From e29c6229cef5e1c9b8522c948f9bc2da3b492aac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Mat=C4=9Bja?= Date: Thu, 6 Jun 2024 15:55:36 +0200 Subject: [PATCH] Define resource bacula::director::console --- REFERENCE.md | 138 +++++++++++++++++++++++++++++++ manifests/director.pp | 1 + manifests/director/console.pp | 70 ++++++++++++++++ templates/bacula-dir-console.epp | 42 ++++++++++ templates/bacula-dir-tail.epp | 1 + 5 files changed, 252 insertions(+) create mode 100644 manifests/director/console.pp create mode 100644 templates/bacula-dir-console.epp diff --git a/REFERENCE.md b/REFERENCE.md index cea8beafb..fa462a443 100644 --- a/REFERENCE.md +++ b/REFERENCE.md @@ -17,6 +17,7 @@ ### Defined types * [`bacula::director::client`](#bacula--director--client): Define a Bacula Director Client +* [`bacula::director::console`](#bacula--director--console): Define a Bacula Director Console * [`bacula::director::fileset`](#bacula--director--fileset): Configure a Bacula Director Fileset * [`bacula::director::job`](#bacula--director--job): Configure a Bacula Director Job * [`bacula::director::pool`](#bacula--director--pool): Configure a Bacula Director Pool @@ -1007,6 +1008,143 @@ The path to the bacula configuration directory Default value: `$bacula::conf_dir` +### `bacula::director::console` + +This define creates a console declaration for the director. +Resources of this type are intended to manage conf.d/console.conf entries. + +Aside from Director resource names and console command names, +the special keyword *all* can be specified in any of the above access control lists. +When this keyword is present, any resource or command name (which ever is appropriate) will be accepted. + +#### Examples + +##### + +```puppet +bacula::director::console { 'Monitoring': + password => 'monitoring_password', +} +``` + +#### Parameters + +The following parameters are available in the `bacula::director::console` defined type: + +* [`conf_dir`](#-bacula--director--console--conf_dir) +* [`password`](#-bacula--director--console--password) +* [`jobacl`](#-bacula--director--console--jobacl) +* [`clientacl`](#-bacula--director--console--clientacl) +* [`storageacl`](#-bacula--director--console--storageacl) +* [`scheduleacl`](#-bacula--director--console--scheduleacl) +* [`poolacl`](#-bacula--director--console--poolacl) +* [`filesetacl`](#-bacula--director--console--filesetacl) +* [`catalogacl`](#-bacula--director--console--catalogacl) +* [`commandacl`](#-bacula--director--console--commandacl) +* [`whereacl`](#-bacula--director--console--whereacl) + +##### `conf_dir` + +Data type: `String` + +The bacula configuration director. Should not need adjusting + +Default value: `$bacula::conf_dir` + +##### `password` + +Data type: `String[1]` + +The password that must be supplied for a named Bacula Console to be authorized + +##### `jobacl` + +Data type: `Optional[String[1]]` + +A list of Job resource names that can be accessed by the console. + +Default value: `undef` + +##### `clientacl` + +Data type: `Optional[String[1]]` + +A list of Client resource names that can be accessed by the console. + +Default value: `undef` + +##### `storageacl` + +Data type: `Optional[String[1]]` + +A list of Storage resource names that can be accessed by the console. + +Default value: `undef` + +##### `scheduleacl` + +Data type: `Optional[String[1]]` + +A list of Schedule resource names that can be accessed by the console. + +Default value: `undef` + +##### `poolacl` + +Data type: `Optional[String[1]]` + +A list of Pool resource names that can be accessed by the console. + +Default value: `undef` + +##### `filesetacl` + +Data type: `Optional[String[1]]` + +A list of FileSet resource names that can be accessed by the console. + +Default value: `undef` + +##### `catalogacl` + +Data type: `String[1]` + +A list of Catalog resource names that can be