summaryrefslogtreecommitdiff
path: root/puppet/modules/site_couchdb
diff options
context:
space:
mode:
authorMicah Anderson <micah@riseup.net>2013-03-31 12:32:42 -0400
committerMicah Anderson <micah@riseup.net>2013-04-02 10:21:06 -0400
commitbaf3ed5b6db4e8af052564864d8c3e426cf5d9d0 (patch)
tree7715f88b8d9df86e9bb3432ab92b9eef0902fd1f /puppet/modules/site_couchdb
parentdd459efb1063de6c11f9f11583290c6a0891436a (diff)
switch to using stunnel_client and stunnel_server leap_cli macros
add bigcouch_replication_clients to couchdb.json change site_couchdb/manifests/stunnel to use stunnel_client and stunnel_server generated hiera values to setup the stunnels for the couch_server connections, and the bigcouch_replication_server and bigcouch_replication_clients tunnels instead of using hard-coded ips and ports. also change the pid names to be more consistent with what the tunnels are and are named
Diffstat (limited to 'puppet/modules/site_couchdb')
-rw-r--r--puppet/modules/site_couchdb/manifests/stunnel.pp41
1 files changed, 26 insertions, 15 deletions
diff --git a/puppet/modules/site_couchdb/manifests/stunnel.pp b/puppet/modules/site_couchdb/manifests/stunnel.pp
index a49b51b9..1eb79293 100644
--- a/puppet/modules/site_couchdb/manifests/stunnel.pp
+++ b/puppet/modules/site_couchdb/manifests/stunnel.pp
@@ -1,13 +1,26 @@
class site_couchdb::stunnel ($key, $cert, $ca) {
- include x509::variables
+ $stunnel = hiera('stunnel')
+
+ $couch_server = $stunnel['couch_server']
+ $couch_server_accept = $couch_server['accept']
+ $couch_server_connect = $couch_server['connect']
+
+ $bigcouch_replication_server = $stunnel['bigcouch_replication_server']
+ $bigcouch_replication_server_accept = $bigcouch_replication_server['accept']
+ $bigcouch_replication_server_connect = $bigcouch_replication_server['connect']
+ $bigcouch_replication_clients = $stunnel['bigcouch_replication_clients']
+
+ include x509::variables
$cert_name = 'leap_couchdb'
$ca_name = 'leap_ca'
$ca_path = "${x509::variables::local_CAs}/${ca_name}.crt"
$cert_path = "${x509::variables::certs}/${cert_name}.crt"
$key_path = "${x509::variables::keys}/${cert_name}.key"
+ # basic setup: ensure cert, key, ca files are in place, and some generic
+ # stunnel things are done
class { 'site_stunnel::setup':
cert_name => $cert_name,
key => $key,
@@ -15,45 +28,43 @@ class site_couchdb::stunnel ($key, $cert, $ca) {
ca => $ca
}
- # webapp access
- stunnel::service { 'couchdb':
- accept => '6984',
- connect => '127.0.0.1:5984',
+ # setup a stunnel server for the webapp to connect to couchdb
+ stunnel::service { 'couch_server':
+ accept => $couch_server_accept,
+ connect => $couch_server_connect,
client => false,
cafile => $ca_path,
key => $key_path,
cert => $cert_path,
verify => '2',
- pid => '/var/run/stunnel4/bigcouch.pid',
+ pid => '/var/run/stunnel4/couchserver.pid',
rndfile => '/var/lib/stunnel4/.rnd',
debuglevel => '4'
}
- # clustering between bigcouch nodes
+ # setup stunnels for bigcouch clustering between each bigcouchdb node
# server
- stunnel::service { 'bigcouch':
- accept => '5369',
- connect => '127.0.0.1:4369',
+ stunnel::service { 'bigcouch_replication_server':
+ accept => $bigcouch_replication_server_accept,
+ connect => $bigcouch_replication_server_connect,
client => false,
cafile => $ca_path,
key => $key_path,
cert => $cert_path,
verify => '2',
- pid => '/var/run/stunnel4/couchdb.pid',
+ pid => '/var/run/stunnel4/bigcouchreplication_server.pid',
rndfile => '/var/lib/stunnel4/.rnd',
debuglevel => '4'
}
# clients
- $couchdb_stunnel_client_defaults = {
- 'connect_port' => '5369',
+ $bigcouch_replication_client_defaults = {
'client' => true,
'cafile' => $ca_path,
'key' => $key_path,
'cert' => $cert_path,
}
- create_resources(site_stunnel::clients, hiera('stunnel'), $couchdb_stunnel_client_defaults)
+ create_resources(site_stunnel::clients, $bigcouch_replication_clients, $bigcouch_replication_client_defaults)
}
-