wmdeit-cf-wmdelib/lib.cf

458 lines
9.1 KiB
CFEngine3

#
#
#
body perms uperm(user,group,mode)
{
mode => "$(mode)";
rxdirs => "false";
groups => { "$(group)" };
owners => { "$(user)" };
}
#
# wmdelib.cf
#
bundle agent wmde_install_packages(pkgs,name)
{
packages:
freebsd::
"$(pkgs)"
policy => "present",
package_module => pkg,
handle => "$(name)_pkgs_installed",
classes => results("namespace","$(name)");
debian::
"$(pkgs)"
policy => "present",
package_module => apt_get,
handle => "$(name)_pkgs_installed",
classes => results("namespace","$(name)");
fedora|centos::
"$(pkgs)"
policy => "present",
package_module => yum,
handle => "$(name)_pkgs_installed",
classes => results("namespace","$(name)");
}
body perms wmde_perms(user,group,mode)
{
owners => { "$(user)" };
groups => { "$(group)" };
mode => "$(mode)";
rxdirs=>"false";
}
bundle agent wmde_srv(service_name,cmd)
{
classes:
"start" expression => strcmp("start","$(cmd)");
"restart" expression => strcmp("restart",cmd);
commands:
freebsd::
"/bin/sh"
args => "-c '/usr/sbin/service $(service_name) onestatus > /dev/null && echo +$(service_name)_running || echo -$(service_name)_running'",
inform => "false",
module => "true",
handle => "$(service_name)_status_tested";
"!$(service_name)_running&start"::
"/bin/sh"
args => "-c '/usr/sbin/service $(service_name) onestart 2> /dev/null > /dev/null && echo +$(service_name)_started || echo -$(service_name)_started'",
module => "true",
depends_on => {"$(service_name)_status_tested"};
"!$(service_name)_running&restart"::
"/bin/sh"
args => "-c '/usr/sbin/service $(service_name) onerestart 2> /dev/null > /dev/null && echo +$(service_name)_started || echo -$(service_name)_started'",
module => "true",
depends_on => {"$(service_name)_status_tested"};
reports:
start::
# "MUST START";
!start::
# "MUST NOT START";
# running::
# "Server $(service_name) - running";
# !running::
# "Server $(service_name) - not running";
}
body service_method wmde
{
service_type => "generic";
service_bundle => wmde_srv ($(this.promiser), $(this.service_policy));
}
bundle agent wmde_enable_service(bundlename)
{
vars:
freebsd::
# "cha" string => "$(bundlename).service_cfg_name";
"filename" string => "/etc/rc.conf.d/$($(bundlename).service_cfg_name)";
files:
freebsd::
"$(filename)"
create => "true",
perms => m("644"),
content => "$($(bundlename).service_cfg_name)_enable=YES";
reports:
# "FREEBSD: $(filename) $(cha)";
}
bundle agent wmde_service(service_name,start_cond, restart_cond)
{
classes:
freebsd::
"service_running" expression => returnszero("/usr/sbin/service $(service_name) onestatus >/dev/null 2>&1", "useshell");
commands:
"freebsd&(!service_running)&($(start_cond))"::
"/usr/sbin/service"
args => "$(service_name) onestart >/dev/null 2>&1",
contain => wmde_cmd_useshell,
handle => "$(handle)_service_started";
"freebsd&(service_running)&($(start_cond))"::
"/usr/bin/true"
inform => "false",
handle => "$(handle)_service_started";
"freebsd&($(restart_cond))"::
"/usr/sbin/service"
args => "$(service_name) onerestart >/dev/null 2>&1",
contain => wmde_cmd_useshell,
handle => "$(handle)_service_restarted";
services:
"(!freebsd)&($(start_cond))"::
"$(service_name)"
service_policy => "start",
handle => "$(handle)_service_started";
"(!freebsd)&($(restart_cond))"::
"$(service_name)"
service_policy => "restart",
handle => "$(handle)_service_restarted";
reports:
}
bundle agent wmde_restart_service(service_name, id)
{
commands:
debian|centos|fedora::
"/bin/sh -c "
args => "'/bin/echo $(id) > /dev/null && /usr/bin/systemctl restart $(service_name)'";
freebsd::
"/bin/sh -c "
args => "'/bin/echo $(id) > /dev/null && /usr/sbin/service $(service_name) onerestart'";
}
body contain wmde_cmd_useshell
{
useshell=>"useshell";
}
bundle agent download_and_untar(
name,
sync_src,
sync_dst,
install_dir,
test_file
)
{
classes:
"$(name)_untar" expression => not(fileexists("$(test_file)"));
files:
"$(sync_dst)"
copy_from => sync_cp("$(sync_src)","$(sys.policy_hub)"),
handle => "$(name)_tgz_copied",
classes => if_repaired ("$(name)_untar"),
perms => m(644);
commands:
"$(name)_untar"::
"/usr/bin/tar"
args => "xzvf $(sync_dst) -C $(install_dir)",
depends_on => {"$(name)_tgz_copied"},
handle => "$(name)_untarred";
reports:
# "TESTFILE: $(test_file)";
}
bundle agent install_yum_repo(name,content)
{
files:
"/etc/yum.repos.d/$(name).repo"
