
|
||||
``selinux_mode``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
The SELinux mode to use, one of ``enforcing``, ``permissive``, and ``disabled``.
|
||||
The *configured* SELinux mode (ie the setting in ``/etc/sysconfig/selinux``) is
|
||||
changed immediately. The runtime mode is changed as follows, as certain
|
||||
transitions are impossible without a reboot:
|
||||
|
||||
========== ========== ===========
|
||||
Current Setting New runtime
|
||||
---------- ---------- -----------
|
||||
Enforcing Disabled Permissive
|
||||
Enforcing Permissive Permissive
|
||||
Permissive Enforcing Enforcing
|
||||
Permissive Disabled Permissive
|
||||
Disabled Permissive Disabled
|
||||
Disabled Enforcing Disabled
|
||||
========== ========== ===========
|
||||
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
The most basic usage is::
|
||||
|
||||
class role::some_role () {
|
||||
|
||||
include role::base
|
||||
|
||||
...
|
||||
}
|
||||
|
||||
Most profiles that are included can be excluded when necessary::
|
||||
|
||||
class role::some_role () {
|
||||
|
||||
class {'role::base':
|
||||
include_icinga => false,
|
||||
}
|
||||
|
||||
...
|
||||
}
|
||||
|
||||
This can be used to customize some of the basic profiles::
|
||||
|
||||
class role::base () {
|
||||
|
||||
class {'role::base':
|
||||
include_aaa => false,
|
||||
}
|
||||
|
||||
class {'profile::aaa':
|
||||
allow_sudoers_d => true,
|
||||
}
|
||||
|
||||
...
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
``role::bootpc``
|
||||
================
|
||||
|
||||
This role implements a GFA bootpc system.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
``yum_client::pkg_group::bootpc``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The package group ``bootpc`` is *always* installed by this role. Other roles
|
||||
usually ignore it, but of course it can be installed on such systems using the
|
||||
``yum_client::package_groups`` parameter. See the :doc:`yum_client
|
||||
<../profiles/yum_client>` documentation for details.
|
||||
@@ -0,0 +1,82 @@
|
||||
``role::console``
|
||||
=================
|
||||
|
||||
A console as used at SLS/SwissFEL/... beamlines. Essentially a workstation with
|
||||
additional configuration for Epics, mounts, etc.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================= ========= ==============
|
||||
**Name** **Type** **Default**
|
||||
----------------- --------- --------------
|
||||
banner_message string See ``common.yaml``
|
||||
favorites array See ``common.yaml``
|
||||
keyboard_layouts array See ``common.yaml``
|
||||
local_homes bool false
|
||||
mount_root string
|
||||
mounts array
|
||||
priv_users array
|
||||
symlink_root string
|
||||
users array
|
||||
================= ========= ==============
|
||||
|
||||
|
||||
``banner_message``
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
A message displayed on the login screen.
|
||||
|
||||
|
||||
``favorites``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
The of applications/locations in the 'Favorites' menu. Entries usually specify
|
||||
an application's desktop file, eg. 'firefox.desktop'.
|
||||
|
||||
|
||||
``keyboard_layouts``
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The list of keyboard layouts available on the login screen.
|
||||
|
||||
|
||||
``local_homes``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Whether or not to use local homes in ``/home``.
|
||||
|
||||
|
||||
``mount_root``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
The directory where the mountpoint for the mounts in `mounts`_ are created.
|
||||
|
||||
|
||||
``mounts``
|
||||
~~~~~~~~~~
|
||||
|
||||
A list of mounts defined through ``mounter::def::NAME`` (see the :doc:`mounter
|
||||
<../profiles/mounter>`). The mounts must have a mountpoint beneath `mount_root`_
|
||||
for `symlink_root`_ to work properly.
|
||||
|
||||
|
||||
``priv_users``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
A list of users, which will have admin privileges in the UI. They can install
|
||||
additional software, for example.
|
||||
|
||||
|
||||
``symlink_root``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
The directory where the symlinks to the mounts in `mounts`_ are created.
|
||||
|
||||
|
||||
``users``
|
||||
~~~~~~~~~
|
||||
|
||||
The list of users/groups, who are allowed to log in. Group names must be
|
||||
prefixed with ``%``.
