Merge branch 'develop' (0.5.0)

Conflicts:
	.gitignore

Change-Id: I778f3e1f1f4832f5894bc149ead67e9a4becf304

28 files changed, 409 insertions, 32 deletions

diff --git a/puppet/modules/site_config/manifests/caching_resolver.pp b/puppet/modules/site_config/manifests/caching_resolver.pp
index 922c394f..3d7b9206 100644
--- a/puppet/modules/site_config/manifests/caching_resolver.pp
+++ b/puppet/modules/site_config/manifests/caching_resolver.pp
@@ -1,4 +1,5 @@
 class site_config::caching_resolver {
+  tag 'leap_base'
 
   # Setup a conf.d directory to place additional unbound configuration files.
   # There must be at least one file in the directory, or unbound will not start,
diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index 00eee9d0..7e421a21 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -2,19 +2,27 @@ class site_config::default {
   tag 'leap_base'
 
   $domain_hash = hiera('domain')
+  include site_config::params
 
-  include concat::setup
+  # make sure apt is updated before any packages are installed
+  include apt::update
+  Package { require => Exec['apt_updated'] }
+
+  include site_config::slow
 
   # default class, used by all hosts
 
   include lsb, git
 
-  # configure apt
-  include site_apt
+  # configure sysctl parameters
+  include site_config::sysctl
 
   # configure ssh and include ssh-keys
   include site_config::sshd
 
+  # include classes for special environments
+  # i.e. openstack/aws nodes, vagrant nodes
+
   # fix dhclient from changing resolver information
   if $::ec2_instance_id {
     include site_config::dhclient
@@ -26,13 +34,11 @@ class site_config::default {
   # configure caching, local resolver
   include site_config::caching_resolver
 
-  # configure /etc/hosts
-  class { 'site_config::hosts':
-    stage => setup,
-  }
+  # install/configure syslog
+  include site_config::syslog
 
   # install/remove base packages
-  include site_config::base_packages
+  include site_config::packages::base
 
   # include basic shorewall config
   include site_shorewall::defaults
@@ -41,4 +47,19 @@ class site_config::default {
 
   # include basic shell config
   include site_config::shell
+
+  # set up core leap files and directories
+  include site_config::files
+
+  if $::services !~ /\bmx\b/ {
+    include site_postfix::satellite
+  }
+
+  # if class site_custom exists, include it.
+  # possibility for users to define custom puppet recipes
+  if defined( '::site_custom') {
+    include ::site_custom
+  }
+
+  include site_check_mk::agent
 }
diff --git a/puppet/modules/site_config/manifests/files.pp b/puppet/modules/site_config/manifests/files.pp
new file mode 100644
index 00000000..684d3ad0
--- /dev/null
+++ b/puppet/modules/site_config/manifests/files.pp
@@ -0,0 +1,23 @@
+class site_config::files {
+
+  file {
+    '/srv/leap':
+      ensure  => directory,
+      owner   => 'root',
+      group   => 'root',
+      mode    => '0711';
+
+    '/var/lib/leap':
+      ensure => directory,
+      owner  => root,
+      group  => 'root',
+      mode   => '0755';
+
+    '/var/log/leap':
+      ensure => directory,
+      owner  => root,
+      group  => 'adm',
+      mode   => '0750';
+  }
+
+}
diff --git a/puppet/modules/site_config/manifests/hosts.pp b/puppet/modules/site_config/manifests/hosts.pp
index ccedf036..e5d4dd70 100644
--- a/puppet/modules/site_config/manifests/hosts.pp
+++ b/puppet/modules/site_config/manifests/hosts.pp
@@ -1,8 +1,9 @@
 class site_config::hosts() {
-  $hosts         = hiera('hosts','')
+  $hosts         = hiera('hosts', false)
   $hostname      = hiera('name')
   $domain_hash   = hiera('domain')
   $domain_public = $domain_hash['full_suffix']
+  $api           = hiera('api', '')
 
