new generic system for stunnel: just `include site_stunnel` and stunnel + needed shorewall will be automatically set up. requires new leap_cli

5 files changed, 62 insertions, 96 deletions

diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp
deleted file mode 100644
index 73bed62b..00000000
--- a/puppet/modules/site_shorewall/manifests/couchdb.pp
+++ /dev/null
@@ -1,24 +0,0 @@
-class site_shorewall::couchdb {
-
-  include site_shorewall::defaults
-
-  $stunnel = hiera('stunnel')
-  $couch_server = $stunnel['couch_server']
-  $couch_stunnel_port = $couch_server['accept']
-
-  # define macro for incoming services
-  file { '/etc/shorewall/macro.leap_couchdb':
-    content => "PARAM   -       -       tcp    ${couch_stunnel_port}",
-    notify  => Service['shorewall'],
-    require => Package['shorewall']
-  }
-
-  shorewall::rule {
-      'net2fw-couchdb':
-        source      => 'net',
-        destination => '$FW',
-        action      => 'leap_couchdb(ACCEPT)',
-        order       => 200;
-  }
-
-}
diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp
deleted file mode 100644
index 20740650..00000000
--- a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp
+++ /dev/null
@@ -1,51 +0,0 @@
-class site_shorewall::couchdb::bigcouch {
-
-  include site_shorewall::defaults
-
-  $stunnel = hiera('stunnel')
-
-  # Erlang Port Mapper Daemon (epmd) stunnel server/clients
-  $epmd_clients         = $stunnel['epmd_clients']
-  $epmd_server          = $stunnel['epmd_server']
-  $epmd_server_port     = $epmd_server['accept']
-  $epmd_server_connect  = $epmd_server['connect']
-
-  # Erlang Distributed Node Protocol (ednp) stunnel server/clients
-  $ednp_clients         = $stunnel['ednp_clients']
-  $ednp_server          = $stunnel['ednp_server']
-  $ednp_server_port     = $ednp_server['accept']
-  $ednp_server_connect  = $ednp_server['connect']
-
-  # define macro for incoming services
-  file { '/etc/shorewall/macro.leap_bigcouch':
-    content => "PARAM   -       -       tcp    ${epmd_server_port},${ednp_server_port}",
-    notify  => Service['shorewall'],
-    require => Package['shorewall']
-  }
-
-  shorewall::rule {
-      'net2fw-bigcouch':
-        source      => 'net',
-        destination => '$FW',
-        action      => 'leap_bigcouch(ACCEPT)',
-        order       => 300;
-  }
-
-  # setup DNAT rules for each epmd
-  $epmd_shorewall_dnat_defaults = {
-    'source'          => '$FW',
-    'proto'           => 'tcp',
-    'destinationport' => regsubst($epmd_server_connect, '^([0-9.]+:)([0-9]+)$', '\2')
-  }
-  create_resources(site_shorewall::couchdb::dnat, $epmd_clients, $epmd_shorewall_dnat_defaults)
-
-  # setup DNAT rules for each ednp
-  $ednp_shorewall_dnat_defaults = {
-    'source'          => '$FW',
-    'proto'           => 'tcp',
-    'destinationport' => regsubst($ednp_server_connect, '^([0-9.]+:)([0-9]+)$', '\2')
-  }
-  create_resources(site_shorewall::couchdb::dnat, $ednp_clients, $ednp_shorewall_dnat_defaults)
-
-}
-
diff --git a/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp
deleted file mode 100644
index f1bc9acf..00000000
--- a/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp
+++ /dev/null
@@ -1,21 +0,0 @@
-define site_shorewall::couchdb::dnat (
-  $source,
-  $connect,
-  $connect_port,
-  $accept_port,
-  $proto,
-  $destinationport )
-{
-
-
-  shorewall::rule {
-    "dnat_${name}_${destinationport}":
-      action          => 'DNAT',
-      source          => $source,
-      destination     => "\$FW:127.0.0.1:${accept_port}",
-      proto           => $proto,
-      destinationport => $destinationport,
-      originaldest    => $connect,
-      order           => 200
-  }
-}
diff --git a/puppet/modules/site_shorewall/manifests/stunnel/client.pp b/puppet/modules/site_shorewall/manifests/stunnel/client.pp
new file mode 100644
index 00000000..9a89a244
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/stunnel/client.pp
@@ -0,0 +1,40 @@
+#
+# Adds some firewall magic to the stunnel.
+#
+# Using DNAT, this firewall rule allow a locally running program
+# to try to connect to the normal remote IP and remote port of the
+# service on another machine, but have this connection magically
+# routed through the locally running stunnel client.
+#
+# The network looks like this:
+#
+#   From the client's perspective:
+#
+#   |------- stunnel client --------------|    |---------- stunnel server -----------------------|
+#    consumer app -> localhost:accept_port  ->  connect:connect_port -> localhost:original_port
+#
+#   From the server's perspective:
+#
+#   |------- stunnel client --------------|    |---------- stunnel server -----------------------|
+#                                       ??  ->  *:accept_port -> localhost:connect_port -> service
+#
+
+define site_shorewall::stunnel::client(
+  $accept_port,
+  $connect,
+  $connect_port,
+  $original_port) {
+
+  include site_shorewall::defaults
+
+  shorewall::rule {
+    "stunnel_dnat_${name}":
+      action          => 'DNAT',
+      source          => '$FW',
+      destination     => "\$FW:127.0.0.1:${accept_port}",
+      proto           => 'tcp',
+      destinationport => $original_port,
+      originaldest    => $connect,
+      order           => 200
+  }
+}
diff --git a/puppet/modules/site_shorewall/manifests/stunnel/server.pp b/puppet/modules/site_shorewall/manifests/stunnel/server.pp
new file mode 100644
index 00000000..db3ecd3e
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/stunnel/server.pp
@@ -0,0 +1,22 @@
+#
+# Allow all incoming connections to stunnel server port
+#
+
+define site_shorewall::stunnel::server($port) {
+
+  include site_shorewall::defaults
+
+  file { "/etc/shorewall/macro.stunnel_server_${name}":
+    content => "PARAM   -       -       tcp    ${port}",
+    notify  => Service['shorewall'],
+    require => Package['shorewall']
+  }
+  shorewall::rule {
+    'net2fw-couchdb':
+      source      => 'net',
+      destination => '$FW',
+      action      => "stunnel_server_${name}(ACCEPT)",
+      order       => 200;
+  }
+
+}
\ No newline at end of file