|
||||
@@ -0,0 +1,17 @@
|
||||
``role::daq_buffer``
|
||||
====================
|
||||
|
||||
A data acquisition server. This role assumes to be running on a system with two
|
||||
disks, ``/dev/sda`` and ``/dev/sdb``. Apart from the usual LVs for the OS there
|
||||
is another LV for metadata on ``/dev/sda`` (as usual). On ``/dev/sdb`` there is
|
||||
a single LV for the actual data.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
``daq_admins``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
A list of users with full root access on the system (in addition to the usual
|
||||
``aaa::admins``).
|
||||
@@ -0,0 +1,4 @@
|
||||
``role::dcache::t3_pools``
|
||||
==========================
|
||||
|
||||
This role implements a DCache pool for the Tier3.
|
||||
@@ -0,0 +1,28 @@
|
||||
``role::desktop``
|
||||
======================
|
||||
|
||||
This role implements a generic desktop system. The following features are
|
||||
supported:
|
||||
|
||||
- AFS (optional), with automatic token renewal
|
||||
- AD authentication
|
||||
- Printing via the PSI CUPS server
|
||||
- Multiple keyboard layouts on the login screen
|
||||
- Kerberos support for Firefox
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
``local_homes``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
If ``true``, then home directories are on local disk in ``/home``, otherwise the
|
||||
home directory is determined by AD.
|
||||
|
||||
|
||||
``priv_users``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
A list of privileged users. Every user on this list has full root and is a
|
||||
member of the wheel group.n
|
||||
@@ -0,0 +1,5 @@
|
||||
``role::ganglia_server``
|
||||
========================
|
||||
|
||||
This role implements a server running the Ganglia web interface for a Ganglia
|
||||
grid.
|
||||
@@ -0,0 +1,6 @@
|
||||
``role::grafana``
|
||||
=================
|
||||
|
||||
This role implements a server running the Grafana web interface.
|
||||
|
||||
For details on its configuration see the :doc:`grafana profile <../profiles/grafana>`.
|
||||
@@ -0,0 +1,2 @@
|
||||
``role::hpc::ces``
|
||||
==================
|
||||
@@ -0,0 +1,20 @@
|
||||
``role::hpc::cn``
|
||||
======================
|
||||
|
||||
This role implements a Computing Node. Currently only Slurm is supported.
|
||||
GPFS can be configured, but need changes in Puppet for newer clusters::
|
||||
|
||||
# Cluster specific classes
|
||||
case $cluster['name'] {
|
||||
'merlin5','ComputeCluster_SwissFEL','ra','xbl','sf': {
|
||||
class { 'profile::gpfs':; }
|
||||
}
|
||||
}
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
``cluster``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Must be defined by the setting: ``slurm::cluster`` in YAML.
|
||||
@@ -0,0 +1,4 @@
|
||||
``role::hpc::database``
|
||||
=======================
|
||||
|
||||
This role implements a MySQL server for Slurm.
|
||||
@@ -0,0 +1,64 @@
|
||||
``role::hpc::server``
|
||||
======================
|
||||
|
||||
This role implements a Server node. Currently only Slurm is supported.
|
||||
GPFS can be configured, but need changes in Puppet for newer clusters::
|
||||
|
||||
# Cluster specific classes
|
||||
case $cluster['name'] {
|
||||
'merlin5': {
|
||||
class { 'profile::gpfs':; }
|
||||
}
|
||||
}
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=========== ========= ==========================
|
||||
**Name** **Type** **Default**
|
||||
----------- --------- --------------------------
|
||||
has_slurm Boolean *true*
|
||||
cluster Hash *slurm::cluster*
|
||||
db_user String *slurm::db::user*
|
||||
db_password String *slurm::db::password*
|
||||
db_backup Boolean *slurm::db::backup*
|
||||
=========== ========= ==========================
|
||||
|
||||
``has_slurm``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
When set to ``true``, installs and configured a **slurm** server.
|
||||
By default **slurm** is always installed, it can be disabled by setting this
|
||||
parameter to ``false``
|
||||
|
||||
``cluster``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Must be defined by the setting ``slurm::cluster`` in YAML.
