Merge remote-tracking branch 'origin/release/v0.2.0'0.2.0

12 files changed, 297 insertions, 0 deletions

diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp
new file mode 100644
index 00000000..9fa59569
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/couchdb.pp
@@ -0,0 +1,23 @@
+class site_shorewall::couchdb {
+
+  include site_shorewall::defaults
+
+  $couchdb_port = '6984'
+
+  # define macro for incoming services
+  file { '/etc/shorewall/macro.leap_couchdb':
+    content => "PARAM   -       -       tcp    $couchdb_port",
+    notify  => Service['shorewall'],
+    require => Package['shorewall']
+  }
+
+
+  shorewall::rule {
+      'net2fw-couchdb':
+        source      => 'net',
+        destination => '$FW',
+        action      => 'leap_couchdb(ACCEPT)',
+        order       => 200;
+  }
+
+}
diff --git a/puppet/modules/site_shorewall/manifests/defaults.pp b/puppet/modules/site_shorewall/manifests/defaults.pp
new file mode 100644
index 00000000..d5639a90
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/defaults.pp
@@ -0,0 +1,54 @@
+class site_shorewall::defaults {
+  include shorewall
+
+  # be safe for development
+  #if ( $::virtual == 'virtualbox') { $shorewall_startup='0' }
+
+  $ip_address     = hiera('ip_address')
+  # a special case for vagrant interfaces
+  $interface      = $::virtual ? {
+    virtualbox => [ 'eth0', 'eth1' ],
+    default    => getvar("interface_${ip_address}")
+  }
+
+
+  # If you want logging:
+  shorewall::params {
+    'LOG': value => 'debug';
+  }
+
+  shorewall::zone {'net': type => 'ipv4'; }
+
+
+  # define interfaces
+  shorewall::interface { $interface:
+    zone      => 'net',
+    options   => 'tcpflags,blacklist,nosmurfs';
+  }
+
+  shorewall::routestopped { $interface: }
+
+  shorewall::policy {
+    'fw-to-all':
+      sourcezone      => 'fw',
+      destinationzone => 'all',
+      policy          => 'ACCEPT',
+      order           => 100;
+    'all-to-all':
+      sourcezone      => 'all',
+      destinationzone => 'all',
+      policy          => 'DROP',
+      order           => 200;
+  }
+
+  shorewall::rule {
+      # ping party
+      'all2all-ping':
+        source      => 'all',
+        destination => 'all',
+        action      => 'Ping(ACCEPT)',
+        order       => 200;
+  }
+
+  include site_shorewall::sshd
+}
diff --git a/puppet/modules/site_shorewall/manifests/dnat_rule.pp b/puppet/modules/site_shorewall/manifests/dnat_rule.pp
new file mode 100644
index 00000000..68f480d8
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/dnat_rule.pp
@@ -0,0 +1,25 @@
+define site_shorewall::dnat_rule {
+
+  $port = $name
+  if $port != 1194 {
+    shorewall::rule {
+        "dnat_tcp_port_$port":
+          action          => 'DNAT',
+          source          => 'net',
+          destination     => "\$FW:${site_openvpn::openvpn_gateway_address}:1194",
+          proto           => 'tcp',
+          destinationport => $port,
+          order           => 100;
+    }
+
+    shorewall::rule {
+        "dnat_udp_port_$port":
+          action          => 'DNAT',
+          source          => 'net',
+          destination     => "\$FW:${site_openvpn::openvpn_gateway_address}:1194",
+          proto           => 'udp',
+          destinationport => $port,
+          order           => 100;
+    }
+  }
+}
diff --git a/puppet/modules/site_shorewall/manifests/eip.pp b/puppet/modules/site_shorewall/manifests/eip.pp
new file mode 100644
index 00000000..4e5a5d48
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/eip.pp
