Recommit for updates in build 40

README.md

@@ -30,13 +30,20 @@ Time management in Linux is important. The underlying protocol is ntp, the servi
 
 ## Features
 
+This module differentiates between client- and server configuration. If the `FQDN` of the puppet client matches the value of `cy_server_fqdn`, it assumes this to be an ntp time server, else it will be a client.
+
+If you have no local time server(s), leave  `cy_use_lan_server` at `false` (default), else set it to `true`. This affects only client configurations.
+
+The value for `cy_server_fqdn` is a string rather array, assuming either a single time server or a round-robin DNS CNAME entry returning several values for the time server (not configured by this module).
+
 INSTALLATION
 
 - installs chrony binaries
 
 CONFIGURATION
 
-- manage directories and files including templates
+- manage directories including selinux contexts
+- and files and their templates including selinux contexts
 - manage service
 - optional: include nagios target for the chrony service (set `cy_manage_nagios`to `true`)
 

doc/_index.html

@@ -98,6 +98,11 @@
       
             </li>
     
+            <li>
+      <span class='object_link'><a href="puppet_classes/confdroid_ntp_3A_3Amonitoring_3A_3Aloki.html" title="puppet_classes::confdroid_ntp::monitoring::loki (puppet_class)">confdroid_ntp::monitoring::loki</a></span>
+      
+            </li>
+    
             <li>
       <span class='object_link'><a href="puppet_classes/confdroid_ntp_3A_3Amonitoring_3A_3Atarget.html" title="puppet_classes::confdroid_ntp::monitoring::target (puppet_class)">confdroid_ntp::monitoring::target</a></span>
       

doc/file.README.html

@@ -103,6 +103,12 @@
 
 <h2 id="label-Features">Features</h2>
 
+<p>This module differentiates between client- and server configuration. If the <code>FQDN</code> of the puppet client matches the value of <code>cy_server_fqdn</code>, it assumes this to be an ntp time server, else it will be a client.</p>
+
+<p>If you have no local time server(s), leave <code>cy_use_lan_server</code> at <code>false</code> (default), else set it to <code>true</code>. This affects only client configurations.</p>
+
+<p>The value for <code>cy_server_fqdn</code> is a string rather array, assuming either a single time server or a round-robin DNS CNAME entry returning several values for the time server (not configured by this module).</p>
+
 <p>INSTALLATION</p>
 <ul><li>
 <p>installs chrony binaries</p>
@@ -110,7 +116,9 @@
 
 <p>CONFIGURATION</p>
 <ul><li>
-<p>manage directories and files including templates</p>
+<p>manage directories including selinux contexts</p>
+</li><li>
+<p>and files and their templates including selinux contexts</p>
 </li><li>
 <p>manage service</p>
 </li><li>

doc/index.html

@@ -103,6 +103,12 @@
 
 <h2 id="label-Features">Features</h2>
 
+<p>This module differentiates between client- and server configuration. If the <code>FQDN</code> of the puppet client matches the value of <code>cy_server_fqdn</code>, it assumes this to be an ntp time server, else it will be a client.</p>
+
+<p>If you have no local time server(s), leave <code>cy_use_lan_server</code> at <code>false</code> (default), else set it to <code>true</code>. This affects only client configurations.</p>
+
+<p>The value for <code>cy_server_fqdn</code> is a string rather array, assuming either a single time server or a round-robin DNS CNAME entry returning several values for the time server (not configured by this module).</p>
+
 <p>INSTALLATION</p>
 <ul><li>
 <p>installs chrony binaries</p>
@@ -110,7 +116,9 @@
 
