Merge build 39 into master

Auto-merge for build 34

See merge request puppet/confdroid_ssh!34

.puppet-lint.rc

@@ -0,0 +1,3 @@
+--no-variable_scope-check
+--no-top_scope_facts
+--no-140chars-check

Jenkinsfile

@@ -0,0 +1,130 @@
+pipeline {
+    agent {
+      label 'puppet'
+    }
+
+    post {
+        always {
+            deleteDir() /* clean up our workspace */
+        }
+        success {
+            updateGitlabCommitStatus state: 'success'
+        }
+        failure {
+            updateGitlabCommitStatus state: 'failed'
+            step([$class: 'Mailer', notifyEveryUnstableBuild: true, recipients: 'support@confdroid.com', sendToIndividuals: true])
+        }
+    }
+
+    options {
+          gitLabConnection('gitlab.confdroid.com')
+    }
+
+    stages {
+
+      stage('pull master') {
+        steps {
+          sshagent(['edd05eb6-26b5-4c7b-a5cc-ea2ab899f4fa']) {
+            sh '''
+                git config user.name "Jenkins Server"
+                git config user.email jenkins@confdroid.com
+                git fetch origin
+              source_branch="${gitlabSourceBranch:-${BRANCH_NAME:-${GIT_LOCAL_BRANCH:-$GIT_BRANCH}}}"
+              source_branch="${source_branch#origin/}"
+              source_branch="${source_branch#refs/heads/}"
+              if [ -z "$source_branch" ]; then
+                source_branch="development"
+              fi
+              echo "Using source branch: $source_branch"
+              # Create an isolated build branch from the triggering branch revision.
+              git checkout -B jenkins-build-$BUILD_NUMBER "origin/$source_branch"
+                # Merge the current master into the build branch before validation.
+                git merge origin/master --no-ff || { echo "Merge conflict detected"; exit 1; }
+            '''
+        }
+      }
+    }
+
+      stage('puppet parser') {
+        steps {
+          sh '''for file in $(find . -iname \'*.pp\'); do
+            /opt/puppetlabs/bin/puppet parser validate --color false --render-as s --modulepath=modules $file || exit 1;
+            done;'''
+          }
+        }
+
+      stage('check templates') {
+        steps{
+          sh '''for file in $(find . -iname \'*.erb\');
+            do erb -P -x -T "-" $file | ruby -c || exit 1;
+            done;'''
+        }
+      }
+
+      stage('puppet-lint') {
+        steps {
+          sh '''/usr/local/bin/puppet-lint . \\
+                --no-variable_scope-check \\
+                || { echo "Puppet lint failed"; exit 1; }
+            '''
+          }
+        }
+
+      stage('SonarScan') {
+         steps {
+            withCredentials([string(credentialsId: 'sonar-token', variable: 'SONAR_TOKEN')]) {
+              sh '''
+              /opt/sonar-scanner/bin/sonar-scanner \
+                -Dsonar.projectKey=confdroid_ssh \
+                -Dsonar.sources=. \
+                -Dsonar.host.url=https://sonarqube.confdroid.com \
+                -Dsonar.token=$SONAR_TOKEN
+                '''
+              }
+            }
+          }
+
+      stage('create Puppet documentation') {
+        steps {
+          sh '/opt/puppetlabs/bin/puppet strings'
+        }
+      }
+
+      stage('update repo') {
+        steps {
+          sshagent(['edd05eb6-26b5-4c7b-a5cc-ea2ab899f4fa']) {
+            sh '''
+                git config user.name "Jenkins Server"
+                git config user.email jenkins@confdroid.com
+                git add -A && git commit -am "Recommit for updates in build $BUILD_NUMBER" || echo "No changes to commit"
+                git fetch origin
+                git checkout -B master origin/master
+                git merge --no-ff jenkins-build-$BUILD_NUMBER -m "Merge build $BUILD_NUMBER into master"
+                git push origin master
+            '''
+        }
+      }
+    }
+      stage('Mirror to Gitea') {
+        steps {
+          withCredentials([usernamePassword(
+            credentialsId: 'Jenkins-gitea',
+            usernameVariable: 'GITEA_USER',
+            passwordVariable: 'GITEA_TOKEN')]) {
+            script {
+                sh '''
+                  git fetch origin
+                  git checkout master
+                  git reset --hard origin/master
+                  git remote get-url master >/dev/null 2>&1 \
+                    && git remote set-url master https://sourcecode.confdroid.com/confdroid/confdroid_ssh.git \
+                    || git remote add master https://sourcecode.confdroid.com/confdroid/confdroid_ssh.git
+                  git -c credential.helper="!f() { echo username=${GITEA_USER}; echo password=${GITEA_TOKEN}; }; f" \
+                  push --force master refs/heads/master:refs/heads/master
+                  '''
+          }
+        }
+      }
+    }
+  }
+}

