Skip to content

Commit 10084cb

Browse files
smortexsmortex
authored
Merge pull request #210 from lemrouch/director-console
Add Console section to the Director configuration
2 parents ecb3431 + dbdfe95 commit 10084cb

7 files changed

Lines changed: 405 additions & 0 deletions

File tree

‎REFERENCE.md‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
### Defined types
1818

1919
* [`bacula::director::client`](#bacula--director--client): Define a Bacula Director Client
20+
* [`bacula::director::console`](#bacula--director--console): Define a Bacula Director Console
2021
* [`bacula::director::fileset`](#bacula--director--fileset): Configure a Bacula Director Fileset
2122
* [`bacula::director::job`](#bacula--director--job): Configure a Bacula Director Job
2223
* [`bacula::director::pool`](#bacula--director--pool): Configure a Bacula Director Pool
@@ -34,6 +35,7 @@
3435

3536
### Data types
3637

38+
* [`Bacula::Command`](#Bacula--Command): A Bacula console command
3739
* [`Bacula::JobType`](#Bacula--JobType): The type of job
3840
* [`Bacula::Message`](#Bacula--Message): A Bacula message specification
3941
* [`Bacula::Password`](#Bacula--Password): Temporary workarond to accept Sensitive and non-Sensitive passwords
@@ -1042,6 +1044,127 @@ The path to the bacula configuration directory
10421044

10431045
Default value: `$bacula::conf_dir`
10441046

1047+
### <a name="bacula--director--console"></a>`bacula::director::console`
1048+
1049+
This define creates a console declaration for the director.
1050+
Resources of this type are intended to manage conf.d/console.conf entries.
1051+
1052+
Aside from Director resource names and console command names,
1053+
the special keyword *all* can be specified in any of the above access control lists.
1054+
When this keyword is present, any resource or command name (which ever is appropriate) will be accepted.
1055+
1056+
#### Examples
1057+
1058+
#####
1059+
1060+
```puppet
1061+
bacula::director::console { 'Monitoring':
1062+
password => 'monitoring_password',
1063+
}
1064+
```
1065+
1066+
#### Parameters
1067+
1068+
The following parameters are available in the `bacula::director::console` defined type:
1069+
1070+
* [`conf_dir`](#-bacula--director--console--conf_dir)
1071+
* [`password`](#-bacula--director--console--password)
1072+
* [`jobacl`](#-bacula--director--console--jobacl)
1073+
* [`clientacl`](#-bacula--director--console--clientacl)
1074+
* [`storageacl`](#-bacula--director--console--storageacl)
1075+
* [`scheduleacl`](#-bacula--director--console--scheduleacl)
1076+
* [`poolacl`](#-bacula--director--console--poolacl)
1077+
* [`filesetacl`](#-bacula--director--console--filesetacl)
1078+
* [`catalogacl`](#-bacula--director--console--catalogacl)
1079+
* [`commandacl`](#-bacula--director--console--commandacl)
1080+
* [`whereacl`](#-bacula--director--console--whereacl)
1081+
1082+
##### <a name="-bacula--director--console--conf_dir"></a>`conf_dir`
1083+
1084+
Data type: `String`
1085+
1086+
The bacula configuration director. Should not need adjusting
1087+
1088+
Default value: `$bacula::conf_dir`
1089+
1090+
##### <a name="-bacula--director--console--password"></a>`password`
1091+
1092+
Data type: `String[1]`
1093+
1094+
The password that must be supplied for a named Bacula Console to be authorized
1095+
1096+
##### <a name="-bacula--director--console--jobacl"></a>`jobacl`
1097+
1098+
Data type: `Optional[String[1]]`
1099+
1100+
A list of Job resource names that can be accessed by the console.
1101+
1102+
Default value: `undef`
1103+
1104+
##### <a name="-bacula--director--console--clientacl"></a>`clientacl`
1105+
1106+
Data type: `Optional[String[1]]`
1107+
1108+
A list of Client resource names that can be accessed by the console.
1109+
1110+
Default value: `undef`
1111+
1112+
##### <a name="-bacula--director--console--storageacl"></a>`storageacl`
1113+
1114+
Data type: `Optional[String[1]]`
1115+
1116+
A list of Storage resource names that can be accessed by the console.
1117+
1118+
Default value: `undef`
1119+
1120+
##### <a name="-bacula--director--console--scheduleacl"></a>`scheduleacl`
1121+
1122+
Data type: `Optional[String[1]]`
1123+
1124+
A list of Schedule resource names that can be accessed by the console.
1125+
1126+
Default value: `undef`
1127+
1128+
##### <a name="-bacula--director--console--poolacl"></a>`poolacl`
1129+
1130+
Data type: `Optional[String[1]]`
1131+
1132+
A list of Pool resource names that can be accessed by the console.
1133+
1134+
Default value: `undef`
1135+
1136+
##### <a name="-bacula--director--console--filesetacl"></a>`filesetacl`
1137+
1138+
Data type: `Optional[String[1]]`
1139+
1140+
A list of FileSet resource names that can be accessed by the console.
1141+
1142+
Default value: `undef`
1143+
1144+
##### <a name="-bacula--director--console--catalogacl"></a>`catalogacl`
1145+
1146+
Data type: `String[1]`
1147+
1148+
A list of Catalog resource names that can be accessed by the console.
1149+
1150+
Default value: `'*all*'`
1151+
1152+
##### <a name="-bacula--director--console--commandacl"></a>`commandacl`
1153+
1154+
Data type: `Array[Bacula::Command]`
1155+
1156+
A list of of console commands that can be executed by the console.
1157+
1158+
Default value: `['list']`
1159+
1160+
##### <a name="-bacula--director--console--whereacl"></a>`whereacl`
1161+
1162+
Data type: `Optional[String[1]]`
1163+
1164+
This directive permits you to specify where a restricted console can restore files.
1165+
1166+
Default value: `undef`
1167+
10451168
### <a name="bacula--director--fileset"></a>`bacula::director::fileset`
10461169