 <p>CONFIGURATION</p>
 <ul><li>
-<p>manage directories and files including templates</p>
+<p>manage directories including selinux contexts</p>
+</li><li>
+<p>and files and their templates including selinux contexts</p>
 </li><li>
 <p>manage service</p>
 </li><li>

doc/puppet_class_list.html

@@ -78,14 +78,21 @@
     </li>
     
 
-    <li id="object_puppet_classes::confdroid_ntp::monitoring::target" class="odd">
+    <li id="object_puppet_classes::confdroid_ntp::monitoring::loki" class="odd">
+      <div class="item">
+        <span class='object_link'><a href="puppet_classes/confdroid_ntp_3A_3Amonitoring_3A_3Aloki.html" title="puppet_classes::confdroid_ntp::monitoring::loki (puppet_class)">confdroid_ntp::monitoring::loki</a></span>
+      </div>
+    </li>
+    
+
+    <li id="object_puppet_classes::confdroid_ntp::monitoring::target" class="even">
       <div class="item">
         <span class='object_link'><a href="puppet_classes/confdroid_ntp_3A_3Amonitoring_3A_3Atarget.html" title="puppet_classes::confdroid_ntp::monitoring::target (puppet_class)">confdroid_ntp::monitoring::target</a></span>
       </div>
     </li>
     
 
-    <li id="object_puppet_classes::confdroid_ntp::params" class="even">
+    <li id="object_puppet_classes::confdroid_ntp::params" class="odd">
       <div class="item">
         <span class='object_link'><a href="puppet_classes/confdroid_ntp_3A_3Aparams.html" title="puppet_classes::confdroid_ntp::params (puppet_class)">confdroid_ntp::params</a></span>
       </div>

doc/puppet_classes/confdroid_ntp_3A_3Amain_3A_3Aconfig.html

@@ -109,7 +109,11 @@
 11
 12
 13
-14</pre>
+14
+15
+16
+17
+18</pre>
       </td>
       <td>
         <pre class="code"><span class="info file"># File 'manifests/main/config.pp', line 6</span>
@@ -119,9 +123,13 @@ class confdroid_ntp::main::config (
 ) inherits confdroid_ntp::params {
   include confdroid_ntp::main::service
 
-#  if $ay_manage_nagios == true {
+  if $cy_manage_nagios == true {
-#    include confdroid_ntp::monitoring::target
+    include confdroid_ntp::monitoring::target
-#  }
+  }
+
+  if $cy_manage_loki == true {
+    include confdroid_ntp::monitoring::loki
+  }
 }</pre>
       </td>
     </tr>

doc/puppet_classes/confdroid_ntp_3A_3Amain_3A_3Adirs.html

@@ -109,7 +109,51 @@
 11
 12
 13
-14</pre>
+14
+15
+16
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58</pre>
       </td>
       <td>
         <pre class="code"><span class="info file"># File 'manifests/main/dirs.pp', line 6</span>
@@ -120,8 +164,52 @@ class confdroid_ntp::main::dirs (
   require confdroid_ntp::main::install
 
   # /var/log/chrony
+  file { &#39;/var/log/chrony&#39;:
+    ensure   =&gt; directory,
+    owner    =&gt; &#39;chrony&#39;,
+    group    =&gt; &#39;chrony&#39;,
+    mode     =&gt; &#39;0750&#39;,
+    selrange =&gt; s0,
+    selrole  =&gt; object_r,
+    seltype  =&gt; chronyd_var_log_t,
+    seluser  =&gt; system_u,
+  }
 
   # /var/lib/chrony
+  file { &#39;/var/lib/chrony&#39;:
+    ensure   =&gt; directory,
+    owner    =&gt; &#39;chrony&#39;,
+    group    =&gt; &#39;chrony&#39;,
+    mode     =&gt; &#39;0750&#39;,
+    selrange =&gt; s0,
+    selrole  =&gt; object_r,
+    seltype  =&gt; chronyd_var_lib_t,
+    seluser  =&gt; system_u,
+  }
+
+  # /run/chrony
+  file { &#39;/run/chrony&#39;:
+    ensure   =&gt; directory,
+    owner    =&gt; &#39;chrony&#39;,
+    group    =&gt; &#39;chrony&#39;,
+    mode     =&gt; &#39;0750&#39;,
+    selrange =&gt; s0,
+    selrole  =&gt; object_r,
+    seltype  =&gt; chronyd_var_run_t,
+    seluser  =&gt; system_u,
+  }
+
+  # /run/chrony-dhcp
+  file { &#39;/run/chrony-dhcp&#39;:
+    ensure   =&gt; directory,
+    owner    =&gt; &#39;root&#39;,
+    group    =&gt; &#39;root&#39;,
+    mode     =&gt; &#39;0755&#39;,
+    selrange =&gt; s0,
+    selrole  =&gt; object_r,
+    seltype  =&gt; chronyd_var_run_t,
+    seluser  =&gt; system_u,
+  }
 }</pre>
       </td>
     </tr>

