Puppet Class: bacula

Defined in:
manifests/init.pp

Overview

Class: bacula

This is the main class to manage all the components of a Bacula infrastructure. This is the only class that needs to be declared.

Parameters:

backup_catalog

Perform a nightly backup of the catalog database from the director server. You may wish to set this to false if you are maintaining your own database backups.

clients

For directors, $clients is a hash of clients. The keys are the clients while the value is a hash of parameters. The parameters accepted are the same as the bacula::client::config define.

console_password

The console’s password

console_template

The ERB template to use for configuring the bconsole instead of the one included with the module

db_backend

The database backend to use

db_database

The db database to connect to on $db_host

db_host

The db server host to connect to

db_password

The password to authenticate $db_user with

db_port

The port to connect to the database server on

db_user

The user to authenticate to $db_db with.

db_user_host

The host string used by MySQL to allow connections from

director_password

The director’s password

director_server

The FQDN of the bacula director

director_template

The ERB template to use for configuring the director instead of the one included with the module

is_client

Whether the node should be a client

is_director

Whether the node should be a director

is_storage

Whether the node should be a storage server

logwatch_enabled

If manage_logwatch is true should the Bacula logwatch configuration be enabled or disabled

mail_to

Send the message to this email address for all jobs. Will default to root@${::fqdn} if it and mail_to_on_error are left undefined.

mail_to_daemon

Send daemon messages to this email address. Will default to either $mail_to_real or $mail_to_on_error in that order if left undefined.

mail_to_on_error

Send the message to this email address if the Job terminates with an error condition.

mail_to_operator

Send the message to this email address. Will default to either $mail_to_real or $mail_to_on_error in that order if left undefined.

manage_bat

Whether the bat should be managed on the node

manage_config_dir

Whether to purge all non-managed files from the bacula config directory

manage_console

Whether the bconsole should be managed on the node

manage_db

Whether to manage the existence of the database. If true, the $db_user must have privileges to create databases on $db_host

manage_db_tables

Whether to create the DB tables during install

manage_logwatch

Whether to configure logwatch on the director

plugin_dir

The directory Bacula plugins are stored in. Use this parameter if you are providing Bacula plugins for use. Only use if the package in the distro repositories supports plugins or you have included a respository with a newer Bacula packaged for your distro. If this is anything other than ‘undef` and you are not providing any plugins in this directory Bacula will throw an error every time it starts even if the package supports plugins.

storage_default_mount

Directory where the default disk for file backups is mounted. A subdirectory named default will be created allowing you to define additional devices in Bacula which use the same disk. Defaults to '/mnt/bacula'.

storage_server

The FQDN of the storage server

storage_template

The ERB template to use for configuring the storage daemon instead of the one included with the module

tls_allowed_cn

Array of common name attribute of allowed peer certificates. If this directive is specified, all server certificates will be verified against this list. This can be used to ensure that only the CA-approved Director may connect.

tls_ca_cert

The full path and filename specifying a PEM encoded TLS CA certificate(s). Multiple certificates are permitted in the file. One of TLS CA Certificate File or TLS CA Certificate Dir are required in a server context if TLS Verify Peer is also specified, and are always required in a client context.

tls_ca_cert_dir

Full path to TLS CA certificate directory. In the current implementation, certificates must be stored PEM encoded with OpenSSL-compatible hashes, which is the subject name’s hash and an extension of .0. One of TLS CA Certificate File or TLS CA Certificate Dir are required in a server context if TLS Verify Peer is also specified, and are always required in a client context.

tls_cert

The full path and filename of a PEM encoded TLS certificate. It can be used as either a client or server certificate. PEM stands for Privacy Enhanced Mail, but in this context refers to how the certificates are encoded. It is used because PEM files are base64 encoded and hence ASCII text based rather than binary. They may also contain encrypted information.

tls_key

The full path and filename of a PEM encoded TLS private key. It must correspond to the TLS certificate.

