Browse code Initial commit master
0 parent commit 77d1dea95e42b549b1517e9e9a6d522ac07a5df5 Mark George authored on 11 Feb 2021

Showing 14 changed files

• .gitignore
• README.md
• bootstrap.sh
• environments/production/manifests/site.pp
• environments/production/modules/bootstrap/files/authentication/etc/krb5.conf
• environments/production/modules/bootstrap/files/authentication/etc/realmd.conf
• environments/production/modules/bootstrap/files/authentication/etc/sssd/sssd.conf
• environments/production/modules/bootstrap/files/authentication/etc/systemd/resolved.conf
• environments/production/modules/bootstrap/files/authentication/etc/systemd/timesyncd.conf
• environments/production/modules/bootstrap/files/puppet_agent/etc/puppet/puppet.conf
• environments/production/modules/bootstrap/files/puppet_agent/etc/systemd/system/puppet.service.d/wait_for_network.conf
• environments/production/modules/bootstrap/manifests/domain_configuration.pp
• environments/production/modules/bootstrap/manifests/init.pp
• environments/production/modules/bootstrap/manifests/puppet_agent.pp

Ignore Space Show notes View .gitignore 0 → 100644
domain_sekrit

Ignore Space Show notes View README.md 0 → 100644

# Post-install bootstrap A minimal post-install configuration that gets a lab machine into a state where puppet can take it the rest of the way for full install. Currently performs the following operations: * Clones this repo into /tmp/bootstrap * Prompts for and sets hostname. * Installs and configures realmd. * Installs and configures sssd. * Configures puppet to use sbis-puppet as master. * Joins the STUDENT domain. Most of the configiuration is provided via the puppet scripts in this repo. Requires a file named `domain_sekrit` that is not part of this repo. This file should contain 3 lines as follows: ``` domain_join_user_name@FULLY.QUALIFIED.DOMAIN.NAME fully.qualified.domain.to.join domain_join_user's password ``` Note the capitalisation. # Usage 1. Make a copy of the `bootstrap.sh` file in the repo, and add to CIDATA volume of install UFD. 1. Add a valid `domain_sekrit` file to the same location as the above script. 1. Install Ubuntu. 1. Mount the CIDATA volume of the install UFD. 1. Run the `bootstrap.sh` script.

Ignore Space Show notes View bootstrap.sh 0 → 100755

#!/usr/bin/env bash # Author: MG BASE_PATH=$(pwd) CURRENT_USER=$(whoami) if [[ ${CURRENT_USER} != root ]]; then echo "You need to run this script as root. Aborting." exit fi cd /tmp echo "## Cloning bootstrap repo ##" git clone https://isgb.otago.ac.nz/infosci/git/linux_lab/bootstrap.git cd bootstrap echo echo -n "Enter hostname: " read hostname echo ${hostname} echo echo "About to join domain as ${hostname}" echo "Press Enter to continue or Ctrl+c to abort" read echo echo "## Setting hostname to ${hostname} ... ##" hostnamectl set-hostname ${hostname} echo echo "## Running bootstrap via puppet... ##" PUPPET_ROOT=/tmp/bootstrap/environments/production MODULE_PATH=${PUPPET_ROOT}/modules SITE_PATH=${PUPPET_ROOT}/manifests/site.pp RUBYOPT='-W0' puppet apply --modulepath ${MODULE_PATH} ${SITE_PATH} echo echo "## Joining domain... ##" user=$(sed -n 1p ${BASE_PATH}/domain_sekrit) domain=$(sed -n 2p ${BASE_PATH}/domain_sekrit) pass=$(sed -n 3p ${BASE_PATH}/domain_sekrit) echo ${pass} | realm join --verbose --user=${user} ${domain} echo echo "## Cleaning up... ##" cd .. rm -rf /tmp/bootstrap echo echo "## Done. ##"

Ignore Space Show notes View environments/production/manifests/site.pp 0 → 100644

#include apt # infosci-packages repository #apt::source { 'infosci_packages' : # ensure => 'present', # architecture => 'amd64', # location => 'http://sbis-puppet.uod.otago.ac.nz/infosci-packages', # release => 'bionic', # key => { # id => '14F3429313B01C17B76AB80A749166DCE8B8C41C', # source => 'http://sbis-puppet.uod.otago.ac.nz/infosci-packages/infosci-packages.key' # } #} #file { 'Puppet Deployment Directory' : # ensure => directory, # path => '/usr/local/puppet-deploy' #} # #-> file { 'Puppet Lock Directory' : # ensure => directory, # path => '/usr/local/puppet-deploy/locks' #} # File defaults File { mode => '0644', owner => 'root', group => 'root', backup => 'false' } ### Node definitions node default { include bootstrap # include base_configuration # include teaching_software # include hoao }

Ignore Space Show notes View environments/production/modules/bootstrap/files/authentication/etc/krb5.conf 0 → 100644
### MANAGED BY PUPPET (base-configuration::authentication) [libdefaults] default_realm = STUDENT.OTAGO.AC.NZ dns_lookup_realm = true dns_lookup_kdc = true