   file { '/etc/hostname':
     ensure  => present,
diff --git a/puppet/modules/site_config/manifests/initial_firewall.pp b/puppet/modules/site_config/manifests/initial_firewall.pp
new file mode 100644
index 00000000..51cceb31
--- /dev/null
+++ b/puppet/modules/site_config/manifests/initial_firewall.pp
@@ -0,0 +1,62 @@
+class site_config::initial_firewall {
+
+  # This class is intended to setup an initial firewall, before shorewall is
+  # configured. The purpose of this is for the rare case where shorewall fails
+  # to start, we should not expose services to the public.
+
+  $ssh_config = hiera('ssh')
+  $ssh_port   = $ssh_config['port']
+
+  package { 'iptables':
+    ensure => present
+  }
+
+  file {
+    # This firewall enables ssh access, dns lookups and web lookups (for
+    # package installation) but otherwise restricts all outgoing and incoming
+    # ports
+    '/etc/network/ipv4firewall_up.rules':
+      content => template('site_config/ipv4firewall_up.rules.erb'),
+      owner   => root,
+      group   => 0,
+      mode    => '0644';
+
+    # This firewall denys all ipv6 traffic - we will need to change this
+    # when we begin to support ipv6
+    '/etc/network/ipv6firewall_up.rules':
+      content => template('site_config/ipv6firewall_up.rules.erb'),
+      owner   => root,
+      group   => 0,
+      mode    => '0644';
+
+    # Run the iptables-restore in if-pre-up so that the network is locked down
+    # until the correct interfaces and ips are connected
+    '/etc/network/if-pre-up.d/ipv4tables':
+      content => "#!/bin/sh\n/sbin/iptables-restore < /etc/network/ipv4firewall_up.rules\n",
+      owner   => root,
+      group   => 0,
+      mode    => '0744';
+
+    # Same as above for IPv6
+    '/etc/network/if-pre-up.d/ipv6tables':
+      content => "#!/bin/sh\n/sbin/ip6tables-restore < /etc/network/ipv6firewall_up.rules\n",
+      owner   => root,
+      group   => 0,
+      mode    => '0744';
+  }
+
+  # Immediately setup these firewall rules, but only if shorewall is not running
+  exec {
+    'default_ipv4_firewall':
+      command   => '/sbin/iptables-restore < /etc/network/ipv4firewall_up.rules',
+      logoutput => true,
+      unless    => 'test -x /etc/init.d/shorewall && /etc/init.d/shorewall status',
+      require   => File['/etc/network/ipv4firewall_up.rules'];
+
+    'default_ipv6_firewall':
+      command   => '/sbin/ip6tables-restore < /etc/network/ipv6firewall_up.rules',
+      logoutput => true,
+      unless    => 'test -x /etc/init.d/shorewall && /etc/init.d/shorewall status',
+      require   => File['/etc/network/ipv6firewall_up.rules'];
+  }
+}
diff --git a/puppet/modules/site_config/manifests/base_packages.pp b/puppet/modules/site_config/manifests/packages/base.pp
index 3d40f7a2..ae47963c 100644
--- a/puppet/modules/site_config/manifests/base_packages.pp
+++ b/puppet/modules/site_config/manifests/packages/base.pp
@@ -1,12 +1,13 @@
-class site_config::base_packages {
+class site_config::packages::base {
+
 
   # base set of packages that we want to have installed everywhere
-  package { [ 'etckeeper', 'screen', 'less' ]:
+  package { [ 'etckeeper', 'screen', 'less', 'ntp' ]:
     ensure => installed,
   }
 