accessed by the console. + +Default value: `'*all*'` + +##### `commandacl` + +Data type: + +```puppet +Array[Enum[ + ['add'], ['autodisplay'], ['automount'], ['cancel'], ['cloud'], ['create'], ['delete'], ['disable'], ['enable'], ['estimate'], + ['exit'], ['gui'], ['help'], ['label'], ['list'], ['llist'], ['messages'], ['memory'], ['mount'], ['prune'], ['purge'], ['query'], + ['quit'], ['relabel'], ['release'], ['reload'], ['restart'], ['resume'], ['restore'], ['run'], ['setbandwidth'], ['setdebug'], + ['setip'], ['show'], ['sqlquery'], ['status'], ['tag'], ['time'], ['trace'], ['umount'], ['unmount'], ['update'], ['use'], ['var'], + ['version'], ['wait'], ['.api'], ['.backups'], ['.clients'], ['.catalogs'], ['.defaults'], ['.die'], ['.dir'], ['.dump'], ['.exit'], + ['.events'], ['.filesets'], ['.help'], ['.jobs'], ['.estimate'], ['.jlist'], ['.levels'], ['.messages'], ['.msgs'], ['.pools'], + ['.quit'], ['.putfile'], ['.schedule'], ['.sql'], ['.status'], ['.storage'], ['.volstatus'], ['.media'], ['.mediatypes'], + ['.locations'], ['.actiononpurge'], ['.bvfs_lsdirs'], ['.bvfs_lsfiles'], ['.bvfs_get_volumes'], ['.bvfs_update'], + ['.bvfs_get_jobids'], ['.bvfs_get_jobs'], ['.bvfs_get_bootstrap'], ['.bvfs_get_fileindex'], ['.bvfs_versions'], ['.bvfs_get_delta'], + ['.bvfs_restore'], ['.bvfs_cleanup'], ['.bvfs_decode_lstat'], ['.bvfs_clear_cache'], ['.bvfs_update_fv'], ['.bvfs_delete_fileid'], + ['.setuid'], ['.ls'], ['.types'], ['.query'], ['.tags'], + ]] +``` + +A list of of console commands that can be executed by the console. + +Default value: `['list']` + +##### `whereacl` + +Data type: `Optional[String[1]]` + +This directive permits you to specify where a restricted console can restore files. + +Default value: `undef` + ### `bacula::director::fileset` This class handles a Director's fileset.conf entry. Filesets are intended to diff --git a/manifests/director.pp b/manifests/director.pp index 40e0b7b1c..0731fd6c3 100644 --- a/manifests/director.pp +++ b/manifests/director.pp @@ -155,6 +155,7 @@ ] $sub_confs_with_secrets = [ + "${conf_dir}/conf.d/console.conf", "${conf_dir}/conf.d/client.conf", "${conf_dir}/conf.d/storage.conf", ] diff --git a/manifests/director/console.pp b/manifests/director/console.pp new file mode 100644 index 000000000..8dd90e671 --- /dev/null +++ b/manifests/director/console.pp @@ -0,0 +1,70 @@ +# @summary Define a Bacula Director Console +# +# This define creates a console declaration for the director. +# Resources of this type are intended to manage conf.d/console.conf entries. +# +# @param conf_dir The bacula configuration director. Should not need adjusting +# @param password The password that must be supplied for a named Bacula Console to be authorized +# @param jobacl A list of Job resource names that can be accessed by the console. +# @param clientacl A list of Client resource names that can be accessed by the console. +# @param storageacl A list of Storage resource names that can be accessed by the console. +# @param scheduleacl A list of Schedule resource names that can be accessed by the console. +# @param poolacl A list of Pool resource names that can be accessed by the console. +# @param filesetacl A list of FileSet resource names that can be accessed by the console. +# @param catalogacl A list of Catalog resource names that can be accessed by the console. +# @param commandacl A list of of console commands that can be executed by the console. +# @param whereacl This directive permits you to specify where a restricted console can restore files. +# +# Aside from Director resource names and console command names, +# the special keyword *all* can be specified in any of the above access control lists. +# When this keyword is present, any resource or command name (which ever is appropriate) will be accepted. +# +# @example +# bacula::director::console { 'Monitoring': +# password => 'monitoring_password', +# } +# +define bacula::director::console ( + String[1] $password, + String $conf_dir = $bacula::conf_dir, + String[1] $catalogacl = '*all*', + Array[Enum[ + ['add'], ['autodisplay'], ['automount'], ['cancel'], ['cloud'], ['create'], ['delete'], ['disable'], ['enable'], ['estimate'], + ['exit'], ['gui'], ['help'], ['label'], ['list'], ['llist'], ['messages'], ['memory'], ['mount'], ['prune'], ['purge'], ['query'], + ['quit'], ['relabel'], ['release'], ['reload'], ['restart'], ['resume'], ['restore'], ['run'], ['setbandwidth'], ['setdebug'], + ['setip'], ['show'], ['sqlquery'], ['status'], ['tag'], ['time'], ['trace'], ['umount'], ['unmount'], ['update'], ['use'], ['var'], + ['version'], ['wait'], ['.api'], ['.backups'], ['.clients'], ['.catalogs'], ['.defaults'], ['.die'], ['.dir'], ['.dump'], ['.exit'], + ['.events'], ['.filesets'], ['.help'], ['.jobs'], ['.estimate'], ['.jlist'], ['.levels'], ['.messages'], ['.msgs'], ['.pools'], + ['.quit'], ['.putfile'], ['.schedule'], ['.sql'], ['.status'], ['.storage'], ['.volstatus'], ['.media'], ['.mediatypes'], + ['.locations'], ['.actiononpurge'], ['.bvfs_lsdirs'], ['.bvfs_lsfiles'], ['.bvfs_get_volumes'], ['.bvfs_update'], + ['.bvfs_get_jobids'], ['.bvfs_get_jobs'], ['.bvfs_get_bootstrap'], ['.bvfs_get_fileindex'], ['.bvfs_versions'], ['.bvfs_get_delta'], + ['.bvfs_restore'], ['.bvfs_cleanup'], ['.bvfs_decode_lstat'], ['.bvfs_clear_cache'], ['.bvfs_update_fv'], ['.bvfs_delete_fileid'], + ['.setuid'], ['.ls'], ['.types'], ['.query'], ['.tags'], + ]] $commandacl = ['list'], + Optional[String[1]] $jobacl = undef, + Optional[String[1]] $clientacl = undef, + Optional[String[1]] $storageacl = undef, + Optional[String[1]] $scheduleacl = undef, + Optional[String[1]] $poolacl = undef, + Optional[String[1]] $filesetacl = undef, + Optional[String[1]] $whereacl = undef, +) { + $epp_console_variables = { + name => $name, + password => $password, + commandacl => $commandacl, + whereacl => $whereacl, + jobacl => $jobacl, + clientacl => $clientacl, + storageacl => $scheduleacl, + scheduleacl => $scheduleacl, + poolacl => $poolacl, + filesetacl => $filesetacl, + catalogacl => $catalogacl, + } + + concat::fragment { "bacula-director-console-${name}": + target => "${conf_dir}/conf.d/console.conf", + content => epp('bacula/bacula-dir-console.epp', $epp_console_variables), + } +} diff --git a/templates/bacula-dir-console.epp b/templates/bacula-dir-console.epp new file mode 100644 index 000000000..2da27d3da --- /dev/null +++ b/templates/bacula-dir-console.epp @@ -0,0 +1,42 @@ +<% + | + String $name, + String $password, + String $catalogacl, + Array $commandacl, + Optional[String] $jobacl, + Optional[String] $clientacl, + Optional[String] $storageacl, + Optional[String] $scheduleacl, + Optional[String] $poolacl, + Optional[String] $filesetacl, + Optional[String] $whereacl, + | +-%> +Console { + Name = <%= $name %> + Password = "<%= $password %>" +<% if $jobacl { -%> + JobACL = <%= $jobacl %> +<% } -%> +<% if $clientacl { -%> + ClientACL = <%= $clientacl %> +<% } -%> +<% if $storageacl { -%> + StorageACL = <%= $storageacl %> +<% } -%> +<% if $scheduleacl { -%> + ScheduleACL = <%= $scheduleacl %> +<% } -%> +<% if $poolacl { -%> + PoolACL = <%= $poolacl %> +<% } -%> +<% if $filesetacl { -%> + FileSetACL = <%= $filesetacl %> +<% } -%> + CatalogACL = <%= $catalogacl %> + CommandACL = <%= $commandacl.join(', ') %> +<% if $whereacl { -%> + WhereACL = <%= $whereacl %> +<% } -%> +} diff --git a/templates/bacula-dir-tail.epp b/templates/bacula-dir-tail.epp index a8e4020d9..d5aa3400a 100644 --- a/templates/bacula-dir-tail.epp +++ b/templates/bacula-dir-tail.epp @@ -5,3 +5,4 @@ @<%= $bacula::conf_dir %>/conf.d/fileset.conf @<%= $bacula::conf_dir %>/conf.d/jobdefs.conf @<%= $bacula::conf_dir %>/conf.d/job.conf +@<%= $bacula::conf_dir %>/conf.d/console.conf