def.cf

###############################################################################
#
# bundle common def
#  - common/global variables and classes here
#
###############################################################################

bundle common def

{

  vars:

    any::

      # Begin change # Your domain name, for use in access control

      "domain"  string => "example.com",
      comment => "Define a global domain for all hosts",
      handle => "common_def_vars_domain";

      # List here the IP masks that we grant access to on the server

      "acl"     slist => {

                           # Assume /16 LAN clients to start with
                           "$(sys.policy_hub)/16",

                           #  "2001:700:700:3.*",
                           #  "217.77.34.18",
                           #  "217.77.34.19",
      },
      comment => "Define an acl for the machines to be granted accesses",
      handle => "common_def_vars_acl";

      # End change #

  cfengine_3_4|cfengine_3_5::
      "dir_masterfiles" string => translatepath("$(sys.workdir)/masterfiles"),
      comment => "Define masterfiles path",
      handle => "common_def_vars_dir_masterfiles_backport";

  !cfengine_3_4.!cfengine_3_5::
      "dir_masterfiles" string => translatepath("$(sys.masterdir)"),
      comment => "Define masterfiles path",
      handle => "common_def_vars_dir_masterfiles";

      "dir_reports"     string => translatepath("$(sys.workdir)/reports"),
      comment => "Define reports path",
      handle => "common_def_vars_dir_reports";

      "dir_software"    string => translatepath("$(sys.workdir)/master_software_updates"),
      comment => "Define software path",
      handle => "common_def_vars_dir_software";

      "dir_bin"         string => translatepath("$(sys.bindir)"),
      comment => "Define binary path",
      handle => "common_def_vars_dir_bin";

      "dir_modules"     string => translatepath("$(sys.workdir)/modules"),
      comment => "Define modules path",
      handle => "common_def_vars_dir_modules";

      "dir_plugins"     string => translatepath("$(sys.workdir)/plugins"),
      comment => "Define plugins path",
      handle => "common_def_vars_dir_plugins";

    cfengine_3_4|cfengine_3_5::
      "cf_apache_user" string => "apache",
      comment => "User that CFEngine Enterprise webserver runs as",
      handle => "common_def_vars_cf_apache_user";

      "cf_apache_group" string => "apache",
      comment => "Group that CFEngine Enterprise webserver runs as",
      handle => "common_def_vars_cf_apache_group";

    !cfengine_3_4.!cfengine_3_5::
      "cf_apache_user" string => "cfapache",
      comment => "User that CFEngine Enterprise webserver runs as",
      handle => "common_def_vars_cf_cfapache_user";

      "cf_apache_group" string => "cfapache",
      comment => "Group that CFEngine Enterprise webserver runs as",
      handle => "common_def_vars_cf_cfapache_group";

      solaris::
      "cf_runagent_shell"
        string  => "/usr/bin/sh",
        comment => "Define path to shell used by cf-runagent",
        handle  => "common_def_vars_solaris_cf_runagent_shell";

      !(windows|solaris)::
      "cf_runagent_shell"
        string  => "/bin/sh",
        comment => "Define path to shell used by cf-runagent",
        handle  => "common_def_vars_cf_runagent_shell";

    enterprise::
      "cfe_enterprise_generic_log_files"    slist => {
                                               "$(sys.workdir)/cf_notkept.log",
                                               "$(sys.workdir)/cf_repair.log",
                                               "$(sys.workdir)/state/cf_value.log",
      	};
      
    enterprise.am_policy_hub::
      "cfe_enterprise_hub_log_files" slist => {						
						"$(sys.workdir)/outputs/dc-scripts.log",
						"$(sys.workdir)/httpd/logs/access_log", # Mission Portal
						"$(sys.workdir)/httpd/logs/error_log", # Mission Portal
	};

    enterprise.!am_policy_hub::
      "cfe_enterprise_hub_log_files" slist => { };

    !enterprise::
      "cfe_enterprise_generic_log_files" slist => { };
      "cfe_enterprise_hub_log_files"     slist => { };

    any::
      # CFEngine's own log files
      "cfe_log_files"    slist => {
				    "$(sys.workdir)/cf3.$(sys.host).runlog",
				    "$(sys.workdir)/promise_summary.log",
				    @(cfe_enterprise_generic_log_files),
				    @(cfe_enterprise_hub_log_files),
				  };

