Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make Firewall & hostname optional #72

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Make Firewall & hostname optional #72

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9a5bf08
fix: unquoted fact
Mar 14, 2017
ae7c12d
disabled firewal
Mar 17, 2017
f48c9c9
added ipa-server-dns required to be able to configure ipa with dns
Mar 17, 2017
4668cf4
make hostane setting optional
dvadgama Mar 19, 2017
d24950e
fix: hostopts in master.pp
dvadgama Mar 19, 2017
84450bd
fixed: reassignment error
dvadgama Mar 19, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions manifests/init.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,8 @@
# $clntpkg = 'ipa-client' - IPA client package.
# $ldaputils = true - Controls the instalation of the LDAP utilities package.
# $ldaputilspkg = 'openldap-clients' - LDAP utilities package.
#
# $enable_firewall = true - Install and Configure iptables ? this is not desired for docker container
# $enable_hostname = true - Configure hostname during instalation? this is not desired for docker container
# === Variables
#
#
Expand Down Expand Up @@ -102,15 +103,17 @@
$autofs = false,
$svrpkg = 'ipa-server',
$clntpkg = $::osfamily ? {
Debian => 'freeipa-client',
'Debian' => 'freeipa-client',
default => 'ipa-client',
},
$ldaputils = true,
$ldaputilspkg = $::osfamily ? {
Debian => 'ldap-utils',
'Debian' => 'ldap-utils',
default => 'openldap-clients',
},
$idstart = false
$idstart = false,
$enable_firewall = true,
$enable_hostname = true
) {

@package { $ipa::svrpkg:
Expand Down Expand Up @@ -158,6 +161,9 @@
}

if $ipa::dns {
@package {'ipa-server-dns':
ensure => installed
}
@package { 'bind-dyndb-ldap':
ensure => installed
}
Expand Down Expand Up @@ -259,7 +265,9 @@
http_pin => $ipa::http_pin,
subject => $ipa::subject,
selfsign => $ipa::selfsign,
idstart => $ipa::idstart
idstart => $ipa::idstart,
enable_firewall => $ipa::enable_firewall,
enable_hostname => $ipa::enable_hostname,
}

if ! $ipa::adminpw {
Expand All @@ -278,7 +286,8 @@
adminpw => $ipa::adminpw,
dspw => $ipa::dspw,
kstart => $ipa::kstart,
sssd => $ipa::sssd
sssd => $ipa::sssd,
enable_firewall => $ipa::enable_firewall
}

class { 'ipa::client':
Expand Down
73 changes: 46 additions & 27 deletions manifests/master.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,12 +38,19 @@
$http_pin = {},
$subject = {},
$selfsign = {},
$idstart = {}
$idstart = {},
$enable_firewall = '',
$enable_hostname = '',
) {

Ipa::Serverinstall[$::fqdn] -> File['/etc/ipa/primary'] -> Ipa::Hostadd <<| |>> -> Ipa::Replicareplicationfirewall <<| tag == "ipa-replica-replication-firewall-${ipa::master::domain}" |>> -> Ipa::Replicaprepare <<| tag == "ipa-replica-prepare-${ipa::master::domain}" |>> -> Ipa::Createreplicas[$::fqdn]
if $enable_firewall {
Ipa::Serverinstall[$::fqdn] -> File['/etc/ipa/primary'] -> Ipa::Hostadd <<| |>> -> Ipa::Replicareplicationfirewall <<| tag == "ipa-replica-replication-firewall-${ipa::master::domain}" |>> -> Ipa::Replicaprepare <<| tag == "ipa-replica-prepare-${ipa::master::domain}" |>> -> Ipa::Createreplicas[$::fqdn]

Ipa::Replicareplicationfirewall <<| tag == "ipa-replica-replication-firewall-${ipa::master::domain}" |>>
Ipa::Replicareplicationfirewall <<| tag == "ipa-replica-replication-firewall-${ipa::master::domain}" |>>
}
else{
Ipa::Serverinstall[$::fqdn] -> File['/etc/ipa/primary'] -> Ipa::Hostadd <<| |>> -> Ipa::Replicaprepare <<| tag == "ipa-replica-prepare-${ipa::master::domain}" |>> -> Ipa::Createreplicas[$::fqdn]
}
Ipa::Replicaprepare <<| tag == "ipa-replica-prepare-${ipa::master::domain}" |>>
Ipa::Hostadd <<| |>>

