Merge remote-tracking branch 'origin/develop'0.2.2

Conflicts:
	provider_base/services/webapp.json

8 files changed, 176 insertions, 69 deletions

diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp
index 9fa59569..73bed62b 100644
--- a/puppet/modules/site_shorewall/manifests/couchdb.pp
+++ b/puppet/modules/site_shorewall/manifests/couchdb.pp
@@ -2,16 +2,17 @@ class site_shorewall::couchdb {
 
   include site_shorewall::defaults
 
-  $couchdb_port = '6984'
+  $stunnel = hiera('stunnel')
+  $couch_server = $stunnel['couch_server']
+  $couch_stunnel_port = $couch_server['accept']
 
   # define macro for incoming services
   file { '/etc/shorewall/macro.leap_couchdb':
-    content => "PARAM   -       -       tcp    $couchdb_port",
+    content => "PARAM   -       -       tcp    ${couch_stunnel_port}",
     notify  => Service['shorewall'],
     require => Package['shorewall']
   }
 
-
   shorewall::rule {
       'net2fw-couchdb':
         source      => 'net',
diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp
new file mode 100644
index 00000000..20740650
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp
@@ -0,0 +1,51 @@
+class site_shorewall::couchdb::bigcouch {
+
+  include site_shorewall::defaults
+
+  $stunnel = hiera('stunnel')
+
+  # Erlang Port Mapper Daemon (epmd) stunnel server/clients
+  $epmd_clients         = $stunnel['epmd_clients']
+  $epmd_server          = $stunnel['epmd_server']
+  $epmd_server_port     = $epmd_server['accept']
+  $epmd_server_connect  = $epmd_server['connect']
+
+  # Erlang Distributed Node Protocol (ednp) stunnel server/clients
+  $ednp_clients         = $stunnel['ednp_clients']
+  $ednp_server          = $stunnel['ednp_server']
+  $ednp_server_port     = $ednp_server['accept']
+  $ednp_server_connect  = $ednp_server['connect']
+
+  # define macro for incoming services
+  file { '/etc/shorewall/macro.leap_bigcouch':
+    content => "PARAM   -       -       tcp    ${epmd_server_port},${ednp_server_port}",
+    notify  => Service['shorewall'],
+    require => Package['shorewall']
+  }
+
+  shorewall::rule {
+      'net2fw-bigcouch':
+        source      => 'net',
+        destination => '$FW',
+        action      => 'leap_bigcouch(ACCEPT)',
+        order       => 300;
+  }
+
+  # setup DNAT rules for each epmd
+  $epmd_shorewall_dnat_defaults = {
+    'source'          => '$FW',
+    'proto'           => 'tcp',
+    'destinationport' => regsubst($epmd_server_connect, '^([0-9.]+:)([0-9]+)$', '\2')
+  }
+  create_resources(site_shorewall::couchdb::dnat, $epmd_clients, $epmd_shorewall_dnat_defaults)
+
+  # setup DNAT rules for each ednp
+  $ednp_shorewall_dnat_defaults = {
+    'source'          => '$FW',
+    'proto'           => 'tcp',
+    'destinationport' => regsubst($ednp_server_connect, '^([0-9.]+:)([0-9]+)$', '\2')
+  }
+  create_resources(site_shorewall::couchdb::dnat, $ednp_clients, $ednp_shorewall_dnat_defaults)
+
+}
+
diff --git a/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp
new file mode 100644
index 00000000..f1bc9acf
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp
@@ -0,0 +1,21 @@
+define site_shorewall::couchdb::dnat (
+  $source,
+  $connect,
+  $connect_port,
+  $accept_port,
+  $proto,
+  $destinationport )
+{
+
+
+  shorewall::rule {
+    "dnat_${name}_${destinationport}":
+      action          => 'DNAT',
+      source          => $source,
+      destination     => "\$FW:127.0.0.1:${accept_port}",
+      proto           => $proto,
+      destinationport => $destinationport,
+      originaldest    => $connect,
+      order           => 200
+  }
+}
diff --git a/puppet/modules/site_shorewall/manifests/defaults.pp b/puppet/modules/site_shorewall/manifests/defaults.pp
index d5639a90..c62c9307 100644
--- a/puppet/modules/site_shorewall/manifests/defaults.pp
+++ b/puppet/modules/site_shorewall/manifests/defaults.pp
@@ -1,17 +1,10 @@
 class site_shorewall::defaults {
   include shorewall
+  include site_config::params
 
