diff --git a/personal.pp b/personal.pp new file mode 100644 index 0000000..9d8ca5b --- /dev/null +++ b/personal.pp @@ -0,0 +1,2 @@ +include software::everywhere +include software::personal diff --git a/puppet-module.sh b/puppet-module.sh index ca79dda..4567d2d 100755 --- a/puppet-module.sh +++ b/puppet-module.sh @@ -10,4 +10,5 @@ puppet module install puppetlabs-vcsrepo --version 3.1.1 puppet module install puppetlabs-docker --version 4.4.0 puppet module install saz-resolv_conf --version 5.0.0 puppet module install puppet-openssl --version 2.0.1 +puppet module install saz-ssh --version 6.2.0 #puppet module install eyp-python --version 0.1.13 diff --git a/sensitive.sh b/sensitive.sh new file mode 100755 index 0000000..f06782d --- /dev/null +++ b/sensitive.sh @@ -0,0 +1,5 @@ +#!/bin/bash + +cmd_replace='sed "s|empty1|$SSH_KEY|g; s|empty2|$SSH_USER|g" software/manifests/personaltpl.pp > software/manifests/personal.pp' + +sops exec-env ./ssh-info.env "$cmd_replace" \ No newline at end of file diff --git a/software/manifests/personaltpl.pp b/software/manifests/personaltpl.pp new file mode 100644 index 0000000..fcbd29d --- /dev/null +++ b/software/manifests/personaltpl.pp @@ -0,0 +1,46 @@ +class software::personal { + $user = 'vitya' + + ssh_authorized_key { 'empty2': + ensure => present, + user => $user, + type => 'ssh-rsa', + key => 'empty1' + } + + $ssh_service_name = $operatingsystem ? { + debian => "ssh", + ubuntu => "ssh", + archlinux => "sshd", + manjarolinux => "sshd" + } + + #service { 'ssh': + # name => $ssh_service_name, + # ensure => "running", + # enable => "true" + #} + + class { 'ssh::server': + validate_sshd_file => true, + options => { + 'Match User www-data' => { + 'ChrootDirectory' => '%h', + 'ForceCommand' => 'internal-sftp', + 'PasswordAuthentication' => 'no', + 'AllowTcpForwarding' => 'no', + 'X11Forwarding' => 'no', + }, + 'Match User vitya' => { + 'PasswordAuthentication' => 'yes', + 'AllowTcpForwarding' => 'yes', + 'X11Forwarding' => 'yes', + }, + 'PrintMotd' => 'no', + 'StreamLocalBindUnlink' => 'yes', + 'PasswordAuthentication' => 'yes', + 'PermitRootLogin' => 'no', + 'Port' => 356, + } + } +} \ No newline at end of file diff --git a/zaebis.sh b/zaebis.sh index 8f32cf7..691b189 100755 --- a/zaebis.sh +++ b/zaebis.sh @@ -52,3 +52,7 @@ fi if [ "$1" = "science" ]; then puppet apply --modulepath="$puppetpath" science.pp fi + +if [ "$1" = "personal" ]; then + puppet apply --modulepath="$puppetpath" personal.pp +fi \ No newline at end of file