summaryrefslogtreecommitdiff
path: root/provider_base
diff options
context:
space:
mode:
Diffstat (limited to 'provider_base')
-rw-r--r--provider_base/common.json6
-rw-r--r--provider_base/files/service-definitions/provider.json.erb2
-rw-r--r--provider_base/files/service-definitions/v1/eip-service.json.erb11
-rw-r--r--provider_base/provider.json18
-rw-r--r--provider_base/services/couchdb.json3
-rw-r--r--provider_base/services/monitor.json13
-rw-r--r--provider_base/services/mx.json2
-rw-r--r--provider_base/services/openvpn.json15
-rw-r--r--provider_base/services/static.json6
-rw-r--r--provider_base/services/webapp.json14
-rw-r--r--provider_base/tags/development.json4
11 files changed, 61 insertions, 33 deletions
diff --git a/provider_base/common.json b/provider_base/common.json
index 07a58bba..a4d9c5f2 100644
--- a/provider_base/common.json
+++ b/provider_base/common.json
@@ -3,10 +3,10 @@
"environment": null,
"services": [],
"tags": [],
- "contacts": "= global.provider.contacts.default",
+ "contacts": "= provider.contacts.default",
"domain": {
- "full_suffix": "= global.provider.domain",
- "internal_suffix": "= global.provider.domain_internal",
+ "full_suffix": "= provider.domain",
+ "internal_suffix": "= provider.domain_internal",
"full": "= node.name + '.' + domain.full_suffix",
"internal": "= node.name + '.' + domain.internal_suffix",
"name": "= node.name + '.' + (dns.public ? domain.full_suffix : domain.internal_suffix)"
diff --git a/provider_base/files/service-definitions/provider.json.erb b/provider_base/files/service-definitions/provider.json.erb
index 5d4c63a0..97454f81 100644
--- a/provider_base/files/service-definitions/provider.json.erb
+++ b/provider_base/files/service-definitions/provider.json.erb
@@ -1,6 +1,6 @@
<%=
# grab some fields from provider.json
- hsh = global.provider.pick(
+ hsh = provider.pick(
:languages, :description, :name,
:enrollment_policy, :default_language, :service
)
diff --git a/provider_base/files/service-definitions/v1/eip-service.json.erb b/provider_base/files/service-definitions/v1/eip-service.json.erb
index feaea25b..3b8976fd 100644
--- a/provider_base/files/service-definitions/v1/eip-service.json.erb
+++ b/provider_base/files/service-definitions/v1/eip-service.json.erb
@@ -27,6 +27,7 @@
hsh["version"] = 1
locations = {}
gateways = []
+ configuration = nil
nodes_like_me[:services => 'openvpn'].each_node do |node|
if node.openvpn.allow_limited && node.openvpn.allow_unlimited
gateways << add_gateway(node, locations, :ip => node.openvpn.gateway_address, :limited => false)
@@ -36,13 +37,13 @@
elsif node.openvpn.allow_limited
gateways << add_gateway(node, locations, :ip => node.openvpn.gateway_address, :limited => true)
end
+ if configuration && node.openvpn.configuration != configuration
+ log :error, "OpenVPN nodes in the environment `#{node.environment}` have conflicting `openvpn.configuration` values. This will result in bad errors."
+ end
+ configuration = node.openvpn.configuration
end
hsh["gateways"] = gateways.compact
hsh["locations"] = locations
- hsh["openvpn_configuration"] = {
- "tls-cipher" => "DHE-RSA-AES128-SHA",
- "auth" => "SHA1",
- "cipher" => "AES-128-CBC"
- }
+ hsh["openvpn_configuration"] = configuration
JSON.sorted_generate hsh
%> \ No newline at end of file
diff --git a/provider_base/provider.json b/provider_base/provider.json
index 8864e24d..fa69318b 100644
--- a/provider_base/provider.json
+++ b/provider_base/provider.json
@@ -23,17 +23,17 @@
],
"default_service_level": 1,
"bandwidth_limit": 102400,
- "allow_free": "= global.provider.service.levels.select {|l| l['rate'].nil?}.any?",
- "allow_paid": "= global.provider.service.levels.select {|l| !l['rate'].nil?}.any?",
- "allow_anonymous": "= global.provider.service.levels.select {|l| l['name'] == 'anonymous'}.any?",
- "allow_registration": "= global.provider.service.levels.select {|l| l['name'] != 'anonymous'}.any?",
- "allow_limited_bandwidth": "= global.provider.service.levels.select {|l| l['bandwidth'] == 'limited'}.any?",
- "allow_unlimited_bandwidth": "= global.provider.service.levels.select {|l| l['bandwidth'].nil?}.any?"
