def.cf

###############################################################################
#
# bundle common def
#  - common/global variables and classes here
#
###############################################################################

bundle common def

{

  vars:

    any::

      # Begin change

      # Your domain name, for use in access control

      "domain"  string => "$(sys.domain)", # this default may be inaccurate!
      comment => "Define a global domain for all hosts",
      handle => "common_def_vars_domain";

      # List here the IP masks that we grant access to on the server

      "acl"     slist => {
                           # Allow everything in my own domain.

                           # Note that this:
                           # 1. requires def.domain to be correctly set
                           # 2. will cause a DNS lookup for every access
                           ".*$(def.domain)",

                           # Assume /16 LAN clients to start with
                           "$(sys.policy_hub)/16",

                           #  "2001:700:700:3.*",
                           #  "217.77.34.18",
                           #  "217.77.34.19",
      },
      comment => "Define an acl for the machines to be granted accesses",
      handle => "common_def_vars_acl";

      # Out of the hosts in allowconnects, trust new keys only from the
      # following ones.  This is open by default for bootstrapping.

      "trustkeysfrom" slist => {
                                 # COMMENT THE NEXT LINE OUT AFTER ALL MACHINES HAVE BEEN BOOTSTRAPPED.
                                 "0.0.0.0/0", # allow any IP
      },
      comment => "Define from which machines keys can be trusted";

      # End change #

  cfengine_3_5::
      "dir_masterfiles" string => translatepath("$(sys.workdir)/masterfiles"),
      comment => "Define masterfiles path",
      handle => "common_def_vars_dir_masterfiles_backport";

    !cfengine_3_5::
      "dir_masterfiles" string => translatepath("$(sys.masterdir)"),
      comment => "Define masterfiles path",
      handle => "common_def_vars_dir_masterfiles";

      "dir_reports"     string => translatepath("$(sys.workdir)/reports"),
      comment => "Define reports path",
      handle => "common_def_vars_dir_reports";

      "dir_software"    string => translatepath("$(sys.workdir)/master_software_updates"),
      comment => "Define software path",
      handle => "common_def_vars_dir_software";

      "dir_bin"         string => translatepath("$(sys.bindir)"),
      comment => "Define binary path",
      handle => "common_def_vars_dir_bin";

      "dir_modules"     string => translatepath("$(sys.workdir)/modules"),
      comment => "Define modules path",
      handle => "common_def_vars_dir_modules";

      "dir_plugins"     string => translatepath("$(sys.workdir)/plugins"),
      comment => "Define plugins path",
      handle => "common_def_vars_dir_plugins";

    cfengine_3_5::
      "cf_apache_user" string => "apache",
      comment => "User that CFEngine Enterprise webserver runs as",
      handle => "common_def_vars_cf_apache_user";

      "cf_apache_group" string => "apache",
      comment => "Group that CFEngine Enterprise webserver runs as",
      handle => "common_def_vars_cf_apache_group";

    !cfengine_3_5::
      "cf_apache_user" string => "cfapache",
      comment => "User that CFEngine Enterprise webserver runs as",
      handle => "common_def_vars_cf_cfapache_user";

      "cf_apache_group" string => "cfapache",
      comment => "Group that CFEngine Enterprise webserver runs as",
      handle => "common_def_vars_cf_cfapache_group";

      solaris::
      "cf_runagent_shell"
        string  => "/usr/bin/sh",
        comment => "Define path to shell used by cf-runagent",
        handle  => "common_def_vars_solaris_cf_runagent_shell";

      !(windows|solaris)::
      "cf_runagent_shell"
        string  => "/bin/sh",
        comment => "Define path to shell used by cf-runagent",
        handle  => "common_def_vars_cf_runagent_shell";

    any::
      "base_log_files" slist =>
      {
        "$(sys.workdir)/cf3.$(sys.host).runlog",
        "$(sys.workdir)/promise_summary.log",
      };

      "enterprise_log_files" slist =>
      {
        "$(sys.workdir)/cf_notkept.log",
        "$(sys.workdir)/cf_repair.log",
        "$(sys.workdir)/state/cf_value.log",
        "$(sys.workdir)/outputs/dc-scripts.log",
      };

      "hub_log_files" slist =>
      {
        "$(sys.workdir)/httpd/logs/access_log", # Mission Portal
        "$(sys.workdir)/httpd/logs/error_log", # Mission Portal
      };

    enterprise.!am_policy_hub::
      # CFEngine's own log files
      "cfe_log_files" slist => { @(base_log_files), @(enterprise_log_files) };

    enterprise.am_policy_hub::
      # CFEngine's own log files
      "cfe_log_files" slist => { @(base_log_files), @(enterprise_log_files), @(hub_log_files) };

    !enterprise::
      # CFEngine's own log files
      "cfe_log_files" slist => { @(base_log_files) };

    any::
      "cfe_log_dirs" slist =>
      {
        "$(sys.workdir)/outputs",
        "$(sys.workdir)/reports",
      };

  classes:

      ### Enable special features policies. Set to "any" to enable.

      # Auto-load files in "services/autorun" and run bundles tagged "autorun".
      # Disabled by default!
      "services_autorun" expression => "!any";

