snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

puppet/kandra/manifests/profile/base.pp

@@ -0,0 +1,126 @@
+class kandra::profile::base {
+  include zulip::profile::base
+  include kandra::ksplice_uptrack
+  include kandra::firewall
+  include kandra::teleport::node
+  include kandra::prometheus::node
+
+  kandra::firewall_allow { 'ssh': order => '10'}
+  $is_ec2 = zulipconf('machine', 'hosting_provider', 'ec2') == 'ec2'
+
+  $org_base_packages = [
+    # Standard kernel, not AWS', so ksplice works
+    'linux-image-virtual',
+    # Management for our systems
+    'openssh-server',
+    # package management
+    'aptitude',
+    # SSL certificates
+    'certbot',
+    # For managing our current Debian packages
+    'debian-goodies',
+    # Popular editors
+    'vim',
+    'emacs-nox',
+    # Prevent accidental reboots
+    'molly-guard',
+    # For extracting Teleport certs
+    'sqlite3',
+    # Useful tools in a production environment
+    'screen',
+    'strace',
+    'bind9-host',
+    'git',
+    'nagios-plugins-contrib',
+    'ripgrep',
+    'bat',
+  ]
+  zulip::safepackage { $org_base_packages: ensure => installed }
+  file { '/usr/local/bin/bat':
+    ensure => link,
+    target => '/usr/bin/batcat',
+  }
+
+  # Uninstall the AWS kernel, but only after we install the usual one
+  package { ['linux-image-aws', 'linux-headers-aws', 'linux-aws-*', 'linux-image-*-aws', 'linux-modules-*-aws']:
+    ensure  => absent,
+    require => Package['linux-image-virtual'],
+  }
+
+  file { '/etc/apt/apt.conf.d/02periodic':
+    ensure => file,
+    mode   => '0644',
+    source => 'puppet:///modules/kandra/apt/apt.conf.d/02periodic',
+  }
+
+  file { '/etc/apt/apt.conf.d/50unattended-upgrades':
+    ensure => file,
+    mode   => '0644',
+    source => 'puppet:///modules/kandra/apt/apt.conf.d/50unattended-upgrades',
+  }
+  file { '/etc/needrestart/conf.d/zulip.conf':
+    ensure => file,
+    mode   => '0644',
+    source => 'puppet:///modules/kandra/needrestart/zulip.conf',
+  }
+
+  user { 'root': }
+  kandra::user_dotfiles { 'root':
+    home            => '/root',
+    keys            => 'internal-read-only-deploy-key',
+    authorized_keys => 'common',
+    known_hosts     => ['github.com'],
+  }
+
+  kandra::user_dotfiles { 'zulip':
+    keys            => 'internal-read-only-deploy-key',
+    authorized_keys => 'common',
+    known_hosts     => ['github.com'],
+  }
+
+  service { 'ssh':
+    ensure => running,
+  }
+
+  include kandra::aws_tools
+
+  if $is_ec2 {
+    # EC2 hosts can use the in-VPC timeserver
+    file { '/etc/chrony/chrony.conf':
+      ensure  => file,
+      mode    => '0644',
+      source  => 'puppet:///modules/kandra/chrony.conf',
+      require => Package['chrony'],
+      notify  => Service['chrony'],
+    }
+  }
+
+  group { 'nagios':
+    ensure => present,
+    gid    => '1050',
+  }
+  user { 'nagios':
+    ensure     => present,
+    uid        => '1050',
+    gid        => '1050',
+    shell      => '/bin/bash',
+    home       => '/var/lib/nagios',
+    managehome => true,
+  }
+  file { '/var/lib/nagios':
+    ensure  => directory,
+    require => User['nagios'],
+    owner   => 'nagios',
+    group   => 'nagios',
+    mode    => '0700',
+  }
+  kandra::user_dotfiles { 'nagios':
+    home            => '/var/lib/nagios',
+    authorized_keys => true,
+  }
+  file { '/home/nagios':
+    ensure  => absent,
+    force   => true,
+    recurse => true,
+  }
+}

