2 files changed, 52 insertions, 0 deletions
diff --git a/puppet/modules/site_tor/manifests/disable_exit.pp b/puppet/modules/site_tor/manifests/disable_exit.pp
new file mode 100644
index 00000000..078f80ae
--- /dev/null
+++ b/puppet/modules/site_tor/manifests/disable_exit.pp
@@ -0,0 +1,7 @@
+class site_tor::disable_exit {
+  tor::daemon::exit_policy {
+    'no_exit_at_all':
+      reject => [ '*:*' ];
+  }
+}
+
diff --git a/puppet/modules/site_tor/manifests/init.pp b/puppet/modules/site_tor/manifests/init.pp
new file mode 100644
index 00000000..2207a5a9
--- /dev/null
+++ b/puppet/modules/site_tor/manifests/init.pp
@@ -0,0 +1,45 @@
+class site_tor {
+  tag 'leap_service'
+  Class['site_config::default'] -> Class['site_tor']
+
+  $tor            = hiera('tor')
+  $bandwidth_rate = $tor['bandwidth_rate']
+  $tor_type       = $tor['type']
+  $nickname       = $tor['nickname']
+  $contact_emails = join($tor['contacts'],', ')
+  $family         = $tor['family']
+
+  $address        = hiera('ip_address')
+
+  $openvpn        = hiera('openvpn', undef)
+  if $openvpn {
+    $openvpn_ports = $openvpn['ports']
+  }
+  else {
+    $openvpn_ports = []
+  }
+
+  include site_config::default
+  include tor::daemon
+  tor::daemon::relay { $nickname:
+    port           => 9001,
+    address        => $address,
+    contact_info   => obfuscate_email($contact_emails),
+    bandwidth_rate => $bandwidth_rate,
+    my_family      => $family
+  }
+
+  if ( $tor_type == 'exit'){
+    # Only enable the daemon directory if the node isn't also a webapp node
+    # or running openvpn on port 80
+    if ! member($::services, 'webapp') and ! member($openvpn_ports, '80') {
+      tor::daemon::directory { $::hostname: port => 80 }
+    }
+  }
+  else {
+    include site_tor::disable_exit
+  }
+
+  include site_shorewall::tor
+
+}