      # Internal CFEngine log files rotation
      "cfengine_internal_rotate_logs" expression => "any";

      # Transfer policies and binaries with encryption
      # you can also request it from the command line with
      # -Dcfengine_internal_encrypt_transfers

      # NOTE THAT THIS CLASS ALSO NEEDS TO BE SET IN update.cf

      "cfengine_internal_encrypt_transfers" expression => "!any";

      # Purge policies that don't exist on the server side.
      # you can also request it from the command line with
      # -Dcfengine_internal_purge_policies

      # NOTE THAT THIS CLASS ALSO NEEDS TO BE SET IN update.cf

      "cfengine_internal_purge_policies" expression => "!any";

      # Allow the hub to edit sudoers in order for the Apache user to
      # run passwordless sudo cf-runagent. Enable this if you want the
      # Mission Portal to be able to troubleshoot failed Design Center
      # sketch activations on a host.
      "cfengine_internal_sudoers_editing_enable" expression => "!any";

      # Class defining which versions of cfengine are (not) supported
      # by this policy version.
      # Also note that this policy will only be run on enterprise policy_server
      "postgresql_maintenance_supported" expression => "policy_server.enterprise.!cfengine_3_5";

      # This class is for PosgreSQL maintenance
      # pre-defined to every Sunday at 2 a.m.
      # This can be changed later on.

      "postgresql_full_maintenance" expression => "postgresql_maintenance_supported.Sunday.Hr02.Min00_05";

      # Vacuum monitoring_mg table every day (except Sunday, when vacuum is run on entire db)
      "postgresql_monitoring_maintenance" expression => "postgresql_maintenance_supported.!Sunday.Hr02.Min00_05";
}

bundle common inventory_control
# @brief Inventory control bundle
#
# This common bundle is for controlling whether some inventory bundles
# are disabled.
{
  vars:
      "dmidecoder" string => "/usr/sbin/dmidecode";
      "lldpctl_exec" string => "/usr/bin/lldpctl";
      "lsb_exec" string => "/usr/bin/lsb_release";
      "mtab" string => "/etc/mtab";
      "proc" string => "/proc";

  classes:
      # setting this disables all the inventory modules except package_refresh
      "disable_inventory" expression => "!any";

      # disable specific inventory modules below

      # by default disable the LSB inventory if the general inventory
      # is disabled or the binary is missing.  Note that the LSB
      # binary is typically not very fast.
      "disable_inventory_lsb" expression => "disable_inventory";
      "disable_inventory_lsb" not => fileexists($(lsb_exec));

      # by default disable the dmidecode inventory if the general
      # inventory is disabled or the binary does not exist.  Note that
      # typically this is a very fast binary.
      "disable_inventory_dmidecode" expression => "disable_inventory";
      "disable_inventory_dmidecode" not => fileexists($(dmidecoder));

      # by default disable the LLDP inventory if the general inventory
      # is disabled or the binary does not exist.  Note that typically
      # this is a reasonably fast binary but still may require network
      # I/O.
      "disable_inventory_LLDP" expression => "disable_inventory";
      "disable_inventory_LLDP" not => fileexists($(lldpctl_exec));

      # by default run the package inventory refresh every time, even
      # if disable_inventory is set
      "disable_inventory_package_refresh" expression => "!any";

      # by default disable the mtab inventory if the general inventory
      # is disabled or $(mtab) is missing.  Note that this is very
      # fast.
      "disable_inventory_mtab" expression => "disable_inventory";
      "disable_inventory_mtab" not => fileexists($(mtab));

      # by default disable the fstab inventory if the general
      # inventory is disabled or $(sys.fstab) is missing.  Note that
      # this is very fast.
      "disable_inventory_fstab" expression => "disable_inventory";
      "disable_inventory_fstab" not => fileexists($(sys.fstab));

      # by default disable the proc inventory if the general
      # inventory is disabled or /proc is missing.  Note that
      # this is typically fast.
      "disable_inventory_proc" expression => "disable_inventory";
      "disable_inventory_proc" not => isdir($(proc));

      # by default don't run the CMDB integration every time, even if
      # disable_inventory is not set
      "disable_inventory_cmdb" expression => "any";

  reports:
    verbose_mode.disable_inventory::
      "$(this.bundle): All inventory modules disabled";
    verbose_mode.!disable_inventory_lsb::
      "$(this.bundle): LSB module enabled";
    verbose_mode.!disable_inventory_dmidecode::
      "$(this.bundle): dmidecode module enabled";
    verbose_mode.!disable_inventory_LLDP::
      "$(this.bundle): LLDP module enabled";
    verbose_mode.!disable_inventory_mtab::
      "$(this.bundle): mtab module enabled";
    verbose_mode.!disable_inventory_fstab::
      "$(this.bundle): fstab module enabled";
    verbose_mode.!disable_inventory_proc::
      "$(this.bundle): proc module enabled";
    verbose_mode.!disable_inventory_package_refresh::
      "$(this.bundle): package_refresh module enabled";
    verbose_mode.!disable_inventory_cmdb::
      "$(this.bundle): CMDB module enabled";
}