(MODULES-10413) Allow custom ntp user and daemon options

.travis.yml

@@ -98,6 +98,7 @@ branches:
     - master
     - /^v\d/
     - release
+    - /devel*/
 notifications:
   email: false
   slack:

REFERENCE.md

@@ -82,6 +82,14 @@ Data type: `Optional[String]`
 Specifies an absolute or relative file path to an ERB template for the config file.
 Example value: 'ntp/ntp.conf.erb'. A validation error is thrown if both this **and** the `config_epp` parameter are specified.
 
+##### `daemon_extra_opts`
+
+Data type: `Optional[String]`
+
+Specifies any arguments to pass to ntp daemon. Default value: '-g'.
+Example value: '-g -i /var/lib/ntp' to enable jaildir options.
+Note that user is a specific parameter handled separately.
+
 ##### `disable_auth`
 
 Data type: `Boolean`
@@ -443,6 +451,14 @@ Specifies the stratum the server should operate at when using the undisciplined
 This value should be set to no less than 10 if ntpd might be accessible outside your immediate, controlled network.
 Default value: 10.am udlc
 
+##### `user`
+
+Data type: `Optional[String]`
+
+Specifies user to run ntpd daemon. Default value: ntp.
+Usually set by default on Centos7 (/etc/systemd/system/multi-user.target.wants/ntpd.service) and ubuntu 18.04 (/usr/lib/ntp/ntp-systemd-wrapper)
+This is currently restricted to Redhat based systems of version 7 and above and Ubuntu 18.04.
+
 ## Data types
 
 ### Ntp::Key_id

data/common.yaml

@@ -7,6 +7,7 @@ ntp::config_file_mode: '0644'
 ntp::config: '/etc/ntp.conf'
 ntp::config_template: ~
 ntp::config_epp: ~
+ntp::daemon_extra_opts: ~
 ntp::disable_auth: false
 ntp::disable_dhclient: false
 ntp::disable_kernel: false
@@ -67,3 +68,4 @@ ntp::tos_orphan: ~
 ntp::tos: false
 ntp::udlc_stratum: 10
 ntp::udlc: false
+ntp::user: ~

manifests/config.pp

@@ -13,6 +13,63 @@
     }
   }
 
+  case $::osfamily
+  {
+    'redhat':
+    {
+      $daemon_config = '/etc/sysconfig/ntpd'
+      if $ntp::daemon_extra_opts {
+        file_line { 'Set NTPD daemon options':
+          ensure => present,
+          path   => $daemon_config,
+          line   => "OPTIONS='${ntp::daemon_extra_opts}'",
+          match  => '^OPTIONS\=',
+        }
+      }
+      if $ntp::user and $facts['operatingsystemmajrelease'] != '6' {
+        file_line { 'Set NTPD daemon user':
+          ensure => present,
+          path   => '/etc/systemd/system/multi-user.target.wants/ntpd.service',
+          line   => "ExecStart=/usr/sbin/ntpd -u ${ntp::user}:${ntp::user} \$OPTIONS",
+          match  => '^ExecStart\=',
+        }
+      }
+    }
+    'Debian':
+    {
+      $daemon_config = '/etc/default/ntp'
+      if $ntp::daemon_extra_opts {
+        file_line { 'Set NTPD daemon options':
+          ensure => present,
+          path   => $daemon_config,
+          line   => "NTPD_OPTS='${ntp::daemon_extra_opts}'",
+          match  => '^NTPD_OPTS\=',
+        }
+      }
+      if $ntp::user and $facts['operatingsystemmajrelease'] == '18.04' {
+        file_line { 'Set NTPD daemon user':
+          ensure => present,
+          path   => '/usr/lib/ntp/ntp-systemd-wrapper',
+          line   => "RUNASUSER=${ntp::user}",
+          match  => '^RUNASUSER\=',
+        }
+      }
+    }
+    'Suse':
+    {
+      $daemon_config = '/etc/sysconfig/ntp'
+      if $ntp::daemon_extra_opts {
+        file_line { 'Set NTPD daemon options':
+          ensure => present,
+          path   => $daemon_config,
+          line   => "OPTIONS='${ntp::daemon_extra_opts}'",
+          match  => '^OPTIONS\=',
+        }
+      }
+    }
+    default: { }
+  }
+
   if $ntp::keys_enable {
     case $ntp::config_dir {
       '/', '/etc', undef: {}

