snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

puppet/kandra/manifests/teleport/application.pp

@@ -0,0 +1,30 @@
+# @summary Adds an http "application" to the Teleport configuration for the host.
+#
+# See https://goteleport.com/docs/application-access/
+define kandra::teleport::application (
+  $port,
+  $description = '',
+  $order = '50',
+  $labels = {},
+) {
+  include kandra::teleport::application_top
+  $app_data = [
+    {
+      name        => $name,
+      description => $description,
+      uri         => "http://localhost:${port}",
+      labels      => {
+        name => $name,
+      } + $labels,
+    },
+  ]
+
+  # This is appended to puppet/kandra/files/teleport_node.yaml, so
+  # must be indented, and the leading document dashes stripped.
+  $app_yaml = to_yaml($app_data).regsubst(/\A---\s*\n/, '').regsubst(/^/, '    ', 'G')
+  concat::fragment { "teleport_app_${name}":
+    target  => '/etc/teleport_node.yaml',
+    order   => $order,
+    content => $app_yaml,
+  }
+}

puppet/kandra/manifests/teleport/application_top.pp

@@ -0,0 +1,10 @@
+# @summary Enables application support on the node; include once.
+#
+# See https://goteleport.com/docs/application-access/
+class kandra::teleport::application_top {
+  concat::fragment { 'teleport_app':
+    target => '/etc/teleport_node.yaml',
+    order  => '10',
+    source => 'puppet:///modules/kandra/teleport_app.yaml',
+  }
+}

puppet/kandra/manifests/teleport/base.pp

@@ -0,0 +1,18 @@
+class kandra::teleport::base {
+  include zulip::supervisor
+
+  $setup_apt_repo_file = "${facts['zulip_scripts_path']}/lib/setup-apt-repo"
+  exec{ 'setup-apt-repo-teleport':
+    command => "${setup_apt_repo_file} --list teleport",
+    unless  => "${setup_apt_repo_file} --list teleport --verify",
+  }
+  package { 'teleport':
+    ensure  => installed,
+    require => Exec['setup-apt-repo-teleport'],
+  }
+  service { 'teleport':
+    ensure  => stopped,
+    enable  => mask,
+    require => Package['teleport'],
+  }
+}

puppet/kandra/manifests/teleport/db.pp

@@ -0,0 +1,23 @@
+# @summary Provide Teleport SSH access to a node.
+#
+# https://goteleport.com/docs/admin-guide/#adding-nodes-to-the-cluster
+# details additional manual steps to allow a node to join the cluster.
+class kandra::teleport::db {
+  include kandra::teleport::base
+
+  $fqdn = $facts['networking']['fqdn']
+  $hostname = $facts['networking']['hostname']
+  $is_ec2 = zulipconf('machine', 'hosting_provider', 'ec2') == 'ec2'
+  $join_token = zulipsecret('secrets', 'teleport_join_token', '')
+  file { '/etc/teleport_db.yaml':
+    ensure  => file,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/teleport_db.yaml.template.erb'),
+    before  => Kandra::Teleport::Part['db'],
+    notify  => Exec['reload teleport_db'],
+  }
+
+  kandra::teleport::part { 'db': }
+}

puppet/kandra/manifests/teleport/node.pp

@@ -0,0 +1,39 @@
+# @summary Provide Teleport SSH access to a node.
+#
+# EC2 nodes will automatically join the cluster; non-EC2 hosts will
+# need to set a teleport_join_token secret.  See
+# https://goteleport.com/docs/agents/join-services-to-your-cluster/join-token/#generate-a-token
+class kandra::teleport::node {
+  include kandra::teleport::base
+
+  $is_ec2 = zulipconf('machine', 'hosting_provider', 'ec2') == 'ec2'
+  $join_token = zulipsecret('secrets', 'teleport_join_token', '')
+  concat { '/etc/teleport_node.yaml':
+    ensure => present,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0644',
+    before => Kandra::Teleport::Part['node'],
+    notify => Exec['reload teleport_node'],
+  }
+  concat::fragment { 'teleport_node_base':
+    target  => '/etc/teleport_node.yaml',
+    content => template('kandra/teleport_node.yaml.template.erb'),
+    order   => '01',
+  }
+
+  kandra::teleport::part { 'node': }
+
+  $host_ca_path = '/etc/ssl/certs/teleport-ca-host.cert'
+  $host_ca_extract = @("EOT")
+    sqlite3 /var/lib/teleport/proc/sqlite.db "select value from kv where key = '/ids/node/current'" \
+      | jq -r .spec.tls_ca_certs[] \
+      | base64 -d \
+      > ${host_ca_path}
+    | EOT
+  exec { 'teleport host CA':
+    require => [Service['teleport_node'], Package['sqlite3']],
+    creates => $host_ca_path,
+    command => $host_ca_extract,
+  }
+}

