Merge branch 'develop' of ssh://leap.se/leap_platform into develop

2 files changed, 48 insertions, 20 deletions

diff --git a/puppet/modules/site_couchdb/manifests/init.pp b/puppet/modules/site_couchdb/manifests/init.pp
index d317de65..e0f379cd 100644
--- a/puppet/modules/site_couchdb/manifests/init.pp
+++ b/puppet/modules/site_couchdb/manifests/init.pp
@@ -67,4 +67,5 @@ class site_couchdb ( $bigcouch = false ) {
   }
 
   include site_shorewall::couchdb
+  include site_shorewall::couchdb::bigcouch
 }
diff --git a/puppet/modules/site_couchdb/manifests/stunnel.pp b/puppet/modules/site_couchdb/manifests/stunnel.pp
index 1afe25a4..1eb79293 100644
--- a/puppet/modules/site_couchdb/manifests/stunnel.pp
+++ b/puppet/modules/site_couchdb/manifests/stunnel.pp
@@ -1,43 +1,70 @@
 class site_couchdb::stunnel ($key, $cert, $ca) {
 
-  include x509::variables
-  include site_stunnel
+  $stunnel              = hiera('stunnel')
+
+  $couch_server         = $stunnel['couch_server']
+  $couch_server_accept  = $couch_server['accept']
+  $couch_server_connect = $couch_server['connect']
+
+  $bigcouch_replication_server         = $stunnel['bigcouch_replication_server']
+  $bigcouch_replication_server_accept  = $bigcouch_replication_server['accept']
+  $bigcouch_replication_server_connect = $bigcouch_replication_server['connect']
 
+  $bigcouch_replication_clients         = $stunnel['bigcouch_replication_clients']
+
+  include x509::variables
   $cert_name = 'leap_couchdb'
   $ca_name   = 'leap_ca'
   $ca_path   = "${x509::variables::local_CAs}/${ca_name}.crt"
   $cert_path = "${x509::variables::certs}/${cert_name}.crt"
   $key_path  = "${x509::variables::keys}/${cert_name}.key"
 
-  x509::key {
-    $cert_name:
-      content => $key,
-      notify  => Service['stunnel'];
+  # basic setup: ensure cert, key, ca files are in place, and some generic
+  # stunnel things are done
+  class { 'site_stunnel::setup':
+    cert_name => $cert_name,
+    key       => $key,
+    cert      => $cert,
+    ca        => $ca
   }
 
-  x509::cert {
-    $cert_name:
-      content => $cert,
-      notify  => Service['stunnel'];
+  # setup a stunnel server for the webapp to connect to couchdb
+  stunnel::service { 'couch_server':
+    accept     => $couch_server_accept,
+    connect    => $couch_server_connect,
+    client     => false,
+    cafile     => $ca_path,
+    key        => $key_path,
+    cert       => $cert_path,
+    verify     => '2',
+    pid        => '/var/run/stunnel4/couchserver.pid',
+    rndfile    => '/var/lib/stunnel4/.rnd',
+    debuglevel => '4'
   }
 
-  x509::ca {
-    $ca_name:
-      content => $ca,
-      notify  => Service['stunnel'];
-  }
 
-  stunnel::service { 'couchdb':
-    accept     => '6984',
-    connect    => '127.0.0.1:5984',
+  # setup stunnels for bigcouch clustering between each bigcouchdb node
+  # server
+  stunnel::service { 'bigcouch_replication_server':
+    accept     => $bigcouch_replication_server_accept,
+    connect    => $bigcouch_replication_server_connect,
     client     => false,
     cafile     => $ca_path,
     key        => $key_path,
     cert       => $cert_path,
     verify     => '2',
-    pid        => '/var/run/stunnel4/couchdb.pid',
+    pid        => '/var/run/stunnel4/bigcouchreplication_server.pid',
     rndfile    => '/var/lib/stunnel4/.rnd',
     debuglevel => '4'
   }
-}
 
+  # clients
+  $bigcouch_replication_client_defaults = {
+    'client'       => true,
+    'cafile'       => $ca_path,
+    'key'          => $key_path,
+    'cert'         => $cert_path,
+  }
+
+  create_resources(site_stunnel::clients, $bigcouch_replication_clients, $bigcouch_replication_client_defaults)
+}