README.md

@@ -7,6 +7,7 @@
   - [Synopsis](#synopsis)
   - [WARNING](#warning)
   - [Features](#features)
+  - [Adding custom configurations](#adding-custom-configurations)
   - [Support](#support)
   - [Parameter Inheritance](#parameter-inheritance)
   - [Module Deployment](#module-deployment)
@@ -25,10 +26,34 @@
 ## Features
 
 - install required binaries
-- manage selinux rules
+- manage required files and directories including selinux context
 - manage service
 - (optional) manage firewall
 
+## Adding custom configurations
+
+Custom configuration files live in  `/etc/ssh/sshd_config.d/`. IN order to create a custom config file, add a stanza like this in your control repo:
+
+```puppet
+confdroid_ssh::custom::custom_config { '30-my-custom-rule':
+  config_name    => '30-custom-rule',
+  config_content => ['PasswordAuthentication no'],
+}
+```
+
+This will create a file /etc/ssh/sshd_config.d/30-custom-rule.conf with this content:
+
+```puppet
+###############################################################################
+##### DO NOT EDIT THIS FILE MANUALLY                                          #
+##### This file is managed by Puppet. Any changes to this file will be        #
+##### overwritten. Update the Puppet define input instead.                    #
+###############################################################################
+PasswordAuthentication no
+```
+
+Note that the value for config_content **has to be an array**, even if only one key pair is in there. This field is designed to hold multiple values, which create one line in the config file each.
+
 ## Support
 
 - Rocky 9 (Any RHEL 9 based OS should work but has not been tested)

doc/_index.html

@@ -122,6 +122,30 @@
 
 
 
+<h2>Defined Type Listing A-Z</h2>
+
+  
+<table>
+  <tr>
+    <td valign='top' width="33%">
+  
+    
+      <ul id="alpha_C" class="alpha">
+        <li class="letter">C</li>
+          <ul>
+    
+            <li>
+      <span class='object_link'><a href="puppet_defined_types/confdroid_ssh_3A_3Acustom_3A_3Acustom_config.html" title="puppet_defined_types::confdroid_ssh::custom::custom_config (puppet_defined_type)">confdroid_ssh::custom::custom_config</a></span>
+      
+            </li>
+    
+      </ul>
+    </ul>
+  
+    </td>
+  </tr>
+</table>
+
 
 
 

doc/file.README.html

@@ -70,6 +70,8 @@
 </li><li>
 <p><a href="#features">Features</a></p>
 </li><li>
+<p><a href="#adding-custom-configurations">Adding custom configurations</a></p>
+</li><li>
 <p><a href="#support">Support</a></p>
 </li><li>
 <p><a href="#parameter-inheritance">Parameter Inheritance</a></p>
@@ -97,13 +99,35 @@
 <ul><li>
 <p>install required binaries</p>
 </li><li>
-<p>manage selinux rules</p>
+<p>manage required files and directories including selinux context</p>
 </li><li>
 <p>manage service</p>
 </li><li>
 <p>(optional) manage firewall</p>
 </li></ul>
 