+ "allow_free": "= provider.service.levels.select {|l| l['rate'].nil?}.any?",
+ "allow_paid": "= provider.service.levels.select {|l| !l['rate'].nil?}.any?",
+ "allow_anonymous": "= provider.service.levels.select {|l| l['name'] == 'anonymous'}.any?",
+ "allow_registration": "= provider.service.levels.select {|l| l['name'] != 'anonymous'}.any?",
+ "allow_limited_bandwidth": "= provider.service.levels.select {|l| l['bandwidth'] == 'limited'}.any?",
+ "allow_unlimited_bandwidth": "= provider.service.levels.select {|l| l['bandwidth'].nil?}.any?"
},
"ca": {
- "name": "= global.provider.ca.organization + ' Root CA'",
- "organization": "= global.provider.name[global.provider.default_language]",
- "organizational_unit": "= 'https://' + global.provider.domain",
+ "name": "= provider.ca.organization + ' Root CA'",
+ "organization": "= provider.name[provider.default_language]",
+ "organizational_unit": "= 'https://' + provider.domain",
"bit_size": 4096,
"digest": "SHA256",
"life_span": "10y",
diff --git a/provider_base/services/couchdb.json b/provider_base/services/couchdb.json
index 0cb044ef..5f1b5381 100644
--- a/provider_base/services/couchdb.json
+++ b/provider_base/services/couchdb.json
@@ -48,6 +48,9 @@
"password": "= secret :couch_webapp_password",
"salt": "= hex_secret :couch_webapp_password_salt, 128"
}
+ },
+ "webapp": {
+ "nagios_test_pw": "= secret :nagios_test_password"
}
}
}
diff --git a/provider_base/services/monitor.json b/provider_base/services/monitor.json
index 53e6b1f1..03f6c6d1 100644
--- a/provider_base/services/monitor.json
+++ b/provider_base/services/monitor.json
@@ -1,13 +1,22 @@
{
"nagios": {
"nagiosadmin_pw": "= secret :nagios_admin_password",
- "hosts": "= nodes_like_me[:services => '!monitor'].pick_fields('domain.internal', 'ip_address', 'services', 'openvpn.gateway_address')"
+ "hosts": "= (self.environment == 'local' ? nodes_like_me : nodes[:environment => '!local']).pick_fields('domain.internal', 'domain.full_suffix', 'ip_address', 'services', 'openvpn.gateway_address', 'ssh.port')"
},
- "hosts": "= hosts_file(nodes_like_me[:services => '!monitor'])",
+ "hosts": "= self.environment == 'local' ? hosts_file(nodes_like_me) : hosts_file(nodes[:environment => '!local'])",
"ssh": {
"monitor": {
"username": "= Leap::Platform.monitor_username",
"private_key": "= file(:monitor_priv_key)"
}
+ },
+ "x509": {
+ "use": true,
+ "ca_cert": "= file :ca_cert, :missing => 'provider CA. Run `leap cert ca`'",
+ "client_ca_cert": "= file :client_ca_cert, :missing => 'Certificate Authority. Run `leap cert ca`'",
+ "client_ca_key": "= file :client_ca_key, :missing => 'Certificate Authority. Run `leap cert ca`'",
+ "commercial_cert": "= file [:commercial_cert, domain.full_suffix]",
+ "commercial_key": "= file [:commercial_key, domain.full_suffix]",
+ "commercial_ca_cert": "= try_file :commercial_ca_cert"
}
}
diff --git a/provider_base/services/mx.json b/provider_base/services/mx.json
index 7e3f20ba..731dee9a 100644
--- a/provider_base/services/mx.json
+++ b/provider_base/services/mx.json
@@ -10,7 +10,7 @@
"password": "= secret :couch_leap_mx_password",
"salt": "= hex_secret :couch_leap_mx_password_salt, 128"
},
- "mx_nodes": "= nodes['services' => 'mx']['environment' => '!local'].field('ip_address')",
+ "mynetworks": "= nodes['environment' => '!local'].map{|name, n| [n.ip_address, (global.facts[name]||{})['ec2_public_ipv4']]}.flatten.compact.uniq",
"x509": {
"use": true,
"ca_cert": "= file :ca_cert, :missing => 'provider CA. Run `leap cert ca`'",