Ignore Space Show notes View environments/production/modules/bootstrap/files/authentication/etc/realmd.conf 0 → 100644

### MANAGED BY PUPPET (base-configuration::authentication) [users] default-home = /home/%U default-shell = /bin/bash [active-directory] default-client = sssd os-name = Ubuntu Desktop os-version = 20.04 [service] # disable package-kit installs automatic-install = no [student.otago.ac.nz] # don't require fully qualified usernames fully-qualified-names = no automatic-id-mapping = yes # don't use domain policy for authorisation manage-system = no

Ignore Space Show notes View environments/production/modules/bootstrap/files/authentication/etc/sssd/sssd.conf 0 → 100644

### MANAGED BY PUPPET (base-configuration::authentication) [sssd] domains = student.otago.ac.nz config_file_version = 2 services = nss, pam [domain/student.otago.ac.nz] ad_domain = student.otago.ac.nz krb5_realm = STUDENT.OTAGO.AC.NZ realmd_tags = joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = False fallback_homedir = /home/%u # create private groups for users auto_private_groups = True # only retrieve the "domain user" group (the rest are useless to us) ldap_use_tokengroups = False ldap_group_search_base = CN=Users,DC=win,DC=trust,DC=test?sub?(|(cn=domain users)) # don't manage sudo via SSSD sudo_provider = None # the following *significantly* speeds up login (we don't need to validate group memberships) ignore_group_members = True

Ignore Space Show notes View environments/production/modules/bootstrap/files/authentication/etc/systemd/resolved.conf 0 → 100644
### MANAGED BY PUPPET (base-configuration::authentication) [Resolve] DNS=10.64.0.112 10.64.0.232 Domains=staff.uod.otago.ac.nz uod.otago.ac.nz otago.ac.nz Cache=yes

Ignore Space Show notes View environments/production/modules/bootstrap/files/authentication/etc/systemd/timesyncd.conf 0 → 100644
### MANAGED BY PUPPET (base-configuration::authentication) [Time] NTP=student.otago.ac.nz

Ignore Space Show notes View environments/production/modules/bootstrap/files/puppet_agent/etc/puppet/puppet.conf 0 → 100644
### MANAGED BY PUPPET (base-configuration::puppet_agent) [agent] server = sbis-puppet.uod.otago.ac.nz # set to true to switch to noop mode (agent will report changes that would be made, but not actually make them). noop = false

Ignore Space Show notes View environments/production/modules/bootstrap/files/puppet_agent/etc/systemd/system/puppet.service.d/wait_for_network.conf 0 → 100644
[Unit] Wants=network-online.target After=network-online.target

Ignore Space Show notes View environments/production/modules/bootstrap/manifests/domain_configuration.pp 0 → 100644

### Everything needed to join the STUDENT domain class bootstrap::domain_configuration { package { 'realmd' : ensure => installed } package { 'sssd' : ensure => installed } package { 'sssd-tools' : ensure => installed } package { 'libnss-sss' : ensure => installed } package { 'libpam-sss' : ensure => installed } package { 'krb5-user' : ensure => installed } package { 'adcli' : ensure => installed } package { 'samba-common-bin' : ensure => installed } file { '/etc/systemd/resolved.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/systemd/resolved.conf', ensure => 'present', } file { '/etc/systemd/timesyncd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/systemd/timesyncd.conf', ensure => 'present', } file { '/etc/krb5.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/krb5.conf', ensure => 'present', } file { '/etc/sssd/sssd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/sssd/sssd.conf', ensure => 'present', mode => '0600', require => Package['sssd'], } file { '/etc/realmd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/realmd.conf', ensure => 'present', } }

Ignore Space Show notes View environments/production/modules/bootstrap/manifests/init.pp 0 → 100644

### Get the machine into a state where puppet can reliably take over the remainder of the installation ### ### This includes: ### * Configuring SSSD and realmd in preparation for joining the student domain (lots of stuff breaks if SSSD is only partially configured, so get this out of the way early) ### * Configuring the puppet agent class bootstrap { include bootstrap::domain_configuration include bootstrap::puppet_agent }

Ignore Space Show notes View environments/production/modules/bootstrap/manifests/puppet_agent.pp 0 → 100644

class bootstrap::puppet_agent { file { '/etc/puppet/puppet.conf' : ensure => present, source => 'puppet:///modules/bootstrap/puppet_agent/etc/puppet/puppet.conf' } file { '/etc/systemd/system/puppet.service.d' : ensure => 'directory' } file { '/etc/systemd/system/puppet.service.d/wait_for_network.conf' : ensure => 'present', source => 'puppet:///modules/bootstrap/puppet_agent/etc/systemd/system/puppet.service.d/wait_for_network.conf', require => File['/etc/systemd/system/puppet.service.d'] } service { 'puppet': enable => 'true', ensure => 'running' } }

Show line notes below