+<h2 id="label-Adding+custom+configurations">Adding custom configurations</h2>
+
+<p>Custom configuration files live in <code>/etc/ssh/sshd_config.d/</code>. IN order to create a custom config file, add a stanza like this in your control repo:</p>
+
+<pre class="code ruby"><code class="ruby">confdroid_ssh::custom::custom_config { &#39;30-my-custom-rule&#39;:
+  config_name    =&gt; &#39;30-custom-rule&#39;,
+  config_content =&gt; [&#39;PasswordAuthentication no&#39;],
+}
+</code></pre>
+
+<p>This will create a file /etc/ssh/sshd_config.d/30-custom-rule.conf with this content:</p>
+
+<pre class="code ruby"><code class="ruby"><span class='comment'>###############################################################################
+</span><span class='comment'>##### DO NOT EDIT THIS FILE MANUALLY                                          #
+</span><span class='comment'>##### This file is managed by Puppet. Any changes to this file will be        #
+</span><span class='comment'>##### overwritten. Update the Puppet define input instead.                    #
+</span><span class='comment'>###############################################################################
+</span><span class='const'>PasswordAuthentication</span> <span class='id identifier rubyid_no'>no</span>
+</code></pre>
+
+<p>Note that the value for config_content <strong>has to be an array</strong>, even if only one key pair is in there. This field is designed to hold multiple values, which create one line in the config file each.</p>
+
 <h2 id="label-Support">Support</h2>
 <ul><li>
 <p>Rocky 9 (Any RHEL 9 based OS should work but has not been tested)</p>

doc/index.html

@@ -70,6 +70,8 @@
 </li><li>
 <p><a href="#features">Features</a></p>
 </li><li>
+<p><a href="#adding-custom-configurations">Adding custom configurations</a></p>
+</li><li>
 <p><a href="#support">Support</a></p>
 </li><li>
 <p><a href="#parameter-inheritance">Parameter Inheritance</a></p>
@@ -97,13 +99,35 @@
 <ul><li>
 <p>install required binaries</p>
 </li><li>
-<p>manage selinux rules</p>
+<p>manage required files and directories including selinux context</p>
 </li><li>
 <p>manage service</p>
 </li><li>
 <p>(optional) manage firewall</p>
 </li></ul>
 
+<h2 id="label-Adding+custom+configurations">Adding custom configurations</h2>
+
+<p>Custom configuration files live in <code>/etc/ssh/sshd_config.d/</code>. IN order to create a custom config file, add a stanza like this in your control repo:</p>
+
+<pre class="code ruby"><code class="ruby">confdroid_ssh::custom::custom_config { &#39;30-my-custom-rule&#39;:
+  config_name    =&gt; &#39;30-custom-rule&#39;,
+  config_content =&gt; [&#39;PasswordAuthentication no&#39;],
+}
+</code></pre>
+
+<p>This will create a file /etc/ssh/sshd_config.d/30-custom-rule.conf with this content:</p>
+
+<pre class="code ruby"><code class="ruby"><span class='comment'>###############################################################################
+</span><span class='comment'>##### DO NOT EDIT THIS FILE MANUALLY                                          #
+</span><span class='comment'>##### This file is managed by Puppet. Any changes to this file will be        #
+</span><span class='comment'>##### overwritten. Update the Puppet define input instead.                    #
+</span><span class='comment'>###############################################################################
+</span><span class='const'>PasswordAuthentication</span> <span class='id identifier rubyid_no'>no</span>
+</code></pre>
+
+<p>Note that the value for config_content <strong>has to be an array</strong>, even if only one key pair is in there. This field is designed to hold multiple values, which create one line in the config file each.</p>
+
 <h2 id="label-Support">Support</h2>
 <ul><li>
 <p>Rocky 9 (Any RHEL 9 based OS should work but has not been tested)</p>

doc/puppet_class_list.html

@@ -28,6 +28,10 @@
               Puppet Classes
             </a></span>
           
+            <span><a target="_self" href="puppet_defined_type_list.html">
+              Defined Types
+            </a></span>
+          
         </div>
 