diff --git a/provider_base/services/openvpn.json b/provider_base/services/openvpn.json
index 5d77f946..e5b97ed9 100644
--- a/provider_base/services/openvpn.json
+++ b/provider_base/services/openvpn.json
@@ -14,10 +14,15 @@
"filter_dns": false,
"adblock": false,
"user_ips": false,
- "allow_limited": "= global.provider.service.allow_limited_bandwidth",
- "allow_unlimited": "= global.provider.service.allow_unlimited_bandwidth",
- "limited_prefix": "= global.provider.ca.client_certificates.limited_prefix",
- "unlimited_prefix": "= global.provider.ca.client_certificates.unlimited_prefix",
- "rate_limit": "= openvpn.allow_limited ? global.provider.service.bandwidth_limit : nil"
+ "allow_limited": "= provider.service.allow_limited_bandwidth",
+ "allow_unlimited": "= provider.service.allow_unlimited_bandwidth",
+ "limited_prefix": "= provider.ca.client_certificates.limited_prefix",
+ "unlimited_prefix": "= provider.ca.client_certificates.unlimited_prefix",
+ "rate_limit": "= openvpn.allow_limited ? provider.service.bandwidth_limit : nil",
+ "configuration": {
+ "tls-cipher": "TLS-DHE-RSA-WITH-AES-128-CBC-SHA",
+ "auth": "SHA1",
+ "cipher": "AES-128-CBC"
+ }
}
}
diff --git a/provider_base/services/static.json b/provider_base/services/static.json
new file mode 100644
index 00000000..d9155a84
--- /dev/null
+++ b/provider_base/services/static.json
@@ -0,0 +1,6 @@
+{
+ "static": {
+ "formats": "=> (self.static.domains||{}).values.collect{|d| (d.locations||{}).values.collect{|l|l['format']}}.flatten.uniq"
+ },
+ "service_type": "public_service"
+} \ No newline at end of file
diff --git a/provider_base/services/webapp.json b/provider_base/services/webapp.json
index 8974f851..29c0cbf9 100644
--- a/provider_base/services/webapp.json
+++ b/provider_base/services/webapp.json
@@ -8,10 +8,10 @@
"salt": "= hex_secret :couch_webapp_password_salt, 128"
},
"customization_dir": "= file_path 'webapp'",
- "client_certificates": "= global.provider.ca.client_certificates",
- "allow_limited_certs": "= global.provider.service.allow_limited_bandwidth",
- "allow_unlimited_certs": "= global.provider.service.allow_unlimited_bandwidth",
- "allow_anonymous_certs": "= global.provider.service.allow_anonymous",
+ "client_certificates": "= provider.ca.client_certificates",
+ "allow_limited_certs": "= provider.service.allow_limited_bandwidth",
+ "allow_unlimited_certs": "= provider.service.allow_unlimited_bandwidth",
+ "allow_anonymous_certs": "= provider.service.allow_anonymous",
"secret_token": "= secret :webapp_secret_token",
"api_version": 1,
"secure": false,
@@ -19,7 +19,11 @@
"source": "https://leap.se/git/leap_web",
"revision": "origin/master"
},
- "client_version": "= global.provider.client_version"
+ "client_version": "= provider.client_version",
+ "nagios_test_user": {
+ "username": "nagios_test",
+ "password": "= secret :nagios_test_password"
+ }
},
"stunnel": {
"couch_client": "= stunnel_client(nodes_like_me[:services => :couchdb], global.services[:couchdb].couch.port)"
diff --git a/provider_base/tags/development.json b/provider_base/tags/development.json
index 6d4f9e25..d9c2c007 100644
--- a/provider_base/tags/development.json
+++ b/provider_base/tags/development.json
@@ -1,7 +1,7 @@
{
"environment": "development",
"domain": {
- "full_suffix": "= 'dev.' + global.provider.domain",
- "internal_suffix": "= 'dev.' + global.provider.domain_internal"
+ "full_suffix": "= 'dev.' + provider.domain",
+ "internal_suffix": "= 'dev.' + provider.domain_internal"
}
} \ No newline at end of file
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-05 21:06:09 +0000