puppet/kandra/manifests/profile/chat_zulip_org.pp

@@ -0,0 +1,23 @@
+class kandra::profile::chat_zulip_org inherits kandra::profile::base {
+  include zulip::profile::standalone
+  include zulip::local_mailserver
+  include zulip::hooks::sentry
+  include zulip::hooks::zulip_notify
+
+  include kandra::app_frontend_monitoring
+  include kandra::prometheus::redis
+  include kandra::prometheus::postgresql
+  kandra::teleport::prometheus_app { 'smokescreen': port => '4760' }
+  kandra::teleport::prometheus_app { 'camo': port => '9292' }
+
+  kandra::firewall_allow { 'http': }
+  kandra::firewall_allow { 'https': }
+  kandra::firewall_allow { 'smtp': }
+
+  Kandra::User_Dotfiles['root'] {
+    keys => false,
+  }
+  Kandra::User_Dotfiles['zulip'] {
+    keys => false,
+  }
+}

puppet/kandra/manifests/profile/grafana.pp

@@ -0,0 +1,78 @@
+# @summary Observability using Grafana
+#
+class kandra::profile::grafana inherits kandra::profile::base {
+
+  include zulip::supervisor
+
+  $version = $zulip::common::versions['grafana']['version']
+  $dir = "/srv/zulip-grafana-${version}"
+  $bin = "${dir}/bin/grafana-server"
+  $data_dir = '/var/lib/grafana'
+
+  zulip::external_dep { 'grafana':
+    version        => $version,
+    url            => "https://dl.grafana.com/oss/release/grafana-${version}.linux-${zulip::common::goarch}.tar.gz",
+    tarball_prefix => "grafana-${version}",
+    bin            => [$bin],
+    cleanup_after  => [Service[supervisor]],
+  }
+
+  group { 'grafana':
+    ensure => present,
+    gid    => '1070',
+  }
+  user { 'grafana':
+    ensure     => present,
+    uid        => '1070',
+    gid        => '1070',
+    shell      => '/bin/bash',
+    home       => $data_dir,
+    managehome => false,
+  }
+  file { $data_dir:
+    ensure  => directory,
+    owner   => 'grafana',
+    group   => 'grafana',
+    require => [ User[grafana], Group[grafana] ],
+  }
+  file { '/var/log/grafana':
+    ensure => directory,
+    owner  => 'grafana',
+    group  => 'grafana',
+  }
+
+  kandra::teleport::application { 'monitoring': port => '3000' }
+  file { "${zulip::common::supervisor_conf_dir}/grafana.conf":
+    ensure  => file,
+    require => [
+      Package[supervisor],
+      File[$bin],
+      File[$data_dir],
+      File['/var/log/grafana'],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/supervisor/conf.d/grafana.conf.erb'),
+    notify  => Service[supervisor],
+  }
+
+  $email_host = zulipconf('grafana', 'email_host', '')
+  $email_from = zulipconf('grafana', 'email_from', '')
+  $email_user = zulipsecret('secrets', 'grafana_email_user', '')
+  $email_password = zulipsecret('secrets', 'grafana_email_password', '')
+  file { '/etc/grafana':
+    ensure => directory,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0755',
+  }
+  file { '/etc/grafana/grafana.ini':
+    ensure  => file,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/grafana.ini.template.erb'),
+    notify  => Service[supervisor],
+  }
+}

