From 40f32a207957293dd7c9a85df3bcccd340e16522 Mon Sep 17 00:00:00 2001 From: varac Date: Wed, 20 Mar 2013 22:02:55 +0100 Subject: added site_shorewall::couchdb::bigcouch bigcouch cluster protocol communicate via the fqdn of the neighbor hosts. So we need to bend all requests to :4369 to localhost:400x (which is the entry of an stunnel connection to the other neighbor) --- puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp (limited to 'puppet/modules/site_shorewall/manifests/couchdb') diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp new file mode 100644 index 00000000..f96ef87b --- /dev/null +++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp @@ -0,0 +1,7 @@ +class site_shorewall::couchdb::bigcouch inherits site_shorewall::couchdb { + + include site_shorewall::defaults + + create_resources(site_shorewall::dnat, hiera('shorewall_dnat')) + +} -- cgit v1.2.3 From fa65ec5b35433ecc643aa240db4c42e60dac6af9 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Sun, 31 Mar 2013 12:16:54 -0400 Subject: remove unnecessary class inheritance --- puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'puppet/modules/site_shorewall/manifests/couchdb') diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp index f96ef87b..2afdea87 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp @@ -1,4 +1,4 @@ -class site_shorewall::couchdb::bigcouch inherits site_shorewall::couchdb { +class site_shorewall::couchdb::bigcouch { include site_shorewall::defaults -- cgit v1.2.3 From 128c8ddfd4969a9b9b525cb4f4a34b1e98c2fe76 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Sun, 31 Mar 2013 12:39:36 -0400 Subject: shorewall: create a macro for the bigcouch replication server stunnel to enable these connections pulling bigcouch_replication_clients, bigcouch_replication_server_port from hiera create site_shorewall::couchdb::dnat and create_resources to properly setup DNAT for bigcouch_replication_clients --- .../site_shorewall/manifests/couchdb/bigcouch.pp | 30 +++++++++++++++++++++- .../site_shorewall/manifests/couchdb/dnat.pp | 21 +++++++++++++++ 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 puppet/modules/site_shorewall/manifests/couchdb/dnat.pp (limited to 'puppet/modules/site_shorewall/manifests/couchdb') diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp index 2afdea87..a0d63d15 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp @@ -2,6 +2,34 @@ class site_shorewall::couchdb::bigcouch { include site_shorewall::defaults - create_resources(site_shorewall::dnat, hiera('shorewall_dnat')) + $stunnel = hiera('stunnel') + $bigcouch_replication_clients = $stunnel['bigcouch_replication_clients'] + + $bigcouch_replication_server = $stunnel['bigcouch_replication_server'] + $bigcouch_replication_server_port = $bigcouch_replication_server['accept'] + + # define macro for incoming services + file { '/etc/shorewall/macro.leap_bigcouch': + content => "PARAM - - tcp ${bigcouch_replication_server_port}", + notify => Service['shorewall'], + require => Package['shorewall'] + } + + shorewall::rule { + 'net2fw-bigcouch': + source => 'net', + destination => '$FW', + action => 'leap_bigcouch(ACCEPT)', + order => 300; + } + + $bigcouch_shorewall_dnat_defaults = { + 'source' => '$FW', + 'proto' => 'tcp', + 'destinationport' => '4369', + } + + create_resources(site_shorewall::couchdb::dnat, $bigcouch_replication_clients, $bigcouch_shorewall_dnat_defaults) } + diff --git a/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp new file mode 100644 index 00000000..85cea9d5 --- /dev/null +++ b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp @@ -0,0 +1,21 @@ +define site_shorewall::couchdb::dnat ( + $source, + $connect, + $connect_port, + $accept_port, + $proto, + $destinationport ) +{ + + + shorewall::rule { + "dnat_${name}_${destinationport}": + source => $source, + destination => "\$FW:127.0.0.1:${accept_port}", + destinationport => $destinationport, + originaldest => $connect, + proto => $proto, + order => 200, + action => 'DNAT'; + } +} -- cgit v1.2.3 From 0227e03513f38cfae4a041ba6740b425fdc21198 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 2 Apr 2013 17:09:22 -0400 Subject: replace hard-coded port number with hiera determined one, manipulated to remove the 'ip:' from the beginning in bigcouch replication client stunnels --- puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'puppet/modules/site_shorewall/manifests/couchdb') diff --git a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp index a0d63d15..85272657 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb/bigcouch.pp @@ -7,6 +7,7 @@ class site_shorewall::couchdb::bigcouch { $bigcouch_replication_server = $stunnel['bigcouch_replication_server'] $bigcouch_replication_server_port = $bigcouch_replication_server['accept'] + $bigcouch_replication_connect = $bigcouch_replication_server['connect'] # define macro for incoming services file { '/etc/shorewall/macro.leap_bigcouch': @@ -26,7 +27,7 @@ class site_shorewall::couchdb::bigcouch { $bigcouch_shorewall_dnat_defaults = { 'source' => '$FW', 'proto' => 'tcp', - 'destinationport' => '4369', + 'destinationport' => regsubst($bigcouch_replication_connect, '^([0-9.]+:)([0-9]+)$', '\2') } create_resources(site_shorewall::couchdb::dnat, $bigcouch_replication_clients, $bigcouch_shorewall_dnat_defaults) -- cgit v1.2.3 From 1750bec7032e90ddbe43da35eb5f49066187d1d4 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 2 Apr 2013 17:43:43 -0400 Subject: shorewall: re-order dnat rule variables to match configuration file order --- puppet/modules/site_shorewall/manifests/couchdb/dnat.pp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'puppet/modules/site_shorewall/manifests/couchdb') diff --git a/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp index 85cea9d5..f1bc9acf 100644 --- a/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp +++ b/puppet/modules/site_shorewall/manifests/couchdb/dnat.pp @@ -10,12 +10,12 @@ define site_shorewall::couchdb::dnat ( shorewall::rule { "dnat_${name}_${destinationport}": + action => 'DNAT', source => $source, destination => "\$FW:127.0.0.1:${accept_port}", + proto => $proto, destinationport => $destinationport, originaldest => $connect, - proto => $proto, - order => 200, - action => 'DNAT'; + order => 200 } } -- cgit v1.2.3