doc/puppet_classes/confdroid_ntp_3A_3Amain_3A_3Afiles.html

@@ -123,7 +123,28 @@
 25
 26
 27
-28</pre>
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49</pre>
       </td>
       <td>
         <pre class="code"><span class="info file"># File 'manifests/main/files.pp', line 6</span>
@@ -148,8 +169,29 @@ class confdroid_ntp::main::files (
   }
 
   # drift file /var/lib/chrony/drift
+  file { $cy_drift_file:
+    ensure   =&gt; file,
+    owner    =&gt; &#39;chrony&#39;,
+    group    =&gt; &#39;chrony&#39;,
+    mode     =&gt; &#39;0644&#39;,
+    selrange =&gt; s0,
+    selrole  =&gt; object_r,
+    seltype  =&gt; chronyd_var_lib_t,
+    seluser  =&gt; system_u,
+  }
 
   # log rotation
+  file { $cy_logrotate_file:
+    ensure   =&gt; file,
+    owner    =&gt; &#39;root&#39;,
+    group    =&gt; &#39;root&#39;,
+    mode     =&gt; &#39;0644&#39;,
+    selrange =&gt; s0,
+    selrole  =&gt; object_r,
+    seltype  =&gt; etc_t,
+    seluser  =&gt; system_u,
+    content  =&gt; template($cy_logrotate_erb),
+  }
 }</pre>
       </td>
     </tr>

doc/puppet_classes/confdroid_ntp_3A_3Amonitoring_3A_3Aloki.html

@@ -0,0 +1,138 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>
+  Puppet Class: confdroid_ntp::monitoring::loki
+  
+    &mdash; Documentation by YARD 0.9.36
+  
+</title>
+
+  <link rel="stylesheet" href="../css/style.css" type="text/css" />
+
+  <link rel="stylesheet" href="../css/common.css" type="text/css" />
+
+<script type="text/javascript">
+  pathId = "puppet_classes::confdroid_ntp::monitoring::loki";
+  relpath = '../';
+</script>
+
+
+  <script type="text/javascript" charset="utf-8" src="../js/jquery.js"></script>
+
+  <script type="text/javascript" charset="utf-8" src="../js/app.js"></script>
+
+
+  </head>
+  <body>
+    <div class="nav_wrap">
+      <iframe id="nav" src="../puppet_class_list.html?1"></iframe>
+      <div id="resizer"></div>
+    </div>
+
+    <div id="main" tabindex="-1">
+      <div id="header">
+        <div id="menu">
+  
+    <a href="../_index.html">Index (c)</a> &raquo;
+    <span class='title'><span class='object_link'>Puppet Classes</span></span>
+     &raquo; 
+    <span class="title">confdroid_ntp::monitoring::loki</span>
+  
+</div>
+
+        <div id="search">
+  
+    <a class="full_list_link" id="puppet_class_list_link"
+        href="../puppet_class_list.html">
+
+        <svg width="24" height="24">
+          <rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
+          <rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
+          <rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
+        </svg>
+    </a>
+  
+</div>
+        <div class="clear"></div>
+      </div>
+
+      <div id="content"><h1>Puppet Class: confdroid_ntp::monitoring::loki</h1>
+<div class="box_info">
+  
+  <dl>
+    <dt>Inherits:</dt>
+    <dd><span class='object_link'><a href="confdroid_ntp_3A_3Aparams.html" title="puppet_classes::confdroid_ntp::params (puppet_class)">confdroid_ntp::params</a></span></dd>
+  </dl>
+  
+  
+  <dl>
+    <dt>Defined in:</dt>
+    <dd>
+      manifests/monitoring/loki.pp
+    </dd>
+  </dl>
+</div>
+
+  <h2>Summary</h2>
+  Class manages loki monitoring for the confdroid_ntp services
+
+<h2>Overview</h2>
+<div class="docstring">
+  <div class="discussion">
+    
+<p>confdroid_ntp::monitoring::loki.pp Module name: confdroid_ntp Author: 12ww1160 (12ww1160@confdroid.com)</p>
+
+  </div>
+</div>
+
+
+
+<div class="tags">
+  
+
+
+</div><div class="method_details_list">
+  <table class="source_code">
+    <tr>
+      <td>
+        <pre class="lines">
+
+
+6
+7
+8
+9
+10
+11
+12
+13
+14</pre>
+      </td>
+      <td>
+        <pre class="code"><span class="info file"># File 'manifests/monitoring/loki.pp', line 6</span>
+
+class confdroid_ntp::monitoring::loki (
+
+) inherits confdroid_ntp::params {
+  if $cy_manage_loki == true {
+    confdroid_alloy::monitoring::log_targets { &quot;confdroid_ntp_${fqdn}&quot;:
+      targets =&gt; [&#39;/var/log/chrony&#39;],
+    }
+  }
+}</pre>
+      </td>
+    </tr>
+  </table>
+</div>
+</div>
+
+      <div id="footer">
+     Generated by <a href="http://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>.
+</div>
+
+    </div>
+  </body>
+</html>

