import "grub2fedora20.pp"
import "passwdfile.pp"
import "securettyfile.pp"
import "warningbanners.pp"
import "openemr.pp"
import "ssh.pp"
import "firewall_rules.pp"
import "crontabconfig.pp"
import "accounts.pp"
import "packages.pp"
import "puppet.pp"
import "time.pp"

node default {
	include basenode
}

node "puppet" {
	include basenode
#	include passwordprotect::grub2
        include clean::securetty
        include issue::warningbanner
        include clean::passwdgroup
	include puppet_server
	include puppet::firewall
	include hardening::crontabconfig
	include logoutallcentos::crontabconfig
	include yumupdates::crontabconfig
	include puppetagent::crontabconfig
}

node "healthitbackup" {
        include basenode
#       include passwordprotect::grub2
        include clean::securetty
        include issue::warningbanner
        include clean::passwdgroup
        include healthitbackup::firewall
        include hardening::crontabconfig
        include logoutallcentos::crontabconfig
        include yumupdates::crontabconfig
        include puppetagent::crontabconfig
}


node "openemr1" {
	include basenode
	include passwordprotect::grub2
        include clean::securetty
        include issue::warningbanner
        include clean::passwdgroup
	include logoutall::crontabconfig
# USE DAYTIME LOGOUT SO PEOPLE CAN WORK   >>>>> logoutall_daytime_config_base.erb
        # include daytimelog::crontabconfig
	include openemr1::firewall
	include hardening::crontabconfig
	include openemr
	include yumupdates::crontabconfig
	include puppetagent::crontabconfig
}

node "healthitfirewall" {
	include basenode
	include passwordprotect::grub2
        include clean::securetty
        include issue::warningbanner
        include clean::passwdgroup
	include logoutall::crontabconfig
# USE DAYTIME LOGOUT SO PEOPLE CAN WORK   >>>>> logoutall_daytime_config_base.erb
        # include daytimelog::crontabconfig
	include healthitfirewall::firewall
	include hardening::crontabconfig
	include yumupdates::crontabconfig
	include puppetagent::crontabconfig
}

node "healthitca" {
	include basenode
	include passwordprotect::grub2
        include clean::securetty
        include issue::warningbanner
        include clean::passwdgroup
	# include logoutall::crontabconfig
# USE DAYTIME LOGOUT SO PEOPLE CAN WORK   >>>>> logoutall_daytime_config_base.erb
	include daytimelog::crontabconfig
        include healthitca::firewall
	include hardening::crontabconfig
        include yumupdates::crontabconfig
        include puppetagent::crontabconfig
}

node "healthitdnse" {
	include basenode
	include passwordprotect::grub2
	include clean::securetty
	include issue::warningbanner
	include clean::passwdgroup
        # include logoutall::crontabconfig
# USE DAYTIME LOGOUT SO PEOPLE CAN WORK   >>>>> logoutall_daytime_config_base.erb
        include daytimelog::crontabconfig
        include healthitdnse::firewall
	include hardening::crontabconfig
        include yumupdates::crontabconfig
        include puppetagent::crontabconfig
}

node "healthitdns" {
	include basenode
	include passwordprotect::grub2
        include clean::securetty
        include issue::warningbanner
        include clean::passwdgroup
        include logoutall::crontabconfig
# USE DAYTIME LOGOUT SO PEOPLE CAN WORK   >>>>> logoutall_daytime_config_base.erb
        # include daytimelog::crontabconfig
        include healthitdns::firewall
	include hardening::crontabconfig
        include yumupdates::crontabconfig
        include puppetagent::crontabconfig
}

class basenode {
#	include time
	include puppet_agent
#	include automatic_updates
#	include accounts
	include sshd
#	include security
	include packages
}

class security {
	include firewall

	# disable IPv6 tunneling like teredo and 6to4
	if $kernel == "Windows" {	
	        registry_value { 'HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents':
        	        ensure => present,
                	type   => dword,
	                data   => "0x01",
        	}
	}
}

class firewall {

	# enable windows firewall
        if $kernel == "Windows" {
                registry_value { 'HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall':
                ensure => present,
                type   => dword,
                data   => "1",
                }
                registry_value { 'HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall':
                ensure => present,
                type   => dword,
                data   => "1",
                }
                registry_value { 'HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall':
                ensure => present,
                type   => dword,
                data   => "1",
                }
                service { 'MpsSvc':
                        ensure => 'running',
                        enable => true,
                }
        }
}

class automatic_updates {
	if ($osfamily == "RedHat") {
		package{"yum-cron":}
		augeas{"yum-cron" :
			context => "/files/etc/yum/yum-cron.conf",
			changes => "set commands/apply_updates yes",
			require => Package['yum-cron']
		}
	}
	if ($osfamily == "Windows") {
                # KB 328010 http://support.microsoft.com/kb/328010
                registry_key { 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU':
                        ensure => present,
                }

                # enable automatic updates
                registry_value { 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate':
                        ensure => present,
                        type   => dword,
                        data   => "0x00",
                        require => Registry_key ['HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'],
                }
                # how to install updates, 3 = Automatically download and notify of installation
		# 4 = automatic download and scheduled install
                registry_value { 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\AUOptions':
                        ensure => present,
                        type   => dword,
                        data   => "0x04",
                        require => Registry_key ['HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'],
                }
                # prevent reboot when logged in: http://www.howtogeek.com/howto/windows-vista/prevent-windows-update-from-forcibly-rebooting-your-computer/
                registry_value { 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoRebootWithLoggedOnUsers':
                        ensure => present,
                        type   => dword,
                        data   => "0x01",
                        require => Registry_key ['HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'],
                }
                service { 'wuauserv':
                        ensure => 'running',
                        enable => true,
                }
	}
}
