Harden installations with class bastion.ct-ops-2017-07-29-v09

1 files changed, 12 insertions, 0 deletions

diff --git a/global/overlay/etc/puppet/manifests/cosmos-site.pp b/global/overlay/etc/puppet/manifests/cosmos-site.pp
index 3020216..105c9a2 100644
--- a/global/overlay/etc/puppet/manifests/cosmos-site.pp
+++ b/global/overlay/etc/puppet/manifests/cosmos-site.pp
@@ -16,6 +16,18 @@ class nunoc {
 }
 
 node default {
+  if $::hostname =~ /ct.nordu.net/ { # kvm hosts need relaxed net?
+    class {'bastion':
+      fstab_fix_shm        => false,
+      sysctl_net_hardening => false,
+    }
+  } else {
+    class {'bastion':
+      fstab_fix_shm     => false,
+      fixperms_paranoia => true,
+    }
+  }
+
 }
 
 class dockerhost {