puppet/kandra/manifests/profile/nagios.pp

@@ -0,0 +1,178 @@
+class kandra::profile::nagios inherits kandra::profile::base {
+
+  include kandra::apache
+
+  package { ['nagios4', 'msmtp', 'autossh']: ensure => installed }
+  $nagios_alert_email = zulipconf('nagios', 'alert_email', undef)
+  $nagios_test_email = zulipconf('nagios', 'test_email', undef)
+  $nagios_pager_email = zulipconf('nagios', 'pager_email', undef)
+
+  $nagios_mail_domain = zulipconf('nagios', 'mail_domain', undef)
+  $nagios_mail_host = zulipconf('nagios', 'mail_host', undef)
+  $nagios_mail_password = zulipsecret('secrets', 'nagios_mail_password', '')
+  if zulipconf('nagios', 'camo_check_url', undef) =~ /^https:\/\/([^\/]*)(\/.*)$/ {
+    $nagios_camo_check_host = $1
+    $nagios_camo_check_path = $2
+  }
+
+  $default_host_domain = zulipconf('nagios', 'default_host_domain', undef)
+  $hosts_app_prod = split(zulipconf('nagios', 'hosts_app_prod', undef), ',')
+  $hosts_app_staging = split(zulipconf('nagios', 'hosts_app_staging', undef), ',')
+  $hosts_postgresql_primary = split(zulipconf('nagios', 'hosts_postgresql_primary', undef), ',')
+  $hosts_postgresql_replica = split(zulipconf('nagios', 'hosts_postgresql_replica', undef), ',')
+  $hosts_redis = split(zulipconf('nagios', 'hosts_redis', undef), ',')
+  $hosts_fullstack = split(zulipconf('nagios', 'hosts_fullstack', undef), ',')
+  $hosts_smokescreen = split(zulipconf('nagios', 'hosts_smokescreen', undef), ',')
+  $hosts_other = split(zulipconf('nagios', 'hosts_other', undef), ',')
+
+  $hosts = zulipconf_nagios_hosts()
+  $qualified_hosts = $hosts.map |$h| { if '.' in $h { $h } else { "${h}.${default_host_domain}" }}
+  Kandra::User_Dotfiles['nagios'] {
+    keys        => 'nagios',
+    known_hosts => $qualified_hosts,
+  }
+
+  file { '/etc/nagios4/':
+    recurse => true,
+    purge   => false,
+    require => Package[nagios4],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    source  => 'puppet:///modules/kandra/nagios4/',
+    notify  => Service['nagios4'],
+  }
+
+  file { '/etc/apache2/sites-available/nagios.conf':
+    purge   => false,
+    require => Package[apache2],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0640',
+    content => template('kandra/nagios_apache_site.conf.template.erb'),
+  }
+  apache2site { 'nagios':
+    ensure  => present,
+    require => [
+      File['/etc/apache2/sites-available/nagios.conf'],
+      Apache2mod['headers'], Apache2mod['ssl'],
+    ],
+    notify  => Service['apache2'],
+  }
+  kandra::teleport::application{ 'nagios':
+    description => 'Monitoring: nagios',
+    port        => '3000',
+  }
+
+  file { '/etc/nagios4/conf.d/contacts.cfg':
+    require => Package[nagios4],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/nagios4/contacts.cfg.template.erb'),
+    notify  => Service['nagios4'],
+  }
+  file { '/etc/nagios4/conf.d/hosts.cfg':
+    require => Package[nagios4],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/nagios4/hosts.cfg.template.erb'),
+    notify  => Service['nagios4'],
+  }
+  file { '/etc/nagios4/conf.d/localhost.cfg':
+    require => Package[nagios4],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/nagios4/localhost.cfg.template.erb'),
+    notify  => Service['nagios4'],
+  }
+
+  file { '/etc/nagios4/cgi.cfg':
+    require => Package[nagios4],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/nagios4/cgi.cfg.template.erb'),
+    notify  => Service['nagios4'],
+  }
+
+  service { 'nagios4':
+    ensure  => running,
+    require => Kandra::User_Dotfiles['nagios'],
+  }
+
+  file { [
+    '/etc/nagios4/conf.d/extinfo_nagios2.cfg',
+    '/etc/nagios4/conf.d/services_nagios2.cfg',
+    '/etc/nagios4/conf.d/contacts_nagios2.cfg',
+    '/etc/nagios4/conf.d/hostgroups_nagios2.cfg',
+    '/etc/nagios4/conf.d/localhost_nagios2.cfg',
+    '/etc/nagios4/conf.d/zulip_nagios.cfg',
+  ]:
+    ensure => absent,
+  }
+
+  file { "${zulip::common::supervisor_conf_dir}/autossh_tunnels.conf":
+    ensure  => file,
+    require => [
+      Package['supervisor', 'autossh'],
+      Kandra::User_Dotfiles['nagios'],
+    ],
+    mode    => '0644',
+    owner   => 'root',
+    group   => 'root',
+    content => template('kandra/supervisor/conf.d/autossh_tunnels.conf.erb'),
+    notify  => Service['supervisor'],
+  }
+  file { '/etc/nagios4/conf.d/zulip_autossh.cfg':
+    ensure  => file,
+    mode    => '0644',
+    owner   => 'root',
+    group   => 'root',
+    content => template('kandra/nagios_autossh.template.erb'),
+    notify  => Service['nagios4'],
+  }
+
+  file { '/var/lib/nagios/msmtprc':
+    ensure  => file,
+    mode    => '0600',
+    owner   => 'nagios',
+    group   => 'nagios',
+    content => template('kandra/msmtprc_nagios.template.erb'),
+    require => File['/var/lib/nagios'],
+  }
+
+  file { '/var/lib/nagios/.ssh/config':
+    ensure => file,
+    mode   => '0644',
+    owner  => 'nagios',
+    group  => 'nagios',
+    source => 'puppet:///modules/kandra/nagios_ssh_config',
+  }
+
+  # Disable apparmor for msmtp so it can read the above config file
+  file { '/etc/apparmor.d/disable/usr.bin.msmtp':
+    ensure => link,
+    target => '/etc/apparmor.d/usr.bin.msmtp',
+    notify => Exec['reload apparmor'],
+  }
+  exec {'reload apparmor':
+    command     => '/sbin/apparmor_parser -R /etc/apparmor.d/usr.bin.msmtp',
+    refreshonly => true,
+  }
+
+  exec { 'fix_nagios_permissions':
+    command => 'dpkg-statoverride --update --add nagios www-data 2710 /var/lib/nagios4/rw',
+    unless  => 'bash -c "ls -ld /var/lib/nagios4/rw | grep ^drwx--s--- -q"',
+    notify  => Service['nagios4'],
+  }
+  exec { 'fix_nagios_permissions2':
+    command => 'dpkg-statoverride --update --add nagios nagios 751 /var/lib/nagios4',
+    unless  => 'bash -c "ls -ld /var/lib/nagios4 | grep ^drwxr-x--x -q"',
+    notify  => Service['nagios4'],
+  }
+
+  # TODO: Install our API
+}

