summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMicah Anderson <micah@riseup.net>2013-03-31 12:39:36 -0400
committerMicah Anderson <micah@riseup.net>2013-04-02 10:21:06 -0400
commit128c8ddfd4969a9b9b525cb4f4a34b1e98c2fe76 (patch)
treecf197012d4ae1d2ba4f3f616b6d65ce668646162
parentbaf3ed5b6db4e8af052564864d8c3e426cf5d9d0 (diff)
shorewall:
create a macro for the bigcouch replication server stunnel to enable these connections pulling bigcouch_replication_clients, bigcouch_replication_server_port from hiera create site_shorewall::couchdb::dnat and create_resources to properly setup DNAT for bigcouch_replication_clients
-rw-r--r--puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp30
-rw-r--r--puppet/modules/site_shorewall/manifests/couchdb/dnat.pp21
2 files changed, 50 insertions, 1 deletions
diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp
index 2afdea87..a0d63d15 100644
--- a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp
+++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp
@@ -2,6 +2,34 @@ class site_shorewall::couchdb::bigcouch {
include site_shorewall::defaults
- create_resources(site_shorewall::dnat, hiera('shorewall_dnat'))
+ $stunnel = hiera('stunnel')
+ $bigcouch_replication_clients = $stunnel['bigcouch_replication_clients']
+
+ $bigcouch_replication_server = $stunnel['bigcouch_replication_server']
+ $bigcouch_replication_server_port = $bigcouch_replication_server['accept']
+
+ # define macro for incoming services
+ file { '/etc/shorewall/macro.leap_bigcouch':
+ content => "PARAM - - tcp ${bigcouch_replication_server_port}",
+ notify => Service['shorewall'],
+ require => Package['shorewall']
+ }
+
+ shorewall::rule {
+ 'net2fw-bigcouch':
+ source => 'net',
+ destination => '$FW',
+ action => 'leap_bigcouch(ACCEPT)',
+ order => 300;
+ }
+
+ $bigcouch_shorewall_dnat_defaults = {
+ 'source' => '$FW',
+ 'proto' => 'tcp',
+ 'destinationport' => '4369',
+ }
+
+ create_resources(site_shorewall::couchdb::dnat, $bigcouch_replication_clients, $bigcouch_shorewall_dnat_defaults)
}
+
diff --git a/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp
new file mode 100644
index 00000000..85cea9d5
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp
@@ -0,0 +1,21 @@
+define site_shorewall::couchdb::dnat (
+ $source,
+ $connect,
+ $connect_port,
+ $accept_port,
+ $proto,
+ $destinationport )
+{
+
+
+ shorewall::rule {
+ "dnat_${name}_${destinationport}":
+ source => $source,
+ destination => "\$FW:127.0.0.1:${accept_port}",
+ destinationport => $destinationport,
+ originaldest => $connect,
+ proto => $proto,
+ order => 200,
+ action => 'DNAT';
+ }
+}