switch to using stunnel_client and stunnel_server leap_cli macros

add bigcouch_replication_clients to couchdb.json

change site_couchdb/manifests/stunnel to use stunnel_client and stunnel_server
generated hiera values to setup the stunnels for the couch_server connections,
and the bigcouch_replication_server and bigcouch_replication_clients tunnels
instead of using hard-coded ips and ports.

also change the pid names to be more consistent with what the tunnels are and
are named

1 files changed, 26 insertions, 15 deletions

diff --git a/puppet/modules/site_couchdb/manifests/stunnel.pp b/puppet/modules/site_couchdb/manifests/stunnel.pp
index a49b51b9..1eb79293 100644
--- a/puppet/modules/site_couchdb/manifests/stunnel.pp
+++ b/puppet/modules/site_couchdb/manifests/stunnel.pp
@@ -1,13 +1,26 @@
 class site_couchdb::stunnel ($key, $cert, $ca) {
 
-  include x509::variables
+  $stunnel              = hiera('stunnel')
+
+  $couch_server         = $stunnel['couch_server']
+  $couch_server_accept  = $couch_server['accept']
+  $couch_server_connect = $couch_server['connect']
+
+  $bigcouch_replication_server         = $stunnel['bigcouch_replication_server']
+  $bigcouch_replication_server_accept  = $bigcouch_replication_server['accept']
+  $bigcouch_replication_server_connect = $bigcouch_replication_server['connect']
 
+  $bigcouch_replication_clients         = $stunnel['bigcouch_replication_clients']
+
+  include x509::variables
   $cert_name = 'leap_couchdb'
   $ca_name   = 'leap_ca'
   $ca_path   = "${x509::variables::local_CAs}/${ca_name}.crt"
   $cert_path = "${x509::variables::certs}/${cert_name}.crt"
   $key_path  = "${x509::variables::keys}/${cert_name}.key"
 
+  # basic setup: ensure cert, key, ca files are in place, and some generic
+  # stunnel things are done
   class { 'site_stunnel::setup':
     cert_name => $cert_name,
     key       => $key,
@@ -15,45 +28,43 @@ class site_couchdb::stunnel ($key, $cert, $ca) {
     ca        => $ca
   }
 
-  # webapp access
-  stunnel::service { 'couchdb':
-    accept     => '6984',
-    connect    => '127.0.0.1:5984',
+  # setup a stunnel server for the webapp to connect to couchdb
+  stunnel::service { 'couch_server':
+    accept     => $couch_server_accept,
+    connect    => $couch_server_connect,
     client     => false,
     cafile     => $ca_path,
     key        => $key_path,
     cert       => $cert_path,
     verify     => '2',
-    pid        => '/var/run/stunnel4/bigcouch.pid',
+    pid        => '/var/run/stunnel4/couchserver.pid',
     rndfile    => '/var/lib/stunnel4/.rnd',
     debuglevel => '4'
   }
 
-  # clustering between bigcouch nodes
 
+  # setup stunnels for bigcouch clustering between each bigcouchdb node
   # server
-  stunnel::service { 'bigcouch':
-    accept     => '5369',
-    connect    => '127.0.0.1:4369',
+  stunnel::service { 'bigcouch_replication_server':
+    accept     => $bigcouch_replication_server_accept,
+    connect    => $bigcouch_replication_server_connect,
     client     => false,
     cafile     => $ca_path,
     key        => $key_path,
     cert       => $cert_path,
     verify     => '2',
-    pid        => '/var/run/stunnel4/couchdb.pid',
+    pid        => '/var/run/stunnel4/bigcouchreplication_server.pid',
     rndfile    => '/var/lib/stunnel4/.rnd',
     debuglevel => '4'
   }
 
   # clients
-  $couchdb_stunnel_client_defaults = {
-    'connect_port' => '5369',
+  $bigcouch_replication_client_defaults = {
     'client'       => true,
     'cafile'       => $ca_path,
     'key'          => $key_path,
     'cert'         => $cert_path,
   }
-  create_resources(site_stunnel::clients, hiera('stunnel'), $couchdb_stunnel_client_defaults)
 
+  create_resources(site_stunnel::clients, $bigcouch_replication_clients, $bigcouch_replication_client_defaults)
 }
-