diff options
| author | Micah <micah@leap.se> | 2016-06-23 12:08:54 -0400 |
|---|---|---|
| committer | Micah <micah@leap.se> | 2016-06-28 13:11:37 -0400 |
| commit | 29d6b7dbbc3b9d8b11f0b215cad894fcfca9989c (patch) | |
| tree | 1f9619db78c6bb2a0410535c6f45f3f6e03bbcc6 /puppet/modules/site_static/manifests | |
| parent | 4cf9b7d34fce1c37d3b4bb16e62f078df642263b (diff) | |
Make static tor hidden services work (#8212).
When tor hidden services were enabled for static sites, only a very
basic configuration was setup and it didn't take into account the
different location configurations that can be configured for a
static site.
This commit resolves that by making a site_static::hidden_service class
similar to the site_webapp::hidden_service class, and fixes up the
apache vhost template to properly create the location blocks for the
hidden service vhost.
Change-Id: Ice3586f4173bd2d1bd3defca29d21c7403d5a03a
Diffstat (limited to 'puppet/modules/site_static/manifests')
| -rw-r--r-- | puppet/modules/site_static/manifests/hidden_service.pp | 37 | ||||
| -rw-r--r-- | puppet/modules/site_static/manifests/init.pp | 20 |
2 files changed, 48 insertions, 9 deletions
diff --git a/puppet/modules/site_static/manifests/hidden_service.pp b/puppet/modules/site_static/manifests/hidden_service.pp new file mode 100644 index 00000000..f1f15f8e --- /dev/null +++ b/puppet/modules/site_static/manifests/hidden_service.pp @@ -0,0 +1,37 @@ +# create hidden service for static sites +class site_static::hidden_service { + + include tor::daemon + tor::daemon::hidden_service { 'static': ports => [ '80 127.0.0.1:80'] } + file { + '/var/lib/tor/webapp/': + ensure => directory, + owner => 'debian-tor', + group => 'debian-tor', + mode => '2700'; + + '/var/lib/tor/static/private_key': + ensure => present, + source => "/srv/leap/files/nodes/${::hostname}/tor.key", + owner => 'debian-tor', + group => 'debian-tor', + mode => '0600', + notify => Service['tor']; + + '/var/lib/tor/static/hostname': + ensure => present, + content => "${::site_static::tor_domain}\n", + owner => 'debian-tor', + group => 'debian-tor', + mode => '0600', + notify => Service['tor']; + } + + # it is necessary to zero out the config of the status module + # because we are configuring our own version that is unavailable + # over the hidden service (see: #7456 and #7776) + apache::module { 'status': ensure => present, conf_content => ' ' } + + include site_shorewall::tor +} + diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp index 8063d432..4912fbab 100644 --- a/puppet/modules/site_static/manifests/init.pp +++ b/puppet/modules/site_static/manifests/init.pp @@ -7,11 +7,14 @@ class site_static { include site_config::x509::key include site_config::x509::ca_bundle - $static = hiera('static') - $domains = $static['domains'] - $formats = $static['formats'] - $bootstrap = $static['bootstrap_files'] - $tor = hiera('tor', false) + $static = hiera('static') + $domains = $static['domains'] + $formats = $static['formats'] + $bootstrap = $static['bootstrap_files'] + + $tor = hiera('tor', false) + $hidden_service = $tor['hidden_service'] + $tor_domain = "${hidden_service['address']}.onion" file { '/srv/static/': @@ -71,15 +74,14 @@ class site_static { } } - create_resources(site_static::domain, $domains) - if $tor { - $hidden_service = $tor['hidden_service'] if $hidden_service['active'] { - include site_webapp::hidden_service + include site_static::hidden_service } } + create_resources(site_static::domain, $domains) + include site_shorewall::defaults include site_shorewall::service::http include site_shorewall::service::https |