Merge remote-tracking branch 'origin/develop' into benvin/go-signer-rpms

site/profiles/manifests/dns/updater.pp

@@ -24,8 +24,7 @@ class profiles::dns::updater (
   Stdlib::AbsolutePath        $config_dir      = '/etc/dns-updater',
   Stdlib::AbsolutePath        $master_basedir  = lookup('profiles::dns::master::basedir'),
   # dns-updater daemon (replaces the dns-update shell script). 'latest' so hosts
-  # pick up new releases (e.g. the record filter); rpm-internal metadata_expire
-  # is 1h so this does not thrash.
+  # pick up new releases (e.g. the record filter).
   String                      $package_ensure   = 'latest',
   Stdlib::AbsolutePath        $api_socket       = '/run/dns-updater/api.sock',
   String                      $resync           = '10m',

site/profiles/manifests/puppet/encapic.pp

@@ -0,0 +1,32 @@
+# Class: profiles::puppet::encapic
+#
+# Manages the configuration for the encapic ENC client. The package itself is
+# installed through profiles::packages (pinned in hiera); this class owns the
+# config so the encapi endpoint can change without repackaging.
+class profiles::puppet::encapic (
+  Stdlib::HTTPUrl       $encapi_url,
+  Stdlib::AbsolutePath  $config_dir = '/etc/encapic',
+  String                $config_name = 'encapic.conf',
+  String                $owner = 'root',
+  String                $group = 'root',
+) {
+
+  # The RPM ships this file as %config(noreplace), so puppet must write it only
+  # once the package is present or the install overwrites it.
+  file { $config_dir:
+    ensure  => directory,
+    mode    => '0755',
+    owner   => $owner,
+    group   => $group,
+    require => Package['encapic'],
+  }
+
+  file { "${config_dir}/${config_name}":
+    ensure  => file,
+    mode    => '0644',
+    owner   => $owner,
+    group   => $group,
+    content => "ENCAPI_URL=${encapi_url}\n",
+    require => File[$config_dir],
+  }
+}

site/profiles/manifests/puppet/puppetmaster.pp

@@ -12,6 +12,7 @@ class profiles::puppet::puppetmaster (
     include profiles::puppet::g10k
     include profiles::puppet::enc
     include profiles::puppet::cobbler_enc
+    include profiles::puppet::encapic
     include profiles::puppet::autosign
     include profiles::puppet::gems
     include profiles::helpers::certmanager

site/roles/manifests/infra/network/router.pp

@@ -0,0 +1,12 @@
+# roles::infra::network::router
+# an ospf router; frr only, interfaces and firewall are managed outside puppet
+#
+class roles::infra::network::router {
+  if $facts['firstrun'] {
+    include profiles::defaults
+    include profiles::firstrun::init
+  }else{
+    include profiles::defaults
+    include profiles::base
+  }
+}