         <div id="search">Search: <input type="text" /></div>

doc/puppet_defined_type_list.html

@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta charset="utf-8" />
+    
+      <link rel="stylesheet" href="css/full_list.css" type="text/css" media="screen" />
+    
+      <link rel="stylesheet" href="css/common.css" type="text/css" media="screen" />
+    
+
+    
+      <script type="text/javascript" charset="utf-8" src="js/jquery.js"></script>
+    
+      <script type="text/javascript" charset="utf-8" src="js/full_list.js"></script>
+    
+
+    <title>Defined Type List</title>
+    <base id="base_target" target="_parent" />
+  </head>
+  <body>
+    <div id="content">
+      <div class="fixed_header">
+        <h1 id="full_list_header">Defined Type List</h1>
+        <div id="full_list_nav">
+          
+            <span><a target="_self" href="puppet_class_list.html">
+              Puppet Classes
+            </a></span>
+          
+            <span><a target="_self" href="puppet_defined_type_list.html">
+              Defined Types
+            </a></span>
+          
+        </div>
+
+        <div id="search">Search: <input type="text" /></div>
+      </div>
+
+      <ul id="full_list" class="puppet_defined_type">
+        
+
+    <li id="object_puppet_defined_types::confdroid_ssh::custom::custom_config" class="odd">
+      <div class="item">
+        <span class='object_link'><a href="puppet_defined_types/confdroid_ssh_3A_3Acustom_3A_3Acustom_config.html" title="puppet_defined_types::confdroid_ssh::custom::custom_config (puppet_defined_type)">confdroid_ssh::custom::custom_config</a></span>
+      </div>
+    </li>
+    
+
+
+      </ul>
+    </div>
+  </body>
+</html>

doc/puppet_defined_types/confdroid_ssh_3A_3Acustom_3A_3Acustom_config.html

@@ -0,0 +1,209 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>
+  Defined Type: confdroid_ssh::custom::custom_config
+  
+    &mdash; Documentation by YARD 0.9.36
+  
+</title>
+
+  <link rel="stylesheet" href="../css/style.css" type="text/css" />
+
+  <link rel="stylesheet" href="../css/common.css" type="text/css" />
+
+<script type="text/javascript">
+  pathId = "puppet_defined_types::confdroid_ssh::custom::custom_config";
+  relpath = '../';
+</script>
+
+
+  <script type="text/javascript" charset="utf-8" src="../js/jquery.js"></script>
+
+  <script type="text/javascript" charset="utf-8" src="../js/app.js"></script>
+
+
+  </head>
+  <body>
+    <div class="nav_wrap">
+      <iframe id="nav" src="../puppet_defined_type_list.html?1"></iframe>
+      <div id="resizer"></div>
+    </div>
+
+    <div id="main" tabindex="-1">
+      <div id="header">
+        <div id="menu">
+  
+    <a href="../_index.html">Index (c)</a> &raquo;
+    <span class='title'><span class='object_link'>Defined Types</span></span>
+     &raquo; 
+    <span class="title">confdroid_ssh::custom::custom_config</span>
+  
+</div>
+
+        <div id="search">
+  
+    <a class="full_list_link" id="puppet_class_list_link"
+        href="../puppet_class_list.html">
+
+        <svg width="24" height="24">
+          <rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
+          <rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
+          <rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
+        </svg>
+    </a>
+  
+</div>
+        <div class="clear"></div>
+      </div>
+
+      <div id="content"><h1>Defined Type: confdroid_ssh::custom::custom_config</h1>
+<div class="box_info">
+  <dl>
+    <dt>Defined in:</dt>
+    <dd>
+      manifests/custom/custom_config.pp
+    </dd>
+  </dl>
+</div>
+
+  <h2>Summary</h2>
+  Class manages custom configurations for SSH
+
+<h2>Overview</h2>
+<div class="docstring">
+  <div class="discussion">
+    
+<p>confdroid_ssh::custom::custom_config.pp Module name: confdroid_ssh Author: 12ww1160 (12ww1160@confdroid.com)  } this will create a file called /etc/ssh/sshd_config.d/50-test.conf with the content:  PasswordAuthentication no and notify the sshd service to reload the configuration</p>
+
+  </div>
+</div>
+
+
+
+<div class="tags">
+  
+  <div class="examples">
+    <p class="tag_title">Examples:</p>
+    
+      
+      <pre class="example code"><code>confdroid_ssh::custom::custom_config { &#39;50-test&#39;:
+ config_name    =&gt; &#39;50-test&#39;,
+ config_content =&gt; [&#39;PasswordAuthentication no&#39;],</code></pre>
+    
+  </div>
+<p class="tag_title">Parameters:</p>
+<ul class="param">
+  
+    <li>
+      
+        <span class='name'>config_name</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>name of the custom configuration file (without .conf extension)</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>config_content</span>
+      
+      
+        <span class='type'>(<tt>Array[String]</tt>)</span>
+      
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>array of configuration lines to include in the custom config</p>
+</div>
+      
+    </li>
+  
+</ul>
+
+
+
+</div><div class="method_details_list">
+  <table class="source_code">
+    <tr>
+      <td>
+        <pre class="lines">
+
+
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41</pre>
+      </td>
+      <td>
+        <pre class="code"><span class="info file"># File 'manifests/custom/custom_config.pp', line 17</span>
+
+define confdroid_ssh::custom::custom_config (
+
+  String $config_name,
+  Array[String] $config_content,
+
+) {
+  $sshd_custom_path  = $confdroid_ssh::params::sshd_custom_path
+  $sshd_service      = $confdroid_ssh::params::sshd_service
+  $custom_config_erb = &#39;confdroid_ssh/custom_config.erb&#39;
+  $config_basename   = regsubst($config_name, &#39;\\.conf$&#39;, &#39;&#39;)
+  $config_file       = &quot;${config_name}.conf&quot;
+
+  file { &quot;${sshd_custom_path}/${config_file}&quot;:
+    ensure   =&gt; file,
+    owner    =&gt; &#39;root&#39;,
+    group    =&gt; &#39;root&#39;,
+    mode     =&gt; &#39;0600&#39;,
+    selrange =&gt; s0,
+    selrole  =&gt; object_r,
+    seltype  =&gt; etc_t,
+    seluser  =&gt; system_u,
+    content  =&gt; template($custom_config_erb),
+    notify   =&gt; Service[$sshd_service],
+  }
+}</pre>
+      </td>
+    </tr>
+  </table>
+</div>
+</div>
+
+      <div id="footer">
+     Generated by <a href="http://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>.
+</div>
+
+    </div>
+  </body>
+</html>

