From 8684aa38ece3271a0eb0f8a1751f6c3297025afa Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 28 Jul 2015 14:35:40 -0400 Subject: Support RBL blocking of incoming mail (#5923) Set zen.spamhaus as the default rbl Change-Id: Ic3537d645c80ba42267bab370a1cf77730382158 --- provider_base/services/mx.json | 1 + 1 file changed, 1 insertion(+) (limited to 'provider_base/services') diff --git a/provider_base/services/mx.json b/provider_base/services/mx.json index 11293ae8..db2e4795 100644 --- a/provider_base/services/mx.json +++ b/provider_base/services/mx.json @@ -16,6 +16,7 @@ "salt": "= hex_secret :couch_leap_mx_password_salt, 128" }, "mynetworks": "= nodes['environment' => '!local'].map{|name, n| [n.ip_address, (global.facts[name]||{})['ec2_public_ipv4']]}.flatten.compact.uniq", + "rbls": ["zen.spamhaus.org"], "x509": { "use": true, "use_commercial": true, -- cgit v1.2.3 From 738e77a729813901db8725cacfb15f4150fd49d2 Mon Sep 17 00:00:00 2001 From: elijah Date: Mon, 3 Aug 2015 14:44:24 -0700 Subject: webapp: add support for customizing locales --- provider_base/services/webapp.json | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'provider_base/services') diff --git a/provider_base/services/webapp.json b/provider_base/services/webapp.json index 941f4f61..081b3718 100644 --- a/provider_base/services/webapp.json +++ b/provider_base/services/webapp.json @@ -31,7 +31,9 @@ }, "engines": [ "support" - ] + ], + "locales": "= provider.languages", + "default_locale": "= provider.default_language" }, "stunnel": { "clients": { -- cgit v1.2.3 From 3f1c9f42cd93f6ef099124b33663fd9f288eb430 Mon Sep 17 00:00:00 2001 From: elijah Date: Wed, 19 Aug 2015 17:41:45 -0700 Subject: allow ca_cert_uri to be configured --- provider_base/services/webapp.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'provider_base/services') diff --git a/provider_base/services/webapp.json b/provider_base/services/webapp.json index 081b3718..7b1ca8fb 100644 --- a/provider_base/services/webapp.json +++ b/provider_base/services/webapp.json @@ -55,7 +55,8 @@ "service_type": "public_service", "api": { "domain": "= 'api.' + webapp.domain", - "port": 4430 + "port": 4430, + "ca_cert_uri": "= 'https://' + webapp.domain + '/ca.crt'" }, "nickserver": { "domain": "= 'nicknym.' + domain.full_suffix", -- cgit v1.2.3 From 4f42910a6792ec3016aa6f9d0792801f75972a62 Mon Sep 17 00:00:00 2001 From: elijah Date: Mon, 31 Aug 2015 12:22:20 -0700 Subject: mx: added mx.key_lookup_domain property --- provider_base/services/mx.json | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'provider_base/services') diff --git a/provider_base/services/mx.json b/provider_base/services/mx.json index db2e4795..4d1b3dad 100644 --- a/provider_base/services/mx.json +++ b/provider_base/services/mx.json @@ -1,4 +1,11 @@ { + "mx": { + // provider should define their own custom aliases. + // these are in *addition* to the standard reserved aliases for root and postmaster, etc. + "aliases": {}, + // this is the domain that is used for the OpenPGP header + "key_lookup_domain": "= global.services[:webapp].webapp.domain" + }, "stunnel": { "clients": { "couch_client": "= stunnel_client(nodes_like_me[:services => :couchdb], global.services[:couchdb].couch.port)" -- cgit v1.2.3 From da53a4a723cc05cfa39e066c64a9467d7efad04b Mon Sep 17 00:00:00 2001 From: elijah Date: Thu, 3 Sep 2015 20:18:12 -0700 Subject: service definition .json files should not refer to properties inherited from common.json. closes #7423 --- provider_base/services/webapp.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'provider_base/services') diff --git a/provider_base/services/webapp.json b/provider_base/services/webapp.json index 7b1ca8fb..dbcfe0a6 100644 --- a/provider_base/services/webapp.json +++ b/provider_base/services/webapp.json @@ -9,7 +9,7 @@ "owner", "owners", "postmaster", "reply", "robot", "ssladmin", "staff", "support", "tech-support", "tech_support", "techsupport", "ticket", "tickets", "vmail", "www-data"], - "domain": "= domain.full_suffix", + "domain": "= provider.domain", "modules": ["user", "billing", "help"], "couchdb_webapp_user": "= global.services[:couchdb].couch.users[:webapp]", "couchdb_admin_user": "= global.services[:couchdb].couch.users[:admin]", -- cgit v1.2.3 From f93e6904fe2abca3cfc7a93a08892dbdcea97327 Mon Sep 17 00:00:00 2001 From: elijah Date: Wed, 9 Sep 2015 18:05:19 -0700 Subject: ensure that the webapp has the service levels config it requires. --- provider_base/services/webapp.