cleanup backup::receiver on puppet01

puppet/manifests/site.pp

@@ -30,7 +30,9 @@
 node /^puppet\d+\.[a-z]+\.theforeman\.org$/ {
   include profiles::base
   include profiles::puppetserver
-  include profiles::backup::receiver
+  class {'profiles::backup::receiver':
+    ensure => absent,
+  }
 }
 
 node /^redmine\d+\.([a-z]+\.)?theforeman\.org$/ {

puppet/modules/profiles/manifests/backup/receiver.pp

@@ -11,25 +11,31 @@
 #   The group which all targets belong to
 # @param directory
 #   The parent directory for all targets
+# @param ensure
+#   The backup receiver state to ensure.
 class profiles::backup::receiver (
   Array[String[1]] $targets = [],
   String[1] $group = 'backup',
   Stdlib::Absolutepath $directory = '/srv/backup',
+  Enum['present', 'absent'] $ensure = present,
 ) {
   group { $group:
-    ensure => present,
+    ensure => $ensure,
   }
 
-  file { $directory:
-    ensure => directory,
-    owner  => 'root',
-    group  => $group,
-    mode   => '0750',
+  if $ensure == present {
+    file { $directory:
+      ensure => 'directory',
+      owner  => 'root',
+      group  => $group,
+      mode   => '0750',
+    }
   }
 
   # Ensure $directory/.ssh is set to to ssh_home_t
   if $facts['os']['selinux']['enabled'] and $directory != '/home' {
     selinux::fcontext { 'backup-ssh':
+      ensure   => $ensure,
       seltype  => 'ssh_home_t',
       pathspec => "${directory}/[^/]+/\\.ssh(/.*)?",
     }
@@ -39,19 +45,19 @@
 
   $sshd_match = "Group ${group}"
   sshd_config_match { $sshd_match:
-    ensure => present,
+    ensure => $ensure,
   }
 
   # TODO: ChrootDirectory %h
 
   sshd_config { 'DisableForwarding':
-    ensure    => present,
+    ensure    => $ensure,
     condition => $sshd_match,
     value     => 'yes',
   }
 
   sshd_config { 'ForceCommand':
-    ensure    => present,
+    ensure    => $ensure,
     condition => $sshd_match,
     value     => 'internal-sftp',
   }
@@ -60,6 +66,7 @@
 
   $targets.each |$target| {
     profiles::backup::receiver::target { $target:
+      ensure  => $ensure,
       require => $require,
     }
   }

puppet/modules/profiles/manifests/backup/receiver/target.pp

@@ -5,15 +5,18 @@
 #
 # @param username
 #   The remote username
+# @param ensure
+#   The backup receiver target state to ensure.
 define profiles::backup::receiver::target (
   String[1] $username = "backup-${title}",
+  Enum['present', 'absent'] $ensure = present,
 ) {
   include profiles::backup::receiver
 
   $homedir = "${profiles::backup::receiver::directory}/${title}"
 
   user { $username:
-    ensure         => present,
+    ensure         => $ensure,
     gid            => $profiles::backup::receiver::group,
     home           => $homedir,
     managehome     => true,
@@ -23,22 +26,24 @@
 
   # Ensure authorized keys file for proper SELinux labels
   file { "${homedir}/.ssh":
-    ensure  => directory,
+    ensure  => bool2str($ensure == present, 'directory', 'absent'),
     owner   => $username,
     mode    => '0700',
+    force   => $ensure == absent,
     seltype => 'ssh_home_t',
   }
 
   file { "${homedir}/.ssh/authorized_keys":
-    ensure  => file,
+    ensure  => bool2str($ensure == present, 'file', 'absent'),
     owner   => $username,
     mode    => '0600',
     seltype => 'ssh_home_t',
   }
 
   ssh_authorized_key { "${username} managed by Puppet":
-    user => $username,
-    key  => ssh::keygen("backup-${title}", true),
-    type => 'ssh-rsa',
+    ensure => $ensure,
+    user   => $username,
+    key    => ssh::keygen("backup-${title}", true),
+    type   => 'ssh-rsa',
   }
 }