manifests/custom/custom_config.pp

@@ -0,0 +1,41 @@
+## confdroid_ssh::custom::custom_config.pp
+# Module name: confdroid_ssh
+# Author: 12ww1160 (12ww1160@confdroid.com)
+# @summary Class manages custom configurations for SSH
+# @param [String] config_name name of the custom configuration file 
+#   (without .conf extension)
+# @param [Array[String]] config_content array of configuration lines to 
+#   include in the custom config
+# @example
+#   confdroid_ssh::custom::custom_config { '50-test':
+#    config_name    => '50-test',
+#    config_content => ['PasswordAuthentication no'],
+#  }
+# this will create a file called /etc/ssh/sshd_config.d/50-test.conf with the content:
+#   PasswordAuthentication no and notify the sshd service to reload the configuration
+##############################################################################
+define confdroid_ssh::custom::custom_config (
+
+  String $config_name,
+  Array[String] $config_content,
+
+) {
+  $sshd_custom_path  = $confdroid_ssh::params::sshd_custom_path
+  $sshd_service      = $confdroid_ssh::params::sshd_service
+  $custom_config_erb = 'confdroid_ssh/custom_config.erb'
+  $config_basename   = regsubst($config_name, '\\.conf$', '')
+  $config_file       = "${config_name}.conf"
+
+  file { "${sshd_custom_path}/${config_file}":
+    ensure   => file,
+    owner    => 'root',
+    group    => 'root',
+    mode     => '0600',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => etc_t,
+    seluser  => system_u,
+    content  => template($custom_config_erb),
+    notify   => Service[$sshd_service],
+  }
+}

templates/custom_config.erb

@@ -0,0 +1,8 @@
+###############################################################################
+##### DO NOT EDIT THIS FILE MANUALLY                                          #
+##### This file is managed by Puppet. Any changes to this file will be        #
+##### overwritten. Update the Puppet define input instead.                    #
+###############################################################################
+<% @config_content.each do |config_line| -%>
+<%= config_line %>
+<% end -%>