From e0354eda8f1dba999c452caf99c40dcb6f7af33e Mon Sep 17 00:00:00 2001 From: varac Date: Tue, 19 Mar 2013 08:57:35 +0100 Subject: working on stunnel for bigcouch clustering --- puppet/modules/site_shorewall/manifests/couchdb.pp | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) (limited to 'puppet/modules/site_shorewall/manifests/couchdb.pp') diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp index 9fa59569..5fa1861b 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb.pp @@ -3,10 +3,13 @@ class site_shorewall::couchdb { include site_shorewall::defaults $couchdb_port = '6984' + # Erlang Port Mapper daemon, used for communication between + # bigcouch cluster nodes + $portmapper_port = '5369' # define macro for incoming services file { '/etc/shorewall/macro.leap_couchdb': - content => "PARAM - - tcp $couchdb_port", + content => "PARAM - - tcp $couchdb_port $portmapper_port", notify => Service['shorewall'], require => Package['shorewall'] } @@ -20,4 +23,15 @@ class site_shorewall::couchdb { order => 200; } + shorewall::rule { + 'dnat-bigcouch-clustering-to-stunnel': + destination => "net:${::ipaddress}:8080", + destinationport => $portmapper_port, + source => '$FW', + proto => 'tcp', + order => 200, + action => 'DNAT'; + } + + } -- cgit v1.2.3 From 4b2aa1020d07d0ab25f907fbc6c76a3d78a6a84e Mon Sep 17 00:00:00 2001 From: varac Date: Tue, 19 Mar 2013 15:11:54 +0100 Subject: shorewall couchdb config: get open ports right --- puppet/modules/site_shorewall/manifests/couchdb.pp | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests/couchdb.pp') diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp index 5fa1861b..f1784a38 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb.pp @@ -9,7 +9,7 @@ class site_shorewall::couchdb { # define macro for incoming services file { '/etc/shorewall/macro.leap_couchdb': - content => "PARAM - - tcp $couchdb_port $portmapper_port", + content => "PARAM - - tcp ${couchdb_port},${portmapper_port}", notify => Service['shorewall'], require => Package['shorewall'] } @@ -23,15 +23,15 @@ class site_shorewall::couchdb { order => 200; } - shorewall::rule { - 'dnat-bigcouch-clustering-to-stunnel': - destination => "net:${::ipaddress}:8080", - destinationport => $portmapper_port, - source => '$FW', - proto => 'tcp', - order => 200, - action => 'DNAT'; - } + #shorewall::rule { + # 'dnat-bigcouch-clustering-to-stunnel': + # destination => "net:${::ipaddress}:8080", + # destinationport => $portmapper_port, + # source => '$FW', + # proto => 'tcp', + # order => 200, + # action => 'DNAT'; + #} } -- cgit v1.2.3 From 40f32a207957293dd7c9a85df3bcccd340e16522 Mon Sep 17 00:00:00 2001 From: varac Date: Wed, 20 Mar 2013 22:02:55 +0100 Subject: added site_shorewall::couchdb::bigcouch bigcouch cluster protocol communicate via the fqdn of the neighbor hosts. So we need to bend all requests to :4369 to localhost:400x (which is the entry of an stunnel connection to the other neighbor) --- puppet/modules/site_shorewall/manifests/couchdb.pp | 11 ----------- 1 file changed, 11 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests/couchdb.pp') diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp index f1784a38..a448dd42 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb.pp @@ -23,15 +23,4 @@ class site_shorewall::couchdb { order => 200; } - #shorewall::rule { - # 'dnat-bigcouch-clustering-to-stunnel': - # destination => "net:${::ipaddress}:8080", - # destinationport => $portmapper_port, - # source => '$FW', - # proto => 'tcp', - # order => 200, - # action => 'DNAT'; - #} - - } -- cgit v1.2.3 From eac4d82da1675d839fcdc2360df5929e41322c2d Mon Sep 17 00:00:00 2001 From: varac Date: Thu, 21 Mar 2013 14:03:07 +0100 Subject: start erlang vm on dedicated port so firewalling is easier --- puppet/modules/site_shorewall/manifests/couchdb.pp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'puppet/modules/site_shorewall/manifests/couchdb.pp') diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp index a448dd42..04b608e2 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb.pp @@ -7,9 +7,12 @@ class site_shorewall::couchdb { # bigcouch cluster nodes $portmapper_port = '5369' + # see http://stackoverflow.com/questions/8459949/bigcouch-cluster-connection-issue#comment10467603_8463814 + $erlang_vm_port = '9001' + # define macro for incoming services file { '/etc/shorewall/macro.leap_couchdb': - content => "PARAM - - tcp ${couchdb_port},${portmapper_port}", + content => "PARAM - - tcp ${couchdb_port},${portmapper_port},${erlang_vm_port}", notify => Service['shorewall'], require => Package['shorewall'] } -- cgit v1.2.3 From 8b75721b7941c8ab6b7dc05101e80a121dcb0849 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Sun, 31 Mar 2013 12:09:45 -0400 Subject: shorewall: add couch_server stunnel port to macro.leap_couchdb, this is necessary for the stunnel to communicate --- puppet/modules/site_shorewall/manifests/couchdb.pp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests/couchdb.pp') diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp index 04b608e2..6a8c2cf2 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb.pp @@ -2,7 +2,10 @@ class site_shorewall::couchdb { include site_shorewall::defaults - $couchdb_port = '6984' + $stunnel = hiera('stunnel') + $couch_server = $stunnel['couch_server'] + $couch_stunnel_port = $couch_server['accept'] + # Erlang Port Mapper daemon, used for communication between # bigcouch cluster nodes $portmapper_port = '5369' @@ -12,12 +15,11 @@ class site_shorewall::couchdb { # define macro for incoming services file { '/etc/shorewall/macro.leap_couchdb': - content => "PARAM - - tcp ${couchdb_port},${portmapper_port},${erlang_vm_port}", + content => "PARAM - - tcp ${couch_stunnel_port},${portmapper_port},${erlang_vm_port}", notify => Service['shorewall'], require => Package['shorewall'] } - shorewall::rule { 'net2fw-couchdb': source => 'net', -- cgit v1.2.3 From ee1555bd9091e1ffe66e54856d2bde72d50a7e60 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 2 Apr 2013 16:55:12 -0400 Subject: firewall: remove no longer needed epmd port --- puppet/modules/site_shorewall/manifests/couchdb.pp | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests/couchdb.pp') diff --git a/puppet/modules/site_shorewall/manifests/couchdb.pp b/puppet/modules/site_shorewall/manifests/couchdb.pp index 6a8c2cf2..1ef91bb0 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb.pp @@ -6,16 +6,12 @@ class site_shorewall::couchdb { $couch_server = $stunnel['couch_server'] $couch_stunnel_port = $couch_server['accept'] - # Erlang Port Mapper daemon, used for communication between - # bigcouch cluster nodes - $portmapper_port = '5369' - # see http://stackoverflow.com/questions/8459949/bigcouch-cluster-connection-issue#comment10467603_8463814 $erlang_vm_port = '9001' # define macro for incoming services file { '/etc/shorewall/macro.leap_couchdb': - content => "PARAM - - tcp ${couch_stunnel_port},${portmapper_port},${erlang_vm_port}", + content => "PARAM - - tcp ${couch_stunnel_port},${erlang_vm_port}", notify => Service['shorewall'], require => Package['shorewall'] } -- cgit v1.2.3