OP#830 fix process name

README.md

@@ -30,13 +30,20 @@ Time management in Linux is important. The underlying protocol is ntp, the servi
 
 ## Features
 
+This module differentiates between client- and server configuration. If the `FQDN` of the puppet client matches the value of `cy_server_fqdn`, it assumes this to be an ntp time server, else it will be a client.
+
+If you have no local time server(s), leave  `cy_use_lan_server` at `false` (default), else set it to `true`. This affects only client configurations.
+
+The value for `cy_server_fqdn` is a string rather array, assuming either a single time server or a round-robin DNS CNAME entry returning several values for the time server (not configured by this module).
+
 INSTALLATION
 
 - installs chrony binaries
 
 CONFIGURATION
 
-- manage directories and files including templates
+- manage directories including selinux contexts
+- and files and their templates including selinux contexts
 - manage service
 - optional: include nagios target for the chrony service (set `cy_manage_nagios`to `true`)
 

manifests/main/config.pp

@@ -8,7 +8,7 @@ class confdroid_ntp::main::config (
 ) inherits confdroid_ntp::params {
   include confdroid_ntp::main::service
 
-#  if $ay_manage_nagios == true {
+  if $cy_manage_nagios == true {
-#    include confdroid_ntp::monitoring::target
+    include confdroid_ntp::monitoring::target
-#  }
+  }
 }

manifests/main/dirs.pp

@@ -9,6 +9,50 @@ class confdroid_ntp::main::dirs (
   require confdroid_ntp::main::install
 
   # /var/log/chrony
+  file { '/var/log/chrony':
+    ensure   => directory,
+    owner    => 'chrony',
+    group    => 'chrony',
+    mode     => '0750',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => chronyd_var_log_t,
+    seluser  => system_u,
+  }
 
   # /var/lib/chrony
+  file { '/var/lib/chrony':
+    ensure   => directory,
+    owner    => 'chrony',
+    group    => 'chrony',
+    mode     => '0750',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => chronyd_var_lib_t,
+    seluser  => system_u,
+  }
+
+  # /run/chrony
+  file { '/run/chrony':
+    ensure   => directory,
+    owner    => 'chrony',
+    group    => 'chrony',
+    mode     => '0750',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => chronyd_var_run_t,
+    seluser  => system_u,
+  }
+
+  # /run/chrony-dhcp
+  file { '/run/chrony-dhcp':
+    ensure   => directory,
+    owner    => 'root',
+    group    => 'root',
+    mode     => '0755',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => chronyd_var_run_t,
+    seluser  => system_u,
+  }
 }

manifests/main/files.pp

@@ -23,6 +23,27 @@ class confdroid_ntp::main::files (
   }
 
   # drift file /var/lib/chrony/drift
+  file { $cy_drift_file:
+    ensure   => file,
+    owner    => 'chrony',
+    group    => 'chrony',
+    mode     => '0644',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => chronyd_var_lib_t,
+    seluser  => system_u,
+  }
 
   # log rotation
+  file { $cy_logrotate_file:
+    ensure   => file,
+    owner    => 'root',
+    group    => 'root',
+    mode     => '0644',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => etc_t,
+    seluser  => system_u,
+    content  => template($cy_logrotate_erb),
+  }
 }

manifests/monitoring/target.pp

@@ -6,4 +6,18 @@
 class confdroid_ntp::monitoring::target (
 
 ) inherits confdroid_ntp::params {
+  if $cy_manage_nagios == true {
+    @@nagios_service { "check_chronyd_${fqdn}":
+      check_command       => "check_nrpe!check_chronyd!${cy_procs_allowed}!chronyd",
+      use                 => 'generic-service',
+      host_name           => $fqdn,
+      notification_period => '24x7',
+      service_description => "${fqdn}_check_chronyd",
+      target              => $cy_target_service,
+      owner               => 'nagios',
+      group               => 'nagios',
+      mode                => '0640',
+      contacts            => $cy_target_contacts,
+    }
+  }
 }

