tweak ulimits (in ubuntu?) with puppet

limits.pp

define helpers::limits (
  $domain = "root",
  $type = "soft",
  $item = "nofile",
  $value = "10000"
  ) {

    # guid of this entry
    $key = "$domain/$type/$item"

    # augtool> match /files/etc/security/limits.conf/domain[.="root"][./type="hard" and ./item="nofile" and ./value="10000"]

    $context = "/files/etc/security/limits.conf"

    $path_list  = "domain[.=\"$domain\"][./type=\"$type\" and ./item=\"$item\"]"
    $path_exact = "domain[.=\"$domain\"][./type=\"$type\" and ./item=\"$item\" and ./value=\"$value\"]"

    augeas { "limits_conf/$key":
       context => "$context",
       onlyif  => "match $path_exact size != 1",
       changes => [
         # remove all matching to the $domain, $type, $item, for any $value
         "rm $path_list", 
         # insert new node at the end of tree
         "set domain[last()+1] $domain",
         # assign values to the new node
         "set domain[last()]/type $type",
         "set domain[last()]/item $item",
         "set domain[last()]/value $value",
       ],
     }
}

pamd.pp

define helpers::pamd (
  $type    = "session",
  $control = "required",
  $module,
  ) {

    # guid of this entry
    $key = "$type/$control/$module"

    $context = "/files/etc/pam.d/common-session"

    $path_list  = "*[type=\"$type\"][module=\"$module\"]"
    $path_exact = "*[type=\"$type\"][control=\"$control\"][module=\"$module\"]"

    augeas { "pamd/$key":
       context => "$context",
       onlyif  => "match $path_exact size != 1",
       changes => [
         "rm $path_list", 
         "ins 1000000 after *[last()]",
         "set 1000000/type $type",
         "set 1000000/control $control",
         "set 1000000/module $module",
       ],
     }
}

usage.pp

class usage () {
  helpers::pamd { 
    "enable-pamd-limits": module =>  "pam_limits.so";
  }

  helpers::limits { 
    "myuser-soft": domain => root, type => soft, item => nofile, value =>  9999;
    "myuser-hard": domain => root, type => hard, item => nofile, value =>  9999;
  }
}