doas puppet module

Table of Contents

1. Description
2. Setup - The basics of getting started with doas
3. Usage - Configuration options and additional functionality
4. Development - Guide for contributing to the module

Description

This puppet module is intended to configure doas (the equivalent of sudo) on an OpenBSD system.

Setup

Include the module, with:

include doas

Usage

To allow icinga to execute 'syspatch -c' (this shows if syspatches to update are available), you add to your hiera hieranrchy:

doas::entries:
  icinga2_syspatch:
    identity: '_icinga'
    as_target: 'root'
    command: '/usr/sbin/syspatch'
    args:
      - '-c'
    options:
      - 'nopass'

Reference

See REFERENCE.md

Contributing

Please report bugs and feature request using GitHub issue tracker.

For pull requests, it is very much appreciated to check your Puppet manifest with puppet-lint and the available spec tests in order to follow the recommended Puppet style guidelines from the Puppet Labs style guide.

Authors

This module is mainly written by Cirrax GmbH.

See the list of contributors for a list of all contributors.

Reference

Table of Contents

Classes

• doas: configure doas

Defined types

• doas::entry: Create an entry in the doas configfile

Classes

doas

define doas config on OpenBSD

Examples

include doas

Parameters

The following parameters are available in the doas class:

• configfile
• entries
• owner
• group
• mode

configfile

Data type: String

the configuration file to put the entries in

Default value: '/etc/doas.conf'

entries

Data type: Hash

entries to append to the doas.conf file this parameter has lookup_options set to hash !!

Default value: {}

owner

Data type: String

owner of $configfile

Default value: 'root'

group

Data type: String

group of $configfile

Default value: 'wheel'

mode

Data type: String

mode of $configfile

Default value: '0555'

Defined types

doas::entry

Create an entry in the doas configfile

Parameters

The following parameters are available in the doas::entry defined type:

• order
• action
• options
• identity
• as_target
• command
• target
• setenvs
• args

order

Data type: String

order to append

Default value: $title

action

Data type: Enum['permit','deny']

The action to be taken if this rule matches

Default value: 'permit'

options

Data type: Array

Array of options

Default value: []

identity

Data type: String

The username to match.

as_target

Data type: String

The target user the running user is allowed to run the command as.

command

Data type: String

the command to run

target

Data type: String

target to append the configuration

setenvs

Data type: Array

environment vars to set

Default value: []

args

Data type: Array

needed arguments Hint: to allow command only without arguments, set to ['']! the default allows any arguments

Default value: []

Changelog

All notable changes to this project will be documented in this file. See git changelog for minor changes and improvements

Release 1.0.0

Warning the behaviour of the default for args have changed !