   # base set of packages that we want to remove everywhere
-  package { [ 'acpi', 'acpid', 'acpi-support-base',  'eject', 'ftp',
+  package { [ 'acpi', 'acpid', 'acpi-support-base',  'eject', 'ftp', 'fontconfig-config',
               'laptop-detect', 'lpr', 'nfs-common', 'nfs-kernel-server',
               'portmap', 'pppconfig', 'pppoe', 'pump', 'qstat', 'rpcbind',
               'samba-common', 'samba-common-bin', 'smbclient', 'tcl8.5',
@@ -14,15 +15,4 @@ class site_config::base_packages {
               'x11-utils', 'xterm' ]:
     ensure => absent;
   }
-
-  if $::virtual == 'virtualbox' {
-    $virtualbox_ensure = present
-  } else {
-    $virtualbox_ensure = absent
-  }
-
-  package { [ 'build-essential', 'fontconfig-config', 'g++', 'g++-4.7', 'gcc',
-              'gcc-4.6', 'gcc-4.7', 'cpp', 'cpp-4.6', 'cpp-4.7', 'libc6-dev' ]:
-                ensure => $virtualbox_ensure
-  }
 }
diff --git a/puppet/modules/site_config/manifests/packages/build_essential.pp b/puppet/modules/site_config/manifests/packages/build_essential.pp
new file mode 100644
index 00000000..7dfb8b03
--- /dev/null
+++ b/puppet/modules/site_config/manifests/packages/build_essential.pp
@@ -0,0 +1,11 @@
+#
+# include this whenever you want to ensure build-essential package and related compilers are installed.
+#
+class site_config::packages::build_essential {
+  if !defined(Package['build-essential']) {
+    package {
+      ['build-essential', 'g++', 'g++-4.7', 'gcc', 'gcc-4.6', 'gcc-4.7', 'cpp', 'cpp-4.6', 'cpp-4.7', 'libc6-dev']:
+        ensure => present
+    }
+  }
+}
\ No newline at end of file
diff --git a/puppet/modules/site_config/manifests/packages/gnutls.pp b/puppet/modules/site_config/manifests/packages/gnutls.pp
new file mode 100644
index 00000000..b1f17480
--- /dev/null
+++ b/puppet/modules/site_config/manifests/packages/gnutls.pp
@@ -0,0 +1,5 @@
+class site_config::packages::gnutls {
+
+  package { 'gnutls-bin': ensure => installed }
+
+}
diff --git a/puppet/modules/site_config/manifests/packages/uninstall.pp b/puppet/modules/site_config/manifests/packages/uninstall.pp
new file mode 100644
index 00000000..12f527d9
--- /dev/null
+++ b/puppet/modules/site_config/manifests/packages/uninstall.pp
@@ -0,0 +1,16 @@
+#
+# Uninstall build-essential and compilers, unless they have been explicitly installed elsewhere.
+#
+class site_config::packages::uninstall {
+  tag 'leap_base'
+
+  # generally, dev packages are needed for installing ruby gems with native extensions.
+  # (nickserver, webapp, etc)
+
+  if !defined(Package['build-essential']) {
+    package {
+      ['build-essential', 'g++', 'g++-4.7', 'gcc', 'gcc-4.6', 'gcc-4.7', 'cpp', 'cpp-4.6', 'cpp-4.7', 'libc6-dev']:
+        ensure => purged
+    }
+  }
+}
\ No newline at end of file
diff --git a/puppet/modules/site_config/manifests/params.pp b/puppet/modules/site_config/manifests/params.pp
index 237ee454..012b3ce0 100644
--- a/puppet/modules/site_config/manifests/params.pp
+++ b/puppet/modules/site_config/manifests/params.pp
@@ -3,9 +3,12 @@ class site_config::params {
   $ip_address               = hiera('ip_address')
   $ip_address_interface     = getvar("interface_${ip_address}")
   $ec2_local_ipv4_interface = getvar("interface_${::ec2_local_ipv4}")
+  $environment              = hiera('environment', undef)
 
-  if $::virtual == 'virtualbox' {
-    $interface = [ 'eth0', 'eth1' ]
+
+  if $environment == 'local' {
+    $interface = 'eth1'
+    include site_config::packages::build_essential
   }
   elsif hiera('interface','') != '' {
     $interface = hiera('interface')
@@ -17,9 +20,16 @@ class site_config::params {
     $interface = $ec2_local_ipv4_interface
   }
   elsif $::interfaces =~ /eth0/ {
-    $interface = eth0
+    $interface = 'eth0'
   }
   else {
     fail("unable to determine a valid interface, please set a valid interface for this node in nodes/${::hostname}.json")
   }
+
+  $ca_name              = 'leap_ca'
+  $client_ca_name       = 'leap_client_ca'
+  $ca_bundle_name       = 'leap_ca_bundle'
+  $cert_name            = 'leap'
+  $commercial_ca_name   = 'leap_commercial_ca'
+  $commercial_cert_name = 'leap_commercial'
 }
diff --git a/puppet/modules/site_config/manifests/resolvconf.pp b/puppet/modules/site_config/manifests/resolvconf.pp
index 271c5043..05990c67 100644
--- a/puppet/modules/site_config/manifests/resolvconf.pp
+++ b/puppet/modules/site_config/manifests/resolvconf.pp
@@ -2,12 +2,13 @@ class site_config::resolvconf {
 
   $domain_public = $site_config::default::domain_hash['full_suffix']
 