manifests/init.pp

@@ -28,6 +28,11 @@
 #   Specifies an absolute or relative file path to an ERB template for the config file.
 #   Example value: 'ntp/ntp.conf.erb'. A validation error is thrown if both this **and** the `config_epp` parameter are specified.
 #
+# @param daemon_extra_opts
+#   Specifies any arguments to pass to ntp daemon. Default value: '-g'.
+#   Example value: '-g -i /var/lib/ntp' to enable jaildir options.
+#   Note that user is a specific parameter handled separately.
+#
 # @param disable_auth
 #   Disables cryptographic authentication for broadcast client, multicast client, and symmetric passive associations.
 #
@@ -218,6 +223,11 @@
 #   This value should be set to no less than 10 if ntpd might be accessible outside your immediate, controlled network.
 #   Default value: 10.am udlc
 #
+# @param user
+#   Specifies user to run ntpd daemon. Default value: ntp.
+#   Usually set by default on Centos7 (/etc/systemd/system/multi-user.target.wants/ntpd.service) and ubuntu 18.04 (/usr/lib/ntp/ntp-systemd-wrapper)
+#   This is currently restricted to Redhat based systems of version 7 and above and Ubuntu 18.04.
+#
 class ntp (
   Boolean $broadcastclient,
   Boolean $burst,
@@ -284,6 +294,8 @@
   Optional[Integer[1,15]] $udlc_stratum,
   Optional[Stdlib::Absolutepath] $ntpsigndsocket,
   Optional[String] $authprov,
+  Optional[String] $user,
+  Optional[String] $daemon_extra_opts,
 ) {
   # defaults for tinker and panic are different, when running on virtual machines
   if $facts['is_virtual'] {

spec/acceptance/ntp_user_and_daemon_opts_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper_acceptance'
+
+case os[:family]
+when 'redhat', 'freebsd', 'linux'
+  servicename = 'ntpd'
+when 'solaris'
+  case fact('kernelrelease')
+  when '5.10'
+    servicename = 'network/ntp4'
+  when '5.11'
+    servicename = 'network/ntp'
+  end
+when 'aix'
+  servicename = 'xntpd'
+else
+  servicename = if os[:family] == 'sles' && os[:release].start_with?('12', '15')
+                  'ntpd'
+                else
+                  'ntp'
+                end
+end
+config = if os[:family] == 'redhat'
+           '/etc/sysconfig/ntpd'
+         elsif os[:family] == 'sles'
+           '/etc/sysconfig/ntp'
+         else
+           '/etc/default/ntp'
+         end
+describe 'ntp class with daemon options:', unless: UNSUPPORTED_PLATFORMS.include?(os[:family]) do
+  let(:pp) { "class { 'ntp': service_enable => true, service_ensure => running, service_manage => true, service_name => '#{servicename}', user => 'ntp', daemon_extra_opts => '-g -i /var/lib/ntp' }" }
+
+  context 'when run' do
+    it 'is successful' do
+      apply_manifest(pp, catch_failures: true)
+    end
+
+    describe file(config.to_s) do
+      its(:content) { is_expected.to match(%r{(OPTIONS|NTPD_OPTS)='-g -i \/var\/lib\/ntp'}) }
+    end
+    if os[:family] == 'redhat' && !os[:release].start_with?('6')
+      describe file('/etc/systemd/system/multi-user.target.wants/ntpd.service') do
+        its(:content) { is_expected.to match(%r{ntpd -u ntp:ntp}) }
+      end
+    elsif os[:family] == 'ubuntu' && os[:release].start_with?('18')
+      describe file('/usr/lib/ntp/ntp-systemd-wrapper') do
+        its(:content) { is_expected.to match(%r{RUNASUSER=ntp}) }
+      end
+    end
+  end
+end