@@ -0,0 +1,75 @@
+class site_shorewall::eip {
+
+  include site_shorewall::defaults
+  include site_shorewall::ip_forward
+
+  $openvpn_config = hiera('openvpn')
+  $openvpn_ports  = $openvpn_config['ports']
+  $openvpn_gateway_address = $site_openvpn::openvpn_gateway_address
+
+  # define macro for incoming services
+  file { '/etc/shorewall/macro.leap_eip':
+    content => "PARAM   -       -       tcp     1194
+PARAM   -       -       udp     1194
+",
+    notify  => Service['shorewall']
+  }
+
+
+  shorewall::interface {
+    'tun0':
+      zone    => 'eip',
+      options => 'tcpflags,blacklist,nosmurfs';
+    'tun1':
+      zone    => 'eip',
+      options => 'tcpflags,blacklist,nosmurfs'
+  }
+
+
+  shorewall::zone {'eip':
+    type => 'ipv4'; }
+
+  case $::virtual {
+    'virtualbox': {
+      shorewall::masq {
+        'eth0_tcp':
+          interface => 'eth0',
+          source    => "${site_openvpn::openvpn_tcp_network_prefix}.0/${site_openvpn::openvpn_tcp_cidr}";
+        'eth0_udp':
+          interface => 'eth0',
+          source    => "${site_openvpn::openvpn_udp_network_prefix}.0/${site_openvpn::openvpn_udp_cidr}"; }
+    }
+    default: {
+      $interface = $site_shorewall::defaults::interface
+      shorewall::masq {
+        "${interface}_tcp":
+          interface => $interface,
+          source    => "${site_openvpn::openvpn_tcp_network_prefix}.0/${site_openvpn::openvpn_tcp_cidr}";
+
+        "${interface}_udp":
+          interface => $interface,
+          source    => "${site_openvpn::openvpn_udp_network_prefix}.0/${site_openvpn::openvpn_udp_cidr}"; }
+    }
+  }
+
+  shorewall::policy {
+    'eip-to-all':
+      sourcezone      => 'eip',
+      destinationzone => 'all',
+      policy          => 'ACCEPT',
+      order           => 100;
+  }
+
+  shorewall::rule {
+      'net2fw-openvpn':
+        source      => 'net',
+        destination => '$FW',
+        action      => 'leap_eip(ACCEPT)',
+        order       => 200;
+  }
+
+  # create dnat rule for each port
+  #create_resources('site_shorewall::dnat_rule', $openvpn_ports)
+  site_shorewall::dnat_rule { $openvpn_ports: }
+
+}
diff --git a/puppet/modules/site_shorewall/manifests/ip_forward.pp b/puppet/modules/site_shorewall/manifests/ip_forward.pp
new file mode 100644
index 00000000..d53ee8a5
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/ip_forward.pp
@@ -0,0 +1,10 @@
+class site_shorewall::ip_forward {
+  include augeas
+  augeas { 'enable_ip_forwarding':
+    changes => 'set /files/etc/shorewall/shorewall.conf/IP_FORWARDING Yes',
+    lens    => 'Shellvars.lns',
+    incl    => '/etc/shorewall/shorewall.conf',
+    notify  => Service[shorewall],
+    require => [ Class[augeas], Package[shorewall] ];
+  }
+}
diff --git a/puppet/modules/site_shorewall/manifests/monitor.pp b/puppet/modules/site_shorewall/manifests/monitor.pp
new file mode 100644
index 00000000..f4ed4f7c
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/monitor.pp
@@ -0,0 +1,8 @@
+class site_shorewall::monitor {
+
+  include site_shorewall::defaults
+  include site_shorewall::service::http
+  include site_shorewall::service::https
+
+
+}
diff --git a/puppet/modules/site_shorewall/manifests/service/http.pp b/puppet/modules/site_shorewall/manifests/service/http.pp
new file mode 100644
index 00000000..74b874d5
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/service/http.pp
@@ -0,0 +1,13 @@
+class site_shorewall::service::http {
+
+  include site_shorewall::defaults
+
+  shorewall::rule {