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'provider_base/services') diff --git a/provider_base/services/webapp.json b/provider_base/services/webapp.json index dbcfe0a6..039b1c0b 100644 --- a/provider_base/services/webapp.json +++ b/provider_base/services/webapp.json @@ -20,7 +20,7 @@ "allow_anonymous_certs": "= provider.service.allow_anonymous", "allow_registration": "= provider.service.allow_registration", "default_service_level": "= provider.service.default_service_level", - "service_levels": "= provider.service.levels", + "service_levels": "= service_levels()", "secret_token": "= secret :webapp_secret_token", "api_version": 1, "secure": false, -- cgit v1.2.3 From 9352ce45a7950ff1175d3a7e5412fc9006691799 Mon Sep 17 00:00:00 2001 From: elijah Date: Fri, 7 Aug 2015 14:22:48 -0700 Subject: added firewall information to nodes (needed for `leap compile firewall`) --- provider_base/services/dns.json | 9 ++++++++- provider_base/services/monitor.json | 7 +++++++ provider_base/services/mx.json | 9 ++++++++- provider_base/services/openvpn.json | 7 +++++++ provider_base/services/soledad.json | 9 ++++++++- provider_base/services/static.json | 9 ++++++++- provider_base/services/webapp.json | 7 +++++++ 7 files changed, 53 insertions(+), 4 deletions(-) (limited to 'provider_base/services') diff --git a/provider_base/services/dns.json b/provider_base/services/dns.json index 677d9b2c..67948ef8 100644 --- a/provider_base/services/dns.json +++ b/provider_base/services/dns.json @@ -3,5 +3,12 @@ "public": "= nodes['dns.public' => true].fields('domain.name', 'dns.aliases', 'ip_address')", "private": "= nodes['dns.public' => false].fields('domain.name', 'dns.aliases', 'ip_address')" }, - "service_type": "public_service" + "service_type": "public_service", + "firewall": { + "dns": { + "from": "*", + "to": "= ip_address", + "port": "53" + } + } } \ No newline at end of file diff --git a/provider_base/services/monitor.json b/provider_base/services/monitor.json index 10d5ac81..28fb837c 100644 --- a/provider_base/services/monitor.json +++ b/provider_base/services/monitor.json @@ -18,5 +18,12 @@ "ca_cert": "= file :ca_cert, :missing => 'provider CA. Run `leap cert ca`'", "client_ca_cert": "= file :client_ca_cert, :missing => 'Certificate Authority. Run `leap cert ca`'", "client_ca_key": "= file :client_ca_key, :missing => 'Certificate Authority. Run `leap cert ca`'" + }, + "firewall": { + "monitor": { + "from": "sysadmin", + "to": "= ip_address", + "port": [443, 80] + } } } diff --git a/provider_base/services/mx.json b/provider_base/services/mx.json index 4d1b3dad..d6e9fff9 100644 --- a/provider_base/services/mx.json +++ b/provider_base/services/mx.json @@ -31,5 +31,12 @@ "client_ca_cert": "= file :client_ca_cert, :missing => 'Certificate Authority. Run `leap cert ca`'", "client_ca_key": "= file :client_ca_key, :missing => 'Certificate Authority. Run `leap cert ca`'" }, - "service_type": "user_service" + "service_type": "user_service", + "firewall": { + "mx": { + "from": "*", + "to": "= ip_address", + "port": [25, 465] + } + } } diff --git a/provider_base/services/openvpn.json b/provider_base/services/openvpn.json index 11cb0dc2..6f73e31c 100644 --- a/provider_base/services/openvpn.json +++ b/provider_base/services/openvpn.json @@ -34,5 +34,12 @@ "port" : "= rand_range('scramblesuit_port_'+name, 18000..32000)" }, "gateway_address": "= openvpn.gateway_address" + }, + "firewall": { + "vpn": { + "from": "*", + "to": "= openvpn.gateway_address", + "port": "= openvpn.ports + [obfsproxy.scramblesuit.port]" + } } } diff --git a/provider_base/services/soledad.json b/provider_base/services/soledad.json index ed6fbc9f..76f7155f 100644 --- a/provider_base/services/soledad.json +++ b/provider_base/services/soledad.json @@ -8,5 +8,12 @@ "salt": "= hex_secret :couch_soledad_password_salt, 