10471170
This class handles a Director's fileset.conf entry. Filesets are intended to
@@ -2199,6 +2322,15 @@ A boolean value
21992322

22002323
## Data types
22012324

2325+
### <a name="Bacula--Command"></a>`Bacula::Command`
2326+
2327+
A Bacula console command
2328+
2329+
* **See also**
2330+
* https://www.bacula.org/15.0.x-manuals/en/console/Bacula_Enterprise_Console.html
2331+
2332+
Alias of `Enum['add', 'autodisplay', 'automount', 'cancel', 'cloud', 'create', 'delete', 'disable', 'enable', 'estimate', 'exit', 'gui', 'help', 'label', 'list', 'llist', 'messages', 'memory', 'mount', 'prune', 'purge', 'query', 'quit', 'relabel', 'release', 'reload', 'restart', 'resume', 'restore', 'run', 'setbandwidth', 'setdebug', 'setip', 'show', 'sqlquery', 'status', 'tag', 'time', 'trace', 'umount', 'unmount', 'update', 'use', 'var', 'version', 'wait', '.api', '.backups', '.clients', '.catalogs', '.defaults', '.die', '.dir', '.dump', '.exit', '.events', '.filesets', '.help', '.jobs', '.estimate', '.jlist', '.levels', '.messages', '.msgs', '.pools', '.quit', '.putfile', '.schedule', '.sql', '.status', '.storage', '.volstatus', '.media', '.mediatypes', '.locations', '.actiononpurge', '.bvfs_lsdirs', '.bvfs_lsfiles', '.bvfs_get_volumes', '.bvfs_update', '.bvfs_get_jobids', '.bvfs_get_jobs', '.bvfs_get_bootstrap', '.bvfs_get_fileindex', '.bvfs_versions', '.bvfs_get_delta', '.bvfs_restore', '.bvfs_cleanup', '.bvfs_decode_lstat', '.bvfs_clear_cache', '.bvfs_update_fv', '.bvfs_delete_fileid', '.setuid', '.ls', '.types', '.query', '.tags']`
2333+
22022334
### <a name="Bacula--JobType"></a>`Bacula::JobType`
22032335

22042336
The type of job

‎manifests/director.pp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,7 @@
157157
]
158158

159159
$sub_confs_with_secrets = [
160+
"${conf_dir}/conf.d/console.conf",
160161
"${conf_dir}/conf.d/client.conf",
161162
"${conf_dir}/conf.d/storage.conf",
162163
]

‎manifests/director/console.pp‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# @summary Define a Bacula Director Console
2+
#
3+
# This define creates a console declaration for the director.
4+
# Resources of this type are intended to manage conf.d/console.conf entries.
5+
#
6+
# @param conf_dir The bacula configuration director. Should not need adjusting
7+
# @param password The password that must be supplied for a named Bacula Console to be authorized
8+
# @param jobacl A list of Job resource names that can be accessed by the console.
9+
# @param clientacl A list of Client resource names that can be accessed by the console.
10+
# @param storageacl A list of Storage resource names that can be accessed by the console.
11+
# @param scheduleacl A list of Schedule resource names that can be accessed by the console.
12+
# @param poolacl A list of Pool resource names that can be accessed by the console.
13+
# @param filesetacl A list of FileSet resource names that can be accessed by the console.
14+
# @param catalogacl A list of Catalog resource names that can be accessed by the console.
15+
# @param commandacl A list of of console commands that can be executed by the console.
16+
# @param whereacl This directive permits you to specify where a restricted console can restore files.
17+
#
18+
# Aside from Director resource names and console command names,
19+
# the special keyword *all* can be specified in any of the above access control lists.
20+
# When this keyword is present, any resource or command name (which ever is appropriate) will be accepted.
21+
#
22+
# @example
23+
# bacula::director::console { 'Monitoring':
24+
# password => 'monitoring_password',
25+
# }
26+
#
27+
define bacula::director::console (
28+
String[1] $password,
29+
String $conf_dir = $bacula::conf_dir,
30+
String[1] $catalogacl = '*all*',
31+
Array[Bacula::Command] $commandacl = ['list'],
32+
Optional[String[1]] $jobacl = undef,
33+
Optional[String[1]] $clientacl = undef,
34+
Optional[String[1]] $storageacl = undef,
35+
Optional[String[1]] $scheduleacl = undef,
36+
Optional[String[1]] $poolacl = undef,
37+
Optional[String[1]] $filesetacl = undef,
38+
Optional[String[1]] $whereacl = undef,
39+
) {
40+
$epp_console_variables = {
41+
name => $name,
42+
password => $password,
43+
commandacl => $commandacl,
44+
whereacl => $whereacl,
45+
jobacl => $jobacl,
46+
clientacl => $clientacl,
47+
storageacl => $storageacl,
48+
scheduleacl => $scheduleacl,
49+
poolacl => $poolacl,
50+
filesetacl => $filesetacl,
51+
catalogacl => $catalogacl,
52+
}
53+
54+
concat::fragment { "bacula-director-console-${name}":
55+
target => "${conf_dir}/conf.d/console.conf",
56+
content => epp('bacula/bacula-dir-console.epp', $epp_console_variables),
57+
}
58+
}

