Add class profile::tfc_agent

README.md

@@ -65,6 +65,7 @@ The `profile::` sections list the available classes, their role and their parame
 - [`profile::squid::server`](#profilesquidserver)
 - [`profile::sssd::client`](#profilesssdclient)
 - [`profile::swap`](#profileswap)
+- [`profile::tfc_agent`](#profiletfc_agent)
 - [`profile::ssh::base`](#profilesshbase)
 - [`profile::ssh::known_hosts`](#profilesshknown_hosts)
 - [`profile::ssh::hostbased_auth::client`](#profilesshhostbased_authclient)
@@ -1827,6 +1828,37 @@ profile::swap::swappiness: 20
 ```
 </details>
 
+## `profile::tfc_agent`
+
+This class installs the Terraform Cloud Agent binary, writes its environment
+file, configures its systemd service, and enables the service.
+
+### parameters
+
+| Variable      | Description                                  | Type   |
+| :------------ | :------------------------------------------- | :----- |
+| `token`       | Terraform Cloud agent token                  | String |
+| `agent_name`  | Name assigned to the Terraform Cloud agent   | String |
+| `version`     | Terraform Cloud Agent version to install     | String |
+
+<details>
+<summary>default values</summary>
+
+```yaml
+profile::tfc_agent::version: '1.28.8'
+```
+</details>
+
+<details>
+<summary>example</summary>
+
+```yaml
+profile::tfc_agent::token: 'xxxxxxxx.atlasv1.zzzzzzzzzzzzzzzzzzzzzzzz'
+profile::tfc_agent::agent_name: 'magic-castle'
+profile::tfc_agent::version: '1.28.8'
+```
+</details>
+
 ## `profile::ssh::base`
 
 This class optimizer ssh server daemon (sshd) configuration to achieve an A+ audit score on

site/profile/manifests/tfc_agent.pp

@@ -0,0 +1,89 @@
+class profile::tfc_agent (
+  String $token,
+  String $agent_name,
+  String $version = '1.28.8',
+) {
+  $architecture = $facts['os']['architecture'] ? {
+    'x86_64'  => 'amd64',
+    'aarch64' => 'arm64',
+    default   => $facts['os']['architecture'],
+  }
+
+  $install_dir  = '/var/lib/tfc-agent'
+  $version_dir  = "${install_dir}/${version}"
+  $etc_dir      = '/etc/tfc-agent'
+  $env_file     = "${etc_dir}/tfc-agent.env"
+  $service_file = '/etc/systemd/system/tfc-agent.service'
+  $archive_file = "/opt/puppetlabs/puppet/cache/puppet-archive/tfc-agent_${version}_linux_${architecture}.zip"
+  $archive_url  = "https://releases.hashicorp.com/tfc-agent/${version}/tfc-agent_${version}_linux_${architecture}.zip"
+
+  ensure_resource('file', '/opt/puppetlabs/puppet/cache/puppet-archive', { 'ensure' => 'directory' })
+
+  file { [$install_dir, $version_dir, $etc_dir]:
+    ensure => 'directory',
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0755',
+  }
+
+  archive { 'tfc-agent':
+    path         => $archive_file,
+    source       => $archive_url,
+    extract      => true,
+    extract_path => $version_dir,
+    creates      => "${version_dir}/tfc-agent",
+    require      => [
+      File['/opt/puppetlabs/puppet/cache/puppet-archive'],
+      File[$version_dir],
+    ],
+  }
+
+  file { "${install_dir}/tfc-agent":
+    ensure  => 'link',
+    target  => "${version_dir}/tfc-agent",
+    owner   => 'root',
+    group   => 'root',
+    require => Archive['tfc-agent'],
+    notify  => Service['tfc-agent'],
+  }
+
+  file { $service_file:
+    ensure  => 'file',
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => epp('profile/tfc_agent/tfc-agent.service.epp',
+      {
+        env_file    => $env_file,
+        install_dir => $install_dir,
+      }
+    ),
+    notify  => Service['tfc-agent'],
+  }
+
+  file { $env_file:
+    ensure    => 'file',
+    owner     => 'root',
+    group     => 'root',
+    mode      => '0600',
+    show_diff => false,
+    content   => epp('profile/tfc_agent/tfc-agent.env.epp',
+      {
+        token      => $token,
+        agent_name => $agent_name,
+      }
+    ),
+    require   => File[$etc_dir],
+    notify    => Service['tfc-agent'],
+  }
+
+  service { 'tfc-agent':
+    ensure  => 'running',
+    enable  => true,
+    require => [
+      File["${install_dir}/tfc-agent"],
+      File[$env_file],
+      File[$service_file],
+    ],
+  }
+}

site/profile/templates/tfc_agent/tfc-agent.env.epp

@@ -0,0 +1,3 @@
+TFC_AGENT_TOKEN="<%= $token %>"
+TFC_AGENT_NAME="<%= $agent_name %>"
+TFC_AGENT_LOG_LEVEL="INFO"

site/profile/templates/tfc_agent/tfc-agent.service.epp

@@ -0,0 +1,47 @@
+[Unit]
+Description=Service to automatically start TFC/E Agent
+After=network.target
+
+[Service]
+EnvironmentFile=<%= $env_file %>
+Type=simple
+ExecStart=<%= $install_dir %>/tfc-agent
+KillSignal=SIGINT
+Restart=always
+RestartSec=5
+DynamicUser=yes
+RuntimeDirectory=tfc-agent
+Environment=HOME=/run/tfc-agent
+PrivateTmp=true
+
+ProtectSystem=yes
+ProtectHome=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectControlGroups=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+PrivateDevices=yes
+PrivateNetwork=no
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+DevicePolicy=closed
+KeyringMode=private
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+PrivateUsers=yes
+RemoveIPC=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallFilter=
+SystemCallArchitectures=native
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged
+
+[Install]
+WantedBy=multi-user.target