move role dtn to ls, add flag to firewall

hieradata/org/lsst/role/dtn.yaml → hieradata/site/ls/role/dtn.yaml

@@ -1,19 +1,14 @@
 ---
 classes:
-  - "sudo"
-  - "accounts"
-  - "puppet_agent"
-  - "ssh"
-  - "easy_ipa"
-  - "rsyslog"
-  - "profile::icinga::agent"
+  - "profile::core::common"
 
 ssh::server_options:
   Port: 2712
 sudo::configs:
   wheel_b:
     content: "%wheel_b ALL=(ALL) NOPASSWD: ALL"
-
+
+profile::core::common::manage_firewall: false
 profile::core::common::deploy_icinga_agent: true
 profile::icinga::agent::host_template: "DtnTemplate"
 profile::icinga::agent::icinga_master_fqdn: "icinga-master.ls.lsst.org"

site/profile/manifests/core/common.pp

@@ -4,6 +4,9 @@
 # @param deploy_icinga_agent
 #   Enables or disable the installation of icinga agent on the node
 #
+# @param manage_firewall
+#   Whether or not to include the firewall class
+#
 # @param manage_puppet_agent
 #   Whether or not to include the puppet_agent class
 #
@@ -32,12 +35,12 @@
   Boolean $manage_krb5 = true,
   Boolean $manage_ldap = true,
   Boolean $manage_ipa = true,
+  Boolean $manage_firewall = true,
 ) {
   include accounts
   include augeas
   include easy_ipa
   include epel
-  include firewall
   include irqbalance
   include network
   include profile::core::dielibwrapdie
@@ -59,6 +62,10 @@
     include profile::icinga::agent
   }
 
+  if $manage_firewall {
+    include firewall
+  }
+
   if $manage_puppet_agent {
     include puppet_agent
   }