Add `puppetlabs/apt` module to Puppetfile

Add `puppetlabs/apt` module, which allows us to use unattended-upgrades on this
box.
Add `mail_to` key to Hiera

This commit adds a `mail_to` key to Hiera in order to direct exception mail from
apt to the machine.email list.
Add alphagov/clamav module to Puppetfile

Adds the alphagov/clamav module to Puppetfile. We're eating our own dog food here.
Add `base::clamav` and `clamav` classes to Hiera

To use the `alphagov/clamav` package and the `base::clamav` class to control
configuration, we need to add it to Hiera as we're using Hiera as a
lightweight ENC in this instance.
Add /srv/infected directory

The /srv/infected directory is used by ClamAV to move infected files to in
7660f5d. This change ensures that the directory exists.
Add shell script to scan /srv/backup-data

This commit adds a shell script to scan the contents of /srv/backup-data, log
output to a specified .log file, and move infected data to /srv/infected
Add clamav.pp manifest to control ClamAV scanning

This commit adds a manifest (clamav.pp) to Puppet in order to control ClamAV.
The manifest itself does not directly run ClamAV, but rather it contains a cron
type to run a shell script at a random number of minutes (between 0 and 60) past
every hour.
Amend binary

@dcarley is correct; the binary was incorrect.
Move /srv/infected dir to clamav.pp; set require

Move /srv/infected directory to clamav.pp and set a require param on the File
type for the shell script.
Add logrotate support

The scan-backup-data.sh script logs output to a file in /var/log. By default,
this file will then be allowed to grow indefinitely. We should curtail this by
using logrotate.

This commit adds a logrotate configuration for `/var/log/clamav/clamdscan.log',
which:

- sets the log rotation to daily
- keeps the prior seven days of logs
- compresses stored logs with gzip
- delays compression until next rotation
- doesn't halt on error
- avoids log rotation if the file is empty
- creates a new file after rotation

It also ensures the file is present in the clamav.pp Puppet manifest.
Amends rotation intervals

The comments in this file are already well documented; they serve little purpose
in-line in the file, and add extra overhead if the commands are ever changed.

The rotation interval has been changed to weekly; we keep a year's worth (52
weeks) of logs before logrotate rotates them. This was done for security
purposes.
Amend clamscan program

In it's original form, this script used `clamdscan`, rather than `clamscan`.
During testing, however, it was realised that the script died as `clamdscan` was
unable to access `/srv/infected`.

By default, AppArmor restricts the behaviour of the clamdscan executable, and
investigation using `aa-status` showed that AppArmor was holding `clamdscan` in
enforce mode. I amended AppArmor to put `clamdscan` in to complain mode
(allowing the executable to run, and logging errors, rather than disallowing it
to run entirely). This then allowed `clamdscan` to run successfully.

However, a second issue then arose: `/srv/backup-data/lost+found` was
unaccessible. `clamdscan` doesn't support the --exclude switch, whereas `clamscan`
does. To that end, the command has been changed to support `clamscan`, thereby
allowing us to exclude `lost+found` as we do not particularly care about data
stored within that folder. Unfortunately, `clamdscan` did not like the use of
the `--exclude` switch.

`clamscan` and `clamdscan` have subtle differences, it seems. The former is
meant to be run as one-off and in cron jobs; the latter is daemonized. The
former also processes the virus definitions each time it runs; the latter does
not.

After it was realised that simply changing the command from `clamdscan` to
`clamscan` allowed us to use the `--exclude` switch, I then tested to see if the
AppArmor changes were still required. It turns out that they were not - using
`clamscan` over `clamdscan` was the overall fix to the issue, and the AppArmor
changes were reverted.
Net: Add `interfaces.yaml`

The interfaces.yaml file is used by vcloud-net-spinner to apply rules to the
correct vShield Edge firewall. This commit adds an `interfaces.yaml` file to the
repository, and updates the URL appropriately.
Net: Add `firewall.rb`

This commit adds a `firewall.rb` file for use when configuring the vSE to work
with a new GOV.UK Off-site Backup machine in Carrenza.
Net: Add `jenkins.sh`

This commit adds a `jenkins.sh` file which allows for the Jenkinsisation of
network deployment jobs. The EdgeGateway's UUID has been changed to match the
`0E7T-IS-GATEWAY-002` EdgeGateway, so that rules deploy the right EG!
Net: Add `nat.rb`

The `nat.rb` file is a ruleset used to configure NAT rules on the vShield Edge
firewall. This commit adds this file.
Box: Add YAML file for use when launching boxes

The YAML file in this commit is used when launching new GOV.UK off-site backup
machines using `vcloud-launch`.
Box: Add `jenkins.sh` for use when launching boxes

This commit adds a `jenkins.sh` box for use when launching boxes using
`vcloud-launch` and a one-click Jenkinsified installation.
Add a README for configuring networking

A README for configuring networking. Very useful if you're new to the repository
and want to know how things work.
Amend BACKUP_SERVER_IPS values

There will only, currently, be one off-site backup server on Carrenza. Thus, the
IPs have been changed and the variable name has been changed from `...IPS` to
`...IP`.

It has been left variabalised in order to allow for additional IPs to be added
with limited overhead in future.