manifests/params.pp

@@ -9,29 +9,61 @@
 #   If the fqdn of the host matches this value, a time server will be 
 #   configured, else a client.
 # @param [Array] cy_conf_servers List of NTP servers to point to as time source
+# @param [String] cy_min_sources Minimum number of selectable sources required 
+#   to adjust the system clock. Primarily used for servers.
+# @param [String] cy_client_allow CIDR notation for allowed client networks
+# @param [String] cy_leapsec_mode Leap second handling mode. Valid values are
+#   'slew' or 'step'. 
+# @param [String] cy_leapsectz Leap second timezone file to use. 
+# @param [String] cy_loginfo Log information to record. Valid values are
+#   'measurements', 'statistics', and 'tracking'.
+# @param [Boolean] cy_use_lan_server Whether to use a local LAN server or external pool.
+# @param [Boolean] cy_manage_nagios Whether to manage Nagios monitoring for the module.
+# @param [String] cy_procs_allowed Number of allowed processes for the Nagios check.
+# @param [String] cy_target_service Path to the Nagios service configuration file.
+# @param [Array] cy_target_contacts List of Nagios contacts for notifications. 
+#   must exist in Nagios contacts configuration!
 ###############################################################################
 class confdroid_ntp::params (
 
 # installation
-  Array $cy_reqpackages     = ['chrony'],
+  Array $cy_reqpackages       = ['chrony'],
-  String $cy_pkg_ensure     = 'present',
+  String $cy_pkg_ensure       = 'present',
 
 # configuration
-  String $cy_server_fqdn    = 'ntp.example.com',
+  Boolean $cy_use_lan_server  = false,
-  Array $cy_conf_servers    = ['0.pool.ntp.org', '1.pool.ntp.org', '2.pool.ntp.org', '3.pool.ntp.org'],
+  String $cy_server_fqdn      = 'ntp.example.local',
+  Array $cy_conf_servers      = ['0.pool.ntp.org', '1.pool.ntp.org', '2.pool.ntp.org', '3.pool.ntp.org'],
+  String $cy_min_sources      = '3',
+  String $cy_client_allow     = '192.168.1.0/24',
+  String $cy_leapsec_mode     = 'slew',
+  String $cy_leapsectz        = 'right/UTC',
+  String $cy_loginfo          = 'measurements statistics tracking',
+
+# monitoring
+  Boolean $cy_manage_nagios   = false,
+  String $cy_procs_allowed    = '1:',
+  String $cy_target_service   = '/etc/nagios/conf.d/chronyd_service.cfg',
+  Array $cy_target_contacts   = ['nagiosadmin'],
 
 ) {
-# defaults
+# facts
-  $fqdn                     = $facts['networking']['fqdn']
+  $fqdn                       = $facts['networking']['fqdn']
+  $domain                     = $facts['networking']['domain']
+  $os_name                    = $facts['os']['name']
+  $os_release                 = $facts['os']['release']['major']
 
 # dirs
 
 # files
-  $cy_conf_file             = '/etc/chrony.conf'
+  $cy_conf_file               = '/etc/chrony.conf'
-  $cy_conf_erb              = 'confdroid_ntp/chrony.conf.erb'
+  $cy_conf_erb                = 'confdroid_ntp/chrony.conf.erb'
+  $cy_drift_file              = '/var/lib/chrony/drift'
+  $cy_logrotate_file          = '/etc/logrotate.d/chrony'
+  $cy_logrotate_erb           = 'confdroid_ntp/logrotate.chrony.erb'
 
 # service
-  $cy_service               = 'chronyd'
+  $cy_service                 = 'chronyd'
 
 # includes must be last
   include confdroid_ntp::main::config

templates/chrony.conf.erb

@@ -6,17 +6,114 @@
 
 <%  if @fqdn == @cy_server_fqdn -%>
 # This is a time server configuration file
-<%= @fqdn %> 
+# Use public servers from the pool.ntp.org project.
 <% @cy_conf_servers.each do |this_server| -%>
 pool <%= this_server %> iburst
-
 <% end -%>
 
