promises.cf

###############################################################################
#
#   promises.cf - Basic Policy for CFEngine
#
###############################################################################

body common control

{

      bundlesequence => {
                        # Common bundle first (Best Practice)
                          inventory_control,
                          @(inventory.bundles),
                          ha_def,
                          def,
                          cfe_internal_hub_vars,

                          # Design Center
                          cfsketch_run,

                          # autorun system
                          services_autorun,
                          @(services_autorun.bundles),

                         # Agent bundle
                          cfe_internal_management,   # See cfe_internal/CFE_cfengine.cf
                          service_catalogue,
                          ha_main,

      };

      inputs => {
                 # File definition for global variables and classes
                  "cfe_internal/ha/ha_def.cf",
                  "def.cf",

                # Inventory policy
                  @(inventory.inputs),

                 # Design Center
                  "sketches/meta/api-runfile.cf",
                  @(cfsketch_g.inputs),

                 # CFEngine internal processes for Mission Portal mostly
                  "cfe_internal/CFE_cfengine.cf",
                  "cfe_internal/CFE_hub_specific.cf",
                  "cfe_internal/CFE_knowledge.cf",

                 # Control body for all CFEngine robot agents
                  @(cfengine_controls.inputs),

                 # COPBL/Custom libraries.  Eventually this should use wildcards.
                  @(cfengine_stdlib.inputs),

                 # Reports
                  @(cfengine_reports.inputs),

                  # autorun system
                  @(services_autorun.inputs),

                  # Add update files to build Knowledge Map relationship
                  "update/update_bins.cf",
                  "update/cfe_internal_dc_workflow.cf",
                  "update/cfe_internal_local_git_remote.cf",
                  "update/cfe_internal_update_from_repository.cf",
                  "update/update_policy.cf",
                  "update/update_processes.cf",

                # List of services here
                  "services/file_change.cf",
                  "cfe_internal/ha/ha.cf"

      };

      version => "CFEngine Promises.cf 3.7.0";

      # Uncomment to connect to the hub using latest protocol.
      #protocol_version => "latest";

      #   goal_categories => { "goals", "targets", "milestones" };
      #   goal_patterns   => { "goal_.*", "target.*","milestone.*" };
}

      #

bundle common inventory
# @brief Set up inventory inputs
#
# This bundle creates the inputs for inventory bundles.
#
# Inventory bundles are simply common bundles loaded before anything
# else in promises.cf
#
# Tested to work properly against 3.5.x
{
  classes:
      "other_unix_os" expression => "!windows.!macos.!linux";
      "specific_linux_os" expression => "redhat|debian|suse";

  vars:
      # This list is intended to grow as needed
    !cfengine_3_5.debian::
      "inputs" slist => { "inventory/any.cf", "inventory/linux.cf", "inventory/lsb.cf", "inventory/debian.cf", "inventory/os.cf" };
      "bundles" slist => { "inventory_control", "inventory_any", "inventory_autorun", "inventory_linux", "inventory_lsb", "inventory_debian", "inventory_os" };
    !cfengine_3_5.redhat::
      "inputs" slist => { "inventory/any.cf", "inventory/linux.cf", "inventory/lsb.cf", "inventory/redhat.cf", "inventory/os.cf" };
      "bundles" slist => { "inventory_control", "inventory_any", "inventory_autorun", "inventory_linux", "inventory_lsb", "inventory_redhat", "inventory_os" };
    !cfengine_3_5.suse::
      "inputs" slist => { "inventory/any.cf", "inventory/linux.cf", "inventory/lsb.cf", "inventory/suse.cf", "inventory/os.cf" };
      "bundles" slist => { "inventory_control", "inventory_any", "inventory_autorun", "inventory_linux", "inventory_lsb", "inventory_suse", "inventory_os" };
    !cfengine_3_5.windows::
      "inputs" slist => { "inventory/any.cf", "inventory/windows.cf", "inventory/os.cf" };
      "bundles" slist => { "inventory_control", "inventory_any", "inventory_autorun", "inventory_windows", "inventory_os" };
    !cfengine_3_5.macos::
      "inputs" slist => { "inventory/any.cf", "inventory/macos.cf", "inventory/os.cf" };
      "bundles" slist => { "inventory_control", "inventory_any", "inventory_autorun", "inventory_macos", "inventory_os" };
    !cfengine_3_5.linux.!specific_linux_os::
      "inputs" slist => { "inventory/any.cf", "inventory/linux.cf", "inventory/lsb.cf", "inventory/os.cf"};
      "bundles" slist => { "inventory_control", "inventory_any", "inventory_autorun", "inventory_linux", "inventory_lsb", "inventory_os" };
    !cfengine_3_5.other_unix_os::
      "inputs" slist => { "inventory/any.cf", "inventory/generic.cf", "inventory/os.cf" };
      "bundles" slist => { "inventory_control", "inventory_any", "inventory_autorun", "inventory_generic", "inventory_os" };

