summaryrefslogtreecommitdiff
path: root/puppet/modules/site_shorewall
diff options
context:
space:
mode:
authorMicah Anderson <micah@riseup.net>2013-07-09 16:43:39 +0100
committerMicah Anderson <micah@riseup.net>2013-07-09 16:43:39 +0100
commitb4077083b971377636754b2988668a6ddd384da5 (patch)
treeb8e358b5f0f6dfa882d31d7446266111bc0d201b /puppet/modules/site_shorewall
parent625aaa11138bba365958391664299692402f8da4 (diff)
parent672154a8322901b86c9882854234eae53221a38e (diff)
Merge remote-tracking branch 'origin/develop'0.2.2
Conflicts: provider_base/services/webapp.json
Diffstat (limited to 'puppet/modules/site_shorewall')
-rw-r--r--puppet/modules/site_shorewall/manifests/couchdb.pp7
-rw-r--r--puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp51
-rw-r--r--puppet/modules/site_shorewall/manifests/couchdb/dnat.pp21
-rw-r--r--puppet/modules/site_shorewall/manifests/defaults.pp14
-rw-r--r--puppet/modules/site_shorewall/manifests/dnat.pp19
-rw-r--r--puppet/modules/site_shorewall/manifests/dnat_rule.pp55
-rw-r--r--puppet/modules/site_shorewall/manifests/eip.pp77
-rw-r--r--puppet/modules/site_shorewall/manifests/webapp.pp1
8 files changed, 176 insertions, 69 deletions
diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp
index 9fa59569..73bed62b 100644
--- a/puppet/modules/site_shorewall/manifests/couchdb.pp
+++ b/puppet/modules/site_shorewall/manifests/couchdb.pp
@@ -2,16 +2,17 @@ class site_shorewall::couchdb {
include site_shorewall::defaults
- $couchdb_port = '6984'
+ $stunnel = hiera('stunnel')
+ $couch_server = $stunnel['couch_server']
+ $couch_stunnel_port = $couch_server['accept']
# define macro for incoming services
file { '/etc/shorewall/macro.leap_couchdb':
- content => "PARAM - - tcp $couchdb_port",
+ content => "PARAM - - tcp ${couch_stunnel_port}",
notify => Service['shorewall'],
require => Package['shorewall']
}
-
shorewall::rule {
'net2fw-couchdb':
source => 'net',
diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp
new file mode 100644
index 00000000..20740650
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp
@@ -0,0 +1,51 @@
+class site_shorewall::couchdb::bigcouch {
+
+ include site_shorewall::defaults
+
+ $stunnel = hiera('stunnel')
+
+ # Erlang Port Mapper Daemon (epmd) stunnel server/clients
+ $epmd_clients = $stunnel['epmd_clients']
+ $epmd_server = $stunnel['epmd_server']
+ $epmd_server_port = $epmd_server['accept']
+ $epmd_server_connect = $epmd_server['connect']
+
+ # Erlang Distributed Node Protocol (ednp) stunnel server/clients
+ $ednp_clients = $stunnel['ednp_clients']
+ $ednp_server = $stunnel['ednp_server']
+ $ednp_server_port = $ednp_server['accept']
+ $ednp_server_connect = $ednp_server['connect']
+
+ # define macro for incoming services
+ file { '/etc/shorewall/macro.leap_bigcouch':
+ content => "PARAM - - tcp ${epmd_server_port},${ednp_server_port}",
+ notify => Service['shorewall'],
+ require => Package['shorewall']
+ }
+
+ shorewall::rule {
+ 'net2fw-bigcouch':
+ source => 'net',
+ destination => '$FW',
+ action => 'leap_bigcouch(ACCEPT)',
+ order => 300;
+ }
+
+ # setup DNAT rules for each epmd
+ $epmd_shorewall_dnat_defaults = {
+ 'source' => '$FW',
+ 'proto' => 'tcp',
+ 'destinationport' => regsubst($epmd_server_connect, '^([0-9.]+:)([0-9]+)$', '\2')
+ }
+ create_resources(site_shorewall::couchdb::dnat, $epmd_clients, $epmd_shorewall_dnat_defaults)
+
+ # setup DNAT rules for each ednp
+ $ednp_shorewall_dnat_defaults = {
+ 'source' => '$FW',
+ 'proto' => 'tcp',
+ 'destinationport' => regsubst($ednp_server_connect, '^([0-9.]+:)([0-9]+)$', '\2')
+ }
+ create_resources(site_shorewall::couchdb::dnat, $ednp_clients, $ednp_shorewall_dnat_defaults)
+
+}
+
diff --git a/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp
new file mode 100644
index 00000000..f1bc9acf
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp
@@ -0,0 +1,21 @@
+define site_shorewall::couchdb::dnat (
+ $source,
+ $connect,
+ $connect_port,
+ $accept_port,
+ $proto,
+ $destinationport )
+{
+
+
+ shorewall::rule {
+ "dnat_${name}_${destinationport}":
+ action => 'DNAT',
+ source => $source,
+ destination => "\$FW:127.0.0.1:${accept_port}",
+ proto => $proto,
+ destinationport => $destinationport,
+ originaldest => $connect,
+ order => 200
+ }
+}
diff --git a/puppet/modules/site_shorewall/manifests/defaults.pp b/puppet/modules/site_shorewall/manifests/defaults.pp
index d5639a90..c62c9307 100644
--- a/puppet/modules/site_shorewall/manifests/defaults.pp
+++ b/puppet/modules/site_shorewall/manifests/defaults.pp
@@ -1,17 +1,10 @@
class site_shorewall::defaults {
include shorewall
+ include site_config::params
# be safe for development
#if ( $::virtual == 'virtualbox') { $shorewall_startup='0' }
- $ip_address = hiera('ip_address')
- # a special case for vagrant interfaces
- $interface = $::virtual ? {
- virtualbox => [ 'eth0', 'eth1' ],
- default => getvar("interface_${ip_address}")
- }
-
-
# If you want logging:
shorewall::params {
'LOG': value => 'debug';
@@ -19,14 +12,13 @@ class site_shorewall::defaults {
shorewall::zone {'net': type => 'ipv4'; }
-
# define interfaces
- shorewall::interface { $interface:
+ shorewall::interface { $site_config::params::interface:
zone => 'net',
options => 'tcpflags,blacklist,nosmurfs';
}
- shorewall::routestopped { $interface: }
+ shorewall::routestopped { $site_config::params::interface: }
shorewall::policy {
'fw-to-all':
diff --git a/puppet/modules/site_shorewall/manifests/dnat.pp b/puppet/modules/site_shorewall/manifests/dnat.pp
new file mode 100644
index 00000000..a73294cc
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/dnat.pp
@@ -0,0 +1,19 @@
+define site_shorewall::dnat (
+ $source,
+ $destination,
+ $proto,
+ $destinationport,
+ $originaldest ) {
+
+
+ shorewall::rule {
+ "dnat_${name}_${destinationport}":
+ action => 'DNAT',
+ source => $source,
+ destination => $destination,
+ proto => $proto,
+ destinationport => $destinationport,
+ originaldest => $originaldest,
+ order => 200
+ }
+}
diff --git a/puppet/modules/site_shorewall/manifests/dnat_rule.pp b/puppet/modules/site_shorewall/manifests/dnat_rule.pp
index 68f480d8..aa298408 100644
--- a/puppet/modules/site_shorewall/manifests/dnat_rule.pp
+++ b/puppet/modules/site_shorewall/manifests/dnat_rule.pp
@@ -2,24 +2,45 @@ define site_shorewall::dnat_rule {
$port = $name
if $port != 1194 {
- shorewall::rule {
- "dnat_tcp_port_$port":
- action => 'DNAT',
- source => 'net',
- destination => "\$FW:${site_openvpn::openvpn_gateway_address}:1194",
- proto => 'tcp',
- destinationport => $port,
- order => 100;
+ if $site_openvpn::openvpn_allow_unlimited {
+ shorewall::rule {
+ "dnat_tcp_port_$port":
+ action => 'DNAT',
+ source => 'net',
+ destination => "\$FW:${site_openvpn::unlimited_gateway_address}:1194",
+ proto => 'tcp',
+ destinationport => $port,
+ order => 100;
+ }
+ shorewall::rule {
+ "dnat_udp_port_$port":
+ action => 'DNAT',
+ source => 'net',
+ destination => "\$FW:${site_openvpn::unlimited_gateway_address}:1194",
+ proto => 'udp',
+ destinationport => $port,
+ order => 100;
+ }
}
-
- shorewall::rule {
- "dnat_udp_port_$port":
- action => 'DNAT',
- source => 'net',
- destination => "\$FW:${site_openvpn::openvpn_gateway_address}:1194",
- proto => 'udp',
- destinationport => $port,
- order => 100;
+ if $site_openvpn::openvpn_allow_limited {
+ shorewall::rule {
+ "dnat_free_tcp_port_$port":
+ action => 'DNAT',
+ source => 'net',
+ destination => "\$FW:${site_openvpn::limited_gateway_address}:1194",
+ proto => 'tcp',
+ destinationport => $port,
+ order => 100;
+ }
+ shorewall::rule {
+ "dnat_free_udp_port_$port":
+ action => 'DNAT',
+ source => 'net',
+ destination => "\$FW:${site_openvpn::limited_gateway_address}:1194",
