Merge branch 'define' into 'master'

# patchman_client

## Introduction

Module to install patchman client package and configuration.

    class {'patchman_client':

      patchman_server      => 'patchman_server_to_send_reports',

    patchman_client { 'patchman.example.com':

      ensure               => 'present',

      wallet_client_netrc  => 'wallet_file_name',

    }

We make this a Puppet define to allow a server to send Patchman reports to

multiple Patchman servers. The define `name` (in this case,

`patchman.example.com`) is the fully-qualified name of the Patchman

server.

## The `.netrc` file

The `wallet_client_netrc` parameter is required and should be the Wallet

name for the netrc file used by the Patchman client when connecting to the

Patchman server. It should have this format:

```

machine patchman.example.com

login patchman-client

password vEWLKbvJdxUicT2meV5j

```

The login/password correspond to the Basic authentication used to access

the Patchman server's report upload service.

## Removing the `patchman-client` package

If the `patchman_client` define is called multiple times there is no way

for one define to know if the other defines are setting the `ensure`

parameter to `present` or `absent`. Because of this the

`patchman_client` define _always_ installs the `patchman-client`

package. If you need to remove the `patchman-client` package, you will

have to do so separately after removing all calls to the `patchman_client`

define from your Puppet code.

class patchman_client (

# Create the configuration to send Patchman information to a Patchman server.

# This define:

#

# * ensures that the patchman-client is installed

# * downloads the secret needed to send the report to the Patchman server

# * creates a /etc/cron.daily file that send the report every day

#

# We make this a "define" rather than a "class" so that we can, if

# so choose, send to multiple Patchman servers.

#

# If using this define more than once, be sure that each

# $wallet_client_netrc parameter is distinct from any other or else you

# will get a duplicate resource error.

#

# NOTE: This define will _always_ install the patchman-client package, even

# if the $ensure parameter is set to 'absent'. This is due to the fact that

# if multiple patchman_client defines are used there is no way for one

# define to know if the others are ensuring 'absent' or 'present'. Thus,

# it is up to the user to remove the patchman-client themselves if they

# want it removed.

# ######################################################################

# $ensure: if set to 'present' will install the necessary confgurations

# for the Patchman server given by $name.

define patchman_client (

  Enum['present', 'absent'] $ensure = 'present',

  $patchman_server                   = undef,

  $wallet_client_netrc              = undef,

)

{

  if ($patchman_server  == undef) {

    fail("patchman_server: must be set to send reports")

  }

  if ($wallet_client_netrc  == undef) {

    fail("wallet_client_netrc: must be set to download the patchman netrc")

    fail('wallet_client_netrc: must be set to download the patchman netrc')

  }

  package { 'patchman-client':

    ensure => $ensure,

  }

  # We define $patchman_server as an alias $name just to make

  # the rest of the code a little clearer.

  $patchman_server = $name

  # Get the .netrc file with the username and password. This is used

  # to login to the patchman service for uploads.

  base::wallet { "$wallet_client_netrc":

  # Install/remove the patchman_client package:

  include patchman_client::install_package

  # Get the .netrc file with the username and password. This is used to

  # login to the patchman service for uploads. We use $name as part of the

  # filename in case this define is called more than once.

  $netrc_path = "/etc/patchman/${patchman_server}.netrc"

  base::wallet { $wallet_client_netrc:

    ensure  => $ensure,

    type    => 'file',

    path    => "/etc/patchman/patchman.netrc",

    path    => $netrc_path,

    owner   => 'root',

    group   => 'root',

    mode    => '0660',

    require => Package['patchman-client'],

    require => Class['Patchman_client::Install_package'],

  }

  file { '/etc/patchman/patchman-client.conf':

  $patchman_conf_path = "/etc/patchman/${patchman_server}.conf"

  file { $patchman_conf_path:

    ensure  => $ensure,

    content => template('patchman_client/etc/patchman/patchman-client.conf.erb'),

    require => Package['patchman-client'],

    require => Class['Patchman_client::Install_package'],

  }

  ## Make sure this file is absent, Otherwise it sends report to patchman server

  ## everytime when install or upgrade a package

  file { "/etc/apt/apt.conf.d/05patchman":

     ensure  => absent,

  }

  ## Make sure the file /etc/apt/apt.conf.d/05patchman is absent,

  ## otherwise it sends report to patchman server everytime when install

  ## or upgrade a package.

  include patchman_client::remove_aptconf

  # Install a cron job to update patchman periodically.

  file { '/etc/cron.daily/patchman-client':

  file { "/etc/cron.daily/patchman-client-${patchman_server}":

    ensure  => $ensure,

    content => template('patchman_client/etc/cron.daily/patchman-client.erb'),

    require => Package['patchman-client'],

    mode    => '0755',

    require => Class['Patchman_client::Install_package'],

  }

}

# Make sure the 'patchman-client' package is installed. We make this a

# class so that it can safely be loaded multiple times.

class patchman_client::install_package {

  package { 'patchman-client':

    ensure => 'present',

  }

}

# Make sure the file /etc/apt/apt.conf.d/05patchman is absent, Otherwise

# it sends report to the patchman server everytime when we install or

# upgrade a package.

class patchman_client::remove_aptconf {

  file { '/etc/apt/apt.conf.d/05patchman':

    ensure => absent,

  }

}

#!/bin/sh

# Sleep between 5 and 90 minutes before running

# Sleep between 5 and 90 minutes before running to avoid "herding":

SLEEP_MINUTES=$(/usr/bin/shuf -i 5-90 -n 1)

SLEEP_SECONDS=$((60 * $SLEEP_MINUTES))

sleep $SLEEP_SECONDS

patchman-client -s https://<%= @patchman_server %>/patchman

patchman-client -c <%= @patchman_conf_path %> -s https://<%= @patchman_server %>/patchman