ocf_ssl: update incommon intermediate for sha2
ocf_www: use appropriate ssl chain file

We were using the bundle before, i.e. sending the server cert twice.
It worked but was unnecessary.
Rename blight -> ocf_wiki
ocf_wiki: remove gitweb config
ocf_www: quote mode appropriately for linter
Use ocf_ssl module to provide ssl for more modules

We're still hard-coding a lot of FQDNs because I don't want to spend the
time to turn the vhosts and config files that reference them into
templates and use $fqdn right now.

Eventually we should, though.
ocf_mail: send ssl bundle instead of just cert
ocf_ssl: use concat to build cert chain
ocf_www: add dev-ocf.b.e to vhost aliases

We have dev-ocf.b.e and a dev-ocf.b.e SSL cert for dev-death now, we
might as well use it.
ocf_dhcp: switch yearbook ip

yearbook.ocf.b.e is 169.229.10.216, which is an address we reserved for
them. I'm not sure why I gave them 130 instead -- probably a mistake.

(For context, we provide internet to B&G; they have a router which does
NAT in their space, which is patched into our server room. This is
probably only temporary and won't continue in the new space (not that
it's really much of a burden on us, though).)
Add ocf_filehost module for pandemic nfs
Move ocf_ssh::nfs to common::nfs

We can use the same NFS config on multiple servers (currently just ssh,
admin, and apphost -- but could also be used on www).
ocf_stats: auto-deploy latest labstats from GitHub

- Move update.cgi script into labstats repo, use that for document root.
- Ensure using vcsrepo that the latest labstats is checked out.
- Minor cleanup
Move munin master config from common to ocf_stats
ocf_stats: refactor to use apache module

I really quite like the Apache module; it makes some simpler configs a
lot cleaner (and avoids the same boilerplate everywhere for enabling
vhosts/mods/etc.

Unfortunately the munin master config is a little hairy, and while it's
now using the Apache vhost (and I think it's probably better this
way...), I'll be the first to admit it's a bit frustrating to
write/read. With a complicated config file it probably makes more sense
to just turn the file into a template and puppet it...

P.S. puppet-lint has annoying rules that make hash indentation look
really, really terrible. I've never found a way I like to indent sparse
hashes, but this one isn't terrible:

  { rewrite_rule => '^/favicon.ico /var/cache/munin/www/static/favicon.ico [L]' },
  { rewrite_rule => '^/static/(.*) /var/cache/munin/www/static/$1 [L]' },
  { rewrite_rule => '^(/.*\.html)?$ /munin-cgi/munin-cgi-html/$1 [PT]' },

Unfortunately, puppet-lint refuses to accept this syntax, and makes me
do this instead:

  {
    rewrite_rule => '^/favicon.ico /var/cache/munin/www/static/favicon.ico [L]'
  },
  {
    rewrite_rule => '^/static/(.*) /var/cache/munin/www/static/$1 [L]'
  },
  {
    rewrite_rule => '^(/.*\.html)?$ /munin-cgi/munin-cgi-html/$1 [PT]'
  },

...oh well :(
ocf_stats: add more aliases for stats www
ocf_apphost: add apparmor
Revert "ocf_apphost: add apparmor"

We can't use apparmor currently because the networking stack doesn't
support per-port granularity in restricting binds. Committed and
reverted just to have a record of the changes, even though we won't use
them now.
Add biohazard as login server
ocf_apphost: add proxy and vhost config