summaryrefslogtreecommitdiff
path: root/puppet/modules/site_static/manifests
diff options
context:
space:
mode:
Diffstat (limited to 'puppet/modules/site_static/manifests')
-rw-r--r--puppet/modules/site_static/manifests/hidden_service.pp37
-rw-r--r--puppet/modules/site_static/manifests/init.pp20
2 files changed, 48 insertions, 9 deletions
diff --git a/puppet/modules/site_static/manifests/hidden_service.pp b/puppet/modules/site_static/manifests/hidden_service.pp
new file mode 100644
index 00000000..f1f15f8e
--- /dev/null
+++ b/puppet/modules/site_static/manifests/hidden_service.pp
@@ -0,0 +1,37 @@
+# create hidden service for static sites
+class site_static::hidden_service {
+
+ include tor::daemon
+ tor::daemon::hidden_service { 'static': ports => [ '80 127.0.0.1:80'] }
+ file {
+ '/var/lib/tor/webapp/':
+ ensure => directory,
+ owner => 'debian-tor',
+ group => 'debian-tor',
+ mode => '2700';
+
+ '/var/lib/tor/static/private_key':
+ ensure => present,
+ source => "/srv/leap/files/nodes/${::hostname}/tor.key",
+ owner => 'debian-tor',
+ group => 'debian-tor',
+ mode => '0600',
+ notify => Service['tor'];
+
+ '/var/lib/tor/static/hostname':
+ ensure => present,
+ content => "${::site_static::tor_domain}\n",
+ owner => 'debian-tor',
+ group => 'debian-tor',
+ mode => '0600',
+ notify => Service['tor'];
+ }
+
+ # it is necessary to zero out the config of the status module
+ # because we are configuring our own version that is unavailable
+ # over the hidden service (see: #7456 and #7776)
+ apache::module { 'status': ensure => present, conf_content => ' ' }
+
+ include site_shorewall::tor
+}
+
diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp
index 8063d432..4912fbab 100644
--- a/puppet/modules/site_static/manifests/init.pp
+++ b/puppet/modules/site_static/manifests/init.pp
@@ -7,11 +7,14 @@ class site_static {
include site_config::x509::key
include site_config::x509::ca_bundle
- $static = hiera('static')
- $domains = $static['domains']
- $formats = $static['formats']
- $bootstrap = $static['bootstrap_files']
- $tor = hiera('tor', false)
+ $static = hiera('static')
+ $domains = $static['domains']
+ $formats = $static['formats']
+ $bootstrap = $static['bootstrap_files']
+
+ $tor = hiera('tor', false)
+ $hidden_service = $tor['hidden_service']
+ $tor_domain = "${hidden_service['address']}.onion"
file {
'/srv/static/':
@@ -71,15 +74,14 @@ class site_static {
}
}
- create_resources(site_static::domain, $domains)
-
if $tor {
- $hidden_service = $tor['hidden_service']
if $hidden_service['active'] {
- include site_webapp::hidden_service
+ include site_static::hidden_service
}
}
+ create_resources(site_static::domain, $domains)
+
include site_shorewall::defaults
include site_shorewall::service::http
include site_shorewall::service::https