    cfengine_3_5::
      "inputs" slist => { };
      "bundles" slist => { };

  reports:
    verbose_mode::
      "$(this.bundle): loading inventory module '$(inputs)'";
}

      #

bundle common cfengine_stdlib
{
  vars:
    cfengine_3_5::
      # 3.5 doesn't have "body file control" so all the includes are listed here
      "inputs" slist => {
                          "lib/3.5/paths.cf",
                          "lib/3.5/common.cf",
                          "lib/3.5/commands.cf",
                          "lib/3.5/packages.cf",
                          "lib/3.5/files.cf",
                          "lib/3.5/services.cf",
                          "lib/3.5/processes.cf",
                          "lib/3.5/storage.cf",
                          "lib/3.5/databases.cf",
                          "lib/3.5/monitor.cf",
                          "lib/3.5/guest_environments.cf",
                          "lib/3.5/bundles.cf",
                          "lib/3.5/reports.cf",
                          "lib/3.5/cfe_internal.cf",
      };

    !cfengine_3_5::
      # CFEngine 3.6 and higher can include through a secondary file
      "inputs" slist => { "$(sys.local_libdir)/stdlib.cf" };

  reports:
    verbose_mode::
      "$(this.bundle): defining inputs='$(inputs)'";
}

      #

bundle common cfengine_controls
{
  vars:
      "inputs" slist => {
                          "controls/cf_agent.cf",
                          "controls/cf_execd.cf",
                          "controls/cf_hub.cf",
                          "controls/cf_monitord.cf",
                          "controls/cf_runagent.cf",
                          "controls/cf_serverd.cf",
      };

  reports:
    verbose_mode::
      "$(this.bundle): defining inputs='$(inputs)'";
}

bundle common cfengine_reports
{
  vars:
    cfengine_3_5::
      "inputs" slist => { cf_null };

    !cfengine_3_5::
      "inputs" slist => {
                          "cfe_internal/host_info_report.cf",
      };

  reports:
    verbose_mode::
      "$(this.bundle): defining inputs='$(inputs)'";
}

bundle common services_autorun
{
  vars:
    cfengine_3_5||!services_autorun::
      "inputs" slist => { };
      "found_inputs" slist => {};
      "bundles" slist => { "services_autorun" }; # run self

    !cfengine_3_5::
      "inputs" slist => { "services/autorun.cf" };
      "found_inputs" slist => lsdir("$(this.promise_dirname)/services/autorun", ".*\.cf", "true");
      "bundles" slist => { "autorun" }; # run loaded bundles

  reports:
    verbose_mode::
      "$(this.bundle): defining inputs='$(inputs)'";
}

###############################################################################
#
# bundle agent service_catalogue
#  - general purposes of usage
#
###############################################################################

bundle agent service_catalogue

{

  methods:

    any::

      "security" -> { goal_infosec, goal_compliance }
      comment => "Basic change management",
      handle => "service_catalogue_change_management",
      usebundle => change_management;

}

# special body for update/*.cf compatibility
body classes u_kept_successful_command
# @brief Set command to "kept" instead of "repaired" if it returns 0
{
      kept_returncodes => { "0" };
}