Remove references to archived SIMP modules

.fixtures.yml

@@ -22,7 +22,6 @@ fixtures:
     stunnel: https://github.com/simp/pupmod-simp-stunnel.git
     svckill: https://github.com/simp/pupmod-simp-svckill.git
     systemd: https://github.com/simp/puppet-systemd.git
-    tcpwrappers: https://github.com/simp/pupmod-simp-tcpwrappers.git
     vox_selinux:
       repo: https://github.com/simp/pupmod-voxpupuli-selinux.git
       branch: simp-master

data/common.yaml

@@ -2,10 +2,6 @@
 # Common defaults for all operating systems
 # These values will be used unless overridden by OS-specific data
 
-# Controls whether to manage tcpwrappers configuration
-# TCP wrappers was dropped in EL8+
-nfs::manage_tcpwrappers: true
-
 # Controls whether to install quota-rpc package
 # In EL7, rpc.rquotad files were in the quota package
 # In EL8+, quota-rpc package is needed for NFS servers

data/os/RedHat/7.yaml

@@ -1,8 +1,6 @@
 ---
 # EL7-specific configuration
 
-# TCP wrappers is supported in EL7
-nfs::manage_tcpwrappers: true
 
 # quota-rpc is not a separate package in EL7
 # (rpc.rquotad files are in the quota package)

data/os/RedHat/8.yaml

@@ -1,8 +1,6 @@
 ---
 # EL8-specific configuration
 
-# TCP wrappers was dropped in EL8
-nfs::manage_tcpwrappers: false
 
 # quota-rpc is a separate package in EL8+
 nfs::install_quota_rpc: true

data/os/RedHat/9.yaml

@@ -1,8 +1,6 @@
 ---
 # EL9-specific configuration
 
-# TCP wrappers was dropped in EL8
-nfs::manage_tcpwrappers: false
 
 # quota-rpc is a separate package in EL8+
 nfs::install_quota_rpc: true

manifests/client/config.pp

@@ -51,10 +51,6 @@
     }
   }
 
-  if $nfs::tcpwrappers {
-    include 'nfs::client::tcpwrappers'
-  }
-
   if $nfs::idmapd {
     include 'nfs::idmapd::client'
   }

manifests/client/config.pp.tmp.877772.1775159215182

@@ -0,0 +1,57 @@
+# @summary Manage NFS client-specific configuration
+#
+# @api private
+# @author https://github.com/simp/pupmod-simp-nfs/graphs/contributors
+#
+class nfs::client::config {
+
+  assert_private()
+
+  # We need to configure the NFSv4.0 client delegation callback port for the
+  # nfsv4 kernel module, to ensure the port will pass through a firewall (i.e.,
+  # is not ephemeral).  Normally, the nfsv4 kernel module would be loaded when
+  # the mount requiring it is executed.  This dynamic loading doesn't play
+  # well with sysctl.  So, we are going to ensure the kernel module is
+  # configured properly with a static configuration file, load the module if
+  # necessary, and, in case it was already loaded, set the value by sysctl
+  # in nfs::client::service.
+  #
+  # NOTE: The parameter has to be configured via the nfs kernel module (a
+  # dependency of the nfsv4 kernel module), but won't be activated until the
+  # nfsv4 module is loaded.
+  #
+  exec { 'modprobe_nfsv4':
+    command => '/sbin/modprobe nfsv4',
+    unless  => '/sbin/lsmod | /usr/bin/grep -qw nfsv4',
+    require =>  File['/etc/modprobe.d/nfs.conf'],
+    notify  => Sysctl['fs.nfs.nfs_callback_tcpport']
+  }
+
+  $_modprobe_d_nfs_conf = @("NFSCONF")
+    # This file is managed by Puppet (simp-nfs module).  Changes will be overwritten
+    # at the next puppet run.
+    #
+    options nfs callback_tcpport=${nfs::client::callback_port}
+    | NFSCONF
+
+  file { '/etc/modprobe.d/nfs.conf':
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0640',
+    content => $_modprobe_d_nfs_conf
+  }
+
+  if !$nfs::is_server {
+    file { '/etc/exports':
+      ensure  => 'file',
+      mode    => '0644',
+      owner   => 'root',
+      group   => 'root',
+      content => "\n"
+    }
+  }
+
+  if $nfs::idmapd {
+    include 'nfs::idmapd::client'
+  }
+}

manifests/client/mount.pp

@@ -286,7 +286,6 @@
     stunnel_socket_options => $_stunnel_socket_options,
     stunnel_verify         => $_stunnel_verify,
     stunnel_wantedby       => $_stunnel_wantedby,
-    tcpwrappers            => $nfs::tcpwrappers
   }
 
   if $autofs {

manifests/client/mount/connection.pp

@@ -49,9 +49,6 @@
 #
 #   * Unused when `$stunnel` is `false`
 #
-# @param tcpwrappers
-#   Use the SIMP `tcpwrappers` module to manage TCP wrappers
-#
 # @api private
 # @author https://github.com/simp/pupmod-simp-nfs/graphs/contributors
 #
@@ -65,15 +62,14 @@
   Array[String] $stunnel_socket_options,
   Integer       $stunnel_verify,
   Array[String] $stunnel_wantedby,
-  Boolean       $tcpwrappers
 ) {
 