+ proto => 'udp',
+ destinationport => $port,
+ order => 100;
+ }
}
}
}
diff --git a/puppet/modules/site_shorewall/manifests/eip.pp b/puppet/modules/site_shorewall/manifests/eip.pp
index 4e5a5d48..7109b770 100644
--- a/puppet/modules/site_shorewall/manifests/eip.pp
+++ b/puppet/modules/site_shorewall/manifests/eip.pp
@@ -1,54 +1,56 @@
class site_shorewall::eip {
include site_shorewall::defaults
+ include site_config::params
include site_shorewall::ip_forward
- $openvpn_config = hiera('openvpn')
- $openvpn_ports = $openvpn_config['ports']
- $openvpn_gateway_address = $site_openvpn::openvpn_gateway_address
-
# define macro for incoming services
file { '/etc/shorewall/macro.leap_eip':
content => "PARAM - - tcp 1194
-PARAM - - udp 1194
-",
- notify => Service['shorewall']
+ PARAM - - udp 1194
+ ",
+ notify => Service['shorewall'],
+ require => Package['shorewall']
}
-
shorewall::interface {
'tun0':
zone => 'eip',
options => 'tcpflags,blacklist,nosmurfs';
'tun1':
zone => 'eip',
- options => 'tcpflags,blacklist,nosmurfs'
+ options => 'tcpflags,blacklist,nosmurfs';
+ 'tun2':
+ zone => 'eip',
+ options => 'tcpflags,blacklist,nosmurfs';
+ 'tun3':
+ zone => 'eip',
+ options => 'tcpflags,blacklist,nosmurfs';
}
+ shorewall::zone {
+ 'eip':
+ type => 'ipv4';
+ }
- shorewall::zone {'eip':
- type => 'ipv4'; }
+ $interface = $site_config::params::interface
- case $::virtual {
- 'virtualbox': {
- shorewall::masq {
- 'eth0_tcp':
- interface => 'eth0',
- source => "${site_openvpn::openvpn_tcp_network_prefix}.0/${site_openvpn::openvpn_tcp_cidr}";
- 'eth0_udp':
- interface => 'eth0',
- source => "${site_openvpn::openvpn_udp_network_prefix}.0/${site_openvpn::openvpn_udp_cidr}"; }
- }
- default: {
- $interface = $site_shorewall::defaults::interface
- shorewall::masq {
- "${interface}_tcp":
- interface => $interface,
- source => "${site_openvpn::openvpn_tcp_network_prefix}.0/${site_openvpn::openvpn_tcp_cidr}";
-
- "${interface}_udp":
- interface => $interface,
- source => "${site_openvpn::openvpn_udp_network_prefix}.0/${site_openvpn::openvpn_udp_cidr}"; }
+ shorewall::masq {
+ "${interface}_unlimited_tcp":
+ interface => $interface,
+ source => "${site_openvpn::openvpn_unlimited_tcp_network_prefix}.0/${site_openvpn::openvpn_unlimited_tcp_cidr}";
+ "${interface}_unlimited_udp":
+ interface => $interface,
+ source => "${site_openvpn::openvpn_unlimited_udp_network_prefix}.0/${site_openvpn::openvpn_unlimited_udp_cidr}";
+ }
+ if ! $::ec2_instance_id {
+ shorewall::masq {
+ "${interface}_limited_tcp":
+ interface => $interface,
+ source => "${site_openvpn::openvpn_limited_tcp_network_prefix}.0/${site_openvpn::openvpn_limited_tcp_cidr}";
+ "${interface}_limited_udp":
+ interface => $interface,
+ source => "${site_openvpn::openvpn_limited_udp_network_prefix}.0/${site_openvpn::openvpn_limited_udp_cidr}";
}
}
@@ -61,15 +63,14 @@ PARAM - - udp 1194
}
shorewall::rule {
- 'net2fw-openvpn':
- source => 'net',
- destination => '$FW',
- action => 'leap_eip(ACCEPT)',
- order => 200;
+ 'net2fw-openvpn':
+ source => 'net',
+ destination => '$FW',
+ action => 'leap_eip(ACCEPT)',
+ order => 200;
}
# create dnat rule for each port
- #create_resources('site_shorewall::dnat_rule', $openvpn_ports)
- site_shorewall::dnat_rule { $openvpn_ports: }
+ site_shorewall::dnat_rule { $site_openvpn::openvpn_ports: }
}
diff --git a/puppet/modules/site_shorewall/manifests/webapp.pp b/puppet/modules/site_shorewall/manifests/webapp.pp
index d12bbc8f..a8d2aa5b 100644
--- a/puppet/modules/site_shorewall/manifests/webapp.pp
+++ b/puppet/modules/site_shorewall/manifests/webapp.pp
@@ -2,5 +2,6 @@ class site_shorewall::webapp {
include site_shorewall::defaults
include site_shorewall::service::https
+ include site_shorewall::service::http
include site_shorewall::service::webapp_api
}