‎spec/defines/director_console_spec.rb‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# frozen_string_literal: true
2+
3+
require 'spec_helper'
4+
5+
describe 'bacula::director::console' do
6+
on_supported_os.each do |os, facts|
7+
context "on #{os}" do
8+
let(:facts) { facts }
9+
10+
let(:pre_condition) { 'include bacula' }
11+
12+
context 'with default parameters' do
13+
let(:title) { 'Monitoring' }
14+
15+
let(:params) do
16+
{
17+
password: 'monitoring_password',
18+
}
19+
end
20+
21+
it { is_expected.to contain_concat__fragment('bacula-director-console-Monitoring').with(content: <<~FRAGMENT) }
22+
Console {
23+
Name = Monitoring
24+
Password = "monitoring_password"
25+
CatalogACL = *all*
26+
CommandACL = list
27+
}
28+
FRAGMENT
29+
end
30+
31+
context 'with all parameters set' do
32+
let(:title) { 'restricted-user' }
33+
34+
let(:params) do
35+
{
36+
password: 'A different UntrustedUser',
37+
jobacl: 'Restricted Client Save',
38+
clientacl: 'restricted-client',
39+
storageacl: 'second-storage',
40+
scheduleacl: 'weekly-schedule',
41+
poolacl: 'backup-pool',
42+
filesetacl: "Restricted Client's FileSet",
43+
catalogacl: 'RestrictedCatalog',
44+
commandacl: %w[run restore],
45+
whereacl: '/',
46+
}
47+
end
48+
49+
it { is_expected.to contain_concat__fragment('bacula-director-console-restricted-user').with(content: <<~FRAGMENT) }
50+
Console {
51+
Name = restricted-user
52+
Password = "A different UntrustedUser"
53+
JobACL = Restricted Client Save
54+
ClientACL = restricted-client
55+
StorageACL = second-storage
56+
ScheduleACL = weekly-schedule
57+
PoolACL = backup-pool
58+
FileSetACL = Restricted Client's FileSet
59+
CatalogACL = RestrictedCatalog
60+
CommandACL = run, restore
61+
WhereACL = /
62+
}
63+
FRAGMENT
64+
end
65+
end
66+
end
67+
end

‎templates/bacula-dir-console.epp‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<%
2+
|
3+
String $name,
4+
String $password,
5+
String $catalogacl,
6+
Array $commandacl,
7+
Optional[String] $jobacl,
8+
Optional[String] $clientacl,
9+
Optional[String] $storageacl,
10+
Optional[String] $scheduleacl,
11+
Optional[String] $poolacl,
12+
Optional[String] $filesetacl,
13+
Optional[String] $whereacl,
14+
|
15+
-%>
16+
Console {
17+
Name = <%= $name %>
18+
Password = "<%= $password %>"
19+
<% if $jobacl { -%>
20+
JobACL = <%= $jobacl %>
21+
<% } -%>
22+
<% if $clientacl { -%>
23+
ClientACL = <%= $clientacl %>
24+
<% } -%>
25+
<% if $storageacl { -%>
26+
StorageACL = <%= $storageacl %>
27+
<% } -%>
28+
<% if $scheduleacl { -%>
29+
ScheduleACL = <%= $scheduleacl %>
30+
<% } -%>
31+
<% if $poolacl { -%>
32+
PoolACL = <%= $poolacl %>
33+
<% } -%>
34+
<% if $filesetacl { -%>
35+
FileSetACL = <%= $filesetacl %>
36+
<% } -%>
37+
CatalogACL = <%= $catalogacl %>
38+
CommandACL = <%= $commandacl.join(', ') %>
39+
<% if $whereacl { -%>
40+
WhereACL = <%= $whereacl %>
41+
<% } -%>
42+
}

‎templates/bacula-dir-tail.epp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,4 @@
55
@<%= $bacula::conf_dir %>/conf.d/fileset.conf
66
@<%= $bacula::conf_dir %>/conf.d/jobdefs.conf
77
@<%= $bacula::conf_dir %>/conf.d/job.conf
8+
@<%= $bacula::conf_dir %>/conf.d/console.conf

0 commit comments

Comments
 (0)