   # be safe for development
   #if ( $::virtual == 'virtualbox') { $shorewall_startup='0' }
 
-  $ip_address     = hiera('ip_address')
-  # a special case for vagrant interfaces
-  $interface      = $::virtual ? {
-    virtualbox => [ 'eth0', 'eth1' ],
-    default    => getvar("interface_${ip_address}")
-  }
-
-
   # If you want logging:
   shorewall::params {
     'LOG': value => 'debug';
@@ -19,14 +12,13 @@ class site_shorewall::defaults {
 
   shorewall::zone {'net': type => 'ipv4'; }
 
-
   # define interfaces
-  shorewall::interface { $interface:
+  shorewall::interface { $site_config::params::interface:
     zone      => 'net',
     options   => 'tcpflags,blacklist,nosmurfs';
   }
 
-  shorewall::routestopped { $interface: }
+  shorewall::routestopped { $site_config::params::interface: }
 
   shorewall::policy {
     'fw-to-all':
diff --git a/puppet/modules/site_shorewall/manifests/dnat.pp b/puppet/modules/site_shorewall/manifests/dnat.pp
new file mode 100644
index 00000000..a73294cc
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/dnat.pp
@@ -0,0 +1,19 @@
+define site_shorewall::dnat (
+  $source,
+  $destination,
+  $proto,
+  $destinationport,
+  $originaldest ) {
+
+
+  shorewall::rule {
+    "dnat_${name}_${destinationport}":
+      action          => 'DNAT',
+      source          => $source,
+      destination     => $destination,
+      proto           => $proto,
+      destinationport => $destinationport,
+      originaldest    => $originaldest,
+      order           => 200
+  }
+}
diff --git a/puppet/modules/site_shorewall/manifests/dnat_rule.pp b/puppet/modules/site_shorewall/manifests/dnat_rule.pp
index 68f480d8..aa298408 100644
--- a/puppet/modules/site_shorewall/manifests/dnat_rule.pp
+++ b/puppet/modules/site_shorewall/manifests/dnat_rule.pp
@@ -2,24 +2,45 @@ define site_shorewall::dnat_rule {
 
   $port = $name
   if $port != 1194 {
-    shorewall::rule {
-        "dnat_tcp_port_$port":
-          action          => 'DNAT',
-          source          => 'net',
-          destination     => "\$FW:${site_openvpn::openvpn_gateway_address}:1194",
-          proto           => 'tcp',
-          destinationport => $port,
-          order           => 100;
+    if $site_openvpn::openvpn_allow_unlimited {
+      shorewall::rule {
+          "dnat_tcp_port_$port":
+            action          => 'DNAT',
+            source          => 'net',
+            destination     => "\$FW:${site_openvpn::unlimited_gateway_address}:1194",
+            proto           => 'tcp',
+            destinationport => $port,
+            order           => 100;
+      }
+      shorewall::rule {
+          "dnat_udp_port_$port":
+            action          => 'DNAT',
+            source          => 'net',
+            destination     => "\$FW:${site_openvpn::unlimited_gateway_address}:1194",
+            proto           => 'udp',
+            destinationport => $port,
+            order           => 100;
+      }
     }
-
-    shorewall::rule {
-        "dnat_udp_port_$port":
-          action          => 'DNAT',
-          source          => 'net',
-          destination     => "\$FW:${site_openvpn::openvpn_gateway_address}:1194",
-          proto           => 'udp',
-          destinationport => $port,
-          order           => 100;
+    if $site_openvpn::openvpn_allow_limited {
+      shorewall::rule {
+          "dnat_free_tcp_port_$port":
+            action          => 'DNAT',
+            source          => 'net',
+            destination     => "\$FW:${site_openvpn::limited_gateway_address}:1194",
+            proto           => 'tcp',
+            destinationport => $port,
+            order           => 100;
+      }
+      shorewall::rule {
+          "dnat_free_udp_port_$port":
+            action          => 'DNAT',
+            source          => 'net',
+            destination     => "\$FW:${site_openvpn::limited_gateway_address}:1194",
+            proto           => 'udp',
+            destinationport => $port,
+            order           => 100;
+      }
     }
   }
 }
diff --git a/puppet/modules/site_shorewall/manifests/eip.pp b/puppet/modules/site_shorewall/manifests/eip.pp
index 4e5a5d48..7109b770 100644
--- a/puppet/modules/site_shorewall/manifests/eip.pp
+++ b/puppet/modules/site_shorewall/manifests/eip.pp
@@ -1,54 +1,56 @@
 class site_shorewall::eip {
 
   include site_shorewall::defaults
+  include site_config::params
   include site_shorewall::ip_forward
 