+# Use NTP servers from DHCP.
+sourcedir /run/chrony-dhcp
+
+# Record the rate at which the system clock gains/losses time.
+driftfile /var/lib/chrony/drift
+
+# Allow the system clock to be stepped in the first three updates
+# if its offset is larger than 1 second.
+makestep 1.0 3
+
+# Enable kernel synchronization of the real-time clock (RTC).
+rtcsync
+
+# Enable hardware timestamping on all interfaces that support it.
+hwtimestamp *
+
+# Increase the minimum number of selectable sources required to adjust
+# the system clock.
+minsources <%= @cy_min_sources %>
+
+# Allow NTP client access from local network.
+allow <%= @cy_client_allow %>
+
+# Serve time even if not synchronized to a time source.
+local stratum 10
+
+# Require authentication (nts or key option) for all NTP sources.
+#authselectmode require
+
+# Specify file containing keys for NTP authentication.
+keyfile /etc/chrony.keys
+
+# Save NTS keys and cookies.
+ntsdumpdir /var/lib/chrony
+
+# Insert/delete leap seconds by slewing instead of stepping.
+leapsecmode <%= @cy_leapsec_mode %>
+
+# Get TAI-UTC offset and leap seconds from the system tz database.
+leapsectz <%= @cy_leapsectz %> 
+
+# Specify directory for log files.
+logdir /var/log/chrony
+
+# Select which information is logged.
+log <%= @cy_loginfo %>
+<% end %>
+
+
 <% if @fqdn != @cy_server_fqdn -%>
 # This is a time client configuration file
-<%= @fqdn %> 
+<% if @cy_use_lan_server -%>
-<% end -%>
+server <%= @cy_server_fqdn %> iburst
+<% else -%>
+# Use public servers from the pool.ntp.org project.
+<% @cy_conf_servers.each do |this_server| -%>
+server <%= this_server %> iburst
+<% end end -%>
 
-<% end -%>
+# Use NTP servers from DHCP.
+sourcedir /run/chrony-dhcp
 
-<%= @fqdn %> 
+# Record the rate at which the system clock gains/losses time.
+driftfile /var/lib/chrony/drift
+
+# Allow the system clock to be stepped in the first three updates
+# if its offset is larger than 1 second.
+makestep 1.0 3
+
+# Enable kernel synchronization of the real-time clock (RTC).
+rtcsync
+
+# Enable hardware timestamping on all interfaces that support it.
+# hwtimestamp *
+
+# Increase the minimum number of selectable sources required to adjust
+# the system clock. Primarily for servers.
+#minsources 2
+
+# Allow NTP client access from local network.
+#allow 192.168.0.0/16
+
+# Serve time even if not synchronized to a time source.
+#local stratum 10
+
+# Require authentication (nts or key option) for all NTP sources.
+#authselectmode require
+
+# Specify file containing keys for NTP authentication.
+keyfile /etc/chrony.keys
+
+# Save NTS keys and cookies.
+ntsdumpdir /var/lib/chrony
+
+# Insert/delete leap seconds by slewing instead of stepping.
+leapsecmode <%= @cy_leapsec_mode %>
+
+# Get TAI-UTC offset and leap seconds from the system tz database.
+leapsectz <%= @cy_leapsectz %> 
+
+# Specify directory for log files.
+logdir /var/log/chrony
+
+# Select which information is logged.
+log <%= @cy_loginfo %>
+<% end %>

templates/logrotate.chrony.erb

@@ -0,0 +1,9 @@
+# file created by Puppet, manual changes will be overwritten
+/var/log/chrony/*.log {
+    missingok
+    nocreate
+    sharedscripts
+    postrotate
+        /usr/bin/chronyc cyclelogs > /dev/null 2>&1 || true
+    endscript
+}