Install `pdxcat/nrpe` module

The `pdxcat/nrpe` module allows us to configure NRPE on client machines. It was
chosen for a number of reasons:

- it does not require any dependencies: a lot of other modules on the Puppet
  Forge did, and bringing these in to the mix would then add additional layers
  of complication which I did not wish to introduce

- re-using other people's code is a [Good
  Thing(TM)](https://gds.blog.gov.uk/2012/10/12/coding-in-the-open/) to continue
  our strategy of coding in the open

This commit adds the `pdxcat/nrpe` module to our Puppetfile (and the
Puppetfile.lock using librarian-puppet).
Add NRPE to auto-loadable classes

This repository uses Hiera as a lightweight ENC, therefore this commit adds the
`pdxcat/nrpe` module to the array of classes which we autoload.
Open tcp/5666 in UFW

NRPE listens on tcp/5666 - without this port open, NRPE won't be able to work
correctly. This commit opens the port in UFW from any IP. Opening up this port
might seem like a bit of a security hole - and we can revisit it later if it is
deemed to be - but we will be locking down the hosts which NRPE can interact
with using the NRPE module.

Netcat shows that this commit has opened tcp/5666 (172.16.10.10 is my local
Vagrant VM's IP):

nc -v 172.16.10.10 5666
found 0 associations
found 1 connections:
     1: flags=82<CONNECTED,PREFERRED>
        outif vboxnet7
        src 172.16.10.1 port 62118
        dst 172.16.10.10 port 5666
        rank info not available
        TCP aux info available

Connection to 172.16.10.10 port 5666 [tcp/*] succeeded!
Open tcp/5666 on vSE

NRPE requires tcp\5666 to be opened on the vShield Edge in order for traffic
to flow. This commit does that, and restricts the traffic flowing
unidirectionally between the Icinga box and the off-site back-up box.
Set NRPE's allowed hosts

NRPE and Nagios interact using a client-server model, with NRPE being the server
and Nagios being the client. Nagios requests data from NRPE, hence why NRPE is
the server. NRPE is, in essence, a way to perform remote code execution so it is
especially important that we restrict which clients can connect to it and
perform code execution - anything that is not our production Nagios instance
should not be allowed to connect to it.

Our Nagios instance will respond, like all machines, from the SNAT IP in the
vSE - 37.26.90.227. It is, therefore, this IP that has been included in the
allowed_hosts directive. The inclusion of 127.0.0.1 is best practice, according
to the web, to allow for testing.
Create check_disk NRPE command in Hiera

The pdxcat/nrpe Puppet Forge module allows us to specify allowed NRPE commands.
This ensures that `allowed_hosts` are only allowed to run commands specified by
`allowed_commands`.

We set the arguments to `check_disk` in NRPE to ensure that, for security
reasons, arguments cannot be injected on-the-wire between monitoring host and
remote host.
Merge pull request #35 from alphagov/add-nrpe

Configure NRPE to check /dev/mapper/backup-data
Revert `ecac72c`

This commit reverts the firewall changes made in `ecac72c` to allow us to
copy old off-site backup data from the Memset MiniServer VM to the new
Carrenza machine.