tls_require

Require TLS connections. This directive is ignored unless TLS Enable is set to yes. If TLS is not required, and TLS is enabled, then Bacula will connect with other daemons either with or without TLS depending on what the other daemon requests. If TLS is enabled and TLS is required, then Bacula will refuse any connection that does not use TLS. Valid values are 'yes' or 'no'.

tls_verify_peer

Verify peer certificate. Instructs server to request and verify the client’s x509 certificate. Any client certificate signed by a known-CA will be accepted unless the TLS Allowed CN configuration directive is used, in which case the client certificate must correspond to the Allowed Common Name specified. Valid values are 'yes' or 'no'.

use_console

Whether to configure a console resource on the director

use_tls

Whether to use Bacula TLS - Communications Encryption.

volume_retention

Length of time to retain volumes in the default pool.

volume_retention_diff

Length of time to retain volumes in the default differential pool.

volume_retention_full

Length of time to retain volumes in the default full pool.

volume_retention_incr

Length of time to retain volumes in the default incremental pool.

Sample Usage

$clients = {
  'node1.example.com' => {
    'fileset'         => 'Basic:noHome',
    'client_schedule' => 'Hourly',
  },
  'node2.example.com' => {
    'fileset'         => 'Basic:noHome',
    'client_schedule' => 'Hourly',
  }
}

class { '::bacula':
  is_storage        => true,
  is_director       => true,
  is_client         => true,
  manage_console    => true,
  director_password => 'xxxxxxxxx',
  console_password  => 'xxxxxxxxx',
  director_server   => 'bacula.domain.com',
  mail_to           => 'bacula-admin@domain.com',
  storage_server    => 'bacula.domain.com',
  clients           => $clients,
}

Copyright 2012 Russell Harrison

License

Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Parameters:

  • backup_catalog (Any) (defaults to: true)
  • clients (Any) (defaults to: undef)
  • console_password (Any) (defaults to: '')
  • console_template (Any) (defaults to: undef)
  • db_backend (Any) (defaults to: 'sqlite')
  • db_database (Any) (defaults to: 'bacula')
  • db_host (Any) (defaults to: 'localhost')
  • db_password (Any) (defaults to: '')
  • db_port (Any) (defaults to: '3306')
  • db_user (Any) (defaults to: '')
  • db_user_host (Any) (defaults to: undef)
  • director_password (Any) (defaults to: '')
  • director_server (Any) (defaults to: undef)
  • director_template (Any) (defaults to: undef)
  • is_client (Any) (defaults to: true)
  • is_director (Any) (defaults to: false)
  • is_storage (Any) (defaults to: false)
  • logwatch_enabled (Any) (defaults to: true)
  • mail_to (Any) (defaults to: undef)
  • mail_to_daemon (Any) (defaults to: undef)
  • mail_to_on_error (Any) (defaults to: undef)
  • mail_to_operator (Any) (defaults to: undef)
  • manage_bat (Any) (defaults to: false)
  • manage_config_dir (Any) (defaults to: false)
  • manage_console (Any) (defaults to: false)
  • manage_db (Any) (defaults to: false)
  • manage_db_tables (Any) (defaults to: true)
  • manage_logwatch (Any) (defaults to: undef)
  • plugin_dir (Any) (defaults to: undef)
  • storage_default_mount (Any) (defaults to: '/mnt/bacula')
  • storage_server (Any) (defaults to: undef)
  • storage_template (Any) (defaults to: undef)
  • tls_allowed_cn (Any) (defaults to: [])
  • tls_ca_cert (Any) (defaults to: undef)
  • tls_ca_cert_dir (Any) (defaults to: undef)
  • tls_cert (Any) (defaults to: undef)
  • tls_key (Any) (defaults to: undef)
  • tls_require (Any) (defaults to: 'yes')
  • tls_verify_peer (Any) (defaults to: 'yes')
  • use_console (Any) (defaults to: false)
  • use_tls (Any) (defaults to: false)
  • volume_retention (Any) (defaults to: '1 Year')
  • volume_retention_diff (Any) (defaults to: '40 Days')
  • volume_retention_full (Any) (defaults to: '1 Year')
  • volume_retention_incr (Any) (defaults to: '10 Days') 


