diff options
Diffstat (limited to 'puppet/modules/site_static/manifests')
| -rw-r--r-- | puppet/modules/site_static/manifests/domain.pp | 1 | ||||
| -rw-r--r-- | puppet/modules/site_static/manifests/hidden_service.pp | 37 | ||||
| -rw-r--r-- | puppet/modules/site_static/manifests/init.pp | 51 |
3 files changed, 75 insertions, 14 deletions
diff --git a/puppet/modules/site_static/manifests/domain.pp b/puppet/modules/site_static/manifests/domain.pp index b26cc9e3..6cf2c653 100644 --- a/puppet/modules/site_static/manifests/domain.pp +++ b/puppet/modules/site_static/manifests/domain.pp @@ -4,6 +4,7 @@ define site_static::domain ( $key, $cert, $tls_only=true, + $use_hidden_service=false, $locations=undef, $aliases=undef, $apache_config=undef) { diff --git a/puppet/modules/site_static/manifests/hidden_service.pp b/puppet/modules/site_static/manifests/hidden_service.pp new file mode 100644 index 00000000..f1f15f8e --- /dev/null +++ b/puppet/modules/site_static/manifests/hidden_service.pp @@ -0,0 +1,37 @@ +# create hidden service for static sites +class site_static::hidden_service { + + include tor::daemon + tor::daemon::hidden_service { 'static': ports => [ '80 127.0.0.1:80'] } + file { + '/var/lib/tor/webapp/': + ensure => directory, + owner => 'debian-tor', + group => 'debian-tor', + mode => '2700'; + + '/var/lib/tor/static/private_key': + ensure => present, + source => "/srv/leap/files/nodes/${::hostname}/tor.key", + owner => 'debian-tor', + group => 'debian-tor', + mode => '0600', + notify => Service['tor']; + + '/var/lib/tor/static/hostname': + ensure => present, + content => "${::site_static::tor_domain}\n", + owner => 'debian-tor', + group => 'debian-tor', + mode => '0600', + notify => Service['tor']; + } + + # it is necessary to zero out the config of the status module + # because we are configuring our own version that is unavailable + # over the hidden service (see: #7456 and #7776) + apache::module { 'status': ensure => present, conf_content => ' ' } + + include site_shorewall::tor +} + diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp index 4a722d62..dd3f912d 100644 --- a/puppet/modules/site_static/manifests/init.pp +++ b/puppet/modules/site_static/manifests/init.pp @@ -7,26 +7,40 @@ class site_static { include site_config::x509::key include site_config::x509::ca_bundle - $static = hiera('static') - $domains = $static['domains'] - $formats = $static['formats'] - $bootstrap = $static['bootstrap_files'] - $tor = hiera('tor', false) + $static = hiera('static') + $domains = $static['domains'] + $formats = $static['formats'] + $bootstrap = $static['bootstrap_files'] + $tor = hiera('tor', false) + + file { + '/srv/static/': + ensure => 'directory', + owner => 'root', + group => 'root', + mode => '0744'; + '/srv/static/public': + ensure => 'directory', + owner => 'root', + group => 'root', + mode => '0744'; + } if $bootstrap['enabled'] { $bootstrap_domain = $bootstrap['domain'] $bootstrap_client = $bootstrap['client_version'] - file { '/srv/leap/provider.json': + file { '/srv/static/public/provider.json': content => $bootstrap['provider_json'], owner => 'www-data', group => 'www-data', - mode => '0444'; + mode => '0444', + notify => Service[apache]; } # It is important to always touch provider.json: the client needs to check x-min-client-version header, # but this is only sent when the file has been modified (otherwise 304 is sent by apache). The problem # is that changing min client version won't alter the content of provider.json, so we must touch it. - exec { '/bin/touch /srv/leap/provider.json': - require => File['/srv/leap/provider.json']; + exec { '/bin/touch /srv/static/public/provider.json': + require => File['/srv/static/public/provider.json']; } } @@ -42,8 +56,8 @@ class site_static { if (member($formats, 'rack')) { include site_apt::preferences::passenger class { 'passenger': - use_munin => false, - require => Class['site_apt::preferences::passenger'] + manage_munin => false, + require => Class['site_apt::preferences::passenger'] } } @@ -57,15 +71,24 @@ class site_static { } } - create_resources(site_static::domain, $domains) - if $tor { $hidden_service = $tor['hidden_service'] + $tor_domain = "${hidden_service['address']}.onion" if $hidden_service['active'] { - include site_webapp::hidden_service + include site_static::hidden_service + } + # Currently, we only support a single hidden service address per server. + # So if there is more than one domain configured, then we need to make sure + # we don't enable the hidden service for every domain. + if size(keys($domains)) == 1 { + $always_use_hidden_service = true + } else { + $always_use_hidden_service = false } } + create_resources(site_static::domain, $domains) + include site_shorewall::defaults include site_shorewall::service::http include site_shorewall::service::https |