128" } }, - "service_type": "public_service" + "service_type": "public_service", + "firewall": { + "soledad": { + "from": "*", + "to": "= ip_address", + "port": "= soledad.port" + } + } } diff --git a/provider_base/services/static.json b/provider_base/services/static.json index d9f52b36..2f408ec1 100644 --- a/provider_base/services/static.json +++ b/provider_base/services/static.json @@ -9,5 +9,12 @@ "client_version": "= static.bootstrap_files.enabled ? provider.client_version : nil" } }, - "service_type": "public_service" + "service_type": "public_service", + "firewall": { + "static": { + "from": "*", + "to": "= ip_address", + "port": [80, 443] + } + } } \ No newline at end of file diff --git a/provider_base/services/webapp.json b/provider_base/services/webapp.json index 039b1c0b..9e3d751b 100644 --- a/provider_base/services/webapp.json +++ b/provider_base/services/webapp.json @@ -76,5 +76,12 @@ "ca_cert": "= file :ca_cert, :missing => 'provider CA. Run `leap cert ca`'", "client_ca_cert": "= file :client_ca_cert, :missing => 'Certificate Authority. Run `leap cert ca`.'", "client_ca_key": "= file :client_ca_key, :missing => 'Certificate Authority. Run `leap cert ca`.'" + }, + "firewall": { + "webapp": { + "from": "*", + "to": "= ip_address", + "port": "= [api.port, 443, 80, nickserver.port]" + } } } -- cgit v1.2.3 From b1e50fc76ddece9944ae253da9bacd485ffea84b Mon Sep 17 00:00:00 2001 From: varac Date: Tue, 6 Oct 2015 13:23:56 +0200 Subject: [feat] Remove tapicero from more places Remove from: - platform white-box tests (couchdb user ACLs, tapicero daemon test) - provider_base/ dir that handles the compilation of the hiera config file - Resolves: #7501 --- provider_base/services/couchdb.json | 5 ----- 1 file changed, 5 deletions(-) (limited to 'provider_base/services') diff --git a/provider_base/services/couchdb.json b/provider_base/services/couchdb.json index 8b1386f8..5e65b2ec 100644 --- a/provider_base/services/couchdb.json +++ b/provider_base/services/couchdb.json @@ -31,11 +31,6 @@ "password": "= secret :couch_soledad_password", "salt": "= hex_secret :couch_soledad_password_salt, 128" }, - "tapicero": { - "username": "tapicero", - "password": "= secret :couch_tapicero_password", - "salt": "= hex_secret :couch_tapicero_password_salt, 128" - }, "webapp": { "username": "webapp", "password": "= secret :couch_webapp_password", -- cgit v1.2.3 From d6b521372243b79105a1513d4559572dfab6db54 Mon Sep 17 00:00:00 2001 From: Micah Date: Tue, 22 Sep 2015 15:04:33 -0400 Subject: add clamav filtering, with sanesecurity signature updating and provider whitelisting (#3625) Change-Id: I15985ca00ee95bc62855f098a78e364ebbc32616 --- provider_base/services/mx.json | 3 +++ 1 file changed, 3 insertions(+) (limited to 'provider_base/services') diff --git a/provider_base/services/mx.json b/provider_base/services/mx.json index d6e9fff9..70acf5cb 100644 --- a/provider_base/services/mx.json +++ b/provider_base/services/mx.json @@ -24,6 +24,9 @@ }, "mynetworks": "= nodes['environment' => '!local'].map{|name, n| [n.ip_address, (global.facts[name]||{})['ec2_public_ipv4']]}.flatten.compact.uniq", "rbls": ["zen.spamhaus.org"], + "clamav": { + "whitelisted_addresses": [] + }, "x509": { "use": true, "use_commercial": true, -- cgit v1.2.3 From 171a5a9a3794224a92244078574aac4b22845266 Mon Sep 17 00:00:00 2001 From: varac Date: Mon, 26 Oct 2015 16:18:17 +0100 Subject: [bug] Add leap_mx username to soledad.conf - Tested: [unstable.pixelated-project.org] - Related: https://github.com/pixelated/pixelated-platform/issues/127 --- provider_base/services/soledad.json | 3 +++ 1 file changed, 3 insertions(+) (limited to 'provider_base/services') diff --git a/provider_base/services/soledad.json b/provider_base/services/soledad.json index 76f7155f..99390d17 100644 --- a/provider_base/services/soledad.json +++ b/provider_base/services/soledad.json @@ -6,6 +6,9 @@ "username": "= global.services[:couchdb].couch.users[:soledad].username", "password": "= secret :couch_soledad_password", "salt": "= hex_secret :couch_soledad_password_salt, 128" + }, + "couchdb_leap_mx_user": { + "username": "= global.services[:couchdb].couch.users[:leap_mx].username" } }, "service_type": "public_service", -- cgit v1.2.3