Expand Down Expand Up @@ -100,12 +107,21 @@
}
$dnsopt = '--setup-dns'
realize Package['bind-dyndb-ldap']
realize Package['ipa-server-dns']
}
else {
$dnsopt = ''
$forwarderopts = ''
}

if $ipa::master::enable_hostname {
$hostopt = "--hostname=${::fqdn}"
}
else
{
$hostopt = ''
}

$ntpopt = $ipa::master::ntp ? {
false => '--no-ntp',
default => ''
Expand Down Expand Up @@ -133,7 +149,8 @@
ntpopt => $ipa::master::ntpopt,
extcaopt => $ipa::master::extcaopt,
idstart => $ipa::master::generated_idstart,
require => Package[$ipa::master::svrpkg]
require => Package[$ipa::master::svrpkg],
hostopt => $ipa::master::hostopt
}

if $extca {
Expand All @@ -159,33 +176,35 @@
ipa::createreplicas { $::fqdn:
}

firewall { '101 allow IPA master TCP services (http,https,kerberos,kpasswd,ldap,ldaps)':
ensure => 'present',
action => 'accept',
proto => 'tcp',
dport => ['80','88','389','443','464','636']
}
if $ipa::enable_firewall {
firewall { '101 allow IPA master TCP services (http,https,kerberos,kpasswd,ldap,ldaps)':
ensure => 'present',
action => 'accept',
proto => 'tcp',
dport => ['80','88','389','443','464','636']
}

firewall { '102 allow IPA master UDP services (kerberos,kpasswd,ntp)':
ensure => 'present',
action => 'accept',
proto => 'udp',
dport => ['88','123','464']
}
firewall { '102 allow IPA master UDP services (kerberos,kpasswd,ntp)':
ensure => 'present',
action => 'accept',
proto => 'udp',
dport => ['88','123','464']
}

@@ipa::replicapreparefirewall { $::fqdn:
source => $::ipaddress,
tag => "ipa-replica-prepare-firewall-${ipa::master::domain}"
}
@@ipa::replicapreparefirewall { $::fqdn:
source => $::ipaddress,
tag => "ipa-replica-prepare-firewall-${ipa::master::domain}"
}

@@ipa::masterreplicationfirewall { $::fqdn:
source => $::ipaddress,
tag => "ipa-master-replication-firewall-${ipa::master::domain}"
}
@@ipa::masterreplicationfirewall { $::fqdn:
source => $::ipaddress,
tag => "ipa-master-replication-firewall-${ipa::master::domain}"
}

@@ipa::masterprincipal { $::fqdn:
realm => $ipa::master::realm,
tag => "ipa-master-principal-${ipa::master::domain}"
@@ipa::masterprincipal { $::fqdn:
realm => $ipa::master::realm,
tag => "ipa-master-principal-${ipa::master::domain}"
}
}

@@ipa::clientinstall { $::fqdn:
Expand Down
58 changes: 33 additions & 25 deletions manifests/replica.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,19 @@
$dspw = {},
$domain = {},
$kstart = {},
$sssd = {}
$sssd = {},
$enable_firewall = '',
) {

Class['ipa::client'] -> Ipa::Masterprincipal <<| tag == "ipa-master-principal-${ipa::replica::domain}" |>> -> Ipa::Replicapreparefirewall <<| tag == "ipa-replica-prepare-firewall-${ipa::replica::domain}" |>> -> Ipa::Masterreplicationfirewall <<| tag == "ipa-master-replication-firewall-${ipa::replica::domain}" |>> -> Ipa::Replicainstall[$::fqdn] -> Service['ipa']
if $enable_firewall {
Class['ipa::client'] -> Ipa::Masterprincipal <<| tag == "ipa-master-principal-${ipa::replica::domain}" |>> -> Ipa::Replicapreparefirewall <<| tag == "ipa-replica-prepare-firewall-${ipa::replica::domain}" |>> -> Ipa::Masterreplicationfirewall <<| tag == "ipa-master-replication-firewall-${ipa::replica::domain}" |>> -> Ipa::Replicainstall[$::fqdn] -> Service['ipa']