doc/puppet_classes/confdroid_ntp_3A_3Amonitoring_3A_3Atarget.html

@@ -104,7 +104,21 @@
 6
 7
 8
-9</pre>
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18
+19
+20
+21
+22
+23</pre>
       </td>
       <td>
         <pre class="code"><span class="info file"># File 'manifests/monitoring/target.pp', line 6</span>
@@ -112,6 +126,20 @@
 class confdroid_ntp::monitoring::target (
 
 ) inherits confdroid_ntp::params {
+  if $cy_manage_nagios == true {
+    @@nagios_service { &quot;check_chronyd_${fqdn}&quot;:
+      check_command       =&gt; &quot;check_nrpe!check_chronyd!${cy_procs_allowed}!chronyd&quot;,
+      use                 =&gt; &#39;generic-service&#39;,
+      host_name           =&gt; $fqdn,
+      notification_period =&gt; &#39;24x7&#39;,
+      service_description =&gt; &quot;${fqdn}_check_chronyd&quot;,
+      target              =&gt; $cy_target_service,
+      owner               =&gt; &#39;nagios&#39;,
+      group               =&gt; &#39;nagios&#39;,
+      mode                =&gt; &#39;0640&#39;,
+      contacts            =&gt; $cy_target_contacts,
+    }
+  }
 }</pre>
       </td>
     </tr>

doc/puppet_classes/confdroid_ntp_3A_3Aparams.html

@@ -77,6 +77,8 @@
       
       <span class='object_link'><a href="confdroid_ntp_3A_3Amain_3A_3Aservice.html" title="puppet_classes::confdroid_ntp::main::service (puppet_class)">confdroid_ntp::main::service</a></span><br/>
       
+      <span class='object_link'><a href="confdroid_ntp_3A_3Amonitoring_3A_3Aloki.html" title="puppet_classes::confdroid_ntp::monitoring::loki (puppet_class)">confdroid_ntp::monitoring::loki</a></span><br/>
+      
       <span class='object_link'><a href="confdroid_ntp_3A_3Amonitoring_3A_3Atarget.html" title="puppet_classes::confdroid_ntp::monitoring::target (puppet_class)">confdroid_ntp::monitoring::target</a></span><br/>
       
