refs sysadmin#17740
refs sysadmin#17950

refs sysadmin#17740

The path to the dockerd executable is hardcoded in the docker Puppet
module and differs from the path of the binary in the Debian package.
Let's trick systemd by adding a symlink:

    /usr/bin/dockerd -> /usr/sbin/dockerd

refs sysadmin#17740

It's simpler to manage package instalation in our custom profile.

refs sysadmin#17740

The docker Puppet module tries to find a package declared with name
"docker", but in Debian the package is called "docker.io".

refs sysadmin#17740

refs sysadmin#17740

refs sysadmin#17740

Our current use case mandates using a local image proxy cache (otherwise
we quickly reach Docker Hub's daily download limits). Let's make this
mandatory for now and avoid unneeded extra config in hiera.

Bonus: wrap a few GitLab CI Runner params so we can configure them using
the `tails::profile::gitlab_runner` namespace.

refs sysadmin#17740

Each part of our infra has different needs for routing via the VPN. This
commit changes the collection of VPN exported network routes to allow
fore selection of which routes a node wants to collect.

refs sysadmin#17950
refs sysadmin#17960

We won't immediately have a Libvirt-based GitLab Runner in production,
so let's temporarily disable tests that need it.

refs sysadmin#17740

refs sysadmin#17740

refs sysadmin#17950

With this move, the VPN code is free from tails-specific data.

refs sysadmin#17950

The netmask is already contained in the subnet.

refs sysadmin#17950

refs sysadmin#17950

refs sysadmin#17950

The previous approach, using the network::route resource, doesn't work
because the Tinc network is not brought up using ifupdown, which is the
mechanism used by that resource.

This change makes use of exported concat::fragment resources to
configure the routes provided by other nodes.

refs sysadmin#17950

refs sysadmin#17950

refs sysadmin#17950

refs sysadmin#17950

While at it:

    - Make SSH port configurable
    - Move SSH config template to EPP

refs sysadmin#17950

- Allow DHCP and DNS in guests subnet
- Allow guests to access the Internet

refs sysadmin#17950

- Allow for purging unmanaged rules
- Configure default policy for all internal firewall chains
- Allow ICMP
- Accept all traffic in loopback interface
- Reject local traffic in other interfaces
- Allow all outgoing traffic as well as all incoming established traffic

refs sysadmin#17950