Ipa::Replicapreparefirewall <<| tag == "ipa-replica-prepare-firewall-${ipa::replica::domain}" |>>
Ipa::Masterreplicationfirewall <<| tag == "ipa-master-replication-firewall-${ipa::replica::domain}" |>>
Ipa::Masterprincipal <<| tag == "ipa-master-principal-${ipa::replica::domain}" |>>
Ipa::Replicapreparefirewall <<| tag == "ipa-replica-prepare-firewall-${ipa::replica::domain}" |>>
Ipa::Masterreplicationfirewall <<| tag == "ipa-master-replication-firewall-${ipa::replica::domain}" |>>
Ipa::Masterprincipal <<| tag == "ipa-master-principal-${ipa::replica::domain}" |>>
}else {
Class['ipa::client'] -> Ipa::Replicainstall[$::fqdn] -> Service['ipa']
}

if $::osfamily != 'RedHat' {
fail("Cannot configure an IPA replica server on ${::operatingsystem} operating systems. Must be a RedHat-like operating system.")
Expand All @@ -42,18 +47,30 @@
realize Service['sssd']
}

firewall { '101 allow IPA replica TCP services (kerberos,kpasswd,ldap,ldaps)':
ensure => 'present',
action => 'accept',
proto => 'tcp',
dport => ['88','389','464','636']
}
if $enable_firewall {
firewall { '101 allow IPA replica TCP services (kerberos,kpasswd,ldap,ldaps)':
ensure => 'present',
action => 'accept',
proto => 'tcp',
dport => ['88','389','464','636']
}

firewall { '102 allow IPA replica UDP services (kerberos,kpasswd,ntp)':
ensure => 'present',
action => 'accept',
proto => 'udp',
dport => ['88','123','464']
}

@@ipa::replicareplicationfirewall { $::fqdn:
source => $::ipaddress,
tag => "ipa-replica-replication-firewall-${ipa::replica::domain}"
}

firewall { '102 allow IPA replica UDP services (kerberos,kpasswd,ntp)':
ensure => 'present',
action => 'accept',
proto => 'udp',
dport => ['88','123','464']
@@ipa::replicaprepare { $::fqdn:
dspw => $ipa::replica::dspw,
tag => "ipa-replica-prepare-${ipa::replica::domain}"
}
}

ipa::replicainstall { $::fqdn:
Expand All @@ -62,13 +79,4 @@
require => Package[$ipa::replica::svrpkg]
}

@@ipa::replicareplicationfirewall { $::fqdn:
source => $::ipaddress,
tag => "ipa-replica-replication-firewall-${ipa::replica::domain}"
}

@@ipa::replicaprepare { $::fqdn:
dspw => $ipa::replica::dspw,
tag => "ipa-replica-prepare-${ipa::replica::domain}"
}
}
5 changes: 3 additions & 2 deletions manifests/serverinstall.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,15 +11,16 @@
$forwarderopts = {},
$ntpopt = {},
$extcaopt = {},
$idstart = {}
$idstart = {},
$hostopt = {},
) {

$idstartopt = "--idstart=${idstart}"

anchor { 'ipa::serverinstall::start': }

exec { "serverinstall-${host}":
command => "/usr/sbin/ipa-server-install --hostname=${host} --realm=${realm} --domain=${domain} --admin-password='${adminpw}' --ds-password='${dspw}' ${dnsopt} ${forwarderopts} ${ntpopt} ${extcaopt} ${idstartopt} --unattended",
command => "/usr/sbin/ipa-server-install ${hostopt} --realm=${realm} --domain=${domain} --admin-password='${adminpw}' --ds-password='${dspw}' ${dnsopt} ${forwarderopts} ${ntpopt} ${extcaopt} ${idstartopt} --unattended",
timeout => '0',
unless => '/usr/sbin/ipactl status >/dev/null 2>&1',
creates => '/etc/ipa/default.conf',
Expand Down