puppet/kandra/manifests/profile/postgresql.pp

@@ -0,0 +1,74 @@
+class kandra::profile::postgresql inherits kandra::profile::base {
+  include kandra::teleport::db
+  include kandra::prometheus::postgresql
+
+  # We key off of `listen_addresses` being set to know if we should be starting PostgreSQL.
+  $listen_addresses = zulipconf('postgresql', 'listen_addresses', undef)
+  $is_stage1 = ($listen_addresses == undef)
+  class { 'zulip::profile::postgresql':
+    start => ! $is_stage1,
+  }
+
+  package { ['xfsprogs', 'nvme-cli']: ensure => installed }
+
+  kandra::firewall_allow{ 'postgresql': }
+
+  zulip::sysctl { 'postgresql-swappiness':
+    key   => 'vm.swappiness',
+    value => '0',
+  }
+  zulip::sysctl { 'postgresql-overcommit':
+    key   => 'vm.overcommit_memory',
+    value => '2',
+  }
+
+  file { '/root/setup_disks.sh':
+    ensure => file,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0744',
+    source => 'puppet:///modules/kandra/postgresql/setup_disks.sh',
+  }
+  exec { 'setup_disks':
+    command => '/root/setup_disks.sh',
+    # We need to not have started installing the non-AWS kernel, so
+    # the xfs module gets installed for the running kernel, and we can
+    # mount it.
+    before  => Package['linux-image-virtual'],
+    require => Package["postgresql-${zulip::postgresql_common::version}", 'xfsprogs', 'nvme-cli'],
+    unless  => 'test /var/lib/postgresql/ -ef /srv/data/postgresql/',
+  }
+
+  # This is the second stage, after secrets are configured
+  if (! $is_stage1) {
+    $replication_primary = zulipconf('postgresql', 'replication_primary', undef)
+    $replication_user = zulipconf('postgresql', 'replication_user', undef)
+    if $replication_primary != undef and $replication_user != undef {
+      file { '/root/setup_data.sh':
+        ensure => file,
+        owner  => 'root',
+        group  => 'root',
+        mode   => '0744',
+        source => 'puppet:///modules/kandra/postgresql/setup_data.sh',
+      }
+      exec { 'setup_data':
+        command => '/root/setup_data.sh',
+        require => [File['/usr/local/bin/env-wal-g'], Exec['setup_disks']],
+        unless  => "test -d /srv/data/postgresql/${zulip::postgresql_common::version}/main",
+        timeout => 0,
+        before  => File["${zulip::postgresql_base::postgresql_datadir}/standby.signal"],
+        notify  => Service['postgresql'],
+      }
+    }
+  }
+
+  file { "${zulip::postgresql_base::postgresql_confdir}/pg_hba.conf":
+    ensure  => file,
+    require => Package["postgresql-${zulip::postgresql_common::version}"],
+    notify  => Service['postgresql'],
+    owner   => 'postgres',
+    group   => 'postgres',
+    mode    => '0640',
+    source  => 'puppet:///modules/kandra/postgresql/pg_hba.conf',
+  }
+}

