summaryrefslogtreecommitdiff
path: root/puppet
AgeCommit message (Collapse)Author
2013-04-02start erlang vm on dedicated port so firewalling is easiervarac
2013-04-02fix bigcouch stunnel pid namevarac
2013-04-02provide stunnel connect_port to site_webapp:couchdbvarac
2013-04-02decrease stunnel debug levelvarac
2013-04-02couchdb hosts include site_shorewall::couchdb::bigcouchvarac
2013-04-02added site_shorewall::couchdb::bigcouchvarac
bigcouch cluster protocol communicate via the fqdn of the neighbor hosts. So we need to bend all requests to <fqdn>:4369 to localhost:400x (which is the entry of an stunnel connection to the other neighbor)
2013-04-02added site_shorewall::dnat to configure DNAT rulesvarac
2013-04-02increase stunnel verbosity until everything is running smoothvarac
2013-04-02addded client side of bigcouch cluster protocol stunnel configvarac
2013-04-02make site_stunnel::clients connect_port configurablevarac
2013-04-02added bigcouch.conf as incoming stunnel config for bigcouch clusteringvarac
2013-04-02moving generic stunnel config from site_webapp to site_stunnel now workingvarac
2013-04-02shorewall couchdb config: get open ports rightvarac
2013-04-02moved generic stunnel config from site_webapp to site_stunnelvarac
2013-04-02working on stunnel for bigcouch clusteringvarac
2013-04-01Merge branch 'develop' of ssh://leap.se/leap_platform into developelijah
2013-04-01added setup.ppelijah
2013-03-31automatic update of submodule couchdbMicah Anderson
2013-03-29fixed site_openvpn bug with redefined variable.elijah
2013-03-28added stunnel_serverelijah
2013-03-19add webapp secret token that pulls from hiera a 'secret'Micah Anderson
2013-03-19cp instead of mv for the couchdb configuration fileMicah Anderson
if we move, then we need to re-create the file on the next deploy
2013-03-19create a separate couchdb.yml.admin that contains the couchdb admin ↵Micah Anderson
privileges, putting the unprivileged ones in as user webapp in couchdb.yml. This allows us to migrate the couchdb design docs on deployment, but use an unprivileged user the remainder of the time
2013-03-19fix spelling of 'command' parameterMicah Anderson
2013-03-19fix missing closing curly braceMicah Anderson
2013-03-19configure webapp haproxy couchdb connectionMicah Anderson
2013-03-19configure site_webapp::haproxy to ship a haproxy config::fragment to setup theMicah Anderson
haproxy listener 'bigcouch-in'. This haproxy listener is configured to listen on port 4096 (arbitrarily chosen) and balance across the locally configured stunnels to the bigcouch instances It may be that we will need some additional haproxy options for handling persistence, cookies, or other HTTP headers, I'm unsure as of this moment
2013-03-19add some generic haproxy defaultsMicah Anderson
2013-03-19add haproxy submoduleMicah Anderson
2013-03-19Migrate the couchdb design documents during webapp deploy (#1976)Micah Anderson
2013-03-19turn off automatic updates of couchdb design docs (#1979)Micah Anderson
2013-03-18Webapp: Use stunnel localhost:5000 for couchdb connectionvarac
2013-03-17fix webapp/couchdb stunnel certificate authorityMicah Anderson
2013-03-17added support for "limited" service levels (although vpn is not yet actually ↵elijah
rate limited).
2013-03-16Merge branch 'stunnel_switch' into developvarac
2013-03-16pick the first couchdb host for webapp couch configvarac
Until we have a proper load balancing setup (see https://leap.se/code/issues/1994)
2013-03-15automatic update of submodule couchdbvarac
2013-03-15automatic update of submodule aptvarac
2013-03-15automatic update of submodule couchdbvarac
2013-03-14add couchdb stunnel clientsMicah Anderson
2013-03-14add couchdb stunnel serverMicah Anderson
2013-03-14add a basic site_stunnel that takes care of some generic functionality that ↵Micah Anderson
all stunnel client/servers will need handled (at least in debian and ubuntu)
2013-03-14remove apache ssl proxy in preparation of replacing it with a stunnel setupMicah Anderson
This presents us with an interesting problem of deprecation. We need to manage the removal of something that we previously installed in any released code. How long we carry the puppet code that removes raises some interesting questions: do we require that someone who deployed version 1 (where the apache ssl proxy was deployed) of the platform upgrade first to version 2 (where we remove the apache ssl proxy) before they upgrade to version 3 (where the apache ssl proxy removal is no longer present) -- or do we allow people to skip versions?
2013-03-14add shared stunnel moduleMicah Anderson
2013-03-14automatic update of submodule aptvarac
2013-03-14automatic update of submodule aptvarac
2013-03-14include cloudant package repo for bigcouch servervarac
2013-03-14pass template() to aptvarac
2013-03-14added apt preferences template that includes squeezevarac
2013-03-14evalute $services before including site_config::*varac