Completed files for http://terrarum.net/blog/puppet-infrastructure-2015.html

etc__puppet__site.pp

node 'puppet.example.com' {
  contain site::roles::puppet_server
}

modules__site__data__common.yaml

---
# Firewall
trusted_networks:
  - '192.168.1.0/24'
  - '10.255.0.0/24'
  
# Puppet
site::puppet::puppet_package_ensure: 'latest'
site::puppet::server_package_ensure: 'latest'
site::puppet::settings::main:
  server: 'puppet'
  parser: 'future'
  ordering: 'manifest'
  pluginsync: true
  logdir: '/var/log/puppet'
  vardir: '/var/lib/puppet'
  ssldir: '/var/lib/puppet/ssl'
  rundir: '/var/run/puppet'
site::puppet::settings::agent:
  certname: "%{::fqdn}"
  show_diff: true
  splay: false
  configtimeout: 360
  usecacheonfailure: true
  report: true
  environment: "%{::environment}"
site::puppet::settings::server_default:
  JAVA_ARGS: '-Xms1g -Xmx1g -XX:MaxPermSize=256m'
site::puppet::settings::master:
  ca: true
  ssldir: '/var/lib/puppet/ssl'
puppetdb::master::config::restart_puppet: false

modules__site__ext__hiera.yaml

---
:backends:
  - yaml

:hierarchy:
  - "node/%{::hostname}"
  - "location/%{::location}"
  - "role/%{::role}"
  - common

:yaml:
  :datadir: /etc/puppet/modules/site/data

:merge_behavior: deeper

modules__site__ext__Puppetfile

mod 'concat',
  :git => 'https://github.com/puppetlabs/puppetlabs-concat',
  :ref => '1.1.2'

mod 'firewall',
  :git => 'https://github.com/puppetlabs/puppetlabs-firewall'

mod 'inifile',
  :git => 'https://github.com/puppetlabs/puppetlabs-inifile',
  :ref => '792d35cdb48fc2cba08ab578c1b7bc42ef3a0ace'

mod 'ntp',
  :git => 'https://github.com/puppetlabs/puppetlabs-ntp'

mod 'postgresql',
  :git => 'https://github.com/puppetlabs/puppetlabs-postgresql',
  :ref => '4.1.0'

mod 'puppet',
  :git => 'https://github.com/jtopjian/puppet-puppet',
  :ref => 'puppetserver'

mod 'puppetdb',
  :git => 'https://github.com/puppetlabs/puppetlabs-puppetdb',
  :ref => '4.1.0'

mod 'stdlib',
  :git => 'https://github.com/puppetlabs/puppetlabs-stdlib',
  :ref => '4.4.x'

modules__site__manifests__firewall.pp

class site::firewall {
  firewall { '000 accept all icmp':
    proto  => 'icmp',
    action => 'accept',
  }

  firewall { '001 accept all to lo interface':
    proto   => 'all',
    iniface => 'lo',
    action  => 'accept',
  }

  firewall { '002 accept related established rules':
    proto   => 'all',
    ctstate => ['RELATED', 'ESTABLISHED'],
    action  => 'accept',
  }

  $trusted_networks = hiera_array('trusted_networks')
  $trusted_networks.each |$network| {
    firewall { "003 allow all traffic from ${network}":
      proto  => 'all',
      source => $network,
      action => 'accept',
    }
  }

  firewall { '999 drop all':
    proto  => 'all',
    action => 'drop',
  }
}

modules__site__manifests__profiles__base.pp

class site::profiles::base {
  class { '::ntp': }
  class { '::firewall': }
  class { '::site::firewall': }
  
  $packages = ['git', 'vim']
  package { $packages: ensure => latest }

}

modules__site__manifests__profiles__puppet__server.pp

class site::profiles::puppet::server {

  # Hiera
  $main_settings           = hiera('site::puppet::settings::main')
  $agent_settings          = hiera('site::puppet::settings::agent')
  $master_settings         = hiera('site::puppet::settings::master')
  $server_default_settings = hiera('site::puppet::settings::server_default')
  $puppet_package_ensure   = hiera('site::puppet::puppet_package_ensure')
  $server_package_ensure   = hiera('site::puppet::server_package_ensure')

  # Resources
  class { '::puppet':
    server                  => true,
    main_settings           => $main_settings,
    agent_settings          => $agent_settings,
    master_settings         => $master_settings,
    server_default_settings => $server_default_settings,
    puppet_package_ensure   => $server_package_ensure,
  }

  class { 'puppetdb': }
  class { 'puppetdb::master::config': }

}

site__manifests__profiles__puppet__agent.pp

class site::profiles::puppet::agent {

  # Hiera
  $main_settings         = hiera('site::puppet::settings::main')
  $agent_settings        = hiera('site::puppet::settings::agent')
  $puppet_package_ensure = hiera('site::puppet::puppet_package_ensure')

  # Resources
  class { '::puppet':
    main_settings         => $main_settings,
    agent_settings        => $agent_settings,
    puppet_package_ensure => $server_package_ensure,
  }

}

site__manifests__roles__puppet_server.pp

class site::roles::puppet_server {
  contain site::profiles::base
  contain site::profiles::puppet::server
}