summaryrefslogtreecommitdiff
path: root/puppet
diff options
context:
space:
mode:
authorMicah Anderson <micah@riseup.net>2013-05-21 17:35:20 -0400
committerMicah Anderson <micah@leap.se>2013-07-25 15:07:57 -0400
commit1c9c5a5fec51919a8e9ec14f5fe9b16c538bb4fa (patch)
treedbd74b22f7d76dbdfc518dc2c7bcde0190e47586 /puppet
parenta1d8ec10bd7d7ac4a146222010cf5a6862e45869 (diff)
initial soledad configuration
Change-Id: I19e91887c3f8e90764b4baef8c5e29e25658e190
Diffstat (limited to 'puppet')
-rw-r--r--puppet/manifests/site.pp4
-rw-r--r--puppet/modules/site_shorewall/manifests/soledad.pp20
-rw-r--r--puppet/modules/soledad/manifests/init.pp34
-rw-r--r--puppet/modules/soledad/manifests/server.pp62
-rw-r--r--puppet/modules/soledad/templates/soledad-server.conf.erb3
5 files changed, 123 insertions, 0 deletions
diff --git a/puppet/manifests/site.pp b/puppet/manifests/site.pp
index 08cbbb9e..bdb57c83 100644
--- a/puppet/manifests/site.pp
+++ b/puppet/manifests/site.pp
@@ -30,6 +30,10 @@ if $services =~ /\bwebapp\b/ {
include site_nickserver
}
+if $services =~ /\bsoledad\b/ {
+ include soledad::server
+}
+
if $services =~ /\bmonitor\b/ {
include site_nagios
}
diff --git a/puppet/modules/site_shorewall/manifests/soledad.pp b/puppet/modules/site_shorewall/manifests/soledad.pp
new file mode 100644
index 00000000..f3272c04
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/soledad.pp
@@ -0,0 +1,20 @@
+class site_shorewall::soledad {
+
+ include site_shorewall::defaults
+
+ # define macro for incoming services
+ file { '/etc/shorewall/macro.leap_soledad':
+ content => 'PARAM - - tcp 2424',
+ notify => Service['shorewall'],
+ require => Package['shorewall']
+ }
+
+ shorewall::rule {
+ 'net2fw-soledad':
+ source => 'net',
+ destination => '$FW',
+ action => 'leap_soledad(ACCEPT)',
+ order => 200;
+ }
+}
+
diff --git a/puppet/modules/soledad/manifests/init.pp b/puppet/modules/soledad/manifests/init.pp
new file mode 100644
index 00000000..08ba88a7
--- /dev/null
+++ b/puppet/modules/soledad/manifests/init.pp
@@ -0,0 +1,34 @@
+class soledad {
+
+ group { 'soledad':
+ ensure => present,
+ allowdupe => false;
+ }
+
+ user { 'soledad':
+ ensure => present,
+ allowdupe => false,
+ gid => 'soledad',
+ home => '/srv/leap/soledad',
+ require => Group['soledad'];
+ }
+
+ file {
+ '/srv/leap/soledad':
+ ensure => directory,
+ owner => 'soledad',
+ group => 'soledad',
+ require => User['soledad'];
+
+ '/var/lib/soledad':
+ ensure => directory,
+ owner => 'soledad',
+ group => 'soledad',
+ require => User['soledad'];
+ }
+
+ package { 'soledad-common':
+ ensure => installed,
+ require => User['soledad'];
+ }
+}
diff --git a/puppet/modules/soledad/manifests/server.pp b/puppet/modules/soledad/manifests/server.pp
new file mode 100644
index 00000000..06de8642
--- /dev/null
+++ b/puppet/modules/soledad/manifests/server.pp
@@ -0,0 +1,62 @@
+class soledad::server {
+ tag 'leap_service'
+ include soledad
+
+ $couchdb = hiera('couch')
+ $couchdb_host = 'localhost'
+ $couchdb_port = '4096'
+ $couchdb_user = $couchdb['users']['soledad']['username']
+ $couchdb_password = $couchdb['users']['soledad']['password']
+
+ $x509 = hiera('x509')
+ $x509_key = $x509['key']
+ $x509_cert = $x509['cert']
+ $x509_ca = $x509['ca_cert']
+
+ x509::key { 'soledad':
+ content => $x509_key,
+ notify => Service['soledad-server'];
+ }
+
+ x509::cert { 'soledad':
+ content => $x509_cert,
+ notify => Service['soledad-server'];
+ }
+
+ x509::ca { 'soledad':
+ content => $x509_ca,
+ notify => Service['soledad-server'];
+ }
+
+ #
+ # SOLEDAD CONFIG
+ #
+
+ file { '/etc/leap/soledad-server.conf':
+ content => template('soledad/soledad-server.conf.erb'),
+ owner => 'soledad',
+ group => 'soledad',
+ mode => '0600',
+ notify => Service['soledad-server'],
+ require => Class['soledad'];
+ }
+
+ package { 'soledad-server':
+ ensure => installed
+ }
+
+ file { '/etc/default/soledad':
+ content => "CERT_PATH=/etc/x509/certs/soledad.crt\nPRIVKEY_PATH=/etc/x509/keys/soledad.key\n",
+ require => Package['soledad-server']
+ }
+
+ service { 'soledad-server':
+ ensure => running,
+ enable => true,
+ hasstatus => true,
+ hasrestart => true,
+ require => [ Class['soledad'], Package['soledad-server'] ];
+ }
+
+ include site_shorewall::soledad
+}
diff --git a/puppet/modules/soledad/templates/soledad-server.conf.erb b/puppet/modules/soledad/templates/soledad-server.conf.erb
new file mode 100644
index 00000000..47d1f6e4
--- /dev/null
+++ b/puppet/modules/soledad/templates/soledad-server.conf.erb
@@ -0,0 +1,3 @@
+[soledad-server]
+couch_url = http://<%= @couchdb_user %>:<%= @couchdb_password %>@<%= @couchdb_host %>:<%= @couchdb_port %>
+