174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
 
# File 'manifests/init.pp', line 174

class bacula (
  $backup_catalog        = true,
  $clients               = undef,
  $console_password      = '',
  $console_template      = undef,
  $db_backend            = 'sqlite',
  $db_database           = 'bacula',
  $db_host               = 'localhost',
  $db_password           = '',
  $db_port               = '3306',
  $db_user               = '',
  $db_user_host          = undef,
  $director_password     = '',
  $director_server       = undef,
  $director_template     = undef,
  $is_client             = true,
  $is_director           = false,
  $is_storage            = false,
  $logwatch_enabled      = true,
  $mail_to               = undef,
  $mail_to_daemon        = undef,
  $mail_to_on_error      = undef,
  $mail_to_operator      = undef,
  $manage_bat            = false,
  $manage_config_dir     = false,
  $manage_console        = false,
  $manage_db             = false,
  $manage_db_tables      = true,
  $manage_logwatch       = undef,
  $plugin_dir            = undef,
  $storage_default_mount = '/mnt/bacula',
  $storage_server        = undef,
  $storage_template      = undef,
  $tls_allowed_cn        = [],
  $tls_ca_cert           = undef,
  $tls_ca_cert_dir       = undef,
  $tls_cert              = undef,
  $tls_key               = undef,
  $tls_require           = 'yes',
  $tls_verify_peer       = 'yes',
  $use_console           = false,
  $use_tls               = false,
  $volume_retention      = '1 Year',
  $volume_retention_diff = '40 Days',
  $volume_retention_full = '1 Year',
  $volume_retention_incr = '10 Days'
) {
  include ::bacula::params

  $director_server_real = $director_server ? {
    undef   => $::bacula::params::director_server_default,
    default => $director_server,
  }
  $storage_server_real  = $storage_server ? {
    undef   => $::bacula::params::storage_server_default,
    default => $storage_server,
  }

  $manage_logwatch_real = $manage_logwatch ? {
    undef   => $::bacula::params::manage_logwatch,
    default => $manage_logwatch,
  }

  # Validate our parameters
  # It's ugly to do it in the parent class
  class { '::bacula::params::validate':
    backup_catalog        => $backup_catalog,
    console_password      => $console_password,
    db_backend            => $db_backend,
    db_database           => $db_database,
    db_host               => $db_host,
    db_password           => $db_password,
    db_port               => $db_port,
    db_user               => $db_user,
    director_password     => $director_password,
    director_server       => $director_server_real,
    is_client             => $is_client,
    is_director           => $is_director,
    is_storage            => $is_storage,
    logwatch_enabled      => $logwatch_enabled,
    mail_to               => $mail_to,
    mail_to_daemon        => $mail_to_daemon,
    mail_to_on_error      => $mail_to_on_error,
    mail_to_operator      => $mail_to_operator,
    manage_bat            => $manage_bat,
    manage_config_dir     => $manage_config_dir,
    manage_console        => $manage_console,
    manage_db             => $manage_db,
    manage_db_tables      => $manage_db_tables,
    manage_logwatch       => $manage_logwatch_real,
    plugin_dir            => $plugin_dir,
    storage_default_mount => $storage_default_mount,
    storage_server        => $storage_server_real,
    tls_allowed_cn        => $tls_allowed_cn,
    tls_ca_cert           => $tls_ca_cert,
    tls_ca_cert_dir       => $tls_ca_cert_dir,
    tls_cert              => $tls_cert,
    tls_key               => $tls_key,
    tls_require           => $tls_require,
    tls_verify_peer       => $tls_verify_peer,
    use_console           => $use_console,
    use_tls               => $use_tls,
  }

