diff options
| author | Micah Anderson <micah@riseup.net> | 2013-03-31 12:32:42 -0400 |
|---|---|---|
| committer | Micah Anderson <micah@riseup.net> | 2013-04-02 10:21:06 -0400 |
| commit | baf3ed5b6db4e8af052564864d8c3e426cf5d9d0 (patch) | |
| tree | 7715f88b8d9df86e9bb3432ab92b9eef0902fd1f | |
| parent | dd459efb1063de6c11f9f11583290c6a0891436a (diff) | |
switch to using stunnel_client and stunnel_server leap_cli macros
add bigcouch_replication_clients to couchdb.json
change site_couchdb/manifests/stunnel to use stunnel_client and stunnel_server
generated hiera values to setup the stunnels for the couch_server connections,
and the bigcouch_replication_server and bigcouch_replication_clients tunnels
instead of using hard-coded ips and ports.
also change the pid names to be more consistent with what the tunnels are and
are named
| -rw-r--r-- | provider_base/services/couchdb.json | 3 | ||||
| -rw-r--r-- | puppet/modules/site_couchdb/manifests/stunnel.pp | 41 |
2 files changed, 28 insertions, 16 deletions
diff --git a/provider_base/services/couchdb.json b/provider_base/services/couchdb.json index 41f9695f..c00f08cd 100644 --- a/provider_base/services/couchdb.json +++ b/provider_base/services/couchdb.json @@ -5,7 +5,8 @@ }, "stunnel": { "couch_server": "= stunnel_server(couch.port)", - "bigcouch_replication_server": "= stunnel_server(couch.bigcouch.port)" + "bigcouch_replication_server": "= stunnel_server(couch.bigcouch.port)", + "bigcouch_replication_clients": "= stunnel_client(nodes_like_me[:services => :couchdb], global.services[:couchdb].couch.bigcouch.port)" }, "couch": { "port": 5984, diff --git a/puppet/modules/site_couchdb/manifests/stunnel.pp b/puppet/modules/site_couchdb/manifests/stunnel.pp index a49b51b9..1eb79293 100644 --- a/puppet/modules/site_couchdb/manifests/stunnel.pp +++ b/puppet/modules/site_couchdb/manifests/stunnel.pp @@ -1,13 +1,26 @@ class site_couchdb::stunnel ($key, $cert, $ca) { - include x509::variables + $stunnel = hiera('stunnel') + + $couch_server = $stunnel['couch_server'] + $couch_server_accept = $couch_server['accept'] + $couch_server_connect = $couch_server['connect'] + + $bigcouch_replication_server = $stunnel['bigcouch_replication_server'] + $bigcouch_replication_server_accept = $bigcouch_replication_server['accept'] + $bigcouch_replication_server_connect = $bigcouch_replication_server['connect'] + $bigcouch_replication_clients = $stunnel['bigcouch_replication_clients'] + + include x509::variables $cert_name = 'leap_couchdb' $ca_name = 'leap_ca' $ca_path = "${x509::variables::local_CAs}/${ca_name}.crt" $cert_path = "${x509::variables::certs}/${cert_name}.crt" $key_path = "${x509::variables::keys}/${cert_name}.key" + # basic setup: ensure cert, key, ca files are in place, and some generic + # stunnel things are done class { 'site_stunnel::setup': cert_name => $cert_name, key => $key, @@ -15,45 +28,43 @@ class site_couchdb::stunnel ($key, $cert, $ca) { ca => $ca } - # webapp access - stunnel::service { 'couchdb': - accept => '6984', - connect => '127.0.0.1:5984', + # setup a stunnel server for the webapp to connect to couchdb + stunnel::service { 'couch_server': + accept => $couch_server_accept, + connect => $couch_server_connect, client => false, cafile => $ca_path, key => $key_path, cert => $cert_path, verify => '2', - pid => '/var/run/stunnel4/bigcouch.pid', + pid => '/var/run/stunnel4/couchserver.pid', rndfile => '/var/lib/stunnel4/.rnd', debuglevel => '4' } - # clustering between bigcouch nodes + # setup stunnels for bigcouch clustering between each bigcouchdb node # server - stunnel::service { 'bigcouch': - accept => '5369', - connect => '127.0.0.1:4369', + stunnel::service { 'bigcouch_replication_server': + accept => $bigcouch_replication_server_accept, + connect => $bigcouch_replication_server_connect, client => false, cafile => $ca_path, key => $key_path, cert => $cert_path, verify => '2', - pid => '/var/run/stunnel4/couchdb.pid', + pid => '/var/run/stunnel4/bigcouchreplication_server.pid', rndfile => '/var/lib/stunnel4/.rnd', debuglevel => '4' } # clients - $couchdb_stunnel_client_defaults = { - 'connect_port' => '5369', + $bigcouch_replication_client_defaults = { 'client' => true, 'cafile' => $ca_path, 'key' => $key_path, 'cert' => $cert_path, } - create_resources(site_stunnel::clients, hiera('stunnel'), $couchdb_stunnel_client_defaults) + create_resources(site_stunnel::clients, $bigcouch_replication_clients, $bigcouch_replication_client_defaults) } - |