-  # 127.0.0.1:      caching-only local bind
-  # 87.118.100.175: http://server.privacyfoundation.de
-  # 62.141.58.13:   http://www.privacyfoundation.ch/de/service/server.html
   class { '::resolvconf':
     domain      => $domain_public,
     search      => $domain_public,
-    nameservers => [ '127.0.0.1', '87.118.100.175', '62.141.58.13' ]
+    nameservers => [
+      '127.0.0.1      # local caching-only, unbound',
+      '85.214.20.141  # Digitalcourage, a german privacy organisation: (https://en.wikipedia.org/wiki/Digitalcourage)',
+      '77.109.138.45  # Swiss privacy Foundation (http://www.privacyfoundation.ch/de/service/server.html)'
+    ]
   }
 }
diff --git a/puppet/modules/site_config/manifests/ruby/dev.pp b/puppet/modules/site_config/manifests/ruby/dev.pp
new file mode 100644
index 00000000..3ea6ca96
--- /dev/null
+++ b/puppet/modules/site_config/manifests/ruby/dev.pp
@@ -0,0 +1,8 @@
+class site_config::ruby::dev inherits site_config::ruby {
+  Class['::ruby'] {
+    ruby_version => '1.9.3',
+    install_dev  => true
+  }
+  # building gems locally probably requires build-essential and gcc:
+  include site_config::packages::build_essential
+}
diff --git a/puppet/modules/site_config/manifests/setup.pp b/puppet/modules/site_config/manifests/setup.pp
new file mode 100644
index 00000000..6d89be86
--- /dev/null
+++ b/puppet/modules/site_config/manifests/setup.pp
@@ -0,0 +1,50 @@
+class site_config::setup {
+  tag 'leap_base'
+
+  #
+  # this is applied before each run of site.pp
+  #
+  #$services = ''
+
+  Exec { path => '/usr/bin:/usr/sbin/:/bin:/sbin:/usr/local/bin:/usr/local/sbin' }
+
+  include site_config::params
+
+  include concat::setup
+  include stdlib
+
+  # configure /etc/hosts
+  class { 'site_config::hosts':
+    stage => setup,
+  }
+
+  include site_config::initial_firewall
+
+  include site_apt
+
+  package { 'facter':
+    ensure  => latest,
+    require => Exec['refresh_apt']
+  }
+
+  # if squid_deb_proxy_client is set to true, install and configure
+  # squid_deb_proxy_client for apt caching
+  if hiera('squid_deb_proxy_client', false) {
+    include site_squid_deb_proxy::client
+  }
+
+  # shorewall is installed/half-configured during setup.pp (Bug #3871)
+  # we need to include shorewall::interface{eth0} in setup.pp so
+  # packages can be installed during main puppetrun, even before shorewall
+  # is configured completly
+  if ( $::site_config::params::environment == 'local' ) {
+    include site_config::vagrant
+  }
+
+  # if class site_custom::setup exists, include it.
+  # possibility for users to define custom puppet recipes
+  if defined( '::site_custom::setup') {
+    include ::site_custom::setup
+  }
+
+}
diff --git a/puppet/modules/site_config/manifests/sysctl.pp b/puppet/modules/site_config/manifests/sysctl.pp
new file mode 100644
index 00000000..99f75123
--- /dev/null
+++ b/puppet/modules/site_config/manifests/sysctl.pp
@@ -0,0 +1,8 @@
+class site_config::sysctl {
+
+  sysctl::config {
+    'net.ipv4.ip_nonlocal_bind':
+      value   => 1,
+      comment => 'Allow applications to bind to an address when link is down (see https://leap.se/code/issues/4506)'
+  }
+}
diff --git a/puppet/modules/site_config/manifests/syslog.pp b/puppet/modules/site_config/manifests/syslog.pp
new file mode 100644
index 00000000..d3abeca1
--- /dev/null
+++ b/puppet/modules/site_config/manifests/syslog.pp
@@ -0,0 +1,28 @@
+class site_config::syslog {
+
+  # we need to pull in rsyslog from the leap repository until it is availbale in
+  # wheezy-backports
+  apt::preferences_snippet { 'fixed_rsyslog_anon_package':
+    package  => 'rsyslog*',
+    priority => '999',
+    pin      => 'release o=leap.se',
+    before   => Class['rsyslog::install']
+  }
+
+  apt::preferences_snippet { 'rsyslog_anon_depends':
+    package  => 'libestr0 librelp0',
+    priority => '999',
+    pin      => 'release a=wheezy-backports',
+    before   => Class['rsyslog::install']
+  }
+
+  class { 'rsyslog::client':
+    log_remote => false,
+    log_local  => true
+  }
+
+  rsyslog::snippet { '00-anonymize_logs':
+    content => '$ModLoad mmanon
+action(type="mmanon" ipv4.bits="32" mode="rewrite")'
+  }
+}
diff --git a/puppet/modules/site_config/manifests/vagrant.pp b/puppet/modules/site_config/manifests/vagrant.pp
new file mode 100644
index 00000000..8f50b305
--- /dev/null
+++ b/puppet/modules/site_config/manifests/vagrant.pp
@@ -0,0 +1,11 @@
+class site_config::vagrant {
+  # class for vagrant nodes
+
+  include site_shorewall::defaults
+  # eth0 on vagrant nodes is the uplink if
+  shorewall::interface { 'eth0':
+    zone      => 'net',
+    options   => 'tcpflags,blacklist,nosmurfs';
+  }
+
+}
diff --git a/puppet/modules/site_config/manifests/x509/ca.pp b/puppet/modules/site_config/manifests/x509/ca.pp
new file mode 100644
