default.rb
1.44 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
# enable EPEL repository by default
package 'epel-release'
# replicate production security setup
package 'selinux-policy'
package 'policycoreutils-python'
cookbook_file '/etc/selinux/config' do
source 'selinux_config'
owner 'root'
group 'root'
mode 0644
end
cookbook_file '/usr/local/bin/selinux-enabled' do
owner 'root'
group 'root'
mode '0755'
end
execute 'setenforce Enforcing' do
only_if 'selinux-enabled'
end
execute 'setsebool httpd_can_network_connect 1' do
only_if 'selinux-enabled'
end
# directory for local type enforcements
directory '/etc/selinux/local' do
owner 'root'
group 'root'
mode '0755'
end
cookbook_file '/usr/local/bin/selinux-install-module' do
owner 'root'
group 'root'
mode '0755'
end
package 'vim'
package 'bash-completion'
package 'rsyslog'
package 'tmux'
package 'less'
package 'htop'
package 'ntp'
cookbook_file '/usr/local/bin/is-a-container' do
owner 'root'
group 'root'
mode '0755'
end
service 'ntpd' do
action [:enable, :start]
not_if 'is-a-container'
end
service 'firewalld' do
action [:disable, :stop]
ignore_failure true
end
service 'sshd' do
action [:enable]
end
# FIXME on Debian it's postgresql-client
package 'postgresql'
# key for our custom repositories
if node['platform'] == 'centos'
cookbook_file '/etc/yum.repos.d/softwarepublico.key' do
owner 'root'
mode 0644
end
end
template '/etc/hosts' do
owner 'root'
mode 0644
end