     </dd>
@@ -152,7 +154,7 @@
         <span class='type'>(<tt>String</tt>)</span>
       
       
-        <em class="default">(defaults to: <tt>&#39;ntp.example.com&#39;</tt>)</em>
+        <em class="default">(defaults to: <tt>&#39;ntp.example.local&#39;</tt>)</em>
       
       
         &mdash;
@@ -176,6 +178,204 @@
         &mdash;
         <div class='inline'>
 <p>List of NTP servers to point to as time source</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cy_min_sources</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>&#39;3&#39;</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>Minimum number of selectable sources required to adjust the system clock. Primarily used for servers.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cy_client_allow</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>&#39;192.168.1.0/24&#39;</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>CIDR notation for allowed client networks</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cy_leapsec_mode</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>&#39;slew&#39;</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>Leap second handling mode. Valid values are ‘slew’ or ‘step’.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cy_leapsectz</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>&#39;right/UTC&#39;</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>Leap second timezone file to use.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cy_loginfo</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>&#39;measurements statistics tracking&#39;</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>Log information to record. Valid values are ‘measurements’, ‘statistics’, and ‘tracking’.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cy_use_lan_server</span>
+      
+      
+        <span class='type'>(<tt>Boolean</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>false</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>Whether to use a local LAN server or external pool.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cy_manage_nagios</span>
+      
+      
+        <span class='type'>(<tt>Boolean</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>false</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>Whether to manage Nagios monitoring for the module.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cy_procs_allowed</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>&#39;1:&#39;</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>Number of allowed processes for the Nagios check.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cy_target_service</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>&#39;/etc/nagios/conf.d/chronyd_service.cfg&#39;</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>Path to the Nagios service configuration file.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cy_target_contacts</span>
+      
+      
+        <span class='type'>(<tt>Array</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>[&#39;nagiosadmin&#39;]</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>List of Nagios contacts for notifications. must exist in Nagios contacts configuration!</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cy_manage_loki</span>
+      
+      
+        <span class='type'>(<tt>Boolean</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>false</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>Whether to manage Loki logging for the module.</p>
 </div>
       
     </li>
@@ -191,21 +391,6 @@
         <pre class="lines">
 
 
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
 28
 29
 30
@@ -216,10 +401,46 @@
 35
 36
 37
-38</pre>
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
+69
+70
+71
+72
+73
+74</pre>
       </td>
       <td>
-        <pre class="code"><span class="info file"># File 'manifests/params.pp', line 13</span>
+        <pre class="code"><span class="info file"># File 'manifests/params.pp', line 28</span>
 
 class confdroid_ntp::params (
 
@@ -228,18 +449,39 @@ class confdroid_ntp::params (
   String $cy_pkg_ensure       = &#39;present&#39;,
 
 # configuration
-  String $cy_server_fqdn    = &#39;ntp.example.com&#39;,
+  Boolean $cy_use_lan_server  = false,
+  String $cy_server_fqdn      = &#39;ntp.example.local&#39;,
   Array $cy_conf_servers      = [&#39;0.pool.ntp.org&#39;, &#39;1.pool.ntp.org&#39;, &#39;2.pool.ntp.org&#39;, &#39;3.pool.ntp.org&#39;],
+  String $cy_min_sources      = &#39;3&#39;,
+  String $cy_client_allow     = &#39;192.168.1.0/24&#39;,
+  String $cy_leapsec_mode     = &#39;slew&#39;,
+  String $cy_leapsectz        = &#39;right/UTC&#39;,
+  String $cy_loginfo          = &#39;measurements statistics tracking&#39;,
+
+# monitoring
+  Boolean $cy_manage_nagios   = false,
+  String $cy_procs_allowed    = &#39;1:&#39;,
+  String $cy_target_service   = &#39;/etc/nagios/conf.d/chronyd_service.cfg&#39;,
+  Array $cy_target_contacts   = [&#39;nagiosadmin&#39;],
+
+# loki
+  Boolean $cy_manage_loki     = false,
 