      "cfe_log_dirs"     slist => {
                                    "$(sys.workdir)/outputs",
                                    "$(sys.workdir)/reports",
                                  };

  classes:

    ### Enable special features policies. Set to "any" to enable.

    # Internal CFEngine log files rotation
    "cfengine_internal_rotate_logs" expression => "any";

    # Transfer policies and binaries with encryption
    "cfengine_internal_encrypt_transfers" expression => "!any";

    # Purge policies that don't exist on the server side.
    "cfengine_internal_purge_policies" expression => "!any";
}

bundle common inventory_control
# @brief Inventory control bundle
#
# This common bundle is for controlling whether some inventory bundles
# are disabled.
{
  vars:
      "dmidecoder" string => "/usr/sbin/dmidecode";
      "lldpctl_exec" string => "/usr/bin/lldpctl";
      "lsb_exec" string => "/usr/bin/lsb_release";
      "mtab" string => "/etc/mtab";
      "proc" string => "/proc";

  classes:
      # setting this disables all the inventory modules except package_refresh
      "disable_inventory" expression => "!any";

      # disable specific inventory modules below

      # by default disable the LSB inventory if the general inventory
      # is disabled or the binary is missing.  Note that the LSB
      # binary is typically not very fast.
      "disable_inventory_lsb" expression => "disable_inventory";
      "disable_inventory_lsb" not => fileexists($(lsb_exec));

      # by default disable the dmidecode inventory if the general
      # inventory is disabled or the binary does not exist.  Note that
      # typically this is a very fast binary.
      "disable_inventory_dmidecode" expression => "disable_inventory";
      "disable_inventory_dmidecode" not => fileexists($(dmidecoder));

      # by default disable the LLDP inventory if the general inventory
      # is disabled or the binary does not exist.  Note that typically
      # this is a reasonably fast binary but still may require network
      # I/O.
      "disable_inventory_LLDP" expression => "disable_inventory";
      "disable_inventory_LLDP" not => fileexists($(lldpctl_exec));

      # by default run the package inventory refresh every time, even
      # if disable_inventory is set
      "disable_inventory_package_refresh" expression => "!any";

      # by default disable the mtab inventory if the general inventory
      # is disabled or $(mtab) is missing.  Note that this is very
      # fast.
      "disable_inventory_mtab" expression => "disable_inventory";
      "disable_inventory_mtab" not => fileexists($(mtab));

      # by default disable the fstab inventory if the general
      # inventory is disabled or $(sys.fstab) is missing.  Note that
      # this is very fast.
      "disable_inventory_fstab" expression => "disable_inventory";
      "disable_inventory_fstab" not => fileexists($(sys.fstab));

      # by default disable the proc inventory if the general
      # inventory is disabled or /proc is missing.  Note that
      # this is typically fast.
      "disable_inventory_proc" expression => "disable_inventory";
      "disable_inventory_proc" not => isdir($(proc));

      # by default don't run the CMDB integration every time, even if
      # disable_inventory is not set
      "disable_inventory_cmdb" expression => "any";

  reports:
    verbose_mode.disable_inventory::
      "$(this.bundle): All inventory modules disabled";
    verbose_mode.!disable_inventory_lsb::
      "$(this.bundle): LSB module enabled";
    verbose_mode.!disable_inventory_dmidecode::
      "$(this.bundle): dmidecode module enabled";
    verbose_mode.!disable_inventory_LLDP::
      "$(this.bundle): LLDP module enabled";
    verbose_mode.!disable_inventory_mtab::
      "$(this.bundle): mtab module enabled";
    verbose_mode.!disable_inventory_fstab::
      "$(this.bundle): fstab module enabled";
    verbose_mode.!disable_inventory_proc::
      "$(this.bundle): proc module enabled";
    verbose_mode.!disable_inventory_package_refresh::
      "$(this.bundle): package_refresh module enabled";
    verbose_mode.!disable_inventory_cmdb::
      "$(this.bundle): CMDB module enabled";
}