From b7e8dca0b38999b361b108e852c47ebd1ab77938 Mon Sep 17 00:00:00 2001
From: alex <alex@pdp7.net>
Date: Sat, 14 Jan 2023 19:11:18 +0100
Subject: Add tinc management

---
 .../puppet/modules/tinc/manifests/init.pp          | 71 ++++++++++++++++++++++
 .../puppet/modules/tinc/templates/tinc-up.epp      | 11 ++++
 .../puppet/modules/tinc/templates/tinc.conf.epp    |  8 +++
 3 files changed, 90 insertions(+)
 create mode 100644 personal_infra/puppet/modules/tinc/manifests/init.pp
 create mode 100644 personal_infra/puppet/modules/tinc/templates/tinc-up.epp
 create mode 100644 personal_infra/puppet/modules/tinc/templates/tinc.conf.epp

(limited to 'personal_infra/puppet/modules/tinc')

diff --git a/personal_infra/puppet/modules/tinc/manifests/init.pp b/personal_infra/puppet/modules/tinc/manifests/init.pp
new file mode 100644
index 00000000..9f1ab0b6
--- /dev/null
+++ b/personal_infra/puppet/modules/tinc/manifests/init.pp
@@ -0,0 +1,71 @@
+class tinc($tinc_name, $tinc_location, $tinc_connect_to, $tinc_locations, $tinc_ip, $tinc_netmask, $tinc_other_networks) {
+  package {'tinc':}
+  ->
+  file {'/etc/tinc':
+    ensure => directory,
+  }
+  ->
+  file {"/etc/tinc/${tinc_name}":
+    ensure => directory,
+  }
+  ->
+  file {"/etc/tinc/${tinc_name}/hosts":
+    ensure => directory,
+  }
+  ->
+  file {"/etc/tinc/${tinc_name}/tinc.conf":
+    content => epp('tinc/tinc.conf', {'tinc_name'       => $tinc_name,
+                                      'tinc_location'   => $tinc_location,
+                                      'tinc_connect_to' => $tinc_connect_to,
+                                      }),
+    notify => Service["tinc@${tinc_name}"],
+  }
+
+  $tinc_locations.each |$name, $location| {
+    exec {"/bin/echo Subnet = ${location['subnet']} >/etc/tinc/${tinc_name}/hosts/${name} && echo Address = ${location['address']} >>/etc/tinc/${tinc_name}/hosts/${name} ; cat /etc/ansible/tinc/public_${location['address']}.pem >>/etc/tinc/${tinc_name}/hosts/${name}":
+      require => File["/etc/tinc/${tinc_name}/hosts"],
+      notify => Service["tinc@${tinc_name}"],
+    }
+  }
+
+  service {"tinc@${tinc_name}":
+    ensure => running,
+    enable => true,
+  }
+
+  exec {"/bin/cp /etc/ansible/tinc/private.pem /etc/tinc/${tinc_name}/rsa_key.priv":
+    creates => "/etc/tinc/${tinc_name}/rsa_key.priv",
+    require => File["/etc/tinc/${tinc_name}"],
+    notify => Service["tinc@${tinc_name}"],
+  }
+
+  file {"/etc/tinc/${tinc_name}/tinc-up":
+    content => epp('tinc/tinc-up', {'ip' => $tinc_ip,
+                                    'netmask' => $tinc_netmask,
+                                    'tinc_other_networks' => $tinc_other_networks,}),
+    require => File["/etc/tinc/${tinc_name}"],
+    mode => '777',
+    notify => Service["tinc@${tinc_name}"],
+  }
+
+  if ($osfamily == 'RedHat') {
+    exec {'open firewall for tinc':
+      command => '/usr/bin/firewall-cmd --permanent --add-port=655/{tcp,udp}',
+      unless => '/usr/bin/firewall-cmd --query-port=655/udp',
+    }
+    ~>
+    exec {'reload firewall for tinc':
+      command => '/usr/bin/firewall-cmd --reload',
+      refreshonly => true,
+    }
+  }
+
+  file {'/etc/sysctl.d/tinc.conf':
+    content => "net.ipv4.ip_forward=1\nnet.ipv4.conf.all.proxy_arp=0\n",
+  }
+  ~>
+  exec {'reload sysctl for tinc':
+    command => '/sbin/sysctl --system',
+    refreshonly => true,
+  }
+}
diff --git a/personal_infra/puppet/modules/tinc/templates/tinc-up.epp b/personal_infra/puppet/modules/tinc/templates/tinc-up.epp
new file mode 100644
index 00000000..7c89098f
--- /dev/null
+++ b/personal_infra/puppet/modules/tinc/templates/tinc-up.epp
@@ -0,0 +1,11 @@
+<%- | $ip,
+      $netmask,
+      $tinc_other_networks,
+| -%>
+#!/bin/sh
+
+ifconfig $INTERFACE <%= $ip %> netmask 255.255.255.255
+
+<% $tinc_other_networks.each |$tinc_other_network| { %>
+  route add -net <%= $tinc_other_network %> dev $INTERFACE
+<% } %>
diff --git a/personal_infra/puppet/modules/tinc/templates/tinc.conf.epp b/personal_infra/puppet/modules/tinc/templates/tinc.conf.epp
new file mode 100644
index 00000000..959fb949
--- /dev/null
+++ b/personal_infra/puppet/modules/tinc/templates/tinc.conf.epp
@@ -0,0 +1,8 @@
+<%- | $tinc_name,
+      $tinc_location,
+      $tinc_connect_to,
+| -%>
+Name = <%= $tinc_location %>
+<% $tinc_connect_to.each | $tinc_connection | { -%>
+ConnectTo = <%= $tinc_connection %>
+<% } %>
-- 
cgit v1.2.3