  class { '::bacula::common':
    db_backend        => $db_backend,
    db_database       => $db_database,
    db_host           => $db_host,
    db_password       => $db_password,
    db_port           => $db_port,
    db_user           => $db_user,
    is_client         => $is_client,
    is_director       => $is_director,
    is_storage        => $is_storage,
    manage_bat        => $manage_bat,
    manage_config_dir => $manage_config_dir,
    manage_console    => $manage_console,
    manage_db_tables  => $manage_db_tables,
    plugin_dir        => $plugin_dir,
  }

  if $is_director {
    class { '::bacula::director':
      backup_catalog        => $backup_catalog,
      clients               => $clients,
      console_password      => $console_password,
      db_backend            => $db_backend,
      db_database           => $db_database,
      db_host               => $db_host,
      db_password           => $db_password,
      db_port               => $db_port,
      db_user               => $db_user,
      db_user_host          => $db_user_host,
      dir_template          => $director_template,
      director_password     => $director_password,
      director_server       => $director_server_real,
      mail_to               => $mail_to,
      mail_to_daemon        => $mail_to_daemon,
      mail_to_on_error      => $mail_to_on_error,
      mail_to_operator      => $mail_to_operator,
      manage_config_dir     => $manage_config_dir,
      manage_db             => $manage_db,
      manage_db_tables      => $manage_db_tables,
      manage_logwatch       => $manage_logwatch_real,
      plugin_dir            => $plugin_dir,
      storage_server        => $storage_server_real,
      tls_allowed_cn        => $tls_allowed_cn,
      tls_ca_cert           => $tls_ca_cert,
      tls_ca_cert_dir       => $tls_ca_cert_dir,
      tls_cert              => $tls_cert,
      tls_key               => $tls_key,
      tls_require           => $tls_require,
      tls_verify_peer       => $tls_verify_peer,
      use_console           => $use_console,
      use_tls               => $use_tls,
      volume_retention      => $volume_retention,
      volume_retention_diff => $volume_retention_diff,
      volume_retention_full => $volume_retention_full,
      volume_retention_incr => $volume_retention,
    }

    if $manage_logwatch_real {
      class { '::bacula::director::logwatch':
        logwatch_enabled => $logwatch_enabled,
      }
    }
  }

  if $is_storage {
    class { '::bacula::storage':
      console_password      => $console_password,
      db_backend            => $db_backend,
      director_password     => $director_password,
      director_server       => $director_server_real,
      plugin_dir            => $plugin_dir,
      storage_default_mount => $storage_default_mount,
      storage_server        => $storage_server_real,
      storage_template      => $storage_template,
      tls_allowed_cn        => $tls_allowed_cn,
      tls_ca_cert           => $tls_ca_cert,
      tls_ca_cert_dir       => $tls_ca_cert_dir,
      tls_cert              => $tls_cert,
      tls_key               => $tls_key,
      tls_require           => $tls_require,
      tls_verify_peer       => $tls_verify_peer,
      use_tls               => $use_tls,
    }
  }

  if $is_client {
    class { '::bacula::client':
      director_server   => $director_server_real,
      director_password => $director_password,
      plugin_dir        => $plugin_dir,
      tls_allowed_cn    => $tls_allowed_cn,
      tls_ca_cert       => $tls_ca_cert,
      tls_ca_cert_dir   => $tls_ca_cert_dir,
      tls_cert          => $tls_cert,
      tls_key           => $tls_key,
      tls_require       => $tls_require,
      tls_verify_peer   => $tls_verify_peer,
      use_tls           => $use_tls,
    }
  }

  if $manage_console {
    class { '::bacula::console':
      console_template  => $console_template,
      director_password => $director_password,
      director_server   => $director_server_real,
      tls_ca_cert       => $tls_ca_cert,
      tls_ca_cert_dir   => $tls_ca_cert_dir,
      tls_cert          => $tls_cert,
      tls_key           => $tls_key,
      tls_require       => $tls_require,
      tls_verify_peer   => $tls_verify_peer,
      use_tls           => $use_tls,
    }
  }

  if $manage_bat {
    class { '::bacula::console::bat':
    }
  }
}