+      'net2fw-http':
+        source      => 'net',
+        destination => '$FW',
+        action      => 'HTTP(ACCEPT)',
+        order       => 200;
+  }
+
+}
diff --git a/puppet/modules/site_shorewall/manifests/service/https.pp b/puppet/modules/site_shorewall/manifests/service/https.pp
new file mode 100644
index 00000000..4a8b119c
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/service/https.pp
@@ -0,0 +1,12 @@
+class site_shorewall::service::https {
+
+  include site_shorewall::defaults
+
+  shorewall::rule {
+      'net2fw-https':
+        source      => 'net',
+        destination => '$FW',
+        action      => 'HTTPS(ACCEPT)',
+        order       => 200;
+  }
+}
diff --git a/puppet/modules/site_shorewall/manifests/service/webapp_api.pp b/puppet/modules/site_shorewall/manifests/service/webapp_api.pp
new file mode 100644
index 00000000..0c6c824d
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/service/webapp_api.pp
@@ -0,0 +1,22 @@
+class site_shorewall::service::webapp_api {
+
+  $api = hiera('api')
+  $api_port = $api['port']
+
+  # define macro for incoming services
+  file { '/etc/shorewall/macro.leap_webapp_api':
+    content => "PARAM   -       -       tcp    $api_port ",
+    notify  => Service['shorewall'],
+    require => Package['shorewall']
+  }
+
+
+  shorewall::rule {
+      'net2fw-webapp_api':
+        source      => 'net',
+        destination => '$FW',
+        action      => 'leap_webapp_api(ACCEPT)',
+        order       => 200;
+  }
+
+}
diff --git a/puppet/modules/site_shorewall/manifests/sshd.pp b/puppet/modules/site_shorewall/manifests/sshd.pp
new file mode 100644
index 00000000..a8e09e42
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/sshd.pp
@@ -0,0 +1,24 @@
+class site_shorewall::sshd {
+
+  $ssh_config     = hiera('ssh')
+  $ssh_port       = $ssh_config['port']
+
+  include shorewall
+
+  # define macro for incoming sshd
+  file { '/etc/shorewall/macro.leap_sshd':
+    content => "PARAM   -       -       tcp    $ssh_port",
+    notify  => Service['shorewall'],
+    require => Package['shorewall']
+  }
+
+
+  shorewall::rule {
+      # outside to server
+      'net2fw-ssh':
+        source      => 'net',
+        destination => '$FW',
+        action      => 'leap_sshd(ACCEPT)',
+        order       => 200;
+  }
+}
diff --git a/puppet/modules/site_shorewall/manifests/tor.pp b/puppet/modules/site_shorewall/manifests/tor.pp
new file mode 100644
index 00000000..f35af985
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/tor.pp
@@ -0,0 +1,25 @@
+class site_shorewall::tor {
+
+  include site_shorewall::defaults
+  include site_shorewall::ip_forward
+
+  $tor_port = '9001'
+
+  # define macro for incoming services
+  file { '/etc/shorewall/macro.leap_tor':
+    content => "PARAM   -       -       tcp    $tor_port ",
+    notify  => Service['shorewall'],
+    require => Package['shorewall']
+  }
+
+
+  shorewall::rule {
+      'net2fw-tor':
+        source      => 'net',
+        destination => '$FW',
+        action      => 'leap_tor(ACCEPT)',
+        order       => 200;
+  }
+
+  include site_shorewall::service::http
+}
diff --git a/puppet/modules/site_shorewall/manifests/webapp.pp b/puppet/modules/site_shorewall/manifests/webapp.pp
new file mode 100644
index 00000000..d12bbc8f
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/webapp.pp
@@ -0,0 +1,6 @@
+class site_shorewall::webapp {
+
+  include site_shorewall::defaults
+  include site_shorewall::service::https
+  include site_shorewall::service::webapp_api
+}