-  $openvpn_config = hiera('openvpn')
-  $openvpn_ports  = $openvpn_config['ports']
-  $openvpn_gateway_address = $site_openvpn::openvpn_gateway_address
-
   # define macro for incoming services
   file { '/etc/shorewall/macro.leap_eip':
     content => "PARAM   -       -       tcp     1194
-PARAM   -       -       udp     1194
-",
-    notify  => Service['shorewall']
+    PARAM   -       -       udp     1194
+    ",
+    notify  => Service['shorewall'],
+    require => Package['shorewall']
   }
 
-
   shorewall::interface {
     'tun0':
       zone    => 'eip',
       options => 'tcpflags,blacklist,nosmurfs';
     'tun1':
       zone    => 'eip',
-      options => 'tcpflags,blacklist,nosmurfs'
+      options => 'tcpflags,blacklist,nosmurfs';
+    'tun2':
+      zone    => 'eip',
+      options => 'tcpflags,blacklist,nosmurfs';
+    'tun3':
+      zone    => 'eip',
+      options => 'tcpflags,blacklist,nosmurfs';
   }
 
+  shorewall::zone {
+    'eip':
+      type => 'ipv4';
+  }
 
-  shorewall::zone {'eip':
-    type => 'ipv4'; }
+  $interface = $site_config::params::interface
 
-  case $::virtual {
-    'virtualbox': {
-      shorewall::masq {
-        'eth0_tcp':
-          interface => 'eth0',
-          source    => "${site_openvpn::openvpn_tcp_network_prefix}.0/${site_openvpn::openvpn_tcp_cidr}";
-        'eth0_udp':
-          interface => 'eth0',
-          source    => "${site_openvpn::openvpn_udp_network_prefix}.0/${site_openvpn::openvpn_udp_cidr}"; }
-    }
-    default: {
-      $interface = $site_shorewall::defaults::interface
-      shorewall::masq {
-        "${interface}_tcp":
-          interface => $interface,
-          source    => "${site_openvpn::openvpn_tcp_network_prefix}.0/${site_openvpn::openvpn_tcp_cidr}";
-
-        "${interface}_udp":
-          interface => $interface,
-          source    => "${site_openvpn::openvpn_udp_network_prefix}.0/${site_openvpn::openvpn_udp_cidr}"; }
+  shorewall::masq {
+    "${interface}_unlimited_tcp":
+      interface => $interface,
+      source    => "${site_openvpn::openvpn_unlimited_tcp_network_prefix}.0/${site_openvpn::openvpn_unlimited_tcp_cidr}";
+    "${interface}_unlimited_udp":
+      interface => $interface,
+      source    => "${site_openvpn::openvpn_unlimited_udp_network_prefix}.0/${site_openvpn::openvpn_unlimited_udp_cidr}";
+  }
+  if ! $::ec2_instance_id {
+    shorewall::masq {
+      "${interface}_limited_tcp":
+        interface => $interface,
+        source    => "${site_openvpn::openvpn_limited_tcp_network_prefix}.0/${site_openvpn::openvpn_limited_tcp_cidr}";
+      "${interface}_limited_udp":
+        interface => $interface,
+        source    => "${site_openvpn::openvpn_limited_udp_network_prefix}.0/${site_openvpn::openvpn_limited_udp_cidr}";
     }
   }
 
@@ -61,15 +63,14 @@ PARAM   -       -       udp     1194
   }
 
   shorewall::rule {
-      'net2fw-openvpn':
-        source      => 'net',
-        destination => '$FW',
-        action      => 'leap_eip(ACCEPT)',
-        order       => 200;
+    'net2fw-openvpn':
+      source      => 'net',
+      destination => '$FW',
+      action      => 'leap_eip(ACCEPT)',
+      order       => 200;
   }
 
   # create dnat rule for each port
-  #create_resources('site_shorewall::dnat_rule', $openvpn_ports)
-  site_shorewall::dnat_rule { $openvpn_ports: }
+  site_shorewall::dnat_rule { $site_openvpn::openvpn_ports: }
 
 }
diff --git a/puppet/modules/site_shorewall/manifests/webapp.pp b/puppet/modules/site_shorewall/manifests/webapp.pp
index d12bbc8f..a8d2aa5b 100644
--- a/puppet/modules/site_shorewall/manifests/webapp.pp
+++ b/puppet/modules/site_shorewall/manifests/webapp.pp
@@ -2,5 +2,6 @@ class site_shorewall::webapp {
 
   include site_shorewall::defaults
   include site_shorewall::service::https
+  include site_shorewall::service::http
   include site_shorewall::service::webapp_api
 }