puppet/kandra/manifests/profile/prod_app_frontend.pp

@@ -0,0 +1,37 @@
+class kandra::profile::prod_app_frontend inherits kandra::profile::base {
+  include kandra::app_frontend
+  include zulip::hooks::zulip_notify
+
+  Kandra::User_Dotfiles['root'] {
+    keys => 'internal-limited-write-deploy-key',
+  }
+  Kandra::User_Dotfiles['zulip'] {
+    keys => 'internal-limited-write-deploy-key',
+  }
+
+  zulip::sysctl { 'conntrack':
+    comment => 'Increase conntrack kernel table size',
+    key     => 'net.nf_conntrack_max',
+    value   => zulipconf('application_server', 'conntrack_max', 262144),
+  }
+
+  file { '/etc/nginx/sites-available/zulip':
+    ensure  => file,
+    require => [Package['nginx-full'], Exec['generate-default-snakeoil']],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    source  => 'puppet:///modules/kandra/nginx/sites-available/zulip',
+    notify  => Service['nginx'],
+  }
+
+  file { '/etc/nginx/sites-enabled/zulip':
+    ensure  => link,
+    require => Package['nginx-full'],
+    target  => '/etc/nginx/sites-available/zulip',
+    notify  => Service['nginx'],
+  }
+
+  # Prod has our Apple Push Notifications Service private key at
+  # /etc/ssl/django-private/apns-dist.pem
+}

puppet/kandra/manifests/profile/prometheus_server.pp

@@ -0,0 +1,87 @@
+# @summary Gathers Prometheus statistics from all nodes.
+#
+# Only one instance is necessary.
+#
+class kandra::profile::prometheus_server inherits kandra::profile::base {
+
+  include kandra::prometheus::base
+
+  # Service discovery via Teleport
+  include kandra::teleport::tbot
+  include kandra::teleport::sd
+
+  # This blackbox monitoring of the backup system runs locally
+  include kandra::prometheus::wal_g
+
+  # Ditto the Akamai logs
+  include kandra::prometheus::akamai
+
+  # Ditto Weblate
+  include kandra::prometheus::weblate
+
+  # The SES log ETL (writing to S3) runs on vector
+  include kandra::ses_logs
+
+  # Export prometheus stats to status.zulip.com
+  include kandra::statuspage
+
+  $version = $zulip::common::versions['prometheus']['version']
+  $dir = "/srv/zulip-prometheus-${version}"
+  $bin = "${dir}/prometheus"
+  $data_dir = '/var/lib/prometheus'
+
+  zulip::external_dep { 'prometheus':
+    version        => $version,
+    url            => "https://github.com/prometheus/prometheus/releases/download/v${version}/prometheus-${version}.linux-${zulip::common::goarch}.tar.gz",
+    tarball_prefix => "prometheus-${version}.linux-${zulip::common::goarch}",
+    bin            => [$bin, "${dir}/promtool"],
+    cleanup_after  => [Service[supervisor]],
+  }
+  file { '/usr/local/bin/promtool':
+    ensure  => link,
+    target  => "${dir}/promtool",
+    require => File["${dir}/promtool"],
+    before  => Exec['Cleanup prometheus'],
+  }
+
+  file { $data_dir:
+    ensure  => directory,
+    owner   => 'prometheus',
+    group   => 'prometheus',
+    require => [ User[prometheus], Group[prometheus] ],
+  }
+  file { '/etc/prometheus':
+    ensure => directory,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0755',
+  }
+
+  $czo = zulipconf('prometheus', 'czo', '')
+  $other_hosts = split(zulipconf('prometheus', 'other_hosts', ''), ',')
+  $backup_buckets = split(zulipconf('prometheus', 'walg_buckets', ''), ',')
+  file { '/etc/prometheus/prometheus.yaml':
+    ensure  => file,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/prometheus/prometheus.yaml.template.erb'),
+    notify  => Service[supervisor],
+  }
+
+  file { "${zulip::common::supervisor_conf_dir}/prometheus.conf":
+    ensure  => file,
+    require => [
+      Package[supervisor],
+      File[$bin],
+      File[$data_dir],
+      File['/etc/prometheus/prometheus.yaml'],
+      Service['tbot'],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/supervisor/conf.d/prometheus.conf.template.erb'),
+    notify  => Service[supervisor],
+  }
+}