   # This is only meant to be called from inside nfs::client::mount
   assert_private()
 
   if $stunnel and ($nfs_version == 4) {
     # It is possible that this is called for multiple mounts on the same server.
-    # stunnel-related firewall and tcpwrappers settings handled by the
+    # stunnel-related firewall settings handled by the
     # stunnel::instance, itself.
     ensure_resource('nfs::client::stunnel',
       "${nfs_server}:${nfsd_port}",
@@ -85,7 +81,6 @@
         stunnel_verify         => $stunnel_verify,
         stunnel_wantedby       => $stunnel_wantedby,
         firewall               => $firewall,
-        tcpwrappers            => $tcpwrappers
       }
     )
   } elsif $firewall  {

manifests/client/stunnel.pp

@@ -43,9 +43,6 @@
 # @param firewall
 #   Use the SIMP `iptables` module to manage firewall connections
 #
-# @param tcpwrappers
-#   Use the SIMP `tcpwrappers` module to manage TCP wrappers
-#
 # @api private
 # @author https://github.com/simp/pupmod-simp-nfs/graphs/contributors
 #
@@ -57,7 +54,6 @@
   Integer[0]    $stunnel_verify,
   Array[String] $stunnel_wantedby,
   Boolean       $firewall,
-  Boolean       $tcpwrappers
 ) {
   assert_private()
 
@@ -74,7 +70,6 @@
       socket_options   => $stunnel_socket_options,
       systemd_wantedby => $stunnel_wantedby,
       firewall         => $firewall,
-      tcpwrappers      => $tcpwrappers,
       tag              => ['nfs']
     }
   }

manifests/init.pp

@@ -149,9 +149,6 @@
 # @param firewall
 #   Use the SIMP `iptables` module to manage firewall connections
 #
-# @param tcpwrappers
-#   Use the SIMP `tcpwrappers` module to manage TCP wrappers
-#
 # @param stunnel
 #   Wrap `stunnel` around critical NFSv4 connections
 #
@@ -205,12 +202,6 @@
 #   * Stunnel verify for just the NFS server on this host can be controlled
 #     by the `stunnel_verify` parameter in the `nfs::server` class.
 #
-# @param manage_tcpwrappers
-#   Whether tcpwrappers configuration should be managed for NFS services
-#
-#   * Automatically set based on OS version via Hiera (false for EL8+)
-#   * TCP wrappers was dropped in EL8
-#
 # @param install_quota_rpc
 #   Whether to install the quota-rpc package on NFS servers
 #
@@ -236,9 +227,6 @@
 #
 #   * Automatically set via Hiera
 #
-# @param tcpwrappers
-#   Use the SIMP `tcpwrappers` module to manage TCP wrappers
-#
 # @param trusted_nets
 #   The systems that are allowed to connect to this service
 #
@@ -273,9 +261,7 @@
   Simplib::Port         $stunnel_nfsd_port             = 20490,
   Array[String]         $stunnel_socket_options        = ['l:TCP_NODELAY=1','r:TCP_NODELAY=1'],
   Integer               $stunnel_verify                = 2,
-  Boolean               $tcpwrappers                   = simplib::lookup('simp_options::tcpwrappers', { 'default_value' => false }),
   Simplib::Netlist      $trusted_nets                  = simplib::lookup('simp_options::trusted_nets', { 'default_value' => ['127.0.0.1'] }),
-  Boolean               $manage_tcpwrappers            = true,
   Boolean               $install_quota_rpc             = false,
   Boolean               $manage_sysconfig_nfs          = false,
   Boolean               $apply_selinux_hotfix          = false,
@@ -295,10 +281,6 @@
     simplib::assert_optional_dependency($module_name, 'simp/krb5')
   }
 
-  if $tcpwrappers and $manage_tcpwrappers {
-    simplib::assert_optional_dependency($module_name, 'simp/tcpwrappers')
-  }
-
   include 'nfs::install'
 
   if $kerberos and $apply_selinux_hotfix {

manifests/server/config.pp

@@ -178,7 +178,4 @@
     content => $_simp_etc_exports_service
   }
 
-  if $nfs::tcpwrappers {
-    include 'nfs::server::tcpwrappers'
-  }
 }

manifests/server/stunnel.pp

@@ -42,7 +42,6 @@
     socket_options   => $nfs::server::stunnel_socket_options,
     systemd_wantedby => $nfs::server::stunnel_wantedby,
     firewall         => $nfs::firewall,
-    tcpwrappers      => $nfs::tcpwrappers,
     tag              => ['nfs']
   }
 }

metadata.json

@@ -60,10 +60,6 @@
       {
         "name": "simp/stunnel",
         "version_requirement": ">= 6.6.0 < 7.0.0"
-      },
-      {
-        "name": "simp/tcpwrappers",
-        "version_requirement": ">= 6.2.0 < 7.0.0"
       }
     ]
   },