shorewall:

create a macro for the bigcouch replication server stunnel to enable these
connections pulling bigcouch_replication_clients,
bigcouch_replication_server_port from hiera

create site_shorewall::couchdb::dnat and create_resources to properly setup DNAT
for bigcouch_replication_clients

1 files changed, 29 insertions, 1 deletions

diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp
index 2afdea87..a0d63d15 100644
--- a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp
+++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp
@@ -2,6 +2,34 @@ class site_shorewall::couchdb::bigcouch {
 
   include site_shorewall::defaults
 
-  create_resources(site_shorewall::dnat, hiera('shorewall_dnat'))
+  $stunnel = hiera('stunnel')
+  $bigcouch_replication_clients         = $stunnel['bigcouch_replication_clients']
+
+  $bigcouch_replication_server          = $stunnel['bigcouch_replication_server']
+  $bigcouch_replication_server_port     = $bigcouch_replication_server['accept']
+
+  # define macro for incoming services
+  file { '/etc/shorewall/macro.leap_bigcouch':
+    content => "PARAM   -       -       tcp    ${bigcouch_replication_server_port}",
+    notify  => Service['shorewall'],
+    require => Package['shorewall']
+  }
+
+  shorewall::rule {
+      'net2fw-bigcouch':
+        source      => 'net',
+        destination => '$FW',
+        action      => 'leap_bigcouch(ACCEPT)',
+        order       => 300;
+  }
+
+  $bigcouch_shorewall_dnat_defaults = {
+    'source'          => '$FW',
+    'proto'           => 'tcp',
+    'destinationport' => '4369',
+  }
+
+  create_resources(site_shorewall::couchdb::dnat, $bigcouch_replication_clients, $bigcouch_shorewall_dnat_defaults)
 
 }
+