puppet/kandra/manifests/profile/redis.pp

@@ -0,0 +1,35 @@
+class kandra::profile::redis inherits kandra::profile::base {
+  include zulip::profile::redis
+  include kandra::prometheus::redis
+
+  zulip::sysctl { 'redis-somaxconn':
+    key   => 'net.core.somaxconn',
+    value => '65535',
+  }
+
+  # Need redis_password in its own file for Nagios
+  file { '/var/lib/nagios/redis_password':
+    ensure  => file,
+    mode    => '0600',
+    owner   => 'nagios',
+    group   => 'nagios',
+    content => "${zulip::profile::redis::redis_password}\n",
+  }
+
+  group { 'redistunnel':
+    ensure => present,
+    gid    => '1080',
+  }
+  user { 'redistunnel':
+    ensure     => present,
+    uid        => '1080',
+    gid        => '1080',
+    groups     => ['zulip'],
+    shell      => '/bin/true',
+    home       => '/home/redistunnel',
+    managehome => true,
+  }
+  kandra::user_dotfiles { 'redistunnel':
+    authorized_keys => true,
+  }
+}

puppet/kandra/manifests/profile/smokescreen.pp

@@ -0,0 +1,9 @@
+class kandra::profile::smokescreen inherits kandra::profile::base {
+
+
+  include zulip::profile::smokescreen
+  kandra::firewall_allow { 'smokescreen': port => '4750' }
+  kandra::teleport::prometheus_app { 'smokescreen': port => '4760' }
+
+  include kandra::camo
+}

puppet/kandra/manifests/profile/staging_app_frontend.pp

@@ -0,0 +1,28 @@
+class kandra::profile::staging_app_frontend inherits kandra::profile::base {
+
+  include kandra::app_frontend
+
+  file { '/etc/nginx/sites-available/zulip-staging':
+    ensure  => file,
+    require => [Package['nginx-full'], Exec['generate-default-snakeoil']],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    source  => 'puppet:///modules/kandra/nginx/sites-available/zulip-staging',
+    notify  => Service['nginx'],
+  }
+  file { '/etc/nginx/sites-enabled/zulip-staging':
+    ensure  => link,
+    require => Package['nginx-full'],
+    target  => '/etc/nginx/sites-available/zulip-staging',
+    notify  => Service['nginx'],
+  }
+
+  # Eventually, this will go in a staging_app_frontend_once.pp
+  zulip::cron { 'check_send_receive_time':
+    hour      => '*',
+    minute    => '*',
+    command   => '/usr/lib/nagios/plugins/zulip_app_frontend/check_send_receive_time',
+    use_proxy => false,
+  }
+}

puppet/kandra/manifests/profile/teleport.pp

@@ -0,0 +1,23 @@
+class kandra::profile::teleport inherits kandra::profile::base {
+
+
+  file { '/etc/teleport_server.yaml':
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0644',
+    source => 'puppet:///modules/kandra/teleport_server.yaml',
+    before => Kandra::Teleport::Part['server'],
+    notify => Exec['reload teleport_server'],
+  }
+  file { '/var/lib/teleport-server':
+    ensure => directory,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0700',
+    before => Kandra::Teleport::Part['server'],
+  }
+  kandra::teleport::part { 'server': }
+
+  # https://goteleport.com/docs/reference/deployment/networking/#ports-with-tls-routing
+  kandra::firewall_allow { 'teleport_server_ui': port => 443 }
+}

puppet/kandra/manifests/profile/zulipbot_zulip_org.pp

@@ -0,0 +1,8 @@
+class kandra::profile::zulipbot_zulip_org inherits kandra::profile::base {
+
+  kandra::firewall_allow { 'http': }
+  kandra::firewall_allow { 'https': }
+
+  # TODO: This does not do any configuration of zulipbot itself, or of
+  # caddy.
+}