 ) {
-# defaults
+# facts
   $fqdn                       = $facts[&#39;networking&#39;][&#39;fqdn&#39;]
+  $domain                     = $facts[&#39;networking&#39;][&#39;domain&#39;]
+  $os_name                    = $facts[&#39;os&#39;][&#39;name&#39;]
+  $os_release                 = $facts[&#39;os&#39;][&#39;release&#39;][&#39;major&#39;]
 
 # dirs
 
 # files
   $cy_conf_file               = &#39;/etc/chrony.conf&#39;
   $cy_conf_erb                = &#39;confdroid_ntp/chrony.conf.erb&#39;
+  $cy_drift_file              = &#39;/var/lib/chrony/drift&#39;
+  $cy_logrotate_file          = &#39;/etc/logrotate.d/chrony&#39;
+  $cy_logrotate_erb           = &#39;confdroid_ntp/logrotate.chrony.erb&#39;
 
 # service
   $cy_service                 = &#39;chronyd&#39;

manifests/main/config.pp

@@ -8,7 +8,11 @@ class confdroid_ntp::main::config (
 ) inherits confdroid_ntp::params {
   include confdroid_ntp::main::service
 
-#  if $ay_manage_nagios == true {
+  if $cy_manage_nagios == true {
-#    include confdroid_ntp::monitoring::target
+    include confdroid_ntp::monitoring::target
-#  }
+  }
+
+  if $cy_manage_loki == true {
+    include confdroid_ntp::monitoring::loki
+  }
 }

manifests/main/dirs.pp

@@ -9,6 +9,50 @@ class confdroid_ntp::main::dirs (
   require confdroid_ntp::main::install
 
   # /var/log/chrony
+  file { '/var/log/chrony':
+    ensure   => directory,
+    owner    => 'chrony',
+    group    => 'chrony',
+    mode     => '0750',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => chronyd_var_log_t,
+    seluser  => system_u,
+  }
 
   # /var/lib/chrony
+  file { '/var/lib/chrony':
+    ensure   => directory,
+    owner    => 'chrony',
+    group    => 'chrony',
+    mode     => '0750',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => chronyd_var_lib_t,
+    seluser  => system_u,
+  }
+
+  # /run/chrony
+  file { '/run/chrony':
+    ensure   => directory,
+    owner    => 'chrony',
+    group    => 'chrony',
+    mode     => '0750',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => chronyd_var_run_t,
+    seluser  => system_u,
+  }
+
+  # /run/chrony-dhcp
+  file { '/run/chrony-dhcp':
+    ensure   => directory,
+    owner    => 'root',
+    group    => 'root',
+    mode     => '0755',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => chronyd_var_run_t,
+    seluser  => system_u,
+  }
 }

manifests/main/files.pp

@@ -23,6 +23,27 @@ class confdroid_ntp::main::files (
   }
 
   # drift file /var/lib/chrony/drift
+  file { $cy_drift_file:
+    ensure   => file,
+    owner    => 'chrony',
+    group    => 'chrony',
+    mode     => '0644',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => chronyd_var_lib_t,
+    seluser  => system_u,
+  }
 
   # log rotation
+  file { $cy_logrotate_file:
+    ensure   => file,
+    owner    => 'root',
+    group    => 'root',
+    mode     => '0644',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => etc_t,
+    seluser  => system_u,
+    content  => template($cy_logrotate_erb),
+  }
 }

manifests/monitoring/loki.pp

@@ -0,0 +1,14 @@
+#### confdroid_ntp::monitoring::loki.pp
+# Module name: confdroid_ntp
+# Author: 12ww1160 (12ww1160@confdroid.com)
+# @summary Class manages loki monitoring for the confdroid_ntp services
+###############################################################################
+class confdroid_ntp::monitoring::loki (
+
+) inherits confdroid_ntp::params {
+  if $cy_manage_loki == true {
+    confdroid_alloy::monitoring::log_targets { "confdroid_ntp_${fqdn}":
+      targets => ['/var/log/chrony'],
+    }
+  }
+}

