summaryrefslogtreecommitdiff
path: root/puppet/modules/site_shorewall
AgeCommit message (Collapse)Author
2013-08-31postfix enable submission port using starttls, so the client can transition ↵Micah Anderson
to the more restrictive TLS wrapper mode Change-Id: I2a1728788378d9a1b79155ddb9bb4b0464b16baa
2013-08-29Make TLS-required smtps (465) be port for sending SMTP. This is preferred ↵Micah Anderson
over 25 because that is typically blocked, and we cannot force TLS on that port due to other MTAs not being configured for this century. We don't use submission (568) because that uses STARTTLS, and the STARTTLS banner can easily be stripped by an adversary. (#3604) . enable smtps (port 465) for client submission over TLS, and require that TLS is enabled . add 465 to the allowed open ports in the firewall . change the smtp-service.json to use 465 instead of 25 note: I did not use the 'use_smtps' parameter that is available in the postfix class because it added some options that we do not want/need. Change-Id: I0040eb2dff6008a1c830d59df9963eb83dc9ea02
2013-08-22install a preliminary firewall that blocks everything, except ssh for the ↵Micah Anderson
cases when shorewall doesn't properly come up, ensuring that it fails safe (#3339) Change-Id: Id4f0bf6cf25f420aa2ad67635b37ae95f54e3d38
2013-08-01make site_shorewall::soledad use the hiera value for the soledad portMicah Anderson
Change-Id: I923f15de807f907d6246c3a83df1e59c39d4e920
2013-07-26Merge branch 'feature/soledad' into feature/leap_mxMicah Anderson
2013-07-25initial soledad configurationMicah Anderson
Change-Id: I19e91887c3f8e90764b4baef8c5e29e25658e190
2013-07-25shorewall rules for site_mxvarac
2013-06-12webapp should be available over http so a proper redirect can be done to httpsMicah Anderson
without this rule, one just gets a 'site is unavailable' result Change-Id: I27b80a0044e9fe4e87e607412c8d0a089d4866a6
2013-05-16special casing for pistoncloud/openstack/ec2Micah Anderson
2013-05-02fixed dnat_ruleselijah
2013-04-30minor spacing changesMicah Anderson
2013-04-30setup a site_config::params class that can be used to set some common ↵Micah Anderson
variables that are used in different places to start with we setup the $interface variable, based on logic as defined in #2213 change the various places that were looking up this value to use site_config::params::interface instead
2013-04-04add Erlang Distributed Node Protocol Port json entry under bigcouchMicah Anderson
setup ednp_server and ednp_client stunnels update couchdb puppet submodule to support configurable ednp_port parameter and general module cleanup pass ednp_port to couchdb setup so that it is configured in the vm.args template clarify in comments the difference between the epmd and ednp ports remove hard-coded erlang_vm_port variable and instead setup shorewall to allow for the stunnel connection only setup dnat rules for the ednp client connections
2013-04-04rename bigcouch.port to more accurate bigcouch.epmd_portMicah Anderson
2013-04-02shorewall: re-order dnat rule variables to match configuration file orderMicah Anderson
2013-04-02replace hard-coded port number with hiera determined one, manipulated to ↵Micah Anderson
remove the 'ip:' from the beginning in bigcouch replication client stunnels
2013-04-02firewall: remove no longer needed epmd portMicah Anderson
2013-04-02shorewall:Micah Anderson
create a macro for the bigcouch replication server stunnel to enable these connections pulling bigcouch_replication_clients, bigcouch_replication_server_port from hiera create site_shorewall::couchdb::dnat and create_resources to properly setup DNAT for bigcouch_replication_clients
2013-04-02remove unnecessary class inheritanceMicah Anderson
2013-04-02shorewall: add couch_server stunnel port to macro.leap_couchdb, this is ↵Micah Anderson
necessary for the stunnel to communicate
2013-04-02start erlang vm on dedicated port so firewalling is easiervarac
2013-04-02added site_shorewall::couchdb::bigcouchvarac
bigcouch cluster protocol communicate via the fqdn of the neighbor hosts. So we need to bend all requests to <fqdn>:4369 to localhost:400x (which is the entry of an stunnel connection to the other neighbor)
2013-04-02added site_shorewall::dnat to configure DNAT rulesvarac
2013-04-02shorewall couchdb config: get open ports rightvarac
2013-04-02working on stunnel for bigcouch clusteringvarac
2013-03-17added support for "limited" service levels (although vpn is not yet actually ↵elijah
rate limited).
2013-02-27openvpn -- added support for optional "free" rate-limited service via ↵elijah
special client certificates with the FREE prefix in the common name.
2013-02-26missed another require => Package['shorewall'] on the file resources in ↵Micah Anderson
site_shorewall
2013-02-12missed one require => Package['shorewall'] on of the file resources in ↵Micah Anderson
site_shorewall
2013-02-12file resources that make changes to shorewall need to make sure that ↵Micah Anderson
shorewall is installed first (#1741)
2013-02-12fixed shorewall is blocking api port (Bug #1735)varac
2013-02-11duplicate shortwall service definitions now inclduded from services/*varac
2013-02-09site_shorewall::monitor: allow port 80 + 443varac
2013-02-06allow outgoing traffic moved to site_shorewall::defaultsvarac
2013-02-06allow port 80 to tor servervarac
2013-02-06configure shorewall for couchdb, tor, webappvarac
2013-02-06allow all outgoing trafficvarac
2013-02-06Restructuring site_shorewallvarac
site_shorewall::defaults can be used on every host, it configures a basic firewall, which blocks everything from outside except ping + ssh, and allows outgoing traffic for http, git, dns.
2013-01-30start shorewall on vagrant nodes too (#1467)varac
2013-01-29fix variable name for re-ordered factMicah Anderson
2013-01-29setup special casing for vagrant/virtualboxMicah Anderson
2013-01-29fix variable scopingMicah Anderson
2013-01-29create a special case for vagrant machines that need to have both interfaces inMicah Anderson
the net zone so we dont lock ourselves out during deploy, but also are able to access the internet
2013-01-29enclose the variables in curly braces, as recommended by puppet-lintMicah Anderson
2013-01-29add a new fact that provides a fact for each configured ip address, telling youMicah Anderson
which interface has it (essentially the inverse of the ipaddress_${interface} fact). Switch the hiera lookups of the $interface, which was pulling from the .json to pull instead from the above fact, see #1547 and #1548
2013-01-29start shorewall on deploy (fixes #1122)varac
2013-01-17require the augeas class before doing any augeas operations (#1215)Micah Anderson
2012-12-14no need for sections in shorewall rulesvarac
from the shorewall-rules manpage: "If no Section Headers appear in the file then all rules are assumed to be in the NEW section."
2012-12-04set ip_forwarding using augeasMicah Anderson
2012-11-21move site_config::eip to site_openvpn (Feature #943)varac