|
||||
|
||||
``db_user``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Must be defined by the setting ``slurm::db::user`` in YAML.
|
||||
|
||||
``db_passwd``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Must be defined by the setting ``slurm::db::password`` in YAML.
|
||||
|
||||
``db_backup``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Must be defined by the setting ``slurm::db::backup`` in YAML.
|
||||
|
||||
``db_options``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Can be defined by the setting ``slurm::db::options`` in YAML.
|
||||
Defaults to ``{}``
|
||||
|
||||
``db_backup_dir``
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
Can be defined by the setting ``slurm::db::backup_dir`` in YAML.
|
||||
Defaults to ``undef``
|
||||
@@ -0,0 +1,20 @@
|
||||
``role::hpc::ui``
|
||||
======================
|
||||
|
||||
This role implements a User Interface. Currently only Slurm is supported.
|
||||
GPFS can be configured, but need changes in Puppet for newer clusters::
|
||||
|
||||
# Cluster specific classes
|
||||
case $cluster['name'] {
|
||||
'merlin5','xbl','sf': {
|
||||
class { 'profile::gpfs':; }
|
||||
}
|
||||
}
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
``cluster``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Must be defined by the setting: ``slurm::cluster`` in YAML.
|
||||
@@ -0,0 +1,5 @@
|
||||
``role::influxdb``
|
||||
==================
|
||||
|
||||
This role implements a simple InfluxDB server. It is used in combination with
|
||||
the :doc:`telegraf client <../profiles/telegraf>`.
|
||||
@@ -0,0 +1,5 @@
|
||||
``role::jupyterserver``
|
||||
=========================
|
||||
|
||||
This role implements a Jupyterhub service that can spawn singleuser servers
|
||||
on cluster nodes via a batch system.
|
||||
@@ -0,0 +1,5 @@
|
||||
``role::log_server``
|
||||
=========================
|
||||
|
||||
This role implements a syslog server, accepting logs via UDP and TCP on
|
||||
port 514.
|
||||
@@ -0,0 +1,5 @@
|
||||
``role::login_server``
|
||||
===========================
|
||||
|
||||
This role implements a login server. Its primary purpose is to allow users
|
||||
without Linux workstations to work with Linux tools.
|
||||
@@ -0,0 +1,6 @@
|
||||
``role::media_station``
|
||||
=======================
|
||||
|
||||
A media station, ie. a workstation for transferring experimental data to
|
||||
external media (usually USB disks) and for managing said media.
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
``role::nomachine_proxy``
|
||||
=========================
|
||||
|
||||
This role implements a NoMachine proxy, acting as a HUB to access
|
||||
to other machines through SSH.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
================== ===================== ===============================================================================
|
||||
**Name** **Type** **Default**
|
||||
------------------ --------------------- -------------------------------------------------------------------------------
|
||||
$nomachine_desktop Enum['gnome','icewm'] ``hiera('nomachine::proxy::desktop_environment')``
|
||||
$banner_message String ``hiera('nomachine::gnome::banner', 'Wellcome to the NoMachine Proxy Server')``
|
||||
$keyboard_layouts Array ``hiera('nomachine::gnome::keyboards', ['us','de'])``
|
||||
================== ===================== ===============================================================================
|
||||
|
||||
```nomachine_desktop```
|
||||
~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Must be defined. Please refer to ``common.yaml`` to see the default value. Currently ``gnome`` is only supported.
|
||||
For ``icewm`` changes must be done in this class.
|
||||
|
||||
```banner_message```
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Customize Banner message. This can be done from hiera with ``nomachine::gnome::banner``
|
||||
|
||||
```keyboard_layouts```
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Modify this in order to add or remove the default keyboard layouts. This can be done from hiera with
|
||||
``nomachine::gnome::keyboards``
|
||||
@@ -0,0 +1,55 @@
|
||||
``role::reverse_proxy``
|
||||
=======================
|
||||
|
||||
A reverse proxy based on Apache, which maps a set of URLs to other URLs on
|
||||
various backend systems.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
=========== ========= ============
|
||||
**Name** **Type** **Default**
|
||||
----------- --------- ------------
|
||||
tls_cert string
|
||||
tls_chain string
|
||||
tls_key string
|
||||
backends hash
|
||||
allow_from string
|
||||
=========== ========= ============
|
||||
|
||||
|
||||
``tls_cert``
|
||||
~~~~~~~~~~~~
|
||||
|
||||
The TLS certificate (PEM).