manifests/monitoring/target.pp

@@ -6,4 +6,18 @@
 class confdroid_ntp::monitoring::target (
 
 ) inherits confdroid_ntp::params {
+  if $cy_manage_nagios == true {
+    @@nagios_service { "check_chronyd_${fqdn}":
+      check_command       => "check_nrpe!check_chronyd!${cy_procs_allowed}!chronyd",
+      use                 => 'generic-service',
+      host_name           => $fqdn,
+      notification_period => '24x7',
+      service_description => "${fqdn}_check_chronyd",
+      target              => $cy_target_service,
+      owner               => 'nagios',
+      group               => 'nagios',
+      mode                => '0640',
+      contacts            => $cy_target_contacts,
+    }
+  }
 }

manifests/params.pp

@@ -9,6 +9,21 @@
 #   If the fqdn of the host matches this value, a time server will be 
 #   configured, else a client.
 # @param [Array] cy_conf_servers List of NTP servers to point to as time source
+# @param [String] cy_min_sources Minimum number of selectable sources required 
+#   to adjust the system clock. Primarily used for servers.
+# @param [String] cy_client_allow CIDR notation for allowed client networks
+# @param [String] cy_leapsec_mode Leap second handling mode. Valid values are
+#   'slew' or 'step'. 
+# @param [String] cy_leapsectz Leap second timezone file to use. 
+# @param [String] cy_loginfo Log information to record. Valid values are
+#   'measurements', 'statistics', and 'tracking'.
+# @param [Boolean] cy_use_lan_server Whether to use a local LAN server or external pool.
+# @param [Boolean] cy_manage_nagios Whether to manage Nagios monitoring for the module.
+# @param [String] cy_procs_allowed Number of allowed processes for the Nagios check.
+# @param [String] cy_target_service Path to the Nagios service configuration file.
+# @param [Array] cy_target_contacts List of Nagios contacts for notifications. 
+#   must exist in Nagios contacts configuration!
+# @param [Boolean] cy_manage_loki Whether to manage Loki logging for the module.
 ###############################################################################
 class confdroid_ntp::params (
 
@@ -17,18 +32,39 @@ class confdroid_ntp::params (
   String $cy_pkg_ensure       = 'present',
 
 # configuration
-  String $cy_server_fqdn    = 'ntp.example.com',
+  Boolean $cy_use_lan_server  = false,
+  String $cy_server_fqdn      = 'ntp.example.local',
   Array $cy_conf_servers      = ['0.pool.ntp.org', '1.pool.ntp.org', '2.pool.ntp.org', '3.pool.ntp.org'],
+  String $cy_min_sources      = '3',
+  String $cy_client_allow     = '192.168.1.0/24',
+  String $cy_leapsec_mode     = 'slew',
+  String $cy_leapsectz        = 'right/UTC',
+  String $cy_loginfo          = 'measurements statistics tracking',
+
+# monitoring
+  Boolean $cy_manage_nagios   = false,
+  String $cy_procs_allowed    = '1:',
+  String $cy_target_service   = '/etc/nagios/conf.d/chronyd_service.cfg',
+  Array $cy_target_contacts   = ['nagiosadmin'],
+
+# loki
+  Boolean $cy_manage_loki     = false,
 
 ) {
-# defaults
+# facts
   $fqdn                       = $facts['networking']['fqdn']
+  $domain                     = $facts['networking']['domain']
+  $os_name                    = $facts['os']['name']
+  $os_release                 = $facts['os']['release']['major']
 
 # dirs
 
 # files
   $cy_conf_file               = '/etc/chrony.conf'
   $cy_conf_erb                = 'confdroid_ntp/chrony.conf.erb'
+  $cy_drift_file              = '/var/lib/chrony/drift'
+  $cy_logrotate_file          = '/etc/logrotate.d/chrony'
+  $cy_logrotate_erb           = 'confdroid_ntp/logrotate.chrony.erb'
 
