9 files changed, 64 insertions, 14 deletions
diff --git a/provider_base/common.json b/provider_base/common.json
index e968dd27..5821789b 100644
--- a/provider_base/common.json
+++ b/provider_base/common.json
@@ -50,6 +50,14 @@
     "clients": {},
     "servers": {}
   },
+  "firewall": {
+    "ssh": {
+      "from": "sysadmin",
+      "to": "= ip_address",
+      "port": "= ssh.port"
+    },
+    "stunnel": "=> stunnel_firewall"
+  },
   "platform": {
     "version": "= Leap::Platform.version.to_s",
     "major_version": "= Leap::Platform.major_version"
@@ -75,11 +83,6 @@
       "package": "soledad-server",
       "revision": "latest"
     },
-    "tapicero": {
-      "type": "git",
-      "source": "https://leap.se/git/tapicero",
-      "revision": "origin/version/0.7"
-    },
     "webapp": {
       "type": "git",
       "source": "https://leap.se/git/leap_web",
diff --git a/provider_base/services/couchdb.json b/provider_base/services/couchdb.json
index 8b1386f8..5e65b2ec 100644
--- a/provider_base/services/couchdb.json
+++ b/provider_base/services/couchdb.json
@@ -31,11 +31,6 @@
                 "password": "= secret :couch_soledad_password",
                 "salt": "= hex_secret :couch_soledad_password_salt, 128"
             },
-            "tapicero": {
-                "username": "tapicero",
-                "password": "= secret :couch_tapicero_password",
-                "salt": "= hex_secret :couch_tapicero_password_salt, 128"
-            },
             "webapp": {
                 "username": "webapp",
                 "password": "= secret :couch_webapp_password",
diff --git a/provider_base/services/dns.json b/provider_base/services/dns.json
index 677d9b2c..67948ef8 100644
--- a/provider_base/services/dns.json
+++ b/provider_base/services/dns.json
@@ -3,5 +3,12 @@
     "public":  "= nodes['dns.public' => true].fields('domain.name', 'dns.aliases', 'ip_address')",
     "private": "= nodes['dns.public' => false].fields('domain.name', 'dns.aliases', 'ip_address')"
   },
-  "service_type": "public_service"
+  "service_type": "public_service",
+  "firewall": {
+    "dns": {
+      "from": "*",
+      "to": "= ip_address",
+      "port": "53"
+    }
+  }
 }
 \ No newline at end of file
diff --git a/provider_base/services/monitor.json b/provider_base/services/monitor.json
index 10d5ac81..28fb837c 100644
--- a/provider_base/services/monitor.json
+++ b/provider_base/services/monitor.json
@@ -18,5 +18,12 @@
     "ca_cert": "= file :ca_cert, :missing => 'provider CA. Run `leap cert ca`'",
     "client_ca_cert": "= file :client_ca_cert, :missing => 'Certificate Authority. Run `leap cert ca`'",
     "client_ca_key": "= file :client_ca_key, :missing => 'Certificate Authority. Run `leap cert ca`'"
+  },
+  "firewall": {
+    "monitor": {
+      "from": "sysadmin",
+      "to": "= ip_address",
+      "port": [443, 80]
+    }
   }
 }
diff --git a/provider_base/services/mx.json b/provider_base/services/mx.json
index 4d1b3dad..70acf5cb 100644
--- a/provider_base/services/mx.json
+++ b/provider_base/services/mx.json
@@ -24,6 +24,9 @@
   },
   "mynetworks": "= nodes['environment' => '!local'].map{|name, n| [n.ip_address, (global.facts[name]||{})['ec2_public_ipv4']]}.flatten.compact.uniq",
   "rbls": ["zen.spamhaus.org"],
+  "clamav": {
+    "whitelisted_addresses": []
+  },
   "x509": {
     "use": true,
     "use_commercial": true,
@@ -31,5 +34,12 @@
     "client_ca_cert": "= file :client_ca_cert, :missing => 'Certificate Authority. Run `leap cert ca`'",
     "client_ca_key": "= file :client_ca_key, :missing => 'Certificate Authority. Run `leap cert ca`'"
   },
-  "service_type": "user_service"
+  "service_type": "user_service",
+  "firewall": {
+    "mx": {
+      "from": "*",
+      "to": "= ip_address",
+      "port": [25, 465]
+    }
+  }
 }
diff --git a/provider_base/services/openvpn.json b/provider_base/services/openvpn.json
index 11cb0dc2..6f73e31c 100644
--- a/provider_base/services/openvpn.json
+++ b/provider_base/services/openvpn.json
@@ -34,5 +34,12 @@
       "port" : "= rand_range('scramblesuit_port_'+name, 18000..32000)"
     },
     "gateway_address": "= openvpn.gateway_address"
+  },
+  "firewall": {
+    "vpn": {
+      "from": "*",
+      "to": "= openvpn.gateway_address",
+      "port": "= openvpn.ports + [obfsproxy.scramblesuit.port]"
+    }
   }
 }
diff --git a/provider_base/services/soledad.json b/provider_base/services/soledad.json
index ed6fbc9f..76f7155f 100644
--- a/provider_base/services/soledad.json
+++ b/provider_base/services/soledad.json
@@ -8,5 +8,12 @@
       "salt": "= hex_secret :couch_soledad_password_salt, 128"
     }
   },
-  "service_type": "public_service"
+  "service_type": "public_service",
+  "firewall": {
+    "soledad": {
+      "from": "*",
+      "to": "= ip_address",
+      "port": "= soledad.port"
+    }
+  }
 }
diff --git a/provider_base/services/static.json b/provider_base/services/static.json
index d9f52b36..2f408ec1 100644
--- a/provider_base/services/static.json
+++ b/provider_base/services/static.json
@@ -9,5 +9,12 @@
       "client_version": "= static.bootstrap_files.enabled ? provider.client_version : nil"
     }
   },
-  "service_type": "public_service"
+  "service_type": "public_service",
+  "firewall": {
+    "static": {
+      "from": "*",
+      "to": "= ip_address",
+      "port": [80, 443]
+    }
+  }
 }
 \ No newline at end of file
diff --git a/provider_base/services/webapp.json b/provider_base/services/webapp.json
index 039b1c0b..9e3d751b 100644
--- a/provider_base/services/webapp.json
+++ b/provider_base/services/webapp.json
@@ -76,5 +76,12 @@
     "ca_cert": "= file :ca_cert, :missing => 'provider CA. Run `leap cert ca`'",
     "client_ca_cert": "= file :client_ca_cert, :missing => 'Certificate Authority. Run `leap cert ca`.'",
     "client_ca_key": "= file :client_ca_key, :missing => 'Certificate Authority. Run `leap cert ca`.'"
+  },
+  "firewall": {
+    "webapp": {
+      "from": "*",
+      "to": "= ip_address",
+      "port": "= [api.port, 443, 80, nickserver.port]"
+    }
   }
 }