create => "true",
content => $(content),
classes => if_repaired("yum_repo_$(name)_repaired"),
handle => "yum_repo_$(name)_installed";
commands:
"yum_repo_$(name)_repaired"::
"dnf"
args => "makecache",
contain => wmde_cmd_useshell;
}
bundle agent install_apt_repo(name,repo_src,key_src,key_name)
{
classes:
debian|ubuntu::
"do_install" expression => not(fileexists("/etc/apt/sources.list.d/$(name).list"));
vars:
do_install::
"pkgs" slist => {
"curl",
"ca-certificates",
"lsb-release"
};
"add_repo_cmd" string => "/usr/bin/add-apt-repository";
methods:
do_install::
"any" usebundle => install_wget;
"any" usebundle => wmde_install_packages(@(pkgs),"apt_repo");
commands:
do_install::
"/bin/sh"
args => "$(sys.workdir)/inputs/$(def.wmde_libdir)/scripts/install-php-repo.sh $(name) $(repo_src) $(key_src) $(key_name)",
depends_on => {
"wget_pkgs_installed",
"apt_repo_pkgs_installed"
};
}
bundle agent install_server_tools
{
vars:
debian|fedora|centos::
"pkgs" slist => {
"net-tools",
"telnet",
"tcpdump",
"nmap"
};
methods:
debian|fedora|centos::
"any" usebundle => wmde_install_packages(@(pkgs),"server_tools");
}
bundle agent install_system_repos
{
classes:
centos::
"centos_9_and_later" expression => isgreaterthan("$(sys.os_version_major)", "8") ;
commands:
vars:
# centos::
# "pkgs" slist => {
# "epel-release"
# };
# !centos::
# "pkgs" slist => {},
# handle => "system_repos_pkgs_installed";
commands:
centos::
"/usr/bin/yum"
args => "install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(sys.os_version_major).noarch.rpm",
if => not(returnszero("rpm -q epel-release > /dev/null","useshell")),
handle=>"system_repos_pkgs_installed";
centos_8::
"/usr/bin/dnf"
inform => "false",
args => "config-manager --set-enabled powertools";
centos_9_and_later::
"/usr/bin/dnf"
inform => "false",
args => "config-manager --set-enabled crb";
"/usr/bin/update-crypto-policies"
inform => "false",
contain => wmde_cmd_useshell,
args => "--set LEGACY > /dev/null";
methods:
# "any" usebundle => wmde_install_packages(@(pkgs),"system_repos");
reports:
}
bundle agent download_file(method,src,dst,cls,prms_arg)
{
vars:
"prms_default" data => '{
"m":"600",
"o":"$(sys.user_data[uid])",
"g":"$(sys.user_data[gid])"
}';
"prms" data => mergedata(@(prms_default),parsejson($(prms_arg)));
classes:
"$(method)";
wget::
"run_wget" expression => not(fileexists($(dst)));
files:
policyhub::
"$(dst)"
copy_from => remote_dcp("$(src)","$(sys.policy_hub)"),
classes => if_repaired("$(cls)_repaired"),
perms => mog ("$(prms[m])","$(prms[o])","$(prms[g])");
methods:
wget::
"any" usebundle => "install_wget"; #, handle=>"wget_installed";
commands:
run_wget::
"$(wget.exe)"
args => "-q -O $(dst) $(src) || (rm -f $(dst) && /usr/bin/false) ",
contain => wmde_cmd_useshell,
handle => "$(cls)_downloaded",
classes => results("namespace","$(cls)"),
depends_on => {"wget_installed"},
inform => "true";
"/usr/bin/true"
inform => "false",
depends_on => {"$(cls)_downloaded"},
classes => if_repaired("$(cls)_kept");
(!run_wget)&(wget)::
"/usr/bin/true"
inform => "false",
classes => if_repaired("$(cls)_kept");
files:
"$(dst)"
perms => mog ("$(prms[m])","$(prms[o])","$(prms[g])"),
depends_on => {"$(cls)_downloaded"};
reports:
}
bundle edit_line bind_mount(src,dst)
{
insert_lines:
freebsd::
"$(src) $(dst) nullfs rw,late 0 0";
centos::
"$(src) $(dst) none defaults,bind 0 0";
}
bundle agent bind_mount(src,dst)
{
files:
"/etc/fstab"
edit_line => bind_mount("$(src)","$(dst)"),
classes => if_repaired(bind_mount_fstab_changed);
commands:
bind_mount_fstab_changed::
"echo '$(src)$(dst)' > /dev/null && mount"
contain=>wmde_cmd_useshell,
args => "-a";
}
bundle agent etc_hosts(hosts)
{
vars:
"idx" slist => getindices(@(hosts));
"settings[$(idx)]" string => "$(hosts[$(idx)])";
files:
"/etc/hosts"
create => "true",
perms => m("644"),
edit_line => set_config_values("$(this.bundle).settings"),
classes => results("namespace","etc_hosts");
}
bundle agent cron
{
vars:
"cron_d" string => "/etc/cron.d";
freebsd::
"cron_d" string => "/usr/local/etc/cron.d";
files:
"$(cron_d)/."
create => "true",
handle => "cron_d_created";
}
bundle agent create_cron_job(name,time,command)
{
methods:
"any" usebundle => cron;
files:
"$(cron.cron_d)/$(name)"
create => "true",
content => "#
# Managed by CFEngin
#
$(time) $(command)
",
depends_on => {"cron_d_created"};
}