|
||||
|
||||
|
||||
``tls_chain``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
The TLS certificate chain, ie. the intermediate certificate concatenated with
|
||||
the host's certificate.
|
||||
|
||||
|
||||
``tls_key``
|
||||
~~~~~~~~~~~
|
||||
|
||||
The TLS key (PEM). **Must be encrypted**!
|
||||
|
||||
|
||||
``backends``
|
||||
~~~~~~~~~~~~
|
||||
|
||||
A hash describing the URLs to be proxied. The keys are the URLs relative to the
|
||||
hostname, the values are hashes containing the following keys:
|
||||
|
||||
- ``url``: the URL to forward requests to
|
||||
|
||||
|
||||
``allow_from``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
An expression controlling access to the reverse proxy. Syntax as described in
|
||||
the `Apache manual
|
||||
<https://httpd.apache.org/docs/2.4/de/mod/mod_access_compat.html#allow>`_
|
||||
@@ -0,0 +1,5 @@
|
||||
``role::server``
|
||||
=====================
|
||||
|
||||
This role implements a generic server. Only basic system functionality is
|
||||
managed, e.g. authentication or logging.
|
||||
@@ -0,0 +1,4 @@
|
||||
``role::slurm_client``
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
**Deprecated**, please use ``role::hpc::ui`` instead.
|
||||
@@ -0,0 +1,4 @@
|
||||
``role::slurm_compute``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
**Deprecated**, please use ``role::hpc::cn`` instead.
|
||||
@@ -0,0 +1,4 @@
|
||||
``role::slurm_server``
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
**Deprecated**, please use ``role::hpc::server`` instead.
|
||||
@@ -0,0 +1,64 @@
|
||||
``role::softioc``
|
||||
=================
|
||||
|
||||
This role implements a GFA SoftIOC system.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
============== ======== ===================================
|
||||
local_homes bool hiera('softioc::local_homes')
|
||||
mount_root string hiera('softioc::mount_root')
|
||||
mounts hash hiera_hash('softioc::mounts', {})
|
||||
symlink_root string hiera('softioc::symlink_root')
|
||||
users array hiera('softioc::users', [])
|
||||
============== ======== ===================================
|
||||
|
||||
|
||||
``local_homes``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
If this is true, the home directories on the system will be in ``/home/%u``.
|
||||
|
||||
|
||||
``mount_root``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
The directory where the mounts given in ``mounts`` are mounted.
|
||||
|
||||
|
||||
``mounts``
|
||||
~~~~~~~~~~
|
||||
|
||||
A hash defining the mounts to be mounted below ``mount_root``.
|
||||
|
||||
|
||||
``symlink_root``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
This defines the directory where symlinks to the mounts defined by ``mounts``
|
||||
are created.
|
||||
|
||||
|
||||
``users``
|
||||
~~~~~~~~~
|
||||
|
||||
This overrides the ``aaa::users`` parameter.
|
||||
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
Configuration::
|
||||
|
||||
softioc::mount_root: '/gfa/.mounts'
|
||||
softioc::symlink_root: '/sf'
|
||||
softioc::mounts:
|
||||
'data':
|
||||
...
|
||||
|
||||
Resulting files:
|
||||
|
||||
- ``/gfa/.mounts/data``: mountpoint for ``data``
|
||||
- ``/sf/data ``: symlink to ``/gfa/.mounts/data``
|
||||
@@ -0,0 +1,26 @@
|
||||
``role::web_server``
|
||||
====================
|
||||
|
||||
This role implements a simple web server which simply exports directories under
|
||||
certain URLs.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
``directories``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
A hash whose keys are the (relative) URLs under which to export the directories.
|
||||
The values of the hash are the directories that should be made available.
