Ben Vincent
fe3c1a1410
ci/woodpecker/pr/ruby-validate Pipeline was successful
ci/woodpecker/pr/puppet-lint Pipeline was successful
ci/woodpecker/pr/yamllint Pipeline was successful
ci/woodpecker/pr/bolt-validate Pipeline was successful
ci/woodpecker/pr/erb-validate Pipeline was successful
ci/woodpecker/pr/epp-validate Pipeline was successful
ci/woodpecker/pr/puppet-validate Pipeline was successful
ci/woodpecker/pr/ruby-check Pipeline was successful
Add a structured `netbox` fact that reads this node's IP/interface data from NetBox, and profiles::netbox::facts to seed its credentials. - netbox fact: queries NetBox (devices + VMs) by fqdn/hostname, emits interfaces (name, mac, ips, primary) and primary_ip. - Caches every success to /var/cache/puppet-netbox/facts.json (0600). On any failure (short timeouts, DNS, non-200, parse) it serves the cached payload with cached=true; static IPs never change so stale is always safe. A never-cached host returns nothing; the fact never raises. - profiles::netbox::facts: inert until $api_token is set; writes the root-only token/url files and the cache dir. Confined off (no-op) on hosts without the token. Included from profiles::base. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
76 lines
2.3 KiB
Puppet
76 lines
2.3 KiB
Puppet
# this is the base class, which will be used by all servers
|
|
class profiles::base () {
|
|
|
|
# run a limited set of classes on the first run aimed at bootstrapping the new node
|
|
if $facts['firstrun'] {
|
|
include profiles::firstrun::init
|
|
}else{
|
|
|
|
# install the vault ca first
|
|
include profiles::pki::vaultca
|
|
|
|
# manage the puppet agent
|
|
include profiles::puppet::agent
|
|
include profiles::puppet::client
|
|
# k8s migration switch; ships disabled, flip its ::enabled boolean in
|
|
# hiera (node/role/common) to repoint a target onto puppet-on-k8s.
|
|
include profiles::puppet::migrate
|
|
|
|
# include the base profiles
|
|
include profiles::base::repos
|
|
include profiles::packages
|
|
include profiles::base::motd
|
|
include profiles::base::scripts
|
|
include profiles::base::hosts
|
|
include profiles::base::groups
|
|
include profiles::accounts::root
|
|
include profiles::accounts::sysadmin
|
|
if $facts['virtual'] != 'lxc' {
|
|
include profiles::ntp::client
|
|
}
|
|
include profiles::dns::base
|
|
include profiles::pki::vault
|
|
include profiles::ssh::sign
|
|
include profiles::ssh::knownhosts
|
|
include profiles::ssh::service
|
|
include profiles::cloudinit::init
|
|
include profiles::helpers::node_lookup
|
|
include profiles::netbox::facts
|
|
include profiles::consul::client
|
|
include victorialogs::client::journald
|
|
|
|
# include the python class
|
|
class { 'python':
|
|
manage_python_package => true,
|
|
manage_venv_package => true,
|
|
manage_pip_package => true,
|
|
use_epel => false,
|
|
}
|
|
|
|
# all hosts will have sudo applied
|
|
class { 'sudo':
|
|
secure_path => '/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/opt/puppetlabs/bin'
|
|
}
|
|
|
|
# manage virtualised guest agents
|
|
if $::facts['is_virtual'] and $::facts['dmi']['manufacturer'] == 'QEMU' {
|
|
include profiles::qemu::agent
|
|
}
|
|
|
|
class { 'limits':
|
|
purge_limits_d_dir => false,
|
|
}
|
|
|
|
# include classes from hiera
|
|
$hiera_include = lookup('hiera_include', Array[String], 'unique', [])
|
|
$hiera_exclude = lookup('hiera_exclude', Array[String], 'unique', [])
|
|
($hiera_include - $hiera_exclude).include
|
|
|
|
# specifc ordering constraints
|
|
Class['profiles::defaults']
|
|
-> Class['profiles::pki::vaultca']
|
|
-> Class['profiles::base::repos']
|
|
-> Class['profiles::packages']
|
|
}
|
|
}
|