puppet/kandra/manifests/teleport/part.pp

@@ -0,0 +1,32 @@
+# @summary Adds a systemd service named teleport_$name
+#
+define kandra::teleport::part() {
+  $part = $name
+
+  include zulip::systemd_daemon_reload
+  file { "/etc/systemd/system/teleport_${part}.service":
+    require => [
+      Package[teleport],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/teleport.service.template.erb'),
+    notify  => [Exec['reload systemd'], Service["teleport_${part}"]],
+  }
+
+  service {"teleport_${part}":
+    ensure  => running,
+    enable  => true,
+    require => [Service['supervisor'], Service['teleport'], Exec['reload systemd']],
+  }
+
+  # Notify this from YAML config changes (rather than the service)
+  # to get a SIGHUP-based graceful restart -- Teleport forks a new
+  # daemon and drains the old -- instead of a hard stop+start.
+  exec { "reload teleport_${part}":
+    command     => "/bin/systemctl reload teleport_${part}",
+    refreshonly => true,
+    require     => Service["teleport_${part}"],
+  }
+}

puppet/kandra/manifests/teleport/prometheus_app.pp

@@ -0,0 +1,24 @@
+define kandra::teleport::prometheus_app (
+  $port,
+  $description = '',
+  $order = '50',
+) {
+  $app_name = regsubst("${facts['networking']['hostname']}-${name}", '_', '-', 'G')
+  # Handle non-AWS hosts which don't have ec2 metadata
+  $fallback_role = $facts['networking']['hostname'] ? {
+    /^([^.-]+)/ => $1,
+    default     => '',
+  }
+  $role = pick_default($facts.dig('ec2_metadata', 'tags', 'instance', 'role'), $fallback_role)
+  kandra::teleport::application { $app_name:
+    port        => $port,
+    order       => $order,
+    description => $description,
+    labels      => {
+      type     => 'prometheus',
+      instance => $facts['networking']['hostname'],
+      exporter => $name,
+      role     => $role,
+    }
+  }
+}

puppet/kandra/manifests/teleport/sd.pp

@@ -0,0 +1,31 @@
+# @summary Returns Prometheus scrape targets based on Teleport apps
+#
+# Only one instance is necessary.
+#
+class kandra::teleport::sd {
+  include zulip::supervisor
+  include kandra::teleport::tbot
+
+  $version = $zulip::common::versions['teleport-sd']['version']
+  $bin = "/srv/zulip-teleport-sd-${version}"
+
+  zulip::external_dep { 'teleport-sd':
+    version       => $version,
+    url           => "https://github.com/alexmv/teleport-sd/releases/download/v${version}/teleport-sd-linux-${zulip::common::goarch}",
+    cleanup_after => [Service[supervisor]],
+  }
+
+  file { "${zulip::common::supervisor_conf_dir}/teleport-sd.conf":
+    ensure  => file,
+    require => [
+      Package[teleport],
+      Package[supervisor],
+      File[$bin],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/supervisor/conf.d/teleport-sd.conf.erb'),
+    notify  => Service[supervisor],
+  }
+}

puppet/kandra/manifests/teleport/tbot.pp

@@ -0,0 +1,48 @@
+# @summary Provide a local application proxy
+# https://goteleport.com/docs/reference/machine-workload-identity/configuration/#application-proxy
+class kandra::teleport::tbot {
+  include kandra::teleport::base
+
+  file { '/etc/tbot.yaml':
+    ensure => file,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0644',
+    source => 'puppet:///modules/kandra/tbot.yaml',
+    before => Service['tbot'],
+    notify => Exec['reload tbot'],
+  }
+
+  file { '/etc/systemd/system/tbot.service':
+    require => [
+      Package[teleport],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    source  => 'puppet:///modules/kandra/tbot.service',
+    notify  => [Exec['reload systemd'], Service['tbot']],
+  }
+
+  file { ['/var/lib/teleport/bot', '/var/lib/teleport/bot-identity']:
+    ensure  => directory,
+    owner   => 'teleport',
+    group   => 'teleport',
+    mode    => '0644',
+    require => Service['teleport'],
+    before  => Service['tbot'],
+  }
+
+  service {'tbot':
+    ensure  => running,
+    enable  => true,
+    require => [Service['teleport'], Exec['reload systemd']],
+  }
+
+  # See the equivalent in kandra::teleport::part.
+  exec { 'reload tbot':
+    command     => '/bin/systemctl reload tbot',
+    refreshonly => true,
+    require     => Service['tbot'],
+  }
+}