|
||||
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
The following configuration exports ``/usr/share/doc`` as
|
||||
``$FQDN/documentation`` and ``/usr/share/man`` as ``$FQDN/manpages``::
|
||||
|
||||
web_server::directories:
|
||||
'/documentation': '/usr/share/doc'
|
||||
'/manpages': '/usr/share/man'
|
||||
@@ -0,0 +1,103 @@
|
||||
``role::workstation``
|
||||
=====================
|
||||
|
||||
This role implements a generic desktop system. The following features are
|
||||
supported:
|
||||
|
||||
- AFS (optional), with automatic token renewal
|
||||
- AD authentication
|
||||
- Printing via the PSI CUPS server
|
||||
- Multiple keyboard layouts on the login screen
|
||||
- Kerberos support for Firefox
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
|
||||
================= ========= ========================================
|
||||
**Name** **Type** **Default**
|
||||
----------------- --------- ----------------------------------------
|
||||
banner_message string See ``common.yaml``
|
||||
favorites array See ``common.yaml``
|
||||
keyboard_layouts array See ``common.yaml``
|
||||
local_homes bool false
|
||||
priv_users array []
|
||||
idle_delay integer hiera('workstation::idle_delay')
|
||||
lock_delay integer hiera('workstation::lock_delay')
|
||||
lock_enabled boolean hiera('workstation::lock_enabled')
|
||||
timedlogin_delay integer hiera('workstation::timedlogin_delay')
|
||||
timedlogin_enable boolean hiera('workstation::timedlogin_enable')
|
||||
timedlogin_user string hiera('workstation::timedlogin_user')
|
||||
================= ========= ========================================
|
||||
|
||||
``banner_message``
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
A message displayed on the login screen.
|
||||
|
||||
|
||||
``favorites``
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
The of applications/locations in the 'Favorites' menu. Entries usually specify
|
||||
an application's desktop file, eg. 'firefox.desktop'.
|
||||
|
||||
|
||||
``idle_delay``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
The number of seconds before the screensaver is started. Also see `lock_delay`_
|
||||
and `lock_enabled`_.
|
||||
|
||||
|
||||
``keyboard_layouts``
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The list of keyboard layouts available on the login screen.
|
||||
|
||||
|
||||
``local_homes``
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Whether or not to use local homes in ``/home``.
|
||||
|
||||
|
||||
``lock_delay``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
The number of seconds to wait after the start of the screensaver before locking
|
||||
the screen. Also see `idle_delay`_.
|
||||
|
||||
|
||||
``lock_enabled``
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
Whether or not to lock the screen after a period of inactivity. See
|
||||
`idle_delay`_ and `lock_delay`_ for more.
|
||||
|
||||
|
||||
``priv_users``
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
A list of users, which will have admin privileges in the UI. They can install
|
||||
additional software, for example.
|
||||
|
||||
|
||||
``timedlogin_delay``
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
How many seconds to wait at the login screen before logging in automatically.
|
||||
|
||||
|
||||
``timedlogin_enable``
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Enable automatic logins. This does not work with accounts which require AFS, of
|
||||
course.
|
||||
|
||||
|
||||
``timedlogin_user``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Which user to log in as if automatic logins have been enabled.
|
||||
@@ -0,0 +1,30 @@
|
||||
``role::zookeeper``
|
||||
===================
|
||||
|
||||
This role implements a `zookeeper <https://zookeeper.apache.org/>`_ server. It
|
||||
only writes the configuration files and enables and starts the service. It *does
|
||||
not* install the necessary packages.
|
||||
|
||||
|
||||
Parameters
|
||||
----------
|
||||
|
||||
Technically this role has no parameters, but the following parameters are used
|
||||
by ``profile::zookeeper``.
|
||||
|
||||
================= ========= =========================================
|
||||
myid string hiera('zookeeper::myid')
|
||||
zookeeper_nodes array hiera('zookeeper::zookeeper_nodes', [])
|
||||
================= ========= =========================================
|
||||
|
||||
|
||||
``myid``
|
||||
~~~~~~~~
|
||||
|
||||
The unique ID of the zookeeper node.
|
||||
|
||||
|
||||
``zookeeper_nodes``
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The list off zookeeper nodes in the cluster.
|
||||
Reference in New Issue
Block a user