index 00000000..b16d0eeb
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/ca.pp
@@ -0,0 +1,9 @@
+class site_config::x509::ca {
+
+  $x509      = hiera('x509')
+  $ca        = $x509['ca_cert']
+
+  x509::ca { $site_config::params::ca_name:
+    content => $ca
+  }
+}
diff --git a/puppet/modules/site_config/manifests/x509/ca_bundle.pp b/puppet/modules/site_config/manifests/x509/ca_bundle.pp
new file mode 100644
index 00000000..4cbe574a
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/ca_bundle.pp
@@ -0,0 +1,16 @@
+class site_config::x509::ca_bundle {
+
+  # CA bundle -- we want to have the possibility of allowing multiple CAs.
+  # For now, the reason is to transition to using client CA. In the future,
+  # we will want to be able to smoothly phase out one CA and phase in another.
+  # I tried "--capath" for this, but it did not work.
+
+
+  $x509      = hiera('x509')
+  $ca        = $x509['ca_cert']
+  $client_ca = $x509['client_ca_cert']
+
+  x509::ca { $site_config::params::ca_bundle_name:
+    content => "${ca}${client_ca}"
+  }
+}
diff --git a/puppet/modules/site_config/manifests/x509/cert.pp b/puppet/modules/site_config/manifests/x509/cert.pp
new file mode 100644
index 00000000..7ed42959
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/cert.pp
@@ -0,0 +1,10 @@
+class site_config::x509::cert {
+
+  $x509      = hiera('x509')
+  $cert      = $x509['cert']
+
+  x509::cert { $site_config::params::cert_name:
+    content => $cert
+  }
+
+}
diff --git a/puppet/modules/site_config/manifests/x509/client_ca/ca.pp b/puppet/modules/site_config/manifests/x509/client_ca/ca.pp
new file mode 100644
index 00000000..0f313898
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/client_ca/ca.pp
@@ -0,0 +1,14 @@
+class site_config::x509::client_ca::ca {
+
+  ##
+  ## This is for the special CA that is used exclusively for generating
+  ## client certificates by the webapp.
+  ##
+
+  $x509 = hiera('x509')
+  $cert = $x509['client_ca_cert']
+
+  x509::ca { $site_config::params::client_ca_name:
+    content => $cert
+  }
+}
diff --git a/puppet/modules/site_config/manifests/x509/client_ca/key.pp b/puppet/modules/site_config/manifests/x509/client_ca/key.pp
new file mode 100644
index 00000000..f9ef3f52
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/client_ca/key.pp
@@ -0,0 +1,14 @@
+class site_config::x509::client_ca::key {
+
+  ##
+  ## This is for the special CA that is used exclusively for generating
+  ## client certificates by the webapp.
+  ##
+
+  $x509 = hiera('x509')
+  $key  = $x509['client_ca_key']
+
+  x509::key { $site_config::params::client_ca_name:
+    content => $key
+  }
+}
diff --git a/puppet/modules/site_config/manifests/x509/commercial/ca.pp b/puppet/modules/site_config/manifests/x509/commercial/ca.pp
new file mode 100644
index 00000000..8f35759f
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/commercial/ca.pp
@@ -0,0 +1,9 @@
+class site_config::x509::commercial::ca {
+
+  $x509      = hiera('x509')
+  $ca        = $x509['commercial_ca_cert']
+
+  x509::ca { $site_config::params::commercial_ca_name:
+    content => $ca
+  }
+}
diff --git a/puppet/modules/site_config/manifests/x509/commercial/cert.pp b/puppet/modules/site_config/manifests/x509/commercial/cert.pp
new file mode 100644
index 00000000..0c71a705
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/commercial/cert.pp
@@ -0,0 +1,10 @@
+class site_config::x509::commercial::cert {
+
+  $x509      = hiera('x509')
+  $cert      = $x509['commercial_cert']
+
+  x509::cert { $site_config::params::commercial_cert_name:
+    content => $cert
+  }
+
+}
diff --git a/puppet/modules/site_config/manifests/x509/commercial/key.pp b/puppet/modules/site_config/manifests/x509/commercial/key.pp
new file mode 100644
index 00000000..d32e85ef
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/commercial/key.pp
@@ -0,0 +1,9 @@
+class site_config::x509::commercial::key {
+
+  $x509      = hiera('x509')
+  $key       = $x509['commercial_key']
+
+  x509::key { $site_config::params::commercial_cert_name:
+    content => $key
+  }
+}
diff --git a/puppet/modules/site_config/manifests/x509/key.pp b/puppet/modules/site_config/manifests/x509/key.pp
new file mode 100644
index 00000000..32b59726
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/key.pp
@@ -0,0 +1,9 @@
+class site_config::x509::key {
+
+  $x509      = hiera('x509')
+  $key       = $x509['key']
+
+  x509::key { $site_config::params::cert_name:
+    content => $key
+  }
+}
diff --git a/puppet/modules/site_config/templates/hosts b/puppet/modules/site_config/templates/hosts
index 2c784b05..bfcabaa5 100644
--- a/puppet/modules/site_config/templates/hosts
+++ b/puppet/modules/site_config/templates/hosts
@@ -1,10 +1,12 @@
 # This file is managed by puppet, any changes will be overwritten!
 