 # service
   $cy_service                 = 'chronyd'

templates/chrony.conf.erb

@@ -6,13 +6,114 @@
 
 <%  if @fqdn == @cy_server_fqdn -%>
 # This is a time server configuration file
+# Use public servers from the pool.ntp.org project.
 <% @cy_conf_servers.each do |this_server| -%>
 pool <%= this_server %> iburst
-
 <% end -%>
 
+# Use NTP servers from DHCP.
+sourcedir /run/chrony-dhcp
+
+# Record the rate at which the system clock gains/losses time.
+driftfile /var/lib/chrony/drift
+
+# Allow the system clock to be stepped in the first three updates
+# if its offset is larger than 1 second.
+makestep 1.0 3
+
+# Enable kernel synchronization of the real-time clock (RTC).
+rtcsync
+
+# Enable hardware timestamping on all interfaces that support it.
+hwtimestamp *
+
+# Increase the minimum number of selectable sources required to adjust
+# the system clock.
+minsources <%= @cy_min_sources %>
+
+# Allow NTP client access from local network.
+allow <%= @cy_client_allow %>
+
+# Serve time even if not synchronized to a time source.
+local stratum 10
+
+# Require authentication (nts or key option) for all NTP sources.
+#authselectmode require
+
+# Specify file containing keys for NTP authentication.
+keyfile /etc/chrony.keys
+
+# Save NTS keys and cookies.
+ntsdumpdir /var/lib/chrony
+
+# Insert/delete leap seconds by slewing instead of stepping.
+leapsecmode <%= @cy_leapsec_mode %>
+
+# Get TAI-UTC offset and leap seconds from the system tz database.
+leapsectz <%= @cy_leapsectz %> 
+
+# Specify directory for log files.
+logdir /var/log/chrony
+
+# Select which information is logged.
+log <%= @cy_loginfo %>
+<% end %>
+
+
 <% if @fqdn != @cy_server_fqdn -%>
 # This is a time client configuration file
-<% end -%>
+<% if @cy_use_lan_server -%>
+server <%= @cy_server_fqdn %> iburst
+<% else -%>
+# Use public servers from the pool.ntp.org project.
+<% @cy_conf_servers.each do |this_server| -%>
+server <%= this_server %> iburst
+<% end end -%>
 
-<% end -%>
+# Use NTP servers from DHCP.
+sourcedir /run/chrony-dhcp
+
+# Record the rate at which the system clock gains/losses time.
+driftfile /var/lib/chrony/drift
+
+# Allow the system clock to be stepped in the first three updates
+# if its offset is larger than 1 second.
+makestep 1.0 3
+
+# Enable kernel synchronization of the real-time clock (RTC).
+rtcsync
+
+# Enable hardware timestamping on all interfaces that support it.
+# hwtimestamp *
+
+# Increase the minimum number of selectable sources required to adjust
+# the system clock. Primarily for servers.
+#minsources 2
+
+# Allow NTP client access from local network.
+#allow 192.168.0.0/16
+
+# Serve time even if not synchronized to a time source.
+#local stratum 10
+
+# Require authentication (nts or key option) for all NTP sources.
+#authselectmode require
+
+# Specify file containing keys for NTP authentication.
+keyfile /etc/chrony.keys
+
+# Save NTS keys and cookies.
+ntsdumpdir /var/lib/chrony
+
+# Insert/delete leap seconds by slewing instead of stepping.
+leapsecmode <%= @cy_leapsec_mode %>
+
+# Get TAI-UTC offset and leap seconds from the system tz database.
+leapsectz <%= @cy_leapsectz %> 
+
+# Specify directory for log files.
+logdir /var/log/chrony
+
+# Select which information is logged.
+log <%= @cy_loginfo %>
+<% end %>

templates/logrotate.chrony.erb

@@ -0,0 +1,9 @@
+# file created by Puppet, manual changes will be overwritten
+/var/log/chrony/*.log {
+    missingok
+    nocreate
+    sharedscripts
+    postrotate
+        /usr/bin/chronyc cyclelogs > /dev/null 2>&1 || true
+    endscript
+}