 127.0.0.1    localhost
-127.0.1.1    <%= @hostname %>.<%= @domain_public %> <%= @hostname %>
+127.0.1.1    <%= @hostname %>.<%= @domain_public %> <%= @hostname %> <% if (defined? @services) and (@services.include? 'webapp') -%><%= @domain_public %> <%= @api['domain'] %><% end -%>
+
 
 <%- if @hosts then -%>
-<%   @hosts.each do |name, props| -%>
+<%   @hosts.keys.sort.each do |name| -%>
+<%-     props = @hosts[name] -%>
 <%=     props["ip_address"] %> <%= props["domain_full"] %> <%= props["domain_internal"] %> <%= name %>
 <%   end -%>
 <% end -%>
diff --git a/puppet/modules/site_config/templates/ipv4firewall_up.rules.erb b/puppet/modules/site_config/templates/ipv4firewall_up.rules.erb
new file mode 100644
index 00000000..524ae308
--- /dev/null
+++ b/puppet/modules/site_config/templates/ipv4firewall_up.rules.erb
@@ -0,0 +1,22 @@
+# Generated by iptables-save v1.4.14 on Tue Aug 20 14:40:40 2013
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT DROP [0:0]
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -p tcp -m state --state NEW,ESTABLISHED --dport <%= @ssh_port %> -j ACCEPT
+-A INPUT -p udp -m udp --sport 53 -j ACCEPT
+-A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -p icmp -m icmp --icmp-type 0 -m state --state RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
+-A OUTPUT -o lo -j ACCEPT
+-A OUTPUT -p icmp -m icmp --icmp-type 0 -m state --state RELATED,ESTABLISHED -j ACCEPT
+-A OUTPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
+-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED --sport <%= @ssh_port %> -j ACCEPT
+-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED --dport 80 -j ACCEPT
+-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED --dport 443 -j ACCEPT
+-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
+-A OUTPUT -p udp -m udp --dport 123 -j ACCEPT
+-A OUTPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
+COMMIT
diff --git a/puppet/modules/site_config/templates/ipv6firewall_up.rules.erb b/puppet/modules/site_config/templates/ipv6firewall_up.rules.erb
new file mode 100644
index 00000000..e7fae52e
--- /dev/null
+++ b/puppet/modules/site_config/templates/ipv6firewall_up.rules.erb
@@ -0,0 +1,7 @@
+# Generated by ip6tables-save v1.4.20 on Tue Aug 20 12:19:43 2013
+*filter
+:INPUT DROP [24:1980]
+:FORWARD DROP [0:0]
+:OUTPUT DROP [14:8030]
+COMMIT
+# Completed on Tue Aug 20 12:19:43 2013